From: Sasha Levin Date: Fri, 6 Dec 2019 21:13:25 +0000 (-0500) Subject: fixes for 4.19 X-Git-Tag: v5.4.3~79 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a15fce607ac826b56ebe798dd10c427afa8ae423;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch b/queue-4.19/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch new file mode 100644 index 00000000000..f9f66c330ab --- /dev/null +++ b/queue-4.19/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch @@ -0,0 +1,36 @@ +From b1ba90684179f3b25165da9b458d5e24bf73e34b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Nov 2018 23:07:14 +0300 +Subject: ACPI: fix acpi_find_child_device() invocation in + acpi_preset_companion() + +From: Alexey Dobriyan + +[ Upstream commit f8c6d1402b89f22a3647705d63cbd171aa19a77e ] + +acpi_find_child_device() accepts boolean not pointer as last argument. + +Signed-off-by: Alexey Dobriyan +[ rjw: Subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/acpi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 59a416dfcaaa2..df1252e22dcfd 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -101,7 +101,7 @@ static inline bool has_acpi_companion(struct device *dev) + static inline void acpi_preset_companion(struct device *dev, + struct acpi_device *parent, u64 addr) + { +- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL)); ++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false)); + } + + static inline const char *acpi_dev_name(struct acpi_device *adev) +-- +2.20.1 + diff --git a/queue-4.19/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch b/queue-4.19/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch new file mode 100644 index 00000000000..2f2b735ef06 --- /dev/null +++ b/queue-4.19/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch @@ -0,0 +1,53 @@ +From 7c2fb5c105e9e18e7f86c9577444970d7062524f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 01:17:14 +0800 +Subject: ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() + +From: paulhsia + +[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ] + +If the nullity check for `substream->runtime` is outside of the lock +region, it is possible to have a null runtime in the critical section +if snd_pcm_detach_substream is called right before the lock. + +Signed-off-by: paulhsia +Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_lib.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 4e6110d778bd2..ad52126d3d22e 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1797,11 +1797,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + unsigned long flags; + +- if (PCM_RUNTIME_CHECK(substream)) ++ if (snd_BUG_ON(!substream)) + return; +- runtime = substream->runtime; + + snd_pcm_stream_lock_irqsave(substream, flags); ++ if (PCM_RUNTIME_CHECK(substream)) ++ goto _unlock; ++ runtime = substream->runtime; ++ + if (!snd_pcm_running(substream) || + snd_pcm_update_hw_ptr0(substream, 1) < 0) + goto _end; +@@ -1812,6 +1815,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + #endif + _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ _unlock: + snd_pcm_stream_unlock_irqrestore(substream, flags); + } + EXPORT_SYMBOL(snd_pcm_period_elapsed); +-- +2.20.1 + diff --git a/queue-4.19/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch b/queue-4.19/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch new file mode 100644 index 00000000000..3b8facb3ecc --- /dev/null +++ b/queue-4.19/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch @@ -0,0 +1,41 @@ +From d5640e5a1f74a4c2178c5cb2b62aa3dff19eccc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Nov 2018 12:34:10 +0000 +Subject: altera-stapl: check for a null key before strcasecmp'ing it + +From: Colin Ian King + +[ Upstream commit 9ccb645683ef46e3c52c12c088a368baa58447d4 ] + +Currently the null check on key is occurring after the strcasecmp on +the key, hence there is a potential null pointer dereference on key. +Fix this by checking if key is null first. Also replace the == 0 +check on strcasecmp with just the ! operator. + +Detected by CoverityScan, CID#1248787 ("Dereference before null check") + +Fixes: fa766c9be58b ("[media] Altera FPGA firmware download module") +Signed-off-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/altera-stapl/altera.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index ef83a9078646f..d2ed3b9728b7c 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size, + key_ptr = &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])]; +- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) && +- (key != NULL)) { ++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) { + status = 0; + + value_ptr = &p[note_strings + +-- +2.20.1 + diff --git a/queue-4.19/arc-ioc-panic-if-kernel-was-started-with-previously-.patch b/queue-4.19/arc-ioc-panic-if-kernel-was-started-with-previously-.patch new file mode 100644 index 00000000000..4ef152cc2c3 --- /dev/null +++ b/queue-4.19/arc-ioc-panic-if-kernel-was-started-with-previously-.patch @@ -0,0 +1,94 @@ +From 0ecee61df124810670bf289000532f74d3ab1f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 16:12:12 +0300 +Subject: ARC: IOC: panic if kernel was started with previously enabled IOC + +From: Eugeniy Paltsev + +[ Upstream commit 3624379d90ad2b65f9dbb30d7f7ce5498d2fe322 ] + +If IOC was already enabled (due to bootloader) it technically needs to +be reconfigured with aperture base,size corresponding to Linux memory map +which will certainly be different than uboot's. But disabling and +reenabling IOC when DMA might be potentially active is tricky business. +To avoid random memory issues later, just panic here and ask user to +upgrade bootloader to one which doesn't enable IOC + +This was actually seen as issue on some of the HSDK board with a version +of uboot which enabled IOC. There were random issues later with starting +of X or peripherals etc. + +Also while I'm at it, replace hardcoded bits in ARC_REG_IO_COH_PARTIAL +and ARC_REG_IO_COH_ENABLE registers by definitions. + +Inspired by: https://lkml.org/lkml/2018/1/19/557 +Signed-off-by: Eugeniy Paltsev +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/cache.h | 2 ++ + arch/arc/mm/cache.c | 20 +++++++++++++++++--- + 2 files changed, 19 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h +index db681cf4959c8..2ad77fb43639c 100644 +--- a/arch/arc/include/asm/cache.h ++++ b/arch/arc/include/asm/cache.h +@@ -124,7 +124,9 @@ extern unsigned long perip_base, perip_end; + + /* IO coherency related Auxiliary registers */ + #define ARC_REG_IO_COH_ENABLE 0x500 ++#define ARC_IO_COH_ENABLE_BIT BIT(0) + #define ARC_REG_IO_COH_PARTIAL 0x501 ++#define ARC_IO_COH_PARTIAL_BIT BIT(0) + #define ARC_REG_IO_COH_AP0_BASE 0x508 + #define ARC_REG_IO_COH_AP0_SIZE 0x509 + +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index f2701c13a66b2..cf9619d4efb4f 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -1144,6 +1144,20 @@ noinline void __init arc_ioc_setup(void) + { + unsigned int ioc_base, mem_sz; + ++ /* ++ * If IOC was already enabled (due to bootloader) it technically needs to ++ * be reconfigured with aperture base,size corresponding to Linux memory map ++ * which will certainly be different than uboot's. But disabling and ++ * reenabling IOC when DMA might be potentially active is tricky business. ++ * To avoid random memory issues later, just panic here and ask user to ++ * upgrade bootloader to one which doesn't enable IOC ++ */ ++ if (read_aux_reg(ARC_REG_IO_COH_ENABLE) & ARC_IO_COH_ENABLE_BIT) ++ panic("IOC already enabled, please upgrade bootloader!\n"); ++ ++ if (!ioc_enable) ++ return; ++ + /* + * As for today we don't support both IOC and ZONE_HIGHMEM enabled + * simultaneously. This happens because as of today IOC aperture covers +@@ -1187,8 +1201,8 @@ noinline void __init arc_ioc_setup(void) + panic("IOC Aperture start must be aligned to the size of the aperture"); + + write_aux_reg(ARC_REG_IO_COH_AP0_BASE, ioc_base >> 12); +- write_aux_reg(ARC_REG_IO_COH_PARTIAL, 1); +- write_aux_reg(ARC_REG_IO_COH_ENABLE, 1); ++ write_aux_reg(ARC_REG_IO_COH_PARTIAL, ARC_IO_COH_PARTIAL_BIT); ++ write_aux_reg(ARC_REG_IO_COH_ENABLE, ARC_IO_COH_ENABLE_BIT); + + /* Re-enable L1 dcache */ + __dc_enable(); +@@ -1265,7 +1279,7 @@ void __init arc_cache_init_master(void) + if (is_isa_arcv2() && l2_line_sz && !slc_enable) + arc_slc_disable(); + +- if (is_isa_arcv2() && ioc_enable) ++ if (is_isa_arcv2() && ioc_exists) + arc_ioc_setup(); + + if (is_isa_arcv2() && l2_line_sz && slc_enable) { +-- +2.20.1 + diff --git a/queue-4.19/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch b/queue-4.19/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch new file mode 100644 index 00000000000..580bd103640 --- /dev/null +++ b/queue-4.19/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch @@ -0,0 +1,172 @@ +From 0b81379a1a1bfa43d6079af97f2fa14ee35433ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 10:12:30 +0100 +Subject: ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ + +From: Vincent Whitchurch + +[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ] + +getuser() and putuser() (and there underscored variants) use two +strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits. +This means that the read/write is not atomic even when performed to a +16-bit-aligned address. + +This leads to problems with vhost: vhost uses __getuser() to read the +vring's 16-bit avail.index field, and if it happens to observe a partial +update of the index, wrong descriptors will be used which will lead to a +breakdown of the virtio communication. A similar problem exists for +__putuser() which is used to write to the vring's used.index field. + +The reason these functions use strb[t]/ldrb[t] is because strht/ldrht +instructions did not exist until ARMv6T2/ARMv7. So we should be easily +able to fix this on ARMv7. Also, since all ARMv6 processors also don't +actually use the unprivileged instructions anymore for uaccess (since +CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too. + +Signed-off-by: Vincent Whitchurch +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++ + arch/arm/lib/getuser.S | 11 +++++++++++ + arch/arm/lib/putuser.S | 20 ++++++++++---------- + 3 files changed, 39 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index c136eef8f690b..6390a40f16e73 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -349,6 +349,13 @@ do { \ + #define __get_user_asm_byte(x, addr, err) \ + __get_user_asm(x, addr, err, ldrb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __get_user_asm_half(x, addr, err) \ ++ __get_user_asm(x, addr, err, ldrh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __get_user_asm_half(x, __gu_addr, err) \ + ({ \ +@@ -367,6 +374,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __get_user_asm_word(x, addr, err) \ + __get_user_asm(x, addr, err, ldr) + #endif +@@ -442,6 +451,13 @@ do { \ + #define __put_user_asm_byte(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, strb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __put_user_asm_half(x, __pu_addr, err) \ ++ __put_user_asm(x, __pu_addr, err, strh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __put_user_asm_half(x, __pu_addr, err) \ + ({ \ +@@ -458,6 +474,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __put_user_asm_word(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, str) + +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index 746e7801dcdf7..b2e4bc3a635e2 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1) + + ENTRY(__get_user_2) + check_uaccess r0, 2, r1, r2, __get_user_bad ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(ldrh) r2, [r0] ++ ++#else ++ + #ifdef CONFIG_CPU_USE_DOMAINS + rb .req ip + 2: ldrbt r2, [r0], #1 +@@ -56,6 +62,9 @@ rb .req r0 + #else + orr r2, rb, r2, lsl #8 + #endif ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + mov r0, #0 + ret lr + ENDPROC(__get_user_2) +@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8) + .pushsection __ex_table, "a" + .long 1b, __get_user_bad + .long 2b, __get_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __get_user_bad ++#endif + .long 4b, __get_user_bad + .long 5b, __get_user_bad8 + .long 6b, __get_user_bad8 +diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S +index 38d660d3705f4..515eeaa9975c6 100644 +--- a/arch/arm/lib/putuser.S ++++ b/arch/arm/lib/putuser.S +@@ -41,16 +41,13 @@ ENDPROC(__put_user_1) + + ENTRY(__put_user_2) + check_uaccess r0, 2, r1, ip, __put_user_bad +- mov ip, r2, lsr #8 +-#ifdef CONFIG_THUMB2_KERNEL +-#ifndef __ARMEB__ +-2: TUSER(strb) r2, [r0] +-3: TUSER(strb) ip, [r0, #1] ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(strh) r2, [r0] ++ + #else +-2: TUSER(strb) ip, [r0] +-3: TUSER(strb) r2, [r0, #1] +-#endif +-#else /* !CONFIG_THUMB2_KERNEL */ ++ ++ mov ip, r2, lsr #8 + #ifndef __ARMEB__ + 2: TUSER(strb) r2, [r0], #1 + 3: TUSER(strb) ip, [r0] +@@ -58,7 +55,8 @@ ENTRY(__put_user_2) + 2: TUSER(strb) ip, [r0], #1 + 3: TUSER(strb) r2, [r0] + #endif +-#endif /* CONFIG_THUMB2_KERNEL */ ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ + mov r0, #0 + ret lr + ENDPROC(__put_user_2) +@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad) + .pushsection __ex_table, "a" + .long 1b, __put_user_bad + .long 2b, __put_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __put_user_bad ++#endif + .long 4b, __put_user_bad + .long 5b, __put_user_bad + .long 6b, __put_user_bad +-- +2.20.1 + diff --git a/queue-4.19/arm-debug-enable-uart1-for-socfpga-cyclone5.patch b/queue-4.19/arm-debug-enable-uart1-for-socfpga-cyclone5.patch new file mode 100644 index 00000000000..554ca1bb780 --- /dev/null +++ b/queue-4.19/arm-debug-enable-uart1-for-socfpga-cyclone5.patch @@ -0,0 +1,87 @@ +From a7ca2a7251adb6ab32123a08a9099f56344d3772 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Oct 2018 13:28:37 +0200 +Subject: ARM: debug: enable UART1 for socfpga Cyclone5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Péron + +[ Upstream commit f6628486c8489e91c513b62608f89ccdb745600d ] + +Cyclone5 and Arria10 doesn't have the same memory map for UART1. + +Split the SOCFPGA_UART1 into 2 options to allow debugging on UART1 for Cyclone5. + +Signed-off-by: Clément Péron +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig.debug | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index f95a90dfc282a..bee0ba1d1cfb7 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -1079,14 +1079,21 @@ choice + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + +- config DEBUG_SOCFPGA_UART1 ++ config DEBUG_SOCFPGA_ARRIA10_UART1 + depends on ARCH_SOCFPGA +- bool "Use SOCFPGA UART1 for low-level debug" ++ bool "Use SOCFPGA Arria10 UART1 for low-level debug" + select DEBUG_UART_8250 + help + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Arria 10) based platforms. + ++ config DEBUG_SOCFPGA_CYCLONE5_UART1 ++ depends on ARCH_SOCFPGA ++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug" ++ select DEBUG_UART_8250 ++ help ++ Say Y here if you want kernel low-level debugging support ++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + + config DEBUG_SUN9I_UART0 + bool "Kernel low-level debugging messages via sun9i UART0" +@@ -1647,7 +1654,8 @@ config DEBUG_UART_PHYS + default 0xfe800000 if ARCH_IOP32X + default 0xff690000 if DEBUG_RK32_UART2 + default 0xffc02000 if DEBUG_SOCFPGA_UART0 +- default 0xffc02100 if DEBUG_SOCFPGA_UART1 ++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xffd82340 if ARCH_IOP13XX + default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0 + default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2 +@@ -1754,7 +1762,8 @@ config DEBUG_UART_VIRT + default 0xfeb30c00 if DEBUG_KEYSTONE_UART0 + default 0xfeb31000 if DEBUG_KEYSTONE_UART1 + default 0xfec02000 if DEBUG_SOCFPGA_UART0 +- default 0xfec02100 if DEBUG_SOCFPGA_UART1 ++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU + default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE + default 0xfec10000 if DEBUG_SIRFATLAS7_UART0 +@@ -1803,9 +1812,9 @@ config DEBUG_UART_8250_WORD + depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250 + depends on DEBUG_UART_8250_SHIFT >= 2 + default y if DEBUG_PICOXCELL_UART || \ +- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \ +- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \ +- DEBUG_ALPINE_UART0 || \ ++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \ ++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \ ++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \ + DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \ + DEBUG_DAVINCI_DA8XX_UART2 || DEBUG_BCM_IPROC_UART3 || \ + DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2 +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-am335x-pdu001-fix-polarity-of-card-detection.patch b/queue-4.19/arm-dts-am335x-pdu001-fix-polarity-of-card-detection.patch new file mode 100644 index 00000000000..b969ea5dddf --- /dev/null +++ b/queue-4.19/arm-dts-am335x-pdu001-fix-polarity-of-card-detection.patch @@ -0,0 +1,37 @@ +From 1d3e3ce4e748633c57e325fa020a41b171d2c32e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 15:54:46 +0100 +Subject: ARM: dts: am335x-pdu001: Fix polarity of card detection input + +From: Felix Brack + +[ Upstream commit 5760367298a37c459ef0b1364463d70fd9a1f972 ] + +When a micro SD card is inserted in the PDU001 card cage, the card +detection switch is opened and the corresponding GPIO input is driven +by a pull-up. Hence change the active level of the card detection +input from low to high. + +Signed-off-by: Felix Brack +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-pdu001.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/am335x-pdu001.dts b/arch/arm/boot/dts/am335x-pdu001.dts +index 34fb63ef420f5..f56798efddff3 100644 +--- a/arch/arm/boot/dts/am335x-pdu001.dts ++++ b/arch/arm/boot/dts/am335x-pdu001.dts +@@ -577,7 +577,7 @@ + bus-width = <4>; + pinctrl-names = "default"; + pinctrl-0 = <&mmc2_pins>; +- cd-gpios = <&gpio2 2 GPIO_ACTIVE_LOW>; ++ cd-gpios = <&gpio2 2 GPIO_ACTIVE_HIGH>; + }; + + &sham { +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-exynos-fix-ldo13-min-values-on-odroid-xu3-xu.patch b/queue-4.19/arm-dts-exynos-fix-ldo13-min-values-on-odroid-xu3-xu.patch new file mode 100644 index 00000000000..6a0335408cd --- /dev/null +++ b/queue-4.19/arm-dts-exynos-fix-ldo13-min-values-on-odroid-xu3-xu.patch @@ -0,0 +1,37 @@ +From 5b5a27e4a9744f945b209770822c46bbd31584b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 14:07:34 +0000 +Subject: ARM: dts: exynos: Fix LDO13 min values on Odroid XU3/XU4/HC1 + +From: Anand Moon + +[ Upstream commit 8fe325fa9d065aa54db4914fdaccab2169fd67a8 ] + +From Odroid XU3/XU4/HC1 schematics the LDO13 regulator for SD2, can be +set on 1.8V or 2.8V so the minimal value should be fixed to 1.8V. This +is necessary to support UHS-I tuning (otherwise card won't be detected +during boot). + +Signed-off-by: Anand Moon +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroid-core.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +index 27214e6ebe4f4..d476ba0f07b6b 100644 +--- a/arch/arm/boot/dts/exynos5422-odroid-core.dtsi ++++ b/arch/arm/boot/dts/exynos5422-odroid-core.dtsi +@@ -224,7 +224,7 @@ + + ldo13_reg: LDO13 { + regulator-name = "vddq_mmc2"; +- regulator-min-microvolt = <2800000>; ++ regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <2800000>; + }; + +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch b/queue-4.19/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch new file mode 100644 index 00000000000..890ee0678c0 --- /dev/null +++ b/queue-4.19/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch @@ -0,0 +1,36 @@ +From 03d8fcefebe3fdee1a98c47e2afcb5a955038adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 16:54:28 +0100 +Subject: ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module + +From: Marek Szyprowski + +[ Upstream commit 6035cbcceb069f87296b3cd0bc4736ad5618bf47 ] + +DWC2 hardware module integrated in Samsung SoCs requires some quirks to +operate properly, so use Samsung SoC specific compatible to notify driver +to apply respective fixes. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi +index 94efca78c42ff..5892a9f7622fa 100644 +--- a/arch/arm/boot/dts/exynos3250.dtsi ++++ b/arch/arm/boot/dts/exynos3250.dtsi +@@ -360,7 +360,7 @@ + }; + + hsotg: hsotg@12480000 { +- compatible = "snps,dwc2"; ++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2"; + reg = <0x12480000 0x20000>; + interrupts = ; + clocks = <&cmu CLK_USBOTG>; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-imx6-rdu2-fix-egalax-touchscreen-node.patch b/queue-4.19/arm-dts-imx6-rdu2-fix-egalax-touchscreen-node.patch new file mode 100644 index 00000000000..fbf58072429 --- /dev/null +++ b/queue-4.19/arm-dts-imx6-rdu2-fix-egalax-touchscreen-node.patch @@ -0,0 +1,44 @@ +From 07721c8386791fe1c277ae5bf961996705d9abc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Nov 2018 18:31:56 +0100 +Subject: ARM: dts: imx6: RDU2: fix eGalax touchscreen node + +From: Lucas Stach + +[ Upstream commit 749a5068f2e2453a38777b1d5fc322d503cabf1d ] + +Use the correct compatible for the new protocol used by the firmware +on the touch controller, the GPIO wakeup isn't used in that case. +Also eGalax touch needs axis swapping, just as with the RMI4 touch. + +Signed-off-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi +index 7fff3717cf7c0..315d0e7615f33 100644 +--- a/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-zii-rdu2.dtsi +@@ -609,13 +609,14 @@ + }; + + touchscreen@2a { +- compatible = "eeti,egalax_ts"; ++ compatible = "eeti,exc3000"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_ts>; + reg = <0x2a>; + interrupt-parent = <&gpio1>; + interrupts = <8 IRQ_TYPE_LEVEL_LOW>; +- wakeup-gpios = <&gpio1 8 GPIO_ACTIVE_LOW>; ++ touchscreen-inverted-x; ++ touchscreen-swapped-x-y; + status = "disabled"; + }; + +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch b/queue-4.19/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch new file mode 100644 index 00000000000..7e857349cb8 --- /dev/null +++ b/queue-4.19/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch @@ -0,0 +1,36 @@ +From 0288eaaebe8d10a6f2454441baee83d185fa1262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 18:53:06 +0100 +Subject: ARM: dts: mmp2: fix the gpio interrupt cell number + +From: Lubomir Rintel + +[ Upstream commit 400583983f8a8e95ec02c9c9e2b50188753a87fb ] + +gpio-pxa uses two cell to encode the interrupt source: the pin number +and the trigger type. Adjust the device node accordingly. + +Signed-off-by: Lubomir Rintel +Acked-by: Pavel Machek +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mmp2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi +index 47e5b63339d18..e95deed6a7973 100644 +--- a/arch/arm/boot/dts/mmp2.dtsi ++++ b/arch/arm/boot/dts/mmp2.dtsi +@@ -180,7 +180,7 @@ + clocks = <&soc_clocks MMP2_CLK_GPIO>; + resets = <&soc_clocks MMP2_CLK_GPIO>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + ranges; + + gcb0: gpio@d4019000 { +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-pxa-clean-up-usb-controller-nodes.patch b/queue-4.19/arm-dts-pxa-clean-up-usb-controller-nodes.patch new file mode 100644 index 00000000000..b180a470dd6 --- /dev/null +++ b/queue-4.19/arm-dts-pxa-clean-up-usb-controller-nodes.patch @@ -0,0 +1,73 @@ +From c5755f73e6a917366b886e1fc0f9bec389ef238b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Dec 2018 14:54:51 +0100 +Subject: ARM: dts: pxa: clean up USB controller nodes + +From: Daniel Mack + +[ Upstream commit c40ad24254f1dbd54f2df5f5f524130dc1862122 ] + +PXA25xx SoCs don't have a USB controller, so drop the node from the +common pxa2xx.dtsi base file. Both pxa27x and pxa3xx have a dedicated +node already anyway. + +While at it, unify the names for the nodes across all pxa platforms. + +Signed-off-by: Daniel Mack +Reported-by: Sergey Yanovich +Link: https://patchwork.kernel.org/patch/8375421/ +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/pxa27x.dtsi | 2 +- + arch/arm/boot/dts/pxa2xx.dtsi | 7 ------- + arch/arm/boot/dts/pxa3xx.dtsi | 2 +- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 3228ad5fb725f..ccbecad9c5c7c 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -35,7 +35,7 @@ + clocks = <&clks CLK_NONE>; + }; + +- pxa27x_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi +index a520b4c14ea9f..0a0e837dc79cb 100644 +--- a/arch/arm/boot/dts/pxa2xx.dtsi ++++ b/arch/arm/boot/dts/pxa2xx.dtsi +@@ -117,13 +117,6 @@ + status = "disabled"; + }; + +- usb0: ohci@4c000000 { +- compatible = "marvell,pxa-ohci"; +- reg = <0x4c000000 0x10000>; +- interrupts = <3>; +- status = "disabled"; +- }; +- + mmc0: mmc@41100000 { + compatible = "marvell,pxa-mmc"; + reg = <0x41100000 0x1000>; +diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi +index 3a8f0edc3af99..53009dbd36158 100644 +--- a/arch/arm/boot/dts/pxa3xx.dtsi ++++ b/arch/arm/boot/dts/pxa3xx.dtsi +@@ -204,7 +204,7 @@ + status = "disabled"; + }; + +- pxa3xx_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-r8a779-01-disable-unconnected-lvds-encoders.patch b/queue-4.19/arm-dts-r8a779-01-disable-unconnected-lvds-encoders.patch new file mode 100644 index 00000000000..3f67599a786 --- /dev/null +++ b/queue-4.19/arm-dts-r8a779-01-disable-unconnected-lvds-encoders.patch @@ -0,0 +1,71 @@ +From 9a8fa051519256afc5de3573081f382a7df49f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Oct 2018 20:48:01 +0300 +Subject: ARM: dts: r8a779[01]: Disable unconnected LVDS encoders + +From: Laurent Pinchart + +[ Upstream commit 89862542fab10fed8a3c2f9c167622ef4287351d ] + +The LVDS0 encoder on Koelsh and Porter, and the LVDS1 encoder on Lager, +are enabled in DT but have no device connected to their output. This +result in spurious messages being printed to the kernel log such as + +rcar-du feb00000.display: no connector for encoder /soc/lvds@feb90000, skipping + +Fix it by disabling the encoders. + +Fixes: 15a1ff30d8f9 ("ARM: dts: r8a7790: Convert to new LVDS DT bindings") +Fixes: e5c3f4707f39 ("ARM: dts: r8a7791: Convert to new LVDS DT bindings") +Reported-by: Geert Uytterhoeven +Signed-off-by: Laurent Pinchart +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/r8a7790-lager.dts | 2 -- + arch/arm/boot/dts/r8a7791-koelsch.dts | 2 -- + arch/arm/boot/dts/r8a7791-porter.dts | 2 -- + 3 files changed, 6 deletions(-) + +diff --git a/arch/arm/boot/dts/r8a7790-lager.dts b/arch/arm/boot/dts/r8a7790-lager.dts +index 50312e752e2fa..7b9508e83d46c 100644 +--- a/arch/arm/boot/dts/r8a7790-lager.dts ++++ b/arch/arm/boot/dts/r8a7790-lager.dts +@@ -489,8 +489,6 @@ + }; + + &lvds1 { +- status = "okay"; +- + ports { + port@1 { + lvds_connector: endpoint { +diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts +index ce22db01fbbaa..e6580aa0cea35 100644 +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -479,8 +479,6 @@ + }; + + &lvds0 { +- status = "okay"; +- + ports { + port@1 { + lvds_connector: endpoint { +diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts +index f02036e5de015..fefdf8238bbe9 100644 +--- a/arch/arm/boot/dts/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/r8a7791-porter.dts +@@ -482,8 +482,6 @@ + }; + + &lvds0 { +- status = "okay"; +- + ports { + port@1 { + lvds_connector: endpoint { +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch b/queue-4.19/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch new file mode 100644 index 00000000000..2af8e695093 --- /dev/null +++ b/queue-4.19/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch @@ -0,0 +1,73 @@ +From 174dea05964266f86be3e336c17052a476016f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 13:12:48 -0600 +Subject: ARM: dts: realview: Fix some more duplicate regulator nodes + +From: Rob Herring + +[ Upstream commit f3b2f758ec1e6cdb13c925647cbd8ad4938b78fb ] + +There's a bug in dtc in checking for duplicate node names when there's +another section (e.g. "/ { };"). In this case, skeleton.dtsi provides +another section. Upon removal of skeleton.dtsi, the dtb fails to build +due to a duplicate node 'fixedregulator@0'. As both nodes were pretty +much the same 3.3V fixed regulator, it hasn't really mattered. Fix this +by renaming the nodes to something unique. In the process, drop the +unit-address which shouldn't be present wtihout reg property. + +Signed-off-by: Rob Herring +Reviewed-by: Linus Walleij +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm-realview-pb1176.dts | 4 ++-- + arch/arm/boot/dts/arm-realview-pb11mp.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts +index f2a1d25eb6cf3..83e0fbc4a1a10 100644 +--- a/arch/arm/boot/dts/arm-realview-pb1176.dts ++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts +@@ -45,7 +45,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -53,7 +53,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts +index 7f9cbdf33a510..2f6aa24a0b67c 100644 +--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts ++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts +@@ -145,7 +145,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -153,7 +153,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch b/queue-4.19/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch new file mode 100644 index 00000000000..4b80ecb9b66 --- /dev/null +++ b/queue-4.19/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch @@ -0,0 +1,55 @@ +From bca9c15c2e0930bc214c47cecf32389b5b3159ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 19:05:47 -0600 +Subject: ARM: dts: realview-pbx: Fix duplicate regulator nodes + +From: Rob Herring + +[ Upstream commit 7f4b001b7f6e0480b5bdab9cd8ce1711e43e5cb5 ] + +There's a bug in dtc in checking for duplicate node names when there's +another section (e.g. "/ { };"). In this case, skeleton.dtsi provides +another section. Upon removal of skeleton.dtsi, the dtb fails to build +due to a duplicate node 'fixedregulator@0'. As both nodes were pretty +much the same 3.3V fixed regulator, it hasn't really mattered. Fix this +by renaming the nodes to something unique. In the process, drop the +unit-address which shouldn't be present wtihout reg property. + +Cc: Linus Walleij +Signed-off-by: Rob Herring +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm-realview-pbx.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi +index a5676697ff3b7..916a97734f84c 100644 +--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi ++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi +@@ -44,7 +44,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -52,7 +52,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +@@ -567,4 +567,3 @@ + }; + }; + }; +- +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch b/queue-4.19/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch new file mode 100644 index 00000000000..a057964d1f5 --- /dev/null +++ b/queue-4.19/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch @@ -0,0 +1,65 @@ +From 83bc10a3ab829e3f7fbbd53a400f51a67671aa4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 15:35:04 -0200 +Subject: ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108 + +From: Otavio Salvador + +[ Upstream commit efc2e0bd9594060915696a418564aefd0270b1d6 ] + +It is not correct to assign the 24MHz clock oscillator to the GPIO +ports. + +Fix it by assigning the proper GPIO clocks instead. + +Signed-off-by: Otavio Salvador +Tested-by: Fabio Berton +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rv1108.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi +index 4090ad2619ffb..a9f053dfdc068 100644 +--- a/arch/arm/boot/dts/rv1108.dtsi ++++ b/arch/arm/boot/dts/rv1108.dtsi +@@ -541,7 +541,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x20030000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO0_PMU>; + + gpio-controller; + #gpio-cells = <2>; +@@ -554,7 +554,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10310000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO1>; + + gpio-controller; + #gpio-cells = <2>; +@@ -567,7 +567,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10320000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO2>; + + gpio-controller; + #gpio-cells = <2>; +@@ -580,7 +580,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10330000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO3>; + + gpio-controller; + #gpio-cells = <2>; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch b/queue-4.19/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch new file mode 100644 index 00000000000..91df49f1fe6 --- /dev/null +++ b/queue-4.19/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch @@ -0,0 +1,36 @@ +From e2d409e7fa18f1a23c6deab1f9907a94de15e057 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 15:24:13 +0000 +Subject: ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name + +From: John Keeping + +[ Upstream commit 03d9f8fa2bfdc791865624d3adc29070cf67814e ] + +There is no functional change from this, but it is confusing to find two +copies of vcc_sys and no vcc_flash when looking in +/sys/class/regulator/*/name. + +Signed-off-by: John Keeping +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +index 50325489c0ced..32e1ab3366629 100644 +--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi ++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +@@ -25,7 +25,7 @@ + + vcc_flash: flash-regulator { + compatible = "regulator-fixed"; +- regulator-name = "vcc_sys"; ++ regulator-name = "vcc_flash"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + startup-delay-us = <150>; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch b/queue-4.19/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch new file mode 100644 index 00000000000..e5ca972659d --- /dev/null +++ b/queue-4.19/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch @@ -0,0 +1,36 @@ +From 4d3a556e58db5a520cb4c6bc531b79b5a183dd21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 15:35:03 -0200 +Subject: ARM: dts: rockchip: Fix the PMU interrupt number for rv1108 + +From: Otavio Salvador + +[ Upstream commit c955b7aec510145129ca7aaea6ecbf6d748f5ebf ] + +According to the Rockchip vendor tree the PMU interrupt number is +76, so fix it accordingly. + +Signed-off-by: Otavio Salvador +Tested-by: Fabio Berton +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rv1108.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi +index ed8f6ca52c5bc..4090ad2619ffb 100644 +--- a/arch/arm/boot/dts/rv1108.dtsi ++++ b/arch/arm/boot/dts/rv1108.dtsi +@@ -66,7 +66,7 @@ + + arm-pmu { + compatible = "arm,cortex-a7-pmu"; +- interrupts = ; ++ interrupts = ; + }; + + timer { +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun4i-fix-gpio-keys-warning.patch b/queue-4.19/arm-dts-sun4i-fix-gpio-keys-warning.patch new file mode 100644 index 00000000000..6e0bab0196a --- /dev/null +++ b/queue-4.19/arm-dts-sun4i-fix-gpio-keys-warning.patch @@ -0,0 +1,49 @@ +From 9f028f82b34a124c242871f1c7b3d0356b114b68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Sep 2018 15:59:30 +0200 +Subject: ARM: dts: sun4i: Fix gpio-keys warning + +From: Maxime Ripard + +[ Upstream commit c9b543404c5e1fd51a7ac375294519be5064bf80 ] + +Fix the 'unnecessary #address-cells/#size-cells without "ranges" or child +"reg" property' DTC warning for the gpio-keys DT node on A10 boards. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts | 2 -- + arch/arm/boot/dts/sun4i-a10-pcduino.dts | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts +index 221acd10f6c84..2f0d966f39ad8 100644 +--- a/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts ++++ b/arch/arm/boot/dts/sun4i-a10-inet9f-rev03.dts +@@ -63,8 +63,6 @@ + compatible = "gpio-keys-polled"; + pinctrl-names = "default"; + pinctrl-0 = <&key_pins_inet9f>; +- #address-cells = <1>; +- #size-cells = <0>; + poll-interval = <20>; + + left-joystick-left { +diff --git a/arch/arm/boot/dts/sun4i-a10-pcduino.dts b/arch/arm/boot/dts/sun4i-a10-pcduino.dts +index b97a0f2f20b97..d82a604f3d9c7 100644 +--- a/arch/arm/boot/dts/sun4i-a10-pcduino.dts ++++ b/arch/arm/boot/dts/sun4i-a10-pcduino.dts +@@ -76,8 +76,6 @@ + + gpio-keys { + compatible = "gpio-keys"; +- #address-cells = <1>; +- #size-cells = <0>; + + back { + label = "Key Back"; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun4i-fix-hdmi-output-dtc-warning.patch b/queue-4.19/arm-dts-sun4i-fix-hdmi-output-dtc-warning.patch new file mode 100644 index 00000000000..804eb2c1710 --- /dev/null +++ b/queue-4.19/arm-dts-sun4i-fix-hdmi-output-dtc-warning.patch @@ -0,0 +1,36 @@ +From 75d1524c17c1b56ac5fae70f7107394f2a0588ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Sep 2018 16:00:22 +0200 +Subject: ARM: dts: sun4i: Fix HDMI output DTC warning + +From: Maxime Ripard + +[ Upstream commit 123b796d3fac60d69a3737d81901ab483c4efd6e ] + +Our HDMI output endpoint on the A10 DTSI has a warning under DTC: "graph +node has single child node 'endpoint', #address-cells/#size-cells are not +necessary". Fix this by removing those properties. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun4i-a10.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi +index 3d62a89507207..5d46bb0139fad 100644 +--- a/arch/arm/boot/dts/sun4i-a10.dtsi ++++ b/arch/arm/boot/dts/sun4i-a10.dtsi +@@ -530,8 +530,6 @@ + }; + + hdmi_out: port@1 { +- #address-cells = <1>; +- #size-cells = <0>; + reg = <1>; + }; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch b/queue-4.19/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch new file mode 100644 index 00000000000..00bbe3992db --- /dev/null +++ b/queue-4.19/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch @@ -0,0 +1,36 @@ +From d889fdd6ba25df9c402874f38cbef715d8eba69c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Sep 2018 16:00:22 +0200 +Subject: ARM: dts: sun5i: a10s: Fix HDMI output DTC warning + +From: Maxime Ripard + +[ Upstream commit ed5fc60b909427be6ca93d3e07a0a5f296d7000a ] + +Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph +node has single child node 'endpoint', #address-cells/#size-cells are not +necessary". Fix this by removing those properties. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun5i-a10s.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi +index 316cb8b2945b1..a66d9f92f58f5 100644 +--- a/arch/arm/boot/dts/sun5i-a10s.dtsi ++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi +@@ -104,8 +104,6 @@ + }; + + hdmi_out: port@1 { +- #address-cells = <1>; +- #size-cells = <0>; + reg = <1>; + }; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun7i-fix-hdmi-output-dtc-warning.patch b/queue-4.19/arm-dts-sun7i-fix-hdmi-output-dtc-warning.patch new file mode 100644 index 00000000000..56655174310 --- /dev/null +++ b/queue-4.19/arm-dts-sun7i-fix-hdmi-output-dtc-warning.patch @@ -0,0 +1,36 @@ +From 269b2d8ea263d5261e5c0e2855b7f385a7f12d40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Sep 2018 16:00:22 +0200 +Subject: ARM: dts: sun7i: Fix HDMI output DTC warning + +From: Maxime Ripard + +[ Upstream commit 4d9a06979b1ae0c802440cb4433dfcd85fc7bdd3 ] + +Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph +node has single child node 'endpoint', #address-cells/#size-cells are not +necessary". Fix this by removing those properties. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi +index 9c52712af2411..73e789a133de1 100644 +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -639,8 +639,6 @@ + }; + + hdmi_out: port@1 { +- #address-cells = <1>; +- #size-cells = <0>; + reg = <1>; + }; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun8i-a23-a33-fix-opp-dtc-warnings.patch b/queue-4.19/arm-dts-sun8i-a23-a33-fix-opp-dtc-warnings.patch new file mode 100644 index 00000000000..77848d1cd58 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-a23-a33-fix-opp-dtc-warnings.patch @@ -0,0 +1,73 @@ +From ae7d9baa762700f965925bc4319099cb36d396a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 09:51:04 +0100 +Subject: ARM: dts: sun8i: a23/a33: Fix OPP DTC warnings + +From: Maxime Ripard + +[ Upstream commit a858f569b80a69076c521532a289097af905cf1e ] + +DTC will emit a warning on our OPPs nodes for the common DTSI between the +A23 and A33 since those nodes use the frequency as unit addresses, but +don't have a matching reg property. + +Fix this by moving the frequency to the node name instead. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3.dtsi | 6 +++--- + arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi +index f0096074a4678..97de6ad133dc2 100644 +--- a/arch/arm/boot/dts/sun8i-h3.dtsi ++++ b/arch/arm/boot/dts/sun8i-h3.dtsi +@@ -47,19 +47,19 @@ + compatible = "operating-points-v2"; + opp-shared; + +- opp@648000000 { ++ opp-648000000 { + opp-hz = /bits/ 64 <648000000>; + opp-microvolt = <1040000 1040000 1300000>; + clock-latency-ns = <244144>; /* 8 32k periods */ + }; + +- opp@816000000 { ++ opp-816000000 { + opp-hz = /bits/ 64 <816000000>; + opp-microvolt = <1100000 1100000 1300000>; + clock-latency-ns = <244144>; /* 8 32k periods */ + }; + +- opp@1008000000 { ++ opp-1008000000 { + opp-hz = /bits/ 64 <1008000000>; + opp-microvolt = <1200000 1200000 1300000>; + clock-latency-ns = <244144>; /* 8 32k periods */ +diff --git a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts +index 0dbdb29a8fff9..ee7ce3752581b 100644 +--- a/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts ++++ b/arch/arm/boot/dts/sun8i-r16-bananapi-m2m.dts +@@ -103,13 +103,13 @@ + }; + + &cpu0_opp_table { +- opp@1104000000 { ++ opp-1104000000 { + opp-hz = /bits/ 64 <1104000000>; + opp-microvolt = <1320000>; + clock-latency-ns = <244144>; /* 8 32k periods */ + }; + +- opp@1200000000 { ++ opp-1200000000 { + opp-hz = /bits/ 64 <1200000000>; + opp-microvolt = <1320000>; + clock-latency-ns = <244144>; /* 8 32k periods */ +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun8i-a23-a33-fix-up-rtc-device-node.patch b/queue-4.19/arm-dts-sun8i-a23-a33-fix-up-rtc-device-node.patch new file mode 100644 index 00000000000..2b1558fa001 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-a23-a33-fix-up-rtc-device-node.patch @@ -0,0 +1,46 @@ +From 83e9ee5b5a78469b8941c308e7316eb5f1ae75c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 22:58:20 +0800 +Subject: ARM: dts: sun8i: a23/a33: Fix up RTC device node + +From: Chen-Yu Tsai + +[ Upstream commit f6f4422532ad9ec9380a9936ed16b30922066a50 ] + +The RTC module on the A23 was claimed to be the same as on the A31, when +in fact it is not. The A31 does not have an RTC external clock output, +and its internal RC oscillator's average clock rate is not in the same +range. The A33's RTC is the same as the A23. + +This patch fixes the compatible string and clock properties to conform +to the updated bindings. The register range is also fixed. + +Acked-by: Maxime Ripard +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-a23-a33.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-a23-a33.dtsi b/arch/arm/boot/dts/sun8i-a23-a33.dtsi +index c16ffcc4db7da..5616333c0e0e3 100644 +--- a/arch/arm/boot/dts/sun8i-a23-a33.dtsi ++++ b/arch/arm/boot/dts/sun8i-a23-a33.dtsi +@@ -565,11 +565,11 @@ + }; + + rtc: rtc@1f00000 { +- compatible = "allwinner,sun6i-a31-rtc"; +- reg = <0x01f00000 0x54>; ++ compatible = "allwinner,sun8i-a23-rtc"; ++ reg = <0x01f00000 0x400>; + interrupts = , + ; +- clock-output-names = "osc32k"; ++ clock-output-names = "osc32k", "osc32k-out"; + clocks = <&ext_osc32k>; + #clock-cells = <1>; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun8i-h3-fix-the-system-control-register-ran.patch b/queue-4.19/arm-dts-sun8i-h3-fix-the-system-control-register-ran.patch new file mode 100644 index 00000000000..9f6ca49e4a0 --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-h3-fix-the-system-control-register-ran.patch @@ -0,0 +1,40 @@ +From 00b32db0c6e54c7ae30ef60c097bbce7cb8b1119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 10:24:30 +0100 +Subject: ARM: dts: sun8i: h3: Fix the system-control register range + +From: Paul Kocialkowski + +[ Upstream commit 925c5afd78c40169c7e0e6adec52d5119ff43751 ] + +Unlike in previous generations, the system-control register range is not +limited to a size of 0x30 on the H3. In particular, the EMAC clock +configuration register (accessed through syscon) is at offset 0x30 in +that range. + +Extend the register size to its full range (0x1000) as a result. + +Signed-off-by: Paul Kocialkowski +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-h3.dtsi b/arch/arm/boot/dts/sun8i-h3.dtsi +index 97de6ad133dc2..9233ba30a857c 100644 +--- a/arch/arm/boot/dts/sun8i-h3.dtsi ++++ b/arch/arm/boot/dts/sun8i-h3.dtsi +@@ -122,7 +122,7 @@ + soc { + system-control@1c00000 { + compatible = "allwinner,sun8i-h3-system-control"; +- reg = <0x01c00000 0x30>; ++ reg = <0x01c00000 0x1000>; + #address-cells = <1>; + #size-cells = <1>; + ranges; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch b/queue-4.19/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch new file mode 100644 index 00000000000..13bfeeac27e --- /dev/null +++ b/queue-4.19/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch @@ -0,0 +1,93 @@ +From a9ddf0136b5da57061b41a6d285773690bc2ada7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 10:58:01 +0100 +Subject: ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning + +From: Maxime Ripard + +[ Upstream commit 438a44ce7e51ce571f942433c6c7cb87c4c0effd ] + +All our pinctrl nodes were using a node name convention with a unit-address +to differentiate the different muxing options. However, since those nodes +didn't have a reg property, they were generating warnings in DTC. + +In order to accomodate for this, convert the old nodes to the syntax we've +been using for the new SoCs, including removing the letter suffix of the +node labels to the bank of those pins to make things more readable. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts | 4 ++-- + arch/arm/boot/dts/sun8i-v3s.dtsi | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +index 387fc2aa546d6..333df90e8037c 100644 +--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts ++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +@@ -78,7 +78,7 @@ + }; + + &mmc0 { +- pinctrl-0 = <&mmc0_pins_a>; ++ pinctrl-0 = <&mmc0_pins>; + pinctrl-names = "default"; + broken-cd; + bus-width = <4>; +@@ -87,7 +87,7 @@ + }; + + &uart0 { +- pinctrl-0 = <&uart0_pins_a>; ++ pinctrl-0 = <&uart0_pb_pins>; + pinctrl-names = "default"; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index 443b083c6adc9..92fcb756a08a9 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -292,17 +292,17 @@ + interrupt-controller; + #interrupt-cells = <3>; + +- i2c0_pins: i2c0 { ++ i2c0_pins: i2c0-pins { + pins = "PB6", "PB7"; + function = "i2c0"; + }; + +- uart0_pins_a: uart0@0 { ++ uart0_pb_pins: uart0-pb-pins { + pins = "PB8", "PB9"; + function = "uart0"; + }; + +- mmc0_pins_a: mmc0@0 { ++ mmc0_pins: mmc0-pins { + pins = "PF0", "PF1", "PF2", "PF3", + "PF4", "PF5"; + function = "mmc0"; +@@ -310,7 +310,7 @@ + bias-pull-up; + }; + +- mmc1_pins: mmc1 { ++ mmc1_pins: mmc1-pins { + pins = "PG0", "PG1", "PG2", "PG3", + "PG4", "PG5"; + function = "mmc1"; +@@ -318,7 +318,7 @@ + bias-pull-up; + }; + +- spi0_pins: spi0 { ++ spi0_pins: spi0-pins { + pins = "PC0", "PC1", "PC2", "PC3"; + function = "spi0"; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-dts-sunxi-fix-pmu-compatible-strings.patch b/queue-4.19/arm-dts-sunxi-fix-pmu-compatible-strings.patch new file mode 100644 index 00000000000..12b3eaa167e --- /dev/null +++ b/queue-4.19/arm-dts-sunxi-fix-pmu-compatible-strings.patch @@ -0,0 +1,52 @@ +From 396de51f9449b7796005df0b1ee1ea3d422e6c07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 13:11:42 -0600 +Subject: ARM: dts: sunxi: Fix PMU compatible strings + +From: Rob Herring + +[ Upstream commit 5719ac19fc32d892434939c1756c2f9a8322e6ef ] + +"arm,cortex-a15-pmu" is not a valid fallback compatible string for an +Cortex-A7 PMU, so drop it. + +Cc: Maxime Ripard +Cc: Chen-Yu Tsai +Signed-off-by: Rob Herring +Acked-by: Will Deacon +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun6i-a31.dtsi | 2 +- + arch/arm/boot/dts/sun7i-a20.