From: Sasha Levin Date: Thu, 23 Jan 2020 16:26:57 +0000 (-0500) Subject: fixes for 4.14 X-Git-Tag: v5.4.15~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b56d29afbace24e423c79bc3c9d1b37f57992e96;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/6lowpan-off-by-one-handling-nexthdr.patch b/queue-4.14/6lowpan-off-by-one-handling-nexthdr.patch new file mode 100644 index 00000000000..f856ba5354e --- /dev/null +++ b/queue-4.14/6lowpan-off-by-one-handling-nexthdr.patch @@ -0,0 +1,41 @@ +From c8a9d82b9f8764c68ddd9c8f705ccb1faa7f014f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2019 08:34:16 +0300 +Subject: 6lowpan: Off by one handling ->nexthdr + +From: Dan Carpenter + +[ Upstream commit f57c4bbf34439531adccd7d3a4ecc14f409c1399 ] + +NEXTHDR_MAX is 255. What happens here is that we take a u8 value +"hdr->nexthdr" from the network and then look it up in +lowpan_nexthdr_nhcs[]. The problem is that if hdr->nexthdr is 0xff then +we read one element beyond the end of the array so the array needs to +be one element larger. + +Fixes: 92aa7c65d295 ("6lowpan: add generic nhc layer interface") +Signed-off-by: Dan Carpenter +Acked-by: Jukka Rissanen +Acked-by: Alexander Aring +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/6lowpan/nhc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/6lowpan/nhc.c b/net/6lowpan/nhc.c +index 4fa2fdda174d0..9e56fb98f33cf 100644 +--- a/net/6lowpan/nhc.c ++++ b/net/6lowpan/nhc.c +@@ -18,7 +18,7 @@ + #include "nhc.h" + + static struct rb_root rb_root = RB_ROOT; +-static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX]; ++static struct lowpan_nhc *lowpan_nexthdr_nhcs[NEXTHDR_MAX + 1]; + static DEFINE_SPINLOCK(lowpan_nhc_lock); + + static int lowpan_nhc_insert(struct lowpan_nhc *nhc) +-- +2.20.1 + diff --git a/queue-4.14/act_mirred-fix-mirred_init_module-error-handling.patch b/queue-4.14/act_mirred-fix-mirred_init_module-error-handling.patch new file mode 100644 index 00000000000..ea28bd14669 --- /dev/null +++ b/queue-4.14/act_mirred-fix-mirred_init_module-error-handling.patch @@ -0,0 +1,40 @@ +From 829aa82dd4968ba8a18ab05b4241594792c9cd44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 11:10:52 +0800 +Subject: act_mirred: Fix mirred_init_module error handling + +From: YueHaibing + +[ Upstream commit 11c9a7d38af524217efb7a176ad322b97ac2f163 ] + +If tcf_register_action failed, mirred_device_notifier +should be unregistered. + +Fixes: 3b87956ea645 ("net sched: fix race in mirred device removal") +Signed-off-by: YueHaibing +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index 529bb064c4a4d..dcfaa4f9c7c5b 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -371,7 +371,11 @@ static int __init mirred_init_module(void) + return err; + + pr_info("Mirror/redirect action on\n"); +- return tcf_register_action(&act_mirred_ops, &mirred_net_ops); ++ err = tcf_register_action(&act_mirred_ops, &mirred_net_ops); ++ if (err) ++ unregister_netdevice_notifier(&mirred_device_notifier); ++ ++ return err; + } + + static void __exit mirred_cleanup_module(void) +-- +2.20.1 + diff --git a/queue-4.14/affs-fix-a-memory-leak-in-affs_remount.patch b/queue-4.14/affs-fix-a-memory-leak-in-affs_remount.patch new file mode 100644 index 00000000000..09e5acc76cb --- /dev/null +++ b/queue-4.14/affs-fix-a-memory-leak-in-affs_remount.patch @@ -0,0 +1,60 @@ +From 644036c4676eb3f56d71f2ef36178ebd44a6337e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 16:52:37 -0500 +Subject: affs: fix a memory leak in affs_remount + +From: Navid Emamdoost + +[ Upstream commit 450c3d4166837c496ebce03650c08800991f2150 ] + +In affs_remount if data is provided it is duplicated into new_opts. The +allocated memory for new_opts is only released if parse_options fails. + +There's a bit of history behind new_options, originally there was +save/replace options on the VFS layer so the 'data' passed must not +change (thus strdup), this got cleaned up in later patches. But not +completely. + +There's no reason to do the strdup in cases where the filesystem does +not need to reuse the 'data' again, because strsep would modify it +directly. + +Fixes: c8f33d0bec99 ("affs: kstrdup() memory handling") +Signed-off-by: Navid Emamdoost +[ update changelog ] +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/affs/super.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/fs/affs/super.c b/fs/affs/super.c +index 884bedab7266a..789a1c7db5d8c 100644 +--- a/fs/affs/super.c ++++ b/fs/affs/super.c +@@ -559,14 +559,9 @@ affs_remount(struct super_block *sb, int *flags, char *data) + int root_block; + unsigned long mount_flags; + int res = 0; +- char *new_opts; + char volume[32]; + char *prefix = NULL; + +- new_opts = kstrdup(data, GFP_KERNEL); +- if (data && !new_opts) +- return -ENOMEM; +- + pr_debug("%s(flags=0x%x,opts=\"%s\")\n", __func__, *flags, data); + + sync_filesystem(sb); +@@ -577,7 +572,6 @@ affs_remount(struct super_block *sb, int *flags, char *data) + &blocksize, &prefix, volume, + &mount_flags)) { + kfree(prefix); +- kfree(new_opts); + return -EINVAL; + } + +-- +2.20.1 + diff --git a/queue-4.14/afs-fix-large-file-support.patch b/queue-4.14/afs-fix-large-file-support.patch new file mode 100644 index 00000000000..7dc41eb421d --- /dev/null +++ b/queue-4.14/afs-fix-large-file-support.patch @@ -0,0 +1,45 @@ +From ab196de4f2e9b1026aecce9337a4f0efb4db394a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2019 15:37:26 +0000 +Subject: afs: Fix large file support + +From: Marc Dionne + +[ Upstream commit b485275f1aca8a9da37fd35e4fad673935e827da ] + +By default s_maxbytes is set to MAX_NON_LFS, which limits the usable +file size to 2GB, enforced by the vfs. + +Commit b9b1f8d5930a ("AFS: write support fixes") added support for the +64-bit fetch and store server operations, but did not change this value. +As a result, attempts to write past the 2G mark result in EFBIG errors: + + $ dd if=/dev/zero of=foo bs=1M count=1 seek=2048 + dd: error writing 'foo': File too large + +Set s_maxbytes to MAX_LFS_FILESIZE. + +Fixes: b9b1f8d5930a ("AFS: write support fixes") +Signed-off-by: Marc Dionne +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 689173c0a682f..f8529ddbd587f 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -359,6 +359,7 @@ static int afs_fill_super(struct super_block *sb, + /* fill in the superblock */ + sb->s_blocksize = PAGE_SIZE; + sb->s_blocksize_bits = PAGE_SHIFT; ++ sb->s_maxbytes = MAX_LFS_FILESIZE; + sb->s_magic = AFS_FS_MAGIC; + sb->s_op = &afs_super_ops; + sb->s_xattr = afs_xattr_handlers; +-- +2.20.1 + diff --git a/queue-4.14/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch b/queue-4.14/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch new file mode 100644 index 00000000000..8d53d8f614b --- /dev/null +++ b/queue-4.14/afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch @@ -0,0 +1,46 @@ +From ea43c50cf8f0c20cde1034214320b45e8d2e5d2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 13:27:09 +0100 +Subject: afs: Fix the afs.cell and afs.volume xattr handlers + +From: David Howells + +[ Upstream commit c73aa4102f5b9f261a907c3b3df94cd2c478504d ] + +Fix the ->get handlers for the afs.cell and afs.volume xattrs to pass the +source data size to memcpy() rather than target buffer size. + +Overcopying the source data occasionally causes the kernel to oops. + +Fixes: d3e3b7eac886 ("afs: Add metadata xattrs") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/xattr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/afs/xattr.c b/fs/afs/xattr.c +index 2830e4f48d854..7c6b62a94e7e7 100644 +--- a/fs/afs/xattr.c ++++ b/fs/afs/xattr.c +@@ -50,7 +50,7 @@ static int afs_xattr_get_cell(const struct xattr_handler *handler, + return namelen; + if (namelen > size) + return -ERANGE; +- memcpy(buffer, cell->name, size); ++ memcpy(buffer, cell->name, namelen); + return namelen; + } + +@@ -104,7 +104,7 @@ static int afs_xattr_get_volume(const struct xattr_handler *handler, + return namelen; + if (namelen > size) + return -ERANGE; +- memcpy(buffer, volname, size); ++ memcpy(buffer, volname, namelen); + return namelen; + } + +-- +2.20.1 + diff --git a/queue-4.14/ahci-do-not-export-local-variable-ahci_em_messages.patch b/queue-4.14/ahci-do-not-export-local-variable-ahci_em_messages.patch new file mode 100644 index 00000000000..e39495a6c71 --- /dev/null +++ b/queue-4.14/ahci-do-not-export-local-variable-ahci_em_messages.patch @@ -0,0 +1,41 @@ +From d6f355a1a31b5e3ac4b8ea10d7a7cc5eb9b63e96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 22:42:55 +0300 +Subject: ahci: Do not export local variable ahci_em_messages + +From: Andy Shevchenko + +[ Upstream commit 60fc35f327e0a9e60b955c0f3c3ed623608d1baa ] + +The commit ed08d40cdec4 + ("ahci: Changing two module params with static and __read_mostly") +moved ahci_em_messages to be static while missing the fact of exporting it. + +WARNING: "ahci_em_messages" [vmlinux] is a static EXPORT_SYMBOL_GPL + +Drop export for the local variable ahci_em_messages. + +Fixes: ed08d40cdec4 ("ahci: Changing two module params with static and __read_mostly") +Cc: Chuansheng Liu +Signed-off-by: Andy Shevchenko +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libahci.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index cda9a0b5bdaaa..7473ff46de66c 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -191,7 +191,6 @@ struct ata_port_operations ahci_pmp_retry_srst_ops = { + EXPORT_SYMBOL_GPL(ahci_pmp_retry_srst_ops); + + static bool ahci_em_messages __read_mostly = true; +-EXPORT_SYMBOL_GPL(ahci_em_messages); + module_param(ahci_em_messages, bool, 0444); + /* add other LED protocol types when they become supported */ + MODULE_PARM_DESC(ahci_em_messages, +-- +2.20.1 + diff --git a/queue-4.14/alsa-aoa-onyx-always-initialize-register-read-value.patch b/queue-4.14/alsa-aoa-onyx-always-initialize-register-read-value.patch new file mode 100644 index 00000000000..fc14a9758f7 --- /dev/null +++ b/queue-4.14/alsa-aoa-onyx-always-initialize-register-read-value.patch @@ -0,0 +1,43 @@ +From 480ea4da7ffbd17da1e8656ae16020108b85583a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2019 09:14:22 +0200 +Subject: ALSA: aoa: onyx: always initialize register read value + +From: Johannes Berg + +[ Upstream commit f474808acb3c4b30552d9c59b181244e0300d218 ] + +A lot of places in the driver use onyx_read_register() without +checking the return value, and it's been working OK for ~10 years +or so, so probably never fails ... Rather than trying to check the +return value everywhere, which would be relatively intrusive, at +least make sure we don't use an uninitialized value. + +Fixes: f3d9478b2ce4 ("[ALSA] snd-aoa: add snd-aoa") +Reported-by: Stephen Rothwell +Signed-off-by: Johannes Berg +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/aoa/codecs/onyx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/aoa/codecs/onyx.c b/sound/aoa/codecs/onyx.c +index d2d96ca082b71..6224fd3bbf7cc 100644 +--- a/sound/aoa/codecs/onyx.c ++++ b/sound/aoa/codecs/onyx.c +@@ -74,8 +74,10 @@ static int onyx_read_register(struct onyx *onyx, u8 reg, u8 *value) + return 0; + } + v = i2c_smbus_read_byte_data(onyx->i2c, reg); +- if (v < 0) ++ if (v < 0) { ++ *value = 0; + return -1; ++ } + *value = (u8)v; + onyx->cache[ONYX_REG_CONTROL-FIRSTREGISTER] = *value; + return 0; +-- +2.20.1 + diff --git a/queue-4.14/alsa-hda-fix-unused-variable-warning.patch b/queue-4.14/alsa-hda-fix-unused-variable-warning.patch new file mode 100644 index 00000000000..1b435194bf8 --- /dev/null +++ b/queue-4.14/alsa-hda-fix-unused-variable-warning.patch @@ -0,0 +1,53 @@ +From 6d07d8e3d1efd54c26f6e9f9cf04a7add0ffb53c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 16:18:36 +0200 +Subject: ALSA: hda: fix unused variable warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Anders Roxell + +[ Upstream commit 5b03006d5c58ddd31caf542eef4d0269bcf265b3 ] + +When CONFIG_X86=n function azx_snoop doesn't use the variable chip it +only returns true. + +sound/pci/hda/hda_intel.c: In function ‘dma_alloc_pages’: +sound/pci/hda/hda_intel.c:2002:14: warning: unused variable ‘chip’ [-Wunused-variable] + struct azx *chip = bus_to_azx(bus); + ^~~~ + +Create a inline function of azx_snoop. + +Fixes: a41d122449be ("ALSA: hda - Embed bus into controller object") +Signed-off-by: Anders Roxell +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_controller.h | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h +index 8a9dd4767b1ec..63cc10604afc7 100644 +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -176,11 +176,10 @@ struct azx { + #define azx_bus(chip) (&(chip)->bus.core) + #define bus_to_azx(_bus) container_of(_bus, struct azx, bus.core) + +-#ifdef CONFIG_X86 +-#define azx_snoop(chip) ((chip)->snoop) +-#else +-#define azx_snoop(chip) true +-#endif ++static inline bool azx_snoop(struct azx *chip) ++{ ++ return !IS_ENABLED(CONFIG_X86) || chip->snoop; ++} + + /* + * macros for easy use +-- +2.20.1 + diff --git a/queue-4.14/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch b/queue-4.14/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch new file mode 100644 index 00000000000..6f4ced73707 --- /dev/null +++ b/queue-4.14/alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch @@ -0,0 +1,39 @@ +From 336c6d07fe74316ce5355bb746b4fdaa6bcaf4df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2019 13:00:03 +0200 +Subject: ALSA: usb-audio: Handle the error from + snd_usb_mixer_apply_create_quirk() + +From: Takashi Iwai + +[ Upstream commit 328e9f6973be2ee67862cb17bf6c0c5c5918cd72 ] + +The error from snd_usb_mixer_apply_create_quirk() is ignored in the +current usb-audio driver code, which will continue the probing even +after the error. Let's take it more serious. + +Fixes: 7b1eda223deb ("ALSA: usb-mixer: factor out quirks") +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 044193b2364d0..e6e4c3b9d9d3f 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -2632,7 +2632,9 @@ int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif, + (err = snd_usb_mixer_status_create(mixer)) < 0) + goto _error; + +- snd_usb_mixer_apply_create_quirk(mixer); ++ err = snd_usb_mixer_apply_create_quirk(mixer); ++ if (err < 0) ++ goto _error; + + err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops); + if (err < 0) +-- +2.20.1 + diff --git a/queue-4.14/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch b/queue-4.14/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch new file mode 100644 index 00000000000..d030ef2c8da --- /dev/null +++ b/queue-4.14/alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch @@ -0,0 +1,64 @@ +From 904dc76212993332e7faf953ec3a341992286260 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 16:42:05 +0200 +Subject: ALSA: usb-audio: update quirk for B&W PX to remove microphone + +From: Nicolas Huaman + +[ Upstream commit c369c8db15d51fa175d2ba85928f79d16af6b562 ] + +A quirk in snd-usb-audio was added to automate setting sample rate to +4800k and remove the previously exposed nonfunctional microphone for +the Bowers & Wilkins PX: +commit 240a8af929c7c57dcde28682725b29cf8474e8e5 +https://lore.kernel.org/patchwork/patch/919689/ + +However the headphones where updated shortly after that to remove the +unintentional microphone functionality. I guess because of this the +headphones now crash when connecting them via USB while the quirk is +active. Dmesg: + +snd-usb-audio: probe of 2-3:1.0 failed with error -22 +usb 2-3: 2:1: cannot get min/max values for control 2 (id 2) + +This patch removes the microfone and allows the headphones to connect +and work out of the box. It is based on the current mainline kernel + and successfully applied an tested on my machine (4.18.10.arch1-1). + +Fixes: 240a8af929c7 ("ALSA: usb-audio: Add a quirck for B&W PX headphones") +Signed-off-by: Nicolas Huaman +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/quirks-table.h | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index d32727c74a168..c892b4d1e733f 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3293,19 +3293,14 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + .ifnum = 0, + .type = QUIRK_AUDIO_STANDARD_MIXER, + }, +- /* Capture */ +- { +- .ifnum = 1, +- .type = QUIRK_IGNORE_INTERFACE, +- }, + /* Playback */ + { +- .ifnum = 2, ++ .ifnum = 1, + .type = QUIRK_AUDIO_FIXED_ENDPOINT, + .data = &(const struct audioformat) { + .formats = SNDRV_PCM_FMTBIT_S16_LE, + .channels = 2, +- .iface = 2, ++ .iface = 1, + .altsetting = 1, + .altset_idx = 1, + .attributes = UAC_EP_CS_ATTR_FILL_MAX | +-- +2.20.1 + diff --git a/queue-4.14/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch b/queue-4.14/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch new file mode 100644 index 00000000000..06cc7c6c95d --- /dev/null +++ b/queue-4.14/apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch @@ -0,0 +1,63 @@ +From 11ad6a6c20d99cd81283b3c556483b7c63c3edba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 18:12:09 +0200 +Subject: apparmor: don't try to replace stale label in ptrace access check + +From: Jann Horn + +[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ] + +As a comment above begin_current_label_crit_section() explains, +begin_current_label_crit_section() must run in sleepable context because +when label_is_stale() is true, aa_replace_current_label() runs, which uses +prepare_creds(), which can sleep. +Until now, the ptrace access check (which runs with a task lock held) +violated this rule. + +Also add a might_sleep() assertion to begin_current_label_crit_section(), +because asserts are less likely to be ignored than comments. + +Fixes: b2d09ae449ced ("apparmor: move ptrace checks to using labels") +Signed-off-by: Jann Horn +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/include/context.h | 2 ++ + security/apparmor/lsm.c | 4 ++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/include/context.h b/security/apparmor/include/context.h +index 6ae07e9aaa172..812cdec9dd3be 100644 +--- a/security/apparmor/include/context.h ++++ b/security/apparmor/include/context.h +@@ -191,6 +191,8 @@ static inline struct aa_label *begin_current_label_crit_section(void) + { + struct aa_label *label = aa_current_raw_label(); + ++ might_sleep(); ++ + if (label_is_stale(label)) { + label = aa_get_newest_label(label); + if (aa_replace_current_label(label) == 0) +diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c +index 1346ee5be04f1..4f08023101f3c 100644 +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -108,12 +108,12 @@ static int apparmor_ptrace_access_check(struct task_struct *child, + struct aa_label *tracer, *tracee; + int error; + +- tracer = begin_current_label_crit_section(); ++ tracer = __begin_current_label_crit_section(); + tracee = aa_get_task_label(child); + error = aa_may_ptrace(tracer, tracee, + mode == PTRACE_MODE_READ ? AA_PTRACE_READ : AA_PTRACE_TRACE); + aa_put_label(tracee); +- end_current_label_crit_section(tracer); ++ __end_current_label_crit_section(tracer); + + return error; + } +-- +2.20.1 + diff --git a/queue-4.14/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch b/queue-4.14/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch new file mode 100644 index 00000000000..fe8a84a2341 --- /dev/null +++ b/queue-4.14/arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch @@ -0,0 +1,97 @@ +From 966776b2c5bae94af70d8aa4e18789e514f2fd70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Feb 2019 09:31:41 +0100 +Subject: ARM: 8847/1: pm: fix HYP/SVC mode mismatch when MCPM is used + +From: Marek Szyprowski + +[ Upstream commit ca70ea43f80c98582f5ffbbd1e6f4da2742da0c4 ] + +MCPM does a soft reset of the CPUs and uses common cpu_resume() routine to +perform low-level platform initialization. This results in a try to install +HYP stubs for the second time for each CPU and results in false HYP/SVC +mode mismatch detection. The HYP stubs are already installed at the +beginning of the kernel initialization on the boot CPU (head.S) or in the +secondary_startup() for other CPUs. To fix this issue MCPM code should use +a cpu_resume() routine without HYP stubs installation. + +This change fixes HYP/SVC mode mismatch on Samsung Exynos5422-based Odroid +XU3/XU4/HC1 boards. + +Fixes: 3721924c8154 ("ARM: 8081/1: MCPM: provide infrastructure to allow for MCPM loopback") +Signed-off-by: Marek Szyprowski +Acked-by: Nicolas Pitre +Tested-by: Anand Moon +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/common/mcpm_entry.c | 2 +- + arch/arm/include/asm/suspend.h | 1 + + arch/arm/kernel/sleep.S | 12 ++++++++++++ + 3 files changed, 14 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/common/mcpm_entry.c b/arch/arm/common/mcpm_entry.c +index 2b913f17d50f5..c24a55b0deac7 100644 +--- a/arch/arm/common/mcpm_entry.c ++++ b/arch/arm/common/mcpm_entry.c +@@ -379,7 +379,7 @@ static int __init nocache_trampoline(unsigned long _arg) + unsigned int cluster = MPIDR_AFFINITY_LEVEL(mpidr, 1); + phys_reset_t phys_reset; + +- mcpm_set_entry_vector(cpu, cluster, cpu_resume); ++ mcpm_set_entry_vector(cpu, cluster, cpu_resume_no_hyp); + setup_mm_for_reboot(); + + __mcpm_cpu_going_down(cpu, cluster); +diff --git a/arch/arm/include/asm/suspend.h b/arch/arm/include/asm/suspend.h +index 452bbdcbcc835..506314265c6f1 100644 +--- a/arch/arm/include/asm/suspend.h ++++ b/arch/arm/include/asm/suspend.h +@@ -10,6 +10,7 @@ struct sleep_save_sp { + }; + + extern void cpu_resume(void); ++extern void cpu_resume_no_hyp(void); + extern void cpu_resume_arm(void); + extern int cpu_suspend(unsigned long, int (*)(unsigned long)); + +diff --git a/arch/arm/kernel/sleep.S b/arch/arm/kernel/sleep.S +index a8257fc9cf2a9..5dc8b80bb6938 100644 +--- a/arch/arm/kernel/sleep.S ++++ b/arch/arm/kernel/sleep.S +@@ -120,6 +120,14 @@ ENDPROC(cpu_resume_after_mmu) + .text + .align + ++#ifdef CONFIG_MCPM ++ .arm ++THUMB( .thumb ) ++ENTRY(cpu_resume_no_hyp) ++ARM_BE8(setend be) @ ensure we are in BE mode ++ b no_hyp ++#endif ++ + #ifdef CONFIG_MMU + .arm + ENTRY(cpu_resume_arm) +@@ -135,6 +143,7 @@ ARM_BE8(setend be) @ ensure we are in BE mode + bl __hyp_stub_install_secondary + #endif + safe_svcmode_maskall r1 ++no_hyp: + mov r1, #0 + ALT_SMP(mrc p15, 0, r0, c0, c0, 5) + ALT_UP_B(1f) +@@ -163,6 +172,9 @@ ENDPROC(cpu_resume) + + #ifdef CONFIG_MMU + ENDPROC(cpu_resume_arm) ++#endif ++#ifdef CONFIG_MCPM ++ENDPROC(cpu_resume_no_hyp) + #endif + + .align 2 +-- +2.20.1 + diff --git a/queue-4.14/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch b/queue-4.14/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch new file mode 100644 index 00000000000..8f97335d07d --- /dev/null +++ b/queue-4.14/arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch @@ -0,0 +1,40 @@ +From 7ce84e3f9eabd22857a3f3ac2ffa795dcb96f354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Feb 2019 15:00:13 +0100 +Subject: ARM: 8848/1: virt: Align GIC version check with arm64 counterpart + +From: Vladimir Murzin + +[ Upstream commit 9db043d36bd379f4cc99054c079de0dabfc38d03 ] + +arm64 has got relaxation on GIC version check at early boot stage due +to update of the GIC architecture let's align ARM with that. + +To help backports (even though the code was correct at the time of writing) +Fixes: e59941b9b381 ("ARM: 8527/1: virt: enable GICv3 system registers") +Signed-off-by: Vladimir Murzin +Reviewed-by: Marc Zyngier +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/hyp-stub.S | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/kernel/hyp-stub.S b/arch/arm/kernel/hyp-stub.S +index 60146e32619a5..82a942894fc04 100644 +--- a/arch/arm/kernel/hyp-stub.S ++++ b/arch/arm/kernel/hyp-stub.S +@@ -180,8 +180,8 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE + @ Check whether GICv3 system registers are available + mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1 + ubfx r7, r7, #28, #4 +- cmp r7, #1 +- bne 2f ++ teq r7, #0 ++ beq 2f + + @ Enable system register accesses + mrc p15, 4, r7, c12, c9, 5 @ ICC_HSRE +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch b/queue-4.14/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch new file mode 100644 index 00000000000..204f427129a --- /dev/null +++ b/queue-4.14/arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch @@ -0,0 +1,38 @@ +From 0339f1cf342948182929ec7dd42d6590d3166521 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Jan 2019 16:29:20 +0200 +Subject: ARM: dts: lpc32xx: add required clocks property to keypad device node + +From: Vladimir Zapolskiy + +[ Upstream commit 3e88bc38b9f6fe4b69cecf81badd3c19fde97f97 ] + +NXP LPC32xx keypad controller requires a clock property to be defined. + +The change fixes the driver initialization problem: + + lpc32xx_keys 40050000.key: failed to get clock + lpc32xx_keys: probe of 40050000.key failed with error -2 + +Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc32xx.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index d077bd2b9583e..2ca881055ef0e 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -462,6 +462,7 @@ + key: key@40050000 { + compatible = "nxp,lpc3220-key"; + reg = <0x40050000 0x1000>; ++ clocks = <&clk LPC32XX_CLK_KEY>; + interrupts = <54 IRQ_TYPE_LEVEL_HIGH>; + status = "disabled"; + }; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch b/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch new file mode 100644 index 00000000000..d142d3389d8 --- /dev/null +++ b/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch @@ -0,0 +1,38 @@ +From 5a1da7700c2889ecd3f954fa7223d1bf02128ff8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 21:20:40 +0200 +Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller clocks property + +From: Vladimir Zapolskiy + +[ Upstream commit 30fc01bae3cda747e7d9c352b1aa51ca113c8a9d ] + +The originally added ARM PrimeCell PL111 clocks property misses +the required "clcdclk" clock, which is the same as a clock to enable +the LCD controller on NXP LPC3230 and NXP LPC3250 SoCs. + +Fixes: 93898eb775e5 ("arm: dts: lpc32xx: add clock properties to device nodes") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc32xx.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index a08ebc9509234..c5b119ddb70b8 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -142,8 +142,8 @@ + compatible = "arm,pl111", "arm,primecell"; + reg = <0x31040000 0x1000>; + interrupts = <14 IRQ_TYPE_LEVEL_HIGH>; +- clocks = <&clk LPC32XX_CLK_LCD>; +- clock-names = "apb_pclk"; ++ clocks = <&clk LPC32XX_CLK_LCD>, <&clk LPC32XX_CLK_LCD>; ++ clock-names = "clcdclk", "apb_pclk"; + status = "disabled"; + }; + +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch b/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch new file mode 100644 index 00000000000..ee6ab080bcd --- /dev/null +++ b/queue-4.14/arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch @@ -0,0 +1,36 @@ +From ed108894e81cd4d881835fb9ebb4e4c458978543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 21:20:39 +0200 +Subject: ARM: dts: lpc32xx: fix ARM PrimeCell LCD controller variant + +From: Vladimir Zapolskiy + +[ Upstream commit 7a0790a4121cbcd111cc537cdc801c46ccb789ee ] + +ARM PrimeCell PL111 LCD controller is found on On NXP LPC3230 +and LPC3250 SoCs variants, the original reference in compatible +property to an older one ARM PrimeCell PL110 is invalid. + +Fixes: e04920d9efcb3 ("ARM: LPC32xx: DTS files for device tree conversion") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc32xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index 9f9386c926d1e..a08ebc9509234 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -139,7 +139,7 @@ + }; + + clcd: clcd@31040000 { +- compatible = "arm,pl110", "arm,primecell"; ++ compatible = "arm,pl111", "arm,primecell"; + reg = <0x31040000 0x1000>; + interrupts = <14 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&clk LPC32XX_CLK_LCD>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch b/queue-4.14/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch new file mode 100644 index 00000000000..9920be644f6 --- /dev/null +++ b/queue-4.14/arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch @@ -0,0 +1,39 @@ +From 96febaa92b6f3c3236b37fcb956593a086148c94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 21:20:41 +0200 +Subject: ARM: dts: lpc32xx: phy3250: fix SD card regulator voltage + +From: Vladimir Zapolskiy + +[ Upstream commit dc141b99fc36cf910a1d8d5ee30f43f2442fd1bd ] + +The fixed voltage regulator on Phytec phyCORE-LPC3250 board, which +supplies SD/MMC card's power, has a constant output voltage level +of either 3.15V or 3.3V, the actual value depends on JP4 position, +the power rail is referenced as VCC_SDIO in the board hardware manual. + +Fixes: d06670e96267 ("arm: dts: phy3250: add SD fixed regulator") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc3250-phy3250.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/lpc3250-phy3250.dts b/arch/arm/boot/dts/lpc3250-phy3250.dts +index b7bd3a110a8dd..dd0bdf765599d 100644 +--- a/arch/arm/boot/dts/lpc3250-phy3250.dts ++++ b/arch/arm/boot/dts/lpc3250-phy3250.dts +@@ -49,8 +49,8 @@ + sd_reg: regulator@2 { + compatible = "regulator-fixed"; + regulator-name = "sd_reg"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + gpio = <&gpio 5 5 0>; + enable-active-high; + }; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch b/queue-4.14/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch new file mode 100644 index 00000000000..1d4af549a9b --- /dev/null +++ b/queue-4.14/arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch @@ -0,0 +1,43 @@ +From dfc45d330b19ffa0e6790c74cda1fb0894c94c97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Jan 2019 16:29:21 +0200 +Subject: ARM: dts: lpc32xx: reparent keypad controller to SIC1 + +From: Vladimir Zapolskiy + +[ Upstream commit 489261c45f0ebbc1c2813f337bbdf858267f5033 ] + +After switching to a new interrupt controller scheme by separating SIC1 +and SIC2 from MIC interrupt controller just one SoC keypad controller +was not taken into account, fix it now: + + WARNING: CPU: 0 PID: 1 at kernel/irq/irqdomain.c:524 irq_domain_associate+0x50/0x1b0 + error: hwirq 0x36 is too large for interrupt-controller@40008000 + ... + lpc32xx_keys 40050000.key: failed to get platform irq + lpc32xx_keys: probe of 40050000.key failed with error -22 + +Fixes: 9b8ad3fb81ae ("ARM: dts: lpc32xx: reparent SIC1 and SIC2 interrupts from MIC") +Signed-off-by: Vladimir Zapolskiy +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/lpc32xx.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi +index 2ca881055ef0e..9f9386c926d1e 100644 +--- a/arch/arm/boot/dts/lpc32xx.dtsi ++++ b/arch/arm/boot/dts/lpc32xx.dtsi +@@ -463,7 +463,8 @@ + compatible = "nxp,lpc3220-key"; + reg = <0x40050000 0x1000>; + clocks = <&clk LPC32XX_CLK_KEY>; +- interrupts = <54 IRQ_TYPE_LEVEL_HIGH>; ++ interrupt-parent = <&sic1>; ++ interrupts = <22 IRQ_TYPE_LEVEL_HIGH>; + status = "disabled"; + }; + +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch b/queue-4.14/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch new file mode 100644 index 00000000000..c80e89069ef --- /dev/null +++ b/queue-4.14/arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch @@ -0,0 +1,95 @@ +From 518f5958d9ab82202de014ce3c243db4b2dd2c1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Apr 2019 02:23:14 +0300 +Subject: ARM: dts: ls1021: Fix SGMII PCS link remaining down after PHY + disconnect + +From: Vladimir Oltean + +[ Upstream commit c7861adbe37f576931650ad8ef805e0c47564b9a ] + +Each eTSEC MAC has its own TBI (SGMII) PCS and private MDIO bus. +But due to a DTS oversight, both SGMII-compatible MACs of the LS1021 SoC +are pointing towards the same internal PCS. Therefore nobody is +controlling the internal PCS of eTSEC0. + +Upon initial ndo_open, the SGMII link is ok by virtue of U-boot +initialization. But upon an ifdown/ifup sequence, the code path from +ndo_open -> init_phy -> gfar_configure_serdes does not get executed for +the PCS of eTSEC0 (and is executed twice for MAC eTSEC1). So the SGMII +link remains down for eTSEC0. On the LS1021A-TWR board, to signal this +failure condition, the PHY driver keeps printing +'803x_aneg_done: SGMII link is not ok'. + +Also, it changes compatible of mdio0 to "fsl,etsec2-mdio" to match +mdio1 device. + +Fixes: 055223d4d22d ("ARM: dts: ls1021a: Enable the eTSEC ports on QDS and TWR") +Signed-off-by: Vladimir Oltean +Reviewed-by: Claudiu Manoil +Acked-by: Li Yang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ls1021a-twr.dts | 9 ++++++++- + arch/arm/boot/dts/ls1021a.dtsi | 11 ++++++++++- + 2 files changed, 18 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts +index 44715c8ef756b..72a3fc63d0ece 100644 +--- a/arch/arm/boot/dts/ls1021a-twr.dts ++++ b/arch/arm/boot/dts/ls1021a-twr.dts +@@ -143,7 +143,7 @@ + }; + + &enet0 { +- tbi-handle = <&tbi1>; ++ tbi-handle = <&tbi0>; + phy-handle = <&sgmii_phy2>; + phy-connection-type = "sgmii"; + status = "okay"; +@@ -222,6 +222,13 @@ + sgmii_phy2: ethernet-phy@2 { + reg = <0x2>; + }; ++ tbi0: tbi-phy@1f { ++ reg = <0x1f>; ++ device_type = "tbi-phy"; ++ }; ++}; ++ ++&mdio1 { + tbi1: tbi-phy@1f { + reg = <0x1f>; + device_type = "tbi-phy"; +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index 2d20f60947b95..1343c86988c54 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -562,13 +562,22 @@ + }; + + mdio0: mdio@2d24000 { +- compatible = "gianfar"; ++ compatible = "fsl,etsec2-mdio"; + device_type = "mdio"; + #address-cells = <1>; + #size-cells = <0>; + reg = <0x0 0x2d24000 0x0 0x4000>; + }; + ++ mdio1: mdio@2d64000 { ++ compatible = "fsl,etsec2-mdio"; ++ device_type = "mdio"; ++ #address-cells = <1>; ++ #size-cells = <0>; ++ reg = <0x0 0x2d64000 0x0 0x4000>, ++ <0x0 0x2d50030 0x0 0x4>; ++ }; ++ + ptp_clock@2d10e00 { + compatible = "fsl,etsec-ptp"; + reg = <0x0 0x2d10e00 0x0 0xb0>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch b/queue-4.14/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch new file mode 100644 index 00000000000..c835feecf32 --- /dev/null +++ b/queue-4.14/arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch @@ -0,0 +1,36 @@ +From 65ad3ae557902eba3009b36b6ddaa5af20d9e439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jun 2019 14:29:58 +0200 +Subject: ARM: dts: stm32: add missing vdda-supply to adc on stm32h743i-eval + +From: Fabrice Gasnier + +[ Upstream commit 493e84c5dc4d703d976b5875f5db22dae08a0782 ] + +Add missing vdda-supply required by STM32 ADC. + +Fixes: 090992a9ca54 ("ARM: dts: stm32: enable ADC on stm32h743i-eval +board") + +Signed-off-by: Fabrice Gasnier +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32h743i-eval.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32h743i-eval.dts b/arch/arm/boot/dts/stm32h743i-eval.dts +index 6c07786e7ddb9..0d98b2865bd77 100644 +--- a/arch/arm/boot/dts/stm32h743i-eval.dts ++++ b/arch/arm/boot/dts/stm32h743i-eval.dts +@@ -71,6 +71,7 @@ + }; + + &adc_12 { ++ vdda-supply = <&vdda>; + vref-supply = <&vdda>; + status = "okay"; + adc1: adc@0 { +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch b/queue-4.14/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch new file mode 100644 index 00000000000..555872c2509 --- /dev/null +++ b/queue-4.14/arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch @@ -0,0 +1,50 @@ +From 15f7406a0f7354f76cd58df43f59130cd06fb14d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 May 2019 17:40:14 +0200 +Subject: ARM: dts: sun8i-h3: Fix wifi in Beelink X2 DT + +From: Jernej Skrabec + +[ Upstream commit ca0961011db57e39880df0b5708df8aa3339dc6f ] + +mmc1 node where wifi module is connected doesn't have properly defined +power supplies so wifi module is never powered up. Fix that by +specifying additional power supplies. + +Additionally, this STB may have either Realtek or Broadcom based wifi +module. One based on Broadcom module also needs external clock to work +properly. Fix that by adding clock property to wifi_pwrseq node. + +Fixes: e582b47a9252 ("ARM: dts: sun8i-h3: Add dts for the Beelink X2 STB") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-h3-beelink-x2.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts +index 10da56e86ab80..21b38c386f1b3 100644 +--- a/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts ++++ b/arch/arm/boot/dts/sun8i-h3-beelink-x2.dts +@@ -79,6 +79,8 @@ + wifi_pwrseq: wifi_pwrseq { + compatible = "mmc-pwrseq-simple"; + reset-gpios = <&r_pio 0 7 GPIO_ACTIVE_LOW>; /* PL7 */ ++ clocks = <&rtc 1>; ++ clock-names = "ext_clock"; + }; + + sound_spdif { +@@ -128,6 +130,8 @@ + pinctrl-names = "default"; + pinctrl-0 = <&mmc1_pins_a>; + vmmc-supply = <®_vcc3v3>; ++ vqmmc-supply = <®_vcc3v3>; ++ mmc-pwrseq = <&wifi_pwrseq>; + bus-width = <4>; + non-removable; + status = "okay"; +-- +2.20.1 + diff --git a/queue-4.14/arm-omap2-fix-potentially-uninitialized-return-value.patch b/queue-4.14/arm-omap2-fix-potentially-uninitialized-return-value.patch new file mode 100644 index 00000000000..24969193751 --- /dev/null +++ b/queue-4.14/arm-omap2-fix-potentially-uninitialized-return-value.patch @@ -0,0 +1,44 @@ +From 1d3291b4e15f21e20d0451a1a5c3c603b15d4c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Mar 2019 11:00:21 -0700 +Subject: ARM: OMAP2+: Fix potentially uninitialized return value for + _setup_reset() + +From: Tony Lindgren + +[ Upstream commit 7f0d078667a494466991aa7133f49594f32ff6a2 ] + +Commit 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") made +the call to _enable() conditional based on no oh->rst_lines_cnt. This +caused the return value to be potentially uninitialized. Curiously we see +no compiler warnings for this, probably as this gets inlined. + +We call _setup_reset() from _setup() and only _setup_postsetup() if the +return value is zero. Currently the return value can be uninitialized for +cases where oh->rst_lines_cnt is set and HWMOD_INIT_NO_RESET is not set. + +Fixes: 747834ab8347 ("ARM: OMAP2+: hwmod: revise hardreset behavior") +Cc: Paul Walmsley +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index 45c8f2ef4e23c..9274a484c6a39 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2530,7 +2530,7 @@ static void _setup_iclk_autoidle(struct omap_hwmod *oh) + */ + static int _setup_reset(struct omap_hwmod *oh) + { +- int r; ++ int r = 0; + + if (oh->_state != _HWMOD_STATE_INITIALIZED) + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.14/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch b/queue-4.14/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch new file mode 100644 index 00000000000..4b68bf98ef9 --- /dev/null +++ b/queue-4.14/arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch @@ -0,0 +1,47 @@ +From 7bd39c2e0e3b993d078b98562c393c4bbea88036 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jan 2019 16:03:24 +0800 +Subject: ARM: pxa: ssp: Fix "WARNING: invalid free of devm_ allocated data" + +From: YueHaibing + +[ Upstream commit 9ee8578d953023cc57e7e736ae48502c707c0210 ] + +Since commit 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions") +kfree, iounmap, clk_put etc are not needed anymore in remove path. + +Fixes: 1c459de1e645 ("ARM: pxa: ssp: use devm_ functions") +Signed-off-by: YueHaibing +[ commit message spelling fix ] +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +--- + arch/arm/plat-pxa/ssp.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/arch/arm/plat-pxa/ssp.c b/arch/arm/plat-pxa/ssp.c +index b92673efffffb..97bd43c16cd87 100644 +--- a/arch/arm/plat-pxa/ssp.c ++++ b/arch/arm/plat-pxa/ssp.c +@@ -230,18 +230,12 @@ static int pxa_ssp_probe(struct platform_device *pdev) + + static int pxa_ssp_remove(struct platform_device *pdev) + { +- struct resource *res; + struct ssp_device *ssp; + + ssp = platform_get_drvdata(pdev); + if (ssp == NULL) + return -ENODEV; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- release_mem_region(res->start, resource_size(res)); +- +- clk_put(ssp->clk); +- + mutex_lock(&ssp_lock); + list_del(&ssp->node); + mutex_unlock(&ssp_lock); +-- +2.20.1 + diff --git a/queue-4.14/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch b/queue-4.14/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch new file mode 100644 index 00000000000..fb841baa03b --- /dev/null +++ b/queue-4.14/arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch @@ -0,0 +1,42 @@ +From e599d3a9f2cfde955fade1ef25758038fac92643 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Apr 2019 22:43:49 +0100 +Subject: ARM: riscpc: fix lack of keyboard interrupts after irq conversion + +From: Russell King + +[ Upstream commit 63a0666bca9311f35017be454587f3ba903644b8 ] + +Fix lack of keyboard interrupts for RiscPC due to incorrect conversion. + +Fixes: e8d36d5dbb6a ("ARM: kill off set_irq_flags usage") +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mach-rpc/irq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-rpc/irq.c b/arch/arm/mach-rpc/irq.c +index b8a61cb112073..7f0f401786344 100644 +--- a/arch/arm/mach-rpc/irq.c ++++ b/arch/arm/mach-rpc/irq.c +@@ -118,7 +118,7 @@ extern unsigned char rpc_default_fiq_start, rpc_default_fiq_end; + + void __init rpc_init_irq(void) + { +- unsigned int irq, clr, set = 0; ++ unsigned int irq, clr, set; + + iomd_writeb(0, IOMD_IRQMASKA); + iomd_writeb(0, IOMD_IRQMASKB); +@@ -130,6 +130,7 @@ void __init rpc_init_irq(void) + + for (irq = 0; irq < NR_IRQS; irq++) { + clr = IRQ_NOREQUEST; ++ set = 0; + + if (irq <= 6 || (irq >= 9 && irq <= 15)) + clr |= IRQ_NOPROBE; +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch b/queue-4.14/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch new file mode 100644 index 00000000000..8a7e06e2307 --- /dev/null +++ b/queue-4.14/arm64-dts-allwinner-a64-add-missing-pio-clocks.patch @@ -0,0 +1,40 @@ +From df507624e829295c15e560bdf7932f7edd5497f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Mar 2019 14:52:50 +0100 +Subject: arm64: dts: allwinner: a64: Add missing PIO clocks + +From: Maxime Ripard + +[ Upstream commit 562bf19611c000cb7219431c3cc78aa60c2b371e ] + +The pinctrl binding mandates that we have the three clocks fed into the PIO +described. + +Even though the old case is still supported for backward compatibility, we +should update our DTs to fix this. + +Fixes: 6bc37fac30cf ("arm64: dts: add Allwinner A64 SoC .dtsi") +Acked-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index 8c8db1b057dfc..788a6f8c5994e 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -274,7 +274,8 @@ + interrupts = , + , + ; +- clocks = <&ccu 58>; ++ clocks = <&ccu 58>, <&osc24M>, <&rtc 0>; ++ clock-names = "apb", "hosc", "losc"; + gpio-controller; + #gpio-cells = <3>; + interrupt-controller; +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch b/queue-4.14/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch new file mode 100644 index 00000000000..039ebcd1115 --- /dev/null +++ b/queue-4.14/arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch @@ -0,0 +1,42 @@ +From 6a89b1a0576555dfaee22ff8452861a189e82ed1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Dec 2018 12:01:02 +0100 +Subject: arm64: dts: apq8016-sbc: Increase load on l11 for SDCARD + +From: Loic Poulain + +[ Upstream commit af61bef513ba179559e56908b8c465e587bc3890 ] + +In the same way as for msm8974-hammerhead, l11 load, used for SDCARD +VMMC, needs to be increased in order to prevent any voltage drop issues +(due to limited current) happening with some SDCARDS or during specific +operations (e.g. write). + +Tested on Dragonboard-410c and DART-SD410 boards. + +Fixes: 4c7d53d16d77 (arm64: dts: apq8016-sbc: add regulators support) +Reported-by: Manabu Igusa +Signed-off-by: Loic Poulain +Signed-off-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index b6b44fdf7face..c1028b47edde9 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -458,6 +458,8 @@ + l11 { + regulator-min-microvolt = <1750000>; + regulator-max-microvolt = <3337000>; ++ regulator-allow-set-load; ++ regulator-system-load = <200000>; + }; + + l12 { +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-juno-fix-uart-frequency.patch b/queue-4.14/arm64-dts-juno-fix-uart-frequency.patch new file mode 100644 index 00000000000..ae8cc418935 --- /dev/null +++ b/queue-4.14/arm64-dts-juno-fix-uart-frequency.patch @@ -0,0 +1,54 @@ +From 92ae7812fe46d4b553a3f75e8c625307ac9001b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2019 12:03:31 +0000 +Subject: arm64: dts: juno: Fix UART frequency + +From: Andre Przywara + +[ Upstream commit 39a1a8941b27c37f79508426e27a2ec29829d66c ] + +Older versions of the Juno *SoC* TRM [1] recommended that the UART clock +source should be 7.2738 MHz, whereas the *system* TRM [2] stated a more +correct value of 7.3728 MHz. Somehow the wrong value managed to end up in +our DT. + +Doing a prime factorisation, a modulo divide by 115200 and trying +to buy a 7.2738 MHz crystal at your favourite electronics dealer suggest +that the old value was actually a typo. The actual UART clock is driven +by a PLL, configured via a parameter in some board.txt file in the +firmware, which reads 7.37 MHz (sic!). + +Fix this to correct the baud rate divisor calculation on the Juno board. + +[1] http://infocenter.arm.com/help/topic/com.arm.doc.ddi0515b.b/DDI0515B_b_juno_arm_development_platform_soc_trm.pdf +[2] http://infocenter.arm.com/help/topic/com.arm.doc.100113_0000_07_en/arm_versatile_express_juno_development_platform_(v2m_juno)_technical_reference_manual_100113_0000_07_en.pdf + +Fixes: 71f867ec130e ("arm64: Add Juno board device tree.") +Signed-off-by: Andre Przywara +Acked-by: Liviu Dudau +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/arm/juno-clocks.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/arm/juno-clocks.dtsi b/arch/arm64/boot/dts/arm/juno-clocks.dtsi +index e5e265dfa9025..2870b5eeb1984 100644 +--- a/arch/arm64/boot/dts/arm/juno-clocks.dtsi ++++ b/arch/arm64/boot/dts/arm/juno-clocks.dtsi +@@ -8,10 +8,10 @@ + */ + / { + /* SoC fixed clocks */ +- soc_uartclk: refclk7273800hz { ++ soc_uartclk: refclk7372800hz { + compatible = "fixed-clock"; + #clock-cells = <0>; +- clock-frequency = <7273800>; ++ clock-frequency = <7372800>; + clock-output-names = "juno:uartclk"; + }; + +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch b/queue-4.14/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch new file mode 100644 index 00000000000..ab5dbc11367 --- /dev/null +++ b/queue-4.14/arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch @@ -0,0 +1,37 @@ +From 3ab033dcca8434bff392765af25204ab2072d642 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Apr 2019 14:27:09 +0200 +Subject: arm64: dts: meson: libretech-cc: set eMMC as removable + +From: Jerome Brunet + +[ Upstream commit 9f72e321d5506fe3e162a6308a4a295d7f10bb5d ] + +The eMMC on this board is add-on module which is not mandatory. Removing +'non-removable' property should prevent some errors when booting a board +w/o an eMMC module present. + +Fixes: 72fb2c852188 ("ARM64: dts: meson-gxl-s905x-libretech-cc: fixup board definition") +Signed-off-by: Jerome Brunet +Reviewed-by: Martin Blumenstingl +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index e2c71753e3278..407d32f4fe734 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -226,7 +226,6 @@ + cap-mmc-highspeed; + mmc-ddr-3_3v; + max-frequency = <50000000>; +- non-removable; + disable-wp; + + mmc-pwrseq = <&emmc_pwrseq>; +-- +2.20.1 + diff --git a/queue-4.14/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch b/queue-4.14/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch new file mode 100644 index 00000000000..a76b8b9af54 --- /dev/null +++ b/queue-4.14/asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch @@ -0,0 +1,40 @@ +From 79fd3ff9a4b0946980b47b7454e209432333fe86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 17:01:57 +0800 +Subject: ASoC: cs4349: Use PM ops 'cs4349_runtime_pm' + +From: YueHaibing + +[ Upstream commit 9b4275c415acca6264a3d7f1182589959c93d530 ] + +sound/soc/codecs/cs4349.c:358:32: warning: + cs4349_runtime_pm defined but not used [-Wunused-const-variable=] + +cs4349_runtime_pm ops already defined, it seems +we should enable it. + +Reported-by: Hulk Robot +Fixes: e40da86 ("ASoC: cs4349: Add support for Cirrus Logic CS4349") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20190815090157.70036-1-yuehaibing@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs4349.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/cs4349.c b/sound/soc/codecs/cs4349.c +index 0a749c79ef579..1d38e53dc95c8 100644 +--- a/sound/soc/codecs/cs4349.c ++++ b/sound/soc/codecs/cs4349.c +@@ -380,6 +380,7 @@ static struct i2c_driver cs4349_i2c_driver = { + .driver = { + .name = "cs4349", + .of_match_table = cs4349_of_match, ++ .pm = &cs4349_runtime_pm, + }, + .id_table = cs4349_i2c_id, + .probe = cs4349_i2c_probe, +-- +2.20.1 + diff --git a/queue-4.14/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch b/queue-4.14/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch new file mode 100644 index 00000000000..e15b7a9a612 --- /dev/null +++ b/queue-4.14/asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch @@ -0,0 +1,37 @@ +From 5e9df4022bfec0c7a498f76a9987f904fb6cccbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 17:23:00 +0800 +Subject: ASoC: es8328: Fix copy-paste error in es8328_right_line_controls + +From: YueHaibing + +[ Upstream commit 630742c296341a8cfe00dfd941392025ba8dd4e8 ] + +It seems 'es8328_rline_enum' should be used +in es8328_right_line_controls + +Fixes: 567e4f98922c ("ASoC: add es8328 codec driver") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20190815092300.68712-1-yuehaibing@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/es8328.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c +index bcdb8914ec16b..e2f44fa46262d 100644 +--- a/sound/soc/codecs/es8328.c ++++ b/sound/soc/codecs/es8328.c +@@ -231,7 +231,7 @@ static const struct soc_enum es8328_rline_enum = + ARRAY_SIZE(es8328_line_texts), + es8328_line_texts); + static const struct snd_kcontrol_new es8328_right_line_controls = +- SOC_DAPM_ENUM("Route", es8328_lline_enum); ++ SOC_DAPM_ENUM("Route", es8328_rline_enum); + + /* Left Mixer */ + static const struct snd_kcontrol_new es8328_left_mixer_controls[] = { +-- +2.20.1 + diff --git a/queue-4.14/asoc-fix-valid-stream-condition.patch b/queue-4.14/asoc-fix-valid-stream-condition.patch new file mode 100644 index 00000000000..ab64bafec89 --- /dev/null +++ b/queue-4.14/asoc-fix-valid-stream-condition.patch @@ -0,0 +1,40 @@ +From 072c0782d27c744a03a496b0bbc3e98b1b4003e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2019 11:47:49 +0200 +Subject: ASoC: fix valid stream condition + +From: Jerome Brunet + +[ Upstream commit 6a7c59c6d9f3b280e81d7a04bbe4e55e90152dce ] + +A stream may specify a rate range using 'rate_min' and 'rate_max', so a +stream may be valid and not specify any rates. However, as stream cannot +be valid and not have any channel. Let's use this condition instead to +determine if a stream is valid or not. + +Fixes: cde79035c6cf ("ASoC: Handle multiple codecs with split playback / capture") +Signed-off-by: Jerome Brunet +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 24047375c2fbb..70e1a60a2e980 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -48,8 +48,8 @@ static bool snd_soc_dai_stream_valid(struct snd_soc_dai *dai, int stream) + else + codec_stream = &dai->driver->capture; + +- /* If the codec specifies any rate at all, it supports the stream. */ +- return codec_stream->rates; ++ /* If the codec specifies any channels at all, it supports the stream */ ++ return codec_stream->channels_min; + } + + /** +-- +2.20.1 + diff --git a/queue-4.14/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch b/queue-4.14/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch new file mode 100644 index 00000000000..b26a199ddd9 --- /dev/null +++ b/queue-4.14/asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch @@ -0,0 +1,40 @@ +From af0605662056a0d179401679bca124ebe11fa24c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jan 2019 10:06:52 +0100 +Subject: ASoC: imx-sgtl5000: put of nodes if finding codec fails + +From: Stefan Agner + +[ Upstream commit d9866572486802bc598a3e8576a5231378d190de ] + +Make sure to properly put the of node in case finding the codec +fails. + +Fixes: 81e8e4926167 ("ASoC: fsl: add sgtl5000 clock support for imx-sgtl5000") +Signed-off-by: Stefan Agner +Reviewed-by: Daniel Baluta +Acked-by: Nicolin Chen +Reviewed-by: Fabio Estevam +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-sgtl5000.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c +index 8e525f7ac08d1..3d99a8579c99f 100644 +--- a/sound/soc/fsl/imx-sgtl5000.c ++++ b/sound/soc/fsl/imx-sgtl5000.c +@@ -119,7 +119,8 @@ static int imx_sgtl5000_probe(struct platform_device *pdev) + codec_dev = of_find_i2c_device_by_node(codec_np); + if (!codec_dev) { + dev_err(&pdev->dev, "failed to find codec platform device\n"); +- return -EPROBE_DEFER; ++ ret = -EPROBE_DEFER; ++ goto fail; + } + + data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL); +-- +2.20.1 + diff --git a/queue-4.14/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch b/queue-4.14/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch new file mode 100644 index 00000000000..038f818f9cd --- /dev/null +++ b/queue-4.14/asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch @@ -0,0 +1,89 @@ +From 74f518625d9fa66bce2b0e1e169515376d07be9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Feb 2019 16:46:50 +0100 +Subject: ASoC: qcom: Fix of-node refcount unbalance in apq8016_sbc_parse_of() + +From: Takashi Iwai + +[ Upstream commit 8d1667200850f8753c0265fa4bd25c9a6e5f94ce ] + +The apq8016 driver leaves the of-node refcount at aborting from the +loop of for_each_child_of_node() in the error path. Not only the +iterator node of for_each_child_of_node(), the children nodes referred +from it for codec and cpu have to be properly unreferenced. + +Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support") +Cc: Patrick Lai +Cc: Banajit Goswami +Signed-off-by: Takashi Iwai +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/apq8016_sbc.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c +index d49adc822a110..8e6b88d68ca6c 100644 +--- a/sound/soc/qcom/apq8016_sbc.c ++++ b/sound/soc/qcom/apq8016_sbc.c +@@ -163,41 +163,52 @@ static struct apq8016_sbc_data *apq8016_sbc_parse_of(struct snd_soc_card *card) + + if (!cpu || !codec) { + dev_err(dev, "Can't find cpu/codec DT node\n"); +- return ERR_PTR(-EINVAL); ++ ret = -EINVAL; ++ goto error; + } + + link->cpu_of_node = of_parse_phandle(cpu, "sound-dai", 0); + if (!link->cpu_of_node) { + dev_err(card->dev, "error getting cpu phandle\n"); +- return ERR_PTR(-EINVAL); ++ ret = -EINVAL; ++ goto error; + } + + ret = snd_soc_of_get_dai_name(cpu, &link->cpu_dai_name); + if (ret) { + dev_err(card->dev, "error getting cpu dai name\n"); +- return ERR_PTR(ret); ++ goto error; + } + + ret = snd_soc_of_get_dai_link_codecs(dev, codec, link); + + if (ret < 0) { + dev_err(card->dev, "error getting codec dai name\n"); +- return ERR_PTR(ret); ++ goto error; + } + + link->platform_of_node = link->cpu_of_node; + ret = of_property_read_string(np, "link-name", &link->name); + if (ret) { + dev_err(card->dev, "error getting codec dai_link name\n"); +- return ERR_PTR(ret); ++ goto error; + } + + link->stream_name = link->name; + link->init = apq8016_sbc_dai_init; + link++; ++ ++ of_node_put(cpu); ++ of_node_put(codec); + } + + return data; ++ ++ error: ++ of_node_put(np); ++ of_node_put(cpu); ++ of_node_put(codec); ++ return ERR_PTR(ret); + } + + static const struct snd_soc_dapm_widget apq8016_sbc_dapm_widgets[] = { +-- +2.20.1 + diff --git a/queue-4.14/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch b/queue-4.14/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch new file mode 100644 index 00000000000..40a63d1b2c9 --- /dev/null +++ b/queue-4.14/asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch @@ -0,0 +1,38 @@ +From 62de328a1c2d3582c84ad065b85034d8d7783bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 21:25:17 +0200 +Subject: ASoC: sun4i-i2s: RX and TX counter registers are swapped + +From: Maxime Ripard + +[ Upstream commit cf2c0e1ce9544df42170fb921f12da82dc0cc8d6 ] + +The RX and TX counters registers offset have been swapped, fix that. + +Fixes: fa7c0d13cb26 ("ASoC: sunxi: Add Allwinner A10 Digital Audio driver") +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/8b26477560ad5fd8f69e037b167c5e61de5c26a3.1566242458.git-series.maxime.ripard@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index da0a2083e12af..d2802fd8c1dd7 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -80,8 +80,8 @@ + #define SUN4I_I2S_CLK_DIV_MCLK_MASK GENMASK(3, 0) + #define SUN4I_I2S_CLK_DIV_MCLK(mclk) ((mclk) << 0) + +-#define SUN4I_I2S_RX_CNT_REG 0x28 +-#define SUN4I_I2S_TX_CNT_REG 0x2c ++#define SUN4I_I2S_TX_CNT_REG 0x28 ++#define SUN4I_I2S_RX_CNT_REG 0x2c + + #define SUN4I_I2S_TX_CHAN_SEL_REG 0x30 + #define SUN4I_I2S_CHAN_SEL(num_chan) (((num_chan) - 1) << 0) +-- +2.20.1 + diff --git a/queue-4.14/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch b/queue-4.14/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch new file mode 100644 index 00000000000..5273a2f9726 --- /dev/null +++ b/queue-4.14/asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch @@ -0,0 +1,51 @@ +From 0b4b1dc8039fdb0cc8910f9b067337c7cd670e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jun 2019 12:20:02 +0300 +Subject: ASoC: ti: davinci-mcasp: Fix slot mask settings when using multiple + AXRs + +From: Peter Ujfalusi + +[ Upstream commit fd14f4436fd47d5418023c90e933e66d3645552e ] + +If multiple serializers are connected in the system and the number of +channels will need to use more than one serializer the mask to enable the +serializers were left to 0 if tdm_mask is provided + +Fixes: dd55ff8346a97 ("ASoC: davinci-mcasp: Add set_tdm_slots() support") + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/davinci/davinci-mcasp.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/davinci/davinci-mcasp.c b/sound/soc/davinci/davinci-mcasp.c +index 07bac9ea65c41..e10e03800cce5 100644 +--- a/sound/soc/davinci/davinci-mcasp.c ++++ b/sound/soc/davinci/davinci-mcasp.c +@@ -882,14 +882,13 @@ static int mcasp_i2s_hw_param(struct davinci_mcasp *mcasp, int stream, + active_slots = hweight32(mcasp->tdm_mask[stream]); + active_serializers = (channels + active_slots - 1) / + active_slots; +- if (active_serializers == 1) { ++ if (active_serializers == 1) + active_slots = channels; +- for (i = 0; i < total_slots; i++) { +- if ((1 << i) & mcasp->tdm_mask[stream]) { +- mask |= (1 << i); +- if (--active_slots <= 0) +- break; +- } ++ for (i = 0; i < total_slots; i++) { ++ if ((1 << i) & mcasp->tdm_mask[stream]) { ++ mask |= (1 << i); ++ if (--active_slots <= 0) ++ break; + } + } + } else { +-- +2.20.1 + diff --git a/queue-4.14/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch b/queue-4.14/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch new file mode 100644 index 00000000000..1da7b499eb3 --- /dev/null +++ b/queue-4.14/asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch @@ -0,0 +1,41 @@ +From 64e8654f51897283846ad786a05f4c8495d43a7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 17:19:20 +0800 +Subject: ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls + +From: YueHaibing + +[ Upstream commit 554b75bde64bcad9662530726d1483f7ef012069 ] + +sound/soc/codecs/wm8737.c:112:29: warning: + high_3d defined but not used [-Wunused-const-variable=] + +'high_3d' should be used for 3D High Cut-off. + +Reported-by: Hulk Robot +Fixes: 2a9ae13a2641 ("ASoC: Add initial WM8737 driver") +Signed-off-by: YueHaibing +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20190815091920.64480-1-yuehaibing@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8737.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c +index f0cb1c4afe3ce..c5a8d758f58b8 100644 +--- a/sound/soc/codecs/wm8737.c ++++ b/sound/soc/codecs/wm8737.c +@@ -170,7 +170,7 @@ SOC_DOUBLE("Polarity Invert Switch", WM8737_ADC_CONTROL, 5, 6, 1, 0), + SOC_SINGLE("3D Switch", WM8737_3D_ENHANCE, 0, 1, 0), + SOC_SINGLE("3D Depth", WM8737_3D_ENHANCE, 1, 15, 0), + SOC_ENUM("3D Low Cut-off", low_3d), +-SOC_ENUM("3D High Cut-off", low_3d), ++SOC_ENUM("3D High Cut-off", high_3d), + SOC_SINGLE_TLV("3D ADC Volume", WM8737_3D_ENHANCE, 7, 1, 1, adc_tlv), + + SOC_SINGLE("Noise Gate Switch", WM8737_NOISE_GATE, 0, 1, 0), +-- +2.20.1 + diff --git a/queue-4.14/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch b/queue-4.14/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch new file mode 100644 index 00000000000..fe24a4a2b80 --- /dev/null +++ b/queue-4.14/ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch @@ -0,0 +1,101 @@ +From b816ffd1f17054dc9216add7f8ef4e37f7bb0e5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2019 16:46:17 +0300 +Subject: ath10k: adjust skb length in ath10k_sdio_mbox_rx_packet + +From: Nicolas Boichat + +[ Upstream commit b7139960832eb56fa15d390a4b5c8c5739bd0d1a ] + +When the FW bundles multiple packets, pkt->act_len may be incorrect +as it refers to the first packet only (however, the FW will only +bundle packets that fit into the same pkt->alloc_len). + +Before this patch, the skb length would be set (incorrectly) to +pkt->act_len in ath10k_sdio_mbox_rx_packet, and then later manually +adjusted in ath10k_sdio_mbox_rx_process_packet. + +The first problem is that ath10k_sdio_mbox_rx_process_packet does not +use proper skb_put commands to adjust the length (it directly changes +skb->len), so we end up with a mismatch between skb->head + skb->tail +and skb->data + skb->len. This is quite serious, and causes corruptions +in the TCP stack, as the stack tries to coalesce packets, and relies +on skb->tail being correct (that is, skb_tail_pointer must point to +the first byte_after_ the data). + +Instead of re-adjusting the size in ath10k_sdio_mbox_rx_process_packet, +this moves the code to ath10k_sdio_mbox_rx_packet, and also add a +bounds check, as skb_put would crash the kernel if not enough space is +available. + +Tested with QCA6174 SDIO with firmware +WLAN.RMH.4.4.1-00007-QCARMSWP-1. + +Fixes: 8530b4e7b22bc3b ("ath10k: sdio: set skb len for all rx packets") +Signed-off-by: Nicolas Boichat +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/sdio.c | 29 +++++++++++++++++++------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/sdio.c b/drivers/net/wireless/ath/ath10k/sdio.c +index 0a1248ebccf5f..f49b21b137c13 100644 +--- a/drivers/net/wireless/ath/ath10k/sdio.c ++++ b/drivers/net/wireless/ath/ath10k/sdio.c +@@ -392,16 +392,11 @@ static int ath10k_sdio_mbox_rx_process_packet(struct ath10k *ar, + struct ath10k_htc_hdr *htc_hdr = (struct ath10k_htc_hdr *)skb->data; + bool trailer_present = htc_hdr->flags & ATH10K_HTC_FLAG_TRAILER_PRESENT; + enum ath10k_htc_ep_id eid; +- u16 payload_len; + u8 *trailer; + int ret; + +- payload_len = le16_to_cpu(htc_hdr->len); +- skb->len = payload_len + sizeof(struct ath10k_htc_hdr); +- + if (trailer_present) { +- trailer = skb->data + sizeof(*htc_hdr) + +- payload_len - htc_hdr->trailer_len; ++ trailer = skb->data + skb->len - htc_hdr->trailer_len; + + eid = pipe_id_to_eid(htc_hdr->eid); + +@@ -635,13 +630,31 @@ static int ath10k_sdio_mbox_rx_packet(struct ath10k *ar, + { + struct ath10k_sdio *ar_sdio = ath10k_sdio_priv(ar); + struct sk_buff *skb = pkt->skb; ++ struct ath10k_htc_hdr *htc_hdr; + int ret; + + ret = ath10k_sdio_readsb(ar, ar_sdio->mbox_info.htc_addr, + skb->data, pkt->alloc_len); ++ if (ret) ++ goto out; ++ ++ /* Update actual length. The original length may be incorrect, ++ * as the FW will bundle multiple packets as long as their sizes ++ * fit within the same aligned length (pkt->alloc_len). ++ */ ++ htc_hdr = (struct ath10k_htc_hdr *)skb->data; ++ pkt->act_len = le16_to_cpu(htc_hdr->len) + sizeof(*htc_hdr); ++ if (pkt->act_len > pkt->alloc_len) { ++ ath10k_warn(ar, "rx packet too large (%zu > %zu)\n", ++ pkt->act_len, pkt->alloc_len); ++ ret = -EMSGSIZE; ++ goto out; ++ } ++ ++ skb_put(skb, pkt->act_len); ++ ++out: + pkt->status = ret; +- if (!ret) +- skb_put(skb, pkt->act_len); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.14/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch b/queue-4.14/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch new file mode 100644 index 00000000000..0afd63f665d --- /dev/null +++ b/queue-4.14/ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch @@ -0,0 +1,136 @@ +From dcd849acf990e972c9a1a29fb94a74508dabb2ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2019 09:41:39 +0200 +Subject: ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init + +From: Lorenzo Bianconi + +[ Upstream commit e1aa1a1db3b01c9890e82cf065cee99962ba1ed9 ] + +Fix following lockdep warning disabling bh in +ath_dynack_node_init/ath_dynack_node_deinit + +[ 75.955878] -------------------------------- +[ 75.955880] inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. +[ 75.955884] swapper/0/0 [HC0[0]:SC1[3]:HE1:SE0] takes: +[ 75.955888] 00000000792a7ee0 (&(&da->qlock)->rlock){+.?.}, at: ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] +[ 75.955905] {SOFTIRQ-ON-W} state was registered at: +[ 75.955912] lock_acquire+0x9a/0x160 +[ 75.955917] _raw_spin_lock+0x2c/0x70 +[ 75.955927] ath_dynack_node_init+0x2a/0x60 [ath9k_hw] +[ 75.955934] ath9k_sta_state+0xec/0x160 [ath9k] +[ 75.955976] drv_sta_state+0xb2/0x740 [mac80211] +[ 75.956008] sta_info_insert_finish+0x21a/0x420 [mac80211] +[ 75.956039] sta_info_insert_rcu+0x12b/0x2c0 [mac80211] +[ 75.956069] sta_info_insert+0x7/0x70 [mac80211] +[ 75.956093] ieee80211_prep_connection+0x42e/0x730 [mac80211] +[ 75.956120] ieee80211_mgd_auth.cold+0xb9/0x15c [mac80211] +[ 75.956152] cfg80211_mlme_auth+0x143/0x350 [cfg80211] +[ 75.956169] nl80211_authenticate+0x25e/0x2b0 [cfg80211] +[ 75.956172] genl_family_rcv_msg+0x198/0x400 +[ 75.956174] genl_rcv_msg+0x42/0x90 +[ 75.956176] netlink_rcv_skb+0x35/0xf0 +[ 75.956178] genl_rcv+0x1f/0x30 +[ 75.956180] netlink_unicast+0x154/0x200 +[ 75.956182] netlink_sendmsg+0x1bf/0x3d0 +[ 75.956186] ___sys_sendmsg+0x2c2/0x2f0 +[ 75.956187] __sys_sendmsg+0x44/0x80 +[ 75.956190] do_syscall_64+0x55/0x1a0 +[ 75.956192] entry_SYSCALL_64_after_hwframe+0x49/0xbe +[ 75.956194] irq event stamp: 2357092 +[ 75.956196] hardirqs last enabled at (2357092): [] _raw_spin_unlock_irqrestore+0x3e/0x50 +[ 75.956199] hardirqs last disabled at (2357091): [] _raw_spin_lock_irqsave+0x11/0x80 +[ 75.956202] softirqs last enabled at (2357072): [] irq_enter+0x59/0x60 +[ 75.956204] softirqs last disabled at (2357073): [] irq_exit+0xae/0xc0 +[ 75.956206] + other info that might help us debug this: +[ 75.956207] Possible unsafe locking scenario: + +[ 75.956208] CPU0 +[ 75.956209] ---- +[ 75.956210] lock(&(&da->qlock)->rlock); +[ 75.956213] +[ 75.956214] lock(&(&da->qlock)->rlock); +[ 75.956216] + *** DEADLOCK *** + +[ 75.956217] 1 lock held by swapper/0/0: +[ 75.956219] #0: 000000003bb5675c (&(&sc->sc_pcu_lock)->rlock){+.