From: Greg Kroah-Hartman Date: Thu, 23 May 2019 08:46:26 +0000 (+0200) Subject: 5.1-stable patches X-Git-Tag: v5.1.5~42 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b32881e5702cda936b3a781e0f0357dbb200808a;p=thirdparty%2Fkernel%2Fstable-queue.git 5.1-stable patches added patches: blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch brd-re-enable-__gfp_highmem-in-brd_insert_page.patch cifs-fix-credits-leak-for-smb1-oplock-breaks.patch cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch intel_th-msu-fix-single-mode-with-iommu.patch md-add-a-missing-endianness-conversion-in-check_sb_changes.patch md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch md-batch-flush-requests.patch media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch media-imx-csi-allow-unknown-nearest-upstream-entities.patch media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch media-imx-rename-functions-that-add-ipu-internal-subdevs.patch media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch media-seco-cec-fix-building-with-rc_core-m.patch of-fix-clang-wunsequenced-for-be32_to_cpu.patch p54-drop-device-reference-count-if-fails-to-enable-device.patch parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch parisc-add-memory-clobber-to-tlb-purges.patch parisc-allow-live-patching-of-__meminit-functions.patch parisc-export-running_on_qemu-symbol-for-modules.patch parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch parisc-skip-registering-led-when-running-in-qemu.patch parisc-use-pa_asm_level-in-boot-code.patch phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch proc-prevent-changes-to-overridden-credentials.patch regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch revert-md-fix-lock-contention-for-flush-bios.patch stm-class-fix-channel-bitmap-on-32-bit-systems.patch stm-class-fix-channel-free-in-stm-output-free-path.patch --- diff --git a/queue-5.1/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch b/queue-5.1/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch new file mode 100644 index 00000000000..4f8de9c8fb7 --- /dev/null +++ b/queue-5.1/blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch @@ -0,0 +1,130 @@ +From c7e2d94b3d1634988a95ac4d77a72dc7487ece06 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Tue, 30 Apr 2019 09:52:25 +0800 +Subject: blk-mq: free hw queue's resource in hctx's release handler + +From: Ming Lei + +commit c7e2d94b3d1634988a95ac4d77a72dc7487ece06 upstream. + +Once blk_cleanup_queue() returns, tags shouldn't be used any more, +because blk_mq_free_tag_set() may be called. Commit 45a9c9d909b2 +("blk-mq: Fix a use-after-free") fixes this issue exactly. + +However, that commit introduces another issue. Before 45a9c9d909b2, +we are allowed to run queue during cleaning up queue if the queue's +kobj refcount is held. After that commit, queue can't be run during +queue cleaning up, otherwise oops can be triggered easily because +some fields of hctx are freed by blk_mq_free_queue() in blk_cleanup_queue(). + +We have invented ways for addressing this kind of issue before, such as: + + 8dc765d438f1 ("SCSI: fix queue cleanup race before queue initialization is done") + c2856ae2f315 ("blk-mq: quiesce queue before freeing queue") + +But still can't cover all cases, recently James reports another such +kind of issue: + + https://marc.info/?l=linux-scsi&m=155389088124782&w=2 + +This issue can be quite hard to address by previous way, given +scsi_run_queue() may run requeues for other LUNs. + +Fixes the above issue by freeing hctx's resources in its release handler, and this +way is safe becasue tags isn't needed for freeing such hctx resource. + +This approach follows typical design pattern wrt. kobject's release handler. + +Cc: Dongli Zhang +Cc: James Smart +Cc: Bart Van Assche +Cc: linux-scsi@vger.kernel.org, +Cc: Martin K . Petersen , +Cc: Christoph Hellwig , +Cc: James E . J . Bottomley , +Reported-by: James Smart +Fixes: 45a9c9d909b2 ("blk-mq: Fix a use-after-free") +Cc: stable@vger.kernel.org +Reviewed-by: Hannes Reinecke +Reviewed-by: Christoph Hellwig +Tested-by: James Smart +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + block/blk-core.c | 2 +- + block/blk-mq-sysfs.c | 6 ++++++ + block/blk-mq.c | 8 ++------ + block/blk-mq.h | 2 +- + 4 files changed, 10 insertions(+), 8 deletions(-) + +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -375,7 +375,7 @@ void blk_cleanup_queue(struct request_qu + blk_exit_queue(q); + + if (queue_is_mq(q)) +- blk_mq_free_queue(q); ++ blk_mq_exit_queue(q); + + percpu_ref_exit(&q->q_usage_counter); + +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -10,6 +10,7 @@ + #include + + #include ++#include "blk.h" + #include "blk-mq.h" + #include "blk-mq-tag.h" + +@@ -33,6 +34,11 @@ static void blk_mq_hw_sysfs_release(stru + { + struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx, + kobj); ++ ++ if (hctx->flags & BLK_MQ_F_BLOCKING) ++ cleanup_srcu_struct(hctx->srcu); ++ blk_free_flush_queue(hctx->fq); ++ sbitmap_free(&hctx->ctx_map); + free_cpumask_var(hctx->cpumask); + kfree(hctx->ctxs); + kfree(hctx); +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2267,12 +2267,7 @@ static void blk_mq_exit_hctx(struct requ + if (set->ops->exit_hctx) + set->ops->exit_hctx(hctx, hctx_idx); + +- if (hctx->flags & BLK_MQ_F_BLOCKING) +- cleanup_srcu_struct(hctx->srcu); +- + blk_mq_remove_cpuhp(hctx); +- blk_free_flush_queue(hctx->fq); +- sbitmap_free(&hctx->ctx_map); + } + + static void blk_mq_exit_hw_queues(struct request_queue *q, +@@ -2905,7 +2900,8 @@ err_exit: + } + EXPORT_SYMBOL(blk_mq_init_allocated_queue); + +-void blk_mq_free_queue(struct request_queue *q) ++/* tags can _not_ be used after returning from blk_mq_exit_queue */ ++void blk_mq_exit_queue(struct request_queue *q) + { + struct blk_mq_tag_set *set = q->tag_set; + +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -37,7 +37,7 @@ struct blk_mq_ctx { + struct kobject kobj; + } ____cacheline_aligned_in_smp; + +-void blk_mq_free_queue(struct request_queue *q); ++void blk_mq_exit_queue(struct request_queue *q); + int blk_mq_update_nr_requests(struct request_queue *q, unsigned int nr); + void blk_mq_wake_waiters(struct request_queue *q); + bool blk_mq_dispatch_rq_list(struct request_queue *, struct list_head *, bool); diff --git a/queue-5.1/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch b/queue-5.1/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch new file mode 100644 index 00000000000..9a4a113c40f --- /dev/null +++ b/queue-5.1/brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch @@ -0,0 +1,75 @@ +From b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Mon, 22 Apr 2019 22:41:23 +0200 +Subject: brcmfmac: Add DMI nvram filename quirk for ACEPC T8 and T11 mini PCs + +From: Hans de Goede + +commit b1a0ba8f772d7a6dcb5aa3e856f5bd8274989ebe upstream. + +The ACEPC T8 and T11 mini PCs contain quite generic names in the sys_vendor +and product_name DMI strings, without this patch brcmfmac will try to load: +"brcmfmac43455-sdio.Default string-Default string.txt" as nvram file which +is way too generic. + +The DMI strings on which we are matching are somewhat generic too, but +"To be filled by O.E.M." is less common then "Default string" and the +system-sku and bios-version strings are pretty unique. Beside the DMI +strings we also check the wifi-module chip-id and revision. I'm confident +that the combination of all this is unique. + +Both the T8 and T11 use the same wifi-module, this commit adds DMI +quirks for both mini PCs pointing to brcmfmac43455-sdio.acepc-t8.txt . + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1690852 +Cc: stable@vger.kernel.org +Signed-off-by: Hans de Goede +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c | 26 +++++++++++++++++ + 1 file changed, 26 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c +@@ -31,6 +31,10 @@ struct brcmf_dmi_data { + + /* NOTE: Please keep all entries sorted alphabetically */ + ++static const struct brcmf_dmi_data acepc_t8_data = { ++ BRCM_CC_4345_CHIP_ID, 6, "acepc-t8" ++}; ++ + static const struct brcmf_dmi_data gpd_win_pocket_data = { + BRCM_CC_4356_CHIP_ID, 2, "gpd-win-pocket" + }; +@@ -49,6 +53,28 @@ static const struct brcmf_dmi_data pov_t + + static const struct dmi_system_id dmi_platform_data[] = { + { ++ /* ACEPC T8 Cherry Trail Z8350 mini PC */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T8"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { ++ /* ACEPC T11 Cherry Trail Z8350 mini PC, same wifi as the T8 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "To be filled by O.E.M."), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "T11"), ++ /* also match on somewhat unique bios-version */ ++ DMI_EXACT_MATCH(DMI_BIOS_VERSION, "1.000"), ++ }, ++ .driver_data = (void *)&acepc_t8_data, ++ }, ++ { + /* Match for the GPDwin which unfortunately uses somewhat + * generic dmi strings, which is why we test for 4 strings. + * Comparing against 23 other byt/cht boards, board_vendor diff --git a/queue-5.1/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch b/queue-5.1/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch new file mode 100644 index 00000000000..017ce52d25a --- /dev/null +++ b/queue-5.1/brd-re-enable-__gfp_highmem-in-brd_insert_page.patch @@ -0,0 +1,43 @@ +From f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 Mon Sep 17 00:00:00 2001 +From: Hou Tao +Date: Mon, 22 Apr 2019 21:23:21 +0800 +Subject: brd: re-enable __GFP_HIGHMEM in brd_insert_page() + +From: Hou Tao + +commit f6b50160a06d4a0d6a3999ab0c5aec4f52dba248 upstream. + +__GFP_HIGHMEM is disabled if dax is enabled on brd, however +dax support for brd has been removed since commit (7a862fbbdec6 +"brd: remove dax support"), so restore __GFP_HIGHMEM in +brd_insert_page(). + +Also remove the no longer applicable comments about DAX and highmem. + +Cc: stable@vger.kernel.org +Fixes: 7a862fbbdec6 ("brd: remove dax support") +Signed-off-by: Hou Tao +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/brd.