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi +index debc0bf22ea3b..76924fa42bbc3 100644 +--- a/arch/arm/boot/dts/sun6i-a31.dtsi ++++ b/arch/arm/boot/dts/sun6i-a31.dtsi +@@ -201,7 +201,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + , + , +diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi +index 73e789a133de1..355619dce7994 100644 +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -183,7 +183,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + ; + }; +-- +2.20.1 + diff --git a/queue-4.19/arm-omap1-2-fix-soc-name-printing.patch b/queue-4.19/arm-omap1-2-fix-soc-name-printing.patch new file mode 100644 index 00000000000..8750693ca1f --- /dev/null +++ b/queue-4.19/arm-omap1-2-fix-soc-name-printing.patch @@ -0,0 +1,63 @@ +From 2c4cf4e6224271df635f048993491e45b815f084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 21:46:41 +0200 +Subject: ARM: OMAP1/2: fix SoC name printing + +From: Aaro Koskinen + +[ Upstream commit 04a92358b3964988c78dfe370a559ae550383886 ] + +Currently we get extra newlines on OMAP1/2 when the SoC name is printed: + +[ 0.000000] OMAP1510 +[ 0.000000] revision 2 handled as 15xx id: bc058c9b93111a16 + +[ 0.000000] OMAP2420 +[ 0.000000] + +Fix by using pr_cont. + +Signed-off-by: Aaro Koskinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/id.c | 6 +++--- + arch/arm/mach-omap2/id.c | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c +index 52de382fc8047..7e49dfda3d2f4 100644 +--- a/arch/arm/mach-omap1/id.c ++++ b/arch/arm/mach-omap1/id.c +@@ -200,10 +200,10 @@ void __init omap_check_revision(void) + printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type); + } + +- printk(KERN_INFO "OMAP%04x", omap_revision >> 16); ++ pr_info("OMAP%04x", omap_revision >> 16); + if ((omap_revision >> 8) & 0xff) +- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff); +- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n", ++ pr_cont("%x", (omap_revision >> 8) & 0xff); ++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n", + die_rev, omap_revision & 0xff, system_serial_low, + system_serial_high); + } +diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c +index 68ba5f472f6ba..859c71c4e9324 100644 +--- a/arch/arm/mach-omap2/id.c ++++ b/arch/arm/mach-omap2/id.c +@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void) + + pr_info("%s", soc_name); + if ((omap_rev() >> 8) & 0x0f) +- pr_info("%s", soc_rev); +- pr_info("\n"); ++ pr_cont("%s", soc_rev); ++ pr_cont("\n"); + } + + #define OMAP3_SHOW_FEATURE(feat) \ +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-enable-sound-on-pinebook.patch b/queue-4.19/arm64-dts-allwinner-a64-enable-sound-on-pinebook.patch new file mode 100644 index 00000000000..7292f192ef3 --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-enable-sound-on-pinebook.patch @@ -0,0 +1,97 @@ +From 4e3b4ee3bd4f6b5ef25c970c17cdce956aaba70d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 18:23:25 +0800 +Subject: arm64: dts: allwinner: a64: enable sound on Pinebook + +From: Vasily Khoruzhick + +[ Upstream commit 6de8e717848f1b07b05f1b512dd6b8552677d958 ] + +The Pinebook has a headphone jack tied to the HP headphone output of +the SoC, and internal speakers connected to the LINEOUT of the SoC, +through a standalone amplifier. + +This commit enables I2S, digital and analog parts of audio codec on +Pinebook, along with a device node for the external amplifier. + +Signed-off-by: Vasily Khoruzhick +[wens@csie.org: dropped headphone_amp; added headphone amp regulator supply; + fixed speaker_amp node name and sound-name-prefix name] +Acked-by: Maxime Ripard +Tested-by: Vasily Khoruzhick +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + .../dts/allwinner/sun50i-a64-pinebook.dts | 49 +++++++++++++++++++ + 1 file changed, 49 insertions(+) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +index 897e60cbe38d1..b71ac80f6dc77 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinebook.dts +@@ -64,6 +64,32 @@ + compatible = "mmc-pwrseq-simple"; + reset-gpios = <&r_pio 0 2 GPIO_ACTIVE_LOW>; /* PL2 */ + }; ++ ++ speaker_amp: audio-amplifier { ++ compatible = "simple-audio-amplifier"; ++ /* ++ * TODO This is actually a fixed regulator controlled by ++ * the GPIO line on the PMIC. This should be corrected ++ * once GPIO support is added for this PMIC. ++ */ ++ VCC-supply = <®_ldo_io0>; ++ enable-gpios = <&pio 7 7 GPIO_ACTIVE_HIGH>; /* PH7 */ ++ sound-name-prefix = "Speaker Amp"; ++ }; ++ ++}; ++ ++&codec { ++ status = "okay"; ++}; ++ ++&codec_analog { ++ hpvcc-supply = <®_eldo1>; ++ status = "okay"; ++}; ++ ++&dai { ++ status = "okay"; + }; + + &ehci0 { +@@ -268,6 +294,29 @@ + vcc-hdmi-supply = <®_dldo1>; + }; + ++&sound { ++ status = "okay"; ++ simple-audio-card,aux-devs = <&codec_analog>, <&speaker_amp>; ++ simple-audio-card,widgets = "Microphone", "Internal Microphone Left", ++ "Microphone", "Internal Microphone Right", ++ "Headphone", "Headphone Jack", ++ "Speaker", "Internal Speaker"; ++ simple-audio-card,routing = ++ "Left DAC", "AIF1 Slot 0 Left", ++ "Right DAC", "AIF1 Slot 0 Right", ++ "Speaker Amp INL", "LINEOUT", ++ "Speaker Amp INR", "LINEOUT", ++ "Internal Speaker", "Speaker Amp OUTL", ++ "Internal Speaker", "Speaker Amp OUTR", ++ "Headphone Jack", "HP", ++ "AIF1 Slot 0 Left ADC", "Left ADC", ++ "AIF1 Slot 0 Right ADC", "Right ADC", ++ "Internal Microphone Left", "MBIAS", ++ "MIC1", "Internal Microphone Left", ++ "Internal Microphone Right", "HBIAS", ++ "MIC2", "Internal Microphone Right"; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pins_a>; +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-allwinner-a64-fix-up-rtc-device-node-and-c.patch b/queue-4.19/arm64-dts-allwinner-a64-fix-up-rtc-device-node-and-c.patch new file mode 100644 index 00000000000..502e2968150 --- /dev/null +++ b/queue-4.19/arm64-dts-allwinner-a64-fix-up-rtc-device-node-and-c.patch @@ -0,0 +1,86 @@ +From 9da49d0b489610801400fa2d55a4f43d1c9492d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 22:58:25 +0800 +Subject: arm64: dts: allwinner: a64: Fix up RTC device node and clock + references + +From: Chen-Yu Tsai + +[ Upstream commit 44ff3cafcd7f413e7710a58ac40cfdc3a9380097 ] + +The RTC module on the A64 was claimed to be the same as on the A31, when +in fact it is not. It is actually compatible to the H3's RTC. The A64's +RTC has some extra crypto-related registers which the H3's does not, but +the exact function of these is not clear. + +This patch fixes the compatible string and clock properties to conform +to the updated bindings. The device node for the internal oscillator is +removed, as it is internalized into the RTC device. Clock references to +the IOSC and LOSC are also fixed. + +Acked-by: Maxime Ripard +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 22 ++++++------------- + 1 file changed, 7 insertions(+), 15 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index d3daf90a8715c..f2e1b1c3c92a8 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -123,15 +123,7 @@ + #clock-cells = <0>; + compatible = "fixed-clock"; + clock-frequency = <32768>; +- clock-output-names = "osc32k"; +- }; +- +- iosc: internal-osc-clk { +- #clock-cells = <0>; +- compatible = "fixed-clock"; +- clock-frequency = <16000000>; +- clock-accuracy = <300000000>; +- clock-output-names = "iosc"; ++ clock-output-names = "ext-osc32k"; + }; + + psci { +@@ -354,7 +346,7 @@ + ccu: clock@1c20000 { + compatible = "allwinner,sun50i-a64-ccu"; + reg = <0x01c20000 0x400>; +- clocks = <&osc24M>, <&osc32k>; ++ clocks = <&osc24M>, <&rtc 0>; + clock-names = "hosc", "losc"; + #clock-cells = <1>; + #reset-cells = <1>; +@@ -687,11 +679,12 @@ + }; + + rtc: rtc@1f00000 { +- compatible = "allwinner,sun6i-a31-rtc"; +- reg = <0x01f00000 0x54>; ++ compatible = "allwinner,sun50i-a64-rtc", ++ "allwinner,sun8i-h3-rtc"; ++ reg = <0x01f00000 0x400>; + interrupts = , + ; +- clock-output-names = "rtc-osc32k", "rtc-osc32k-out"; ++ clock-output-names = "osc32k", "osc32k-out", "iosc"; + clocks = <&osc32k>; + #clock-cells = <1>; + }; +@@ -708,8 +701,7 @@ + r_ccu: clock@1f01400 { + compatible = "allwinner,sun50i-a64-r-ccu"; + reg = <0x01f01400 0x100>; +- clocks = <&osc24M>, <&osc32k>, <&iosc>, +- <&ccu 11>; ++ clocks = <&osc24M>, <&rtc 0>, <&rtc 2>, <&ccu 11>; + clock-names = "hosc", "losc", "iosc", "pll-periph"; + #clock-cells = <1>; + #reset-cells = <1>; +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch b/queue-4.19/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..4cd2e6ec306 --- /dev/null +++ b/queue-4.19/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From 1c787ac81c0fcad4ed320780258ef8100e70c25d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:48 +0100 +Subject: arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit f0783f5edb52af14ecaae6c5ce4f38e0a358f5d8 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 12ada0513d7a ("ARM64: dts: meson-gxbb-nanopi-k2: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +index cbe99bd4e06d2..8cd50b75171de 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +@@ -191,7 +191,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In", + "VCCK En", "CON1 Header Pin31", + "I2S Header Pin6", "IR In", "I2S Header Pin7", +@@ -201,7 +201,7 @@ + ""; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch b/queue-4.19/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..9b181e989cc --- /dev/null +++ b/queue-4.19/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From 4b9ec2d3aea3a2f8b550258ed4d928dc6f4f4a4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:49 +0100 +Subject: arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 2165b006b65d609140dafafcb14cce5a4aaacbab ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: b03c7d6438bb ("ARM64: dts: meson-gxbb-odroidc2: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index 54954b314a452..00f7be6d83f7c 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -187,7 +187,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En", + "USB HUB nRESET", "USB OTG Power En", + "J7 Header Pin2", "IR In", "J7 Header Pin4", +@@ -197,7 +197,7 @@ + ""; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch b/queue-4.19/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..ee28565a17f --- /dev/null +++ b/queue-4.19/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From af418ac4c5d8bfa3283dc86d4029410b798a48de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:50 +0100 +Subject: arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 5b78012636f537344bd551934387f5772c38ba80 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 60795933b709 ("ARM64: dts: meson-gxl-khadas-vim: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +index d32cf38463702..864ef0111b01a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +@@ -112,7 +112,7 @@ + linux,rc-map-name = "rc-geekbox"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Power Key In", +@@ -127,7 +127,7 @@ + ""; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch b/queue-4.19/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch new file mode 100644 index 00000000000..56c8424acd4 --- /dev/null +++ b/queue-4.19/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch @@ -0,0 +1,46 @@ +From d9b56bce9c6df19a6301532b026a7e3f99598084 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:47 +0100 +Subject: arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 11fa9774612decea87144d7f950a9c53a4fe3050 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 47884c5c746e ("ARM64: dts: meson-gxl-libretech-cc: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index 90a56af967a7f..b4dfb9afdef86 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -163,7 +163,7 @@ + }; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Blue LED", +@@ -178,7 +178,7 @@ + "7J1 Header Pin15"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-qcom-sdm845-mtp-mark-protected-gcc-clocks.patch b/queue-4.19/arm64-dts-qcom-sdm845-mtp-mark-protected-gcc-clocks.patch new file mode 100644 index 00000000000..0acf8739f4b --- /dev/null +++ b/queue-4.19/arm64-dts-qcom-sdm845-mtp-mark-protected-gcc-clocks.patch @@ -0,0 +1,43 @@ +From 04760e45777a137706cbd4c30a98e70a1bbbff36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Nov 2018 21:50:13 -0800 +Subject: arm64: dts: qcom: sdm845-mtp: Mark protected gcc clocks + +From: Bjorn Andersson + +[ Upstream commit d206e6b7ea3fdc8ec8f6be9a2ecfe58142b49e37 ] + +As of v4.20-rc1 probing the GCC driver on a SDM845 device with the +standard security implementation causes an access violation and an +immediate system restart. Use the protected-clocks property to mark the +offending clocks protected for the MTP, in order to allow it to boot. + +Cc: Stephen Boyd +Signed-off-by: Bjorn Andersson +Acked-by: Andy Gross +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-mtp.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +index 6921f8dc5ebbc..ea5bdda0681e6 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-mtp.dts ++++ b/arch/arm64/boot/dts/qcom/sdm845-mtp.dts +@@ -22,6 +22,12 @@ + }; + }; + ++&gcc { ++ protected-clocks = , ++ , ++ ; ++}; ++ + &i2c10 { + status = "okay"; + clock-frequency = <400000>; +-- +2.20.1 + diff --git a/queue-4.19/arm64-dts-zynqmp-fix-node-names-which-contain-_.patch b/queue-4.19/arm64-dts-zynqmp-fix-node-names-which-contain-_.patch new file mode 100644 index 00000000000..641cd14c774 --- /dev/null +++ b/queue-4.19/arm64-dts-zynqmp-fix-node-names-which-contain-_.patch @@ -0,0 +1,164 @@ +From 12dfeba43c42a5d07e1295ce62b836e66abcc4a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 10:06:53 +0100 +Subject: arm64: dts: zynqmp: Fix node names which contain "_" + +From: Michal Simek + +[ Upstream commit d1d4445abffb2b17e841d37b555b6f1364b571c1 ] + +s/_/-/ for node names. + +It fixes warnings like this: +... Warning (node_name_chars_strict): /cpu_opp_table: +Character '_' not recommended in node name ... + +Issues reported by make dtbs W=12 + +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi | 4 ++-- + arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts | 4 ++-- + arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts | 10 +++++----- + arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts | 2 +- + arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts | 2 +- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- + 6 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi +index 9c09baca7dd78..306ad2157c988 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-clk.dtsi +@@ -58,13 +58,13 @@ + clock-accuracy = <100>; + }; + +- dpdma_clk: dpdma_clk { ++ dpdma_clk: dpdma-clk { + compatible = "fixed-clock"; + #clock-cells = <0x0>; + clock-frequency = <533000000>; + }; + +- drm_clock: drm_clock { ++ drm_clock: drm-clock { + compatible = "fixed-clock"; + #clock-cells = <0x0>; + clock-frequency = <262750000>; +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts +index 8954c8c6f5475..14062b4535dd7 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu100-revC.dts +@@ -82,7 +82,7 @@ + linux,default-trigger = "bluetooth-power"; + }; + +- vbus_det { /* U5 USB5744 VBUS detection via MIO25 */ ++ vbus-det { /* U5 USB5744 VBUS detection via MIO25 */ + label = "vbus_det"; + gpios = <&gpio 25 GPIO_ACTIVE_HIGH>; + default-state = "on"; +@@ -98,7 +98,7 @@ + regulator-boot-on; + }; + +- sdio_pwrseq: sdio_pwrseq { ++ sdio_pwrseq: sdio-pwrseq { + compatible = "mmc-pwrseq-simple"; + reset-gpios = <&gpio 7 GPIO_ACTIVE_LOW>; /* WIFI_EN */ + post-power-on-delay-ms = <10>; +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts +index 25dd574853235..d3b8e1a9c0761 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu102-revA.dts +@@ -53,7 +53,7 @@ + + leds { + compatible = "gpio-leds"; +- heartbeat_led { ++ heartbeat-led { + label = "heartbeat"; + gpios = <&gpio 23 GPIO_ACTIVE_HIGH>; + linux,default-trigger = "heartbeat"; +@@ -139,25 +139,25 @@ + * 7, 10 - 17 - not connected + */ + +- gtr_sel0 { ++ gtr-sel0 { + gpio-hog; + gpios = <0 0>; + output-low; /* PCIE = 0, DP = 1 */ + line-name = "sel0"; + }; +- gtr_sel1 { ++ gtr-sel1 { + gpio-hog; + gpios = <1 0>; + output-high; /* PCIE = 0, DP = 1 */ + line-name = "sel1"; + }; +- gtr_sel2 { ++ gtr-sel2 { + gpio-hog; + gpios = <2 0>; + output-high; /* PCIE = 0, USB0 = 1 */ + line-name = "sel2"; + }; +- gtr_sel3 { ++ gtr-sel3 { + gpio-hog; + gpios = <3 0>; + output-high; /* PCIE = 0, SATA = 1 */ +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts +index 259f21b0c0014..28dee4dad82c2 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu106-revA.dts +@@ -53,7 +53,7 @@ + + leds { + compatible = "gpio-leds"; +- heartbeat_led { ++ heartbeat-led { + label = "heartbeat"; + gpios = <&gpio 23 GPIO_ACTIVE_HIGH>; + linux,default-trigger = "heartbeat"; +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts +index a61b3cc6f4c95..47b5989035e4e 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zcu111-revA.dts +@@ -53,7 +53,7 @@ + + leds { + compatible = "gpio-leds"; +- heartbeat_led { ++ heartbeat-led { + label = "heartbeat"; + gpios = <&gpio 23 GPIO_ACTIVE_HIGH>; + linux,default-trigger = "heartbeat"; +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 29ce23422acf2..a516c0e01429a 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -71,7 +71,7 @@ + }; + }; + +- cpu_opp_table: cpu_opp_table { ++ cpu_opp_table: cpu-opp-table { + compatible = "operating-points-v2"; + opp-shared; + opp00 { +@@ -124,7 +124,7 @@ + <1 10 0xf08>; + }; + +- amba_apu: amba_apu@0 { ++ amba_apu: amba-apu@0 { + compatible = "simple-bus"; + #address-cells = <2>; + #size-cells = <1>; +-- +2.20.1 + diff --git a/queue-4.19/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch b/queue-4.19/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch new file mode 100644 index 00000000000..a6df3bbe154 --- /dev/null +++ b/queue-4.19/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch @@ -0,0 +1,41 @@ +From f9887ec47ccd1955c8deb844a4f65f06b3719bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 17:47:25 +0100 +Subject: arm64: tegra: Fix power key interrupt type on Jetson TX2 + +From: Thierry Reding + +[ Upstream commit 6f13f10b3bbfed3b29c812f0f65bef802ce05e3c ] + +In order for the correct interrupt type to be configured, the event +action for the power key needs to be "asserted". + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +index bd5305a634b16..9fc577a1ec442 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +@@ -2,6 +2,7 @@ + /dts-v1/; + + #include ++#include + + #include "tegra186-p3310.dtsi" + +@@ -121,6 +122,7 @@ + linux,input-type = ; + linux,code = ; + debounce-interval = <10>; ++ wakeup-event-action = ; + wakeup-source; + }; + +-- +2.20.1 + diff --git a/queue-4.19/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch b/queue-4.19/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch new file mode 100644 index 00000000000..dd685c1cd8d --- /dev/null +++ b/queue-4.19/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch @@ -0,0 +1,41 @@ +From 67fae614a24c3fb6c4fe54b6476950944af25beb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 06:33:16 +0000 +Subject: ASoC: au8540: use 64-bit arithmetic instead of 32-bit + +From: Young_X + +[ Upstream commit cd7fdc45bc69a62b4e22c6e875f1f1aea566256d ] + +Add suffix ULL to constant 256 in order to give the compiler complete +information about the proper arithmetic to use. + +Notice that such constant is used in a context that expects an +expression of type u64 (64 bits, unsigned) and the following +expression is currently being evaluated using 32-bit arithmetic: + + 256 * fs * 2 * mclk_src_scaling[i].param + +Signed-off-by: Young_X +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8540.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c +index e3c8cd17daf2d..4dd1a609756be 100644 +--- a/sound/soc/codecs/nau8540.c ++++ b/sound/soc/codecs/nau8540.c +@@ -585,7 +585,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in, + fvco_max = 0; + fvco_sel = ARRAY_SIZE(mclk_src_scaling); + for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) { +- fvco = 256 * fs * 2 * mclk_src_scaling[i].param; ++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param; + if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX && + fvco_max < fvco) { + fvco_max = fvco; +-- +2.20.1 + diff --git a/queue-4.19/asoc-max9867-fix-power-management.patch b/queue-4.19/asoc-max9867-fix-power-management.patch new file mode 100644 index 00000000000..54204782f9f --- /dev/null +++ b/queue-4.19/asoc-max9867-fix-power-management.patch @@ -0,0 +1,162 @@ +From 2eb3c559a62ea62963da0d36a1fbea7494ac17cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 19:19:51 +0100 +Subject: ASoC: max9867: Fix power management + +From: Ladislav Michl + +[ Upstream commit 29f58ff06795a923407d011d4721eaf3e8d39acc ] + +Implement set_bias_level to drive shutdown bit, so device is +put to sleep when unused. + +Signed-off-by: Ladislav Michl +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max9867.c | 72 ++++++++++++++++++++++++-------------- + sound/soc/codecs/max9867.h | 2 +- + 2 files changed, 46 insertions(+), 28 deletions(-) + +diff --git a/sound/soc/codecs/max9867.c b/sound/soc/codecs/max9867.c +index 4ea3287162ad2..e51143df4702a 100644 +--- a/sound/soc/codecs/max9867.c ++++ b/sound/soc/codecs/max9867.c +@@ -248,17 +248,6 @@ static int max9867_dai_hw_params(struct snd_pcm_substream *substream, + return 0; + } + +-static int max9867_prepare(struct snd_pcm_substream *substream, +- struct snd_soc_dai *dai) +-{ +- struct snd_soc_component *component = dai->component; +- struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component); +- +- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN, +- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK); +- return 0; +-} +- + static int max9867_mute(struct snd_soc_dai *dai, int mute) + { + struct snd_soc_component *component = dai->component; +@@ -361,7 +350,6 @@ static int max9867_dai_set_fmt(struct snd_soc_dai *codec_dai, + static const struct snd_soc_dai_ops max9867_dai_ops = { + .set_fmt = max9867_dai_set_fmt, + .set_sysclk = max9867_set_dai_sysclk, +- .prepare = max9867_prepare, + .digital_mute = max9867_mute, + .hw_params = max9867_dai_hw_params, + }; +@@ -392,27 +380,59 @@ static struct snd_soc_dai_driver max9867_dai[] = { + } + }; + +-#ifdef CONFIG_PM_SLEEP +-static int max9867_suspend(struct device *dev) ++#ifdef CONFIG_PM ++static int max9867_suspend(struct snd_soc_component *component) + { +- struct max9867_priv *max9867 = dev_get_drvdata(dev); ++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_OFF); + +- /* Drop down to power saving mode when system is suspended */ +- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN, +- MAX9867_SHTDOWN_MASK, ~MAX9867_SHTDOWN_MASK); + return 0; + } + +-static int max9867_resume(struct device *dev) ++static int max9867_resume(struct snd_soc_component *component) + { +- struct max9867_priv *max9867 = dev_get_drvdata(dev); ++ snd_soc_component_force_bias_level(component, SND_SOC_BIAS_STANDBY); + +- regmap_update_bits(max9867->regmap, MAX9867_PWRMAN, +- MAX9867_SHTDOWN_MASK, MAX9867_SHTDOWN_MASK); + return 0; + } ++#else ++#define max9867_suspend NULL ++#define max9867_resume NULL + #endif + ++static int max9867_set_bias_level(struct snd_soc_component *component, ++ enum snd_soc_bias_level level) ++{ ++ int err; ++ struct max9867_priv *max9867 = snd_soc_component_get_drvdata(component); ++ ++ switch (level) { ++ case SND_SOC_BIAS_STANDBY: ++ if (snd_soc_component_get_bias_level(component) == SND_SOC_BIAS_OFF) { ++ err = regcache_sync(max9867->regmap); ++ if (err) ++ return err; ++ ++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN, ++ MAX9867_SHTDOWN, MAX9867_SHTDOWN); ++ if (err) ++ return err; ++ } ++ break; ++ case SND_SOC_BIAS_OFF: ++ err = regmap_update_bits(max9867->regmap, MAX9867_PWRMAN, ++ MAX9867_SHTDOWN, 0); ++ if (err) ++ return err; ++ ++ regcache_mark_dirty(max9867->regmap); ++ break; ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ + static const struct snd_soc_component_driver max9867_component = { + .controls = max9867_snd_controls, + .num_controls = ARRAY_SIZE(max9867_snd_controls), +@@ -420,6 +440,9 @@ static const struct snd_soc_component_driver max9867_component = { + .num_dapm_routes = ARRAY_SIZE(max9867_audio_map), + .dapm_widgets = max9867_dapm_widgets, + .num_dapm_widgets = ARRAY_SIZE(max9867_dapm_widgets), ++ .suspend = max9867_suspend, ++ .resume = max9867_resume, ++ .set_bias_level = max9867_set_bias_level, + .idle_bias_on = 1, + .use_pmdown_time = 1, + .endianness = 1, +@@ -518,15 +541,10 @@ static const struct of_device_id max9867_of_match[] = { + }; + MODULE_DEVICE_TABLE(of, max9867_of_match); + +-static const struct dev_pm_ops max9867_pm_ops = { +- SET_SYSTEM_SLEEP_PM_OPS(max9867_suspend, max9867_resume) +-}; +- + static struct i2c_driver max9867_i2c_driver = { + .driver = { + .name = "max9867", + .of_match_table = of_match_ptr(max9867_of_match), +- .pm = &max9867_pm_ops, + }, + .probe = max9867_i2c_probe, + .id_table = max9867_i2c_id, +diff --git a/sound/soc/codecs/max9867.h b/sound/soc/codecs/max9867.h +index 55cd9976ff47d..d9170850c96ea 100644 +--- a/sound/soc/codecs/max9867.h ++++ b/sound/soc/codecs/max9867.h +@@ -67,7 +67,7 @@ + #define MAX9867_MICCONFIG 0x15 + #define MAX9867_MODECONFIG 0x16 + #define MAX9867_PWRMAN 0x17 +-#define MAX9867_SHTDOWN_MASK (1<<7) ++#define MAX9867_SHTDOWN 0x80 + #define MAX9867_REVISION 0xff + + #define MAX9867_CACHEREGNUM 10 +-- +2.20.1 + diff --git a/queue-4.19/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch b/queue-4.19/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch new file mode 100644 index 00000000000..f2d22e7e81d --- /dev/null +++ b/queue-4.19/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch @@ -0,0 +1,98 @@ +From 8de9a18f8121c327f46182e247f4ae04354c2eaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 07:35:34 +0000 +Subject: ASoC: rsnd: tidyup registering method for rsnd_kctrl_new() + +From: Kuninori Morimoto + +[ Upstream commit 9c698e8481a15237a5b1db5f8391dd66d59e42a4 ] + +Current rsnd dvc.c is using flags to avoid duplicating register for +MIXer case. OTOH, commit e894efef9ac7 ("ASoC: core: add support to card +rebind") allows to rebind sound card without rebinding all drivers. + +Because of above patch and dvc.c flags, it can't re-register kctrl if +only sound card was rebinded, because dvc is keeping old flags. +(Of course it will be no problem if rsnd driver also be rebinded, +but it is not purpose of above patch). + +This patch checks current card registered kctrl when registering. +In MIXer case, it can avoid duplicate register if card already has same +kctrl. In rebind case, it can re-register kctrl because card registered +kctl had been removed when unbinding. + +This patch is updated version of commit b918f1bc7f1ce ("ASoC: rsnd: DVC +kctrl sets once") + +Reported-by: Nguyen Viet Dung +Signed-off-by: Kuninori Morimoto +Tested-by: Nguyen Viet Dung +Cc: Hiroyuki Yokoyama +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 12 ++++++++++++ + sound/soc/sh/rcar/dvc.c | 8 -------- + 2 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 15a31820df169..99cd52b9ff228 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1344,6 +1344,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod, + }; + int ret; + ++ /* ++ * 1) Avoid duplicate register (ex. MIXer case) ++ * 2) re-register if card was rebinded ++ */ ++ list_for_each_entry(kctrl, &card->controls, list) { ++ struct rsnd_kctrl_cfg *c = kctrl->private_data; ++ ++ if (strcmp(kctrl->id.name, name) == 0 && ++ c->mod == mod) ++ return 0; ++ } ++ + if (size > RSND_MAX_CHANNELS) + return -EINVAL; + +diff --git a/sound/soc/sh/rcar/dvc.c b/sound/soc/sh/rcar/dvc.c +index 2b16e0ce6bc53..024ece46bf685 100644 +--- a/sound/soc/sh/rcar/dvc.c ++++ b/sound/soc/sh/rcar/dvc.c +@@ -40,11 +40,8 @@ struct rsnd_dvc { + struct rsnd_kctrl_cfg_s ren; /* Ramp Enable */ + struct rsnd_kctrl_cfg_s rup; /* Ramp Rate Up */ + struct rsnd_kctrl_cfg_s rdown; /* Ramp Rate Down */ +- u32 flags; + }; + +-#define KCTRL_INITIALIZED (1 << 0) +- + #define rsnd_dvc_get(priv, id) ((struct rsnd_dvc *)(priv->dvc) + id) + #define rsnd_dvc_nr(priv) ((priv)->dvc_nr) + +@@ -227,9 +224,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod, + int channels = rsnd_rdai_channels_get(rdai); + int ret; + +- if (rsnd_flags_has(dvc, KCTRL_INITIALIZED)) +- return 0; +- + /* Volume */ + ret = rsnd_kctrl_new_m(mod, io, rtd, + is_play ? +@@ -285,8 +279,6 @@ static int rsnd_dvc_pcm_new(struct rsnd_mod *mod, + if (ret < 0) + return ret; + +- rsnd_flags_set(dvc, KCTRL_INITIALIZED); +- + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/audit-embed-key-into-chunk.patch b/queue-4.19/audit-embed-key-into-chunk.patch new file mode 100644 index 00000000000..8aa42511bab --- /dev/null +++ b/queue-4.19/audit-embed-key-into-chunk.patch @@ -0,0 +1,143 @@ +From 90f6029f9c6f4abdc2cfe9ac1dad5195de3c8810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 09:54:48 -0500 +Subject: audit: Embed key into chunk + +From: Jan Kara + +[ Upstream commit 8d20d6e9301d7b3777d66d47dd5b89acd645cd39 ] + +Currently chunk hash key (which is in fact pointer to the inode) is +derived as chunk->mark.conn->obj. It is tricky to make this dereference +reliable for hash table lookups only under RCU as mark can get detached +from the connector and connector gets freed independently of the +running lookup. Thus there is a possible use after free / NULL ptr +dereference issue: + +CPU1 CPU2 + untag_chunk() + ... +audit_tree_lookup() + list_for_each_entry_rcu(p, list, hash) { + list_del_rcu(&chunk->hash); + fsnotify_destroy_mark(entry); + fsnotify_put_mark(entry) + chunk_to_key(p) + if (!chunk->mark.connector) + ... + hlist_del_init_rcu(&mark->obj_list); + if (hlist_empty(&conn->list)) { + inode = fsnotify_detach_connector_from_object(conn); + mark->connector = NULL; + ... + frees connector from workqueue + chunk->mark.connector->obj + +This race is probably impossible to hit in practice as the race window +on CPU1 is very narrow and CPU2 has a lot of code to execute. Still it's +better to have this fixed. Since the inode the chunk is attached to is +constant during chunk's lifetime it is easy to cache the key in the +chunk itself and thus avoid these issues. + +Reviewed-by: Richard Guy Briggs +Signed-off-by: Jan Kara +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/audit_tree.c | 27 ++++++++------------------- + 1 file changed, 8 insertions(+), 19 deletions(-) + +diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c +index ea43181cde4a2..04f59dfd3e71f 100644 +--- a/kernel/audit_tree.c ++++ b/kernel/audit_tree.c +@@ -24,6 +24,7 @@ struct audit_tree { + + struct audit_chunk { + struct list_head hash; ++ unsigned long key; + struct fsnotify_mark mark; + struct list_head trees; /* with root here */ + int dead; +@@ -172,21 +173,6 @@ static unsigned long inode_to_key(const struct inode *inode) + return (unsigned long)&inode->i_fsnotify_marks; + } + +-/* +- * Function to return search key in our hash from chunk. Key 0 is special and +- * should never be present in the hash. +- */ +-static unsigned long chunk_to_key(struct audit_chunk *chunk) +-{ +- /* +- * We have a reference to the mark so it should be attached to a +- * connector. +- */ +- if (WARN_ON_ONCE(!chunk->mark.connector)) +- return 0; +- return (unsigned long)chunk->mark.connector->obj; +-} +- + static inline struct list_head *chunk_hash(unsigned long key) + { + unsigned long n = key / L1_CACHE_BYTES; +@@ -196,12 +182,12 @@ static inline struct list_head *chunk_hash(unsigned long key) + /* hash_lock & entry->lock is held by caller */ + static void insert_hash(struct audit_chunk *chunk) + { +- unsigned long key = chunk_to_key(chunk); + struct list_head *list; + + if (!(chunk->mark.flags & FSNOTIFY_MARK_FLAG_ATTACHED)) + return; +- list = chunk_hash(key); ++ WARN_ON_ONCE(!chunk->key); ++ list = chunk_hash(chunk->key); + list_add_rcu(&chunk->hash, list); + } + +@@ -213,7 +199,7 @@ struct audit_chunk *audit_tree_lookup(const struct inode *inode) + struct audit_chunk *p; + + list_for_each_entry_rcu(p, list, hash) { +- if (chunk_to_key(p) == key) { ++ if (p->key == key) { + atomic_long_inc(&p->refs); + return p; + } +@@ -297,6 +283,7 @@ static void untag_chunk(struct node *p) + + chunk->dead = 1; + spin_lock(&hash_lock); ++ new->key = chunk->key; + list_replace_init(&chunk->trees, &new->trees); + if (owner->root == chunk) { + list_del_init(&owner->same_root); +@@ -378,6 +365,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree) + tree->root = chunk; + list_add(&tree->same_root, &chunk->trees); + } ++ chunk->key = inode_to_key(inode); + insert_hash(chunk); + spin_unlock(&hash_lock); + spin_unlock(&entry->lock); +@@ -462,6 +450,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree) + fsnotify_put_mark(old_entry); + return 0; + } ++ chunk->key = old->key; + list_replace_init(&old->trees, &chunk->trees); + for (n = 0, p = chunk->owners; n < old->count; n++, p++) { + struct audit_tree *s = old->owners[n].owner; +@@ -661,7 +650,7 @@ void audit_trim_trees(void) + /* this could be NULL if the watch is dying else where... */ + node->index |= 1U<<31; + if (iterate_mounts(compare_root, +- (void *)chunk_to_key(chunk), ++ (void *)(chunk->key), + root_mnt)) + node->index &= ~(1U<<31); + } +-- +2.20.1 + diff --git a/queue-4.19/audit_get_nd-don-t-unlock-parent-too-early.patch b/queue-4.19/audit_get_nd-don-t-unlock-parent-too-early.patch new file mode 100644 index 00000000000..0f8c89746f9 --- /dev/null +++ b/queue-4.19/audit_get_nd-don-t-unlock-parent-too-early.patch @@ -0,0 +1,40 @@ +From 169a4fdff86052f9d75be28dbe2b1b8ae56bca52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2019 13:11:41 -0400 +Subject: audit_get_nd(): don't unlock parent too early + +From: Al Viro + +[ Upstream commit 69924b89687a2923e88cc42144aea27868913d0e ] + +if the child has been negative and just went positive +under us, we want coherent d_is_positive() and ->d_inode. +Don't unlock the parent until we'd done that work... + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + kernel/audit_watch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index 787c7afdf8294..4f7262eba73d8 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -366,12 +366,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent) + struct dentry *d = kern_path_locked(watch->path, parent); + if (IS_ERR(d)) + return PTR_ERR(d); +- inode_unlock(d_backing_inode(parent->dentry)); + if (d_is_positive(d)) { + /* update watch filter fields */ + watch->dev = d->d_sb->s_dev; + watch->ino = d_backing_inode(d)->i_ino; + } ++ inode_unlock(d_backing_inode(parent->dentry)); + dput(d); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.19/autofs-fix-a-leak-in-autofs_expire_indirect.patch b/queue-4.19/autofs-fix-a-leak-in-autofs_expire_indirect.patch new file mode 100644 index 00000000000..00a05bdb071 --- /dev/null +++ b/queue-4.19/autofs-fix-a-leak-in-autofs_expire_indirect.patch @@ -0,0 +1,39 @@ +From 96a2be4902dea67c66ece5e01d3d6fed4582c844 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 00:03:11 -0400 +Subject: autofs: fix a leak in autofs_expire_indirect() + +From: Al Viro + +[ Upstream commit 03ad0d703df75c43f78bd72e16124b5b94a95188 ] + +if the second call of should_expire() in there ends up +grabbing and returning a new reference to dentry, we need +to drop it before continuing. + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/autofs/expire.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/autofs/expire.c b/fs/autofs/expire.c +index 28d9c2b1b3bb3..70e9afe589fbf 100644 +--- a/fs/autofs/expire.c ++++ b/fs/autofs/expire.c +@@ -501,9 +501,10 @@ static struct dentry *autofs_expire_indirect(struct super_block *sb, + */ + how &= ~AUTOFS_EXP_LEAVES; + found = should_expire(expired, mnt, timeout, how); +- if (!found || found != expired) +- /* Something has changed, continue */ ++ if (found != expired) { // something has changed, continue ++ dput(found); + goto next; ++ } + + if (expired != dentry) + dput(dentry); +-- +2.20.1 + diff --git a/queue-4.19/bpf-arm64-fix-getting-subprog-addr-from-aux-for-call.patch b/queue-4.19/bpf-arm64-fix-getting-subprog-addr-from-aux-for-call.patch new file mode 100644 index 00000000000..c060eaac9c5 --- /dev/null +++ b/queue-4.19/bpf-arm64-fix-getting-subprog-addr-from-aux-for-call.patch @@ -0,0 +1,105 @@ +From b768ee87c27bcc6de62befc5c8caea67ddcae0b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 14:05:39 +0100 +Subject: bpf, arm64: fix getting subprog addr from aux for calls + +From: Daniel Borkmann + +[ Upstream commit 8c11ea5ce13da0252fc92f91e90b0cb0c8fe5619 ] + +The arm64 JIT has the same issue as ppc64 JIT in that the relative BPF +to BPF call offset can be too far away from core kernel in that relative +encoding into imm is not sufficient and could potentially be truncated, +see also fd045f6cd98e ("arm64: add support for module PLTs") which adds +spill-over space for module_alloc() and therefore bpf_jit_binary_alloc(). +Therefore, use the recently added bpf_jit_get_func_addr() helper for +properly fetching the address through prog->aux->func[off]->bpf_func +instead. This also has the benefit to optimize normal helper calls since +their address can use the optimized emission. Tested on Cavium ThunderX +CN8890. + +Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") +Signed-off-by: Daniel Borkmann +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 7f0258ed1f5fe..722b7cdb5892b 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -351,7 +351,8 @@ static void build_epilogue(struct jit_ctx *ctx) + * >0 - successfully JITed a 16-byte eBPF instruction. + * <0 - failed to JIT. + */ +-static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) ++static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, ++ bool extra_pass) + { + const u8 code = insn->code; + const u8 dst = bpf2a64[insn->dst_reg]; +@@ -625,12 +626,19 @@ emit_cond_jmp: + case BPF_JMP | BPF_CALL: + { + const u8 r0 = bpf2a64[BPF_REG_0]; +- const u64 func = (u64)__bpf_call_base + imm; ++ bool func_addr_fixed; ++ u64 func_addr; ++ int ret; + +- if (ctx->prog->is_func) +- emit_addr_mov_i64(tmp, func, ctx); ++ ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, ++ &func_addr, &func_addr_fixed); ++ if (ret < 0) ++ return ret; ++ if (func_addr_fixed) ++ /* We can use optimized emission here. */ ++ emit_a64_mov_i64(tmp, func_addr, ctx); + else +- emit_a64_mov_i64(tmp, func, ctx); ++ emit_addr_mov_i64(tmp, func_addr, ctx); + emit(A64_BLR(tmp), ctx); + emit(A64_MOV(1, r0, A64_R(0)), ctx); + break; +@@ -762,7 +770,7 @@ emit_cond_jmp: + return 0; + } + +-static int build_body(struct jit_ctx *ctx) ++static int build_body(struct jit_ctx *ctx, bool extra_pass) + { + const struct bpf_prog *prog = ctx->prog; + int i; +@@ -771,7 +779,7 @@ static int build_body(struct jit_ctx *ctx) + const struct bpf_insn *insn = &prog->insnsi[i]; + int ret; + +- ret = build_insn(insn, ctx); ++ ret = build_insn(insn, ctx, extra_pass); + if (ret > 0) { + i++; + if (ctx->image == NULL) +@@ -867,7 +875,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + /* 1. Initial fake pass to compute ctx->idx. */ + + /* Fake pass to fill in ctx->offset. */ +- if (build_body(&ctx)) { ++ if (build_body(&ctx, extra_pass)) { + prog = orig_prog; + goto out_off; + } +@@ -897,7 +905,7 @@ skip_init_ctx: + + build_prologue(&ctx, was_classic); + +- if (build_body(&ctx)) { ++ if (build_body(&ctx, extra_pass)) { + bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; +-- +2.20.1 + diff --git a/queue-4.19/bpf-btf-check-name-validity-for-various-types.patch b/queue-4.19/bpf-btf-check-name-validity-for-various-types.patch new file mode 100644 index 00000000000..fe7316619f8 --- /dev/null +++ b/queue-4.19/bpf-btf-check-name-validity-for-various-types.patch @@ -0,0 +1,146 @@ +From ac654f6e35d5412da06475900e37a5f9da505115 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 13:23:28 -0800 +Subject: bpf: btf: check name validity for various types + +From: Yonghong Song + +[ Upstream commit eb04bbb608e683f8fd3ef7f716e2fa32dd90861f ] + +This patch added name checking for the following types: + . BTF_KIND_PTR, BTF_KIND_ARRAY, BTF_KIND_VOLATILE, + BTF_KIND_CONST, BTF_KIND_RESTRICT: + the name must be null + . BTF_KIND_STRUCT, BTF_KIND_UNION: the struct/member name + is either null or a valid identifier + . BTF_KIND_ENUM: the enum type name is either null or a valid + identifier; the enumerator name must be a valid identifier. + . BTF_KIND_FWD: the name must be a valid identifier + . BTF_KIND_TYPEDEF: the name must be a valid identifier + +For those places a valid name is required, the name must be +a valid C identifier. This can be relaxed later if we found +use cases for a different (non-C) frontend. + +Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") +Acked-by: Martin KaFai Lau +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 57 ++++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 57 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index f0f9109f59bac..3e2413345e718 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -1168,6 +1168,22 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* typedef type must have a valid name, and other ref types, ++ * volatile, const, restrict, should have a null name. ++ */ ++ if (BTF_INFO_KIND(t->info) == BTF_KIND_TYPEDEF) { ++ if (!t->name_off || ++ !btf_name_valid_identifier(env->btf, t->name_off)) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ } else { ++ if (t->name_off) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ } ++ + btf_verifier_log_type(env, t, NULL); + + return 0; +@@ -1325,6 +1341,13 @@ static s32 btf_fwd_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* fwd type must have a valid name */ ++ if (!t->name_off || ++ !btf_name_valid_identifier(env->btf, t->name_off)) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ + btf_verifier_log_type(env, t, NULL); + + return 0; +@@ -1381,6 +1404,12 @@ static s32 btf_array_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* array type should not have a name */ ++ if (t->name_off) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ + if (btf_type_vlen(t)) { + btf_verifier_log_type(env, t, "vlen != 0"); + return -EINVAL; +@@ -1557,6 +1586,13 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* struct type either no name or a valid one */ ++ if (t->name_off && ++ !btf_name_valid_identifier(env->btf, t->name_off)) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ + btf_verifier_log_type(env, t, NULL); + + last_offset = 0; +@@ -1568,6 +1604,12 @@ static s32 btf_struct_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* struct member either no name or a valid one */ ++ if (member->name_off && ++ !btf_name_valid_identifier(btf, member->name_off)) { ++ btf_verifier_log_member(env, t, member, "Invalid name"); ++ return -EINVAL; ++ } + /* A member cannot be in type void */ + if (!member->type || !BTF_TYPE_ID_VALID(member->type)) { + btf_verifier_log_member(env, t, member, +@@ -1755,6 +1797,13 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* enum type either no name or a valid one */ ++ if (t->name_off && ++ !btf_name_valid_identifier(env->btf, t->name_off)) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ + btf_verifier_log_type(env, t, NULL); + + for (i = 0; i < nr_enums; i++) { +@@ -1764,6 +1813,14 @@ static s32 btf_enum_check_meta(struct btf_verifier_env *env, + return -EINVAL; + } + ++ /* enum member must have a valid name */ ++ if (!enums[i].name_off || ++ !btf_name_valid_identifier(btf, enums[i].name_off)) { ++ btf_verifier_log_type(env, t, "Invalid name"); ++ return -EINVAL; ++ } ++ ++ + btf_verifier_log(env, "\t%s val=%d\n", + btf_name_by_offset(btf, enums[i].name_off), + enums[i].val); +-- +2.20.1 + diff --git a/queue-4.19/bpf-btf-implement-btf_name_valid_identifier.patch b/queue-4.19/bpf-btf-implement-btf_name_valid_identifier.patch new file mode 100644 index 00000000000..d60e652bd21 --- /dev/null +++ b/queue-4.19/bpf-btf-implement-btf_name_valid_identifier.patch @@ -0,0 +1,68 @@ +From f581dafb0e98a809f56c811bdc3281e1f0cbc50c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 13:23:27 -0800 +Subject: bpf: btf: implement btf_name_valid_identifier() + +From: Yonghong Song + +[ Upstream commit cdbb096adddb3f42584cecb5ec2e07c26815b71f ] + +Function btf_name_valid_identifier() have been implemented in +bpf-next commit 2667a2626f4d ("bpf: btf: Add BTF_KIND_FUNC and +BTF_KIND_FUNC_PROTO"). Backport this function so later patch +can use it. + +Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)") +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index cfa27b7d1168c..f0f9109f59bac 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -426,6 +427,30 @@ static bool btf_name_offset_valid(const struct btf *btf, u32 offset) + offset < btf->hdr.str_len; + } + ++/* Only C-style identifier is permitted. This can be relaxed if ++ * necessary. ++ */ ++static bool btf_name_valid_identifier(const struct btf *btf, u32 offset) ++{ ++ /* offset must be valid */ ++ const char *src = &btf->strings[offset]; ++ const char *src_limit; ++ ++ if (!isalpha(*src) && *src != '_') ++ return false; ++ ++ /* set a limit on identifier length */ ++ src_limit = src + KSYM_NAME_LEN; ++ src++; ++ while (*src && src < src_limit) { ++ if (!isalnum(*src) && *src != '_') ++ return false; ++ src++; ++ } ++ ++ return !*src; ++} ++ + static const char *btf_name_by_offset(const struct btf *btf, u32 offset) + { + if (!offset) +-- +2.20.1 + diff --git a/queue-4.19/bus-ti-sysc-fix-getting-optional-clocks-in-clock_rol.patch b/queue-4.19/bus-ti-sysc-fix-getting-optional-clocks-in-clock_rol.patch new file mode 100644 index 00000000000..6c3f4d23999 --- /dev/null +++ b/queue-4.19/bus-ti-sysc-fix-getting-optional-clocks-in-clock_rol.patch @@ -0,0 +1,43 @@ +From 042e1380a706d016779220e50dcf937079a4d7c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 14:46:52 -0800 +Subject: bus: ti-sysc: Fix getting optional clocks in clock_roles + +From: Tony Lindgren + +[ Upstream commit 7b4f8ac2f1acdff3c0cce23d8c3b86434a6e768a ] + +We can have holes in clock_roles with interface clock missing for +example. Currently getting an optional clock will fail if there are +only a functional clock and an optional clock. + +Fixes: 09dfe5810762 ("bus: ti-sysc: Add handling for clkctrl opt clocks") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 5b31131d0cba2..b6f63e7620214 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -217,8 +217,13 @@ static int sysc_get_clocks(struct sysc *ddata) + if (!ddata->clocks) + return -ENOMEM; + +- for (i = 0; i < ddata->nr_clocks; i++) { +- error = sysc_get_one_clock(ddata, ddata->clock_roles[i]); ++ for (i = 0; i < SYSC_MAX_CLOCKS; i++) { ++ const char *name = ddata->clock_roles[i]; ++ ++ if (!name) ++ continue; ++ ++ error = sysc_get_one_clock(ddata, name); + if (error && error != -ENOENT) + return error; + } +-- +2.20.1 + diff --git a/queue-4.19/can-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch b/queue-4.19/can-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch new file mode 100644 index 00000000000..6388e40ecdc --- /dev/null +++ b/queue-4.19/can-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch @@ -0,0 +1,39 @@ +From eb7e6c52b64822fe0a8681544ee167ccfe0dcf0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 18:32:29 +0800 +Subject: can: xilinx: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit 81de0cd60fd492575b24d97667f38b8b833fb058 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/xilinx_can.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 3df23487487f7..b01c6da4dd814 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -612,7 +612,7 @@ static int xcan_start_xmit_mailbox(struct sk_buff *skb, struct net_device *ndev) + * + * Return: NETDEV_TX_OK on success and NETDEV_TX_BUSY when the tx queue is full + */ +-static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) ++static netdev_tx_t xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + { + struct xcan_priv *priv = netdev_priv(ndev); + int ret; +-- +2.20.1 + diff --git a/queue-4.19/clk-mediatek-drop-more-__init-markings-for-driver-pr.patch b/queue-4.19/clk-mediatek-drop-more-__init-markings-for-driver-pr.patch new file mode 100644 index 00000000000..461e7648c1c --- /dev/null +++ b/queue-4.19/clk-mediatek-drop-more-__init-markings-for-driver-pr.patch @@ -0,0 +1,50 @@ +From 0e6de807e239ddeca65152571347fef67537fcd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 00:36:33 -0800 +Subject: clk: mediatek: Drop more __init markings for driver probe + +From: Stephen Boyd + +[ Upstream commit 553604c041b8c18cd6a8e1d785a77f3e4be61cdb ] + +This function is called from driver probe, which isn't the same as +__init code because driver probe can happen later. Drop the __init +marking here to fix this potential problem. + +Cc: Sean Wang +Cc: Ryder Lee +Cc: Rob Herring +Cc: Wenzhen Yu +Cc: Weiyi Lu +Fixes: 2fc0a509e4ee ("clk: mediatek: add clock support for MT7622 SoC") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt7622.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mediatek/clk-mt7622.c b/drivers/clk/mediatek/clk-mt7622.c +index 92f7e32770c6a..a8aecef1ba89a 100644 +--- a/drivers/clk/mediatek/clk-mt7622.c ++++ b/drivers/clk/mediatek/clk-mt7622.c +@@ -513,7 +513,7 @@ static const struct mtk_gate peri_clks[] = { + GATE_PERI1(CLK_PERI_IRTX_PD, "peri_irtx_pd", "irtx_sel", 2), + }; + +-static struct mtk_composite infra_muxes[] __initdata = { ++static struct mtk_composite infra_muxes[] = { + MUX(CLK_INFRA_MUX1_SEL, "infra_mux1_sel", infra_mux1_parents, + 0x000, 2, 2), + }; +@@ -652,7 +652,7 @@ static int mtk_topckgen_init(struct platform_device *pdev) + return of_clk_add_provider(node, of_clk_src_onecell_get, clk_data); + } + +-static int __init mtk_infrasys_init(struct platform_device *pdev) ++static int mtk_infrasys_init(struct platform_device *pdev) + { + struct device_node *node = pdev->dev.of_node; + struct clk_onecell_data *clk_data; +-- +2.20.1 + diff --git a/queue-4.19/clk-meson-fix-gxl-hdmi-pll-fractional-bits-width.patch b/queue-4.19/clk-meson-fix-gxl-hdmi-pll-fractional-bits-width.patch new file mode 100644 index 00000000000..06ad8d59968 --- /dev/null +++ b/queue-4.19/clk-meson-fix-gxl-hdmi-pll-fractional-bits-width.patch @@ -0,0 +1,51 @@ +From 76a256bf18a2a841a9205a6f08be4e9bb0fb0a4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 12:19:22 +0100 +Subject: clk: meson: Fix GXL HDMI PLL fractional bits width + +From: Neil Armstrong + +[ Upstream commit 21310c39ec01e82ef3ef9bf8ac385b53ccdc158c ] + +The GXL Documentation specifies 12 bits for the Fractional bit field, +bit the last bits have a different purpose that we cannot handle right +now, so update the bitwidth to have correct fractional calculations. + +Signed-off-by: Neil Armstrong +[narmstrong: added comment on GXL HHI_HDMI_PLL_CNTL register shift] +Acked-by: Martin Blumenstingl +Link: https://lkml.kernel.org/r/20181121111922.1277-1-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/gxbb.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index d94b65061b9f1..b039909e03cf8 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -295,6 +295,12 @@ static struct clk_regmap gxl_hdmi_pll = { + .shift = 9, + .width = 5, + }, ++ /* ++ * On gxl, there is a register shift due to ++ * HHI_HDMI_PLL_CNTL1 which does not exist on gxbb, ++ * so we use the HHI_HDMI_PLL_CNTL2 define from GXBB ++ * instead which is defined at the same offset. ++ */ + .frac = { + /* + * On gxl, there is a register shift due to +@@ -304,7 +310,7 @@ static struct clk_regmap gxl_hdmi_pll = { + */ + .reg_off = HHI_HDMI_PLL_CNTL + 4, + .shift = 0, +- .width = 12, ++ .width = 10, + }, + .od = { + .reg_off = HHI_HDMI_PLL_CNTL + 8, +-- +2.20.1 + diff --git a/queue-4.19/clk-meson-meson8b-fix-the-offset-of-vid_pll_dco-s-n-.patch b/queue-4.19/clk-meson-meson8b-fix-the-offset-of-vid_pll_dco-s-n-.patch new file mode 100644 index 00000000000..39b64cf0bdf --- /dev/null +++ b/queue-4.19/clk-meson-meson8b-fix-the-offset-of-vid_pll_dco-s-n-.patch @@ -0,0 +1,42 @@ +From 06c777e73f6344d25e3d7907a0ee80f877c3e088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Dec 2018 22:42:18 +0100 +Subject: clk: meson: meson8b: fix the offset of vid_pll_dco's N value + +From: Martin Blumenstingl + +[ Upstream commit 376d8c45bd6ac79f02ecf9ca1606dc5d1b271bc0 ] + +Unlike the other PLLs on Meson8b the N value "vid_pll_dco" (a better +name would be hdmi_pll_dco or - as the datasheet calls it - HPLL) is +located at HHI_VID_PLL_CNTL[14:10] instead of [13:9]. +This results in an incorrect calculation of the rate of this PLL because +the value seen by the kernel is double the actual N (divider) value. +Update the offset of the N value to fix the calculation of the PLL rate. + +Fixes: 28b9fcd016126e ("clk: meson8b: Add support for Meson8b clocks") +Reported-by: Jianxin Pan +Signed-off-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lkml.kernel.org/r/20181202214220.7715-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/meson8b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 9d79ff857d83e..e90af556ff90f 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -144,7 +144,7 @@ static struct clk_regmap meson8b_vid_pll = { + }, + .n = { + .reg_off = HHI_VID_PLL_CNTL, +- .shift = 9, ++ .shift = 10, + .width = 5, + }, + .od = { +-- +2.20.1 + diff --git a/queue-4.19/clk-qcom-fix-msm8998-resets.patch b/queue-4.19/clk-qcom-fix-msm8998-resets.patch new file mode 100644 index 00000000000..da5e7288f9d --- /dev/null +++ b/queue-4.19/clk-qcom-fix-msm8998-resets.patch @@ -0,0 +1,73 @@ +From 381bcfff7d5794e5b9cc1bc2123c769abc6e4b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 09:13:43 -0700 +Subject: clk: qcom: Fix MSM8998 resets + +From: Jeffrey Hugo + +[ Upstream commit 4f89f7b59a6ea17e81cff212c18a0b580ff5ff27 ] + +The offsets for the defined BCR reset registers does not match the hardware +documentation. Update the values to match the hardware documentation. + +Fixes: b5f5f525c547 (clk: qcom: Add MSM8998 Global Clock Control (GCC) driver) +Signed-off-by: Jeffrey Hugo +Reviewed-by: Bjorn Andersson +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8998.c | 38 +++++++++++++++++----------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c +index cd937ce6aaaf6..5fd6662a1beac 100644 +--- a/drivers/clk/qcom/gcc-msm8998.c ++++ b/drivers/clk/qcom/gcc-msm8998.c +@@ -2743,25 +2743,25 @@ static struct gdsc *gcc_msm8998_gdscs[] = { + }; + + static const struct qcom_reset_map gcc_msm8998_resets[] = { +- [GCC_BLSP1_QUP1_BCR] = { 0x102400 }, +- [GCC_BLSP1_QUP2_BCR] = { 0x110592 }, +- [GCC_BLSP1_QUP3_BCR] = { 0x118784 }, +- [GCC_BLSP1_QUP4_BCR] = { 0x126976 }, +- [GCC_BLSP1_QUP5_BCR] = { 0x135168 }, +- [GCC_BLSP1_QUP6_BCR] = { 0x143360 }, +- [GCC_BLSP2_QUP1_BCR] = { 0x155648 }, +- [GCC_BLSP2_QUP2_BCR] = { 0x163840 }, +- [GCC_BLSP2_QUP3_BCR] = { 0x172032 }, +- [GCC_BLSP2_QUP4_BCR] = { 0x180224 }, +- [GCC_BLSP2_QUP5_BCR] = { 0x188416 }, +- [GCC_BLSP2_QUP6_BCR] = { 0x196608 }, +- [GCC_PCIE_0_BCR] = { 0x438272 }, +- [GCC_PDM_BCR] = { 0x208896 }, +- [GCC_SDCC2_BCR] = { 0x81920 }, +- [GCC_SDCC4_BCR] = { 0x90112 }, +- [GCC_TSIF_BCR] = { 0x221184 }, +- [GCC_UFS_BCR] = { 0x479232 }, +- [GCC_USB_30_BCR] = { 0x61440 }, ++ [GCC_BLSP1_QUP1_BCR] = { 0x19000 }, ++ [GCC_BLSP1_QUP2_BCR] = { 0x1b000 }, ++ [GCC_BLSP1_QUP3_BCR] = { 0x1d000 }, ++ [GCC_BLSP1_QUP4_BCR] = { 0x1f000 }, ++ [GCC_BLSP1_QUP5_BCR] = { 0x21000 }, ++ [GCC_BLSP1_QUP6_BCR] = { 0x23000 }, ++ [GCC_BLSP2_QUP1_BCR] = { 0x26000 }, ++ [GCC_BLSP2_QUP2_BCR] = { 0x28000 }, ++ [GCC_BLSP2_QUP3_BCR] = { 0x2a000 }, ++ [GCC_BLSP2_QUP4_BCR] = { 0x2c000 }, ++ [GCC_BLSP2_QUP5_BCR] = { 0x2e000 }, ++ [GCC_BLSP2_QUP6_BCR] = { 0x30000 }, ++ [GCC_PCIE_0_BCR] = { 0x6b000 }, ++ [GCC_PDM_BCR] = { 0x33000 }, ++ [GCC_SDCC2_BCR] = { 0x14000 }, ++ [GCC_SDCC4_BCR] = { 0x16000 }, ++ [GCC_TSIF_BCR] = { 0x36000 }, ++ [GCC_UFS_BCR] = { 0x75000 }, ++ [GCC_USB_30_BCR] = { 0xf000 }, + }; + + static const struct regmap_config gcc_msm8998_regmap_config = { +-- +2.20.1 + diff --git a/queue-4.19/clk-qcom-gcc-msm8998-disable-halt-check-of-ufs-clock.patch b/queue-4.19/clk-qcom-gcc-msm8998-disable-halt-check-of-ufs-clock.patch new file mode 100644 index 00000000000..ff944569181 --- /dev/null +++ b/queue-4.19/clk-qcom-gcc-msm8998-disable-halt-check-of-ufs-clock.patch @@ -0,0 +1,54 @@ +From 5ebfdc8b653e454ec1da801676ea70fb5f338fd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 10:33:29 -0800 +Subject: clk: qcom: gcc-msm8998: Disable halt check of UFS clocks + +From: Bjorn Andersson + +[ Upstream commit 2abf856202fd3e4883e4c518acaa9a023b0dbe54 ] + +Drop the halt check of the UFS symbol clocks, in accordance with other +platforms. This makes clk_disable_unused() happy and makes it possible +to turn the clocks on again without an error. + +Signed-off-by: Bjorn Andersson +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8998.