-.}, at: ath9k_tasklet+0x55/0x240 [ath9k] +[ 75.956225] + stack backtrace: +[ 75.956228] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.0-rc1-wdn+ #13 +[ 75.956229] Hardware name: Dell Inc. Studio XPS 1340/0K183D, BIOS A11 09/08/2009 +[ 75.956231] Call Trace: +[ 75.956233] +[ 75.956236] dump_stack+0x67/0x90 +[ 75.956239] mark_lock+0x4c1/0x640 +[ 75.956242] ? check_usage_backwards+0x130/0x130 +[ 75.956245] ? sched_clock_local+0x12/0x80 +[ 75.956247] __lock_acquire+0x484/0x7a0 +[ 75.956250] ? __lock_acquire+0x3b9/0x7a0 +[ 75.956252] lock_acquire+0x9a/0x160 +[ 75.956259] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] +[ 75.956262] _raw_spin_lock_bh+0x34/0x80 +[ 75.956268] ? ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] +[ 75.956275] ath_dynack_sample_ack_ts+0x4d/0xa0 [ath9k_hw] +[ 75.956280] ath_rx_tasklet+0xd09/0xe90 [ath9k] +[ 75.956286] ath9k_tasklet+0x102/0x240 [ath9k] +[ 75.956288] tasklet_action_common.isra.0+0x6d/0x170 +[ 75.956291] __do_softirq+0xcc/0x425 +[ 75.956294] irq_exit+0xae/0xc0 +[ 75.956296] do_IRQ+0x8a/0x110 +[ 75.956298] common_interrupt+0xf/0xf +[ 75.956300] +[ 75.956303] RIP: 0010:cpuidle_enter_state+0xb2/0x400 +[ 75.956308] RSP: 0018:ffffffff82203e70 EFLAGS: 00000202 ORIG_RAX: ffffffffffffffd7 +[ 75.956310] RAX: ffffffff82219800 RBX: ffffffff822bd0a0 RCX: 0000000000000000 +[ 75.956312] RDX: 0000000000000046 RSI: 0000000000000006 RDI: ffffffff82219800 +[ 75.956314] RBP: ffff888155a01c00 R08: 00000011af51aabe R09: 0000000000000000 +[ 75.956315] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 +[ 75.956317] R13: 00000011af51aabe R14: 0000000000000003 R15: ffffffff82219800 +[ 75.956321] cpuidle_enter+0x24/0x40 +[ 75.956323] do_idle+0x1ac/0x220 +[ 75.956326] cpu_startup_entry+0x14/0x20 +[ 75.956329] start_kernel+0x482/0x489 +[ 75.956332] secondary_startup_64+0xa4/0xb0 + +Fixes: c774d57fd47c ("ath9k: add dynamic ACK timeout estimation") +Signed-off-by: Lorenzo Bianconi +Tested-by: Koen Vandeputte +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/dynack.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c +index 6e236a4854311..71b4888b30e71 100644 +--- a/drivers/net/wireless/ath/ath9k/dynack.c ++++ b/drivers/net/wireless/ath/ath9k/dynack.c +@@ -300,9 +300,9 @@ void ath_dynack_node_init(struct ath_hw *ah, struct ath_node *an) + + an->ackto = ackto; + +- spin_lock(&da->qlock); ++ spin_lock_bh(&da->qlock); + list_add_tail(&an->list, &da->nodes); +- spin_unlock(&da->qlock); ++ spin_unlock_bh(&da->qlock); + } + EXPORT_SYMBOL(ath_dynack_node_init); + +@@ -316,9 +316,9 @@ void ath_dynack_node_deinit(struct ath_hw *ah, struct ath_node *an) + { + struct ath_dynack *da = &ah->dynack; + +- spin_lock(&da->qlock); ++ spin_lock_bh(&da->qlock); + list_del(&an->list); +- spin_unlock(&da->qlock); ++ spin_unlock_bh(&da->qlock); + } + EXPORT_SYMBOL(ath_dynack_node_deinit); + +-- +2.20.1 + diff --git a/queue-4.14/backlight-lm3630a-return-0-on-success-in-update_stat.patch b/queue-4.14/backlight-lm3630a-return-0-on-success-in-update_stat.patch new file mode 100644 index 00000000000..f52c9a67b73 --- /dev/null +++ b/queue-4.14/backlight-lm3630a-return-0-on-success-in-update_stat.patch @@ -0,0 +1,50 @@ +From 800b4be48ce667dd4b40fb4cb54da1f1714ab58f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2019 05:25:03 -0400 +Subject: backlight: lm3630a: Return 0 on success in update_status functions + +From: Brian Masney + +[ Upstream commit d3f48ec0954c6aac736ab21c34a35d7554409112 ] + +lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status() +both return the brightness value if the brightness was successfully +updated. Writing to these attributes via sysfs would cause a 'Bad +address' error to be returned. These functions should return 0 on +success, so let's change it to correct that error. + +Fixes: 28e64a68a2ef ("backlight: lm3630: apply chip revision") +Signed-off-by: Brian Masney +Acked-by: Pavel Machek +Acked-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index 2030a6b77a097..ef2553f452ca9 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE); + if (ret < 0) + goto out_i2c_err; +- return bl->props.brightness; ++ return 0; + + out_i2c_err: + dev_err(pchip->dev, "i2c failed to access\n"); +@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE); + if (ret < 0) + goto out_i2c_err; +- return bl->props.brightness; ++ return 0; + + out_i2c_err: + dev_err(pchip->dev, "i2c failed to access REG_CTRL\n"); +-- +2.20.1 + diff --git a/queue-4.14/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch b/queue-4.14/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch new file mode 100644 index 00000000000..6ed60f235e8 --- /dev/null +++ b/queue-4.14/bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch @@ -0,0 +1,48 @@ +From 0da95693af53ed91c41b648edef07791f5ec8a75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 09:16:20 +0100 +Subject: bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA + +From: Colin Ian King + +[ Upstream commit 420c20be08a4597404d272ae9793b642401146eb ] + +An earlier commit re-worked the setting of the bitmask and is now +assigning v with some bit flags rather than bitwise or-ing them +into v, consequently the earlier bit-settings of v are being lost. +Fix this by replacing an assignment with the bitwise or instead. + +Addresses-Coverity: ("Unused value") +Fixes: 2be25cac8402 ("bcma: add constants for PCI and use them") +Signed-off-by: Colin Ian King +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/bcma/driver_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bcma/driver_pci.c b/drivers/bcma/driver_pci.c +index f499a469e66d0..12b2cc9a3fbe8 100644 +--- a/drivers/bcma/driver_pci.c ++++ b/drivers/bcma/driver_pci.c +@@ -78,7 +78,7 @@ static u16 bcma_pcie_mdio_read(struct bcma_drv_pci *pc, u16 device, u8 address) + v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD); + } + +- v = BCMA_CORE_PCI_MDIODATA_START; ++ v |= BCMA_CORE_PCI_MDIODATA_START; + v |= BCMA_CORE_PCI_MDIODATA_READ; + v |= BCMA_CORE_PCI_MDIODATA_TA; + +@@ -121,7 +121,7 @@ static void bcma_pcie_mdio_write(struct bcma_drv_pci *pc, u16 device, + v |= (address << BCMA_CORE_PCI_MDIODATA_REGADDR_SHF_OLD); + } + +- v = BCMA_CORE_PCI_MDIODATA_START; ++ v |= BCMA_CORE_PCI_MDIODATA_START; + v |= BCMA_CORE_PCI_MDIODATA_WRITE; + v |= BCMA_CORE_PCI_MDIODATA_TA; + v |= data; +-- +2.20.1 + diff --git a/queue-4.14/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch b/queue-4.14/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch new file mode 100644 index 00000000000..45d3f84b01e --- /dev/null +++ b/queue-4.14/block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch @@ -0,0 +1,50 @@ +From 1af32052cf665e8b5b33fd2804467f67e80ac9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Feb 2019 19:13:08 +0800 +Subject: block: don't use bio->bi_vcnt to figure out segment number + +From: Ming Lei + +[ Upstream commit 1a67356e9a4829da2935dd338630a550c59c8489 ] + +It is wrong to use bio->bi_vcnt to figure out how many segments +there are in the bio even though CLONED flag isn't set on this bio, +because this bio may be splitted or advanced. + +So always use bio_segments() in blk_recount_segments(), and it shouldn't +cause any performance loss now because the physical segment number is figured +out in blk_queue_split() and BIO_SEG_VALID is set meantime since +bdced438acd83ad83a6c ("block: setup bi_phys_segments after splitting"). + +Reviewed-by: Omar Sandoval +Reviewed-by: Christoph Hellwig +Fixes: 76d8137a3113 ("blk-merge: recaculate segment if it isn't less than max segments") +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index f61b50a01bc7a..415b5dafd9e6e 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -299,13 +299,7 @@ void blk_recalc_rq_segments(struct request *rq) + + void blk_recount_segments(struct request_queue *q, struct bio *bio) + { +- unsigned short seg_cnt; +- +- /* estimate segment number by bi_vcnt for non-cloned bio */ +- if (bio_flagged(bio, BIO_CLONED)) +- seg_cnt = bio_segments(bio); +- else +- seg_cnt = bio->bi_vcnt; ++ unsigned short seg_cnt = bio_segments(bio); + + if (test_bit(QUEUE_FLAG_NO_SG_MERGE, &q->queue_flags) && + (seg_cnt < queue_max_segments(q))) +-- +2.20.1 + diff --git a/queue-4.14/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch b/queue-4.14/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch new file mode 100644 index 00000000000..236a11bb5ef --- /dev/null +++ b/queue-4.14/bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch @@ -0,0 +1,51 @@ +From 63436ddffe5217fc5523ae6a8bf4d47cfb3ae977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jun 2019 11:16:45 -0400 +Subject: bnxt_en: Fix ethtool selftest crash under error conditions. + +From: Michael Chan + +[ Upstream commit d27e2ca1166aefd54d9c48fb6647dee8115a5dfc ] + +After ethtool loopback packet tests, we re-open the nic for the next +IRQ test. If the open fails, we must not proceed with the IRQ test +or we will crash with NULL pointer dereference. Fix it by checking +the bnxt_open_nic() return code before proceeding. + +Reported-by: Somasundaram Krishnasamy +Fixes: 67fea463fd87 ("bnxt_en: Add interrupt test to ethtool -t selftest.") +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index fc8e185718a1d..963beaa8fabbc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -2463,7 +2463,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, + bool offline = false; + u8 test_results = 0; + u8 test_mask = 0; +- int rc, i; ++ int rc = 0, i; + + if (!bp->num_tests || !BNXT_SINGLE_PF(bp)) + return; +@@ -2521,9 +2521,9 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, + } + bnxt_hwrm_phy_loopback(bp, false); + bnxt_half_close_nic(bp); +- bnxt_open_nic(bp, false, true); ++ rc = bnxt_open_nic(bp, false, true); + } +- if (bnxt_test_irq(bp)) { ++ if (rc || bnxt_test_irq(bp)) { + buf[BNXT_IRQ_TEST_IDX] = 1; + etest->flags |= ETH_TEST_FL_FAILED; + } +-- +2.20.1 + diff --git a/queue-4.14/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch b/queue-4.14/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch new file mode 100644 index 00000000000..8d605e71b39 --- /dev/null +++ b/queue-4.14/bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch @@ -0,0 +1,57 @@ +From 4bace2e538bf5b9d0a981ac85862740d5d9047ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Aug 2019 17:04:49 -0400 +Subject: bnxt_en: Fix handling FRAG_ERR when NVM_INSTALL_UPDATE cmd fails + +From: Vasundhara Volam + +[ Upstream commit dd2ebf3404c7c295014bc025dea23960960ceb1a ] + +If FW returns FRAG_ERR in response error code, driver is resending the +command only when HWRM command returns success. Fix the code to resend +NVM_INSTALL_UPDATE command with DEFRAG install flags, if FW returns +FRAG_ERR in its response error code. + +Fixes: cb4d1d626145 ("bnxt_en: Retry failed NVM_INSTALL_UPDATE with defragmentation flag enabled.") +Signed-off-by: Vasundhara Volam +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 963beaa8fabbc..3c78cd1cdd6fb 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1667,21 +1667,19 @@ static int bnxt_flash_package_from_file(struct net_device *dev, + mutex_lock(&bp->hwrm_cmd_lock); + hwrm_err = _hwrm_send_message(bp, &install, sizeof(install), + INSTALL_PACKAGE_TIMEOUT); +- if (hwrm_err) +- goto flash_pkg_exit; +- +- if (resp->error_code) { ++ if (hwrm_err) { + u8 error_code = ((struct hwrm_err_output *)resp)->cmd_err; + +- if (error_code == NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) { ++ if (resp->error_code && error_code == ++ NVM_INSTALL_UPDATE_CMD_ERR_CODE_FRAG_ERR) { + install.flags |= cpu_to_le16( + NVM_INSTALL_UPDATE_REQ_FLAGS_ALLOWED_TO_DEFRAG); + hwrm_err = _hwrm_send_message(bp, &install, + sizeof(install), + INSTALL_PACKAGE_TIMEOUT); +- if (hwrm_err) +- goto flash_pkg_exit; + } ++ if (hwrm_err) ++ goto flash_pkg_exit; + } + + if (resp->result) { +-- +2.20.1 + diff --git a/queue-4.14/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch b/queue-4.14/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch new file mode 100644 index 00000000000..685c6461340 --- /dev/null +++ b/queue-4.14/btrfs-fix-hang-when-loading-existing-inode-cache-off.patch @@ -0,0 +1,86 @@ +From 00a6a1756f7f41d0cc665a8b2e50120fe3c6459e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2019 16:24:09 +0100 +Subject: Btrfs: fix hang when loading existing inode cache off disk + +From: Filipe Manana + +[ Upstream commit 7764d56baa844d7f6206394f21a0e8c1f303c476 ] + +If we are able to load an existing inode cache off disk, we set the state +of the cache to BTRFS_CACHE_FINISHED, but we don't wake up any one waiting +for the cache to be available. This means that anyone waiting for the +cache to be available, waiting on the condition that either its state is +BTRFS_CACHE_FINISHED or its available free space is greather than zero, +can hang forever. + +This could be observed running fstests with MOUNT_OPTIONS="-o inode_cache", +in particular test case generic/161 triggered it very frequently for me, +producing a trace like the following: + + [63795.739712] BTRFS info (device sdc): enabling inode map caching + [63795.739714] BTRFS info (device sdc): disk space caching is enabled + [63795.739716] BTRFS info (device sdc): has skinny extents + [64036.653886] INFO: task btrfs-transacti:3917 blocked for more than 120 seconds. + [64036.654079] Not tainted 5.2.0-rc4-btrfs-next-50 #1 + [64036.654143] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [64036.654232] btrfs-transacti D 0 3917 2 0x80004000 + [64036.654239] Call Trace: + [64036.654258] ? __schedule+0x3ae/0x7b0 + [64036.654271] schedule+0x3a/0xb0 + [64036.654325] btrfs_commit_transaction+0x978/0xae0 [btrfs] + [64036.654339] ? remove_wait_queue+0x60/0x60 + [64036.654395] transaction_kthread+0x146/0x180 [btrfs] + [64036.654450] ? btrfs_cleanup_transaction+0x620/0x620 [btrfs] + [64036.654456] kthread+0x103/0x140 + [64036.654464] ? kthread_create_worker_on_cpu+0x70/0x70 + [64036.654476] ret_from_fork+0x3a/0x50 + [64036.654504] INFO: task xfs_io:3919 blocked for more than 120 seconds. + [64036.654568] Not tainted 5.2.0-rc4-btrfs-next-50 #1 + [64036.654617] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [64036.654685] xfs_io D 0 3919 3633 0x00000000 + [64036.654691] Call Trace: + [64036.654703] ? __schedule+0x3ae/0x7b0 + [64036.654716] schedule+0x3a/0xb0 + [64036.654756] btrfs_find_free_ino+0xa9/0x120 [btrfs] + [64036.654764] ? remove_wait_queue+0x60/0x60 + [64036.654809] btrfs_create+0x72/0x1f0 [btrfs] + [64036.654822] lookup_open+0x6bc/0x790 + [64036.654849] path_openat+0x3bc/0xc00 + [64036.654854] ? __lock_acquire+0x331/0x1cb0 + [64036.654869] do_filp_open+0x99/0x110 + [64036.654884] ? __alloc_fd+0xee/0x200 + [64036.654895] ? do_raw_spin_unlock+0x49/0xc0 + [64036.654909] ? do_sys_open+0x132/0x220 + [64036.654913] do_sys_open+0x132/0x220 + [64036.654926] do_syscall_64+0x60/0x1d0 + [64036.654933] entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fix this by adding a wake_up() call right after setting the cache state to +BTRFS_CACHE_FINISHED, at start_caching(), when we are able to load the +cache from disk. + +Fixes: 82d5902d9c681b ("Btrfs: Support reading/writing on disk free ino cache") +Reviewed-by: Nikolay Borisov +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode-map.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index d02019747d001..7dc2923655d98 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -159,6 +159,7 @@ static void start_caching(struct btrfs_root *root) + spin_lock(&root->ino_cache_lock); + root->ino_cache_state = BTRFS_CACHE_FINISHED; + spin_unlock(&root->ino_cache_lock); ++ wake_up(&root->ino_cache_wait); + return; + } + +-- +2.20.1 + diff --git a/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch b/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch new file mode 100644 index 00000000000..96132bd33fe --- /dev/null +++ b/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch @@ -0,0 +1,80 @@ +From 7eb010ee5409574815d27ee643eccf2033a84f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2019 16:24:32 +0100 +Subject: Btrfs: fix inode cache waiters hanging on failure to start caching + thread + +From: Filipe Manana + +[ Upstream commit a68ebe0790fc88b4314d17984a2cf99ce2361901 ] + +If we fail to start the inode caching thread, we print an error message +and disable the inode cache, however we never wake up any waiters, so they +hang forever waiting for the caching to finish. Fix this by waking them +up and have them fallback to a call to btrfs_find_free_objectid(). + +Fixes: e60efa84252c05 ("Btrfs: avoid triggering bug_on() when we fail to start inode caching task") +Reviewed-by: Nikolay Borisov +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode-map.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index 7dc2923655d98..b1c3a4ec76c8c 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -26,6 +26,19 @@ + #include "inode-map.h" + #include "transaction.h" + ++static void fail_caching_thread(struct btrfs_root *root) ++{ ++ struct btrfs_fs_info *fs_info = root->fs_info; ++ ++ btrfs_warn(fs_info, "failed to start inode caching task"); ++ btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE, ++ "disabling inode map caching"); ++ spin_lock(&root->ino_cache_lock); ++ root->ino_cache_state = BTRFS_CACHE_ERROR; ++ spin_unlock(&root->ino_cache_lock); ++ wake_up(&root->ino_cache_wait); ++} ++ + static int caching_kthread(void *data) + { + struct btrfs_root *root = data; +@@ -178,11 +191,8 @@ static void start_caching(struct btrfs_root *root) + + tsk = kthread_run(caching_kthread, root, "btrfs-ino-cache-%llu", + root->root_key.objectid); +- if (IS_ERR(tsk)) { +- btrfs_warn(fs_info, "failed to start inode caching task"); +- btrfs_clear_pending_and_info(fs_info, INODE_MAP_CACHE, +- "disabling inode map caching"); +- } ++ if (IS_ERR(tsk)) ++ fail_caching_thread(root); + } + + int btrfs_find_free_ino(struct btrfs_root *root, u64 *objectid) +@@ -200,11 +210,14 @@ again: + + wait_event(root->ino_cache_wait, + root->ino_cache_state == BTRFS_CACHE_FINISHED || ++ root->ino_cache_state == BTRFS_CACHE_ERROR || + root->free_ino_ctl->free_space > 0); + + if (root->ino_cache_state == BTRFS_CACHE_FINISHED && + root->free_ino_ctl->free_space == 0) + return -ENOSPC; ++ else if (root->ino_cache_state == BTRFS_CACHE_ERROR) ++ return btrfs_find_free_objectid(root, objectid); + else + goto again; + } +-- +2.20.1 + diff --git a/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch b/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch new file mode 100644 index 00000000000..95a16b95ee3 --- /dev/null +++ b/queue-4.14/btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch @@ -0,0 +1,43 @@ +From 8b5385d7c7a1a2c18d3d89a9c44311bb6d5059f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jul 2019 16:24:44 +0100 +Subject: Btrfs: fix inode cache waiters hanging on path allocation failure + +From: Filipe Manana + +[ Upstream commit 9d123a35d7e97bb2139747b16127c9b22b6a593e ] + +If the caching thread fails to allocate a path, it returns without waking +up any cache waiters, leaving them hang forever. Fix this by following the +same approach as when we fail to start the caching thread: print an error +message, disable inode caching and make the wakers fallback to non-caching +mode behaviour (calling btrfs_find_free_objectid()). + +Fixes: 581bb050941b4f ("Btrfs: Cache free inode numbers in memory") +Reviewed-by: Nikolay Borisov +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode-map.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c +index b1c3a4ec76c8c..2ae32451fb5b0 100644 +--- a/fs/btrfs/inode-map.c ++++ b/fs/btrfs/inode-map.c +@@ -55,8 +55,10 @@ static int caching_kthread(void *data) + return 0; + + path = btrfs_alloc_path(); +- if (!path) ++ if (!path) { ++ fail_caching_thread(root); + return -ENOMEM; ++ } + + /* Since the commit root is read-only, we can safely skip locking. */ + path->skip_locking = 1; +-- +2.20.1 + diff --git a/queue-4.14/btrfs-use-correct-count-in-btrfs_file_write_iter.patch b/queue-4.14/btrfs-use-correct-count-in-btrfs_file_write_iter.patch new file mode 100644 index 00000000000..b1e3e06ab5b --- /dev/null +++ b/queue-4.14/btrfs-use-correct-count-in-btrfs_file_write_iter.patch @@ -0,0 +1,55 @@ +From c64f6d6a11e09fce3a41ff0dcb61d523ab0d582b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 14:04:02 -0700 +Subject: btrfs: use correct count in btrfs_file_write_iter() + +From: Omar Sandoval + +[ Upstream commit c09767a8960ca0500fb636bf73686723337debf4 ] + +generic_write_checks() may modify iov_iter_count(), so we must get the +count after the call, not before. Using the wrong one has a couple of +consequences: + +1. We check a longer range in check_can_nocow() for nowait than we're + actually writing. +2. We create extra hole extent maps in btrfs_cont_expand(). As far as I + can tell, this is harmless, but I might be missing something. + +These issues are pretty minor, but let's fix it before something more +important trips on it. + +Fixes: edf064e7c6fe ("btrfs: nowait aio support") +Reviewed-by: Josef Bacik +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 97be32da857ab..c68ce3412dc11 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1882,7 +1882,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb, + bool sync = (file->f_flags & O_DSYNC) || IS_SYNC(file->f_mapping->host); + ssize_t err; + loff_t pos; +- size_t count = iov_iter_count(from); ++ size_t count; + loff_t oldsize; + int clean_page = 0; + +@@ -1904,6 +1904,7 @@ static ssize_t btrfs_file_write_iter(struct kiocb *iocb, + } + + pos = iocb->ki_pos; ++ count = iov_iter_count(from); + if (iocb->ki_flags & IOCB_NOWAIT) { + /* + * We will allocate space in case nodatacow is not set, +-- +2.20.1 + diff --git a/queue-4.14/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch b/queue-4.14/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch new file mode 100644 index 00000000000..d8de08aabe6 --- /dev/null +++ b/queue-4.14/cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch @@ -0,0 +1,35 @@ +From 7377509ae4d9b299c1253de3c308d52671572ce0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Feb 2019 22:34:51 +0800 +Subject: cdc-wdm: pass return value of recover_from_urb_loss + +From: YueHaibing + +[ Upstream commit 0742a338f5b3446a26de551ad8273fb41b2787f2 ] + +'rv' is the correct return value, pass it upstream instead of 0 + +Fixes: 17d80d562fd7 ("USB: autosuspend for cdc-wdm") +Signed-off-by: YueHaibing +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-wdm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index a593cdfc897fd..d5d42dccda10a 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -1085,7 +1085,7 @@ static int wdm_post_reset(struct usb_interface *intf) + rv = recover_from_urb_loss(desc); + mutex_unlock(&desc->wlock); + mutex_unlock(&desc->rlock); +- return 0; ++ return rv; + } + + static struct usb_driver wdm_driver = { +-- +2.20.1 + diff --git a/queue-4.14/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch b/queue-4.14/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch new file mode 100644 index 00000000000..d57a7d000c8 --- /dev/null +++ b/queue-4.14/cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch @@ -0,0 +1,38 @@ +From e41f634075f1f271a83446f7409f4a29424c6761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2019 22:14:29 -0500 +Subject: cifs: fix rmmod regression in cifs.ko caused by force_sig changes + +From: Steve French + +[ Upstream commit 247bc9470b1eeefc7b58cdf2c39f2866ba651509 ] + +Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig") + +The global change from force_sig caused module unloading of cifs.ko +to fail (since the cifsd process could not be killed, "rmmod cifs" +now would always fail) + +Signed-off-by: Steve French +Reviewed-by: Ronnie Sahlberg +CC: Eric W. Biederman +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 51bbb1c0b71ae..ed4a0352ea90e 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -921,6 +921,7 @@ cifs_demultiplex_thread(void *p) + mempool_resize(cifs_req_poolp, length + cifs_min_rcv); + + set_freezable(); ++ allow_signal(SIGKILL); + while (server->tcpStatus != CifsExiting) { + if (try_to_freeze()) + continue; +-- +2.20.1 + diff --git a/queue-4.14/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch b/queue-4.14/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch new file mode 100644 index 00000000000..fd74631f966 --- /dev/null +++ b/queue-4.14/clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch @@ -0,0 +1,41 @@ +From 0f918d87510b8bc6c702993d2b4111e3e59af3de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:36:58 -0500 +Subject: clk: armada-370: fix refcount leak in a370_clk_init() + +From: Yangtao Li + +[ Upstream commit a3c24050bdf70c958a8d98c2823b66ea761e6a31 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Reviewed-by: Gregory CLEMENT +Fixes: 07ad6836fa21 ("clk: mvebu: armada-370: maintain clock init order") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-370.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/mvebu/armada-370.c b/drivers/clk/mvebu/armada-370.c +index 2c7c1085f8830..8fdfa97900cd8 100644 +--- a/drivers/clk/mvebu/armada-370.c ++++ b/drivers/clk/mvebu/armada-370.c +@@ -177,8 +177,10 @@ static void __init a370_clk_init(struct device_node *np) + + mvebu_coreclk_setup(np, &a370_coreclks); + +- if (cgnp) ++ if (cgnp) { + mvebu_clk_gating_setup(cgnp, a370_gating_desc); ++ of_node_put(cgnp); ++ } + } + CLK_OF_DECLARE(a370_clk, "marvell,armada-370-core-clock", a370_clk_init); + +-- +2.20.1 + diff --git a/queue-4.14/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch b/queue-4.14/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch new file mode 100644 index 00000000000..8402954a343 --- /dev/null +++ b/queue-4.14/clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch @@ -0,0 +1,40 @@ +From 93000d9d6d6a1f0ca1e6132f1ac16bc158face84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:42:26 -0500 +Subject: clk: armada-xp: fix refcount leak in axp_clk_init() + +From: Yangtao Li + +[ Upstream commit db20a90a4b6745dad62753f8bd2f66afdd5abc84 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Reviewed-by: Gregory CLEMENT +Fixes: 0a11a6ae9437 ("clk: mvebu: armada-xp: maintain clock init order") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/armada-xp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/mvebu/armada-xp.c b/drivers/clk/mvebu/armada-xp.c +index 0ec44ae9a2a26..df529982adc97 100644 +--- a/drivers/clk/mvebu/armada-xp.c ++++ b/drivers/clk/mvebu/armada-xp.c +@@ -228,7 +228,9 @@ static void __init axp_clk_init(struct device_node *np) + + mvebu_coreclk_setup(np, &axp_coreclks); + +- if (cgnp) ++ if (cgnp) { + mvebu_clk_gating_setup(cgnp, axp_gating_desc); ++ of_node_put(cgnp); ++ } + } + CLK_OF_DECLARE(axp_clk, "marvell,armada-xp-core-clock", axp_clk_init); +-- +2.20.1 + diff --git a/queue-4.14/clk-dove-fix-refcount-leak-in-dove_clk_init.patch b/queue-4.14/clk-dove-fix-refcount-leak-in-dove_clk_init.patch new file mode 100644 index 00000000000..1b50f66ec01 --- /dev/null +++ b/queue-4.14/clk-dove-fix-refcount-leak-in-dove_clk_init.patch @@ -0,0 +1,47 @@ +From cfac19ef0ec2d94fbb696b1f9c012472505259ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:50:13 -0500 +Subject: clk: dove: fix refcount leak in dove_clk_init() + +From: Yangtao Li + +[ Upstream commit 8d726c5128298386b907963033be93407b0c4275 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Reviewed-by: Gregory CLEMENT +Fixes: 8f7fc5450b64 ("clk: mvebu: dove: maintain clock init order") +Fixes: 63b8d92c793f ("clk: add Dove PLL divider support for GPU, VMeta and AXI clocks") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/dove.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mvebu/dove.c b/drivers/clk/mvebu/dove.c +index 59fad9546c847..5f258c9bb68bf 100644 +--- a/drivers/clk/mvebu/dove.c ++++ b/drivers/clk/mvebu/dove.c +@@ -190,10 +190,14 @@ static void __init dove_clk_init(struct device_node *np) + + mvebu_coreclk_setup(np, &dove_coreclks); + +- if (ddnp) ++ if (ddnp) { + dove_divider_clk_init(ddnp); ++ of_node_put(ddnp); ++ } + +- if (cgnp) ++ if (cgnp) { + mvebu_clk_gating_setup(cgnp, dove_gating_desc); ++ of_node_put(cgnp); ++ } + } + CLK_OF_DECLARE(dove_clk, "marvell,dove-core-clock", dove_clk_init); +-- +2.20.1 + diff --git a/queue-4.14/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch b/queue-4.14/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch new file mode 100644 index 00000000000..89b65317656 --- /dev/null +++ b/queue-4.14/clk-highbank-fix-refcount-leak-in-hb_clk_init.patch @@ -0,0 +1,36 @@ +From d66242bd750e11202d7ebd40f9bff0b0a24b4234 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:10:01 -0500 +Subject: clk: highbank: fix refcount leak in hb_clk_init() + +From: Yangtao Li + +[ Upstream commit 5eb8ba90958de1285120dae5d3a5d2b1a360b3b4 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 26cae166cff9 ("ARM: highbank: remove custom .init_time hook") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-highbank.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-highbank.c b/drivers/clk/clk-highbank.c +index 727ed8e1bb726..8e4581004695c 100644 +--- a/drivers/clk/clk-highbank.c ++++ b/drivers/clk/clk-highbank.c +@@ -293,6 +293,7 @@ static __init struct clk *hb_clk_init(struct device_node *node, const struct clk + /* Map system registers */ + srnp = of_find_compatible_node(NULL, NULL, "calxeda,hb-sregs"); + hb_clk->reg = of_iomap(srnp, 0); ++ of_node_put(srnp); + BUG_ON(!hb_clk->reg); + hb_clk->reg += reg; + +-- +2.20.1 + diff --git a/queue-4.14/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch b/queue-4.14/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch new file mode 100644 index 00000000000..287075d77fb --- /dev/null +++ b/queue-4.14/clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch @@ -0,0 +1,36 @@ +From 155ac1e2c907fdb46c28aa895c6b24d272b33587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:53:00 -0500 +Subject: clk: imx6q: fix refcount leak in imx6q_clocks_init() + +From: Yangtao Li + +[ Upstream commit c9ec1d8fef31b5fc9e90e99f9bd685db5caa7c5e ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 2acd1b6f889c ("ARM: i.MX6: implement clocks using common clock framework") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6q.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c +index 8eb93eb2f8573..e0547654cb7bd 100644 +--- a/drivers/clk/imx/clk-imx6q.c ++++ b/drivers/clk/imx/clk-imx6q.c +@@ -431,6 +431,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) + np = of_find_compatible_node(NULL, NULL, "fsl,imx6q-anatop"); + anatop_base = base = of_iomap(np, 0); + WARN_ON(!base); ++ of_node_put(np); + + /* Audio/video PLL post dividers do not work on i.MX6q revision 1.0 */ + if (clk_on_imx6q() && imx_get_soc_revision() == IMX_CHIP_REVISION_1_0) { +-- +2.20.1 + diff --git a/queue-4.14/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch b/queue-4.14/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch new file mode 100644 index 00000000000..1c58e7ff370 --- /dev/null +++ b/queue-4.14/clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch @@ -0,0 +1,36 @@ +From ec6a1ba9dcb9414af9ae0b96625b3468f1b8377a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:55:10 -0500 +Subject: clk: imx6sx: fix refcount leak in imx6sx_clocks_init() + +From: Yangtao Li + +[ Upstream commit 1731e14fb30212dd8c1e9f8fc1af061e56498c55 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: d55135689019 ("ARM: imx: add clock driver for imx6sx") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6sx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/imx/clk-imx6sx.c b/drivers/clk/imx/clk-imx6sx.c +index e6d389e333d7d..baa07553a0ddc 100644 +--- a/drivers/clk/imx/clk-imx6sx.c ++++ b/drivers/clk/imx/clk-imx6sx.c +@@ -164,6 +164,7 @@ static void __init imx6sx_clocks_init(struct device_node *ccm_node) + np = of_find_compatible_node(NULL, NULL, "fsl,imx6sx-anatop"); + base = of_iomap(np, 0); + WARN_ON(!base); ++ of_node_put(np); + + clks[IMX6SX_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); + clks[IMX6SX_PLL2_BYPASS_SRC] = imx_clk_mux("pll2_bypass_src", base + 0x30, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +-- +2.20.1 + diff --git a/queue-4.14/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch b/queue-4.14/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch new file mode 100644 index 00000000000..8e03771d2be --- /dev/null +++ b/queue-4.14/clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch @@ -0,0 +1,36 @@ +From 77b65369e2be0d64d40c215238076cab1a110de0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:57:16 -0500 +Subject: clk: imx7d: fix refcount leak in imx7d_clocks_init() + +From: Yangtao Li + +[ Upstream commit 5f8c183a996b76bb09748073c856e4246fd4ce95 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 8f6d8094b215 ("ARM: imx: add imx7d clk tree support") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx7d.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c +index 0ac9b30c8b906..9f5e5b9d4a25a 100644 +--- a/drivers/clk/imx/clk-imx7d.c ++++ b/drivers/clk/imx/clk-imx7d.c +@@ -416,6 +416,7 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) + np = of_find_compatible_node(NULL, NULL, "fsl,imx7d-anatop"); + base = of_iomap(np, 0); + WARN_ON(!base); ++ of_node_put(np); + + clks[IMX7D_PLL_ARM_MAIN_SRC] = imx_clk_mux("pll_arm_main_src", base + 0x60, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel)); + clks[IMX7D_PLL_DRAM_MAIN_SRC] = imx_clk_mux("pll_dram_main_src", base + 0x70, 14, 2, pll_bypass_src_sel, ARRAY_SIZE(pll_bypass_src_sel)); +-- +2.20.1 + diff --git a/queue-4.14/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch b/queue-4.14/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch new file mode 100644 index 00000000000..9622e65d082 --- /dev/null +++ b/queue-4.14/clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch @@ -0,0 +1,38 @@ +From 9d0cc353b0d6387b14bc82370d5f97981db47c2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:40:19 -0500 +Subject: clk: kirkwood: fix refcount leak in kirkwood_clk_init() + +From: Yangtao Li + +[ Upstream commit e7beeab9c61591cd0e690d8733d534c3f4278ff8 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Reviewed-by: Gregory CLEMENT +Fixes: 58d516ae95cb ("clk: mvebu: kirkwood: maintain clock init order") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/kirkwood.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/mvebu/kirkwood.c b/drivers/clk/mvebu/kirkwood.c +index a2a8d614039da..890ebf623261b 100644 +--- a/drivers/clk/mvebu/kirkwood.c ++++ b/drivers/clk/mvebu/kirkwood.c +@@ -333,6 +333,8 @@ static void __init kirkwood_clk_init(struct device_node *np) + if (cgnp) { + mvebu_clk_gating_setup(cgnp, kirkwood_gating_desc); + kirkwood_clk_muxing_setup(cgnp, kirkwood_mux_desc); ++ ++ of_node_put(cgnp); + } + } + CLK_OF_DECLARE(kirkwood_clk, "marvell,kirkwood-core-clock", +-- +2.20.1 + diff --git a/queue-4.14/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch b/queue-4.14/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch new file mode 100644 index 00000000000..1b1c1eb597b --- /dev/null +++ b/queue-4.14/clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch @@ -0,0 +1,40 @@ +From d0c1627e3b40dcbef233b938ba595dc34cbd5e47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:48:05 -0500 +Subject: clk: mv98dx3236: fix refcount leak in mv98dx3236_clk_init() + +From: Yangtao Li + +[ Upstream commit 9b4eedf627045ae5ddcff60a484200cdd554c413 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Reviewed-by: Gregory CLEMENT +Fixes: 337072604224 ("clk: mvebu: Expand mv98dx3236-core-clock support") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/mv98dx3236.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/mvebu/mv98dx3236.c b/drivers/clk/mvebu/mv98dx3236.c +index 6e203af73cac1..c8a0d03d2cd60 100644 +--- a/drivers/clk/mvebu/mv98dx3236.c ++++ b/drivers/clk/mvebu/mv98dx3236.c +@@ -174,7 +174,9 @@ static void __init mv98dx3236_clk_init(struct device_node *np) + + mvebu_coreclk_setup(np, &mv98dx3236_core_clocks); + +- if (cgnp) ++ if (cgnp) { + mvebu_clk_gating_setup(cgnp, mv98dx3236_gating_desc); ++ of_node_put(cgnp); ++ } + } + CLK_OF_DECLARE(mv98dx3236_clk, "marvell,mv98dx3236-core-clock", mv98dx3236_clk_init); +-- +2.20.1 + diff --git a/queue-4.14/clk-qcom-fix-wunused-const-variable.patch b/queue-4.14/clk-qcom-fix-wunused-const-variable.patch new file mode 100644 index 00000000000..afa1fbaec38 --- /dev/null +++ b/queue-4.14/clk-qcom-fix-wunused-const-variable.patch @@ -0,0 +1,98 @@ +From e0889da8b55d605e10baf6a521e68963a7391830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2019 14:11:34 -0700 +Subject: clk: qcom: Fix -Wunused-const-variable + +From: Nathan Huckleberry + +[ Upstream commit da642427bd7710ec4f4140f693f59aa8521a358c ] + +Clang produces the following warning + +drivers/clk/qcom/gcc-msm8996.c:133:32: warning: unused variable +'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map' [-Wunused-const-variable] +static const struct +parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = +{ ^drivers/clk/qcom/gcc-msm8996.c:141:27: warning: unused variable +'gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div' [-Wunused-const-variable] static +const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { ^ +drivers/clk/qcom/gcc-msm8996.c:187:32: warning: unused variable +'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map' +[-Wunused-const-variable] static const struct parent_map +gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { ^ +drivers/clk/qcom/gcc-msm8996.c:197:27: warning: unused variable +'gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div' +[-Wunused-const-variable] static const char * const +gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = { + +It looks like these were never used. + +Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver") +Cc: clang-built-linux@googlegroups.com +Link: https://github.com/ClangBuiltLinux/linux/issues/518 +Suggested-by: Nathan Chancellor +Signed-off-by: Nathan Huckleberry +Reviewed-by: Nathan Chancellor +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8996.c | 36 ---------------------------------- + 1 file changed, 36 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c +index 7ddec886fcd35..c0b043b1bd248 100644 +--- a/drivers/clk/qcom/gcc-msm8996.c ++++ b/drivers/clk/qcom/gcc-msm8996.c +@@ -140,22 +140,6 @@ static const char * const gcc_xo_gpll0_gpll4_gpll0_early_div[] = { + "gpll0_early_div" + }; + +-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div_map[] = { +- { P_XO, 0 }, +- { P_GPLL0, 1 }, +- { P_GPLL2, 2 }, +- { P_GPLL3, 3 }, +- { P_GPLL0_EARLY_DIV, 6 } +-}; +- +-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll0_early_div[] = { +- "xo", +- "gpll0", +- "gpll2", +- "gpll3", +- "gpll0_early_div" +-}; +- + static const struct parent_map gcc_xo_gpll0_gpll1_early_div_gpll1_gpll4_gpll0_early_div_map[] = { + { P_XO, 0 }, + { P_GPLL0, 1 }, +@@ -194,26 +178,6 @@ static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll2_early_gpll0_early + "gpll0_early_div" + }; + +-static const struct parent_map gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div_map[] = { +- { P_XO, 0 }, +- { P_GPLL0, 1 }, +- { P_GPLL2, 2 }, +- { P_GPLL3, 3 }, +- { P_GPLL1, 4 }, +- { P_GPLL4, 5 }, +- { P_GPLL0_EARLY_DIV, 6 } +-}; +- +-static const char * const gcc_xo_gpll0_gpll2_gpll3_gpll1_gpll4_gpll0_early_div[] = { +- "xo", +- "gpll0", +- "gpll2", +- "gpll3", +- "gpll1", +- "gpll4", +- "gpll0_early_div" +-}; +- + static struct clk_fixed_factor xo = { + .mult = 1, + .div = 1, +-- +2.20.1 + diff --git a/queue-4.14/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch b/queue-4.14/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch new file mode 100644 index 00000000000..d6a7bf6ae11 --- /dev/null +++ b/queue-4.14/clk-qoriq-fix-refcount-leak-in-clockgen_init.patch @@ -0,0 +1,36 @@ +From 959e0f0f055c7ba800237cbd7f719ddf447043a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:14:42 -0500 +Subject: clk: qoriq: fix refcount leak in clockgen_init() + +From: Yangtao Li + +[ Upstream commit 70af6c5b5270e8101f318c4b69cc98a726edfab9 ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 0dfc86b3173f ("clk: qoriq: Move chip-specific knowledge into driver") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-qoriq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-qoriq.c b/drivers/clk/clk-qoriq.c +index 1a292519d84f2..999a90a166092 100644 +--- a/drivers/clk/clk-qoriq.c ++++ b/drivers/clk/clk-qoriq.c +@@ -1382,6 +1382,7 @@ static void __init clockgen_init(struct device_node *np) + pr_err("%s: Couldn't map %pOF regs\n", __func__, + guts); + } ++ of_node_put(guts); + } + + } +-- +2.20.1 + diff --git a/queue-4.14/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch b/queue-4.14/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch new file mode 100644 index 00000000000..23d40705709 --- /dev/null +++ b/queue-4.14/clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch @@ -0,0 +1,36 @@ +From 18b9899b52162e5d2a0c1951069cd1af9736e75b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:32:15 -0500 +Subject: clk: samsung: exynos4: fix refcount leak in exynos4_get_xom() + +From: Yangtao Li + +[ Upstream commit cee82eb9532090cd1dc953e845d71f9b1445c84e ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos4.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c +index d8d3cb67b4029..3d30262219275 100644 +--- a/drivers/clk/samsung/clk-exynos4.c ++++ b/drivers/clk/samsung/clk-exynos4.c +@@ -1240,6 +1240,7 @@ static unsigned long __init exynos4_get_xom(void) + xom = readl(chipid_base + 8); + + iounmap(chipid_base); ++ of_node_put(np); + } + + return xom; +-- +2.20.1 + diff --git a/queue-4.14/clk-socfpga-fix-refcount-leak.patch b/queue-4.14/clk-socfpga-fix-refcount-leak.patch new file mode 100644 index 00000000000..cea66e57599 --- /dev/null +++ b/queue-4.14/clk-socfpga-fix-refcount-leak.patch @@ -0,0 +1,50 @@ +From e1f2700f394da876ad3a0ad493e41a6428f3883b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:29:02 -0500 +Subject: clk: socfpga: fix refcount leak + +From: Yangtao Li + +[ Upstream commit 7f9705beeb3759e69165e7aff588f6488ff6c1ac ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 5343325ff3dd ("clk: socfpga: add a clock driver for the Arria 10 platform") +Fixes: a30d27ed739b ("clk: socfpga: fix clock driver for 3.15") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/socfpga/clk-pll-a10.c | 1 + + drivers/clk/socfpga/clk-pll.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/clk/socfpga/clk-pll-a10.c b/drivers/clk/socfpga/clk-pll-a10.c +index 35fabe1a32c30..269467e8e07e1 100644 +--- a/drivers/clk/socfpga/clk-pll-a10.c ++++ b/drivers/clk/socfpga/clk-pll-a10.c +@@ -95,6 +95,7 @@ static struct clk * __init __socfpga_pll_init(struct device_node *node, + + clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr"); + clk_mgr_a10_base_addr = of_iomap(clkmgr_np, 0); ++ of_node_put(clkmgr_np); + BUG_ON(!clk_mgr_a10_base_addr); + pll_clk->hw.reg = clk_mgr_a10_base_addr + reg; + +diff --git a/drivers/clk/socfpga/clk-pll.c b/drivers/clk/socfpga/clk-pll.c +index c7f463172e4b9..b4b44e9b59011 100644 +--- a/drivers/clk/socfpga/clk-pll.c ++++ b/drivers/clk/socfpga/clk-pll.c +@@ -100,6 +100,7 @@ static __init struct clk *__socfpga_pll_init(struct device_node *node, + + clkmgr_np = of_find_compatible_node(NULL, NULL, "altr,clk-mgr"); + clk_mgr_base_addr = of_iomap(clkmgr_np, 0); ++ of_node_put(clkmgr_np); + BUG_ON(!clk_mgr_base_addr); + pll_clk->hw.reg = clk_mgr_base_addr + reg; + +-- +2.20.1 + diff --git a/queue-4.14/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch b/queue-4.14/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch new file mode 100644 index 00000000000..eb837cbef20 --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch @@ -0,0 +1,39 @@ +From 75fa3d4d0ba4909d1148d61a551bba8bc88815d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jan 2019 11:23:04 +0800 +Subject: clk: sunxi-ng: sun8i-a23: Enable PLL-MIPI LDOs when ungating it + +From: Chen-Yu Tsai + +[ Upstream commit 108a459ef4cd17a28711d81092044e597b5c7618 ] + +The PLL-MIPI clock is somewhat special as it has its own LDOs which +need to be turned on for this PLL to actually work and output a clock +signal. + +Add the 2 LDO enable bits to the gate bits. + +Fixes: 5690879d93e8 ("clk: sunxi-ng: Add A23 CCU") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun8i-a23.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c +index d93b452f0df97..1cef040ebe829 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a23.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a23.c +@@ -132,7 +132,7 @@ static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_mipi_clk, "pll-mipi", + 8, 4, /* N */ + 4, 2, /* K */ + 0, 4, /* M */ +- BIT(31), /* gate */ ++ BIT(31) | BIT(23) | BIT(22), /* gate */ + BIT(28), /* lock */ + CLK_SET_RATE_UNGATE); + +-- +2.20.1 + diff --git a/queue-4.14/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch b/queue-4.14/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch new file mode 100644 index 00000000000..453b0852e39 --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch @@ -0,0 +1,114 @@ +From 9ac7acf49b24e0ad0b8b2cccccd6d4f5a5e54322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jul 2019 11:46:28 +0800 +Subject: clk: sunxi-ng: v3s: add the missing PLL_DDR1 + +From: Icenowy Zheng + +[ Upstream commit c5ed9475c22c89d5409402055142372e35d26a3f ] + +The user manual of V3/V3s/S3 declares a PLL_DDR1, however it's forgot +when developing the V3s CCU driver. + +Add back the missing PLL_DDR1. + +Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU") +Signed-off-by: Icenowy Zheng +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun8i-v3s.c | 19 +++++++++++++++---- + drivers/clk/sunxi-ng/ccu-sun8i-v3s.h | 6 ++++-- + 2 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +index 9e3f4088724b4..c7f9d974b10d5 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c +@@ -84,7 +84,7 @@ static SUNXI_CCU_NM_WITH_FRAC_GATE_LOCK(pll_ve_clk, "pll-ve", + BIT(28), /* lock */ + 0); + +-static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr_clk, "pll-ddr", ++static SUNXI_CCU_NKM_WITH_GATE_LOCK(pll_ddr0_clk, "pll-ddr0", + "osc24M", 0x020, + 8, 5, /* N */ + 4, 2, /* K */ +@@ -123,6 +123,14 @@ static SUNXI_CCU_NK_WITH_GATE_LOCK_POSTDIV(pll_periph1_clk, "pll-periph1", + 2, /* post-div */ + 0); + ++static SUNXI_CCU_NM_WITH_GATE_LOCK(pll_ddr1_clk, "pll-ddr1", ++ "osc24M", 0x04c, ++ 8, 7, /* N */ ++ 0, 2, /* M */ ++ BIT(31), /* gate */ ++ BIT(28), /* lock */ ++ 0); ++ + static const char * const cpu_parents[] = { "osc32k", "osc24M", + "pll-cpu", "pll-cpu" }; + static SUNXI_CCU_MUX(cpu_clk, "cpu", cpu_parents, +@@ -310,7 +318,8 @@ static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M", + static SUNXI_CCU_GATE(usb_ohci0_clk, "usb-ohci0", "osc24M", + 0x0cc, BIT(16), 0); + +-static const char * const dram_parents[] = { "pll-ddr", "pll-periph0-2x" }; ++static const char * const dram_parents[] = { "pll-ddr0", "pll-ddr1", ++ "pll-periph0-2x" }; + static SUNXI_CCU_M_WITH_MUX(dram_clk, "dram", dram_parents, + 0x0f4, 0, 4, 20, 2, CLK_IS_CRITICAL); + +@@ -369,10 +378,11 @@ static struct ccu_common *sun8i_v3s_ccu_clks[] = { + &pll_audio_base_clk.common, + &pll_video_clk.common, + &pll_ve_clk.common, +- &pll_ddr_clk.common, ++ &pll_ddr0_clk.common, + &pll_periph0_clk.common, + &pll_isp_clk.common, + &pll_periph1_clk.common, ++ &pll_ddr1_clk.common, + &cpu_clk.common, + &axi_clk.common, + &ahb1_clk.common, +@@ -457,11 +467,12 @@ static struct clk_hw_onecell_data sun8i_v3s_hw_clks = { + [CLK_PLL_AUDIO_8X] = &pll_audio_8x_clk.hw, + [CLK_PLL_VIDEO] = &pll_video_clk.common.hw, + [CLK_PLL_VE] = &pll_ve_clk.common.hw, +- [CLK_PLL_DDR] = &pll_ddr_clk.common.hw, ++ [CLK_PLL_DDR0] = &pll_ddr0_clk.common.hw, + [CLK_PLL_PERIPH0] = &pll_periph0_clk.common.hw, + [CLK_PLL_PERIPH0_2X] = &pll_periph0_2x_clk.hw, + [CLK_PLL_ISP] = &pll_isp_clk.common.hw, + [CLK_PLL_PERIPH1] = &pll_periph1_clk.common.hw, ++ [CLK_PLL_DDR1] = &pll_ddr1_clk.common.hw, + [CLK_CPU] = &cpu_clk.common.hw, + [CLK_AXI] = &axi_clk.common.hw, + [CLK_AHB1] = &ahb1_clk.common.hw, +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h +index 4a4d36fdad960..a091b7217dfd5 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.h +@@ -29,7 +29,7 @@ + #define CLK_PLL_AUDIO_8X 5 + #define CLK_PLL_VIDEO 6 + #define CLK_PLL_VE 7 +-#define CLK_PLL_DDR 8 ++#define CLK_PLL_DDR0 8 + #define CLK_PLL_PERIPH0 9 + #define CLK_PLL_PERIPH0_2X 10 + #define CLK_PLL_ISP 11 +@@ -58,6 +58,8 @@ + + /* And the GPU module clock is exported */ + +-#define CLK_NUMBER (CLK_MIPI_CSI + 1) ++#define CLK_PLL_DDR1 74 ++ ++#define CLK_NUMBER (CLK_PLL_DDR1 + 1) + + #endif /* _CCU_SUN8I_H3_H_ */ +-- +2.20.1 + diff --git a/queue-4.14/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch b/queue-4.14/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch new file mode 100644 index 00000000000..604f5df1abf --- /dev/null +++ b/queue-4.14/clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch @@ -0,0 +1,36 @@ +From a5a326747f2d449294341c6cec9d79e18d69b9e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 08:59:36 -0500 +Subject: clk: vf610: fix refcount leak in vf610_clocks_init() + +From: Yangtao Li + +[ Upstream commit 567177024e0313e4f0dcba7ba10c0732e50e655d ] + +The of_find_compatible_node() returns a node pointer with refcount +incremented, but there is the lack of use of the of_node_put() when +done. Add the missing of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Fixes: 1f2c5fd5f048 ("ARM: imx: add VF610 clock support") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-vf610.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/imx/clk-vf610.c b/drivers/clk/imx/clk-vf610.c +index 6dae54325a91d..a334667c450a1 100644 +--- a/drivers/clk/imx/clk-vf610.c ++++ b/drivers/clk/imx/clk-vf610.c +@@ -203,6 +203,7 @@ static void __init vf610_clocks_init(struct device_node *ccm_node) + np = of_find_compatible_node(NULL, NULL, "fsl,vf610-anatop"); + anatop_base = of_iomap(np, 0); + BUG_ON(!anatop_base); ++ of_node_put(np); + + np = ccm_node; + ccm_base = of_iomap(np, 0); +-- +2.20.1 + diff --git a/queue-4.14/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch b/queue-4.14/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch new file mode 100644 index 00000000000..79079b48fac --- /dev/null +++ b/queue-4.14/clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch @@ -0,0 +1,53 @@ +From 410ae284ded75d36c33e44d530c6bb70ef5229ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Oct 2018 11:57:04 +0200 +Subject: clocksource/drivers/exynos_mct: Fix error path in timer resources + initialization + +From: Marek Szyprowski + +[ Upstream commit b9307420196009cdf18bad55e762ac49fb9a80f4 ] + +While freeing interrupt handlers in error path, don't assume that all +requested interrupts are per-processor interrupts and properly release +standard interrupts too. + +Reported-by: Krzysztof Kozlowski +Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier") +Signed-off-by: Marek Szyprowski +Reviewed-by: Krzysztof Kozlowski +Reviewed-by: Chanwoo Choi +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/exynos_mct.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index aaf5bfa9bd9c9..e3ae041ac30e1 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -563,7 +563,19 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem * + return 0; + + out_irq: +- free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick); ++ if (mct_int_type == MCT_INT_PPI) { ++ free_percpu_irq(mct_irqs[MCT_L0_IRQ], &percpu_mct_tick); ++ } else { ++ for_each_possible_cpu(cpu) { ++ struct mct_clock_event_device *pcpu_mevt = ++ per_cpu_ptr(&percpu_mct_tick, cpu); ++ ++ if (pcpu_mevt->evt.irq != -1) { ++ free_irq(pcpu_mevt->evt.irq, pcpu_mevt); ++ pcpu_mevt->evt.irq = -1; ++ } ++ } ++ } + return err; + } + +-- +2.20.1 + diff --git a/queue-4.14/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch b/queue-4.14/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch new file mode 100644 index 00000000000..da59d2421c5 --- /dev/null +++ b/queue-4.14/clocksource-drivers-sun5i-fail-gracefully-when-clock.patch @@ -0,0 +1,58 @@ +From 780592d66cbebb52e4199897bbc92be1329a3ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jan 2019 14:22:07 +0800 +Subject: clocksource/drivers/sun5i: Fail gracefully when clock rate is + unavailable + +From: Chen-Yu Tsai + +[ Upstream commit e7e7e0d7beafebd11b0c065cd5fbc1e5759c5aab ] + +If the clock tree is not fully populated when the timer-sun5i init code +is called, attempts to get the clock rate for the timer would fail and +return 0. + +Make the init code for both clock events and clocksource check the +returned clock rate and fail gracefully if the result is 0, instead of +causing a divide by 0 exception later on. + +Fixes: 4a59058f0b09 ("clocksource/drivers/sun5i: Refactor the current code") +Signed-off-by: Chen-Yu Tsai +Acked-by: Maxime Ripard +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-sun5i.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c +index 2a3fe83ec3377..6f4a9a8faccc2 100644 +--- a/drivers/clocksource/timer-sun5i.c ++++ b/drivers/clocksource/timer-sun5i.c +@@ -202,6 +202,11 @@ static int __init sun5i_setup_clocksource(struct device_node *node, + } + + rate = clk_get_rate(clk); ++ if (!rate) { ++ pr_err("Couldn't get parent clock rate\n"); ++ ret = -EINVAL; ++ goto err_disable_clk; ++ } + + cs->timer.base = base; + cs->timer.clk = clk; +@@ -275,6 +280,11 @@ static int __init sun5i_setup_clockevent(struct device_node *node, void __iomem + } + + rate = clk_get_rate(clk); ++ if (!rate) { ++ pr_err("Couldn't get parent clock rate\n"); ++ ret = -EINVAL; ++ goto err_disable_clk; ++ } + + ce->timer.base = base; + ce->timer.ticks_per_jiffy = DIV_ROUND_UP(rate, HZ); +-- +2.20.1 + diff --git a/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch b/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch new file mode 100644 index 00000000000..a1f3357250c --- /dev/null +++ b/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch @@ -0,0 +1,40 @@ +From a9b0d53c869059d13c0252f3ffe029952855d3de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2019 11:45:46 -0700 +Subject: cpufreq: brcmstb-avs-cpufreq: Fix initial command check + +From: Florian Fainelli + +[ Upstream commit 22a26cc6a51ef73dcfeb64c50513903f6b2d53d8 ] + +There is a logical error in brcm_avs_is_firmware_loaded() whereby if the +firmware returns -EINVAL, we will be reporting this as an error. The +comment is correct, the code was not. + +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Signed-off-by: Florian Fainelli +Acked-by: Markus Mayer +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index 7281a2c19c362..bae3190376582 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -762,8 +762,8 @@ static bool brcm_avs_is_firmware_loaded(struct private_data *priv) + rc = brcm_avs_get_pmap(priv, NULL); + magic = readl(priv->base + AVS_MBOX_MAGIC); + +- return (magic == AVS_FIRMWARE_MAGIC) && (rc != -ENOTSUPP) && +- (rc != -EINVAL); ++ return (magic == AVS_FIRMWARE_MAGIC) && ((rc != -ENOTSUPP) || ++ (rc != -EINVAL)); + } + + static unsigned int brcm_avs_cpufreq_get(unsigned int cpu) +-- +2.20.1 + diff --git a/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch b/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch new file mode 100644 index 00000000000..513d740bf71 --- /dev/null +++ b/queue-4.14/cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch @@ -0,0 +1,61 @@ +From 2ff71ef24470847ed86c589790b577e9b8624332 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2019 11:45:47 -0700 +Subject: cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency + +From: Florian Fainelli + +[ Upstream commit 4c5681fcc684c762b09435de3e82ffeee7769d21 ] + +What we read back from the register is going to be capped at 32-bits, +and cpufreq_freq_table.frequency is an unsigned int. Avoid any possible +value truncation by using the appropriate return value. + +Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs") +Signed-off-by: Florian Fainelli +Acked-by: Markus Mayer +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/brcmstb-avs-cpufreq.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/cpufreq/brcmstb-avs-cpufreq.c b/drivers/cpufreq/brcmstb-avs-cpufreq.c +index bae3190376582..39c462711eae0 100644 +--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c ++++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c +@@ -468,12 +468,12 @@ static int brcm_avs_set_pstate(struct private_data *priv, unsigned int pstate) + return __issue_avs_command(priv, AVS_CMD_SET_PSTATE, true, args); + } + +-static unsigned long brcm_avs_get_voltage(void __iomem *base) ++static u32 brcm_avs_get_voltage(void __iomem *base) + { + return readl(base + AVS_MBOX_VOLTAGE1); + } + +-static unsigned long brcm_avs_get_frequency(void __iomem *base) ++static u32 brcm_avs_get_frequency(void __iomem *base) + { + return readl(base + AVS_MBOX_FREQUENCY) * 1000; /* in kHz */ + } +@@ -973,14 +973,14 @@ static ssize_t show_brcm_avs_voltage(struct cpufreq_policy *policy, char *buf) + { + struct private_data *priv = policy->driver_data; + +- return sprintf(buf, "0x%08lx\n", brcm_avs_get_voltage(priv->base)); ++ return sprintf(buf, "0x%08x\n", brcm_avs_get_voltage(priv->base)); + } + + static ssize_t show_brcm_avs_frequency(struct cpufreq_policy *policy, char *buf) + { + struct private_data *priv = policy->driver_data; + +- return sprintf(buf, "0x%08lx\n", brcm_avs_get_frequency(priv->base)); ++ return sprintf(buf, "0x%08x\n", brcm_avs_get_frequency(priv->base)); + } + + cpufreq_freq_attr_ro(brcm_avs_pstate); +-- +2.20.1 + diff --git a/queue-4.14/crypto-brcm-fix-some-set-but-not-used-warning.patch b/queue-4.14/crypto-brcm-fix-some-set-but-not-used-warning.patch new file mode 100644 index 00000000000..bda783593af --- /dev/null +++ b/queue-4.14/crypto-brcm-fix-some-set-but-not-used-warning.patch @@ -0,0 +1,65 @@ +From 732375593ae7e8c2ad02a432a6507ae9a8166586 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jan 2019 06:11:18 +0000 +Subject: crypto: brcm - Fix some set-but-not-used warning + +From: YueHaibing + +[ Upstream commit 707d0cf8f7cff6dfee9197002859912310532c4f ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/crypto/bcm/cipher.c: In function 'handle_ahash_req': +drivers/crypto/bcm/cipher.c:720:15: warning: + variable 'chunk_start' set but not used [-Wunused-but-set-variable] + +drivers/crypto/bcm/cipher.c: In function 'spu_rx_callback': +drivers/crypto/bcm/cipher.c:1679:31: warning: + variable 'areq' set but not used [-Wunused-but-set-variable] + +drivers/crypto/bcm/cipher.c:1678:22: warning: + variable 'ctx' set but not used [-Wunused-but-set-variable] + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: YueHaibing +Reviewed-by: Raveendra Padasalagi +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/cipher.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index 84422435f39b4..279e907590e98 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -718,7 +718,7 @@ static int handle_ahash_req(struct iproc_reqctx_s *rctx) + */ + unsigned int new_data_len; + +- unsigned int chunk_start = 0; ++ unsigned int __maybe_unused chunk_start = 0; + u32 db_size; /* Length of data field, incl gcm and hash padding */ + int pad_len = 0; /* total pad len, including gcm, hash, stat padding */ + u32 data_pad_len = 0; /* length of GCM/CCM padding */ +@@ -1676,8 +1676,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg) + struct spu_hw *spu = &iproc_priv.spu; + struct brcm_message *mssg = msg; + struct iproc_reqctx_s *rctx; +- struct iproc_ctx_s *ctx; +- struct crypto_async_request *areq; + int err = 0; + + rctx = mssg->ctx; +@@ -1687,8 +1685,6 @@ static void spu_rx_callback(struct mbox_client *cl, void *msg) + err = -EFAULT; + goto cb_finish; + } +- areq = rctx->parent; +- ctx = rctx->ctx; + + /* process the SPU status */ + err = spu->spu_status_process(rctx->msg_buf.rx_stat); +-- +2.20.1 + diff --git a/queue-4.14/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch b/queue-4.14/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch new file mode 100644 index 00000000000..eb422508b96 --- /dev/null +++ b/queue-4.14/crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch @@ -0,0 +1,40 @@ +From 101f60a2e88506f6179ee8b7f27310a7545ab168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 May 2019 16:37:03 +0300 +Subject: crypto: caam - fix caam_dump_sg that iterates through scatterlist +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Iuliana Prodan + +[ Upstream commit 8c65d35435e8cbfdf953cafe5ebe3648ee9276a2 ] + +Fix caam_dump_sg by correctly determining the next scatterlist +entry in the list. + +Fixes: 5ecf8ef9103c ("crypto: caam - fix sg dump") +Signed-off-by: Iuliana Prodan +Reviewed-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/error.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c +index 8da88beb1abbe..832ba2afdcd57 100644 +--- a/drivers/crypto/caam/error.c ++++ b/drivers/crypto/caam/error.c +@@ -22,7 +22,7 @@ void caam_dump_sg(const char *level, const char *prefix_str, int prefix_type, + size_t len; + void *buf; + +- for (it = sg; it && tlen > 0 ; it = sg_next(sg)) { ++ for (it = sg; it && tlen > 0 ; it = sg_next(it)) { + /* + * make sure the scatterlist's page + * has a valid virtual memory mapping +-- +2.20.1 + diff --git a/queue-4.14/crypto-caam-free-resources-in-case-caam_rng-registra.patch b/queue-4.14/crypto-caam-free-resources-in-case-caam_rng-registra.patch new file mode 100644 index 00000000000..42c80d93e12 --- /dev/null +++ b/queue-4.14/crypto-caam-free-resources-in-case-caam_rng-registra.patch @@ -0,0 +1,40 @@ +From 833461554fea4610558936ce52401cd2e147c590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 16:08:12 +0300 +Subject: crypto: caam - free resources in case caam_rng registration failed + +From: Iuliana Prodan + +[ Upstream commit c59a1d41672a89b5cac49db1a472ff889e35a2d2 ] + +Check the return value of the hardware registration for caam_rng and free +resources in case of failure. + +Fixes: e24f7c9e87d4 ("crypto: caam - hwrng support") +Signed-off-by: Iuliana Prodan +Reviewed-by: Horia Geanta +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/caamrng.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/caam/caamrng.c b/drivers/crypto/caam/caamrng.c +index fde07d4ff0190..ff6718a11e9ec 100644 +--- a/drivers/crypto/caam/caamrng.c ++++ b/drivers/crypto/caam/caamrng.c +@@ -353,7 +353,10 @@ static int __init caam_rng_init(void) + goto free_rng_ctx; + + dev_info(dev, "registering rng-caam\n"); +- return hwrng_register(&caam_rng); ++ ++ err = hwrng_register(&caam_rng); ++ if (!err) ++ return err; + + free_rng_ctx: + kfree(rng_ctx); +-- +2.20.1 + diff --git a/queue-4.14/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch b/queue-4.14/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch new file mode 100644 index 00000000000..f719dc2e04a --- /dev/null +++ b/queue-4.14/crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch @@ -0,0 +1,77 @@ +From badafd662191d6377aca49664c678805f52f85d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2019 21:53:30 +0000 +Subject: crypto: ccp - Fix 3DES complaint from ccp-crypto module + +From: Hook, Gary + +[ Upstream commit 89646fdda4cae203185444ac7988835f36a21ee1 ] + +Crypto self-tests reveal an error: + +alg: skcipher: cbc-des3-ccp encryption test failed (wrong output IV) on test vector 0, cfg="in-place" + +The offset value should not be recomputed when retrieving the context. +Also, a code path exists which makes decisions based on older (version 3) +hardware; a v3 device deosn't support 3DES so remove this check. + +Fixes: 990672d48515 ('crypto: ccp - Enable 3DES function on v5 CCPs') + +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-ops.c | 15 ++++----------- + 1 file changed, 4 insertions(+), 11 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 1e2e42106dee0..4b48b8523a40c 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -1293,6 +1293,9 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + int ret; + + /* Error checks */ ++ if (cmd_q->ccp->vdata->version < CCP_VERSION(5, 0)) ++ return -EINVAL; ++ + if (!cmd_q->ccp->vdata->perform->des3) + return -EINVAL; + +@@ -1375,8 +1378,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + * passthru option to convert from big endian to little endian. + */ + if (des3->mode != CCP_DES3_MODE_ECB) { +- u32 load_mode; +- + op.sb_ctx = cmd_q->sb_ctx; + + ret = ccp_init_dm_workarea(&ctx, cmd_q, +@@ -1392,12 +1393,8 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + if (ret) + goto e_ctx; + +- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0)) +- load_mode = CCP_PASSTHRU_BYTESWAP_NOOP; +- else +- load_mode = CCP_PASSTHRU_BYTESWAP_256BIT; + ret = ccp_copy_to_sb(cmd_q, &ctx, op.jobid, op.sb_ctx, +- load_mode); ++ CCP_PASSTHRU_BYTESWAP_256BIT); + if (ret) { + cmd->engine_error = cmd_q->cmd_error; + goto e_ctx; +@@ -1459,10 +1456,6 @@ static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + } + + /* ...but we only need the last DES3_EDE_BLOCK_SIZE bytes */ +- if (cmd_q->ccp->vdata->version == CCP_VERSION(3, 0)) +- dm_offset = CCP_SB_BYTES - des3->iv_len; +- else +- dm_offset = 0; + ccp_get_dm_area(&ctx, dm_offset, des3->iv, 0, + DES3_EDE_BLOCK_SIZE); + } +-- +2.20.1 + diff --git a/queue-4.14/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch b/queue-4.14/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch new file mode 100644 index 00000000000..9a050aff1cc --- /dev/null +++ b/queue-4.14/crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch @@ -0,0 +1,63 @@ +From ded9202bd06fd198484e8ef58c375ed17209d7cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2019 21:53:23 +0000 +Subject: crypto: ccp - fix AES CFB error exposed by new test vectors + +From: Hook, Gary + +[ Upstream commit c3b359d6567c0b8f413e924feb37cf025067d55a ] + +Updated testmgr will exhibit this error message when loading the +ccp-crypto module: + +alg: skcipher: cfb-aes-ccp encryption failed with err -22 on test vector 3, cfg="in-place" + +Update the CCP crypto driver to correctly treat CFB as a streaming mode +cipher (instead of block mode). Update the configuration for CFB to +specify the block size as a single byte; + +Fixes: 2b789435d7f3 ('crypto: ccp - CCP AES crypto API support') + +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-crypto-aes.