From: Sasha Levin Date: Thu, 28 Feb 2019 01:02:06 +0000 (-0500) Subject: patches for 4.20 X-Git-Tag: v4.9.162~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ad5c1aa102cd4fb0782a404d6dbd261c5842adfe;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.20 Signed-off-by: Sasha Levin --- diff --git a/queue-4.20/alsa-compress-prevent-potential-divide-by-zero-bugs.patch b/queue-4.20/alsa-compress-prevent-potential-divide-by-zero-bugs.patch new file mode 100644 index 00000000000..5842757d47f --- /dev/null +++ b/queue-4.20/alsa-compress-prevent-potential-divide-by-zero-bugs.patch @@ -0,0 +1,45 @@ +From 1610ead45f5ea71b29a6e443d955f73e4b812d49 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 21 Dec 2018 12:06:58 +0300 +Subject: ALSA: compress: prevent potential divide by zero bugs + +[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ] + +The problem is seen in the q6asm_dai_compr_set_params() function: + + ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, + (prtd->pcm_size / prtd->periods), + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + prtd->periods); + +In this code prtd->pcm_size is the buffer_size and prtd->periods comes +from params->buffer.fragments. If we allow the number of fragments to +be zero then it results in a divide by zero bug. One possible fix would +be to use prtd->pcm_count directly instead of using the division to +re-calculate it. But I decided that it doesn't really make sense to +allow zero fragments. + +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 26b5e245b0747..8b78ddffa509a 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size) ++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments == 0) + return -EINVAL; + + /* now codec parameters */ +-- +2.19.1 + diff --git a/queue-4.20/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch b/queue-4.20/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch new file mode 100644 index 00000000000..e076426f928 --- /dev/null +++ b/queue-4.20/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch @@ -0,0 +1,74 @@ +From 12eed7f7453b5f22990ad4a99d7157ea9633d0be Mon Sep 17 00:00:00 2001 +From: Eugeniy Paltsev +Date: Thu, 13 Dec 2018 18:42:57 +0300 +Subject: ARC: fix __ffs return value to avoid build warnings + +[ Upstream commit 4e868f8419cb4cb558c5d428e7ab5629cef864c7 ] + +| CC mm/nobootmem.o +|In file included from ./include/asm-generic/bug.h:18:0, +| from ./arch/arc/include/asm/bug.h:32, +| from ./include/linux/bug.h:5, +| from ./include/linux/mmdebug.h:5, +| from ./include/linux/gfp.h:5, +| from ./include/linux/slab.h:15, +| from mm/nobootmem.c:14: +|mm/nobootmem.c: In function '__free_pages_memory': +|./include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast +| (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) +| ^ +|./include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck' +| (__typecheck(x, y) && __no_side_effects(x, y)) +| ^~~~~~~~~~~ +|./include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp' +| __builtin_choose_expr(__safe_cmp(x, y), \ +| ^~~~~~~~~~ +|./include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp' +| #define min(x, y) __careful_cmp(x, y, <) +| ^~~~~~~~~~~~~ +|mm/nobootmem.c:104:11: note: in expansion of macro 'min' +| order = min(MAX_ORDER - 1UL, __ffs(start)); + +Change __ffs return value from 'int' to 'unsigned long' as it +is done in other implementations (like asm-generic, x86, etc...) +to avoid build-time warnings in places where type is strictly +checked. + +As __ffs may return values in [0-31] interval changing return +type to unsigned is valid. + +Signed-off-by: Eugeniy Paltsev +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/bitops.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h +index 8da87feec59aa..99e6d8948f4ac 100644 +--- a/arch/arc/include/asm/bitops.h ++++ b/arch/arc/include/asm/bitops.h +@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long word) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word) + { + if (!word) + return word; +@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long x) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x) + { +- int n; ++ unsigned long n; + + asm volatile( + " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */ +-- +2.19.1 + diff --git a/queue-4.20/arc-show_regs-lockdep-avoid-page-allocator.patch b/queue-4.20/arc-show_regs-lockdep-avoid-page-allocator.patch new file mode 100644 index 00000000000..007b550ed6b --- /dev/null +++ b/queue-4.20/arc-show_regs-lockdep-avoid-page-allocator.patch @@ -0,0 +1,141 @@ +From f9a0d6c3da8324941e980080922ce5208b77a457 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Mon, 17 Dec 2018 14:11:19 -0800 +Subject: ARC: show_regs: lockdep: avoid page allocator... + +[ Upstream commit ab6c03676cb190156603cf4c5ecf97aa406c9c53 ] + +and use smaller/on-stack buffer instead + +The motivation for this change was lockdep splat like below. + +| potentially unexpected fatal signal 11. +| BUG: sleeping function called from invalid context at ../mm/page_alloc.c:4317 +| in_atomic(): 1, irqs_disabled(): 0, pid: 57, name: segv +| no locks held by segv/57. +| Preemption disabled at: +| [<8182f17e>] get_signal+0x4a6/0x7c4 +| CPU: 0 PID: 57 Comm: segv Not tainted 4.17.0+ #23 +| +| Stack Trace: +| arc_unwind_core.constprop.1+0xd0/0xf4 +| __might_sleep+0x1f6/0x234 +| __get_free_pages+0x174/0xca0 +| show_regs+0x22/0x330 +| get_signal+0x4ac/0x7c4 # print_fatal_signals() -> preempt_disable() +| do_signal+0x30/0x224 +| resume_user_mode_begin+0x90/0xd8 + +So signal handling core calls show_regs() with preemption disabled but +an ensuing GFP_KERNEL page allocator call is flagged by lockdep. + +We could have switched to GFP_NOWAIT, but turns out that is not enough +anways and eliding page allocator call leads to less code and +instruction traces to sift thru when debugging pesky crashes. + +FWIW, this patch doesn't cure the lockdep splat (which next patch does). + +Reviewed-by: William Kucharski +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/troubleshoot.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c +index e8d9fb4523462..5c6663321e873 100644 +--- a/arch/arc/kernel/troubleshoot.c ++++ b/arch/arc/kernel/troubleshoot.c +@@ -18,6 +18,8 @@ + #include + #include + ++#define ARC_PATH_MAX 256 ++ + /* + * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25) + * -Prints 3 regs per line and a CR. +@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs) + print_reg_file(&(cregs->r13), 13); + } + +-static void print_task_path_n_nm(struct task_struct *tsk, char *buf) ++static void print_task_path_n_nm(struct task_struct *tsk) + { + char *path_nm = NULL; + struct mm_struct *mm; + struct file *exe_file; ++ char buf[ARC_PATH_MAX]; + + mm = get_task_mm(tsk); + if (!mm) +@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf) + mmput(mm); + + if (exe_file) { +- path_nm = file_path(exe_file, buf, 255); ++ path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1); + fput(exe_file); + } + +@@ -80,10 +83,9 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf) + pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?"); + } + +-static void show_faulting_vma(unsigned long address, char *buf) ++static void show_faulting_vma(unsigned long address) + { + struct vm_area_struct *vma; +- char *nm = buf; + struct mm_struct *active_mm = current->active_mm; + + /* can't use print_vma_addr() yet as it doesn't check for +@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf) + * if the container VMA is not found + */ + if (vma && (vma->vm_start <= address)) { ++ char buf[ARC_PATH_MAX]; ++ char *nm = "?"; ++ + if (vma->vm_file) { +- nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1); ++ nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1); + if (IS_ERR(nm)) + nm = "?"; + } +@@ -173,13 +178,8 @@ void show_regs(struct pt_regs *regs) + { + struct task_struct *tsk = current; + struct callee_regs *cregs; +- char *buf; + +- buf = (char *)__get_free_page(GFP_KERNEL); +- if (!buf) +- return; +- +- print_task_path_n_nm(tsk, buf); ++ print_task_path_n_nm(tsk); + show_regs_print_info(KERN_INFO); + + show_ecr_verbose(regs); +@@ -189,7 +189,7 @@ void show_regs(struct pt_regs *regs) + (void *)regs->blink, (void *)regs->ret); + + if (user_mode(regs)) +- show_faulting_vma(regs->ret, buf); /* faulting code, not data */ ++ show_faulting_vma(regs->ret); /* faulting code, not data */ + + pr_info("[STAT32]: 0x%08lx", regs->status32); + +@@ -221,8 +221,6 @@ void show_regs(struct pt_regs *regs) + cregs = (struct callee_regs *)current->thread.callee_reg; + if (cregs) + show_callee_regs(cregs); +- +- free_page((unsigned long)buf); + } + + void show_kernel_fault_diag(const char *str, struct pt_regs *regs, +-- +2.19.1 + diff --git a/queue-4.20/asoc-core-make-snd_soc_find_component-more-robust.patch b/queue-4.20/asoc-core-make-snd_soc_find_component-more-robust.patch new file mode 100644 index 00000000000..fb8648af68a --- /dev/null +++ b/queue-4.20/asoc-core-make-snd_soc_find_component-more-robust.patch @@ -0,0 +1,40 @@ +From a2d08cf517cc6a2c2b008c033aa9122ae99963b2 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Mon, 14 Jan 2019 23:29:36 +0000 +Subject: ASoC: core: Make snd_soc_find_component() more robust + +[ Upstream commit 5a7b2aabc1aa0393f067d9325ada96fdf67f8cb7 ] + +There are some use cases where you're checking for a lot of things on a +card and it makes sense that you might end up trying to call +snd_soc_find_component() without either a name or an of_node. Currently +in that case we try to dereference the name and crash but it's more +useful to allow the caller to just treat that as a case where we don't +find anything, that error handling will already exist. + +Inspired by a patch from Ajit Pandey fixing some callers. + +Fixes: 8780cf1142a5 ("ASoC: soc-core: defer card probe until all component is added to list") +Reported-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 2d49492d60692..78f953be8aad8 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -742,7 +742,7 @@ static struct snd_soc_component *soc_find_component( + if (of_node) { + if (component->dev->of_node == of_node) + return component; +- } else if (strcmp(component->name, name) == 0) { ++ } else if (name && strcmp(component->name, name) == 0) { + return component; + } + } +-- +2.19.1 + diff --git a/queue-4.20/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch b/queue-4.20/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch new file mode 100644 index 00000000000..bb73b375004 --- /dev/null +++ b/queue-4.20/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch @@ -0,0 +1,83 @@ +From 6fe60f0d31d384dcf20b210a8feedf85c6e14d63 Mon Sep 17 00:00:00 2001 +From: Silvio Cesare +Date: Sat, 12 Jan 2019 16:28:43 +0100 +Subject: ASoC: dapm: change snprintf to scnprintf for possible overflow + +[ Upstream commit e581e151e965bf1f2815dd94620b638fec4d0a7e ] + +Change snprintf to scnprintf. There are generally two cases where using +snprintf causes problems. + +1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) +In this case, if snprintf would have written more characters than what the +buffer size (SIZE) is, then size will end up larger than SIZE. In later +uses of snprintf, SIZE - size will result in a negative number, leading +to problems. Note that size might already be too large by using +size = snprintf before the code reaches a case of size += snprintf. + +2) If size is ultimately used as a length parameter for a copy back to user +space, then it will potentially allow for a buffer overflow and information +disclosure when size is greater than SIZE. When the size is used to index +the buffer directly, we can have memory corruption. This also means when +size = snprintf... is used, it may also cause problems since size may become +large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel +configuration. + +The solution to these issues is to use scnprintf which returns the number of +characters actually written to the buffer, so the size variable will never +exceed SIZE. + +Signed-off-by: Silvio Cesare +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Dan Carpenter +Cc: Kees Cook +Cc: Will Deacon +Cc: Greg KH +Signed-off-by: Willy Tarreau +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index a5178845065b3..2c4c134195392 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2019,19 +2019,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + out = is_connected_output_ep(w, NULL, NULL); + } + +- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", ++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", + w->name, w->power ? "On" : "Off", + w->force ? " (forced)" : "", in, out); + + if (w->reg >= 0) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " - R%d(0x%x) mask 0x%x", + w->reg, w->reg, w->mask << w->shift); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (w->sname) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", + w->sname, + w->active ? "active" : "inactive"); + +@@ -2044,7 +2044,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + if (!p->connect) + continue; + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " %s \"%s\" \"%s\"\n", + (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", + p->name ? p->name : "static", +-- +2.19.1 + diff --git a/queue-4.20/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch b/queue-4.20/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch new file mode 100644 index 00000000000..5c4358e6945 --- /dev/null +++ b/queue-4.20/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch @@ -0,0 +1,117 @@ +From d7fa5fb3e1b9279355d0cbcfb2dc4b059ff15ac9 Mon Sep 17 00:00:00 2001 +From: Silvio Cesare +Date: Tue, 15 Jan 2019 04:27:27 +0100 +Subject: ASoC: imx-audmux: change snprintf to scnprintf for possible overflow + +[ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ] + +Change snprintf to scnprintf. There are generally two cases where using +snprintf causes problems. + +1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) +In this case, if snprintf would have written more characters than what the +buffer size (SIZE) is, then size will end up larger than SIZE. In later +uses of snprintf, SIZE - size will result in a negative number, leading +to problems. Note that size might already be too large by using +size = snprintf before the code reaches a case of size += snprintf. + +2) If size is ultimately used as a length parameter for a copy back to user +space, then it will potentially allow for a buffer overflow and information +disclosure when size is greater than SIZE. When the size is used to index +the buffer directly, we can have memory corruption. This also means when +size = snprintf... is used, it may also cause problems since size may become +large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel +configuration. + +The solution to these issues is to use scnprintf which returns the number of +characters actually written to the buffer, so the size variable will never +exceed SIZE. + +Signed-off-by: Silvio Cesare +Cc: Timur Tabi +Cc: Nicolin Chen +Cc: Mark Brown +Cc: Xiubo Li +Cc: Fabio Estevam +Cc: Dan Carpenter +Cc: Kees Cook +Cc: Will Deacon +Cc: Greg KH +Signed-off-by: Willy Tarreau +Acked-by: Nicolin Chen +Reviewed-by: Kees Cook +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c +index 392d5eef356d3..99e07b01a2ce9 100644 +--- a/sound/soc/fsl/imx-audmux.c ++++ b/sound/soc/fsl/imx-audmux.c +@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, + if (!buf) + return -ENOMEM; + +- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", ++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", + pdcr, ptcr); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS output from %s, ", + audmux_port_string((ptcr >> 27) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk output from %s", + audmux_port_string((ptcr >> 22) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk input"); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "Port is symmetric"); + } else { + if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS output from %s, ", + audmux_port_string((ptcr >> 17) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk output from %s", + audmux_port_string((ptcr >> 12) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk input"); + } + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "\nData received from %s\n", + audmux_port_string((pdcr >> 13) & 0x7)); + +-- +2.19.1 + diff --git a/queue-4.20/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch b/queue-4.20/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch new file mode 100644 index 00000000000..9862d121c21 --- /dev/null +++ b/queue-4.20/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch @@ -0,0 +1,50 @@ +From bdfd4783bdefb305c623508fc08b977d771ca65b Mon Sep 17 00:00:00 2001 +From: Rander Wang +Date: Tue, 18 Dec 2018 16:24:54 +0800 +Subject: ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field + +[ Upstream commit 906a9abc5de73c383af518f5a806f4be2993a0c7 ] + +For some reason this field was set to zero when all other drivers use +.dynamic = 1 for front-ends. This change was tested on Dell XPS13 and +has no impact with the existing legacy driver. The SOF driver also works +with this change which enables it to override the fixed topology. + +Signed-off-by: Rander Wang +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/broadwell.c | 2 +- + sound/soc/intel/boards/haswell.