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c +index 5fd6662a1beac..4e23973b6cd16 100644 +--- a/drivers/clk/qcom/gcc-msm8998.c ++++ b/drivers/clk/qcom/gcc-msm8998.c +@@ -2402,7 +2402,7 @@ static struct clk_branch gcc_ufs_phy_aux_clk = { + + static struct clk_branch gcc_ufs_rx_symbol_0_clk = { + .halt_reg = 0x75014, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x75014, + .enable_mask = BIT(0), +@@ -2415,7 +2415,7 @@ static struct clk_branch gcc_ufs_rx_symbol_0_clk = { + + static struct clk_branch gcc_ufs_rx_symbol_1_clk = { + .halt_reg = 0x7605c, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x7605c, + .enable_mask = BIT(0), +@@ -2428,7 +2428,7 @@ static struct clk_branch gcc_ufs_rx_symbol_1_clk = { + + static struct clk_branch gcc_ufs_tx_symbol_0_clk = { + .halt_reg = 0x75010, +- .halt_check = BRANCH_HALT, ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x75010, + .enable_mask = BIT(0), +-- +2.20.1 + diff --git a/queue-4.19/clk-renesas-r8a77990-correct-parent-clock-of-du.patch b/queue-4.19/clk-renesas-r8a77990-correct-parent-clock-of-du.patch new file mode 100644 index 00000000000..c36d3302f61 --- /dev/null +++ b/queue-4.19/clk-renesas-r8a77990-correct-parent-clock-of-du.patch @@ -0,0 +1,40 @@ +From d5cca48e90dc16d96106089cd573e9cd4cac426e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 16:48:34 +0900 +Subject: clk: renesas: r8a77990: Correct parent clock of DU + +From: Takeshi Kihara + +[ Upstream commit 7cf3a216a2b3a672cad3e498c186c9333bdff90a ] + +According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock +of the DU module clocks on R-Car E3 is S1D1. + +Signed-off-by: Takeshi Kihara +Fixes: 3570a2af473789c5 ("clk: renesas: cpg-mssr: Add support for R-Car E3") +Signed-off-by: Geert Uytterhoeven +Acked-by: Stephen Boyd +Reviewed-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a77990-cpg-mssr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/r8a77990-cpg-mssr.c b/drivers/clk/renesas/r8a77990-cpg-mssr.c +index 9e14f1486fbb9..81569767025cc 100644 +--- a/drivers/clk/renesas/r8a77990-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a77990-cpg-mssr.c +@@ -175,8 +175,8 @@ static const struct mssr_mod_clk r8a77990_mod_clks[] __initconst = { + DEF_MOD("ehci0", 703, R8A77990_CLK_S3D4), + DEF_MOD("hsusb", 704, R8A77990_CLK_S3D4), + DEF_MOD("csi40", 716, R8A77990_CLK_CSI0), +- DEF_MOD("du1", 723, R8A77990_CLK_S2D1), +- DEF_MOD("du0", 724, R8A77990_CLK_S2D1), ++ DEF_MOD("du1", 723, R8A77990_CLK_S1D1), ++ DEF_MOD("du0", 724, R8A77990_CLK_S1D1), + DEF_MOD("lvds", 727, R8A77990_CLK_S2D1), + + DEF_MOD("vin5", 806, R8A77990_CLK_S1D2), +-- +2.20.1 + diff --git a/queue-4.19/clk-renesas-r8a77995-correct-parent-clock-of-du.patch b/queue-4.19/clk-renesas-r8a77995-correct-parent-clock-of-du.patch new file mode 100644 index 00000000000..46e3627eb36 --- /dev/null +++ b/queue-4.19/clk-renesas-r8a77995-correct-parent-clock-of-du.patch @@ -0,0 +1,40 @@ +From 607ed23b59d6f5579549788090473a4ac6c35bbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 11:06:37 +0100 +Subject: clk: renesas: r8a77995: Correct parent clock of DU + +From: Geert Uytterhoeven + +[ Upstream commit 515b2915ee08060ad4f6a3b3de38c5c2c5258e8b ] + +According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock +of the DU module clocks on R-Car D3 is S1D1. + +Fixes: d71e851d82c6cfe5 ("clk: renesas: cpg-mssr: Add R8A77995 support") +Signed-off-by: Geert Uytterhoeven +Acked-by: Stephen Boyd +Reviewed-by: Laurent Pinchart +Tested-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a77995-cpg-mssr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c +index ea4cafbe6e851..9e16931e6f28a 100644 +--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c +@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = { + DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1), + DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2), + DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2), +- DEF_MOD("du1", 723, R8A77995_CLK_S2D1), +- DEF_MOD("du0", 724, R8A77995_CLK_S2D1), ++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1), ++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1), + DEF_MOD("lvds", 727, R8A77995_CLK_S2D1), + DEF_MOD("vin7", 804, R8A77995_CLK_S1D2), + DEF_MOD("vin6", 805, R8A77995_CLK_S1D2), +-- +2.20.1 + diff --git a/queue-4.19/clk-renesas-rcar-gen3-set-state-when-registering-sd-.patch b/queue-4.19/clk-renesas-rcar-gen3-set-state-when-registering-sd-.patch new file mode 100644 index 00000000000..217f1d7d2c1 --- /dev/null +++ b/queue-4.19/clk-renesas-rcar-gen3-set-state-when-registering-sd-.patch @@ -0,0 +1,72 @@ +From 5596ab3465df34d171ca9c5002d5f471a42d6a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 01:15:38 +0100 +Subject: clk: renesas: rcar-gen3: Set state when registering SD clocks +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit ecda0a09fa9933bcd67e33c952f778f0872392ed ] + +The driver tries to figure out which state a SD clock is in when the +clock is registered, instead of setting a known state. This can be +problematic for two reasons. + +1. If the clock driver can't figure out the state of the clock, + registration of the clock fails, and setting of a known state by a + clock user is not possible. + +2. The state of the clock depends on if and how the bootloader + configured it. The driver only checks that the rate is known, not if + the clock is stopped or not for example. + +Fix this by setting a known state and making sure the clock is stopped. + +Signed-off-by: Niklas Söderlund +Tested-by: Wolfram Sang +Acked-by: Wolfram Sang +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/rcar-gen3-cpg.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/clk/renesas/rcar-gen3-cpg.c b/drivers/clk/renesas/rcar-gen3-cpg.c +index 628b63b85d3f0..9ace7d39cd1b5 100644 +--- a/drivers/clk/renesas/rcar-gen3-cpg.c ++++ b/drivers/clk/renesas/rcar-gen3-cpg.c +@@ -361,7 +361,7 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core, + struct sd_clock *clock; + struct clk *clk; + unsigned int i; +- u32 sd_fc; ++ u32 val; + + clock = kzalloc(sizeof(*clock), GFP_KERNEL); + if (!clock) +@@ -378,17 +378,9 @@ static struct clk * __init cpg_sd_clk_register(const struct cpg_core_clk *core, + clock->div_table = cpg_sd_div_table; + clock->div_num = ARRAY_SIZE(cpg_sd_div_table); + +- sd_fc = readl(clock->csn.reg) & CPG_SD_FC_MASK; +- for (i = 0; i < clock->div_num; i++) +- if (sd_fc == (clock->div_table[i].val & CPG_SD_FC_MASK)) +- break; +- +- if (WARN_ON(i >= clock->div_num)) { +- kfree(clock); +- return ERR_PTR(-EINVAL); +- } +- +- clock->cur_div_idx = i; ++ val = readl(clock->csn.reg) & ~CPG_SD_FC_MASK; ++ val |= CPG_SD_STP_MASK | (clock->div_table[0].val & CPG_SD_FC_MASK); ++ writel(val, clock->csn.reg); + + clock->div_max = clock->div_table[0].div; + clock->div_min = clock->div_max; +-- +2.20.1 + diff --git a/queue-4.19/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch b/queue-4.19/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch new file mode 100644 index 00000000000..db6fb45f4d6 --- /dev/null +++ b/queue-4.19/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch @@ -0,0 +1,37 @@ +From 733c8f30526d84cba6ce80d53393af5f120a86b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 13:16:12 +0900 +Subject: clk: rockchip: fix I2S1 clock gate register for rk3328 + +From: Katsuhiro Suzuki + +[ Upstream commit 5c73ac2f8b70834a603eb2d92eb0bb464634420b ] + +This patch fixes definition of I2S1 clock gate register for rk3328. +Current setting is not related I2S clocks. + - bit6 of CRU_CLKGATE_CON0 means clk_ddrmon_en + - bit6 of CRU_CLKGATE_CON1 means clk_i2s1_en + +Signed-off-by: Katsuhiro Suzuki +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3328.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index ecbae8acd05b8..f2f13b603ae9b 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { + RK3328_CLKGATE_CON(1), 5, GFLAGS, + &rk3328_i2s1_fracmux), + GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT, +- RK3328_CLKGATE_CON(0), 6, GFLAGS), ++ RK3328_CLKGATE_CON(1), 6, GFLAGS), + COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0, + RK3328_CLKSEL_CON(8), 12, 1, MFLAGS, + RK3328_CLKGATE_CON(1), 7, GFLAGS), +-- +2.20.1 + diff --git a/queue-4.19/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch b/queue-4.19/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch new file mode 100644 index 00000000000..8606789281f --- /dev/null +++ b/queue-4.19/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch @@ -0,0 +1,35 @@ +From df96eb57f8f5fb08a15b1d892c00b19ae741c42e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 13:18:02 +0900 +Subject: clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 + +From: Katsuhiro Suzuki + +[ Upstream commit df7b1f2e0a4ae0fceff261e29cde63dafcf2360f ] + +This patch fixes mistakes in HCLK_I2S1_8CH for running I2S1 +successfully. + +Signed-off-by: Katsuhiro Suzuki +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/rk3328-cru.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h +index a82a0109faffe..9d5f799469eee 100644 +--- a/include/dt-bindings/clock/rk3328-cru.h ++++ b/include/dt-bindings/clock/rk3328-cru.h +@@ -178,7 +178,7 @@ + #define HCLK_TSP 309 + #define HCLK_GMAC 310 + #define HCLK_I2S0_8CH 311 +-#define HCLK_I2S1_8CH 313 ++#define HCLK_I2S1_8CH 312 + #define HCLK_I2S2_2CH 313 + #define HCLK_SPDIF_8CH 314 + #define HCLK_VOP 315 +-- +2.20.1 + diff --git a/queue-4.19/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch b/queue-4.19/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch new file mode 100644 index 00000000000..9fc4b78787a --- /dev/null +++ b/queue-4.19/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch @@ -0,0 +1,37 @@ +From 046cd73a9fa5d4044ad783254e783eeedd95717c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 12:17:30 +0100 +Subject: clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering + +From: Heiko Stuebner + +[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ] + +Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc +gate data") there is one other gate clock in the rk3188 clock driver +with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well. + +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3188.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 9a6ad5a4cdf06..2ca7e2be2f09e 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + RK2928_CLKGATE_CON(2), 5, GFLAGS), + MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT, + RK2928_CLKSEL_CON(21), 4, 1, MFLAGS), +- GATE(0, "sclk_mac_lbtest", "sclk_macref", +- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS), ++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0, ++ RK2928_CLKGATE_CON(2), 12, GFLAGS), + + COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0, + RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS, +-- +2.20.1 + diff --git a/queue-4.19/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch b/queue-4.19/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch new file mode 100644 index 00000000000..87f455dd1a7 --- /dev/null +++ b/queue-4.19/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch @@ -0,0 +1,38 @@ +From 96bbeb6a0742e05e253806f1909300bb20ce1487 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 15:45:49 +0000 +Subject: clk: rockchip: fix rk3188 sclk_smc gate data + +From: Finley Xiao + +[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ] + +Fix sclk_smc gate data. +Change variable order, flags come before the register address. + +Signed-off-by: Finley Xiao +Signed-off-by: Johan Jonker +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3188.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 69fb3afc970fb..9a6ad5a4cdf06 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + * Clock-Architecture Diagram 4 + */ + +- GATE(SCLK_SMC, "sclk_smc", "hclk_peri", +- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS), ++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0, ++ RK2928_CLKGATE_CON(2), 4, GFLAGS), + + COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0, + RK2928_CLKSEL_CON(25), 0, 7, DFLAGS, +-- +2.20.1 + diff --git a/queue-4.19/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch b/queue-4.19/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch new file mode 100644 index 00000000000..f220c81f954 --- /dev/null +++ b/queue-4.19/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch @@ -0,0 +1,36 @@ +From 3132945faa1c1de17f670e480b5d90ab44ffd1b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 16:46:08 +0530 +Subject: clk: sunxi-ng: a64: Fix gate bit of DSI DPHY + +From: Jagan Teki + +[ Upstream commit ee678706e46d0d185c27cc214ad97828e0643159 ] + +DSI DPHY gate bit on MIPI DSI clock register is bit 15 +not bit 30. + +Signed-off-by: Jagan Teki +Acked-by: Stephen Boyd +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index 2a60981799216..dec4a130390a3 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -582,7 +582,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" }; + static const u8 dsi_dphy_table[] = { 0, 2, }; + static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy", + dsi_dphy_parents, dsi_dphy_table, +- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT); ++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu", + 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT); +-- +2.20.1 + diff --git a/queue-4.19/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch b/queue-4.19/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch new file mode 100644 index 00000000000..d576359d932 --- /dev/null +++ b/queue-4.19/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch @@ -0,0 +1,36 @@ +From b4f4962363771ab23aa2719cc49d23346c1aaeff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 13:33:28 +0800 +Subject: clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent + +From: Chen-Yu Tsai + +[ Upstream commit 7bb7d29cffdd24bf419516d14b6768591e74069e ] + +The third parent of CSI_MCLK is PLL_PERIPH1, not PLL_PERIPH0. +Fix it. + +Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks") +Acked-by: Stephen Boyd +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +index 77ed0b0ba6819..61e3ba12773ea 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -475,7 +475,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents, + 0x134, 16, 4, 24, 3, BIT(31), 0); + +-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" }; ++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents, + 0x134, 0, 5, 8, 3, BIT(15), 0); + +-- +2.20.1 + diff --git a/queue-4.19/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch b/queue-4.19/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch new file mode 100644 index 00000000000..179521bbb50 --- /dev/null +++ b/queue-4.19/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch @@ -0,0 +1,45 @@ +From 6649c0ebfbf9a63c365aa122d484f87e9d80e7b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 13:58:58 +0530 +Subject: crypto: bcm - fix normal/non key hash algorithm failure + +From: Raveendra Padasalagi + +[ Upstream commit 4f0129d13e69bad0363fd75553fb22897b32c379 ] + +Remove setkey() callback handler for normal/non key +hash algorithms and keep it for AES-CBC/CMAC which needs key. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Raveendra Padasalagi +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/cipher.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index cd464637b0cb6..49c0097fa4749 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -4634,12 +4634,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg) + hash->halg.statesize = sizeof(struct spu_hash_export_s); + + if (driver_alg->auth_info.mode != HASH_MODE_HMAC) { +- hash->setkey = ahash_setkey; + hash->init = ahash_init; + hash->update = ahash_update; + hash->final = ahash_final; + hash->finup = ahash_finup; + hash->digest = ahash_digest; ++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) && ++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) || ++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) { ++ hash->setkey = ahash_setkey; ++ } + } else { + hash->setkey = ahash_hmac_setkey; + hash->init = ahash_hmac_init; +-- +2.20.1 + diff --git a/queue-4.19/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch b/queue-4.19/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch new file mode 100644 index 00000000000..3bf5c61968c --- /dev/null +++ b/queue-4.19/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch @@ -0,0 +1,97 @@ +From 1b145cefa4b2b965a2a31449d19b9043874858fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Nov 2018 11:36:18 +0300 +Subject: crypto: ecc - check for invalid values in the key verification test + +From: Vitaly Chikunov + +[ Upstream commit 2eb4942b6609d35a4e835644a33203b0aef7443d ] + +Currently used scalar multiplication algorithm (Matthieu Rivain, 2011) +have invalid values for scalar == 1, n-1, and for regularized version +n-2, which was previously not checked. Verify that they are not used as +private keys. + +Signed-off-by: Vitaly Chikunov +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/ecc.c | 42 ++++++++++++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 16 deletions(-) + +diff --git a/crypto/ecc.c b/crypto/ecc.c +index adcce310f6462..ed1237115066b 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -912,30 +912,43 @@ static inline void ecc_swap_digits(const u64 *in, u64 *out, + out[i] = __swab64(in[ndigits - 1 - i]); + } + +-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, +- const u64 *private_key, unsigned int private_key_len) ++static int __ecc_is_key_valid(const struct ecc_curve *curve, ++ const u64 *private_key, unsigned int ndigits) + { +- int nbytes; +- const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ u64 one[ECC_MAX_DIGITS] = { 1, }; ++ u64 res[ECC_MAX_DIGITS]; + + if (!private_key) + return -EINVAL; + +- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; +- +- if (private_key_len != nbytes) ++ if (curve->g.ndigits != ndigits) + return -EINVAL; + +- if (vli_is_zero(private_key, ndigits)) ++ /* Make sure the private key is in the range [2, n-3]. */ ++ if (vli_cmp(one, private_key, ndigits) != -1) + return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, private_key, ndigits) != 1) ++ vli_sub(res, curve->n, one, ndigits); ++ vli_sub(res, res, one, ndigits); ++ if (vli_cmp(res, private_key, ndigits) != 1) + return -EINVAL; + + return 0; + } + ++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, ++ const u64 *private_key, unsigned int private_key_len) ++{ ++ int nbytes; ++ const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ ++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; ++ ++ if (private_key_len != nbytes) ++ return -EINVAL; ++ ++ return __ecc_is_key_valid(curve, private_key, ndigits); ++} ++ + /* + * ECC private keys are generated using the method of extra random bits, + * equivalent to that described in FIPS 186-4, Appendix B.4.1. +@@ -979,11 +992,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey) + if (err) + return err; + +- if (vli_is_zero(priv, ndigits)) +- return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, priv, ndigits) != 1) ++ /* Make sure the private key is in the valid range. */ ++ if (__ecc_is_key_valid(curve, priv, ndigits)) + return -EINVAL; + + ecc_swap_digits(priv, privkey, ndigits); +-- +2.20.1 + diff --git a/queue-4.19/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch b/queue-4.19/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch new file mode 100644 index 00000000000..568d909629e --- /dev/null +++ b/queue-4.19/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch @@ -0,0 +1,51 @@ +From a13fde0627e7be9f8138c5fbb02a6a6c3f1428e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 14:52:01 +0530 +Subject: cxgb4vf: fix memleak in mac_hlist initialization + +From: Arjun Vynipadath + +[ Upstream commit 24357e06ba511ad874d664d39475dbb01c1ca450 ] + +mac_hlist was initialized during adapter_up, which will be called +every time a vf device is first brought up, or every time when device +is brought up again after bringing all devices down. This means our +state of previous list is lost, causing a memleak if entries are +present in the list. To fix that, move list init to the condition +that performs initial one time adapter setup. + +Signed-off-by: Arjun Vynipadath +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index ff84791a0ff85..972dc7bd721d9 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -722,6 +722,10 @@ static int adapter_up(struct adapter *adapter) + + if (adapter->flags & USING_MSIX) + name_msix_vecs(adapter); ++ ++ /* Initialize hash mac addr list*/ ++ INIT_LIST_HEAD(&adapter->mac_hlist); ++ + adapter->flags |= FULL_INIT_DONE; + } + +@@ -747,8 +751,6 @@ static int adapter_up(struct adapter *adapter) + enable_rx(adapter); + t4vf_sge_start(adapter); + +- /* Initialize hash mac addr list*/ +- INIT_LIST_HEAD(&adapter->mac_hlist); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/dlm-fix-invalid-cluster-name-warning.patch b/queue-4.19/dlm-fix-invalid-cluster-name-warning.patch new file mode 100644 index 00000000000..9c6f311ac21 --- /dev/null +++ b/queue-4.19/dlm-fix-invalid-cluster-name-warning.patch @@ -0,0 +1,47 @@ +From 14a69eac44bdc4ac73486bfd338ddaef070675dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 15:27:37 -0600 +Subject: dlm: fix invalid cluster name warning + +From: David Teigland + +[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ] + +The warning added in commit 3b0e761ba83 + "dlm: print log message when cluster name is not set" + +did not account for the fact that lockspaces created +from userland do not supply a cluster name, so bogus +warnings are printed every time a userland lockspace +is created. + +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index 13f29409600bb..3c84c62dadb7b 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -25,6 +25,7 @@ + #include "lvb_table.h" + #include "user.h" + #include "ast.h" ++#include "config.h" + + static const char name_prefix[] = "dlm"; + static const struct file_operations device_fops; +@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- error = dlm_new_lockspace(params->name, NULL, params->flags, ++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags, + DLM_USER_LVB_LEN, NULL, NULL, NULL, + &lockspace); + if (error) +-- +2.20.1 + diff --git a/queue-4.19/dlm-fix-missing-idr_destroy-for-recover_idr.patch b/queue-4.19/dlm-fix-missing-idr_destroy-for-recover_idr.patch new file mode 100644 index 00000000000..859b77c8fb6 --- /dev/null +++ b/queue-4.19/dlm-fix-missing-idr_destroy-for-recover_idr.patch @@ -0,0 +1,32 @@ +From 59f35205c4d99ca66d4081ccef89ae3657d711c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 11:17:40 -0600 +Subject: dlm: fix missing idr_destroy for recover_idr + +From: David Teigland + +[ Upstream commit 8fc6ed9a3508a0435b9270c313600799d210d319 ] + +Which would leak memory for the idr internals. + +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lockspace.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 6a1529e478f3d..f1261fa0af8a1 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) + + dlm_delete_debug_file(ls); + ++ idr_destroy(&ls->ls_recover_idr); + kfree(ls->ls_recover_buf); + + /* +-- +2.20.1 + diff --git a/queue-4.19/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch b/queue-4.19/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch new file mode 100644 index 00000000000..d00da2a34e4 --- /dev/null +++ b/queue-4.19/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch @@ -0,0 +1,38 @@ +From 7a7ed137f75b2abed46da7502b7fe3bd42f97b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 20:39:50 +0300 +Subject: dlm: fix possible call to kfree() for non-initialized pointer + +From: Denis V. Lunev + +[ Upstream commit 58a923adf4d9aca8bf7205985c9c8fc531c65d72 ] + +Technically dlm_config_nodes() could return error and keep nodes +uninitialized. After that on the fail path of we'll call kfree() +for that uninitialized value. + +The patch is simple - we should just initialize nodes with NULL. + +Signed-off-by: Denis V. Lunev +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/member.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/member.c b/fs/dlm/member.c +index cad6d85911a80..0bc43b35d2c53 100644 +--- a/fs/dlm/member.c ++++ b/fs/dlm/member.c +@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls) + int dlm_ls_start(struct dlm_ls *ls) + { + struct dlm_recover *rv, *rv_old; +- struct dlm_config_node *nodes; ++ struct dlm_config_node *nodes = NULL; + int error, count; + + rv = kzalloc(sizeof(*rv), GFP_NOFS); +-- +2.20.1 + diff --git a/queue-4.19/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch b/queue-4.19/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch new file mode 100644 index 00000000000..0e056220133 --- /dev/null +++ b/queue-4.19/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch @@ -0,0 +1,49 @@ +From 77197ec432b1e9be579d388b98afbc8e8f17c93b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 15:25:00 +0800 +Subject: dlm: NULL check before kmem_cache_destroy is not needed + +From: Wen Yang + +[ Upstream commit f31a89692830061bceba8469607e4e4b0f900159 ] + +kmem_cache_destroy(NULL) is safe, so removes NULL check before +freeing the mem. This patch also fix ifnullfree.cocci warnings. + +Signed-off-by: Wen Yang +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/memory.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c +index 7cd24bccd4fe5..37be29f21d04d 100644 +--- a/fs/dlm/memory.c ++++ b/fs/dlm/memory.c +@@ -38,10 +38,8 @@ int __init dlm_memory_init(void) + + void dlm_memory_exit(void) + { +- if (lkb_cache) +- kmem_cache_destroy(lkb_cache); +- if (rsb_cache) +- kmem_cache_destroy(rsb_cache); ++ kmem_cache_destroy(lkb_cache); ++ kmem_cache_destroy(rsb_cache); + } + + char *dlm_allocate_lvb(struct dlm_ls *ls) +@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb) + struct dlm_user_args *ua; + ua = lkb->lkb_ua; + if (ua) { +- if (ua->lksb.sb_lvbptr) +- kfree(ua->lksb.sb_lvbptr); ++ kfree(ua->lksb.sb_lvbptr); + kfree(ua); + } + } +-- +2.20.1 + diff --git a/queue-4.19/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch b/queue-4.19/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch new file mode 100644 index 00000000000..de0d0b72544 --- /dev/null +++ b/queue-4.19/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch @@ -0,0 +1,41 @@ +From 3a06b4d99de7aa91c23bce9b9383319e8e205849 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 23:29:21 +0200 +Subject: dma-mapping: fix return type of dma_set_max_seg_size() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit c9d76d0655c06b8c1f944e46c4fd9e9cf4b331c0 ] + +The function dma_set_max_seg_size() can return either 0 on success or +-EIO on error. Change its return type from unsigned int to int to +capture this. + +Signed-off-by: Niklas Söderlund +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 1db6a6b46d0d3..669cde2fa8723 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -674,8 +674,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev) + return SZ_64K; + } + +-static inline unsigned int dma_set_max_seg_size(struct device *dev, +- unsigned int size) ++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size) + { + if (dev->dma_parms) { + dev->dma_parms->max_segment_size = size; +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug.patch b/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug.patch new file mode 100644 index 00000000000..099040954bc --- /dev/null +++ b/queue-4.19/dmaengine-coh901318-fix-a-double-lock-bug.patch @@ -0,0 +1,51 @@ +From c1dd1672bdddee27257b5085aa438a8f2cdaab4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 11:33:48 +0800 +Subject: dmaengine: coh901318: Fix a double-lock bug + +From: Jia-Ju Bai + +[ Upstream commit 627469e4445b9b12e0229b3bdf8564d5ce384dd7 ] + +The function coh901318_alloc_chan_resources() calls spin_lock_irqsave() +before calling coh901318_config(). +But coh901318_config() calls spin_lock_irqsave() again in its +definition, which may cause a double-lock bug. + +Because coh901318_config() is only called by +coh901318_alloc_chan_resources(), the bug fix is to remove the +calls to spin-lock and -unlock functions in coh901318_config(). + +Signed-off-by: Jia-Ju Bai +Reviewed-by: Linus Walleij +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/coh901318.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c +index da74fd74636b4..502e9af85f303 100644 +--- a/drivers/dma/coh901318.c ++++ b/drivers/dma/coh901318.c +@@ -1802,8 +1802,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + int channel = cohc->id; + void __iomem *virtbase = cohc->base->virtbase; + +- spin_lock_irqsave(&cohc->lock, flags); +- + if (param) + p = param; + else +@@ -1823,8 +1821,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + coh901318_set_conf(cohc, p->config); + coh901318_set_ctrl(cohc, p->ctrl_lli_last); + +- spin_unlock_irqrestore(&cohc->lock, flags); +- + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-dw-dmac-implement-dma-protection-control-s.patch b/queue-4.19/dmaengine-dw-dmac-implement-dma-protection-control-s.patch new file mode 100644 index 00000000000..0c33ba8318a --- /dev/null +++ b/queue-4.19/dmaengine-dw-dmac-implement-dma-protection-control-s.patch @@ -0,0 +1,145 @@ +From cc3689b43ba3fadc9c7eb6cc7ccfcc7cfb3c2ab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Nov 2018 17:17:21 +0100 +Subject: dmaengine: dw-dmac: implement dma protection control setting + +From: Christian Lamparter + +[ Upstream commit 7b0c03ecc42fb223baf015877fee9d517c2c8af1 ] + +This patch adds a new device-tree property that allows to +specify the dma protection control bits for the all of the +DMA controller's channel uniformly. + +Setting the "correct" bits can have a huge impact on the +PPC460EX and APM82181 that use this DMA engine in combination +with a DesignWare' SATA-II core (sata_dwc_460ex driver). + +In the OpenWrt Forum, the user takimata reported that: +|It seems your patch unleashed the full power of the SATA port. +|Where I was previously hitting a really hard limit at around +|82 MB/s for reading and 27 MB/s for writing, I am now getting this: +| +|root@OpenWrt:/mnt# time dd if=/dev/zero of=tempfile bs=1M count=1024 +|1024+0 records in +|1024+0 records out +|real 0m 13.65s +|user 0m 0.01s +|sys 0m 11.89s +| +|root@OpenWrt:/mnt# time dd if=tempfile of=/dev/null bs=1M count=1024 +|1024+0 records in +|1024+0 records out +|real 0m 8.41s +|user 0m 0.01s +|sys 0m 4.70s +| +|This means: 121 MB/s reading and 75 MB/s writing! +| +|The drive is a WD Green WD10EARX taken from an older MBL Single. +|I repeated the test a few times with even larger files to rule out +|any caching, I'm still seeing the same great performance. OpenWrt is +|now completely on par with the original MBL firmware's performance. + +Another user And.short reported: +|I can report that your fix worked! Boots up fine with two +|drives even with more partitions, and no more reboot on +|concurrent disk access! + +A closer look into the sata_dwc_460ex code revealed that +the driver did initally set the correct protection control +bits. However, this feature was lost when the sata_dwc_460ex +driver was converted to the generic DMA driver framework. + +BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/55 +BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/50 +Fixes: 8b3444852a2b ("sata_dwc_460ex: move to generic DMA driver") +Reviewed-by: Andy Shevchenko +Signed-off-by: Christian Lamparter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/core.c | 2 ++ + drivers/dma/dw/platform.c | 6 ++++++ + drivers/dma/dw/regs.h | 4 ++++ + include/linux/platform_data/dma-dw.h | 6 ++++++ + 4 files changed, 18 insertions(+) + +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 0f389e008ce64..055d83b6cb68a 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc) + + static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc) + { ++ struct dw_dma *dw = to_dw_dma(dwc->chan.device); + u32 cfghi = DWC_CFGH_FIFO_MODE; + u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); + bool hs_polarity = dwc->dws.hs_polarity; + + cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id); + cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id); ++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl); + + /* Set polarity of handshake interface */ + cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0; +diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c +index f62dd0944908d..c299ff181bb68 100644 +--- a/drivers/dma/dw/platform.c ++++ b/drivers/dma/dw/platform.c +@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev) + pdata->multi_block[tmp] = 1; + } + ++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) { ++ if (tmp > CHAN_PROTCTL_MASK) ++ return NULL; ++ pdata->protctl = tmp; ++ } ++ + return pdata; + } + #else +diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h +index 09e7dfdbb7907..646c9c960c071 100644 +--- a/drivers/dma/dw/regs.h ++++ b/drivers/dma/dw/regs.h +@@ -200,6 +200,10 @@ enum dw_dma_msize { + #define DWC_CFGH_FCMODE (1 << 0) + #define DWC_CFGH_FIFO_MODE (1 << 1) + #define DWC_CFGH_PROTCTL(x) ((x) << 2) ++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */ ++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */ ++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */ ++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */ + #define DWC_CFGH_DS_UPD_EN (1 << 5) + #define DWC_CFGH_SS_UPD_EN (1 << 6) + #define DWC_CFGH_SRC_PER(x) ((x) << 7) +diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h +index 896cb71a382cb..1a1d58ebffbf1 100644 +--- a/include/linux/platform_data/dma-dw.h ++++ b/include/linux/platform_data/dma-dw.h +@@ -49,6 +49,7 @@ struct dw_dma_slave { + * @data_width: Maximum data width supported by hardware per AHB master + * (in bytes, power of 2) + * @multi_block: Multi block transfers supported by hardware per channel. ++ * @protctl: Protection control signals setting per channel. + */ + struct dw_dma_platform_data { + unsigned int nr_channels; +@@ -65,6 +66,11 @@ struct dw_dma_platform_data { + unsigned char nr_masters; + unsigned char data_width[DW_DMA_MAX_NR_MASTERS]; + unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS]; ++#define CHAN_PROTCTL_PRIVILEGED BIT(0) ++#define CHAN_PROTCTL_BUFFERABLE BIT(1) ++#define CHAN_PROTCTL_CACHEABLE BIT(2) ++#define CHAN_PROTCTL_MASK GENMASK(2, 0) ++ unsigned char protctl; + }; + + #endif /* _PLATFORM_DATA_DMA_DW_H */ +-- +2.20.1 + diff --git a/queue-4.19/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch b/queue-4.19/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch new file mode 100644 index 00000000000..e0ea362b251 --- /dev/null +++ b/queue-4.19/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch @@ -0,0 +1,42 @@ +From 782417e1346195bed4e9ac3d73eef1d4e99e7ce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Sep 2018 11:18:00 -0600 +Subject: dmaengine: xilinx_dma: Fix 64-bit simple CDMA transfer + +From: Radhey Shyam Pandey + +[ Upstream commit 0e03aca2659ef7a85eaff1a1ca9b0b498002ede8 ] + +In AXI CDMA simple mode also pass MSB bits of source and destination +address to xilinx_write function. This fixes simple CDMA operation +mode using 64-bit addressing. + +Signed-off-by: Radhey Shyam Pandey +Signed-off-by: Michal Simek +Reviewed-by: Appana Durga Kedareswara Rao +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 8aec137b4fcaa..0ef4388bbeaa9 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -1248,8 +1248,10 @@ static void xilinx_cdma_start_transfer(struct xilinx_dma_chan *chan) + + hw = &segment->hw; + +- xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, hw->src_addr); +- xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, hw->dest_addr); ++ xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, ++ xilinx_prep_dma_addr_t(hw->src_addr)); ++ xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, ++ xilinx_prep_dma_addr_t(hw->dest_addr)); + + /* Start the transfer */ + dma_ctrl_write(chan, XILINX_DMA_REG_BTT, +-- +2.20.1 + diff --git a/queue-4.19/drivers-soc-allow-building-the-amlogic-drivers-witho.patch b/queue-4.19/drivers-soc-allow-building-the-amlogic-drivers-witho.patch new file mode 100644 index 00000000000..2b67f4c1382 --- /dev/null +++ b/queue-4.19/drivers-soc-allow-building-the-amlogic-drivers-witho.patch @@ -0,0 +1,38 @@ +From 589376748a4d3ae6aa9f7670679cfd869e7af1be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 17:46:54 +0100 +Subject: drivers: soc: Allow building the amlogic drivers without ARCH_MESON + +From: Maxime Jourdan + +[ Upstream commit 41bb5769b7f4b7a85e4b92c37429228279b4f569 ] + +The current condition makes it difficult to compile the amlogic/ +drivers with COMPILE_TEST, or without ARCH_MESON in general. + +Fixes kbuild errors with patch series that depend on drivers in that +directory, for instance the meson video decoder. + +Signed-off-by: Maxime Jourdan +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + drivers/soc/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/Makefile b/drivers/soc/Makefile +index 113e884697fd8..f0d46b16e08c4 100644 +--- a/drivers/soc/Makefile ++++ b/drivers/soc/Makefile +@@ -13,7 +13,7 @@ obj-$(CONFIG_ARCH_GEMINI) += gemini/ + obj-$(CONFIG_ARCH_MXC) += imx/ + obj-$(CONFIG_SOC_XWAY) += lantiq/ + obj-y += mediatek/ +-obj-$(CONFIG_ARCH_MESON) += amlogic/ ++obj-y += amlogic/ + obj-y += qcom/ + obj-y += renesas/ + obj-$(CONFIG_ARCH_ROCKCHIP) += rockchip/ +-- +2.20.1 + diff --git a/queue-4.19/drm-sun4i-tcon-set-min-division-of-tcon0_dclk-to-1.patch b/queue-4.19/drm-sun4i-tcon-set-min-division-of-tcon0_dclk-to-1.patch new file mode 100644 index 00000000000..bc59322d7ef --- /dev/null +++ b/queue-4.19/drm-sun4i-tcon-set-min-division-of-tcon0_dclk-to-1.patch @@ -0,0 +1,44 @@ +From 98b9fd88d80c45f8eea374b0ee2361971e4d1bd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 13:27:25 +0000 +Subject: drm/sun4i: tcon: Set min division of TCON0_DCLK to 1. + +From: Yunhao Tian + +[ Upstream commit 0b8e7bbde5e7e2c419567e1ee29587dae3b78ee3 ] + +The datasheet of V3s (and various other chips) wrote +that TCON0_DCLK_DIV can be >= 1 if only dclk is used, +and must >= 6 if dclk1 or dclk2 is used. As currently +neither dclk1 nor dclk2 is used (no writes to these +bits), let's set minimal division to 1. + +If this minimal division is 6, some common dot clock +frequencies can't be produced (e.g. 30MHz will not be +possible and will fallback to 25MHz), which is +obviously not an expected behaviour. + +Signed-off-by: Yunhao Tian +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/linux-arm-kernel/MN2PR08MB57905AD8A00C08DA219377C989760@MN2PR08MB5790.namprd08.prod.outlook.com/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_tcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_tcon.c b/drivers/gpu/drm/sun4i/sun4i_tcon.c +index 8c31c9ab06f8b..fda1ae12069a7 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_tcon.c ++++ b/drivers/gpu/drm/sun4i/sun4i_tcon.c +@@ -423,7 +423,7 @@ static void sun4i_tcon0_mode_set_rgb(struct sun4i_tcon *tcon, + + WARN_ON(!tcon->quirks->has_channel_0); + +- tcon->dclk_min_div = 6; ++ tcon->dclk_min_div = 1; + tcon->dclk_max_div = 127; + sun4i_tcon0_mode_set_common(tcon, mode); + +-- +2.20.1 + diff --git a/queue-4.19/exportfs_decode_fh-negative-pinned-may-become-positi.patch b/queue-4.19/exportfs_decode_fh-negative-pinned-may-become-positi.patch new file mode 100644 index 00000000000..ee35f94b791 --- /dev/null +++ b/queue-4.19/exportfs_decode_fh-negative-pinned-may-become-positi.patch @@ -0,0 +1,69 @@ +From a510389e195193f60c1d9b073d78052bbef41d2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 22:08:29 -0500 +Subject: exportfs_decode_fh(): negative pinned may become positive without the + parent locked + +From: Al Viro + +[ Upstream commit a2ece088882666e1dc7113744ac912eb161e3f87 ] + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/exportfs/expfs.c | 31 +++++++++++++++++++------------ + 1 file changed, 19 insertions(+), 12 deletions(-) + +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index 63707abcbeb3e..808cae6d5f50f 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -517,26 +517,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid, + * inode is actually connected to the parent. + */ + err = exportfs_get_name(mnt, target_dir, nbuf, result); +- if (!err) { +- inode_lock(target_dir->d_inode); +- nresult = lookup_one_len(nbuf, target_dir, +- strlen(nbuf)); +- inode_unlock(target_dir->d_inode); +- if (!IS_ERR(nresult)) { +- if (nresult->d_inode) { +- dput(result); +- result = nresult; +- } else +- dput(nresult); +- } ++ if (err) { ++ dput(target_dir); ++ goto err_result; + } + ++ inode_lock(target_dir->d_inode); ++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf)); ++ if (!IS_ERR(nresult)) { ++ if (unlikely(nresult->d_inode != result->d_inode)) { ++ dput(nresult); ++ nresult = ERR_PTR(-ESTALE); ++ } ++ } ++ inode_unlock(target_dir->d_inode); + /* + * At this point we are done with the parent, but it's pinned + * by the child dentry anyway. + */ + dput(target_dir); + ++ if (IS_ERR(nresult)) { ++ err = PTR_ERR(nresult); ++ goto err_result; ++ } ++ dput(result); ++ result = nresult; ++ + /* + * And finally make sure the dentry is actually acceptable + * to NFSD. +-- +2.20.1 + diff --git a/queue-4.19/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch b/queue-4.19/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch new file mode 100644 index 00000000000..37b7b4dd117 --- /dev/null +++ b/queue-4.19/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch @@ -0,0 +1,49 @@ +From 89e3aa22e55a039976265fdb9e8845b765afb16f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 16:38:47 +0100 +Subject: extcon: max8997: Fix lack of path setting in USB device mode + +From: Marek Szyprowski + +[ Upstream commit a2dc50914744eea9f83a70a5db0486be625e5dc0 ] + +MAX8997 driver disables automatic path selection from MicroUSB connector +and manually sets path to either UART or USB lines. However the code for +setting USB path worked only for USB host mode (when ID pin is set +to ground). When standard USB cable (USB device mode) is connected, path +registers are not touched. This means that once the non-USB accessory is +connected to MAX8997-operated micro USB port, the path is no longer set +to USB and USB device mode doesn't work. This patch fixes it by setting +USB path both for USB and USB host modes. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max8997.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 9f30f4929b729..7a767b66dd865 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info, + { + int ret = 0; + +- if (usb_type == MAX8997_USB_HOST) { +- ret = max8997_muic_set_path(info, info->path_usb, attached); +- if (ret < 0) { +- dev_err(info->dev, "failed to update muic register\n"); +- return ret; +- } ++ ret = max8997_muic_set_path(info, info->path_usb, attached); ++ if (ret < 0) { ++ dev_err(info->dev, "failed to update muic register\n"); ++ return ret; + } + + switch (usb_type) { +-- +2.20.1 + diff --git a/queue-4.19/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch b/queue-4.19/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch new file mode 100644 index 00000000000..fcf4665ae77 --- /dev/null +++ b/queue-4.19/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch @@ -0,0 +1,36 @@ +From 987acab3c98a586726179b98ef9f1e66910b24ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 20:37:55 +0800 +Subject: f2fs: change segment to section in f2fs_ioc_gc_range + +From: Yunlong Song + +[ Upstream commit 67b0e42b768c9ddc3fd5ca1aee3db815cfaa635c ] + +f2fs_ioc_gc_range skips blocks_per_seg each time, however, f2fs_gc moves +blocks of section each time, so fix it from segment to section. + +Signed-off-by: Yunlong Song +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 187bf7e260c99..5eef2a8b29ab6 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2143,7 +2143,7 @@ do_more: + } + + ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start)); +- range.start += sbi->blocks_per_seg; ++ range.start += BLKS_PER_SEC(sbi); + if (range.start <= end) + goto do_more; + out: +-- +2.20.1 + diff --git a/queue-4.19/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch b/queue-4.19/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch new file mode 100644 index 00000000000..6cce60c2c20 --- /dev/null +++ b/queue-4.19/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch @@ -0,0 +1,50 @@ +From 48b739d5c23405cbb138f2cc5389956eb0838344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Oct 2018 16:08:30 +0800 +Subject: f2fs: fix count of seg_freed to make sec_freed correct + +From: Yunlong Song + +[ Upstream commit d6c66cd19ef322fe0d51ba09ce1b7f386acab04a ] + +When sbi->segs_per_sec > 1, and if some segno has 0 valid blocks before +gc starts, do_garbage_collect will skip counting seg_freed++, and this +will cause seg_freed < sbi->segs_per_sec and finally skip sec_freed++. + +Signed-off-by: Yunlong Song +Signed-off-by: Chao Yu +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 8c4cb1eee10a6..3d98e909201d9 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1081,9 +1081,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + GET_SUM_BLOCK(sbi, segno)); + f2fs_put_page(sum_page, 0); + +- if (get_valid_blocks(sbi, segno, false) == 0 || +- !PageUptodate(sum_page) || +- unlikely(f2fs_cp_error(sbi))) ++ if (get_valid_blocks(sbi, segno, false) == 0) ++ goto freed; ++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi))) + goto next; + + sum = page_address(sum_page); +@@ -1110,6 +1110,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + + stat_inc_seg_count(sbi, type, gc_type); + ++freed: + if (gc_type == FG_GC && + get_valid_blocks(sbi, segno, false) == 0) + seg_freed++; +-- +2.20.1 + diff --git a/queue-4.19/f2fs-fix-to-account-preflush-command-for-noflush_mer.patch b/queue-4.19/f2fs-fix-to-account-preflush-command-for-noflush_mer.patch new file mode 100644 index 00000000000..c92c6182aff --- /dev/null +++ b/queue-4.19/f2fs-fix-to-account-preflush-command-for-noflush_mer.patch @@ -0,0 +1,37 @@ +From bf9572054aee63a43b202f9d8892737cde2f425f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Oct 2018 17:24:10 +0800 +Subject: f2fs: fix to account preflush command for noflush_merge mode + +From: Chao Yu + +[ Upstream commit a8075dc484cf10ebdb07bee2b17322fb0a846309 ] + +Previously, we only account preflush command for flush_merge mode, +so for noflush_merge mode, we can not know in-flight preflush +command count, fix it. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index a807a8d5e38f0..0e3e590a250f7 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -637,7 +637,9 @@ int f2fs_issue_flush(struct f2fs_sb_info *sbi, nid_t ino) + return 0; + + if (!test_opt(sbi, FLUSH_MERGE)) { ++ atomic_inc(&fcc->issing_flush); + ret = submit_flush_wait(sbi, ino); ++ atomic_dec(&fcc->issing_flush); + atomic_inc(&fcc->issued_flush); + return ret; + } +-- +2.20.1 + diff --git a/queue-4.19/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch b/queue-4.19/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch new file mode 100644 index 00000000000..15b8c24bd7e --- /dev/null +++ b/queue-4.19/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch @@ -0,0 +1,37 @@ +From 64a62bdeee2f5da52d5d84adb4c876c7d3dad32d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 13:31:41 +0530 +Subject: f2fs: fix to allow node segment for GC by ioctl path + +From: Sahitya Tummala + +[ Upstream commit 08ac9a3870f6babb2b1fff46118536ca8a71ef19 ] + +Allow node type segments also to be GC'd via f2fs ioctl +F2FS_IOC_GARBAGE_COLLECT_RANGE. + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 3d98e909201d9..700c39ec99f5a 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -318,8 +318,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, + p.min_cost = get_max_cost(sbi, &p); + + if (*result != NULL_SEGNO) { +- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) && +- get_valid_blocks(sbi, *result, false) && ++ if (get_valid_blocks(sbi, *result, false) && + !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result))) + p.min_segno = *result; + goto out; +-- +2.20.1 + diff --git a/queue-4.19/firmware-qcom-scm-fix-compilation-error-when-disable.patch b/queue-4.19/firmware-qcom-scm-fix-compilation-error-when-disable.patch new file mode 100644 index 00000000000..5d4965c2f07 --- /dev/null +++ b/queue-4.19/firmware-qcom-scm-fix-compilation-error-when-disable.patch @@ -0,0 +1,37 @@ +From 979a9a7af95cefaf2514cce8965aed5b46f9010e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 21:32:25 -0500 +Subject: firmware: qcom: scm: fix compilation error when disabled + +From: Jonathan Marek + +[ Upstream commit 16ad9501b1f2edebe24f8cf3c09da0695871986b ] + +This fixes the case when CONFIG_QCOM_SCM is not enabled, and linux/errno.h +has not been included previously. + +Signed-off-by: Jonathan Marek +Reviewed-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +--- + include/linux/qcom_scm.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h +index 5d65521260b3d..116b81ac442ad 100644 +--- a/include/linux/qcom_scm.h ++++ b/include/linux/qcom_scm.h +@@ -65,6 +65,9 @@ extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare); + extern int qcom_scm_io_readl(phys_addr_t addr, unsigned int *val); + extern int qcom_scm_io_writel(phys_addr_t addr, unsigned int val); + #else ++ ++#include ++ + static inline + int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus) + { +-- +2.20.1 + diff --git a/queue-4.19/firmware-raspberrypi-fix-firmware-calls-with-large-b.patch b/queue-4.19/firmware-raspberrypi-fix-firmware-calls-with-large-b.patch new file mode 100644 index 00000000000..e81967fbdf7 --- /dev/null +++ b/queue-4.19/firmware-raspberrypi-fix-firmware-calls-with-large-b.patch @@ -0,0 +1,100 @@ +From 2c2bdf60542ce65bc8879fe313e576c30d52a92d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 14:39:07 +0000 +Subject: firmware: raspberrypi: Fix firmware calls with large buffers + +From: James Hughes + +[ Upstream commit 91c6ada69f396e663acb2b713e8acb8a9463557d ] + +Commit a1547e0bca51 ("firmware: raspberrypi: Remove VLA usage") +moved away from VLA's to a fixed maximum size for mailbox data. +However, some mailbox calls use larger data buffers +than the maximum allowed in that change. This fix therefor +moves from using fixed buffers to kmalloc to ensure all sizes +are catered for. + +There is some documentation, which is somewhat out of date, +on the mailbox calls here : +https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface + +Fixes: a1547e0bca51 ("firmware: raspberrypi: Remove VLA usage") + +Signed-off-by: James Hughes +Reviewed-by: Eric Anholt +Signed-off-by: Stefan Wahren +Signed-off-by: Sasha Levin +--- + drivers/firmware/raspberrypi.c | 35 +++++++++++++++++----------------- + 1 file changed, 18 insertions(+), 17 deletions(-) + +diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c +index a200a21746119..44eb99807e337 100644 +--- a/drivers/firmware/raspberrypi.c ++++ b/drivers/firmware/raspberrypi.