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -96,13 +96,8 @@ static struct page *brd_insert_page(stru + /* + * Must use NOIO because we don't want to recurse back into the + * block or filesystem layers from page reclaim. +- * +- * Cannot support DAX and highmem, because our ->direct_access +- * routine for DAX must return memory that is always addressable. +- * If DAX was reworked to use pfns and kmap throughout, this +- * restriction might be able to be lifted. + */ +- gfp_flags = GFP_NOIO | __GFP_ZERO; ++ gfp_flags = GFP_NOIO | __GFP_ZERO | __GFP_HIGHMEM; + page = alloc_page(gfp_flags); + if (!page) + return NULL; diff --git a/queue-5.1/cifs-fix-credits-leak-for-smb1-oplock-breaks.patch b/queue-5.1/cifs-fix-credits-leak-for-smb1-oplock-breaks.patch new file mode 100644 index 00000000000..fd77f8d20ba --- /dev/null +++ b/queue-5.1/cifs-fix-credits-leak-for-smb1-oplock-breaks.patch @@ -0,0 +1,77 @@ +From d69cb728e70c40268762182a62f5d5d6fa51c5b2 Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Wed, 1 May 2019 12:03:41 +1000 +Subject: cifs: fix credits leak for SMB1 oplock breaks + +From: Ronnie Sahlberg + +commit d69cb728e70c40268762182a62f5d5d6fa51c5b2 upstream. + +For SMB1 oplock breaks we would grab one credit while sending the PDU +but we would never relese the credit back since we will never receive a +response to this from the server. Eventuallt this would lead to a hang +once all credits are leaked. + +Fix this by defining a new flag CIFS_NO_SRV_RSP which indicates that there +is no server response to this command and thus we need to add any credits back +immediately after sending the PDU. + +CC: Stable #v5.0+ +Signed-off-by: Ronnie Sahlberg +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/cifsglob.h | 1 + + fs/cifs/cifssmb.c | 2 +- + fs/cifs/transport.c | 10 +++++----- + 3 files changed, 7 insertions(+), 6 deletions(-) + +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1687,6 +1687,7 @@ static inline bool is_retryable_error(in + + #define CIFS_HAS_CREDITS 0x0400 /* already has credits */ + #define CIFS_TRANSFORM_REQ 0x0800 /* transform request before sending */ ++#define CIFS_NO_SRV_RSP 0x1000 /* there is no server response */ + + /* Security Flags: indicate type of session setup needed */ + #define CIFSSEC_MAY_SIGN 0x00001 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -2540,7 +2540,7 @@ CIFSSMBLock(const unsigned int xid, stru + + if (lockType == LOCKING_ANDX_OPLOCK_RELEASE) { + /* no response expected */ +- flags = CIFS_ASYNC_OP | CIFS_OBREAK_OP; ++ flags = CIFS_NO_SRV_RSP | CIFS_ASYNC_OP | CIFS_OBREAK_OP; + pSMB->Timeout = 0; + } else if (waitFlag) { + flags = CIFS_BLOCKING_OP; /* blocking operation, no timeout */ +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -1054,8 +1054,11 @@ compound_send_recv(const unsigned int xi + + mutex_unlock(&ses->server->srv_mutex); + +- if (rc < 0) { +- /* Sending failed for some reason - return credits back */ ++ /* ++ * If sending failed for some reason or it is an oplock break that we ++ * will not receive a response to - return credits back ++ */ ++ if (rc < 0 || (flags & CIFS_NO_SRV_RSP)) { + for (i = 0; i < num_rqst; i++) + add_credits(ses->server, &credits[i], optype); + goto out; +@@ -1076,9 +1079,6 @@ compound_send_recv(const unsigned int xi + smb311_update_preauth_hash(ses, rqst[0].rq_iov, + rqst[0].rq_nvec); + +- if ((flags & CIFS_TIMEOUT_MASK) == CIFS_ASYNC_OP) +- goto out; +- + for (i = 0; i < num_rqst; i++) { + rc = wait_for_response(ses->server, midQ[i]); + if (rc != 0) diff --git a/queue-5.1/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch b/queue-5.1/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch new file mode 100644 index 00000000000..a0aee93b6a2 --- /dev/null +++ b/queue-5.1/cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch @@ -0,0 +1,62 @@ +From 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb Mon Sep 17 00:00:00 2001 +From: Christoph Probst +Date: Tue, 7 May 2019 17:16:40 +0200 +Subject: cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() + +From: Christoph Probst + +commit 6a54b2e002c9d00b398d35724c79f9fe0d9b38fb upstream. + +Change strcat to strncpy in the "None" case to fix a buffer overflow +when cinode->oplock is reset to 0 by another thread accessing the same +cinode. It is never valid to append "None" to any other message. + +Consolidate multiple writes to cinode->oplock to reduce raciness. + +Signed-off-by: Christoph Probst +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +CC: Stable +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/smb2ops.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -2917,26 +2917,28 @@ smb21_set_oplock_level(struct cifsInodeI + unsigned int epoch, bool *purge_cache) + { + char message[5] = {0}; ++ unsigned int new_oplock = 0; + + oplock &= 0xFF; + if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE) + return; + +- cinode->oplock = 0; + if (oplock & SMB2_LEASE_READ_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_READ_FLG; ++ new_oplock |= CIFS_CACHE_READ_FLG; + strcat(message, "R"); + } + if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_HANDLE_FLG; ++ new_oplock |= CIFS_CACHE_HANDLE_FLG; + strcat(message, "H"); + } + if (oplock & SMB2_LEASE_WRITE_CACHING_HE) { +- cinode->oplock |= CIFS_CACHE_WRITE_FLG; ++ new_oplock |= CIFS_CACHE_WRITE_FLG; + strcat(message, "W"); + } +- if (!cinode->oplock) +- strcat(message, "None"); ++ if (!new_oplock) ++ strncpy(message, "None", sizeof(message)); ++ ++ cinode->oplock = new_oplock; + cifs_dbg(FYI, "%s Lease granted on inode %p\n", message, + &cinode->vfs_inode); + } diff --git a/queue-5.1/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch b/queue-5.1/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch new file mode 100644 index 00000000000..88e4fe18cbc --- /dev/null +++ b/queue-5.1/dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch @@ -0,0 +1,171 @@ +From 5467a68cbf6884c9a9d91e2a89140afb1839c835 Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Fri, 15 Mar 2019 22:23:19 -0400 +Subject: dcache: sort the freeing-without-RCU-delay mess for good. + +From: Al Viro + +commit 5467a68cbf6884c9a9d91e2a89140afb1839c835 upstream. + +For lockless accesses to dentries we don't have pinned we rely +(among other things) upon having an RCU delay between dropping +the last reference and actually freeing the memory. + +On the other hand, for things like pipes and sockets we neither +do that kind of lockless access, nor want to deal with the +overhead of an RCU delay every time a socket gets closed. + +So delay was made optional - setting DCACHE_RCUACCESS in ->d_flags +made sure it would happen. We tried to avoid setting it unless +we knew we need it. Unfortunately, that had led to recurring +class of bugs, in which we missed the need to set it. + +We only really need it for dentries that are created by +d_alloc_pseudo(), so let's not bother with trying to be smart - +just make having an RCU delay the default. The ones that do +*not* get it set the replacement flag (DCACHE_NORCU) and we'd +better use that sparingly. d_alloc_pseudo() is the only +such user right now. + +FWIW, the race that finally prompted that switch had been +between __lock_parent() of immediate subdirectory of what's +currently the root of a disconnected tree (e.g. from +open-by-handle in progress) racing with d_splice_alias() +elsewhere picking another alias for the same inode, either +on outright corrupted fs image, or (in case of open-by-handle +on NFS) that subdirectory having been just moved on server. +It's not easy to hit, so the sky is not falling, but that's +not the first race on similar missed cases and the logics +for settinf DCACHE_RCUACCESS has gotten ridiculously +convoluted. + +Cc: stable@vger.kernel.org +Signed-off-by: Al Viro +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/filesystems/porting | 5 +++++ + fs/dcache.c | 24 +++++++++++++----------- + fs/nsfs.c | 3 +-- + include/linux/dcache.h | 2 +- + 4 files changed, 20 insertions(+), 14 deletions(-) + +--- a/Documentation/filesystems/porting ++++ b/Documentation/filesystems/porting +@@ -638,3 +638,8 @@ in your dentry operations instead. + inode to d_splice_alias() will also do the right thing (equivalent of + d_add(dentry, NULL); return NULL;), so that kind of special cases + also doesn't need a separate treatment. ++-- ++[mandatory] ++ DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the ++ default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any ++ business doing so. +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -344,7 +344,7 @@ static void dentry_free(struct dentry *d + } + } + /* if dentry was never visible to RCU, immediate free is OK */ +- if (!(dentry->d_flags & DCACHE_RCUACCESS)) ++ if (dentry->d_flags & DCACHE_NORCU) + __d_free(&dentry->d_u.d_rcu); + else + call_rcu(&dentry->d_u.d_rcu, __d_free); +@@ -1701,7 +1701,6 @@ struct dentry *d_alloc(struct dentry * p + struct dentry *dentry = __d_alloc(parent->d_sb, name); + if (!dentry) + return NULL; +- dentry->d_flags |= DCACHE_RCUACCESS; + spin_lock(&parent->d_lock); + /* + * don't need child lock because it is not subject +@@ -1726,7 +1725,7 @@ struct dentry *d_alloc_cursor(struct den + { + struct dentry *dentry = d_alloc_anon(parent->d_sb); + if (dentry) { +- dentry->d_flags |= DCACHE_RCUACCESS | DCACHE_DENTRY_CURSOR; ++ dentry->d_flags |= DCACHE_DENTRY_CURSOR; + dentry->d_parent = dget(parent); + } + return dentry; +@@ -1739,10 +1738,17 @@ struct dentry *d_alloc_cursor(struct den + * + * For a filesystem that just pins its dentries in memory and never + * performs lookups at all, return an unhashed IS_ROOT dentry. ++ * This is used for pipes, sockets et.al. - the stuff that should ++ * never be anyone's children or parents. Unlike all other ++ * dentries, these will not have RCU delay between dropping the ++ * last reference and freeing them. + */ + struct dentry *d_alloc_pseudo(struct super_block *sb, const struct qstr *name) + { +- return __d_alloc(sb, name); ++ struct dentry *dentry = __d_alloc(sb, name); ++ if (likely(dentry)) ++ dentry->d_flags |= DCACHE_NORCU; ++ return dentry; + } + EXPORT_SYMBOL(d_alloc_pseudo); + +@@ -1911,12 +1917,10 @@ struct dentry *d_make_root(struct inode + + if (root_inode) { + res = d_alloc_anon(root_inode->i_sb); +- if (res) { +- res->d_flags |= DCACHE_RCUACCESS; ++ if (res) + d_instantiate(res, root_inode); +- } else { ++ else + iput(root_inode); +- } + } + return res; + } +@@ -2781,9 +2785,7 @@ static void __d_move(struct dentry *dent + copy_name(dentry, target); + target->d_hash.pprev = NULL; + dentry->d_parent->d_lockref.count++; +- if (dentry == old_parent) +- dentry->d_flags |= DCACHE_RCUACCESS; +- else ++ if (dentry != old_parent) /* wasn't IS_ROOT */ + WARN_ON(!