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c +index 89291c15015cd..3f768699332ba 100644 +--- a/drivers/crypto/ccp/ccp-crypto-aes.c ++++ b/drivers/crypto/ccp/ccp-crypto-aes.c +@@ -1,7 +1,8 @@ ++// SPDX-License-Identifier: GPL-2.0 + /* + * AMD Cryptographic Coprocessor (CCP) AES crypto API support + * +- * Copyright (C) 2013,2016 Advanced Micro Devices, Inc. ++ * Copyright (C) 2013-2019 Advanced Micro Devices, Inc. + * + * Author: Tom Lendacky + * +@@ -79,8 +80,7 @@ static int ccp_aes_crypt(struct ablkcipher_request *req, bool encrypt) + return -EINVAL; + + if (((ctx->u.aes.mode == CCP_AES_MODE_ECB) || +- (ctx->u.aes.mode == CCP_AES_MODE_CBC) || +- (ctx->u.aes.mode == CCP_AES_MODE_CFB)) && ++ (ctx->u.aes.mode == CCP_AES_MODE_CBC)) && + (req->nbytes & (AES_BLOCK_SIZE - 1))) + return -EINVAL; + +@@ -291,7 +291,7 @@ static struct ccp_aes_def aes_algs[] = { + .version = CCP_VERSION(3, 0), + .name = "cfb(aes)", + .driver_name = "cfb-aes-ccp", +- .blocksize = AES_BLOCK_SIZE, ++ .blocksize = 1, + .ivsize = AES_BLOCK_SIZE, + .alg_defaults = &ccp_aes_defaults, + }, +-- +2.20.1 + diff --git a/queue-4.14/crypto-ccp-reduce-maximum-stack-usage.patch b/queue-4.14/crypto-ccp-reduce-maximum-stack-usage.patch new file mode 100644 index 00000000000..04681dfff3d --- /dev/null +++ b/queue-4.14/crypto-ccp-reduce-maximum-stack-usage.patch @@ -0,0 +1,178 @@ +From 6a928cf40af816420f49d44f6e00b10bfe934adc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2019 10:59:24 +0200 +Subject: crypto: ccp - Reduce maximum stack usage + +From: Arnd Bergmann + +[ Upstream commit 72c8117adfced37df101c8c0b3f363e0906f83f0 ] + +Each of the operations in ccp_run_cmd() needs several hundred +bytes of kernel stack. Depending on the inlining, these may +need separate stack slots that add up to more than the warning +limit, as shown in this clang based build: + +drivers/crypto/ccp/ccp-ops.c:871:12: error: stack frame size of 1164 bytes in function 'ccp_run_aes_cmd' [-Werror,-Wframe-larger-than=] +static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + +The problem may also happen when there is no warning, e.g. in the +ccp_run_cmd()->ccp_run_aes_cmd()->ccp_run_aes_gcm_cmd() call chain with +over 2000 bytes. + +Mark each individual function as 'noinline_for_stack' to prevent +this from happening, and move the calls to the two special cases for aes +into the top-level function. This will keep the actual combined stack +usage to the mimimum: 828 bytes for ccp_run_aes_gcm_cmd() and +at most 524 bytes for each of the other cases. + +Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-ops.c | 52 +++++++++++++++++++++--------------- + 1 file changed, 31 insertions(+), 21 deletions(-) + +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 4b48b8523a40c..330853a2702f0 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -458,8 +458,8 @@ static int ccp_copy_from_sb(struct ccp_cmd_queue *cmd_q, + return ccp_copy_to_from_sb(cmd_q, wa, jobid, sb, byte_swap, true); + } + +-static int ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, +- struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_aes_cmac_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_aes_engine *aes = &cmd->u.aes; + struct ccp_dm_workarea key, ctx; +@@ -614,8 +614,8 @@ e_key: + return ret; + } + +-static int ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, +- struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_aes_gcm_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_aes_engine *aes = &cmd->u.aes; + struct ccp_dm_workarea key, ctx, final_wa, tag; +@@ -897,7 +897,8 @@ e_key: + return ret; + } + +-static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_aes_engine *aes = &cmd->u.aes; + struct ccp_dm_workarea key, ctx; +@@ -907,12 +908,6 @@ static int ccp_run_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + bool in_place = false; + int ret; + +- if (aes->mode == CCP_AES_MODE_CMAC) +- return ccp_run_aes_cmac_cmd(cmd_q, cmd); +- +- if (aes->mode == CCP_AES_MODE_GCM) +- return ccp_run_aes_gcm_cmd(cmd_q, cmd); +- + if (!((aes->key_len == AES_KEYSIZE_128) || + (aes->key_len == AES_KEYSIZE_192) || + (aes->key_len == AES_KEYSIZE_256))) +@@ -1080,8 +1075,8 @@ e_key: + return ret; + } + +-static int ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, +- struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_xts_aes_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_xts_aes_engine *xts = &cmd->u.xts; + struct ccp_dm_workarea key, ctx; +@@ -1280,7 +1275,8 @@ e_key: + return ret; + } + +-static int ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_des3_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_des3_engine *des3 = &cmd->u.des3; + +@@ -1476,7 +1472,8 @@ e_key: + return ret; + } + +-static int ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_sha_engine *sha = &cmd->u.sha; + struct ccp_dm_workarea ctx; +@@ -1820,7 +1817,8 @@ e_ctx: + return ret; + } + +-static int ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_rsa_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_rsa_engine *rsa = &cmd->u.rsa; + struct ccp_dm_workarea exp, src, dst; +@@ -1951,8 +1949,8 @@ e_sb: + return ret; + } + +-static int ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, +- struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_passthru_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_passthru_engine *pt = &cmd->u.passthru; + struct ccp_dm_workarea mask; +@@ -2083,7 +2081,8 @@ e_mask: + return ret; + } + +-static int ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q, ++static noinline_for_stack int ++ccp_run_passthru_nomap_cmd(struct ccp_cmd_queue *cmd_q, + struct ccp_cmd *cmd) + { + struct ccp_passthru_nomap_engine *pt = &cmd->u.passthru_nomap; +@@ -2424,7 +2423,8 @@ e_src: + return ret; + } + +-static int ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) ++static noinline_for_stack int ++ccp_run_ecc_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + { + struct ccp_ecc_engine *ecc = &cmd->u.ecc; + +@@ -2461,7 +2461,17 @@ int ccp_run_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + + switch (cmd->engine) { + case CCP_ENGINE_AES: +- ret = ccp_run_aes_cmd(cmd_q, cmd); ++ switch (cmd->u.aes.mode) { ++ case CCP_AES_MODE_CMAC: ++ ret = ccp_run_aes_cmac_cmd(cmd_q, cmd); ++ break; ++ case CCP_AES_MODE_GCM: ++ ret = ccp_run_aes_gcm_cmd(cmd_q, cmd); ++ break; ++ default: ++ ret = ccp_run_aes_cmd(cmd_q, cmd); ++ break; ++ } + break; + case CCP_ENGINE_XTS_AES_128: + ret = ccp_run_xts_aes_cmd(cmd_q, cmd); +-- +2.20.1 + diff --git a/queue-4.14/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch b/queue-4.14/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch new file mode 100644 index 00000000000..14135852809 --- /dev/null +++ b/queue-4.14/crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch @@ -0,0 +1,49 @@ +From a0b3d38d8d902e616fce85e25c4283c8d9c1fd28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 11:24:18 +0000 +Subject: crypto: crypto4xx - Fix wrong + ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments + +From: Corentin Labbe + +[ Upstream commit 6e88098ca43a3d80ae86908f7badba683c8a0d84 ] + +When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure: +drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe': +drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types] +In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0: +drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *' +drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove': +drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types] +In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0: +drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *' + +This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case. + +Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/amcc/crypto4xx_trng.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/amcc/crypto4xx_trng.h b/drivers/crypto/amcc/crypto4xx_trng.h +index 931d22531f515..7bbda51b7337c 100644 +--- a/drivers/crypto/amcc/crypto4xx_trng.h ++++ b/drivers/crypto/amcc/crypto4xx_trng.h +@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device *core_dev); + void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev); + #else + static inline void ppc4xx_trng_probe( +- struct crypto4xx_device *dev __maybe_unused) { } ++ struct crypto4xx_core_device *dev __maybe_unused) { } + static inline void ppc4xx_trng_remove( +- struct crypto4xx_device *dev __maybe_unused) { } ++ struct crypto4xx_core_device *dev __maybe_unused) { } + #endif + + #endif +-- +2.20.1 + diff --git a/queue-4.14/crypto-tgr192-fix-unaligned-memory-access.patch b/queue-4.14/crypto-tgr192-fix-unaligned-memory-access.patch new file mode 100644 index 00000000000..4c4be3ae14e --- /dev/null +++ b/queue-4.14/crypto-tgr192-fix-unaligned-memory-access.patch @@ -0,0 +1,50 @@ +From befa103f26c77ac41ec1b1641ad20c08dd9d773b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jan 2019 12:17:58 -0800 +Subject: crypto: tgr192 - fix unaligned memory access + +From: Eric Biggers + +[ Upstream commit f990f7fb58ac8ac9a43316f09a48cff1a49dda42 ] + +Fix an unaligned memory access in tgr192_transform() by using the +unaligned access helpers. + +Fixes: 06ace7a9bafe ("[CRYPTO] Use standard byte order macros wherever possible") +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/tgr192.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/crypto/tgr192.c b/crypto/tgr192.c +index 321bc6ff2a9d1..904c8444aa0a2 100644 +--- a/crypto/tgr192.c ++++ b/crypto/tgr192.c +@@ -25,8 +25,9 @@ + #include + #include + #include +-#include + #include ++#include ++#include + + #define TGR192_DIGEST_SIZE 24 + #define TGR160_DIGEST_SIZE 20 +@@ -468,10 +469,9 @@ static void tgr192_transform(struct tgr192_ctx *tctx, const u8 * data) + u64 a, b, c, aa, bb, cc; + u64 x[8]; + int i; +- const __le64 *ptr = (const __le64 *)data; + + for (i = 0; i < 8; i++) +- x[i] = le64_to_cpu(ptr[i]); ++ x[i] = get_unaligned_le64(data + i * sizeof(__le64)); + + /* save */ + a = aa = tctx->a; +-- +2.20.1 + diff --git a/queue-4.14/devres-allow-const-resource-arguments.patch b/queue-4.14/devres-allow-const-resource-arguments.patch new file mode 100644 index 00000000000..cdd8d1c8fcb --- /dev/null +++ b/queue-4.14/devres-allow-const-resource-arguments.patch @@ -0,0 +1,63 @@ +From 8f8af7fd491365b48c6730277e0f6595c838534e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jun 2019 16:59:45 +0200 +Subject: devres: allow const resource arguments + +From: Arnd Bergmann + +[ Upstream commit 9dea44c91469512d346e638694c22c30a5273992 ] + +devm_ioremap_resource() does not currently take 'const' arguments, +which results in a warning from the first driver trying to do it +anyway: + +drivers/gpio/gpio-amd-fch.c: In function 'amd_fch_gpio_probe': +drivers/gpio/gpio-amd-fch.c:171:49: error: passing argument 2 of 'devm_ioremap_resource' discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] + priv->base = devm_ioremap_resource(&pdev->dev, &amd_fch_gpio_iores); + ^~~~~~~~~~~~~~~~~~~ + +Change the prototype to allow it, as there is no real reason not to. + +Fixes: 9bb2e0452508 ("gpio: amd: Make resource struct const") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20190628150049.1108048-1-arnd@arndb.de +Acked-by: Greg Kroah-Hartman +Reviwed-By: Enrico Weigelt +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + include/linux/device.h | 3 ++- + lib/devres.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/include/linux/device.h b/include/linux/device.h +index 66fe271c2544d..0b2e67014a833 100644 +--- a/include/linux/device.h ++++ b/include/linux/device.h +@@ -682,7 +682,8 @@ extern unsigned long devm_get_free_pages(struct device *dev, + gfp_t gfp_mask, unsigned int order); + extern void devm_free_pages(struct device *dev, unsigned long addr); + +-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res); ++void __iomem *devm_ioremap_resource(struct device *dev, ++ const struct resource *res); + + /* allows to add/remove a custom action to devres stack */ + int devm_add_action(struct device *dev, void (*action)(void *), void *data); +diff --git a/lib/devres.c b/lib/devres.c +index 5f2aedd58bc50..40a8b12a8b6b9 100644 +--- a/lib/devres.c ++++ b/lib/devres.c +@@ -132,7 +132,8 @@ EXPORT_SYMBOL(devm_iounmap); + * if (IS_ERR(base)) + * return PTR_ERR(base); + */ +-void __iomem *devm_ioremap_resource(struct device *dev, struct resource *res) ++void __iomem *devm_ioremap_resource(struct device *dev, ++ const struct resource *res) + { + resource_size_t size; + const char *name; +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch b/queue-4.14/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch new file mode 100644 index 00000000000..cb744300867 --- /dev/null +++ b/queue-4.14/dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch @@ -0,0 +1,45 @@ +From 1add46b76166dcd99d3d2492f14c0cad360fd568 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 16:05:20 +0200 +Subject: dmaengine: axi-dmac: Don't check the number of frames for alignment + +From: Alexandru Ardelean + +[ Upstream commit 648865a79d8ee3d1aa64aab5eb2a9d12eeed14f9 ] + +In 2D transfers (for the AXI DMAC), the number of frames (numf) represents +Y_LENGTH, and the length of a frame is X_LENGTH. 2D transfers are useful +for video transfers where screen resolutions ( X * Y ) are typically +aligned for X, but not for Y. + +There is no requirement for Y_LENGTH to be aligned to the bus-width (or +anything), and this is also true for AXI DMAC. + +Checking the Y_LENGTH for alignment causes false errors when initiating DMA +transfers. This change fixes this by checking only that the Y_LENGTH is +non-zero. + +Fixes: 0e3b67b348b8 ("dmaengine: Add support for the Analog Devices AXI-DMAC DMA controller") +Signed-off-by: Alexandru Ardelean +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dma-axi-dmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dma-axi-dmac.c b/drivers/dma/dma-axi-dmac.c +index 7f0b9aa158679..9887f2a14aa98 100644 +--- a/drivers/dma/dma-axi-dmac.c ++++ b/drivers/dma/dma-axi-dmac.c +@@ -451,7 +451,7 @@ static struct dma_async_tx_descriptor *axi_dmac_prep_interleaved( + + if (chan->hw_2d) { + if (!axi_dmac_check_len(chan, xt->sgl[0].size) || +- !axi_dmac_check_len(chan, xt->numf)) ++ xt->numf == 0) + return NULL; + if (xt->sgl[0].size + dst_icg > chan->max_length || + xt->sgl[0].size + src_icg > chan->max_length) +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch b/queue-4.14/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch new file mode 100644 index 00000000000..0d087ebdb40 --- /dev/null +++ b/queue-4.14/dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch @@ -0,0 +1,64 @@ +From c531b4f28fe48120ade236353128ffa79b24c6c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 16:15:43 +0300 +Subject: dmaengine: dw: platform: Switch to acpi_dma_controller_register() + +From: Andy Shevchenko + +[ Upstream commit e7b8514e4d68bec21fc6385fa0a66797ddc34ac9 ] + +There is a possibility to have registered ACPI DMA controller +while it has been gone already. + +To avoid the potential crash, move to non-managed +acpi_dma_controller_register(). + +Fixes: 42c91ee71d6d ("dw_dmac: add ACPI support") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20190820131546.75744-8-andriy.shevchenko@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/platform.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c +index 46a519e07195c..b408c07662f59 100644 +--- a/drivers/dma/dw/platform.c ++++ b/drivers/dma/dw/platform.c +@@ -87,13 +87,20 @@ static void dw_dma_acpi_controller_register(struct dw_dma *dw) + dma_cap_set(DMA_SLAVE, info->dma_cap); + info->filter_fn = dw_dma_acpi_filter; + +- ret = devm_acpi_dma_controller_register(dev, acpi_dma_simple_xlate, +- info); ++ ret = acpi_dma_controller_register(dev, acpi_dma_simple_xlate, info); + if (ret) + dev_err(dev, "could not register acpi_dma_controller\n"); + } ++ ++static void dw_dma_acpi_controller_free(struct dw_dma *dw) ++{ ++ struct device *dev = dw->dma.dev; ++ ++ acpi_dma_controller_free(dev); ++} + #else /* !CONFIG_ACPI */ + static inline void dw_dma_acpi_controller_register(struct dw_dma *dw) {} ++static inline void dw_dma_acpi_controller_free(struct dw_dma *dw) {} + #endif /* !CONFIG_ACPI */ + + #ifdef CONFIG_OF +@@ -249,6 +256,9 @@ static int dw_remove(struct platform_device *pdev) + { + struct dw_dma_chip *chip = platform_get_drvdata(pdev); + ++ if (ACPI_HANDLE(&pdev->dev)) ++ dw_dma_acpi_controller_free(chip->dw); ++ + if (pdev->dev.of_node) + of_dma_controller_free(pdev->dev.of_node); + +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch b/queue-4.14/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch new file mode 100644 index 00000000000..9ace82b0acb --- /dev/null +++ b/queue-4.14/dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch @@ -0,0 +1,51 @@ +From 65afdf3355484f5f9f7d71a779d14c96b87489c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2019 16:32:32 +0300 +Subject: dmaengine: hsu: Revert "set HSU_CH_MTSR to memory width" + +From: Andy Shevchenko + +[ Upstream commit c24a5c735f87d0549060de31367c095e8810b895 ] + +The commit + + 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width") + +has been mistakenly submitted. The further investigations show that +the original code does better job since the memory side transfer size +has never been configured by DMA users. + +As per latest revision of documentation: "Channel minimum transfer size +(CHnMTSR)... For IOSF UART, maximum value that can be programmed is 64 and +minimum value that can be programmed is 1." + +This reverts commit 080edf75d337d35faa6fc3df99342b10d2848d16. + +Fixes: 080edf75d337 ("dmaengine: hsu: set HSU_CH_MTSR to memory width") +Signed-off-by: Andy Shevchenko +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/hsu/hsu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/hsu/hsu.c b/drivers/dma/hsu/hsu.c +index 29d04ca71d52e..15525a2b8ebd7 100644 +--- a/drivers/dma/hsu/hsu.c ++++ b/drivers/dma/hsu/hsu.c +@@ -64,10 +64,10 @@ static void hsu_dma_chan_start(struct hsu_dma_chan *hsuc) + + if (hsuc->direction == DMA_MEM_TO_DEV) { + bsr = config->dst_maxburst; +- mtsr = config->src_addr_width; ++ mtsr = config->dst_addr_width; + } else if (hsuc->direction == DMA_DEV_TO_MEM) { + bsr = config->src_maxburst; +- mtsr = config->dst_addr_width; ++ mtsr = config->src_addr_width; + } + + hsu_chan_disable(hsuc); +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch b/queue-4.14/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch new file mode 100644 index 00000000000..d620ee61665 --- /dev/null +++ b/queue-4.14/dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch @@ -0,0 +1,73 @@ +From c2bd2d49ea6e0d601b8727895ca36481a9e42a24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 09:49:18 +0000 +Subject: dmaengine: imx-sdma: fix size check for sdma script_number + +From: Robin Gong + +[ Upstream commit bd73dfabdda280fc5f05bdec79b6721b4b2f035f ] + +Illegal memory will be touch if SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 +(41) exceed the size of structure sdma_script_start_addrs(40), +thus cause memory corrupt such as slob block header so that kernel +trap into while() loop forever in slob_free(). Please refer to below +code piece in imx-sdma.c: +for (i = 0; i < sdma->script_number; i++) + if (addr_arr[i] > 0) + saddr_arr[i] = addr_arr[i]; /* memory corrupt here */ +That issue was brought by commit a572460be9cf ("dmaengine: imx-sdma: Add +support for version 3 firmware") because SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V3 +(38->41 3 scripts added) not align with script number added in +sdma_script_start_addrs(2 scripts). + +Fixes: a572460be9cf ("dmaengine: imx-sdma: Add support for version 3 firmware") +Cc: stable@vger.kernel +Link: https://www.spinics.net/lists/arm-kernel/msg754895.html +Signed-off-by: Robin Gong +Reported-by: Jurgen Lambrecht +Link: https://lore.kernel.org/r/1569347584-3478-1-git-send-email-yibin.gong@nxp.com +[vkoul: update the patch title] +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/imx-sdma.c | 8 ++++++++ + include/linux/platform_data/dma-imx-sdma.h | 3 +++ + 2 files changed, 11 insertions(+) + +diff --git a/drivers/dma/imx-sdma.c b/drivers/dma/imx-sdma.c +index 0fc12a8783e39..99f3f22ed6476 100644 +--- a/drivers/dma/imx-sdma.c ++++ b/drivers/dma/imx-sdma.c +@@ -1441,6 +1441,14 @@ static void sdma_add_scripts(struct sdma_engine *sdma, + if (!sdma->script_number) + sdma->script_number = SDMA_SCRIPT_ADDRS_ARRAY_SIZE_V1; + ++ if (sdma->script_number > sizeof(struct sdma_script_start_addrs) ++ / sizeof(s32)) { ++ dev_err(sdma->dev, ++ "SDMA script number %d not match with firmware.\n", ++ sdma->script_number); ++ return; ++ } ++ + for (i = 0; i < sdma->script_number; i++) + if (addr_arr[i] > 0) + saddr_arr[i] = addr_arr[i]; +diff --git a/include/linux/platform_data/dma-imx-sdma.h b/include/linux/platform_data/dma-imx-sdma.h +index 6eaa53cef0bd2..30e676b36b247 100644 +--- a/include/linux/platform_data/dma-imx-sdma.h ++++ b/include/linux/platform_data/dma-imx-sdma.h +@@ -51,7 +51,10 @@ struct sdma_script_start_addrs { + /* End of v2 array */ + s32 zcanfd_2_mcu_addr; + s32 zqspi_2_mcu_addr; ++ s32 mcu_2_ecspi_addr; + /* End of v3 array */ ++ s32 mcu_2_zqspi_addr; ++ /* End of v4 array */ + }; + + /** +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-mv_xor-use-correct-device-for-dma-api.patch b/queue-4.14/dmaengine-mv_xor-use-correct-device-for-dma-api.patch new file mode 100644 index 00000000000..0f3417e8cca --- /dev/null +++ b/queue-4.14/dmaengine-mv_xor-use-correct-device-for-dma-api.patch @@ -0,0 +1,53 @@ +From 048bda76a6f02fedcffb98491486f46b72cfe04c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Feb 2019 18:27:06 +0000 +Subject: dmaengine: mv_xor: Use correct device for DMA API + +From: Robin Murphy + +[ Upstream commit 3e5daee5ecf314da33a890fabaa2404244cd2a36 ] + +Using dma_dev->dev for mappings before it's assigned with the correct +device is unlikely to work as expected, and with future dma-direct +changes, passing a NULL device may end up crashing entirely. I don't +know enough about this hardware or the mv_xor_prep_dma_interrupt() +operation to implement the appropriate error-handling logic that would +have revealed those dma_map_single() calls failing on arm64 for as long +as the driver has been enabled there, but moving the assignment earlier +will at least make the current code operate as intended. + +Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT") +Reported-by: John David Anglin +Tested-by: John David Anglin +Signed-off-by: Robin Murphy +Acked-by: Thomas Petazzoni +Tested-by: Thomas Petazzoni +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mv_xor.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c +index 1993889003fd1..1c57577f49fea 100644 +--- a/drivers/dma/mv_xor.c ++++ b/drivers/dma/mv_xor.c +@@ -1059,6 +1059,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev, + mv_chan->op_in_desc = XOR_MODE_IN_DESC; + + dma_dev = &mv_chan->dmadev; ++ dma_dev->dev = &pdev->dev; + mv_chan->xordev = xordev; + + /* +@@ -1091,7 +1092,6 @@ mv_xor_channel_add(struct mv_xor_device *xordev, + dma_dev->device_free_chan_resources = mv_xor_free_chan_resources; + dma_dev->device_tx_status = mv_xor_status; + dma_dev->device_issue_pending = mv_xor_issue_pending; +- dma_dev->dev = &pdev->dev; + + /* set prep routines based on capability */ + if (dma_has_cap(DMA_INTERRUPT, dma_dev->cap_mask)) +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-tegra210-adma-fix-crash-during-probe.patch b/queue-4.14/dmaengine-tegra210-adma-fix-crash-during-probe.patch new file mode 100644 index 00000000000..65ab8331943 --- /dev/null +++ b/queue-4.14/dmaengine-tegra210-adma-fix-crash-during-probe.patch @@ -0,0 +1,92 @@ +From 0e0eaa163b8438611c0b0c7ed8f205c072ae6abb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 May 2019 16:53:52 +0100 +Subject: dmaengine: tegra210-adma: Fix crash during probe + +From: Jon Hunter + +[ Upstream commit b53611fb1ce9b1786bd18205473e0c1d6bfa8934 ] + +Commit f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status") +added support to save and restore the DMA channel registers when runtime +suspending the ADMA. This change is causing the kernel to crash when +probing the ADMA, if the device is probed deferred when looking up the +channel interrupts. The crash occurs because not all of the channel base +addresses have been setup at this point and in the clean-up path of the +probe, pm_runtime_suspend() is called invoking its callback which +expects all the channel base addresses to be initialised. + +Although this could be fixed by simply checking for a NULL address, on +further review of the driver it seems more appropriate that we only call +pm_runtime_get_sync() after all the channel interrupts and base +addresses have been configured. Therefore, fix this crash by moving the +calls to pm_runtime_enable(), pm_runtime_get_sync() and +tegra_adma_init() after the DMA channels have been initialised. + +Fixes: f33e7bb3eb92 ("dmaengine: tegra210-adma: restore channel status") + +Signed-off-by: Jon Hunter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra210-adma.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index ac2a6b800db3e..4f4733d831a1a 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -744,16 +744,6 @@ static int tegra_adma_probe(struct platform_device *pdev) + return PTR_ERR(tdma->ahub_clk); + } + +- pm_runtime_enable(&pdev->dev); +- +- ret = pm_runtime_get_sync(&pdev->dev); +- if (ret < 0) +- goto rpm_disable; +- +- ret = tegra_adma_init(tdma); +- if (ret) +- goto rpm_put; +- + INIT_LIST_HEAD(&tdma->dma_dev.channels); + for (i = 0; i < tdma->nr_channels; i++) { + struct tegra_adma_chan *tdc = &tdma->channels[i]; +@@ -771,6 +761,16 @@ static int tegra_adma_probe(struct platform_device *pdev) + tdc->tdma = tdma; + } + ++ pm_runtime_enable(&pdev->dev); ++ ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret < 0) ++ goto rpm_disable; ++ ++ ret = tegra_adma_init(tdma); ++ if (ret) ++ goto rpm_put; ++ + dma_cap_set(DMA_SLAVE, tdma->dma_dev.cap_mask); + dma_cap_set(DMA_PRIVATE, tdma->dma_dev.cap_mask); + dma_cap_set(DMA_CYCLIC, tdma->dma_dev.cap_mask); +@@ -812,13 +812,13 @@ static int tegra_adma_probe(struct platform_device *pdev) + + dma_remove: + dma_async_device_unregister(&tdma->dma_dev); +-irq_dispose: +- while (--i >= 0) +- irq_dispose_mapping(tdma->channels[i].irq); + rpm_put: + pm_runtime_put_sync(&pdev->dev); + rpm_disable: + pm_runtime_disable(&pdev->dev); ++irq_dispose: ++ while (--i >= 0) ++ irq_dispose_mapping(tdma->channels[i].irq); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-tegra210-adma-restore-channel-status.patch b/queue-4.14/dmaengine-tegra210-adma-restore-channel-status.patch new file mode 100644 index 00000000000..253bd4ab6ab --- /dev/null +++ b/queue-4.14/dmaengine-tegra210-adma-restore-channel-status.patch @@ -0,0 +1,124 @@ +From c84f754f87875877140a2c3cc7d35d6f79845ee7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2019 18:25:17 +0530 +Subject: dmaengine: tegra210-adma: restore channel status + +From: Sameer Pujar + +[ Upstream commit f33e7bb3eb922618612a90f0a828c790e8880773 ] + +Status of ADMA channel registers is not saved and restored during system +suspend. During active playback if system enters suspend, this results in +wrong state of channel registers during system resume and playback fails +to resume properly. Fix this by saving following channel registers in +runtime suspend and restore during runtime resume. + * ADMA_CH_LOWER_SRC_ADDR + * ADMA_CH_LOWER_TRG_ADDR + * ADMA_CH_FIFO_CTRL + * ADMA_CH_CONFIG + * ADMA_CH_CTRL + * ADMA_CH_CMD + * ADMA_CH_TC +Runtime PM calls will be inovked during system resume path if a playback +or capture needs to be resumed. Hence above changes work fine for system +suspend case. + +Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA") +Signed-off-by: Sameer Pujar +Reviewed-by: Jon Hunter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/tegra210-adma.c | 46 ++++++++++++++++++++++++++++++++++++- + 1 file changed, 45 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/tegra210-adma.c b/drivers/dma/tegra210-adma.c +index 09b6756366c30..ac2a6b800db3e 100644 +--- a/drivers/dma/tegra210-adma.c ++++ b/drivers/dma/tegra210-adma.c +@@ -98,6 +98,7 @@ struct tegra_adma_chan_regs { + unsigned int src_addr; + unsigned int trg_addr; + unsigned int fifo_ctrl; ++ unsigned int cmd; + unsigned int tc; + }; + +@@ -127,6 +128,7 @@ struct tegra_adma_chan { + enum dma_transfer_direction sreq_dir; + unsigned int sreq_index; + bool sreq_reserved; ++ struct tegra_adma_chan_regs ch_regs; + + /* Transfer count and position info */ + unsigned int tx_buf_count; +@@ -635,8 +637,30 @@ static struct dma_chan *tegra_dma_of_xlate(struct of_phandle_args *dma_spec, + static int tegra_adma_runtime_suspend(struct device *dev) + { + struct tegra_adma *tdma = dev_get_drvdata(dev); ++ struct tegra_adma_chan_regs *ch_reg; ++ struct tegra_adma_chan *tdc; ++ int i; + + tdma->global_cmd = tdma_read(tdma, ADMA_GLOBAL_CMD); ++ if (!tdma->global_cmd) ++ goto clk_disable; ++ ++ for (i = 0; i < tdma->nr_channels; i++) { ++ tdc = &tdma->channels[i]; ++ ch_reg = &tdc->ch_regs; ++ ch_reg->cmd = tdma_ch_read(tdc, ADMA_CH_CMD); ++ /* skip if channel is not active */ ++ if (!ch_reg->cmd) ++ continue; ++ ch_reg->tc = tdma_ch_read(tdc, ADMA_CH_TC); ++ ch_reg->src_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_SRC_ADDR); ++ ch_reg->trg_addr = tdma_ch_read(tdc, ADMA_CH_LOWER_TRG_ADDR); ++ ch_reg->ctrl = tdma_ch_read(tdc, ADMA_CH_CTRL); ++ ch_reg->fifo_ctrl = tdma_ch_read(tdc, ADMA_CH_FIFO_CTRL); ++ ch_reg->config = tdma_ch_read(tdc, ADMA_CH_CONFIG); ++ } ++ ++clk_disable: + clk_disable_unprepare(tdma->ahub_clk); + + return 0; +@@ -645,7 +669,9 @@ static int tegra_adma_runtime_suspend(struct device *dev) + static int tegra_adma_runtime_resume(struct device *dev) + { + struct tegra_adma *tdma = dev_get_drvdata(dev); +- int ret; ++ struct tegra_adma_chan_regs *ch_reg; ++ struct tegra_adma_chan *tdc; ++ int ret, i; + + ret = clk_prepare_enable(tdma->ahub_clk); + if (ret) { +@@ -654,6 +680,24 @@ static int tegra_adma_runtime_resume(struct device *dev) + } + tdma_write(tdma, ADMA_GLOBAL_CMD, tdma->global_cmd); + ++ if (!tdma->global_cmd) ++ return 0; ++ ++ for (i = 0; i < tdma->nr_channels; i++) { ++ tdc = &tdma->channels[i]; ++ ch_reg = &tdc->ch_regs; ++ /* skip if channel was not active earlier */ ++ if (!ch_reg->cmd) ++ continue; ++ tdma_ch_write(tdc, ADMA_CH_TC, ch_reg->tc); ++ tdma_ch_write(tdc, ADMA_CH_LOWER_SRC_ADDR, ch_reg->src_addr); ++ tdma_ch_write(tdc, ADMA_CH_LOWER_TRG_ADDR, ch_reg->trg_addr); ++ tdma_ch_write(tdc, ADMA_CH_CTRL, ch_reg->ctrl); ++ tdma_ch_write(tdc, ADMA_CH_FIFO_CTRL, ch_reg->fifo_ctrl); ++ tdma_ch_write(tdc, ADMA_CH_CONFIG, ch_reg->config); ++ tdma_ch_write(tdc, ADMA_CH_CMD, ch_reg->cmd); ++ } ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-ti-edma-fix-missed-failure-handling.patch b/queue-4.14/dmaengine-ti-edma-fix-missed-failure-handling.patch new file mode 100644 index 00000000000..66bc9a2c550 --- /dev/null +++ b/queue-4.14/dmaengine-ti-edma-fix-missed-failure-handling.patch @@ -0,0 +1,41 @@ +From c4276df8167301b7ade0b47c1b44c8f4ebc95f49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 15:38:02 +0800 +Subject: dmaengine: ti: edma: fix missed failure handling + +From: Chuhong Yuan + +[ Upstream commit 340049d453682a9fe8d91fe794dd091730f4bb25 ] + +When devm_kcalloc fails, it forgets to call edma_free_slot. +Replace direct return with failure handler to fix it. + +Fixes: 1be5336bc7ba ("dmaengine: edma: New device tree binding") +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20191118073802.28424-1-hslester96@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/edma.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c +index 519c24465dea4..57a49fe713fdc 100644 +--- a/drivers/dma/edma.c ++++ b/drivers/dma/edma.c +@@ -2340,8 +2340,10 @@ static int edma_probe(struct platform_device *pdev) + + ecc->tc_list = devm_kcalloc(dev, ecc->num_tc, + sizeof(*ecc->tc_list), GFP_KERNEL); +- if (!ecc->tc_list) +- return -ENOMEM; ++ if (!ecc->tc_list) { ++ ret = -ENOMEM; ++ goto err_reg1; ++ } + + for (i = 0;; i++) { + ret = of_parse_phandle_with_fixed_args(node, "ti,tptcs", +-- +2.20.1 + diff --git a/queue-4.14/driver-core-do-not-resume-suppliers-under-device_lin.patch b/queue-4.14/driver-core-do-not-resume-suppliers-under-device_lin.patch new file mode 100644 index 00000000000..c2bc58f6cbe --- /dev/null +++ b/queue-4.14/driver-core-do-not-resume-suppliers-under-device_lin.patch @@ -0,0 +1,79 @@ +From 60cf8eab5241566e6bdb5919e39f8e2e2140b80e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Feb 2019 01:47:53 +0100 +Subject: driver core: Do not resume suppliers under device_links_write_lock() + +From: Rafael J. Wysocki + +[ Upstream commit 5db25c9eb893df8f6b93c1d97b8006d768e1b6f5 ] + +It is incorrect to call pm_runtime_get_sync() under +device_links_write_lock(), because it may end up trying to take +device_links_read_lock() while resuming the target device and that +will deadlock in the non-SRCU case, so avoid that by resuming the +supplier device in device_link_add() before calling +device_links_write_lock(). + +Fixes: 21d5c57b3726 ("PM / runtime: Use device links") +Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/core.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 2b0a1054535ce..93c2fc58013ed 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -180,11 +180,20 @@ struct device_link *device_link_add(struct device *consumer, + struct device *supplier, u32 flags) + { + struct device_link *link; ++ bool rpm_put_supplier = false; + + if (!consumer || !supplier || + ((flags & DL_FLAG_STATELESS) && (flags & DL_FLAG_AUTOREMOVE))) + return NULL; + ++ if (flags & DL_FLAG_PM_RUNTIME && flags & DL_FLAG_RPM_ACTIVE) { ++ if (pm_runtime_get_sync(supplier) < 0) { ++ pm_runtime_put_noidle(supplier); ++ return NULL; ++ } ++ rpm_put_supplier = true; ++ } ++ + device_links_write_lock(); + device_pm_lock(); + +@@ -209,13 +218,8 @@ struct device_link *device_link_add(struct device *consumer, + + if (flags & DL_FLAG_PM_RUNTIME) { + if (flags & DL_FLAG_RPM_ACTIVE) { +- if (pm_runtime_get_sync(supplier) < 0) { +- pm_runtime_put_noidle(supplier); +- kfree(link); +- link = NULL; +- goto out; +- } + link->rpm_active = true; ++ rpm_put_supplier = false; + } + pm_runtime_new_link(consumer); + /* +@@ -286,6 +290,10 @@ struct device_link *device_link_add(struct device *consumer, + out: + device_pm_unlock(); + device_links_write_unlock(); ++ ++ if (rpm_put_supplier) ++ pm_runtime_put(supplier); ++ + return link; + } + EXPORT_SYMBOL_GPL(device_link_add); +-- +2.20.1 + diff --git a/queue-4.14/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch b/queue-4.14/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch new file mode 100644 index 00000000000..724ce1a7b66 --- /dev/null +++ b/queue-4.14/driver-uio-fix-possible-memory-leak-in-__uio_registe.patch @@ -0,0 +1,41 @@ +From 2b9d0c07d9c3a1c32e9af4688be70011afa4f5c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 06:45:37 +0800 +Subject: driver: uio: fix possible memory leak in __uio_register_device + +From: Liu Jian + +[ Upstream commit 1a392b3de7c5747506b38fc14b2e79977d3c7770 ] + +'idev' is malloced in __uio_register_device() and leak free it before +leaving from the uio_get_minor() error handing case, it will cause +memory leak. + +Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") +Signed-off-by: Liu Jian +Reviewed-by: Hamish Martin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/uio/uio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index fb5c9701b1fbd..4e9b0ff79b131 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -939,8 +939,10 @@ int __uio_register_device(struct module *owner, + atomic_set(&idev->event, 0); + + ret = uio_get_minor(idev); +- if (ret) ++ if (ret) { ++ kfree(idev); + return ret; ++ } + + idev->dev.devt = MKDEV(uio_major, idev->minor); + idev->dev.class = &uio_class; +-- +2.20.1 + diff --git a/queue-4.14/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch b/queue-4.14/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch new file mode 100644 index 00000000000..13dffc8a234 --- /dev/null +++ b/queue-4.14/driver-uio-fix-possible-use-after-free-in-__uio_regi.patch @@ -0,0 +1,58 @@ +From bcd5a08c22efd307b112886068d7f7d6db75a7a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 06:45:38 +0800 +Subject: driver: uio: fix possible use-after-free in __uio_register_device + +From: Liu Jian + +[ Upstream commit 221a1f4ac12d2ab46246c160b2e00d1b1160d5d9 ] + +In uio_dev_add_attributes() error handing case, idev is used after +device_unregister(), in which 'idev' has been released, touch idev cause +use-after-free. + +Fixes: a93e7b331568 ("uio: Prevent device destruction while fds are open") +Signed-off-by: Liu Jian +Reviewed-by: Hamish Martin +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/uio/uio.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c +index 4e9b0ff79b131..7c18536a3742a 100644 +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -944,6 +944,7 @@ int __uio_register_device(struct module *owner, + return ret; + } + ++ device_initialize(&idev->dev); + idev->dev.devt = MKDEV(uio_major, idev->minor); + idev->dev.class = &uio_class; + idev->dev.parent = parent; +@@ -954,7 +955,7 @@ int __uio_register_device(struct module *owner, + if (ret) + goto err_device_create; + +- ret = device_register(&idev->dev); ++ ret = device_add(&idev->dev); + if (ret) + goto err_device_create; + +@@ -986,9 +987,10 @@ int __uio_register_device(struct module *owner, + err_request_irq: + uio_dev_del_attributes(idev); + err_uio_dev_add_attributes: +- device_unregister(&idev->dev); ++ device_del(&idev->dev); + err_device_create: + uio_free_minor(idev); ++ put_device(&idev->dev); + return ret; + } + EXPORT_SYMBOL_GPL(__uio_register_device); +-- +2.20.1 + diff --git a/queue-4.14/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch b/queue-4.14/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch new file mode 100644 index 00000000000..e6eff918a56 --- /dev/null +++ b/queue-4.14/drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch @@ -0,0 +1,44 @@ +From 3d2af266f25f6aaafb867da54593186a949585f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2019 16:29:33 -0800 +Subject: drivers/rapidio/rio_cm.c: fix potential oops in riocm_ch_listen() + +From: Dan Carpenter + +[ Upstream commit 5ac188b12e7cbdd92dee60877d1fac913fc1d074 ] + +If riocm_get_channel() fails, then we should just return -EINVAL. +Calling riocm_put_channel() will trigger a NULL dereference and +generally we should call put() if the get() didn't succeed. + +Link: http://lkml.kernel.org/r/20190110130230.GB27017@kadam +Fixes: b6e8d4aa1110 ("rapidio: add RapidIO channelized messaging driver") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrew Morton +Cc: Matt Porter +Cc: Alexandre Bounine +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/rapidio/rio_cm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c +index ef989a15aefc4..b29fc258eeba4 100644 +--- a/drivers/rapidio/rio_cm.c ++++ b/drivers/rapidio/rio_cm.c +@@ -1215,7 +1215,9 @@ static int riocm_ch_listen(u16 ch_id) + riocm_debug(CHOP, "(ch_%d)", ch_id); + + ch = riocm_get_channel(ch_id); +- if (!ch || !riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN)) ++ if (!ch) ++ return -EINVAL; ++ if (!riocm_cmp_exch(ch, RIO_CM_CHAN_BOUND, RIO_CM_LISTEN)) + ret = -EINVAL; + riocm_put_channel(ch); + return ret; +-- +2.20.1 + diff --git a/queue-4.14/drm-dp_mst-skip-validating-ports-during-destruction-.patch b/queue-4.14/drm-dp_mst-skip-validating-ports-during-destruction-.patch new file mode 100644 index 00000000000..cd100e10431 --- /dev/null +++ b/queue-4.14/drm-dp_mst-skip-validating-ports-during-destruction-.patch @@ -0,0 +1,90 @@ +From c0140d2eb318a51d41cd75822a372fc6bc4f0470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 17:46:14 -0500 +Subject: drm/dp_mst: Skip validating ports during destruction, just ref + +From: Lyude Paul + +[ Upstream commit c54c7374ff44de5e609506aca7c0deae4703b6d1 ] + +Jerry Zuo pointed out a rather obscure hotplugging issue that it seems I +accidentally introduced into DRM two years ago. + +Pretend we have a topology like this: + +|- DP-1: mst_primary + |- DP-4: active display + |- DP-5: disconnected + |- DP-6: active hub + |- DP-7: active display + |- DP-8: disconnected + |- DP-9: disconnected + +If we unplug DP-6, the topology starting at DP-7 will be destroyed but +it's payloads will live on in DP-1's VCPI allocations and thus require +removal. However, this removal currently fails because +drm_dp_update_payload_part1() will (rightly so) try to validate the port +before accessing it, fail then abort. If we keep going, eventually we +run the MST hub out of bandwidth and all new allocations will start to +fail (or in my case; all new displays just start flickering a ton). + +We could just teach drm_dp_update_payload_part1() not to drop the port +ref in this case, but then we also need to teach +drm_dp_destroy_payload_step1() to do the same thing, then hope no one +ever adds anything to the that requires a validated port reference in +drm_dp_destroy_connector_work(). Kind of sketchy. + +So let's go with a more clever solution: any port that +drm_dp_destroy_connector_work() interacts with is guaranteed to still +exist in memory until we say so. While said port might not be valid we +don't really care: that's the whole reason we're destroying it in the +first place! So, teach drm_dp_get_validated_port_ref() to use the all +mighty current_work() function to avoid attempting to validate ports +from the context of mgr->destroy_connector_work. I can't see any +situation where this wouldn't be safe, and this avoids having to play +whack-a-mole in the future of trying to work around port validation. + +Signed-off-by: Lyude Paul +Fixes: 263efde31f97 ("drm/dp/mst: Get validated port ref in drm_dp_update_payload_part1()") +Reported-by: Jerry Zuo +Cc: Jerry Zuo +Cc: Harry Wentland +Cc: # v4.6+ +Reviewed-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/20181113224613.28809-1-lyude@redhat.com +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index c8c83f84acedd..9d94c306c8ca1 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -982,9 +982,20 @@ static struct drm_dp_mst_port *drm_dp_mst_get_port_ref_locked(struct drm_dp_mst_ + static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port) + { + struct drm_dp_mst_port *rport = NULL; ++ + mutex_lock(&mgr->lock); +- if (mgr->mst_primary) +- rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port); ++ /* ++ * Port may or may not be 'valid' but we don't care about that when ++ * destroying the port and we are guaranteed that the port pointer ++ * will be valid until we've finished ++ */ ++ if (current_work() == &mgr->destroy_connector_work) { ++ kref_get(&port->kref); ++ rport = port; ++ } else if (mgr->mst_primary) { ++ rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, ++ port); ++ } + mutex_unlock(&mgr->lock); + return rport; + } +-- +2.20.1 + diff --git a/queue-4.14/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch b/queue-4.14/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch new file mode 100644 index 00000000000..dde776ec602 --- /dev/null +++ b/queue-4.14/drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch @@ -0,0 +1,36 @@ +From 43fc63afeccd4b8b35aca4ac829598db30d13ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jan 2019 13:49:46 +0300 +Subject: drm/etnaviv: NULL vs IS_ERR() buf in etnaviv_core_dump() + +From: Dan Carpenter + +[ Upstream commit f8261c376e7f8cb9024af5a6c54be540c7f9108e ] + +The etnaviv_gem_get_pages() never returns NULL. It returns error +pointers on error. + +Fixes: a8c21a5451d8 ("drm/etnaviv: add initial etnaviv DRM driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_dump.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +index 2d955d7d7b6d8..e154e6fb64dac 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c +@@ -207,7 +207,7 @@ void etnaviv_core_dump(struct etnaviv_gpu *gpu) + mutex_lock(&obj->lock); + pages = etnaviv_gem_get_pages(obj); + mutex_unlock(&obj->lock); +- if (pages) { ++ if (!IS_ERR(pages)) { + int j; + + iter.hdr->data[0] = bomap - bomap_start; +-- +2.20.1 + diff --git a/queue-4.14/drm-etnaviv-potential-null-dereference.patch b/queue-4.14/drm-etnaviv-potential-null-dereference.patch new file mode 100644 index 00000000000..775f29b6836 --- /dev/null +++ b/queue-4.14/drm-etnaviv-potential-null-dereference.patch @@ -0,0 +1,38 @@ +From 29061f400cf487a3a77a60c0b547dcacc1b6ce33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Feb 2019 12:08:19 +0300 +Subject: drm/etnaviv: potential NULL dereference + +From: Dan Carpenter + +[ Upstream commit 9e05352340d3a3e68c144136db9810b26ebb88c3 ] + +The etnaviv_gem_prime_get_sg_table() is supposed to return error +pointers. Otherwise it can lead to a NULL dereference when it's called +from drm_gem_map_dma_buf(). + +Fixes: 5f4a4a73f437 ("drm/etnaviv: fix gem_prime_get_sg_table to return new SG table") +Signed-off-by: Dan Carpenter +Reviewed-by: Christian Gmeiner +Signed-off-by: Lucas Stach +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +index ae884723e9b1b..880b95511b987 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gem_prime.c +@@ -26,7 +26,7 @@ struct sg_table *etnaviv_gem_prime_get_sg_table(struct drm_gem_object *obj) + int npages = obj->size >> PAGE_SHIFT; + + if (WARN_ON(!etnaviv_obj->pages)) /* should have already pinned! */ +- return NULL; ++ return ERR_PTR(-EINVAL); + + return drm_prime_pages_to_sg(etnaviv_obj->pages, npages); + } +-- +2.20.1 + diff --git a/queue-4.14/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch b/queue-4.14/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch new file mode 100644 index 00000000000..5808fe46790 --- /dev/null +++ b/queue-4.14/drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch @@ -0,0 +1,42 @@ +From 622e607e5abc7d8b28031807a6c67d2d1191716b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Sep 2018 01:25:26 +0800 +Subject: drm/hisilicon: hibmc: Don't overwrite fb helper surface depth + +From: John Garry + +[ Upstream commit 0ff9f49646353ce31312411e7e7bd2281492a40e ] + +Currently the driver overwrites the surface depth provided by the fb +helper to give an invalid bpp/surface depth combination. + +This has been exposed by commit 70109354fed2 ("drm: Reject unknown legacy +bpp and depth for drm_mode_addfb ioctl"), which now causes the driver to +fail to probe. + +Fix by not overwriting the surface depth. + +Fixes: d1667b86795a ("drm/hisilicon/hibmc: Add support for frame buffer") +Signed-off-by: John Garry +Reviewed-by: Xinliang Liu +Signed-off-by: Xinliang Liu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +index 8bd29075ae4eb..edcca17615001 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +@@ -71,7 +71,6 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper, + DRM_DEBUG_DRIVER("surface width(%d), height(%d) and bpp(%d)\n", + sizes->surface_width, sizes->surface_height, + sizes->surface_bpp); +- sizes->surface_depth = 32; + + bytes_per_pixel = DIV_ROUND_UP(sizes->surface_bpp, 8); + +-- +2.20.1 + diff --git a/queue-4.14/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch b/queue-4.14/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch new file mode 100644 index 00000000000..24c3b213b29 --- /dev/null +++ b/queue-4.14/drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch @@ -0,0 +1,60 @@ +From e88421de676a119c65265e43fabbe6fa53c1fe6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2019 09:09:47 -0700 +Subject: drm/msm/a3xx: remove TPL1 regs from snapshot + +From: Rob Clark + +[ Upstream commit f47bee2ba447bebc304111c16ef1e1a73a9744dd ] + +These regs are write-only, and the hw throws a hissy-fit (ie. reboots) +when we try to read them for GPU state snapshot, in response to a GPU +hang. It is rather impolite when GPU recovery triggers an insta- +reboot, so lets remove the TPL1 registers from the snapshot. + +Fixes: 7198e6b03155 drm/msm: add a3xx gpu support +Signed-off-by: Rob Clark +Reviewed-by: Jordan Crouse +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 24 +++++++++++------------- + 1 file changed, 11 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c +index 7791313405b5f..c8671b1578c66 100644 +--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c +@@ -394,19 +394,17 @@ static const unsigned int a3xx_registers[] = { + 0x2200, 0x2212, 0x2214, 0x2217, 0x221a, 0x221a, 0x2240, 0x227e, + 0x2280, 0x228b, 0x22c0, 0x22c0, 0x22c4, 0x22ce, 0x22d0, 0x22d8, + 0x22df, 0x22e6, 0x22e8, 0x22e9, 0x22ec, 0x22ec, 0x22f0, 0x22f7, +- 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2348, 0x2349, 0x2350, 0x2356, +- 0x2360, 0x2360, 0x2440, 0x2440, 0x2444, 0x2444, 0x2448, 0x244d, +- 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, 0x2472, 0x2472, +- 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, 0x24e4, 0x24ef, +- 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, 0x2510, 0x2511, +- 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, 0x25ec, 0x25ed, +- 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, 0x261a, 0x261a, +- 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, 0x26c4, 0x26ce, +- 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, 0x26ec, 0x26ec, +- 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, 0x2748, 0x2749, +- 0x2750, 0x2756, 0x2760, 0x2760, 0x300c, 0x300e, 0x301c, 0x301d, +- 0x302a, 0x302a, 0x302c, 0x302d, 0x3030, 0x3031, 0x3034, 0x3036, +- 0x303c, 0x303c, 0x305e, 0x305f, ++ 0x22ff, 0x22ff, 0x2340, 0x2343, 0x2440, 0x2440, 0x2444, 0x2444, ++ 0x2448, 0x244d, 0x2468, 0x2469, 0x246c, 0x246d, 0x2470, 0x2470, ++ 0x2472, 0x2472, 0x2474, 0x2475, 0x2479, 0x247a, 0x24c0, 0x24d3, ++ 0x24e4, 0x24ef, 0x2500, 0x2509, 0x250c, 0x250c, 0x250e, 0x250e, ++ 0x2510, 0x2511, 0x2514, 0x2515, 0x25e4, 0x25e4, 0x25ea, 0x25ea, ++ 0x25ec, 0x25ed, 0x25f0, 0x25f0, 0x2600, 0x2612, 0x2614, 0x2617, ++ 0x261a, 0x261a, 0x2640, 0x267e, 0x2680, 0x268b, 0x26c0, 0x26c0, ++ 0x26c4, 0x26ce, 0x26d0, 0x26d8, 0x26df, 0x26e6, 0x26e8, 0x26e9, ++ 0x26ec, 0x26ec, 0x26f0, 0x26f7, 0x26ff, 0x26ff, 0x2740, 0x2743, ++ 0x300c, 0x300e, 0x301c, 0x301d, 0x302a, 0x302a, 0x302c, 0x302d, ++ 0x3030, 0x3031, 0x3034, 0x3036, 0x303c, 0x303c, 0x305e, 0x305f, + ~0 /* sentinel */ + }; + +-- +2.20.1 + diff --git a/queue-4.14/drm-msm-dsi-implement-reset-correctly.patch b/queue-4.14/drm-msm-dsi-implement-reset-correctly.patch new file mode 100644 index 00000000000..78b885cd14d --- /dev/null +++ b/queue-4.14/drm-msm-dsi-implement-reset-correctly.patch @@ -0,0 +1,73 @@ +From 80081b7014eac8c56d265811223e8409f6373736 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 06:39:39 -0700 +Subject: drm/msm/dsi: Implement reset correctly + +From: Jeffrey Hugo + +[ Upstream commit 78e31c42261779a01bc73472d0f65f15378e9de3 ] + +On msm8998, vblank timeouts are observed because the DSI controller is not +reset properly, which ends up stalling the MDP. This is because the reset +logic is not correct per the hardware documentation. + +The documentation states that after asserting reset, software should wait +some time (no indication of how long), or poll the status register until it +returns 0 before deasserting reset. + +wmb() is insufficient for this purpose since it just ensures ordering, not +timing between writes. Since asserting and deasserting reset occurs on the +same register, ordering is already guaranteed by the architecture, making +the wmb extraneous. + +Since we would define a timeout for polling the status register to avoid a +possible infinite loop, lets just use a static delay of 20 ms, since 16.666 +ms is the time available to process one frame at 60 fps. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: Hai Li +Cc: Rob Clark +Signed-off-by: Jeffrey Hugo +Reviewed-by: Sean Paul +[seanpaul renamed RESET_DELAY to DSI_RESET_TOGGLE_DELAY_MS] +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20191011133939.16551-1-jeffrey.l.hugo@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/dsi_host.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index a9a0b56f1fbc5..b9cb7c09e05a6 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -34,6 +34,8 @@ + #include "dsi_cfg.h" + #include "msm_kms.h" + ++#define DSI_RESET_TOGGLE_DELAY_MS 20 ++ + static int dsi_get_version(const void __iomem *base, u32 *major, u32 *minor) + { + u32 ver; +@@ -906,7 +908,7 @@ static void dsi_sw_reset(struct msm_dsi_host *msm_host) + wmb(); /* clocks need to be enabled before reset */ + + dsi_write(msm_host, REG_DSI_RESET, 1); +- wmb(); /* make sure reset happen */ ++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */ + dsi_write(msm_host, REG_DSI_RESET, 0); + } + +@@ -1288,7 +1290,7 @@ static void dsi_sw_reset_restore(struct msm_dsi_host *msm_host) + + /* dsi controller can only be reset while clocks are running */ + dsi_write(msm_host, REG_DSI_RESET, 1); +- wmb(); /* make sure reset happen */ ++ msleep(DSI_RESET_TOGGLE_DELAY_MS); /* make sure reset happen */ + dsi_write(msm_host, REG_DSI_RESET, 0); + wmb(); /* controller out of reset */ + dsi_write(msm_host, REG_DSI_CTRL, data0); +-- +2.20.1 + diff --git a/queue-4.14/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch b/queue-4.14/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch new file mode 100644 index 00000000000..af09ca8bdae --- /dev/null +++ b/queue-4.14/drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch @@ -0,0 +1,39 @@ +From bb65c5b7b75930c1dd86363e0c409cefee5a93e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 08:00:30 -0700 +Subject: drm/msm/mdp5: Fix mdp5_cfg_init error return + +From: Jeffrey Hugo + +[ Upstream commit fc19cbb785d7bbd1a1af26229b5240a3ab332744 ] + +If mdp5_cfg_init fails because of an unknown major version, a null pointer +dereference occurs. This is because the caller of init expects error +pointers, but init returns NULL on error. Fix this by returning the +expected values on error. + +Fixes: 2e362e1772b8 (drm/msm/mdp5: introduce mdp5_cfg module) +Signed-off-by: Jeffrey Hugo +Reviewed-by: Bjorn Andersson +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c +index 824067d2d4277..42f0ecb0cf35f 100644 +--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c ++++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_cfg.c +@@ -635,7 +635,7 @@ fail: + if (cfg_handler) + mdp5_cfg_destroy(cfg_handler); + +- return NULL; ++ return ERR_PTR(ret); + } + + static struct mdp5_cfg_platform *mdp5_get_config(struct platform_device *dev) +-- +2.20.1 + diff --git a/queue-4.14/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch b/queue-4.14/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch new file mode 100644 index 00000000000..0feefa2e8c7 --- /dev/null +++ b/queue-4.14/drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch @@ -0,0 +1,43 @@ +From 996aa04b87f2b40d8667d23f367d711c5703960d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Nov 2018 17:09:18 +0000 +Subject: drm/nouveau/bios/ramcfg: fix missing parentheses when calculating RON + +From: Colin Ian King + +[ Upstream commit 13649101a25c53c87f4ab98a076dfe61f3636ab1 ] + +Currently, the expression for calculating RON is always going to result +in zero no matter the value of ram->mr[1] because the ! operator has +higher precedence than the shift >> operator. I believe the missing +parentheses around the expression before appying the ! operator will +result in the desired result. + +[ Note, not tested ] + +Detected by CoveritScan, CID#1324005 ("Operands don't affect result") + +Fixes: c25bf7b6155c ("drm/nouveau/bios/ramcfg: Separate out RON pull value") +Signed-off-by: Colin Ian King +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c +index 60ece0a8a2e1b..1d2d6bae73cd1 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/fb/gddr3.c +@@ -87,7 +87,7 @@ nvkm_gddr3_calc(struct nvkm_ram *ram) + WR = (ram->next->bios.timing[2] & 0x007f0000) >> 16; + /* XXX: Get these values from the VBIOS instead */ + DLL = !(ram->mr[1] & 0x1); +- RON = !(ram->mr[1] & 0x300) >> 8; ++ RON = !((ram->mr[1] & 0x300) >> 8); + break; + default: + return -ENOSYS; +-- +2.20.1 + diff --git a/queue-4.14/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch b/queue-4.14/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch new file mode 100644 index 00000000000..3f869326a1e --- /dev/null +++ b/queue-4.14/drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch @@ -0,0 +1,44 @@ +From 59ab8f784d9585d7aa4efdc15160706c4c69fa42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Dec 2018 15:29:49 +0000 +Subject: drm/nouveau/pmu: don't print reply values if exec is false + +From: Colin Ian King + +[ Upstream commit b1d03fc36ec9834465a08c275c8d563e07f6f6bf ] + +Currently the uninitialized values in the array reply are printed out +when exec is false and nvkm_pmu_send has not updated the array. Avoid +confusion by only dumping out these values if they have been actually +updated. + +Detected by CoverityScan, CID#1271291 ("Uninitialized scaler variable") +Fixes: ebb58dc2ef8c ("drm/nouveau/pmu: rename from pwr (no binary change)") + +Signed-off-by: Colin Ian King +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c +index 11b28b086a062..7b052879af728 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/memx.c +@@ -88,10 +88,10 @@ nvkm_memx_fini(struct nvkm_memx **pmemx, bool exec) + if (exec) { + nvkm_pmu_send(pmu, reply, PROC_MEMX, MEMX_MSG_EXEC, + memx->base, finish); ++ nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n", ++ reply[0], reply[1]); + } + +- nvkm_debug(subdev, "Exec took %uns, PMU_IN %08x\n", +- reply[0], reply[1]); + kfree(memx); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch b/queue-4.14/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch new file mode 100644 index 00000000000..7d6999c437d --- /dev/null +++ b/queue-4.14/drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch @@ -0,0 +1,77 @@ +From 3e0ea72a8669ee3005bb1389885363c6f8bd1f84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Nov 2019 10:53:53 +1100 +Subject: drm/radeon: fix bad DMA from INTERRUPT_CNTL2 + +From: Sam Bobroff + +[ Upstream commit 62d91dd2851e8ae2ca552f1b090a3575a4edf759 ] + +The INTERRUPT_CNTL2 register expects a valid DMA address, but is +currently set with a GPU MC address. This can cause problems on +systems that detect the resulting DMA read from an invalid address +(found on a Power8 guest). + +Instead, use the DMA address of the dummy page because it will always +be safe. + +Fixes: d8f60cfc9345 ("drm/radeon/kms: Add support for interrupts on r6xx/r7xx chips (v3)") +Fixes: 25a857fbe973 ("drm/radeon/kms: add support for interrupts on SI") +Fixes: a59781bbe528 ("drm/radeon: add support for interrupts on CIK (v5)") +Signed-off-by: Sam Bobroff +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/cik.c | 4 ++-- + drivers/gpu/drm/radeon/r600.c | 4 ++-- + drivers/gpu/drm/radeon/si.c | 4 ++-- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index ce8b353b5753a..ba31c7674fcdd 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -7012,8 +7012,8 @@ static int cik_irq_init(struct radeon_device *rdev) + } + + /* setup interrupt control */ +- /* XXX this should actually be a bus address, not an MC address. same on older asics */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index e06e2d8feab39..a724bb87cfad7 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3690,8 +3690,8 @@ int r600_irq_init(struct radeon_device *rdev) + } + + /* setup interrupt control */ +- /* set dummy read address to ring address */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index 1907c950d76f0..1144cafea9acd 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -5993,8 +5993,8 @@ static int si_irq_init(struct radeon_device *rdev) + } + + /* setup interrupt control */ +- /* set dummy read address to ring address */ +- WREG32(INTERRUPT_CNTL2, rdev->ih.gpu_addr >> 8); ++ /* set dummy read address to dummy page address */ ++ WREG32(INTERRUPT_CNTL2, rdev->dummy_page.addr >> 8); + interrupt_cntl = RREG32(INTERRUPT_CNTL); + /* IH_DUMMY_RD_OVERRIDE=0 - dummy read disabled with msi, enabled without msi + * IH_DUMMY_RD_OVERRIDE=1 - dummy read controlled by IH_DUMMY_RD_EN +-- +2.20.1 + diff --git a/queue-4.14/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch b/queue-4.14/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch new file mode 100644 index 00000000000..c6dc7c47c7f --- /dev/null +++ b/queue-4.14/drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch @@ -0,0 +1,42 @@ +From f3ddce731d0e5e3e0bfa77e3ceb16bcd24636105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Dec 2018 17:18:30 +0800 +Subject: drm/shmob: Fix return value check in shmob_drm_probe + +From: YueHaibing + +[ Upstream commit 06c3bbd3c12737a50c2e981821b5585e1786e73d ] + +In case of error, the function devm_ioremap_resource() returns ERR_PTR() +and never returns NULL. The NULL test in the return value check should +be replaced with IS_ERR(). + +Fixes: 8f1597c8f1a5 ("drm: shmobile: Perform initialization/cleanup at probe/remove time") +Signed-off-by: YueHaibing +Reviewed-by: Simon Horman +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/shmobile/shmob_drm_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c +index 592572554eb0e..58d8a98c749b4 100644 +--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c ++++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c +@@ -233,8 +233,8 @@ static int shmob_drm_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + sdev->mmio = devm_ioremap_resource(&pdev->dev, res); +- if (sdev->mmio == NULL) +- return -ENOMEM; ++ if (IS_ERR(sdev->mmio)) ++ return PTR_ERR(sdev->mmio); + + ret = shmob_drm_setup_clocks(sdev, pdata->clk_source); + if (ret < 0) +-- +2.20.1 + diff --git a/queue-4.14/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch b/queue-4.14/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch new file mode 100644 index 00000000000..5f5528dc70c --- /dev/null +++ b/queue-4.14/drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch @@ -0,0 +1,55 @@ +From 272fdae3eff7372a1d926085eac90372579540f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Aug 2018 08:19:09 +0200 +Subject: drm/sti: do not remove the drm_bridge that was never added + +From: Peter Rosin + +[ Upstream commit 66e31a72dc38543b2d9d1ce267dc78ba9beebcfd ] + +Removing the drm_bridge_remove call should avoid a NULL dereference +during list processing in drm_bridge_remove if the error path is ever +taken. + +The more natural approach would perhaps be to add a drm_bridge_add, +but there are several other bridges that never call drm_bridge_add. +Just removing the drm_bridge_remove is the easier fix. + +Fixes: 84601dbdea36 ("drm: sti: rework init sequence") +Acked-by: Daniel Vetter +Signed-off-by: Peter Rosin +Signed-off-by: Benjamin Gaignard +Link: https://patchwork.freedesktop.org/patch/msgid/20180806061910.29914-2-peda@axentia.se +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sti/sti_hda.c | 1 - + drivers/gpu/drm/sti/sti_hdmi.