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + + #define MBOX_MSG(chan, data28) (((data28) & ~0xf) | ((chan) & 0xf)) +@@ -21,8 +22,6 @@ + #define MBOX_DATA28(msg) ((msg) & ~0xf) + #define MBOX_CHAN_PROPERTY 8 + +-#define MAX_RPI_FW_PROP_BUF_SIZE 32 +- + static struct platform_device *rpi_hwmon; + + struct rpi_firmware { +@@ -144,28 +143,30 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_list); + int rpi_firmware_property(struct rpi_firmware *fw, + u32 tag, void *tag_data, size_t buf_size) + { +- /* Single tags are very small (generally 8 bytes), so the +- * stack should be safe. +- */ +- u8 data[sizeof(struct rpi_firmware_property_tag_header) + +- MAX_RPI_FW_PROP_BUF_SIZE]; +- struct rpi_firmware_property_tag_header *header = +- (struct rpi_firmware_property_tag_header *)data; ++ struct rpi_firmware_property_tag_header *header; + int ret; + +- if (WARN_ON(buf_size > sizeof(data) - sizeof(*header))) +- return -EINVAL; ++ /* Some mailboxes can use over 1k bytes. Rather than checking ++ * size and using stack or kmalloc depending on requirements, ++ * just use kmalloc. Mailboxes don't get called enough to worry ++ * too much about the time taken in the allocation. ++ */ ++ void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL); + ++ if (!data) ++ return -ENOMEM; ++ ++ header = data; + header->tag = tag; + header->buf_size = buf_size; + header->req_resp_size = 0; +- memcpy(data + sizeof(struct rpi_firmware_property_tag_header), +- tag_data, buf_size); ++ memcpy(data + sizeof(*header), tag_data, buf_size); ++ ++ ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header)); ++ ++ memcpy(tag_data, data + sizeof(*header), buf_size); + +- ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header)); +- memcpy(tag_data, +- data + sizeof(struct rpi_firmware_property_tag_header), +- buf_size); ++ kfree(data); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.19/gpio-of-parse-mmc-specific-cd-and-wp-properties.patch b/queue-4.19/gpio-of-parse-mmc-specific-cd-and-wp-properties.patch new file mode 100644 index 00000000000..f632403f619 --- /dev/null +++ b/queue-4.19/gpio-of-parse-mmc-specific-cd-and-wp-properties.patch @@ -0,0 +1,122 @@ +From 1843ae54ce037708d78ed76c152d9644a0cd228c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 14:51:23 +0100 +Subject: gpio: OF: Parse MMC-specific CD and WP properties + +From: Linus Walleij + +[ Upstream commit 81c85ec15a1946f2e347ec0bf66936121eb97ce7 ] + +When retrieveing CD (card detect) and WP (write protect) +GPIO handles from the device tree, make sure to assign +them active low by default unless the "cd-inverted" or +"wp-inverted" properties are set. These properties mean +that respective signal is active HIGH since the SDHCI +specification stipulates that this kind of signals +should be treated as active LOW. + +If the twocell GPIO flag is also specified as active +low, well that's nice and we will silently ignore the +tautological specification. + +If however the GPIO line is specified as active low +in the GPIO flasg cell and "cd-inverted" or "wp-inverted" +is also specified, the latter takes precedence and we +print a warning. + +The current effect on the MMC slot-gpio core are as +follows: + +For CD GPIOs: no effect. The current code in +mmc/core/host.c calls mmc_gpiod_request_cd() with +the "override_active_level" argument set to true, +which means that whatever the GPIO descriptor +thinks about active low/high will be ignored, the +core will use the MMC_CAP2_CD_ACTIVE_HIGH to keep +track of this and reads the raw value from the +GPIO descriptor, totally bypassing gpiolibs inversion +semantics. I plan to clean this up at a later point +passing the handling of inversion semantics over +to gpiolib, so this patch prepares the ground for +that. + +Fow WP GPIOs: this is probably fixing a bug, because +the code in mmc/core/host.c calls mmc_gpiod_request_ro() +with the "override_active_level" argument set to false, +which means it will respect the inversion semantics of +the gpiolib and ignore the MMC_CAP2_RO_ACTIVE_HIGH +flag for everyone using this through device tree. +However the code in host.c confusingly goes to great +lengths setting up the MMC_CAP2_RO_ACTIVE_HIGH flag +from the GPIO descriptor and by reading the "wp-inverted" +property of the node. As far as I can tell this is all +in vain and the inversion is broken: device trees that +use "wp-inverted" do not work as intended, instead the +only way to actually get inversion on a line is by +setting the second cell flag to GPIO_ACTIVE_HIGH (which +will be the default) or GPIO_ACTIVE_LOW if they want +the proper MMC semantics. Presumably all device trees do +this right but we need to parse and handle this properly. + +Cc: linux-mmc@vger.kernel.org +Cc: linux-gpio@vger.kernel.org +Cc: Bartosz Golaszewski +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib-of.c | 39 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 39 insertions(+) + +diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c +index e0f149bdf98ff..1147ad968fd75 100644 +--- a/drivers/gpio/gpiolib-of.c ++++ b/drivers/gpio/gpiolib-of.c +@@ -60,6 +60,45 @@ static struct gpio_desc *of_xlate_and_get_gpiod_flags(struct gpio_chip *chip, + static void of_gpio_flags_quirks(struct device_node *np, + enum of_gpio_flags *flags) + { ++ /* ++ * Handle MMC "cd-inverted" and "wp-inverted" semantics. ++ */ ++ if (IS_ENABLED(CONFIG_MMC)) { ++ if (of_property_read_bool(np, "cd-gpios")) { ++ if (of_property_read_bool(np, "cd-inverted")) { ++ if (*flags & OF_GPIO_ACTIVE_LOW) { ++ /* "cd-inverted" takes precedence */ ++ *flags &= ~OF_GPIO_ACTIVE_LOW; ++ pr_warn("%s GPIO handle specifies CD active low - ignored\n", ++ of_node_full_name(np)); ++ } ++ } else { ++ /* ++ * Active low is the default according to the ++ * SDHCI specification. If the GPIO handle ++ * specifies the same thing - good. ++ */ ++ *flags |= OF_GPIO_ACTIVE_LOW; ++ } ++ } ++ if (of_property_read_bool(np, "wp-gpios")) { ++ if (of_property_read_bool(np, "wp-inverted")) { ++ /* "wp-inverted" takes precedence */ ++ if (*flags & OF_GPIO_ACTIVE_LOW) { ++ *flags &= ~OF_GPIO_ACTIVE_LOW; ++ pr_warn("%s GPIO handle specifies WP active low - ignored\n", ++ of_node_full_name(np)); ++ } ++ } else { ++ /* ++ * Active low is the default according to the ++ * SDHCI specification. If the GPIO handle ++ * specifies the same thing - good. ++ */ ++ *flags |= OF_GPIO_ACTIVE_LOW; ++ } ++ } ++ } + /* + * Some GPIO fixed regulator quirks. + * Note that active low is the default. +-- +2.20.1 + diff --git a/queue-4.19/gpu-host1x-fix-syncpoint-id-field-size-on-tegra186.patch b/queue-4.19/gpu-host1x-fix-syncpoint-id-field-size-on-tegra186.patch new file mode 100644 index 00000000000..76e7433728b --- /dev/null +++ b/queue-4.19/gpu-host1x-fix-syncpoint-id-field-size-on-tegra186.patch @@ -0,0 +1,36 @@ +From ef6b7be356d3e1019234b784092f689612b24c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 11:31:30 +0100 +Subject: gpu: host1x: Fix syncpoint ID field size on Tegra186 + +From: Thierry Reding + +[ Upstream commit 2fc777ba8422e4a38cae61537ad6a26435a86fb8 ] + +The number of syncpoints on Tegra186 is 576 and therefore no longer fits +into 8 bits. Increase the size of the syncpoint ID field to 10 in order +to accomodate all syncpoints. + +Reviewed-by: Mikko Perttunen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/hw/hw_host1x06_uclass.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h +index 4457486c72b05..e599e15bf999a 100644 +--- a/drivers/gpu/host1x/hw/hw_host1x06_uclass.h ++++ b/drivers/gpu/host1x/hw/hw_host1x06_uclass.h +@@ -59,7 +59,7 @@ static inline u32 host1x_uclass_incr_syncpt_r(void) + host1x_uclass_incr_syncpt_r() + static inline u32 host1x_uclass_incr_syncpt_cond_f(u32 v) + { +- return (v & 0xff) << 8; ++ return (v & 0xff) << 10; + } + #define HOST1X_UCLASS_INCR_SYNCPT_COND_F(v) \ + host1x_uclass_incr_syncpt_cond_f(v) +-- +2.20.1 + diff --git a/queue-4.19/i2c-core-fix-use-after-free-in-of_i2c_notify.patch b/queue-4.19/i2c-core-fix-use-after-free-in-of_i2c_notify.patch new file mode 100644 index 00000000000..245a94a6ecb --- /dev/null +++ b/queue-4.19/i2c-core-fix-use-after-free-in-of_i2c_notify.patch @@ -0,0 +1,43 @@ +From b0eb1bc5525b941322bf837570e93480ababc63c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 16:36:48 +0800 +Subject: i2c: core: fix use after free in of_i2c_notify + +From: Wen Yang + +[ Upstream commit a4c2fec16f5e6a5fee4865e6e0e91e2bc2d10f37 ] + +We can't use "adap->dev" after it has been freed. + +Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file") +Signed-off-by: Wen Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-of.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c +index 0f01cdba9d2c6..14d4884996968 100644 +--- a/drivers/i2c/i2c-core-of.c ++++ b/drivers/i2c/i2c-core-of.c +@@ -253,14 +253,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action, + } + + client = of_i2c_register_device(adap, rd->dn); +- put_device(&adap->dev); +- + if (IS_ERR(client)) { + dev_err(&adap->dev, "failed to create client for '%pOF'\n", + rd->dn); ++ put_device(&adap->dev); + of_node_clear_flag(rd->dn, OF_POPULATED); + return notifier_from_errno(PTR_ERR(client)); + } ++ put_device(&adap->dev); + break; + case OF_RECONFIG_CHANGE_REMOVE: + /* already depopulated? */ +-- +2.20.1 + diff --git a/queue-4.19/i2c-imx-don-t-print-error-message-on-probe-defer.patch b/queue-4.19/i2c-imx-don-t-print-error-message-on-probe-defer.patch new file mode 100644 index 00000000000..791f742a391 --- /dev/null +++ b/queue-4.19/i2c-imx-don-t-print-error-message-on-probe-defer.patch @@ -0,0 +1,40 @@ +From 0d564bd5b5dda9946de6186cbb8b4b68b84fd394 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:29:13 +0100 +Subject: i2c: imx: don't print error message on probe defer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lucas Stach + +[ Upstream commit fece4978510e43f09c8cd386fee15210e8c68493 ] + +Probe deferral is a normal operating condition in the probe function, +so don't spam the log with an error in this case. + +Signed-off-by: Lucas Stach +Acked-by: Uwe Kleine-König +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index 7bd409eaf0acd..d4b72e4ffd71f 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1090,7 +1090,8 @@ static int i2c_imx_probe(struct platform_device *pdev) + /* Get I2C clock */ + i2c_imx->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(i2c_imx->clk)) { +- dev_err(&pdev->dev, "can't get I2C clock\n"); ++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "can't get I2C clock\n"); + return PTR_ERR(i2c_imx->clk); + } + +-- +2.20.1 + diff --git a/queue-4.19/i40e-don-t-restart-nway-if-autoneg-not-supported.patch b/queue-4.19/i40e-don-t-restart-nway-if-autoneg-not-supported.patch new file mode 100644 index 00000000000..fcb8ad1cb07 --- /dev/null +++ b/queue-4.19/i40e-don-t-restart-nway-if-autoneg-not-supported.patch @@ -0,0 +1,67 @@ +From 34bed3c53a5ed774b9a39f3be44312e8cc3a9570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 14:33:28 -0700 +Subject: i40e: don't restart nway if autoneg not supported + +From: Mitch Williams + +[ Upstream commit 7c3758f7839377ab67529cc50264a640636c47af ] + +On link types that do not support autoneg, we cannot attempt to restart +nway negotiation. This results in a dead link that requires a power +cycle to remedy. + +Fix this by saving off the autoneg state and checking this value before +we try to restart nway. + +Signed-off-by: Mitch Williams +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 5ff6caa83948c..a6b0f605a7d8b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1136,6 +1136,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + i40e_status status; + u8 aq_failures; + int err = 0; ++ u32 is_an; + + /* Changing the port's flow control is not supported if this isn't the + * port's controlling PF +@@ -1148,15 +1149,14 @@ static int i40e_set_pauseparam(struct net_device *netdev, + if (vsi != pf->vsi[pf->lan_vsi]) + return -EOPNOTSUPP; + +- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ? +- AUTONEG_ENABLE : AUTONEG_DISABLE)) { ++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED; ++ if (pause->autoneg != is_an) { + netdev_info(netdev, "To change autoneg please use: ethtool -s autoneg \n"); + return -EOPNOTSUPP; + } + + /* If we have link and don't have autoneg */ +- if (!test_bit(__I40E_DOWN, pf->state) && +- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) { + /* Send message that it might not necessarily work*/ + netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n"); + } +@@ -1207,7 +1207,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + err = -EAGAIN; + } + +- if (!test_bit(__I40E_DOWN, pf->state)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) { + /* Give it a little more time to try to come back */ + msleep(75); + if (!test_bit(__I40E_DOWN, pf->state)) +-- +2.20.1 + diff --git a/queue-4.19/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch b/queue-4.19/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch new file mode 100644 index 00000000000..54253fba3e6 --- /dev/null +++ b/queue-4.19/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch @@ -0,0 +1,90 @@ +From 778b1cdf9b8f483d85ede2b5635f5c628cf1b424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:32:48 -0800 +Subject: IB/hfi1: Close VNIC sdma_progress sleep window + +From: Mike Marciniszyn + +[ Upstream commit 18912c4524385dd6532c682cb9d4f6aa39ba8d47 ] + +The call to sdma_progress() is called outside the wait lock. + +In this case, there is a race condition where sdma_progress() can return +false and the sdma_engine can idle. If that happens, there will be no +more sdma interrupts to cause the wakeup and the vnic_sdma xmit will hang. + +Fix by moving the lock to enclose the sdma_progress() call. + +Also, delete the tx_retry. The need for this was removed by: +commit bcad29137a97 ("IB/hfi1: Serve the most starved iowait entry first") + +Fixes: 64551ede6cd1 ("IB/hfi1: VNIC SDMA support") +Reviewed-by: Gary Leshner +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/vnic_sdma.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3c96c5869ed4..718dcdef946ee 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -57,7 +57,6 @@ + + #define HFI1_VNIC_TXREQ_NAME_LEN 32 + #define HFI1_VNIC_SDMA_DESC_WTRMRK 64 +-#define HFI1_VNIC_SDMA_RETRY_COUNT 1 + + /* + * struct vnic_txreq - VNIC transmit descriptor +@@ -67,7 +66,6 @@ + * @pad: pad buffer + * @plen: pad length + * @pbc_val: pbc value +- * @retry_count: tx retry count + */ + struct vnic_txreq { + struct sdma_txreq txreq; +@@ -77,8 +75,6 @@ struct vnic_txreq { + unsigned char pad[HFI1_VNIC_MAX_PAD]; + u16 plen; + __le64 pbc_val; +- +- u32 retry_count; + }; + + static void vnic_sdma_complete(struct sdma_txreq *txreq, +@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx, + ret = build_vnic_tx_desc(sde, tx, pbc); + if (unlikely(ret)) + goto free_desc; +- tx->retry_count = 0; + + ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq, + vnic_sdma->pkts_sent); +@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde, + struct hfi1_vnic_sdma *vnic_sdma = + container_of(wait, struct hfi1_vnic_sdma, wait); + struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev; +- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq); + +- if (sdma_progress(sde, seq, txreq)) +- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT) +- return -EAGAIN; ++ write_seqlock(&dev->iowait_lock); ++ if (sdma_progress(sde, seq, txreq)) { ++ write_sequnlock(&dev->iowait_lock); ++ return -EAGAIN; ++ } + + vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED; +- write_seqlock(&dev->iowait_lock); + if (list_empty(&vnic_sdma->wait.list)) + iowait_queue(pkts_sent, wait, &sde->dmawait); + write_sequnlock(&dev->iowait_lock); +-- +2.20.1 + diff --git a/queue-4.19/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch b/queue-4.19/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch new file mode 100644 index 00000000000..b568fcb9525 --- /dev/null +++ b/queue-4.19/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch @@ -0,0 +1,122 @@ +From 6b9e4890f574cd01c2ba51df90018d9b5eff5c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:19:04 -0800 +Subject: IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state + +From: Kaike Wan + +[ Upstream commit c1a797c0818e0122c7ec8422edd971cfec9b15ea ] + +When it is requested to change its physical state back to Offline while in +the process to go up, DC8051 will set the ERROR field in the +DC8051_DBG_ERR_INFO_SET_BY_8051 register. This ERROR field will remain +until the next time when DC8051 transitions from Offline to Polling. +Subsequently, when the host requests DC8051 to change its physical state +to Polling again, it may receive a DC8051 interrupt with the stale ERROR +field still in DC8051_DBG_ERR_INFO_SET_BY_8051. If the host link state has +been changed to Polling, this stale ERROR will force the host to +transition to Offline state, resulting in a vicious cycle of Polling +->Offline->Polling->Offline. On the other hand, if the host link state is +still Offline when the stale ERROR is received, the stale ERROR will be +ignored, and the link will come up correctly. This patch implements the +correct behavior by changing host link state to Polling only after DC8051 +changes its physical state to Polling. + +Reviewed-by: Mike Marciniszyn +Signed-off-by: Krzysztof Goreczny +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/chip.c | 47 ++++++++++++++++++++++++++++++- + 1 file changed, 46 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 6aa5a8a242ffd..6b89353611333 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state); + static void log_physical_state(struct hfi1_pportdata *ppd, u32 state); + static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state, + int msecs); ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs); + static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc); + static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr); + static void handle_temp_err(struct hfi1_devdata *dd); +@@ -10769,13 +10771,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + break; + + ppd->port_error_action = 0; +- ppd->host_link_state = HLS_DN_POLL; + + if (quick_linkup) { + /* quick linkup does not go into polling */ + ret = do_quick_linkup(dd); + } else { + ret1 = set_physical_link_state(dd, PLS_POLLING); ++ if (!ret1) ++ ret1 = wait_phys_link_out_of_offline(ppd, ++ 3000); + if (ret1 != HCMD_SUCCESS) { + dd_dev_err(dd, + "Failed to transition to Polling link state, return 0x%x\n", +@@ -10783,6 +10787,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + ret = -EINVAL; + } + } ++ ++ /* ++ * Change the host link state after requesting DC8051 to ++ * change its physical state so that we can ignore any ++ * interrupt with stale LNI(XX) error, which will not be ++ * cleared until DC8051 transitions to Polling state. ++ */ ++ ppd->host_link_state = HLS_DN_POLL; + ppd->offline_disabled_reason = + HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE); + /* +@@ -12914,6 +12926,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd, + return read_state; + } + ++/* ++ * wait_phys_link_out_of_offline - wait for any out of offline state ++ * @ppd: port device ++ * @msecs: the number of milliseconds to wait ++ * ++ * Wait up to msecs milliseconds for any out of offline physical link ++ * state change to occur. ++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT. ++ */ ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs) ++{ ++ u32 read_state; ++ unsigned long timeout; ++ ++ timeout = jiffies + msecs_to_jiffies(msecs); ++ while (1) { ++ read_state = read_physical_state(ppd->dd); ++ if ((read_state & 0xF0) != PLS_OFFLINE) ++ break; ++ if (time_after(jiffies, timeout)) { ++ dd_dev_err(ppd->dd, ++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n", ++ read_state, msecs); ++ return -ETIMEDOUT; ++ } ++ usleep_range(1950, 2050); /* sleep 2ms-ish */ ++ } ++ ++ log_state_transition(ppd, read_state); ++ return read_state; ++} ++ + #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \ + (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK) + +-- +2.20.1 + diff --git a/queue-4.19/ice-fix-nvm-mask-defines.patch b/queue-4.19/ice-fix-nvm-mask-defines.patch new file mode 100644 index 00000000000..19e99697d34 --- /dev/null +++ b/queue-4.19/ice-fix-nvm-mask-defines.patch @@ -0,0 +1,41 @@ +From e1ab1d5933b4a46f3288956e5fc4ff52cedaa089 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 10:41:05 -0700 +Subject: ice: Fix NVM mask defines + +From: Lev Faerman + +[ Upstream commit 6263e811f4d4418660c20b36a08063c6d2c3fb9d ] + +Fixes bad masks that would break compilation when evaluated. + +Signed-off-by: Lev Faerman +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +index a0614f472658a..328d293bc3ff5 100644 +--- a/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h ++++ b/drivers/net/ethernet/intel/ice/ice_adminq_cmd.h +@@ -1056,10 +1056,10 @@ struct ice_aqc_nvm { + #define ICE_AQC_NVM_LAST_CMD BIT(0) + #define ICE_AQC_NVM_PCIR_REQ BIT(0) /* Used by NVM Update reply */ + #define ICE_AQC_NVM_PRESERVATION_S 1 +-#define ICE_AQC_NVM_PRESERVATION_M (3 << CSR_AQ_NVM_PRESERVATION_S) +-#define ICE_AQC_NVM_NO_PRESERVATION (0 << CSR_AQ_NVM_PRESERVATION_S) ++#define ICE_AQC_NVM_PRESERVATION_M (3 << ICE_AQC_NVM_PRESERVATION_S) ++#define ICE_AQC_NVM_NO_PRESERVATION (0 << ICE_AQC_NVM_PRESERVATION_S) + #define ICE_AQC_NVM_PRESERVE_ALL BIT(1) +-#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << CSR_AQ_NVM_PRESERVATION_S) ++#define ICE_AQC_NVM_PRESERVE_SELECTED (3 << ICE_AQC_NVM_PRESERVATION_S) + #define ICE_AQC_NVM_FLASH_ONLY BIT(7) + __le16 module_typeid; + __le16 length; +-- +2.20.1 + diff --git a/queue-4.19/ice-fix-possible-null-pointer-de-reference.patch b/queue-4.19/ice-fix-possible-null-pointer-de-reference.patch new file mode 100644 index 00000000000..5d89468d441 --- /dev/null +++ b/queue-4.19/ice-fix-possible-null-pointer-de-reference.patch @@ -0,0 +1,38 @@ +From e4315dd574208beb060276b468b8d051aaad9e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 10:19:35 -0800 +Subject: ice: Fix possible NULL pointer de-reference + +From: Bruce Allan + +[ Upstream commit f25dad19ba70f7cc135da78ec013325042cd8c52 ] + +A recent update to smatch is causing it to report the error "we previously +assumed 'm_entry->vsi_list_info' could be null". Fix that. + +Signed-off-by: Bruce Allan +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_switch.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/ice/ice_switch.c b/drivers/net/ethernet/intel/ice/ice_switch.c +index 4012adbab0112..1bfc59dff51f7 100644 +--- a/drivers/net/ethernet/intel/ice/ice_switch.c ++++ b/drivers/net/ethernet/intel/ice/ice_switch.c +@@ -1023,6 +1023,9 @@ ice_handle_vsi_list_mgmt(struct ice_hw *hw, + u16 vsi_id = new_fltr->fwd_id.vsi_id; + enum ice_adminq_opc opcode; + ++ if (!m_entry->vsi_list_info) ++ return ICE_ERR_CFG; ++ + /* A rule already exists with the new VSI being added */ + if (test_bit(vsi_id, m_entry->vsi_list_info->vsi_map)) + return 0; +-- +2.20.1 + diff --git a/queue-4.19/ice-fix-return-value-from-napi-poll.patch b/queue-4.19/ice-fix-return-value-from-napi-poll.patch new file mode 100644 index 00000000000..26dc7f4ac0e --- /dev/null +++ b/queue-4.19/ice-fix-return-value-from-napi-poll.patch @@ -0,0 +1,41 @@ +From c60312845ba53addbb9b143309f3138d83707b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 11:44:43 -0700 +Subject: ice: Fix return value from NAPI poll + +From: Dave Ertman + +[ Upstream commit e0c9fd9b77a7334032ec407d9e14d7c3cac1ac4f ] + +ice_napi_poll is hard-coded to return zero when it's done. It should +instead return the work done (if any work was done). The only time it +should return zero is if an interrupt or poll is handled and no work +is performed. So change the return value to be the minimum of work +done or budget-1. + +Signed-off-by: Dave Ertman +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_txrx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c +index 0c95c8f83432c..1d84fedf1f649 100644 +--- a/drivers/net/ethernet/intel/ice/ice_txrx.c ++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c +@@ -1106,7 +1106,8 @@ int ice_napi_poll(struct napi_struct *napi, int budget) + napi_complete_done(napi, work_done); + if (test_bit(ICE_FLAG_MSIX_ENA, pf->flags)) + ice_irq_dynamic_ena(&vsi->back->hw, vsi, q_vector); +- return 0; ++ ++ return min(work_done, budget - 1); + } + + /* helper function for building cmd/type/offset */ +-- +2.20.1 + diff --git a/queue-4.19/input-cyttsp4_core-fix-use-after-free-bug.patch b/queue-4.19/input-cyttsp4_core-fix-use-after-free-bug.patch new file mode 100644 index 00000000000..93243100ba5 --- /dev/null +++ b/queue-4.19/input-cyttsp4_core-fix-use-after-free-bug.patch @@ -0,0 +1,51 @@ +From c0ff4235181661dffc9f29937b637bb30b72f350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 17:04:54 -0800 +Subject: Input: cyttsp4_core - fix use after free bug + +From: Pan Bian + +[ Upstream commit 79aae6acbef16f720a7949f8fc6ac69816c79d62 ] + +The device md->input is used after it is released. Setting the device +data to NULL is unnecessary as the device is never used again. Instead, +md->input should be assigned NULL to avoid accessing the freed memory +accidently. Besides, checking md->si against NULL is superfluous as it +points to a variable address, which cannot be NULL. + +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/1572936379-6423-1-git-send-email-bianpan2016@163.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/cyttsp4_core.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index 727c3232517cd..c84ee739a8d50 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -2000,11 +2000,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + /* get sysinfo */ + md->si = &cd->sysinfo; +- if (!md->si) { +- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", +- __func__, md->si); +- goto error_get_sysinfo; +- } + + rc = cyttsp4_setup_input_device(cd); + if (rc) +@@ -2014,8 +2009,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + error_init_input: + input_free_device(md->input); +-error_get_sysinfo: +- input_set_drvdata(md->input, NULL); + error_alloc_failed: + dev_err(dev, "%s failed.\n", __func__); + return rc; +-- +2.20.1 + diff --git a/queue-4.19/iomap-dio-data-corruption-and-spurious-errors-when-p.patch b/queue-4.19/iomap-dio-data-corruption-and-spurious-errors-when-p.patch new file mode 100644 index 00000000000..1bf3b9e1718 --- /dev/null +++ b/queue-4.19/iomap-dio-data-corruption-and-spurious-errors-when-p.patch @@ -0,0 +1,107 @@ +From d074dfabfcde1eda4ac093d6fecb29ca3f138b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 13:31:11 -0800 +Subject: iomap: dio data corruption and spurious errors when pipes fill + +From: Dave Chinner + +[ Upstream commit 4721a6010990971440b4ffefbdf014976b8eda2f ] + +When doing direct IO to a pipe for do_splice_direct(), then pipe is +trivial to fill up and overflow as it can only hold 16 pages. At +this point bio_iov_iter_get_pages() then returns -EFAULT, and we +abort the IO submission process. Unfortunately, iomap_dio_rw() +propagates the error back up the stack. + +The error is converted from the EFAULT to EAGAIN in +generic_file_splice_read() to tell the splice layers that the pipe +is full. do_splice_direct() completely fails to handle EAGAIN errors +(it aborts on error) and returns EAGAIN to the caller. + +copy_file_write() then completely fails to handle EAGAIN as well, +and so returns EAGAIN to userspace, having failed to copy the data +it was asked to. + +Avoid this whole steaming pile of fail by having iomap_dio_rw() +silently swallow EFAULT errors and so do short reads. + +To make matters worse, iomap_dio_actor() has a stale data exposure +bug bio_iov_iter_get_pages() fails - it does not zero the tail block +that it may have been left uncovered by partial IO. Fix the error +handling case to drop to the sub-block zeroing rather than +immmediately returning the -EFAULT error. + +Signed-off-by: Dave Chinner +Reviewed-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/fs/iomap.c b/fs/iomap.c +index d3d227682f7d4..0ff0f8ca3b197 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -1603,7 +1603,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + struct bio *bio; + bool need_zeroout = false; + bool use_fua = false; +- int nr_pages, ret; ++ int nr_pages, ret = 0; + size_t copied = 0; + + if ((pos | length | align) & ((1 << blkbits) - 1)) +@@ -1668,8 +1668,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + + ret = bio_iov_iter_get_pages(bio, &iter); + if (unlikely(ret)) { ++ /* ++ * We have to stop part way through an IO. We must fall ++ * through to the sub-block tail zeroing here, otherwise ++ * this short IO may expose stale data in the tail of ++ * the block we haven't written data to. ++ */ + bio_put(bio); +- return copied ? copied : ret; ++ goto zero_tail; + } + + n = bio->bi_iter.bi_size; +@@ -1706,6 +1712,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + * the block tail in the latter case, we can expose stale data via mmap + * reads of the EOF block. + */ ++zero_tail: + if (need_zeroout || + ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { + /* zero out from the end of the write to the end of the block */ +@@ -1713,7 +1720,7 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + if (pad) + iomap_dio_zero(dio, iomap, pos, fs_block_size - pad); + } +- return copied; ++ return copied ? copied : ret; + } + + static loff_t +@@ -1888,6 +1895,15 @@ iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, + wait_for_completion = true; + ret = 0; + } ++ ++ /* ++ * Splicing to pipes can fail on a full pipe. We have to ++ * swallow this to make it look like a short IO ++ * otherwise the higher splice layers will completely ++ * mishandle the error and stop moving data. ++ */ ++ if (ret == -EFAULT) ++ ret = 0; + break; + } + pos += ret; +-- +2.20.1 + diff --git a/queue-4.19/iomap-fua-is-wrong-for-dio-o_dsync-writes-into-unwri.patch b/queue-4.19/iomap-fua-is-wrong-for-dio-o_dsync-writes-into-unwri.patch new file mode 100644 index 00000000000..35becf6c583 --- /dev/null +++ b/queue-4.19/iomap-fua-is-wrong-for-dio-o_dsync-writes-into-unwri.patch @@ -0,0 +1,61 @@ +From 75262e256b6dad96a91eed932c8217f85321e040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 13:31:10 -0800 +Subject: iomap: FUA is wrong for DIO O_DSYNC writes into unwritten extents + +From: Dave Chinner + +[ Upstream commit 0929d8580071c6a1cec1a7916a8f674c243ceee1 ] + +When we write into an unwritten extent via direct IO, we dirty +metadata on IO completion to convert the unwritten extent to +written. However, when we do the FUA optimisation checks, the inode +may be clean and so we issue a FUA write into the unwritten extent. +This means we then bypass the generic_write_sync() call after +unwritten extent conversion has ben done and we don't force the +modified metadata to stable storage. + +This violates O_DSYNC semantics. The window of exposure is a single +IO, as the next DIO write will see the inode has dirty metadata and +hence will not use the FUA optimisation. Calling +generic_write_sync() after completion of the second IO will also +sync the first write and it's metadata. + +Fix this by avoiding the FUA optimisation when writing to unwritten +extents. + +Signed-off-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/iomap.c b/fs/iomap.c +index fac45206418a2..914c07c9e0d6f 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -1619,12 +1619,13 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + + if (iomap->flags & IOMAP_F_NEW) { + need_zeroout = true; +- } else { ++ } else if (iomap->type == IOMAP_MAPPED) { + /* +- * Use a FUA write if we need datasync semantics, this +- * is a pure data IO that doesn't require any metadata +- * updates and the underlying device supports FUA. This +- * allows us to avoid cache flushes on IO completion. ++ * Use a FUA write if we need datasync semantics, this is a pure ++ * data IO that doesn't require any metadata updates (including ++ * after IO completion such as unwritten extent conversion) and ++ * the underlying device supports FUA. This allows us to avoid ++ * cache flushes on IO completion. + */ + if (!(iomap->flags & (IOMAP_F_SHARED|IOMAP_F_DIRTY)) && + (dio->flags & IOMAP_DIO_WRITE_FUA) && +-- +2.20.1 + diff --git a/queue-4.19/iomap-readpages-doesn-t-zero-page-tail-beyond-eof.patch b/queue-4.19/iomap-readpages-doesn-t-zero-page-tail-beyond-eof.patch new file mode 100644 index 00000000000..483a188dc9b --- /dev/null +++ b/queue-4.19/iomap-readpages-doesn-t-zero-page-tail-beyond-eof.patch @@ -0,0 +1,141 @@ +From 4d77a37a2584030f9a3ac8c6268cf10377c236ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 08:06:37 -0800 +Subject: iomap: readpages doesn't zero page tail beyond EOF + +From: Dave Chinner + +[ Upstream commit 8c110d43c6bca4b24dd13272a9d4e0ba6f2ec957 ] + +When we read the EOF page of the file via readpages, we need +to zero the region beyond EOF that we either do not read or +should not contain data so that mmap does not expose stale data to +user applications. + +However, iomap_adjust_read_range() fails to detect EOF correctly, +and so fsx on 1k block size filesystems fails very quickly with +mapreads exposing data beyond EOF. There are two problems here. + +Firstly, when calculating the end block of the EOF byte, we have +to round the size by one to avoid a block aligned EOF from reporting +a block too large. i.e. a size of 1024 bytes is 1 block, which in +index terms is block 0. Therefore we have to calculate the end block +from (isize - 1), not isize. + +The second bug is determining if the current page spans EOF, and so +whether we need split it into two half, one for the IO, and the +other for zeroing. Unfortunately, the code that checks whether +we should split the block doesn't actually check if we span EOF, it +just checks if the read spans the /offset in the page/ that EOF +sits on. So it splits every read into two if EOF is not page +aligned, regardless of whether we are reading the EOF block or not. + +Hence we need to restrict the "does the read span EOF" check to +just the page that spans EOF, not every page we read. + +This patch results in correct EOF detection through readpages: + +xfs_vm_readpages: dev 259:0 ino 0x43 nr_pages 24 +xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x4f000 count 98304 type hole startoff 0x13c startblock 1368 blockcount 0x4 +iomap_readpage_actor: orig pos 323584 pos 323584, length 4096, poff 0 plen 4096, isize 420864 +xfs_iomap_found: dev 259:0 ino 0x43 size 0x66c00 offset 0x50000 count 94208 type hole startoff 0x140 startblock 1497 blockcount 0x5c +iomap_readpage_actor: orig pos 327680 pos 327680, length 94208, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 331776 pos 331776, length 90112, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 335872 pos 335872, length 86016, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 339968 pos 339968, length 81920, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 344064 pos 344064, length 77824, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 348160 pos 348160, length 73728, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 352256 pos 352256, length 69632, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 356352 pos 356352, length 65536, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 360448 pos 360448, length 61440, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 364544 pos 364544, length 57344, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 368640 pos 368640, length 53248, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 372736 pos 372736, length 49152, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 376832 pos 376832, length 45056, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 380928 pos 380928, length 40960, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 385024 pos 385024, length 36864, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 389120 pos 389120, length 32768, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 393216 pos 393216, length 28672, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 397312 pos 397312, length 24576, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 401408 pos 401408, length 20480, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 405504 pos 405504, length 16384, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 409600 pos 409600, length 12288, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 413696 pos 413696, length 8192, poff 0 plen 4096, isize 420864 +iomap_readpage_actor: orig pos 417792 pos 417792, length 4096, poff 0 plen 3072, isize 420864 +iomap_readpage_actor: orig pos 420864 pos 420864, length 1024, poff 3072 plen 1024, isize 420864 + +As you can see, it now does full page reads until the last one which +is split correctly at the block aligned EOF, reading 3072 bytes and +zeroing the last 1024 bytes. The original version of the patch got +this right, but it got another case wrong. + +The EOF detection crossing really needs to the the original length +as plen, while it starts at the end of the block, will be shortened +as up-to-date blocks are found on the page. This means "orig_pos + +plen" no longer points to the end of the page, and so will not +correctly detect EOF crossing. Hence we have to use the length +passed in to detect this partial page case: + +xfs_filemap_fault: dev 259:1 ino 0x43 write_fault 0 +xfs_vm_readpage: dev 259:1 ino 0x43 nr_pages 1 +xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2c000 count 4096 type hole startoff 0xb0 startblock 282 blockcount 0x4 +iomap_readpage_actor: orig pos 180224 pos 181248, length 4096, poff 1024 plen 2048, isize 183296 +xfs_iomap_found: dev 259:1 ino 0x43 size 0x2cc00 offset 0x2cc00 count 1024 type hole startoff 0xb3 startblock 285 blockcount 0x1 +iomap_readpage_actor: orig pos 183296 pos 183296, length 1024, poff 3072 plen 1024, isize 183296 + +Heere we see a trace where the first block on the EOF page is up to +date, hence poff = 1024 bytes. The offset into the page of EOF is +3072, so the range we want to read is 1024 - 3071, and the range we +want to zero is 3072 - 4095. You can see this is split correctly +now. + +This fixes the stale data beyond EOF problem that fsx quickly +uncovers on 1k block size filesystems. + +Signed-off-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/iomap.c b/fs/iomap.c +index 0ff0f8ca3b197..caa45f73967cf 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -150,13 +150,14 @@ static void + iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, + loff_t *pos, loff_t length, unsigned *offp, unsigned *lenp) + { ++ loff_t orig_pos = *pos; ++ loff_t isize = i_size_read(inode); + unsigned block_bits = inode->i_blkbits; + unsigned block_size = (1 << block_bits); + unsigned poff = offset_in_page(*pos); + unsigned plen = min_t(loff_t, PAGE_SIZE - poff, length); + unsigned first = poff >> block_bits; + unsigned last = (poff + plen - 1) >> block_bits; +- unsigned end = offset_in_page(i_size_read(inode)) >> block_bits; + + /* + * If the block size is smaller than the page size we need to check the +@@ -191,8 +192,12 @@ iomap_adjust_read_range(struct inode *inode, struct iomap_page *iop, + * handle both halves separately so that we properly zero data in the + * page cache for blocks that are entirely outside of i_size. + */ +- if (first <= end && last > end) +- plen -= (last - end) * block_size; ++ if (orig_pos <= isize && orig_pos + length > isize) { ++ unsigned end = offset_in_page(isize - 1) >> block_bits; ++ ++ if (first <= end && last > end) ++ plen -= (last - end) * block_size; ++ } + + *offp = poff; + *lenp = plen; +-- +2.20.1 + diff --git a/queue-4.19/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch b/queue-4.19/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch new file mode 100644 index 00000000000..4b0bdb58e69 --- /dev/null +++ b/queue-4.19/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch @@ -0,0 +1,50 @@ +From e2651b022de57f56c1a9fe714a5758538e15cd8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 13:31:10 -0800 +Subject: iomap: sub-block dio needs to zeroout beyond EOF + +From: Dave Chinner + +[ Upstream commit b450672fb66b4a991a5b55ee24209ac7ae7690ce ] + +If we are doing sub-block dio that extends EOF, we need to zero +the unused tail of the block to initialise the data in it it. If we +do not zero the tail of the block, then an immediate mmap read of +the EOF block will expose stale data beyond EOF to userspace. Found +with fsx running sub-block DIO sizes vs MAPREAD/MAPWRITE operations. + +Fix this by detecting if the end of the DIO write is beyond EOF +and zeroing the tail if necessary. + +Signed-off-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/iomap.c b/fs/iomap.c +index 914c07c9e0d6f..d3d227682f7d4 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -1700,7 +1700,14 @@ iomap_dio_bio_actor(struct inode *inode, loff_t pos, loff_t length, + dio->submit.cookie = submit_bio(bio); + } while (nr_pages); + +- if (need_zeroout) { ++ /* ++ * We need to zeroout the tail of a sub-block write if the extent type ++ * requires zeroing or the write extends beyond EOF. If we don't zero ++ * the block tail in the latter case, we can expose stale data via mmap ++ * reads of the EOF block. ++ */ ++ if (need_zeroout || ++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { + /* zero out from the end of the write to the end of the block */ + pad = pos & (fs_block_size - 1); + if (pad) +-- +2.20.1 + diff --git a/queue-4.19/iommu-amd-fix-line-break-in-error-log-reporting.patch b/queue-4.19/iommu-amd-fix-line-break-in-error-log-reporting.patch new file mode 100644 index 00000000000..c470365e009 --- /dev/null +++ b/queue-4.19/iommu-amd-fix-line-break-in-error-log-reporting.patch @@ -0,0 +1,105 @@ +From a1c2f59fc4126363aada985e9a8116f705687083 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 16:43:57 +0100 +Subject: iommu/amd: Fix line-break in error log reporting + +From: Joerg Roedel + +[ Upstream commit 1a21ee1aabf7ff9484f2eb122476d80c7f60a620 ] + +With the switch to dev_err for reporting errors from the +iommu log there was an unwanted newline introduced. The +reason was that the reporting was done in multiple dev_err() +calls, and dev_err adds a newline after every call. + +Fix it by printing the log messages with only one dev_err() +call. + +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index fe18804a50083..9991386fb7000 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -549,7 +549,7 @@ static void amd_iommu_report_page_fault(u16 devid, u16 domain_id, + dev_data = get_dev_data(&pdev->dev); + + if (dev_data && __ratelimit(&dev_data->rs)) { +- dev_err(&pdev->dev, "AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n", ++ dev_err(&pdev->dev, "Event logged [IO_PAGE_FAULT domain=0x%04x address=0x%016llx flags=0x%04x]\n", + domain_id, address, flags); + } else if (printk_ratelimit()) { + pr_err("AMD-Vi: Event logged [IO_PAGE_FAULT device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n", +@@ -589,43 +589,41 @@ retry: + if (type == EVENT_TYPE_IO_FAULT) { + amd_iommu_report_page_fault(devid, pasid, address, flags); + return; +- } else { +- dev_err(dev, "AMD-Vi: Event logged ["); + } + + switch (type) { + case EVENT_TYPE_ILL_DEV: +- dev_err(dev, "ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", ++ dev_err(dev, "Event logged [ILLEGAL_DEV_TABLE_ENTRY device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + pasid, address, flags); + dump_dte_entry(devid); + break; + case EVENT_TYPE_DEV_TAB_ERR: +- dev_err(dev, "DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x " ++ dev_err(dev, "Event logged [DEV_TAB_HARDWARE_ERROR device=%02x:%02x.%x " + "address=0x%016llx flags=0x%04x]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + address, flags); + break; + case EVENT_TYPE_PAGE_TAB_ERR: +- dev_err(dev, "PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n", ++ dev_err(dev, "Event logged [PAGE_TAB_HARDWARE_ERROR device=%02x:%02x.%x domain=0x%04x address=0x%016llx flags=0x%04x]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + pasid, address, flags); + break; + case EVENT_TYPE_ILL_CMD: +- dev_err(dev, "ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address); ++ dev_err(dev, "Event logged [ILLEGAL_COMMAND_ERROR address=0x%016llx]\n", address); + dump_command(address); + break; + case EVENT_TYPE_CMD_HARD_ERR: +- dev_err(dev, "COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n", ++ dev_err(dev, "Event logged [COMMAND_HARDWARE_ERROR address=0x%016llx flags=0x%04x]\n", + address, flags); + break; + case EVENT_TYPE_IOTLB_INV_TO: +- dev_err(dev, "IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n", ++ dev_err(dev, "Event logged [IOTLB_INV_TIMEOUT device=%02x:%02x.%x address=0x%016llx]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + address); + break; + case EVENT_TYPE_INV_DEV_REQ: +- dev_err(dev, "INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", ++ dev_err(dev, "Event logged [INVALID_DEVICE_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + pasid, address, flags); + break; +@@ -633,12 +631,12 @@ retry: + pasid = ((event[0] >> 16) & 0xFFFF) + | ((event[1] << 6) & 0xF0000); + tag = event[1] & 0x03FF; +- dev_err(dev, "INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", ++ dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%02x:%02x.%x pasid=0x%05x address=0x%016llx flags=0x%04x]\n", + PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + pasid, address, flags); + break; + default: +- dev_err(dev, "UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n", ++ dev_err(dev, "Event logged [UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n", + event[0], event[1], event[2], event[3]); + } + +-- +2.20.1 + diff --git a/queue-4.19/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch b/queue-4.19/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch new file mode 100644 index 00000000000..361ab6bdeea --- /dev/null +++ b/queue-4.19/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch @@ -0,0 +1,39 @@ +From 837296519595c616f1050f5b4ae8d95c626d29b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Nov 2018 05:27:39 -0800 +Subject: iw_cxgb4: only reconnect with MPAv1 if the peer aborts + +From: Steve Wise + +[ Upstream commit 9828ca654b52848e7eb7dcc9b0994ff130dd4546 ] + +Only retry connection setup with MPAv1 if the peer actually aborted the +connection upon receiving the MPAv2 start message. This avoids retrying +with MPAv1 in the case where the connection was aborted due to retransmit +timeouts. + +Fixes: d2fe99e86bb2 ("RDMA/cxgb4: Add support for MPAv2 Enhanced RDMA Negotiation") +Signed-off-by: Steve Wise +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index a5ff1f0f2073e..4dcc92d116097 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2798,7 +2798,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb) + break; + case MPA_REQ_SENT: + (void)stop_ep_timer(ep); +- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1)) ++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 || ++ (mpa_rev == 2 && ep->tried_with_mpa_v1)) + connect_reply_upcall(ep, -ECONNRESET); + else { + /* +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-fix-cfg-structs-for-22000-with-different-rf-.patch b/queue-4.19/iwlwifi-fix-cfg-structs-for-22000-with-different-rf-.patch new file mode 100644 index 00000000000..1109db20d12 --- /dev/null +++ b/queue-4.19/iwlwifi-fix-cfg-structs-for-22000-with-different-rf-.patch @@ -0,0 +1,90 @@ +From da435c30b1d5d0a6c5ce2c17d9521d2fb98faf56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Aug 2018 14:45:42 +0300 +Subject: iwlwifi: fix cfg structs for 22000 with different RF modules + +From: Luca Coelho + +[ Upstream commit b1bbc1a636505ebdd6336ff781e417123226d4f7 ] + +We have to choose different configuration and different firmwares +depending on the external RF module that is installed. Since the +external module is not represented in the PCI IDs, we need to change +the configuration at runtime, after checking the RF ID of the module +installed. We have a bit of a mess in the code that does this, +because it applies cfg's according to the RF ID only, ignoring the +integrated module that is in use. + +Fix that for some devices by adding correct configurations for them +and not ignoring the integrated module's type when making the +decision. + +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/cfg/22000.c | 1 - + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 +- + .../net/wireless/intel/iwlwifi/pcie/trans.c | 22 +++++++++++++++++-- + 3 files changed, 21 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +index a0de61aa0feff..d7335fabd9294 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/22000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/22000.c +@@ -321,7 +321,6 @@ MODULE_FIRMWARE(IWL_22000_HR_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_JF_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_HR_A_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_HR_B_F0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); +-MODULE_FIRMWARE(IWL_22000_QU_B_HR_B_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_HR_B_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_JF_B0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL_22000_HR_A0_QNJ_MODULE_FIRMWARE(IWL_22000_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 0982bd99b1c3c..844a1009484f6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -888,7 +888,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x34F0, 0x0040, iwl22000_2ax_cfg_hr)}, + {IWL_PCI_DEVICE(0x34F0, 0x0070, iwl22000_2ax_cfg_hr)}, + {IWL_PCI_DEVICE(0x34F0, 0x0078, iwl22000_2ax_cfg_hr)}, +- {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ac_cfg_jf)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0310, iwl22000_2ax_cfg_hr)}, + {IWL_PCI_DEVICE(0x40C0, 0x0000, iwl22560_2ax_cfg_su_cdb)}, + {IWL_PCI_DEVICE(0x40C0, 0x0010, iwl22560_2ax_cfg_su_cdb)}, + {IWL_PCI_DEVICE(0x40c0, 0x0090, iwl22560_2ax_cfg_su_cdb)}, +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index f89d43bc7d4bd..4f5571123f70a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -3415,8 +3415,26 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev, + #if IS_ENABLED(CONFIG_IWLMVM) + trans->hw_rf_id = iwl_read32(trans, CSR_HW_RF_ID); + +- if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) == +- CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) { ++ if (cfg == &iwl22000_2ax_cfg_hr) { ++ if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) == ++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) { ++ trans->cfg = &iwl22000_2ax_cfg_hr; ++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) == ++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_JF)) { ++ trans->cfg = &iwl22000_2ax_cfg_jf; ++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) == ++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HRCDB)) { ++ IWL_ERR(trans, "RF ID HRCDB is not supported\n"); ++ ret = -EINVAL; ++ goto out_no_pci; ++ } else { ++ IWL_ERR(trans, "Unrecognized RF ID 0x%08x\n", ++ CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id)); ++ ret = -EINVAL; ++ goto out_no_pci; ++ } ++ } else if (CSR_HW_RF_ID_TYPE_CHIP_ID(trans->hw_rf_id) == ++ CSR_HW_RF_ID_TYPE_CHIP_ID(CSR_HW_RF_ID_TYPE_HR)) { + u32 hw_status; + + hw_status = iwl_read_prph(trans, UMAG_GEN_HW_STATUS); +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch b/queue-4.19/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch new file mode 100644 index 00000000000..4a570fbf425 --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch @@ -0,0 +1,51 @@ +From 582dae32d99bd7528d108777d530a103c9fc5c58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jul 2018 21:57:50 +0300 +Subject: iwlwifi: mvm: Send non offchannel traffic via AP sta + +From: Andrei Otcheretianski + +[ Upstream commit dc1aca22f8f38b7e2ad7b118db87404d11e68771 ] + +TDLS discovery response frame is a unicast direct frame to the peer. +Since we don't have a STA for this peer, this frame goes through +iwl_tx_skb_non_sta(). As the result aux_sta and some completely +arbitrary queue would be selected for this frame, resulting in a queue +hang. Fix that by sending such frames through AP sta instead. + +Signed-off-by: Andrei Otcheretianski +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 0f357e8c4f940..476c44db0e64b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -820,6 +820,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, + !