--old_parent->d_lockref.count); + } else { + target->d_parent = old_parent; +--- a/fs/nsfs.c ++++ b/fs/nsfs.c +@@ -85,13 +85,12 @@ slow: + inode->i_fop = &ns_file_operations; + inode->i_private = ns; + +- dentry = d_alloc_pseudo(mnt->mnt_sb, &empty_name); ++ dentry = d_alloc_anon(mnt->mnt_sb); + if (!dentry) { + iput(inode); + return ERR_PTR(-ENOMEM); + } + d_instantiate(dentry, inode); +- dentry->d_flags |= DCACHE_RCUACCESS; + dentry->d_fsdata = (void *)ns->ops; + d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); + if (d) { +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -176,7 +176,6 @@ struct dentry_operations { + * typically using d_splice_alias. */ + + #define DCACHE_REFERENCED 0x00000040 /* Recently used, don't discard. */ +-#define DCACHE_RCUACCESS 0x00000080 /* Entry has ever been RCU-visible */ + + #define DCACHE_CANT_MOUNT 0x00000100 + #define DCACHE_GENOCIDE 0x00000200 +@@ -217,6 +216,7 @@ struct dentry_operations { + + #define DCACHE_PAR_LOOKUP 0x10000000 /* being looked up (with parent locked shared) */ + #define DCACHE_DENTRY_CURSOR 0x20000000 ++#define DCACHE_NORCU 0x40000000 /* No RCU delay for freeing */ + + extern seqlock_t rename_lock; + diff --git a/queue-5.1/intel_th-msu-fix-single-mode-with-iommu.patch b/queue-5.1/intel_th-msu-fix-single-mode-with-iommu.patch new file mode 100644 index 00000000000..bf101b4f064 --- /dev/null +++ b/queue-5.1/intel_th-msu-fix-single-mode-with-iommu.patch @@ -0,0 +1,104 @@ +From 4e0eaf239fb33ebc671303e2b736fa043462e2f4 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Fri, 3 May 2019 11:44:34 +0300 +Subject: intel_th: msu: Fix single mode with IOMMU + +From: Alexander Shishkin + +commit 4e0eaf239fb33ebc671303e2b736fa043462e2f4 upstream. + +Currently, the pages that are allocated for the single mode of MSC are not +mapped into the device's dma space and the code is incorrectly using +*_to_phys() in place of a dma address. This fails with IOMMU enabled and +is otherwise bad practice. + +Fix the single mode buffer allocation to map the pages into the device's +DMA space. + +Signed-off-by: Alexander Shishkin +Fixes: ba82664c134e ("intel_th: Add Memory Storage Unit driver") +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/intel_th/msu.c | 35 ++++++++++++++++++++++++++++++++--- + 1 file changed, 32 insertions(+), 3 deletions(-) + +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -84,6 +84,7 @@ struct msc_iter { + * @reg_base: register window base address + * @thdev: intel_th_device pointer + * @win_list: list of windows in multiblock mode ++ * @single_sgt: single mode buffer + * @nr_pages: total number of pages allocated for this buffer + * @single_sz: amount of data in single mode + * @single_wrap: single mode wrap occurred +@@ -104,6 +105,7 @@ struct msc { + struct intel_th_device *thdev; + + struct list_head win_list; ++ struct sg_table single_sgt; + unsigned long nr_pages; + unsigned long single_sz; + unsigned int single_wrap : 1; +@@ -617,22 +619,45 @@ static void intel_th_msc_deactivate(stru + */ + static int msc_buffer_contig_alloc(struct msc *msc, unsigned long size) + { ++ unsigned long nr_pages = size >> PAGE_SHIFT; + unsigned int order = get_order(size); + struct page *page; ++ int ret; + + if (!size) + return 0; + ++ ret = sg_alloc_table(&msc->single_sgt, 1, GFP_KERNEL); ++ if (ret) ++ goto err_out; ++ ++ ret = -ENOMEM; + page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); + if (!page) +- return -ENOMEM; ++ goto err_free_sgt; + + split_page(page, order); +- msc->nr_pages = size >> PAGE_SHIFT; ++ sg_set_buf(msc->single_sgt.sgl, page_address(page), size); ++ ++ ret = dma_map_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, 1, ++ DMA_FROM_DEVICE); ++ if (ret < 0) ++ goto err_free_pages; ++ ++ msc->nr_pages = nr_pages; + msc->base = page_address(page); +- msc->base_addr = page_to_phys(page); ++ msc->base_addr = sg_dma_address(msc->single_sgt.sgl); + + return 0; ++ ++err_free_pages: ++ __free_pages(page, order); ++ ++err_free_sgt: ++ sg_free_table(&msc->single_sgt); ++ ++err_out: ++ return ret; + } + + /** +@@ -643,6 +668,10 @@ static void msc_buffer_contig_free(struc + { + unsigned long off; + ++ dma_unmap_sg(msc_dev(msc)->parent->parent, msc->single_sgt.sgl, ++ 1, DMA_FROM_DEVICE); ++ sg_free_table(&msc->single_sgt); ++ + for (off = 0; off < msc->nr_pages << PAGE_SHIFT; off += PAGE_SIZE) { + struct page *page = virt_to_page(msc->base + off); + diff --git a/queue-5.1/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch b/queue-5.1/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch new file mode 100644 index 00000000000..066e8334b28 --- /dev/null +++ b/queue-5.1/md-add-a-missing-endianness-conversion-in-check_sb_changes.patch @@ -0,0 +1,34 @@ +From ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Thu, 4 Apr 2019 18:56:10 +0200 +Subject: md: add a missing endianness conversion in check_sb_changes + +From: Christoph Hellwig + +commit ed4d0a4ea11e19863952ac6a7cea3bbb27ccd452 upstream. + +The on-disk value is little endian and we need to convert it to +native endian before storing the value in the in-core structure. + +Fixes: 7564beda19b36 ("md-cluster/raid10: support add disk under grow mode") +Cc: # 4.20+ +Acked-by: Guoqing Jiang +Signed-off-by: Christoph Hellwig +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -9229,7 +9229,7 @@ static void check_sb_changes(struct mdde + * reshape is happening in the remote node, we need to + * update reshape_position and call start_reshape. + */ +- mddev->reshape_position = sb->reshape_position; ++ mddev->reshape_position = le64_to_cpu(sb->reshape_position); + if (mddev->pers->update_reshape_pos) + mddev->pers->update_reshape_pos(mddev); + if (mddev->pers->start_reshape) diff --git a/queue-5.1/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch b/queue-5.1/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..a230c5d7662 --- /dev/null +++ b/queue-5.1/md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch @@ -0,0 +1,41 @@ +From ee37e62191a59d253fc916b9fc763deb777211e2 Mon Sep 17 00:00:00 2001 +From: Yufen Yu +Date: Tue, 2 Apr 2019 14:22:14 +0800 +Subject: md: add mddev->pers to avoid potential NULL pointer dereference + +From: Yufen Yu + +commit ee37e62191a59d253fc916b9fc763deb777211e2 upstream. + +When doing re-add, we need to ensure rdev->mddev->pers is not NULL, +which can avoid potential NULL pointer derefence in fallowing +add_bound_rdev(). + +Fixes: a6da4ef85cef ("md: re-add a failed disk") +Cc: Xiao Ni +Cc: NeilBrown +Cc: # 4.4+ +Reviewed-by: NeilBrown +Signed-off-by: Yufen Yu +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2852,8 +2852,10 @@ state_store(struct md_rdev *rdev, const + err = 0; + } + } else if (cmd_match(buf, "re-add")) { +- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && +- rdev->saved_raid_disk >= 0) { ++ if (!rdev->mddev->pers) ++ err = -EINVAL; ++ else if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && ++ rdev->saved_raid_disk >= 0) { + /* clear_bit is performed _after_ all the devices + * have their local Faulty bit cleared. If any writes + * happen in the meantime in the local node, they diff --git a/queue-5.1/md-batch-flush-requests.patch b/queue-5.1/md-batch-flush-requests.patch new file mode 100644 index 00000000000..db7e03cca25 --- /dev/null +++ b/queue-5.1/md-batch-flush-requests.patch @@ -0,0 +1,170 @@ +From 2bc13b83e6298486371761de503faeffd15b7534 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 29 Mar 2019 10:46:17 -0700 +Subject: md: batch flush requests. + +From: NeilBrown + +commit 2bc13b83e6298486371761de503faeffd15b7534 upstream. + +Currently if many flush requests are submitted to an md device is quick +succession, they are serialized and can take a long to process them all. +We don't really need to call flush all those times - a single flush call +can satisfy all requests submitted before it started. +So keep track of when the current flush started and when it finished, +allow any pending flush that was requested before the flush started +to complete without waiting any more. + +Test results from Xiao: + +Test is done on a raid10 device which is created by 4 SSDs. The tool is +dbench. + +1. The latest linux stable kernel + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 768 10.509 78.305 + Flush 2078376 0.013 10.094 + Close 21787697 0.019 18.821 + LockX 96580 0.007 3.184 + Mkdir 384 0.008 0.062 + Rename 1255883 0.191 23.534 + ReadX 46495589 0.020 14.230 + WriteX 14790591 7.123 60.706 + Unlink 5989118 0.440 54.551 + UnlockX 96580 0.005 2.736 + FIND_FIRST 10393845 0.042 12.079 + SET_FILE_INFORMATION 2415558 0.129 10.088 + QUERY_FILE_INFORMATION 4711725 0.005 8.462 + QUERY_PATH_INFORMATION 26883327 0.032 21.715 + QUERY_FS_INFORMATION 4929409 0.010 8.238 + NTCreateX 29660080 0.100 53.268 + +Throughput 1034.88 MB/sec (sync open) 128 clients 128 procs +max_latency=60.712 ms + +2. With patch1 "Revert "MD: fix lock contention for flush bios"" + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 256 8.326 36.761 + Flush 693291 3.974 180.269 + Close 7266404 0.009 36.929 + LockX 32160 0.006 0.840 + Mkdir 128 0.008 0.021 + Rename 418755 0.063 29.945 + ReadX 15498708 0.007 7.216 + WriteX 4932310 22.482 267.928 + Unlink 1997557 0.109 47.553 + UnlockX 32160 0.004 1.110 + FIND_FIRST 3465791 0.036 7.320 + SET_FILE_INFORMATION 805825 0.015 1.561 + QUERY_FILE_INFORMATION 1570950 0.005 2.403 + QUERY_PATH_INFORMATION 8965483 0.013 14.277 + QUERY_FS_INFORMATION 1643626 0.009 3.314 + NTCreateX 9892174 0.061 41.278 + +Throughput 345.009 MB/sec (sync open) 128 clients 128 procs +max_latency=267.939 m + +3. With patch1 and patch2 + Operation Count AvgLat MaxLat + -------------------------------------------------- + Deltree 768 9.570 54.588 + Flush 2061354 0.666 15.102 + Close 21604811 0.012 25.697 + LockX 95770 0.007 1.424 + Mkdir 384 0.008 0.053 + Rename 1245411 0.096 12.263 + ReadX 46103198 0.011 12.116 + WriteX 14667988 7.375 60.069 + Unlink 5938936 0.173 30.905 + UnlockX 95770 0.005 4.147 + FIND_FIRST 10306407 0.041 11.715 + SET_FILE_INFORMATION 2395987 0.048 7.640 + QUERY_FILE_INFORMATION 4672371 0.005 9.291 + QUERY_PATH_INFORMATION 26656735 0.018 19.719 + QUERY_FS_INFORMATION 4887940 0.010 7.654 + NTCreateX 29410811 0.059 28.551 + +Throughput 1026.21 MB/sec (sync open) 128 clients 128 procs +max_latency=60.075 ms + +Cc: # v4.19+ +Tested-by: Xiao Ni +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 27 +++++++++++++++++++++++---- + drivers/md/md.h | 3 +++ + 2 files changed, 26 insertions(+), 4 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -427,6 +427,7 @@ static void submit_flushes(struct work_s + struct mddev *mddev = container_of(ws, struct mddev, flush_work); + struct md_rdev *rdev; + ++ mddev->start_flush = ktime_get_boottime(); + INIT_WORK(&mddev->flush_work, md_submit_flush_data); + atomic_set(&mddev->flush_pending, 1); + rcu_read_lock(); +@@ -467,6 +468,7 @@ static void md_submit_flush_data(struct + * could wait for this and below md_handle_request could wait for those + * bios because of suspend check + */ ++ mddev->last_flush = mddev->start_flush; + mddev->flush_bio = NULL; + wake_up(&mddev->sb_wait); + +@@ -481,15 +483,32 @@ static void