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/sti/sti_hda.c b/drivers/gpu/drm/sti/sti_hda.c +index cf65e32b5090a..0399bb18d3872 100644 +--- a/drivers/gpu/drm/sti/sti_hda.c ++++ b/drivers/gpu/drm/sti/sti_hda.c +@@ -721,7 +721,6 @@ static int sti_hda_bind(struct device *dev, struct device *master, void *data) + return 0; + + err_sysfs: +- drm_bridge_remove(bridge); + return -EINVAL; + } + +diff --git a/drivers/gpu/drm/sti/sti_hdmi.c b/drivers/gpu/drm/sti/sti_hdmi.c +index 30f02d2fdd034..bbb195a92e93f 100644 +--- a/drivers/gpu/drm/sti/sti_hdmi.c ++++ b/drivers/gpu/drm/sti/sti_hdmi.c +@@ -1314,7 +1314,6 @@ static int sti_hdmi_bind(struct device *dev, struct device *master, void *data) + return 0; + + err_sysfs: +- drm_bridge_remove(bridge); + hdmi->drm_connector = NULL; + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.14/drm-sun4i-hdmi-fix-double-flag-assignation.patch b/queue-4.14/drm-sun4i-hdmi-fix-double-flag-assignation.patch new file mode 100644 index 00000000000..7da025c3955 --- /dev/null +++ b/queue-4.14/drm-sun4i-hdmi-fix-double-flag-assignation.patch @@ -0,0 +1,42 @@ +From a47fc3e622e3f69e5a9d1b0af1548ea081cb2378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Oct 2018 18:34:46 +0200 +Subject: drm/sun4i: hdmi: Fix double flag assignation + +From: Maxime Ripard + +[ Upstream commit 1e0ff648940e603cab6c52cf3723017d30d78f30 ] + +The is_double flag is a boolean currently assigned to the value of the d +variable, that is either 1 or 2. It means that this is_double variable is +always set to true, even though the initial intent was to have it set to +true when d is 2. + +Fix this. + +Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") +Reported-by: Dan Carpenter +Signed-off-by: Maxime Ripard +Reviewed-by: Giulio Benetti +Link: https://patchwork.freedesktop.org/patch/msgid/20181021163446.29135-2-maxime.ripard@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c +index 5cf2527bffc86..d7a8fea945574 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_tmds_clk.c +@@ -50,7 +50,7 @@ static unsigned long sun4i_tmds_calc_divider(unsigned long rate, + (rate - tmp_rate) < (rate - best_rate)) { + best_rate = tmp_rate; + best_m = m; +- is_double = d; ++ is_double = (d == 2) ? true : false; + } + } + } +-- +2.20.1 + diff --git a/queue-4.14/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch b/queue-4.14/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch new file mode 100644 index 00000000000..cac0289f211 --- /dev/null +++ b/queue-4.14/drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch @@ -0,0 +1,55 @@ +From aa09b14aeaca15848dab17e2b0fb05870053c715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 12:42:50 +0300 +Subject: drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset() + +From: Dan Carpenter + +[ Upstream commit 09c4b49457434fa74749ad6194ef28464d9f5df9 ] + +This doesn't affect runtime because in the current code "idx" is always +valid. + +First, we read from "vgdev->capsets[idx].max_size" before checking +whether "idx" is within bounds. And secondly the bounds check is off by +one so we could end up reading one element beyond the end of the +vgdev->capsets[] array. + +Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support") +Signed-off-by: Dan Carpenter +Link: http://patchwork.freedesktop.org/patch/msgid/20180704094250.m7sgvvzg3dhcvv3h@kili.mountain +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_vq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c +index 21c2de81f3e32..a3be65e689fd2 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -648,11 +648,11 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev, + { + struct virtio_gpu_get_capset *cmd_p; + struct virtio_gpu_vbuffer *vbuf; +- int max_size = vgdev->capsets[idx].max_size; ++ int max_size; + struct virtio_gpu_drv_cap_cache *cache_ent; + void *resp_buf; + +- if (idx > vgdev->num_capsets) ++ if (idx >= vgdev->num_capsets) + return -EINVAL; + + if (version > vgdev->capsets[idx].max_version) +@@ -662,6 +662,7 @@ int virtio_gpu_cmd_get_capset(struct virtio_gpu_device *vgdev, + if (!cache_ent) + return -ENOMEM; + ++ max_size = vgdev->capsets[idx].max_size; + cache_ent->caps_cache = kmalloc(max_size, GFP_KERNEL); + if (!cache_ent->caps_cache) { + kfree(cache_ent); +-- +2.20.1 + diff --git a/queue-4.14/dwc2-gadget-fix-completed-transfer-size-calculation-.patch b/queue-4.14/dwc2-gadget-fix-completed-transfer-size-calculation-.patch new file mode 100644 index 00000000000..c514b64759a --- /dev/null +++ b/queue-4.14/dwc2-gadget-fix-completed-transfer-size-calculation-.patch @@ -0,0 +1,39 @@ +From 223fb18f5efa3293b697a1f41feb88fe73a0252c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Feb 2019 15:49:19 +0400 +Subject: dwc2: gadget: Fix completed transfer size calculation in DDMA + +From: Minas Harutyunyan + +[ Upstream commit 5acb4b970184d189d901192d075997c933b82260 ] + +Fix calculation of transfer size on completion in function +dwc2_gadget_get_xfersize_ddma(). + +Added increment of descriptor pointer to move to next descriptor in +the loop. + +Fixes: aa3e8bc81311 ("usb: dwc2: gadget: DDMA transfer start and complete") + +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index e164439b21542..4af9a1c652edb 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -2276,6 +2276,7 @@ static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep) + if (status & DEV_DMA_STS_MASK) + dev_err(hsotg->dev, "descriptor %d closed with %x\n", + i, status & DEV_DMA_STS_MASK); ++ desc++; + } + + return bytes_rem; +-- +2.20.1 + diff --git a/queue-4.14/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch b/queue-4.14/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch new file mode 100644 index 00000000000..42f78292621 --- /dev/null +++ b/queue-4.14/edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch @@ -0,0 +1,65 @@ +From f6f54143c6e7a864631bb0b81c016197e4ee8fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 May 2019 10:49:09 +0000 +Subject: EDAC/mc: Fix edac_mc_find() in case no device is found + +From: Robert Richter + +[ Upstream commit 29a0c843973bc385918158c6976e4dbe891df969 ] + +The function should return NULL in case no device is found, but it +always returns the last checked mc device from the list even if the +index did not match. Fix that. + +I did some analysis why this did not raise any issues for about 3 years +and the reason is that edac_mc_find() is mostly used to search for +existing devices. Thus, the bug is not triggered. + + [ bp: Drop the if (mci->mc_idx > idx) test in favor of readability. ] + +Fixes: c73e8833bec5 ("EDAC, mc: Fix locking around mc_devices list") +Signed-off-by: Robert Richter +Signed-off-by: Borislav Petkov +Cc: "linux-edac@vger.kernel.org" +Cc: James Morse +Cc: Mauro Carvalho Chehab +Link: https://lkml.kernel.org/r/20190514104838.15065-1-rrichter@marvell.com +Signed-off-by: Sasha Levin +--- + drivers/edac/edac_mc.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c +index f7fa05fee45a1..329021189c38b 100644 +--- a/drivers/edac/edac_mc.c ++++ b/drivers/edac/edac_mc.c +@@ -680,22 +680,18 @@ static int del_mc_from_global_list(struct mem_ctl_info *mci) + + struct mem_ctl_info *edac_mc_find(int idx) + { +- struct mem_ctl_info *mci = NULL; ++ struct mem_ctl_info *mci; + struct list_head *item; + + mutex_lock(&mem_ctls_mutex); + + list_for_each(item, &mc_devices) { + mci = list_entry(item, struct mem_ctl_info, link); +- +- if (mci->mc_idx >= idx) { +- if (mci->mc_idx == idx) { +- goto unlock; +- } +- break; +- } ++ if (mci->mc_idx == idx) ++ goto unlock; + } + ++ mci = NULL; + unlock: + mutex_unlock(&mem_ctls_mutex); + return mci; +-- +2.20.1 + diff --git a/queue-4.14/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch b/queue-4.14/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch new file mode 100644 index 00000000000..2e3eb622198 --- /dev/null +++ b/queue-4.14/ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch @@ -0,0 +1,38 @@ +From bddf10c971709c6af88790ff674527360807d518 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2019 15:47:59 +0800 +Subject: ehea: Fix a copy-paste err in ehea_init_port_res + +From: YueHaibing + +[ Upstream commit c8f191282f819ab4e9b47b22a65c6c29734cefce ] + +pr->tx_bytes should be assigned to tx_bytes other than +rx_bytes. + +Reported-by: Hulk Robot +Fixes: ce45b873028f ("ehea: Fixing statistics") +Signed-off-by: YueHaibing +Reviewed-by: Mukesh Ojha +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ehea/ehea_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index 30cbdf0fed595..373deb247ac01 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -1475,7 +1475,7 @@ static int ehea_init_port_res(struct ehea_port *port, struct ehea_port_res *pr, + + memset(pr, 0, sizeof(struct ehea_port_res)); + +- pr->tx_bytes = rx_bytes; ++ pr->tx_bytes = tx_bytes; + pr->tx_packets = tx_packets; + pr->rx_bytes = rx_bytes; + pr->rx_packets = rx_packets; +-- +2.20.1 + diff --git a/queue-4.14/exportfs-fix-passing-zero-to-err_ptr-warning.patch b/queue-4.14/exportfs-fix-passing-zero-to-err_ptr-warning.patch new file mode 100644 index 00000000000..89214caa4a3 --- /dev/null +++ b/queue-4.14/exportfs-fix-passing-zero-to-err_ptr-warning.patch @@ -0,0 +1,38 @@ +From a6b706622a48233eab809af18b0ebb99d95c49da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 11:32:41 +0800 +Subject: exportfs: fix 'passing zero to ERR_PTR()' warning + +From: YueHaibing + +[ Upstream commit 909e22e05353a783c526829427e9a8de122fba9c ] + +Fix a static code checker warning: + fs/exportfs/expfs.c:171 reconnect_one() warn: passing zero to 'ERR_PTR' + +The error path for lookup_one_len_unlocked failure +should set err to PTR_ERR. + +Fixes: bbf7a8a3562f ("exportfs: move most of reconnect_path to helper function") +Signed-off-by: YueHaibing +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/exportfs/expfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index a561ae17cf435..c08960040dd05 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -147,6 +147,7 @@ static struct dentry *reconnect_one(struct vfsmount *mnt, + tmp = lookup_one_len_unlocked(nbuf, parent, strlen(nbuf)); + if (IS_ERR(tmp)) { + dprintk("%s: lookup failed: %d\n", __func__, PTR_ERR(tmp)); ++ err = PTR_ERR(tmp); + goto out_err; + } + if (tmp != dentry) { +-- +2.20.1 + diff --git a/queue-4.14/ext4-set-error-return-correctly-when-ext4_htree_stor.patch b/queue-4.14/ext4-set-error-return-correctly-when-ext4_htree_stor.patch new file mode 100644 index 00000000000..3de535810c5 --- /dev/null +++ b/queue-4.14/ext4-set-error-return-correctly-when-ext4_htree_stor.patch @@ -0,0 +1,39 @@ +From a6c9e9163f82c9e1ad9f52b234c184444c49bcf3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Aug 2019 14:29:38 -0400 +Subject: ext4: set error return correctly when ext4_htree_store_dirent fails + +From: Colin Ian King + +[ Upstream commit 7a14826ede1d714f0bb56de8167c0e519041eeda ] + +Currently when the call to ext4_htree_store_dirent fails the error return +variable 'ret' is is not being set to the error code and variable count is +instead, hence the error code is not being returned. Fix this by assigning +ret to the error return code. + +Addresses-Coverity: ("Unused value") +Fixes: 8af0f0822797 ("ext4: fix readdir error in the case of inline_data+dir_index") +Signed-off-by: Colin Ian King +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/inline.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 137c752ab9853..6064bcb8572b3 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -1425,7 +1425,7 @@ int htree_inlinedir_to_tree(struct file *dir_file, + err = ext4_htree_store_dirent(dir_file, hinfo->hash, + hinfo->minor_hash, de, &tmp_str); + if (err) { +- count = err; ++ ret = err; + goto out; + } + count++; +-- +2.20.1 + diff --git a/queue-4.14/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch b/queue-4.14/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch new file mode 100644 index 00000000000..dfa23ee08c7 --- /dev/null +++ b/queue-4.14/fbdev-chipsfb-remove-set-but-not-used-variable-size.patch @@ -0,0 +1,51 @@ +From 94a3a811f2b9bac9ed3ca01b7343f5de1f09549f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Feb 2019 19:24:45 +0100 +Subject: fbdev: chipsfb: remove set but not used variable 'size' + +From: YueHaibing + +[ Upstream commit 8e71fa5e4d86bedfd26df85381d65d6b4c860020 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/video/fbdev/chipsfb.c: In function 'chipsfb_pci_init': +drivers/video/fbdev/chipsfb.c:352:22: warning: + variable 'size' set but not used [-Wunused-but-set-variable] + +Fixes: 8c8709334cec ("[PATCH] ppc32: Remove CONFIG_PMAC_PBOOK"). +Signed-off-by: YueHaibing +Acked-by: Michael Ellerman +Cc: Daniel Vetter +Cc: Christophe Leroy +[b.zolnierkie: minor commit summary and description fixups] +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/chipsfb.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c +index f103665cad431..f9b366d175875 100644 +--- a/drivers/video/fbdev/chipsfb.c ++++ b/drivers/video/fbdev/chipsfb.c +@@ -350,7 +350,7 @@ static void init_chips(struct fb_info *p, unsigned long addr) + static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent) + { + struct fb_info *p; +- unsigned long addr, size; ++ unsigned long addr; + unsigned short cmd; + int rc = -ENODEV; + +@@ -362,7 +362,6 @@ static int chipsfb_pci_init(struct pci_dev *dp, const struct pci_device_id *ent) + if ((dp->resource[0].flags & IORESOURCE_MEM) == 0) + goto err_disable; + addr = pci_resource_start(dp, 0); +- size = pci_resource_len(dp, 0); + if (addr == 0) + goto err_disable; + +-- +2.20.1 + diff --git a/queue-4.14/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch b/queue-4.14/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch new file mode 100644 index 00000000000..8dea42aa415 --- /dev/null +++ b/queue-4.14/fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch @@ -0,0 +1,38 @@ +From ba1873e42cf2f944dcaf785113bc069838688810 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jan 2019 07:58:38 -0600 +Subject: fs/nfs: Fix nfs_parse_devname to not modify it's argument + +From: Eric W. Biederman + +[ Upstream commit 40cc394be1aa18848b8757e03bd8ed23281f572e ] + +In the rare and unsupported case of a hostname list nfs_parse_devname +will modify dev_name. There is no need to modify dev_name as the all +that is being computed is the length of the hostname, so the computed +length can just be shorted. + +Fixes: dc04589827f7 ("NFS: Use common device name parsing logic for NFSv4 and NFSv2/v3") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index f464f8d9060c0..470b761839a51 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1925,7 +1925,7 @@ static int nfs_parse_devname(const char *dev_name, + /* kill possible hostname list: not supported */ + comma = strchr(dev_name, ','); + if (comma != NULL && comma < end) +- *comma = 0; ++ len = comma - dev_name; + } + + if (len > maxnamlen) +-- +2.20.1 + diff --git a/queue-4.14/hv_netvsc-flag-software-created-hash-value.patch b/queue-4.14/hv_netvsc-flag-software-created-hash-value.patch new file mode 100644 index 00000000000..2bd8bd53827 --- /dev/null +++ b/queue-4.14/hv_netvsc-flag-software-created-hash-value.patch @@ -0,0 +1,50 @@ +From e9a4003300f8f5848c2f239a8548befe5eb4fa72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 16:42:37 -0700 +Subject: hv_netvsc: flag software created hash value + +From: Stephen Hemminger + +[ Upstream commit df9f540ca74297a84bafacfa197e9347b20beea5 ] + +When the driver needs to create a hash value because it +was not done at higher level, then the hash should be marked +as a software not hardware hash. + +Fixes: f72860afa2e3 ("hv_netvsc: Exclude non-TCP port numbers from vRSS hashing") +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc_drv.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 9e48855f64074..14451e14d99dc 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -282,9 +282,9 @@ static inline u32 netvsc_get_hash( + else if (flow.basic.n_proto == htons(ETH_P_IPV6)) + hash = jhash2((u32 *)&flow.addrs.v6addrs, 8, hashrnd); + else +- hash = 0; ++ return 0; + +- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3); ++ __skb_set_sw_hash(skb, hash, false); + } + + return hash; +@@ -802,8 +802,7 @@ static struct sk_buff *netvsc_alloc_recv_skb(struct net_device *net, + skb->protocol == htons(ETH_P_IP)) + netvsc_comp_ipcsum(skb); + +- /* Do L4 checksum offload if enabled and present. +- */ ++ /* Do L4 checksum offload if enabled and present. */ + if (csum_info && (net->features & NETIF_F_RXCSUM)) { + if (csum_info->receive.tcp_checksum_succeeded || + csum_info->receive.udp_checksum_succeeded) +-- +2.20.1 + diff --git a/queue-4.14/hwmon-lm75-fix-write-operations-for-negative-tempera.patch b/queue-4.14/hwmon-lm75-fix-write-operations-for-negative-tempera.patch new file mode 100644 index 00000000000..354e5008261 --- /dev/null +++ b/queue-4.14/hwmon-lm75-fix-write-operations-for-negative-tempera.patch @@ -0,0 +1,40 @@ +From da303e946aa52aeb3ea574ff18f495f7d1a54113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 12:00:18 -0700 +Subject: hwmon: (lm75) Fix write operations for negative temperatures + +From: Guenter Roeck + +[ Upstream commit 7d82fcc9d9e81241778aaa22fda7be753e237d86 ] + +Writes into limit registers fail if the temperature written is negative. +The regmap write operation checks the value range, regmap_write accepts +an unsigned int as parameter, and the temperature value passed to +regmap_write is kept in a variable declared as long. Negative values +are converted large unsigned integers, which fails the range check. +Fix by type casting the temperature to u16 when calling regmap_write(). + +Cc: Iker Perez del Palomar Sustatxa +Fixes: e65365fed87f ("hwmon: (lm75) Convert to use regmap") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm75.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm75.c b/drivers/hwmon/lm75.c +index 005ffb5ffa92d..1737bb5fbaafe 100644 +--- a/drivers/hwmon/lm75.c ++++ b/drivers/hwmon/lm75.c +@@ -165,7 +165,7 @@ static int lm75_write(struct device *dev, enum hwmon_sensor_types type, + temp = DIV_ROUND_CLOSEST(temp << (resolution - 8), + 1000) << (16 - resolution); + +- return regmap_write(data->regmap, reg, temp); ++ return regmap_write(data->regmap, reg, (u16)temp); + } + + static umode_t lm75_is_visible(const void *data, enum hwmon_sensor_types type, +-- +2.20.1 + diff --git a/queue-4.14/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch b/queue-4.14/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch new file mode 100644 index 00000000000..d2ef9425400 --- /dev/null +++ b/queue-4.14/hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch @@ -0,0 +1,48 @@ +From 6afcf3efabcfb2b029b47925492c015c3e84b5f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 18 Feb 2019 19:54:40 +0000 +Subject: hwmon: (pmbus/tps53679) Fix driver info initialization in probe + routine + +From: Vadim Pasternak + +[ Upstream commit ff066653aeed8ee2d4dadb1e35774dd91ecbb19f ] + +Fix tps53679_probe() by using dynamically allocated "pmbus_driver_info" +structure instead of static. Usage of static structures causes +overwritten of the field "vrm_version", in case the system is equipped +with several tps53679 devices with the different "vrm_version". +In such case the last probed device overwrites this field for all +others. + +Fixes: 610526527a13 ("hwmon: (pmbus) Add support for Texas Instruments tps53679 device") +Signed-off-by: Vadim Pasternak +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/tps53679.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/tps53679.c b/drivers/hwmon/pmbus/tps53679.c +index 85b515cd9df0e..2bc352c5357f4 100644 +--- a/drivers/hwmon/pmbus/tps53679.c ++++ b/drivers/hwmon/pmbus/tps53679.c +@@ -80,7 +80,14 @@ static struct pmbus_driver_info tps53679_info = { + static int tps53679_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { +- return pmbus_do_probe(client, id, &tps53679_info); ++ struct pmbus_driver_info *info; ++ ++ info = devm_kmemdup(&client->dev, &tps53679_info, sizeof(*info), ++ GFP_KERNEL); ++ if (!info) ++ return -ENOMEM; ++ ++ return pmbus_do_probe(client, id, info); + } + + static const struct i2c_device_id tps53679_id[] = { +-- +2.20.1 + diff --git a/queue-4.14/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch b/queue-4.14/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch new file mode 100644 index 00000000000..2ae9c8517bf --- /dev/null +++ b/queue-4.14/hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch @@ -0,0 +1,39 @@ +From c4d4cd4b0ba84e1456ccd1c40f0ede138acdfb51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 01:45:54 +0000 +Subject: hwmon: (shtc1) fix shtc1 and shtw1 id mask + +From: Dan Robertson + +[ Upstream commit fdc7d8e829ec755c5cfb2f5a8d8c0cdfb664f895 ] + +Fix an error in the bitmaskfor the shtc1 and shtw1 bitmask used to +retrieve the chip ID from the ID register. See section 5.7 of the shtw1 +or shtc1 datasheet for details. + +Fixes: 1a539d372edd9832444e7a3daa710c444c014dc9 ("hwmon: add support for Sensirion SHTC1 sensor") +Signed-off-by: Dan Robertson +Link: https://lore.kernel.org/r/20190905014554.21658-3-dan@dlrobertson.com +[groeck: Reordered to be first in series and adjusted accordingly] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/shtc1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/shtc1.c b/drivers/hwmon/shtc1.c +index decd7df995abf..2a18539591eaf 100644 +--- a/drivers/hwmon/shtc1.c ++++ b/drivers/hwmon/shtc1.c +@@ -38,7 +38,7 @@ static const unsigned char shtc1_cmd_read_id_reg[] = { 0xef, 0xc8 }; + + /* constants for reading the ID register */ + #define SHTC1_ID 0x07 +-#define SHTC1_ID_REG_MASK 0x1f ++#define SHTC1_ID_REG_MASK 0x3f + + /* delays for non-blocking i2c commands, both in us */ + #define SHTC1_NONBLOCKING_WAIT_TIME_HPM 14400 +-- +2.20.1 + diff --git a/queue-4.14/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch b/queue-4.14/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch new file mode 100644 index 00000000000..bd411f2cd80 --- /dev/null +++ b/queue-4.14/hwmon-w83627hf-use-request_muxed_region-for-super-io.patch @@ -0,0 +1,121 @@ +From 796c473ee983fd37bb18d11325e3842c72606dd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Apr 2019 08:44:41 -0700 +Subject: hwmon: (w83627hf) Use request_muxed_region for Super-IO accesses + +From: Guenter Roeck + +[ Upstream commit e95fd518d05bfc087da6fcdea4900a57cfb083bd ] + +Super-IO accesses may fail on a system with no or unmapped LPC bus. + +Also, other drivers may attempt to access the LPC bus at the same time, +resulting in undefined behavior. + +Use request_muxed_region() to ensure that IO access on the requested +address space is supported, and to ensure that access by multiple drivers +is synchronized. + +Fixes: b72656dbc491 ("hwmon: (w83627hf) Stop using globals for I/O port numbers") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/w83627hf.c | 42 +++++++++++++++++++++++++++++++++++----- + 1 file changed, 37 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwmon/w83627hf.c b/drivers/hwmon/w83627hf.c +index 8ac89d0781ccc..a575e1cdb81a8 100644 +--- a/drivers/hwmon/w83627hf.c ++++ b/drivers/hwmon/w83627hf.c +@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data *sio, int ld) + outb(ld, sio->sioaddr + 1); + } + +-static inline void ++static inline int + superio_enter(struct w83627hf_sio_data *sio) + { ++ if (!request_muxed_region(sio->sioaddr, 2, DRVNAME)) ++ return -EBUSY; ++ + outb(0x87, sio->sioaddr); + outb(0x87, sio->sioaddr); ++ ++ return 0; + } + + static inline void + superio_exit(struct w83627hf_sio_data *sio) + { + outb(0xAA, sio->sioaddr); ++ release_region(sio->sioaddr, 2); + } + + #define W627_DEVID 0x52 +@@ -1278,7 +1284,7 @@ static DEVICE_ATTR_RO(name); + static int __init w83627hf_find(int sioaddr, unsigned short *addr, + struct w83627hf_sio_data *sio_data) + { +- int err = -ENODEV; ++ int err; + u16 val; + + static __initconst char *const names[] = { +@@ -1290,7 +1296,11 @@ static int __init w83627hf_find(int sioaddr, unsigned short *addr, + }; + + sio_data->sioaddr = sioaddr; +- superio_enter(sio_data); ++ err = superio_enter(sio_data); ++ if (err) ++ return err; ++ ++ err = -ENODEV; + val = force_id ? force_id : superio_inb(sio_data, DEVID); + switch (val) { + case W627_DEVID: +@@ -1644,9 +1654,21 @@ static int w83627thf_read_gpio5(struct platform_device *pdev) + struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev); + int res = 0xff, sel; + +- superio_enter(sio_data); ++ if (superio_enter(sio_data)) { ++ /* ++ * Some other driver reserved the address space for itself. ++ * We don't want to fail driver instantiation because of that, ++ * so display a warning and keep going. ++ */ ++ dev_warn(&pdev->dev, ++ "Can not read VID data: Failed to enable SuperIO access\n"); ++ return res; ++ } ++ + superio_select(sio_data, W83627HF_LD_GPIO5); + ++ res = 0xff; ++ + /* Make sure these GPIO pins are enabled */ + if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) { + dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n"); +@@ -1677,7 +1699,17 @@ static int w83687thf_read_vid(struct platform_device *pdev) + struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev); + int res = 0xff; + +- superio_enter(sio_data); ++ if (superio_enter(sio_data)) { ++ /* ++ * Some other driver reserved the address space for itself. ++ * We don't want to fail driver instantiation because of that, ++ * so display a warning and keep going. ++ */ ++ dev_warn(&pdev->dev, ++ "Can not read VID data: Failed to enable SuperIO access\n"); ++ return res; ++ } ++ + superio_select(sio_data, W83627HF_LD_HWM); + + /* Make sure these GPIO pins are enabled */ +-- +2.20.1 + diff --git a/queue-4.14/ib-hfi1-add-mtu-check-for-operational-data-vls.patch b/queue-4.14/ib-hfi1-add-mtu-check-for-operational-data-vls.patch new file mode 100644 index 00000000000..1f8c4295435 --- /dev/null +++ b/queue-4.14/ib-hfi1-add-mtu-check-for-operational-data-vls.patch @@ -0,0 +1,74 @@ +From 3870533dd7ea821412f7662a50e6d6f4ec4b2c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 10:56:03 -0700 +Subject: IB/hfi1: Add mtu check for operational data VLs + +From: Alex Estrin + +[ Upstream commit eb50130964e8c1379f37c3d3bab33a411ec62e98 ] + +Since Virtual Lanes BCT credits and MTU are set through separate MADs, we +have to ensure both are valid, and data VLs are ready for transmission +before we allow port transition to Armed state. + +Fixes: 5e2d6764a729 ("IB/hfi1: Verify port data VLs credits on transition to Armed") +Reviewed-by: Mike Marciniszyn +Reviewed-by: Michael J. Ruhl +Signed-off-by: Alex Estrin +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/chip.c | 26 ++++++++++++++++++++++---- + 1 file changed, 22 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 9f78bb07744c7..4a0b7c0034771 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -10552,12 +10552,29 @@ void set_link_down_reason(struct hfi1_pportdata *ppd, u8 lcl_reason, + } + } + +-/* +- * Verify if BCT for data VLs is non-zero. ++/** ++ * data_vls_operational() - Verify if data VL BCT credits and MTU ++ * are both set. ++ * @ppd: pointer to hfi1_pportdata structure ++ * ++ * Return: true - Ok, false -otherwise. + */ + static inline bool data_vls_operational(struct hfi1_pportdata *ppd) + { +- return !!ppd->actual_vls_operational; ++ int i; ++ u64 reg; ++ ++ if (!ppd->actual_vls_operational) ++ return false; ++ ++ for (i = 0; i < ppd->vls_supported; i++) { ++ reg = read_csr(ppd->dd, SEND_CM_CREDIT_VL + (8 * i)); ++ if ((reg && !ppd->dd->vld[i].mtu) || ++ (!reg && ppd->dd->vld[i].mtu)) ++ return false; ++ } ++ ++ return true; + } + + /* +@@ -10662,7 +10679,8 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + + if (!data_vls_operational(ppd)) { + dd_dev_err(dd, +- "%s: data VLs not operational\n", __func__); ++ "%s: Invalid data VL credits or mtu\n", ++ __func__); + ret = -EINVAL; + break; + } +-- +2.20.1 + diff --git a/queue-4.14/ib-iser-fix-dma_nents-type-definition.patch b/queue-4.14/ib-iser-fix-dma_nents-type-definition.patch new file mode 100644 index 00000000000..b5c65152c3b --- /dev/null +++ b/queue-4.14/ib-iser-fix-dma_nents-type-definition.patch @@ -0,0 +1,41 @@ +From 8fc9e3a018a8fc073bc0614f7118755b1d00e349 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Feb 2019 12:22:11 +0200 +Subject: IB/iser: Fix dma_nents type definition + +From: Max Gurtovoy + +[ Upstream commit c1545f1a200f4adc4ef8dd534bf33e2f1aa22c2f ] + +The retured value from ib_dma_map_sg saved in dma_nents variable. To avoid +future mismatch between types, define dma_nents as an integer instead of +unsigned. + +Fixes: 57b26497fabe ("IB/iser: Pass the correct number of entries for dma mapped SGL") +Reported-by: Dan Carpenter +Reviewed-by: Israel Rukshin +Signed-off-by: Max Gurtovoy +Acked-by: Sagi Grimberg +Reviewed-by: Dan Carpenter +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iscsi_iser.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h +index c1ae4aeae2f90..46dfc6ae9d1c1 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.h ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.h +@@ -197,7 +197,7 @@ struct iser_data_buf { + struct scatterlist *sg; + int size; + unsigned long data_len; +- unsigned int dma_nents; ++ int dma_nents; + }; + + /* fwd declarations */ +-- +2.20.1 + diff --git a/queue-4.14/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch b/queue-4.14/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch new file mode 100644 index 00000000000..c8b42c80a30 --- /dev/null +++ b/queue-4.14/ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch @@ -0,0 +1,61 @@ +From ca1b75264925d3792c00252eb7beb0473a85d9af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jan 2019 15:45:45 +0000 +Subject: IB/iser: Pass the correct number of entries for dma mapped SGL + +From: Israel Rukshin + +[ Upstream commit 57b26497fabe1b9379b59fbc7e35e608e114df16 ] + +ib_dma_map_sg() augments the SGL into a 'dma mapped SGL'. This process may +change the number of entries and the lengths of each entry. + +Code that touches dma_address is iterating over the 'dma mapped SGL' and +must use dma_nents which returned from ib_dma_map_sg(). + +ib_sg_to_pages() and ib_map_mr_sg() are using dma_address so they must use +dma_nents. + +Fixes: 39405885005a ("IB/iser: Port to new fast registration API") +Fixes: bfe066e256d5 ("IB/iser: Reuse ib_sg_to_pages") +Signed-off-by: Israel Rukshin +Reviewed-by: Max Gurtovoy +Acked-by: Sagi Grimberg +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iser_memory.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c +index 322209d5ff582..19883169e7b76 100644 +--- a/drivers/infiniband/ulp/iser/iser_memory.c ++++ b/drivers/infiniband/ulp/iser/iser_memory.c +@@ -240,8 +240,8 @@ int iser_fast_reg_fmr(struct iscsi_iser_task *iser_task, + page_vec->npages = 0; + page_vec->fake_mr.page_size = SIZE_4K; + plen = ib_sg_to_pages(&page_vec->fake_mr, mem->sg, +- mem->size, NULL, iser_set_page); +- if (unlikely(plen < mem->size)) { ++ mem->dma_nents, NULL, iser_set_page); ++ if (unlikely(plen < mem->dma_nents)) { + iser_err("page vec too short to hold this SG\n"); + iser_data_buf_dump(mem, device->ib_device); + iser_dump_page_vec(page_vec); +@@ -450,10 +450,10 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task, + + ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey)); + +- n = ib_map_mr_sg(mr, mem->sg, mem->size, NULL, SIZE_4K); +- if (unlikely(n != mem->size)) { ++ n = ib_map_mr_sg(mr, mem->sg, mem->dma_nents, NULL, SIZE_4K); ++ if (unlikely(n != mem->dma_nents)) { + iser_err("failed to map sg (%d/%d)\n", +- n, mem->size); ++ n, mem->dma_nents); + return n < 0 ? n : -EINVAL; + } + +-- +2.20.1 + diff --git a/queue-4.14/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch b/queue-4.14/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch new file mode 100644 index 00000000000..70c6c3a6882 --- /dev/null +++ b/queue-4.14/ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch @@ -0,0 +1,90 @@ +From b71144ffcc7800283139c268fc9a6231c160ab23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 08:38:30 +0300 +Subject: IB/mlx5: Add missing XRC options to QP optional params mask + +From: Jack Morgenstein + +[ Upstream commit 8f4426aa19fcdb9326ac44154a117b1a3a5ae126 ] + +The QP transition optional parameters for the various transition for XRC +QPs are identical to those for RC QPs. + +Many of the XRC QP transition optional parameter bits are missing from the +QP optional mask table. These omissions caused failures when doing XRC QP +state transitions. + +For example, when trying to change the response timer of an XRC receive QP +via the RTS2RTS transition, the new timer value was ignored because +MLX5_QP_OPTPAR_RNR_TIMEOUT bit was missing from the optional params mask +for XRC qps for the RTS2RTS transition. + +Fix this by adding the missing XRC optional parameters for all QP +transitions to the opt_mask table. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Fixes: a4774e9095de ("IB/mlx5: Fix opt param mask according to firmware spec") +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/qp.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 5a7dcb5afe6e3..84c962820aa2a 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2357,6 +2357,11 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_PKEY_INDEX | + MLX5_QP_OPTPAR_Q_KEY | + MLX5_QP_OPTPAR_PRI_PORT, ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE | ++ MLX5_QP_OPTPAR_RAE | ++ MLX5_QP_OPTPAR_RWE | ++ MLX5_QP_OPTPAR_PKEY_INDEX | ++ MLX5_QP_OPTPAR_PRI_PORT, + }, + [MLX5_QP_STATE_RTR] = { + [MLX5_QP_ST_RC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH | +@@ -2390,6 +2395,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q + MLX5_QP_OPTPAR_RWE | + MLX5_QP_OPTPAR_PM_STATE, + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY, ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_ALT_ADDR_PATH | ++ MLX5_QP_OPTPAR_RRE | ++ MLX5_QP_OPTPAR_RAE | ++ MLX5_QP_OPTPAR_RWE | ++ MLX5_QP_OPTPAR_PM_STATE | ++ MLX5_QP_OPTPAR_RNR_TIMEOUT, + }, + }, + [MLX5_QP_STATE_RTS] = { +@@ -2406,6 +2417,12 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q + [MLX5_QP_ST_UD] = MLX5_QP_OPTPAR_Q_KEY | + MLX5_QP_OPTPAR_SRQN | + MLX5_QP_OPTPAR_CQN_RCV, ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RRE | ++ MLX5_QP_OPTPAR_RAE | ++ MLX5_QP_OPTPAR_RWE | ++ MLX5_QP_OPTPAR_RNR_TIMEOUT | ++ MLX5_QP_OPTPAR_PM_STATE | ++ MLX5_QP_OPTPAR_ALT_ADDR_PATH, + }, + }, + [MLX5_QP_STATE_SQER] = { +@@ -2417,6 +2434,10 @@ static enum mlx5_qp_optpar opt_mask[MLX5_QP_NUM_STATE][MLX5_QP_NUM_STATE][MLX5_Q + MLX5_QP_OPTPAR_RWE | + MLX5_QP_OPTPAR_RAE | + MLX5_QP_OPTPAR_RRE, ++ [MLX5_QP_ST_XRC] = MLX5_QP_OPTPAR_RNR_TIMEOUT | ++ MLX5_QP_OPTPAR_RWE | ++ MLX5_QP_OPTPAR_RAE | ++ MLX5_QP_OPTPAR_RRE, + }, + }, + }; +-- +2.20.1 + diff --git a/queue-4.14/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch b/queue-4.14/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch new file mode 100644 index 00000000000..308d847bda1 --- /dev/null +++ b/queue-4.14/ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch @@ -0,0 +1,75 @@ +From c5705ced3108d70b48b1838508b95c5159f595eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Dec 2018 15:53:49 +0200 +Subject: IB/rxe: Fix incorrect cache cleanup in error flow + +From: Yuval Shaia + +[ Upstream commit 6db21d8986e14e2e86573a3b055b05296188bd2c ] + +Array iterator stays at the same slot, fix it. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Yuval Shaia +Reviewed-by: Bart Van Assche +Reviewed-by: Zhu Yanjun +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_pool.c | 26 ++++++++++++++------------ + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_pool.c b/drivers/infiniband/sw/rxe/rxe_pool.c +index b4a8acc7bb7d6..0e2425f282335 100644 +--- a/drivers/infiniband/sw/rxe/rxe_pool.c ++++ b/drivers/infiniband/sw/rxe/rxe_pool.c +@@ -112,6 +112,18 @@ static inline struct kmem_cache *pool_cache(struct rxe_pool *pool) + return rxe_type_info[pool->type].cache; + } + ++static void rxe_cache_clean(size_t cnt) ++{ ++ int i; ++ struct rxe_type_info *type; ++ ++ for (i = 0; i < cnt; i++) { ++ type = &rxe_type_info[i]; ++ kmem_cache_destroy(type->cache); ++ type->cache = NULL; ++ } ++} ++ + int rxe_cache_init(void) + { + int err; +@@ -136,24 +148,14 @@ int rxe_cache_init(void) + return 0; + + err1: +- while (--i >= 0) { +- kmem_cache_destroy(type->cache); +- type->cache = NULL; +- } ++ rxe_cache_clean(i); + + return err; + } + + void rxe_cache_exit(void) + { +- int i; +- struct rxe_type_info *type; +- +- for (i = 0; i < RXE_NUM_TYPES; i++) { +- type = &rxe_type_info[i]; +- kmem_cache_destroy(type->cache); +- type->cache = NULL; +- } ++ rxe_cache_clean(RXE_NUM_TYPES); + } + + static int rxe_pool_init_index(struct rxe_pool *pool, u32 max, u32 min) +-- +2.20.1 + diff --git a/queue-4.14/ib-rxe-replace-kvfree-with-vfree.patch b/queue-4.14/ib-rxe-replace-kvfree-with-vfree.patch new file mode 100644 index 00000000000..b5182119e53 --- /dev/null +++ b/queue-4.14/ib-rxe-replace-kvfree-with-vfree.patch @@ -0,0 +1,77 @@ +From cb0dde6168798056cb69e0558202530b74b6c221 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 01:57:42 -0400 +Subject: IB/rxe: replace kvfree with vfree + +From: Zhu Yanjun + +[ Upstream commit 721ad7e643f7002efa398838693f90284ea216d1 ] + +The buf is allocated by vmalloc_user in the function rxe_queue_init. +So it is better to free it by vfree. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Reviewed-by: Leon Romanovsky +Signed-off-by: Zhu Yanjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_cq.c | 4 ++-- + drivers/infiniband/sw/rxe/rxe_qp.c | 5 +++-- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_cq.c b/drivers/infiniband/sw/rxe/rxe_cq.c +index c4aabf78dc90f..f6e036ded046e 100644 +--- a/drivers/infiniband/sw/rxe/rxe_cq.c ++++ b/drivers/infiniband/sw/rxe/rxe_cq.c +@@ -30,7 +30,7 @@ + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ +- ++#include + #include "rxe.h" + #include "rxe_loc.h" + #include "rxe_queue.h" +@@ -97,7 +97,7 @@ int rxe_cq_from_init(struct rxe_dev *rxe, struct rxe_cq *cq, int cqe, + err = do_mmap_info(rxe, udata, false, context, cq->queue->buf, + cq->queue->buf_size, &cq->queue->ip); + if (err) { +- kvfree(cq->queue->buf); ++ vfree(cq->queue->buf); + kfree(cq->queue); + return err; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index aeea994b04c43..25055a68a2c07 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + #include "rxe.h" + #include "rxe_loc.h" +@@ -255,7 +256,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->sq.queue->buf_size, &qp->sq.queue->ip); + + if (err) { +- kvfree(qp->sq.queue->buf); ++ vfree(qp->sq.queue->buf); + kfree(qp->sq.queue); + return err; + } +@@ -308,7 +309,7 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, + qp->rq.queue->buf_size, + &qp->rq.queue->ip); + if (err) { +- kvfree(qp->rq.queue->buf); ++ vfree(qp->rq.queue->buf); + kfree(qp->rq.queue); + return err; + } +-- +2.20.1 + diff --git a/queue-4.14/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch b/queue-4.14/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch new file mode 100644 index 00000000000..f4ff6304024 --- /dev/null +++ b/queue-4.14/ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch @@ -0,0 +1,37 @@ +From ac1a4652a5cbf93430c9b81c77e840ea1d5ba0e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jan 2019 17:27:54 +0200 +Subject: IB/usnic: Fix out of bounds index check in query pkey + +From: Gal Pressman + +[ Upstream commit 4959d5da5737dd804255c75b8cea0a2929ce279a ] + +The pkey table size is one element, index should be tested for > 0 instead +of > 1. + +Fixes: e3cf00d0a87f ("IB/usnic: Add Cisco VIC low-level hardware driver") +Signed-off-by: Gal Pressman +Acked-by: Parvi Kaustubhi +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c +index fdfa25059723d..2602c7375d585 100644 +--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c ++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c +@@ -423,7 +423,7 @@ struct net_device *usnic_get_netdev(struct ib_device *device, u8 port_num) + int usnic_ib_query_pkey(struct ib_device *ibdev, u8 port, u16 index, + u16 *pkey) + { +- if (index > 1) ++ if (index > 0) + return -EINVAL; + + *pkey = 0xffff; +-- +2.20.1 + diff --git a/queue-4.14/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch b/queue-4.14/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch new file mode 100644 index 00000000000..94ff42981eb --- /dev/null +++ b/queue-4.14/iio-dac-ad5380-fix-incorrect-assignment-to-val.patch @@ -0,0 +1,39 @@ +From 1e00025ff4639e42623af18190edaf8ec1430896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Aug 2019 12:58:46 +0100 +Subject: iio: dac: ad5380: fix incorrect assignment to val + +From: Colin Ian King + +[ Upstream commit b1e18768ef1214c0a8048327918a182cabe09f9d ] + +Currently the pointer val is being incorrectly incremented +instead of the value pointed to by val. Fix this by adding +in the missing * indirection operator. + +Addresses-Coverity: ("Unused value") +Fixes: c03f2c536818 ("staging:iio:dac: Add AD5380 driver") +Signed-off-by: Colin Ian King +Reviewed-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/dac/ad5380.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c +index 97d2c5111f438..8bf7fc626a9d4 100644 +--- a/drivers/iio/dac/ad5380.c ++++ b/drivers/iio/dac/ad5380.c +@@ -221,7 +221,7 @@ static int ad5380_read_raw(struct iio_dev *indio_dev, + if (ret) + return ret; + *val >>= chan->scan_type.shift; +- val -= (1 << chan->scan_type.realbits) / 2; ++ *val -= (1 << chan->scan_type.realbits) / 2; + return IIO_VAL_INT; + case IIO_CHAN_INFO_SCALE: + *val = 2 * st->vref; +-- +2.20.1 + diff --git a/queue-4.14/inet-frags-call-inet_frags_fini-after-unregister_per.patch b/queue-4.14/inet-frags-call-inet_frags_fini-after-unregister_per.patch new file mode 100644 index 00000000000..c3c579baae4 --- /dev/null +++ b/queue-4.14/inet-frags-call-inet_frags_fini-after-unregister_per.patch @@ -0,0 +1,56 @@ +From c510681f12e525e49b6e5cb1c8e4bc1c5140390b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 May 2019 16:56:48 -0700 +Subject: inet: frags: call inet_frags_fini() after unregister_pernet_subsys() + +From: Eric Dumazet + +[ Upstream commit ae7352d384a552d8c799c242e74a934809990a71 ] + +Both IPv6 and 6lowpan are calling inet_frags_fini() too soon. + +inet_frags_fini() is dismantling a kmem_cache, that might be needed +later when unregister_pernet_subsys() eventually has to remove +frags queues from hash tables and free them. + +This fixes potential use-after-free, and is a prereq for the following patch. + +Fixes: d4ad4d22e7ac ("inet: frags: use kmem_cache for inet_frag_queue") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ieee802154/6lowpan/reassembly.c | 2 +- + net/ipv6/reassembly.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c +index ec7a5da561290..e873a6a007f2a 100644 +--- a/net/ieee802154/6lowpan/reassembly.c ++++ b/net/ieee802154/6lowpan/reassembly.c +@@ -634,7 +634,7 @@ err_sysctl: + + void lowpan_net_frag_exit(void) + { +- inet_frags_fini(&lowpan_frags); + lowpan_frags_sysctl_unregister(); + unregister_pernet_subsys(&lowpan_frags_ops); ++ inet_frags_fini(&lowpan_frags); + } +diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c +index fe797b29ca89d..6dea6e92e6863 100644 +--- a/net/ipv6/reassembly.c ++++ b/net/ipv6/reassembly.c +@@ -593,8 +593,8 @@ err_protocol: + + void ipv6_frag_exit(void) + { +- inet_frags_fini(&ip6_frags); + ip6_frags_sysctl_unregister(); + unregister_pernet_subsys(&ip6_frags_ops); + inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT); ++ inet_frags_fini(&ip6_frags); + } +-- +2.20.1 + diff --git a/queue-4.14/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch b/queue-4.14/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch new file mode 100644 index 00000000000..1191348739d --- /dev/null +++ b/queue-4.14/input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch @@ -0,0 +1,35 @@ +From 75736a3a0489bd3cc1a98540e2f55f17ad620cd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Dec 2018 00:38:30 -0800 +Subject: Input: nomadik-ske-keypad - fix a loop timeout test + +From: Dan Carpenter + +[ Upstream commit 4d8f727b83bcd6702c2d210330872c9122d2d360 ] + +The loop exits with "timeout" set to -1 not to 0. + +Fixes: 1158f0f16224 ("Input: add support for Nomadik SKE keypad controller") +Signed-off-by: Dan Carpenter +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/nomadik-ske-keypad.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/keyboard/nomadik-ske-keypad.c b/drivers/input/keyboard/nomadik-ske-keypad.c +index 8567ee47761e1..ae3b045570740 100644 +--- a/drivers/input/keyboard/nomadik-ske-keypad.c ++++ b/drivers/input/keyboard/nomadik-ske-keypad.c +@@ -100,7 +100,7 @@ static int __init ske_keypad_chip_init(struct ske_keypad *keypad) + while ((readl(keypad->reg_base + SKE_RIS) != 0x00000000) && timeout--) + cpu_relax(); + +- if (!timeout) ++ if (timeout == -1) + return -EINVAL; + + /* +-- +2.20.1 + diff --git a/queue-4.14/iommu-amd-make-iommu_disable-safer.patch b/queue-4.14/iommu-amd-make-iommu_disable-safer.patch new file mode 100644 index 00000000000..b1dc3ab5865 --- /dev/null +++ b/queue-4.14/iommu-amd-make-iommu_disable-safer.patch @@ -0,0 +1,40 @@ +From 1048252ef119dcf3576ba444ce436741bbdd4b5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2019 14:52:03 -0700 +Subject: iommu/amd: Make iommu_disable safer + +From: Kevin Mitchell + +[ Upstream commit 3ddbe913e55516d3e2165d43d4d5570761769878 ] + +Make it safe to call iommu_disable during early init error conditions +before mmio_base is set, but after the struct amd_iommu has been added +to the amd_iommu_list. For example, this happens if firmware fails to +fill in mmio_phys in the ACPI table leading to a NULL pointer +dereference in iommu_feature_disable. + +Fixes: 2c0ae1720c09c ('iommu/amd: Convert iommu initialization to state machine') +Signed-off-by: Kevin Mitchell +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 6a3cf4d0bd5e3..4d2920988d607 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -420,6 +420,9 @@ static void iommu_enable(struct amd_iommu *iommu) + + static void iommu_disable(struct amd_iommu *iommu) + { ++ if (!iommu->mmio_base) ++ return; ++ + /* Disable command buffer */ + iommu_feature_disable(iommu, CONTROL_CMDBUF_EN); + +-- +2.20.1 + diff --git a/queue-4.14/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch b/queue-4.14/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch new file mode 100644 index 00000000000..ffc8fca8889 --- /dev/null +++ b/queue-4.14/iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch @@ -0,0 +1,37 @@ +From 2ba153c74c0a7cf7b412b765341a05fb45004bed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2019 19:49:21 +0200 +Subject: iommu/amd: Wait for completion of IOTLB flush in attach_device + +From: Filippo Sironi + +[ Upstream commit 0b15e02f0cc4fb34a9160de7ba6db3a4013dc1b7 ] + +To make sure the domain tlb flush completes before the +function returns, explicitly wait for its completion. + +Signed-off-by: Filippo Sironi +Fixes: 42a49f965a8d ("amd-iommu: flush domain tlb when attaching a new device") +[joro: Added commit message and fixes tag] +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index d09c24825734e..778f167be2d35 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2160,6 +2160,8 @@ skip_ats_check: + */ + domain_flush_tlb_pde(domain); + ++ domain_flush_complete(domain); ++ + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.14/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch b/queue-4.14/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch new file mode 100644 index 00000000000..2cfed3e0494 --- /dev/null +++ b/queue-4.14/iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch @@ -0,0 +1,96 @@ +From 3b88dbca9213639d36d3e0926f069bf1b03c4ed6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Aug 2019 11:01:50 +0800 +Subject: iommu/mediatek: Fix iova_to_phys PA start for 4GB mode + +From: Yong Wu + +[ Upstream commit 76ce65464fcd2c21db84391572b7938b716aceb0 ] + +In M4U 4GB mode, the physical address is remapped as below: + +CPU Physical address: + +==================== + +0 1G 2G 3G 4G 5G +|---A---|---B---|---C---|---D---|---E---| ++--I/O--+------------Memory-------------+ + +IOMMU output physical address: + ============================= + + 4G 5G 6G 7G 8G + |---E---|---B---|---C---|---D---| + +------------Memory-------------+ + +The Region 'A'(I/O) can not be mapped by M4U; For Region 'B'/'C'/'D', the +bit32 of the CPU physical address always is needed to set, and for Region +'E', the CPU physical address keep as is. something looks like this: +CPU PA -> M4U OUTPUT PA +0x4000_0000 0x1_4000_0000 (Add bit32) +0x8000_0000 0x1_8000_0000 ... +0xc000_0000 0x1_c000_0000 ... +0x1_0000_0000 0x1_0000_0000 (No change) + +Additionally, the iommu consumers always use the CPU phyiscal address. + +The PA in the iova_to_phys that is got from v7s always is u32, But +from the CPU point of view, PA only need add BIT(32) when PA < 0x4000_0000. + +Fixes: 30e2fccf9512 ("iommu/mediatek: Enlarge the validate PA range +for 4GB mode") +Signed-off-by: Yong Wu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/mtk_iommu.c | 26 +++++++++++++++++++++++++- + 1 file changed, 25 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index c30f627004315..0f99e95a1a739 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -115,6 +115,30 @@ struct mtk_iommu_domain { + + static struct iommu_ops mtk_iommu_ops; + ++/* ++ * In M4U 4GB mode, the physical address is remapped as below: ++ * ++ * CPU Physical address: ++ * ==================== ++ * ++ * 0 1G 2G 3G 4G 5G ++ * |---A---|---B---|---C---|---D---|---E---| ++ * +--I/O--+------------Memory-------------+ ++ * ++ * IOMMU output physical address: ++ * ============================= ++ * ++ * 4G 5G 6G 7G 8G ++ * |---E---|---B---|---C---|---D---| ++ * +------------Memory-------------+ ++ * ++ * The Region 'A'(I/O) can NOT be mapped by M4U; For Region 'B'/'C'/'D', the ++ * bit32 of the CPU physical address always is needed to set, and for Region ++ * 'E', the CPU physical address keep as is. ++ * Additionally, The iommu consumers always use the CPU phyiscal address. ++ */ ++#define MTK_IOMMU_4GB_MODE_REMAP_BASE 0x40000000 ++ + static LIST_HEAD(m4ulist); /* List all the M4U HWs */ + + #define for_each_m4u(data) list_for_each_entry(data, &m4ulist, list) +@@ -404,7 +428,7 @@ static phys_addr_t mtk_iommu_iova_to_phys(struct iommu_domain *domain, + pa = dom->iop->iova_to_phys(dom->iop, iova); + spin_unlock_irqrestore(&dom->pgtlock, flags); + +- if (data->enable_4GB) ++ if (data->enable_4GB && pa < MTK_IOMMU_4GB_MODE_REMAP_BASE) + pa |= BIT_ULL(32); + + return pa; +-- +2.20.1 + diff --git a/queue-4.14/iommu-use-right-function-to-get-group-for-device.patch b/queue-4.14/iommu-use-right-function-to-get-group-for-device.patch new file mode 100644 index 00000000000..c76d4296bfc --- /dev/null +++ b/queue-4.14/iommu-use-right-function-to-get-group-for-device.patch @@ -0,0 +1,42 @@ +From 326270914a88e50390809ad02caa95fe37978762 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 15:27:35 +0800 +Subject: iommu: Use right function to get group for device + +From: Lu Baolu + +[ Upstream commit 57274ea25736496ee019a5c40479855b21888839 ] + +The iommu_group_get_for_dev() will allocate a group for a +device if it isn't in any group. This isn't the use case +in iommu_request_dm_for_dev(). Let's use iommu_group_get() +instead. + +Fixes: d290f1e70d85a ("iommu: Introduce iommu_request_dm_for_dev()") +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 4b761678a18bb..2c48a9d6d91e9 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -1856,9 +1856,9 @@ int iommu_request_dm_for_dev(struct device *dev) + int ret; + + /* Device must already be in a group before calling this function */ +- group = iommu_group_get_for_dev(dev); +- if (IS_ERR(group)) +- return PTR_ERR(group); ++ group = iommu_group_get(dev); ++ if (!group) ++ return -EINVAL; + + mutex_lock(&group->mutex); + +-- +2.20.1 + diff --git a/queue-4.14/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch b/queue-4.14/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch new file mode 100644 index 00000000000..bf892d0f4c8 --- /dev/null +++ b/queue-4.14/iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch @@ -0,0 +1,135 @@ +From 0c97da230c08fe8cdcdb510e1b1ff43d53a95807 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Jun 2019 08:53:31 +0200 +Subject: iommu/vt-d: Duplicate iommu_resv_region objects per device list + +From: Eric Auger + +[ Upstream commit 5f64ce5411b467f1cfea6c63e2494c22b773582b ] + +intel_iommu_get_resv_regions() aims to return the list of +reserved regions accessible by a given @device. However several +devices can access the same reserved memory region and when +building the list it is not safe to use a single iommu_resv_region +object, whose container is the RMRR. This iommu_resv_region must +be duplicated per device reserved region list. + +Let's remove the struct iommu_resv_region from the RMRR unit +and allocate the iommu_resv_region directly in +intel_iommu_get_resv_regions(). We hold the dmar_global_lock instead +of the rcu-lock to allow sleeping. + +Fixes: 0659b8dc45a6 ("iommu/vt-d: Implement reserved region get/put callbacks") +Signed-off-by: Eric Auger +Reviewed-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 34 +++++++++++++++++----------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 4fbd183d973ab..b48666849dbed 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -442,7 +442,6 @@ struct dmar_rmrr_unit { + u64 end_address; /* reserved end address */ + struct dmar_dev_scope *devices; /* target devices */ + int devices_cnt; /* target device count */ +- struct iommu_resv_region *resv; /* reserved region handle */ + }; + + struct dmar_atsr_unit { +@@ -4171,7 +4170,6 @@ static inline void init_iommu_pm_ops(void) {} + int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg) + { + struct acpi_dmar_reserved_memory *rmrr; +- int prot = DMA_PTE_READ|DMA_PTE_WRITE; + struct dmar_rmrr_unit *rmrru; + size_t length; + +@@ -4185,22 +4183,16 @@ int __init dmar_parse_one_rmrr(struct acpi_dmar_header *header, void *arg) + rmrru->end_address = rmrr->end_address; + + length = rmrr->end_address - rmrr->base_address + 1; +- rmrru->resv = iommu_alloc_resv_region(rmrr->base_address, length, prot, +- IOMMU_RESV_DIRECT); +- if (!rmrru->resv) +- goto free_rmrru; + + rmrru->devices = dmar_alloc_dev_scope((void *)(rmrr + 1), + ((void *)rmrr) + rmrr->header.length, + &rmrru->devices_cnt); + if (rmrru->devices_cnt && rmrru->devices == NULL) +- goto free_all; ++ goto free_rmrru; + + list_add(&rmrru->list, &dmar_rmrr_units); + + return 0; +-free_all: +- kfree(rmrru->resv); + free_rmrru: + kfree(rmrru); + out: +@@ -4418,7 +4410,6 @@ static void intel_iommu_free_dmars(void) + list_for_each_entry_safe(rmrru, rmrr_n, &dmar_rmrr_units, list) { + list_del(&rmrru->list); + dmar_free_dev_scope(&rmrru->devices, &rmrru->devices_cnt); +- kfree(rmrru->resv); + kfree(rmrru); + } + +@@ -5186,22 +5177,33 @@ static void intel_iommu_remove_device(struct device *dev) + static void intel_iommu_get_resv_regions(struct device *device, + struct list_head *head) + { ++ int prot = DMA_PTE_READ | DMA_PTE_WRITE; + struct iommu_resv_region *reg; + struct dmar_rmrr_unit *rmrr; + struct device *i_dev; + int i; + +- rcu_read_lock(); ++ down_read(&dmar_global_lock); + for_each_rmrr_units(rmrr) { + for_each_active_dev_scope(rmrr->devices, rmrr->devices_cnt, + i, i_dev) { ++ struct iommu_resv_region *resv; ++ size_t length; ++ + if (i_dev != device) + continue; + +- list_add_tail(&rmrr->resv->list, head); ++ length = rmrr->end_address - rmrr->base_address + 1; ++ resv = iommu_alloc_resv_region(rmrr->base_address, ++ length, prot, ++ IOMMU_RESV_DIRECT); ++ if (!resv) ++ break; ++ ++ list_add_tail(&resv->list, head); + } + } +- rcu_read_unlock(); ++ up_read(&dmar_global_lock); + + reg = iommu_alloc_resv_region(IOAPIC_RANGE_START, + IOAPIC_RANGE_END - IOAPIC_RANGE_START + 1, +@@ -5216,10 +5218,8 @@ static void intel_iommu_put_resv_regions(struct device *dev, + { + struct iommu_resv_region *entry, *next; + +- list_for_each_entry_safe(entry, next, head, list) { +- if (entry->type == IOMMU_RESV_MSI) +- kfree(entry); +- } ++ list_for_each_entry_safe(entry, next, head, list) ++ kfree(entry); + } + + #ifdef CONFIG_INTEL_IOMMU_SVM +-- +2.20.1 + diff --git a/queue-4.14/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch b/queue-4.14/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch new file mode 100644 index 00000000000..696111bc4dc --- /dev/null +++ b/queue-4.14/iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch @@ -0,0 +1,49 @@ +From dad2a5679eedc44e38d8b5dc96e0a2c6a6934558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2019 09:34:26 +0800 +Subject: iommu/vt-d: Make kernel parameter igfx_off work with vIOMMU + +From: Lu Baolu + +[ Upstream commit 5daab58043ee2bca861068e2595564828f3bc663 ] + +The kernel parameter igfx_off is used by users to disable +DMA remapping for the Intel integrated graphic device. It +was designed for bare metal cases where a dedicated IOMMU +is used for graphic. This doesn't apply to virtual IOMMU +case where an include-all IOMMU is used. This makes the +kernel parameter work with virtual IOMMU as well. + +Cc: Ashok Raj +Cc: Jacob Pan +Suggested-by: Kevin Tian +Fixes: c0771df8d5297 ("intel-iommu: Export a flag indicating that the IOMMU is used for iGFX.") +Signed-off-by: Lu Baolu +Tested-by: Zhenyu Wang +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 523d0889c2a4e..4fbd183d973ab 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3361,9 +3361,12 @@ static int __init init_dmars(void) + iommu_identity_mapping |= IDENTMAP_ALL; + + #ifdef CONFIG_INTEL_IOMMU_BROKEN_GFX_WA +- iommu_identity_mapping |= IDENTMAP_GFX; ++ dmar_map_gfx = 0; + #endif + ++ if (!dmar_map_gfx) ++ iommu_identity_mapping |= IDENTMAP_GFX; ++ + check_tylersburg_isoch(); + + if (iommu_identity_mapping) { +-- +2.20.1 + diff --git a/queue-4.14/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch b/queue-4.14/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch new file mode 100644 index 00000000000..9e28f4af120 --- /dev/null +++ b/queue-4.14/irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch @@ -0,0 +1,81 @@ +From 48adaae8cc442bc4b9d4ebd1b77db30a34fdf0e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2019 22:01:03 +0800 +Subject: irqchip/gic-v3-its: fix some definitions of inner cacheability + attributes + +From: Hongbo Yao + +[ Upstream commit 0f29456d08042134aff6e562d07a6365c841c4ad ] + +Some definitions of Inner Cacheability attibutes need to be corrected. + +Fixes: 8c828a535e29f ("irqchip/gicv3-its: Restore all cacheability attributes") +Signed-off-by: Hongbo Yao +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + include/linux/irqchip/arm-gic-v3.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h +index 845ff8c51564c..0fe1fdedb8a19 100644 +--- a/include/linux/irqchip/arm-gic-v3.h ++++ b/include/linux/irqchip/arm-gic-v3.h +@@ -152,7 +152,7 @@ + #define GICR_PROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nCnB) + #define GICR_PROPBASER_nC GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, nC) + #define GICR_PROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt) +-#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWt) ++#define GICR_PROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWb) + #define GICR_PROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWt) + #define GICR_PROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, WaWb) + #define GICR_PROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PROPBASER, INNER, RaWaWt) +@@ -179,7 +179,7 @@ + #define GICR_PENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nCnB) + #define GICR_PENDBASER_nC GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, nC) + #define GICR_PENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt) +-#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWt) ++#define GICR_PENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWb) + #define GICR_PENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWt) + #define GICR_PENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, WaWb) + #define GICR_PENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_PENDBASER, INNER, RaWaWt) +@@ -238,7 +238,7 @@ + #define GICR_VPROPBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nCnB) + #define GICR_VPROPBASER_nC GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, nC) + #define GICR_VPROPBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt) +-#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWt) ++#define GICR_VPROPBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWb) + #define GICR_VPROPBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWt) + #define GICR_VPROPBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, WaWb) + #define GICR_VPROPBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPROPBASER, INNER, RaWaWt) +@@ -264,7 +264,7 @@ + #define GICR_VPENDBASER_nCnB GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nCnB) + #define GICR_VPENDBASER_nC GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, nC) + #define GICR_VPENDBASER_RaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt) +-#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWt) ++#define GICR_VPENDBASER_RaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWb) + #define GICR_VPENDBASER_WaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWt) + #define GICR_VPENDBASER_WaWb GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, WaWb) + #define GICR_VPENDBASER_RaWaWt GIC_BASER_CACHEABILITY(GICR_VPENDBASER, INNER, RaWaWt) +@@ -337,7 +337,7 @@ + #define GITS_CBASER_nCnB GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nCnB) + #define GITS_CBASER_nC GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, nC) + #define GITS_CBASER_RaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt) +-#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWt) ++#define GITS_CBASER_RaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWb) + #define GITS_CBASER_WaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWt) + #define GITS_CBASER_WaWb GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, WaWb) + #define GITS_CBASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_CBASER, INNER, RaWaWt) +@@ -361,7 +361,7 @@ + #define GITS_BASER_nCnB GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nCnB) + #define GITS_BASER_nC GIC_BASER_CACHEABILITY(GITS_BASER, INNER, nC) + #define GITS_BASER_RaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt) +-#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWt) ++#define GITS_BASER_RaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWb) + #define GITS_BASER_WaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWt) + #define GITS_BASER_WaWb GIC_BASER_CACHEABILITY(GITS_BASER, INNER, WaWb) + #define GITS_BASER_RaWaWt GIC_BASER_CACHEABILITY(GITS_BASER, INNER, RaWaWt) +-- +2.20.1 + diff --git a/queue-4.14/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch b/queue-4.14/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch new file mode 100644 index 00000000000..4345d825fff --- /dev/null +++ b/queue-4.14/irqdomain-add-the-missing-assignment-of-domain-fwnod.patch @@ -0,0 +1,61 @@ +From a7118888441517b136ec15a803c398fba2d705ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2019 23:14:56 +0000 +Subject: irqdomain: Add the missing assignment of domain->fwnode for named + fwnode + +From: Dexuan Cui + +[ Upstream commit 711419e504ebd68c8f03656616829c8ad7829389 ] + +Recently device pass-through stops working for Linux VM running on Hyper-V. + +git-bisect shows the regression is caused by the recent commit +467a3bb97432 ("PCI: hv: Allocate a named fwnode ..."), but the root cause +is that the commit d59f6617eef0 forgets to set the domain->fwnode for +IRQCHIP_FWNODE_NAMED*, and as a result: + +1. The domain->fwnode remains to be NULL. + +2. irq_find_matching_fwspec() returns NULL since "h->fwnode == fwnode" is +false, and pci_set_bus_msi_domain() sets the Hyper-V PCI root bus's +msi_domain to NULL. + +3. When the device is added onto the root bus, the device's dev->msi_domain +is set to NULL in pci_set_msi_domain(). + +4. When a device driver tries to enable MSI-X, pci_msi_setup_msi_irqs() +calls arch_setup_msi_irqs(), which uses the native MSI chip (i.e. +arch/x86/kernel/apic/msi.c: pci_msi_controller) to set up the irqs, but +actually pci_msi_setup_msi_irqs() is supposed to call +msi_domain_alloc_irqs() with the hbus->irq_domain, which is created in +hv_pcie_init_irq_domain() and is associated with the Hyper-V chip +hv_msi_irq_chip. Consequently, the irq line is not properly set up, and +the device driver can not receive any interrupt. + +Fixes: d59f6617eef0 ("genirq: Allow fwnode to carry name information only") +Fixes: 467a3bb97432 ("PCI: hv: Allocate a named fwnode instead of an address-based one") +Reported-by: Lili Deng +Signed-off-by: Dexuan Cui +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/PU1P153MB01694D9AF625AC335C600C5FBFBE0@PU1P153MB0169.APCP153.PROD.OUTLOOK.COM +Signed-off-by: Sasha Levin +--- + kernel/irq/irqdomain.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index ac4644e92b499..0f0e7975a3093 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -147,6 +147,7 @@ struct irq_domain *__irq_domain_add(struct fwnode_handle *fwnode, int size, + switch (fwid->type) { + case IRQCHIP_FWNODE_NAMED: + case IRQCHIP_FWNODE_NAMED_ID: ++ domain->fwnode = fwnode; + domain->name = kstrdup(fwid->name, GFP_KERNEL); + if (!domain->name) { + kfree(domain); +-- +2.20.1 + diff --git a/queue-4.14/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch b/queue-4.14/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch new file mode 100644 index 00000000000..93fde53fbcf --- /dev/null +++ b/queue-4.14/iw_cxgb4-use-tos-when-finding-ipv6-routes.patch @@ -0,0 +1,46 @@ +From 0b0b4e474a8120ace95d52fdc93cb5d19b0c1ba1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Feb 2019 12:44:53 -0800 +Subject: iw_cxgb4: use tos when finding ipv6 routes + +From: Steve Wise + +[ Upstream commit c8a7eb554a83214c3d8ee5cb322da8c72810d2dc ] + +When IPv6 support was added, the correct tos was not passed to +cxgb_find_route6(). This potentially results in the wrong route entry. + +Fixes: 830662f6f032 ("RDMA/cxgb4: Add support for active and passive open connection with IPv6 address") +Signed-off-by: Steve Wise +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 942403e42dd0f..7eb1cc1b1aa04 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2147,7 +2147,8 @@ static int c4iw_reconnect(struct c4iw_ep *ep) + laddr6->sin6_addr.s6_addr, + raddr6->sin6_addr.s6_addr, + laddr6->sin6_port, +- raddr6->sin6_port, 0, ++ raddr6->sin6_port, ++ ep->com.cm_id->tos, + raddr6->sin6_scope_id); + iptype = 6; + ra = (__u8 *)&raddr6->sin6_addr; +@@ -3298,7 +3299,7 @@ int c4iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + laddr6->sin6_addr.s6_addr, + raddr6->sin6_addr.s6_addr, + laddr6->sin6_port, +- raddr6->sin6_port, 0, ++ raddr6->sin6_port, cm_id->tos, + raddr6->sin6_scope_id); + } + if (!ep->dst) { +-- +2.20.1 + diff --git a/queue-4.14/iw_cxgb4-use-tos-when-importing-the-endpoint.patch b/queue-4.14/iw_cxgb4-use-tos-when-importing-the-endpoint.patch new file mode 100644 index 00000000000..354c930bc22 --- /dev/null +++ b/queue-4.14/iw_cxgb4-use-tos-when-importing-the-endpoint.patch @@ -0,0 +1,35 @@ +From a146a6a50ee308615230c93bef8f89e9aa3484a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Feb 2019 12:44:41 -0800 +Subject: iw_cxgb4: use tos when importing the endpoint + +From: Steve Wise + +[ Upstream commit cb3ba0bde881f0cb7e3945d2a266901e2bd18c92 ] + +import_ep() is passed the correct tos, but doesn't use it correctly. + +Fixes: ac8e4c69a021 ("cxgb4/iw_cxgb4: TOS support") +Signed-off-by: Steve Wise +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 3668cc71b47e2..942403e42dd0f 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2056,7 +2056,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip, + } else { + pdev = get_real_dev(n->dev); + ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t, +- n, pdev, 0); ++ n, pdev, rt_tos2priority(tos)); + if (!ep->l2t) + goto out; + ep->mtu = dst_mtu(dst); +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-mvm-avoid-possible-access-out-of-array.patch b/queue-4.14/iwlwifi-mvm-avoid-possible-access-out-of-array.patch new file mode 100644 index 00000000000..77317a41fc5 --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-avoid-possible-access-out-of-array.patch @@ -0,0 +1,66 @@ +From e50b3c5d44ec48bb4c4b7d912fb3b67ac4f9fa9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 21 Oct 2018 18:27:26 +0300 +Subject: iwlwifi: mvm: avoid possible access out of array. + +From: Mordechay Goodstein + +[ Upstream commit b0d795a9ae558209656b18930c2b4def5f8fdfb8 ] + +The value in txq_id can be out of array scope, +validate it before accessing the array. + +Signed-off-by: Mordechay Goodstein +Fixes: cf961e16620f ("iwlwifi: mvm: support dqa-mode agg on non-shared queue") +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 0cfdbaa2af3a7..684c0f65a0528 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -2417,7 +2417,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct iwl_mvm_tid_data *tid_data; + u16 normalized_ssn; +- int txq_id; ++ u16 txq_id; + int ret; + + if (WARN_ON_ONCE(tid >= IWL_MAX_TID_COUNT)) +@@ -2452,17 +2452,24 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + */ + txq_id = mvmsta->tid_data[tid].txq_id; + if (txq_id == IWL_MVM_INVALID_QUEUE) { +- txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id, +- IWL_MVM_DQA_MIN_DATA_QUEUE, +- IWL_MVM_DQA_MAX_DATA_QUEUE); +- if (txq_id < 0) { +- ret = txq_id; ++ ret = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id, ++ IWL_MVM_DQA_MIN_DATA_QUEUE, ++ IWL_MVM_DQA_MAX_DATA_QUEUE); ++ if (ret < 0) { + IWL_ERR(mvm, "Failed to allocate agg queue\n"); + goto release_locks; + } + ++ txq_id = ret; ++ + /* TXQ hasn't yet been enabled, so mark it only as reserved */ + mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED; ++ } else if (WARN_ON(txq_id >= IWL_MAX_HW_QUEUES)) { ++ ret = -ENXIO; ++ IWL_ERR(mvm, "tid_id %d out of range (0, %d)!