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c +index 68e6543e6cb02..99f2a0156ae88 100644 +--- a/sound/soc/intel/boards/broadwell.c ++++ b/sound/soc/intel/boards/broadwell.c +@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index eab1f439dd3f1..a4022983a7ce0 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +-- +2.19.1 + diff --git a/queue-4.20/asoc-rt5682-fix-pll-source-register-definitions.patch b/queue-4.20/asoc-rt5682-fix-pll-source-register-definitions.patch new file mode 100644 index 00000000000..15cdefe1289 --- /dev/null +++ b/queue-4.20/asoc-rt5682-fix-pll-source-register-definitions.patch @@ -0,0 +1,55 @@ +From bf1052bc352ede2a4c8af649aefcde77d7de39da Mon Sep 17 00:00:00 2001 +From: Shuming Fan +Date: Tue, 15 Jan 2019 11:27:39 +0800 +Subject: ASoC: rt5682: Fix PLL source register definitions + +[ Upstream commit ee7ea2a9a318a89d21b156dc75e54d53904bdbe5 ] + +Fix typo which causes headphone no sound while using BCLK +as PLL source. + +Signed-off-by: Shuming Fan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h +index d82a8301fd745..96944cff0ed73 100644 +--- a/sound/soc/codecs/rt5682.h ++++ b/sound/soc/codecs/rt5682.h +@@ -849,18 +849,18 @@ + #define RT5682_SCLK_SRC_PLL2 (0x2 << 13) + #define RT5682_SCLK_SRC_SDW (0x3 << 13) + #define RT5682_SCLK_SRC_RCCLK (0x4 << 13) +-#define RT5682_PLL1_SRC_MASK (0x3 << 10) +-#define RT5682_PLL1_SRC_SFT 10 +-#define RT5682_PLL1_SRC_MCLK (0x0 << 10) +-#define RT5682_PLL1_SRC_BCLK1 (0x1 << 10) +-#define RT5682_PLL1_SRC_SDW (0x2 << 10) +-#define RT5682_PLL1_SRC_RC (0x3 << 10) +-#define RT5682_PLL2_SRC_MASK (0x3 << 8) +-#define RT5682_PLL2_SRC_SFT 8 +-#define RT5682_PLL2_SRC_MCLK (0x0 << 8) +-#define RT5682_PLL2_SRC_BCLK1 (0x1 << 8) +-#define RT5682_PLL2_SRC_SDW (0x2 << 8) +-#define RT5682_PLL2_SRC_RC (0x3 << 8) ++#define RT5682_PLL2_SRC_MASK (0x3 << 10) ++#define RT5682_PLL2_SRC_SFT 10 ++#define RT5682_PLL2_SRC_MCLK (0x0 << 10) ++#define RT5682_PLL2_SRC_BCLK1 (0x1 << 10) ++#define RT5682_PLL2_SRC_SDW (0x2 << 10) ++#define RT5682_PLL2_SRC_RC (0x3 << 10) ++#define RT5682_PLL1_SRC_MASK (0x3 << 8) ++#define RT5682_PLL1_SRC_SFT 8 ++#define RT5682_PLL1_SRC_MCLK (0x0 << 8) ++#define RT5682_PLL1_SRC_BCLK1 (0x1 << 8) ++#define RT5682_PLL1_SRC_SDW (0x2 << 8) ++#define RT5682_PLL1_SRC_RC (0x3 << 8) + + + +-- +2.19.1 + diff --git a/queue-4.20/asoc-rt5682-fix-recording-no-sound-issue.patch b/queue-4.20/asoc-rt5682-fix-recording-no-sound-issue.patch new file mode 100644 index 00000000000..c97236eccc8 --- /dev/null +++ b/queue-4.20/asoc-rt5682-fix-recording-no-sound-issue.patch @@ -0,0 +1,32 @@ +From 60c1877be5a9eb0f5ac1f48b6e0cfa863ce164e4 Mon Sep 17 00:00:00 2001 +From: Shuming Fan +Date: Wed, 2 Jan 2019 17:18:56 +0800 +Subject: ASoC: rt5682: Fix recording no sound issue + +[ Upstream commit 22c7d5e7bad1fb2d8b9c611acb55a389f5d848d8 ] + +The ADC mixer setting needs to restore to default value +after calibration. + +Signed-off-by: Shuming Fan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/rt5682.c b/sound/soc/codecs/rt5682.c +index 34cfaf8f6f345..89c43b26c3790 100644 +--- a/sound/soc/codecs/rt5682.c ++++ b/sound/soc/codecs/rt5682.c +@@ -2512,6 +2512,7 @@ static void rt5682_calibrate(struct rt5682_priv *rt5682) + regmap_write(rt5682->regmap, RT5682_PWR_DIG_1, 0x0000); + regmap_write(rt5682->regmap, RT5682_CHOP_DAC, 0x2000); + regmap_write(rt5682->regmap, RT5682_CALIB_ADC_CTRL, 0x2005); ++ regmap_write(rt5682->regmap, RT5682_STO1_ADC_MIXER, 0xc0c4); + + mutex_unlock(&rt5682->calibrate_mutex); + +-- +2.19.1 + diff --git a/queue-4.20/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch b/queue-4.20/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch new file mode 100644 index 00000000000..c469f872616 --- /dev/null +++ b/queue-4.20/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch @@ -0,0 +1,39 @@ +From 124d4187c40c7c7970f25f36859efc8cf670a35d Mon Sep 17 00:00:00 2001 +From: Yizhuo +Date: Thu, 3 Jan 2019 13:59:12 -0800 +Subject: ASoC: Variable "val" in function rt274_i2c_probe() could be + uninitialized + +[ Upstream commit 8c3590de0a378c2449fc1aec127cc693632458e4 ] + +Inside function rt274_i2c_probe(), if regmap_read() function +returns -EINVAL, then local variable "val" leaves uninitialized +but used in if statement. This is potentially unsafe. + +Signed-off-by: Yizhuo +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt274.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c +index 0ef966d56bac3..e2855ab9a2c6b 100644 +--- a/sound/soc/codecs/rt274.c ++++ b/sound/soc/codecs/rt274.c +@@ -1128,8 +1128,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c, + return ret; + } + +- regmap_read(rt274->regmap, ++ ret = regmap_read(rt274->regmap, + RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ if (ret) ++ return ret; ++ + if (val != RT274_VENDOR_ID) { + dev_err(&i2c->dev, + "Device with ID register %#x is not rt274\n", val); +-- +2.19.1 + diff --git a/queue-4.20/cfg80211-extend-range-deviation-for-dmg.patch b/queue-4.20/cfg80211-extend-range-deviation-for-dmg.patch new file mode 100644 index 00000000000..c9fb2e12cc7 --- /dev/null +++ b/queue-4.20/cfg80211-extend-range-deviation-for-dmg.patch @@ -0,0 +1,43 @@ +From bdb0d5821bd7bd6017b6f78a12ae7c6a890daa2d Mon Sep 17 00:00:00 2001 +From: Chaitanya Tata +Date: Sat, 19 Jan 2019 03:17:47 +0530 +Subject: cfg80211: extend range deviation for DMG + +[ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ] + +Recently, DMG frequency bands have been extended till 71GHz, so extend +the range check till 20GHz (45-71GHZ), else some channels will be marked +as disabled. + +Signed-off-by: Chaitanya Tata +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index ecfb1a06dbb2b..cce4c16eaaa0d 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1255,7 +1255,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd) + * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), + * however it is safe for now to assume that a frequency rule should not be + * part of a frequency's band if the start freq or end freq are off by more +- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the ++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the + * 60 GHz band. + * This resolution can be lowered and should be considered as we add + * regulatory rule support for other "bands". +@@ -1270,7 +1270,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range, + * with the Channel starting frequency above 45 GHz. + */ + u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ? +- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; ++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; + if (abs(freq_khz - freq_range->start_freq_khz) <= limit) + return true; + if (abs(freq_khz - freq_range->end_freq_khz) <= limit) +-- +2.19.1 + diff --git a/queue-4.20/cifs-fix-memory-leak-of-an-allocated-cifs_ntsd-struc.patch b/queue-4.20/cifs-fix-memory-leak-of-an-allocated-cifs_ntsd-struc.patch new file mode 100644 index 00000000000..558760c5883 --- /dev/null +++ b/queue-4.20/cifs-fix-memory-leak-of-an-allocated-cifs_ntsd-struc.patch @@ -0,0 +1,66 @@ +From 95197ada5bd3b6995af0d64aff02f35e27468090 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Wed, 16 Jan 2019 16:28:59 +0000 +Subject: cifs: fix memory leak of an allocated cifs_ntsd structure + +[ Upstream commit 73aaf920cc72024c4a4460cfa46d56e5014172f3 ] + +The call to SMB2_queary_acl can allocate memory to pntsd and also +return a failure via a call to SMB2_query_acl (and then query_info). +This occurs when query_info allocates the structure and then in +query_info the call to smb2_validate_and_copy_iov fails. Currently the +failure just returns without kfree'ing pntsd hence causing a memory +leak. + +Currently, *data is allocated if it's not already pointing to a buffer, +so it needs to be kfree'd only if was allocated in query_info, so the +fix adds an allocated flag to track this. Also set *dlen to zero on +an error just to be safe since *data is kfree'd. + +Also set errno to -ENOMEM if the allocation of *data fails. + +Signed-off-by: Colin Ian King +Signed-off-by: Steve French +Reviewed-by: Dan Carpener +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 28712080add97..3c44c51310c4b 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2714,6 +2714,7 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon, + int resp_buftype = CIFS_NO_BUFFER; + struct cifs_ses *ses = tcon->ses; + int flags = 0; ++ bool allocated = false; + + cifs_dbg(FYI, "Query Info\n"); + +@@ -2753,14 +2754,21 @@ query_info(const unsigned int xid, struct cifs_tcon *tcon, + "Error %d allocating memory for acl\n", + rc); + *dlen = 0; ++ rc = -ENOMEM; + goto qinf_exit; + } ++ allocated = true; + } + } + + rc = smb2_validate_and_copy_iov(le16_to_cpu(rsp->OutputBufferOffset), + le32_to_cpu(rsp->OutputBufferLength), + &rsp_iov, min_len, *data); ++ if (rc && allocated) { ++ kfree(*data); ++ *data = NULL; ++ *dlen = 0; ++ } + + qinf_exit: + SMB2_query_info_free(&rqst); +-- +2.19.1 + diff --git a/queue-4.20/clk-sysfs-fix-invalid-json-in-clk_dump.patch b/queue-4.20/clk-sysfs-fix-invalid-json-in-clk_dump.patch new file mode 100644 index 00000000000..3c1a47c83cc --- /dev/null +++ b/queue-4.20/clk-sysfs-fix-invalid-json-in-clk_dump.patch @@ -0,0 +1,33 @@ +From f700dee41cf4b3372a45f37e80d65af295b3a6b7 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Fri, 4 Jan 2019 23:05:49 +0100 +Subject: clk: sysfs: fix invalid JSON in clk_dump + +[ Upstream commit c6e909972ef87aa2a479269f46b84126f99ec6db ] + +Add a missing comma so that the output is valid JSON format again. + +Fixes: 9fba738a53dd ("clk: add duty cycle support") +Signed-off-by: Lubomir Rintel +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index af011974d4ecb..2bcd9cb26348c 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2782,7 +2782,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + seq_printf(s, "\"protect_count\": %d,", c->protect_count); + seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c)); + seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c)); +- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c)); ++ seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c)); + seq_printf(s, "\"duty_cycle\": %u", + clk_core_get_scaled_duty_cycle(c, 100000)); + } +-- +2.19.1 + diff --git a/queue-4.20/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch b/queue-4.20/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch new file mode 100644 index 00000000000..1941424c9c6 --- /dev/null +++ b/queue-4.20/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch @@ -0,0 +1,38 @@ +From ecb427fcbcaf67f5fe9bda29de5d7a9f8f6293da Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 18 Dec 2018 11:22:41 +0300 +Subject: clk: tegra: dfll: Fix a potential Oop in remove() + +[ Upstream commit d39eca547f3ec67140a5d765a426eb157b978a59 ] + +If tegra_dfll_unregister() fails then "soc" is an error pointer. We +should just return instead of dereferencing it. + +Fixes: 1752c9ee23fb ("clk: tegra: dfll: Fix drvdata overwriting issue") +Signed-off-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra124-dfll-fcpu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +index 269d3595758be..edc31bb56674a 100644 +--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c ++++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev) + struct tegra_dfll_soc_data *soc; + + soc = tegra_dfll_unregister(pdev); +- if (IS_ERR(soc)) ++ if (IS_ERR(soc)) { + dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n", + PTR_ERR(soc)); ++ return PTR_ERR(soc); ++ } + + tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq); + +-- +2.19.1 + diff --git a/queue-4.20/clk-vc5-abort-clock-configuration-without-upstream-c.patch b/queue-4.20/clk-vc5-abort-clock-configuration-without-upstream-c.patch new file mode 100644 index 00000000000..155be977181 --- /dev/null +++ b/queue-4.20/clk-vc5-abort-clock-configuration-without-upstream-c.patch @@ -0,0 +1,49 @@ +From bca37a00ecd007893918f7a95b3ea31a2191c265 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 15 Dec 2018 01:55:19 +0100 +Subject: clk: vc5: Abort clock configuration without upstream clock + +[ Upstream commit 2137a109a5e39c2bdccfffe65230ed3fadbaac0e ] + +In case the upstream clock are not set, which can happen in case the +VC5 has no valid upstream clock, the $src variable is used uninited +by regmap_update_bits(). Check for this condition and return -EINVAL +in such case. + +Note that in case the VC5 has no valid upstream clock, the VC5 can +not operate correctly. That is a hardware property of the VC5. The +internal oscilator present in some VC5 models is also considered +upstream clock. + +Signed-off-by: Marek Vasut +Cc: Alexey Firago +Cc: Laurent Pinchart +Cc: Stephen Boyd +Cc: linux-renesas-soc@vger.kernel.org +[sboyd@kernel.org: Added comment about probe preventing this from +happening in the first place] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index decffb3826ece..a738af893532f 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index) + + if (vc5->clk_mux_ins == VC5_MUX_IN_XIN) + src = VC5_PRIM_SRC_SHDN_EN_XTAL; +- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) ++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) + src = VC5_PRIM_SRC_SHDN_EN_CLKIN; ++ else /* Invalid; should have been caught by vc5_probe() */ ++ return -EINVAL; + } + + return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src); +-- +2.19.1 + diff --git a/queue-4.20/direct-io-allow-direct-writes-to-empty-inodes.patch b/queue-4.20/direct-io-allow-direct-writes-to-empty-inodes.patch new file mode 100644 index 00000000000..df6736eface --- /dev/null +++ b/queue-4.20/direct-io-allow-direct-writes-to-empty-inodes.patch @@ -0,0 +1,56 @@ +From 478f29d49d4f18080400a37236a0342fd8921f43 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?= + +Date: Mon, 8 Oct 2018 20:58:23 -0300 +Subject: direct-io: allow direct writes to empty inodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 8b9433eb4de3c26a9226c981c283f9f4896ae030 ] + +On a DIO_SKIP_HOLES filesystem, the ->get_block() method is currently +not allowed to create blocks for an empty inode. This confusion comes +from trying to bit shift a negative number, so check the size of the +inode first. + +The problem is most visible for hfsplus, because the fallback to +buffered I/O doesn't happen and the write fails with EIO. This is in +part the fault of the module, because it gives a wrong return value on +->get_block(); that will be fixed in a separate patch. + +Reviewed-by: Jeff Moyer +Reviewed-by: Jan Kara +Signed-off-by: Ernesto A. Fernández +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/direct-io.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/direct-io.c b/fs/direct-io.c +index 41a0e97252aed..7d3f2c1d141dc 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + unsigned long fs_count; /* Number of filesystem-sized blocks */ + int create; + unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor; ++ loff_t i_size; + + /* + * If there was a memory error and we've overwritten all the +@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + */ + create = dio->op == REQ_OP_WRITE; + if (dio->flags & DIO_SKIP_HOLES) { +- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >> +- i_blkbits)) ++ i_size = i_size_read(dio->inode); ++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits) + create = 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch b/queue-4.20/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch new file mode 100644 index 00000000000..f397519e974 --- /dev/null +++ b/queue-4.20/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch @@ -0,0 +1,113 @@ +From 16337008e4d3e60ca40324662faed3728f4f2a7e Mon Sep 17 00:00:00 2001 +From: Aaron Hill +Date: Mon, 24 Dec 2018 14:23:36 -0500 +Subject: drivers: thermal: int340x_thermal: Fix sysfs race condition + +[ Upstream commit 129699bb8c7572106b5bbb2407c2daee4727ccad ] + +Changes since V1: +* Use dev_info instead of printk +* Use dev_warn instead of BUG_ON + +Previously, sysfs_create_group was called before all initialization had +fully run - specifically, before pci_set_drvdata was called. Since the +sysctl group is visible to userspace as soon as sysfs_create_group +returns, a small window of time existed during which a process could read +from an uninitialized/partially-initialized device. + +This commit moves the creation of the sysctl group to after all +initialized is completed. This ensures that it's impossible for +userspace to read from a sysctl file before initialization has fully +completed. + +To catch any future regressions, I've added a check to ensure +that proc_thermal_emum_mode is never PROC_THERMAL_NONE when a process +tries to read from a sysctl file. Previously, the aforementioned race +condition could result in the 'else' branch +running while PROC_THERMAL_NONE was set, +leading to a null pointer deference. + +Signed-off-by: Aaron Hill +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + .../processor_thermal_device.c | 28 ++++++++++--------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index 8e0f665cf06f8..8e1cf4d789be1 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \ + struct pci_dev *pci_dev; \ + struct platform_device *pdev; \ + struct proc_thermal_device *proc_dev; \ +-\ ++ \ ++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \ ++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \ ++ return 0; \ ++ } \ ++ \ + if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \ + pdev = to_platform_device(dev); \ + proc_dev = platform_get_drvdata(pdev); \ +@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev, + *priv = proc_priv; + + ret = proc_thermal_read_ppcc(proc_priv); +- if (!ret) { +- ret = sysfs_create_group(&dev->kobj, +- &power_limit_attribute_group); +- +- } + if (ret) + return ret; + +@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev, + + proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops); + if (IS_ERR(proc_priv->int340x_zone)) { +- ret = PTR_ERR(proc_priv->int340x_zone); +- goto remove_group; ++ return PTR_ERR(proc_priv->int340x_zone); + } else + ret = 0; + +@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev, + + remove_zone: + int340x_thermal_zone_remove(proc_priv->int340x_zone); +-remove_group: +- sysfs_remove_group(&proc_priv->dev->kobj, +- &power_limit_attribute_group); + + return ret; + } +@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev) + platform_set_drvdata(pdev, proc_priv); + proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV; + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static int int3401_remove(struct platform_device *pdev) +@@ -441,7 +440,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "No auxiliary DTSs enabled\n"); + } + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static void proc_thermal_pci_remove(struct pci_dev *pdev) +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-powerplay-od-setting-fix-on-vega10.patch b/queue-4.20/drm-amd-powerplay-od-setting-fix-on-vega10.patch new file mode 100644 index 00000000000..37e079446c9 --- /dev/null +++ b/queue-4.20/drm-amd-powerplay-od-setting-fix-on-vega10.patch @@ -0,0 +1,61 @@ +From 8cca040d246a7634d2ebfe00bb2b7d57621ca584 