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) + sta = NULL; + ++ /* If there is no sta, and it's not offchannel - send through AP */ ++ if (info->control.vif->type == NL80211_IFTYPE_STATION && ++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) { ++ struct iwl_mvm_vif *mvmvif = ++ iwl_mvm_vif_from_mac80211(info->control.vif); ++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id); ++ ++ if (ap_sta_id < IWL_MVM_STATION_COUNT) { ++ /* mac80211 holds rcu read lock */ ++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]); ++ if (IS_ERR_OR_NULL(sta)) ++ goto drop; ++ } ++ } ++ + if (sta) { + if (iwl_mvm_defer_tx(mvm, sta, skb)) + return; +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-mvm-synchronize-tid-queue-removal.patch b/queue-4.19/iwlwifi-mvm-synchronize-tid-queue-removal.patch new file mode 100644 index 00000000000..303d4901e38 --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-synchronize-tid-queue-removal.patch @@ -0,0 +1,47 @@ +From 7a950f581199d2bb37d0c2f8dd7bfbb9f96e2480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 23:12:33 +0200 +Subject: iwlwifi: mvm: synchronize TID queue removal + +From: Johannes Berg + +[ Upstream commit 06bc6f6ed4ae0246a5e52094d1be90906a1361c7 ] + +When we mark a TID as no longer having a queue, there's no +guarantee the TX path isn't using this txq_id right now, +having accessed it just before we reset the value. To fix +this, add synchronize_net() when we change the TIDs from +having a queue to not having one, so that we can then be +sure that the TX path is no longer accessing that queue. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 04ea516bddcc0..e850aa504b608 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -440,6 +440,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) + + rcu_read_unlock(); + ++ /* ++ * The TX path may have been using this TXQ_ID from the tid_data, ++ * so make sure it's no longer running so that we can safely reuse ++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE ++ * above, but nothing guarantees we've stopped using them. Thus, ++ * without this, we could get to iwl_mvm_disable_txq() and remove ++ * the queue while still sending frames to it. ++ */ ++ synchronize_net(); ++ + return disable_agg_tids; + } + +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch b/queue-4.19/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch new file mode 100644 index 00000000000..e01082bb718 --- /dev/null +++ b/queue-4.19/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch @@ -0,0 +1,90 @@ +From 4f823097e96bfa0948363fdd70c15a79705c3757 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 13:51:47 +0200 +Subject: iwlwifi: pcie: don't consider IV len in A-MSDU + +From: Mordechay Goodstein + +[ Upstream commit cb1a4badf59275eb7221dcec621e8154917eabd1 ] + +From gen2 PN is totally offloaded to hardware (also the space for the +IV isn't part of the skb). As you can see in mvm/mac80211.c:3545, the +MAC for cipher types CCMP/GCMP doesn't set +IEEE80211_KEY_FLAG_PUT_IV_SPACE for gen2 NICs. + +This causes all the AMSDU data to be corrupted with cipher enabled. + +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 20 +++++++------------ + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index 316e2ba0c34d7..7b1dff92b7094 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -242,27 +242,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + struct ieee80211_hdr *hdr = (void *)skb->data; + unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room; + unsigned int mss = skb_shinfo(skb)->gso_size; +- u16 length, iv_len, amsdu_pad; ++ u16 length, amsdu_pad; + u8 *start_hdr; + struct iwl_tso_hdr_page *hdr_page; + struct page **page_ptr; + struct tso_t tso; + +- /* if the packet is protected, then it must be CCMP or GCMP */ +- iv_len = ieee80211_has_protected(hdr->frame_control) ? +- IEEE80211_CCMP_HDR_LEN : 0; +- + trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), + &dev_cmd->hdr, start_len, 0); + + ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb); + snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb); +- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len; ++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len; + amsdu_pad = 0; + + /* total amount of header we may need for this A-MSDU */ + hdr_room = DIV_ROUND_UP(total_len, mss) * +- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len; ++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)); + + /* Our device supports 9 segments at most, it will fit in 1 page */ + hdr_page = get_page_hdr(trans, hdr_room); +@@ -273,14 +269,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + start_hdr = hdr_page->pos; + page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs); + *page_ptr = hdr_page->page; +- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len); +- hdr_page->pos += iv_len; + + /* +- * Pull the ieee80211 header + IV to be able to use TSO core, ++ * Pull the ieee80211 header to be able to use TSO core, + * we will restore it for the tx_status flow. + */ +- skb_pull(skb, hdr_len + iv_len); ++ skb_pull(skb, hdr_len); + + /* + * Remove the length of all the headers that we don't actually +@@ -355,8 +349,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + } + } + +- /* re -add the WiFi header and IV */ +- skb_push(skb, hdr_len + iv_len); ++ /* re -add the WiFi header */ ++ skb_push(skb, hdr_len); + + return 0; + +-- +2.20.1 + diff --git a/queue-4.19/iwlwifi-trans-clear-persistence-bit-when-starting-th.patch b/queue-4.19/iwlwifi-trans-clear-persistence-bit-when-starting-th.patch new file mode 100644 index 00000000000..a1d37e5fc70 --- /dev/null +++ b/queue-4.19/iwlwifi-trans-clear-persistence-bit-when-starting-th.patch @@ -0,0 +1,111 @@ +From d312a77c216dca6a3742b7e65e1524ec4fc04845 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 15:31:36 +0300 +Subject: iwlwifi: trans: Clear persistence bit when starting the FW + +From: Shahar S Matityahu + +[ Upstream commit 8954e1eb2270fa2effffd031b4839253952c76f2 ] + +In D3 suspend flow in 9260 gen2 HW, the NIC receives two PERST signals. +The first PERST is expected and indicates the device on coming resume flow. +The second PERST causes FW restart FW restart. +In order to avoid this issue, the FW set the persistence bit on. +Once this bit is set, the FW ignores reset attempts. +The problem is when the FW gets assert during D3 and then the persistence +bit is set and causes the FW to ignore reset. +To handle this issue, the FW opens the preg bit which allows access +to the persistence bit, so that the driver clear the persistence bit +and reset the NIC. + +The flow is as follows: +the driver checks if the persistence bit is set. +If the bit is set, the driver checks if he can clear the bit. +If the driver can not clear the bit then there is no point to continue +configuring the NIC since it will fail. + +The fix was added is in start HW flow instead of the resume flow since in +general, if the persistence bit is set, the driver can not start the FW. +So it is good to check it when we start configuring the NIC. + +The driver does not need to close the preg bit since the FW close it +during the start flow. + +Signed-off-by: Shahar S Matityahu +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-prph.h | 7 +++++++ + drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 12 ++++++++++++ + 2 files changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h +index 421a869633a32..2e512f6e9ebcd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-prph.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-prph.h +@@ -8,6 +8,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2016 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -35,6 +36,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2016 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -399,6 +401,7 @@ enum aux_misc_master1_en { + #define AUX_MISC_MASTER1_SMPHR_STATUS 0xA20800 + #define RSA_ENABLE 0xA24B08 + #define PREG_AUX_BUS_WPROT_0 0xA04CC0 ++#define PREG_PRPH_WPROT_0 0xA04CE0 + #define SB_CPU_1_STATUS 0xA01E30 + #define SB_CPU_2_STATUS 0xA01E34 + #define UMAG_SB_CPU_1_STATUS 0xA038C0 +@@ -425,4 +428,8 @@ enum { + #define UREG_CHICK (0xA05C00) + #define UREG_CHICK_MSI_ENABLE BIT(24) + #define UREG_CHICK_MSIX_ENABLE BIT(25) ++ ++#define HPM_DEBUG 0xA03440 ++#define PERSISTENCE_BIT BIT(12) ++#define PREG_WFPM_ACCESS BIT(12) + #endif /* __iwl_prph_h__ */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 954f932e9c88e..f89d43bc7d4bd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1747,6 +1747,7 @@ static int iwl_pcie_init_msix_handler(struct pci_dev *pdev, + static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); ++ u32 hpm; + int err; + + lockdep_assert_held(&trans_pcie->mutex); +@@ -1757,6 +1758,17 @@ static int _iwl_trans_pcie_start_hw(struct iwl_trans *trans, bool low_power) + return err; + } + ++ hpm = iwl_trans_read_prph(trans, HPM_DEBUG); ++ if (hpm != 0xa5a5a5a0 && (hpm & PERSISTENCE_BIT)) { ++ if (iwl_trans_read_prph(trans, PREG_PRPH_WPROT_0) & ++ PREG_WFPM_ACCESS) { ++ IWL_ERR(trans, ++ "Error, can not clear persistence bit\n"); ++ return -EPERM; ++ } ++ iwl_trans_write_prph(trans, HPM_DEBUG, hpm & ~PERSISTENCE_BIT); ++ } ++ + iwl_trans_pcie_sw_reset(trans); + + err = iwl_pcie_apm_init(trans); +-- +2.20.1 + diff --git a/queue-4.19/kbuild-disable-dtc-simple_bus_reg-warnings-by-defaul.patch b/queue-4.19/kbuild-disable-dtc-simple_bus_reg-warnings-by-defaul.patch new file mode 100644 index 00000000000..fa1f9a54f0e --- /dev/null +++ b/queue-4.19/kbuild-disable-dtc-simple_bus_reg-warnings-by-defaul.patch @@ -0,0 +1,34 @@ +From 03a6d5c3189f489b6f54e857544cbf81b9b22a92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 19:11:50 -0600 +Subject: kbuild: disable dtc simple_bus_reg warnings by default + +From: Rob Herring + +[ Upstream commit 70523a3ce5ff928faa43bb2cad554dc63438e3e7 ] + +The updated version of dtc has a bug fix for simple_bus_reg warnings +and lots of warnings are generated now. So disable this warning by +default. + +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + scripts/Makefile.lib | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib +index 61e596650ed31..a232741e3fd3b 100644 +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -252,6 +252,7 @@ DTC_FLAGS += -Wno-unit_address_vs_reg \ + -Wno-alias_paths \ + -Wno-graph_child_address \ + -Wno-graph_port \ ++ -Wno-simple_bus_reg \ + -Wno-unique_unit_address \ + -Wno-pci_device_reg + endif +-- +2.20.1 + diff --git a/queue-4.19/kbuild-enable-dtc-graph_port-warning-by-default.patch b/queue-4.19/kbuild-enable-dtc-graph_port-warning-by-default.patch new file mode 100644 index 00000000000..157589c914c --- /dev/null +++ b/queue-4.19/kbuild-enable-dtc-graph_port-warning-by-default.patch @@ -0,0 +1,33 @@ +From fb5901019cef9ed5a76ddeaf83eccff8b2bd5c28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 09:08:21 -0600 +Subject: kbuild: Enable dtc graph_port warning by default + +From: Rob Herring + +[ Upstream commit a2237fec1e0645d1e99e108f2658c26cb5a66c74 ] + +All the 'graph_port' warnings have been fixed or have pending fixes, so +we can enable it by default now. + +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + scripts/Makefile.lib | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib +index a232741e3fd3b..18f44bba3c8c2 100644 +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -251,7 +251,6 @@ DTC_FLAGS += -Wno-unit_address_vs_reg \ + -Wno-avoid_unnecessary_addr_size \ + -Wno-alias_paths \ + -Wno-graph_child_address \ +- -Wno-graph_port \ + -Wno-simple_bus_reg \ + -Wno-unique_unit_address \ + -Wno-pci_device_reg +-- +2.20.1 + diff --git a/queue-4.19/kbuild-fix-single-target-build-for-external-module.patch b/queue-4.19/kbuild-fix-single-target-build-for-external-module.patch new file mode 100644 index 00000000000..11a67d4e94a --- /dev/null +++ b/queue-4.19/kbuild-fix-single-target-build-for-external-module.patch @@ -0,0 +1,85 @@ +From 48cdf320b608b507f2f2309f747e4719c6817f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 08:11:54 +0900 +Subject: kbuild: fix single target build for external module + +From: Masahiro Yamada + +[ Upstream commit e07db28eea38ed4e332b3a89f3995c86b713cb5b ] + +Building a single target in an external module fails due to missing +.tmp_versions directory. + +For example, + + $ make -C /lib/modules/$(uname -r)/build M=$PWD foo.o + +will fail in the following way: + + CC [M] /home/masahiro/foo/foo.o +/bin/sh: 1: cannot create /home/masahiro/foo/.tmp_versions/foo.mod: Directory nonexistent + +This is because $(cmd_crmodverdir) is executed only before building +/, %/, %.ko single targets of external modules. Create .tmp_versions +in the 'prepare' target. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + Makefile | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/Makefile b/Makefile +index f9ebb74e8e43f..471acfc74998b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1507,9 +1507,6 @@ else # KBUILD_EXTMOD + + # We are always building modules + KBUILD_MODULES := 1 +-PHONY += crmodverdir +-crmodverdir: +- $(cmd_crmodverdir) + + PHONY += $(objtree)/Module.symvers + $(objtree)/Module.symvers: +@@ -1521,7 +1518,7 @@ $(objtree)/Module.symvers: + + module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD)) + PHONY += $(module-dirs) modules +-$(module-dirs): crmodverdir $(objtree)/Module.symvers ++$(module-dirs): prepare $(objtree)/Module.symvers + $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) + + modules: $(module-dirs) +@@ -1562,7 +1559,8 @@ help: + + # Dummies... + PHONY += prepare scripts +-prepare: ; ++prepare: ++ $(cmd_crmodverdir) + scripts: ; + endif # KBUILD_EXTMOD + +@@ -1689,17 +1687,14 @@ endif + + # Modules + /: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + # Make sure the latest headers are built for Documentation + Documentation/ samples/: headers_install + %/: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + %.ko: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) $(@:.ko=.o) + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost +-- +2.20.1 + diff --git a/queue-4.19/lockd-fix-decoding-of-test-results.patch b/queue-4.19/lockd-fix-decoding-of-test-results.patch new file mode 100644 index 00000000000..0138f71c1f6 --- /dev/null +++ b/queue-4.19/lockd-fix-decoding-of-test-results.patch @@ -0,0 +1,98 @@ +From 54decfa1a6966d8c4ba55e77a7a40831aa91552f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 11:36:52 -0500 +Subject: lockd: fix decoding of TEST results + +From: J. Bruce Fields + +[ Upstream commit b8db159239b3f51e2b909859935cc25cb3ff3eed ] + +We fail to advance the read pointer when reading the stat.oh field that +identifies the lock-holder in a TEST result. + +This turns out not to matter if the server is knfsd, which always +returns a zero-length field. But other servers (Ganesha is an example) +may not do this. The result is bad values in fcntl F_GETLK results. + +Fix this. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/lockd/clnt4xdr.c | 22 ++++++---------------- + fs/lockd/clntxdr.c | 22 ++++++---------------- + 2 files changed, 12 insertions(+), 32 deletions(-) + +diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c +index 00d5ef5f99f73..214a2fa1f1e39 100644 +--- a/fs/lockd/clnt4xdr.c ++++ b/fs/lockd/clnt4xdr.c +@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c +index 2c6176387143c..747b9c8c940ac 100644 +--- a/fs/lockd/clntxdr.c ++++ b/fs/lockd/clntxdr.c +@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +-- +2.20.1 + diff --git a/queue-4.19/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch b/queue-4.19/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch new file mode 100644 index 00000000000..b9cbb03186d --- /dev/null +++ b/queue-4.19/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch @@ -0,0 +1,41 @@ +From ba5bb5d8dfa22352df5a210cf456433dad47a9bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 11:14:38 +0800 +Subject: math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning + +From: Vincent Chen + +[ Upstream commit 83312f1b7ae205dca647bf52bbe2d51303cdedfb ] + +_FP_ROUND_ZERO is defined as 0 and used as a statemente in macro +_FP_ROUND. This generates "error: statement with no effect +[-Werror=unused-value]" from gcc. Defining _FP_ROUND_ZERO as (void)0 to +fix it. + +This modification is quoted from glibc 'commit +(8ed1e7d5894000c155acbd06f)' + +Signed-off-by: Vincent Chen +Acked-by: Greentime Hu +Signed-off-by: Greentime Hu +Signed-off-by: Sasha Levin +--- + include/math-emu/soft-fp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h +index 3f284bc031809..5650c16283830 100644 +--- a/include/math-emu/soft-fp.h ++++ b/include/math-emu/soft-fp.h +@@ -138,7 +138,7 @@ do { \ + _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \ + } while (0) + +-#define _FP_ROUND_ZERO(wc, X) 0 ++#define _FP_ROUND_ZERO(wc, X) (void)0 + + #define _FP_ROUND_PINF(wc, X) \ + do { \ +-- +2.20.1 + diff --git a/queue-4.19/media-cec-report-vendor-id-after-initialization.patch b/queue-4.19/media-cec-report-vendor-id-after-initialization.patch new file mode 100644 index 00000000000..589b9d6cb57 --- /dev/null +++ b/queue-4.19/media-cec-report-vendor-id-after-initialization.patch @@ -0,0 +1,42 @@ +From 254d9965a6de082559f5038b9bd0b1016ced58dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 03:44:20 -0400 +Subject: media: cec: report Vendor ID after initialization + +From: Hans Verkuil + +[ Upstream commit 7f02ac77c768ba2bcdd0ce719c1fca0870ffe2fb ] + +The CEC specification requires that the Vendor ID (if any) is reported +after a logical address was claimed. + +This was never done, so add support for this. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/cec-adap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index 4a15d53f659ec..dd6f3e6ce0062 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1437,6 +1437,13 @@ configured: + las->log_addr[i], + cec_phys_addr_exp(adap->phys_addr)); + cec_transmit_msg_fh(adap, &msg, NULL, false); ++ ++ /* Report Vendor ID */ ++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) { ++ cec_msg_device_vendor_id(&msg, ++ adap->log_addrs.vendor_id); ++ cec_transmit_msg_fh(adap, &msg, NULL, false); ++ } + } + adap->kthread_config = NULL; + complete(&adap->config_completion); +-- +2.20.1 + diff --git a/queue-4.19/media-coda-fix-memory-corruption-in-case-more-than-3.patch b/queue-4.19/media-coda-fix-memory-corruption-in-case-more-than-3.patch new file mode 100644 index 00000000000..0f5f391fb76 --- /dev/null +++ b/queue-4.19/media-coda-fix-memory-corruption-in-case-more-than-3.patch @@ -0,0 +1,140 @@ +From e0c9ade66069781e702e804c78f4930e5225527c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 05:40:54 -0500 +Subject: media: coda: fix memory corruption in case more than 32 instances are + opened + +From: Philipp Zabel + +[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ] + +The ffz() return value is undefined if the instance mask does not +contain any zeros. If it returned 32, the following set_bit would +corrupt the debugfs_root pointer. +Switch to IDA for context index allocation. This also removes the +artificial 32 instance limit for all except CodaDx6. + +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-common.c | 26 +++++++++-------------- + drivers/media/platform/coda/coda.h | 3 ++- + 2 files changed, 12 insertions(+), 17 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 4b0220f40b425..fccc771d23a51 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -2101,17 +2102,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq, + return coda_queue_init(priv, dst_vq); + } + +-static int coda_next_free_instance(struct coda_dev *dev) +-{ +- int idx = ffz(dev->instance_mask); +- +- if ((idx < 0) || +- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES)) +- return -EBUSY; +- +- return idx; +-} +- + /* + * File operations + */ +@@ -2120,7 +2110,8 @@ static int coda_open(struct file *file) + { + struct video_device *vdev = video_devdata(file); + struct coda_dev *dev = video_get_drvdata(vdev); +- struct coda_ctx *ctx = NULL; ++ struct coda_ctx *ctx; ++ unsigned int max = ~0; + char *name; + int ret; + int idx; +@@ -2129,12 +2120,13 @@ static int coda_open(struct file *file) + if (!ctx) + return -ENOMEM; + +- idx = coda_next_free_instance(dev); ++ if (dev->devtype->product == CODA_DX6) ++ max = CODADX6_MAX_INSTANCES - 1; ++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL); + if (idx < 0) { + ret = idx; + goto err_coda_max; + } +- set_bit(idx, &dev->instance_mask); + + name = kasprintf(GFP_KERNEL, "context%d", idx); + if (!name) { +@@ -2243,8 +2235,8 @@ err_clk_per: + err_pm_get: + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +- clear_bit(ctx->idx, &dev->instance_mask); + err_coda_name_init: ++ ida_free(&dev->ida, ctx->idx); + err_coda_max: + kfree(ctx); + return ret; +@@ -2286,7 +2278,7 @@ static int coda_release(struct file *file) + pm_runtime_put_sync(&dev->plat_dev->dev); + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +- clear_bit(ctx->idx, &dev->instance_mask); ++ ida_free(&dev->ida, ctx->idx); + if (ctx->ops->release) + ctx->ops->release(ctx); + debugfs_remove_recursive(ctx->debugfs_entry); +@@ -2747,6 +2739,7 @@ static int coda_probe(struct platform_device *pdev) + + mutex_init(&dev->dev_mutex); + mutex_init(&dev->coda_mutex); ++ ida_init(&dev->ida); + + dev->debugfs_root = debugfs_create_dir("coda", NULL); + if (!dev->debugfs_root) +@@ -2834,6 +2827,7 @@ static int coda_remove(struct platform_device *pdev) + coda_free_aux_buf(dev, &dev->tempbuf); + coda_free_aux_buf(dev, &dev->workbuf); + debugfs_remove_recursive(dev->debugfs_root); ++ ida_destroy(&dev->ida); + return 0; + } + +diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h +index 2469ca1dc5985..8df02c32781ee 100644 +--- a/drivers/media/platform/coda/coda.h ++++ b/drivers/media/platform/coda/coda.h +@@ -16,6 +16,7 @@ + #define __CODA_H__ + + #include ++#include + #include + #include + #include +@@ -95,7 +96,7 @@ struct coda_dev { + struct workqueue_struct *workqueue; + struct v4l2_m2m_dev *m2m_dev; + struct list_head instances; +- unsigned long instance_mask; ++ struct ida ida; + struct dentry *debugfs_root; + }; + +-- +2.20.1 + diff --git a/queue-4.19/media-cxd2880-spi-fix-probe-when-dvb_attach-fails.patch b/queue-4.19/media-cxd2880-spi-fix-probe-when-dvb_attach-fails.patch new file mode 100644 index 00000000000..f1851b60a87 --- /dev/null +++ b/queue-4.19/media-cxd2880-spi-fix-probe-when-dvb_attach-fails.patch @@ -0,0 +1,38 @@ +From db0afc33c9b1bb7c314be6bd40ce1d9bc78b008c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 07:44:48 -0500 +Subject: media: cxd2880-spi: fix probe when dvb_attach fails + +From: Neil Armstrong + +[ Upstream commit 458ffce1cb46e46e3cec48b625ed142250475708 ] + +When dvb_attach fails, probe returns 0, and remove crashes afterwards. +This patch sets the return value to -ENODEV when attach fails. + +Fixes: bd24fcddf6b8 ("media: cxd2880-spi: Add support for CXD2880 SPI interface") + +Signed-off-by: Neil Armstrong +Acked-by: Yasunari Takiguchi +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/spi/cxd2880-spi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/spi/cxd2880-spi.c b/drivers/media/spi/cxd2880-spi.c +index 11ce5101e19f6..c43730977f53c 100644 +--- a/drivers/media/spi/cxd2880-spi.c ++++ b/drivers/media/spi/cxd2880-spi.c +@@ -536,6 +536,7 @@ cxd2880_spi_probe(struct spi_device *spi) + + if (!dvb_attach(cxd2880_attach, &dvb_spi->dvb_fe, &config)) { + pr_err("cxd2880_attach failed\n"); ++ ret = -ENODEV; + goto fail_attach; + } + +-- +2.20.1 + diff --git a/queue-4.19/media-pulse8-cec-return-0-when-invalidating-the-logi.patch b/queue-4.19/media-pulse8-cec-return-0-when-invalidating-the-logi.patch new file mode 100644 index 00000000000..b7f9ee5807e --- /dev/null +++ b/queue-4.19/media-pulse8-cec-return-0-when-invalidating-the-logi.patch @@ -0,0 +1,37 @@ +From 2c93d98b701120f8a122b5309786b0306630915b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 08:25:53 -0500 +Subject: media: pulse8-cec: return 0 when invalidating the logical address + +From: Hans Verkuil + +[ Upstream commit 2e84eb9affac43eeaf834992888b72426a8cd442 ] + +Return 0 when invalidating the logical address. The cec core produces +a warning for drivers that do this. + +Signed-off-by: Hans Verkuil +Reported-by: Torbjorn Jansson +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pulse8-cec/pulse8-cec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c +index 350635826aaed..6e3bdd71e273b 100644 +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -585,7 +585,7 @@ unlock: + else + pulse8->config_pending = true; + mutex_unlock(&pulse8->config_lock); +- return err; ++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err; + } + + static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, +-- +2.20.1 + diff --git a/queue-4.19/media-stkwebcam-bugfix-for-wrong-return-values.patch b/queue-4.19/media-stkwebcam-bugfix-for-wrong-return-values.patch new file mode 100644 index 00000000000..217510ddbcd --- /dev/null +++ b/queue-4.19/media-stkwebcam-bugfix-for-wrong-return-values.patch @@ -0,0 +1,42 @@ +From 51ba2ed58d315da6dcd27de3338685de4340e798 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Nov 2018 11:14:54 -0500 +Subject: media: stkwebcam: Bugfix for wrong return values + +From: Andreas Pape + +[ Upstream commit 3c28b91380dd1183347d32d87d820818031ebecf ] + +usb_control_msg returns in case of a successfully sent message the number +of sent bytes as a positive number. Don't use this value as a return value +for stk_camera_read_reg, as a non-zero return value is used as an error +condition in some cases when stk_camera_read_reg is called. + +Signed-off-by: Andreas Pape +Reviewed-by: Kieran Bingham +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/stkwebcam/stk-webcam.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c +index 6e3f234e790b8..e33fa78ef98dd 100644 +--- a/drivers/media/usb/stkwebcam/stk-webcam.c ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c +@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value) + *value = *buf; + + kfree(buf); +- return ret; ++ ++ if (ret < 0) ++ return ret; ++ else ++ return 0; + } + + static int stk_start_stream(struct stk_camera *dev) +-- +2.20.1 + diff --git a/queue-4.19/media-uvcvideo-abstract-streaming-object-lifetime.patch b/queue-4.19/media-uvcvideo-abstract-streaming-object-lifetime.patch new file mode 100644 index 00000000000..b3dab12b235 --- /dev/null +++ b/queue-4.19/media-uvcvideo-abstract-streaming-object-lifetime.patch @@ -0,0 +1,134 @@ +From 3c3b428c05b46ebfcac9b0e2a6bba0f74ad1e85b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 09:26:10 -0500 +Subject: media: uvcvideo: Abstract streaming object lifetime + +From: Kieran Bingham + +[ Upstream commit ece41454c6a5ed8f301ef1c37710ab222e577823 ] + +The streaming object is a key part of handling the UVC device. Although +not critical, we are currently missing a call to destroy the mutex on +clean up paths, and we are due to extend the objects complexity in the +near future. + +Facilitate easy management of a stream object by creating a pair of +functions to handle creating and destroying the allocation. The new +uvc_stream_delete() function also performs the missing mutex_destroy() +operation. + +Previously a failed streaming object allocation would cause +uvc_parse_streaming() to return -EINVAL, which is inappropriate. If the +constructor failes, we will instead return -ENOMEM. + +While we're here, fix the trivial spelling error in the function banner +of uvc_delete(). + +Signed-off-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_driver.c | 54 +++++++++++++++++++++--------- + 1 file changed, 38 insertions(+), 16 deletions(-) + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index cf4feff2a48c1..063e229ead5ef 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -390,6 +390,39 @@ static struct uvc_streaming *uvc_stream_by_id(struct uvc_device *dev, int id) + return NULL; + } + ++/* ------------------------------------------------------------------------ ++ * Streaming Object Management ++ */ ++ ++static void uvc_stream_delete(struct uvc_streaming *stream) ++{ ++ mutex_destroy(&stream->mutex); ++ ++ usb_put_intf(stream->intf); ++ ++ kfree(stream->format); ++ kfree(stream->header.bmaControls); ++ kfree(stream); ++} ++ ++static struct uvc_streaming *uvc_stream_new(struct uvc_device *dev, ++ struct usb_interface *intf) ++{ ++ struct uvc_streaming *stream; ++ ++ stream = kzalloc(sizeof(*stream), GFP_KERNEL); ++ if (stream == NULL) ++ return NULL; ++ ++ mutex_init(&stream->mutex); ++ ++ stream->dev = dev; ++ stream->intf = usb_get_intf(intf); ++ stream->intfnum = intf->cur_altsetting->desc.bInterfaceNumber; ++ ++ return stream; ++} ++ + /* ------------------------------------------------------------------------ + * Descriptors parsing + */ +@@ -682,17 +715,12 @@ static int uvc_parse_streaming(struct uvc_device *dev, + return -EINVAL; + } + +- streaming = kzalloc(sizeof(*streaming), GFP_KERNEL); ++ streaming = uvc_stream_new(dev, intf); + if (streaming == NULL) { + usb_driver_release_interface(&uvc_driver.driver, intf); +- return -EINVAL; ++ return -ENOMEM; + } + +- mutex_init(&streaming->mutex); +- streaming->dev = dev; +- streaming->intf = usb_get_intf(intf); +- streaming->intfnum = intf->cur_altsetting->desc.bInterfaceNumber; +- + /* The Pico iMage webcam has its class-specific interface descriptors + * after the endpoint descriptors. + */ +@@ -899,10 +927,7 @@ static int uvc_parse_streaming(struct uvc_device *dev, + + error: + usb_driver_release_interface(&uvc_driver.driver, intf); +- usb_put_intf(intf); +- kfree(streaming->format); +- kfree(streaming->header.bmaControls); +- kfree(streaming); ++ uvc_stream_delete(streaming); + return ret; + } + +@@ -1818,7 +1843,7 @@ static int uvc_scan_device(struct uvc_device *dev) + * is released. + * + * As this function is called after or during disconnect(), all URBs have +- * already been canceled by the USB core. There is no need to kill the ++ * already been cancelled by the USB core. There is no need to kill the + * interrupt URB manually. + */ + static void uvc_delete(struct kref *kref) +@@ -1856,10 +1881,7 @@ static void uvc_delete(struct kref *kref) + streaming = list_entry(p, struct uvc_streaming, list); + usb_driver_release_interface(&uvc_driver.driver, + streaming->intf); +- usb_put_intf(streaming->intf); +- kfree(streaming->format); +- kfree(streaming->header.bmaControls); +- kfree(streaming); ++ uvc_stream_delete(streaming); + } + + kfree(dev); +-- +2.20.1 + diff --git a/queue-4.19/media-vimc-fix-start-stream-when-link-is-disabled.patch b/queue-4.19/media-vimc-fix-start-stream-when-link-is-disabled.patch new file mode 100644 index 00000000000..66d0b2240e6 --- /dev/null +++ b/queue-4.19/media-vimc-fix-start-stream-when-link-is-disabled.patch @@ -0,0 +1,36 @@ +From caeb333c3dfdc742fb47ca3952a084c348f02af9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 12:56:41 -0500 +Subject: media: vimc: fix start stream when link is disabled + +From: Helen Fornazier + +[ Upstream commit e159b6074c82fe31b79aad672e02fa204dbbc6d8 ] + +If link is disabled, media_entity_remote_pad returns NULL, causing a +NULL pointer deference. +Ignore links that are not enabled instead. + +Signed-off-by: Helen Koike +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vimc/vimc-common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c +index 204aa6f554e4d..fa8435ac2b1ae 100644 +--- a/drivers/media/platform/vimc/vimc-common.c ++++ b/drivers/media/platform/vimc/vimc-common.c +@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable) + + /* Start the stream in the subdevice direct connected */ + pad = media_entity_remote_pad(&ent->pads[i]); ++ if (!pad) ++ continue; + + if (!is_media_entity_v4l2_subdev(pad->entity)) + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.19/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch b/queue-4.19/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch new file mode 100644 index 00000000000..701aec4be7f --- /dev/null +++ b/queue-4.19/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch @@ -0,0 +1,53 @@ +From f331be075b208837582870c47152815dcc4ea970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 22:12:17 +0200 +Subject: MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible + definition + +From: Aaro Koskinen + +[ Upstream commit 1c6121c39677175bd372076020948e184bad4b6b ] + +cn58xx is compatible with cn50xx, so use the latter. + +Signed-off-by: Aaro Koskinen +[paul.burton@mips.com: s/cn52xx/cn50xx/ in commit message.] +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +- + arch/mips/include/asm/octeon/cvmx-pko.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +index 8241fc6aa17d8..3839feba68f20 100644 +--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c ++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id) + } else { + union cvmx_pko_mem_debug8 debug8; + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- return debug8.cn58xx.doorbell; ++ return debug8.cn50xx.doorbell; + } + case CVMX_CMD_QUEUE_ZIP: + case CVMX_CMD_QUEUE_DFA: +diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h +index 5f47f76ed510a..20eb9c46a75ab 100644 +--- a/arch/mips/include/asm/octeon/cvmx-pko.h ++++ b/arch/mips/include/asm/octeon/cvmx-pko.h +@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear, + pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num); + cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64); + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- status->doorbell = debug8.cn58xx.doorbell; ++ status->doorbell = debug8.cn50xx.doorbell; + } + } + +-- +2.20.1 + diff --git a/queue-4.19/mips-octeon-octeon-platform-fix-typing.patch b/queue-4.19/mips-octeon-octeon-platform-fix-typing.patch new file mode 100644 index 00000000000..572a07456ea --- /dev/null +++ b/queue-4.19/mips-octeon-octeon-platform-fix-typing.patch @@ -0,0 +1,38 @@ +From ed18f1542e47b316c12995ff0262acaf53bd049b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 00:37:29 +0200 +Subject: MIPS: OCTEON: octeon-platform: fix typing + +From: Aaro Koskinen + +[ Upstream commit 2cf1c8933dd93088cfb5f8f58b3bb9bbdf1781b9 ] + +Use correct type for fdt_property nameoff field. + +Signed-off-by: Aaro Koskinen +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/21204/ +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 807cadaf554e2..5ba181e87d2c1 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr) + if (phy_addr >= 256 && alt_phy > 0) { + const struct fdt_property *phy_prop; + struct fdt_property *alt_prop; +- u32 phy_handle_name; ++ fdt32_t phy_handle_name; + + /* Use the alt phy node instead.*/ + phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL); +-- +2.20.1 + diff --git a/queue-4.19/mips-sibyte-enable-zone_dma32-for-littlesur.patch b/queue-4.19/mips-sibyte-enable-zone_dma32-for-littlesur.patch new file mode 100644 index 00000000000..bef2b9393b0 --- /dev/null +++ b/queue-4.19/mips-sibyte-enable-zone_dma32-for-littlesur.patch @@ -0,0 +1,53 @@ +From bb7fbd856b1afad9ea39917217cfda5e5a5ec50b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 22:42:37 +0000 +Subject: MIPS: SiByte: Enable ZONE_DMA32 for LittleSur + +From: Maciej W. Rozycki + +[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ] + +The LittleSur board is marked for high memory support and therefore +clearly must provide a way to have enough memory installed for some to +be present outside the low 4GiB physical address range. With the memory +map of the BCM1250 SOC it has been built around it means over 1GiB of +actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical +address range[1]. + +Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need +DMA32.") then and also enable ZONE_DMA32 for LittleSur. + +References: + +[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R, + Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview", + "Memory Map", pp. 34-38 + +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Paul Burton +Reviewed-by: Christoph Hellwig +Patchwork: https://patchwork.linux-mips.org/patch/21107/ +Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.") +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 201caf226b47b..a830a9701e501 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -806,6 +806,7 @@ config SIBYTE_LITTLESUR + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_SUPPORTS_HIGHMEM + select SYS_SUPPORTS_LITTLE_ENDIAN ++ select ZONE_DMA32 if 64BIT + + config SIBYTE_SENTOSA + bool "Sibyte BCM91250E-Sentosa" +-- +2.20.1 + diff --git a/queue-4.19/mlx4-use-snprintf-instead-of-complicated-strcpy.patch b/queue-4.19/mlx4-use-snprintf-instead-of-complicated-strcpy.patch new file mode 100644 index 00000000000..823caa70297 --- /dev/null +++ b/queue-4.19/mlx4-use-snprintf-instead-of-complicated-strcpy.patch @@ -0,0 +1,53 @@ +From 6aee17cde111c6c4606b4bc5d68d1e90ff175a40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 21:18:07 -0500 +Subject: mlx4: Use snprintf instead of complicated strcpy + +From: Qian Cai + +[ Upstream commit 0fbc9b8b4ea3f688a5da141a64f97aa33ad02ae9 ] + +This fixes a compilation warning in sysfs.c + +drivers/infiniband/hw/mlx4/sysfs.c:360:2: warning: 'strncpy' output may be +truncated copying 8 bytes from a string of length 31 +[-Wstringop-truncation] + +By eliminating the temporary stack buffer. + +Signed-off-by: Qian Cai +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/sysfs.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c +index e219093d27645..d2da28d613f2c 100644 +--- a/drivers/infiniband/hw/mlx4/sysfs.c ++++ b/drivers/infiniband/hw/mlx4/sysfs.c +@@ -353,16 +353,12 @@ err: + + static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max) + { +- char base_name[9]; +- +- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */ +- strlcpy(name, pci_name(dev->dev->persist->pdev), max); +- strncpy(base_name, name, 8); /*till xxxx:yy:*/ +- base_name[8] = '\0'; +- /* with no ARI only 3 last bits are used so when the fn is higher than 8 ++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n ++ * with no ARI only 3 last bits are used so when the fn is higher than 8 + * need to add it to the dev num, so count in the last number will be + * modulo 8 */ +- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8)); ++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev), ++ i / 8, i % 8); + } + + struct mlx4_port { +-- +2.20.1 + diff --git a/queue-4.19/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch b/queue-4.19/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch new file mode 100644 index 00000000000..fe590c3d744 --- /dev/null +++ b/queue-4.19/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch @@ -0,0 +1,52 @@ +From fa203629a01f6791b9b45cc4cac780237e19f56f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 17:44:52 +0000 +Subject: mlxsw: spectrum_router: Relax GRE decap matching check + +From: Nir Dotan + +[ Upstream commit da93d2913fdf43d5cde3c5a53ac9cc29684d5c7c ] + +GRE decap offload is configured when local routes prefix correspond to the +local address of one of the offloaded GRE tunnels. The matching check was +found to be too strict, such that for a flat GRE configuration, in which +the overlay and underlay traffic share the same non-default VRF, decap flow +was not offloaded. + +Relax the check for decap flow offloading. A match occurs if the local +address of the tunnel matches the local route address while both share the +same VRF table. + +Fixes: 4607f6d26950 ("mlxsw: spectrum_router: Support IPv4 underlay decap") +Signed-off-by: Nir Dotan +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 3f54b3ca38bad..44b6c2ac5961d 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -1215,15 +1215,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp, + { + u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN; + enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt; +- struct net_device *ipip_ul_dev; + + if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto) + return false; + +- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev); + return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip, +- ul_tb_id, ipip_entry) && +- (!ipip_ul_dev || ipip_ul_dev == ul_dev); ++ ul_tb_id, ipip_entry); + } + + /* Given decap parameters, find the corresponding IPIP entry. */ +-- +2.20.1 + diff --git a/queue-4.19/mm-vmstat.c-fix-numa-statistics-updates.patch b/queue-4.19/mm-vmstat.c-fix-numa-statistics-updates.patch new file mode 100644 index 00000000000..72ac9103647 --- /dev/null +++ b/queue-4.19/mm-vmstat.c-fix-numa-statistics-updates.patch @@ -0,0 +1,55 @@ +From 25617f4173b2022deab3b14f9aef2405b8e167fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 15:08:32 -0800 +Subject: mm/vmstat.c: fix NUMA statistics updates + +From: Janne Huttunen + +[ Upstream commit 13c9aaf7fa01cc7600c61981609feadeef3354ec ] + +Scan through the whole array to see if an update is needed. While we're +at it, use sizeof() to be safe against any possible type changes in the +future. + +The bug here is that we wouldn't sync per-cpu counters into global ones +if there was an update of numa_stats for higher cpus. Highly +theoretical one though because it is much more probable that zone_stats +are updated so we would refresh anyway. So I wouldn't bother to mark +this for stable, yet something nice to fix. + +[mhocko@suse.com: changelog enhancement] +Link: http://lkml.kernel.org/r/1541601517-17282-1-git-send-email-janne.huttunen@nokia.com +Fixes: 1d90ca897cb0 ("mm: update NUMA counter threshold size") +Signed-off-by: Janne Huttunen +Acked-by: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/vmstat.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/mm/vmstat.c b/mm/vmstat.c +index a2b2ea786c9b2..ce81b0a7d0186 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1826,12 +1826,13 @@ static bool need_update(int cpu) + + /* + * The fast way of checking if there are any vmstat diffs. +- * This works because the diffs are byte sized items. + */ +- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS)) ++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS * ++ sizeof(p->vm_stat_diff[0]))) + return true; + #ifdef CONFIG_NUMA +- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS)) ++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS * ++ sizeof(p->vm_numa_stat_diff[0]))) + return true; + #endif + } +-- +2.20.1 + diff --git a/queue-4.19/modpost-skip-elf-local-symbols-during-section-mismat.patch b/queue-4.19/modpost-skip-elf-local-symbols-during-section-mismat.patch new file mode 100644 index 00000000000..54237b9809a --- /dev/null +++ b/queue-4.19/modpost-skip-elf-local-symbols-during-section-mismat.patch @@ -0,0 +1,96 @@ +From 30283e56a0762e780c81384e4ba58d8cb40aacd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 13:14:13 -0800 +Subject: modpost: skip ELF local symbols during section mismatch check + +From: Paul Walmsley + +[ Upstream commit a4d26f1a0958bb1c2b60c6f1e67c6f5d43e2647b ] + +During development of a serial console driver with a gcc 8.2.0 +toolchain for RISC-V, the following modpost warning appeared: + +---- +WARNING: vmlinux.o(.data+0x19b10): Section mismatch in reference from the variable .LANCHOR1 to the function .init.text:sifive_serial_console_setup() +The variable .LANCHOR1 references +the function __init sifive_serial_console_setup() +If the reference is valid then annotate the +variable with __init* or __refdata (see linux/init.h) or name the variable: +*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console +---- + +".LANCHOR1" is an ELF local symbol, automatically created by gcc's section +anchor generation code: + +https://gcc.gnu.org/onlinedocs/gccint/Anchored-Addresses.html + +https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/varasm.c;h=cd9591a45617464946dcf9a126dde277d9de9804;hb=9fb89fa845c1b2e0a18d85ada0b077c84508ab78#l7473 + +This was verified by compiling the kernel with -fno-section-anchors +and observing that the ".LANCHOR1" ELF local symbol disappeared, and +modpost no longer warned about the section mismatch. The serial +driver code idiom triggering the warning is standard Linux serial +driver practice that has a specific whitelist inclusion in modpost.c. + +I'm neither a modpost nor an ELF expert, but naively, it doesn't seem +useful for modpost to report section mismatch warnings caused by ELF +local symbols by default. Local symbols have compiler-generated +names, and thus bypass modpost's whitelisting algorithm, which relies +on the presence of a non-autogenerated symbol name. This increases +the likelihood that false positive warnings will be generated (as in +the above case). + +Thus, disable section mismatch reporting on ELF local symbols. The +rationale here is similar to that of commit 2e3a10a1551d ("ARM: avoid +ARM binutils leaking ELF local symbols") and of similar code already +present in modpost.c: + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/mod/modpost.c?h=v4.19-rc4&id=7876320f88802b22d4e2daf7eb027dd14175a0f8#n1256 + +This third version of the patch implements a suggestion from Masahiro +Yamada to restructure the code as an +additional pattern matching step inside secref_whitelist(), and +further improves the patch description. + +Signed-off-by: Paul Walmsley +Signed-off-by: Paul Walmsley +Acked-by: Sam Ravnborg +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 858cbe56b1006..91a80036c05d5 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1163,6 +1163,14 @@ static const struct sectioncheck *section_mismatch( + * fromsec = text section + * refsymname = *.constprop.* + * ++ * Pattern 6: ++ * Hide section mismatch warnings for ELF local symbols. The goal ++ * is to eliminate false positive modpost warnings caused by ++ * compiler-generated ELF local symbol names such as ".LANCHOR1". ++ * Autogenerated symbol names bypass modpost's "Pattern 2" ++ * whitelisting, which relies on pattern-matching against symbol ++ * names to work. (One situation where gcc can autogenerate ELF ++ * local symbols is when "-fsection-anchors" is used.) + **/ + static int secref_whitelist(const struct sectioncheck *mismatch, + const char *fromsec, const char *fromsym, +@@ -1201,6 +1209,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + match(fromsym, optim_symbols)) + return 0; + ++ /* Check for pattern 6 */ ++ if (strstarts(fromsym, ".L")) ++ return 0; ++ + return 1; + } + +-- +2.20.1 + diff --git a/queue-4.19/mtd-fix-mtd_oobavail-incoherent-returned-value.patch b/queue-4.19/mtd-fix-mtd_oobavail-incoherent-returned-value.patch new file mode 100644 index 00000000000..65aab991f81 --- /dev/null +++ b/queue-4.19/mtd-fix-mtd_oobavail-incoherent-returned-value.patch @@ -0,0 +1,36 @@ +From 54135ca9301899b493dda2d7fa6bb3d909742b5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 21:18:30 +0100 +Subject: mtd: fix mtd_oobavail() incoherent returned value + +From: Miquel Raynal + +[ Upstream commit 4348433d8c0234f44adb6e12112e69343f50f0c5 ] + +mtd_oobavail() returns either mtd->oovabail or mtd->oobsize. Both +values are unsigned 32-bit entities, so there is no reason to pretend +returning a signed one. + +Signed-off-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + include/linux/mtd/mtd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h +index cd0be91bdefa5..035d641e8847c 100644 +--- a/include/linux/mtd/mtd.h ++++ b/include/linux/mtd/mtd.h +@@ -386,7 +386,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd) + return dev_of_node(&mtd->dev); + } + +-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) ++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) + { + return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize; + } +-- +2.20.1 + diff --git a/queue-4.19/nds32-fix-the-items-of-hwcap_str-ordering-issue.patch b/queue-4.19/nds32-fix-the-items-of-hwcap_str-ordering-issue.patch new file mode 100644 index 00000000000..7dd2e625322 --- /dev/null +++ b/queue-4.19/nds32-fix-the-items-of-hwcap_str-ordering-issue.patch @@ -0,0 +1,38 @@ +From b76436d49caa9567fc602a5992ef10592b944896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 19:28:05 +0800 +Subject: nds32: Fix the items of hwcap_str ordering issue. + +From: Nylon Chen + +[ Upstream commit a5234068e6dc18ae5300d678fbf3e129d9b93f78 ] + +The hwcap_str should be set in a correct order according to HWCAP_xx. +We also add the missing "fpu_dp" to it. + +Signed-off-by: Nylon Chen +Acked-by: Greentime Hu +Signed-off-by: Greentime Hu +Signed-off-by: Sasha Levin +--- + arch/nds32/kernel/setup.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/nds32/kernel/setup.c b/arch/nds32/kernel/setup.c +index 63a1a5ef5219f..87683583f2064 100644 +--- a/arch/nds32/kernel/setup.c ++++ b/arch/nds32/kernel/setup.c +@@ -71,8 +71,9 @@ static const char *hwcap_str[] = { + "div", + "mac", + "l2c", +- "dx_regs", ++ "fpu_dp", + "v2", ++ "dx_regs", + NULL, + }; + +-- +2.20.1 + diff --git a/queue-4.19/net-aquantia-fix-rss-table-and-key-sizes.patch b/queue-4.19/net-aquantia-fix-rss-table-and-key-sizes.patch new file mode 100644 index 00000000000..5d073e1b9b6 --- /dev/null +++ b/queue-4.19/net-aquantia-fix-rss-table-and-key-sizes.patch @@ -0,0 +1,51 @@ +From d3e909b4a52fcb2c0f0f72816d6744b3d5c5dfa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 14:00:11 +0000 +Subject: net: aquantia: fix RSS table and key sizes + +From: Dmitry Bogdanov + +[ Upstream commit 474fb1150d40780e71f0b569aeac4f375df3af3d ] + +Set RSS indirection table and RSS hash key sizes to their real size. + +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_cfg.h | 4 ++-- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +index 91eb8910b1c99..90a0e1d0d6221 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +@@ -42,8 +42,8 @@ + #define AQ_CFG_IS_LRO_DEF 1U + + /* RSS */ +-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U +-#define AQ_CFG_RSS_HASHKEY_SIZE 320U ++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U ++#define AQ_CFG_RSS_HASHKEY_SIZE 40U + + #define AQ_CFG_IS_RSS_DEF 1U + #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 4f34808f1e064..8cc34b0bedc3a 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -44,7 +44,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues) + struct aq_rss_parameters *rss_params = &cfg->aq_rss; + int i = 0; + +- static u8 rss_key[40] = { ++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = { + 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d, + 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18, + 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8, +-- +2.20.1 + diff --git a/queue-4.19/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch b/queue-4.19/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch new file mode 100644 index 00000000000..0ccb556a653 --- /dev/null +++ b/queue-4.19/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch @@ -0,0 +1,64 @@ +From b44677c021512b1099e86711a590a39b9379a340 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 18:51:01 +0100 +Subject: net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing + MII_PHYSID2 + +From: Andrew Lunn + +[ Upstream commit ddc49acb659a2d8bfc5fdb0de0ef197712c11d75 ] + +We already have a workaround for a couple of switches whose internal +PHYs only have the Marvel OUI, but no model number. We detect such +PHYs and give them the 6390 ID as the model number. However the +mv88e6161 has two SERDES interfaces in the same address range as its +internal PHYs. These suffer from the same problem, the Marvell OUI, +but no model number. As a result, these SERDES interfaces were getting +the same PHY ID as the mv88e6390, even though they are not PHYs, and +the Marvell PHY driver was trying to drive them. + +Add a special case to stop this from happen. + +Reported-by: Chris Healy +Signed-off-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 411ae9961bf4f..43b00e8bcdcd7 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2645,11 +2645,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg) + mutex_unlock(&chip->reg_lock); + + if (reg == MII_PHYSID2) { +- /* Some internal PHYS don't have a model number. Use +- * the mv88e6390 family model number instead. +- */ +- if (!