md_submit_flush_data(struct + + void md_flush_request(struct mddev *mddev, struct bio *bio) + { ++ ktime_t start = ktime_get_boottime(); + spin_lock_irq(&mddev->lock); + wait_event_lock_irq(mddev->sb_wait, +- !mddev->flush_bio, ++ !mddev->flush_bio || ++ ktime_after(mddev->last_flush, start), + mddev->lock); +- mddev->flush_bio = bio; ++ if (!ktime_after(mddev->last_flush, start)) { ++ WARN_ON(mddev->flush_bio); ++ mddev->flush_bio = bio; ++ bio = NULL; ++ } + spin_unlock_irq(&mddev->lock); + +- INIT_WORK(&mddev->flush_work, submit_flushes); +- queue_work(md_wq, &mddev->flush_work); ++ if (!bio) { ++ INIT_WORK(&mddev->flush_work, submit_flushes); ++ queue_work(md_wq, &mddev->flush_work); ++ } else { ++ /* flush was performed for some other bio while we waited. */ ++ if (bio->bi_iter.bi_size == 0) ++ /* an empty barrier - all done */ ++ bio_endio(bio); ++ else { ++ bio->bi_opf &= ~REQ_PREFLUSH; ++ mddev->pers->make_request(mddev, bio); ++ } ++ } + } + EXPORT_SYMBOL(md_flush_request); + +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -463,6 +463,9 @@ struct mddev { + */ + struct bio *flush_bio; + atomic_t flush_pending; ++ ktime_t start_flush, last_flush; /* last_flush is when the last completed ++ * flush was started. ++ */ + struct work_struct flush_work; + struct work_struct event_work; /* used by dm to report failure event */ + void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev); diff --git a/queue-5.1/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch b/queue-5.1/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch new file mode 100644 index 00000000000..cd44a21160a --- /dev/null +++ b/queue-5.1/media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch @@ -0,0 +1,55 @@ +From 107927fa597c99eaeee4f51865ca0956ec71b6a2 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:30 -0500 +Subject: media: imx: Clear fwnode link struct for each endpoint iteration + +From: Steve Longerbeam + +commit 107927fa597c99eaeee4f51865ca0956ec71b6a2 upstream. + +In imx_media_create_csi_of_links(), the 'struct v4l2_fwnode_link' must +be cleared for each endpoint iteration, otherwise if the remote port +has no "reg" property, link.remote_port will not be reset to zero. +This was discovered on the i.MX53 SMD board, since the OV5642 connects +directly to ipu1_csi0 and has a single source port with no "reg" +property. + +Fixes: 621b08eabcddb ("media: staging/imx: remove static media link arrays") + +Signed-off-by: Steve Longerbeam +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-media-of.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -145,15 +145,18 @@ int imx_media_create_csi_of_links(struct + struct v4l2_subdev *csi) + { + struct device_node *csi_np = csi->dev->of_node; +- struct fwnode_handle *fwnode, *csi_ep; +- struct v4l2_fwnode_link link; + struct device_node *ep; +- int ret; +- +- link.local_node = of_fwnode_handle(csi_np); +- link.local_port = CSI_SINK_PAD; + + for_each_child_of_node(csi_np, ep) { ++ struct fwnode_handle *fwnode, *csi_ep; ++ struct v4l2_fwnode_link link; ++ int ret; ++ ++ memset(&link, 0, sizeof(link)); ++ ++ link.local_node = of_fwnode_handle(csi_np); ++ link.local_port = CSI_SINK_PAD; ++ + csi_ep = of_fwnode_handle(ep); + + fwnode = fwnode_graph_get_remote_endpoint(csi_ep); diff --git a/queue-5.1/media-imx-csi-allow-unknown-nearest-upstream-entities.patch b/queue-5.1/media-imx-csi-allow-unknown-nearest-upstream-entities.patch new file mode 100644 index 00000000000..92ee00a06aa --- /dev/null +++ b/queue-5.1/media-imx-csi-allow-unknown-nearest-upstream-entities.patch @@ -0,0 +1,70 @@ +From 904371f90b2c0c749a5ab75478c129a4682ac3d8 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:29 -0500 +Subject: media: imx: csi: Allow unknown nearest upstream entities + +From: Steve Longerbeam + +commit 904371f90b2c0c749a5ab75478c129a4682ac3d8 upstream. + +On i.MX6, the nearest upstream entity to the CSI can only be the +CSI video muxes or the Synopsys DW MIPI CSI-2 receiver. + +However the i.MX53 has no CSI video muxes or a MIPI CSI-2 receiver. +So allow for the nearest upstream entity to the CSI to be something +other than those. + +Fixes: bf3cfaa712e5c ("media: staging/imx: get CSI bus type from nearest +upstream entity") + +Signed-off-by: Steve Longerbeam +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-media-csi.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -154,9 +154,10 @@ static inline bool requires_passthrough( + /* + * Parses the fwnode endpoint from the source pad of the entity + * connected to this CSI. This will either be the entity directly +- * upstream from the CSI-2 receiver, or directly upstream from the +- * video mux. The endpoint is needed to determine the bus type and +- * bus config coming into the CSI. ++ * upstream from the CSI-2 receiver, directly upstream from the ++ * video mux, or directly upstream from the CSI itself. The endpoint ++ * is needed to determine the bus type and bus config coming into ++ * the CSI. + */ + static int csi_get_upstream_endpoint(struct csi_priv *priv, + struct v4l2_fwnode_endpoint *ep) +@@ -172,7 +173,8 @@ static int csi_get_upstream_endpoint(str + if (!priv->src_sd) + return -EPIPE; + +- src = &priv->src_sd->entity; ++ sd = priv->src_sd; ++ src = &sd->entity; + + if (src->function == MEDIA_ENT_F_VID_MUX) { + /* +@@ -186,6 +188,14 @@ static int csi_get_upstream_endpoint(str + src = &sd->entity; + } + ++ /* ++ * If the source is neither the video mux nor the CSI-2 receiver, ++ * get the source pad directly upstream from CSI itself. ++ */ ++ if (src->function != MEDIA_ENT_F_VID_MUX && ++ sd->grp_id != IMX_MEDIA_GRP_ID_CSI2) ++ src = &priv->sd.entity; ++ + /* get source pad of entity directly upstream from src */ + pad = imx_media_find_upstream_pad(priv->md, src, 0); + if (IS_ERR(pad)) diff --git a/queue-5.1/media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch b/queue-5.1/media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch new file mode 100644 index 00000000000..8a829cc41b2 --- /dev/null +++ b/queue-5.1/media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch @@ -0,0 +1,206 @@ +From dee747f88167124884a918855c1f438e2f7f39e2 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:32 -0500 +Subject: media: imx: Don't register IPU subdevs/links if CSI port missing + +From: Steve Longerbeam + +commit dee747f88167124884a918855c1f438e2f7f39e2 upstream. + +The second IPU internal sub-devices were being registered and links +to them created even when the second IPU is not present. This is wrong +for i.MX6 S/DL and i.MX53 which have only a single IPU. + +Fixes: e130291212df5 ("[media] media: Add i.MX media core driver") + +Signed-off-by: Steve Longerbeam +Reviewed-by: Philipp Zabel +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-media-dev.c | 7 -- + drivers/staging/media/imx/imx-media-internal-sd.c | 22 +------- + drivers/staging/media/imx/imx-media-of.c | 58 ++++++++++++++-------- + drivers/staging/media/imx/imx-media.h | 3 - + drivers/staging/media/imx/imx7-media-csi.c | 2 + 5 files changed, 46 insertions(+), 46 deletions(-) + +--- a/drivers/staging/media/imx/imx-media-dev.c ++++ b/drivers/staging/media/imx/imx-media-dev.c +@@ -477,13 +477,6 @@ static int imx_media_probe(struct platfo + goto cleanup; + } + +- ret = imx_media_add_ipu_internal_subdevs(imxmd); +- if (ret) { +- v4l2_err(&imxmd->v4l2_dev, +- "add_ipu_internal_subdevs failed with %d\n", ret); +- goto cleanup; +- } +- + ret = imx_media_dev_notifier_register(imxmd); + if (ret) + goto del_int; +--- a/drivers/staging/media/imx/imx-media-internal-sd.c ++++ b/drivers/staging/media/imx/imx-media-internal-sd.c +@@ -298,13 +298,14 @@ static int add_internal_subdev(struct im + } + + /* adds the internal subdevs in one ipu */ +-static int add_ipu_internal_subdevs(struct imx_media_dev *imxmd, int ipu_id) ++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd, ++ int ipu_id) + { + enum isd_enum i; ++ int ret; + + for (i = 0; i < num_isd; i++) { + const struct internal_subdev *isd = &int_subdev[i]; +- int ret; + + /* + * the CSIs are represented in the device-tree, so those +@@ -322,25 +323,10 @@ static int add_ipu_internal_subdevs(stru + } + + if (ret) +- return ret; ++ goto remove; + } + + return 0; +-} +- +-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd) +-{ +- int ret; +- +- ret = add_ipu_internal_subdevs(imxmd, 0); +- if (ret) +- goto remove; +- +- ret = add_ipu_internal_subdevs(imxmd, 1); +- if (ret) +- goto remove; +- +- return 0; + + remove: + imx_media_remove_ipu_internal_subdevs(imxmd); +--- a/drivers/staging/media/imx/imx-media-of.c ++++ b/drivers/staging/media/imx/imx-media-of.c +@@ -23,36 +23,25 @@ + int imx_media_of_add_csi(struct imx_media_dev *imxmd, + struct device_node *csi_np) + { +- int ret; +- + if (!of_device_is_available(csi_np)) { + dev_dbg(imxmd->md.dev, "%s: %pOFn not enabled\n", __func__, + csi_np); +- /* unavailable is not an error */ +- return 0; ++ return -ENODEV; + } + + /* add CSI fwnode to async notifier */ +- ret = imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np), NULL); +- if (ret) { +- if (ret == -EEXIST) { +- /* already added, everything is fine */ +- return 0; +- } +- +- /* other error, can't continue */ +- return ret; +- } +- +- return 0; ++ return imx_media_add_async_subdev(imxmd, of_fwnode_handle(csi_np), ++ NULL); + } + EXPORT_SYMBOL_GPL(imx_media_of_add_csi); + + int imx_media_add_of_subdevs(struct imx_media_dev *imxmd, + struct device_node *np) + { ++ bool ipu_found[2] = {false, false}; + struct device_node *csi_np; + int i, ret; ++ u32 ipu_id; + + for (i = 0; ; i++) { + csi_np = of_parse_phandle(np, "ports", i); +@@ -60,12 +49,43 @@ int imx_media_add_of_subdevs(struct imx_ + break; + + ret = imx_media_of_add_csi(imxmd, csi_np); +- of_node_put(csi_np); +- if (ret) +- return ret; ++ if (ret) { ++ /* unavailable or already added is not an error */ ++ if (ret == -ENODEV || ret == -EEXIST) { ++ of_node_put(csi_np); ++ continue; ++ } ++ ++ /* other error, can't continue */ ++ goto err_out; ++ } ++ ++ ret = of_alias_get_id(csi_np->parent, "ipu"); ++ if (ret < 0) ++ goto err_out; ++ if (ret > 1) { ++ ret = -EINVAL; ++ goto err_out; ++ } ++ ++ ipu_id = ret; ++ ++ if (!ipu_found[ipu_id]) { ++ ret = imx_media_add_ipu_internal_subdevs(imxmd, ++ ipu_id); ++ if (ret) ++ goto err_out; ++ } ++ ++ ipu_found[ipu_id] = true; + } + + return 0; ++ ++err_out: ++ imx_media_remove_ipu_internal_subdevs(imxmd); ++ of_node_put(csi_np); ++ return ret; + } + + /* +--- a/drivers/staging/media/imx/imx-media.h ++++ b/drivers/staging/media/imx/imx-media.h +@@ -252,7 +252,8 @@ struct imx_media_fim *imx_media_fim_init + void imx_media_fim_free(struct imx_media_fim *fim); + + /* imx-media-internal-sd.c */ +-int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd); ++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd, ++ int ipu_id); + int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd, + struct v4l2_subdev *sd); + void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd); +--- a/drivers/staging/media/imx/imx7-media-csi.c ++++ b/drivers/staging/media/imx/imx7-media-csi.c +@@ -1271,7 +1271,7 @@ static int imx7_csi_probe(struct platfor + platform_set_drvdata(pdev, &csi->sd); + + ret = imx_media_of_add_csi(imxmd, node); +- if (ret < 0) ++ if (ret < 0 && ret != -ENODEV && ret != -EEXIST) + goto cleanup; + + ret = imx_media_dev_notifier_register(imxmd); diff --git a/queue-5.1/media-imx-rename-functions-that-add-ipu-internal-subdevs.patch b/queue-5.1/media-imx-rename-functions-that-add-ipu-internal-subdevs.patch new file mode 100644 index 00000000000..d0efc378e58 --- /dev/null +++ b/queue-5.1/media-imx-rename-functions-that-add-ipu-internal-subdevs.patch @@ -0,0 +1,160 @@ +From 085b26da62211cb77622008082adff56aefa771d Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 20 Feb 2019 18:53:31 -0500 +Subject: media: imx: Rename functions that add IPU-internal subdevs + +From: Steve Longerbeam + +commit 085b26da62211cb77622008082adff56aefa771d upstream. + +For the functions that add and remove the internal IPU subdevice +descriptors, rename them to make clear they are the subdevs internal +to the IPU. Also rename the platform data structure for the internal +IPU subdevices. No functional changes. + +Signed-off-by: Steve Longerbeam +Acked-by: Philipp Zabel +Cc: stable@vger.kernel.org +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/staging/media/imx/imx-ic-common.c | 2 +- + drivers/staging/media/imx/imx-media-dev.c | 8 ++++---- + drivers/staging/media/imx/imx-media-internal-sd.c | 12 ++++++------ + drivers/staging/media/imx/imx-media-vdic.c | 2 +- + drivers/staging/media/imx/imx-media.h | 6 +++--- + 5 files changed, 15 insertions(+), 15 deletions(-) + +--- a/drivers/staging/media/imx/imx-ic-common.c ++++ b/drivers/staging/media/imx/imx-ic-common.c +@@ -26,7 +26,7 @@ static struct imx_ic_ops *ic_ops[IC_NUM_ + + static int imx_ic_probe(struct platform_device *pdev) + { +- struct imx_media_internal_sd_platformdata *pdata; ++ struct imx_media_ipu_internal_sd_pdata *pdata; + struct imx_ic_priv *priv; + int ret; + +--- a/drivers/staging/media/imx/imx-media-dev.c ++++ b/drivers/staging/media/imx/imx-media-dev.c +@@ -477,10 +477,10 @@ static int imx_media_probe(struct platfo + goto cleanup; + } + +- ret = imx_media_add_internal_subdevs(imxmd); ++ ret = imx_media_add_ipu_internal_subdevs(imxmd); + if (ret) { + v4l2_err(&imxmd->v4l2_dev, +- "add_internal_subdevs failed with %d\n", ret); ++ "add_ipu_internal_subdevs failed with %d\n", ret); + goto cleanup; + } + +@@ -491,7 +491,7 @@ static int imx_media_probe(struct platfo + return 0; + + del_int: +- imx_media_remove_internal_subdevs(imxmd); ++ imx_media_remove_ipu_internal_subdevs(imxmd); + cleanup: + v4l2_async_notifier_cleanup(&imxmd->notifier); + v4l2_device_unregister(&imxmd->v4l2_dev); +@@ -508,7 +508,7 @@ static int imx_media_remove(struct platf + v4l2_info(&imxmd->v4l2_dev, "Removing imx-media\n"); + + v4l2_async_notifier_unregister(&imxmd->notifier); +- imx_media_remove_internal_subdevs(imxmd); ++ imx_media_remove_ipu_internal_subdevs(imxmd); + v4l2_async_notifier_cleanup(&imxmd->notifier); + media_device_unregister(&imxmd->md); + v4l2_device_unregister(&imxmd->v4l2_dev); +--- a/drivers/staging/media/imx/imx-media-internal-sd.c ++++ b/drivers/staging/media/imx/imx-media-internal-sd.c +@@ -1,7 +1,7 @@ + /* + * Media driver for Freescale i.MX5/6 SOC + * +- * Adds the internal subdevices and the media links between them. ++ * Adds the IPU internal subdevices and the media links between them. + * + * Copyright (c) 2016 Mentor Graphics Inc. + * +@@ -192,7 +192,7 @@ static struct v4l2_subdev *find_sink(str + + /* + * retrieve IPU id from subdev name, note: can't get this from +- * struct imx_media_internal_sd_platformdata because if src is ++ * struct imx_media_ipu_internal_sd_pdata because if src is + * a CSI, it has different struct ipu_client_platformdata which + * does not contain IPU id. + */ +@@ -270,7 +270,7 @@ static int add_internal_subdev(struct im + const struct internal_subdev *isd, + int ipu_id) + { +- struct imx_media_internal_sd_platformdata pdata; ++ struct imx_media_ipu_internal_sd_pdata pdata; + struct platform_device_info pdevinfo = {}; + struct platform_device *pdev; + +@@ -328,7 +328,7 @@ static int add_ipu_internal_subdevs(stru + return 0; + } + +-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd) ++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd) + { + int ret; + +@@ -343,11 +343,11 @@ int imx_media_add_internal_subdevs(struc + return 0; + + remove: +- imx_media_remove_internal_subdevs(imxmd); ++ imx_media_remove_ipu_internal_subdevs(imxmd); + return ret; + } + +-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd) ++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd) + { + struct imx_media_async_subdev *imxasd; + struct v4l2_async_subdev *asd; +--- a/drivers/staging/media/imx/imx-media-vdic.c ++++ b/drivers/staging/media/imx/imx-media-vdic.c +@@ -934,7 +934,7 @@ static const struct v4l2_subdev_internal + + static int imx_vdic_probe(struct platform_device *pdev) + { +- struct imx_media_internal_sd_platformdata *pdata; ++ struct imx_media_ipu_internal_sd_pdata *pdata; + struct vdic_priv *priv; + int ret; + +--- a/drivers/staging/media/imx/imx-media.h ++++ b/drivers/staging/media/imx/imx-media.h +@@ -115,7 +115,7 @@ struct imx_media_pad_vdev { + struct list_head list; + }; + +-struct imx_media_internal_sd_platformdata { ++struct imx_media_ipu_internal_sd_pdata { + char sd_name[V4L2_SUBDEV_NAME_SIZE]; + u32 grp_id; + int ipu_id; +@@ -252,10 +252,10 @@ struct imx_media_fim *imx_media_fim_init + void imx_media_fim_free(struct imx_media_fim *fim); + + /* imx-media-internal-sd.c */ +-int imx_media_add_internal_subdevs(struct imx_media_dev *imxmd); ++int imx_media_add_ipu_internal_subdevs(struct imx_media_dev *imxmd); + int imx_media_create_ipu_internal_links(struct imx_media_dev *imxmd, + struct v4l2_subdev *sd); +-void imx_media_remove_internal_subdevs(struct imx_media_dev *imxmd); ++void imx_media_remove_ipu_internal_subdevs(struct imx_media_dev *imxmd); + + /* imx-media-of.c */ + int imx_media_add_of_subdevs(struct imx_media_dev *dev, diff --git a/queue-5.1/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch b/queue-5.1/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch new file mode 100644 index 00000000000..8bed52ec200 --- /dev/null +++ b/queue-5.1/media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch @@ -0,0 +1,47 @@ +From 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Sun, 24 Mar 2019 20:21:12 -0400 +Subject: media: ov6650: Fix sensor possibly not detected on probe + +From: Janusz Krzysztofik + +commit 933c1320847f5ed6b61a7d10f0a948aa98ccd7b0 upstream. + +After removal of clock_start() from before soc_camera_init_i2c() in +soc_camera_probe() by commit 9aea470b399d ("[media] soc-camera: switch +I2C subdevice drivers to use v4l2-clk") introduced in v3.11, the ov6650 +driver could no longer probe the sensor successfully because its clock +was no longer turned on in advance. The issue was initially worked +around by adding that missing clock_start() equivalent to OMAP1 camera +interface driver - the only user of this sensor - but a propoer fix +should be rather implemented in the sensor driver code itself. + +Fix the issue by inserting a delay between the clock is turned on and +the sensor I2C registers are read for the first time. + +Tested on Amstrad Delta with now out of tree but still locally +maintained omap1_camera host driver. + +Fixes: 9aea470b399d ("[media] soc-camera: switch I2C subdevice drivers to use v4l2-clk") + +Signed-off-by: Janusz Krzysztofik +Cc: stable@vger.kernel.org +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/i2c/ov6650.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/i2c/ov6650.c ++++ b/drivers/media/i2c/ov6650.c +@@ -814,6 +814,8 @@ static int ov6650_video_probe(struct i2c + if (ret < 0) + return ret; + ++ msleep(20); ++ + /* + * check and show product ID and manufacturer ID + */ diff --git a/queue-5.1/media-seco-cec-fix-building-with-rc_core-m.patch b/queue-5.1/media-seco-cec-fix-building-with-rc_core-m.patch new file mode 100644 index 00000000000..f9930745baf --- /dev/null +++ b/queue-5.1/media-seco-cec-fix-building-with-rc_core-m.patch @@ -0,0 +1,45 @@ +From 63604a143fe168094fbbccba56f6e3241683e399 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 13 Mar 2019 17:18:07 -0400 +Subject: media: seco-cec: fix building with RC_CORE=m + +From: Arnd Bergmann + +commit 63604a143fe168094fbbccba56f6e3241683e399 upstream. + +I previously added an RC_CORE dependency here, but missed the corner +case of CONFIG_VIDEO_SECO_CEC=y with CONFIG_RC_CORE=m, which still +causes a link error: + +drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_probe': +seco-cec.c:(.text+0x1b8): undefined reference to `devm_rc_allocate_device' +seco-cec.c:(.text+0x2e8): undefined reference to `devm_rc_register_device' +drivers/media/platform/seco-cec/seco-cec.o: In function `secocec_irq_handler': +seco-cec.c:(.text+0xa2c): undefined reference to `rc_keydown' + +Refine the dependency to disallow building the RC subdriver in this case. +This is the same logic we apply in other drivers like it. + +Fixes: f27dd0ad6885 ("media: seco-cec: fix RC_CORE dependency") + +Cc: # 5.1 +Signed-off-by: Arnd Bergmann +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/platform/Kconfig ++++ b/drivers/media/platform/Kconfig +@@ -649,7 +649,7 @@ config VIDEO_SECO_CEC + config VIDEO_SECO_RC + bool "SECO Boards IR RC5 support" + depends on VIDEO_SECO_CEC +- depends on RC_CORE ++ depends on RC_CORE=y || RC_CORE = VIDEO_SECO_CEC + help + If you say yes here you will get support for the + SECO Boards Consumer-IR in seco-cec driver. diff --git a/queue-5.1/of-fix-clang-wunsequenced-for-be32_to_cpu.patch b/queue-5.1/of-fix-clang-wunsequenced-for-be32_to_cpu.patch new file mode 100644 index 00000000000..0c9b1fd3545 --- /dev/null +++ b/queue-5.1/of-fix-clang-wunsequenced-for-be32_to_cpu.patch @@ -0,0 +1,56 @@ +From 440868661f36071886ed360d91de83bd67c73b4f Mon Sep 17 00:00:00 2001 +From: Phong Tran +Date: Tue, 30 Apr 2019 21:56:24 +0700 +Subject: of: fix clang -Wunsequenced for be32_to_cpu() + +From: Phong Tran + +commit 440868661f36071886ed360d91de83bd67c73b4f upstream. + +Now, make the loop explicit to avoid clang warning. + +./include/linux/of.h:238:37: warning: multiple unsequenced modifications +to 'cell' [-Wunsequenced] + r = (r << 32) | be32_to_cpu(*(cell++)); + ^~ +./include/linux/byteorder/generic.h:95:21: note: expanded from macro +'be32_to_cpu' + ^ +./include/uapi/linux/byteorder/little_endian.h:40:59: note: expanded +from macro '__be32_to_cpu' + ^ +./include/uapi/linux/swab.h:118:21: note: expanded from macro '__swab32' + ___constant_swab32(x) : \ + ^ +./include/uapi/linux/swab.h:18:12: note: expanded from macro +'___constant_swab32' + (((__u32)(x) & (__u32)0x000000ffUL) << 24) | \ + ^ + +Signed-off-by: Phong Tran +Reported-by: Nick Desaulniers +Link: https://github.com/ClangBuiltLinux/linux/issues/460 +Suggested-by: David Laight +Reviewed-by: Nick Desaulniers +Cc: stable@vger.kernel.org +[robh: fix up whitespace] +Signed-off-by: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/of.