Mon Sep 17 00:00:00 2001 +From: Kenneth Feng +Date: Fri, 18 Jan 2019 18:08:19 +0800 +Subject: drm/amd/powerplay: OD setting fix on Vega10 + +[ Upstream commit 6d87dc97eb3341de3f7b1efa3156cb0e014f4a96 ] + +gfxclk for OD setting is limited to 1980M for non-acg +ASICs of Vega10 + +Signed-off-by: Kenneth Feng +Reviewed-by: Evan Quan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../powerplay/hwmgr/vega10_processpptables.c | 22 ++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +index b8747a5c9204d..99d596dc0e897 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +@@ -32,6 +32,7 @@ + #include "vega10_pptable.h" + + #define NUM_DSPCLK_LEVELS 8 ++#define VEGA10_ENGINECLOCK_HARDMAX 198000 + + static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable, + enum phm_platform_caps cap) +@@ -258,7 +259,26 @@ static int init_over_drive_limits( + struct pp_hwmgr *hwmgr, + const ATOM_Vega10_POWERPLAYTABLE *powerplay_table) + { +- hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table = ++ (const ATOM_Vega10_GFXCLK_Dependency_Table *) ++ (((unsigned long) powerplay_table) + ++ le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset)); ++ bool is_acg_enabled = false; ++ ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2; ++ ++ if (gfxclk_dep_table->ucRevId == 1) { ++ patom_record_v2 = ++ (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries; ++ is_acg_enabled = ++ (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable; ++ } ++ ++ if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX && ++ !is_acg_enabled) ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ VEGA10_ENGINECLOCK_HARDMAX; ++ else ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = + le32_to_cpu(powerplay_table->ulMaxODEngineClock); + hwmgr->platform_descriptor.overdriveLimit.memoryClock = + le32_to_cpu(powerplay_table->ulMaxODMemoryClock); +-- +2.19.1 + diff --git a/queue-4.20/drm-msm-avoid-unused-function-warning.patch b/queue-4.20/drm-msm-avoid-unused-function-warning.patch new file mode 100644 index 00000000000..b62f1207f5f --- /dev/null +++ b/queue-4.20/drm-msm-avoid-unused-function-warning.patch @@ -0,0 +1,65 @@ +From 073153f4173667c2091192ce9c226e9525d5ee67 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 10 Jan 2019 15:14:03 +0100 +Subject: drm/msm: avoid unused function warning + +[ Upstream commit a840f690d3c6f2f27425ca7e7bd2d635cdec07d7 ] + +drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:368:13: error: 'dpu_plane_danger_signal_ctrl' defined but not used [-Werror=unused-function] + +Fixes: 7b2e7adea732 ("drm/msm/dpu: Make dpu_plane_danger_signal_ctrl void") +Signed-off-by: Arnd Bergmann +Signed-off-by: Anders Roxell +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 26 +++++++++++------------ + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index f549daf30fe6d..1d155a7cb08c3 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -365,19 +365,6 @@ static void _dpu_plane_set_qos_ctrl(struct drm_plane *plane, + &pdpu->pipe_qos_cfg); + } + +-static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable) +-{ +- struct dpu_plane *pdpu = to_dpu_plane(plane); +- struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane); +- +- if (!pdpu->is_rt_pipe) +- return; +- +- pm_runtime_get_sync(&dpu_kms->pdev->dev); +- _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL); +- pm_runtime_put_sync(&dpu_kms->pdev->dev); +-} +- + /** + * _dpu_plane_set_ot_limit - set OT limit for the given plane + * @plane: Pointer to drm plane +@@ -1271,6 +1258,19 @@ static void dpu_plane_reset(struct drm_plane *plane) + } + + #ifdef CONFIG_DEBUG_FS ++static void dpu_plane_danger_signal_ctrl(struct drm_plane *plane, bool enable) ++{ ++ struct dpu_plane *pdpu = to_dpu_plane(plane); ++ struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane); ++ ++ if (!pdpu->is_rt_pipe) ++ return; ++ ++ pm_runtime_get_sync(&dpu_kms->pdev->dev); ++ _dpu_plane_set_qos_ctrl(plane, enable, DPU_PLANE_QOS_PANIC_CTRL); ++ pm_runtime_put_sync(&dpu_kms->pdev->dev); ++} ++ + static ssize_t _dpu_plane_danger_read(struct file *file, + char __user *buff, size_t count, loff_t *ppos) + { +-- +2.19.1 + diff --git a/queue-4.20/drm-msm-fix-a6xx-support-for-opp-level.patch b/queue-4.20/drm-msm-fix-a6xx-support-for-opp-level.patch new file mode 100644 index 00000000000..4b19913b46c --- /dev/null +++ b/queue-4.20/drm-msm-fix-a6xx-support-for-opp-level.patch @@ -0,0 +1,49 @@ +From a86cda3b0c77aa2134fafc1f076ce4cc98758a73 Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Wed, 16 Jan 2019 10:46:21 -0800 +Subject: drm/msm: Fix A6XX support for opp-level + +[ Upstream commit a3c5e2cd79753121f49a8662c1e0a60ddb5486ca ] + +The bindings for Qualcomm opp levels changed after being Acked but +before landing. Thus the code in the GPU driver that was relying on +the old bindings is now broken. + +Let's change the code to match the new bindings by adjusting the old +string 'qcom,level' to the new string 'opp-level'. See the patch +("dt-bindings: opp: Introduce opp-level bindings"). + +NOTE: we will do additional cleanup to totally remove the string from +the code and use the new dev_pm_opp_get_level() but we'll do it in a +future patch. This will facilitate getting the important code fix in +sooner without having to deal with cross-maintainer dependencies. + +This patch needs to land before the patch ("arm64: dts: sdm845: Add +gpu and gmu device nodes") since if a tree contains the device tree +patch but not this one you'll get a crash at bootup. + +Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") +Signed-off-by: Douglas Anderson +Reviewed-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index d4e98e5876bc4..00b2e6e94689f 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -939,7 +939,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq) + np = dev_pm_opp_get_of_node(opp); + + if (np) { +- of_property_read_u32(np, "qcom,level", &val); ++ of_property_read_u32(np, "opp-level", &val); + of_node_put(np); + } + +-- +2.19.1 + diff --git a/queue-4.20/drm-msm-unblock-writer-if-reader-closes-file.patch b/queue-4.20/drm-msm-unblock-writer-if-reader-closes-file.patch new file mode 100644 index 00000000000..6c369602ec0 --- /dev/null +++ b/queue-4.20/drm-msm-unblock-writer-if-reader-closes-file.patch @@ -0,0 +1,45 @@ +From 4c59c5456a1b7591121cde6939f90dbd48166514 Mon Sep 17 00:00:00 2001 +From: "Kristian H. Kristensen" +Date: Wed, 19 Dec 2018 08:57:41 -0800 +Subject: drm/msm: Unblock writer if reader closes file + +[ Upstream commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd ] + +Prevents deadlock when fifo is full and reader closes file. + +Signed-off-by: Kristian H. Kristensen +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_rd.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c +index 0c2c8d2c631f3..25fc161ab6181 100644 +--- a/drivers/gpu/drm/msm/msm_rd.c ++++ b/drivers/gpu/drm/msm/msm_rd.c +@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz) + char *fptr = &fifo->buf[fifo->head]; + int n; + +- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0); ++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open); ++ if (!rd->open) ++ return; + + /* Note that smp_load_acquire() is not strictly required + * as CIRC_SPACE_TO_END() does not access the tail more +@@ -213,7 +215,10 @@ static int rd_open(struct inode *inode, struct file *file) + static int rd_release(struct inode *inode, struct file *file) + { + struct msm_rd_state *rd = inode->i_private; ++ + rd->open = false; ++ wake_up_all(&rd->fifo_event); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch b/queue-4.20/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch new file mode 100644 index 00000000000..19553593516 --- /dev/null +++ b/queue-4.20/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch @@ -0,0 +1,50 @@ +From 9e9f1492bde78124db2e2262c8a6fa3ecee49312 Mon Sep 17 00:00:00 2001 +From: Priit Laes +Date: Tue, 22 Jan 2019 09:32:32 +0200 +Subject: drm/sun4i: hdmi: Fix usage of TMDS clock + +[ Upstream commit 5e1bc251cebc84b41b8eb5d2434e54d939a85430 ] + +Although TMDS clock is required for HDMI to properly function, +nobody called clk_prepare_enable(). This fixes reference counting +issues and makes sure clock is running when it needs to be running. + +Due to TDMS clock being parent clock for DDC clock, TDMS clock +was turned on/off for each EDID probe, causing spurious failures +for certain HDMI/DVI screens. + +Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") +Signed-off-by: Priit Laes +[Maxime: Moved the TMDS clock enable earlier] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20190122073232.7240-1-plaes@plaes.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index 061d2e0d9011e..416da53767018 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder) + val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG); + val &= ~SUN4I_HDMI_VID_CTRL_ENABLE; + writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG); ++ ++ clk_disable_unprepare(hdmi->tmds_clk); + } + + static void sun4i_hdmi_enable(struct drm_encoder *encoder) +@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder) + + DRM_DEBUG_DRIVER("Enabling the HDMI Output\n"); + ++ clk_prepare_enable(hdmi->tmds_clk); ++ + sun4i_hdmi_setup_avi_infoframes(hdmi, mode); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END); +-- +2.19.1 + diff --git a/queue-4.20/futex-fix-possible-missed-wakeup.patch b/queue-4.20/futex-fix-possible-missed-wakeup.patch new file mode 100644 index 00000000000..25bbb429449 --- /dev/null +++ b/queue-4.20/futex-fix-possible-missed-wakeup.patch @@ -0,0 +1,61 @@ +From d1f7c7dce5551c3df8e7bf73e3701d81fd760b40 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 29 Nov 2018 14:44:49 +0100 +Subject: futex: Fix (possible) missed wakeup + +[ Upstream commit b061c38bef43406df8e73c5be06cbfacad5ee6ad ] + +We must not rely on wake_q_add() to delay the wakeup; in particular +commit: + + 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") + +moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which +could result in futex_wait() waking before observing ->lock_ptr == +NULL and going back to sleep again. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/futex.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index 4d1b7db04e105..48449897476d5 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1444,11 +1444,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n")) + return; + +- /* +- * Queue the task for later wakeup for after we've released +- * the hb->lock. wake_q_add() grabs reference to p. +- */ +- wake_q_add(wake_q, p); ++ get_task_struct(p); + __unqueue_futex(q); + /* + * The waiting task can free the futex_q as soon as q->lock_ptr = NULL +@@ -1458,6 +1454,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + * plist_del in __unqueue_futex(). + */ + smp_store_release(&q->lock_ptr, NULL); ++ ++ /* ++ * Queue the task for later wakeup for after we've released ++ * the hb->lock. wake_q_add() grabs reference to p. ++ */ ++ wake_q_add(wake_q, p); ++ put_task_struct(p); + } + + /* +-- +2.19.1 + diff --git a/queue-4.20/genirq-make-sure-the-initial-affinity-is-not-empty.patch b/queue-4.20/genirq-make-sure-the-initial-affinity-is-not-empty.patch new file mode 100644 index 00000000000..8e051f5c197 --- /dev/null +++ b/queue-4.20/genirq-make-sure-the-initial-affinity-is-not-empty.patch @@ -0,0 +1,40 @@ +From be85699040c21a28f7de7dd025e6ade1e991fd58 Mon Sep 17 00:00:00 2001 +From: Srinivas Ramana +Date: Thu, 20 Dec 2018 19:05:57 +0530 +Subject: genirq: Make sure the initial affinity is not empty + +[ Upstream commit bddda606ec76550dd63592e32a6e87e7d32583f7 ] + +If all CPUs in the irq_default_affinity mask are offline when an interrupt +is initialized then irq_setup_affinity() can set an empty affinity mask for +a newly allocated interrupt. + +Fix this by falling back to cpu_online_mask in case the resulting affinity +mask is zero. + +Signed-off-by: Srinivas Ramana +Signed-off-by: Thomas Gleixner +Cc: linux-arm-msm@vger.kernel.org +Link: https://lkml.kernel.org/r/1545312957-8504-1-git-send-email-sramana@codeaurora.org +Signed-off-by: Sasha Levin +--- + kernel/irq/manage.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 9dbdccab3b6a3..5c0ba5ca59308 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc) + } + + cpumask_and(&mask, cpu_online_mask, set); ++ if (cpumask_empty(&mask)) ++ cpumask_copy(&mask, cpu_online_mask); ++ + if (node != NUMA_NO_NODE) { + const struct cpumask *nodemask = cpumask_of_node(node); + +-- +2.19.1 + diff --git a/queue-4.20/hid-i2c-hid-disable-runtime-pm-on-goodix-touchpad.patch b/queue-4.20/hid-i2c-hid-disable-runtime-pm-on-goodix-touchpad.patch new file mode 100644 index 00000000000..da5f7ec6646 --- /dev/null +++ b/queue-4.20/hid-i2c-hid-disable-runtime-pm-on-goodix-touchpad.patch @@ -0,0 +1,54 @@ +From abce6f69e87feba3fd3a91b077fb19ebac2f1df2 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 14 Jan 2019 16:47:34 +0800 +Subject: HID: i2c-hid: Disable runtime PM on Goodix touchpad + +[ Upstream commit 77ae0d8e401f083ca69c202502da4fc0e38cb1b7 ] + +A Goodix touchpad doesn't work. Touching the touchpad can trigger IRQ +but there's no input event from HID subsystem. + +Turns out it reports some invalid data: +[ 22.136630] i2c_hid i2c-DELL091F:00: input: 0b 00 01 00 00 00 00 00 00 00 00 + +After some trial and error, it's another device that doesn't work well +with ON/SLEEP commands. Disable runtime PM to fix the issue. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 27519eb8ee636..81bc2f6b93a34 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -459,6 +459,9 @@ + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_010A 0x010a + #define USB_DEVICE_ID_GENERAL_TOUCH_WIN8_PIT_E100 0xe100 + ++#define I2C_VENDOR_ID_GOODIX 0x27c6 ++#define I2C_DEVICE_ID_GOODIX_01F0 0x01f0 ++ + #define USB_VENDOR_ID_GOODTOUCH 0x1aad + #define USB_DEVICE_ID_GOODTOUCH_000f 0x000f + +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 8555ce7e737b3..c5edfa966343d 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -179,6 +179,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_DELAY_AFTER_SLEEP }, + { USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_8001, + I2C_HID_QUIRK_NO_RUNTIME_PM }, ++ { I2C_VENDOR_ID_GOODIX, I2C_DEVICE_ID_GOODIX_01F0, ++ I2C_HID_QUIRK_NO_RUNTIME_PM }, + { 0, 0 } + }; + +-- +2.19.1 + diff --git a/queue-4.20/hv_netvsc-fix-ethtool-change-hash-key-error.patch b/queue-4.20/hv_netvsc-fix-ethtool-change-hash-key-error.patch new file mode 100644 index 00000000000..fbc344a0ec9 --- /dev/null +++ b/queue-4.20/hv_netvsc-fix-ethtool-change-hash-key-error.patch @@ -0,0 +1,81 @@ +From c7b4db6723f6d8f72035612b616a62b70a2742dc Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:42 +0000 +Subject: hv_netvsc: Fix ethtool change hash key error + +[ Upstream commit b4a10c750424e01b5e37372fef0a574ebf7b56c3 ] + +Hyper-V hosts require us to disable RSS before changing RSS key, +otherwise the changing request will fail. This patch fixes the +coding error. + +Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") +Reported-by: Wei Hu +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/rndis_filter.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 8b537a049c1e5..a4661d396e3cd 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -774,8 +774,8 @@ rndis_filter_set_offload_params(struct net_device *ndev, + return ret; + } + +-int rndis_filter_set_rss_param(struct rndis_device *rdev, +- const u8 *rss_key) ++static int rndis_set_rss_param_msg(struct rndis_device *rdev, ++ const u8 *rss_key, u16 flag) + { + struct net_device *ndev = rdev->ndev; + struct rndis_request *request; +@@ -804,7 +804,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS; + rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2; + rssp->hdr.size = sizeof(struct ndis_recv_scale_param); +- rssp->flag = 0; ++ rssp->flag = flag; + rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 | + NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 | + NDIS_HASH_TCP_IPV6; +@@ -829,9 +829,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + + wait_for_completion(&request->wait_event); + set_complete = &request->response_msg.msg.set_complete; +- if (set_complete->status == RNDIS_STATUS_SUCCESS) +- memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); +- else { ++ if (set_complete->status == RNDIS_STATUS_SUCCESS) { ++ if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) && ++ !