(val & 0x3f0)) +- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; ++ /* Some internal PHYs don't have a model number. */ ++ if (chip->info->family != MV88E6XXX_FAMILY_6165) ++ /* Then there is the 6165 family. It gets is ++ * PHYs correct. But it can also have two ++ * SERDES interfaces in the PHY address ++ * space. And these don't have a model ++ * number. But they are not PHYs, so we don't ++ * want to give them something a PHY driver ++ * will recognise. ++ * ++ * Use the mv88e6390 family model number ++ * instead, for anything which really could be ++ * a PHY, ++ */ ++ if (!(val & 0x3f0)) ++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; + } + + return err ? err : val; +-- +2.20.1 + diff --git a/queue-4.19/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch b/queue-4.19/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch new file mode 100644 index 00000000000..a6967eb0209 --- /dev/null +++ b/queue-4.19/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch @@ -0,0 +1,46 @@ +From 70096703cf6f7a387611ed89955e0bb19651d8b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 23:43:24 +0800 +Subject: net: ep93xx_eth: fix mismatch of request_mem_region in remove + +From: Chuhong Yuan + +[ Upstream commit 3df70afe8d33f4977d0e0891bdcfb639320b5257 ] + +The driver calls release_resource in remove to match request_mem_region +in probe, which is incorrect. +Fix it by using the right one, release_mem_region. + +Signed-off-by: Chuhong Yuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c +index 13dfdfca49fc7..edc1d19c9c02e 100644 +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + { + struct net_device *dev; + struct ep93xx_priv *ep; ++ struct resource *mem; + + dev = platform_get_drvdata(pdev); + if (dev == NULL) +@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + iounmap(ep->base_addr); + + if (ep->res != NULL) { +- release_resource(ep->res); +- kfree(ep->res); ++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ release_mem_region(mem->start, resource_size(mem)); + } + + free_netdev(dev); +-- +2.20.1 + diff --git a/queue-4.19/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch b/queue-4.19/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch new file mode 100644 index 00000000000..a7c25bdcb2d --- /dev/null +++ b/queue-4.19/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch @@ -0,0 +1,37 @@ +From a0c73b88bc967cceafdbef90fc5ba05c9cd7df4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 16:00:20 +0200 +Subject: net: ethernet: ti: cpts: correct debug for expired txq skb + +From: Ivan Khoronzhuk + +[ Upstream commit d0e14c4d9bcef0d4aa1057d2959adaa6f18d4a17 ] + +The msgtype and seqid that is smth that belongs to event for +comparison but not for staled txq skb. + +Signed-off-by: Ivan Khoronzhuk +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpts.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index 4f644ac314fe8..d7543811dfae2 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -119,9 +119,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event) + + if (time_after(jiffies, skb_cb->tmo)) { + /* timeout any expired skbs over 1s */ +- dev_dbg(cpts->dev, +- "expiring tx timestamp mtype %u seqid %04x\n", +- mtype, seqid); ++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n"); + __skb_unlink(skb, &cpts->txq); + dev_consume_skb_any(skb); + } +-- +2.20.1 + diff --git a/queue-4.19/net-ipv6-re-do-dad-when-interface-has-iff_noarp-flag.patch b/queue-4.19/net-ipv6-re-do-dad-when-interface-has-iff_noarp-flag.patch new file mode 100644 index 00000000000..82c1774a1f2 --- /dev/null +++ b/queue-4.19/net-ipv6-re-do-dad-when-interface-has-iff_noarp-flag.patch @@ -0,0 +1,107 @@ +From 44333da9e6051b94b50be2fceec165a165754761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 21:52:33 +0800 +Subject: net/ipv6: re-do dad when interface has IFF_NOARP flag change + +From: Hangbin Liu + +[ Upstream commit 896585d48e8e9ba44cd1754fbce8537feffcc1a5 ] + +When we add a new IPv6 address, we should also join corresponding solicited-node +multicast address, unless the interface has IFF_NOARP flag, as function +addrconf_join_solict() did. But if we remove IFF_NOARP flag later, we do +not do dad and add the mcast address. So we will drop corresponding neighbour +discovery message that came from other nodes. + +A typical example is after creating a ipvlan with mode l3, setting up an ipv6 +address and changing the mode to l2. Then we will not be able to ping this +address as the interface doesn't join related solicited-node mcast address. + +Fix it by re-doing dad when interface changed IFF_NOARP flag. Then we will add +corresponding mcast group and check if there is a duplicate address on the +network. + +Reported-by: Jianlin Shi +Reviewed-by: Stefano Brivio +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index d2968a79abea8..ef309a26aba0f 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -179,7 +179,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp); + static void addrconf_dad_work(struct work_struct *w); + static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id, + bool send_na); +-static void addrconf_dad_run(struct inet6_dev *idev); ++static void addrconf_dad_run(struct inet6_dev *idev, bool restart); + static void addrconf_rs_timer(struct timer_list *t); + static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa); + static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa); +@@ -3424,6 +3424,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + void *ptr) + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); ++ struct netdev_notifier_change_info *change_info; + struct netdev_notifier_changeupper_info *info; + struct inet6_dev *idev = __in6_dev_get(dev); + struct net *net = dev_net(dev); +@@ -3498,7 +3499,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + break; + } + +- if (idev) { ++ if (!IS_ERR_OR_NULL(idev)) { + if (idev->if_flags & IF_READY) { + /* device is already configured - + * but resend MLD reports, we might +@@ -3506,6 +3507,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + * multicast snooping switches + */ + ipv6_mc_up(idev); ++ change_info = ptr; ++ if (change_info->flags_changed & IFF_NOARP) ++ addrconf_dad_run(idev, true); + rt6_sync_up(dev, RTNH_F_LINKDOWN); + break; + } +@@ -3540,7 +3544,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + + if (!IS_ERR_OR_NULL(idev)) { + if (run_pending) +- addrconf_dad_run(idev); ++ addrconf_dad_run(idev, false); + + /* Device has an address by now */ + rt6_sync_up(dev, RTNH_F_DEAD); +@@ -4158,16 +4162,19 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id, + addrconf_verify_rtnl(); + } + +-static void addrconf_dad_run(struct inet6_dev *idev) ++static void addrconf_dad_run(struct inet6_dev *idev, bool restart) + { + struct inet6_ifaddr *ifp; + + read_lock_bh(&idev->lock); + list_for_each_entry(ifp, &idev->addr_list, if_list) { + spin_lock(&ifp->lock); +- if (ifp->flags & IFA_F_TENTATIVE && +- ifp->state == INET6_IFADDR_STATE_DAD) ++ if ((ifp->flags & IFA_F_TENTATIVE && ++ ifp->state == INET6_IFADDR_STATE_DAD) || restart) { ++ if (restart) ++ ifp->state = INET6_IFADDR_STATE_PREDAD; + addrconf_dad_kick(ifp); ++ } + spin_unlock(&ifp->lock); + } + read_unlock_bh(&idev->lock); +-- +2.20.1 + diff --git a/queue-4.19/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch b/queue-4.19/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch new file mode 100644 index 00000000000..8de1f5c225f --- /dev/null +++ b/queue-4.19/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch @@ -0,0 +1,76 @@ +From f80d0d1e49065d1d58cb775d381bf8cd14a3b5bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Dec 2018 17:40:25 +0200 +Subject: net/mlx4_core: Fix return codes of unsupported operations + +From: Erez Alfasi + +[ Upstream commit 95aac2cdafd8c8298c9b2589c52f44db0d824e0e ] + +Functions __set_port_type and mlx4_check_port_params returned +-EINVAL while the proper return code is -EOPNOTSUPP as a +result of an unsupported operation. All drivers should generate +this and all users should check for it when detecting an +unsupported functionality. + +Signed-off-by: Erez Alfasi +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/main.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 6a046030e8734..4afe56a6eedfb 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -313,7 +313,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + for (i = 0; i < dev->caps.num_ports - 1; i++) { + if (port_type[i] != port_type[i + 1]) { + mlx4_err(dev, "Only same port types supported on this HCA, aborting\n"); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + } +@@ -322,7 +322,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + if (!(port_type[i] & dev->caps.supported_type[i+1])) { + mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n", + i + 1); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + return 0; +@@ -1188,8 +1188,7 @@ static int __set_port_type(struct mlx4_port_info *info, + mlx4_err(mdev, + "Requested port type for port %d is not supported on this HCA\n", + info->port); +- err = -EINVAL; +- goto err_sup; ++ return -EOPNOTSUPP; + } + + mlx4_stop_sense(mdev); +@@ -1211,7 +1210,7 @@ static int __set_port_type(struct mlx4_port_info *info, + for (i = 1; i <= mdev->caps.num_ports; i++) { + if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) { + mdev->caps.possible_type[i] = mdev->caps.port_type[i]; +- err = -EINVAL; ++ err = -EOPNOTSUPP; + } + } + } +@@ -1237,7 +1236,7 @@ static int __set_port_type(struct mlx4_port_info *info, + out: + mlx4_start_sense(mdev); + mutex_unlock(&priv->port_mutex); +-err_sup: ++ + return err; + } + +-- +2.20.1 + diff --git a/queue-4.19/net-mlx5-release-resource-on-error-flow.patch b/queue-4.19/net-mlx5-release-resource-on-error-flow.patch new file mode 100644 index 00000000000..5ab126cec35 --- /dev/null +++ b/queue-4.19/net-mlx5-release-resource-on-error-flow.patch @@ -0,0 +1,46 @@ +From be5993a8d4205f69fc92d69c87ff0634920603eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 21:10:08 +0200 +Subject: net/mlx5: Release resource on error flow + +From: Moni Shoua + +[ Upstream commit 698114968a22f6c0c9f42e983ba033cc36bb7217 ] + +Fix reference counting leakage when the event handler aborts due to an +unsupported event for the resource type. + +Fixes: a14c2d4beee5 ("net/mlx5_core: Warn on unsupported events of QP/RQ/SQ") +Signed-off-by: Moni Shoua +Reviewed-by: Majd Dibbiny +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index 4ca07bfb6b14f..f33707ce8b6b0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -132,7 +132,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) { + mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n", + event_type, rsn); +- return; ++ goto out; + } + + switch (common->res) { +@@ -150,7 +150,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + default: + mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn); + } +- ++out: + mlx5_core_put_rsc(common); + } + +-- +2.20.1 + diff --git a/queue-4.19/net-next-hinic-fix-a-bug-in-rx-data-flow.patch b/queue-4.19/net-next-hinic-fix-a-bug-in-rx-data-flow.patch new file mode 100644 index 00000000000..53f2a917c65 --- /dev/null +++ b/queue-4.19/net-next-hinic-fix-a-bug-in-rx-data-flow.patch @@ -0,0 +1,38 @@ +From 3b7c963591bf8518cd975e726cf63445b00aa4f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 05:47:34 +0000 +Subject: net-next/hinic: fix a bug in rx data flow + +From: Xue Chaojing + +[ Upstream commit b1a200484143a727ce293e0f200a543cc7584152 ] + +In rx_alloc_pkts(), there is a loop call of tasklet, which causes +100% cpu utilization, even no packets are being received. This patch +fixes this bug. + +Signed-off-by: Xue Chaojing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_rx.c b/drivers/net/ethernet/huawei/hinic/hinic_rx.c +index 4c0f7eda1166c..06b24a92ed7d4 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_rx.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_rx.c +@@ -207,9 +207,9 @@ skb_out: + wmb(); /* write all the wqes before update PI */ + + hinic_rq_update(rxq->rq, prod_idx); ++ tasklet_schedule(&rxq->rx_task); + } + +- tasklet_schedule(&rxq->rx_task); + return i; + } + +-- +2.20.1 + diff --git a/queue-4.19/net-next-hinic-fix-a-bug-in-set-mac-address.patch b/queue-4.19/net-next-hinic-fix-a-bug-in-set-mac-address.patch new file mode 100644 index 00000000000..293fcf82cca --- /dev/null +++ b/queue-4.19/net-next-hinic-fix-a-bug-in-set-mac-address.patch @@ -0,0 +1,55 @@ +From a8815fd856a8a48f27c457fda90b59599ee25424 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 05:47:33 +0000 +Subject: net-next/hinic:fix a bug in set mac address + +From: Xue Chaojing + +[ Upstream commit 9ea72dc9430306b77c73a8a21beb51437cde1d6d ] + +In add_mac_addr(), if the MAC address is a muliticast address, +it will not be set, which causes the network card fail to receive +the multicast packet. This patch fixes this bug. + +Signed-off-by: Xue Chaojing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index 4a8f82938ed5b..2352046971a4e 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -600,9 +600,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr) + u16 vid = 0; + int err; + +- if (!is_valid_ether_addr(addr)) +- return -EADDRNOTAVAIL; +- + netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n", + addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); + +@@ -726,6 +723,7 @@ static void set_rx_mode(struct work_struct *work) + { + struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work); + struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work); ++ struct netdev_hw_addr *ha; + + netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n"); + +@@ -733,6 +731,9 @@ static void set_rx_mode(struct work_struct *work) + + __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); + __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); ++ ++ netdev_for_each_mc_addr(ha, nic_dev->netdev) ++ add_mac_addr(nic_dev->netdev, ha->addr); + } + + static void hinic_set_rx_mode(struct net_device *netdev) +-- +2.20.1 + diff --git a/queue-4.19/net-qualcomm-rmnet-move-null-check-on-dev-before-der.patch b/queue-4.19/net-qualcomm-rmnet-move-null-check-on-dev-before-der.patch new file mode 100644 index 00000000000..72e2302525f --- /dev/null +++ b/queue-4.19/net-qualcomm-rmnet-move-null-check-on-dev-before-der.patch @@ -0,0 +1,45 @@ +From 3e60467009d0a59ce23722e8c4957717701e93d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Nov 2018 15:03:02 +0000 +Subject: net: qualcomm: rmnet: move null check on dev before dereferecing it + +From: Colin Ian King + +[ Upstream commit 3c18aa1464f9232d6abac8d7b4540f61b0658d62 ] + +Currently dev is dereferenced by the call dev_net(dev) before dev is null +checked. Fix this by null checking dev before the potential null +pointer dereference. + +Detected by CoverityScan, CID#1462955 ("Dereference before null check") + +Fixes: 23790ef12082 ("net: qualcomm: rmnet: Allow to configure flags for existing devices") +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +index f66d1255e36a2..4c476fac78358 100644 +--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c ++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c +@@ -301,10 +301,13 @@ static int rmnet_changelink(struct net_device *dev, struct nlattr *tb[], + struct rmnet_port *port; + u16 mux_id; + ++ if (!dev) ++ return -ENODEV; ++ + real_dev = __dev_get_by_index(dev_net(dev), + nla_get_u32(tb[IFLA_LINK])); + +- if (!real_dev || !dev || !rmnet_is_real_dev_registered(real_dev)) ++ if (!real_dev || !rmnet_is_real_dev_registered(real_dev)) + return -ENODEV; + + port = rmnet_get_port_rtnl(real_dev); +-- +2.20.1 + diff --git a/queue-4.19/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch b/queue-4.19/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch new file mode 100644 index 00000000000..87ad205bd09 --- /dev/null +++ b/queue-4.19/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch @@ -0,0 +1,44 @@ +From da611f3622279fb3286da8580cff535402034661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 16:46:43 +0100 +Subject: net/smc: use after free fix in smc_wr_tx_put_slot() + +From: Ursula Braun + +[ Upstream commit e438bae43c1e08e688c09c410407b59fc1c173b4 ] + +In smc_wr_tx_put_slot() field pend->idx is used after being +cleared. That means always idx 0 is cleared in the wr_tx_mask. +This results in a broken administration of available WR send +payload buffers. + +Signed-off-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_wr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c +index 3c458d2798557..c2694750a6a8a 100644 +--- a/net/smc/smc_wr.c ++++ b/net/smc/smc_wr.c +@@ -215,12 +215,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, + + pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); + if (pend->idx < link->wr_tx_cnt) { ++ u32 idx = pend->idx; ++ + /* clear the full struct smc_wr_tx_pend including .priv */ + memset(&link->wr_tx_pends[pend->idx], 0, + sizeof(link->wr_tx_pends[pend->idx])); + memset(&link->wr_tx_bufs[pend->idx], 0, + sizeof(link->wr_tx_bufs[pend->idx])); +- test_and_clear_bit(pend->idx, link->wr_tx_mask); ++ test_and_clear_bit(idx, link->wr_tx_mask); + return 1; + } + +-- +2.20.1 + diff --git a/queue-4.19/net-x25-fix-called-calling-length-calculation-in-x25.patch b/queue-4.19/net-x25-fix-called-calling-length-calculation-in-x25.patch new file mode 100644 index 00000000000..443924f2a4d --- /dev/null +++ b/queue-4.19/net-x25-fix-called-calling-length-calculation-in-x25.patch @@ -0,0 +1,36 @@ +From 2b613fc891d56bc0a6bbf74c247d6be27f980f20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 09:50:27 +0100 +Subject: net/x25: fix called/calling length calculation in + x25_parse_address_block + +From: Martin Schiller + +[ Upstream commit d449ba3d581ed29f751a59792fdc775572c66904 ] + +The length of the called and calling address was not calculated +correctly (BCD encoding). + +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index f7f53f9ae7efb..3150648206b68 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb, + } + + len = *skb->data; +- needed = 1 + (len >> 4) + (len & 0x0f); ++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2; + + if (!pskb_may_pull(skb, needed)) { + /* packet is too short to hold the addresses it claims +-- +2.20.1 + diff --git a/queue-4.19/net-x25-fix-null_x25_address-handling.patch b/queue-4.19/net-x25-fix-null_x25_address-handling.patch new file mode 100644 index 00000000000..d2a9670f20d --- /dev/null +++ b/queue-4.19/net-x25-fix-null_x25_address-handling.patch @@ -0,0 +1,59 @@ +From e6f6253ad16bcbc002cf526e4155daf7abc1a040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 09:50:28 +0100 +Subject: net/x25: fix null_x25_address handling + +From: Martin Schiller + +[ Upstream commit 06137619f061f498c2924f6543fa45b7d39f0501 ] + +o x25_find_listener(): the compare for the null_x25_address was wrong. + We have to check the x25_addr of the listener socket instead of the + x25_addr of the incomming call. + + o x25_bind(): it was not possible to bind a socket to null_x25_address + +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 3150648206b68..20a511398389d 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr, + sk_for_each(s, &x25_list) + if ((!strcmp(addr->x25_addr, + x25_sk(s)->source_addr.x25_addr) || +- !strcmp(addr->x25_addr, ++ !strcmp(x25_sk(s)->source_addr.x25_addr, + null_x25_address.x25_addr)) && + s->sk_state == TCP_LISTEN) { + /* +@@ -685,11 +685,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + +- len = strlen(addr->sx25_addr.x25_addr); +- for (i = 0; i < len; i++) { +- if (!isdigit(addr->sx25_addr.x25_addr[i])) { +- rc = -EINVAL; +- goto out; ++ /* check for the null_x25_address */ ++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { ++ ++ len = strlen(addr->sx25_addr.x25_addr); ++ for (i = 0; i < len; i++) { ++ if (!isdigit(addr->sx25_addr.x25_addr[i])) { ++ rc = -EINVAL; ++ goto out; ++ } + } + } + +-- +2.20.1 + diff --git a/queue-4.19/netfilter-nf_tables-don-t-use-position-attribute-on-.patch b/queue-4.19/netfilter-nf_tables-don-t-use-position-attribute-on-.patch new file mode 100644 index 00000000000..49d24c931eb --- /dev/null +++ b/queue-4.19/netfilter-nf_tables-don-t-use-position-attribute-on-.patch @@ -0,0 +1,58 @@ +From 81e4fbfe4939b66c52a3e0d0106e5c1893449ef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Nov 2018 12:07:14 +0100 +Subject: netfilter: nf_tables: don't use position attribute on rule + replacement + +From: Florian Westphal + +[ Upstream commit 447750f281abef547be44fdcfe3bc4447b3115a8 ] + +Its possible to set both HANDLE and POSITION when replacing a rule. +In this case, the rule at POSITION gets replaced using the +userspace-provided handle. Rule handles are supposed to be generated +by the kernel only. + +Duplicate handles should be harmless, however better disable this "feature" +by only checking for the POSITION attribute on insert operations. + +Fixes: 5e94846686d0 ("netfilter: nf_tables: add insert operation") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index ec0f8b5bde0aa..0e1b1f7f4745e 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2610,17 +2610,14 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + + if (chain->use == UINT_MAX) + return -EOVERFLOW; +- } +- +- if (nla[NFTA_RULE_POSITION]) { +- if (!(nlh->nlmsg_flags & NLM_F_CREATE)) +- return -EOPNOTSUPP; + +- pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); +- old_rule = __nft_rule_lookup(chain, pos_handle); +- if (IS_ERR(old_rule)) { +- NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); +- return PTR_ERR(old_rule); ++ if (nla[NFTA_RULE_POSITION]) { ++ pos_handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_POSITION])); ++ old_rule = __nft_rule_lookup(chain, pos_handle); ++ if (IS_ERR(old_rule)) { ++ NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION]); ++ return PTR_ERR(old_rule); ++ } + } + } + +-- +2.20.1 + diff --git a/queue-4.19/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch b/queue-4.19/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch new file mode 100644 index 00000000000..3cd0f800d1e --- /dev/null +++ b/queue-4.19/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch @@ -0,0 +1,73 @@ +From ec0b0897e5c549daada6eb2ddb55d5db3b8441e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2019 17:19:15 +0100 +Subject: NFC: nxp-nci: Fix NULL pointer dereference after I2C communication + error + +From: Stephan Gerhold + +[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ] + +I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci +result in a NULL pointer dereference at the moment: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + Oops: 0002 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1 + RIP: 0010:skb_queue_tail+0x25/0x50 + Call Trace: + nci_recv_frame+0x36/0x90 [nci] + nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c] + ? preempt_count_add+0x68/0xa0 + ? irq_forced_thread_fn+0x80/0x80 + irq_thread_fn+0x20/0x60 + irq_thread+0xee/0x180 + ? wake_threads_waitq+0x30/0x30 + kthread+0xfb/0x130 + ? irq_thread_check_affinity+0xd0/0xd0 + ? kthread_park+0x90/0x90 + ret_from_fork+0x1f/0x40 + +Afterward the kernel must be rebooted to work properly again. + +This happens because it attempts to call nci_recv_frame() with skb == NULL. +However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any +NULL checks for skb, causing the NULL pointer dereference. + +Change the code to call only nxp_nci_fw_recv_frame() in case of an error. +Make sure to log it so it is obvious that a communication error occurred. +The error above then becomes: + + nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 + nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 + nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 + +Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") +Signed-off-by: Stephan Gerhold +Reviewed-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index ba695e392c3b7..0df745cad601a 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + + if (r == -EREMOTEIO) { + phy->hard_fault = r; +- skb = NULL; +- } else if (r < 0) { ++ if (info->mode == NXP_NCI_MODE_FW) ++ nxp_nci_fw_recv_frame(phy->ndev, NULL); ++ } ++ if (r < 0) { + nfc_err(&client->dev, "Read failed with error %d\n", r); + goto exit_irq_handled; + } +-- +2.20.1 + diff --git a/queue-4.19/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch b/queue-4.19/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch new file mode 100644 index 00000000000..5a53e674463 --- /dev/null +++ b/queue-4.19/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch @@ -0,0 +1,89 @@ +From 83fde08274c0927d0e1544fb723a7fd446e9acf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 13:35:08 -0500 +Subject: nfsd: fix a warning in __cld_pipe_upcall() + +From: Scott Mayhew + +[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ] + +__cld_pipe_upcall() emits a "do not call blocking ops when +!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall(). +Fix it by using a completion instead of hand coding the wait. + +Signed-off-by: Scott Mayhew +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4recover.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index 9c247fa1e9594..5188f9f70c78c 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -662,7 +662,7 @@ struct cld_net { + struct cld_upcall { + struct list_head cu_list; + struct cld_net *cu_net; +- struct task_struct *cu_task; ++ struct completion cu_done; + struct cld_msg cu_msg; + }; + +@@ -671,23 +671,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg) + { + int ret; + struct rpc_pipe_msg msg; ++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg); + + memset(&msg, 0, sizeof(msg)); + msg.data = cmsg; + msg.len = sizeof(*cmsg); + +- /* +- * Set task state before we queue the upcall. That prevents +- * wake_up_process in the downcall from racing with schedule. +- */ +- set_current_state(TASK_UNINTERRUPTIBLE); + ret = rpc_queue_upcall(pipe, &msg); + if (ret < 0) { +- set_current_state(TASK_RUNNING); + goto out; + } + +- schedule(); ++ wait_for_completion(&cup->cu_done); + + if (msg.errno < 0) + ret = msg.errno; +@@ -754,7 +749,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (copy_from_user(&cup->cu_msg, src, mlen) != 0) + return -EFAULT; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + return mlen; + } + +@@ -769,7 +764,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) + if (msg->errno >= 0) + return; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + } + + static const struct rpc_pipe_ops cld_upcall_ops = { +@@ -900,7 +895,7 @@ restart_search: + goto restart_search; + } + } +- new->cu_task = current; ++ init_completion(&new->cu_done); + new->cu_msg.cm_vers = CLD_UPCALL_VERSION; + put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid); + new->cu_net = cn; +-- +2.20.1 + diff --git a/queue-4.19/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch b/queue-4.19/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch new file mode 100644 index 00000000000..b0fb8f89248 --- /dev/null +++ b/queue-4.19/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch @@ -0,0 +1,57 @@ +From 5223dbb0e6e3b58b23f76bec75cf3372a450e835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 16:04:25 +0800 +Subject: nfsd: Return EPERM, not EACCES, in some SETATTR cases + +From: zhengbin + +[ Upstream commit 255fbca65137e25b12bced18ec9a014dc77ecda0 ] + +As the man(2) page for utime/utimes states, EPERM is returned when the +second parameter of utime or utimes is not NULL, the caller's effective UID +does not match the owner of the file, and the caller is not privileged. + +However, in a NFS directory mounted from knfsd, it will return EACCES +(from nfsd_setattr-> fh_verify->nfsd_permission). This patch fixes +that. + +Signed-off-by: zhengbin +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/vfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index b53e76391e525..4fe8db3149506 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + bool get_write_count; + bool size_change = (iap->ia_valid & ATTR_SIZE); + +- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) ++ if (iap->ia_valid & ATTR_SIZE) { + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +- if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; ++ } ++ ++ /* ++ * If utimes(2) and friends are called with times not NULL, we should ++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission ++ * will return EACCESS, when the caller's effective UID does not match ++ * the owner of the file, and the caller is not privileged. In this ++ * situation, we should return EPERM(notify_change will return this). ++ */ ++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) { ++ accmode |= NFSD_MAY_OWNER_OVERRIDE; ++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET))) ++ accmode |= NFSD_MAY_WRITE; ++ } + + /* Callers that do fh_verify should do the fh_want_write: */ + get_write_count = !fhp->fh_dentry; +-- +2.20.1 + diff --git a/queue-4.19/nvme-free-ctrl-device-name-on-init-failure.patch b/queue-4.19/nvme-free-ctrl-device-name-on-init-failure.patch new file mode 100644 index 00000000000..687c59602db --- /dev/null +++ b/queue-4.19/nvme-free-ctrl-device-name-on-init-failure.patch @@ -0,0 +1,36 @@ +From c1b471a8b55d1a079d1ca9960dbb90b1ba158748 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 16:39:47 -0700 +Subject: nvme: Free ctrl device name on init failure + +From: Keith Busch + +[ Upstream commit d6a2b9535d1e52bea269c138614c4801469d10e1 ] + +Free the kobject name that was allocated for the controller device on +failure rather than its parent. + +Fixes: d22524a4782a9 ("nvme: switch controller refcounting to use struct device") +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index c4ff4f079448e..b2d9bd564960a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3652,7 +3652,7 @@ int nvme_init_ctrl(struct nvme_ctrl *ctrl, struct device *dev, + + return 0; + out_free_name: +- kfree_const(dev->kobj.name); ++ kfree_const(ctrl->device->kobj.name); + out_release_instance: + ida_simple_remove(&nvme_instance_ida, ctrl->instance); + out: +-- +2.20.1 + diff --git a/queue-4.19/perf-core-consistently-fail-fork-on-allocation-failu.patch b/queue-4.19/perf-core-consistently-fail-fork-on-allocation-failu.patch new file mode 100644 index 00000000000..660d7053c29 --- /dev/null +++ b/queue-4.19/perf-core-consistently-fail-fork-on-allocation-failu.patch @@ -0,0 +1,55 @@ +From 624244767be86fcdcc74984b64aa64123d37be85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 09:57:02 +0200 +Subject: perf/core: Consistently fail fork on allocation failures + +From: Alexander Shishkin + +[ Upstream commit 697d877849d4b34ab58d7078d6930bad0ef6fc66 ] + +Commit: + + 313ccb9615948 ("perf: Allocate context task_ctx_data for child event") + +makes the inherit path skip over the current event in case of task_ctx_data +allocation failure. This, however, is inconsistent with allocation failures +in perf_event_alloc(), which would abort the fork. + +Correct this by returning an error code on task_ctx_data allocation +failure and failing the fork in that case. + +Signed-off-by: Alexander Shishkin +Signed-off-by: Peter Zijlstra (Intel) +Cc: Arnaldo Carvalho de Melo +Cc: David Ahern +Cc: Jiri Olsa +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Link: https://lkml.kernel.org/r/20191105075702.60319-1-alexander.shishkin@linux.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 625ba462e5bbd..460d5fd3ec4e4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -11377,7 +11377,7 @@ inherit_event(struct perf_event *parent_event, + GFP_KERNEL); + if (!child_ctx->task_ctx_data) { + free_event(child_event); +- return NULL; ++ return ERR_PTR(-ENOMEM); + } + } + +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch b/queue-4.19/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch new file mode 100644 index 00000000000..dbf21234aff --- /dev/null +++ b/queue-4.19/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch @@ -0,0 +1,69 @@ +From f7cc8ed4df0f7ba6d4bb9e12c230849d4e531ed9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Nov 2018 20:34:11 -0500 +Subject: pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues + +From: Brian Masney + +[ Upstream commit 7ed07855773814337b9814f1c3e866df52ebce68 ] + +When attempting to setup up a gpio hog, device probing will repeatedly +fail with -EPROBE_DEFERED errors. It is caused by a circular dependency +between the gpio and pinctrl frameworks. If the gpio-ranges property is +present in device tree, then the gpio framework will handle the gpio pin +registration and eliminate the circular dependency. + +See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix +gpio-hog related boot issues") for a detailed commit message that +explains the issue in much more detail. The code comment in this commit +came from Christian's commit. + +I did not test this change against any hardware supported by this +particular driver, however I was able to validate this same fix works +for pinctrl-spmi-gpio.c using a LG Nexus 5 (hammerhead) phone. + +Signed-off-by: Brian Masney +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +index 0e153bae322ee..6bed433e54205 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev) + return ret; + } + +- ret = gpiochip_add_pin_range(&pctrl->chip, +- dev_name(pctrl->dev), +- 0, 0, pctrl->chip.ngpio); +- if (ret) { +- dev_err(pctrl->dev, "failed to add pin range\n"); +- goto unregister_gpiochip; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), ++ 0, 0, pctrl->chip.ngpio); ++ if (ret) { ++ dev_err(pctrl->dev, "failed to add pin range\n"); ++ goto unregister_gpiochip; ++ } + } + + platform_set_drvdata(pdev, pctrl); +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch b/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch new file mode 100644 index 00000000000..4e2a40ac9bd --- /dev/null +++ b/queue-4.19/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch @@ -0,0 +1,46 @@ +From 2baff95354561ef666795650ddb5668b83c8be3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 17:07:25 +0100 +Subject: pinctrl: sh-pfc: r8a7792: Fix VIN versioned groups + +From: Jacopo Mondi + +[ Upstream commit 11c8f8df85e77329d5a3cacc08682722cb80b95b ] + +Versioned VIN groups can appear on different sets of pins. Using the +VIN_DATA_PIN_GROUP macro now supports proper naming of said groups +through an optional 'version' argument. + +Use the 'version' argument for said macro to fix naming of versioned +groups for the R-Car V2H R8A7792 SoC. + +Fixes: 7dd74bb1f058 ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups") +Signed-off-by: Jacopo Mondi +Reviewed-by: Simon Horman +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +index cc3597f66605a..b3814ca009b02 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +@@ -1747,10 +1747,10 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + VIN_DATA_PIN_GROUP(vin1_data, 12), + VIN_DATA_PIN_GROUP(vin1_data, 10), + VIN_DATA_PIN_GROUP(vin1_data, 8), +- VIN_DATA_PIN_GROUP(vin1_data_b, 24), +- VIN_DATA_PIN_GROUP(vin1_data_b, 20), ++ VIN_DATA_PIN_GROUP(vin1_data, 24, _b), ++ VIN_DATA_PIN_GROUP(vin1_data, 20, _b), + SH_PFC_PIN_GROUP(vin1_data18_b), +- VIN_DATA_PIN_GROUP(vin1_data_b, 16), ++ VIN_DATA_PIN_GROUP(vin1_data, 16, _b), + SH_PFC_PIN_GROUP(vin1_sync), + SH_PFC_PIN_GROUP(vin1_field), + SH_PFC_PIN_GROUP(vin1_clkenb), +-- +2.20.1 + diff --git a/queue-4.19/pinctrl-sh-pfc-r8a7795-fix-vin-versioned-groups.patch b/queue-4.19/pinctrl-sh-pfc-r8a7795-fix-vin-versioned-groups.patch new file mode 100644 index 00000000000..4c7e8c54e95 --- /dev/null +++ b/queue-4.19/pinctrl-sh-pfc-r8a7795-fix-vin-versioned-groups.patch @@ -0,0 +1,65 @@ +From 7050fc57818e96eab2e6a7f0d456e2c53542616c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 17:07:26 +0100 +Subject: pinctrl: sh-pfc: r8a7795: Fix VIN versioned groups + +From: Jacopo Mondi + +[ Upstream commit 184844ccda4138402846bf4b42c28ac5f16a458a ] + +Versioned VIN groups can appear on different sets of pins. Using the +VIN_DATA_PIN_GROUP macro now supports proper naming of said groups +through an optional 'version' argument. + +Use the 'version' argument for said macro to fix naming of versioned +groups for the R-Car H3 R8A7795 SoC. + +Fixes: 9942a5b52990 ("pinctrl: sh-pfc: r8a7795: Deduplicate VIN4 pin definitions") +Signed-off-by: Jacopo Mondi +Reviewed-by: Simon Horman +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7795.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c +index 4f55b1562ad48..2893e3b05ff38 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c +@@ -4477,20 +4477,20 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + SH_PFC_PIN_GROUP(usb2), + SH_PFC_PIN_GROUP(usb2_ch3), + SH_PFC_PIN_GROUP(usb30), +- VIN_DATA_PIN_GROUP(vin4_data_a, 8), +- VIN_DATA_PIN_GROUP(vin4_data_a, 10), +- VIN_DATA_PIN_GROUP(vin4_data_a, 12), +- VIN_DATA_PIN_GROUP(vin4_data_a, 16), ++ VIN_DATA_PIN_GROUP(vin4_data, 8, _a), ++ VIN_DATA_PIN_GROUP(vin4_data, 10, _a), ++ VIN_DATA_PIN_GROUP(vin4_data, 12, _a), ++ VIN_DATA_PIN_GROUP(vin4_data, 16, _a), + SH_PFC_PIN_GROUP(vin4_data18_a), +- VIN_DATA_PIN_GROUP(vin4_data_a, 20), +- VIN_DATA_PIN_GROUP(vin4_data_a, 24), +- VIN_DATA_PIN_GROUP(vin4_data_b, 8), +- VIN_DATA_PIN_GROUP(vin4_data_b, 10), +- VIN_DATA_PIN_GROUP(vin4_data_b, 12), +- VIN_DATA_PIN_GROUP(vin4_data_b, 16), ++ VIN_DATA_PIN_GROUP(vin4_data, 20, _a), ++ VIN_DATA_PIN_GROUP(vin4_data, 24, _a), ++ VIN_DATA_PIN_GROUP(vin4_data, 8, _b), ++ VIN_DATA_PIN_GROUP(vin4_data, 10, _b), ++ VIN_DATA_PIN_GROUP(vin4_data, 12, _b), ++ VIN_DATA_PIN_GROUP(vin4_data, 16, _b), + SH_PFC_PIN_GROUP(vin4_data18_b), +- VIN_DATA_PIN_GROUP(vin4_data_b, 20), +- VIN_DATA_PIN_GROUP(vin4_data_b, 24), ++ VIN_DATA_PIN_GROUP(vin4_data, 20, _b), ++ VIN_DATA_PIN_GROUP(vin4_data, 24, _b), + SH_PFC_PIN_GROUP(vin4_sync), + SH_PFC_PIN_GROUP(vin4_field), + SH_PFC_PIN_GROUP(vin4_clkenb), +-- +2.20.1 + diff --git a/queue-4.19/powerpc-math-emu-update-macros-from-gcc.patch b/queue-4.19/powerpc-math-emu-update-macros-from-gcc.patch new file mode 100644 index 00000000000..016f54cd491 --- /dev/null +++ b/queue-4.19/powerpc-math-emu-update-macros-from-gcc.patch @@ -0,0 +1,191 @@ +From a26bd962f82086c0ae58fa13fbff0aece22cf9db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 09:37:46 +1030 +Subject: powerpc/math-emu: Update macros from GCC + +From: Joel Stanley + +[ Upstream commit b682c8692442711684befe413cf93cf01c5324ea ] + +The add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros originate +from GCC's longlong.h which in turn was copied from GMP's longlong.h a +few decades ago. + +This was found when compiling with clang: + + arch/powerpc/math-emu/fnmsub.c:46:2: error: invalid use of a cast in a + inline asm context requiring an l-value: remove the cast or build with + -fheinous-gnu-extensions + FP_ADD_D(R, T, B); + ^~~~~~~~~~~~~~~~~ + ... + + ./arch/powerpc/include/asm/sfp-machine.h:283:27: note: expanded from + macro 'sub_ddmmss' + : "=r" ((USItype)(sh)), \ + ~~~~~~~~~~^~~ + +Segher points out: this was fixed in GCC over 16 years ago +( https://gcc.gnu.org/r56600 ), and in GMP (where it comes from) +presumably before that. + +Update the add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros to +the latest GCC version in order to git rid of the invalid casts. These +were taken as-is from GCC's longlong in order to make future syncs +obvious. Other parts of sfp-machine.h were left as-is as the file +contains more features than present in longlong.h. + +Link: https://github.com/ClangBuiltLinux/linux/issues/260 +Signed-off-by: Joel Stanley +Reviewed-by: Nick Desaulniers +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/sfp-machine.h | 92 ++++++++------------------ + 1 file changed, 29 insertions(+), 63 deletions(-) + +diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h +index d89beaba26ff9..8b957aabb826d 100644 +--- a/arch/powerpc/include/asm/sfp-machine.h ++++ b/arch/powerpc/include/asm/sfp-machine.h +@@ -213,30 +213,18 @@ + * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow + * (i.e. carry out) is not stored anywhere, and is lost. + */ +-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ ++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ + else \ +- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \ + } while (0) + + /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to +@@ -248,44 +236,24 @@ + * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere, + * and is lost. + */ +-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ ++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (ah) && (ah) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ + else if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ + else \ +- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \ + } while (0) + + /* asm fragments for mul and div */ +@@ -294,13 +262,10 @@ + * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype + * word product in HIGH_PROD and LOW_PROD. + */ +-#define umul_ppmm(ph, pl, m0, m1) \ ++#define umul_ppmm(ph, pl, m0, m1) \ + do { \ + USItype __m0 = (m0), __m1 = (m1); \ +- __asm__ ("mulhwu %0,%1,%2" \ +- : "=r" ((USItype)(ph)) \ +- : "%r" (__m0), \ +- "r" (__m1)); \ ++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \ + (pl) = __m0 * __m1; \ + } while (0) + +@@ -312,9 +277,10 @@ + * significant bit of DENOMINATOR must be 1, then the pre-processor symbol + * UDIV_NEEDS_NORMALIZATION is defined to 1. + */ +-#define udiv_qrnnd(q, r, n1, n0, d) \ ++#define udiv_qrnnd(q, r, n1, n0, d) \ + do { \ +- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \ ++ UWtype __d1, __d0, __q1, __q0; \ ++ UWtype __r1, __r0, __m; \ + __d1 = __ll_highpart (d); \ + __d0 = __ll_lowpart (d); \ + \ +@@ -325,7 +291,7 @@ + if (__r1 < __m) \ + { \ + __q1--, __r1 += (d); \ +- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \ ++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\ + if (__r1 < __m) \ + __q1--, __r1 += (d); \ + } \ +-- +2.20.1 + diff --git a/queue-4.19/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch b/queue-4.19/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch new file mode 100644 index 00000000000..9273804d7f9 --- /dev/null +++ b/queue-4.19/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch @@ -0,0 +1,50 @@ +From 6ac30cfb01d0369e035d566346c3cca218f930c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 16:39:01 -0800 +Subject: pstore/ram: Avoid NULL deref in ftrace merging failure path + +From: Kees Cook + +[ Upstream commit 8665569e97dd52920713b95675409648986b5b0d ] + +Given corruption in the ftrace records, it might be possible to allocate +tmp_prz without assigning prz to it, but still marking it as needing to +be freed, which would cause at least a NULL dereference. + +smatch warnings: +fs/pstore/ram.c:340 ramoops_pstore_read() error: we previously assumed 'prz' could be null (see line 255) + +https://lists.01.org/pipermail/kbuild-all/2018-December/055528.html + +Reported-by: Dan Carpenter +Fixes: 2fbea82bbb89 ("pstore: Merge per-CPU ftrace records into one") +Cc: "Joel Fernandes (Google)" +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 015d74ee31a03..631ae057ab537 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -301,6 +301,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + GFP_KERNEL); + if (!tmp_prz) + return -ENOMEM; ++ prz = tmp_prz; + free_prz = true; + + while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) { +@@ -323,7 +324,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + goto out; + } + record->id = 0; +- prz = tmp_prz; + } + } + +-- +2.20.1 + diff --git a/queue-4.19/ravb-clean-up-duplex-handling.patch b/queue-4.19/ravb-clean-up-duplex-handling.patch new file mode 100644 index 00000000000..d399fb62b37 --- /dev/null +++ b/queue-4.19/ravb-clean-up-duplex-handling.patch @@ -0,0 +1,103 @@ +From 805ebe084f35af9ea4689d9700653509fec0cc78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 20:21:26 +0900 +Subject: ravb: Clean up duplex handling + +From: Magnus Damm + +[ Upstream commit 08b43857804dd0eca48f5c5a84885cf0079586e0 ] + +Since only full-duplex operation is supported by the +hardware, remove duplex handling code and keep the +register setting of ECMR.DM fixed at 1. + +This updates the driver implementation to follow the +data sheet text "This bit should always be set to 1." + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Signed-off-by: Magnus Damm +Reviewed-by: Sergei Shtylyov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/ravb.h | 1 - + drivers/net/ethernet/renesas/ravb_main.c | 19 +------------------ + 2 files changed, 1 insertion(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/renesas/ravb.h b/drivers/net/ethernet/renesas/ravb.h +index 9b6bf557a2f5f..e04af9546e526 100644 +--- a/drivers/net/ethernet/renesas/ravb.h ++++ b/drivers/net/ethernet/renesas/ravb.h +@@ -1029,7 +1029,6 @@ struct ravb_private { + phy_interface_t phy_interface; + int msg_enable; + int speed; +- int duplex; + int emac_irq; + enum ravb_chip_id chip_id; + int rx_irqs[NUM_RX_QUEUE]; +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 5462d2e8a1b71..faaf74073a120 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -82,13 +82,6 @@ static int ravb_config(struct net_device *ndev) + return error; + } + +-static void ravb_set_duplex(struct net_device *ndev) +-{ +- struct ravb_private *priv = netdev_priv(ndev); +- +- ravb_modify(ndev, ECMR, ECMR_DM, priv->duplex ? ECMR_DM : 0); +-} +- + static void ravb_set_rate(struct net_device *ndev) + { + struct ravb_private *priv = netdev_priv(ndev); +@@ -398,13 +391,11 @@ error: + /* E-MAC init function */ + static void ravb_emac_init(struct net_device *ndev) + { +- struct ravb_private *priv = netdev_priv(ndev); +- + /* Receive frame limit set register */ + ravb_write(ndev, ndev->mtu + ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN, RFLR); + + /* EMAC Mode: PAUSE prohibition; Duplex; RX Checksum; TX; RX */ +- ravb_write(ndev, ECMR_ZPF | (priv->duplex ? ECMR_DM : 0) | ++ ravb_write(ndev, ECMR_ZPF | ECMR_DM | + (ndev->features & NETIF_F_RXCSUM ? ECMR_RCSC : 0) | + ECMR_TE | ECMR_RE, ECMR); + +@@ -992,12 +983,6 @@ static void ravb_adjust_link(struct net_device *ndev) + ravb_rcv_snd_disable(ndev); + + if (phydev->link) { +- if (phydev->duplex != priv->duplex) { +- new_state = true; +- priv->duplex = phydev->duplex; +- ravb_set_duplex(ndev); +- } +- + if (phydev->speed != priv->speed) { + new_state = true; + priv->speed = phydev->speed; +@@ -1012,7 +997,6 @@ static void ravb_adjust_link(struct net_device *ndev) + new_state = true; + priv->link = 0; + priv->speed = 0; +- priv->duplex = -1; + } + + /* Enable TX and RX right over here, if E-MAC change is ignored */ +@@ -1042,7 +1026,6 @@ static int ravb_phy_init(struct net_device *ndev) + + priv->link = 0; + priv->speed = 0; +- priv->duplex = -1; + + /* Try connecting to PHY */ + pn = of_parse_phandle(np, "phy-handle", 0); +-- +2.20.1 + diff --git a/queue-4.19/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch b/queue-4.19/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch new file mode 100644 index 00000000000..dc496c307e9 --- /dev/null +++ b/queue-4.19/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch @@ -0,0 +1,39 @@ +From 590d3903af950955d0e5f2c689aa729706eccae9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 10:33:29 +0800 +Subject: RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN + +From: Sirong Wang + +[ Upstream commit 531eb45b3da4267fc2a64233ba256c8ffb02edd2 ] + +Size of pointer to buf field of struct hns_roce_hem_chunk should be +considered when calculating HNS_ROCE_HEM_CHUNK_LEN, or sg table size will +be larger than expected when allocating hem. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/1572575610-52530-2-git-send-email-liweihang@hisilicon.com +Signed-off-by: Sirong Wang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index e8850d59e7804..a94444db3045a 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -54,7 +54,7 @@ enum { + + #define HNS_ROCE_HEM_CHUNK_LEN \ + ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \ +- (sizeof(struct scatterlist))) ++ (sizeof(struct scatterlist) + sizeof(void *))) + + #define check_whether_bt_num_3(type, hop_num) \ + (type < HEM_TYPE_MTT && hop_num == 2) +-- +2.20.1 + diff --git a/queue-4.19/regulator-fix-return-value-of-_set_load-stub.patch b/queue-4.19/regulator-fix-return-value-of-_set_load-stub.patch new file mode 100644 index 00000000000..e1b9ea7c9e5 --- /dev/null +++ b/queue-4.19/regulator-fix-return-value-of-_set_load-stub.patch @@ -0,0 +1,39 @@ +From b87df424fe697fe9508215d306c6f9efa867a877 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 19:19:30 -0800 +Subject: regulator: Fix return value of _set_load() stub + +From: Mark Brown + +[ Upstream commit f1abf67217de91f5cd3c757ae857632ca565099a ] + +The stub implementation of _set_load() returns a mode value which is +within the bounds of valid return codes for success (the documentation +just says that failures are negative error codes) but not sensible or +what the actual implementation does. Fix it to just return 0. + +Reported-by: Cheng-Yi Chiang +Signed-off-by: Mark Brown +Reviewed-by: Douglas Anderson +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/regulator/consumer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h +index 25602afd48447..f3f76051e8b00 100644 +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator, + + static inline int regulator_set_load(struct regulator *regulator, int load_uA) + { +- return REGULATOR_MODE_NORMAL; ++ return 0; + } + + static inline int regulator_allow_bypass(struct regulator *regulator, +-- +2.20.1 + diff --git a/queue-4.19/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch b/queue-4.19/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch new file mode 100644 index 00000000000..8bffb0070b8 --- /dev/null +++ b/queue-4.19/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch @@ -0,0 +1,38 @@ +From 7338bc41c75074e1c920c8745b7cbbfabe23a175 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 14:38:47 +0800 +Subject: rsxx: add missed destroy_workqueue calls in remove + +From: Chuhong Yuan + +[ Upstream commit dcb77e4b274b8f13ac6482dfb09160cd2fae9a40 ] + +The driver misses calling destroy_workqueue in remove like what is done +when probe fails. +Add the missed calls to fix it. + +Signed-off-by: Chuhong Yuan +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rsxx/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index f2c631ce793cc..14056dc450642 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -1014,8 +1014,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) + + cancel_work_sync(&card->event_work); + ++ destroy_workqueue(card->event_wq); + rsxx_destroy_dev(card); + rsxx_dma_destroy(card); ++ destroy_workqueue(card->creg_ctrl.creg_wq); + + spin_lock_irqsave(&card->irq_lock, flags); + rsxx_disable_ier_and_isr(card, CR_INTR_ALL); +-- +2.20.1 + diff --git a/queue-4.19/rtc-dt-binding-abx80x-fix-resistance-scale.patch b/queue-4.19/rtc-dt-binding-abx80x-fix-resistance-scale.patch new file mode 100644 index 00000000000..565928a806b --- /dev/null +++ b/queue-4.19/rtc-dt-binding-abx80x-fix-resistance-scale.patch @@ -0,0 +1,31 @@ +From 88b5aa110934d3c3de5ba46c332340877e481df2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 14:34:02 +0200 +Subject: rtc: dt-binding: abx80x: fix resistance scale + +From: Baruch Siach + +[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ] + +The abracon,tc-resistor property value is in kOhm. + +Signed-off-by: Baruch Siach +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +index be789685a1c24..18b892d010d87 100644 +--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt ++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +@@ -27,4 +27,4 @@ and valid to enable charging: + + - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V) + - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output +- resistor, the other values are in ohm. ++ resistor, the other values are in kOhm. +-- +2.20.1 + diff --git a/queue-4.19/rtc-max77686-fix-the-returned-value-in-case-of-error.patch b/queue-4.19/rtc-max77686-fix-the-returned-value-in-case-of-error.patch new file mode 100644 index 00000000000..66715ab268f --- /dev/null +++ b/queue-4.19/rtc-max77686-fix-the-returned-value-in-case-of-error.patch @@ -0,0 +1,41 @@ +From e472e0102a0c99c8d0ab913ba510e8555877fc03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 00:36:45 +0100 +Subject: rtc: max77686: Fix the returned value in case of error in + 'max77686_rtc_read_time()' + +From: Christophe JAILLET + +[ Upstream commit b28cc6cec3d814f5184cbebb2d1f987e769f534a ] + +In case of error, we return 0. +This is spurious and not consistent with the other functions of the driver. +Commit e115a2bf1426 has modified more than what is said in the commit +message. Reverse part of it znd return an error when needed, as it was +previously. + +Fixes: e115a2bf1426 ("rtc: max77686: stop validating rtc_time in .read_time") +Signed-off-by: Christophe JAILLET +Reviewed-by: Chanwoo Choi +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-max77686.