\n", ++ tid, IWL_MAX_HW_QUEUES - 1); ++ goto out; ++ + } else if (unlikely(mvm->queue_info[txq_id].status == + IWL_MVM_QUEUE_SHARED)) { + ret = -ENXIO; +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch b/queue-4.14/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch new file mode 100644 index 00000000000..f0425539192 --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch @@ -0,0 +1,50 @@ +From d2197322582bf0aa1d3bccd34cc2876f8ed60b62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 09:51:56 +0100 +Subject: iwlwifi: mvm: fix A-MPDU reference assignment + +From: Johannes Berg + +[ Upstream commit 1f7698abedeeb3fef3cbcf78e16f925df675a179 ] + +The current code assigns the reference, and then goes to increment +it if the toggle bit has changed. That way, we get + +Toggle 0 0 0 0 1 1 1 1 +ID 1 1 1 1 1 2 2 2 + +Fix that by assigning the post-toggle ID to get + +Toggle 0 0 0 0 1 1 1 1 +ID 1 1 1 1 2 2 2 2 + +Reported-by: Danny Alexander +Signed-off-by: Johannes Berg +Fixes: fbe4112791b8 ("iwlwifi: mvm: update mpdu metadata API") +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 7fb8bbaf21420..1a12e829e98b0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -871,12 +871,12 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, + bool toggle_bit = phy_info & IWL_RX_MPDU_PHY_AMPDU_TOGGLE; + + rx_status->flag |= RX_FLAG_AMPDU_DETAILS; +- rx_status->ampdu_reference = mvm->ampdu_ref; + /* toggle is switched whenever new aggregation starts */ + if (toggle_bit != mvm->ampdu_toggle) { + mvm->ampdu_ref++; + mvm->ampdu_toggle = toggle_bit; + } ++ rx_status->ampdu_reference = mvm->ampdu_ref; + } + + rcu_read_lock(); +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-mvm-fix-rss-config-command.patch b/queue-4.14/iwlwifi-mvm-fix-rss-config-command.patch new file mode 100644 index 00000000000..3382c3fea4c --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-fix-rss-config-command.patch @@ -0,0 +1,46 @@ +From da8c2589feef6c0902d6da77b3e53420870e003a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 09:45:11 +0200 +Subject: iwlwifi: mvm: fix RSS config command + +From: Sara Sharon + +[ Upstream commit 608dce95db10b8ee1a26dbce3f60204bb69812a5 ] + +The hash mask is a bitmap, so we should use BIT() on +the enum values. + +Signed-off-by: Sara Sharon +Fixes: 43413a975d06 ("iwlwifi: mvm: support rss queues configuration command") +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 78228f870f8f5..754dcc1c1f400 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -107,12 +107,12 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm) + int i; + struct iwl_rss_config_cmd cmd = { + .flags = cpu_to_le32(IWL_RSS_ENABLE), +- .hash_mask = IWL_RSS_HASH_TYPE_IPV4_TCP | +- IWL_RSS_HASH_TYPE_IPV4_UDP | +- IWL_RSS_HASH_TYPE_IPV4_PAYLOAD | +- IWL_RSS_HASH_TYPE_IPV6_TCP | +- IWL_RSS_HASH_TYPE_IPV6_UDP | +- IWL_RSS_HASH_TYPE_IPV6_PAYLOAD, ++ .hash_mask = BIT(IWL_RSS_HASH_TYPE_IPV4_TCP) | ++ BIT(IWL_RSS_HASH_TYPE_IPV4_UDP) | ++ BIT(IWL_RSS_HASH_TYPE_IPV4_PAYLOAD) | ++ BIT(IWL_RSS_HASH_TYPE_IPV6_TCP) | ++ BIT(IWL_RSS_HASH_TYPE_IPV6_UDP) | ++ BIT(IWL_RSS_HASH_TYPE_IPV6_PAYLOAD), + }; + + if (mvm->trans->num_rx_queues == 1) +-- +2.20.1 + diff --git a/queue-4.14/ixgbe-sync-the-first-fragment-unconditionally.patch b/queue-4.14/ixgbe-sync-the-first-fragment-unconditionally.patch new file mode 100644 index 00000000000..18dfcd379f4 --- /dev/null +++ b/queue-4.14/ixgbe-sync-the-first-fragment-unconditionally.patch @@ -0,0 +1,78 @@ +From 8302105db137b89c420cda8516fedcdd6a36f8fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Aug 2019 04:03:49 +0000 +Subject: ixgbe: sync the first fragment unconditionally + +From: Firo Yang + +[ Upstream commit e7ba676c6188d394a0133fc4b9bcd7ee50d54b7f ] + +In Xen environment, if Xen-swiotlb is enabled, ixgbe driver +could possibly allocate a page, DMA memory buffer, for the first +fragment which is not suitable for Xen-swiotlb to do DMA operations. +Xen-swiotlb have to internally allocate another page for doing DMA +operations. This mechanism requires syncing the data from the internal +page to the page which ixgbe sends to upper network stack. However, +since commit f3213d932173 ("ixgbe: Update driver to make use of DMA +attributes in Rx path"), the unmap operation is performed with +DMA_ATTR_SKIP_CPU_SYNC. As a result, the sync is not performed. +Since the sync isn't performed, the upper network stack could receive +a incomplete network packet. By incomplete, it means the linear data +on the first fragment(between skb->head and skb->end) is invalid. So +we have to copy the data from the internal xen-swiotlb page to the page +which ixgbe sends to upper network stack through the sync operation. + +More details from Alexander Duyck: +Specifically since we are mapping the frame with +DMA_ATTR_SKIP_CPU_SYNC we have to unmap with that as well. As a result +a sync is not performed on an unmap and must be done manually as we +skipped it for the first frag. As such we need to always sync before +possibly performing a page unmap operation. + +Fixes: f3213d932173 ("ixgbe: Update driver to make use of DMA attributes in Rx path") +Signed-off-by: Firo Yang +Reviewed-by: Alexander Duyck +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 0edfd199937d5..e4c1e6345edd0 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -1871,13 +1871,7 @@ static void ixgbe_pull_tail(struct ixgbe_ring *rx_ring, + static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring, + struct sk_buff *skb) + { +- /* if the page was released unmap it, else just sync our portion */ +- if (unlikely(IXGBE_CB(skb)->page_released)) { +- dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma, +- ixgbe_rx_pg_size(rx_ring), +- DMA_FROM_DEVICE, +- IXGBE_RX_DMA_ATTR); +- } else if (ring_uses_build_skb(rx_ring)) { ++ if (ring_uses_build_skb(rx_ring)) { + unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK; + + dma_sync_single_range_for_cpu(rx_ring->dev, +@@ -1894,6 +1888,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring, + skb_frag_size(frag), + DMA_FROM_DEVICE); + } ++ ++ /* If the page was released, just unmap it. */ ++ if (unlikely(IXGBE_CB(skb)->page_released)) { ++ dma_unmap_page_attrs(rx_ring->dev, IXGBE_CB(skb)->dma, ++ ixgbe_rx_pg_size(rx_ring), ++ DMA_FROM_DEVICE, ++ IXGBE_RX_DMA_ATTR); ++ } + } + + /** +-- +2.20.1 + diff --git a/queue-4.14/jfs-fix-bogus-variable-self-initialization.patch b/queue-4.14/jfs-fix-bogus-variable-self-initialization.patch new file mode 100644 index 00000000000..f9505dbacaf --- /dev/null +++ b/queue-4.14/jfs-fix-bogus-variable-self-initialization.patch @@ -0,0 +1,45 @@ +From 3d0997dc56b879553ebf08a605777eed0130509c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2019 15:19:16 +0100 +Subject: jfs: fix bogus variable self-initialization + +From: Arnd Bergmann + +[ Upstream commit a5fdd713d256887b5f012608701149fa939e5645 ] + +A statement was originally added in 2006 to shut up a gcc warning, +now but now clang warns about it: + +fs/jfs/jfs_txnmgr.c:1932:15: error: variable 'pxd' is uninitialized when used within its own initialization + [-Werror,-Wuninitialized] + pxd_t pxd = pxd; /* truncated extent of xad */ + ~~~ ^~~ + +Modern versions of gcc are fine without the silly assignment, so just +drop it. Tested with gcc-4.6 (released 2011), 4.7, 4.8, and 4.9. + +Fixes: c9e3ad6021e5 ("JFS: Get rid of "may be used uninitialized" warnings") +Signed-off-by: Arnd Bergmann +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_txnmgr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c +index 4d973524c8879..224ef034004b7 100644 +--- a/fs/jfs/jfs_txnmgr.c ++++ b/fs/jfs/jfs_txnmgr.c +@@ -1928,8 +1928,7 @@ static void xtLog(struct jfs_log * log, struct tblock * tblk, struct lrd * lrd, + * header ? + */ + if (tlck->type & tlckTRUNCATE) { +- /* This odd declaration suppresses a bogus gcc warning */ +- pxd_t pxd = pxd; /* truncated extent of xad */ ++ pxd_t pxd; /* truncated extent of xad */ + int twm; + + /* +-- +2.20.1 + diff --git a/queue-4.14/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch b/queue-4.14/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch new file mode 100644 index 00000000000..8e8d3d4a4a8 --- /dev/null +++ b/queue-4.14/kbuild-mark-prepare0-as-phony-to-fix-external-module.patch @@ -0,0 +1,72 @@ +From 975a50d929f37fb9c93b46ce8f3e33ce09fe348d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jan 2019 16:19:00 +0900 +Subject: kbuild: mark prepare0 as PHONY to fix external module build + +From: Masahiro Yamada + +[ Upstream commit e00d8880481497474792d28c14479a9fb6752046 ] + +Commit c3ff2a5193fa ("powerpc/32: add stack protector support") +caused kernel panic on PowerPC when an external module is used with +CONFIG_STACKPROTECTOR because the 'prepare' target was not executed +for the external module build. + +Commit e07db28eea38 ("kbuild: fix single target build for external +module") turned it into a build error because the 'prepare' target is +now executed but the 'prepare0' target is missing for the external +module build. + +External module on arm/arm64 with CONFIG_STACKPROTECTOR_PER_TASK is +also broken in the same way. + +Move 'PHONY += prepare0' to the common place. GNU Make is fine with +missing rule for phony targets. I also removed the comment which is +wrong irrespective of this commit. + +I minimize the change so it can be easily backported to 4.20.x + +To fix v4.20, please backport e07db28eea38 ("kbuild: fix single target +build for external module"), and then this commit. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=201891 +Fixes: e07db28eea38 ("kbuild: fix single target build for external module") +Fixes: c3ff2a5193fa ("powerpc/32: add stack protector support") +Fixes: 189af4657186 ("ARM: smp: add support for per-task stack canaries") +Fixes: 0a1213fa7432 ("arm64: enable per-task stack canaries") +Cc: linux-stable # v4.20 +Reported-by: Samuel Holland +Reported-by: Alexey Kardashevskiy +Signed-off-by: Masahiro Yamada +Acked-by: Ard Biesheuvel +Tested-by: Alexey Kardashevskiy +Signed-off-by: Sasha Levin +--- + Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/Makefile b/Makefile +index 3e8eaabf2bcbd..b538e6170f730 100644 +--- a/Makefile ++++ b/Makefile +@@ -971,6 +971,7 @@ ifdef CONFIG_STACK_VALIDATION + endif + endif + ++PHONY += prepare0 + + ifeq ($(KBUILD_EXTMOD),) + core-y += kernel/ certs/ mm/ fs/ ipc/ security/ crypto/ block/ +@@ -1065,8 +1066,7 @@ include/config/kernel.release: include/config/auto.conf FORCE + # archprepare is used in arch Makefiles and when processed asm symlink, + # version.h and scripts_basic is processed / created. + +-# Listed in dependency order +-PHONY += prepare archprepare prepare0 prepare1 prepare2 prepare3 ++PHONY += prepare archprepare prepare1 prepare2 prepare3 + + # prepare3 is used to check if we are building in a separate output directory, + # and if so do: +-- +2.20.1 + diff --git a/queue-4.14/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch b/queue-4.14/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch new file mode 100644 index 00000000000..dd8959848c8 --- /dev/null +++ b/queue-4.14/kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch @@ -0,0 +1,38 @@ +From 3e99eca411344d0aca75149d8018b073311559a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2019 15:50:18 +0300 +Subject: kdb: do a sanity check on the cpu in kdb_per_cpu() + +From: Dan Carpenter + +[ Upstream commit b586627e10f57ee3aa8f0cfab0d6f7dc4ae63760 ] + +The "whichcpu" comes from argv[3]. The cpu_online() macro looks up the +cpu in a bitmap of online cpus, but if the value is too high then it +could read beyond the end of the bitmap and possibly Oops. + +Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)") +Signed-off-by: Dan Carpenter +Reviewed-by: Douglas Anderson +Signed-off-by: Daniel Thompson +Signed-off-by: Sasha Levin +--- + kernel/debug/kdb/kdb_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index 993db6b2348e7..15d902daeef6c 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -2634,7 +2634,7 @@ static int kdb_per_cpu(int argc, const char **argv) + diag = kdbgetularg(argv[3], &whichcpu); + if (diag) + return diag; +- if (!cpu_online(whichcpu)) { ++ if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) { + kdb_printf("cpu %ld is not online\n", whichcpu); + return KDB_BADCPUNUM; + } +-- +2.20.1 + diff --git a/queue-4.14/keys-timestamp-new-keys.patch b/queue-4.14/keys-timestamp-new-keys.patch new file mode 100644 index 00000000000..b7197689545 --- /dev/null +++ b/queue-4.14/keys-timestamp-new-keys.patch @@ -0,0 +1,34 @@ +From bad8b5fb9421969da6760451a54d8f3152e51ecd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Feb 2019 16:20:37 +0000 +Subject: keys: Timestamp new keys + +From: David Howells + +[ Upstream commit 7c1857bdbdf1e4c541e45eab477ee23ed4333ea4 ] + +Set the timestamp on new keys rather than leaving it unset. + +Fixes: 31d5a79d7f3d ("KEYS: Do LRU discard in full keyrings") +Signed-off-by: David Howells +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +--- + security/keys/key.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/security/keys/key.c b/security/keys/key.c +index 87172f99f73e0..17244f5f54c69 100644 +--- a/security/keys/key.c ++++ b/security/keys/key.c +@@ -297,6 +297,7 @@ struct key *key_alloc(struct key_type *type, const char *desc, + key->gid = gid; + key->perm = perm; + key->restrict_link = restrict_link; ++ key->last_used_at = ktime_get_real_seconds(); + + if (!(flags & KEY_ALLOC_NOT_IN_QUOTA)) + key->flags |= 1 << KEY_FLAG_IN_QUOTA; +-- +2.20.1 + diff --git a/queue-4.14/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch b/queue-4.14/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch new file mode 100644 index 00000000000..34cff162319 --- /dev/null +++ b/queue-4.14/kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch @@ -0,0 +1,48 @@ +From 6190b5109419a19da003f120666174d268af0be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Feb 2019 15:37:45 +1100 +Subject: KVM: PPC: Release all hardware TCE tables attached to a group + +From: Alexey Kardashevskiy + +[ Upstream commit a67614cc05a5052b265ea48196dab2fce11f5f2e ] + +The SPAPR TCE KVM device references all hardware IOMMU tables assigned to +some IOMMU group to ensure that in-kernel KVM acceleration of H_PUT_TCE +can work. The tables are references when an IOMMU group gets registered +with the VFIO KVM device by the KVM_DEV_VFIO_GROUP_ADD ioctl; +KVM_DEV_VFIO_GROUP_DEL calls into the dereferencing code +in kvm_spapr_tce_release_iommu_group() which walks through the list of +LIOBNs, finds a matching IOMMU table and calls kref_put() when found. + +However that code stops after the very first successful derefencing +leaving other tables referenced till the SPAPR TCE KVM device is destroyed +which normally happens on guest reboot or termination so if we do hotplug +and unplug in a loop, we are leaking IOMMU tables here. + +This removes a premature return to let kvm_spapr_tce_release_iommu_group() +find and dereference all attached tables. + +Fixes: 121f80ba68f ("KVM: PPC: VFIO: Add in-kernel acceleration for VFIO") +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_64_vio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 5e44462960213..ef6a58838e7ce 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -134,7 +134,6 @@ extern void kvm_spapr_tce_release_iommu_group(struct kvm *kvm, + continue; + + kref_put(&stit->kref, kvm_spapr_tce_liobn_put); +- return; + } + } + } +-- +2.20.1 + diff --git a/queue-4.14/l2tp-fix-possible-null-pointer-dereference.patch b/queue-4.14/l2tp-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..226e534ba96 --- /dev/null +++ b/queue-4.14/l2tp-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,92 @@ +From c2079220abc48913aa84cb6441babe4e1e30b10c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 May 2019 22:44:04 +0800 +Subject: l2tp: Fix possible NULL pointer dereference + +From: YueHaibing + +[ Upstream commit 638a3a1e349ddf5b82f222ff5cb3b4f266e7c278 ] + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 +PGD 0 P4D 0 +Oops: 0000 [#1 +CPU: 0 PID: 5697 Comm: modprobe Tainted: G W 5.1.0-rc7+ #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 +RIP: 0010:__lock_acquire+0x53/0x10b0 +Code: 8b 1c 25 40 5e 01 00 4c 8b 6d 10 45 85 e4 0f 84 bd 06 00 00 44 8b 1d 7c d2 09 02 49 89 fe 41 89 d2 45 85 db 0f 84 47 02 00 00 <48> 81 3f a0 05 70 83 b8 00 00 00 00 44 0f 44 c0 83 fe 01 0f 86 3a +RSP: 0018:ffffc90001c07a28 EFLAGS: 00010002 +RAX: 0000000000000000 RBX: ffff88822f038440 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000128 +RBP: ffffc90001c07a88 R08: 0000000000000001 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 +R13: 0000000000000000 R14: 0000000000000128 R15: 0000000000000000 +FS: 00007fead0811540(0000) GS:ffff888237a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000128 CR3: 00000002310da000 CR4: 00000000000006f0 +Call Trace: + ? __lock_acquire+0x24e/0x10b0 + lock_acquire+0xdf/0x230 + ? flush_workqueue+0x71/0x530 + flush_workqueue+0x97/0x530 + ? flush_workqueue+0x71/0x530 + l2tp_exit_net+0x170/0x2b0 [l2tp_core + ? l2tp_exit_net+0x93/0x2b0 [l2tp_core + ops_exit_list.isra.6+0x36/0x60 + unregister_pernet_operations+0xb8/0x110 + unregister_pernet_device+0x25/0x40 + l2tp_init+0x55/0x1000 [l2tp_core + ? 0xffffffffa018d000 + do_one_initcall+0x6c/0x3cc + ? do_init_module+0x22/0x1f1 + ? rcu_read_lock_sched_held+0x97/0xb0 + ? kmem_cache_alloc_trace+0x325/0x3b0 + do_init_module+0x5b/0x1f1 + load_module+0x1db1/0x2690 + ? m_show+0x1d0/0x1d0 + __do_sys_finit_module+0xc5/0xd0 + __x64_sys_finit_module+0x15/0x20 + do_syscall_64+0x6b/0x1d0 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x7fead031a839 +Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffe8d9acca8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 +RAX: ffffffffffffffda RBX: 0000560078398b80 RCX: 00007fead031a839 +RDX: 0000000000000000 RSI: 000056007659dc2e RDI: 0000000000000003 +RBP: 000056007659dc2e R08: 0000000000000000 R09: 0000560078398b80 +R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 +R13: 00005600783a04a0 R14: 0000000000040000 R15: 0000560078398b80 +Modules linked in: l2tp_core(+) e1000 ip_tables ipv6 [last unloaded: l2tp_core +CR2: 0000000000000128 +---[ end trace 8322b2b8bf83f8e1 + +If alloc_workqueue fails in l2tp_init, l2tp_net_ops +is unregistered on failure path. Then l2tp_exit_net +is called which will flush NULL workqueue, this patch +add a NULL check to fix it. + +Fixes: 67e04c29ec0d ("l2tp: unregister l2tp_net_ops on failure path") +Signed-off-by: YueHaibing +Acked-by: Guillaume Nault +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/l2tp/l2tp_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index e494f04819e9c..b9be0360ab94b 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1892,7 +1892,8 @@ static __net_exit void l2tp_exit_net(struct net *net) + } + rcu_read_unlock_bh(); + +- flush_workqueue(l2tp_wq); ++ if (l2tp_wq) ++ flush_workqueue(l2tp_wq); + rcu_barrier(); + } + +-- +2.20.1 + diff --git a/queue-4.14/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch b/queue-4.14/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch new file mode 100644 index 00000000000..a1d0091701f --- /dev/null +++ b/queue-4.14/libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch @@ -0,0 +1,38 @@ +From 99c31162ee4d268fb69be4e6c3bd7fe9cbeade99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jul 2019 22:42:18 +0800 +Subject: libertas_tf: Use correct channel range in lbtf_geo_init + +From: YueHaibing + +[ Upstream commit 2ec4ad49b98e4a14147d04f914717135eca7c8b1 ] + +It seems we should use 'range' instead of 'priv->range' +in lbtf_geo_init(), because 'range' is the corret one +related to current regioncode. + +Reported-by: Hulk Robot +Fixes: 691cdb49388b ("libertas_tf: command helper functions for libertas_tf") +Signed-off-by: YueHaibing +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/libertas_tf/cmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/libertas_tf/cmd.c b/drivers/net/wireless/marvell/libertas_tf/cmd.c +index 909ac3685010f..2b193f1257a5a 100644 +--- a/drivers/net/wireless/marvell/libertas_tf/cmd.c ++++ b/drivers/net/wireless/marvell/libertas_tf/cmd.c +@@ -69,7 +69,7 @@ static void lbtf_geo_init(struct lbtf_private *priv) + break; + } + +- for (ch = priv->range.start; ch < priv->range.end; ch++) ++ for (ch = range->start; ch < range->end; ch++) + priv->channels[CHAN_TO_IDX(ch)].flags = 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch b/queue-4.14/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch new file mode 100644 index 00000000000..ad2545679fa --- /dev/null +++ b/queue-4.14/lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch @@ -0,0 +1,43 @@ +From 545b134508eb7d3d64b5579268bc49fcc6b0c48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 May 2019 20:37:59 +0200 +Subject: lightnvm: pblk: fix lock order in pblk_rb_tear_down_check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Igor Konopko + +[ Upstream commit 486b5aac85f6ec0b2df3e82a6a629d5eb7804db5 ] + +In pblk_rb_tear_down_check() the spinlock functions are not +called in proper order. + +Fixes: a4bd217 ("lightnvm: physical block device (pblk) target") +Signed-off-by: Igor Konopko +Reviewed-by: Javier González +Reviewed-by: Hans Holmberg +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/lightnvm/pblk-rb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c +index c0dd17a821709..73de2deaba673 100644 +--- a/drivers/lightnvm/pblk-rb.c ++++ b/drivers/lightnvm/pblk-rb.c +@@ -825,8 +825,8 @@ int pblk_rb_tear_down_check(struct pblk_rb *rb) + } + + out: +- spin_unlock(&rb->w_lock); + spin_unlock_irq(&rb->s_lock); ++ spin_unlock(&rb->w_lock); + + return ret; + } +-- +2.20.1 + diff --git a/queue-4.14/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch b/queue-4.14/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch new file mode 100644 index 00000000000..c35b0007ed2 --- /dev/null +++ b/queue-4.14/llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch @@ -0,0 +1,196 @@ +From 0de46079c91165b015a1bb86d5919899d5d26b26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2019 14:24:26 -0700 +Subject: llc: fix another potential sk_buff leak in llc_ui_sendmsg() + +From: Eric Biggers + +[ Upstream commit fc8d5db10cbe1338a52ebc74e7feab9276721774 ] + +All callers of llc_conn_state_process() except llc_build_and_send_pkt() +(via llc_ui_sendmsg() -> llc_ui_send_data()) assume that it always +consumes a reference to the skb. Fix this caller to do the same. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Biggers +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/llc/af_llc.c | 34 ++++++++++++++++++++-------------- + net/llc/llc_conn.c | 2 ++ + net/llc/llc_if.c | 12 ++++++++---- + 3 files changed, 30 insertions(+), 18 deletions(-) + +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index 2e472d5c3ea41..d552e88197133 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -113,22 +113,26 @@ static inline u8 llc_ui_header_len(struct sock *sk, struct sockaddr_llc *addr) + * + * Send data via reliable llc2 connection. + * Returns 0 upon success, non-zero if action did not succeed. ++ * ++ * This function always consumes a reference to the skb. + */ + static int llc_ui_send_data(struct sock* sk, struct sk_buff *skb, int noblock) + { + struct llc_sock* llc = llc_sk(sk); +- int rc = 0; + + if (unlikely(llc_data_accept_state(llc->state) || + llc->remote_busy_flag || + llc->p_flag)) { + long timeout = sock_sndtimeo(sk, noblock); ++ int rc; + + rc = llc_ui_wait_for_busy_core(sk, timeout); ++ if (rc) { ++ kfree_skb(skb); ++ return rc; ++ } + } +- if (unlikely(!rc)) +- rc = llc_build_and_send_pkt(sk, skb); +- return rc; ++ return llc_build_and_send_pkt(sk, skb); + } + + static void llc_ui_sk_init(struct socket *sock, struct sock *sk) +@@ -900,7 +904,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + DECLARE_SOCKADDR(struct sockaddr_llc *, addr, msg->msg_name); + int flags = msg->msg_flags; + int noblock = flags & MSG_DONTWAIT; +- struct sk_buff *skb; ++ struct sk_buff *skb = NULL; + size_t size = 0; + int rc = -EINVAL, copied = 0, hdrlen; + +@@ -909,10 +913,10 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + lock_sock(sk); + if (addr) { + if (msg->msg_namelen < sizeof(*addr)) +- goto release; ++ goto out; + } else { + if (llc_ui_addr_null(&llc->addr)) +- goto release; ++ goto out; + addr = &llc->addr; + } + /* must bind connection to sap if user hasn't done it. */ +@@ -920,7 +924,7 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + /* bind to sap with null dev, exclusive. */ + rc = llc_ui_autobind(sock, addr); + if (rc) +- goto release; ++ goto out; + } + hdrlen = llc->dev->hard_header_len + llc_ui_header_len(sk, addr); + size = hdrlen + len; +@@ -929,12 +933,12 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + copied = size - hdrlen; + rc = -EINVAL; + if (copied < 0) +- goto release; ++ goto out; + release_sock(sk); + skb = sock_alloc_send_skb(sk, size, noblock, &rc); + lock_sock(sk); + if (!skb) +- goto release; ++ goto out; + skb->dev = llc->dev; + skb->protocol = llc_proto_type(addr->sllc_arphrd); + skb_reserve(skb, hdrlen); +@@ -944,29 +948,31 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + if (sk->sk_type == SOCK_DGRAM || addr->sllc_ua) { + llc_build_and_send_ui_pkt(llc->sap, skb, addr->sllc_mac, + addr->sllc_sap); ++ skb = NULL; + goto out; + } + if (addr->sllc_test) { + llc_build_and_send_test_pkt(llc->sap, skb, addr->sllc_mac, + addr->sllc_sap); ++ skb = NULL; + goto out; + } + if (addr->sllc_xid) { + llc_build_and_send_xid_pkt(llc->sap, skb, addr->sllc_mac, + addr->sllc_sap); ++ skb = NULL; + goto out; + } + rc = -ENOPROTOOPT; + if (!(sk->sk_type == SOCK_STREAM && !addr->sllc_ua)) + goto out; + rc = llc_ui_send_data(sk, skb, noblock); ++ skb = NULL; + out: +- if (rc) { +- kfree_skb(skb); +-release: ++ kfree_skb(skb); ++ if (rc) + dprintk("%s: failed sending from %02X to %02X: %d\n", + __func__, llc->laddr.lsap, llc->daddr.lsap, rc); +- } + release_sock(sk); + return rc ? : copied; + } +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 444c13e752a08..7340f23e16de3 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -55,6 +55,8 @@ int sysctl_llc2_busy_timeout = LLC2_BUSY_TIME * HZ; + * (executing it's actions and changing state), upper layer will be + * indicated or confirmed, if needed. Returns 0 for success, 1 for + * failure. The socket lock has to be held before calling this function. ++ * ++ * This function always consumes a reference to the skb. + */ + int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + { +diff --git a/net/llc/llc_if.c b/net/llc/llc_if.c +index 6daf391b3e847..fc4d2bd8816f5 100644 +--- a/net/llc/llc_if.c ++++ b/net/llc/llc_if.c +@@ -38,6 +38,8 @@ + * closed and -EBUSY when sending data is not permitted in this state or + * LLC has send an I pdu with p bit set to 1 and is waiting for it's + * response. ++ * ++ * This function always consumes a reference to the skb. + */ + int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb) + { +@@ -46,20 +48,22 @@ int llc_build_and_send_pkt(struct sock *sk, struct sk_buff *skb) + struct llc_sock *llc = llc_sk(sk); + + if (unlikely(llc->state == LLC_CONN_STATE_ADM)) +- goto out; ++ goto out_free; + rc = -EBUSY; + if (unlikely(llc_data_accept_state(llc->state) || /* data_conn_refuse */ + llc->p_flag)) { + llc->failed_data_req = 1; +- goto out; ++ goto out_free; + } + ev = llc_conn_ev(skb); + ev->type = LLC_CONN_EV_TYPE_PRIM; + ev->prim = LLC_DATA_PRIM; + ev->prim_type = LLC_PRIM_TYPE_REQ; + skb->dev = llc->dev; +- rc = llc_conn_state_process(sk, skb); +-out: ++ return llc_conn_state_process(sk, skb); ++ ++out_free: ++ kfree_skb(skb); + return rc; + } + +-- +2.20.1 + diff --git a/queue-4.14/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch b/queue-4.14/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch new file mode 100644 index 00000000000..9b5e6daab4e --- /dev/null +++ b/queue-4.14/llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch @@ -0,0 +1,125 @@ +From bc02bfa5c80ccbcab85b86f2bf39aa27fb9b17f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2019 14:24:27 -0700 +Subject: llc: fix sk_buff refcounting in llc_conn_state_process() + +From: Eric Biggers + +[ Upstream commit 36453c852816f19947ca482a595dffdd2efa4965 ] + +If llc_conn_state_process() sees that llc_conn_service() put the skb on +a list, it will drop one fewer references to it. This is wrong because +the current behavior is that llc_conn_service() never consumes a +reference to the skb. + +The code also makes the number of skb references being dropped +conditional on which of ind_prim and cfm_prim are nonzero, yet neither +of these affects how many references are *acquired*. So there is extra +code that tries to fix this up by sometimes taking another reference. + +Remove the unnecessary/broken refcounting logic and instead just add an +skb_get() before the only two places where an extra reference is +actually consumed. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Biggers +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/llc/llc_conn.c | 33 ++++++--------------------------- + 1 file changed, 6 insertions(+), 27 deletions(-) + +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 7340f23e16de3..7fbc682aff043 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -64,12 +64,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + struct llc_sock *llc = llc_sk(skb->sk); + struct llc_conn_state_ev *ev = llc_conn_ev(skb); + +- /* +- * We have to hold the skb, because llc_conn_service will kfree it in +- * the sending path and we need to look at the skb->cb, where we encode +- * llc_conn_state_ev. +- */ +- skb_get(skb); + ev->ind_prim = ev->cfm_prim = 0; + /* + * Send event to state machine +@@ -77,21 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + rc = llc_conn_service(skb->sk, skb); + if (unlikely(rc != 0)) { + printk(KERN_ERR "%s: llc_conn_service failed\n", __func__); +- goto out_kfree_skb; +- } +- +- if (unlikely(!ev->ind_prim && !ev->cfm_prim)) { +- /* indicate or confirm not required */ +- if (!skb->next) +- goto out_kfree_skb; + goto out_skb_put; + } + +- if (unlikely(ev->ind_prim && ev->cfm_prim)) /* Paranoia */ +- skb_get(skb); +- + switch (ev->ind_prim) { + case LLC_DATA_PRIM: ++ skb_get(skb); + llc_save_primitive(sk, skb, LLC_DATA_PRIM); + if (unlikely(sock_queue_rcv_skb(sk, skb))) { + /* +@@ -108,6 +93,7 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + * skb->sk pointing to the newly created struct sock in + * llc_conn_handler. -acme + */ ++ skb_get(skb); + skb_queue_tail(&sk->sk_receive_queue, skb); + sk->sk_state_change(sk); + break; +@@ -123,7 +109,6 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + sk->sk_state_change(sk); + } + } +- kfree_skb(skb); + sock_put(sk); + break; + case LLC_RESET_PRIM: +@@ -132,14 +117,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + * RESET is not being notified to upper layers for now + */ + printk(KERN_INFO "%s: received a reset ind!\n", __func__); +- kfree_skb(skb); + break; + default: +- if (ev->ind_prim) { ++ if (ev->ind_prim) + printk(KERN_INFO "%s: received unknown %d prim!\n", + __func__, ev->ind_prim); +- kfree_skb(skb); +- } + /* No indication */ + break; + } +@@ -181,15 +163,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + printk(KERN_INFO "%s: received a reset conf!\n", __func__); + break; + default: +- if (ev->cfm_prim) { ++ if (ev->cfm_prim) + printk(KERN_INFO "%s: received unknown %d prim!\n", + __func__, ev->cfm_prim); +- break; +- } +- goto out_skb_put; /* No confirmation */ ++ /* No confirmation */ ++ break; + } +-out_kfree_skb: +- kfree_skb(skb); + out_skb_put: + kfree_skb(skb); + return rc; +-- +2.20.1 + diff --git a/queue-4.14/m68k-call-timer_interrupt-with-interrupts-disabled.patch b/queue-4.14/m68k-call-timer_interrupt-with-interrupts-disabled.patch new file mode 100644 index 00000000000..6a374f40fd3 --- /dev/null +++ b/queue-4.14/m68k-call-timer_interrupt-with-interrupts-disabled.patch @@ -0,0 +1,422 @@ +From 93c94b74f9afae24c53e0e8665ba959b44c1b76b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Dec 2018 11:53:10 +1100 +Subject: m68k: Call timer_interrupt() with interrupts disabled + +From: Finn Thain + +[ Upstream commit 1efdd4bd254311498123a15fa0acd565f454da97 ] + +Some platforms execute their timer handler with the interrupt priority +level set below 6. That means the handler could be interrupted by another +driver and this could lead to re-entry of the timer core. + +Avoid this by use of local_irq_save/restore for timer interrupt dispatch. +This provides mutual exclusion around the timer interrupt flag access +which is needed later in this series for the clocksource conversion. + +Reported-by: Thomas Gleixner +Link: http://lkml.kernel.org/r/alpine.DEB.2.21.1811131407120.2697@nanos.tec.linutronix.de +Signed-off-by: Finn Thain +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/amiga/cia.c | 9 +++++++++ + arch/m68k/atari/ataints.c | 4 ++-- + arch/m68k/atari/time.c | 15 ++++++++++++++- + arch/m68k/bvme6000/config.c | 20 ++++++++++---------- + arch/m68k/hp300/time.c | 10 ++++++++-- + arch/m68k/mac/via.c | 17 +++++++++++++++++ + arch/m68k/mvme147/config.c | 18 ++++++++++-------- + arch/m68k/mvme16x/config.c | 21 +++++++++++---------- + arch/m68k/q40/q40ints.c | 19 +++++++++++-------- + arch/m68k/sun3/sun3ints.c | 3 +++ + arch/m68k/sun3x/time.c | 16 ++++++++++------ + 11 files changed, 105 insertions(+), 47 deletions(-) + +diff --git a/arch/m68k/amiga/cia.c b/arch/m68k/amiga/cia.c +index 2081b8cd5591c..b9aee983e6f4c 100644 +--- a/arch/m68k/amiga/cia.c ++++ b/arch/m68k/amiga/cia.c +@@ -88,10 +88,19 @@ static irqreturn_t cia_handler(int irq, void *dev_id) + struct ciabase *base = dev_id; + int mach_irq; + unsigned char ints; ++ unsigned long flags; + ++ /* Interrupts get disabled while the timer irq flag is cleared and ++ * the timer interrupt serviced. ++ */ + mach_irq = base->cia_irq; ++ local_irq_save(flags); + ints = cia_set_irq(base, CIA_ICR_ALL); + amiga_custom.intreq = base->int_mask; ++ if (ints & 1) ++ generic_handle_irq(mach_irq); ++ local_irq_restore(flags); ++ mach_irq++, ints >>= 1; + for (; ints; mach_irq++, ints >>= 1) { + if (ints & 1) + generic_handle_irq(mach_irq); +diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c +index 3d2b63bedf058..56f02ea2c248d 100644 +--- a/arch/m68k/atari/ataints.c ++++ b/arch/m68k/atari/ataints.c +@@ -142,7 +142,7 @@ struct mfptimerbase { + .name = "MFP Timer D" + }; + +-static irqreturn_t mfptimer_handler(int irq, void *dev_id) ++static irqreturn_t mfp_timer_d_handler(int irq, void *dev_id) + { + struct mfptimerbase *base = dev_id; + int mach_irq; +@@ -344,7 +344,7 @@ void __init atari_init_IRQ(void) + st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 0xf0) | 0x6; + + /* request timer D dispatch handler */ +- if (request_irq(IRQ_MFP_TIMD, mfptimer_handler, IRQF_SHARED, ++ if (request_irq(IRQ_MFP_TIMD, mfp_timer_d_handler, IRQF_SHARED, + stmfp_base.name, &stmfp_base)) + pr_err("Couldn't register %s interrupt\n", stmfp_base.name); + +diff --git a/arch/m68k/atari/time.c b/arch/m68k/atari/time.c +index c549b48174ec8..972181c1fe4b7 100644 +--- a/arch/m68k/atari/time.c ++++ b/arch/m68k/atari/time.c +@@ -24,6 +24,18 @@ + DEFINE_SPINLOCK(rtc_lock); + EXPORT_SYMBOL_GPL(rtc_lock); + ++static irqreturn_t mfp_timer_c_handler(int irq, void *dev_id) ++{ ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ timer_routine(0, NULL); ++ local_irq_restore(flags); ++ ++ return IRQ_HANDLED; ++} ++ + void __init + atari_sched_init(irq_handler_t timer_routine) + { +@@ -32,7 +44,8 @@ atari_sched_init(irq_handler_t timer_routine) + /* start timer C, div = 1:100 */ + st_mfp.tim_ct_cd = (st_mfp.tim_ct_cd & 15) | 0x60; + /* install interrupt service routine for MFP Timer C */ +- if (request_irq(IRQ_MFP_TIMC, timer_routine, 0, "timer", timer_routine)) ++ if (request_irq(IRQ_MFP_TIMC, mfp_timer_c_handler, 0, "timer", ++ timer_routine)) + pr_err("Couldn't register timer interrupt\n"); + } + +diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c +index 2cfff47650407..0e602c32b246f 100644 +--- a/arch/m68k/bvme6000/config.c ++++ b/arch/m68k/bvme6000/config.c +@@ -45,11 +45,6 @@ extern int bvme6000_set_clock_mmss (unsigned long); + extern void bvme6000_reset (void); + void bvme6000_set_vectors (void); + +-/* Save tick handler routine pointer, will point to xtime_update() in +- * kernel/timer/timekeeping.c, called via bvme6000_process_int() */ +- +-static irq_handler_t tick_handler; +- + + int __init bvme6000_parse_bootinfo(const struct bi_record *bi) + { +@@ -159,12 +154,18 @@ irqreturn_t bvme6000_abort_int (int irq, void *dev_id) + + static irqreturn_t bvme6000_timer_int (int irq, void *dev_id) + { ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; + volatile RtcPtr_t rtc = (RtcPtr_t)BVME_RTC_BASE; +- unsigned char msr = rtc->msr & 0xc0; ++ unsigned char msr; + ++ local_irq_save(flags); ++ msr = rtc->msr & 0xc0; + rtc->msr = msr | 0x20; /* Ack the interrupt */ ++ timer_routine(0, NULL); ++ local_irq_restore(flags); + +- return tick_handler(irq, dev_id); ++ return IRQ_HANDLED; + } + + /* +@@ -183,9 +184,8 @@ void bvme6000_sched_init (irq_handler_t timer_routine) + + rtc->msr = 0; /* Ensure timer registers accessible */ + +- tick_handler = timer_routine; +- if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, +- "timer", bvme6000_timer_int)) ++ if (request_irq(BVME_IRQ_RTC, bvme6000_timer_int, 0, "timer", ++ timer_routine)) + panic ("Couldn't register timer int"); + + rtc->t1cr_omr = 0x04; /* Mode 2, ext clk */ +diff --git a/arch/m68k/hp300/time.c b/arch/m68k/hp300/time.c +index 289d928a46cbe..d30b03ea93a27 100644 +--- a/arch/m68k/hp300/time.c ++++ b/arch/m68k/hp300/time.c +@@ -38,13 +38,19 @@ + + static irqreturn_t hp300_tick(int irq, void *dev_id) + { ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; + unsigned long tmp; +- irq_handler_t vector = dev_id; ++ ++ local_irq_save(flags); + in_8(CLOCKBASE + CLKSR); + asm volatile ("movpw %1@(5),%0" : "=d" (tmp) : "a" (CLOCKBASE)); ++ timer_routine(0, NULL); ++ local_irq_restore(flags); ++ + /* Turn off the network and SCSI leds */ + blinken_leds(0, 0xe0); +- return vector(irq, NULL); ++ return IRQ_HANDLED; + } + + u32 hp300_gettimeoffset(void) +diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c +index 7334245abf26f..863806e6775a8 100644 +--- a/arch/m68k/mac/via.c ++++ b/arch/m68k/mac/via.c +@@ -398,6 +398,8 @@ void via_nubus_irq_shutdown(int irq) + * via6522.c :-), disable/pending masks added. + */ + ++#define VIA_TIMER_1_INT BIT(6) ++ + void via1_irq(struct irq_desc *desc) + { + int irq_num; +@@ -407,6 +409,21 @@ void via1_irq(struct irq_desc *desc) + if (!events) + return; + ++ irq_num = IRQ_MAC_TIMER_1; ++ irq_bit = VIA_TIMER_1_INT; ++ if (events & irq_bit) { ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ via1[vIFR] = irq_bit; ++ generic_handle_irq(irq_num); ++ local_irq_restore(flags); ++ ++ events &= ~irq_bit; ++ if (!events) ++ return; ++ } ++ + irq_num = VIA1_SOURCE_BASE; + irq_bit = 1; + do { +diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c +index 8778612d1f312..78ae803c833e1 100644 +--- a/arch/m68k/mvme147/config.c ++++ b/arch/m68k/mvme147/config.c +@@ -46,11 +46,6 @@ extern void mvme147_reset (void); + + static int bcd2int (unsigned char b); + +-/* Save tick handler routine pointer, will point to xtime_update() in +- * kernel/time/timekeeping.c, called via mvme147_process_int() */ +- +-irq_handler_t tick_handler; +- + + int __init mvme147_parse_bootinfo(const struct bi_record *bi) + { +@@ -106,16 +101,23 @@ void __init config_mvme147(void) + + static irqreturn_t mvme147_timer_int (int irq, void *dev_id) + { ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; ++ ++ local_irq_save(flags); + m147_pcc->t1_int_cntrl = PCC_TIMER_INT_CLR; + m147_pcc->t1_int_cntrl = PCC_INT_ENAB|PCC_LEVEL_TIMER1; +- return tick_handler(irq, dev_id); ++ timer_routine(0, NULL); ++ local_irq_restore(flags); ++ ++ return IRQ_HANDLED; + } + + + void mvme147_sched_init (irq_handler_t timer_routine) + { +- tick_handler = timer_routine; +- if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", NULL)) ++ if (request_irq(PCC_IRQ_TIMER1, mvme147_timer_int, 0, "timer 1", ++ timer_routine)) + pr_err("Couldn't register timer interrupt\n"); + + /* Init the clock with a value */ +diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c +index 6fa06d4d16bf0..3116dd576bb3c 100644 +--- a/arch/m68k/mvme16x/config.c ++++ b/arch/m68k/mvme16x/config.c +@@ -51,11 +51,6 @@ extern void mvme16x_reset (void); + + int bcd2int (unsigned char b); + +-/* Save tick handler routine pointer, will point to xtime_update() in +- * kernel/time/timekeeping.c, called via mvme16x_process_int() */ +- +-static irq_handler_t tick_handler; +- + + unsigned short mvme16x_config; + EXPORT_SYMBOL(mvme16x_config); +@@ -354,8 +349,15 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id) + + static irqreturn_t mvme16x_timer_int (int irq, void *dev_id) + { +- *(volatile unsigned char *)0xfff4201b |= 8; +- return tick_handler(irq, dev_id); ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ *(volatile unsigned char *)0xfff4201b |= 8; ++ timer_routine(0, NULL); ++ local_irq_restore(flags); ++ ++ return IRQ_HANDLED; + } + + void mvme16x_sched_init (irq_handler_t timer_routine) +@@ -363,14 +365,13 @@ void mvme16x_sched_init (irq_handler_t timer_routine) + uint16_t brdno = be16_to_cpu(mvme_bdid.brdno); + int irq; + +- tick_handler = timer_routine; + /* Using PCCchip2 or MC2 chip tick timer 1 */ + *(volatile unsigned long *)0xfff42008 = 0; + *(volatile unsigned long *)0xfff42004 = 10000; /* 10ms */ + *(volatile unsigned char *)0xfff42017 |= 3; + *(volatile unsigned char *)0xfff4201b = 0x16; +- if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, +- "timer", mvme16x_timer_int)) ++ if (request_irq(MVME16x_IRQ_TIMER, mvme16x_timer_int, 0, "timer", ++ timer_routine)) + panic ("Couldn't register timer int"); + + if (brdno == 0x0162 || brdno == 0x172) +diff --git a/arch/m68k/q40/q40ints.c b/arch/m68k/q40/q40ints.c +index 3e7603202977e..1c696906c159f 100644 +--- a/arch/m68k/q40/q40ints.c ++++ b/arch/m68k/q40/q40ints.c +@@ -127,10 +127,10 @@ void q40_mksound(unsigned int hz, unsigned int ticks) + sound_ticks = ticks << 1; + } + +-static irq_handler_t q40_timer_routine; +- +-static irqreturn_t q40_timer_int (int irq, void * dev) ++static irqreturn_t q40_timer_int(int irq, void *dev_id) + { ++ irq_handler_t timer_routine = dev_id; ++ + ql_ticks = ql_ticks ? 0 : 1; + if (sound_ticks) { + unsigned char sval=(sound_ticks & 1) ? 128-SVOL : 128+SVOL; +@@ -139,8 +139,13 @@ static irqreturn_t q40_timer_int (int irq, void * dev) + *DAC_RIGHT=sval; + } + +- if (!ql_ticks) +- q40_timer_routine(irq, dev); ++ if (!ql_ticks) { ++ unsigned long flags; ++ ++ local_irq_save(flags); ++ timer_routine(0, NULL); ++ local_irq_restore(flags); ++ } + return IRQ_HANDLED; + } + +@@ -148,11 +153,9 @@ void q40_sched_init (irq_handler_t timer_routine) + { + int timer_irq; + +- q40_timer_routine = timer_routine; + timer_irq = Q40_IRQ_FRAME; + +- if (request_irq(timer_irq, q40_timer_int, 0, +- "timer", q40_timer_int)) ++ if (request_irq(timer_irq, q40_timer_int, 0, "timer", timer_routine)) + panic("Couldn't register timer int"); + + master_outb(-1, FRAME_CLEAR_REG); +diff --git a/arch/m68k/sun3/sun3ints.c b/arch/m68k/sun3/sun3ints.c +index 6bbca30c91884..a5824abb4a39c 100644 +--- a/arch/m68k/sun3/sun3ints.c ++++ b/arch/m68k/sun3/sun3ints.c +@@ -61,8 +61,10 @@ static irqreturn_t sun3_int7(int irq, void *dev_id) + + static irqreturn_t sun3_int5(int irq, void *dev_id) + { ++ unsigned long flags; + unsigned int cnt; + ++ local_irq_save(flags); + #ifdef CONFIG_SUN3 + intersil_clear(); + #endif +@@ -76,6 +78,7 @@ static irqreturn_t sun3_int5(int irq, void *dev_id) + cnt = kstat_irqs_cpu(irq, 0); + if (!(cnt % 20)) + sun3_leds(led_pattern[cnt % 160 / 20]); ++ local_irq_restore(flags); + return IRQ_HANDLED; + } + +diff --git a/arch/m68k/sun3x/time.c b/arch/m68k/sun3x/time.c +index 7a2c53d9f779a..48b43903253e4 100644 +--- a/arch/m68k/sun3x/time.c ++++ b/arch/m68k/sun3x/time.c +@@ -78,15 +78,19 @@ u32 sun3x_gettimeoffset(void) + } + + #if 0 +-static void sun3x_timer_tick(int irq, void *dev_id, struct pt_regs *regs) ++static irqreturn_t sun3x_timer_tick(int irq, void *dev_id) + { +- void (*vector)(int, void *, struct pt_regs *) = dev_id; ++ irq_handler_t timer_routine = dev_id; ++ unsigned long flags; + +- /* Clear the pending interrupt - pulse the enable line low */ +- disable_irq(5); +- enable_irq(5); ++ local_irq_save(flags); ++ /* Clear the pending interrupt - pulse the enable line low */ ++ disable_irq(5); ++ enable_irq(5); ++ timer_routine(0, NULL); ++ local_irq_restore(flags); + +- vector(irq, NULL, regs); ++ return IRQ_HANDLED; + } + #endif + +-- +2.20.1 + diff --git a/queue-4.14/m68k-mac-fix-via-timer-counter-accesses.patch b/queue-4.14/m68k-mac-fix-via-timer-counter-accesses.patch new file mode 100644 index 00000000000..73a51d62cad --- /dev/null +++ b/queue-4.14/m68k-mac-fix-via-timer-counter-accesses.patch @@ -0,0 +1,156 @@ +From c8e32ed8496da6ff7246919c0a8a367ea0c99de6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Dec 2018 11:53:10 +1100 +Subject: m68k: mac: Fix VIA timer counter accesses + +From: Finn Thain + +[ Upstream commit 0ca7ce7db771580433bf24454f7a1542bd326078 ] + +This resolves some bugs that affect VIA timer counter accesses. +Avoid lost interrupts caused by reading the counter low byte register. +Make allowance for the fact that the counter will be decremented to +0xFFFF before being reloaded. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/mac/via.c | 102 +++++++++++++++++++++++--------------------- + 1 file changed, 53 insertions(+), 49 deletions(-) + +diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c +index 9f59a662ace57..7334245abf26f 100644 +--- a/arch/m68k/mac/via.c ++++ b/arch/m68k/mac/via.c +@@ -54,16 +54,6 @@ static __u8 rbv_clear; + + static int gIER,gIFR,gBufA,gBufB; + +-/* +- * Timer defs. +- */ +- +-#define TICK_SIZE 10000 +-#define MAC_CLOCK_TICK (783300/HZ) /* ticks per HZ */ +-#define MAC_CLOCK_LOW (MAC_CLOCK_TICK&0xFF) +-#define MAC_CLOCK_HIGH (MAC_CLOCK_TICK>>8) +- +- + /* + * On Macs with a genuine VIA chip there is no way to mask an individual slot + * interrupt. This limitation also seems to apply to VIA clone logic cores in +@@ -278,22 +268,6 @@ void __init via_init(void) + } + } + +-/* +- * Start the 100 Hz clock +- */ +- +-void __init via_init_clock(irq_handler_t func) +-{ +- via1[vACR] |= 0x40; +- via1[vT1LL] = MAC_CLOCK_LOW; +- via1[vT1LH] = MAC_CLOCK_HIGH; +- via1[vT1CL] = MAC_CLOCK_LOW; +- via1[vT1CH] = MAC_CLOCK_HIGH; +- +- if (request_irq(IRQ_MAC_TIMER_1, func, 0, "timer", func)) +- pr_err("Couldn't register %s interrupt\n", "timer"); +-} +- + /* + * Debugging dump, used in various places to see what's going on. + */ +@@ -321,29 +295,6 @@ void via_debug_dump(void) + } + } + +-/* +- * This is always executed with interrupts disabled. +- * +- * TBI: get time offset between scheduling timer ticks +- */ +- +-u32 mac_gettimeoffset(void) +-{ +- unsigned long ticks, offset = 0; +- +- /* read VIA1 timer 2 current value */ +- ticks = via1[vT1CL] | (via1[vT1CH] << 8); +- /* The probability of underflow is less than 2% */ +- if (ticks > MAC_CLOCK_TICK - MAC_CLOCK_TICK / 50) +- /* Check for pending timer interrupt in VIA1 IFR */ +- if (via1[vIFR] & 0x40) offset = TICK_SIZE; +- +- ticks = MAC_CLOCK_TICK - ticks; +- ticks = ticks * 10000L / MAC_CLOCK_TICK; +- +- return (ticks + offset) * 1000; +-} +- + /* + * Flush the L2 cache on Macs that have it by flipping + * the system into 24-bit mode for an instant. +@@ -612,3 +563,56 @@ int via2_scsi_drq_pending(void) + return via2[gIFR] & (1 << IRQ_IDX(IRQ_MAC_SCSIDRQ)); + } + EXPORT_SYMBOL(via2_scsi_drq_pending); ++ ++/* timer and clock source */ ++ ++#define VIA_CLOCK_FREQ 783360 /* VIA "phase 2" clock in Hz */ ++#define VIA_TIMER_INTERVAL (1000000 / HZ) /* microseconds per jiffy */ ++#define VIA_TIMER_CYCLES (VIA_CLOCK_FREQ / HZ) /* clock cycles per jiffy */ ++ ++#define VIA_TC (VIA_TIMER_CYCLES - 2) /* including 0 and -1 */ ++#define VIA_TC_LOW (VIA_TC & 0xFF) ++#define VIA_TC_HIGH (VIA_TC >> 8) ++ ++void __init via_init_clock(irq_handler_t timer_routine) ++{ ++ if (request_irq(IRQ_MAC_TIMER_1, timer_routine, 0, "timer", NULL)) { ++ pr_err("Couldn't register %s interrupt\n", "timer"); ++ return; ++ } ++ ++ via1[vT1LL] = VIA_TC_LOW; ++ via1[vT1LH] = VIA_TC_HIGH; ++ via1[vT1CL] = VIA_TC_LOW; ++ via1[vT1CH] = VIA_TC_HIGH; ++ via1[vACR] |= 0x40; ++} ++ ++u32 mac_gettimeoffset(void) ++{ ++ unsigned long flags; ++ u8 count_high; ++ u16 count, offset = 0; ++ ++ /* ++ * Timer counter wrap-around is detected with the timer interrupt flag ++ * but reading the counter low byte (vT1CL) would reset the flag. ++ * Also, accessing both counter registers is essentially a data race. ++ * These problems are avoided by ignoring the low byte. Clock accuracy ++ * is 256 times worse (error can reach 0.327 ms) but CPU overhead is ++ * reduced by avoiding slow VIA register accesses. ++ */ ++ ++ local_irq_save(flags); ++ count_high = via1[vT1CH]; ++ if (count_high == 0xFF) ++ count_high = 0; ++ if (count_high > 0 && (via1[vIFR] & VIA_TIMER_1_INT)) ++ offset = VIA_TIMER_CYCLES; ++ local_irq_restore(flags); ++ ++ count = count_high << 8; ++ count = VIA_TIMER_CYCLES - count + offset; ++ ++ return ((count * VIA_TIMER_INTERVAL) / VIA_TIMER_CYCLES) * 1000; ++} +-- +2.20.1 + diff --git a/queue-4.14/mac80211-accept-deauth-frames-in-ibss-mode.patch b/queue-4.14/mac80211-accept-deauth-frames-in-ibss-mode.patch new file mode 100644 index 00000000000..a52e67b5f87 --- /dev/null +++ b/queue-4.14/mac80211-accept-deauth-frames-in-ibss-mode.patch @@ -0,0 +1,49 @@ +From 1102956911f8e502f65467f3ecf8ecf976beb8c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 15:37:05 +0300 +Subject: mac80211: accept deauth frames in IBSS mode + +From: Johannes Berg + +[ Upstream commit 95697f9907bfe3eab0ef20265a766b22e27dde64 ] + +We can process deauth frames and all, but we drop them very +early in the RX path today - this could never have worked. + +Fixes: 2cc59e784b54 ("mac80211: reply to AUTH with DEAUTH if sta allocation fails in IBSS") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/20191004123706.15768-2-luca@coelho.fi +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 4a6b3c7b35e37..31000622376df 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3227,9 +3227,18 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx) + case cpu_to_le16(IEEE80211_STYPE_PROBE_RESP): + /* process for all: mesh, mlme, ibss */ + break; ++ case cpu_to_le16(IEEE80211_STYPE_DEAUTH): ++ if (is_multicast_ether_addr(mgmt->da) && ++ !is_broadcast_ether_addr(mgmt->da)) ++ return RX_DROP_MONITOR; ++ ++ /* process only for station/IBSS */ ++ if (sdata->vif.type != NL80211_IFTYPE_STATION && ++ sdata->vif.type != NL80211_IFTYPE_ADHOC) ++ return RX_DROP_MONITOR; ++ break; + case cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP): + case cpu_to_le16(IEEE80211_STYPE_REASSOC_RESP): +- case cpu_to_le16(IEEE80211_STYPE_DEAUTH): + case cpu_to_le16(IEEE80211_STYPE_DISASSOC): + if (is_multicast_ether_addr(mgmt->da) && + !is_broadcast_ether_addr(mgmt->da)) +-- +2.20.1 + diff --git a/queue-4.14/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch b/queue-4.14/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch new file mode 100644 index 00000000000..aa135e6de7a --- /dev/null +++ b/queue-4.14/mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch @@ -0,0 +1,38 @@ +From d02e6b81d798ccaa0792587b76e04f30798bc9fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 11:54:46 +0200 +Subject: mac80211: minstrel_ht: fix per-group max throughput rate + initialization + +From: Felix Fietkau + +[ Upstream commit 56dd918ff06e3ee24d8067e93ed12b2a39e71394 ] + +The group number needs to be multiplied by the number of rates per group +to get the full rate index + +Fixes: 5935839ad735 ("mac80211: improve minstrel_ht rate sorting by throughput & probability") +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20190820095449.45255-1-nbd@nbd.name +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rc80211_minstrel_ht.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c +index e57811e4b91f6..7ba4272642c9f 100644 +--- a/net/mac80211/rc80211_minstrel_ht.c ++++ b/net/mac80211/rc80211_minstrel_ht.c +@@ -529,7 +529,7 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi) + + /* (re)Initialize group rate indexes */ + for(j = 0; j < MAX_THR_RATES; j++) +- tmp_group_tp_rate[j] = group; ++ tmp_group_tp_rate[j] = MCS_GROUP_RATES * group; + + for (i = 0; i < MCS_GROUP_RATES; i++) { + if (!(mi->supported[group] & BIT(i))) +-- +2.20.1 + diff --git a/queue-4.14/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch b/queue-4.14/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch new file mode 100644 index 00000000000..83a15374095 --- /dev/null +++ b/queue-4.14/media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch @@ -0,0 +1,43 @@ +From f68bae24b22ca00d0f22e840bd59b9589c8cb062 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Aug 2019 08:37:45 -0300 +Subject: media: atmel: atmel-isi: fix timeout value for stop streaming + +From: Alexandre Kroupski + +[ Upstream commit 623fd246bb40234fe68dd4e7c1f1f081f9c45a3d ] + +In case of sensor malfunction, stop streaming timeout takes much longer +than expected. This is due to conversion of time to jiffies: milliseconds +multiplied with HZ (ticks/second) gives out a value of jiffies with 10^3 +greater. We need to also divide by 10^3 to obtain the right jiffies value. +In other words FRAME_INTERVAL_MILLI_SEC must be in seconds in order to +multiply by HZ and get the right jiffies value to add to the current +jiffies for the timeout expire time. + +Fixes: 195ebc43bf76 ("[media] V4L: at91: add Atmel Image Sensor Interface (ISI) support") +Signed-off-by: Alexandre Kroupski +Reviewed-by: Eugen Hristev +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/atmel/atmel-isi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/atmel/atmel-isi.c b/drivers/media/platform/atmel/atmel-isi.c +index 891fa2505efa0..2f962a3418f63 100644 +--- a/drivers/media/platform/atmel/atmel-isi.c ++++ b/drivers/media/platform/atmel/atmel-isi.c +@@ -496,7 +496,7 @@ static void stop_streaming(struct vb2_queue *vq) + spin_unlock_irq(&isi->irqlock); + + if (!isi->enable_preview_path) { +- timeout = jiffies + FRAME_INTERVAL_MILLI_SEC * HZ; ++ timeout = jiffies + (FRAME_INTERVAL_MILLI_SEC * HZ) / 1000; + /* Wait until the end of the current frame. */ + while ((isi_readl(isi, ISI_STATUS) & ISI_CTRL_CDC) && + time_before(jiffies, timeout)) +-- +2.20.1 + diff --git a/queue-4.14/media-cx18-update-pos-correctly-in-cx18_read_pos.patch b/queue-4.14/media-cx18-update-pos-correctly-in-cx18_read_pos.patch new file mode 100644 index 00000000000..67bca556cab --- /dev/null +++ b/queue-4.14/media-cx18-update-pos-correctly-in-cx18_read_pos.patch @@ -0,0 +1,37 @@ +From b310d516df5ffa6d24a09ffee3c4f23fb6dc0371 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Feb 2019 01:37:02 -0500 +Subject: media: cx18: update *pos correctly in cx18_read_pos() + +From: Dan Carpenter + +[ Upstream commit 7afb0df554292dca7568446f619965fb8153085d ] + +We should be updating *pos. The current code is a no-op. + +Fixes: 1c1e45d17b66 ("V4L/DVB (7786): cx18: new driver for the Conexant CX23418 MPEG encoder chip") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx18/cx18-fileops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cx18/cx18-fileops.c b/drivers/media/pci/cx18/cx18-fileops.c +index 98467b2089fa8..099d59b992c1b 100644 +--- a/drivers/media/pci/cx18/cx18-fileops.c ++++ b/drivers/media/pci/cx18/cx18-fileops.c +@@ -484,7 +484,7 @@ static ssize_t cx18_read_pos(struct cx18_stream *s, char __user *ubuf, + + CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc); + if (rc > 0) +- pos += rc; ++ *pos += rc; + return rc; + } + +-- +2.20.1 + diff --git a/queue-4.14/media-cx23885-check-allocation-return.patch b/queue-4.14/media-cx23885-check-allocation-return.patch new file mode 100644 index 00000000000..d1649fc0fe8 --- /dev/null +++ b/queue-4.14/media-cx23885-check-allocation-return.patch @@ -0,0 +1,43 @@ +From 969e3bd09b1fcca554745b5694403ca6134cb712 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jan 2019 22:52:23 -0500 +Subject: media: cx23885: check allocation return + +From: Nicholas Mc Guire + +[ Upstream commit a3d7f22ef34ec4206b50ee121384d5c8bebd5591 ] + +Checking of kmalloc() seems to have been committed - as +cx23885_dvb_register() is checking for != 0 return, returning +-ENOMEM should be fine here. While at it address the coccicheck +suggestion to move to kmemdup rather than using kmalloc+memcpy. + +Fixes: 46b21bbaa8a8 ("[media] Add support for DViCO FusionHDTV DVB-T Dual Express2") + +Signed-off-by: Nicholas Mc Guire +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx23885/cx23885-dvb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c +index e795ddeb7fe28..60f122edaefb3 100644 +--- a/drivers/media/pci/cx23885/cx23885-dvb.c ++++ b/drivers/media/pci/cx23885/cx23885-dvb.c +@@ -1460,8 +1460,9 @@ static int dvb_register(struct cx23885_tsport *port) + if (fe0->dvb.frontend != NULL) { + struct i2c_adapter *tun_i2c; + +- fe0->dvb.frontend->sec_priv = kmalloc(sizeof(dib7000p_ops), GFP_KERNEL); +- memcpy(fe0->dvb.frontend->sec_priv, &dib7000p_ops, sizeof(dib7000p_ops)); ++ fe0->dvb.frontend->sec_priv = kmemdup(&dib7000p_ops, sizeof(dib7000p_ops), GFP_KERNEL); ++ if (!fe0->dvb.frontend->sec_priv) ++ return -ENOMEM; + tun_i2c = dib7000p_ops.get_i2c_master(fe0->dvb.frontend, DIBX000_I2C_INTERFACE_TUNER, 1); + if (!dvb_attach(dib0070_attach, fe0->dvb.frontend, tun_i2c, &dib7070p_dib0070_config)) + return -ENODEV; +-- +2.20.1 + diff --git a/queue-4.14/media-davinci-isif-avoid-uninitialized-variable-use.patch b/queue-4.14/media-davinci-isif-avoid-uninitialized-variable-use.patch new file mode 100644 index 00000000000..b4a70fc8c5e --- /dev/null +++ b/queue-4.14/media-davinci-isif-avoid-uninitialized-variable-use.patch @@ -0,0 +1,78 @@ +From 82625f754091cfc06ffa358c6cfcb0729e7f9fd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2019 10:34:22 -0400 +Subject: media: davinci-isif: avoid uninitialized variable use + +From: Arnd Bergmann + +[ Upstream commit 0e633f97162c1c74c68e2eb20bbd9259dce87cd9 ] + +clang warns about a possible variable use that gcc never +complained about: + +drivers/media/platform/davinci/isif.c:982:32: error: variable 'frame_size' is uninitialized when used here + [-Werror,-Wuninitialized] + dm365_vpss_set_pg_frame_size(frame_size); + ^~~~~~~~~~ +drivers/media/platform/davinci/isif.c:887:2: note: variable 'frame_size' is declared here + struct vpss_pg_frame_size frame_size; + ^ +1 error generated. + +There is no initialization for this variable at all, and there +has never been one in the mainline kernel, so we really should +not put that stack data into an mmio register. + +On the other hand, I suspect that gcc checks the condition +more closely and notices that the global +isif_cfg.bayer.config_params.test_pat_gen flag is initialized +to zero and never written to from any code path, so anything +depending on it can be eliminated. + +To shut up the clang warning, just remove the dead code manually, +it has probably never been used because any attempt to do so +would have resulted in undefined behavior. + +Fixes: 63e3ab142fa3 ("V4L/DVB: V4L - vpfe capture - source for ISIF driver on DM365") + +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Acked-by: Lad, Prabhakar +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/isif.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c +index 90d0f13283ae9..12065ad1ac457 100644 +--- a/drivers/media/platform/davinci/isif.c ++++ b/drivers/media/platform/davinci/isif.c +@@ -886,9 +886,7 @@ static int isif_set_hw_if_params(struct vpfe_hw_if_param *params) + static int isif_config_ycbcr(void) + { + struct isif_ycbcr_config *params = &isif_cfg.ycbcr; +- struct vpss_pg_frame_size frame_size; + u32 modeset = 0, ccdcfg = 0; +- struct vpss_sync_pol sync; + + dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr..."); + +@@ -976,13 +974,6 @@ static int isif_config_ycbcr(void) + /* two fields are interleaved in memory */ + regw(0x00000249, SDOFST); + +- /* Setup test pattern if enabled */ +- if (isif_cfg.bayer.config_params.test_pat_gen) { +- sync.ccdpg_hdpol = params->hd_pol; +- sync.ccdpg_vdpol = params->vd_pol; +- dm365_vpss_set_sync_pol(sync); +- dm365_vpss_set_pg_frame_size(frame_size); +- } + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch b/queue-4.14/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch new file mode 100644 index 00000000000..4c9b89439da --- /dev/null +++ b/queue-4.14/media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch @@ -0,0 +1,54 @@ +From e37fc79ae3c40c5894ae8222c5495fe0ab8b58b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2019 05:46:27 -0400 +Subject: media: davinci/vpbe: array underflow in vpbe_enum_outputs() + +From: Dan Carpenter + +[ Upstream commit b72845ee5577b227131b1fef23f9d9a296621d7b ] + +In vpbe_enum_outputs() we check if (temp_index >= cfg->num_outputs) but +the problem is that "temp_index" can be negative. This patch changes +the types to unsigned to address this array underflow bug. + +Fixes: 66715cdc3224 ("[media] davinci vpbe: VPBE display driver") + +Signed-off-by: Dan Carpenter +Acked-by: "Lad, Prabhakar" +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/vpbe.c | 2 +- + include/media/davinci/vpbe.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c +index 1d3c13e369044..915af9ca47111 100644 +--- a/drivers/media/platform/davinci/vpbe.c ++++ b/drivers/media/platform/davinci/vpbe.c +@@ -126,7 +126,7 @@ static int vpbe_enum_outputs(struct vpbe_device *vpbe_dev, + struct v4l2_output *output) + { + struct vpbe_config *cfg = vpbe_dev->cfg; +- int temp_index = output->index; ++ unsigned int temp_index = output->index; + + if (temp_index >= cfg->num_outputs) + return -EINVAL; +diff --git a/include/media/davinci/vpbe.h b/include/media/davinci/vpbe.h +index 79a566d7defd0..180a05e914979 100644 +--- a/include/media/davinci/vpbe.h ++++ b/include/media/davinci/vpbe.h +@@ -92,7 +92,7 @@ struct vpbe_config { + struct encoder_config_info *ext_encoders; + /* amplifier information goes here */ + struct amp_config_info *amp; +- int num_outputs; ++ unsigned int num_outputs; + /* Order is venc outputs followed by LCD and then external encoders */ + struct vpbe_output *outputs; + }; +-- +2.20.1 + diff --git a/queue-4.14/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch b/queue-4.14/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch new file mode 100644 index 00000000000..f28280d9e64 --- /dev/null +++ b/queue-4.14/media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch @@ -0,0 +1,37 @@ +From 4093cd24dec7b290bc7930e433f4997eb28296d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Feb 2019 01:36:41 -0500 +Subject: media: ivtv: update *pos correctly in ivtv_read_pos() + +From: Dan Carpenter + +[ Upstream commit f8e579f3ca0973daef263f513da5edff520a6c0d ] + +We had intended to update *pos, but the current code is a no-op. + +Fixes: 1a0adaf37c30 ("V4L/DVB (5345): ivtv driver for Conexant cx23416/cx23415 MPEG encoder/decoder") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-fileops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c +index c9bd018e53de6..e2b19c3eaa876 100644 +--- a/drivers/media/pci/ivtv/ivtv-fileops.c ++++ b/drivers/media/pci/ivtv/ivtv-fileops.c +@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv_stream *s, char __user *ubuf, size_t co + + IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc); + if (rc > 0) +- pos += rc; ++ *pos += rc; + return rc; + } + +-- +2.20.1 + diff --git a/queue-4.14/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch b/queue-4.14/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch new file mode 100644 index 00000000000..e3d17a280b0 --- /dev/null +++ b/queue-4.14/media-omap_vout-potential-buffer-overflow-in-vidioc_.patch @@ -0,0 +1,68 @@ +From 0c6ab2e220239ab9fdacfcc744d2a93629b2d1c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2019 05:01:57 -0400 +Subject: media: omap_vout: potential buffer overflow in vidioc_dqbuf() + +From: Dan Carpenter + +[ Upstream commit dd6e2a981bfe83aa4a493143fd8cf1edcda6c091 ] + +The "b->index" is a u32 the comes from the user in the ioctl. It hasn't +been checked. We aren't supposed to use it but we're instead supposed +to use the value that gets written to it when we call videobuf_dqbuf(). + +The videobuf_dqbuf() first memsets it to zero and then re-initializes it +inside the videobuf_status() function. It's this final value which we +want. + +Hans Verkuil pointed out that we need to check the return from +videobuf_dqbuf(). I ended up doing a little cleanup related to that as +well. + +Fixes: 72915e851da9 ("[media] V4L2: OMAP: VOUT: dma map and unmap v4l2 buffers in qbuf and dqbuf") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap/omap_vout.