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED)) ++ memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); ++ ++ } else { + netdev_err(ndev, "Fail to set RSS parameters:0x%x\n", + set_complete->status); + ret = -EINVAL; +@@ -842,6 +845,16 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + return ret; + } + ++int rndis_filter_set_rss_param(struct rndis_device *rdev, ++ const u8 *rss_key) ++{ ++ /* Disable RSS before change */ ++ rndis_set_rss_param_msg(rdev, rss_key, ++ NDIS_RSS_PARAM_FLAG_DISABLE_RSS); ++ ++ return rndis_set_rss_param_msg(rdev, rss_key, 0); ++} ++ + static int rndis_filter_query_device_link_status(struct rndis_device *dev, + struct netvsc_device *net_device) + { +-- +2.19.1 + diff --git a/queue-4.20/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch b/queue-4.20/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch new file mode 100644 index 00000000000..7488fa8b963 --- /dev/null +++ b/queue-4.20/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch @@ -0,0 +1,133 @@ +From 080716184e94b8f3f8205dcefdc95b9a5c488322 Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:44 +0000 +Subject: hv_netvsc: Fix hash key value reset after other ops + +[ Upstream commit 17d91256898402daf4425cc541ac9cbf64574d9a ] + +Changing mtu, channels, or buffer sizes ops call to netvsc_attach(), +rndis_set_subchannel(), which always reset the hash key to default +value. That will override hash key changed previously. This patch +fixes the problem by save the hash key, then restore it when we re- +add the netvsc device. + +Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/hyperv_net.h | 10 +++++++--- + drivers/net/hyperv/netvsc.c | 2 +- + drivers/net/hyperv/netvsc_drv.c | 5 ++++- + drivers/net/hyperv/rndis_filter.c | 9 +++++++-- + 4 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index ef6f766f63893..e598a684700b2 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -144,6 +144,8 @@ struct hv_netvsc_packet { + u32 total_data_buflen; + }; + ++#define NETVSC_HASH_KEYLEN 40 ++ + struct netvsc_device_info { + unsigned char mac_adr[ETH_ALEN]; + u32 num_chn; +@@ -151,6 +153,8 @@ struct netvsc_device_info { + u32 recv_sections; + u32 send_section_size; + u32 recv_section_size; ++ ++ u8 rss_key[NETVSC_HASH_KEYLEN]; + }; + + enum rndis_device_state { +@@ -160,8 +164,6 @@ enum rndis_device_state { + RNDIS_DEV_DATAINITIALIZED, + }; + +-#define NETVSC_HASH_KEYLEN 40 +- + struct rndis_device { + struct net_device *ndev; + +@@ -209,7 +211,9 @@ int netvsc_recv_callback(struct net_device *net, + void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev); ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info); + int rndis_filter_open(struct netvsc_device *nvdev); + int rndis_filter_close(struct netvsc_device *nvdev); + struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 922054c1d5448..1910810e55bd7 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w) + + rdev = nvdev->extension; + if (rdev) { +- ret = rndis_set_subchannel(rdev->ndev, nvdev); ++ ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL); + if (ret == 0) { + netif_device_attach(rdev->ndev); + } else { +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 4055e12fce9ac..80d9297ad9d9c 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -876,6 +876,9 @@ static struct netvsc_device_info *netvsc_devinfo_get + dev_info->send_section_size = nvdev->send_section_size; + dev_info->recv_sections = nvdev->recv_section_cnt; + dev_info->recv_section_size = nvdev->recv_section_size; ++ ++ memcpy(dev_info->rss_key, nvdev->extension->rss_key, ++ NETVSC_HASH_KEYLEN); + } else { + dev_info->num_chn = VRSS_CHANNEL_DEFAULT; + dev_info->send_sections = NETVSC_DEFAULT_TX; +@@ -938,7 +941,7 @@ static int netvsc_attach(struct net_device *ndev, + return PTR_ERR(nvdev); + + if (nvdev->num_chn > 1) { +- ret = rndis_set_subchannel(ndev, nvdev); ++ ret = rndis_set_subchannel(ndev, nvdev, dev_info); + + /* if unavailable, just proceed with one queue */ + if (ret) { +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index a4661d396e3cd..db81378e66242 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1134,7 +1134,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) + * This breaks overlap of processing the host message for the + * new primary channel with the initialization of sub-channels. + */ +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info) + { + struct nvsp_message *init_packet = &nvdev->channel_init_pkt; + struct net_device_context *ndev_ctx = netdev_priv(ndev); +@@ -1175,7 +1177,10 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) + atomic_read(&nvdev->open_chn) == nvdev->num_chn); + + /* ignore failues from setting rss parameters, still have channels */ +- rndis_filter_set_rss_param(rdev, netvsc_hash_key); ++ if (dev_info) ++ rndis_filter_set_rss_param(rdev, dev_info->rss_key); ++ else ++ rndis_filter_set_rss_param(rdev, netvsc_hash_key); + + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); +-- +2.19.1 + diff --git a/queue-4.20/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch b/queue-4.20/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch new file mode 100644 index 00000000000..3edd19ae673 --- /dev/null +++ b/queue-4.20/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch @@ -0,0 +1,278 @@ +From 0ef1c71ca4d48133855add05af94a5b1858fbcec Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:43 +0000 +Subject: hv_netvsc: Refactor assignments of struct netvsc_device_info + +[ Upstream commit 7c9f335a3ff20557a92584199f3d35c7e992bbe5 ] + +These assignments occur in multiple places. The patch refactor them +to a function for simplicity. It also puts the struct to heap area +for future expension. + +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc_drv.c | 134 ++++++++++++++++++++------------ + 1 file changed, 85 insertions(+), 49 deletions(-) + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index cf36e7ff31919..4055e12fce9ac 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -857,6 +857,36 @@ static void netvsc_get_channels(struct net_device *net, + } + } + ++/* Alloc struct netvsc_device_info, and initialize it from either existing ++ * struct netvsc_device, or from default values. ++ */ ++static struct netvsc_device_info *netvsc_devinfo_get ++ (struct netvsc_device *nvdev) ++{ ++ struct netvsc_device_info *dev_info; ++ ++ dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC); ++ ++ if (!dev_info) ++ return NULL; ++ ++ if (nvdev) { ++ dev_info->num_chn = nvdev->num_chn; ++ dev_info->send_sections = nvdev->send_section_cnt; ++ dev_info->send_section_size = nvdev->send_section_size; ++ dev_info->recv_sections = nvdev->recv_section_cnt; ++ dev_info->recv_section_size = nvdev->recv_section_size; ++ } else { ++ dev_info->num_chn = VRSS_CHANNEL_DEFAULT; ++ dev_info->send_sections = NETVSC_DEFAULT_TX; ++ dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE; ++ dev_info->recv_sections = NETVSC_DEFAULT_RX; ++ dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE; ++ } ++ ++ return dev_info; ++} ++ + static int netvsc_detach(struct net_device *ndev, + struct netvsc_device *nvdev) + { +@@ -942,7 +972,7 @@ static int netvsc_set_channels(struct net_device *net, + struct net_device_context *net_device_ctx = netdev_priv(net); + struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); + unsigned int orig, count = channels->combined_count; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret; + + /* We do not support separate count for rx, tx, or other */ +@@ -961,24 +991,26 @@ static int netvsc_set_channels(struct net_device *net, + + orig = nvdev->num_chn; + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = count; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->num_chn = count; + + ret = netvsc_detach(net, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(net, &device_info); ++ ret = netvsc_attach(net, device_info); + if (ret) { +- device_info.num_chn = orig; +- if (netvsc_attach(net, &device_info)) ++ device_info->num_chn = orig; ++ if (netvsc_attach(net, device_info)) + netdev_err(net, "restoring channel setting failed\n"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1047,48 +1079,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); + int orig_mtu = ndev->mtu; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret = 0; + + if (!nvdev || nvdev->destroy) + return -ENODEV; + ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ + /* Change MTU of underlying VF netdev first. */ + if (vf_netdev) { + ret = dev_set_mtu(vf_netdev, mtu); + if (ret) +- return ret; ++ goto out; + } + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; +- + ret = netvsc_detach(ndev, nvdev); + if (ret) + goto rollback_vf; + + ndev->mtu = mtu; + +- ret = netvsc_attach(ndev, &device_info); +- if (ret) +- goto rollback; +- +- return 0; ++ ret = netvsc_attach(ndev, device_info); ++ if (!ret) ++ goto out; + +-rollback: + /* Attempt rollback to original MTU */ + ndev->mtu = orig_mtu; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring mtu failed\n"); + rollback_vf: + if (vf_netdev) + dev_set_mtu(vf_netdev, orig_mtu); + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1673,7 +1702,7 @@ static int netvsc_set_ringparam(struct net_device *ndev, + { + struct net_device_context *ndevctx = netdev_priv(ndev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + struct ethtool_ringparam orig; + u32 new_tx, new_rx; + int ret = 0; +@@ -1693,26 +1722,29 @@ static int netvsc_set_ringparam(struct net_device *ndev, + new_rx == orig.rx_pending) + return 0; /* no change */ + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = new_tx; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = new_rx; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->send_sections = new_tx; ++ device_info->recv_sections = new_rx; + + ret = netvsc_detach(ndev, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(ndev, &device_info); ++ ret = netvsc_attach(ndev, device_info); + if (ret) { +- device_info.send_sections = orig.tx_pending; +- device_info.recv_sections = orig.rx_pending; ++ device_info->send_sections = orig.tx_pending; ++ device_info->recv_sections = orig.rx_pending; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring ringparam failed"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -2166,7 +2198,7 @@ static int netvsc_probe(struct hv_device *dev, + { + struct net_device *net = NULL; + struct net_device_context *net_device_ctx; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info = NULL; + struct netvsc_device *nvdev; + int ret = -ENOMEM; + +@@ -2213,21 +2245,21 @@ static int netvsc_probe(struct hv_device *dev, + netif_set_real_num_rx_queues(net, 1); + + /* Notify the netvsc driver of the new device */ +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = VRSS_CHANNEL_DEFAULT; +- device_info.send_sections = NETVSC_DEFAULT_TX; +- device_info.send_section_size = NETVSC_SEND_SECTION_SIZE; +- device_info.recv_sections = NETVSC_DEFAULT_RX; +- device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE; +- +- nvdev = rndis_filter_device_add(dev, &device_info); ++ device_info = netvsc_devinfo_get(NULL); ++ ++ if (!device_info) { ++ ret = -ENOMEM; ++ goto devinfo_failed; ++ } ++ ++ nvdev = rndis_filter_device_add(dev, device_info); + if (IS_ERR(nvdev)) { + ret = PTR_ERR(nvdev); + netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); + goto rndis_failed; + } + +- memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); ++ memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN); + + /* We must get rtnl lock before scheduling nvdev->subchan_work, + * otherwise netvsc_subchan_work() can get rtnl lock first and wait +@@ -2265,12 +2297,16 @@ static int netvsc_probe(struct hv_device *dev, + + list_add(&net_device_ctx->list, &netvsc_dev_list); + rtnl_unlock(); ++ ++ kfree(device_info); + return 0; + + register_failed: + rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: ++ kfree(device_info); ++devinfo_failed: + free_percpu(net_device_ctx->vf_stats); + no_stats: + hv_set_drvdata(dev, NULL); +-- +2.19.1 + diff --git a/queue-4.20/ibmveth-do-not-process-frames-after-calling-napi_res.patch b/queue-4.20/ibmveth-do-not-process-frames-after-calling-napi_res.patch new file mode 100644 index 00000000000..cdbdcbb3ef2 --- /dev/null +++ b/queue-4.20/ibmveth-do-not-process-frames-after-calling-napi_res.patch @@ -0,0 +1,43 @@ +From f226b334e092e66831208d9e41a81fa8fe3901d2 Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Thu, 24 Jan 2019 11:17:01 -0600 +Subject: ibmveth: Do not process frames after calling napi_reschedule + +[ Upstream commit e95d22c69b2c130ccce257b84daf283fd82d611e ] + +The IBM virtual ethernet driver's polling function continues +to process frames after rescheduling NAPI, resulting in a warning +if it exhausted its budget. Do not restart polling after calling +napi_reschedule. Instead let frames be processed in the following +instance. + +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmveth.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 098d8764c0ea9..dd71d5db72747 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1313,7 +1313,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + unsigned long lpar_rc; + u16 mss = 0; + +-restart_poll: + while (frames_processed < budget) { + if (!ibmveth_rxq_pending_buffer(adapter)) + break; +@@ -1401,7 +1400,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + napi_reschedule(napi)) { + lpar_rc = h_vio_signal(adapter->vdev->unit_address, + VIO_IRQ_DISABLE); +- goto restart_poll; + } + } + +-- +2.19.1 + diff --git a/queue-4.20/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch b/queue-4.20/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch new file mode 100644 index 00000000000..b2eb25ada55 --- /dev/null +++ b/queue-4.20/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch @@ -0,0 +1,34 @@ +From 9ec18d115db44bb9c0a3f66379c0447608c6a96a Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Fri, 26 Oct 2018 15:51:17 +0800 +Subject: irqchip/gic-v3-mbi: Fix uninitialized mbi_lock + +[ Upstream commit c530bb8a726a37811e9fb5d68cd6b5408173b545 ] + +The mbi_lock mutex is left uninitialized, so let's use DEFINE_MUTEX +to initialize it statically. + +Fixes: 505287525c24d ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller") +Signed-off-by: Yang Yingliang +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-mbi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c +index ad70e7c416e30..fbfa7ff6deb16 100644 +--- a/drivers/irqchip/irq-gic-v3-mbi.c ++++ b/drivers/irqchip/irq-gic-v3-mbi.c +@@ -24,7 +24,7 @@ struct mbi_range { + unsigned long *bm; + }; + +-static struct mutex mbi_lock; ++static DEFINE_MUTEX(mbi_lock); + static phys_addr_t mbi_phys_base; + static struct mbi_range *mbi_ranges; + static unsigned int mbi_range_nr; +-- +2.19.1 + diff --git a/queue-4.20/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch b/queue-4.20/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch new file mode 100644 index 00000000000..62b90a89ac4 --- /dev/null +++ b/queue-4.20/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch @@ -0,0 +1,47 @@ +From 8e7e7ba9d1d6d2187bd66a970d22ce24c5d0c45e Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Mon, 7 Jan 2019 19:44:51 +0100 +Subject: KVM: nSVM: clear events pending from svm_complete_interrupts() when + exiting to L1 + +[ Upstream commit 619ad846fc3452adaf71ca246c5aa711e2055398 ] + +kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being +delivered to the host (L1) when it's running nested. The problem seems to +be: svm_complete_interrupts() raises 'nmi_injected' flag but later we +decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI +injection upon entry so it got delivered to L1 instead of L2. + +It seems that VMX code solves the same issue in prepare_vmcs12(), this was +introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework +event injection and recovery"). + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 77a9481ce4c49..ea1fab0cb036d 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3401,6 +3401,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) + kvm_mmu_reset_context(&svm->vcpu); + kvm_mmu_load(&svm->vcpu); + ++ /* ++ * Drop what we picked up for L2 via svm_complete_interrupts() so it ++ * doesn't end up in L1. ++ */ ++ svm->vcpu.arch.nmi_injected = false; ++ kvm_clear_exception_queue(&svm->vcpu); ++ kvm_clear_interrupt_queue(&svm->vcpu); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/kvm-selftests-check-returned-evmcs-version-range.patch b/queue-4.20/kvm-selftests-check-returned-evmcs-version-range.patch new file mode 100644 index 00000000000..56b0e2d9320 --- /dev/null +++ b/queue-4.20/kvm-selftests-check-returned-evmcs-version-range.patch @@ -0,0 +1,36 @@ +From ee075d614bb4cffcb622e35609618068a2f6d281 Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Thu, 17 Jan 2019 18:12:10 +0100 +Subject: KVM: selftests: check returned evmcs version range + +[ Upstream commit 35b531a1e7fc30ac8c62e5ac1794eb1460da614e ] + +Check that KVM_CAP_HYPERV_ENLIGHTENED_VMCS returns correct version range. + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/x86_64/evmcs_test.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c +index ea3c73e8f4f6e..c49c2a28b0eb2 100644 +--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c ++++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c +@@ -103,6 +103,12 @@ int main(int argc, char *argv[]) + + vcpu_ioctl(vm, VCPU_ID, KVM_ENABLE_CAP, &enable_evmcs_cap); + ++ /* KVM should return supported EVMCS version range */ ++ TEST_ASSERT(((evmcs_ver >> 8) >= (evmcs_ver & 0xff)) && ++ (evmcs_ver & 0xff) > 0, ++ "Incorrect EVMCS version range: %x:%x\n", ++ evmcs_ver & 0xff, evmcs_ver >> 8); ++ + run = vcpu_state(vm, VCPU_ID); + + vcpu_regs_get(vm, VCPU_ID, ®s1); +-- +2.19.1 + diff --git a/queue-4.20/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch b/queue-4.20/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch new file mode 100644 index 00000000000..7d89666bb1e --- /dev/null +++ b/queue-4.20/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch @@ -0,0 +1,58 @@ +From e1dd3f72739a57e1a6ded09f474b160fe29d094b Mon Sep 17 00:00:00 2001 +From: Ben Gardon +Date: Wed, 16 Jan 2019 09:41:15 -0800 +Subject: kvm: selftests: Fix region overlap check in kvm_util + +[ Upstream commit 94a980c39c8e3f8abaff5d3b5bbcd4ccf1c02c4f ] + +Fix a call to userspace_mem_region_find to conform to its spec of +taking an inclusive, inclusive range. It was previously being called +with an inclusive, exclusive range. Also remove a redundant region bounds +check in vm_userspace_mem_region_add. Region overlap checking is already +performed by the call to userspace_mem_region_find. + +Tested: Compiled tools/testing/selftests/kvm with -static + Ran all resulting test binaries on an Intel Haswell test machine + All tests passed + +Signed-off-by: Ben Gardon +Reviewed-by: Jim Mattson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/lib/kvm_util.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c +index 1b41e71283d5b..6ee49133ad226 100644 +--- a/tools/testing/selftests/kvm/lib/kvm_util.c ++++ b/tools/testing/selftests/kvm/lib/kvm_util.c +@@ -532,7 +532,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + * already exist. + */ + region = (struct userspace_mem_region *) userspace_mem_region_find( +- vm, guest_paddr, guest_paddr + npages * vm->page_size); ++ vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1); + if (region != NULL) + TEST_ASSERT(false, "overlapping userspace_mem_region already " + "exists\n" +@@ -548,15 +548,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + region = region->next) { + if (region->region.slot == slot) + break; +- if ((guest_paddr <= (region->region.guest_phys_addr +- + region->region.memory_size)) +- && ((guest_paddr + npages * vm->page_size) +- >= region->region.guest_phys_addr)) +- break; + } + if (region != NULL) + TEST_ASSERT(false, "A mem region with the requested slot " +- "or overlapping physical memory range already exists.\n" ++ "already exists.