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/include/linux/of.h ++++ b/include/linux/of.h +@@ -234,8 +234,8 @@ extern struct device_node *of_find_all_n + static inline u64 of_read_number(const __be32 *cell, int size) + { + u64 r = 0; +- while (size--) +- r = (r << 32) | be32_to_cpu(*(cell++)); ++ for (; size--; cell++) ++ r = (r << 32) | be32_to_cpu(*cell); + return r; + } + diff --git a/queue-5.1/p54-drop-device-reference-count-if-fails-to-enable-device.patch b/queue-5.1/p54-drop-device-reference-count-if-fails-to-enable-device.patch new file mode 100644 index 00000000000..89727ccc0c1 --- /dev/null +++ b/queue-5.1/p54-drop-device-reference-count-if-fails-to-enable-device.patch @@ -0,0 +1,42 @@ +From 8149069db81853570a665f5e5648c0e526dc0e43 Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Wed, 17 Apr 2019 17:41:23 +0800 +Subject: p54: drop device reference count if fails to enable device + +From: Pan Bian + +commit 8149069db81853570a665f5e5648c0e526dc0e43 upstream. + +The function p54p_probe takes an extra reference count of the PCI +device. However, the extra reference count is not dropped when it fails +to enable the PCI device. This patch fixes the bug. + +Cc: stable@vger.kernel.org +Signed-off-by: Pan Bian +Acked-by: Christian Lamparter +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intersil/p54/p54pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intersil/p54/p54pci.c ++++ b/drivers/net/wireless/intersil/p54/p54pci.c +@@ -554,7 +554,7 @@ static int p54p_probe(struct pci_dev *pd + err = pci_enable_device(pdev); + if (err) { + dev_err(&pdev->dev, "Cannot enable new PCI device\n"); +- return err; ++ goto err_put; + } + + mem_addr = pci_resource_start(pdev, 0); +@@ -639,6 +639,7 @@ static int p54p_probe(struct pci_dev *pd + pci_release_regions(pdev); + err_disable_dev: + pci_disable_device(pdev); ++err_put: + pci_dev_put(pdev); + return err; + } diff --git a/queue-5.1/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch b/queue-5.1/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch new file mode 100644 index 00000000000..8bfc65dcbe5 --- /dev/null +++ b/queue-5.1/parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch @@ -0,0 +1,36 @@ +From 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 27 Apr 2019 23:57:49 +0200 +Subject: parisc: Add memory barrier to asm pdc and sync instructions + +From: Helge Deller + +commit 2d94a832e246ac00fd32eec241e6f1aa6fbc5700 upstream. + +Add compiler memory barriers to ensure the compiler doesn't reorder memory +operations around these instructions. + +Cc: stable@vger.kernel.org # v4.20+ +Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/cache.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/parisc/include/asm/cache.h ++++ b/arch/parisc/include/asm/cache.h +@@ -56,10 +56,10 @@ void parisc_setup_cache_timing(void); + #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ + ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define asm_io_sync() asm volatile("sync" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ +- ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :: ) ++ ALTERNATIVE(ALT_COND_NO_IOC_FDC, INSN_NOP) :::"memory") + + #endif /* ! __ASSEMBLY__ */ + diff --git a/queue-5.1/parisc-add-memory-clobber-to-tlb-purges.patch b/queue-5.1/parisc-add-memory-clobber-to-tlb-purges.patch new file mode 100644 index 00000000000..45b667098ec --- /dev/null +++ b/queue-5.1/parisc-add-memory-clobber-to-tlb-purges.patch @@ -0,0 +1,43 @@ +From 44224bdb99150ad17cf394973b25736cb92c246a Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sun, 21 Apr 2019 19:47:17 -0400 +Subject: parisc: Add memory clobber to TLB purges + +From: John David Anglin + +commit 44224bdb99150ad17cf394973b25736cb92c246a upstream. + +The pdtlb and pitlb instructions are strongly ordered. The asms invoking +these instructions should be compiler memory barriers to ensure the +compiler doesn't reorder memory operations around these instructions. + +Signed-off-by: John David Anglin +CC: stable@vger.kernel.org # v4.20+ +Fixes: 3847dab77421 ("parisc: Add alternative coding infrastructure") +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/cache.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/include/asm/cache.h ++++ b/arch/parisc/include/asm/cache.h +@@ -44,14 +44,14 @@ void parisc_setup_cache_timing(void); + + #define pdtlb(addr) asm volatile("pdtlb 0(%%sr1,%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define pitlb(addr) asm volatile("pitlb 0(%%sr1,%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ + ALTERNATIVE(ALT_COND_NO_SPLIT_TLB, INSN_NOP) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + #define pdtlb_kernel(addr) asm volatile("pdtlb 0(%0)" \ + ALTERNATIVE(ALT_COND_NO_SMP, INSN_PxTLB) \ +- : : "r" (addr)) ++ : : "r" (addr) : "memory") + + #define asm_io_fdc(addr) asm volatile("fdc %%r0(%0)" \ + ALTERNATIVE(ALT_COND_NO_DCACHE, INSN_NOP) \ diff --git a/queue-5.1/parisc-allow-live-patching-of-__meminit-functions.patch b/queue-5.1/parisc-allow-live-patching-of-__meminit-functions.patch new file mode 100644 index 00000000000..f7a02525ff2 --- /dev/null +++ b/queue-5.1/parisc-allow-live-patching-of-__meminit-functions.patch @@ -0,0 +1,32 @@ +From d19a12906e5e558c0f6b6cfece7b7caf1012ef95 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Wed, 1 May 2019 14:59:58 +0200 +Subject: parisc: Allow live-patching of __meminit functions + +From: Helge Deller + +commit d19a12906e5e558c0f6b6cfece7b7caf1012ef95 upstream. + +When making the text sections writeable with set_kernel_text_rw(1), +include all text sections including those in the __init section. +Otherwise functions marked with __meminit will stay read-only. + +Signed-off-by: Helge Deller +Cc: # 4.20+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/mm/init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -495,7 +495,7 @@ static void __init map_pages(unsigned lo + + void __init set_kernel_text_rw(int enable_read_write) + { +- unsigned long start = (unsigned long) _text; ++ unsigned long start = (unsigned long) __init_begin; + unsigned long end = (unsigned long) &data_start; + + map_pages(start, __pa(start), end-start, diff --git a/queue-5.1/parisc-export-running_on_qemu-symbol-for-modules.patch b/queue-5.1/parisc-export-running_on_qemu-symbol-for-modules.patch new file mode 100644 index 00000000000..8b5520619ca --- /dev/null +++ b/queue-5.1/parisc-export-running_on_qemu-symbol-for-modules.patch @@ -0,0 +1,27 @@ +From 3e1120f4b57bc12437048494ab56648edaa5b57d Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 6 Apr 2019 16:45:14 +0200 +Subject: parisc: Export running_on_qemu symbol for modules + +From: Helge Deller + +commit 3e1120f4b57bc12437048494ab56648edaa5b57d upstream. + +Signed-off-by: Helge Deller +CC: stable@vger.kernel.org # v4.9+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/kernel/process.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/parisc/kernel/process.c ++++ b/arch/parisc/kernel/process.c +@@ -193,6 +193,7 @@ int dump_task_fpu (struct task_struct *t + */ + + int running_on_qemu __read_mostly; ++EXPORT_SYMBOL(running_on_qemu); + + void __cpuidle arch_cpu_idle_dead(void) + { diff --git a/queue-5.1/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch b/queue-5.1/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch new file mode 100644 index 00000000000..44ea2a0af96 --- /dev/null +++ b/queue-5.1/parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch @@ -0,0 +1,75 @@ +From 1829dda0e87f4462782ca81be474c7890efe31ce Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 5 May 2019 23:54:34 +0200 +Subject: parisc: Rename LEVEL to PA_ASM_LEVEL to avoid name clash with DRBD code + +From: Helge Deller + +commit 1829dda0e87f4462782ca81be474c7890efe31ce upstream. + +LEVEL is a very common word, and now after many years it suddenly +clashed with another LEVEL define in the DRBD code. +Rename it to PA_ASM_LEVEL instead. + +Reported-by: kbuild test robot +Signed-off-by: Helge Deller +Cc: +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/include/asm/assembly.h | 6 +++--- + arch/parisc/kernel/head.S | 4 ++-- + arch/parisc/kernel/syscall.S | 2 +- + 3 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/parisc/include/asm/assembly.h ++++ b/arch/parisc/include/asm/assembly.h +@@ -61,14 +61,14 @@ + #define LDCW ldcw,co + #define BL b,l + # ifdef CONFIG_64BIT +-# define LEVEL 2.0w ++# define PA_ASM_LEVEL 2.0w + # else +-# define LEVEL 2.0 ++# define PA_ASM_LEVEL 2.0 + # endif + #else + #define LDCW ldcw + #define BL bl +-#define LEVEL 1.1 ++#define PA_ASM_LEVEL 1.1 + #endif + + #ifdef __ASSEMBLY__ +--- a/arch/parisc/kernel/head.S ++++ b/arch/parisc/kernel/head.S +@@ -22,7 +22,7 @@ + #include + #include + +- .level LEVEL ++ .level PA_ASM_LEVEL + + __INITDATA + ENTRY(boot_args) +@@ -258,7 +258,7 @@ stext_pdc_ret: + ldo R%PA(fault_vector_11)(%r10),%r10 + + $is_pa20: +- .level LEVEL /* restore 1.1 || 2.0w */ ++ .level PA_ASM_LEVEL /* restore 1.1 || 2.0w */ + #endif /*!CONFIG_64BIT*/ + load32 PA(fault_vector_20),%r10 + +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -48,7 +48,7 @@ registers). + */ + #define KILL_INSN break 0,0 + +- .level LEVEL ++ .level PA_ASM_LEVEL + + .text + diff --git a/queue-5.1/parisc-skip-registering-led-when-running-in-qemu.patch b/queue-5.1/parisc-skip-registering-led-when-running-in-qemu.patch new file mode 100644 index 00000000000..aa59c7c3a39 --- /dev/null +++ b/queue-5.1/parisc-skip-registering-led-when-running-in-qemu.patch @@ -0,0 +1,31 @@ +From b438749044356dd1329c45e9b5a9377b6ea13eb2 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 2 Apr 2019 12:17:08 +0200 +Subject: parisc: Skip registering LED when running in QEMU + +From: Helge Deller + +commit b438749044356dd1329c45e9b5a9377b6ea13eb2 upstream. + +No need to spend CPU cycles when we run on QEMU. + +Signed-off-by: Helge Deller +CC: stable@vger.kernel.org # v4.9+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parisc/led.