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/platform/omap/omap_vout.c b/drivers/media/platform/omap/omap_vout.c +index 4d29860d27b42..18604b608ab2e 100644 +--- a/drivers/media/platform/omap/omap_vout.c ++++ b/drivers/media/platform/omap/omap_vout.c +@@ -1527,23 +1527,20 @@ static int vidioc_dqbuf(struct file *file, void *fh, struct v4l2_buffer *b) + unsigned long size; + struct videobuf_buffer *vb; + +- vb = q->bufs[b->index]; +- + if (!vout->streaming) + return -EINVAL; + +- if (file->f_flags & O_NONBLOCK) +- /* Call videobuf_dqbuf for non blocking mode */ +- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1); +- else +- /* Call videobuf_dqbuf for blocking mode */ +- ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0); ++ ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK)); ++ if (ret) ++ return ret; ++ ++ vb = q->bufs[b->index]; + + addr = (unsigned long) vout->buf_phy_addr[vb->i]; + size = (unsigned long) vb->size; + dma_unmap_single(vout->vid_dev->v4l2_dev.dev, addr, + size, DMA_TO_DEVICE); +- return ret; ++ return 0; + } + + static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i) +-- +2.20.1 + diff --git a/queue-4.14/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch b/queue-4.14/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch new file mode 100644 index 00000000000..b4f6704ce04 --- /dev/null +++ b/queue-4.14/media-ov2659-fix-unbalanced-mutex_lock-unlock.patch @@ -0,0 +1,39 @@ +From 2e678de6a8e511673dacd6c6db361991cc82781e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2019 10:01:32 -0400 +Subject: media: ov2659: fix unbalanced mutex_lock/unlock + +From: Akinobu Mita + +[ Upstream commit 384538bda10913e5c94ec5b5d34bd3075931bcf4 ] + +Avoid returning with mutex locked. + +Fixes: fa8cb6444c32 ("[media] ov2659: Don't depend on subdev API") + +Cc: "Lad, Prabhakar" +Signed-off-by: Akinobu Mita +Acked-by: Lad, Prabhakar +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2659.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index 44b0584eb8a6c..e7768ed1ff9c2 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -1136,7 +1136,7 @@ static int ov2659_set_fmt(struct v4l2_subdev *sd, + mf = v4l2_subdev_get_try_format(sd, cfg, fmt->pad); + *mf = fmt->format; + #else +- return -ENOTTY; ++ ret = -ENOTTY; + #endif + } else { + s64 val; +-- +2.20.1 + diff --git a/queue-4.14/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch b/queue-4.14/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch new file mode 100644 index 00000000000..206595e6ebc --- /dev/null +++ b/queue-4.14/media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch @@ -0,0 +1,45 @@ +From 579098d17d2768581dafbd3db5901cbfc5f9611c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jan 2019 13:00:41 -0500 +Subject: media: s5p-jpeg: Correct step and max values for + V4L2_CID_JPEG_RESTART_INTERVAL + +From: Pawe? Chmiel + +[ Upstream commit 19c624c6b29e244c418f8b44a711cbf5e82e3cd4 ] + +This commit corrects max and step values for v4l2 control for +V4L2_CID_JPEG_RESTART_INTERVAL. Max should be 0xffff and step should be 1. +It was found by using v4l2-compliance tool and checking result of +VIDIOC_QUERY_EXT_CTRL/QUERYMENU test. +Previously it was complaining that step was bigger than difference +between max and min. + +Fixes: 15f4bc3b1f42 ("[media] s5p-jpeg: Add JPEG controls support") + +Signed-off-by: Pawe? Chmiel +Reviewed-by: Jacek Anaszewski +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-jpeg/jpeg-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c +index 4568e68e15fa6..85a5e33600c03 100644 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c +@@ -2005,7 +2005,7 @@ static int s5p_jpeg_controls_create(struct s5p_jpeg_ctx *ctx) + + v4l2_ctrl_new_std(&ctx->ctrl_handler, &s5p_jpeg_ctrl_ops, + V4L2_CID_JPEG_RESTART_INTERVAL, +- 0, 3, 0xffff, 0); ++ 0, 0xffff, 1, 0); + if (ctx->jpeg->variant->version == SJPEG_S5P) + mask = ~0x06; /* 422, 420 */ + } +-- +2.20.1 + diff --git a/queue-4.14/media-tw5864-fix-possible-null-pointer-dereference-i.patch b/queue-4.14/media-tw5864-fix-possible-null-pointer-dereference-i.patch new file mode 100644 index 00000000000..1f1f54e38e2 --- /dev/null +++ b/queue-4.14/media-tw5864-fix-possible-null-pointer-dereference-i.patch @@ -0,0 +1,47 @@ +From ee84efbaba20d40e4aade04816a7146f7ae64c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2019 22:01:24 -0400 +Subject: media: tw5864: Fix possible NULL pointer dereference in + tw5864_handle_frame + +From: YueHaibing + +[ Upstream commit 2e7682ebfc750177a4944eeb56e97a3f05734528 ] + +'vb' null check should be done before dereferencing it in +tw5864_handle_frame, otherwise a NULL pointer dereference +may occur. + +Fixes: 34d1324edd31 ("[media] pci: Add tw5864 driver") + +Signed-off-by: YueHaibing +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/tw5864/tw5864-video.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/tw5864/tw5864-video.c b/drivers/media/pci/tw5864/tw5864-video.c +index e7bd2b8484e3d..ee1230440b397 100644 +--- a/drivers/media/pci/tw5864/tw5864-video.c ++++ b/drivers/media/pci/tw5864/tw5864-video.c +@@ -1395,13 +1395,13 @@ static void tw5864_handle_frame(struct tw5864_h264_frame *frame) + input->vb = NULL; + spin_unlock_irqrestore(&input->slock, flags); + +- v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf); +- + if (!vb) { /* Gone because of disabling */ + dev_dbg(&dev->pci->dev, "vb is empty, dropping frame\n"); + return; + } + ++ v4l2_buf = to_vb2_v4l2_buffer(&vb->vb.vb2_buf); ++ + /* + * Check for space. + * Mind the overhead of startcode emulation prevention. +-- +2.20.1 + diff --git a/queue-4.14/media-vivid-fix-incorrect-assignment-operation-when-.patch b/queue-4.14/media-vivid-fix-incorrect-assignment-operation-when-.patch new file mode 100644 index 00000000000..04a6a9d58f9 --- /dev/null +++ b/queue-4.14/media-vivid-fix-incorrect-assignment-operation-when-.patch @@ -0,0 +1,42 @@ +From b5b047df2f06b320fccb202982d4956531b9597e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2019 10:55:15 -0400 +Subject: media: vivid: fix incorrect assignment operation when setting video + mode + +From: Colin Ian King + +[ Upstream commit d4ec9550e4b2d2e357a46fdc65d8ef3d4d15984c ] + +The assigment of FB_VMODE_NONINTERLACE to var->vmode should be a +bit-wise or of FB_VMODE_NONINTERLACE instead of an assignment, +otherwise the previous clearing of the FB_VMODE_MASK bits of +var->vmode makes no sense and is redundant. + +Addresses-Coverity: ("Unused value") +Fixes: ad4e02d5081d ("[media] vivid: add a simple framebuffer device for overlay testing") + +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-osd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vivid/vivid-osd.c b/drivers/media/platform/vivid/vivid-osd.c +index bdc380b14e0c4..a95b7c56569e3 100644 +--- a/drivers/media/platform/vivid/vivid-osd.c ++++ b/drivers/media/platform/vivid/vivid-osd.c +@@ -167,7 +167,7 @@ static int _vivid_fb_check_var(struct fb_var_screeninfo *var, struct vivid_dev * + var->nonstd = 0; + + var->vmode &= ~FB_VMODE_MASK; +- var->vmode = FB_VMODE_NONINTERLACED; ++ var->vmode |= FB_VMODE_NONINTERLACED; + + /* Dummy values */ + var->hsync_len = 24; +-- +2.20.1 + diff --git a/queue-4.14/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch b/queue-4.14/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch new file mode 100644 index 00000000000..970a2c7af74 --- /dev/null +++ b/queue-4.14/media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch @@ -0,0 +1,40 @@ +From 40d1aca0ec59c47e89980883c88055d74c3dd9b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Mar 2019 02:27:43 -0500 +Subject: media: wl128x: Fix an error code in fm_download_firmware() + +From: Dan Carpenter + +[ Upstream commit ef4bb63dc1f7213c08e13f6943c69cd27f69e4a3 ] + +We forgot to set "ret" on this error path. + +Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") + +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/radio/wl128x/fmdrv_common.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c +index 26895ae42fcf4..2d20d908e2803 100644 +--- a/drivers/media/radio/wl128x/fmdrv_common.c ++++ b/drivers/media/radio/wl128x/fmdrv_common.c +@@ -1271,8 +1271,9 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name) + + switch (action->type) { + case ACTION_SEND_COMMAND: /* Send */ +- if (fmc_send_cmd(fmdev, 0, 0, action->data, +- action->size, NULL, NULL)) ++ ret = fmc_send_cmd(fmdev, 0, 0, action->data, ++ action->size, NULL, NULL); ++ if (ret) + goto rel_fw; + + cmd_cnt++; +-- +2.20.1 + diff --git a/queue-4.14/mfd-intel-lpss-release-ida-resources.patch b/queue-4.14/mfd-intel-lpss-release-ida-resources.patch new file mode 100644 index 00000000000..51b8e7ad820 --- /dev/null +++ b/queue-4.14/mfd-intel-lpss-release-ida-resources.patch @@ -0,0 +1,36 @@ +From 606faaa4eafe5d7c0a98142c4e30dbf41a453ac6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jun 2019 15:56:31 +0300 +Subject: mfd: intel-lpss: Release IDA resources + +From: Andy Shevchenko + +[ Upstream commit 02f36911c1b41fcd8779fa0c135aab0554333fa5 ] + +ida instances allocate some internal memory for ->free_bitmap +in addition to the base 'struct ida'. Use ida_destroy() to release +that memory at module_exit(). + +Fixes: 4b45efe85263 ("mfd: Add support for Intel Sunrisepoint LPSS devices") +Signed-off-by: Andy Shevchenko +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/intel-lpss.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c +index b5c4f8f974aa7..9ed573e232c00 100644 +--- a/drivers/mfd/intel-lpss.c ++++ b/drivers/mfd/intel-lpss.c +@@ -541,6 +541,7 @@ module_init(intel_lpss_init); + + static void __exit intel_lpss_exit(void) + { ++ ida_destroy(&intel_lpss_devid_ida); + debugfs_remove(intel_lpss_debugfs); + } + module_exit(intel_lpss_exit); +-- +2.20.1 + diff --git a/queue-4.14/mic-avoid-statically-declaring-a-struct-device.patch b/queue-4.14/mic-avoid-statically-declaring-a-struct-device.patch new file mode 100644 index 00000000000..fc70f1780b1 --- /dev/null +++ b/queue-4.14/mic-avoid-statically-declaring-a-struct-device.patch @@ -0,0 +1,118 @@ +From 5d95e60ad3d5e141f38e81fcd11f6f1c1c677b87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jul 2019 11:24:09 +0200 +Subject: mic: avoid statically declaring a 'struct device'. + +From: Arnd Bergmann + +[ Upstream commit bc83f79bd2119230888fb8574639d5a51b38f903 ] + +Generally, declaring a platform device as a static variable is +a bad idea and can cause all kinds of problems, in particular +with the DMA configuration and lifetime rules. + +A specific problem we hit here is from a bug in clang that warns +about certain (otherwise valid) macros when used in static variables: + +drivers/misc/mic/card/mic_x100.c:285:27: warning: shift count >= width of type [-Wshift-count-overflow] +static u64 mic_dma_mask = DMA_BIT_MASK(64); + ^~~~~~~~~~~~~~~~ +include/linux/dma-mapping.h:141:54: note: expanded from macro 'DMA_BIT_MASK' + #define DMA_BIT_MASK(n) (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1)) + ^ ~~~ + +A slightly better way here is to create the platform device dynamically +and set the dma mask in the probe function. +This avoids the warning and some other problems, but is still not ideal +because the device creation should really be separated from the driver, +and the fact that the device has no parent means we have to force +the dma mask rather than having it set up from the bus that the device +is actually on. + +Fixes: dd8d8d44df64 ("misc: mic: MIC card driver specific changes to enable SCIF") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20190712092426.872625-1-arnd@arndb.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mic/card/mic_x100.c | 28 ++++++++++++---------------- + 1 file changed, 12 insertions(+), 16 deletions(-) + +diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c +index b9f0710ffa6b0..4007adc666f37 100644 +--- a/drivers/misc/mic/card/mic_x100.c ++++ b/drivers/misc/mic/card/mic_x100.c +@@ -249,6 +249,9 @@ static int __init mic_probe(struct platform_device *pdev) + mdrv->dev = &pdev->dev; + snprintf(mdrv->name, sizeof(mic_driver_name), mic_driver_name); + ++ /* FIXME: use dma_set_mask_and_coherent() and check result */ ++ dma_coerce_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)); ++ + mdev->mmio.pa = MIC_X100_MMIO_BASE; + mdev->mmio.len = MIC_X100_MMIO_LEN; + mdev->mmio.va = devm_ioremap(&pdev->dev, MIC_X100_MMIO_BASE, +@@ -294,18 +297,6 @@ static void mic_platform_shutdown(struct platform_device *pdev) + mic_remove(pdev); + } + +-static u64 mic_dma_mask = DMA_BIT_MASK(64); +- +-static struct platform_device mic_platform_dev = { +- .name = mic_driver_name, +- .id = 0, +- .num_resources = 0, +- .dev = { +- .dma_mask = &mic_dma_mask, +- .coherent_dma_mask = DMA_BIT_MASK(64), +- }, +-}; +- + static struct platform_driver __refdata mic_platform_driver = { + .probe = mic_probe, + .remove = mic_remove, +@@ -315,6 +306,8 @@ static struct platform_driver __refdata mic_platform_driver = { + }, + }; + ++static struct platform_device *mic_platform_dev; ++ + static int __init mic_init(void) + { + int ret; +@@ -328,9 +321,12 @@ static int __init mic_init(void) + + request_module("mic_x100_dma"); + mic_init_card_debugfs(); +- ret = platform_device_register(&mic_platform_dev); ++ ++ mic_platform_dev = platform_device_register_simple(mic_driver_name, ++ 0, NULL, 0); ++ ret = PTR_ERR_OR_ZERO(mic_platform_dev); + if (ret) { +- pr_err("platform_device_register ret %d\n", ret); ++ pr_err("platform_device_register_full ret %d\n", ret); + goto cleanup_debugfs; + } + ret = platform_driver_register(&mic_platform_driver); +@@ -341,7 +337,7 @@ static int __init mic_init(void) + return ret; + + device_unregister: +- platform_device_unregister(&mic_platform_dev); ++ platform_device_unregister(mic_platform_dev); + cleanup_debugfs: + mic_exit_card_debugfs(); + done: +@@ -351,7 +347,7 @@ done: + static void __exit mic_exit(void) + { + platform_driver_unregister(&mic_platform_driver); +- platform_device_unregister(&mic_platform_dev); ++ platform_device_unregister(mic_platform_dev); + mic_exit_card_debugfs(); + } + +-- +2.20.1 + diff --git a/queue-4.14/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch b/queue-4.14/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch new file mode 100644 index 00000000000..39f80e9d606 --- /dev/null +++ b/queue-4.14/mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch @@ -0,0 +1,103 @@ +From 236d4279c4defca5ba9c7fe74ed48df87b86b00e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2019 14:10:12 -0700 +Subject: mips: avoid explicit UB in assignment of mips_io_port_base + +From: Nick Desaulniers + +[ Upstream commit 12051b318bc3ce5b42d6d786191008284b067d83 ] + +The code in question is modifying a variable declared const through +pointer manipulation. Such code is explicitly undefined behavior, and +is the lone issue preventing malta_defconfig from booting when built +with Clang: + +If an attempt is made to modify an object defined with a const-qualified +type through use of an lvalue with non-const-qualified type, the +behavior is undefined. + +LLVM is removing such assignments. A simple fix is to not declare +variables const that you plan on modifying. Limiting the scope would be +a better method of preventing unwanted writes to such a variable. + +Further, the code in question mentions "compiler bugs" without any links +to bug reports, so it is difficult to know if the issue is resolved in +GCC. The patch was authored in 2006, which would have been GCC 4.0.3 or +4.1.1. The minimal supported version of GCC in the Linux kernel is +currently 4.6. + +For what its worth, there was UB before the commit in question, it just +added a barrier and got lucky IRT codegen. I don't think there's any +actual compiler bugs related, just runtime bugs due to UB. + +Link: https://github.com/ClangBuiltLinux/linux/issues/610 +Fixes: 966f4406d903 ("[MIPS] Work around bad code generation for .") +Reported-by: Nathan Chancellor +Debugged-by: Nathan Chancellor +Suggested-by: Eli Friedman +Signed-off-by: Nick Desaulniers +Reviewed-by: Nathan Chancellor +Tested-by: Nathan Chancellor +Signed-off-by: Paul Burton +Cc: ralf@linux-mips.org +Cc: jhogan@kernel.org +Cc: Maciej W. Rozycki +Cc: Hassan Naveed +Cc: Stephen Kitt +Cc: Serge Semin +Cc: Mike Rapoport +Cc: Andrew Morton +Cc: Michal Hocko +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: clang-built-linux@googlegroups.com +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/io.h | 14 ++------------ + arch/mips/kernel/setup.c | 2 +- + 2 files changed, 3 insertions(+), 13 deletions(-) + +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 57b34257be2bf..98eb15b0524c4 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -60,21 +60,11 @@ + * instruction, so the lower 16 bits must be zero. Should be true on + * on any sane architecture; generic code does not use this assumption. + */ +-extern const unsigned long mips_io_port_base; ++extern unsigned long mips_io_port_base; + +-/* +- * Gcc will generate code to load the value of mips_io_port_base after each +- * function call which may be fairly wasteful in some cases. So we don't +- * play quite by the book. We tell gcc mips_io_port_base is a long variable +- * which solves the code generation issue. Now we need to violate the +- * aliasing rules a little to make initialization possible and finally we +- * will need the barrier() to fight side effects of the aliasing chat. +- * This trickery will eventually collapse under gcc's optimizer. Oh well. +- */ + static inline void set_io_port_base(unsigned long base) + { +- * (unsigned long *) &mips_io_port_base = base; +- barrier(); ++ mips_io_port_base = base; + } + + /* +diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c +index 795caa763da32..05ed4ed411c73 100644 +--- a/arch/mips/kernel/setup.c ++++ b/arch/mips/kernel/setup.c +@@ -75,7 +75,7 @@ static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE; + * mips_io_port_base is the begin of the address space to which x86 style + * I/O ports are mapped. + */ +-const unsigned long mips_io_port_base = -1; ++unsigned long mips_io_port_base = -1; + EXPORT_SYMBOL(mips_io_port_base); + + static struct resource code_resource = { .name = "Kernel code", }; +-- +2.20.1 + diff --git a/queue-4.14/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch b/queue-4.14/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch new file mode 100644 index 00000000000..8e0710c0358 --- /dev/null +++ b/queue-4.14/mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch @@ -0,0 +1,228 @@ +From e237e76098c816eda6be08537c1ff457204cf298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Dec 2018 12:55:09 +0100 +Subject: MIPS: BCM63XX: drop unused and broken DSP platform device + +From: Jonas Gorski + +[ Upstream commit 682fee802843b332f9c51ffc8e062de5ff773f2e ] + +Trying to register the DSP platform device results in a null pointer +access: + +[ 0.124184] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 804e305c, ra == 804e6f20 +[ 0.135208] Oops[#1]: +[ 0.137514] CPU: 0 PID: 1 Comm: swapper Not tainted 4.14.87 +... +[ 0.197117] epc : 804e305c bcm63xx_dsp_register+0x80/0xa4 +[ 0.202838] ra : 804e6f20 board_register_devices+0x258/0x390 +... + +This happens because it tries to copy the passed platform data over the +platform_device's unpopulated platform_data. + +Since this code has been broken since its submission, no driver was ever +submitted for it, and apparently nobody was using it, just remove it +instead of trying to fix it. + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") +Signed-off-by: Jonas Gorski +Signed-off-by: Paul Burton +Acked-by: Florian Fainelli +Cc: linux-mips@linux-mips.org +Cc: Ralf Baechle +Cc: James Hogan +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/Makefile | 6 +- + arch/mips/bcm63xx/boards/board_bcm963xx.c | 20 ------- + arch/mips/bcm63xx/dev-dsp.c | 56 ------------------- + .../asm/mach-bcm63xx/bcm63xx_dev_dsp.h | 14 ----- + .../include/asm/mach-bcm63xx/board_bcm963xx.h | 5 -- + 5 files changed, 3 insertions(+), 98 deletions(-) + delete mode 100644 arch/mips/bcm63xx/dev-dsp.c + delete mode 100644 arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h + +diff --git a/arch/mips/bcm63xx/Makefile b/arch/mips/bcm63xx/Makefile +index c69f297fc1df3..d89651e538f64 100644 +--- a/arch/mips/bcm63xx/Makefile ++++ b/arch/mips/bcm63xx/Makefile +@@ -1,8 +1,8 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-y += clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \ +- setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \ +- dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \ +- dev-wdt.o dev-usb-usbd.o ++ setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \ ++ dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \ ++ dev-usb-usbd.o + obj-$(CONFIG_EARLY_PRINTK) += early_printk.o + + obj-y += boards/ +diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c +index b2097c0d2ed78..36ec3dc2c999a 100644 +--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c ++++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c +@@ -23,7 +23,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -289,14 +288,6 @@ static struct board_info __initdata board_96348gw_10 = { + .has_pccard = 1, + .has_ehci0 = 1, + +- .has_dsp = 1, +- .dsp = { +- .gpio_rst = 6, +- .gpio_int = 34, +- .cs = 2, +- .ext_irq = 2, +- }, +- + .leds = { + { + .name = "adsl-fail", +@@ -401,14 +392,6 @@ static struct board_info __initdata board_96348gw = { + + .has_ohci0 = 1, + +- .has_dsp = 1, +- .dsp = { +- .gpio_rst = 6, +- .gpio_int = 34, +- .ext_irq = 2, +- .cs = 2, +- }, +- + .leds = { + { + .name = "adsl-fail", +@@ -898,9 +881,6 @@ int __init board_register_devices(void) + if (board.has_usbd) + bcm63xx_usbd_register(&board.usbd); + +- if (board.has_dsp) +- bcm63xx_dsp_register(&board.dsp); +- + /* Generate MAC address for WLAN and register our SPROM, + * do this after registering enet devices + */ +diff --git a/arch/mips/bcm63xx/dev-dsp.c b/arch/mips/bcm63xx/dev-dsp.c +deleted file mode 100644 +index 5bb5b154c9bd3..0000000000000 +--- a/arch/mips/bcm63xx/dev-dsp.c ++++ /dev/null +@@ -1,56 +0,0 @@ +-/* +- * Broadcom BCM63xx VoIP DSP registration +- * +- * This file is subject to the terms and conditions of the GNU General Public +- * License. See the file "COPYING" in the main directory of this archive +- * for more details. +- * +- * Copyright (C) 2009 Florian Fainelli +- */ +- +-#include +-#include +-#include +- +-#include +-#include +-#include +-#include +- +-static struct resource voip_dsp_resources[] = { +- { +- .start = -1, /* filled at runtime */ +- .end = -1, /* filled at runtime */ +- .flags = IORESOURCE_MEM, +- }, +- { +- .start = -1, /* filled at runtime */ +- .flags = IORESOURCE_IRQ, +- }, +-}; +- +-static struct platform_device bcm63xx_voip_dsp_device = { +- .name = "bcm63xx-voip-dsp", +- .id = -1, +- .num_resources = ARRAY_SIZE(voip_dsp_resources), +- .resource = voip_dsp_resources, +-}; +- +-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd) +-{ +- struct bcm63xx_dsp_platform_data *dpd; +- u32 val; +- +- /* Get the memory window */ +- val = bcm_mpi_readl(MPI_CSBASE_REG(pd->cs - 1)); +- val &= MPI_CSBASE_BASE_MASK; +- voip_dsp_resources[0].start = val; +- voip_dsp_resources[0].end = val + 0xFFFFFFF; +- voip_dsp_resources[1].start = pd->ext_irq; +- +- /* copy given platform data */ +- dpd = bcm63xx_voip_dsp_device.dev.platform_data; +- memcpy(dpd, pd, sizeof (*pd)); +- +- return platform_device_register(&bcm63xx_voip_dsp_device); +-} +diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h +deleted file mode 100644 +index 4e4970787371a..0000000000000 +--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_dsp.h ++++ /dev/null +@@ -1,14 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-#ifndef __BCM63XX_DSP_H +-#define __BCM63XX_DSP_H +- +-struct bcm63xx_dsp_platform_data { +- unsigned gpio_rst; +- unsigned gpio_int; +- unsigned cs; +- unsigned ext_irq; +-}; +- +-int __init bcm63xx_dsp_register(const struct bcm63xx_dsp_platform_data *pd); +- +-#endif /* __BCM63XX_DSP_H */ +diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h +index 5e5b1bc4a3247..830f53f28e3f7 100644 +--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h ++++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h +@@ -7,7 +7,6 @@ + #include + #include + #include +-#include + + /* + * flash mapping +@@ -31,7 +30,6 @@ struct board_info { + unsigned int has_ohci0:1; + unsigned int has_ehci0:1; + unsigned int has_usbd:1; +- unsigned int has_dsp:1; + unsigned int has_uart0:1; + unsigned int has_uart1:1; + +@@ -43,9 +41,6 @@ struct board_info { + /* USB config */ + struct bcm63xx_usbd_platform_data usbd; + +- /* DSP config */ +- struct bcm63xx_dsp_platform_data dsp; +- + /* GPIO LEDs */ + struct gpio_led leds[5]; + +-- +2.20.1 + diff --git a/queue-4.14/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch b/queue-4.14/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch new file mode 100644 index 00000000000..4f4a755c78f --- /dev/null +++ b/queue-4.14/mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch @@ -0,0 +1,42 @@ +From 8b3f7b3e61d3de2c66f96e0161dc4572f461e244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 21:33:50 +0800 +Subject: MIPS: Loongson: Fix return value of loongson_hwmon_init + +From: Tiezhu Yang + +[ Upstream commit dece3c2a320b0a6d891da6ff774ab763969b6860 ] + +When call function hwmon_device_register failed, use the actual +return value instead of always -ENOMEM. + +Fixes: 64f09aa967e1 ("MIPS: Loongson-3: Add CPU Hwmon platform driver") +Signed-off-by: Tiezhu Yang +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: Huacai Chen +Cc: Jiaxun Yang +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/platform/mips/cpu_hwmon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/mips/cpu_hwmon.c b/drivers/platform/mips/cpu_hwmon.c +index 322de58eebaf5..02484ae9a1165 100644 +--- a/drivers/platform/mips/cpu_hwmon.c ++++ b/drivers/platform/mips/cpu_hwmon.c +@@ -158,7 +158,7 @@ static int __init loongson_hwmon_init(void) + + cpu_hwmon_dev = hwmon_device_register(NULL); + if (IS_ERR(cpu_hwmon_dev)) { +- ret = -ENOMEM; ++ ret = PTR_ERR(cpu_hwmon_dev); + pr_err("hwmon_device_register fail!\n"); + goto fail_hwmon_device_register; + } +-- +2.20.1 + diff --git a/queue-4.14/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch b/queue-4.14/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch new file mode 100644 index 00000000000..cd15cc93cdb --- /dev/null +++ b/queue-4.14/misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch @@ -0,0 +1,70 @@ +From 09ab5da6194716977ff309e226492ac91a4cf3d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 May 2019 09:15:17 -0700 +Subject: misc: sgi-xp: Properly initialize buf in xpc_get_rsvd_page_pa + +From: Nathan Chancellor + +[ Upstream commit b0576f9ecb5c51e9932531d23c447b2739261841 ] + +Clang warns: + +drivers/misc/sgi-xp/xpc_partition.c:73:14: warning: variable 'buf' is +uninitialized when used within its own initialization [-Wuninitialized] + void *buf = buf; + ~~~ ^~~ +1 warning generated. + +Arnd's explanation during review: + + /* + * Returns the physical address of the partition's reserved page through + * an iterative number of calls. + * + * On first call, 'cookie' and 'len' should be set to 0, and 'addr' + * set to the nasid of the partition whose reserved page's address is + * being sought. + * On subsequent calls, pass the values, that were passed back on the + * previous call. + * + * While the return status equals SALRET_MORE_PASSES, keep calling + * this function after first copying 'len' bytes starting at 'addr' + * into 'buf'. Once the return status equals SALRET_OK, 'addr' will + * be the physical address of the partition's reserved page. If the + * return status equals neither of these, an error as occurred. + */ + static inline s64 + sn_partition_reserved_page_pa(u64 buf, u64 *cookie, u64 *addr, u64 *len) + + so *len is set to zero on the first call and tells the bios how many + bytes are accessible at 'buf', and it does get updated by the BIOS to + tell us how many bytes it needs, and then we allocate that and try again. + +Fixes: 279290294662 ("[IA64-SGI] cleanup the way XPC locates the reserved page") +Link: https://github.com/ClangBuiltLinux/linux/issues/466 +Suggested-by: Stephen Hines +Reviewed-by: Arnd Bergmann +Reviewed-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/sgi-xp/xpc_partition.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c +index 6956f7e7d4392..ca5f0102daef4 100644 +--- a/drivers/misc/sgi-xp/xpc_partition.c ++++ b/drivers/misc/sgi-xp/xpc_partition.c +@@ -70,7 +70,7 @@ xpc_get_rsvd_page_pa(int nasid) + unsigned long rp_pa = nasid; /* seed with nasid */ + size_t len = 0; + size_t buf_len = 0; +- void *buf = buf; ++ void *buf = NULL; + void *buf_base = NULL; + enum xp_retval (*get_partition_rsvd_page_pa) + (void *, u64 *, unsigned long *, size_t *) = +-- +2.20.1 + diff --git a/queue-4.14/mlxsw-reg-qeec-add-minimum-shaper-fields.patch b/queue-4.14/mlxsw-reg-qeec-add-minimum-shaper-fields.patch new file mode 100644 index 00000000000..ba1ec5a9c81 --- /dev/null +++ b/queue-4.14/mlxsw-reg-qeec-add-minimum-shaper-fields.patch @@ -0,0 +1,77 @@ +From 5751fef2b10c3a9115fa2e06bd5e032b4d4e5f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 09:56:42 +0000 +Subject: mlxsw: reg: QEEC: Add minimum shaper fields + +From: Petr Machata + +[ Upstream commit 8b931821aa04823e2e5df0ae93937baabbd23286 ] + +Add QEEC.mise (minimum shaper enable) and QEEC.min_shaper_rate to enable +configuration of minimum shaper. + +Increase the QEEC length to 0x20 as well: that's the length that the +register has had for a long time now, but with the configurations that +mlxsw typically exercises, the firmware tolerated 0x1C-sized packets. +With mise=true however, FW rejects packets unless they have the full +required length. + +Fixes: b9b7cee40579 ("mlxsw: reg: Add QoS ETS Element Configuration register") +Signed-off-by: Petr Machata +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/reg.h | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h +index 8ab7a4f98a07c..e7974ba064324 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/reg.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h +@@ -2452,7 +2452,7 @@ static inline void mlxsw_reg_qtct_pack(char *payload, u8 local_port, + * Configures the ETS elements. + */ + #define MLXSW_REG_QEEC_ID 0x400D +-#define MLXSW_REG_QEEC_LEN 0x1C ++#define MLXSW_REG_QEEC_LEN 0x20 + + MLXSW_REG_DEFINE(qeec, MLXSW_REG_QEEC_ID, MLXSW_REG_QEEC_LEN); + +@@ -2494,6 +2494,15 @@ MLXSW_ITEM32(reg, qeec, element_index, 0x04, 0, 8); + */ + MLXSW_ITEM32(reg, qeec, next_element_index, 0x08, 0, 8); + ++/* reg_qeec_mise ++ * Min shaper configuration enable. Enables configuration of the min ++ * shaper on this ETS element ++ * 0 - Disable ++ * 1 - Enable ++ * Access: RW ++ */ ++MLXSW_ITEM32(reg, qeec, mise, 0x0C, 31, 1); ++ + enum { + MLXSW_REG_QEEC_BYTES_MODE, + MLXSW_REG_QEEC_PACKETS_MODE, +@@ -2510,6 +2519,17 @@ enum { + */ + MLXSW_ITEM32(reg, qeec, pb, 0x0C, 28, 1); + ++/* The smallest permitted min shaper rate. */ ++#define MLXSW_REG_QEEC_MIS_MIN 200000 /* Kbps */ ++ ++/* reg_qeec_min_shaper_rate ++ * Min shaper information rate. ++ * For CPU port, can only be configured for port hierarchy. ++ * When in bytes mode, value is specified in units of 1000bps. ++ * Access: RW ++ */ ++MLXSW_ITEM32(reg, qeec, min_shaper_rate, 0x0C, 0, 28); ++ + /* reg_qeec_mase + * Max shaper configuration enable. Enables configuration of the max + * shaper on this ETS element. +-- +2.20.1 + diff --git a/queue-4.14/mmc-core-fix-possible-use-after-free-of-host.patch b/queue-4.14/mmc-core-fix-possible-use-after-free-of-host.patch new file mode 100644 index 00000000000..91b40537f81 --- /dev/null +++ b/queue-4.14/mmc-core-fix-possible-use-after-free-of-host.patch @@ -0,0 +1,40 @@ +From 9a34605b2da8baa740be93be73d03a7ff0b1cee9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2019 16:28:37 +0800 +Subject: mmc: core: fix possible use after free of host + +From: Pan Bian + +[ Upstream commit 8e1943af2986db42bee2b8dddf49a36cdb2e9219 ] + +In the function mmc_alloc_host, the function put_device is called to +release allocated resources when mmc_gpio_alloc fails. Finally, the +function pointed by host->class_dev.class->dev_release (i.e., +mmc_host_classdev_release) is used to release resources including the +host structure. However, after put_device, host is used and released +again. Resulting in a use-after-free bug. + +Fixes: 1ed217194488 ("mmc: core: fix error path in mmc_host_alloc") +Signed-off-by: Pan Bian +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/host.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index ad88deb2e8f3b..3740fb0052a49 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -376,8 +376,6 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + + if (mmc_gpio_alloc(host)) { + put_device(&host->class_dev); +- ida_simple_remove(&mmc_host_ida, host->index); +- kfree(host); + return NULL; + } + +-- +2.20.1 + diff --git a/queue-4.14/mmc-core-fix-wl1251-sdio-quirks.patch b/queue-4.14/mmc-core-fix-wl1251-sdio-quirks.patch new file mode 100644 index 00000000000..69a891a8943 --- /dev/null +++ b/queue-4.14/mmc-core-fix-wl1251-sdio-quirks.patch @@ -0,0 +1,43 @@ +From 82caf3ffeed988fa9fa949286658c5874da1364b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 11:30:43 +0100 +Subject: mmc: core: fix wl1251 sdio quirks + +From: H. Nikolaus Schaller + +[ Upstream commit 16568b4a4f0c34bd35cfadac63303c7af7812764 ] + +wl1251 and wl1271 have different vendor id and device id. +So we need to handle both with sdio quirks. + +Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.11+ +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/quirks.h | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 5153577754f02..09897abb79ed6 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -119,7 +119,14 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = { + END_FIXUP + }; + ++ + static const struct mmc_fixup sdio_fixup_methods[] = { ++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251, ++ add_quirk, MMC_QUIRK_NONSTD_FUNC_IF), ++ ++ SDIO_FIXUP(SDIO_VENDOR_ID_TI_WL1251, SDIO_DEVICE_ID_TI_WL1251, ++ add_quirk, MMC_QUIRK_DISABLE_CD), ++ + SDIO_FIXUP(SDIO_VENDOR_ID_TI, SDIO_DEVICE_ID_TI_WL1271, + add_quirk, MMC_QUIRK_NONSTD_FUNC_IF), + +-- +2.20.1 + diff --git a/queue-4.14/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch b/queue-4.14/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch new file mode 100644 index 00000000000..e4a48472f64 --- /dev/null +++ b/queue-4.14/mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch @@ -0,0 +1,38 @@ +From 93742d47dbe8b9cbc4c7b3567251094f6eb54eec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Dec 2018 21:59:18 +0100 +Subject: mmc: sdhci-brcmstb: handle mmc_of_parse() errors during probe + +From: Stefan Wahren + +[ Upstream commit 1e20186e706da8446f9435f2924cd65ab1397e73 ] + +We need to handle mmc_of_parse() errors during probe otherwise the +MMC driver could start without proper initialization (e.g. power sequence). + +Fixes: 476bf3d62d5c ("mmc: sdhci-brcmstb: Add driver for Broadcom BRCMSTB SoCs") +Signed-off-by: Stefan Wahren +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-brcmstb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-brcmstb.c b/drivers/mmc/host/sdhci-brcmstb.c +index 552bddc5096ce..1cd10356fc14f 100644 +--- a/drivers/mmc/host/sdhci-brcmstb.c ++++ b/drivers/mmc/host/sdhci-brcmstb.c +@@ -55,7 +55,9 @@ static int sdhci_brcmstb_probe(struct platform_device *pdev) + } + + sdhci_get_of_property(pdev); +- mmc_of_parse(host->mmc); ++ res = mmc_of_parse(host->mmc); ++ if (res) ++ goto err; + + /* + * Supply the existing CAPS, but clear the UHS modes. This +-- +2.20.1 + diff --git a/queue-4.14/mmc-sdio-fix-wl1251-vendor-id.patch b/queue-4.14/mmc-sdio-fix-wl1251-vendor-id.patch new file mode 100644 index 00000000000..1d0b0caa674 --- /dev/null +++ b/queue-4.14/mmc-sdio-fix-wl1251-vendor-id.patch @@ -0,0 +1,44 @@ +From 1dc5bf363a07b1e9a1000419133eeb6313ce66cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 11:30:42 +0100 +Subject: mmc: sdio: fix wl1251 vendor id + +From: H. Nikolaus Schaller + +[ Upstream commit e5db673e7fe2f971ec82039a28dc0811c2100e87 ] + +v4.11-rc1 did introduce a patch series that rearranged the +sdio quirks into a header file. Unfortunately this did forget +to handle SDIO_VENDOR_ID_TI differently between wl1251 and +wl1271 with the result that although the wl1251 was found on +the sdio bus, the firmware did not load any more and there was +no interface registration. + +This patch defines separate constants to be used by sdio quirks +and drivers. + +Fixes: 884f38607897 ("mmc: core: move some sdio IDs out of quirks file") +Signed-off-by: H. Nikolaus Schaller +Cc: # v4.11+ +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + include/linux/mmc/sdio_ids.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h +index 0a7abe8a407ff..68bbbd9edc08e 100644 +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -67,6 +67,8 @@ + + #define SDIO_VENDOR_ID_TI 0x0097 + #define SDIO_DEVICE_ID_TI_WL1271 0x4076 ++#define SDIO_VENDOR_ID_TI_WL1251 0x104c ++#define SDIO_DEVICE_ID_TI_WL1251 0x9066 + + #define SDIO_VENDOR_ID_STE 0x0020 + #define SDIO_DEVICE_ID_STE_CW1200 0x2280 +-- +2.20.1 + diff --git a/queue-4.14/mpls-fix-warning-with-multi-label-encap.patch b/queue-4.14/mpls-fix-warning-with-multi-label-encap.patch new file mode 100644 index 00000000000..e819e0eee59 --- /dev/null +++ b/queue-4.14/mpls-fix-warning-with-multi-label-encap.patch @@ -0,0 +1,45 @@ +From fba9b0e2b51f291c97655f7c7fbf573b55d6ed40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jun 2019 11:49:41 +0100 +Subject: mpls: fix warning with multi-label encap + +From: George Wilkie + +[ Upstream commit 2f3f7d1fa0d1039b24a55d127ed190f196fc3e79 ] + +If you configure a route with multiple labels, e.g. + ip route add 10.10.3.0/24 encap mpls 16/100 via 10.10.2.2 dev ens4 +A warning is logged: + kernel: [ 130.561819] netlink: 'ip': attribute type 1 has an invalid + length. + +This happens because mpls_iptunnel_policy has set the type of +MPLS_IPTUNNEL_DST to fixed size NLA_U32. +Change it to a minimum size. +nla_get_labels() does the remaining validation. + +Fixes: e3e4712ec096 ("mpls: ip tunnel support") +Signed-off-by: George Wilkie +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mpls/mpls_iptunnel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mpls/mpls_iptunnel.c b/net/mpls/mpls_iptunnel.c +index 6e558a419f603..6c01166f972b9 100644 +--- a/net/mpls/mpls_iptunnel.c ++++ b/net/mpls/mpls_iptunnel.c +@@ -28,7 +28,7 @@ + #include "internal.h" + + static const struct nla_policy mpls_iptunnel_policy[MPLS_IPTUNNEL_MAX + 1] = { +- [MPLS_IPTUNNEL_DST] = { .type = NLA_U32 }, ++ [MPLS_IPTUNNEL_DST] = { .len = sizeof(u32) }, + [MPLS_IPTUNNEL_TTL] = { .type = NLA_U8 }, + }; + +-- +2.20.1 + diff --git a/queue-4.14/net-add-read-write-_once-annotations-on-rskq_accept_.patch b/queue-4.14/net-add-read-write-_once-annotations-on-rskq_accept_.patch new file mode 100644 index 00000000000..af96b462b05 --- /dev/null +++ b/queue-4.14/net-add-read-write-_once-annotations-on-rskq_accept_.patch @@ -0,0 +1,76 @@ +From f69738a4eb0ab2d0f6119baec3759a50e34e8c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 14:51:20 -0700 +Subject: net: add {READ|WRITE}_ONCE() annotations on ->rskq_accept_head + +From: Eric Dumazet + +[ Upstream commit 60b173ca3d1cd1782bd0096dc17298ec242f6fb1 ] + +reqsk_queue_empty() is called from inet_csk_listen_poll() while +other cpus might write ->rskq_accept_head value. + +Use {READ|WRITE}_ONCE() to avoid compiler tricks +and potential KCSAN splats. + +Fixes: fff1f3001cc5 ("tcp: add a spinlock to protect struct request_sock_queue") +Signed-off-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/xen/pvcalls-back.c | 2 +- + include/net/request_sock.h | 4 ++-- + net/ipv4/inet_connection_sock.c | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index abd6dbc29ac28..58be15c27b6d6 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -792,7 +792,7 @@ static int pvcalls_back_poll(struct xenbus_device *dev, + mappass->reqcopy = *req; + icsk = inet_csk(mappass->sock->sk); + queue = &icsk->icsk_accept_queue; +- data = queue->rskq_accept_head != NULL; ++ data = READ_ONCE(queue->rskq_accept_head) != NULL; + if (data) { + mappass->reqcopy.cmd = 0; + ret = 0; +diff --git a/include/net/request_sock.h b/include/net/request_sock.h +index 23e22054aa60d..04aa2c7d35c4e 100644 +--- a/include/net/request_sock.h ++++ b/include/net/request_sock.h +@@ -181,7 +181,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req, + + static inline bool reqsk_queue_empty(const struct request_sock_queue *queue) + { +- return queue->rskq_accept_head == NULL; ++ return READ_ONCE(queue->rskq_accept_head) == NULL; + } + + static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue *queue, +@@ -193,7 +193,7 @@ static inline struct request_sock *reqsk_queue_remove(struct request_sock_queue + req = queue->rskq_accept_head; + if (req) { + sk_acceptq_removed(parent); +- queue->rskq_accept_head = req->dl_next; ++ WRITE_ONCE(queue->rskq_accept_head, req->dl_next); + if (queue->rskq_accept_head == NULL) + queue->rskq_accept_tail = NULL; + } +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index f7224c4fc30fe..da55ce62fe50b 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -936,7 +936,7 @@ struct sock *inet_csk_reqsk_queue_add(struct sock *sk, + req->sk = child; + req->dl_next = NULL; + if (queue->rskq_accept_head == NULL) +- queue->rskq_accept_head = req; ++ WRITE_ONCE(queue->rskq_accept_head, req); + else + queue->rskq_accept_tail->dl_next = req; + queue->rskq_accept_tail = req; +-- +2.20.1 + diff --git a/queue-4.14/net-af_iucv-always-register-net_device-notifier.patch b/queue-4.14/net-af_iucv-always-register-net_device-notifier.patch new file mode 100644 index 00000000000..f7069dbe20a --- /dev/null +++ b/queue-4.14/net-af_iucv-always-register-net_device-notifier.patch @@ -0,0 +1,84 @@ +From 204705c0aad82a3abc796f109ff85bd0b8311cd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jun 2019 20:43:01 +0200 +Subject: net/af_iucv: always register net_device notifier + +From: Julian Wiedmann + +[ Upstream commit 06996c1d4088a0d5f3e7789d7f96b4653cc947cc ] + +Even when running as VM guest (ie pr_iucv != NULL), af_iucv can still +open HiperTransport-based connections. For robust operation these +connections require the af_iucv_netdev_notifier, so register it +unconditionally. + +Also handle any error that register_netdevice_notifier() returns. + +Fixes: 9fbd87d41392 ("af_iucv: handle netdev events") +Signed-off-by: Julian Wiedmann +Reviewed-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/iucv/af_iucv.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index ca98276c27097..7a9cbc9502d9c 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -2446,6 +2446,13 @@ out: + return err; + } + ++static void afiucv_iucv_exit(void) ++{ ++ device_unregister(af_iucv_dev); ++ driver_unregister(&af_iucv_driver); ++ pr_iucv->iucv_unregister(&af_iucv_handler, 0); ++} ++ + static int __init afiucv_init(void) + { + int err; +@@ -2479,11 +2486,18 @@ static int __init afiucv_init(void) + err = afiucv_iucv_init(); + if (err) + goto out_sock; +- } else +- register_netdevice_notifier(&afiucv_netdev_notifier); ++ } ++ ++ err = register_netdevice_notifier(&afiucv_netdev_notifier); ++ if (err) ++ goto out_notifier; ++ + dev_add_pack(&iucv_packet_type); + return 0; + ++out_notifier: ++ if (pr_iucv) ++ afiucv_iucv_exit(); + out_sock: + sock_unregister(PF_IUCV); + out_proto: +@@ -2497,12 +2511,11 @@ out: + static void __exit afiucv_exit(void) + { + if (pr_iucv) { +- device_unregister(af_iucv_dev); +- driver_unregister(&af_iucv_driver); +- pr_iucv->iucv_unregister(&af_iucv_handler, 0); ++ afiucv_iucv_exit(); + symbol_put(iucv_if); +- } else +- unregister_netdevice_notifier(&afiucv_netdev_notifier); ++ } ++ ++ unregister_netdevice_notifier(&afiucv_netdev_notifier); + dev_remove_pack(&iucv_packet_type); + sock_unregister(PF_IUCV); + proto_unregister(&iucv_proto); +-- +2.20.1 + diff --git a/queue-4.14/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch b/queue-4.14/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch new file mode 100644 index 00000000000..019b06f496c --- /dev/null +++ b/queue-4.14/net-aquantia-fix-aq_vec_isr_legacy-return-value.patch @@ -0,0 +1,67 @@ +From ddba1d640d6bc47f242bd5ea4619ea5653623715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 13:54:30 +0300 +Subject: net: aquantia: Fix aq_vec_isr_legacy() return value + +From: Dan Carpenter + +[ Upstream commit 31aefe14bc9f56566041303d733fda511d3a1c3e ] + +The irqreturn_t type is an enum or an unsigned int in GCC. That +creates to problems because it can't detect if the +self->aq_hw_ops->hw_irq_read() call fails and at the end the function +always returns IRQ_HANDLED. + +drivers/net/ethernet/aquantia/atlantic/aq_vec.c:316 aq_vec_isr_legacy() warn: unsigned 'err' is never less than zero. +drivers/net/ethernet/aquantia/atlantic/aq_vec.c:329 aq_vec_isr_legacy() warn: always true condition '(err >= 0) => (0-u32max >= 0)' + +Fixes: 970a2e9864b0 ("net: ethernet: aquantia: Vector operations") +Signed-off-by: Dan Carpenter +Reviewed-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_vec.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c +index 5fecc9a099ef7..bb2894a333f20 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c +@@ -310,15 +310,13 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private) + { + struct aq_vec_s *self = private; + u64 irq_mask = 0U; +- irqreturn_t err = 0; ++ int err; + +- if (!self) { +- err = -EINVAL; +- goto err_exit; +- } ++ if (!self) ++ return IRQ_NONE; + err = self->aq_hw_ops->hw_irq_read(self->aq_hw, &irq_mask); + if (err < 0) +- goto err_exit; ++ return IRQ_NONE; + + if (irq_mask) { + self->aq_hw_ops->hw_irq_disable(self->aq_hw, +@@ -326,11 +324,10 @@ irqreturn_t aq_vec_isr_legacy(int irq, void *private) + napi_schedule(&self->napi); + } else { + self->aq_hw_ops->hw_irq_enable(self->aq_hw, 1U); +- err = IRQ_NONE; ++ return IRQ_NONE; + } + +-err_exit: +- return err >= 0 ? IRQ_HANDLED : IRQ_NONE; ++ return IRQ_HANDLED; + } + + cpumask_t *aq_vec_get_affinity_mask(struct aq_vec_s *self) +-- +2.20.1 + diff --git a/queue-4.14/net-aquantia-fixed-instack-structure-overflow.patch b/queue-4.14/net-aquantia-fixed-instack-structure-overflow.patch new file mode 100644 index 00000000000..8806f1deaf6 --- /dev/null +++ b/queue-4.14/net-aquantia-fixed-instack-structure-overflow.patch @@ -0,0 +1,58 @@ +From 0373587b8161f809ce436271ee5395fe39dff2f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 Feb 2019 12:10:09 +0000 +Subject: net: aquantia: fixed instack structure overflow + +From: Igor Russkikh + +[ Upstream commit 8006e3730b6e900319411e35cee85b4513d298df ] + +This is a real stack undercorruption found by kasan build. + +The issue did no harm normally because it only overflowed +2 bytes after `bitary` array which on most architectures +were mapped into `err` local. + +Fixes: bab6de8fd180 ("net: ethernet: aquantia: Atlantic A0 and B0 specific functions.") +Signed-off-by: Nikita Danilov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c | 4 ++-- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +index b0abd187cead9..b83ee74d28391 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +@@ -182,8 +182,8 @@ static int hw_atl_a0_hw_rss_set(struct aq_hw_s *self, + u32 i = 0U; + u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues); + int err = 0; +- u16 bitary[(HW_ATL_A0_RSS_REDIRECTION_MAX * +- HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)]; ++ u16 bitary[1 + (HW_ATL_A0_RSS_REDIRECTION_MAX * ++ HW_ATL_A0_RSS_REDIRECTION_BITS / 16U)]; + + memset(bitary, 0, sizeof(bitary)); + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 236325f48ec9b..1c1bb074f6645 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -183,8 +183,8 @@ static int hw_atl_b0_hw_rss_set(struct aq_hw_s *self, + u32 i = 0U; + u32 num_rss_queues = max(1U, self->aq_nic_cfg->num_rss_queues); + int err = 0; +- u16 bitary[(HW_ATL_B0_RSS_REDIRECTION_MAX * +- HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)]; ++ u16 bitary[1 + (HW_ATL_B0_RSS_REDIRECTION_MAX * ++ HW_ATL_B0_RSS_REDIRECTION_BITS / 16U)]; + + memset(bitary, 0, sizeof(bitary)); + +-- +2.20.1 + diff --git a/queue-4.14/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch b/queue-4.14/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch new file mode 100644 index 00000000000..9ed5c4886ee --- /dev/null +++ b/queue-4.14/net-avoid-possible-false-sharing-in-sk_leave_memory_.patch @@ -0,0 +1,48 @@ +From 1057fa51c97781ec6427eab36527274cd48c2ed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 12:55:53 -0700 +Subject: net: avoid possible false sharing in sk_leave_memory_pressure() + +From: Eric Dumazet + +[ Upstream commit 503978aca46124cd714703e180b9c8292ba50ba7 ] + +As mentioned in https://github.com/google/ktsan/wiki/READ_ONCE-and-WRITE_ONCE#it-may-improve-performance +a C compiler can legally transform : + +if (memory_pressure && *memory_pressure) + *memory_pressure = 0; + +to : + +if (memory_pressure) + *memory_pressure = 0; + +Fixes: 0604475119de ("tcp: add TCPMemoryPressuresChrono counter") +Fixes: 180d8cd942ce ("foundations of per-cgroup memory pressure controlling.") +Fixes: 3ab224be6d69 ("[NET] CORE: Introducing new memory accounting interface.") +Signed-off-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 90ccbbf9e6b00..03ca2f638eb4a 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -2165,8 +2165,8 @@ static void sk_leave_memory_pressure(struct sock *sk) + } else { + unsigned long *memory_pressure = sk->sk_prot->memory_pressure; + +- if (memory_pressure && *memory_pressure) +- *memory_pressure = 0; ++ if (memory_pressure && READ_ONCE(*memory_pressure)) ++ WRITE_ONCE(*memory_pressure, 0); + } + } + +-- +2.20.1 + diff --git a/queue-4.14/net-axienet-fix-a-signedness-bug-in-probe.patch b/queue-4.14/net-axienet-fix-a-signedness-bug-in-probe.patch new file mode 100644 index 00000000000..92e6b239679 --- /dev/null +++ b/queue-4.14/net-axienet-fix-a-signedness-bug-in-probe.patch @@ -0,0 +1,37 @@ +From 5b49e00509e2dac20ac78b4ee7f25cc141eead78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 13:59:11 +0300 +Subject: net: axienet: fix a signedness bug in probe + +From: Dan Carpenter + +[ Upstream commit 73e211e11be86715d66bd3c9d38b3c34b05fca9a ] + +The "lp->phy_mode" is an enum but in this context GCC treats it as an +unsigned int so the error handling is never triggered. + +Fixes: ee06b1728b95 ("net: axienet: add support for standard phy-mode binding") +Signed-off-by: Dan Carpenter +Reviewed-by: Radhey Shyam Pandey +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 9ccd08a051f6a..1152d74433f6e 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -1574,7 +1574,7 @@ static int axienet_probe(struct platform_device *pdev) + } + } else { + lp->phy_mode = of_get_phy_mode(pdev->dev.of_node); +- if (lp->phy_mode < 0) { ++ if ((int)lp->phy_mode < 0) { + ret = -EINVAL; + goto free_netdev; + } +-- +2.20.1 + diff --git a/queue-4.14/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch b/queue-4.14/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch new file mode 100644 index 00000000000..f6f4fbe6242 --- /dev/null +++ b/queue-4.14/net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch @@ -0,0 +1,38 @@ +From 32c13f1bc6593b21703442651efda355736ffab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 13:56:04 +0300 +Subject: net: broadcom/bcmsysport: Fix signedness in bcm_sysport_probe() + +From: Dan Carpenter + +[ Upstream commit 25a584955f020d6ec499c513923fb220f3112d2b ] + +The "priv->phy_interface" variable is an enum and in this context GCC +will treat it as unsigned so the error handling will never be +triggered. + +Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") +Signed-off-by: Dan Carpenter +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcmsysport.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 79018fea7be24..69b2f99b0c19d 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2116,7 +2116,7 @@ static int bcm_sysport_probe(struct platform_device *pdev) + + priv->phy_interface = of_get_phy_mode(dn); + /* Default to GMII interface mode */ +- if (priv->phy_interface < 0) ++ if ((int)priv->phy_interface < 0) + priv->phy_interface = PHY_INTERFACE_MODE_GMII; + + /* In the case of a fixed PHY, the DT node associated +-- +2.20.1 + diff --git a/queue-4.14/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch b/queue-4.14/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch new file mode 100644 index 00000000000..87ad865648c --- /dev/null +++ b/queue-4.14/net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch @@ -0,0 +1,64 @@ +From fe926b90dd4696a670417cefe30a0dcbdaad95b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Feb 2019 12:29:43 +0530 +Subject: net: dsa: qca8k: Enable delay for RGMII_ID mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vinod Koul + +[ Upstream commit a968b5e9d5879f9535d6099505f9e14abcafb623 ] + +RGMII_ID specifies that we should have internal delay, so resurrect the +delay addition routine but under the RGMII_ID mode. + +Fixes: 40269aa9f40a ("net: dsa: qca8k: disable delay for RGMII mode") +Tested-by: Michal Vokáč +Signed-off-by: Vinod Koul +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca8k.c | 12 ++++++++++++ + drivers/net/dsa/qca8k.h | 1 + + 2 files changed, 13 insertions(+) + +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index 8e49974ffa0ed..8ee59b20b47a3 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -459,6 +459,18 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode) + qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL, + QCA8K_PORT_PAD_RGMII_RX_DELAY_EN); + break; ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ /* RGMII_ID needs internal delay. This is enabled through ++ * PORT5_PAD_CTRL for all ports, rather than individual port ++ * registers ++ */ ++ qca8k_write(priv, reg, ++ QCA8K_PORT_PAD_RGMII_EN | ++ QCA8K_PORT_PAD_RGMII_TX_DELAY(QCA8K_MAX_DELAY) | ++ QCA8K_PORT_PAD_RGMII_RX_DELAY(QCA8K_MAX_DELAY)); ++ qca8k_write(priv, QCA8K_REG_PORT5_PAD_CTRL, ++ QCA8K_PORT_PAD_RGMII_RX_DELAY_EN); ++ break; + case PHY_INTERFACE_MODE_SGMII: + qca8k_write(priv, reg, QCA8K_PORT_PAD_SGMII_EN); + break; +diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h +index 613fe5c50236c..d146e54c8a6c6 100644 +--- a/drivers/net/dsa/qca8k.h ++++ b/drivers/net/dsa/qca8k.h +@@ -40,6 +40,7 @@ + ((0x8 + (x & 0x3)) << 22) + #define QCA8K_PORT_PAD_RGMII_RX_DELAY(x) \ + ((0x10 + (x & 0x3)) << 20) ++#define QCA8K_MAX_DELAY 3 + #define QCA8K_PORT_PAD_RGMII_RX_DELAY_EN BIT(24) + #define QCA8K_PORT_PAD_SGMII_EN BIT(7) + #define QCA8K_REG_MODULE_EN 0x030 +-- +2.20.1 + diff --git a/queue-4.14/net-ena-fix-ena_com_fill_hash_function-implementatio.patch b/queue-4.14/net-ena-fix-ena_com_fill_hash_function-implementatio.patch new file mode 100644 index 00000000000..cebceea080f --- /dev/null +++ b/queue-4.14/net-ena-fix-ena_com_fill_hash_function-implementatio.patch @@ -0,0 +1,35 @@ +From c39ad6cdf0432ce82afbea8b72f6f98ba0d07ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 16:47:09 +0300 +Subject: net: ena: fix ena_com_fill_hash_function() implementation + +From: Sameeh Jubran + +[ Upstream commit 11bd7a00c0d8ffe33d1e926f8e789b4aea787186 ] + +ena_com_fill_hash_function() didn't configure the rss->hash_func. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Netanel Belgazal +Signed-off-by: Sameeh Jubran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_com.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c +index 011b54c541aae..10e6053f66712 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -2087,6 +2087,7 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev, + return -EINVAL; + } + ++ rss->hash_func = func; + rc = ena_com_set_hash_function(ena_dev); + + /* Restore the old function */ +-- +2.20.1 + diff --git a/queue-4.14/net-ena-fix-free-napi-resources-when-ena_up-fails.patch b/queue-4.14/net-ena-fix-free-napi-resources-when-ena_up-fails.patch new file mode 100644 index 00000000000..99efb258804 --- /dev/null +++ b/queue-4.14/net-ena-fix-free-napi-resources-when-ena_up-fails.patch @@ -0,0 +1,38 @@ +From eb69162aceab202597d995ace7585e952816eb84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 16:47:05 +0300 +Subject: net: ena: fix: Free napi resources when ena_up() fails + +From: Sameeh Jubran + +[ Upstream commit b287cdbd1cedfc9606682c6e02b58d00ff3a33ae ] + +ena_up() calls ena_init_napi() but does not call ena_del_napi() in +case of failure. This causes a segmentation fault upon rmmod when +netif_napi_del() is called. Fix this bug by calling ena_del_napi() +before returning error from ena_up(). + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: Sameeh Jubran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index d22b138c2b096..518ff393a026b 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1796,6 +1796,7 @@ err_setup_rx: + err_setup_tx: + ena_free_io_irq(adapter); + err_req_irq: ++ ena_del_napi(adapter); + + return rc; + } +-- +2.20.1 + diff --git a/queue-4.14/net-ena-fix-incorrect-test-of-supported-hash-functio.patch b/queue-4.14/net-ena-fix-incorrect-test-of-supported-hash-functio.patch new file mode 100644 index 00000000000..a242e61da87 --- /dev/null +++ b/queue-4.14/net-ena-fix-incorrect-test-of-supported-hash-functio.patch @@ -0,0 +1,40 @@ +From 74d73121396dcea493644ae9c18f37390989e168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 16:47:06 +0300 +Subject: net: ena: fix incorrect test of supported hash function + +From: Sameeh Jubran + +[ Upstream commit d3cfe7ddbc3dfbb9b201615b7fef8fd66d1b5fe8 ] + +ena_com_set_hash_function() tests if a hash function is supported +by the device before setting it. +The test returns the opposite result than needed. +Reverse the condition to return the correct value. +Also use the BIT macro instead of inline shift. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: Sameeh Jubran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_com.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c +index 1a4ffc5d3da4e..011b54c541aae 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -2002,7 +2002,7 @@ int ena_com_set_hash_function(struct ena_com_dev *ena_dev) + if (unlikely(ret)) + return ret; + +- if (get_resp.u.flow_hash_func.supported_func & (1 << rss->hash_func)) { ++ if (!(get_resp.u.flow_hash_func.supported_func & BIT(rss->hash_func))) { + pr_err("Func hash %d isn't supported by device, abort\n", + rss->hash_func); + return -EOPNOTSUPP; +-- +2.20.1 + diff --git a/queue-4.14/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch b/queue-4.14/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch new file mode 100644 index 00000000000..fb96194e579 --- /dev/null +++ b/queue-4.14/net-ena-fix-swapped-parameters-when-calling-ena_com_.patch @@ -0,0 +1,39 @@ +From cfed26a28aeda9601d9da57148a4386ff09c60c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 May 2019 16:47:03 +0300 +Subject: net: ena: fix swapped parameters when calling + ena_com_indirect_table_fill_entry + +From: Sameeh Jubran + +[ Upstream commit 3c6eeff295f01bdf1c6c3addcb0a04c0c6c029e9 ] + +second parameter should be the index of the table rather than the value. + +Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") +Signed-off-by: Saeed Bshara +Signed-off-by: Sameeh Jubran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_ethtool.c b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +index 967020fb26ee1..a2f02c23fe141 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_ethtool.c ++++ b/drivers/net/ethernet/amazon/ena/ena_ethtool.c +@@ -694,8 +694,8 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir, + if (indir) { + for (i = 0; i < ENA_RX_RSS_TABLE_SIZE; i++) { + rc = ena_com_indirect_table_fill_entry(ena_dev, +- ENA_IO_RXQ_IDX(indir[i]), +- i); ++ i, ++ ENA_IO_RXQ_IDX(indir[i])); + if (unlikely(rc)) { + netif_err(adapter, drv, netdev, + "Cannot fill indirect table (index is too large)\n"); +-- +2.20.1 + diff --git a/queue-4.14/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch b/queue-4.14/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch new file mode 100644 index 00000000000..e92ac767ab3 --- /dev/null +++ b/queue-4.14/net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch @@ -0,0 +1,37 @@ +From d370fce419e2809c96d7bd9f0dfb558a13293fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 14:05:54 +0300 +Subject: net: ethernet: stmmac: Fix signedness bug in ipq806x_gmac_of_parse() + +From: Dan Carpenter + +[ Upstream commit 231042181dc9d6122c6faba64e99ccb25f13cc6c ] + +The "gmac->phy_mode" variable is an enum and in this context GCC will +treat it as an unsigned int so the error handling will never be +triggered. + +Fixes: b1c17215d718 ("stmmac: add ipq806x glue layer") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +index 866444b6c82fa..11a4a81b0397c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c +@@ -203,7 +203,7 @@ static int ipq806x_gmac_of_parse(struct ipq806x_gmac *gmac) + struct device *dev = &gmac->pdev->dev; + + gmac->phy_mode = of_get_phy_mode(dev->of_node); +- if (gmac->phy_mode < 0) { ++ if ((int)gmac->phy_mode < 0) { + dev_err(dev, "missing phy mode property\n"); + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.14/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch b/queue-4.14/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch new file mode 100644 index 00000000000..722d5f47d6c --- /dev/null +++ b/queue-4.14/net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch @@ -0,0 +1,36 @@ +From ab4b854a582da89e874fc9add73672656f177313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 13:55:32 +0300 +Subject: net: hisilicon: Fix signedness bug in hix5hd2_dev_probe() + +From: Dan Carpenter + +[ Upstream commit 002dfe8085255b7bf1e0758c3d195c5412d35be9 ] + +The "priv->phy_mode" variable is an enum and in this context GCC will +treat it as unsigned to the error handling will never trigger. + +Fixes: 57c5bc9ad7d7 ("net: hisilicon: add hix5hd2 mac driver") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hix5hd2_gmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +index aab6fb10af94a..6adf6831d120a 100644 +--- a/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hix5hd2_gmac.c +@@ -1202,7 +1202,7 @@ static int hix5hd2_dev_probe(struct platform_device *pdev) + goto err_free_mdio; + + priv->phy_mode = of_get_phy_mode(node); +- if (priv->phy_mode < 0) { ++ if ((int)priv->phy_mode < 0) { + netdev_err(ndev, "not find phy-mode\n"); + ret = -EINVAL; + goto err_mdiobus; +-- +2.20.1 + diff --git a/queue-4.14/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch b/queue-4.14/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch new file mode 100644 index 00000000000..8f46e6269ea --- /dev/null +++ b/queue-4.14/net-hns3-fix-for-vport-bw_limit-overflow-problem.patch @@ -0,0 +1,41 @@ +From b3bf29d92f3d0a2d5bcf76afbb3f0b23f14b7edf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Apr 2019 21:48:39 +0800 +Subject: net: hns3: fix for vport->bw_limit overflow problem + +From: Yunsheng Lin + +[ Upstream commit 2566f10676ba996b745e138f54f3e2f974311692 ] + +When setting vport->bw_limit to hdev->tm_info.pg_info[0].bw_limit +in hclge_tm_vport_tc_info_update, vport->bw_limit can be as big as +HCLGE_ETHER_MAX_RATE (100000), which can not fit into u16 (65535). + +So this patch fixes it by using u32 for vport->bw_limit. + +Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") +Reported-by: Dan Carpenter +Signed-off-by: Yunsheng Lin +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +index 9fcfd93954245..a4c5e72d6012a 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -480,7 +480,7 @@ struct hclge_vport { + u16 alloc_rss_size; + + u16 qs_offset; +- u16 bw_limit; /* VSI BW Limit (0 = disabled) */ ++ u32 bw_limit; /* VSI BW Limit (0 = disabled) */ + u8 dwrr; + + int vport_id; +-- +2.20.1 + diff --git a/queue-4.14/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch b/queue-4.14/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch new file mode 100644 index 00000000000..aa5aa76dfa9 --- /dev/null +++ b/queue-4.14/net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch @@ -0,0 +1,36 @@ +From d3d1d2a46bf41c5ab12548c9fd2203efc9cd655c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 14:40:13 +0300 +Subject: net/mlx5: Fix mlx5_ifc_query_lag_out_bits + +From: Mark Zhang + +[ Upstream commit ea77388b02270b0af8dc57f668f311235ea068f0 ] + +Remove the "reserved_at_40" field to match the device specification. + +Fixes: 84df61ebc69b ("net/mlx5: Add HW interfaces used by LAG") +Signed-off-by: Mark Zhang +Reviewed-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index 1d793d86d55fa..6ffa181598e61 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -8671,8 +8671,6 @@ struct mlx5_ifc_query_lag_out_bits { + + u8 syndrome[0x20]; + +- u8 reserved_at_40[0x40]; +- + struct mlx5_ifc_lagc_bits ctx; + }; + +-- +2.20.1 + diff --git a/queue-4.14/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch b/queue-4.14/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch new file mode 100644 index 00000000000..ed31091ce59 --- /dev/null +++ b/queue-4.14/net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch @@ -0,0 +1,82 @@ +From 5b1d33c6463bf4ee207e9d3146228dd963d22934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Dec 2018 19:21:21 +0200 +Subject: net/mlx5: Take lock with IRQs disabled to avoid deadlock + +From: Moni Shoua + +[ Upstream commit 33814e5d127e21f53b52e17b0722c1b57d4f4d29 ] + +The lock in qp_table might be taken from process context or from +interrupt context. This may lead to a deadlock unless it is taken with +IRQs disabled. + +Discovered by lockdep + +================================ +WARNING: inconsistent lock state +4.20.0-rc6 +-------------------------------- +inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} + +python/12572 [HC1[1]:SC0[0]:HE0:SE1] takes: +00000000052a4df4 (&(&table->lock)->rlock#2){?.