\n" + " requested slot: %u paddr: 0x%lx npages: 0x%lx\n" + " existing slot: %u paddr: 0x%lx size: 0x%lx", + slot, guest_paddr, npages, +-- +2.19.1 + diff --git a/queue-4.20/locking-rwsem-fix-possible-missed-wakeup.patch b/queue-4.20/locking-rwsem-fix-possible-missed-wakeup.patch new file mode 100644 index 00000000000..d57318dc9d0 --- /dev/null +++ b/queue-4.20/locking-rwsem-fix-possible-missed-wakeup.patch @@ -0,0 +1,63 @@ +From 1bd33ff98c3958d3903312f506bdc87bbc23b4d9 Mon Sep 17 00:00:00 2001 +From: Xie Yongji +Date: Thu, 29 Nov 2018 20:50:30 +0800 +Subject: locking/rwsem: Fix (possible) missed wakeup + +[ Upstream commit e158488be27b157802753a59b336142dc0eb0380 ] + +Because wake_q_add() can imply an immediate wakeup (cmpxchg failure +case), we must not rely on the wakeup being delayed. However, commit: + + e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") + +relies on exactly that behaviour in that the wakeup must not happen +until after we clear waiter->task. + +[ peterz: Added changelog. ] + +Signed-off-by: Xie Yongji +Signed-off-by: Zhang Yu +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") +Link: https://lkml.kernel.org/r/1543495830-2644-1-git-send-email-xieyongji@baidu.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem-xadd.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index 09b180063ee11..50d9af615dc49 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, + woken++; + tsk = waiter->task; + +- wake_q_add(wake_q, tsk); ++ get_task_struct(tsk); + list_del(&waiter->list); + /* +- * Ensure that the last operation is setting the reader ++ * Ensure calling get_task_struct() before setting the reader + * waiter to nil such that rwsem_down_read_failed() cannot + * race with do_exit() by always holding a reference count + * to the task to wakeup. + */ + smp_store_release(&waiter->task, NULL); ++ /* ++ * Ensure issuing the wakeup (either by us or someone else) ++ * after setting the reader waiter to nil. ++ */ ++ wake_q_add(wake_q, tsk); ++ /* wake_q_add() already take the task ref */ ++ put_task_struct(tsk); + } + + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; +-- +2.19.1 + diff --git a/queue-4.20/mac80211-add-attribute-aligned-2-to-struct-action.patch b/queue-4.20/mac80211-add-attribute-aligned-2-to-struct-action.patch new file mode 100644 index 00000000000..0309a945ffa --- /dev/null +++ b/queue-4.20/mac80211-add-attribute-aligned-2-to-struct-action.patch @@ -0,0 +1,62 @@ +From f3a6c3fcfd726d18fe1e0f774338ebe8803d7dec Mon Sep 17 00:00:00 2001 +From: Mathieu Malaterre +Date: Thu, 24 Jan 2019 19:19:57 +0100 +Subject: mac80211: Add attribute aligned(2) to struct 'action' + +[ Upstream commit 7c53eb5d87bc21464da4268c3c0c47457b6d9c9b ] + +During refactor in commit 9e478066eae4 ("mac80211: fix MU-MIMO +follow-MAC mode") a new struct 'action' was declared with packed +attribute as: + + struct { + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; + } __packed action; + +But since struct 'ieee80211_hdr_3addr' is declared with an aligned +keyword as: + + struct ieee80211_hdr { + __le16 frame_control; + __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; + __le16 seq_ctrl; + u8 addr4[ETH_ALEN]; + } __packed __aligned(2); + +Solve the ambiguity of placing aligned structure in a packed one by +adding the aligned(2) attribute to struct 'action'. + +This removes the following warning (W=1): + + net/mac80211/rx.c:234:2: warning: alignment 1 of 'struct ' is less than 2 [-Wpacked-not-aligned] + +Cc: Johannes Berg +Suggested-by: Johannes Berg +Signed-off-by: Mathieu Malaterre +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 2ee3f09eced1c..cc9be69af44cb 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -231,7 +231,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; +- } __packed action; ++ } __packed __aligned(2) action; + + if (!sdata) + return; +-- +2.19.1 + diff --git a/queue-4.20/mac80211-don-t-initiate-tdls-connection-if-station-i.patch b/queue-4.20/mac80211-don-t-initiate-tdls-connection-if-station-i.patch new file mode 100644 index 00000000000..5265b4fc0e4 --- /dev/null +++ b/queue-4.20/mac80211-don-t-initiate-tdls-connection-if-station-i.patch @@ -0,0 +1,57 @@ +From fb1c2b3b36b89cbf86ec3c1f0a990d75c2b158a1 Mon Sep 17 00:00:00 2001 +From: Balaji Pothunoori +Date: Mon, 21 Jan 2019 12:30:43 +0530 +Subject: mac80211: don't initiate TDLS connection if station is not associated + to AP + +[ Upstream commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce ] + +Following call trace is observed while adding TDLS peer entry in driver +during TDLS setup. + +Call Trace: +[] dump_stack+0x47/0x61 +[] __warn+0xe2/0x100 +[] ? sta_apply_parameters+0x49f/0x550 [mac80211] +[] warn_slowpath_null+0x25/0x30 +[] sta_apply_parameters+0x49f/0x550 [mac80211] +[] ? sta_info_alloc+0x1c2/0x450 [mac80211] +[] ieee80211_add_station+0xe3/0x160 [mac80211] +[] nl80211_new_station+0x273/0x420 +[] genl_rcv_msg+0x219/0x3c0 +[] ? genl_rcv+0x30/0x30 +[] netlink_rcv_skb+0x8e/0xb0 +[] genl_rcv+0x1c/0x30 +[] netlink_unicast+0x13a/0x1d0 +[] netlink_sendmsg+0x2d8/0x390 +[] sock_sendmsg+0x2d/0x40 +[] ___sys_sendmsg+0x1d9/0x1e0 + +Fixing this by allowing TDLS setup request only when we have completed +association. + +Signed-off-by: Balaji Pothunoori +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 517dad83c2fa7..ac8478876b864 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1494,6 +1494,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, + if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) + sta->sta.tdls = true; + ++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && ++ !sdata->u.mgd.associated) ++ return -EINVAL; ++ + err = sta_apply_parameters(local, sta, params); + if (err) { + sta_info_free(local, sta); +-- +2.19.1 + diff --git a/queue-4.20/mac80211-fix-miscounting-of-ttl-dropped-frames.patch b/queue-4.20/mac80211-fix-miscounting-of-ttl-dropped-frames.patch new file mode 100644 index 00000000000..b9c3833ac40 --- /dev/null +++ b/queue-4.20/mac80211-fix-miscounting-of-ttl-dropped-frames.patch @@ -0,0 +1,44 @@ +From d2a3c3999effc718629cc66625f806584b75379a Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Thu, 17 Jan 2019 16:32:42 -0500 +Subject: mac80211: fix miscounting of ttl-dropped frames + +[ Upstream commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c ] + +In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl' +counter when we decrement the ttl to zero. For unicast frames +destined for other hosts, we stop processing the frame at that point. + +For multicast frames, we do not rebroadcast it in this case, but we +do pass the frame up the stack to process it on this STA. That +doesn't match the usual definition of "dropped," so don't count +those as such. + +With this change, something like `ping6 -i0.2 ff02::1%mesh0` from a +peer in a ttl=1 network no longer increments the counter rapidly. + +Signed-off-by: Bob Copeland +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 46ecc417c4210..2ee3f09eced1c 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2720,7 +2720,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + skb_set_queue_mapping(skb, q); + + if (!--mesh_hdr->ttl) { +- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); ++ if (!is_multicast_ether_addr(hdr->addr1)) ++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, ++ dropped_frames_ttl); + goto out; + } + +-- +2.19.1 + diff --git a/queue-4.20/net-altera_tse-fix-connect_local_phy-error-path.patch b/queue-4.20/net-altera_tse-fix-connect_local_phy-error-path.patch new file mode 100644 index 00000000000..98e39c80b4c --- /dev/null +++ b/queue-4.20/net-altera_tse-fix-connect_local_phy-error-path.patch @@ -0,0 +1,37 @@ +From ccfab7c3e3515744c84af1bf39dc95ebcf9245bd Mon Sep 17 00:00:00 2001 +From: Atsushi Nemoto +Date: Mon, 21 Jan 2019 17:26:41 +0900 +Subject: net: altera_tse: fix connect_local_phy error path + +[ Upstream commit 17b42a20d7ca59377788c6a2409e77569570cc10 ] + +The connect_local_phy should return NULL (not negative errno) on +error, since its caller expects it. + +Signed-off-by: Atsushi Nemoto +Acked-by: Thor Thayer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/altera/altera_tse_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index 02921d877c08a..aa1d1f5339d2a 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) + + phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link, + priv->phy_iface); +- if (IS_ERR(phydev)) ++ if (IS_ERR(phydev)) { + netdev_err(dev, "Could not attach to PHY\n"); ++ phydev = NULL; ++ } + + } else { + int ret; +-- +2.19.1 + diff --git a/queue-4.20/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch b/queue-4.20/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch new file mode 100644 index 00000000000..2d45d4053b7 --- /dev/null +++ b/queue-4.20/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch @@ -0,0 +1,36 @@ +From 63fc2ec66e37650b29d90466ea6eceeb92c34d5d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= +Date: Thu, 24 Jan 2019 03:07:02 -0800 +Subject: net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3b707c3008cad04604c1f50e39f456621821c414 ] + +__bpf_redirect() and act_mirred checks this boolean +to determine whether to prefix an ethernet header. + +Signed-off-by: Maciej Å»enczykowski +Acked-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_arp.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h +index 6756fea18b69f..e44746de95cdf 100644 +--- a/include/linux/if_arp.h ++++ b/include/linux/if_arp.h +@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) + case ARPHRD_IPGRE: + case ARPHRD_VOID: + case ARPHRD_NONE: ++ case ARPHRD_RAWIP: + return false; + default: + return true; +-- +2.19.1 + diff --git a/queue-4.20/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch b/queue-4.20/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch new file mode 100644 index 00000000000..f4b8800d98f --- /dev/null +++ b/queue-4.20/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch @@ -0,0 +1,63 @@ +From 1ca0482f40940c1288306e58045d1a6a97d53735 Mon Sep 17 00:00:00 2001 +From: Zhang Run +Date: Thu, 24 Jan 2019 13:48:49 +0800 +Subject: net: usb: asix: ax88772_bind return error when hw_reset fail + +[ Upstream commit 6eea3527e68acc22483f4763c8682f223eb90029 ] + +The ax88772_bind() should return error code immediately when the PHY +was not reset properly through ax88772a_hw_reset(). +Otherwise, The asix_get_phyid() will block when get the PHY +Identifier from the PHYSID1 MII registers through asix_mdio_read() +due to the PHY isn't ready. Furthermore, it will produce a lot of +error message cause system crash.As follows: +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to send + software reset: ffffffb9 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable + software MII access +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable + software MII access +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read + reg index 0x0000: -71 +... + +Signed-off-by: Zhang Run +Reviewed-by: Yang Wei +Tested-by: Marcel Ziswiler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix_devices.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index b654f05b2ccd0..3d93993e74da0 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); + chipcode &= AX_CHIPCODE_MASK; + +- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : +- ax88772a_hw_reset(dev, 0); ++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : ++ ax88772a_hw_reset(dev, 0); ++ ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret); ++ return ret; ++ } + + /* Read PHYID register *AFTER* the PHY was reset properly */ + phyid = asix_get_phyid(dev); +-- +2.19.1 + diff --git a/queue-4.20/nvme-multipath-drop-optimization-for-static-ana-grou.patch b/queue-4.20/nvme-multipath-drop-optimization-for-static-ana-grou.patch new file mode 100644 index 00000000000..e6219ad36ef --- /dev/null +++ b/queue-4.20/nvme-multipath-drop-optimization-for-static-ana-grou.patch @@ -0,0 +1,43 @@ +From 0f28f0dd2bcbee8f574468afcea374d310a3f919 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Wed, 9 Jan 2019 09:45:15 +0100 +Subject: nvme-multipath: drop optimization for static ANA group IDs + +[ Upstream commit 78a61cd42a64f3587862b372a79e1d6aaf131fd7 ] + +Bit 6 in the ANACAP field is used to indicate that the ANA group ID +doesn't change while the namespace is attached to the controller. +There is an optimisation in the code to only allocate space +for the ANA group header, as the namespace list won't change and +hence would not need to be refreshed. +However, this optimisation was never carried over to the actual +workflow, which always assumes that the buffer is large enough +to hold the ANA header _and_ the namespace list. +So drop this optimisation and always allocate enough space. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 2b1d1f066efaf..6ea7c266a9cad 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -561,8 +561,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); + ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + + ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- if (!(ctrl->anacap & (1 << 6))) +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); ++ ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); + + if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { + dev_err(ctrl->device, +-- +2.19.1 + diff --git a/queue-4.20/nvme-rdma-fix-timeout-handler.patch b/queue-4.20/nvme-rdma-fix-timeout-handler.patch new file mode 100644 index 00000000000..93a8d19f837 --- /dev/null +++ b/queue-4.20/nvme-rdma-fix-timeout-handler.patch @@ -0,0 +1,75 @@ +From 5ffeb5c7b1c1027d500705a1643209950c68d1c5 Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Tue, 8 Jan 2019 00:53:22 -0800 +Subject: nvme-rdma: fix timeout handler + +[ Upstream commit 4c174e6366746ae8d49f9cc409f728eebb7a9ac9 ] + +Currently, we have several problems with the timeout +handler: +1. If we timeout on the controller establishment flow, we will hang +because we don't execute the error recovery (and we shouldn't because +the create_ctrl flow needs to fail and cleanup on its own) +2. We might also hang if we get a disconnet on a queue while the +controller is already deleting. This racy flow can cause the controller +disable/shutdown admin command to hang. + +We cannot complete a timed out request from the timeout handler without +mutual exclusion from the teardown flow (e.g. nvme_rdma_error_recovery_work). +So we serialize it in the timeout handler and teardown io and admin +queues to guarantee that no one races with us from completing the +request. + +Reported-by: Jaesoo Lee +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index ab6ec7295bf90..6e24b20304b53 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1679,18 +1679,28 @@ static enum blk_eh_timer_return + nvme_rdma_timeout(struct request *rq, bool reserved) + { + struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq); ++ struct nvme_rdma_queue *queue = req->queue; ++ struct nvme_rdma_ctrl *ctrl = queue->ctrl; + +- dev_warn(req->queue->ctrl->ctrl.device, +- "I/O %d QID %d timeout, reset controller\n", +- rq->tag, nvme_rdma_queue_idx(req->queue)); ++ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n", ++ rq->tag, nvme_rdma_queue_idx(queue)); + +- /* queue error recovery */ +- nvme_rdma_error_recovery(req->queue->ctrl); ++ if (ctrl->ctrl.state != NVME_CTRL_LIVE) { ++ /* ++ * Teardown immediately if controller times out while starting ++ * or we are already started error recovery. all outstanding ++ * requests are completed on shutdown, so we return BLK_EH_DONE. ++ */ ++ flush_work(&ctrl->err_work); ++ nvme_rdma_teardown_io_queues(ctrl, false); ++ nvme_rdma_teardown_admin_queue(ctrl, false); ++ return BLK_EH_DONE; ++ } + +- /* fail with DNR on cmd timeout */ +- nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR; ++ dev_warn(ctrl->ctrl.device, "starting error recovery\n"); ++ nvme_rdma_error_recovery(ctrl); + +- return BLK_EH_DONE; ++ return BLK_EH_RESET_TIMER; + } + + static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx, +-- +2.19.1 + diff --git a/queue-4.20/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch b/queue-4.20/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch new file mode 100644 index 00000000000..e36b65d1882 --- /dev/null +++ b/queue-4.20/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch @@ -0,0 +1,43 @@ +From 6049b1afe10ed86f230a7b4b81a62b2b53243459 Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:44:54 +0100 +Subject: phy: ath79-usb: Fix the main reset name to match the DT binding + +[ Upstream commit 827cb0323928952c0db9515aba9d534fb1285b3f ] + +I submitted this driver several times before it got accepted. The +first series hasn't been accepted but the DTS binding did made it. +I then made a second series that added generic reset support to the +PHY core, this in turn required a change to the DT binding. This +second series seemed to have been ignored, so I did a third one +without the change to the PHY core and the DT binding update, and this +last attempt finally made it. + +But two months later the DT binding update from the second series has +been integrated too. So now the driver doesn't match the binding and +the only DTS using it. This patch fix the driver to match the new +binding. + +Signed-off-by: Alban Bedel +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c +index f7d64f3910b4d..09a77e556eceb 100644 +--- a/drivers/phy/qualcomm/phy-ath79-usb.c ++++ b/drivers/phy/qualcomm/phy-ath79-usb.c +@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + +- priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy"); ++ priv->reset = devm_reset_control_get(&pdev->dev, "phy"); + if (IS_ERR(priv->reset)) + return PTR_ERR(priv->reset); + +-- +2.19.1 + diff --git a/queue-4.20/phy-ath79-usb-fix-the-power-on-error-path.patch b/queue-4.20/phy-ath79-usb-fix-the-power-on-error-path.patch new file mode 100644 index 00000000000..59d26645999 --- /dev/null +++ b/queue-4.20/phy-ath79-usb-fix-the-power-on-error-path.patch @@ -0,0 +1,34 @@ +From 49a7ef46f50f7e530bdef8d07b0fef79bbcda1d6 Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:44:53 +0100 +Subject: phy: ath79-usb: Fix the power on error path + +[ Upstream commit 009808154c69c48d5b41fc8cf5ad5ab5704efd8f ] + +In the power on function the error path doesn't return the suspend +override to its proper state. It should should deassert this reset +line to enable the suspend override. + +Signed-off-by: Alban Bedel +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c +index 6fd6e07ab345f..f7d64f3910b4d 100644 +--- a/drivers/phy/qualcomm/phy-ath79-usb.c ++++ b/drivers/phy/qualcomm/phy-ath79-usb.c +@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy) + + err = reset_control_deassert(priv->reset); + if (err && priv->no_suspend_override) +- reset_control_assert(priv->no_suspend_override); ++ reset_control_deassert(priv->no_suspend_override); + + return err; + } +-- +2.19.1 + diff --git a/queue-4.20/sched-wait-fix-rcuwait_wake_up-ordering.patch b/queue-4.20/sched-wait-fix-rcuwait_wake_up-ordering.patch new file mode 100644 index 00000000000..764b24f8969 --- /dev/null +++ b/queue-4.20/sched-wait-fix-rcuwait_wake_up-ordering.patch @@ -0,0 +1,65 @@ +From 0912a09859ef74c0cf9c61677d66ae8477d121dc Mon Sep 17 00:00:00 2001 +From: Prateek Sood +Date: Fri, 30 Nov 2018 20:40:56 +0530 +Subject: sched/wait: Fix rcuwait_wake_up() ordering + +[ Upstream commit 6dc080eeb2ba01973bfff0d79844d7a59e12542e ] + +For some peculiar reason rcuwait_wake_up() has the right barrier in +the comment, but not in the code. + +This mistake has been observed to cause a deadlock in the following +situation: + + P1 P2 + + percpu_up_read() percpu_down_write() + rcu_sync_is_idle() // false + rcu_sync_enter() + ... + __percpu_up_read() + +[S] ,- __this_cpu_dec(*sem->read_count) + | smp_rmb(); +[L] | task = rcu_dereference(w->task) // NULL + | + | [S] w->task = current + | smp_mb(); + | [L] readers_active_check() // fail + `-> + +Where the smp_rmb() (obviously) fails to constrain the store. + +[ peterz: Added changelog. ] + +Signed-off-by: Prateek Sood +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andrea Parri +Acked-by: Davidlohr Bueso +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 8f95c90ceb54 ("sched/wait, RCU: Introduce rcuwait machinery") +Link: https://lkml.kernel.org/r/1543590656-7157-1-git-send-email-prsood@codeaurora.