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-max77686.c b/drivers/rtc/rtc-max77686.c +index 8a60900d6b8b5..4aff349ae301a 100644 +--- a/drivers/rtc/rtc-max77686.c ++++ b/drivers/rtc/rtc-max77686.c +@@ -360,7 +360,7 @@ static int max77686_rtc_read_time(struct device *dev, struct rtc_time *tm) + + out: + mutex_unlock(&info->lock); +- return 0; ++ return ret; + } + + static int max77686_rtc_set_time(struct device *dev, struct rtc_time *tm) +-- +2.20.1 + diff --git a/queue-4.19/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch b/queue-4.19/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch new file mode 100644 index 00000000000..6db40c36079 --- /dev/null +++ b/queue-4.19/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch @@ -0,0 +1,37 @@ +From 3df728b67577c64428086cfad1cb2a220ccd6ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:19:51 +0100 +Subject: rtc: max8997: Fix the returned value in case of error in + 'max8997_rtc_read_alarm()' + +From: Christophe JAILLET + +[ Upstream commit 41ef3878203cd9218d92eaa07df4b85a2cb128fb ] + +In case of error, we return 0. +This is spurious and not consistent with the other functions of the driver. +Propagate the error code instead. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-max8997.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c +index 08c661a332ec0..20e50d9fdf882 100644 +--- a/drivers/rtc/rtc-max8997.c ++++ b/drivers/rtc/rtc-max8997.c +@@ -215,7 +215,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + + out: + mutex_unlock(&info->lock); +- return 0; ++ return ret; + } + + static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info) +-- +2.20.1 + diff --git a/queue-4.19/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch b/queue-4.19/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch new file mode 100644 index 00000000000..0ffc35cd452 --- /dev/null +++ b/queue-4.19/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch @@ -0,0 +1,60 @@ +From 9c356c063bd3ce2a0ef124c8610393f99061fd78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 12:32:50 +0100 +Subject: rtc: s3c-rtc: Avoid using broken ALMYEAR register + +From: Marek Szyprowski + +[ Upstream commit 50c8aec4212a966817e868056efc9bfbb73337c0 ] + +(RTC,ALM)YEAR registers of Exynos built-in RTC device contains 3 BCD +characters. s3c-rtc driver uses only 2 lower of them and supports years +from 2000..2099 range. The third BCD value is typically set to 0, but it +looks that handling of it is broken in the hardware. It sometimes +defaults to a random (even non-BCD) value. This is not an issue +for handling RTCYEAR register, because bcd2bin() properly handles only +8bit values (2 BCD characters, the third one is skipped). The problem +is however with ALMYEAR register and proper RTC alarm operation. When +YEAREN bit is set for the configured alarm, RTC hardware triggers alarm +only when ALMYEAR and RTCYEAR matches. This usually doesn't happen +because of the random noise on the third BCD character. + +Fix this by simply skipping setting ALMYEAR register in alarm +configuration. This workaround fixes broken alarm operation on Exynos +built-in rtc device. My tests revealed that the issue happens on the +following Exynos series: 3250, 4210, 4412, 5250 and 5410. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-s3c.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c +index 75c8c5033e087..58e03ac3578b7 100644 +--- a/drivers/rtc/rtc-s3c.c ++++ b/drivers/rtc/rtc-s3c.c +@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + struct rtc_time *tm = &alrm->time; + unsigned int alrm_en; + int ret; +- int year = tm->tm_year - 100; + + dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n", + alrm->enabled, +@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR); + } + +- if (year < 100 && year >= 0) { +- alrm_en |= S3C2410_RTCALM_YEAREN; +- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR); +- } +- + if (tm->tm_mon < 12 && tm->tm_mon >= 0) { + alrm_en |= S3C2410_RTCALM_MONEN; + writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON); +-- +2.20.1 + diff --git a/queue-4.19/sched-core-avoid-spurious-lock-dependencies.patch b/queue-4.19/sched-core-avoid-spurious-lock-dependencies.patch new file mode 100644 index 00000000000..9ec7902872a --- /dev/null +++ b/queue-4.19/sched-core-avoid-spurious-lock-dependencies.patch @@ -0,0 +1,67 @@ +From fc510a84b1bb280373fcb00a22d683f70b136ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 11:18:37 +0200 +Subject: sched/core: Avoid spurious lock dependencies + +From: Peter Zijlstra + +[ Upstream commit ff51ff84d82aea5a889b85f2b9fb3aa2b8691668 ] + +While seemingly harmless, __sched_fork() does hrtimer_init(), which, +when DEBUG_OBJETS, can end up doing allocations. + +This then results in the following lock order: + + rq->lock + zone->lock.rlock + batched_entropy_u64.lock + +Which in turn causes deadlocks when we do wakeups while holding that +batched_entropy lock -- as the random code does. + +Solve this by moving __sched_fork() out from under rq->lock. This is +safe because nothing there relies on rq->lock, as also evident from the +other __sched_fork() callsite. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Qian Cai +Cc: Thomas Gleixner +Cc: akpm@linux-foundation.org +Cc: bigeasy@linutronix.de +Cc: cl@linux.com +Cc: keescook@chromium.org +Cc: penberg@kernel.org +Cc: rientjes@google.com +Cc: thgarnie@google.com +Cc: tytso@mit.edu +Cc: will@kernel.org +Fixes: b7d5dc21072c ("random: add a spinlock_t to struct batched_entropy") +Link: https://lkml.kernel.org/r/20191001091837.GK4536@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 78ecdfae25b69..2befd2c4ce9e6 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5413,10 +5413,11 @@ void init_idle(struct task_struct *idle, int cpu) + struct rq *rq = cpu_rq(cpu); + unsigned long flags; + ++ __sched_fork(0, idle); ++ + raw_spin_lock_irqsave(&idle->pi_lock, flags); + raw_spin_lock(&rq->lock); + +- __sched_fork(0, idle); + idle->state = TASK_RUNNING; + idle->se.exec_start = sched_clock(); + idle->flags |= PF_IDLE; +-- +2.20.1 + diff --git a/queue-4.19/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch b/queue-4.19/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch new file mode 100644 index 00000000000..1ff1a6c2708 --- /dev/null +++ b/queue-4.19/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch @@ -0,0 +1,39 @@ +From 858d07cc26891658bb0c2c3aeee3ca4f84012655 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 01:25:18 -0800 +Subject: scsi: qedi: Allocate IRQs based on msix_cnt + +From: Nilesh Javali + +[ Upstream commit 1a291bce5eaf5374627d337157544aa6499ce34a ] + +The driver load on some systems failed with error, +[0004:01:00.5]:[qedi_request_msix_irq:2524]:8: request_irq failed. + +Allocate the IRQs based on MSIX count obtained from qed module instead of +number of queues. + +Signed-off-by: Nilesh Javali +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 763c7628356b1..a81ea8f6c2087 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1304,7 +1304,7 @@ static int qedi_request_msix_irq(struct qedi_ctx *qedi) + int i, rc, cpu; + + cpu = cpumask_first(cpu_online_mask); +- for (i = 0; i < MIN_NUM_CPUS_MSIX(qedi); i++) { ++ for (i = 0; i < qedi->int_info.msix_cnt; i++) { + rc = request_irq(qedi->int_info.msix[i].vector, + qedi_msix_handler, 0, "qedi", + &qedi->fp_array[i]); +-- +2.20.1 + diff --git a/queue-4.19/scsi-zfcp-drop-default-switch-case-which-might-paper.patch b/queue-4.19/scsi-zfcp-drop-default-switch-case-which-might-paper.patch new file mode 100644 index 00000000000..e062e0168d1 --- /dev/null +++ b/queue-4.19/scsi-zfcp-drop-default-switch-case-which-might-paper.patch @@ -0,0 +1,54 @@ +From 953d0584fbf43b0a7ac3bdcf1aa1f953f35a7580 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 15:44:57 +0100 +Subject: scsi: zfcp: drop default switch case which might paper over missing + case + +From: Steffen Maier + +[ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ] + +This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix +missing REC trigger trace for all objects in ERP_FAILED") but would now +suppress helpful -Wswitch compiler warnings when building with W=1 such as +the following forced example: + +drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed': +drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch] + switch (want) { + ^~~~~~ + +But then again, only with W=1 we would notice unhandled enum cases. +Without the default cases and a missed unhandled enum case, the code might +perform unforeseen things we might not want... + +As of today, we never run through the removed default case, so removing it +is no functional change. In the future, we never should run through a +default case but introduce the necessary specific case(s) to handle new +functionality. + +Signed-off-by: Steffen Maier +Reviewed-by: Benjamin Block +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/s390/scsi/zfcp_erp.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index 332701db7379d..f602b42b8343d 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -172,9 +172,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, + adapter, ZFCP_STATUS_COMMON_ERP_FAILED); + } + break; +- default: +- need = 0; +- break; + } + + return need; +-- +2.20.1 + diff --git a/queue-4.19/scsi-zfcp-update-kernel-message-for-invalid-fcp_cmnd.patch b/queue-4.19/scsi-zfcp-update-kernel-message-for-invalid-fcp_cmnd.patch new file mode 100644 index 00000000000..a82bc769108 --- /dev/null +++ b/queue-4.19/scsi-zfcp-update-kernel-message-for-invalid-fcp_cmnd.patch @@ -0,0 +1,42 @@ +From e46aefc4c2513dd774f9b4a01245955008b98f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 15:44:47 +0100 +Subject: scsi: zfcp: update kernel message for invalid FCP_CMND length, it's + not the CDB + +From: Steffen Maier + +[ Upstream commit 724e144387f4d7e7668d3da913d0efc44a9b4664 ] + +The CDB is just a part inside of FCP_CMND, see zfcp_fc_scsi_to_fcp(). +While at it, fix the device driver reaction: adapter not LUN shutdown. + +Signed-off-by: Steffen Maier +Reviewed-by: Benjamin Block +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/s390/scsi/zfcp_fsf.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index df888506e363e..91aa4bfcf8d61 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -2104,11 +2104,8 @@ static void zfcp_fsf_fcp_handler_common(struct zfcp_fsf_req *req, + break; + case FSF_CMND_LENGTH_NOT_VALID: + dev_err(&req->adapter->ccw_device->dev, +- "Incorrect CDB length %d, LUN 0x%016Lx on " +- "port 0x%016Lx closed\n", +- req->qtcb->bottom.io.fcp_cmnd_length, +- (unsigned long long)zfcp_scsi_dev_lun(sdev), +- (unsigned long long)zfcp_sdev->port->wwpn); ++ "Incorrect FCP_CMND length %d, FCP device closed\n", ++ req->qtcb->bottom.io.fcp_cmnd_length); + zfcp_erp_adapter_shutdown(req->adapter, 0, "fssfch4"); + req->status |= ZFCP_STATUS_FSFREQ_ERROR; + break; +-- +2.20.1 + diff --git a/queue-4.19/sctp-count-sk_wmem_alloc-by-skb-truesize-in-sctp_pac.patch b/queue-4.19/sctp-count-sk_wmem_alloc-by-skb-truesize-in-sctp_pac.patch new file mode 100644 index 00000000000..6961e233e35 --- /dev/null +++ b/queue-4.19/sctp-count-sk_wmem_alloc-by-skb-truesize-in-sctp_pac.patch @@ -0,0 +1,77 @@ +From f271f948726c1ac968bf60dcb8a853d9c9c248e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 15:07:38 +0800 +Subject: sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit + +From: Xin Long + +[ Upstream commit 02968ccf0125d39b08ecef5946300a8a873c0942 ] + +Now sctp increases sk_wmem_alloc by 1 when doing set_owner_w for the +skb allocked in sctp_packet_transmit and decreases by 1 when freeing +this skb. + +But when this skb goes through networking stack, some subcomponents +might change skb->truesize and add the same amount on sk_wmem_alloc. +However sctp doesn't know the amount to decrease by, it would cause +a leak on sk->sk_wmem_alloc and the sock can never be freed. + +Xiumei found this issue when it hit esp_output_head() by using sctp +over ipsec, where skb->truesize is added and so is sk->sk_wmem_alloc. + +Since sctp has used sk_wmem_queued to count for writable space since +Commit cd305c74b0f8 ("sctp: use sk_wmem_queued to check for writable +space"), it's ok to fix it by counting sk_wmem_alloc by skb truesize +in sctp_packet_transmit. + +Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") +Reported-by: Xiumei Mu +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/output.c | 21 +-------------------- + 1 file changed, 1 insertion(+), 20 deletions(-) + +diff --git a/net/sctp/output.c b/net/sctp/output.c +index 08601223b0bfa..b0e74a3e77ec5 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -399,25 +399,6 @@ finish: + return retval; + } + +-static void sctp_packet_release_owner(struct sk_buff *skb) +-{ +- sk_free(skb->sk); +-} +- +-static void sctp_packet_set_owner_w(struct sk_buff *skb, struct sock *sk) +-{ +- skb_orphan(skb); +- skb->sk = sk; +- skb->destructor = sctp_packet_release_owner; +- +- /* +- * The data chunks have already been accounted for in sctp_sendmsg(), +- * therefore only reserve a single byte to keep socket around until +- * the packet has been transmitted. +- */ +- refcount_inc(&sk->sk_wmem_alloc); +-} +- + static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb) + { + if (SCTP_OUTPUT_CB(head)->last == head) +@@ -604,7 +585,7 @@ int sctp_packet_transmit(struct sctp_packet *packet, gfp_t gfp) + if (!head) + goto out; + skb_reserve(head, packet->overhead + MAX_HEADER); +- sctp_packet_set_owner_w(head, sk); ++ skb_set_owner_w(head, sk); + + /* set sctp header */ + sh = skb_push(head, sizeof(struct sctphdr)); +-- +2.20.1 + diff --git a/queue-4.19/sctp-frag_point-sanity-check.patch b/queue-4.19/sctp-frag_point-sanity-check.patch new file mode 100644 index 00000000000..08ef22fc50f --- /dev/null +++ b/queue-4.19/sctp-frag_point-sanity-check.patch @@ -0,0 +1,77 @@ +From 5d34fd65d95fc06b482699626e94e3b30105ed2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 20:27:41 +0100 +Subject: sctp: frag_point sanity check + +From: Jakub Audykowicz + +[ Upstream commit afd0a8006e98b1890908f81746c94ca5dae29d7c ] + +If for some reason an association's fragmentation point is zero, +sctp_datamsg_from_user will try to endlessly try to divide a message +into zero-sized chunks. This eventually causes kernel panic due to +running out of memory. + +Although this situation is quite unlikely, it has occurred before as +reported. I propose to add this simple last-ditch sanity check due to +the severity of the potential consequences. + +Signed-off-by: Jakub Audykowicz +Acked-by: Neil Horman +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sctp/sctp.h | 5 +++++ + net/sctp/chunk.c | 6 ++++++ + net/sctp/socket.c | 3 +-- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h +index ab9242e51d9e0..2abbc15824af9 100644 +--- a/include/net/sctp/sctp.h ++++ b/include/net/sctp/sctp.h +@@ -620,4 +620,9 @@ static inline bool sctp_transport_pmtu_check(struct sctp_transport *t) + return false; + } + ++static inline __u32 sctp_min_frag_point(struct sctp_sock *sp, __u16 datasize) ++{ ++ return sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, datasize); ++} ++ + #endif /* __net_sctp_h__ */ +diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c +index ce8087846f059..d2048de86e7c2 100644 +--- a/net/sctp/chunk.c ++++ b/net/sctp/chunk.c +@@ -191,6 +191,12 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc, + * the packet + */ + max_data = asoc->frag_point; ++ if (unlikely(!max_data)) { ++ max_data = sctp_min_frag_point(sctp_sk(asoc->base.sk), ++ sctp_datachk_len(&asoc->stream)); ++ pr_warn_ratelimited("%s: asoc:%p frag_point is zero, forcing max_data to default minimum (%Zu)", ++ __func__, asoc, max_data); ++ } + + /* If the the peer requested that we authenticate DATA chunks + * we need to account for bundling of the AUTH chunks along with +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index e7a11cd7633f5..95f9068b85497 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3328,8 +3328,7 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned + __u16 datasize = asoc ? sctp_datachk_len(&asoc->stream) : + sizeof(struct sctp_data_chunk); + +- min_len = sctp_mtu_payload(sp, SCTP_DEFAULT_MINSEGMENT, +- datasize); ++ min_len = sctp_min_frag_point(sp, datasize); + max_len = SCTP_MAX_CHUNK_LEN - datasize; + + if (val < min_len || val > max_len) +-- +2.20.1 + diff --git a/queue-4.19/sctp-increase-sk_wmem_alloc-when-head-truesize-is-in.patch b/queue-4.19/sctp-increase-sk_wmem_alloc-when-head-truesize-is-in.patch new file mode 100644 index 00000000000..48af6befef8 --- /dev/null +++ b/queue-4.19/sctp-increase-sk_wmem_alloc-when-head-truesize-is-in.patch @@ -0,0 +1,42 @@ +From c5f244ffecdd04de93817f993878702c7c3dac68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 14:52:44 +0800 +Subject: sctp: increase sk_wmem_alloc when head->truesize is increased + +From: Xin Long + +[ Upstream commit 0d32f17717e65e76cbdb248374dd162acdfe2fff ] + +I changed to count sk_wmem_alloc by skb truesize instead of 1 to +fix the sk_wmem_alloc leak caused by later truesize's change in +xfrm in Commit 02968ccf0125 ("sctp: count sk_wmem_alloc by skb +truesize in sctp_packet_transmit"). + +But I should have also increased sk_wmem_alloc when head->truesize +is increased in sctp_packet_gso_append() as xfrm does. Otherwise, +sctp gso packet will cause sk_wmem_alloc underflow. + +Fixes: 02968ccf0125 ("sctp: count sk_wmem_alloc by skb truesize in sctp_packet_transmit") +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/output.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sctp/output.c b/net/sctp/output.c +index b0e74a3e77ec5..025f48e14a91f 100644 +--- a/net/sctp/output.c ++++ b/net/sctp/output.c +@@ -410,6 +410,7 @@ static void sctp_packet_gso_append(struct sk_buff *head, struct sk_buff *skb) + head->truesize += skb->truesize; + head->data_len += skb->len; + head->len += skb->len; ++ refcount_add(skb->truesize, &head->sk->sk_wmem_alloc); + + __skb_header_release(skb); + } +-- +2.20.1 + diff --git a/queue-4.19/selftests-kvm-fix-build-with-glibc-2.30.patch b/queue-4.19/selftests-kvm-fix-build-with-glibc-2.30.patch new file mode 100644 index 00000000000..c9068f8b313 --- /dev/null +++ b/queue-4.19/selftests-kvm-fix-build-with-glibc-2.30.patch @@ -0,0 +1,56 @@ +From ec3cf93d7bd74695ced5c4359edb37b2c5191137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 13:51:15 +0100 +Subject: selftests: kvm: fix build with glibc >= 2.30 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vitaly Kuznetsov + +[ Upstream commit e37f9f139f62deddff90c7298ae3a85026a71067 ] + +Glibc-2.30 gained gettid() wrapper, selftests fail to compile: + +lib/assert.c:58:14: error: static declaration of ‘gettid’ follows non-static declaration + 58 | static pid_t gettid(void) + | ^~~~~~ +In file included from /usr/include/unistd.h:1170, + from include/test_util.h:18, + from lib/assert.c:10: +/usr/include/bits/unistd_ext.h:34:16: note: previous declaration of ‘gettid’ was here + 34 | extern __pid_t gettid (void) __THROW; + | ^~~~~~ + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/lib/assert.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/kvm/lib/assert.c b/tools/testing/selftests/kvm/lib/assert.c +index cd01144d27c8d..d306677065699 100644 +--- a/tools/testing/selftests/kvm/lib/assert.c ++++ b/tools/testing/selftests/kvm/lib/assert.c +@@ -56,7 +56,7 @@ static void test_dump_stack(void) + #pragma GCC diagnostic pop + } + +-static pid_t gettid(void) ++static pid_t _gettid(void) + { + return syscall(SYS_gettid); + } +@@ -73,7 +73,7 @@ test_assert(bool exp, const char *exp_str, + fprintf(stderr, "==== Test Assertion Failure ====\n" + " %s:%u: %s\n" + " pid=%d tid=%d - %s\n", +- file, line, exp_str, getpid(), gettid(), ++ file, line, exp_str, getpid(), _gettid(), + strerror(errno)); + test_dump_stack(); + if (fmt) { +-- +2.20.1 + diff --git a/queue-4.19/selftests-powerpc-allocate-base-registers.patch b/queue-4.19/selftests-powerpc-allocate-base-registers.patch new file mode 100644 index 00000000000..c76c588d1df --- /dev/null +++ b/queue-4.19/selftests-powerpc-allocate-base-registers.patch @@ -0,0 +1,143 @@ +From 52657ebbbb6aaf7b047df6c2be5e888a41e98561 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 11:38:20 -0300 +Subject: selftests/powerpc: Allocate base registers + +From: Breno Leitao + +[ Upstream commit 5249497a7bb6334fcc128588d6a7e1e21786515a ] + +Some ptrace selftests are passing input operands using a constraint that +can allocate any register for the operand, and using these registers on +load/store operations. + +If the register allocated by the compiler happens to be zero (r0), it might +cause an invalid memory address access, since load and store operations +consider the content of 0x0 address if the base register is r0, instead of +the content of the r0 register. For example: + + r1 := 0xdeadbeef + r0 := 0xdeadbeef + + ld r2, 0(1) /* will load into r2 the content of r1 address */ + ld r2, 0(0) /* will load into r2 the content of 0x0 */ + +In order to avoid this possible problem, the inline assembly constraint +should be aware that these registers will be used as a base register, thus, +r0 should not be allocated. + +Other than that, this patch removes inline assembly operands that are not +used by the tests. + +Signed-off-by: Breno Leitao +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c | 2 +- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c | 4 ++-- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c | 2 +- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c | 3 +-- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c | 2 +- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c | 2 +- + tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c | 3 +-- + 7 files changed, 8 insertions(+), 10 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c +index 0b4ebcc2f485a..ca29fafeed5d9 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-gpr.c +@@ -31,7 +31,7 @@ void gpr(void) + ASM_LOAD_GPR_IMMED(gpr_1) + ASM_LOAD_FPR_SINGLE_PRECISION(flt_1) + : +- : [gpr_1]"i"(GPR_1), [flt_1] "r" (&a) ++ : [gpr_1]"i"(GPR_1), [flt_1] "b" (&a) + : "memory", "r6", "r7", "r8", "r9", "r10", + "r11", "r12", "r13", "r14", "r15", "r16", "r17", + "r18", "r19", "r20", "r21", "r22", "r23", "r24", +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c +index 59206b96e98a5..a08a91594dbe5 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-gpr.c +@@ -59,8 +59,8 @@ trans: + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) + : [gpr_1]"i"(GPR_1), [gpr_2]"i"(GPR_2), +- [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "r" (&a), +- [flt_2] "r" (&b), [cptr1] "r" (&cptr[1]) ++ [sprn_texasr] "i" (SPRN_TEXASR), [flt_1] "b" (&a), ++ [flt_2] "b" (&b), [cptr1] "b" (&cptr[1]) + : "memory", "r7", "r8", "r9", "r10", + "r11", "r12", "r13", "r14", "r15", "r16", + "r17", "r18", "r19", "r20", "r21", "r22", +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +index b3c061dc95122..f471747462312 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-tar.c +@@ -72,7 +72,7 @@ trans: + "3: ;" + + : [res] "=r" (result), [texasr] "=r" (texasr) +- : [val] "r" (cptr[1]), [sprn_dscr]"i"(SPRN_DSCR), ++ : [sprn_dscr]"i"(SPRN_DSCR), + [sprn_tar]"i"(SPRN_TAR), [sprn_ppr]"i"(SPRN_PPR), + [sprn_texasr]"i"(SPRN_TEXASR), [tar_1]"i"(TAR_1), + [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), [dscr_2]"i"(DSCR_2), +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +index 277dade1b382f..18a685bf6a097 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spd-vsx.c +@@ -77,8 +77,7 @@ trans: + + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) +- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt), +- [sprn_texasr] "i" (SPRN_TEXASR) ++ : [sprn_texasr] "i" (SPRN_TEXASR) + : "memory", "r0", "r1", "r3", "r4", + "r7", "r8", "r9", "r10", "r11" + ); +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c +index 51427a2465f69..ba04999254e38 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-spr.c +@@ -74,7 +74,7 @@ trans: + + "3: ;" + : [tfhar] "=r" (tfhar), [res] "=r" (result), +- [texasr] "=r" (texasr), [cptr1] "=r" (cptr1) ++ [texasr] "=r" (texasr), [cptr1] "=b" (cptr1) + : [sprn_texasr] "i" (SPRN_TEXASR) + : "memory", "r0", "r8", "r31" + ); +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +index 48b462f750230..f70023b25e6e8 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-tar.c +@@ -65,7 +65,7 @@ trans: + : [sprn_dscr]"i"(SPRN_DSCR), [sprn_tar]"i"(SPRN_TAR), + [sprn_ppr]"i"(SPRN_PPR), [sprn_texasr]"i"(SPRN_TEXASR), + [tar_1]"i"(TAR_1), [dscr_1]"i"(DSCR_1), [tar_2]"i"(TAR_2), +- [dscr_2]"i"(DSCR_2), [cptr1] "r" (&cptr[1]) ++ [dscr_2]"i"(DSCR_2), [cptr1] "b" (&cptr[1]) + : "memory", "r0", "r1", "r3", "r4", "r5", "r6" + ); + +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +index 17c23cabac3ea..dfba800589776 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-tm-vsx.c +@@ -65,8 +65,7 @@ trans: + + "3: ;" + : [res] "=r" (result), [texasr] "=r" (texasr) +- : [fp_load] "r" (fp_load), [fp_load_ckpt] "r" (fp_load_ckpt), +- [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "r" (&cptr[1]) ++ : [sprn_texasr] "i" (SPRN_TEXASR), [cptr1] "b" (&cptr[1]) + : "memory", "r0", "r1", "r3", "r4", + "r7", "r8", "r9", "r10", "r11" + ); +-- +2.20.1 + diff --git a/queue-4.19/selftests-powerpc-skip-test-instead-of-failing.patch b/queue-4.19/selftests-powerpc-skip-test-instead-of-failing.patch new file mode 100644 index 00000000000..2163642bb66 --- /dev/null +++ b/queue-4.19/selftests-powerpc-skip-test-instead-of-failing.patch @@ -0,0 +1,52 @@ +From dd32e68571dfaa92186742a63345d5ba5a0d4995 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 11:38:22 -0300 +Subject: selftests/powerpc: Skip test instead of failing + +From: Breno Leitao + +[ Upstream commit eafcd8e3fbad4f426a40ed2b6a8c697c3a4ef36a ] + +Current core-pkey selftest fails if the test runs without privileges to +write into the core pattern file (/proc/sys/kernel/core_pattern). This +causes the test to fail and give the impression that the subsystem being +tested is broken, when, in fact, the test is being executed without the +proper privileges. This is the current error: + + test: core_pkey + tags: git_version:v4.19-3-g9e3363be9bce-dirty + Error writing to core_pattern file: Permission denied + failure: core_pkey + +This patch simply skips this test if it runs without the proper privileges, +avoiding this undesired failure. + +CC: Tyrel Datwyler +CC: Thiago Jung Bauermann +Signed-off-by: Breno Leitao +Reviewed-by: Thiago Jung Bauermann +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/ptrace/core-pkey.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/core-pkey.c b/tools/testing/selftests/powerpc/ptrace/core-pkey.c +index e23e2e199eb4e..d5c64fee032dc 100644 +--- a/tools/testing/selftests/powerpc/ptrace/core-pkey.c ++++ b/tools/testing/selftests/powerpc/ptrace/core-pkey.c +@@ -352,10 +352,7 @@ static int write_core_pattern(const char *core_pattern) + FILE *f; + + f = fopen(core_pattern_file, "w"); +- if (!f) { +- perror("Error writing to core_pattern file"); +- return TEST_FAIL; +- } ++ SKIP_IF_MSG(!f, "Try with root privileges"); + + ret = fwrite(core_pattern, 1, len, f); + fclose(f); +-- +2.20.1 + diff --git a/queue-4.19/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch b/queue-4.19/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch new file mode 100644 index 00000000000..ed520e8fa78 --- /dev/null +++ b/queue-4.19/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch @@ -0,0 +1,160 @@ +From baca376ffcb144b35b956c8181fade7351564c90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:11:04 -0700 +Subject: serial: core: Allow processing sysrq at port unlock time + +From: Douglas Anderson + +[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ] + +Right now serial drivers process sysrq keys deep in their character +receiving code. This means that they've already grabbed their +port->lock spinlock. This can end up getting in the way if we've go +to do serial stuff (especially kgdb) in response to the sysrq. + +Serial drivers have various hacks in them to handle this. Looking at +'8250_port.c' you can see that the console_write() skips locking if +we're in the sysrq handler. Looking at 'msm_serial.c' you can see +that the port lock is dropped around uart_handle_sysrq_char(). + +It turns out that these hacks aren't exactly perfect. If you have +lockdep turned on and use something like the 8250_port hack you'll get +a splat that looks like: + + WARNING: possible circular locking dependency detected + [...] is trying to acquire lock: + ... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4 + + but task is already holding lock: + ... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (&port_lock_key){-.-.}: + _raw_spin_lock_irqsave+0x58/0x70 + serial8250_console_write+0xa8/0x250 + univ8250_console_write+0x40/0x4c + console_unlock+0x528/0x5e4 + register_console+0x2c4/0x3b0 + uart_add_one_port+0x350/0x478 + serial8250_register_8250_port+0x350/0x3a8 + dw8250_probe+0x67c/0x754 + platform_drv_probe+0x58/0xa4 + really_probe+0x150/0x294 + driver_probe_device+0xac/0xe8 + __driver_attach+0x98/0xd0 + bus_for_each_dev+0x84/0xc8 + driver_attach+0x2c/0x34 + bus_add_driver+0xf0/0x1ec + driver_register+0xb4/0x100 + __platform_driver_register+0x60/0x6c + dw8250_platform_driver_init+0x20/0x28 + ... + + -> #0 (console_owner){-.-.}: + lock_acquire+0x1e8/0x214 + console_unlock+0x35c/0x5e4 + vprintk_emit+0x230/0x274 + vprintk_default+0x7c/0x84 + vprintk_func+0x190/0x1bc + printk+0x80/0xa0 + __handle_sysrq+0x104/0x21c + handle_sysrq+0x30/0x3c + serial8250_read_char+0x15c/0x18c + serial8250_rx_chars+0x34/0x74 + serial8250_handle_irq+0x9c/0xe4 + dw8250_handle_irq+0x98/0xcc + serial8250_interrupt+0x50/0xe8 + ... + + other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&port_lock_key); + lock(console_owner); + lock(&port_lock_key); + lock(console_owner); + + *** DEADLOCK *** + +The hack used in 'msm_serial.c' doesn't cause the above splats but it +seems a bit ugly to unlock / lock our spinlock deep in our irq +handler. + +It seems like we could defer processing the sysrq until the end of the +interrupt handler right after we've unlocked the port. With this +scheme if a whole batch of sysrq characters comes in one irq then we +won't handle them all, but that seems like it should be a fine +compromise. + +Signed-off-by: Douglas Anderson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 406edae44ca30..3460b15a26078 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -173,6 +173,7 @@ struct uart_port { + struct console *cons; /* struct console, if any */ + #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ) + unsigned long sysrq; /* sysrq timeout */ ++ unsigned int sysrq_ch; /* char for sysrq */ + #endif + + /* flags must be updated while holding port mutex */ +@@ -482,8 +483,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) + } + return 0; + } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) ++{ ++ if (port->sysrq) { ++ if (ch && time_before(jiffies, port->sysrq)) { ++ port->sysrq_ch = ch; ++ port->sysrq = 0; ++ return 1; ++ } ++ port->sysrq = 0; ++ } ++ return 0; ++} ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ int sysrq_ch; ++ ++ sysrq_ch = port->sysrq_ch; ++ port->sysrq_ch = 0; ++ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++ ++ if (sysrq_ch) ++ handle_sysrq(sysrq_ch); ++} + #else +-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; }) ++static inline int ++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++} + #endif + + /* +-- +2.20.1 + diff --git a/queue-4.19/serial-imx-fix-error-handling-in-console_setup.patch b/queue-4.19/serial-imx-fix-error-handling-in-console_setup.patch new file mode 100644 index 00000000000..f24dc5d8c76 --- /dev/null +++ b/queue-4.19/serial-imx-fix-error-handling-in-console_setup.patch @@ -0,0 +1,40 @@ +From 0fba9f7c984d27ee072a591a7b92312157337127 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:49:38 +0100 +Subject: serial: imx: fix error handling in console_setup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Agner + +[ Upstream commit 63fd4b94b948c14eeb27a3bbf50ea0f7f0593bad ] + +The ipg clock only needs to be unprepared in case preparing +per clock fails. The ipg clock has already disabled at the point. + +Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check") +Signed-off-by: Stefan Agner +Reviewed-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 105de92b0b3bf..989ca7d662f3f 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2071,7 +2071,7 @@ imx_uart_console_setup(struct console *co, char *options) + + retval = clk_prepare(sport->clk_per); + if (retval) +- clk_disable_unprepare(sport->clk_ipg); ++ clk_unprepare(sport->clk_ipg); + + error_console: + return retval; +-- +2.20.1 + diff --git a/queue-4.19/series b/queue-4.19/series index c3885c241f8..587333b62cc 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -8,3 +8,196 @@ tty-serial-msm_serial-fix-flow-control.patch serial-pl011-fix-dma-flush_buffer.patch serial-serial_core-perform-null-checks-for-break_ctl-ops.patch serial-ifx6x60-add-missed-pm_runtime_disable.patch +autofs-fix-a-leak-in-autofs_expire_indirect.patch +rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch +iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch +exportfs_decode_fh-negative-pinned-may-become-positi.patch +audit_get_nd-don-t-unlock-parent-too-early.patch +nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch +xfrm-release-device-reference-for-invalid-state.patch +input-cyttsp4_core-fix-use-after-free-bug.patch +sched-core-avoid-spurious-lock-dependencies.patch +perf-core-consistently-fail-fork-on-allocation-failu.patch +alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch +drm-sun4i-tcon-set-min-division-of-tcon0_dclk-to-1.patch +selftests-kvm-fix-build-with-glibc-2.30.patch +rsxx-add-missed-destroy_workqueue-calls-in-remove.patch +net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch +i2c-core-fix-use-after-free-in-of_i2c_notify.patch +serial-core-allow-processing-sysrq-at-port-unlock-ti.patch +cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch +iwlwifi-mvm-synchronize-tid-queue-removal.patch +iwlwifi-trans-clear-persistence-bit-when-starting-th.patch +iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch +dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch +arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch +audit-embed-key-into-chunk.patch +netfilter-nf_tables-don-t-use-position-attribute-on-.patch +arc-ioc-panic-if-kernel-was-started-with-previously-.patch +net-mlx5-release-resource-on-error-flow.patch +pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch +pinctrl-sh-pfc-r8a7795-fix-vin-versioned-groups.patch +clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch +ice-fix-nvm-mask-defines.patch +dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch +arm-dts-exynos-fix-ldo13-min-values-on-odroid-xu3-xu.patch +extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch +net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch +rtc-s3c-rtc-avoid-using-broken-almyear-register.patch +rtc-max77686-fix-the-returned-value-in-case-of-error.patch +i40e-don-t-restart-nway-if-autoneg-not-supported.patch +virtchnl-fix-off-by-one-error.patch +clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch +clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch +arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch +dlm-fix-missing-idr_destroy-for-recover_idr.patch +mips-sibyte-enable-zone_dma32-for-littlesur.patch +net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch +scsi-zfcp-update-kernel-message-for-invalid-fcp_cmnd.patch +scsi-zfcp-drop-default-switch-case-which-might-paper.patch +drivers-soc-allow-building-the-amlogic-drivers-witho.patch +bus-ti-sysc-fix-getting-optional-clocks-in-clock_rol.patch +arm-dts-imx6-rdu2-fix-egalax-touchscreen-node.patch +crypto-ecc-check-for-invalid-values-in-the-key-verif.patch +crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch +arm64-dts-zynqmp-fix-node-names-which-contain-_.patch +pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch +staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch +firmware-raspberrypi-fix-firmware-calls-with-large-b.patch +mm-vmstat.c-fix-numa-statistics-updates.patch +clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch +clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch +sctp-count-sk_wmem_alloc-by-skb-truesize-in-sctp_pac.patch +regulator-fix-return-value-of-_set_load-stub.patch +usb-serial-f81534-fix-reading-old-new-ic-config.patch +xfs-extent-shifting-doesn-t-fully-invalidate-page-ca.patch +net-next-hinic-fix-a-bug-in-set-mac-address.patch +net-next-hinic-fix-a-bug-in-rx-data-flow.patch +ice-fix-return-value-from-napi-poll.patch +ice-fix-possible-null-pointer-de-reference.patch +iomap-fua-is-wrong-for-dio-o_dsync-writes-into-unwri.patch +iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch +iomap-dio-data-corruption-and-spurious-errors-when-p.patch +iomap-readpages-doesn-t-zero-page-tail-beyond-eof.patch +iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch +mips-octeon-octeon-platform-fix-typing.patch +net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch +math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch +nds32-fix-the-items-of-hwcap_str-ordering-issue.patch +rtc-max8997-fix-the-returned-value-in-case-of-error-.patch +rtc-dt-binding-abx80x-fix-resistance-scale.patch +arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch +media-coda-fix-memory-corruption-in-case-more-than-3.patch +media-pulse8-cec-return-0-when-invalidating-the-logi.patch +media-cec-report-vendor-id-after-initialization.patch +iwlwifi-fix-cfg-structs-for-22000-with-different-rf-.patch +arm64-dts-allwinner-a64-enable-sound-on-pinebook.patch +ravb-clean-up-duplex-handling.patch +net-ipv6-re-do-dad-when-interface-has-iff_noarp-flag.patch +dmaengine-coh901318-fix-a-double-lock-bug.patch +dmaengine-dw-dmac-implement-dma-protection-control-s.patch +net-qualcomm-rmnet-move-null-check-on-dev-before-der.patch +selftests-powerpc-allocate-base-registers.patch +selftests-powerpc-skip-test-instead-of-failing.patch +usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch +usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch +acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch +f2fs-fix-to-account-preflush-command-for-noflush_mer.patch +f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch +f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch +arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch +arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch +f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch +bpf-arm64-fix-getting-subprog-addr-from-aux-for-call.patch +sparc-fix-jit-fused-branch-convergance.patch +sparc-correct-ctx-saw_frame_pointer-logic.patch +nvme-free-ctrl-device-name-on-init-failure.patch +dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch +slimbus-ngd-fix-build-error-on-x86.patch +altera-stapl-check-for-a-null-key-before-strcasecmp-.patch +serial-imx-fix-error-handling-in-console_setup.patch +i2c-imx-don-t-print-error-message-on-probe-defer.patch +clk-meson-fix-gxl-hdmi-pll-fractional-bits-width.patch +gpu-host1x-fix-syncpoint-id-field-size-on-tegra186.patch +lockd-fix-decoding-of-test-results.patch +sctp-increase-sk_wmem_alloc-when-head-truesize-is-in.patch +arm64-dts-qcom-sdm845-mtp-mark-protected-gcc-clocks.patch +iommu-amd-fix-line-break-in-error-log-reporting.patch +asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch +arm-dts-sun4i-fix-gpio-keys-warning.patch +arm-dts-sun4i-fix-hdmi-output-dtc-warning.patch +arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch +arm-dts-r8a779-01-disable-unconnected-lvds-encoders.patch +arm-dts-sun7i-fix-hdmi-output-dtc-warning.patch +arm-dts-sun8i-a23-a33-fix-opp-dtc-warnings.patch +arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch +dlm-null-check-before-kmem_cache_destroy-is-not-need.patch +arm-debug-enable-uart1-for-socfpga-cyclone5.patch +can-xilinx-fix-return-type-of-ndo_start_xmit-functio.patch +nfsd-fix-a-warning-in-__cld_pipe_upcall.patch +bpf-btf-implement-btf_name_valid_identifier.patch +bpf-btf-check-name-validity-for-various-types.patch +tools-bpftool-fix-a-bitfield-pretty-print-issue.patch +scsi-qedi-allocate-irqs-based-on-msix_cnt.patch +asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch +gpio-of-parse-mmc-specific-cd-and-wp-properties.patch +arm-omap1-2-fix-soc-name-printing.patch +arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch +arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch +arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch +arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch +net-x25-fix-called-calling-length-calculation-in-x25.patch +net-x25-fix-null_x25_address-handling.patch +tools-bpf-make-libbpf-_gnu_source-friendly.patch +clk-mediatek-drop-more-__init-markings-for-driver-pr.patch +soc-renesas-r8a77970-sysc-correct-names-of-a2dp-a2cn.patch +soc-renesas-r8a77980-sysc-correct-names-of-a2dp-01-p.patch +soc-renesas-r8a77980-sysc-correct-a3vip-012-power-do.patch +kbuild-disable-dtc-simple_bus_reg-warnings-by-defaul.patch +kbuild-enable-dtc-graph_port-warning-by-default.patch +tcp-make-tcp_space-aware-of-socket-backlog.patch +arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch +arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch +tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch +tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch +tcp-fix-snmp-tcp-timeout-under-estimation.patch +modpost-skip-elf-local-symbols-during-section-mismat.patch +kbuild-fix-single-target-build-for-external-module.patch +mtd-fix-mtd_oobavail-incoherent-returned-value.patch +arm-dts-pxa-clean-up-usb-controller-nodes.patch +clk-meson-meson8b-fix-the-offset-of-vid_pll_dco-s-n-.patch +arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch +clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch +clk-qcom-fix-msm8998-resets.patch +media-cxd2880-spi-fix-probe-when-dvb_attach-fails.patch +arm-dts-realview-fix-some-more-duplicate-regulator-n.patch +dlm-fix-invalid-cluster-name-warning.patch +net-mlx4_core-fix-return-codes-of-unsupported-operat.patch +pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch +powerpc-math-emu-update-macros-from-gcc.patch +clk-renesas-r8a77990-correct-parent-clock-of-du.patch +clk-renesas-r8a77995-correct-parent-clock-of-du.patch +mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch +nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch +media-uvcvideo-abstract-streaming-object-lifetime.patch +tty-serial-qcom_geni_serial-fix-softlock.patch +arm-dts-sun8i-h3-fix-the-system-control-register-ran.patch +tty-don-t-block-on-io-when-ldisc-change-is-pending.patch +media-stkwebcam-bugfix-for-wrong-return-values.patch +firmware-qcom-scm-fix-compilation-error-when-disable.patch +clk-qcom-gcc-msm8998-disable-halt-check-of-ufs-clock.patch +sctp-frag_point-sanity-check.patch +soc-renesas-r8a77990-sysc-fix-initialization-order-o.patch +mlxsw-spectrum_router-relax-gre-decap-matching-check.patch +arm-dts-sun8i-a23-a33-fix-up-rtc-device-node.patch +arm64-dts-allwinner-a64-fix-up-rtc-device-node-and-c.patch +ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch +ib-hfi1-close-vnic-sdma_progress-sleep-window.patch +mlx4-use-snprintf-instead-of-complicated-strcpy.patch +usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch +clk-renesas-rcar-gen3-set-state-when-registering-sd-.patch +asoc-max9867-fix-power-management.patch +arm-dts-sunxi-fix-pmu-compatible-strings.patch +arm-dts-am335x-pdu001-fix-polarity-of-card-detection.patch +media-vimc-fix-start-stream-when-link-is-disabled.patch +net-aquantia-fix-rss-table-and-key-sizes.patch diff --git a/queue-4.19/slimbus-ngd-fix-build-error-on-x86.patch b/queue-4.19/slimbus-ngd-fix-build-error-on-x86.patch new file mode 100644 index 00000000000..9e47f60ec11 --- /dev/null +++ b/queue-4.19/slimbus-ngd-fix-build-error-on-x86.patch @@ -0,0 +1,43 @@ +From aa85b14b2524e79ea86e91884ca9f1aff1f72173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 12:25:25 +0000 +Subject: slimbus: ngd: Fix build error on x86 + +From: Srinivas Kandagatla + +[ Upstream commit 458a445deb9c9fb13cec46fe9b179a84d2ff514f ] + +on non DT platforms like x86 of_match_node is set to NULL, dereferencing +directly would throw an error. +Fix this by doing this in two steps, get the match then the data. + +Reported-by: Greg KH +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index d72f8eed2e8b7..9221ba7b78637 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1326,11 +1326,12 @@ static int of_qcom_slim_ngd_register(struct device *parent, + { + const struct ngd_reg_offset_data *data; + struct qcom_slim_ngd *ngd; ++ const struct of_device_id *match; + struct device_node *node; + u32 id; + +- data = of_match_node(qcom_slim_ngd_dt_match, parent->of_node)->data; +- ++ match = of_match_node(qcom_slim_ngd_dt_match, parent->of_node); ++ data = match->data; + for_each_available_child_of_node(parent->of_node, node) { + if (of_property_read_u32(node, "reg", &id)) + continue; +-- +2.20.1 + diff --git a/queue-4.19/soc-renesas-r8a77970-sysc-correct-names-of-a2dp-a2cn.patch b/queue-4.19/soc-renesas-r8a77970-sysc-correct-names-of-a2dp-a2cn.patch new file mode 100644 index 00000000000..92761be7aad --- /dev/null +++ b/queue-4.19/soc-renesas-r8a77970-sysc-correct-names-of-a2dp-a2cn.patch @@ -0,0 +1,63 @@ +From 4a7fac1ebd743609182b4011c7084f9cbd26d001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 11:56:16 +0100 +Subject: soc: renesas: r8a77970-sysc: Correct names of A2DP/A2CN power domains + +From: Geert Uytterhoeven + +[ Upstream commit b5eb730e031acaba2d25e8f522ac5966a70885ae ] + +The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018) +renamed the A2IR2 and A2IR3 power domains on R-Car V3M to A2DP resp. +A2CN. + +As these definitions are not yet used from DT, they can just be renamed. + +While at it, fix the indentation of the A3IR definition. + +Fixes: 833bdb47c826a1a6 ("dt-bindings: power: add R8A77970 SYSC power domain definitions") +Fixes: bab9b2a74fe9da96 ("soc: renesas: rcar-sysc: add R8A77970 support") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/r8a77970-sysc.c | 4 ++-- + include/dt-bindings/power/r8a77970-sysc.h | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/soc/renesas/r8a77970-sysc.c b/drivers/soc/renesas/r8a77970-sysc.c +index caf894f193edc..77422baa7a56a 100644 +--- a/drivers/soc/renesas/r8a77970-sysc.c ++++ b/drivers/soc/renesas/r8a77970-sysc.c +@@ -27,8 +27,8 @@ static const struct rcar_sysc_area r8a77970_areas[] __initconst = { + { "a3ir", 0x180, 0, R8A77970_PD_A3IR, R8A77970_PD_ALWAYS_ON }, + { "a2ir0", 0x400, 0, R8A77970_PD_A2IR0, R8A77970_PD_A3IR }, + { "a2ir1", 0x400, 1, R8A77970_PD_A2IR1, R8A77970_PD_A3IR }, +- { "a2ir2", 0x400, 2, R8A77970_PD_A2IR2, R8A77970_PD_A3IR }, +- { "a2ir3", 0x400, 3, R8A77970_PD_A2IR3, R8A77970_PD_A3IR }, ++ { "a2dp", 0x400, 2, R8A77970_PD_A2DP, R8A77970_PD_A3IR }, ++ { "a2cn", 0x400, 3, R8A77970_PD_A2CN, R8A77970_PD_A3IR }, + { "a2sc0", 0x400, 4, R8A77970_PD_A2SC0, R8A77970_PD_A3IR }, + { "a2sc1", 0x400, 5, R8A77970_PD_A2SC1, R8A77970_PD_A3IR }, + }; +diff --git a/include/dt-bindings/power/r8a77970-sysc.h b/include/dt-bindings/power/r8a77970-sysc.h +index bf54779d16252..9eaf824b15826 100644 +--- a/include/dt-bindings/power/r8a77970-sysc.h ++++ b/include/dt-bindings/power/r8a77970-sysc.h +@@ -19,10 +19,10 @@ + #define R8A77970_PD_CR7 13 + #define R8A77970_PD_CA53_SCU 21 + #define R8A77970_PD_A2IR0 23 +-#define R8A77970_PD_A3IR 24 ++#define R8A77970_PD_A3IR 24 + #define R8A77970_PD_A2IR1 27 +-#define R8A77970_PD_A2IR2 28 +-#define R8A77970_PD_A2IR3 29 ++#define R8A77970_PD_A2DP 28 ++#define R8A77970_PD_A2CN 29 + #define R8A77970_PD_A2SC0 30 + #define R8A77970_PD_A2SC1 31 + +-- +2.20.1 + diff --git a/queue-4.19/soc-renesas-r8a77980-sysc-correct-a3vip-012-power-do.patch b/queue-4.19/soc-renesas-r8a77980-sysc-correct-a3vip-012-power-do.patch new file mode 100644 index 00000000000..c3add0f542f --- /dev/null +++ b/queue-4.19/soc-renesas-r8a77980-sysc-correct-a3vip-012-power-do.patch @@ -0,0 +1,60 @@ +From 933317dbc60ef5e1dd9bc2ec94557c88626cb375 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 11:56:18 +0100 +Subject: soc: renesas: r8a77980-sysc: Correct A3VIP[012] power domain + hierarchy + +From: Geert Uytterhoeven + +[ Upstream commit 160bfa7c724b348a90a12dd9694f351927a15b8e ] + +The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018) +renamed the A3VIP power domain on R-Car V3H to A3VIP0, and clarified the +power domain hierarchy for the A3VIP[012] power domains. + +As the definition for the A3VIP0 domain is not yet used from DT, it can +just be renamed. + +Fixes: 7755b40d07a8dba7 ("dt-bindings: power: add R8A77980 SYSC power domain definitions") +Fixes: 41d6d8bd8ae94ca9 ("soc: renesas: rcar-sysc: add R8A77980 support") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/r8a77980-sysc.c | 6 +++--- + include/dt-bindings/power/r8a77980-sysc.