+.}, /0x50 [mlx5_core] +{HARDIRQ-ON-W} state was registered at: + _raw_spin_lock+0x33/0x70 + mlx5_get_rsc+0x1a/0x50 [mlx5_core] + mlx5_ib_eqe_pf_action+0x493/0x1be0 [mlx5_ib] + process_one_work+0x90c/0x1820 + worker_thread+0x87/0xbb0 + kthread+0x320/0x3e0 + ret_from_fork+0x24/0x30 +irq event stamp: 103928 +hardirqs last enabled at (103927): [] nk+0x1a/0x1c +hardirqs last disabled at (103928): [] unk+0x1a/0x1c +softirqs last enabled at (103924): [] tcp_sendmsg+0x31/0x40 +softirqs last disabled at (103922): [] 80 + +other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&(&table->lock)->rlock#2); + + lock(&(&table->lock)->rlock#2); + + *** DEADLOCK *** + +Fixes: 032080ab43ac ("IB/mlx5: Lock QP during page fault handling") +Signed-off-by: Moni Shoua +Reviewed-by: Leon Romanovsky +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/qp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index 5f091c6ea049d..b92d5690287b5 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -44,14 +44,15 @@ static struct mlx5_core_rsc_common *mlx5_get_rsc(struct mlx5_core_dev *dev, + { + struct mlx5_qp_table *table = &dev->priv.qp_table; + struct mlx5_core_rsc_common *common; ++ unsigned long flags; + +- spin_lock(&table->lock); ++ spin_lock_irqsave(&table->lock, flags); + + common = radix_tree_lookup(&table->tree, rsn); + if (common) + atomic_inc(&common->refcount); + +- spin_unlock(&table->lock); ++ spin_unlock_irqrestore(&table->lock, flags); + + if (!common) { + mlx5_core_warn(dev, "Async event for bogus resource 0x%x\n", +-- +2.20.1 + diff --git a/queue-4.14/net-neigh-use-long-type-to-store-jiffies-delta.patch b/queue-4.14/net-neigh-use-long-type-to-store-jiffies-delta.patch new file mode 100644 index 00000000000..931bc2a6abc --- /dev/null +++ b/queue-4.14/net-neigh-use-long-type-to-store-jiffies-delta.patch @@ -0,0 +1,37 @@ +From 68d9e2b5af08920c0655b8b4a739e39b05910c03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 14:11:49 -0800 +Subject: net: neigh: use long type to store jiffies delta + +From: Eric Dumazet + +[ Upstream commit 9d027e3a83f39b819e908e4e09084277a2e45e95 ] + +A difference of two unsigned long needs long storage. + +Fixes: c7fb64db001f ("[NETLINK]: Neighbour table configuration and statistics via rtnetlink") +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 16ac50b1b9a71..567e431813e59 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1877,8 +1877,8 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl, + goto nla_put_failure; + { + unsigned long now = jiffies; +- unsigned int flush_delta = now - tbl->last_flush; +- unsigned int rand_delta = now - tbl->last_rand; ++ long flush_delta = now - tbl->last_flush; ++ long rand_delta = now - tbl->last_rand; + struct neigh_hash_table *nht; + struct ndt_config ndc = { + .ndtc_key_len = tbl->key_len, +-- +2.20.1 + diff --git a/queue-4.14/net-netem-correct-the-parent-s-backlog-when-corrupte.patch b/queue-4.14/net-netem-correct-the-parent-s-backlog-when-corrupte.patch new file mode 100644 index 00000000000..cec4642a9f0 --- /dev/null +++ b/queue-4.14/net-netem-correct-the-parent-s-backlog-when-corrupte.patch @@ -0,0 +1,40 @@ +From ba1967fd23e3c8f87fc875eb3e01fcb8c78cd7cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2019 09:16:58 -0700 +Subject: net: netem: correct the parent's backlog when corrupted packet was + dropped + +From: Jakub Kicinski + +[ Upstream commit e0ad032e144731a5928f2d75e91c2064ba1a764c ] + +If packet corruption failed we jump to finish_segs and return +NET_XMIT_SUCCESS. Seeing success will make the parent qdisc +increment its backlog, that's incorrect - we need to return +NET_XMIT_DROP. + +Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue") +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_netem.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index 64c3cfa357363..328b043edf074 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -603,6 +603,8 @@ finish_segs: + } + /* Parent qdiscs accounted for 1 skb of size @prev_len */ + qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len)); ++ } else if (!skb) { ++ return NET_XMIT_DROP; + } + return NET_XMIT_SUCCESS; + } +-- +2.20.1 + diff --git a/queue-4.14/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch b/queue-4.14/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch new file mode 100644 index 00000000000..b22a9d99bae --- /dev/null +++ b/queue-4.14/net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch @@ -0,0 +1,84 @@ +From 55f96ebf3b5cf556269c108699c767706db0a458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jun 2019 11:11:10 -0700 +Subject: net: netem: fix backlog accounting for corrupted GSO frames + +From: Jakub Kicinski + +[ Upstream commit 177b8007463c4f36c9a2c7ce7aa9875a4cad9bd5 ] + +When GSO frame has to be corrupted netem uses skb_gso_segment() +to produce the list of frames, and re-enqueues the segments one +by one. The backlog length has to be adjusted to account for +new frames. + +The current calculation is incorrect, leading to wrong backlog +lengths in the parent qdisc (both bytes and packets), and +incorrect packet backlog count in netem itself. + +Parent backlog goes negative, netem's packet backlog counts +all non-first segments twice (thus remaining non-zero even +after qdisc is emptied). + +Move the variables used to count the adjustment into local +scope to make 100% sure they aren't used at any stage in +backports. + +Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue") +Signed-off-by: Jakub Kicinski +Reviewed-by: Dirk van der Merwe +Acked-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_netem.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index 6266121a03f9a..ede0a24e67eb8 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -431,8 +431,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct netem_skb_cb *cb; + struct sk_buff *skb2; + struct sk_buff *segs = NULL; +- unsigned int len = 0, last_len, prev_len = qdisc_pkt_len(skb); +- int nb = 0; ++ unsigned int prev_len = qdisc_pkt_len(skb); + int count = 1; + int rc = NET_XMIT_SUCCESS; + int rc_drop = NET_XMIT_DROP; +@@ -489,6 +488,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + segs = netem_segment(skb, sch, to_free); + if (!segs) + return rc_drop; ++ qdisc_skb_cb(segs)->pkt_len = segs->len; + } else { + segs = skb; + } +@@ -579,6 +579,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + + finish_segs: + if (segs) { ++ unsigned int len, last_len; ++ int nb = 0; ++ ++ len = skb->len; ++ + while (segs) { + skb2 = segs->next; + segs->next = NULL; +@@ -594,9 +599,7 @@ finish_segs: + } + segs = skb2; + } +- sch->q.qlen += nb; +- if (nb > 1) +- qdisc_tree_reduce_backlog(sch, 1 - nb, prev_len - len); ++ qdisc_tree_reduce_backlog(sch, -nb, prev_len - len); + } + return NET_XMIT_SUCCESS; + } +-- +2.20.1 + diff --git a/queue-4.14/net-netem-fix-error-path-for-corrupted-gso-frames.patch b/queue-4.14/net-netem-fix-error-path-for-corrupted-gso-frames.patch new file mode 100644 index 00000000000..06b267334c8 --- /dev/null +++ b/queue-4.14/net-netem-fix-error-path-for-corrupted-gso-frames.patch @@ -0,0 +1,74 @@ +From 3cfaf9973874637b1762ef4c1f22429e1cb2c2cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2019 09:16:57 -0700 +Subject: net: netem: fix error path for corrupted GSO frames + +From: Jakub Kicinski + +[ Upstream commit a7fa12d15855904aff1716e1fc723c03ba38c5cc ] + +To corrupt a GSO frame we first perform segmentation. We then +proceed using the first segment instead of the full GSO skb and +requeue the rest of the segments as separate packets. + +If there are any issues with processing the first segment we +still want to process the rest, therefore we jump to the +finish_segs label. + +Commit 177b8007463c ("net: netem: fix backlog accounting for +corrupted GSO frames") started using the pointer to the first +segment in the "rest of segments processing", but as mentioned +above the first segment may had already been freed at this point. + +Backlog corrections for parent qdiscs have to be adjusted. + +Fixes: 177b8007463c ("net: netem: fix backlog accounting for corrupted GSO frames") +Reported-by: kbuild test robot +Reported-by: Dan Carpenter +Reported-by: Ben Hutchings +Signed-off-by: Jakub Kicinski +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_netem.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index ede0a24e67eb8..64c3cfa357363 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -504,6 +504,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + if (skb->ip_summed == CHECKSUM_PARTIAL && + skb_checksum_help(skb)) { + qdisc_drop(skb, sch, to_free); ++ skb = NULL; + goto finish_segs; + } + +@@ -580,9 +581,10 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + finish_segs: + if (segs) { + unsigned int len, last_len; +- int nb = 0; ++ int nb; + +- len = skb->len; ++ len = skb ? skb->len : 0; ++ nb = skb ? 1 : 0; + + while (segs) { + skb2 = segs->next; +@@ -599,7 +601,8 @@ finish_segs: + } + segs = skb2; + } +- qdisc_tree_reduce_backlog(sch, -nb, prev_len - len); ++ /* Parent qdiscs accounted for 1 skb of size @prev_len */ ++ qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len)); + } + return NET_XMIT_SUCCESS; + } +-- +2.20.1 + diff --git a/queue-4.14/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch b/queue-4.14/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch new file mode 100644 index 00000000000..01978450992 --- /dev/null +++ b/queue-4.14/net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch @@ -0,0 +1,49 @@ +From cd771c71159b9d4cbf25d6f62e0093e5916b5d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jul 2019 12:23:41 +0800 +Subject: net: pasemi: fix an use-after-free in pasemi_mac_phy_init() + +From: Wen Yang + +[ Upstream commit faf5577f2498cea23011b5c785ef853ded22700b ] + +The phy_dn variable is still being used in of_phy_connect() after the +of_node_put() call, which may result in use-after-free. + +Fixes: 1dd2d06c0459 ("net: Rework pasemi_mac driver to use of_mdio infrastructure") +Signed-off-by: Wen Yang +Cc: "David S. Miller" +Cc: Thomas Gleixner +Cc: Luis Chamberlain +Cc: Michael Ellerman +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pasemi/pasemi_mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c +index 49591d9c2e1b9..c9b4ac9d3330a 100644 +--- a/drivers/net/ethernet/pasemi/pasemi_mac.c ++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c +@@ -1053,7 +1053,6 @@ static int pasemi_mac_phy_init(struct net_device *dev) + + dn = pci_device_to_OF_node(mac->pdev); + phy_dn = of_parse_phandle(dn, "phy-handle", 0); +- of_node_put(phy_dn); + + mac->link = 0; + mac->speed = 0; +@@ -1062,6 +1061,7 @@ static int pasemi_mac_phy_init(struct net_device *dev) + phydev = of_phy_connect(dev, phy_dn, &pasemi_adjust_link, 0, + PHY_INTERFACE_MODE_SGMII); + ++ of_node_put(phy_dn); + if (!phydev) { + printk(KERN_ERR "%s: Could not attach to phy\n", dev->name); + return -ENODEV; +-- +2.20.1 + diff --git a/queue-4.14/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch b/queue-4.14/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch new file mode 100644 index 00000000000..26a2ccef7ff --- /dev/null +++ b/queue-4.14/net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch @@ -0,0 +1,68 @@ +From 3a3588630311f2db550b727ad59acc4a22205143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 09:02:41 +0000 +Subject: net: phy: Fix not to call phy_resume() if PHY is not attached + +From: Yoshihiro Shimoda + +[ Upstream commit ef1b5bf506b1f0ee3edc98533e1f3ecb105eb46a ] + +This patch fixes an issue that mdio_bus_phy_resume() doesn't call +phy_resume() if the PHY is not attached. + +Fixes: 803dd9c77ac3 ("net: phy: avoid suspending twice a PHY") +Signed-off-by: Yoshihiro Shimoda +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_device.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index a98c227a4c2eb..99dae55cd334b 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list); + static DEFINE_MUTEX(phy_fixup_lock); + + #ifdef CONFIG_PM +-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) ++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) + { + struct device_driver *drv = phydev->mdio.dev.driver; + struct phy_driver *phydrv = to_phy_driver(drv); +@@ -88,10 +88,11 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) + /* PHY not attached? May suspend if the PHY has not already been + * suspended as part of a prior call to phy_disconnect() -> + * phy_detach() -> phy_suspend() because the parent netdev might be the +- * MDIO bus driver and clock gated at this point. ++ * MDIO bus driver and clock gated at this point. Also may resume if ++ * PHY is not attached. + */ + if (!netdev) +- return !phydev->suspended; ++ return suspend ? !phydev->suspended : phydev->suspended; + + /* Don't suspend PHY if the attached netdev parent may wakeup. + * The parent may point to a PCI device, as in tg3 driver. +@@ -121,7 +122,7 @@ static int mdio_bus_phy_suspend(struct device *dev) + if (phydev->attached_dev && phydev->adjust_link) + phy_stop_machine(phydev); + +- if (!mdio_bus_phy_may_suspend(phydev)) ++ if (!mdio_bus_phy_may_suspend(phydev, true)) + return 0; + + return phy_suspend(phydev); +@@ -132,7 +133,7 @@ static int mdio_bus_phy_resume(struct device *dev) + struct phy_device *phydev = to_phy_device(dev); + int ret; + +- if (!mdio_bus_phy_may_suspend(phydev)) ++ if (!mdio_bus_phy_may_suspend(phydev, false)) + goto no_resume; + + ret = phy_resume(phydev); +-- +2.20.1 + diff --git a/queue-4.14/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch b/queue-4.14/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch new file mode 100644 index 00000000000..ef325efdcc7 --- /dev/null +++ b/queue-4.14/net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch @@ -0,0 +1,46 @@ +From f2c005d94173c3601c22e15bf6652b46389870fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Feb 2019 21:45:29 -0800 +Subject: net: phy: fixed_phy: Fix fixed_phy not checking GPIO + +From: Moritz Fischer + +[ Upstream commit 8f289805616e81f7c1690931aa8a586c76f4fa88 ] + +Fix fixed_phy not checking GPIO if no link_update callback +is registered. + +In the original version all users registered a link_update +callback so the issue was masked. + +Fixes: a5597008dbc2 ("phy: fixed_phy: Add gpio to determine link up/down.") +Reviewed-by: Andrew Lunn +Signed-off-by: Moritz Fischer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/fixed_phy.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c +index eb51672106811..3ab2eb677a599 100644 +--- a/drivers/net/phy/fixed_phy.c ++++ b/drivers/net/phy/fixed_phy.c +@@ -67,11 +67,11 @@ static int fixed_mdio_read(struct mii_bus *bus, int phy_addr, int reg_num) + do { + s = read_seqcount_begin(&fp->seqcount); + /* Issue callback if user registered it. */ +- if (fp->link_update) { ++ if (fp->link_update) + fp->link_update(fp->phydev->attached_dev, + &fp->status); +- fixed_phy_update(fp); +- } ++ /* Check the GPIO for change in status */ ++ fixed_phy_update(fp); + state = fp->status; + } while (read_seqcount_retry(&fp->seqcount, s)); + +-- +2.20.1 + diff --git a/queue-4.14/net-qca_spi-move-reset_count-to-struct-qcaspi.patch b/queue-4.14/net-qca_spi-move-reset_count-to-struct-qcaspi.patch new file mode 100644 index 00000000000..fe12c9c925e --- /dev/null +++ b/queue-4.14/net-qca_spi-move-reset_count-to-struct-qcaspi.patch @@ -0,0 +1,68 @@ +From d9099cf3efd3aee5e6e50b0d7e77102866b5daf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 18:29:13 +0100 +Subject: net: qca_spi: Move reset_count to struct qcaspi + +From: Stefan Wahren + +[ Upstream commit bc19c32904e36548335b35fdce6ce734e20afc0a ] + +The reset counter is specific for every QCA700x chip. So move this +into the private driver struct. Otherwise we get unpredictable reset +behavior in setups with multiple QCA700x chips. + +Fixes: 291ab06ecf67 (net: qualcomm: new Ethernet over SPI driver for QCA7000) +Signed-off-by: Stefan Wahren +Signed-off-by: Stefan Wahren +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 9 ++++----- + drivers/net/ethernet/qualcomm/qca_spi.h | 1 + + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 275fc6f154a71..1c87178fc4858 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -475,7 +475,6 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event) + u16 signature = 0; + u16 spi_config; + u16 wrbuf_space = 0; +- static u16 reset_count; + + if (event == QCASPI_EVENT_CPUON) { + /* Read signature twice, if not valid +@@ -528,13 +527,13 @@ qcaspi_qca7k_sync(struct qcaspi *qca, int event) + + qca->sync = QCASPI_SYNC_RESET; + qca->stats.trig_reset++; +- reset_count = 0; ++ qca->reset_count = 0; + break; + case QCASPI_SYNC_RESET: +- reset_count++; ++ qca->reset_count++; + netdev_dbg(qca->net_dev, "sync: waiting for CPU on, count %u.\n", +- reset_count); +- if (reset_count >= QCASPI_RESET_TIMEOUT) { ++ qca->reset_count); ++ if (qca->reset_count >= QCASPI_RESET_TIMEOUT) { + /* reset did not seem to take place, try again */ + qca->sync = QCASPI_SYNC_UNKNOWN; + qca->stats.reset_timeout++; +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.h b/drivers/net/ethernet/qualcomm/qca_spi.h +index fc0e98726b361..719c41227f221 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.h ++++ b/drivers/net/ethernet/qualcomm/qca_spi.h +@@ -92,6 +92,7 @@ struct qcaspi { + + unsigned int intr_req; + unsigned int intr_svc; ++ u16 reset_count; + + #ifdef CONFIG_DEBUG_FS + struct dentry *device_root; +-- +2.20.1 + diff --git a/queue-4.14/net-rds-add-a-few-missing-rds_stat_names-entries.patch b/queue-4.14/net-rds-add-a-few-missing-rds_stat_names-entries.patch new file mode 100644 index 00000000000..bea7924d324 --- /dev/null +++ b/queue-4.14/net-rds-add-a-few-missing-rds_stat_names-entries.patch @@ -0,0 +1,44 @@ +From a72e1267f4a00d56de84d2b8a925b468aeaf2ee9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jul 2019 12:15:50 -0700 +Subject: net/rds: Add a few missing rds_stat_names entries + +From: Gerd Rausch + +[ Upstream commit 55c70ca00c982fbc0df4c4d3e31747fb73f4ddb5 ] + +In a previous commit, fields were added to "struct rds_statistics" +but array "rds_stat_names" was not updated accordingly. + +Please note the inconsistent naming of the string representations +that is done in the name of compatibility +with the Oracle internal code-base. + +s_recv_bytes_added_to_socket -> "recv_bytes_added_to_sock" +s_recv_bytes_removed_from_socket -> "recv_bytes_freed_fromsock" + +Fixes: 192a798f5299 ("RDS: add stat for socket recv memory usage") +Signed-off-by: Gerd Rausch +Acked-by: Santosh Shilimkar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/stats.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/rds/stats.c b/net/rds/stats.c +index 73be187d389ed..6bbab4d74c4fe 100644 +--- a/net/rds/stats.c ++++ b/net/rds/stats.c +@@ -76,6 +76,8 @@ static const char *const rds_stat_names[] = { + "cong_update_received", + "cong_send_error", + "cong_send_blocked", ++ "recv_bytes_added_to_sock", ++ "recv_bytes_freed_fromsock", + }; + + void rds_stats_info_copy(struct rds_info_iterator *iter, +-- +2.20.1 + diff --git a/queue-4.14/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch b/queue-4.14/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch new file mode 100644 index 00000000000..5017e01aa2f --- /dev/null +++ b/queue-4.14/net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch @@ -0,0 +1,40 @@ +From 7f0b53a30283bbe63dbe25fc5666e3fe3512a374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 13:49:41 -0700 +Subject: net/rds: Fix 'ib_evt_handler_call' element in 'rds_ib_stat_names' + +From: Gerd Rausch + +[ Upstream commit 05a82481a3024b94db00b8c816bb3d526b5209e0 ] + +All entries in 'rds_ib_stat_names' are stringified versions +of the corresponding "struct rds_ib_statistics" element +without the "s_"-prefix. + +Fix entry 'ib_evt_handler_call' to do the same. + +Fixes: f4f943c958a2 ("RDS: IB: ack more receive completions to improve performance") +Signed-off-by: Gerd Rausch +Acked-by: Santosh Shilimkar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/ib_stats.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rds/ib_stats.c b/net/rds/ib_stats.c +index 9252ad1263359..ac46d8961b61a 100644 +--- a/net/rds/ib_stats.c ++++ b/net/rds/ib_stats.c +@@ -42,7 +42,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats); + static const char *const rds_ib_stat_names[] = { + "ib_connect_raced", + "ib_listen_closed_stale", +- "s_ib_evt_handler_call", ++ "ib_evt_handler_call", + "ib_tasklet_call", + "ib_tx_cq_event", + "ib_tx_ring_full", +-- +2.20.1 + diff --git a/queue-4.14/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch b/queue-4.14/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch new file mode 100644 index 00000000000..2240e6c1985 --- /dev/null +++ b/queue-4.14/net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch @@ -0,0 +1,49 @@ +From 3e2f3c40917f9f0aa37bf3ec1d613fddfc6678ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Mar 2019 02:43:18 -0500 +Subject: net: sh_eth: fix a missing check of of_get_phy_mode + +From: Kangjie Lu + +[ Upstream commit 035a14e71f27eefa50087963b94cbdb3580d08bf ] + +of_get_phy_mode may fail and return a negative error code; +the fix checks the return value of of_get_phy_mode and +returns NULL of it fails. + +Fixes: b356e978e92f ("sh_eth: add device tree support") +Signed-off-by: Kangjie Lu +Reviewed-by: Sergei Shtylyov +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/renesas/sh_eth.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 9b1906a65e113..25f3b2ad26e9c 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -3046,12 +3046,16 @@ static struct sh_eth_plat_data *sh_eth_parse_dt(struct device *dev) + struct device_node *np = dev->of_node; + struct sh_eth_plat_data *pdata; + const char *mac_addr; ++ int ret; + + pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL); + if (!pdata) + return NULL; + +- pdata->phy_interface = of_get_phy_mode(np); ++ ret = of_get_phy_mode(np); ++ if (ret < 0) ++ return NULL; ++ pdata->phy_interface = ret; + + mac_addr = of_get_mac_address(np); + if (mac_addr) +-- +2.20.1 + diff --git a/queue-4.14/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch b/queue-4.14/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch new file mode 100644 index 00000000000..cf1e8d82ebc --- /dev/null +++ b/queue-4.14/net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch @@ -0,0 +1,37 @@ +From 87f0a5eea1ffb8577f597f70faae54697a8a9309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Sep 2019 09:36:23 +0800 +Subject: net: sonic: replace dev_kfree_skb in sonic_send_packet + +From: Mao Wenan + +[ Upstream commit 49f6c90bf6805948b597eabb499e500a47cf24be ] + +sonic_send_packet will be processed in irq or non-irq +context, so it would better use dev_kfree_skb_any +instead of dev_kfree_skb. + +Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers") +Signed-off-by: Mao Wenan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 11f472fd5d477..a051dddcbd768 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -222,7 +222,7 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE); + if (!laddr) { + pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name); +- dev_kfree_skb(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + +-- +2.20.1 + diff --git a/queue-4.14/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch b/queue-4.14/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch new file mode 100644 index 00000000000..ee30ab36408 --- /dev/null +++ b/queue-4.14/net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch @@ -0,0 +1,42 @@ +From 28758ab8b6cf42fe56785ba8f5004a4ca41b2ad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 09:57:12 +0800 +Subject: net: sonic: return NETDEV_TX_OK if failed to map buffer + +From: Mao Wenan + +[ Upstream commit 6e1cdedcf0362fed3aedfe051d46bd7ee2a85fe1 ] + +NETDEV_TX_BUSY really should only be used by drivers that call +netif_tx_stop_queue() at the wrong moment. If dma_map_single() is +failed to map tx DMA buffer, it might trigger an infinite loop. +This patch use NETDEV_TX_OK instead of NETDEV_TX_BUSY, and change +printk to pr_err_ratelimited. + +Fixes: d9fb9f384292 ("*sonic/natsemi/ns83829: Move the National Semi-conductor drivers") +Signed-off-by: Mao Wenan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/sonic.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 23821540ab078..11f472fd5d477 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -221,9 +221,9 @@ static int sonic_send_packet(struct sk_buff *skb, struct net_device *dev) + + laddr = dma_map_single(lp->device, skb->data, length, DMA_TO_DEVICE); + if (!laddr) { +- printk(KERN_ERR "%s: failed to map tx DMA buffer.\n", dev->name); ++ pr_err_ratelimited("%s: failed to map tx DMA buffer.\n", dev->name); + dev_kfree_skb(skb); +- return NETDEV_TX_BUSY; ++ return NETDEV_TX_OK; + } + + sonic_tda_put(dev, entry, SONIC_TD_STATUS, 0); /* clear status */ +-- +2.20.1 + diff --git a/queue-4.14/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch b/queue-4.14/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch new file mode 100644 index 00000000000..60b2140c264 --- /dev/null +++ b/queue-4.14/net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch @@ -0,0 +1,37 @@ +From 3b2080f55d3c1049e9ba213cd421446261c15a5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 13:58:22 +0300 +Subject: net: stmmac: dwmac-meson8b: Fix signedness bug in probe + +From: Dan Carpenter + +[ Upstream commit f10210517a2f37feea2edf85eb34c98977265c16 ] + +The "dwmac->phy_mode" is an enum and in this context GCC treats it as +an unsigned int so the error handling is never triggered. + +Fixes: 566e82516253 ("net: stmmac: add a glue driver for the Amlogic Meson 8b / GXBB DWMAC") +Signed-off-by: Dan Carpenter +Reviewed-by: Martin Blumenstingl +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +index 8be4b32544ef8..d71d3c1c85eed 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -285,7 +285,7 @@ static int meson8b_dwmac_probe(struct platform_device *pdev) + + dwmac->pdev = pdev; + dwmac->phy_mode = of_get_phy_mode(pdev->dev.of_node); +- if (dwmac->phy_mode < 0) { ++ if ((int)dwmac->phy_mode < 0) { + dev_err(&pdev->dev, "missing phy-mode property\n"); + ret = -EINVAL; + goto err_remove_config_dt; +-- +2.20.1 + diff --git a/queue-4.14/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch b/queue-4.14/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch new file mode 100644 index 00000000000..def79737d16 --- /dev/null +++ b/queue-4.14/net-stmmac-fix-length-of-ptp-clock-s-name-string.patch @@ -0,0 +1,51 @@ +From 630ca9d2c2f29e07549885f3e02c35e3cd114c92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Oct 2019 17:43:04 +0200 +Subject: net: stmmac: fix length of PTP clock's name string + +From: Antonio Borneo + +[ Upstream commit 5da202c88f8c355ad79bc2e8eb582e6d433060e7 ] + +The field "name" in struct ptp_clock_info has a fixed size of 16 +chars and is used as zero terminated string by clock_name_show() +in drivers/ptp/ptp_sysfs.c +The current initialization value requires 17 chars to fit also the +null termination, and this causes overflow to the next bytes in +the struct when the string is read as null terminated: + hexdump -C /sys/class/ptp/ptp0/clock_name + 00000000 73 74 6d 6d 61 63 5f 70 74 70 5f 63 6c 6f 63 6b |stmmac_ptp_clock| + 00000010 a0 ac b9 03 0a |.....| +where the extra 4 bytes (excluding the newline) after the string +represent the integer 0x03b9aca0 = 62500000 assigned to the field +"max_adj" that follows "name" in the same struct. + +There is no strict requirement for the "name" content and in the +comment in ptp_clock_kernel.h it's reported it should just be 'A +short "friendly name" to identify the clock'. +Replace it with "stmmac ptp". + +Signed-off-by: Antonio Borneo +Fixes: 92ba6888510c ("stmmac: add the support for PTP hw clock driver") +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +index e471a903c6543..1c1d6a9428229 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c +@@ -154,7 +154,7 @@ static int stmmac_enable(struct ptp_clock_info *ptp, + /* structure describing a PTP hardware clock */ + static const struct ptp_clock_info stmmac_ptp_clock_ops = { + .owner = THIS_MODULE, +- .name = "stmmac_ptp_clock", ++ .name = "stmmac ptp", + .max_adj = 62500000, + .n_alarm = 0, + .n_ext_ts = 0, +-- +2.20.1 + diff --git a/queue-4.14/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch b/queue-4.14/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch new file mode 100644 index 00000000000..18fe66cacc9 --- /dev/null +++ b/queue-4.14/net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch @@ -0,0 +1,36 @@ +From cc44dfaa42d912d8476e5005102056365eaf0992 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2019 13:08:56 +0200 +Subject: net: stmmac: gmac4+: Not all Unicast addresses may be available + +From: Jose Abreu + +[ Upstream commit 25683bab09a70542b9f8e3e28f79b3369e56701f ] + +Some setups may not have all Unicast addresses filters available. Check +the number of available filters before trying to setup it. + +Fixes: 477286b53f55 ("stmmac: add GMAC4 core support") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 8445af580cb69..e5566c121525d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -438,7 +438,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + } + + /* Handle multiple unicast addresses */ +- if (netdev_uc_count(dev) > GMAC_MAX_PERFECT_ADDRESSES) { ++ if (netdev_uc_count(dev) > hw->unicast_filter_entries) { + /* Switch to promiscuous mode if more than 128 addrs + * are required + */ +-- +2.20.1 + diff --git a/queue-4.14/netfilter-ebtables-config_compat-reject-trailing-dat.patch b/queue-4.14/netfilter-ebtables-config_compat-reject-trailing-dat.patch new file mode 100644 index 00000000000..19916fbc52c --- /dev/null +++ b/queue-4.14/netfilter-ebtables-config_compat-reject-trailing-dat.patch @@ -0,0 +1,44 @@ +From 1d2c2080c7ea5bd59f1e61f179cd0c12e674d1d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 May 2019 18:47:33 +0200 +Subject: netfilter: ebtables: CONFIG_COMPAT: reject trailing data after last + rule + +From: Florian Westphal + +[ Upstream commit 680f6af5337c98d116e4f127cea7845339dba8da ] + +If userspace provides a rule blob with trailing data after last target, +we trigger a splat, then convert ruleset to 64bit format (with trailing +data), then pass that to do_replace_finish() which then returns -EINVAL. + +Erroring out right away avoids the splat plus unneeded translation and +error unwind. + +Fixes: 81e675c227ec ("netfilter: ebtables: add CONFIG_COMPAT support") +Reported-by: Tetsuo Handa +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebtables.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 35a670ec90775..a1834ad7422ce 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2164,7 +2164,9 @@ static int compat_copy_entries(unsigned char *data, unsigned int size_user, + if (ret < 0) + return ret; + +- WARN_ON(size_remaining); ++ if (size_remaining) ++ return -EINVAL; ++ + return state->buf_kern_offset; + } + +-- +2.20.1 + diff --git a/queue-4.14/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch b/queue-4.14/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch new file mode 100644 index 00000000000..5ff2b1e745b --- /dev/null +++ b/queue-4.14/netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch @@ -0,0 +1,73 @@ +From b5bd4dce039967d6fecada86d45d7034eeee7974 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Feb 2019 14:13:41 +0100 +Subject: netfilter: nft_set_hash: fix lookups with fixed size hash on big + endian + +From: Pablo Neira Ayuso + +[ Upstream commit 3b02b0adc242a72b5e46019b6a9e4f84823592f6 ] + +Call jhash_1word() for the 4-bytes key case from the insertion and +deactivation path, otherwise big endian arch set lookups fail. + +Fixes: 446a8268b7f5 ("netfilter: nft_set_hash: add lookup variant for fixed size hashtable") +Reported-by: Florian Westphal +Tested-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_hash.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c +index 33aa2ac3a62ef..73f8f99b1193b 100644 +--- a/net/netfilter/nft_set_hash.c ++++ b/net/netfilter/nft_set_hash.c +@@ -442,6 +442,23 @@ static bool nft_hash_lookup_fast(const struct net *net, + return false; + } + ++static u32 nft_jhash(const struct nft_set *set, const struct nft_hash *priv, ++ const struct nft_set_ext *ext) ++{ ++ const struct nft_data *key = nft_set_ext_key(ext); ++ u32 hash, k1; ++ ++ if (set->klen == 4) { ++ k1 = *(u32 *)key; ++ hash = jhash_1word(k1, priv->seed); ++ } else { ++ hash = jhash(key, set->klen, priv->seed); ++ } ++ hash = reciprocal_scale(hash, priv->buckets); ++ ++ return hash; ++} ++ + static int nft_hash_insert(const struct net *net, const struct nft_set *set, + const struct nft_set_elem *elem, + struct nft_set_ext **ext) +@@ -451,8 +468,7 @@ static int nft_hash_insert(const struct net *net, const struct nft_set *set, + u8 genmask = nft_genmask_next(net); + u32 hash; + +- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed); +- hash = reciprocal_scale(hash, priv->buckets); ++ hash = nft_jhash(set, priv, &this->ext); + hlist_for_each_entry(he, &priv->table[hash], node) { + if (!memcmp(nft_set_ext_key(&this->ext), + nft_set_ext_key(&he->ext), set->klen) && +@@ -491,8 +507,7 @@ static void *nft_hash_deactivate(const struct net *net, + u8 genmask = nft_genmask_next(net); + u32 hash; + +- hash = jhash(nft_set_ext_key(&this->ext), set->klen, priv->seed); +- hash = reciprocal_scale(hash, priv->buckets); ++ hash = nft_jhash(set, priv, &this->ext); + hlist_for_each_entry(he, &priv->table[hash], node) { + if (!memcmp(nft_set_ext_key(&this->ext), &elem->key.val, + set->klen) || +-- +2.20.1 + diff --git a/queue-4.14/netvsc-unshare-skb-in-vf-rx-handler.patch b/queue-4.14/netvsc-unshare-skb-in-vf-rx-handler.patch new file mode 100644 index 00000000000..1fd997966e8 --- /dev/null +++ b/queue-4.14/netvsc-unshare-skb-in-vf-rx-handler.patch @@ -0,0 +1,45 @@ +From 350f79ed774666affb2ff5a81a640df8f277f4cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 May 2019 11:47:30 -0700 +Subject: netvsc: unshare skb in VF rx handler + +From: Stephen Hemminger + +[ Upstream commit 996ed04741467f6d1552440c92988b132a9487ec ] + +The netvsc VF skb handler should make sure that skb is not +shared. Similar logic already exists in bonding and team device +drivers. + +This is not an issue in practice because the VF devicex +does not send up shared skb's. But the netvsc driver +should do the right thing if it did. + +Fixes: 0c195567a8f6 ("netvsc: transparent VF management") +Signed-off-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc_drv.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index a89de5752a8c2..9e48855f64074 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1840,6 +1840,12 @@ static rx_handler_result_t netvsc_vf_handle_frame(struct sk_buff **pskb) + struct netvsc_vf_pcpu_stats *pcpu_stats + = this_cpu_ptr(ndev_ctx->vf_stats); + ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (unlikely(!skb)) ++ return RX_HANDLER_CONSUMED; ++ ++ *pskb = skb; ++ + skb->dev = ndev; + + u64_stats_update_begin(&pcpu_stats->syncp); +-- +2.20.1 + diff --git a/queue-4.14/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch b/queue-4.14/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch new file mode 100644 index 00000000000..d1e01035321 --- /dev/null +++ b/queue-4.14/nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch @@ -0,0 +1,37 @@ +From e4f3e6ebca204377e68a085f25f8484ba3f5a467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Apr 2019 13:59:02 -0400 +Subject: NFS: Don't interrupt file writeout due to fatal errors + +From: Trond Myklebust + +[ Upstream commit 14bebe3c90b326d2a0df78aed5e9de090c71d878 ] + +When flushing out dirty pages, the fact that we may hit fatal errors +is not a reason to stop writeback. Those errors are reported through +fsync(), not through the flush mechanism. + +Fixes: a6598813a4c5b ("NFS: Don't write back further requests if there...") +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 01b9d9341b541..ed3f5afc4ff7f 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -643,7 +643,7 @@ out: + return ret; + out_launder: + nfs_write_error_remove_page(req); +- return ret; ++ return 0; + } + + static int nfs_do_writepage(struct page *page, struct writeback_control *wbc, +-- +2.20.1 + diff --git a/queue-4.14/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch b/queue-4.14/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch new file mode 100644 index 00000000000..0474b91db3b --- /dev/null +++ b/queue-4.14/nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch @@ -0,0 +1,83 @@ +From 43d4fbb583a7be2e3ee2dd8d0b03504e8904cb63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Feb 2019 14:51:25 -0500 +Subject: NFS: Fix a soft lockup in the delegation recovery code + +From: Trond Myklebust + +[ Upstream commit 6f9449be53f3ce383caed797708b332ede8d952c ] + +Fix a soft lockup when NFS client delegation recovery is attempted +but the inode is in the process of being freed. When the +igrab(inode) call fails, and we have to restart the recovery process, +we need to ensure that we won't attempt to recover the same delegation +again. + +Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/delegation.c | 20 ++++++++++++-------- + fs/nfs/delegation.h | 1 + + 2 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 04d57e11577e0..09b3bcb86d328 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -234,6 +234,8 @@ static struct inode *nfs_delegation_grab_inode(struct nfs_delegation *delegation + spin_lock(&delegation->lock); + if (delegation->inode != NULL) + inode = igrab(delegation->inode); ++ if (!inode) ++ set_bit(NFS_DELEGATION_INODE_FREEING, &delegation->flags); + spin_unlock(&delegation->lock); + return inode; + } +@@ -863,10 +865,11 @@ restart: + list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { + list_for_each_entry_rcu(delegation, &server->delegations, + super_list) { +- if (test_bit(NFS_DELEGATION_RETURNING, +- &delegation->flags)) +- continue; +- if (test_bit(NFS_DELEGATION_NEED_RECLAIM, ++ if (test_bit(NFS_DELEGATION_INODE_FREEING, ++ &delegation->flags) || ++ test_bit(NFS_DELEGATION_RETURNING, ++ &delegation->flags) || ++ test_bit(NFS_DELEGATION_NEED_RECLAIM, + &delegation->flags) == 0) + continue; + if (!nfs_sb_active(server->super)) +@@ -971,10 +974,11 @@ restart: + list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { + list_for_each_entry_rcu(delegation, &server->delegations, + super_list) { +- if (test_bit(NFS_DELEGATION_RETURNING, +- &delegation->flags)) +- continue; +- if (test_bit(NFS_DELEGATION_TEST_EXPIRED, ++ if (test_bit(NFS_DELEGATION_INODE_FREEING, ++ &delegation->flags) || ++ test_bit(NFS_DELEGATION_RETURNING, ++ &delegation->flags) || ++ test_bit(NFS_DELEGATION_TEST_EXPIRED, + &delegation->flags) == 0) + continue; + if (!nfs_sb_active(server->super)) +diff --git a/fs/nfs/delegation.h b/fs/nfs/delegation.h +index df41d16dc6ab4..510c9edcc712d 100644 +--- a/fs/nfs/delegation.h ++++ b/fs/nfs/delegation.h +@@ -34,6 +34,7 @@ enum { + NFS_DELEGATION_RETURNING, + NFS_DELEGATION_REVOKED, + NFS_DELEGATION_TEST_EXPIRED, ++ NFS_DELEGATION_INODE_FREEING, + }; + + int nfs_inode_set_delegation(struct inode *inode, struct rpc_cred *cred, struct nfs_openres *res); +-- +2.20.1 + diff --git a/queue-4.14/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch b/queue-4.14/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch new file mode 100644 index 00000000000..affa52c9cfe --- /dev/null +++ b/queue-4.14/nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch @@ -0,0 +1,94 @@ +From 6492e47b2934e078a4a833dc9db8aa7110e8a186 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Feb 2019 14:20:27 -0500 +Subject: NFS/pnfs: Bulk destroy of layouts needs to be safe w.r.t. umount + +From: Trond Myklebust + +[ Upstream commit 5085607d209102b37b169bc94d0aa39566a9842a ] + +If a bulk layout recall or a metadata server reboot coincides with a +umount, then holding a reference to an inode is unsafe unless we +also hold a reference to the super block. + +Fixes: fd9a8d7160937 ("NFSv4.1: Fix bulk recall and destroy of layouts") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs.c | 33 +++++++++++++++++++++++---------- + fs/nfs/pnfs.h | 1 + + 2 files changed, 24 insertions(+), 10 deletions(-) + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index ec04cce31814b..83abf3dd73511 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -725,22 +725,35 @@ static int + pnfs_layout_bulk_destroy_byserver_locked(struct nfs_client *clp, + struct nfs_server *server, + struct list_head *layout_list) ++ __must_hold(&clp->cl_lock) ++ __must_hold(RCU) + { + struct pnfs_layout_hdr *lo, *next; + struct inode *inode; + + list_for_each_entry_safe(lo, next, &server->layouts, plh_layouts) { +- if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) ++ if (test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) || ++ test_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags) || ++ !list_empty(&lo->plh_bulk_destroy)) + continue; ++ /* If the sb is being destroyed, just bail */ ++ if (!nfs_sb_active(server->super)) ++ break; + inode = igrab(lo->plh_inode); +- if (inode == NULL) +- continue; +- list_del_init(&lo->plh_layouts); +- if (pnfs_layout_add_bulk_destroy_list(inode, layout_list)) +- continue; +- rcu_read_unlock(); +- spin_unlock(&clp->cl_lock); +- iput(inode); ++ if (inode != NULL) { ++ list_del_init(&lo->plh_layouts); ++ if (pnfs_layout_add_bulk_destroy_list(inode, ++ layout_list)) ++ continue; ++ rcu_read_unlock(); ++ spin_unlock(&clp->cl_lock); ++ iput(inode); ++ } else { ++ rcu_read_unlock(); ++ spin_unlock(&clp->cl_lock); ++ set_bit(NFS_LAYOUT_INODE_FREEING, &lo->plh_flags); ++ } ++ nfs_sb_deactive(server->super); + spin_lock(&clp->cl_lock); + rcu_read_lock(); + return -EAGAIN; +@@ -778,7 +791,7 @@ pnfs_layout_free_bulk_destroy_list(struct list_head *layout_list, + /* Free all lsegs that are attached to commit buckets */ + nfs_commit_inode(inode, 0); + pnfs_put_layout_hdr(lo); +- iput(inode); ++ nfs_iput_and_deactive(inode); + } + return ret; + } +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 87f144f14d1e0..965d657086c8b 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -99,6 +99,7 @@ enum { + NFS_LAYOUT_RETURN_REQUESTED, /* Return this layout ASAP */ + NFS_LAYOUT_INVALID_STID, /* layout stateid id is invalid */ + NFS_LAYOUT_FIRST_LAYOUTGET, /* Serialize first layoutget */ ++ NFS_LAYOUT_INODE_FREEING, /* The inode is being freed */ + }; + + enum layoutdriver_policy_flags { +-- +2.20.1 + diff --git a/queue-4.14/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch b/queue-4.14/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch new file mode 100644 index 00000000000..7c48b7fef32 --- /dev/null +++ b/queue-4.14/nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch @@ -0,0 +1,73 @@ +From 1ea667c4b05d5b0ecc110e5f2ddac6b15a0644b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Feb 2019 11:19:46 -0500 +Subject: NFSv4/flexfiles: Fix invalid deref in FF_LAYOUT_DEVID_NODE() + +From: Trond Myklebust + +[ Upstream commit 108bb4afd351d65826648a47f11fa3104e250d9b ] + +If the attempt to instantiate the mirror's layout DS pointer failed, +then that pointer may hold a value of type ERR_PTR(), so we need +to check that before we dereference it. + +Fixes: 65990d1afbd2d ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/flexfilelayout/flexfilelayout.h | 32 +++++++++++++++----------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/fs/nfs/flexfilelayout/flexfilelayout.h b/fs/nfs/flexfilelayout/flexfilelayout.h +index d6515f1584f3c..d78ec99b6c4ca 100644 +--- a/fs/nfs/flexfilelayout/flexfilelayout.h ++++ b/fs/nfs/flexfilelayout/flexfilelayout.h +@@ -131,16 +131,6 @@ FF_LAYOUT_LSEG(struct pnfs_layout_segment *lseg) + generic_hdr); + } + +-static inline struct nfs4_deviceid_node * +-FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx) +-{ +- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt || +- FF_LAYOUT_LSEG(lseg)->mirror_array[idx] == NULL || +- FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds == NULL) +- return NULL; +- return &FF_LAYOUT_LSEG(lseg)->mirror_array[idx]->mirror_ds->id_node; +-} +- + static inline struct nfs4_ff_layout_ds * + FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node) + { +@@ -150,9 +140,25 @@ FF_LAYOUT_MIRROR_DS(struct nfs4_deviceid_node *node) + static inline struct nfs4_ff_layout_mirror * + FF_LAYOUT_COMP(struct pnfs_layout_segment *lseg, u32 idx) + { +- if (idx >= FF_LAYOUT_LSEG(lseg)->mirror_array_cnt) +- return NULL; +- return FF_LAYOUT_LSEG(lseg)->mirror_array[idx]; ++ struct nfs4_ff_layout_segment *fls = FF_LAYOUT_LSEG(lseg); ++ ++ if (idx < fls->mirror_array_cnt) ++ return fls->mirror_array[idx]; ++ return NULL; ++} ++ ++static inline struct nfs4_deviceid_node * ++FF_LAYOUT_DEVID_NODE(struct pnfs_layout_segment *lseg, u32 idx) ++{ ++ struct nfs4_ff_layout_mirror *mirror = FF_LAYOUT_COMP(lseg, idx); ++ ++ if (mirror != NULL) { ++ struct nfs4_ff_layout_ds *mirror_ds = mirror->mirror_ds; ++ ++ if (!IS_ERR_OR_NULL(mirror_ds)) ++ return &mirror_ds->id_node; ++ } ++ return NULL; + } + + static inline u32 +-- +2.20.1 + diff --git a/queue-4.14/nios2-ksyms-add-missing-symbol-exports.patch b/queue-4.14/nios2-ksyms-add-missing-symbol-exports.patch new file mode 100644 index 00000000000..f21d37c7bdb --- /dev/null +++ b/queue-4.14/nios2-ksyms-add-missing-symbol-exports.patch @@ -0,0 +1,67 @@ +From 97d70151f22aeed556a8bbd17b498eec3e5b8ffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 10:36:10 +0800 +Subject: nios2: ksyms: Add missing symbol exports + +From: Guenter Roeck + +[ Upstream commit 0f8ed994575429d6042cf5d7ef70081c94091587 ] + +Building nios2:allmodconfig fails as follows (each symbol is only listed +once). + +ERROR: "__ashldi3" [drivers/md/dm-writecache.ko] undefined! +ERROR: "__ashrdi3" [fs/xfs/xfs.ko] undefined! +ERROR: "__ucmpdi2" [drivers/media/i2c/adv7842.ko] undefined! +ERROR: "__lshrdi3" [drivers/md/dm-zoned.ko] undefined! +ERROR: "flush_icache_range" [drivers/misc/lkdtm/lkdtm.ko] undefined! +ERROR: "empty_zero_page" [drivers/md/dm-mod.ko] undefined! + +The problem is seen with gcc 7.3.0. + +Export the missing symbols. + +Fixes: 2fc8483fdcde ("nios2: Build infrastructure") +Signed-off-by: Guenter Roeck +Signed-off-by: Ley Foon Tan +Signed-off-by: Sasha Levin +--- + arch/nios2/kernel/nios2_ksyms.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/nios2/kernel/nios2_ksyms.c b/arch/nios2/kernel/nios2_ksyms.c +index bf2f55d10a4d8..4e704046a150c 100644 +--- a/arch/nios2/kernel/nios2_ksyms.c ++++ b/arch/nios2/kernel/nios2_ksyms.c +@@ -9,12 +9,20 @@ + #include + #include + ++#include ++#include ++ + /* string functions */ + + EXPORT_SYMBOL(memcpy); + EXPORT_SYMBOL(memset); + EXPORT_SYMBOL(memmove); + ++/* memory management */ ++ ++EXPORT_SYMBOL(empty_zero_page); ++EXPORT_SYMBOL(flush_icache_range); ++ + /* + * libgcc functions - functions that are used internally by the + * compiler... (prototypes are not correct though, but that +@@ -31,3 +39,7 @@ DECLARE_EXPORT(__udivsi3); + DECLARE_EXPORT(__umoddi3); + DECLARE_EXPORT(__umodsi3); + DECLARE_EXPORT(__muldi3); ++DECLARE_EXPORT(__ucmpdi2); ++DECLARE_EXPORT(__lshrdi3); ++DECLARE_EXPORT(__ashldi3); ++DECLARE_EXPORT(__ashrdi3); +-- +2.20.1 + diff --git a/queue-4.14/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch b/queue-4.14/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch new file mode 100644 index 00000000000..ef36250f239 --- /dev/null +++ b/queue-4.14/ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch @@ -0,0 +1,54 @@ +From 6f8259bae64f389983861a288a3d41b7814bb6bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Aug 2018 17:13:06 -0500 +Subject: NTB: ntb_hw_idt: replace IS_ERR_OR_NULL with regular NULL checks + +From: Gustavo A. R. Silva + +[ Upstream commit 1b7619828d0c341612f58683e73f279c37e70bbc ] + +Both devm_kcalloc() and devm_kzalloc() return NULL on error. They +never return error pointers. + +The use of IS_ERR_OR_NULL is currently applied to the wrong +context. + +Fix this by replacing IS_ERR_OR_NULL with regular NULL checks. + +Fixes: bf2a952d31d2 ("NTB: Add IDT 89HPESxNTx PCIe-switches support") +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/idt/ntb_hw_idt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/ntb/hw/idt/ntb_hw_idt.c b/drivers/ntb/hw/idt/ntb_hw_idt.c +index d44d7ef38fe88..b68e2cad74cc7 100644 +--- a/drivers/ntb/hw/idt/ntb_hw_idt.c ++++ b/drivers/ntb/hw/idt/ntb_hw_idt.c +@@ -1105,9 +1105,9 @@ static struct idt_mw_cfg *idt_scan_mws(struct idt_ntb_dev *ndev, int port, + } + + /* Allocate memory for memory window descriptors */ +- ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, +- sizeof(*ret_mws), GFP_KERNEL); +- if (IS_ERR_OR_NULL(ret_mws)) ++ ret_mws = devm_kcalloc(&ndev->ntb.pdev->dev, *mw_cnt, sizeof(*ret_mws), ++ GFP_KERNEL); ++ if (!ret_mws) + return ERR_PTR(-ENOMEM); + + /* Copy the info of detected memory windows */ +@@ -2393,7 +2393,7 @@ static struct idt_ntb_dev *idt_create_dev(struct pci_dev *pdev, + + /* Allocate memory for the IDT PCIe-device descriptor */ + ndev = devm_kzalloc(&pdev->dev, sizeof(*ndev), GFP_KERNEL); +- if (IS_ERR_OR_NULL(ndev)) { ++ if (!ndev) { + dev_err(&pdev->dev, "Memory allocation failed for descriptor"); + return ERR_PTR(-ENOMEM); + } +-- +2.20.1 + diff --git a/queue-4.14/nvme-retain-split-access-workaround-for-capability-r.patch b/queue-4.14/nvme-retain-split-access-workaround-for-capability-r.patch new file mode 100644 index 00000000000..74692dcc287 --- /dev/null +++ b/queue-4.14/nvme-retain-split-access-workaround-for-capability-r.patch @@ -0,0 +1,57 @@ +From b36839c78f293608b17a64d8b84f020aacc574fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2019 13:57:29 +0200 +Subject: nvme: retain split access workaround for capability reads + +From: Ard Biesheuvel + +[ Upstream commit 3a8ecc935efabdad106b5e06d07b150c394b4465 ] + +Commit 7fd8930f26be4 + + "nvme: add a common helper to read Identify Controller data" + +has re-introduced an issue that we have attempted to work around in the +past, in commit a310acd7a7ea ("NVMe: use split lo_hi_{read,write}q"). + +The problem is that some PCIe NVMe controllers do not implement 64-bit +outbound accesses correctly, which is why the commit above switched +to using lo_hi_[read|write]q for all 64-bit BAR accesses occuring in +the code. + +In the mean time, the NVMe subsystem has been refactored, and now calls +into the PCIe support layer for NVMe via a .reg_read64() method, which +fails to use lo_hi_readq(), and thus reintroduces the problem that the +workaround above aimed to address. + +Given that, at the moment, .reg_read64() is only used to read the +capability register [which is known to tolerate split reads], let's +switch .reg_read64() to lo_hi_readq() as well. + +This fixes a boot issue on some ARM boxes with NVMe behind a Synopsys +DesignWare PCIe host controller. + +Fixes: 7fd8930f26be4 ("nvme: add a common helper to read Identify Controller data") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index cd11cced36781..3788c053a0b19 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2274,7 +2274,7 @@ static int nvme_pci_reg_write32(struct nvme_ctrl *ctrl, u32 off, u32 val) + + static int nvme_pci_reg_read64(struct nvme_ctrl *ctrl, u32 off, u64 *val) + { +- *val = readq(to_nvme_dev(ctrl)->bar + off); ++ *val = lo_hi_readq(to_nvme_dev(ctrl)->bar + off); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch b/queue-4.14/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch new file mode 100644 index 00000000000..261b106d2a3 --- /dev/null +++ b/queue-4.14/nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch @@ -0,0 +1,47 @@ +From 40725f9e6e1644c3db438a3130e5fc8e25c2b28e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jun 2019 11:27:29 +0100 +Subject: nvmem: imx-ocotp: Ensure WAIT bits are preserved when setting timing + +From: Bryan O'Donoghue + +[ Upstream commit 0493c4792b4eb260441e57f52cc11a9ded48b5a7 ] + +The i.MX6 and i.MX8 both have a bit-field spanning bits 27:22 called the +WAIT field. + +The WAIT field according to the documentation for both parts "specifies +time interval between auto read and write access in one time program. It is +given in number of ipg_clk periods." + +This patch ensures that the relevant field is read and written back to the +timing register. + +Fixes: 0642bac7da42 ("nvmem: imx-ocotp: add write support") + +Signed-off-by: Bryan O'Donoghue +Reviewed-by: Leonard Crestez +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/imx-ocotp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c +index 193ca8fd350a4..0c8c3b9bb6a7a 100644 +--- a/drivers/nvmem/imx-ocotp.c ++++ b/drivers/nvmem/imx-ocotp.c +@@ -199,7 +199,8 @@ static int imx_ocotp_write(void *context, unsigned int offset, void *val, + strobe_prog = clk_rate / (1000000000 / 10000) + 2 * (DEF_RELAX + 1) - 1; + strobe_read = clk_rate / (1000000000 / 40) + 2 * (DEF_RELAX + 1) - 1; + +- timing = strobe_prog & 0x00000FFF; ++ timing = readl(priv->base + IMX_OCOTP_ADDR_TIMING) & 0x0FC00000; ++ timing |= strobe_prog & 0x00000FFF; + timing |= (relax << 12) & 0x0000F000; + timing |= (strobe_read << 16) & 0x003F0000; + +-- +2.20.1 + diff --git a/queue-4.14/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch b/queue-4.14/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch new file mode 100644 index 00000000000..22d3acd4e98 --- /dev/null +++ b/queue-4.14/of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch @@ -0,0 +1,36 @@ +From a3af5d28c0eb9fc57f30f31888e720c159492213 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 14:01:00 +0300 +Subject: of: mdio: Fix a signedness bug in of_phy_get_and_connect() + +From: Dan Carpenter + +[ Upstream commit d7eb651212fdbafa82d485d8e76095ac3b14c193 ] + +The "iface" variable is an enum and in this context GCC treats it as +an unsigned int so the error handling is never triggered. + +Fixes: b78624125304 ("of_mdio: Abstract a general interface for phy connect") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/of/of_mdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c +index 8c1819230ed23..fe26697d3bd72 100644 +--- a/drivers/of/of_mdio.c ++++ b/drivers/of/of_mdio.c +@@ -358,7 +358,7 @@ struct phy_device *of_phy_get_and_connect(struct net_device *dev, + struct phy_device *phy; + + iface = of_get_phy_mode(np); +- if (iface < 0) ++ if ((int)iface < 0) + return NULL; + + phy_np = of_parse_phandle(np, "phy-handle", 0); +-- +2.20.1 + diff --git a/queue-4.14/packet-fix-data-race-in-fanout_flow_is_huge.patch b/queue-4.14/packet-fix-data-race-in-fanout_flow_is_huge.patch new file mode 100644 index 00000000000..9fdf45ddd10 --- /dev/null +++ b/queue-4.14/packet-fix-data-race-in-fanout_flow_is_huge.patch @@ -0,0 +1,134 @@ +From 4aeb4a3180238ba8ecc8d7a3b4b03f1a1caac239 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 05:07:46 -0800 +Subject: packet: fix data-race in fanout_flow_is_huge() + +From: Eric Dumazet + +[ Upstream commit b756ad928d98e5ef0b74af7546a6a31a8dadde00 ] + +KCSAN reported the following data-race [1] + +Adding a couple of READ_ONCE()/WRITE_ONCE() should silence it. + +Since the report hinted about multiple cpus using the history +concurrently, I added a test avoiding writing on it if the +victim slot already contains the desired value. + +[1] + +BUG: KCSAN: data-race in fanout_demux_rollover / fanout_demux_rollover + +read to 0xffff8880b01786cc of 4 bytes by task 18921 on cpu 1: + fanout_flow_is_huge net/packet/af_packet.c:1303 [inline] + fanout_demux_rollover+0x33e/0x3f0 net/packet/af_packet.c:1353 + packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453 + deliver_skb net/core/dev.c:1888 [inline] + dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958 + xmit_one net/core/dev.c:3195 [inline] + dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215 + __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792 + dev_queue_xmit+0x21/0x30 net/core/dev.c:3825 + neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530 + neigh_output include/net/neighbour.h:511 [inline] + ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116 + __ip6_finish_output net/ipv6/ip6_output.c:142 [inline] + __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127 + ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152 + NF_HOOK_COND include/linux/netfilter.h:294 [inline] + ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175 + dst_output include/net/dst.h:436 [inline] + ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179 + ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795 + udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173 + udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471 + inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576 + sock_sendmsg_nosec net/socket.c:637 [inline] + sock_sendmsg+0x9f/0xc0 net/socket.c:657 + ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311 + __sys_sendmmsg+0x123/0x350 net/socket.c:2413 + __do_sys_sendmmsg net/socket.c:2442 [inline] + __se_sys_sendmmsg net/socket.c:2439 [inline] + __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439 + do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +write to 0xffff8880b01786cc of 4 bytes by task 18922 on cpu 0: + fanout_flow_is_huge net/packet/af_packet.c:1306 [inline] + fanout_demux_rollover+0x3a4/0x3f0 net/packet/af_packet.c:1353 + packet_rcv_fanout+0x34e/0x490 net/packet/af_packet.c:1453 + deliver_skb net/core/dev.c:1888 [inline] + dev_queue_xmit_nit+0x15b/0x540 net/core/dev.c:1958 + xmit_one net/core/dev.c:3195 [inline] + dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3215 + __dev_queue_xmit+0x14ab/0x1b40 net/core/dev.c:3792 + dev_queue_xmit+0x21/0x30 net/core/dev.c:3825 + neigh_direct_output+0x1f/0x30 net/core/neighbour.c:1530 + neigh_output include/net/neighbour.h:511 [inline] + ip6_finish_output2+0x7a2/0xec0 net/ipv6/ip6_output.c:116 + __ip6_finish_output net/ipv6/ip6_output.c:142 [inline] + __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127 + ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152 + NF_HOOK_COND include/linux/netfilter.h:294 [inline] + ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175 + dst_output include/net/dst.h:436 [inline] + ip6_local_out+0x74/0x90 net/ipv6/output_core.c:179 + ip6_send_skb+0x53/0x110 net/ipv6/ip6_output.c:1795 + udp_v6_send_skb.isra.0+0x3ec/0xa70 net/ipv6/udp.c:1173 + udpv6_sendmsg+0x1906/0x1c20 net/ipv6/udp.c:1471 + inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576 + sock_sendmsg_nosec net/socket.c:637 [inline] + sock_sendmsg+0x9f/0xc0 net/socket.c:657 + ___sys_sendmsg+0x2b7/0x5d0 net/socket.c:2311 + __sys_sendmmsg+0x123/0x350 net/socket.c:2413 + __do_sys_sendmmsg net/socket.c:2442 [inline] + __se_sys_sendmmsg net/socket.c:2439 [inline] + __x64_sys_sendmmsg+0x64/0x80 net/socket.c:2439 + do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 0 PID: 18922 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 3b3a5b0aab5b ("packet: rollover huge flows before small flows") +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index e788f9c7c3984..46b7fac82775c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1337,15 +1337,21 @@ static void packet_sock_destruct(struct sock *sk) + + static bool fanout_flow_is_huge(struct packet_sock *po, struct sk_buff *skb) + { +- u32 rxhash; ++ u32 *history = po->rollover->history; ++ u32 victim, rxhash; + int i, count = 0; + + rxhash = skb_get_hash(skb); + for (i = 0; i < ROLLOVER_HLEN; i++) +- if (po->rollover->history[i] == rxhash) ++ if (READ_ONCE(history[i]) == rxhash) + count++; + +- po->rollover->history[prandom_u32() % ROLLOVER_HLEN] = rxhash; ++ victim = prandom_u32() % ROLLOVER_HLEN; ++ ++ /* Avoid dirtying the cache line if possible */ ++ if (READ_ONCE(history[victim]) != rxhash) ++ WRITE_ONCE(history[victim], rxhash); ++ + return count > (ROLLOVER_HLEN >> 1); + } + +-- +2.20.1 + diff --git a/queue-4.14/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch b/queue-4.14/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch new file mode 100644 index 00000000000..6e05c1606c4 --- /dev/null +++ b/queue-4.14/packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch @@ -0,0 +1,69 @@ +From 5c43c85ee84499f3c6a4a9b2e5674e5f95c7f11b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Apr 2019 11:46:55 -0400 +Subject: packet: in recvmsg msg_name return at least sizeof sockaddr_ll + +From: Willem de Bruijn + +[ Upstream commit b2cf86e1563e33a14a1c69b3e508d15dc12f804c ] + +Packet send checks that msg_name is at least sizeof sockaddr_ll. +Packet recv must return at least this length, so that its output +can be passed unmodified to packet send. + +This ceased to be true since adding support for lladdr longer than +sll_addr. Since, the return value uses true address length. + +Always return at least sizeof sockaddr_ll, even if address length +is shorter. Zero the padding bytes. + +Change v1->v2: do not overwrite zeroed padding again. use copy_len. + +Fixes: 0fb375fb9b93 ("[AF_PACKET]: Allow for > 8 byte hardware addresses.") +Suggested-by: David Laight +Signed-off-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/packet/af_packet.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 4e1058159b082..e788f9c7c3984 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3407,20 +3407,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + sock_recv_ts_and_drops(msg, sk, skb); + + if (msg->msg_name) { ++ int copy_len; ++ + /* If the address length field is there to be filled + * in, we fill it in now. + */ + if (sock->type == SOCK_PACKET) { + __sockaddr_check_size(sizeof(struct sockaddr_pkt)); + msg->msg_namelen = sizeof(struct sockaddr_pkt); ++ copy_len = msg->msg_namelen; + } else { + struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll; + + msg->msg_namelen = sll->sll_halen + + offsetof(struct sockaddr_ll, sll_addr); ++ copy_len = msg->msg_namelen; ++ if (msg->msg_namelen < sizeof(struct sockaddr_ll)) { ++ memset(msg->msg_name + ++ offsetof(struct sockaddr_ll, sll_addr), ++ 0, sizeof(sll->sll_addr)); ++ msg->msg_namelen = sizeof(struct sockaddr_ll); ++ } + } +- memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, +- msg->msg_namelen); ++ memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len); + } + + if (pkt_sk(sk)->auxdata) { +-- +2.20.1 + diff --git a/queue-4.14/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch b/queue-4.14/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch new file mode 100644 index 00000000000..536b17958d4 --- /dev/null +++ b/queue-4.14/partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch @@ -0,0 +1,62 @@ +From d68981a2bc7e056429a737fd28fdd843dbb9dd45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Aug 2019 18:47:15 -0700 +Subject: Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()" + +From: Linus Torvalds + +[ Upstream commit ab9bb6318b0967671e0c9b6537c1537d51ca4f45 ] + +Commit dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") made +the kfifo code round the number of elements up. That was good for +__kfifo_alloc(), but it's actually wrong for __kfifo_init(). + +The difference? __kfifo_alloc() will allocate the rounded-up number of +elements, but __kfifo_init() uses an allocation done by the caller. We +can't just say "use more elements than the caller allocated", and have +to round down. + +The good news? All the normal cases will be using power-of-two arrays +anyway, and most users of kfifo's don't use kfifo_init() at all, but one +of the helper macros to declare a KFIFO that enforce the proper +power-of-two behavior. But it looks like at least ibmvscsis might be +affected. + +The bad news? Will Deacon refers to an old thread and points points out +that the memory ordering in kfifo's is questionable. See + + https://lore.kernel.org/lkml/20181211034032.32338-1-yuleixzhang@tencent.com/ + +for more. + +Fixes: dfe2a77fd243 ("kfifo: fix kfifo_alloc() and kfifo_init()") +Reported-by: laokz +Cc: Stefani Seibold +Cc: Andrew Morton +Cc: Dan Carpenter +Cc: Greg KH +Cc: Kees Cook +Cc: Will Deacon +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/kfifo.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/kfifo.c b/lib/kfifo.c +index 90ba1eb1df06e..a94227c555510 100644 +--- a/lib/kfifo.c ++++ b/lib/kfifo.c +@@ -82,7 +82,8 @@ int __kfifo_init(struct __kfifo *fifo, void *buffer, + { + size /= esize; + +- size = roundup_pow_of_two(size); ++ if (!is_power_of_2(size)) ++ size = rounddown_pow_of_two(size); + + fifo->in = 0; + fifo->out = 0; +-- +2.20.1 + diff --git a/queue-4.14/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch b/queue-4.14/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch new file mode 100644 index 00000000000..244421f3eaf --- /dev/null +++ b/queue-4.14/pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch @@ -0,0 +1,58 @@ +From b3ddf545e206c7042212b61fc9e6f779f4bd9ea6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Feb 2019 17:04:00 +0800 +Subject: PCI: endpoint: functions: Use memcpy_fromio()/memcpy_toio() + +From: Wen Yang + +[ Upstream commit 726dabfde6aa35a4f1508e235ae37edbbf9fbc65 ] + +Functions copying from/to IO addresses should use the +memcpy_fromio()/memcpy_toio() API rather than plain memcpy(). + +Fix the issue detected through the sparse tool. + +Fixes: 349e7a85b25f ("PCI: endpoint: functions: Add an EP function to test PCI") +Suggested-by: Kishon Vijay Abraham I +Signed-off-by: Wen Yang +[lorenzo.pieralisi@arm.com: updated log] +Signed-off-by: Lorenzo Pieralisi +Acked-by: Kishon Vijay Abraham I +CC: Lorenzo Pieralisi +CC: Bjorn Helgaas +CC: Gustavo Pimentel +CC: Niklas Cassel +CC: Greg Kroah-Hartman +CC: Cyrille Pitchen +CC: linux-pci@vger.kernel.org +CC: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/pci/endpoint/functions/pci-epf-test.