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/exit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/exit.c b/kernel/exit.c +index 55b4fa6d01ebd..d607e23fd0c3e 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w) + * MB (A) MB (B) + * [L] cond [L] tsk + */ +- smp_rmb(); /* (B) */ ++ smp_mb(); /* (B) */ + + /* + * Avoid using task_rcu_dereference() magic as long as we are careful, +-- +2.19.1 + diff --git a/queue-4.20/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch b/queue-4.20/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch new file mode 100644 index 00000000000..d6841eb6b00 --- /dev/null +++ b/queue-4.20/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch @@ -0,0 +1,94 @@ +From 1f02a3701bcc9b8ccc077ef13a090cf8b9190843 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 17 Dec 2018 10:14:53 +0100 +Subject: sched/wake_q: Fix wakeup ordering for wake_q + +[ Upstream commit 4c4e3731564c8945ac5ac90fc2a1e1f21cb79c92 ] + +Notable cmpxchg() does not provide ordering when it fails, however +wake_q_add() requires ordering in this specific case too. Without this +it would be possible for the concurrent wakeup to not observe our +prior state. + +Andrea Parri provided: + + C wake_up_q-wake_q_add + + { + int next = 0; + int y = 0; + } + + P0(int *next, int *y) + { + int r0; + + /* in wake_up_q() */ + + WRITE_ONCE(*next, 1); /* node->next = NULL */ + smp_mb(); /* implied by wake_up_process() */ + r0 = READ_ONCE(*y); + } + + P1(int *next, int *y) + { + int r1; + + /* in wake_q_add() */ + + WRITE_ONCE(*y, 1); /* wake_cond = true */ + smp_mb__before_atomic(); + r1 = cmpxchg_relaxed(next, 1, 2); + } + + exists (0:r0=0 /\ 1:r1=0) + + This "exists" clause cannot be satisfied according to the LKMM: + + Test wake_up_q-wake_q_add Allowed + States 3 + 0:r0=0; 1:r1=1; + 0:r0=1; 1:r1=0; + 0:r0=1; 1:r1=1; + No + Witnesses + Positive: 0 Negative: 3 + Condition exists (0:r0=0 /\ 1:r1=0) + Observation wake_up_q-wake_q_add Never 0 3 + +Reported-by: Yongji Xie +Signed-off-by: Peter Zijlstra (Intel) +Cc: Davidlohr Bueso +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Waiman Long +Cc: Will Deacon +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 6fedf3a98581b..463af32de32cc 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -405,10 +405,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task) + * its already queued (either by us or someone else) and will get the + * wakeup due to that. + * +- * This cmpxchg() executes a full barrier, which pairs with the full +- * barrier executed by the wakeup in wake_up_q(). ++ * In order to ensure that a pending wakeup will observe our pending ++ * state, even in the failed case, an explicit smp_mb() must be used. + */ +- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL)) ++ smp_mb__before_atomic(); ++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL)) + return; + + get_task_struct(task); +-- +2.19.1 + diff --git a/queue-4.20/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch b/queue-4.20/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch new file mode 100644 index 00000000000..8ebc9864ff4 --- /dev/null +++ b/queue-4.20/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch @@ -0,0 +1,41 @@ +From bb52b68df0c2d8c31d1d4877c8964a0ac4b993f7 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Sat, 12 Jan 2019 22:14:30 +0530 +Subject: scsi: csiostor: fix NULL pointer dereference in + csio_vport_set_state() + +[ Upstream commit fe35a40e675473eb65f2f5462b82770f324b5689 ] + +Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to +avoid a NULL pointer dereference in csio_vport_set_state(). + +ln->fc_vport is dereferenced in csio_vport_set_state(). + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/csiostor/csio_attr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c +index 8a004036e3d72..9bd2bd8dc2be2 100644 +--- a/drivers/scsi/csiostor/csio_attr.c ++++ b/drivers/scsi/csiostor/csio_attr.c +@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) + } + + fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); ++ ln->fc_vport = fc_vport; + + if (csio_fcoe_alloc_vnp(hw, ln)) + goto error; + + *(struct csio_lnode **)fc_vport->dd_data = ln; +- ln->fc_vport = fc_vport; + if (!fc_vport->node_name) + fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); + if (!fc_vport->port_name) +-- +2.19.1 + diff --git a/queue-4.20/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch b/queue-4.20/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch new file mode 100644 index 00000000000..f9f76f27563 --- /dev/null +++ b/queue-4.20/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch @@ -0,0 +1,105 @@ +From a808edfc80c9b8302665254f4ceb2e77e5a4420a Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Thu, 17 Jan 2019 11:14:44 -0500 +Subject: scsi: lpfc: nvme: avoid hang / use-after-free when destroying + localport + +[ Upstream commit 7961cba6f7d8215fa632df3d220e5154bb825249 ] + +We cannot wait on a completion object in the lpfc_nvme_lport structure in +the _destroy_localport() code path because the NVMe/fc transport will free +that structure immediately after the .localport_delete() callback. This +results in a use-after-free, and a hang if slub_debug=FZPU is enabled. + +Fix this by putting the completion on the stack. + +Signed-off-by: Ewan D. Milne +Acked-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvme.c | 16 +++++++++------- + drivers/scsi/lpfc/lpfc_nvme.h | 2 +- + 2 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index ba831def9301d..b6fe88de372a8 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport) + lport); + + /* release any threads waiting for the unreg to complete */ +- complete(&lport->lport_unreg_done); ++ if (lport->vport->localport) ++ complete(lport->lport_unreg_cmp); + } + + /* lpfc_nvme_remoteport_delete +@@ -2547,7 +2548,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport) + */ + void + lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, +- struct lpfc_nvme_lport *lport) ++ struct lpfc_nvme_lport *lport, ++ struct completion *lport_unreg_cmp) + { + #if (IS_ENABLED(CONFIG_NVME_FC)) + u32 wait_tmo; +@@ -2559,8 +2561,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, + */ + wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000); + while (true) { +- ret = wait_for_completion_timeout(&lport->lport_unreg_done, +- wait_tmo); ++ ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo); + if (unlikely(!ret)) { + lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR, + "6176 Lport %p Localport %p wait " +@@ -2594,12 +2595,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + struct lpfc_nvme_lport *lport; + struct lpfc_nvme_ctrl_stat *cstat; + int ret; ++ DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp); + + if (vport->nvmei_support == 0) + return; + + localport = vport->localport; +- vport->localport = NULL; + lport = (struct lpfc_nvme_lport *)localport->private; + cstat = lport->cstat; + +@@ -2610,13 +2611,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + /* lport's rport list is clear. Unregister + * lport and release resources. + */ +- init_completion(&lport->lport_unreg_done); ++ lport->lport_unreg_cmp = &lport_unreg_cmp; + ret = nvme_fc_unregister_localport(localport); + + /* Wait for completion. This either blocks + * indefinitely or succeeds + */ +- lpfc_nvme_lport_unreg_wait(vport, lport); ++ lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp); ++ vport->localport = NULL; + kfree(cstat); + + /* Regardless of the unregister upcall response, clear +diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h +index cfd4719be25c3..b234d02989942 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.h ++++ b/drivers/scsi/lpfc/lpfc_nvme.h +@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat { + /* Declare nvme-based local and remote port definitions. */ + struct lpfc_nvme_lport { + struct lpfc_vport *vport; +- struct completion lport_unreg_done; ++ struct completion *lport_unreg_cmp; + /* Add stats counters here */ + struct lpfc_nvme_ctrl_stat *cstat; + atomic_t fc4NvmeLsRequests; +-- +2.19.1 + diff --git a/queue-4.20/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch b/queue-4.20/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch new file mode 100644 index 00000000000..df894ac0e5e --- /dev/null +++ b/queue-4.20/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch @@ -0,0 +1,74 @@ +From cb802ef1fdcaddfec894303dca2eae4cd07b45bb Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Thu, 17 Jan 2019 11:14:45 -0500 +Subject: scsi: lpfc: nvmet: avoid hang / use-after-free when destroying + targetport + +[ Upstream commit c41f59884be5cca293ed61f3d64637dbba3a6381 ] + +We cannot wait on a completion object in the lpfc_nvme_targetport structure +in the _destroy_targetport() code path because the NVMe/fc transport will +free that structure immediately after the .targetport_delete() callback. +This results in a use-after-free, and a hang if slub_debug=FZPU is enabled. + +Fix this by putting the completion on the stack. + +Signed-off-by: Ewan D. Milne +Acked-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvmet.c | 8 +++++--- + drivers/scsi/lpfc/lpfc_nvmet.h | 2 +- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index 6245f442d784b..95fee83090eb7 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport) + struct lpfc_nvmet_tgtport *tport = targetport->private; + + /* release any threads waiting for the unreg to complete */ +- complete(&tport->tport_unreg_done); ++ if (tport->phba->targetport) ++ complete(tport->tport_unreg_cmp); + } + + static void +@@ -1692,6 +1693,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + struct lpfc_nvmet_tgtport *tgtp; + struct lpfc_queue *wq; + uint32_t qidx; ++ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp); + + if (phba->nvmet_support == 0) + return; +@@ -1701,9 +1703,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + wq = phba->sli4_hba.nvme_wq[qidx]; + lpfc_nvmet_wqfull_flush(phba, wq, NULL); + } +- init_completion(&tgtp->tport_unreg_done); ++ tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5); ++ wait_for_completion_timeout(&tport_unreg_cmp, 5); + lpfc_nvmet_cleanup_io_context(phba); + } + phba->targetport = NULL; +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h +index 1aaff63f1f419..0ec1082ce7ef6 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.h ++++ b/drivers/scsi/lpfc/lpfc_nvmet.h +@@ -34,7 +34,7 @@ + /* Used for NVME Target */ + struct lpfc_nvmet_tgtport { + struct lpfc_hba *phba; +- struct completion tport_unreg_done; ++ struct completion *tport_unreg_cmp; + + /* Stats counters - lpfc_nvmet_unsol_ls_buffer */ + atomic_t rcv_ls_req_in; +-- +2.19.1 + diff --git a/queue-4.20/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch b/queue-4.20/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch new file mode 100644 index 00000000000..6de70bf4af0 --- /dev/null +++ b/queue-4.20/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch @@ -0,0 +1,56 @@ +From 340d89c6d72c724acf6df5b84b81ddf33ad118b6 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 14 Jan 2019 14:51:33 +0100 +Subject: selftests: gpio-mockup-chardev: Check asprintf() for error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 508cacd7da6659ae7b7bdd0a335f675422277758 ] + +With gcc 7.3.0: + + gpio-mockup-chardev.c: In function ‘get_debugfs’: + gpio-mockup-chardev.c:62:3: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Wunused-result] + asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Handle asprintf() failures to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/gpio/gpio-mockup-chardev.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +index f8d468f54e986..aaa1e9f083c37 100644 +--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c ++++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +@@ -37,7 +37,7 @@ static int get_debugfs(char **path) + struct libmnt_table *tb; + struct libmnt_iter *itr = NULL; + struct libmnt_fs *fs; +- int found = 0; ++ int found = 0, ret; + + cxt = mnt_new_context(); + if (!cxt) +@@ -58,8 +58,11 @@ static int get_debugfs(char **path) + break; + } + } +- if (found) +- asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (found) { ++ ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (ret < 0) ++ err(EXIT_FAILURE, "failed to format string"); ++ } + + mnt_free_iter(itr); + mnt_free_context(cxt); +-- +2.19.1 + diff --git a/queue-4.20/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch b/queue-4.20/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch new file mode 100644 index 00000000000..43eec7deb52 --- /dev/null +++ b/queue-4.20/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch @@ -0,0 +1,133 @@ +From 13ffc6af3b6510987cb283913273c22478b03967 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Tue, 18 Dec 2018 22:34:21 +0100 +Subject: selftests: rtc: rtctest: add alarm test on minute boundary + +[ Upstream commit 7b3027728f4d4f6763f4d7e771acfc9424cdd0e6 ] + +Unfortunately, some RTC don't have a second resolution for alarm so also +test for alarm on a minute boundary. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/rtc/rtctest.c | 102 ++++++++++++++++++++++++++ + 1 file changed, 102 insertions(+) + +diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c +index dea4e3d6d9e18..b2065536d4075 100644 +--- a/tools/testing/selftests/rtc/rtctest.c ++++ b/tools/testing/selftests/rtc/rtctest.c +@@ -211,6 +211,108 @@ TEST_F(rtc, alarm_wkalm_set) { + ASSERT_EQ(new, secs); + } + ++TEST_F(rtc, alarm_alm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ unsigned long data; ++ struct rtc_time tm; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec; ++ gmtime_r(&secs, (struct tm *)&tm); ++ ++ rc = ioctl(self->fd, RTC_ALM_SET, &tm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_ALM_READ, &tm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d:%02d:%02d.", ++ tm.tm_hour, tm.tm_min, tm.tm_sec); ++ ++ /* Enable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_ON, 0); ++ ASSERT_NE(-1, rc); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); ++ ++ /* Disable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_OFF, 0); ++ ASSERT_NE(-1, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ TH_LOG("data: %lx", data); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ ++TEST_F(rtc, alarm_wkalm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ struct rtc_wkalrm alarm = { 0 }; ++ struct rtc_time tm; ++ unsigned long data; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec; ++ gmtime_r(&secs, (struct tm *)&alarm.time); ++ ++ alarm.enabled = 1; ++ ++ rc = ioctl(self->fd, RTC_WKALM_SET, &alarm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_WKALM_RD, &alarm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.", ++ alarm.time.tm_mday, alarm.time.tm_mon + 1, ++ alarm.time.tm_year + 1900, alarm.time.tm_hour, ++ alarm.time.tm_min, alarm.time.tm_sec); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ + static void __attribute__((constructor)) + __constructor_order_last(void) + { +-- +2.19.1 + diff --git a/queue-4.20/selftests-rtc-rtctest-fix-alarm-tests.patch b/queue-4.20/selftests-rtc-rtctest-fix-alarm-tests.patch new file mode 100644 index 00000000000..c388173e72a --- /dev/null +++ b/queue-4.20/selftests-rtc-rtctest-fix-alarm-tests.patch @@ -0,0 +1,50 @@ +From 023475ee56656a08890c041ef23fb969bcaad65c Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Tue, 18 Dec 2018 22:34:20 +0100 +Subject: selftests: rtc: rtctest: fix alarm tests + +[ Upstream commit fdac94489c4d247088b3885875b39b3e1eb621ef ] + +Return values for select are not checked properly and timeouts may not be +detected. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/rtc/rtctest.