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/parisc/led.c ++++ b/drivers/parisc/led.c +@@ -568,6 +568,9 @@ int __init register_led_driver(int model + break; + + case DISPLAY_MODEL_LASI: ++ /* Skip to register LED in QEMU */ ++ if (running_on_qemu) ++ return 1; + LED_DATA_REG = data_reg; + led_func_ptr = led_LASI_driver; + printk(KERN_INFO "LED display at %lx registered\n", LED_DATA_REG); diff --git a/queue-5.1/parisc-use-pa_asm_level-in-boot-code.patch b/queue-5.1/parisc-use-pa_asm_level-in-boot-code.patch new file mode 100644 index 00000000000..512b2d764af --- /dev/null +++ b/queue-5.1/parisc-use-pa_asm_level-in-boot-code.patch @@ -0,0 +1,49 @@ +From bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 5 May 2019 23:55:02 +0200 +Subject: parisc: Use PA_ASM_LEVEL in boot code + +From: Helge Deller + +commit bdca5d64ee92abeacd6dada0bc6f6f8e6350dd67 upstream. + +The LEVEL define clashed with the DRBD code. + +Reported-by: kbuild test robot +Signed-off-by: Helge Deller +Cc: # v4.14+ +Signed-off-by: Greg Kroah-Hartman + +--- + arch/parisc/boot/compressed/head.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/parisc/boot/compressed/head.S ++++ b/arch/parisc/boot/compressed/head.S +@@ -22,7 +22,7 @@ + __HEAD + + ENTRY(startup) +- .level LEVEL ++ .level PA_ASM_LEVEL + + #define PSW_W_SM 0x200 + #define PSW_W_BIT 36 +@@ -63,7 +63,7 @@ $bss_loop: + load32 BOOTADDR(decompress_kernel),%r3 + + #ifdef CONFIG_64BIT +- .level LEVEL ++ .level PA_ASM_LEVEL + ssm PSW_W_SM, %r0 /* set W-bit */ + depdi 0, 31, 32, %r3 + #endif +@@ -72,7 +72,7 @@ $bss_loop: + + startup_continue: + #ifdef CONFIG_64BIT +- .level LEVEL ++ .level PA_ASM_LEVEL + rsm PSW_W_SM, %r0 /* clear W-bit */ + #endif + diff --git a/queue-5.1/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch b/queue-5.1/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch new file mode 100644 index 00000000000..0856dfb2c10 --- /dev/null +++ b/queue-5.1/phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch @@ -0,0 +1,33 @@ +From e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 19 Feb 2019 14:53:49 +0000 +Subject: phy: ti-pipe3: fix missing bit-wise or operator when assigning val + +From: Colin Ian King + +commit e6577cb5103b7ca7c0204c0c86ef4af8aa6288f6 upstream. + +There seems to be a missing bit-wise or operator when setting val, +fix this by adding it in. + +Fixes: 2796ceb0c18a ("phy: ti-pipe3: Update pcie phy settings") +Cc: stable@vger.kernel.org # v4.19+ +Signed-off-by: Colin Ian King +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/ti/phy-ti-pipe3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/ti/phy-ti-pipe3.c ++++ b/drivers/phy/ti/phy-ti-pipe3.c +@@ -303,7 +303,7 @@ static void ti_pipe3_calibrate(struct ti + + val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY); + val &= ~(INTERFACE_MASK | LOSD_MASK | MEM_PLLDIV); +- val = (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT); ++ val |= (0x1 << INTERFACE_SHIFT | 0xA << LOSD_SHIFT); + ti_pipe3_writel(phy->phy_rx, PCIEPHYRX_ANA_PROGRAMMABILITY, val); + + val = ti_pipe3_readl(phy->phy_rx, PCIEPHYRX_DIGITAL_MODES); diff --git a/queue-5.1/proc-prevent-changes-to-overridden-credentials.patch b/queue-5.1/proc-prevent-changes-to-overridden-credentials.patch new file mode 100644 index 00000000000..b973acbbd62 --- /dev/null +++ b/queue-5.1/proc-prevent-changes-to-overridden-credentials.patch @@ -0,0 +1,41 @@ +From 35a196bef449b5824033865b963ed9a43fb8c730 Mon Sep 17 00:00:00 2001 +From: Paul Moore +Date: Fri, 19 Apr 2019 14:55:12 -0400 +Subject: proc: prevent changes to overridden credentials + +From: Paul Moore + +commit 35a196bef449b5824033865b963ed9a43fb8c730 upstream. + +Prevent userspace from changing the the /proc/PID/attr values if the +task's credentials are currently overriden. This not only makes sense +conceptually, it also prevents some really bizarre error cases caused +when trying to commit credentials to a task with overridden +credentials. + +Cc: +Reported-by: "chengjian (D)" +Signed-off-by: Paul Moore +Acked-by: John Johansen +Acked-by: James Morris +Acked-by: Casey Schaufler +Signed-off-by: Greg Kroah-Hartman + +--- + fs/proc/base.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2540,6 +2540,11 @@ static ssize_t proc_pid_attr_write(struc + rcu_read_unlock(); + return -EACCES; + } ++ /* Prevent changes to overridden credentials. */ ++ if (current_cred() != current_real_cred()) { ++ rcu_read_unlock(); ++ return -EBUSY; ++ } + rcu_read_unlock(); + + if (count > PAGE_SIZE) diff --git a/queue-5.1/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch b/queue-5.1/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch new file mode 100644 index 00000000000..94bd9bbee2e --- /dev/null +++ b/queue-5.1/regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch @@ -0,0 +1,54 @@ +From 70b464918e5331e488058870fcc6821d54c4e541 Mon Sep 17 00:00:00 2001 +From: Steve Twiss +Date: Mon, 18 Mar 2019 16:17:57 +0000 +Subject: regulator: core: fix error path for regulator_set_voltage_unlocked + +From: Steve Twiss + +commit 70b464918e5331e488058870fcc6821d54c4e541 upstream. + +During several error paths in the function +regulator_set_voltage_unlocked() the value of 'ret' can take on negative +error values. However, in calls that go through the 'goto out' statement, +this return value is lost and return 0 is used instead, indicating a +'pass'. + +There are several cases where this function should legitimately return a +fail instead of a pass: one such case includes constraints check during +voltage selection in the call to regulator_check_voltage(), which can +have -EINVAL for the case when an unsupported voltage is incorrectly +requested. In that case, -22 is expected as the return value, not 0. + +Fixes: 9243a195be7a ("regulator: core: Change voltage setting path") +Cc: stable +Signed-off-by: Steve Twiss +Reviewed-by: Dmitry Osipenko +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/core.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -3322,15 +3322,12 @@ static int regulator_set_voltage_unlocke + + /* for not coupled regulators this will just set the voltage */ + ret = regulator_balance_voltage(rdev, state); +- if (ret < 0) +- goto out2; ++ if (ret < 0) { ++ voltage->min_uV = old_min_uV; ++ voltage->max_uV = old_max_uV; ++ } + + out: +- return 0; +-out2: +- voltage->min_uV = old_min_uV; +- voltage->max_uV = old_max_uV; +- + return ret; + } + diff --git a/queue-5.1/revert-md-fix-lock-contention-for-flush-bios.patch b/queue-5.1/revert-md-fix-lock-contention-for-flush-bios.patch new file mode 100644 index 00000000000..8ee980fe024 --- /dev/null +++ b/queue-5.1/revert-md-fix-lock-contention-for-flush-bios.patch @@ -0,0 +1,312 @@ +From 4bc034d35377196c854236133b07730a777c4aba Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Fri, 29 Mar 2019 10:46:16 -0700 +Subject: Revert "MD: fix lock contention for flush bios" + +From: NeilBrown + +commit 4bc034d35377196c854236133b07730a777c4aba upstream. + +This reverts commit 5a409b4f56d50b212334f338cb8465d65550cd85. + +This patch has two problems. + +1/ it make multiple calls to submit_bio() from inside a make_request_fn. + The bios thus submitted will be queued on current->bio_list and not + submitted immediately. As the bios are allocated from a mempool, + this can theoretically result in a deadlock - all the pool of requests + could be in various ->bio_list queues and a subsequent mempool_alloc + could block waiting for one of them to be released. + +2/ It aims to handle a case when there are many concurrent flush requests. + It handles this by submitting many requests in parallel - all of which + are identical and so most of which do nothing useful. + It would be more efficient to just send one lower-level request, but + allow that to satisfy multiple upper-level requests. + +Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") +Cc: # v4.19+ +Tested-by: Xiao Ni +Signed-off-by: NeilBrown +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 159 +++++++++++++++++++------------------------------------- + drivers/md/md.h | 22 ++----- + 2 files changed, 62 insertions(+), 119 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -132,24 +132,6 @@ static inline int speed_max(struct mddev + mddev->sync_speed_max : sysctl_speed_limit_max; + } + +-static void * flush_info_alloc(gfp_t gfp_flags, void *data) +-{ +- return kzalloc(sizeof(struct flush_info), gfp_flags); +-} +-static void flush_info_free(void *flush_info, void *data) +-{ +- kfree(flush_info); +-} +- +-static void * flush_bio_alloc(gfp_t gfp_flags, void *data) +-{ +- return kzalloc(sizeof(struct flush_bio), gfp_flags); +-} +-static void flush_bio_free(void *flush_bio, void *data) +-{ +- kfree(flush_bio); +-} +- + static struct ctl_table_header *raid_table_header; + + static struct ctl_table raid_table[] = { +@@ -423,54 +405,30 @@ static int md_congested(void *data, int + /* + * Generic flush handling for md + */ +-static void submit_flushes(struct work_struct *ws) +-{ +- struct flush_info *fi = container_of(ws, struct flush_info, flush_work); +- struct mddev *mddev = fi->mddev; +- struct bio *bio = fi->bio; +- +- bio->bi_opf &= ~REQ_PREFLUSH; +- md_handle_request(mddev, bio); +- +- mempool_free(fi, mddev->flush_pool); +-} + +-static void md_end_flush(struct bio *fbio) ++static void md_end_flush(struct bio *bio) + { +- struct flush_bio *fb = fbio->bi_private; +- struct md_rdev *rdev = fb->rdev; +- struct flush_info *fi = fb->fi; +- struct bio *bio = fi->bio; +- struct mddev *mddev = fi->mddev; ++ struct md_rdev *rdev = bio->bi_private; ++ struct mddev *mddev = rdev->mddev; + + rdev_dec_pending(rdev, mddev); + +- if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) { +- /* an empty barrier - all done */ +- bio_endio(bio); +- mempool_free(fi, mddev->flush_pool); +- } else { +- INIT_WORK(&fi->flush_work, submit_flushes); +- queue_work(md_wq, &fi->flush_work); +- } ++ if (atomic_dec_and_test(&mddev->flush_pending)) { ++ /* The pre-request flush has finished */ ++ queue_work(md_wq, &mddev->flush_work); + } +- +- mempool_free(fb, mddev->flush_bio_pool); +- bio_put(fbio); ++ bio_put(bio); + } + +-void md_flush_request(struct mddev *mddev, struct bio *bio) ++static void md_submit_flush_data(struct work_struct *ws); ++ ++static void submit_flushes(struct work_struct *ws) + { ++ struct mddev *mddev = container_of(ws, struct mddev, flush_work); + struct md_rdev *rdev; +- struct flush_info *fi; +- +- fi = mempool_alloc(mddev->flush_pool, GFP_NOIO); +- +- fi->bio = bio; +- fi->mddev = mddev; +- atomic_set(&fi->flush_pending, 1); + ++ INIT_WORK(&mddev->flush_work, md_submit_flush_data); ++ atomic_set(&mddev->flush_pending, 1); + rcu_read_lock(); + rdev_for_each_rcu(rdev, mddev) + if (rdev->raid_disk >= 0 && +@@ -480,40 +438,59 @@ void md_flush_request(struct mddev *mdde + * we reclaim rcu_read_lock + */ + struct bio *bi; +- struct flush_bio *fb; + atomic_inc(&rdev->nr_pending); + atomic_inc(&rdev->nr_pending); + rcu_read_unlock(); +- +- fb = mempool_alloc(mddev->flush_bio_pool, GFP_NOIO); +- fb->fi = fi; +- fb->rdev = rdev; +- + bi = bio_alloc_mddev(GFP_NOIO, 0, mddev); +- bio_set_dev(bi, rdev->bdev); + bi->bi_end_io = md_end_flush; +- bi->bi_private = fb; ++ bi->bi_private = rdev; ++ bio_set_dev(bi, rdev->bdev); + bi->bi_opf = REQ_OP_WRITE | REQ_PREFLUSH; +- +- atomic_inc(&fi->flush_pending); ++ atomic_inc(&mddev->flush_pending); + submit_bio(bi); +- + rcu_read_lock(); + rdev_dec_pending(rdev, mddev); + } + rcu_read_unlock(); ++ if (atomic_dec_and_test(&mddev->flush_pending)) ++ queue_work(md_wq, &mddev->flush_work); ++} + +- if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) { +- /* an empty barrier - all done */ +- bio_endio(bio); +- mempool_free(fi, mddev->flush_pool); +- } else { +- INIT_WORK(&fi->flush_work, submit_flushes); +- queue_work(md_wq, &fi->flush_work); +- } ++static void md_submit_flush_data(struct work_struct *ws) ++{ ++ struct mddev *mddev = container_of(ws, struct mddev, flush_work); ++ struct bio *bio = mddev->flush_bio; ++ ++ /* ++ * must reset flush_bio before calling into md_handle_request to avoid a ++ * deadlock, because other bios passed md_handle_request suspend check ++ * could wait for this and below md_handle_request could wait for those ++ * bios because of suspend check ++ */ ++ mddev->flush_bio = NULL; ++ wake_up(&mddev->sb_wait); ++ ++ if (bio->bi_iter.bi_size == 0) { ++ /* an empty barrier - all done */ ++ bio_endio(bio); ++ } else { ++ bio->bi_opf &= ~REQ_PREFLUSH; ++ md_handle_request(mddev, bio); + } + } ++ ++void md_flush_request(struct mddev *mddev, struct bio *bio) ++{ ++ spin_lock_irq(&mddev->lock); ++ wait_event_lock_irq(mddev->sb_wait, ++ !mddev->flush_bio, ++ mddev->lock); ++ mddev->flush_bio = bio; ++ spin_unlock_irq(&mddev->lock); ++ ++ INIT_WORK(&mddev->flush_work, submit_flushes); ++ queue_work(md_wq, &mddev->flush_work); ++} + EXPORT_SYMBOL(md_flush_request); + + static inline struct mddev *mddev_get(struct mddev *mddev) +@@ -560,6 +537,7 @@ void mddev_init(struct mddev *mddev) + atomic_set(&mddev->openers, 0); + atomic_set(&mddev->active_io, 0); + spin_lock_init(&mddev->lock); ++ atomic_set(&mddev->flush_pending, 0); + init_waitqueue_head(&mddev->sb_wait); + init_waitqueue_head(&mddev->recovery_wait); + mddev->reshape_position = MaxSector; +@@ -5511,22 +5489,6 @@ int md_run(struct mddev *mddev) + if (err) + return err; + } +- if (mddev->flush_pool == NULL) { +- mddev->flush_pool = mempool_create(NR_FLUSH_INFOS, flush_info_alloc, +- flush_info_free, mddev); +- if (!mddev->flush_pool) { +- err = -ENOMEM; +- goto abort; +- } +- } +- if (mddev->flush_bio_pool == NULL) { +- mddev->flush_bio_pool = mempool_create(NR_FLUSH_BIOS, flush_bio_alloc, +- flush_bio_free, mddev); +- if (!mddev->flush_bio_pool) { +- err = -ENOMEM; +- goto abort; +- } +- } + + spin_lock(&pers_lock); + pers = find_pers(mddev->level, mddev->clevel); +@@ -5686,11 +5648,8 @@ int md_run(struct mddev *mddev) + return 0; + + abort: +- mempool_destroy(mddev->flush_bio_pool); +- mddev->flush_bio_pool = NULL; +- mempool_destroy(mddev->flush_pool); +- mddev->flush_pool = NULL; +- ++ bioset_exit(&mddev->bio_set); ++ bioset_exit(&mddev->sync_set); + return err; + } + EXPORT_SYMBOL_GPL(md_run); +@@ -5894,14 +5853,6 @@ static void __md_stop(struct mddev *mdde + mddev->to_remove = &md_redundancy_group; + module_put(pers->owner); + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +- if (mddev->flush_bio_pool) { +- mempool_destroy(mddev->flush_bio_pool); +- mddev->flush_bio_pool = NULL; +- } +- if (mddev->flush_pool) { +- mempool_destroy(mddev->flush_pool); +- mddev->flush_pool = NULL; +- } + } + + void md_stop(struct mddev *mddev) +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -252,19 +252,6 @@ enum mddev_sb_flags { + MD_SB_NEED_REWRITE, /* metadata write needs to be repeated */ + }; + +-#define NR_FLUSH_INFOS 8 +-#define NR_FLUSH_BIOS 64 +-struct flush_info { +- struct bio *bio; +- struct mddev *mddev; +- struct work_struct flush_work; +- atomic_t flush_pending; +-}; +-struct flush_bio { +- struct flush_info *fi; +- struct md_rdev *rdev; +-}; +- + struct mddev { + void *private; + struct md_personality *pers; +@@ -470,8 +457,13 @@ struct mddev { + * metadata and bitmap writes + */ + +- mempool_t *flush_pool; +- mempool_t *flush_bio_pool; ++ /* Generic flush handling. ++ * The last to finish preflush schedules a worker to submit ++ * the rest of the request (without the REQ_PREFLUSH flag). ++ */ ++ struct bio *flush_bio; ++ atomic_t flush_pending; ++ struct work_struct flush_work; + struct work_struct event_work; /* used by dm to report failure event */ + void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev); + struct md_cluster_info *cluster_info; diff --git a/queue-5.1/series b/queue-5.1/series index 00ce409a9ae..89c2a7f1610 100644 --- a/queue-5.1/series +++ b/queue-5.1/series @@ -21,3 +21,34 @@ net-mlx5e-add-missing-ethtool-driver-info-for-representors.patch net-mlx5e-additional-check-for-flow-destination-comparison.patch net-mlx5-imply-mlxfw-in-mlx5_core.patch net-mlx5e-fix-ethtool-rxfh-commands-when-config_mlx5_en_rxnfc-is-disabled.patch +blk-mq-free-hw-queue-s-resource-in-hctx-s-release-handler.patch +regulator-core-fix-error-path-for-regulator_set_voltage_unlocked.patch +parisc-export-running_on_qemu-symbol-for-modules.patch +parisc-add-memory-clobber-to-tlb-purges.patch +parisc-skip-registering-led-when-running-in-qemu.patch +parisc-add-memory-barrier-to-asm-pdc-and-sync-instructions.patch +parisc-allow-live-patching-of-__meminit-functions.patch +parisc-use-pa_asm_level-in-boot-code.patch +parisc-rename-level-to-pa_asm_level-to-avoid-name-clash-with-drbd-code.patch +stm-class-fix-channel-free-in-stm-output-free-path.patch +stm-class-fix-channel-bitmap-on-32-bit-systems.patch +brd-re-enable-__gfp_highmem-in-brd_insert_page.patch +proc-prevent-changes-to-overridden-credentials.patch +revert-md-fix-lock-contention-for-flush-bios.patch +md-batch-flush-requests.patch +md-add-mddev-pers-to-avoid-potential-null-pointer-dereference.patch +md-add-a-missing-endianness-conversion-in-check_sb_changes.patch +dcache-sort-the-freeing-without-rcu-delay-mess-for-good.patch +intel_th-msu-fix-single-mode-with-iommu.patch +p54-drop-device-reference-count-if-fails-to-enable-device.patch +of-fix-clang-wunsequenced-for-be32_to_cpu.patch +brcmfmac-add-dmi-nvram-filename-quirk-for-acepc-t8-and-t11-mini-pcs.patch +cifs-fix-credits-leak-for-smb1-oplock-breaks.patch +cifs-fix-strcat-buffer-overflow-and-reduce-raciness-in-smb21_set_oplock_level.patch +phy-ti-pipe3-fix-missing-bit-wise-or-operator-when-assigning-val.patch +media-ov6650-fix-sensor-possibly-not-detected-on-probe.patch +media-seco-cec-fix-building-with-rc_core-m.patch +media-imx-csi-allow-unknown-nearest-upstream-entities.patch +media-imx-clear-fwnode-link-struct-for-each-endpoint-iteration.patch +media-imx-rename-functions-that-add-ipu-internal-subdevs.patch +media-imx-don-t-register-ipu-subdevs-links-if-csi-port-missing.patch diff --git a/queue-5.1/stm-class-fix-channel-bitmap-on-32-bit-systems.patch b/queue-5.1/stm-class-fix-channel-bitmap-on-32-bit-systems.patch new file mode 100644 index 00000000000..74d4a7114be --- /dev/null +++ b/queue-5.1/stm-class-fix-channel-bitmap-on-32-bit-systems.patch @@ -0,0 +1,45 @@ +From 51e0f227812ed81a368de54157ebe14396b4be03 Mon Sep 17 00:00:00 2001 +From: Alexander Shishkin +Date: Wed, 17 Apr 2019 10:35:35 +0300 +Subject: stm class: Fix channel bitmap on 32-bit systems + +From: Alexander Shishkin + +commit 51e0f227812ed81a368de54157ebe14396b4be03 upstream. + +Commit 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace +Module devices") naively calculates the channel bitmap size in 64-bit +chunks regardless of the size of underlying unsigned long, making the +bitmap half as big on a 32-bit system. This leads to an out of bounds +access with the upper half of the bitmap. + +Fix this by using BITS_TO_LONGS. While at it, convert to using +struct_size() for the total size calculation of the master struct. + +Signed-off-by: Alexander Shishkin +Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices") +Reported-by: Mulu He +Cc: stable@vger.kernel.org # v4.4+ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -166,11 +166,10 @@ stm_master(struct stm_device *stm, unsig + static int stp_master_alloc(struct stm_device *stm, unsigned int idx) + { + struct stp_master *master; +- size_t size; + +- size = ALIGN(stm->data->sw_nchannels, 8) / 8; +- size += sizeof(struct stp_master); +- master = kzalloc(size, GFP_ATOMIC); ++ master = kzalloc(struct_size(master, chan_map, ++ BITS_TO_LONGS(stm->data->sw_nchannels)), ++ GFP_ATOMIC); + if (!master) + return -ENOMEM; + diff --git a/queue-5.1/stm-class-fix-channel-free-in-stm-output-free-path.patch b/queue-5.1/stm-class-fix-channel-free-in-stm-output-free-path.patch new file mode 100644 index 00000000000..e6aa1cf499b --- /dev/null +++ b/queue-5.1/stm-class-fix-channel-free-in-stm-output-free-path.patch @@ -0,0 +1,40 @@ +From ee496da4c3915de3232b5f5cd20e21ae3e46fe8d Mon Sep 17 00:00:00 2001 +From: Tingwei Zhang +Date: Wed, 17 Apr 2019 10:35:34 +0300 +Subject: stm class: Fix channel free in stm output free path + +From: Tingwei Zhang + +commit ee496da4c3915de3232b5f5cd20e21ae3e46fe8d upstream. + +Number of free masters is not set correctly in stm +free path. Fix this by properly adding the number +of output channels before setting them to 0 in +stm_output_disclaim(). + +Currently it is equivalent to doing nothing since +master->nr_free is incremented by 0. + +Fixes: 7bd1d4093c2f ("stm class: Introduce an abstraction for System Trace Module devices") +Signed-off-by: Tingwei Zhang +Signed-off-by: Sai Prakash Ranjan +Cc: stable@vger.kernel.org # v4.4 +Signed-off-by: Alexander Shishkin +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hwtracing/stm/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -218,8 +218,8 @@ stm_output_disclaim(struct stm_device *s + bitmap_release_region(&master->chan_map[0], output->channel, + ilog2(output->nr_chans)); + +- output->nr_chans = 0; + master->nr_free += output->nr_chans; ++ output->nr_chans = 0; + } + + /*