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c +index dbb2621ce4e3e..a8dbe55e8ba82 100644 +--- a/drivers/soc/renesas/r8a77980-sysc.c ++++ b/drivers/soc/renesas/r8a77980-sysc.c +@@ -41,9 +41,9 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = { + { "a2dp0", 0x400, 11, R8A77980_PD_A2DP0, R8A77980_PD_A3IR }, + { "a2dp1", 0x400, 12, R8A77980_PD_A2DP1, R8A77980_PD_A3IR }, + { "a2cn", 0x400, 13, R8A77980_PD_A2CN, R8A77980_PD_A3IR }, +- { "a3vip", 0x2c0, 0, R8A77980_PD_A3VIP, R8A77980_PD_ALWAYS_ON }, +- { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_A3VIP }, +- { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_A3VIP }, ++ { "a3vip0", 0x2c0, 0, R8A77980_PD_A3VIP0, R8A77980_PD_ALWAYS_ON }, ++ { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_ALWAYS_ON }, ++ { "a3vip2", 0x280, 0, R8A77980_PD_A3VIP2, R8A77980_PD_ALWAYS_ON }, + }; + + const struct rcar_sysc_info r8a77980_sysc_info __initconst = { +diff --git a/include/dt-bindings/power/r8a77980-sysc.h b/include/dt-bindings/power/r8a77980-sysc.h +index 7bebe7e8dbdbb..e12c8587b87ec 100644 +--- a/include/dt-bindings/power/r8a77980-sysc.h ++++ b/include/dt-bindings/power/r8a77980-sysc.h +@@ -22,7 +22,7 @@ + #define R8A77980_PD_CA53_CPU2 7 + #define R8A77980_PD_CA53_CPU3 8 + #define R8A77980_PD_A2CN 10 +-#define R8A77980_PD_A3VIP 11 ++#define R8A77980_PD_A3VIP0 11 + #define R8A77980_PD_A2IR5 12 + #define R8A77980_PD_CR7 13 + #define R8A77980_PD_A2IR4 15 +-- +2.20.1 + diff --git a/queue-4.19/soc-renesas-r8a77980-sysc-correct-names-of-a2dp-01-p.patch b/queue-4.19/soc-renesas-r8a77980-sysc-correct-names-of-a2dp-01-p.patch new file mode 100644 index 00000000000..39c88da913b --- /dev/null +++ b/queue-4.19/soc-renesas-r8a77980-sysc-correct-names-of-a2dp-01-p.patch @@ -0,0 +1,58 @@ +From 325907c80a4b2c2350dbbc4070c70637327e1173 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 11:56:17 +0100 +Subject: soc: renesas: r8a77980-sysc: Correct names of A2DP[01] power domains + +From: Geert Uytterhoeven + +[ Upstream commit 97473bc85b22ac610b1810b6a9a4669a6cb0b7b0 ] + +The R-Car Gen3 HardWare Manual Errata for Rev. 0.80 (Feb 28, 2018) +renamed the A2PD0 and A2DP0 power domains on R-Car V3H to A2DP0 resp. +A2DP1. + +As these definitions are not yet used from DT, they can just be renamed. + +Fixes: 7755b40d07a8dba7 ("dt-bindings: power: add R8A77980 SYSC power domain definitions") +Fixes: 41d6d8bd8ae94ca9 ("soc: renesas: rcar-sysc: add R8A77980 support") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/r8a77980-sysc.c | 4 ++-- + include/dt-bindings/power/r8a77980-sysc.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/renesas/r8a77980-sysc.c b/drivers/soc/renesas/r8a77980-sysc.c +index 9265fb525ef34..dbb2621ce4e3e 100644 +--- a/drivers/soc/renesas/r8a77980-sysc.c ++++ b/drivers/soc/renesas/r8a77980-sysc.c +@@ -38,8 +38,8 @@ static const struct rcar_sysc_area r8a77980_areas[] __initconst = { + { "a2sc2", 0x400, 8, R8A77980_PD_A2SC2, R8A77980_PD_A3IR }, + { "a2sc3", 0x400, 9, R8A77980_PD_A2SC3, R8A77980_PD_A3IR }, + { "a2sc4", 0x400, 10, R8A77980_PD_A2SC4, R8A77980_PD_A3IR }, +- { "a2pd0", 0x400, 11, R8A77980_PD_A2PD0, R8A77980_PD_A3IR }, +- { "a2pd1", 0x400, 12, R8A77980_PD_A2PD1, R8A77980_PD_A3IR }, ++ { "a2dp0", 0x400, 11, R8A77980_PD_A2DP0, R8A77980_PD_A3IR }, ++ { "a2dp1", 0x400, 12, R8A77980_PD_A2DP1, R8A77980_PD_A3IR }, + { "a2cn", 0x400, 13, R8A77980_PD_A2CN, R8A77980_PD_A3IR }, + { "a3vip", 0x2c0, 0, R8A77980_PD_A3VIP, R8A77980_PD_ALWAYS_ON }, + { "a3vip1", 0x300, 0, R8A77980_PD_A3VIP1, R8A77980_PD_A3VIP }, +diff --git a/include/dt-bindings/power/r8a77980-sysc.h b/include/dt-bindings/power/r8a77980-sysc.h +index 2c90c12377253..7bebe7e8dbdbb 100644 +--- a/include/dt-bindings/power/r8a77980-sysc.h ++++ b/include/dt-bindings/power/r8a77980-sysc.h +@@ -15,8 +15,8 @@ + #define R8A77980_PD_A2SC2 0 + #define R8A77980_PD_A2SC3 1 + #define R8A77980_PD_A2SC4 2 +-#define R8A77980_PD_A2PD0 3 +-#define R8A77980_PD_A2PD1 4 ++#define R8A77980_PD_A2DP0 3 ++#define R8A77980_PD_A2DP1 4 + #define R8A77980_PD_CA53_CPU0 5 + #define R8A77980_PD_CA53_CPU1 6 + #define R8A77980_PD_CA53_CPU2 7 +-- +2.20.1 + diff --git a/queue-4.19/soc-renesas-r8a77990-sysc-fix-initialization-order-o.patch b/queue-4.19/soc-renesas-r8a77990-sysc-fix-initialization-order-o.patch new file mode 100644 index 00000000000..a3b1e6dd398 --- /dev/null +++ b/queue-4.19/soc-renesas-r8a77990-sysc-fix-initialization-order-o.patch @@ -0,0 +1,69 @@ +From af5078c5c96e7a45beade6ab45c19f94fc985b9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 16:39:42 +0100 +Subject: soc: renesas: r8a77990-sysc: Fix initialization order of 3DG-{A,B} + +From: Geert Uytterhoeven + +[ Upstream commit b0d7fbf8b174168c580bb310964c3c809e5569a9 ] + +The workaround for the wrong hierarchy of the 3DG-{A,B} power +domains on R-Car E3 ES1.0 corrected the parent domains. +However, the 3DG-{A,B} power domains were still initialized and powered +in the wrong order, causing 3DG operation to fail. + +Fix this by changing the order in the table at runtime, when running on +an affected SoC. + +Fixes: 086b399965a7ee7e ("soc: renesas: r8a77990-sysc: Add workaround for 3DG-{A,B}") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/r8a77990-sysc.c | 23 ++++------------------- + 1 file changed, 4 insertions(+), 19 deletions(-) + +diff --git a/drivers/soc/renesas/r8a77990-sysc.c b/drivers/soc/renesas/r8a77990-sysc.c +index 15579ebc5ed20..664b244eb1dd9 100644 +--- a/drivers/soc/renesas/r8a77990-sysc.c ++++ b/drivers/soc/renesas/r8a77990-sysc.c +@@ -28,19 +28,6 @@ static struct rcar_sysc_area r8a77990_areas[] __initdata = { + { "3dg-b", 0x100, 1, R8A77990_PD_3DG_B, R8A77990_PD_3DG_A }, + }; + +-static void __init rcar_sysc_fix_parent(struct rcar_sysc_area *areas, +- unsigned int num_areas, u8 id, +- int new_parent) +-{ +- unsigned int i; +- +- for (i = 0; i < num_areas; i++) +- if (areas[i].isr_bit == id) { +- areas[i].parent = new_parent; +- return; +- } +-} +- + /* Fixups for R-Car E3 ES1.0 revision */ + static const struct soc_device_attribute r8a77990[] __initconst = { + { .soc_id = "r8a77990", .revision = "ES1.0" }, +@@ -50,12 +37,10 @@ static const struct soc_device_attribute r8a77990[] __initconst = { + static int __init r8a77990_sysc_init(void) + { + if (soc_device_match(r8a77990)) { +- rcar_sysc_fix_parent(r8a77990_areas, +- ARRAY_SIZE(r8a77990_areas), +- R8A77990_PD_3DG_A, R8A77990_PD_3DG_B); +- rcar_sysc_fix_parent(r8a77990_areas, +- ARRAY_SIZE(r8a77990_areas), +- R8A77990_PD_3DG_B, R8A77990_PD_ALWAYS_ON); ++ /* Fix incorrect 3DG hierarchy */ ++ swap(r8a77990_areas[7], r8a77990_areas[8]); ++ r8a77990_areas[7].parent = R8A77990_PD_ALWAYS_ON; ++ r8a77990_areas[8].parent = R8A77990_PD_3DG_B; + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.19/sparc-correct-ctx-saw_frame_pointer-logic.patch b/queue-4.19/sparc-correct-ctx-saw_frame_pointer-logic.patch new file mode 100644 index 00000000000..7c56e97a261 --- /dev/null +++ b/queue-4.19/sparc-correct-ctx-saw_frame_pointer-logic.patch @@ -0,0 +1,70 @@ +From 3b0f977d42379ab3f66bfe85710f3519ef0450dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 14:52:18 -0800 +Subject: sparc: Correct ctx->saw_frame_pointer logic. + +From: David Miller + +[ Upstream commit e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b ] + +We need to initialize the frame pointer register not just if it is +seen as a source operand, but also if it is seen as the destination +operand of a store or an atomic instruction (which effectively is a +source operand). + +This is exercised by test_verifier's "non-invalid fp arithmetic" + +Signed-off-by: David S. Miller +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/sparc/net/bpf_jit_comp_64.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index 7217d63596431..ec4da4dc98f12 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1270,6 +1270,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_2_used = true; + emit_loadimm(imm, tmp2, ctx); + +@@ -1308,6 +1311,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp = bpf2sparc[TMP_REG_1]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + switch (BPF_SIZE(code)) { + case BPF_W: + opcode = ST32; +@@ -1340,6 +1346,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +@@ -1360,6 +1369,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +-- +2.20.1 + diff --git a/queue-4.19/sparc-fix-jit-fused-branch-convergance.patch b/queue-4.19/sparc-fix-jit-fused-branch-convergance.patch new file mode 100644 index 00000000000..aeed5e24fc5 --- /dev/null +++ b/queue-4.19/sparc-fix-jit-fused-branch-convergance.patch @@ -0,0 +1,173 @@ +From 16b0dfb086f7808ffc8fda9a77141ff822a2b73d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 13:03:46 -0800 +Subject: sparc: Fix JIT fused branch convergance. + +From: David Miller + +[ Upstream commit c44768a33da81b4a0986e79bbf0588f1a0651dec ] + +On T4 and later sparc64 cpus we can use the fused compare and branch +instruction. + +However, it can only be used if the branch destination is in the range +of a signed 10-bit immediate offset. This amounts to 1024 +instructions forwards or backwards. + +After the commit referenced in the Fixes: tag, the largest possible +size program seen by the JIT explodes by a significant factor. + +As a result of this convergance takes many more passes since the +expanded "BPF_LDX | BPF_MSH | BPF_B" code sequence, for example, +contains several embedded branch on condition instructions. + +On each pass, as suddenly new fused compare and branch instances +become valid, this makes thousands more in range for the next pass. +And so on and so forth. + +This is most greatly exemplified by "BPF_MAXINSNS: exec all MSH" which +takes 35 passes to converge, and shrinks the image by about 64K. + +To decrease the cost of this number of convergance passes, do the +convergance pass before we have the program image allocated, just like +other JITs (such as x86) do. + +Fixes: e0cea7ce988c ("bpf: implement ld_abs/ld_ind in native bpf") +Signed-off-by: David S. Miller +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/sparc/net/bpf_jit_comp_64.c | 77 ++++++++++++++++++++------------ + 1 file changed, 49 insertions(+), 28 deletions(-) + +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index 222785af550b4..7217d63596431 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1425,12 +1425,12 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + struct bpf_prog *tmp, *orig_prog = prog; + struct sparc64_jit_data *jit_data; + struct bpf_binary_header *header; ++ u32 prev_image_size, image_size; + bool tmp_blinded = false; + bool extra_pass = false; + struct jit_ctx ctx; +- u32 image_size; + u8 *image_ptr; +- int pass; ++ int pass, i; + + if (!prog->jit_requested) + return orig_prog; +@@ -1461,61 +1461,82 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + header = jit_data->header; + extra_pass = true; + image_size = sizeof(u32) * ctx.idx; ++ prev_image_size = image_size; ++ pass = 1; + goto skip_init_ctx; + } + + memset(&ctx, 0, sizeof(ctx)); + ctx.prog = prog; + +- ctx.offset = kcalloc(prog->len, sizeof(unsigned int), GFP_KERNEL); ++ ctx.offset = kmalloc_array(prog->len, sizeof(unsigned int), GFP_KERNEL); + if (ctx.offset == NULL) { + prog = orig_prog; + goto out_off; + } + +- /* Fake pass to detect features used, and get an accurate assessment +- * of what the final image size will be. ++ /* Longest sequence emitted is for bswap32, 12 instructions. Pre-cook ++ * the offset array so that we converge faster. + */ +- if (build_body(&ctx)) { +- prog = orig_prog; +- goto out_off; +- } +- build_prologue(&ctx); +- build_epilogue(&ctx); ++ for (i = 0; i < prog->len; i++) ++ ctx.offset[i] = i * (12 * 4); + +- /* Now we know the actual image size. */ +- image_size = sizeof(u32) * ctx.idx; +- header = bpf_jit_binary_alloc(image_size, &image_ptr, +- sizeof(u32), jit_fill_hole); +- if (header == NULL) { +- prog = orig_prog; +- goto out_off; +- } +- +- ctx.image = (u32 *)image_ptr; +-skip_init_ctx: +- for (pass = 1; pass < 3; pass++) { ++ prev_image_size = ~0U; ++ for (pass = 1; pass < 40; pass++) { + ctx.idx = 0; + + build_prologue(&ctx); +- + if (build_body(&ctx)) { +- bpf_jit_binary_free(header); + prog = orig_prog; + goto out_off; + } +- + build_epilogue(&ctx); + + if (bpf_jit_enable > 1) +- pr_info("Pass %d: shrink = %d, seen = [%c%c%c%c%c%c]\n", pass, +- image_size - (ctx.idx * 4), ++ pr_info("Pass %d: size = %u, seen = [%c%c%c%c%c%c]\n", pass, ++ ctx.idx * 4, + ctx.tmp_1_used ? '1' : ' ', + ctx.tmp_2_used ? '2' : ' ', + ctx.tmp_3_used ? '3' : ' ', + ctx.saw_frame_pointer ? 'F' : ' ', + ctx.saw_call ? 'C' : ' ', + ctx.saw_tail_call ? 'T' : ' '); ++ ++ if (ctx.idx * 4 == prev_image_size) ++ break; ++ prev_image_size = ctx.idx * 4; ++ cond_resched(); ++ } ++ ++ /* Now we know the actual image size. */ ++ image_size = sizeof(u32) * ctx.idx; ++ header = bpf_jit_binary_alloc(image_size, &image_ptr, ++ sizeof(u32), jit_fill_hole); ++ if (header == NULL) { ++ prog = orig_prog; ++ goto out_off; ++ } ++ ++ ctx.image = (u32 *)image_ptr; ++skip_init_ctx: ++ ctx.idx = 0; ++ ++ build_prologue(&ctx); ++ ++ if (build_body(&ctx)) { ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_off; ++ } ++ ++ build_epilogue(&ctx); ++ ++ if (ctx.idx * 4 != prev_image_size) { ++ pr_err("bpf_jit: Failed to converge, prev_size=%u size=%d\n", ++ prev_image_size, ctx.idx * 4); ++ bpf_jit_binary_free(header); ++ prog = orig_prog; ++ goto out_off; + } + + if (bpf_jit_enable > 1) +-- +2.20.1 + diff --git a/queue-4.19/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch b/queue-4.19/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch new file mode 100644 index 00000000000..cd1ad5a2a41 --- /dev/null +++ b/queue-4.19/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch @@ -0,0 +1,39 @@ +From d38e6028da8d578c3a5a1ed35a13f6407da2b9cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Nov 2018 04:19:07 +0530 +Subject: Staging: iio: adt7316: Fix i2c data reading, set the data field + +From: Shreeya Patel + +[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ] + +adt7316_i2c_read function nowhere sets the data field. +It is necessary to have an appropriate value for it. +Hence, assign the value stored in 'ret' variable to data field. + +This is an ancient bug, and as no one seems to have noticed, +probably no sense in applying it to stable. + +Signed-off-by: Shreeya Patel +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/staging/iio/addac/adt7316-i2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c +index f66dd3ebbab1f..856bcfa60c6c4 100644 +--- a/drivers/staging/iio/addac/adt7316-i2c.c ++++ b/drivers/staging/iio/addac/adt7316-i2c.c +@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data) + return ret; + } + ++ *data = ret; ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.19/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch b/queue-4.19/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch new file mode 100644 index 00000000000..f3e479c7e4b --- /dev/null +++ b/queue-4.19/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch @@ -0,0 +1,38 @@ +From 119f092d794527f144ab181f7117cae7313d6d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:43 -0800 +Subject: tcp: fix off-by-one bug on aborting window-probing socket + +From: Yuchung Cheng + +[ Upstream commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 ] + +Previously there is an off-by-one bug on determining when to abort +a stalled window-probing socket. This patch fixes that so it is +consistent with tcp_write_timeout(). + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index c719a41d2eba2..50b15e1c633b4 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -378,7 +378,7 @@ static void tcp_probe_timer(struct sock *sk) + return; + } + +- if (icsk->icsk_probes_out > max_probes) { ++ if (icsk->icsk_probes_out >= max_probes) { + abort: tcp_write_err(sk); + } else { + /* Only send another probe if we didn't close things up. */ +-- +2.20.1 + diff --git a/queue-4.19/tcp-fix-snmp-tcp-timeout-under-estimation.patch b/queue-4.19/tcp-fix-snmp-tcp-timeout-under-estimation.patch new file mode 100644 index 00000000000..e0d2f6aab21 --- /dev/null +++ b/queue-4.19/tcp-fix-snmp-tcp-timeout-under-estimation.patch @@ -0,0 +1,62 @@ +From 8729908c46864c5f0fc9ab0edcc0ca45cf45e3b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:45 -0800 +Subject: tcp: fix SNMP TCP timeout under-estimation + +From: Yuchung Cheng + +[ Upstream commit e1561fe2dd69dc5dddd69bd73aa65355bdfb048b ] + +Previously the SNMP TCPTIMEOUTS counter has inconsistent accounting: +1. It counts all SYN and SYN-ACK timeouts +2. It counts timeouts in other states except recurring timeouts and + timeouts after fast recovery or disorder state. + +Such selective accounting makes analysis difficult and complicated. For +example the monitoring system needs to collect many other SNMP counters +to infer the total amount of timeout events. This patch makes TCPTIMEOUTS +counter simply counts all the retransmit timeout (SYN or data or FIN). + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 50b15e1c633b4..681882a409686 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -482,11 +482,12 @@ void tcp_retransmit_timer(struct sock *sk) + goto out_reset_timer; + } + ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS); + if (tcp_write_timeout(sk)) + goto out; + + if (icsk->icsk_retransmits == 0) { +- int mib_idx; ++ int mib_idx = 0; + + if (icsk->icsk_ca_state == TCP_CA_Recovery) { + if (tcp_is_sack(tp)) +@@ -501,10 +502,9 @@ void tcp_retransmit_timer(struct sock *sk) + mib_idx = LINUX_MIB_TCPSACKFAILURES; + else + mib_idx = LINUX_MIB_TCPRENOFAILURES; +- } else { +- mib_idx = LINUX_MIB_TCPTIMEOUTS; + } +- __NET_INC_STATS(sock_net(sk), mib_idx); ++ if (mib_idx) ++ __NET_INC_STATS(sock_net(sk), mib_idx); + } + + tcp_enter_loss(sk); +-- +2.20.1 + diff --git a/queue-4.19/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch b/queue-4.19/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch new file mode 100644 index 00000000000..f8581e521c2 --- /dev/null +++ b/queue-4.19/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch @@ -0,0 +1,37 @@ +From bcdaa263a36678b6f27bd42b62f40d403cca9395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:44 -0800 +Subject: tcp: fix SNMP under-estimation on failed retransmission + +From: Yuchung Cheng + +[ Upstream commit ec641b39457e17774313b66697a8a1dc070257bd ] + +Previously the SNMP counter LINUX_MIB_TCPRETRANSFAIL is not counting +the TSO/GSO properly on failed retransmission. This patch fixes that. + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 53f910bb55087..8971cc15d278b 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2919,7 +2919,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS; + trace_tcp_retransmit_skb(sk, skb); + } else if (err != -EBUSY) { +- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL); ++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs); + } + return err; + } +-- +2.20.1 + diff --git a/queue-4.19/tcp-make-tcp_space-aware-of-socket-backlog.patch b/queue-4.19/tcp-make-tcp_space-aware-of-socket-backlog.patch new file mode 100644 index 00000000000..edd03351ece --- /dev/null +++ b/queue-4.19/tcp-make-tcp_space-aware-of-socket-backlog.patch @@ -0,0 +1,50 @@ +From c49305c5b845dec79ca6a4010a0866ca07842026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 14:42:02 -0800 +Subject: tcp: make tcp_space() aware of socket backlog + +From: Eric Dumazet + +[ Upstream commit 85bdf7db5b53cdcc7a901db12bcb3d0063e3866d ] + +Jean-Louis Dupond reported poor iscsi TCP receive performance +that we tracked to backlog drops. + +Apparently we fail to send window updates reflecting the +fact that we are under stress. + +Note that we might lack a proper window increase when +backlog is fully processed, since __release_sock() clears +sk->sk_backlog.len _after_ all skbs have been processed. + +This should not matter in practice. If we had a significant +load through socket backlog, we are in a dangerous +situation. + +Reported-by: Jean-Louis Dupond +Signed-off-by: Eric Dumazet +Acked-by: Neal Cardwell +Acked-by: Yuchung Cheng +Tested-by: Jean-Louis Dupond +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index abcf53a6db045..3f4223a550d92 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1353,7 +1353,7 @@ static inline int tcp_win_from_space(const struct sock *sk, int space) + /* Note: caller must be prepared to deal with negative returns */ + static inline int tcp_space(const struct sock *sk) + { +- return tcp_win_from_space(sk, sk->sk_rcvbuf - ++ return tcp_win_from_space(sk, sk->sk_rcvbuf - sk->sk_backlog.len - + atomic_read(&sk->sk_rmem_alloc)); + } + +-- +2.20.1 + diff --git a/queue-4.19/tools-bpf-make-libbpf-_gnu_source-friendly.patch b/queue-4.19/tools-bpf-make-libbpf-_gnu_source-friendly.patch new file mode 100644 index 00000000000..6d4956405cd --- /dev/null +++ b/queue-4.19/tools-bpf-make-libbpf-_gnu_source-friendly.patch @@ -0,0 +1,69 @@ +From 4aee2528a413d35015e65333818229898493b329 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 15:31:45 -0800 +Subject: tools/bpf: make libbpf _GNU_SOURCE friendly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Yonghong Song + +[ Upstream commit b42699547fc9fb1057795bccc21a6445743a7fde ] + +During porting libbpf to bcc, I got some warnings like below: + ... + [ 2%] Building C object src/cc/CMakeFiles/bpf-shared.dir/libbpf/src/libbpf.c.o + /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf.c:12:0: + warning: "_GNU_SOURCE" redefined [enabled by default] + #define _GNU_SOURCE + ... + [ 3%] Building C object src/cc/CMakeFiles/bpf-shared.dir/libbpf/src/libbpf_errno.c.o + /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf_errno.c: In function ‘libbpf_strerror’: + /home/yhs/work/bcc2/src/cc/libbpf/src/libbpf_errno.c:45:7: + warning: assignment makes integer from pointer without a cast [enabled by default] + ret = strerror_r(err, buf, size); + ... + +bcc is built with _GNU_SOURCE defined and this caused the above warning. +This patch intends to make libpf _GNU_SOURCE friendly by + . define _GNU_SOURCE in libbpf.c unless it is not defined + . undefine _GNU_SOURCE as non-gnu version of strerror_r is expected. + +Signed-off-by: Yonghong Song +Acked-by: Jakub Kicinski +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 2 ++ + tools/lib/bpf/libbpf_errno.c | 1 + + 2 files changed, 3 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index a350f97e3a1a4..a62be78fc07b1 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -22,7 +22,9 @@ + * License along with this program; if not, see + */ + ++#ifndef _GNU_SOURCE + #define _GNU_SOURCE ++#endif + #include + #include + #include +diff --git a/tools/lib/bpf/libbpf_errno.c b/tools/lib/bpf/libbpf_errno.c +index d9ba851bd7f9f..d2d17226d9d6b 100644 +--- a/tools/lib/bpf/libbpf_errno.c ++++ b/tools/lib/bpf/libbpf_errno.c +@@ -20,6 +20,7 @@ + * License along with this program; if not, see + */ + ++#undef _GNU_SOURCE + #include + #include + +-- +2.20.1 + diff --git a/queue-4.19/tools-bpftool-fix-a-bitfield-pretty-print-issue.patch b/queue-4.19/tools-bpftool-fix-a-bitfield-pretty-print-issue.patch new file mode 100644 index 00000000000..a6010b3bb2c --- /dev/null +++ b/queue-4.19/tools-bpftool-fix-a-bitfield-pretty-print-issue.patch @@ -0,0 +1,102 @@ +From 2652bd56bc9e07f3e4b9265787f7e2a6375f1bf6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 09:38:23 -0800 +Subject: tools: bpftool: fix a bitfield pretty print issue + +From: Yonghong Song + +[ Upstream commit 528bff0cdb6649f97f2c4802e4ac7a4b50645f2f ] + +Commit b12d6ec09730 ("bpf: btf: add btf print functionality") +added btf pretty print functionality to bpftool. +There is a problem though in printing a bitfield whose type +has modifiers. + +For example, for a type like + typedef int ___int; + struct tmp_t { + int a:3; + ___int b:3; + }; +Suppose we have a map + struct bpf_map_def SEC("maps") tmpmap = { + .type = BPF_MAP_TYPE_HASH, + .key_size = sizeof(__u32), + .value_size = sizeof(struct tmp_t), + .max_entries = 1, + }; +and the hash table is populated with one element with +key 0 and value (.a = 1 and .b = 2). + +In BTF, the struct member "b" will have a type "typedef" which +points to an int type. The current implementation does not +pass the bit offset during transition from typedef to int type, +hence incorrectly print the value as + $ bpftool m d id 79 + [{ + "key": 0, + "value": { + "a": 0x1, + "b": 0x1 + } + } + ] + +This patch fixed the issue by carrying bit_offset along the type +chain during bit_field print. The correct result can be printed as + $ bpftool m d id 76 + [{ + "key": 0, + "value": { + "a": 0x1, + "b": 0x2 + } + } + ] + +The kernel pretty print is implemented correctly and does not +have this issue. + +Fixes: b12d6ec09730 ("bpf: btf: add btf print functionality") +Signed-off-by: Yonghong Song +Acked-by: Song Liu +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/btf_dumper.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/bpf/bpftool/btf_dumper.c b/tools/bpf/bpftool/btf_dumper.c +index 55bc512a18318..e4e6e2b3fd847 100644 +--- a/tools/bpf/bpftool/btf_dumper.c ++++ b/tools/bpf/bpftool/btf_dumper.c +@@ -32,7 +32,7 @@ static void btf_dumper_ptr(const void *data, json_writer_t *jw, + } + + static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id, +- const void *data) ++ __u8 bit_offset, const void *data) + { + int actual_type_id; + +@@ -40,7 +40,7 @@ static int btf_dumper_modifier(const struct btf_dumper *d, __u32 type_id, + if (actual_type_id < 0) + return actual_type_id; + +- return btf_dumper_do_type(d, actual_type_id, 0, data); ++ return btf_dumper_do_type(d, actual_type_id, bit_offset, data); + } + + static void btf_dumper_enum(const void *data, json_writer_t *jw) +@@ -237,7 +237,7 @@ static int btf_dumper_do_type(const struct btf_dumper *d, __u32 type_id, + case BTF_KIND_VOLATILE: + case BTF_KIND_CONST: + case BTF_KIND_RESTRICT: +- return btf_dumper_modifier(d, type_id, data); ++ return btf_dumper_modifier(d, type_id, bit_offset, data); + default: + jsonw_printf(d->jw, "(unsupported-kind"); + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.19/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch b/queue-4.19/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch new file mode 100644 index 00000000000..6c3f1a438b7 --- /dev/null +++ b/queue-4.19/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch @@ -0,0 +1,161 @@ +From 6ee5c0a9837c1100ea2b426dae243f56fe8636a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Nov 2018 00:24:48 +0000 +Subject: tty: Don't block on IO when ldisc change is pending + +From: Dmitry Safonov + +[ Upstream commit c96cf923a98d1b094df9f0cf97a83e118817e31b ] + +There might be situations where tty_ldisc_lock() has blocked, but there +is already IO on tty and it prevents line discipline changes. +It might theoretically turn into dead-lock. + +Basically, provide more priority to pending tty_ldisc_lock() than to +servicing reads/writes over tty. + +User-visible issue was reported by Mikulas where on pa-risc with +Debian 5 reboot took either 80 seconds, 3 minutes or 3:25 after proper +locking in tty_reopen(). + +Cc: Jiri Slaby +Reported-by: Mikulas Patocka +Signed-off-by: Dmitry Safonov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_hdlc.c | 4 ++-- + drivers/tty/n_r3964.c | 2 +- + drivers/tty/n_tty.c | 8 ++++---- + drivers/tty/tty_ldisc.c | 7 +++++++ + include/linux/tty.h | 7 +++++++ + 5 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index c943716c019e4..0636e10c76c7f 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -613,7 +613,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, + } + + /* no data */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + break; + } +@@ -680,7 +680,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file, + if (tbuf) + break; + +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + error = -EAGAIN; + break; + } +diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c +index dbf1ab36758eb..a3969b773cbe4 100644 +--- a/drivers/tty/n_r3964.c ++++ b/drivers/tty/n_r3964.c +@@ -1078,7 +1078,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file, + pMsg = remove_msg(pInfo, pClient); + if (pMsg == NULL) { + /* no messages available. */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + goto unlock; + } +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 3ad460219fd62..5dc9686697cfa 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1702,7 +1702,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + + down_read(&tty->termios_rwsem); + +- while (1) { ++ do { + /* + * When PARMRK is set, each input char may take up to 3 chars + * in the read buf; reduce the buffer space avail by 3x +@@ -1744,7 +1744,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + fp += n; + count -= n; + rcvd += n; +- } ++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags)); + + tty->receive_room = room; + +@@ -2211,7 +2211,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + break; + if (!timeout) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +@@ -2365,7 +2365,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, + } + if (!nr) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 53bb6d4e9e8d9..245c9a51c2de2 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -336,6 +336,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + { + int ret; + ++ /* Kindly asking blocked readers to release the read side */ ++ set_bit(TTY_LDISC_CHANGING, &tty->flags); ++ wake_up_interruptible_all(&tty->read_wait); ++ wake_up_interruptible_all(&tty->write_wait); ++ + ret = __tty_ldisc_lock(tty, timeout); + if (!ret) + return -EBUSY; +@@ -346,6 +351,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + void tty_ldisc_unlock(struct tty_struct *tty) + { + clear_bit(TTY_LDISC_HALTED, &tty->flags); ++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */ ++ clear_bit(TTY_LDISC_CHANGING, &tty->flags); + __tty_ldisc_unlock(tty); + } + +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 808fbfe86f858..76db046f09ab6 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -366,6 +366,7 @@ struct tty_file_private { + #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ + #define TTY_HUPPED 18 /* Post driver->hangup() */ + #define TTY_HUPPING 19 /* Hangup in progress */ ++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */ + #define TTY_LDISC_HALTED 22 /* Line discipline is halted */ + + /* Values for tty->flow_change */ +@@ -383,6 +384,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val) + smp_mb(); + } + ++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file) ++{ ++ return file->f_flags & O_NONBLOCK || ++ test_bit(TTY_LDISC_CHANGING, &tty->flags); ++} ++ + static inline bool tty_io_error(struct tty_struct *tty) + { + return test_bit(TTY_IO_ERROR, &tty->flags); +-- +2.20.1 + diff --git a/queue-4.19/tty-serial-qcom_geni_serial-fix-softlock.patch b/queue-4.19/tty-serial-qcom_geni_serial-fix-softlock.patch new file mode 100644 index 00000000000..3d0fcb89d71 --- /dev/null +++ b/queue-4.19/tty-serial-qcom_geni_serial-fix-softlock.patch @@ -0,0 +1,179 @@ +From 60ccf0d8459dc3cb43a4d80ace7a02ce12cf4dbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 18:18:40 -0800 +Subject: tty: serial: qcom_geni_serial: Fix softlock + +From: Ryan Case + +[ Upstream commit a1fee899e5bed457afc20a6a2ff3915a95cc5942 ] + +Transfers were being divided into device FIFO sized (64 byte max) +operations which would poll for completion within a spin_lock_irqsave / +spin_unlock_irqrestore block. This both made things slow by waiting for +the FIFO to completely drain before adding further data and would also +result in softlocks on large transmissions. + +This patch allows larger transfers with continuous FIFO additions as +space becomes available and removes polling from the interrupt handler. + +Signed-off-by: Ryan Case +Reviewed-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/qcom_geni_serial.c | 56 +++++++++++++++++++-------- + 1 file changed, 39 insertions(+), 17 deletions(-) + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index 69b980bb8ac29..b3f7d1a1e97f8 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -113,6 +113,8 @@ struct qcom_geni_serial_port { + u32 *rx_fifo; + u32 loopback; + bool brk; ++ ++ unsigned int tx_remaining; + }; + + static const struct uart_ops qcom_geni_console_pops; +@@ -435,6 +437,7 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s, + struct qcom_geni_serial_port *port; + bool locked = true; + unsigned long flags; ++ u32 geni_status; + + WARN_ON(co->index < 0 || co->index >= GENI_UART_CONS_PORTS); + +@@ -448,6 +451,8 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s, + else + spin_lock_irqsave(&uport->lock, flags); + ++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS); ++ + /* Cancel the current write to log the fault */ + if (!locked) { + geni_se_cancel_m_cmd(&port->se); +@@ -461,9 +466,19 @@ static void qcom_geni_serial_console_write(struct console *co, const char *s, + } + writel_relaxed(M_CMD_CANCEL_EN, uport->membase + + SE_GENI_M_IRQ_CLEAR); ++ } else if ((geni_status & M_GENI_CMD_ACTIVE) && !port->tx_remaining) { ++ /* ++ * It seems we can't interrupt existing transfers if all data ++ * has been sent, in which case we need to look for done first. ++ */ ++ qcom_geni_serial_poll_tx_done(uport); + } + + __qcom_geni_serial_console_write(uport, s, count); ++ ++ if (port->tx_remaining) ++ qcom_geni_serial_setup_tx(uport, port->tx_remaining); ++ + if (locked) + spin_unlock_irqrestore(&uport->lock, flags); + } +@@ -694,40 +709,45 @@ static void qcom_geni_serial_handle_rx(struct uart_port *uport, bool drop) + port->handle_rx(uport, total_bytes, drop); + } + +-static void qcom_geni_serial_handle_tx(struct uart_port *uport) ++static void qcom_geni_serial_handle_tx(struct uart_port *uport, bool done, ++ bool active) + { + struct qcom_geni_serial_port *port = to_dev_port(uport, uport); + struct circ_buf *xmit = &uport->state->xmit; + size_t avail; + size_t remaining; ++ size_t pending; + int i; + u32 status; + unsigned int chunk; + int tail; +- u32 irq_en; + +- chunk = uart_circ_chars_pending(xmit); + status = readl_relaxed(uport->membase + SE_GENI_TX_FIFO_STATUS); +- /* Both FIFO and framework buffer are drained */ +- if (!chunk && !status) { ++ ++ /* Complete the current tx command before taking newly added data */ ++ if (active) ++ pending = port->tx_remaining; ++ else ++ pending = uart_circ_chars_pending(xmit); ++ ++ /* All data has been transmitted and acknowledged as received */ ++ if (!pending && !status && done) { + qcom_geni_serial_stop_tx(uport); + goto out_write_wakeup; + } + +- if (!uart_console(uport)) { +- irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN); +- irq_en &= ~(M_TX_FIFO_WATERMARK_EN); +- writel_relaxed(0, uport->membase + SE_GENI_TX_WATERMARK_REG); +- writel_relaxed(irq_en, uport->membase + SE_GENI_M_IRQ_EN); +- } ++ avail = port->tx_fifo_depth - (status & TX_FIFO_WC); ++ avail *= port->tx_bytes_pw; + +- avail = (port->tx_fifo_depth - port->tx_wm) * port->tx_bytes_pw; + tail = xmit->tail; +- chunk = min3((size_t)chunk, (size_t)(UART_XMIT_SIZE - tail), avail); ++ chunk = min3(avail, pending, (size_t)(UART_XMIT_SIZE - tail)); + if (!chunk) + goto out_write_wakeup; + +- qcom_geni_serial_setup_tx(uport, chunk); ++ if (!port->tx_remaining) { ++ qcom_geni_serial_setup_tx(uport, pending); ++ port->tx_remaining = pending; ++ } + + remaining = chunk; + for (i = 0; i < chunk; ) { +@@ -746,11 +766,10 @@ static void qcom_geni_serial_handle_tx(struct uart_port *uport) + tail += tx_bytes; + uport->icount.tx += tx_bytes; + remaining -= tx_bytes; ++ port->tx_remaining -= tx_bytes; + } + + xmit->tail = tail & (UART_XMIT_SIZE - 1); +- if (uart_console(uport)) +- qcom_geni_serial_poll_tx_done(uport); + out_write_wakeup: + if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(uport); +@@ -760,6 +779,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) + { + unsigned int m_irq_status; + unsigned int s_irq_status; ++ unsigned int geni_status; + struct uart_port *uport = dev; + unsigned long flags; + unsigned int m_irq_en; +@@ -773,6 +793,7 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) + spin_lock_irqsave(&uport->lock, flags); + m_irq_status = readl_relaxed(uport->membase + SE_GENI_M_IRQ_STATUS); + s_irq_status = readl_relaxed(uport->membase + SE_GENI_S_IRQ_STATUS); ++ geni_status = readl_relaxed(uport->membase + SE_GENI_STATUS); + m_irq_en = readl_relaxed(uport->membase + SE_GENI_M_IRQ_EN); + writel_relaxed(m_irq_status, uport->membase + SE_GENI_M_IRQ_CLEAR); + writel_relaxed(s_irq_status, uport->membase + SE_GENI_S_IRQ_CLEAR); +@@ -787,7 +808,8 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void *dev) + + if (m_irq_status & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN) && + m_irq_en & (M_TX_FIFO_WATERMARK_EN | M_CMD_DONE_EN)) +- qcom_geni_serial_handle_tx(uport); ++ qcom_geni_serial_handle_tx(uport, m_irq_status & M_CMD_DONE_EN, ++ geni_status & M_GENI_CMD_ACTIVE); + + if (s_irq_status & S_GP_IRQ_0_EN || s_irq_status & S_GP_IRQ_1_EN) { + if (s_irq_status & S_GP_IRQ_0_EN) +-- +2.20.1 + diff --git a/queue-4.19/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch b/queue-4.19/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch new file mode 100644 index 00000000000..ea6df41b9e3 --- /dev/null +++ b/queue-4.19/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch @@ -0,0 +1,113 @@ +From 9f05643100992723bb5aed90511232d48bd62b64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 17:55:19 -0800 +Subject: usb: dwc3: debugfs: Properly print/set link state for HS + +From: Thinh Nguyen + +[ Upstream commit 0d36dede457873404becd7c9cb9d0f2bcfd0dcd9 ] + +Highspeed device and below has different state names than superspeed and +higher. Add proper checks and printouts of link states for highspeed and +below. + +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/debug.h | 29 +++++++++++++++++++++++++++++ + drivers/usb/dwc3/debugfs.c | 19 +++++++++++++++++-- + 2 files changed, 46 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h +index c66d216dcc304..4f75ab3505b77 100644 +--- a/drivers/usb/dwc3/debug.h ++++ b/drivers/usb/dwc3/debug.h +@@ -116,6 +116,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state) + } + } + ++/** ++ * dwc3_gadget_hs_link_string - returns highspeed and below link name ++ * @link_state: link state code ++ */ ++static inline const char * ++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state) ++{ ++ switch (link_state) { ++ case DWC3_LINK_STATE_U0: ++ return "On"; ++ case DWC3_LINK_STATE_U2: ++ return "Sleep"; ++ case DWC3_LINK_STATE_U3: ++ return "Suspend"; ++ case DWC3_LINK_STATE_SS_DIS: ++ return "Disconnected"; ++ case DWC3_LINK_STATE_RX_DET: ++ return "Early Suspend"; ++ case DWC3_LINK_STATE_RECOV: ++ return "Recovery"; ++ case DWC3_LINK_STATE_RESET: ++ return "Reset"; ++ case DWC3_LINK_STATE_RESUME: ++ return "Resume"; ++ default: ++ return "UNKNOWN link state\n"; ++ } ++} ++ + /** + * dwc3_trb_type_string - returns TRB type as a string + * @type: the type of the TRB +diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c +index df8e73ec3342e..04ce7c01a09e6 100644 +--- a/drivers/usb/dwc3/debugfs.c ++++ b/drivers/usb/dwc3/debugfs.c +@@ -433,13 +433,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) + unsigned long flags; + enum dwc3_link_state state; + u32 reg; ++ u8 speed; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_DSTS); + state = DWC3_DSTS_USBLNKST(reg); +- spin_unlock_irqrestore(&dwc->lock, flags); ++ speed = reg & DWC3_DSTS_CONNECTSPD; + +- seq_printf(s, "%s\n", dwc3_gadget_link_string(state)); ++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ? ++ dwc3_gadget_link_string(state) : ++ dwc3_gadget_hs_link_string(state)); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + return 0; + } +@@ -457,6 +461,8 @@ static ssize_t dwc3_link_state_write(struct file *file, + unsigned long flags; + enum dwc3_link_state state = 0; + char buf[32]; ++ u32 reg; ++ u8 speed; + + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; +@@ -477,6 +483,15 @@ static ssize_t dwc3_link_state_write(struct file *file, + return -EINVAL; + + spin_lock_irqsave(&dwc->lock, flags); ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ speed = reg & DWC3_DSTS_CONNECTSPD; ++ ++ if (speed < DWC3_DSTS_SUPERSPEED && ++ state != DWC3_LINK_STATE_RECOV) { ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ return -EINVAL; ++ } ++ + dwc3_gadget_set_link_state(dwc, state); + spin_unlock_irqrestore(&dwc->lock, flags); + +-- +2.20.1 + diff --git a/queue-4.19/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch b/queue-4.19/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch new file mode 100644 index 00000000000..46a0870cb4b --- /dev/null +++ b/queue-4.19/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch @@ -0,0 +1,37 @@ +From fae69c9ab9875e5b339b1713ca214b3d7a1c480d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 12:40:29 -0800 +Subject: usb: dwc3: don't log probe deferrals; but do log other error codes + +From: Brian Norris + +[ Upstream commit 408d3ba006af57380fa48858b39f72fde6405031 ] + +It's not very useful to repeat a bunch of probe deferral errors. And +it's also not very useful to log "failed" without telling the error +code. + +Signed-off-by: Brian Norris +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index aca7e7fa5e47d..f52fcbc5c9718 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1481,7 +1481,8 @@ static int dwc3_probe(struct platform_device *pdev) + + ret = dwc3_core_init(dwc); + if (ret) { +- dev_err(dev, "failed to initialize core\n"); ++ if (ret != -EPROBE_DEFER) ++ dev_err(dev, "failed to initialize core: %d\n", ret); + goto err4; + } + +-- +2.20.1 + diff --git a/queue-4.19/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch b/queue-4.19/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch new file mode 100644 index 00000000000..7fe74757f5c --- /dev/null +++ b/queue-4.19/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch @@ -0,0 +1,41 @@ +From f66efcef01b696190df0006f1bf89d5687cece25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 03:52:43 +0000 +Subject: usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler + +From: YueHaibing + +[ Upstream commit f770e3bc236ee954a3b4052bdf55739e26ee25db ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/usb/mtu3/mtu3_qmu.c: In function 'qmu_tx_zlp_error_handler': +drivers/usb/mtu3/mtu3_qmu.c:385:22: warning: + variable 'req' set but not used [-Wunused-but-set-variable] + +It seems dbginfo original intention is print 'req' other than 'mreq' + +Acked-by: Chunfeng Yun +Signed-off-by: YueHaibing +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_qmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index ff62ba2321779..326b40747128c 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -427,7 +427,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) + return; + } + +- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq); ++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req); + + mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN); + +-- +2.20.1 + diff --git a/queue-4.19/usb-serial-f81534-fix-reading-old-new-ic-config.patch b/queue-4.19/usb-serial-f81534-fix-reading-old-new-ic-config.patch new file mode 100644 index 00000000000..787f03e1535 --- /dev/null +++ b/queue-4.19/usb-serial-f81534-fix-reading-old-new-ic-config.patch @@ -0,0 +1,81 @@ +From 1e597035a3ea1c8ff5c726db821f1e5c88ca1d19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 10:58:44 +0800 +Subject: USB: serial: f81534: fix reading old/new IC config + +From: Ji-Ze Hong (Peter Hong) + +[ Upstream commit ab60075f2a4eebca1abb04f712569963fb4d9d6c ] + +The F81532/534 had a internal configuration space to save & control +IC state with address F81534_CUSTOM_ADDRESS_START (0x2f00). Layout +as following: + +00h: to indicate the section is valid + +01h~04h: UART Mode & port availability + +05h~08h: Output pin control on IC power on + +09h~12h: Output pin control on working <-- New added + +Old driver will use +05~08h as default on working, but newer IC will +configed with shutdown mode(7) in 05h~08h and working mode with RS232(1) +in 09h~12h. It'll make mainstream driver not working. + +This patch will make mainstream driver compatible older and newer IC. +If using a old IC, the +05h~08h will be 00h~06h, we'll direct apply it. +If using a new IC, the +05h~08h will be 07h or larger, we'll read +09h~12h +to apply newer configuration. + +Signed-off-by: Ji-Ze Hong (Peter Hong) +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/f81534.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/serial/f81534.c b/drivers/usb/serial/f81534.c +index 4dfbff20bda4c..db6c93c04b3c8 100644 +--- a/drivers/usb/serial/f81534.c ++++ b/drivers/usb/serial/f81534.c +@@ -45,14 +45,17 @@ + #define F81534_CONFIG1_REG (0x09 + F81534_UART_BASE_ADDRESS) + + #define F81534_DEF_CONF_ADDRESS_START 0x3000 +-#define F81534_DEF_CONF_SIZE 8 ++#define F81534_DEF_CONF_SIZE 12 + + #define F81534_CUSTOM_ADDRESS_START 0x2f00 + #define F81534_CUSTOM_DATA_SIZE 0x10 + #define F81534_CUSTOM_NO_CUSTOM_DATA 0xff + #define F81534_CUSTOM_VALID_TOKEN 0xf0 + #define F81534_CONF_OFFSET 1 +-#define F81534_CONF_GPIO_OFFSET 4 ++#define F81534_CONF_INIT_GPIO_OFFSET 4 ++#define F81534_CONF_WORK_GPIO_OFFSET 8 ++#define F81534_CONF_GPIO_SHUTDOWN 7 ++#define F81534_CONF_GPIO_RS232 1 + + #define F81534_MAX_DATA_BLOCK 64 + #define F81534_MAX_BUS_RETRY 20 +@@ -1359,8 +1362,19 @@ static int f81534_set_port_output_pin(struct usb_serial_port *port) + serial_priv = usb_get_serial_data(serial); + port_priv = usb_get_serial_port_data(port); + +- idx = F81534_CONF_GPIO_OFFSET + port_priv->phy_num; ++ idx = F81534_CONF_INIT_GPIO_OFFSET + port_priv->phy_num; + value = serial_priv->conf_data[idx]; ++ if (value >= F81534_CONF_GPIO_SHUTDOWN) { ++ /* ++ * Newer IC configure will make transceiver in shutdown mode on ++ * initial power on. We need enable it before using UARTs. ++ */ ++ idx = F81534_CONF_WORK_GPIO_OFFSET + port_priv->phy_num; ++ value = serial_priv->conf_data[idx]; ++ if (value >= F81534_CONF_GPIO_SHUTDOWN) ++ value = F81534_CONF_GPIO_RS232; ++ } ++ + pins = &f81534_port_out_pins[port_priv->phy_num]; + + for (i = 0; i < ARRAY_SIZE(pins->pin); ++i) { +-- +2.20.1 + diff --git a/queue-4.19/virtchnl-fix-off-by-one-error.patch b/queue-4.19/virtchnl-fix-off-by-one-error.patch new file mode 100644 index 00000000000..fc99b26e63c --- /dev/null +++ b/queue-4.19/virtchnl-fix-off-by-one-error.patch @@ -0,0 +1,42 @@ +From f44f170d26a2786f2737b7ba34c7251835ea3a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 14:33:31 -0700 +Subject: virtchnl: Fix off by one error + +From: Alice Michael + +[ Upstream commit 843faff87af261bf55eda719a06087af0486a168 ] + +When calculating the valid length for a VIRTCHNL_OP_ENABLE_CHANNELS +message, we accidentally allowed messages with one extra +virtchnl_channel_info structure on the end. This happened due +to an off by one error, because we forgot that valid_len already +accounted for one virtchnl_channel_info structure, so we need to +subtract one from the num_tc value. + +Signed-off-by: Alice Michael +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + include/linux/avf/virtchnl.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h +index 212b3822d1804..92d179fb6d59e 100644 +--- a/include/linux/avf/virtchnl.h ++++ b/include/linux/avf/virtchnl.h +@@ -798,8 +798,8 @@ virtchnl_vc_validate_vf_msg(struct virtchnl_version_info *ver, u32 v_opcode, + if (msglen >= valid_len) { + struct virtchnl_tc_info *vti = + (struct virtchnl_tc_info *)msg; +- valid_len += vti->num_tc * +- sizeof(struct virtchnl_channel_info); ++ valid_len += (vti->num_tc - 1) * ++ sizeof(struct virtchnl_channel_info); + if (vti->num_tc == 0) + err_msg_format = true; + } +-- +2.20.1 + diff --git a/queue-4.19/xfrm-release-device-reference-for-invalid-state.patch b/queue-4.19/xfrm-release-device-reference-for-invalid-state.patch new file mode 100644 index 00000000000..9e4566999da --- /dev/null +++ b/queue-4.19/xfrm-release-device-reference-for-invalid-state.patch @@ -0,0 +1,62 @@ +From 67cdeb32d10af8753f3eef6b74830e6de581cc3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2019 15:05:46 -0800 +Subject: xfrm: release device reference for invalid state + +From: Xiaodong Xu + +[ Upstream commit 4944a4b1077f74d89073624bd286219d2fcbfce3 ] + +An ESP packet could be decrypted in async mode if the input handler for +this packet returns -EINPROGRESS in xfrm_input(). At this moment the device +reference in skb is held. Later xfrm_input() will be invoked again to +resume the processing. +If the transform state is still valid it would continue to release the +device reference and there won't be a problem; however if the transform +state is not valid when async resumption happens, the packet will be +dropped while the device reference is still being held. +When the device is deleted for some reason and the reference to this +device is not properly released, the kernel will keep logging like: + +unregister_netdevice: waiting for ppp2 to become free. Usage count = 1 + +The issue is observed when running IPsec traffic over a PPPoE device based +on a bridge interface. By terminating the PPPoE connection on the server +end for multiple times, the PPPoE device on the client side will eventually +get stuck on the above warning message. + +This patch will check the async mode first and continue to release device +reference in async resumption, before it is dropped due to invalid state. + +v2: Do not assign address family from outer_mode in the transform if the +state is invalid + +v3: Release device reference in the error path instead of jumping to resume + +Fixes: 4ce3dbe397d7b ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)") +Signed-off-by: Xiaodong Xu +Reported-by: Bo Chen +Tested-by: Bo Chen +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_input.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index d5635908587f4..82b0a99ee1f43 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -246,6 +246,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + else + XFRM_INC_STATS(net, + LINUX_MIB_XFRMINSTATEINVALID); ++ ++ if (encap_type == -1) ++ dev_put(skb->dev); + goto drop; + } + +-- +2.20.1 + diff --git a/queue-4.19/xfs-extent-shifting-doesn-t-fully-invalidate-page-ca.patch b/queue-4.19/xfs-extent-shifting-doesn-t-fully-invalidate-page-ca.patch new file mode 100644 index 00000000000..cd01885c5d2 --- /dev/null +++ b/queue-4.19/xfs-extent-shifting-doesn-t-fully-invalidate-page-ca.patch @@ -0,0 +1,50 @@ +From e22f257cd35dbf71844996f9569168c1dd071a2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 13:31:09 -0800 +Subject: xfs: extent shifting doesn't fully invalidate page cache + +From: Dave Chinner + +[ Upstream commit 7f9f71be84bcab368e58020a42f6d0dd97adf0ce ] + +The extent shifting code uses a flush and invalidate mechainsm prior +to shifting extents around. This is similar to what +xfs_free_file_space() does, but it doesn't take into account things +like page cache vs block size differences, and it will fail if there +is a page that it currently busy. + +xfs_flush_unmap_range() handles all of these cases, so just convert +xfs_prepare_shift() to us that mechanism rather than having it's own +special sauce. + +Signed-off-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_bmap_util.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c +index 41ad9eaab6ce9..c045723678be9 100644 +--- a/fs/xfs/xfs_bmap_util.c ++++ b/fs/xfs/xfs_bmap_util.c +@@ -1244,13 +1244,7 @@ xfs_prepare_shift( + * Writeback and invalidate cache for the remainder of the file as we're + * about to shift down every extent from offset to EOF. + */ +- error = filemap_write_and_wait_range(VFS_I(ip)->i_mapping, offset, -1); +- if (error) +- return error; +- error = invalidate_inode_pages2_range(VFS_I(ip)->i_mapping, +- offset >> PAGE_SHIFT, -1); +- if (error) +- return error; ++ error = xfs_flush_unmap_range(ip, offset, XFS_ISIZE(ip)); + + /* + * Clean out anything hanging around in the cow fork now that +-- +2.20.1 +