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c +index e20b017e70731..dea4e3d6d9e18 100644 +--- a/tools/testing/selftests/rtc/rtctest.c ++++ b/tools/testing/selftests/rtc/rtctest.c +@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); + + /* Disable alarm interrupts */ + rc = ioctl(self->fd, RTC_AIE_OFF, 0); + ASSERT_NE(-1, rc); + +- if (rc == 0) +- return; +- + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); + TH_LOG("data: %lx", data); +@@ -202,7 +199,7 @@ TEST_F(rtc, alarm_wkalm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); + + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); +-- +2.19.1 + diff --git a/queue-4.20/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch b/queue-4.20/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch new file mode 100644 index 00000000000..005fce23b02 --- /dev/null +++ b/queue-4.20/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch @@ -0,0 +1,126 @@ +From bd47e970d8425bd911c5b56bf84df82d285027af Mon Sep 17 00:00:00 2001 +From: Fathi Boudra +Date: Wed, 16 Jan 2019 11:43:19 -0600 +Subject: selftests: seccomp: use LDLIBS instead of LDFLAGS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 5bbc73a841d7f0bbe025a342146dde462a796a5a ] + +seccomp_bpf fails to build due to undefined reference errors: + + aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey + -O2 -pipe -g -feliminate-unused-debug-types -Wl,-no-as-needed -Wall + -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lpthread seccomp_bpf.c -o + /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf + /tmp/ccrlR3MW.o: In function `tsync_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' + /tmp/ccrlR3MW.o: In function `TSYNC_setup': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1863: undefined reference to `sem_init' + /tmp/ccrlR3MW.o: In function `TSYNC_teardown': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1904: undefined reference to `sem_destroy' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1897: undefined reference to `pthread_kill' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1898: undefined reference to `pthread_cancel' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1899: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_siblings_fail_prctl': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1978: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1990: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1992: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_ancestor': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2016: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2032: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2034: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_sibling_want_nnp': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2046: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2058: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2060: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_no_filter': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2073: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2098: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2100: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_one_divergence': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2125: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2143: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2145: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_not_under_filter': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2169: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2202: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2227: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + +It's GNU Make and linker specific. + +The default Makefile rule looks like: + +$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) + +When linking is done by gcc itself, no issue, but when it needs to be passed +to proper ld, only LDLIBS follows and then ld cannot know what libs to link +with. + +More detail: +https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html + +LDFLAGS +Extra flags to give to compilers when they are supposed to invoke the linker, +‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable +instead. + +LDLIBS +Library flags or names given to compilers when they are supposed to invoke the +linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to +LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS +variable. + +https://lkml.org/lkml/2010/2/10/362 + +tools/perf: libraries must come after objects + +Link order matters, use LDLIBS instead of LDFLAGS to properly link against +libpthread. + +Signed-off-by: Fathi Boudra +Acked-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/seccomp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile +index fce7f4ce06925..1760b3e397306 100644 +--- a/tools/testing/selftests/seccomp/Makefile ++++ b/tools/testing/selftests/seccomp/Makefile +@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark + CFLAGS += -Wl,-no-as-needed -Wall + + seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h +- $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@ + + TEST_PROGS += $(BINARIES) + EXTRA_CLEAN := $(BINARIES) +-- +2.19.1 + diff --git a/queue-4.20/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch b/queue-4.20/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch new file mode 100644 index 00000000000..90676ebd709 --- /dev/null +++ b/queue-4.20/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch @@ -0,0 +1,36 @@ +From 918bc92e8b8b0dfa7ed7798264973f2f0b7fe4a0 Mon Sep 17 00:00:00 2001 +From: Alison Schofield +Date: Fri, 7 Dec 2018 18:06:45 -0800 +Subject: selftests/vm/gup_benchmark.c: match gup struct to kernel + +[ Upstream commit 91cd63d320f84dcbf21d4327f31f7e1f85adebd0 ] + +An expansion field was added to the kernel copy of this structure for +future use. See mm/gup_benchmark.c. + +Add the same expansion field here, so that the IOCTL command decodes +correctly. Otherwise, it fails with EINVAL. + +Signed-off-by: Alison Schofield +Acked-by: Kirill A. Shutemov +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/gup_benchmark.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c +index 880b96fc80d4c..c0534e298b512 100644 +--- a/tools/testing/selftests/vm/gup_benchmark.c ++++ b/tools/testing/selftests/vm/gup_benchmark.c +@@ -25,6 +25,7 @@ struct gup_benchmark { + __u64 size; + __u32 nr_pages_per_call; + __u32 flags; ++ __u64 expansion[10]; /* For future use */ + }; + + int main(int argc, char **argv) +-- +2.19.1 + diff --git a/queue-4.20/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch b/queue-4.20/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch new file mode 100644 index 00000000000..c60509d243c --- /dev/null +++ b/queue-4.20/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch @@ -0,0 +1,34 @@ +From ccc42a44266a55b8780e780a3f940696f9a01450 Mon Sep 17 00:00:00 2001 +From: Tomonori Sakita +Date: Mon, 21 Jan 2019 17:34:16 +0900 +Subject: serial: fsl_lpuart: fix maximum acceptable baud rate with + over-sampling + +[ Upstream commit 815d835b7ba46685c316b000013367dacb2b461b ] + +Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4. + +Signed-off-by: Tomonori Sakita +Signed-off-by: Atsushi Nemoto +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 086642ea4b26e..020af95ea9e7a 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1697,7 +1697,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + } + + /* ask the core to calculate the divisor */ +- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16); ++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4); + + spin_lock_irqsave(&sport->port.lock, flags); + +-- +2.19.1 + diff --git a/queue-4.20/series b/queue-4.20/series index 9cc9051b6bf..3f0eff5ef08 100644 --- a/queue-4.20/series +++ b/queue-4.20/series @@ -1,2 +1,68 @@ genirq-matrix-improve-target-cpu-selection-for-manag.patch scsi-libsas-fix-rphy-phy_identifier-for-phys-with-end-devices-attached.patch +drm-msm-unblock-writer-if-reader-closes-file.patch +asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch +alsa-compress-prevent-potential-divide-by-zero-bugs.patch +asoc-rt5682-fix-recording-no-sound-issue.patch +asoc-variable-val-in-function-rt274_i2c_probe-could-.patch +clk-tegra-dfll-fix-a-potential-oop-in-remove.patch +clk-sysfs-fix-invalid-json-in-clk_dump.patch +clk-vc5-abort-clock-configuration-without-upstream-c.patch +thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch +usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch +usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch +usb-gadget-potential-null-dereference-on-allocation-.patch +hid-i2c-hid-disable-runtime-pm-on-goodix-touchpad.patch +asoc-core-make-snd_soc_find_component-more-robust.patch +selftests-rtc-rtctest-fix-alarm-tests.patch +selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch +genirq-make-sure-the-initial-affinity-is-not-empty.patch +x86-mm-mem_encrypt-fix-erroneous-sizeof.patch +asoc-rt5682-fix-pll-source-register-definitions.patch +asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch +asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch +selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch +phy-ath79-usb-fix-the-power-on-error-path.patch +phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch +selftests-seccomp-use-ldlibs-instead-of-ldflags.patch +selftests-gpio-mockup-chardev-check-asprintf-for-err.patch +irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch +arc-fix-__ffs-return-value-to-avoid-build-warnings.patch +arc-show_regs-lockdep-avoid-page-allocator.patch +drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch +staging-rtl8723bs-fix-build-error-with-clang-when-in.patch +mac80211-fix-miscounting-of-ttl-dropped-frames.patch +sched-wait-fix-rcuwait_wake_up-ordering.patch +sched-wake_q-fix-wakeup-ordering-for-wake_q.patch +futex-fix-possible-missed-wakeup.patch +locking-rwsem-fix-possible-missed-wakeup.patch +drm-amd-powerplay-od-setting-fix-on-vega10.patch +tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch +serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch +drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch +staging-android-ion-support-cpu-access-during-dma_bu.patch +direct-io-allow-direct-writes-to-empty-inodes.patch +writeback-synchronize-sync-2-against-cgroup-writebac.patch +scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch +scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch +scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch +net-altera_tse-fix-connect_local_phy-error-path.patch +hv_netvsc-fix-ethtool-change-hash-key-error.patch +hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch +hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch +sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch +nvme-rdma-fix-timeout-handler.patch +nvme-multipath-drop-optimization-for-static-ana-grou.patch +cifs-fix-memory-leak-of-an-allocated-cifs_ntsd-struc.patch +drm-msm-fix-a6xx-support-for-opp-level.patch +drm-msm-avoid-unused-function-warning.patch +net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch +net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch +ibmveth-do-not-process-frames-after-calling-napi_res.patch +mac80211-don-t-initiate-tdls-connection-if-station-i.patch +mac80211-add-attribute-aligned-2-to-struct-action.patch +cfg80211-extend-range-deviation-for-dmg.patch +svm-fix-avic-incomplete-ipi-emulation.patch +kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch +kvm-selftests-fix-region-overlap-check-in-kvm_util.patch +kvm-selftests-check-returned-evmcs-version-range.patch diff --git a/queue-4.20/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch b/queue-4.20/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch new file mode 100644 index 00000000000..4929bce8f8d --- /dev/null +++ b/queue-4.20/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch @@ -0,0 +1,98 @@ +From 8ab94631c3e33186e39d076d0fa882ffe9ee8a65 Mon Sep 17 00:00:00 2001 +From: Edward Cree +Date: Tue, 22 Jan 2019 19:02:17 +0000 +Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe + +[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ] + +Use a bitmap to keep track of which partition types we've already seen; + for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and + thus skip adding that partition. +Duplicate partitions occur because of the A/B backup scheme used by newer + sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because + they have the same name, causing us not to expose any MTDs at all. + +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 7eeac3d6cfe89..a497aace7e4f4 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = { + { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" }, + { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" }, + }; ++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types) + + static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + struct efx_mcdi_mtd_partition *part, +- unsigned int type) ++ unsigned int type, ++ unsigned long *found) + { + MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN); + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX); + const struct efx_ef10_nvram_type_info *info; + size_t size, erase_size, outlen; ++ int type_idx = 0; + bool protected; + int rc; + +- for (info = efx_ef10_nvram_types; ; info++) { +- if (info == +- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types)) ++ for (type_idx = 0; ; type_idx++) { ++ if (type_idx == EF10_NVRAM_PARTITION_COUNT) + return -ENODEV; ++ info = efx_ef10_nvram_types + type_idx; + if ((type & ~info->type_mask) == info->type) + break; + } +@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + if (protected) + return -ENODEV; /* hide it */ + ++ /* If we've already exposed a partition of this type, hide this ++ * duplicate. All operations on MTDs are keyed by the type anyway, ++ * so we can't act on the duplicate. ++ */ ++ if (__test_and_set_bit(type_idx, found)) ++ return -EEXIST; ++ + part->nvram_type = type; + + MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type); +@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + static int efx_ef10_mtd_probe(struct efx_nic *efx) + { + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); ++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT); + struct efx_mcdi_mtd_partition *parts; + size_t outlen, n_parts_total, i, n_parts; + unsigned int type; +@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) + for (i = 0; i < n_parts_total; i++) { + type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID, + i); +- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type); +- if (rc == 0) +- n_parts++; +- else if (rc != -ENODEV) ++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type, ++ found); ++ if (rc == -EEXIST || rc == -ENODEV) ++ continue; ++ if (rc) + goto fail; ++ n_parts++; + } + + rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); +-- +2.19.1 + diff --git a/queue-4.20/staging-android-ion-support-cpu-access-during-dma_bu.patch b/queue-4.20/staging-android-ion-support-cpu-access-during-dma_bu.patch new file mode 100644 index 00000000000..266b3a4deda --- /dev/null +++ b/queue-4.20/staging-android-ion-support-cpu-access-during-dma_bu.patch @@ -0,0 +1,51 @@ +From 2fbf520445dacaf4845cc8244e54c3429bdf6e41 Mon Sep 17 00:00:00 2001 +From: Liam Mark +Date: Fri, 18 Jan 2019 10:37:44 -0800 +Subject: staging: android: ion: Support cpu access during dma_buf_detach + +[ Upstream commit 31eb79db420a3f94c4c45a8c0a05cd30e333f981 ] + +Often userspace doesn't know when the kernel will be calling dma_buf_detach +on the buffer. +If userpace starts its CPU access at the same time as the sg list is being +freed it could end up accessing the sg list after it has been freed. + +Thread A Thread B +- DMA_BUF_IOCTL_SYNC IOCT + - ion_dma_buf_begin_cpu_access + - list_for_each_entry + - ion_dma_buf_detatch + - free_duped_table + - dma_sync_sg_for_cpu + +Fix this by getting the ion_buffer lock before freeing the sg table memory. + +Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping") +Signed-off-by: Liam Mark +Acked-by: Laura Abbott +Acked-by: Andrew F. Davis +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/android/ion/ion.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index 99073325b0c00..45c7f829e3872 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf, + struct ion_dma_buf_attachment *a = attachment->priv; + struct ion_buffer *buffer = dmabuf->priv; + +- free_duped_table(a->table); + mutex_lock(&buffer->lock); + list_del(&a->list); + mutex_unlock(&buffer->lock); ++ free_duped_table(a->table); + + kfree(a); + } +-- +2.19.1 + diff --git a/queue-4.20/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch b/queue-4.20/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch new file mode 100644 index 00000000000..af63a7cd67d --- /dev/null +++ b/queue-4.20/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch @@ -0,0 +1,68 @@ +From 00d6a23a619dff64186cd2e6d4fe18ecff0df304 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 16 Jan 2019 06:20:11 -0700 +Subject: staging: rtl8723bs: Fix build error with Clang when inlining is + disabled + +[ Upstream commit 97715058b70da1262fd07798c8b2e3e894f759dd ] + +When CONFIG_NO_AUTO_INLINE was present in linux-next (which added +'-fno-inline-functions' to KBUILD_CFLAGS), an allyesconfig build with +Clang failed at the modpost stage: + +ERROR: "is_broadcast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! +ERROR: "is_zero_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! +ERROR: "is_multicast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! + +These functions were marked as extern inline, meaning that if inlining +doesn't happen, the function will be undefined, as it is above. + +This happens to work with GCC because the '-fno-inline-functions' option +respects the __inline attribute so all instances of these functions are +inlined as expected and the definition doesn't actually matter. However, +with Clang and '-fno-inline-functions', a function has to be marked with +the __always_inline attribute to be considered for inlining, which none +of these functions are. Clang tries to find the symbol definition +elsewhere as it was told and fails, which trickles down to modpost. + +To make sure that this code compiles regardless of compiler and make the +intention of the code clearer, use 'static' to ensure these functions +are always defined, regardless of inlining. Additionally, silence a +checkpatch warning by switching from '__inline' to 'inline'. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/include/ieee80211.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h +index bcc8dfa8e6728..9efb4dcb9d3a8 100644 +--- a/drivers/staging/rtl8723bs/include/ieee80211.h ++++ b/drivers/staging/rtl8723bs/include/ieee80211.h +@@ -850,18 +850,18 @@ enum ieee80211_state { + #define IP_FMT "%pI4" + #define IP_ARG(x) (x) + +-extern __inline int is_multicast_mac_addr(const u8 *addr) ++static inline int is_multicast_mac_addr(const u8 *addr) + { + return ((addr[0] != 0xff) && (0x01 & addr[0])); + } + +-extern __inline int is_broadcast_mac_addr(const u8 *addr) ++static inline int is_broadcast_mac_addr(const u8 *addr) + { + return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) && \ + (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff)); + } + +-extern __inline int is_zero_mac_addr(const u8 *addr) ++static inline int is_zero_mac_addr(const u8 *addr) + { + return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) && \ + (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00)); +-- +2.19.1 + diff --git a/queue-4.20/svm-fix-avic-incomplete-ipi-emulation.patch b/queue-4.20/svm-fix-avic-incomplete-ipi-emulation.patch new file mode 100644 index 00000000000..4bea8a6ba46 --- /dev/null +++ b/queue-4.20/svm-fix-avic-incomplete-ipi-emulation.patch @@ -0,0 +1,58 @@ +From a1742fe7cb3284d42ac4ce5339b99aa9ef70f9c6 Mon Sep 17 00:00:00 2001 +From: Suravee Suthikulpanit +Date: Tue, 22 Jan 2019 10:25:13 +0000 +Subject: svm: Fix AVIC incomplete IPI emulation + +[ Upstream commit bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57 ] + +In case of incomplete IPI with invalid interrupt type, the current +SVM driver does not properly emulate the IPI, and fails to boot +FreeBSD guests with multiple vcpus when enabling AVIC. + +Fix this by update APIC ICR high/low registers, which also +emulate sending the IPI. + +Signed-off-by: Suravee Suthikulpanit +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 13baba9d1cc1a..77a9481ce4c49 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -4486,25 +4486,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) + kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: { +- int i; +- struct kvm_vcpu *vcpu; +- struct kvm *kvm = svm->vcpu.kvm; + struct kvm_lapic *apic = svm->vcpu.arch.apic; + + /* +- * At this point, we expect that the AVIC HW has already +- * set the appropriate IRR bits on the valid target +- * vcpus. So, we just need to kick the appropriate vcpu. ++ * Update ICR high and low, then emulate sending IPI, ++ * which is handled when writing APIC_ICR. + */ +- kvm_for_each_vcpu(i, vcpu, kvm) { +- bool m = kvm_apic_match_dest(vcpu, apic, +- icrl & KVM_APIC_SHORT_MASK, +- GET_APIC_DEST_FIELD(icrh), +- icrl & KVM_APIC_DEST_MASK); +- +- if (m && !avic_vcpu_is_running(vcpu)) +- kvm_vcpu_wake_up(vcpu); +- } ++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh); ++ kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + } + case AVIC_IPI_FAILURE_INVALID_TARGET: +-- +2.19.1 + diff --git a/queue-4.20/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch b/queue-4.20/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch new file mode 100644 index 00000000000..d0c712e8a1a --- /dev/null +++ b/queue-4.20/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch @@ -0,0 +1,34 @@ +From a93dc1bc86f9d3fb967a6a1fda653453df810ef0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 17 Dec 2018 10:02:42 +0300 +Subject: thermal: int340x_thermal: Fix a NULL vs IS_ERR() check + +[ Upstream commit 3fe931b31a4078395c1967f0495dcc9e5ec6b5e3 ] + +The intel_soc_dts_iosf_init() function doesn't return NULL, it returns +error pointers. + +Fixes: 4d0dd6c1576b ("Thermal/int340x/processor_thermal: Enable auxiliary DTS for Braswell") +Signed-off-by: Dan Carpenter +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + drivers/thermal/int340x_thermal/processor_thermal_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index 284cf2c5a8fd9..8e0f665cf06f8 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -423,7 +423,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + proc_priv->soc_dts = intel_soc_dts_iosf_init( + INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0); + +- if (proc_priv->soc_dts && pdev->irq) { ++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) { + ret = pci_enable_msi(pdev); + if (!ret) { + ret = request_threaded_irq(pdev->irq, NULL, +-- +2.19.1 + diff --git a/queue-4.20/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch b/queue-4.20/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch new file mode 100644 index 00000000000..5b804eea25a --- /dev/null +++ b/queue-4.20/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch @@ -0,0 +1,46 @@ +From 0c7d9c6010f0889f0e4b4c21d2dcb5c91c63d939 Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Fri, 18 Jan 2019 16:23:05 -0800 +Subject: tty: serial: qcom_geni_serial: Allow mctrl when flow control is + disabled + +[ Upstream commit e8a6ca808c5ed1e2b43ab25f1f2cbd43a7574f73 ] + +The geni set/get_mctrl() functions currently do nothing unless +hardware flow control is enabled. Remove this arbitrary limitation. + +Suggested-by: Johan Hovold +Fixes: 8a8a66a1a18a ("tty: serial: qcom_geni_serial: Add support for flow control") +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/qcom_geni_serial.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index d3b5261ee80af..76e0ad7251e1f 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -221,7 +221,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport) + unsigned int mctrl = TIOCM_DSR | TIOCM_CAR; + u32 geni_ios; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) { ++ if (uart_console(uport)) { + mctrl |= TIOCM_CTS; + } else { + geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS); +@@ -237,7 +237,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport, + { + u32 uart_manual_rfr = 0; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) ++ if (uart_console(uport)) + return; + + if (!(mctrl & TIOCM_RTS)) +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch b/queue-4.20/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch new file mode 100644 index 00000000000..29c4e6f72a8 --- /dev/null +++ b/queue-4.20/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch @@ -0,0 +1,57 @@ +From 60cc937be7fe956bf076dfce7cd4b2adeec5444f Mon Sep 17 00:00:00 2001 +From: Zeng Tao +Date: Wed, 26 Dec 2018 19:22:00 +0800 +Subject: usb: dwc3: gadget: Fix the uninitialized link_state when udc starts + +[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ] + +Currently the link_state is uninitialized and the default value is 0(U0) +before the first time we start the udc, and after we start the udc then + stop the udc, the link_state will be undefined. +We may have the following warnings if we start the udc again with +an undefined link_state: + +WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308 +dwc3 100e0000.hidwc3_0: wakeup failed --> -22 +[...] +Call Trace: +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0x84/0x98) +[] (dump_stack) from [] (__warn+0xe8/0x100) +[] (__warn) from [](warn_slowpath_fmt+0x38/0x48) +[] (warn_slowpath_fmt) from [](dwc3_send_gadget_ep_cmd+0x304/0x308) +[] (dwc3_send_gadget_ep_cmd) from [](dwc3_ep0_start_trans+0x48/0xf4) +[] (dwc3_ep0_start_trans) from [](dwc3_ep0_out_start+0x64/0x80) +[] (dwc3_ep0_out_start) from [](__dwc3_gadget_start+0x1e0/0x278) +[] (__dwc3_gadget_start) from [](dwc3_gadget_start+0x88/0x10c) +[] (dwc3_gadget_start) from [](udc_bind_to_driver+0x88/0xbc) +[] (udc_bind_to_driver) from [](usb_gadget_probe_driver+0xf8/0x140) +[] (usb_gadget_probe_driver) from [](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite]) +[] (gadget_dev_desc_UDC_store [libcomposite]) from[] (configfs_write_file+0xd4/0x160) +[] (configfs_write_file) from [] (__vfs_write+0x1c/0x114) +[] (__vfs_write) from [] (vfs_write+0xa4/0x168) +[] (vfs_write) from [] (SyS_write+0x3c/0x90) +[] (SyS_write) from [] (ret_fast_syscall+0x0/0x3c) + +Signed-off-by: Zeng Tao +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index a7f6255606443..bf1cb91ef494d 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1873,6 +1873,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) + + /* begin to receive SETUP packets */ + dwc->ep0state = EP0_SETUP_PHASE; ++ dwc->link_state = DWC3_LINK_STATE_SS_DIS; + dwc3_ep0_out_start(dwc); + + dwc3_gadget_enable_irq(dwc); +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch b/queue-4.20/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch new file mode 100644 index 00000000000..119f750aa41 --- /dev/null +++ b/queue-4.20/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch @@ -0,0 +1,38 @@ +From 1aec536908e052ee6d05e94974e82d27f30a6093 Mon Sep 17 00:00:00 2001 +From: Bo He +Date: Mon, 14 Jan 2019 09:48:32 +0200 +Subject: usb: dwc3: gadget: synchronize_irq dwc irq in suspend + +[ Upstream commit 01c10880d24291a96a4ab0da773e3c5ce4d12da8 ] + +We see dwc3 endpoint stopped by unwanted irq during +suspend resume test, which is caused dwc3 ep can't be started +with error "No Resource". + +Here, add synchronize_irq before suspend to sync the +pending IRQ handlers complete. + +Signed-off-by: Bo He +Signed-off-by: Yu Wang +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 5a5b37e0a140f..a7f6255606443 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3283,6 +3283,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + ++ synchronize_irq(dwc->irq_gadget); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/usb-gadget-potential-null-dereference-on-allocation-.patch b/queue-4.20/usb-gadget-potential-null-dereference-on-allocation-.patch new file mode 100644 index 00000000000..0e4dfba7572 --- /dev/null +++ b/queue-4.20/usb-gadget-potential-null-dereference-on-allocation-.patch @@ -0,0 +1,37 @@ +From 64e4d93653a95aa64ec0a39b9a5d212e33d90957 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 21 Dec 2018 23:42:52 +0300 +Subject: usb: gadget: Potential NULL dereference on allocation error + +[ Upstream commit df28169e1538e4a8bcd8b779b043e5aa6524545c ] + +The source_sink_alloc_func() function is supposed to return error +pointers on error. The function is called from usb_get_function() which +doesn't check for NULL returns so it would result in an Oops. + +Of course, in the current kernel, small allocations always succeed so +this doesn't affect runtime. + +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_sourcesink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c +index 9cdef108fb1b3..ed68a4860b7d8 100644 +--- a/drivers/usb/gadget/function/f_sourcesink.c ++++ b/drivers/usb/gadget/function/f_sourcesink.c +@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func( + + ss = kzalloc(sizeof(*ss), GFP_KERNEL); + if (!ss) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + ss_opts = container_of(fi, struct f_ss_opts, func_inst); + +-- +2.19.1 + diff --git a/queue-4.20/writeback-synchronize-sync-2-against-cgroup-writebac.patch b/queue-4.20/writeback-synchronize-sync-2-against-cgroup-writebac.patch new file mode 100644 index 00000000000..cf6b2c6bdec --- /dev/null +++ b/queue-4.20/writeback-synchronize-sync-2-against-cgroup-writebac.patch @@ -0,0 +1,168 @@ +From 627392accf541d7ecfa56b4ec7c4cd60667a4ac0 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 12 Dec 2017 08:38:30 -0800 +Subject: writeback: synchronize sync(2) against cgroup writeback membership + switches + +[ Upstream commit 7fc5854f8c6efae9e7624970ab49a1eac2faefb1 ] + +sync_inodes_sb() can race against cgwb (cgroup writeback) membership +switches and fail to writeback some inodes. For example, if an inode +switches to another wb while sync_inodes_sb() is in progress, the new +wb might not be visible to bdi_split_work_to_wbs() at all or the inode +might jump from a wb which hasn't issued writebacks yet to one which +already has. + +This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb +switch path against sync_inodes_sb() so that sync_inodes_sb() is +guaranteed to see all the target wbs and inodes can't jump wbs to +escape syncing. + +v2: Fixed misplaced rwsem init. Spotted by Jiufei. + +Signed-off-by: Tejun Heo +Reported-by: Jiufei Xue +Link: http://lkml.kernel.org/r/dc694ae2-f07f-61e1-7097-7c8411cee12d@gmail.com +Acked-by: Jan Kara +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/fs-writeback.c | 40 ++++++++++++++++++++++++++++++-- + include/linux/backing-dev-defs.h | 1 + + mm/backing-dev.c | 1 + + 3 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index b40168fcc94a6..36855c1f8dafd 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -331,11 +331,22 @@ struct inode_switch_wbs_context { + struct work_struct work; + }; + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ down_write(&bdi->wb_switch_rwsem); ++} ++ ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ up_write(&bdi->wb_switch_rwsem); ++} ++ + static void inode_switch_wbs_work_fn(struct work_struct *work) + { + struct inode_switch_wbs_context *isw = + container_of(work, struct inode_switch_wbs_context, work); + struct inode *inode = isw->inode; ++ struct backing_dev_info *bdi = inode_to_bdi(inode); + struct address_space *mapping = inode->i_mapping; + struct bdi_writeback *old_wb = inode->i_wb; + struct bdi_writeback *new_wb = isw->new_wb; +@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + struct page *page; + bool switched = false; + ++ /* ++ * If @inode switches cgwb membership while sync_inodes_sb() is ++ * being issued, sync_inodes_sb() might miss it. Synchronize. ++ */ ++ down_read(&bdi->wb_switch_rwsem); ++ + /* + * By the time control reaches here, RCU grace period has passed + * since I_WB_SWITCH assertion and all wb stat update transactions +@@ -428,6 +445,8 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + spin_unlock(&new_wb->list_lock); + spin_unlock(&old_wb->list_lock); + ++ up_read(&bdi->wb_switch_rwsem); ++ + if (switched) { + wb_wakeup(new_wb); + wb_put(old_wb); +@@ -468,9 +487,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + if (inode->i_state & I_WB_SWITCH) + return; + ++ /* ++ * Avoid starting new switches while sync_inodes_sb() is in ++ * progress. Otherwise, if the down_write protected issue path ++ * blocks heavily, we might end up starting a large number of ++ * switches which will block on the rwsem. ++ */ ++ if (!down_read_trylock(&bdi->wb_switch_rwsem)) ++ return; ++ + isw = kzalloc(sizeof(*isw), GFP_ATOMIC); + if (!isw) +- return; ++ goto out_unlock; + + /* find and pin the new wb */ + rcu_read_lock(); +@@ -504,12 +532,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + * Let's continue after I_WB_SWITCH is guaranteed to be visible. + */ + call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); +- return; ++ goto out_unlock; + + out_free: + if (isw->new_wb) + wb_put(isw->new_wb); + kfree(isw); ++out_unlock: ++ up_read(&bdi->wb_switch_rwsem); + } + + /** +@@ -887,6 +917,9 @@ fs_initcall(cgroup_writeback_init); + + #else /* CONFIG_CGROUP_WRITEBACK */ + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++ + static struct bdi_writeback * + locked_inode_to_wb_and_lock_list(struct inode *inode) + __releases(&inode->i_lock) +@@ -2413,8 +2446,11 @@ void sync_inodes_sb(struct super_block *sb) + return; + WARN_ON(!rwsem_is_locked(&sb->s_umount)); + ++ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */ ++ bdi_down_write_wb_switch_rwsem(bdi); + bdi_split_work_to_wbs(bdi, &work, false); + wb_wait_for_completion(bdi, &done); ++ bdi_up_write_wb_switch_rwsem(bdi); + + wait_sb_inodes(sb); + } +diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h +index c311571355981..07e02d6df5ad9 100644 +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -190,6 +190,7 @@ struct backing_dev_info { + struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ + struct rb_root cgwb_congested_tree; /* their congested states */ + struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */ ++ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */ + #else + struct bdi_writeback_congested *wb_congested; + #endif +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 8a8bb8796c6c4..72e6d0c55cfad 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) + INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); + bdi->cgwb_congested_tree = RB_ROOT; + mutex_init(&bdi->cgwb_release_mutex); ++ init_rwsem(&bdi->wb_switch_rwsem); + + ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); + if (!ret) { +-- +2.19.1 + diff --git a/queue-4.20/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch b/queue-4.20/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch new file mode 100644 index 00000000000..4c5b586b837 --- /dev/null +++ b/queue-4.20/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch @@ -0,0 +1,48 @@ +From e5805108c87925e5c64de8b91a5268e7cfe6dc0f Mon Sep 17 00:00:00 2001 +From: Peng Hao +Date: Sat, 29 Dec 2018 14:34:12 +0800 +Subject: x86/mm/mem_encrypt: Fix erroneous sizeof() + +[ Upstream commit bf7d28c53453ea904584960de55e33e03b9d93b1 ] + +Using sizeof(pointer) for determining the size of a memset() only works +when the size of the pointer and the size of type to which it points are +the same. For pte_t this is only true for 64bit and 32bit-NONPAE. On 32bit +PAE systems this is wrong as the pointer size is 4 byte but the PTE entry +is 8 bytes. It's actually not a real world issue as this code depends on +64bit, but it's wrong nevertheless. + +Use sizeof(*p) for correctness sake. + +Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()") +Signed-off-by: Peng Hao +Signed-off-by: Thomas Gleixner +Cc: Kirill A. Shutemov +Cc: Tom Lendacky +Cc: dave.hansen@linux.intel.com +Cc: peterz@infradead.org +Cc: luto@kernel.org +Link: https://lkml.kernel.org/r/1546065252-97996-1-git-send-email-peng.hao2@zte.com.cn +Signed-off-by: Sasha Levin +--- + arch/x86/mm/mem_encrypt_identity.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c +index a19ef1a416ff6..4aa9b1480866b 100644 +--- a/arch/x86/mm/mem_encrypt_identity.c ++++ b/arch/x86/mm/mem_encrypt_identity.c +@@ -158,8 +158,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd) + pmd = pmd_offset(pud, ppd->vaddr); + if (pmd_none(*pmd)) { + pte = ppd->pgtable_area; +- memset(pte, 0, sizeof(pte) * PTRS_PER_PTE); +- ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE; ++ memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE); ++ ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE; + set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte))); + } + +-- +2.19.1 +