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c +index f9308c2f22e67..c2541a772abc8 100644 +--- a/drivers/pci/endpoint/functions/pci-epf-test.c ++++ b/drivers/pci/endpoint/functions/pci-epf-test.c +@@ -177,7 +177,7 @@ static int pci_epf_test_read(struct pci_epf_test *epf_test) + goto err_map_addr; + } + +- memcpy(buf, src_addr, reg->size); ++ memcpy_fromio(buf, src_addr, reg->size); + + crc32 = crc32_le(~0, buf, reg->size); + if (crc32 != reg->checksum) +@@ -231,7 +231,7 @@ static int pci_epf_test_write(struct pci_epf_test *epf_test) + get_random_bytes(buf, reg->size); + reg->checksum = crc32_le(~0, buf, reg->size); + +- memcpy(dst_addr, buf, reg->size); ++ memcpy_toio(dst_addr, buf, reg->size); + + /* + * wait 1ms inorder for the write to complete. Without this delay L3 +-- +2.20.1 + diff --git a/queue-4.14/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch b/queue-4.14/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch new file mode 100644 index 00000000000..d75882f89f3 --- /dev/null +++ b/queue-4.14/pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch @@ -0,0 +1,45 @@ +From 1e3034811a0c50a952a455bb01cf06f484ab23e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 10:22:58 -0700 +Subject: PCI: iproc: Remove PAXC slot check to allow VF support + +From: Jitendra Bhivare + +[ Upstream commit 4da6b4480766e5bc9c4d7bc14bf1d0939a1a5fa7 ] + +Fix previous incorrect logic that limits PAXC slot number to zero only. +In order for SRIOV/VF to work, we need to allow the slot number to be +greater than zero. + +Fixes: 46560388c476c ("PCI: iproc: Allow multiple devices except on PAXC") +Signed-off-by: Jitendra Bhivare +Signed-off-by: Ray Jui +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Andy Gospodarek +Signed-off-by: Sasha Levin +--- + drivers/pci/host/pcie-iproc.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c +index c0ecc9f35667f..8f8dac0155d63 100644 +--- a/drivers/pci/host/pcie-iproc.c ++++ b/drivers/pci/host/pcie-iproc.c +@@ -573,14 +573,6 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct iproc_pcie *pcie, + return (pcie->base + offset); + } + +- /* +- * PAXC is connected to an internally emulated EP within the SoC. It +- * allows only one device. +- */ +- if (pcie->ep_is_internal) +- if (slot > 0) +- return NULL; +- + return iproc_pcie_map_ep_cfg_reg(pcie, busno, slot, fn, where); + } + +-- +2.20.1 + diff --git a/queue-4.14/pci-pm-avoid-possible-suspend-to-idle-issue.patch b/queue-4.14/pci-pm-avoid-possible-suspend-to-idle-issue.patch new file mode 100644 index 00000000000..93fdfffe35e --- /dev/null +++ b/queue-4.14/pci-pm-avoid-possible-suspend-to-idle-issue.patch @@ -0,0 +1,89 @@ +From 8984dcf2ede2f48df34cd584ae0ac04b3c66d7f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 May 2019 11:08:50 +0200 +Subject: PCI: PM: Avoid possible suspend-to-idle issue + +From: Rafael J. Wysocki + +[ Upstream commit d491f2b75237ef37d8867830ab7fad8d9659e853 ] + +If a PCI driver leaves the device handled by it in D0 and calls +pci_save_state() on the device in its ->suspend() or ->suspend_late() +callback, it can expect the device to stay in D0 over the whole +s2idle cycle. However, that may not be the case if there is a +spurious wakeup while the system is suspended, because in that case +pci_pm_suspend_noirq() will run again after pci_pm_resume_noirq() +which calls pci_restore_state(), via pci_pm_default_resume_early(), +so state_saved is cleared and the second iteration of +pci_pm_suspend_noirq() will invoke pci_prepare_to_sleep() which +may change the power state of the device. + +To avoid that, add a new internal flag, skip_bus_pm, that will be set +by pci_pm_suspend_noirq() when it runs for the first time during the +given system suspend-resume cycle if the state of the device has +been saved already and the device is still in D0. Setting that flag +will cause the next iterations of pci_pm_suspend_noirq() to set +state_saved for pci_pm_resume_noirq(), so that it always restores the +device state from the originally saved data, and avoid calling +pci_prepare_to_sleep() for the device. + +Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle") +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Keith Busch +Reviewed-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-driver.c | 17 ++++++++++++++++- + include/linux/pci.h | 1 + + 2 files changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index 522e59274b5d0..1589a147c5364 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -728,6 +728,8 @@ static int pci_pm_suspend(struct device *dev) + struct pci_dev *pci_dev = to_pci_dev(dev); + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + ++ pci_dev->skip_bus_pm = false; ++ + if (pci_has_legacy_pm_support(pci_dev)) + return pci_legacy_suspend(dev, PMSG_SUSPEND); + +@@ -801,7 +803,20 @@ static int pci_pm_suspend_noirq(struct device *dev) + } + } + +- if (!pci_dev->state_saved) { ++ if (pci_dev->skip_bus_pm) { ++ /* ++ * The function is running for the second time in a row without ++ * going through full resume, which is possible only during ++ * suspend-to-idle in a spurious wakeup case. Moreover, the ++ * device was originally left in D0, so its power state should ++ * not be changed here and the device register values saved ++ * originally should be restored on resume again. ++ */ ++ pci_dev->state_saved = true; ++ } else if (pci_dev->state_saved) { ++ if (pci_dev->current_state == PCI_D0) ++ pci_dev->skip_bus_pm = true; ++ } else { + pci_save_state(pci_dev); + if (pci_power_manageable(pci_dev)) + pci_prepare_to_sleep(pci_dev); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 59f4d10568c65..430f3c335446e 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -346,6 +346,7 @@ struct pci_dev { + D3cold, not set for devices + powered on/off by the + corresponding bridge */ ++ unsigned int skip_bus_pm:1; /* Internal: Skip bus-level PM */ + unsigned int ignore_hotplug:1; /* Ignore hotplug events */ + unsigned int hotplug_user_indicators:1; /* SlotCtl indicators + controlled exclusively by +-- +2.20.1 + diff --git a/queue-4.14/pcrypt-use-format-specifier-in-kobject_add.patch b/queue-4.14/pcrypt-use-format-specifier-in-kobject_add.patch new file mode 100644 index 00000000000..999951c4253 --- /dev/null +++ b/queue-4.14/pcrypt-use-format-specifier-in-kobject_add.patch @@ -0,0 +1,43 @@ +From 0522d2c6700ef0633797483312ca9058480970e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Oct 2018 15:49:26 +0100 +Subject: pcrypt: use format specifier in kobject_add + +From: Colin Ian King + +[ Upstream commit b1e3874c75ab15288f573b3532e507c37e8e7656 ] + +Passing string 'name' as the format specifier is potentially hazardous +because name could (although very unlikely to) have a format specifier +embedded in it causing issues when parsing the non-existent arguments +to these. Follow best practice by using the "%s" format string for +the string 'name'. + +Cleans up clang warning: +crypto/pcrypt.c:397:40: warning: format string is not a string literal +(potentially insecure) [-Wformat-security] + +Fixes: a3fb1e330dd2 ("pcrypt: Added sysfs interface to pcrypt") +Signed-off-by: Colin Ian King +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/pcrypt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c +index f8ec3d4ba4a80..a5718c0a3dc4e 100644 +--- a/crypto/pcrypt.c ++++ b/crypto/pcrypt.c +@@ -394,7 +394,7 @@ static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name) + int ret; + + pinst->kobj.kset = pcrypt_kset; +- ret = kobject_add(&pinst->kobj, NULL, name); ++ ret = kobject_add(&pinst->kobj, NULL, "%s", name); + if (!ret) + kobject_uevent(&pinst->kobj, KOBJ_ADD); + +-- +2.20.1 + diff --git a/queue-4.14/perf-ioctl-add-check-for-the-sample_period-value.patch b/queue-4.14/perf-ioctl-add-check-for-the-sample_period-value.patch new file mode 100644 index 00000000000..a1da8d25772 --- /dev/null +++ b/queue-4.14/perf-ioctl-add-check-for-the-sample_period-value.patch @@ -0,0 +1,57 @@ +From dfaf02c546e2c53e9d54cfbf6488907483a18fb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2019 09:59:53 +0530 +Subject: perf/ioctl: Add check for the sample_period value + +From: Ravi Bangoria + +[ Upstream commit 913a90bc5a3a06b1f04c337320e9aeee2328dd77 ] + +perf_event_open() limits the sample_period to 63 bits. See: + + 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits") + +Make ioctl() consistent with it. + +Also on PowerPC, negative sample_period could cause a recursive +PMIs leading to a hang (reported when running perf-fuzzer). + +Signed-off-by: Ravi Bangoria +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Cc: acme@kernel.org +Cc: linuxppc-dev@lists.ozlabs.org +Cc: maddy@linux.vnet.ibm.com +Cc: mpe@ellerman.id.au +Fixes: 0819b2e30ccb ("perf: Limit perf_event_attr::sample_period to 63 bits") +Link: https://lkml.kernel.org/r/20190604042953.914-1-ravi.bangoria@linux.ibm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index ea4f3f7a0c6f3..2ac73b4cb8a93 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4762,6 +4762,9 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) + if (perf_event_check_period(event, value)) + return -EINVAL; + ++ if (!event->attr.freq && (value & (1ULL << 63))) ++ return -EINVAL; ++ + event_function_call(event, __perf_event_period, &value); + + return 0; +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch b/queue-4.14/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch new file mode 100644 index 00000000000..a76bb2593ef --- /dev/null +++ b/queue-4.14/pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch @@ -0,0 +1,227 @@ +From 95c68aed9bfcb56508ee791f1d77f67fa2b10b8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 10:22:27 +0530 +Subject: pinctrl: iproc-gpio: Fix incorrect pinconf configurations + +From: Li Jin + +[ Upstream commit 398a1f50e3c731586182fd52b834103b0aa2f826 ] + +Fix drive strength for AON/CRMU controller; fix pull-up/down setting +for CCM/CDRU controller. + +Fixes: 616043d58a89 ("pinctrl: Rename gpio driver from cygnus to iproc") +Signed-off-by: Li Jin +Link: https://lore.kernel.org/r/1567054348-19685-2-git-send-email-srinath.mannam@broadcom.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-iproc-gpio.c | 96 +++++++++++++++++++----- + 1 file changed, 77 insertions(+), 19 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c +index 85a8c97d9dfed..5fe419e468ecc 100644 +--- a/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c ++++ b/drivers/pinctrl/bcm/pinctrl-iproc-gpio.c +@@ -54,8 +54,12 @@ + /* drive strength control for ASIU GPIO */ + #define IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET 0x58 + +-/* drive strength control for CCM/CRMU (AON) GPIO */ +-#define IPROC_GPIO_DRV0_CTRL_OFFSET 0x00 ++/* pinconf for CCM GPIO */ ++#define IPROC_GPIO_PULL_DN_OFFSET 0x10 ++#define IPROC_GPIO_PULL_UP_OFFSET 0x14 ++ ++/* pinconf for CRMU(aon) GPIO and CCM GPIO*/ ++#define IPROC_GPIO_DRV_CTRL_OFFSET 0x00 + + #define GPIO_BANK_SIZE 0x200 + #define NGPIOS_PER_BANK 32 +@@ -76,6 +80,12 @@ enum iproc_pinconf_param { + IPROC_PINCON_MAX, + }; + ++enum iproc_pinconf_ctrl_type { ++ IOCTRL_TYPE_AON = 1, ++ IOCTRL_TYPE_CDRU, ++ IOCTRL_TYPE_INVALID, ++}; ++ + /* + * Iproc GPIO core + * +@@ -100,6 +110,7 @@ struct iproc_gpio { + + void __iomem *base; + void __iomem *io_ctrl; ++ enum iproc_pinconf_ctrl_type io_ctrl_type; + + raw_spinlock_t lock; + +@@ -461,20 +472,44 @@ static const struct pinctrl_ops iproc_pctrl_ops = { + static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio, + bool disable, bool pull_up) + { ++ void __iomem *base; + unsigned long flags; ++ unsigned int shift; ++ u32 val_1, val_2; + + raw_spin_lock_irqsave(&chip->lock, flags); +- +- if (disable) { +- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, false); ++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) { ++ base = chip->io_ctrl; ++ shift = IPROC_GPIO_SHIFT(gpio); ++ ++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET); ++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET); ++ if (disable) { ++ /* no pull-up or pull-down */ ++ val_1 &= ~BIT(shift); ++ val_2 &= ~BIT(shift); ++ } else if (pull_up) { ++ val_1 |= BIT(shift); ++ val_2 &= ~BIT(shift); ++ } else { ++ val_1 &= ~BIT(shift); ++ val_2 |= BIT(shift); ++ } ++ writel(val_1, base + IPROC_GPIO_PULL_UP_OFFSET); ++ writel(val_2, base + IPROC_GPIO_PULL_DN_OFFSET); + } else { +- iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio, +- pull_up); +- iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, true); ++ if (disable) { ++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, ++ false); ++ } else { ++ iproc_set_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio, ++ pull_up); ++ iproc_set_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio, ++ true); ++ } + } + + raw_spin_unlock_irqrestore(&chip->lock, flags); +- + dev_dbg(chip->dev, "gpio:%u set pullup:%d\n", gpio, pull_up); + + return 0; +@@ -483,14 +518,35 @@ static int iproc_gpio_set_pull(struct iproc_gpio *chip, unsigned gpio, + static void iproc_gpio_get_pull(struct iproc_gpio *chip, unsigned gpio, + bool *disable, bool *pull_up) + { ++ void __iomem *base; + unsigned long flags; ++ unsigned int shift; ++ u32 val_1, val_2; + + raw_spin_lock_irqsave(&chip->lock, flags); +- *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio); +- *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio); ++ if (chip->io_ctrl_type == IOCTRL_TYPE_CDRU) { ++ base = chip->io_ctrl; ++ shift = IPROC_GPIO_SHIFT(gpio); ++ ++ val_1 = readl(base + IPROC_GPIO_PULL_UP_OFFSET) & BIT(shift); ++ val_2 = readl(base + IPROC_GPIO_PULL_DN_OFFSET) & BIT(shift); ++ ++ *pull_up = val_1 ? true : false; ++ *disable = (val_1 | val_2) ? false : true; ++ ++ } else { ++ *disable = !iproc_get_bit(chip, IPROC_GPIO_RES_EN_OFFSET, gpio); ++ *pull_up = iproc_get_bit(chip, IPROC_GPIO_PAD_RES_OFFSET, gpio); ++ } + raw_spin_unlock_irqrestore(&chip->lock, flags); + } + ++#define DRV_STRENGTH_OFFSET(gpio, bit, type) ((type) == IOCTRL_TYPE_AON ? \ ++ ((2 - (bit)) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \ ++ ((type) == IOCTRL_TYPE_CDRU) ? \ ++ ((bit) * 4 + IPROC_GPIO_DRV_CTRL_OFFSET) : \ ++ ((bit) * 4 + IPROC_GPIO_REG(gpio, IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET))) ++ + static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio, + unsigned strength) + { +@@ -505,11 +561,8 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio, + + if (chip->io_ctrl) { + base = chip->io_ctrl; +- offset = IPROC_GPIO_DRV0_CTRL_OFFSET; + } else { + base = chip->base; +- offset = IPROC_GPIO_REG(gpio, +- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET); + } + + shift = IPROC_GPIO_SHIFT(gpio); +@@ -520,11 +573,11 @@ static int iproc_gpio_set_strength(struct iproc_gpio *chip, unsigned gpio, + raw_spin_lock_irqsave(&chip->lock, flags); + strength = (strength / 2) - 1; + for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) { ++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type); + val = readl(base + offset); + val &= ~BIT(shift); + val |= ((strength >> i) & 0x1) << shift; + writel(val, base + offset); +- offset += 4; + } + raw_spin_unlock_irqrestore(&chip->lock, flags); + +@@ -541,11 +594,8 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio, + + if (chip->io_ctrl) { + base = chip->io_ctrl; +- offset = IPROC_GPIO_DRV0_CTRL_OFFSET; + } else { + base = chip->base; +- offset = IPROC_GPIO_REG(gpio, +- IPROC_GPIO_ASIU_DRV0_CTRL_OFFSET); + } + + shift = IPROC_GPIO_SHIFT(gpio); +@@ -553,10 +603,10 @@ static int iproc_gpio_get_strength(struct iproc_gpio *chip, unsigned gpio, + raw_spin_lock_irqsave(&chip->lock, flags); + *strength = 0; + for (i = 0; i < GPIO_DRV_STRENGTH_BITS; i++) { ++ offset = DRV_STRENGTH_OFFSET(gpio, i, chip->io_ctrl_type); + val = readl(base + offset) & BIT(shift); + val >>= shift; + *strength += (val << i); +- offset += 4; + } + + /* convert to mA */ +@@ -734,6 +784,7 @@ static int iproc_gpio_probe(struct platform_device *pdev) + u32 ngpios, pinconf_disable_mask = 0; + int irq, ret; + bool no_pinconf = false; ++ enum iproc_pinconf_ctrl_type io_ctrl_type = IOCTRL_TYPE_INVALID; + + /* NSP does not support drive strength config */ + if (of_device_is_compatible(dev->of_node, "brcm,iproc-nsp-gpio")) +@@ -764,8 +815,15 @@ static int iproc_gpio_probe(struct platform_device *pdev) + dev_err(dev, "unable to map I/O memory\n"); + return PTR_ERR(chip->io_ctrl); + } ++ if (of_device_is_compatible(dev->of_node, ++ "brcm,cygnus-ccm-gpio")) ++ io_ctrl_type = IOCTRL_TYPE_CDRU; ++ else ++ io_ctrl_type = IOCTRL_TYPE_AON; + } + ++ chip->io_ctrl_type = io_ctrl_type; ++ + if (of_property_read_u32(dev->of_node, "ngpios", &ngpios)) { + dev_err(&pdev->dev, "missing ngpios DT property\n"); + return -ENODEV; +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch b/queue-4.14/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch new file mode 100644 index 00000000000..db444da4b1c --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch @@ -0,0 +1,82 @@ +From 11bf51cd1e2efeba28d3996c2e4a2b0d59b1809c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jan 2019 13:04:52 +0100 +Subject: pinctrl: sh-pfc: emev2: Add missing pinmux functions + +From: Geert Uytterhoeven + +[ Upstream commit 1ecd8c9cb899ae277e6986ae134635cb1a50f5de ] + +The err_rst_reqb, ext_clki, lowpwr, and ref_clko pin groups are present, +but no pinmux functions refer to them, hence they can not be selected. + +Fixes: 1e7d5d849cf4f0c5 ("sh-pfc: Add emev2 pinmux support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-emev2.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-emev2.c b/drivers/pinctrl/sh-pfc/pfc-emev2.c +index 1cbbe04d7df65..eafd8edbcbe95 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-emev2.c ++++ b/drivers/pinctrl/sh-pfc/pfc-emev2.c +@@ -1263,6 +1263,14 @@ static const char * const dtv_groups[] = { + "dtv_b", + }; + ++static const char * const err_rst_reqb_groups[] = { ++ "err_rst_reqb", ++}; ++ ++static const char * const ext_clki_groups[] = { ++ "ext_clki", ++}; ++ + static const char * const iic0_groups[] = { + "iic0", + }; +@@ -1285,6 +1293,10 @@ static const char * const lcd_groups[] = { + "yuv3", + }; + ++static const char * const lowpwr_groups[] = { ++ "lowpwr", ++}; ++ + static const char * const ntsc_groups[] = { + "ntsc_clk", + "ntsc_data", +@@ -1298,6 +1310,10 @@ static const char * const pwm1_groups[] = { + "pwm1", + }; + ++static const char * const ref_clko_groups[] = { ++ "ref_clko", ++}; ++ + static const char * const sd_groups[] = { + "sd_cki", + }; +@@ -1391,13 +1407,17 @@ static const struct sh_pfc_function pinmux_functions[] = { + SH_PFC_FUNCTION(cam), + SH_PFC_FUNCTION(cf), + SH_PFC_FUNCTION(dtv), ++ SH_PFC_FUNCTION(err_rst_reqb), ++ SH_PFC_FUNCTION(ext_clki), + SH_PFC_FUNCTION(iic0), + SH_PFC_FUNCTION(iic1), + SH_PFC_FUNCTION(jtag), + SH_PFC_FUNCTION(lcd), ++ SH_PFC_FUNCTION(lowpwr), + SH_PFC_FUNCTION(ntsc), + SH_PFC_FUNCTION(pwm0), + SH_PFC_FUNCTION(pwm1), ++ SH_PFC_FUNCTION(ref_clko), + SH_PFC_FUNCTION(sd), + SH_PFC_FUNCTION(sdi0), + SH_PFC_FUNCTION(sdi1), +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch b/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch new file mode 100644 index 00000000000..8756bed8a9f --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch @@ -0,0 +1,36 @@ +From a4d2e0803a8c367ba0113e02b8c0766265386aeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 11:00:27 +0100 +Subject: pinctrl: sh-pfc: r8a7740: Add missing LCD0 marks to lcd0_data24_1 + group + +From: Geert Uytterhoeven + +[ Upstream commit 96bb2a6ab4eca10e5b6490b3f0738e9f7ec22c2b ] + +The lcd0_data24_1_pins[] array contains the LCD0 D1[2-5] pin numbers, +but the lcd0_data24_1_mux[] array lacks the corresponding pin marks. + +Fixes: 06c7dd866da70f6c ("sh-pfc: r8a7740: Add LCDC0 and LCDC1 pin groups and functions") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c +index d8077065636e3..e9739dbcb356e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c +@@ -2154,6 +2154,7 @@ static const unsigned int lcd0_data24_1_mux[] = { + LCD0_D0_MARK, LCD0_D1_MARK, LCD0_D2_MARK, LCD0_D3_MARK, + LCD0_D4_MARK, LCD0_D5_MARK, LCD0_D6_MARK, LCD0_D7_MARK, + LCD0_D8_MARK, LCD0_D9_MARK, LCD0_D10_MARK, LCD0_D11_MARK, ++ LCD0_D12_MARK, LCD0_D13_MARK, LCD0_D14_MARK, LCD0_D15_MARK, + LCD0_D16_MARK, LCD0_D17_MARK, LCD0_D18_PORT163_MARK, + LCD0_D19_PORT162_MARK, LCD0_D20_PORT161_MARK, LCD0_D21_PORT158_MARK, + LCD0_D22_PORT160_MARK, LCD0_D23_PORT159_MARK, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch b/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch new file mode 100644 index 00000000000..63be37b57f0 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch @@ -0,0 +1,37 @@ +From 9940a24a270c7a4aef103a0c03e117219b8797ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 10:57:27 +0100 +Subject: pinctrl: sh-pfc: r8a7740: Add missing REF125CK pin to gether_gmii + group + +From: Geert Uytterhoeven + +[ Upstream commit 1ebc589a7786f17f97b9e87b44e0fb4d0290d8f8 ] + +The gether_gmii_mux[] array contains the REF125CK pin mark, but the +gether_gmii_pins[] array lacks the corresponding pin number. + +Fixes: bae11d30d0cafdc5 ("sh-pfc: r8a7740: Add GETHER pin groups and functions") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7740.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c +index 35f436bcb8491..d8077065636e3 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7740.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7740.c +@@ -1982,7 +1982,7 @@ static const unsigned int gether_gmii_pins[] = { + */ + 185, 186, 187, 188, 189, 190, 191, 192, 174, 161, 204, + 171, 170, 169, 168, 167, 166, 173, 172, 176, 184, 183, 203, +- 205, 163, 206, 207, ++ 205, 163, 206, 207, 158, + }; + static const unsigned int gether_gmii_mux[] = { + ET_ERXD0_MARK, ET_ERXD1_MARK, ET_ERXD2_MARK, ET_ERXD3_MARK, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch b/queue-4.14/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch new file mode 100644 index 00000000000..d1508edf45e --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch @@ -0,0 +1,36 @@ +From 72a3dd693f622b896c1217007c58054ed418c46f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 17:07:43 +0100 +Subject: pinctrl: sh-pfc: r8a7791: Fix scifb2_data_c pin group + +From: Geert Uytterhoeven + +[ Upstream commit a4b0350047f1b10207e25e72d7cd3f7826e93769 ] + +The entry for "scifb2_data_c" in the SCIFB2 pin group array contains a +typo, thus the group cannot be selected. + +Fixes: 5088451962389924 ("pinctrl: sh-pfc: r8a7791 PFC support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +index d34982ea66bf1..e4774b2200405 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +@@ -5209,7 +5209,7 @@ static const char * const scifb2_groups[] = { + "scifb2_data_b", + "scifb2_clk_b", + "scifb2_ctrl_b", +- "scifb0_data_c", ++ "scifb2_data_c", + "scifb2_clk_c", + "scifb2_data_d", + }; +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch b/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch new file mode 100644 index 00000000000..8fd925a25d1 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch @@ -0,0 +1,40 @@ +From 5d2da31f373a95626c84369dfb482733eb91436b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 11:05:57 +0100 +Subject: pinctrl: sh-pfc: r8a7791: Remove bogus ctrl marks from qspi_data4_b + group + +From: Geert Uytterhoeven + +[ Upstream commit 884fa25fb6e5e63ab970d612a628313bb68f37cc ] + +The qspi_data4_b_mux[] array contains pin marks for the clock and chip +select pins. The qspi_data4_b_pins[] array rightfully does not contain +the corresponding pin numbers, as the control pins are provided by a +separate group (qspi_ctrl_b). + +Fixes: 2d0c386f135e4186 ("pinctrl: sh-pfc: r8a7791: Add QSPI pin groups") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +index c01ef02d326b7..8600ba82f59c3 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +@@ -3220,8 +3220,7 @@ static const unsigned int qspi_data4_b_pins[] = { + RCAR_GP_PIN(6, 4), + }; + static const unsigned int qspi_data4_b_mux[] = { +- SPCLK_B_MARK, MOSI_IO0_B_MARK, MISO_IO1_B_MARK, +- IO2_B_MARK, IO3_B_MARK, SSL_B_MARK, ++ MOSI_IO0_B_MARK, MISO_IO1_B_MARK, IO2_B_MARK, IO3_B_MARK, + }; + /* - SCIF0 ------------------------------------------------------------------ */ + static const unsigned int scif0_data_pins[] = { +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch b/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch new file mode 100644 index 00000000000..c0c140333be --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch @@ -0,0 +1,47 @@ +From 704d16730f3ebe2d2a798040c3e28ac49c09c17c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 11:12:20 +0100 +Subject: pinctrl: sh-pfc: r8a7791: Remove bogus marks from vin1_b_data18 group + +From: Geert Uytterhoeven + +[ Upstream commit 0d6256cb880166a4111bebce35790019e56b6e1b ] + +The vin1_b_data18_mux[] arrays contains pin marks for the 2 LSB bits of +the color components. The vin1_b_data18_pins[] array rightfully does +not include the corresponding pin numbers, as RGB18 is subset of RGB24, +containing only the 6 MSB bits of each component. + +Fixes: 8e32c9671f84acd8 ("pinctrl: sh-pfc: r8a7791: Add VIN pins") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7791.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +index 8600ba82f59c3..d34982ea66bf1 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +@@ -4348,17 +4348,14 @@ static const unsigned int vin1_b_data18_pins[] = { + }; + static const unsigned int vin1_b_data18_mux[] = { + /* B */ +- VI1_DATA0_B_MARK, VI1_DATA1_B_MARK, + VI1_DATA2_B_MARK, VI1_DATA3_B_MARK, + VI1_DATA4_B_MARK, VI1_DATA5_B_MARK, + VI1_DATA6_B_MARK, VI1_DATA7_B_MARK, + /* G */ +- VI1_G0_B_MARK, VI1_G1_B_MARK, + VI1_G2_B_MARK, VI1_G3_B_MARK, + VI1_G4_B_MARK, VI1_G5_B_MARK, + VI1_G6_B_MARK, VI1_G7_B_MARK, + /* R */ +- VI1_R0_B_MARK, VI1_R1_B_MARK, + VI1_R2_B_MARK, VI1_R3_B_MARK, + VI1_R4_B_MARK, VI1_R5_B_MARK, + VI1_R6_B_MARK, VI1_R7_B_MARK, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch b/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch new file mode 100644 index 00000000000..c6fc0d941e2 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch @@ -0,0 +1,35 @@ +From 797e5951af0e79a312943c561f98347e25558600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 17:14:07 +0100 +Subject: pinctrl: sh-pfc: r8a7792: Fix vin1_data18_b pin group + +From: Geert Uytterhoeven + +[ Upstream commit b9fd50488b4939ce5b3a026d29e752e17c2d1800 ] + +The vin1_data18_b pin group itself is present, but it is not listed in +the VIN1 pin group array, and thus cannot be selected. + +Fixes: 7dd74bb1f058786e ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +index cc3597f66605a..46c41ca6ea38b 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +@@ -1916,6 +1916,7 @@ static const char * const vin1_groups[] = { + "vin1_data8", + "vin1_data24_b", + "vin1_data20_b", ++ "vin1_data18_b", + "vin1_data16_b", + "vin1_sync", + "vin1_field", +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch b/queue-4.14/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch new file mode 100644 index 00000000000..78444919fd3 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch @@ -0,0 +1,36 @@ +From a650aa27b53c68dda2cc036a484b8e505dbb07dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 14:21:16 +0100 +Subject: pinctrl: sh-pfc: r8a7794: Remove bogus IPSR9 field + +From: Geert Uytterhoeven + +[ Upstream commit 6a6c195d98a1a5e70faa87f594d7564af1dd1bed ] + +The Peripheral Function Select Register 9 contains 12 fields, but the +variable field descriptor contains a 13th bogus field of 3 bits. + +Fixes: 43c4436e2f1890a7 ("pinctrl: sh-pfc: add R8A7794 PFC support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7794.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c +index a0ed220071f5f..93bdd3e8fb670 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c +@@ -4742,7 +4742,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + FN_AVB_MDC, FN_SSI_SDATA6_B, 0, 0, } + }, + { PINMUX_CFG_REG_VAR("IPSR9", 0xE6060044, 32, +- 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3, 3) { ++ 1, 3, 3, 3, 3, 2, 2, 3, 3, 3, 3, 3) { + /* IP9_31 [1] */ + 0, 0, + /* IP9_30_28 [3] */ +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch b/queue-4.14/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch new file mode 100644 index 00000000000..22341aa8b52 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch @@ -0,0 +1,45 @@ +From 80a34dafb71836cd7552d5c251e7aabf41a83264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 13:59:42 +0100 +Subject: pinctrl: sh-pfc: r8a77995: Remove bogus SEL_PWM[0-3]_3 configurations + +From: Geert Uytterhoeven + +[ Upstream commit e28dc3f09c9d2555a9bd982f0847988591052226 ] + +While the SEL_PWM[0-3] fields in the Module Select Register 0 support 4 +possible configurations per PWM pin, only the first 3 are valid. + +Replace the invalid and unused configurations for SEL_PWM[0-3]_3 by +dummies. + +Fixes: 794a6711764658a1 ("pinctrl: sh-pfc: Initial R8A77995 PFC support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a77995.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c +index 4f5ee1d7317d3..36421df1b3260 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a77995.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a77995.c +@@ -391,10 +391,10 @@ FM(IP12_31_28) IP12_31_28 \ + #define MOD_SEL0_27 FM(SEL_MSIOF3_0) FM(SEL_MSIOF3_1) + #define MOD_SEL0_26 FM(SEL_HSCIF3_0) FM(SEL_HSCIF3_1) + #define MOD_SEL0_25 FM(SEL_SCIF4_0) FM(SEL_SCIF4_1) +-#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) FM(SEL_PWM0_3) +-#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) FM(SEL_PWM1_3) +-#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) FM(SEL_PWM2_3) +-#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) FM(SEL_PWM3_3) ++#define MOD_SEL0_24_23 FM(SEL_PWM0_0) FM(SEL_PWM0_1) FM(SEL_PWM0_2) F_(0, 0) ++#define MOD_SEL0_22_21 FM(SEL_PWM1_0) FM(SEL_PWM1_1) FM(SEL_PWM1_2) F_(0, 0) ++#define MOD_SEL0_20_19 FM(SEL_PWM2_0) FM(SEL_PWM2_1) FM(SEL_PWM2_2) F_(0, 0) ++#define MOD_SEL0_18_17 FM(SEL_PWM3_0) FM(SEL_PWM3_1) FM(SEL_PWM3_2) F_(0, 0) + #define MOD_SEL0_15 FM(SEL_IRQ_0_0) FM(SEL_IRQ_0_1) + #define MOD_SEL0_14 FM(SEL_IRQ_1_0) FM(SEL_IRQ_1_1) + #define MOD_SEL0_13 FM(SEL_IRQ_2_0) FM(SEL_IRQ_2_1) +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch b/queue-4.14/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch new file mode 100644 index 00000000000..5b0bc8024ee --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch @@ -0,0 +1,39 @@ +From 656d61b714de6b0c04ea08456155aa9830d4c913 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 14:27:56 +0100 +Subject: pinctrl: sh-pfc: sh7269: Add missing PCIOR0 field + +From: Geert Uytterhoeven + +[ Upstream commit 9540cbdfcd861caf67a6f0e4bb7f46d41c4aad86 ] + +The Port C I/O Register 0 contains 7 reserved bits, but the descriptor +contains only dummy configuration values for 6 reserved bits, thus +breaking the configuration of all subsequent fields in the register. + +Fix this by adding the two missing configuration values. + +Fixes: f5e811f2a43117b2 ("sh-pfc: Add sh7269 pinmux support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh7269.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7269.c b/drivers/pinctrl/sh-pfc/pfc-sh7269.c +index a50d22bef1f44..cfdb4fc177c3e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7269.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7269.c +@@ -2119,7 +2119,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + }, + + { PINMUX_CFG_REG("PCIOR0", 0xfffe3852, 16, 1) { +- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, ++ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, + PC8_IN, PC8_OUT, + PC7_IN, PC7_OUT, + PC6_IN, PC6_OUT, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch b/queue-4.14/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch new file mode 100644 index 00000000000..cf2777d4ff3 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch @@ -0,0 +1,37 @@ +From bc3a83803c0ea2ea620d58a4dcb8b3d929c5530e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 11:20:14 +0100 +Subject: pinctrl: sh-pfc: sh73a0: Add missing TO pin to tpu4_to3 group + +From: Geert Uytterhoeven + +[ Upstream commit 124cde98f856b6206b804acbdec3b7c80f8c3427 ] + +The tpu4_to3_mux[] array contains the TPU4TO3 pin mark, but the +tpu4_to3_pins[] array lacks the corresponding pin number. + +Add the missing pin number, for non-GPIO pin F26. + +Fixes: 5da4eb049de803c7 ("sh-pfc: sh73a0: Add TPU pin groups and functions") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c +index d25e6f674d0ab..f8fbedb46585d 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c +@@ -3086,6 +3086,7 @@ static const unsigned int tpu4_to2_mux[] = { + }; + static const unsigned int tpu4_to3_pins[] = { + /* TO */ ++ PIN_NUMBER(6, 26), + }; + static const unsigned int tpu4_to3_mux[] = { + TPU4TO3_MARK, +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch b/queue-4.14/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch new file mode 100644 index 00000000000..60032506fd5 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch @@ -0,0 +1,37 @@ +From 7de338420e0cfab20a323613f07b13e9ad36b129 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 16:51:21 +0100 +Subject: pinctrl: sh-pfc: sh73a0: Fix fsic_spdif pin groups + +From: Geert Uytterhoeven + +[ Upstream commit 0e6e448bdcf896d001a289a6112a704542d51516 ] + +There are two pin groups for the FSIC SPDIF signal, but the FSIC pin +group array lists only one, and it refers to a nonexistent group. + +Fixes: 2ecd4154c906b7d6 ("sh-pfc: sh73a0: Add FSI pin groups and functions") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh73a0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c +index f8fbedb46585d..6dca760f9f280 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh73a0.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh73a0.c +@@ -3367,7 +3367,8 @@ static const char * const fsic_groups[] = { + "fsic_sclk_out", + "fsic_data_in", + "fsic_data_out", +- "fsic_spdif", ++ "fsic_spdif_0", ++ "fsic_spdif_1", + }; + + static const char * const fsid_groups[] = { +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch b/queue-4.14/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch new file mode 100644 index 00000000000..0cde15091f3 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch @@ -0,0 +1,37 @@ +From 80e5ae129916e13bcf28b8487f8b293f1fd8d7c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Dec 2018 14:42:16 +0100 +Subject: pinctrl: sh-pfc: sh7734: Add missing IPSR11 field + +From: Geert Uytterhoeven + +[ Upstream commit 94482af7055e1ffa211c1135256b85590ebcac99 ] + +The Peripheral Function Select Register 11 contains 3 reserved bits and +15 variable-width fields, but the variable field descriptor does not +contain the 3-bit field IP11[25:23]. + +Fixes: 856cb4bb337ee504 ("sh: Add support pinmux for SH7734") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 3eccc9b3ca84a..05ccb27f77818 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -2237,7 +2237,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + FN_LCD_DATA15_B, 0, 0, 0 } + }, + { PINMUX_CFG_REG_VAR("IPSR11", 0xFFFC0048, 32, +- 3, 1, 2, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) { ++ 3, 1, 2, 3, 2, 2, 3, 3, 1, 2, 3, 3, 1, 1, 1, 1) { + /* IP11_31_29 [3] */ + 0, 0, 0, 0, 0, 0, 0, 0, + /* IP11_28 [1] */ +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch b/queue-4.14/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch new file mode 100644 index 00000000000..f6b664219a8 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch @@ -0,0 +1,42 @@ +From a787339332f6ffc061184879deb0d8125a88c2cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Dec 2018 14:32:34 +0100 +Subject: pinctrl: sh-pfc: sh7734: Remove bogus IPSR10 value + +From: Geert Uytterhoeven + +[ Upstream commit 4d374bacd7c9665179f9752a52d5d602c45d8190 ] + +The IP10[5:3] field in Peripheral Function Select Register 10 has a +width of 3 bits, i.e. it allows programming one out of 8 different +configurations. +However, 9 values are provided instead of 8, overflowing into the +subsequent field in the register, and thus breaking the configuration of +the latter. + +Fix this by dropping a bogus zero value. + +Fixes: ac1ebc2190f575fc ("sh-pfc: Add sh7734 pinmux support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-sh7734.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-sh7734.c b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +index 05ccb27f77818..c691e5e9d9dea 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-sh7734.c ++++ b/drivers/pinctrl/sh-pfc/pfc-sh7734.c +@@ -2231,7 +2231,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = { + FN_LCD_CL1_B, 0, 0, + /* IP10_5_3 [3] */ + FN_SSI_WS23, FN_VI1_5_B, FN_TX1_D, FN_HSCK0_C, FN_FALE_B, +- FN_LCD_DON_B, 0, 0, 0, ++ FN_LCD_DON_B, 0, 0, + /* IP10_2_0 [3] */ + FN_SSI_SCK23, FN_VI1_4_B, FN_RX1_D, FN_FCLE_B, + FN_LCD_DATA15_B, 0, 0, 0 } +-- +2.20.1 + diff --git a/queue-4.14/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch b/queue-4.14/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch new file mode 100644 index 00000000000..2457402f3f9 --- /dev/null +++ b/queue-4.14/platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch @@ -0,0 +1,65 @@ +From 7915361a29c3c0a55abc206947e57590a44cf7ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2019 00:17:12 +0000 +Subject: platform/x86: alienware-wmi: fix kfree on potentially uninitialized + pointer + +From: Colin Ian King + +[ Upstream commit 98e2630284ab741804bd0713e932e725466f2f84 ] + +Currently the kfree of output.pointer can be potentially freeing +an uninitalized pointer in the case where out_data is NULL. Fix this +by reworking the case where out_data is not-null to perform the +ACPI status check and also the kfree of outpoint.pointer in one block +and hence ensuring the pointer is only freed when it has been used. + +Also replace the if (ptr != NULL) idiom with just if (ptr). + +Fixes: ff0e9f26288d ("platform/x86: alienware-wmi: Correct a memory leak") +Signed-off-by: Colin Ian King +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/alienware-wmi.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c +index e335b18da20fc..cbd84e2e3bd47 100644 +--- a/drivers/platform/x86/alienware-wmi.c ++++ b/drivers/platform/x86/alienware-wmi.c +@@ -505,23 +505,22 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, + + input.length = (acpi_size) sizeof(*in_args); + input.pointer = in_args; +- if (out_data != NULL) { ++ if (out_data) { + output.length = ACPI_ALLOCATE_BUFFER; + output.pointer = NULL; + status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, + command, &input, &output); +- } else ++ if (ACPI_SUCCESS(status)) { ++ obj = (union acpi_object *)output.pointer; ++ if (obj && obj->type == ACPI_TYPE_INTEGER) ++ *out_data = (u32)obj->integer.value; ++ } ++ kfree(output.pointer); ++ } else { + status = wmi_evaluate_method(WMAX_CONTROL_GUID, 0, + command, &input, NULL); +- +- if (ACPI_SUCCESS(status) && out_data != NULL) { +- obj = (union acpi_object *)output.pointer; +- if (obj && obj->type == ACPI_TYPE_INTEGER) +- *out_data = (u32) obj->integer.value; + } +- kfree(output.pointer); + return status; +- + } + + /* +-- +2.20.1 + diff --git a/queue-4.14/platform-x86-alienware-wmi-printing-the-wrong-error-.patch b/queue-4.14/platform-x86-alienware-wmi-printing-the-wrong-error-.patch new file mode 100644 index 00000000000..65538ed4df7 --- /dev/null +++ b/queue-4.14/platform-x86-alienware-wmi-printing-the-wrong-error-.patch @@ -0,0 +1,38 @@ +From aee8efdf72d88cb35680ab20b2be5cfc2a5b01ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Apr 2019 12:44:18 +0300 +Subject: platform/x86: alienware-wmi: printing the wrong error code + +From: Dan Carpenter + +[ Upstream commit 6d1f8b3d75419a8659ac916a1e9543bb3513a882 ] + +The "out_data" variable is uninitialized at the point. Originally, this +used to print "status" instead and that seems like the correct thing to +print. + +Fixes: bc2ef884320b ("alienware-wmi: For WMAX HDMI method, introduce a way to query HDMI cable status") +Signed-off-by: Dan Carpenter +Reviewed-by: Mario Limonciello +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/alienware-wmi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c +index cbd84e2e3bd47..2c82188f8486c 100644 +--- a/drivers/platform/x86/alienware-wmi.c ++++ b/drivers/platform/x86/alienware-wmi.c +@@ -570,7 +570,7 @@ static ssize_t show_hdmi_source(struct device *dev, + return scnprintf(buf, PAGE_SIZE, + "input [gpu] unknown\n"); + } +- pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data); ++ pr_err("alienware-wmi: unknown HDMI source status: %u\n", status); + return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n"); + } + +-- +2.20.1 + diff --git a/queue-4.14/platform-x86-wmi-fix-potential-null-pointer-derefere.patch b/queue-4.14/platform-x86-wmi-fix-potential-null-pointer-derefere.patch new file mode 100644 index 00000000000..c28cab3a050 --- /dev/null +++ b/queue-4.14/platform-x86-wmi-fix-potential-null-pointer-derefere.patch @@ -0,0 +1,42 @@ +From 376ed8e9836b8ee6a3efaf6fca12705500702e73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jan 2019 16:14:24 +0100 +Subject: platform/x86: wmi: fix potential null pointer dereference + +From: Mattias Jacobsson <2pi@mok.nu> + +[ Upstream commit c355ec651a8941864549f2586f969d0eb7bf499a ] + +In the function wmi_dev_match() the variable id is dereferenced without +first performing a NULL check. The variable can for example be NULL if +a WMI driver is registered without specifying the id_table field in +struct wmi_driver. + +Add a NULL check and return that the driver can't handle the device if +the variable is NULL. + +Fixes: 844af950da94 ("platform/x86: wmi: Turn WMI into a bus driver") +Signed-off-by: Mattias Jacobsson <2pi@mok.nu> +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/wmi.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c +index 7f8fa42a10840..a56e997816b23 100644 +--- a/drivers/platform/x86/wmi.c ++++ b/drivers/platform/x86/wmi.c +@@ -748,6 +748,9 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) + struct wmi_block *wblock = dev_to_wblock(dev); + const struct wmi_device_id *id = wmi_driver->id_table; + ++ if (id == NULL) ++ return 0; ++ + while (id->guid_string) { + uuid_le driver_guid; + +-- +2.20.1 + diff --git a/queue-4.14/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch b/queue-4.14/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch new file mode 100644 index 00000000000..b5234ba615c --- /dev/null +++ b/queue-4.14/pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch @@ -0,0 +1,38 @@ +From 70844dd7a26268c0bea18dbfa598f36e072ba4d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2019 13:03:48 +0200 +Subject: PM: sleep: Fix possible overflow in pm_system_cancel_wakeup() + +From: Rafael J. Wysocki + +[ Upstream commit 2933954b71f10d392764f95eec0f0aa2d103054b ] + +It is not actually guaranteed that pm_abort_suspend will be +nonzero when pm_system_cancel_wakeup() is called which may lead to +subtle issues, so make it use atomic_dec_if_positive() instead of +atomic_dec() for the safety sake. + +Fixes: 33e4f80ee69b ("ACPI / PM: Ignore spurious SCI wakeups from suspend-to-idle") +Signed-off-by: Rafael J. Wysocki +Acked-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + drivers/base/power/wakeup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c +index df53e2b3296b4..877b2a1767a5a 100644 +--- a/drivers/base/power/wakeup.c ++++ b/drivers/base/power/wakeup.c +@@ -877,7 +877,7 @@ EXPORT_SYMBOL_GPL(pm_system_wakeup); + + void pm_system_cancel_wakeup(void) + { +- atomic_dec(&pm_abort_suspend); ++ atomic_dec_if_positive(&pm_abort_suspend); + } + + void pm_wakeup_clear(bool reset) +-- +2.20.1 + diff --git a/queue-4.14/power-supply-init-device-wakeup-after-device_add.patch b/queue-4.14/power-supply-init-device-wakeup-after-device_add.patch new file mode 100644 index 00000000000..1de5dd1247d --- /dev/null +++ b/queue-4.14/power-supply-init-device-wakeup-after-device_add.patch @@ -0,0 +1,69 @@ +From 108fd339e9e7ec388b1ecbcb5773f1f10b08ca24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Aug 2019 14:33:30 -0700 +Subject: power: supply: Init device wakeup after device_add() + +From: Stephen Boyd + +[ Upstream commit 8288022284859acbcc3cf1a073a1e2692d6c2543 ] + +We may want to use the device pointer in device_init_wakeup() with +functions that expect the device to already be added with device_add(). +For example, if we were to link the device initializing wakeup to +something in sysfs such as a class for wakeups we'll run into an error. +It looks like this code was written with the assumption that the device +would be added before initializing wakeup due to the order of operations +in power_supply_unregister(). + +Let's change the order of operations so we don't run into problems here. + +Fixes: 948dcf966228 ("power_supply: Prevent suspend until power supply events are processed") +Cc: Greg Kroah-Hartman +Cc: Tri Vo +Cc: Kalesh Singh +Cc: Ravi Chandra Sadineni +Cc: Viresh Kumar +Signed-off-by: Stephen Boyd +Acked-by: Rafael J. Wysocki +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/power_supply_core.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index 3226faebe0a08..0f1a0efd5926c 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -891,14 +891,14 @@ __power_supply_register(struct device *parent, + } + + spin_lock_init(&psy->changed_lock); +- rc = device_init_wakeup(dev, ws); +- if (rc) +- goto wakeup_init_failed; +- + rc = device_add(dev); + if (rc) + goto device_add_failed; + ++ rc = device_init_wakeup(dev, ws); ++ if (rc) ++ goto wakeup_init_failed; ++ + rc = psy_register_thermal(psy); + if (rc) + goto register_thermal_failed; +@@ -935,8 +935,8 @@ register_cooler_failed: + psy_unregister_thermal(psy); + register_thermal_failed: + device_del(dev); +-device_add_failed: + wakeup_init_failed: ++device_add_failed: + check_supplies_failed: + dev_set_name_failed: + put_device(dev); +-- +2.20.1 + diff --git a/queue-4.14/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch b/queue-4.14/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch new file mode 100644 index 00000000000..1dea03613b6 --- /dev/null +++ b/queue-4.14/powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch @@ -0,0 +1,83 @@ +From 367966b12fbd73efdba2fddcefb8f63ce507d86a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Feb 2019 11:20:01 +1100 +Subject: powerpc/64s: Fix logic when handling unknown CPU features +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit 8cfaf106918a8c13abb24c641556172afbb9545c ] + +In cpufeatures_process_feature(), if a provided CPU feature is unknown and +enable_unknown is false, we erroneously print that the feature is being +enabled and return true, even though no feature has been enabled, and +may also set feature bits based on the last entry in the match table. + +Fix this so that we only set feature bits from the match table if we have +actually enabled a feature from that table, and when failing to enable an +unknown feature, always print the "not enabling" message and return false. + +Coincidentally, some older gccs (cpu_ftr_bit_mask) + +An upcoming patch will enable support for kcov, which requires this option. +This patch avoids the warning. + +Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features") +Reported-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +[ajd: add commit message] +Signed-off-by: Andrew Donnellan +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/dt_cpu_ftrs.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index 2357df60de952..7ed2b1b6643cc 100644 +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -705,8 +705,10 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f) + m = &dt_cpu_feature_match_table[i]; + if (!strcmp(f->name, m->name)) { + known = true; +- if (m->enable(f)) ++ if (m->enable(f)) { ++ cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask; + break; ++ } + + pr_info("not enabling: %s (disabled or unsupported by kernel)\n", + f->name); +@@ -714,17 +716,12 @@ static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f) + } + } + +- if (!known && enable_unknown) { +- if (!feat_try_enable_unknown(f)) { +- pr_info("not enabling: %s (unknown and unsupported by kernel)\n", +- f->name); +- return false; +- } ++ if (!known && (!enable_unknown || !feat_try_enable_unknown(f))) { ++ pr_info("not enabling: %s (unknown and unsupported by kernel)\n", ++ f->name); ++ return false; + } + +- if (m->cpu_ftr_bit_mask) +- cur_cpu_spec->cpu_features |= m->cpu_ftr_bit_mask; +- + if (known) + pr_debug("enabling: %s\n", f->name); + else +-- +2.20.1 + diff --git a/queue-4.14/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch b/queue-4.14/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch new file mode 100644 index 00000000000..f08864e0052 --- /dev/null +++ b/queue-4.14/powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch @@ -0,0 +1,71 @@ +From b7c9163ccb40733fc9512a1a5bf6d564041c7999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2019 23:45:04 -0500 +Subject: powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild + +From: Nathan Lynch + +[ Upstream commit d4aa219a074a5abaf95a756b9f0d190b5c03a945 ] + +Allow external callers to force the cacheinfo code to release all its +references to cache nodes, e.g. before processing device tree updates +post-migration, and to rebuild the hierarchy afterward. + +CPU online/offline must be blocked by callers; enforce this. + +Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Gautham R. Shenoy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/cacheinfo.c | 21 +++++++++++++++++++++ + arch/powerpc/kernel/cacheinfo.h | 4 ++++ + 2 files changed, 25 insertions(+) + +diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c +index a8f20e5928e13..9edb454301336 100644 +--- a/arch/powerpc/kernel/cacheinfo.c ++++ b/arch/powerpc/kernel/cacheinfo.c +@@ -865,4 +865,25 @@ void cacheinfo_cpu_offline(unsigned int cpu_id) + if (cache) + cache_cpu_clear(cache, cpu_id); + } ++ ++void cacheinfo_teardown(void) ++{ ++ unsigned int cpu; ++ ++ lockdep_assert_cpus_held(); ++ ++ for_each_online_cpu(cpu) ++ cacheinfo_cpu_offline(cpu); ++} ++ ++void cacheinfo_rebuild(void) ++{ ++ unsigned int cpu; ++ ++ lockdep_assert_cpus_held(); ++ ++ for_each_online_cpu(cpu) ++ cacheinfo_cpu_online(cpu); ++} ++ + #endif /* (CONFIG_PPC_PSERIES && CONFIG_SUSPEND) || CONFIG_HOTPLUG_CPU */ +diff --git a/arch/powerpc/kernel/cacheinfo.h b/arch/powerpc/kernel/cacheinfo.h +index 955f5e999f1b8..52bd3fc6642da 100644 +--- a/arch/powerpc/kernel/cacheinfo.h ++++ b/arch/powerpc/kernel/cacheinfo.h +@@ -6,4 +6,8 @@ + extern void cacheinfo_cpu_online(unsigned int cpu_id); + extern void cacheinfo_cpu_offline(unsigned int cpu_id); + ++/* Allow migration/suspend to tear down and rebuild the hierarchy. */ ++extern void cacheinfo_teardown(void); ++extern void cacheinfo_rebuild(void); ++ + #endif /* _PPC_CACHEINFO_H */ +-- +2.20.1 + diff --git a/queue-4.14/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch b/queue-4.14/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch new file mode 100644 index 00000000000..dcc9ef5213e --- /dev/null +++ b/queue-4.14/powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch @@ -0,0 +1,136 @@ +From 38f07a07c25be6fe84adf5b6557aa42c3fbe56e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Sep 2018 09:26:03 +0000 +Subject: powerpc/kgdb: add kgdb_arch_set/remove_breakpoint() + +From: Christophe Leroy + +[ Upstream commit fb978ca207743badfe7efd9eebe68bcbb4969f79 ] + +Generic implementation fails to remove breakpoints after init +when CONFIG_STRICT_KERNEL_RWX is selected: + +[ 13.251285] KGDB: BP remove failed: c001c338 +[ 13.259587] kgdbts: ERROR PUT: end of test buffer on 'do_fork_test' line 8 expected OK got $E14#aa +[ 13.268969] KGDB: re-enter exception: ALL breakpoints killed +[ 13.275099] CPU: 0 PID: 1 Comm: init Not tainted 4.18.0-g82bbb913ffd8 #860 +[ 13.282836] Call Trace: +[ 13.285313] [c60e1ba0] [c0080ef0] kgdb_handle_exception+0x6f4/0x720 (unreliable) +[ 13.292618] [c60e1c30] [c000e97c] kgdb_handle_breakpoint+0x3c/0x98 +[ 13.298709] [c60e1c40] [c000af54] program_check_exception+0x104/0x700 +[ 13.305083] [c60e1c60] [c000e45c] ret_from_except_full+0x0/0x4 +[ 13.310845] [c60e1d20] [c02a22ac] run_simple_test+0x2b4/0x2d4 +[ 13.316532] [c60e1d30] [c0081698] put_packet+0xb8/0x158 +[ 13.321694] [c60e1d60] [c00820b4] gdb_serial_stub+0x230/0xc4c +[ 13.327374] [c60e1dc0] [c0080af8] kgdb_handle_exception+0x2fc/0x720 +[ 13.333573] [c60e1e50] [c000e928] kgdb_singlestep+0xb4/0xcc +[ 13.339068] [c60e1e70] [c000ae1c] single_step_exception+0x90/0xac +[ 13.345100] [c60e1e80] [c000e45c] ret_from_except_full+0x0/0x4 +[ 13.350865] [c60e1f40] [c000e11c] ret_from_syscall+0x0/0x38 +[ 13.356346] Kernel panic - not syncing: Recursive entry to debugger + +This patch creates powerpc specific version of +kgdb_arch_set_breakpoint() and kgdb_arch_remove_breakpoint() +using patch_instruction() + +Fixes: 1e0fc9d1eb2b ("powerpc/Kconfig: Enable STRICT_KERNEL_RWX for some configs") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/kgdb.h | 5 +++- + arch/powerpc/kernel/kgdb.c | 43 +++++++++++++++++++++++++++------ + 2 files changed, 39 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/include/asm/kgdb.h b/arch/powerpc/include/asm/kgdb.h +index 9db24e77b9f4b..a9e098a3b881f 100644 +--- a/arch/powerpc/include/asm/kgdb.h ++++ b/arch/powerpc/include/asm/kgdb.h +@@ -26,9 +26,12 @@ + #define BREAK_INSTR_SIZE 4 + #define BUFMAX ((NUMREGBYTES * 2) + 512) + #define OUTBUFMAX ((NUMREGBYTES * 2) + 512) ++ ++#define BREAK_INSTR 0x7d821008 /* twge r2, r2 */ ++ + static inline void arch_kgdb_breakpoint(void) + { +- asm(".long 0x7d821008"); /* twge r2, r2 */ ++ asm(stringify_in_c(.long BREAK_INSTR)); + } + #define CACHE_FLUSH_IS_SAFE 1 + #define DBG_MAX_REG_NUM 70 +diff --git a/arch/powerpc/kernel/kgdb.c b/arch/powerpc/kernel/kgdb.c +index 35e240a0a4087..59c578f865aa6 100644 +--- a/arch/powerpc/kernel/kgdb.c ++++ b/arch/powerpc/kernel/kgdb.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -144,7 +145,7 @@ static int kgdb_handle_breakpoint(struct pt_regs *regs) + if (kgdb_handle_exception(1, SIGTRAP, 0, regs) != 0) + return 0; + +- if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr)) ++ if (*(u32 *)regs->nip == BREAK_INSTR) + regs->nip += BREAK_INSTR_SIZE; + + return 1; +@@ -441,16 +442,42 @@ int kgdb_arch_handle_exception(int vector, int signo, int err_code, + return -1; + } + ++int kgdb_arch_set_breakpoint(struct kgdb_bkpt *bpt) ++{ ++ int err; ++ unsigned int instr; ++ unsigned int *addr = (unsigned int *)bpt->bpt_addr; ++ ++ err = probe_kernel_address(addr, instr); ++ if (err) ++ return err; ++ ++ err = patch_instruction(addr, BREAK_INSTR); ++ if (err) ++ return -EFAULT; ++ ++ *(unsigned int *)bpt->saved_instr = instr; ++ ++ return 0; ++} ++ ++int kgdb_arch_remove_breakpoint(struct kgdb_bkpt *bpt) ++{ ++ int err; ++ unsigned int instr = *(unsigned int *)bpt->saved_instr; ++ unsigned int *addr = (unsigned int *)bpt->bpt_addr; ++ ++ err = patch_instruction(addr, instr); ++ if (err) ++ return -EFAULT; ++ ++ return 0; ++} ++ + /* + * Global data + */ +-struct kgdb_arch arch_kgdb_ops = { +-#ifdef __LITTLE_ENDIAN__ +- .gdb_bpt_instr = {0x08, 0x10, 0x82, 0x7d}, +-#else +- .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08}, +-#endif +-}; ++struct kgdb_arch arch_kgdb_ops; + + static int kgdb_not_implemented(struct pt_regs *regs) + { +-- +2.20.1 + diff --git a/queue-4.14/powerpc-mm-check-secondary-hash-page-table.patch b/queue-4.14/powerpc-mm-check-secondary-hash-page-table.patch new file mode 100644 index 00000000000..ee6395b0d99 --- /dev/null +++ b/queue-4.14/powerpc-mm-check-secondary-hash-page-table.patch @@ -0,0 +1,38 @@ +From 85ec0dcf6b294175f15e9efb2d034743040a377e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Feb 2019 10:29:49 +1100 +Subject: powerpc/mm: Check secondary hash page table + +From: Rashmica Gupta + +[ Upstream commit 790845e2f12709d273d08ea7a2af7c2593689519 ] + +We were always calling base_hpte_find() with primary = true, +even when we wanted to check the secondary table. + +mpe: I broke this when refactoring Rashmica's original patch. + +Fixes: 1515ab932156 ("powerpc/mm: Dump hash table") +Signed-off-by: Rashmica Gupta +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/dump_hashpagetable.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/dump_hashpagetable.c b/arch/powerpc/mm/dump_hashpagetable.c +index 5c4c93dcff190..f666d74f05f51 100644 +--- a/arch/powerpc/mm/dump_hashpagetable.c ++++ b/arch/powerpc/mm/dump_hashpagetable.c +@@ -343,7 +343,7 @@ static unsigned long hpte_find(struct pg_state *st, unsigned long ea, int psize) + + /* Look in secondary table */ + if (slot == -1) +- slot = base_hpte_find(ea, psize, true, &v, &r); ++ slot = base_hpte_find(ea, psize, false, &v, &r); + + /* No entry found */ + if (slot == -1) +-- +2.20.1 + diff --git a/queue-4.14/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch b/queue-4.14/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch new file mode 100644 index 00000000000..372430b917a --- /dev/null +++ b/queue-4.14/powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch @@ -0,0 +1,81 @@ +From cb9ec7810231a86f2691c4f43242c8b66778c037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Jun 2019 23:45:06 -0500 +Subject: powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration + +From: Nathan Lynch + +[ Upstream commit e610a466d16a086e321f0bd421e2fc75cff28605 ] + +It's common for the platform to replace the cache device nodes after a +migration. Since the cacheinfo code is never informed about this, it +never drops its references to the source system's cache nodes, causing +it to wind up in an inconsistent state resulting in warnings and oopses +as soon as CPU online/offline occurs after the migration, e.g. + + cache for /cpus/l3-cache@3113(Unified) refers to cache for /cpus/l2-cache@200d(Unified) + WARNING: CPU: 15 PID: 86 at arch/powerpc/kernel/cacheinfo.c:176 release_cache+0x1bc/0x1d0 + [...] + NIP release_cache+0x1bc/0x1d0 + LR release_cache+0x1b8/0x1d0 + Call Trace: + release_cache+0x1b8/0x1d0 (unreliable) + cacheinfo_cpu_offline+0x1c4/0x2c0 + unregister_cpu_online+0x1b8/0x260 + cpuhp_invoke_callback+0x114/0xf40 + cpuhp_thread_fun+0x270/0x310 + smpboot_thread_fn+0x2c8/0x390 + kthread+0x1b8/0x1c0 + ret_from_kernel_thread+0x5c/0x68 + +Using device tree notifiers won't work since we want to rebuild the +hierarchy only after all the removals and additions have occurred and +the device tree is in a consistent state. Call cacheinfo_teardown() +before processing device tree updates, and rebuild the hierarchy +afterward. + +Fixes: 410bccf97881 ("powerpc/pseries: Partition migration in the kernel") +Signed-off-by: Nathan Lynch +Reviewed-by: Gautham R. Shenoy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/mobility.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c +index 9739a055e5f7b..2d3668acb6ef5 100644 +--- a/arch/powerpc/platforms/pseries/mobility.c ++++ b/arch/powerpc/platforms/pseries/mobility.c +@@ -23,6 +23,7 @@ + #include + #include + #include "pseries.h" ++#include "../../kernel/cacheinfo.h" + + static struct kobject *mobility_kobj; + +@@ -359,11 +360,20 @@ void post_mobility_fixup(void) + */ + cpus_read_lock(); + ++ /* ++ * It's common for the destination firmware to replace cache ++ * nodes. Release all of the cacheinfo hierarchy's references ++ * before updating the device tree. ++ */ ++ cacheinfo_teardown(); ++ + rc = pseries_devicetree_update(MIGRATION_SCOPE); + if (rc) + printk(KERN_ERR "Post-mobility device tree update " + "failed: %d\n", rc); + ++ cacheinfo_rebuild(); ++ + cpus_read_unlock(); + + /* Possibly switch to a new RFI flush type */ +-- +2.20.1 + diff --git a/queue-4.14/powerpc-vdso-make-vdso32-installation-conditional-in.patch b/queue-4.14/powerpc-vdso-make-vdso32-installation-conditional-in.patch new file mode 100644 index 00000000000..b7c20e62644 --- /dev/null +++ b/queue-4.14/powerpc-vdso-make-vdso32-installation-conditional-in.patch @@ -0,0 +1,39 @@ +From 5001f7c96d779d110f8b25797ec30fea5624cfd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2019 04:24:37 +0000 +Subject: powerpc: vdso: Make vdso32 installation conditional in vdso_install + +From: Ben Hutchings + +[ Upstream commit ff6d27823f619892ab96f7461764840e0d786b15 ] + +The 32-bit vDSO is not needed and not normally built for 64-bit +little-endian configurations. However, the vdso_install target still +builds and installs it. Add the same config condition as is normally +used for the build. + +Fixes: e0d005916994 ("powerpc/vdso: Disable building the 32-bit VDSO ...") +Signed-off-by: Ben Hutchings +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/Makefile | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index 0f04c878113ef..9c78ef2982572 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -385,7 +385,9 @@ vdso_install: + ifeq ($(CONFIG_PPC64),y) + $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso64 $@ + endif ++ifdef CONFIG_VDSO32 + $(Q)$(MAKE) $(build)=arch/$(ARCH)/kernel/vdso32 $@ ++endif + + archclean: + $(Q)$(MAKE) $(clean)=$(boot) +-- +2.20.1 + diff --git a/queue-4.14/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch b/queue-4.14/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch new file mode 100644 index 00000000000..ee48cc88603 --- /dev/null +++ b/queue-4.14/pwm-lpss-release-runtime-pm-reference-from-the-drive.patch @@ -0,0 +1,45 @@ +From 5b0dfbc0dce0a871ac56cec1f6f6c57513556c82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 12:12:28 +0200 +Subject: pwm: lpss: Release runtime-pm reference from the driver's remove + callback + +From: Hans de Goede + +[ Upstream commit 42885551cedb45961879d2fc3dc3c4dc545cc23e ] + +For each pwm output which gets enabled through pwm_lpss_apply(), we do a +pm_runtime_get_sync(). + +This commit adds pm_runtime_put() calls to pwm_lpss_remove() to balance +these when the driver gets removed with some of the outputs still enabled. + +Fixes: f080be27d7d9 ("pwm: lpss: Add support for runtime PM") +Acked-by: Andy Shevchenko +Signed-off-by: Hans de Goede +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lpss.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c +index 1e69c1c9ec096..7a4a6406cf69a 100644 +--- a/drivers/pwm/pwm-lpss.c ++++ b/drivers/pwm/pwm-lpss.c +@@ -216,6 +216,12 @@ EXPORT_SYMBOL_GPL(pwm_lpss_probe); + + int pwm_lpss_remove(struct pwm_lpss_chip *lpwm) + { ++ int i; ++ ++ for (i = 0; i < lpwm->info->npwm; i++) { ++ if (pwm_is_enabled(&lpwm->chip.pwms[i])) ++ pm_runtime_put(lpwm->chip.dev); ++ } + return pwmchip_remove(&lpwm->chip); + } + EXPORT_SYMBOL_GPL(pwm_lpss_remove); +-- +2.20.1 + diff --git a/queue-4.14/pwm-meson-consider-128-a-valid-pre-divider.patch b/queue-4.14/pwm-meson-consider-128-a-valid-pre-divider.patch new file mode 100644 index 00000000000..8705a87ba4f --- /dev/null +++ b/queue-4.14/pwm-meson-consider-128-a-valid-pre-divider.patch @@ -0,0 +1,54 @@ +From 3ca533c2831060b935f0c0650d12e5023aa3f374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2019 20:18:16 +0200 +Subject: pwm: meson: Consider 128 a valid pre-divider +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Blumenstingl + +[ Upstream commit 51496e4446875726d50a5617a6e0e0dabbc2e6da ] + +The pre-divider allows configuring longer PWM periods compared to using +the input clock directly. The pre-divider is 7 bit wide, meaning it's +maximum value is 128 (the register value is off-by-one: 0x7f or 127). + +Change the loop to also allow for the maximum possible value to be +considered valid. + +Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller") +Signed-off-by: Martin Blumenstingl +Acked-by: Uwe Kleine-König +Reviewed-by: Neil Armstrong +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-meson.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c +index 9b79cbc7a7152..9551f896dd6f3 100644 +--- a/drivers/pwm/pwm-meson.c ++++ b/drivers/pwm/pwm-meson.c +@@ -188,7 +188,7 @@ static int meson_pwm_calc(struct meson_pwm *meson, + do_div(fin_ps, fin_freq); + + /* Calc pre_div with the period */ +- for (pre_div = 0; pre_div < MISC_CLK_DIV_MASK; pre_div++) { ++ for (pre_div = 0; pre_div <= MISC_CLK_DIV_MASK; pre_div++) { + cnt = DIV_ROUND_CLOSEST_ULL((u64)period * 1000, + fin_ps * (pre_div + 1)); + dev_dbg(meson->chip.dev, "fin_ps=%llu pre_div=%u cnt=%u\n", +@@ -197,7 +197,7 @@ static int meson_pwm_calc(struct meson_pwm *meson, + break; + } + +- if (pre_div == MISC_CLK_DIV_MASK) { ++ if (pre_div > MISC_CLK_DIV_MASK) { + dev_err(meson->chip.dev, "unable to get period pre_div\n"); + return -EINVAL; + } +-- +2.20.1 + diff --git a/queue-4.14/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch b/queue-4.14/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch new file mode 100644 index 00000000000..6295fed7513 --- /dev/null +++ b/queue-4.14/pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch @@ -0,0 +1,43 @@ +From a7688515439384d033afefc0cf57647a8275f881 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Apr 2019 20:18:17 +0200 +Subject: pwm: meson: Don't disable PWM when setting duty repeatedly + +From: Bichao Zheng + +[ Upstream commit a279345807e1e0ae79567a52cfdd9d30c9174a3c ] + +There is an abnormally low about 20ms,when setting duty repeatedly. +Because setting the duty will disable PWM and then enable. Delete +this operation now. + +Fixes: 211ed630753d2f ("pwm: Add support for Meson PWM Controller") +Signed-off-by: Bichao Zheng +[ Dropped code instead of hiding it behind a comment ] +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-meson.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/pwm/pwm-meson.c b/drivers/pwm/pwm-meson.c +index 9551f896dd6f3..3d2c36963a4fc 100644 +--- a/drivers/pwm/pwm-meson.c ++++ b/drivers/pwm/pwm-meson.c +@@ -325,11 +325,6 @@ static int meson_pwm_apply(struct pwm_chip *chip, struct pwm_device *pwm, + if (state->period != channel->state.period || + state->duty_cycle != channel->state.duty_cycle || + state->polarity != channel->state.polarity) { +- if (channel->state.enabled) { +- meson_pwm_disable(meson, pwm->hwpwm); +- channel->state.enabled = false; +- } +- + if (state->polarity != channel->state.polarity) { + if (state->polarity == PWM_POLARITY_NORMAL) + meson->inverter_mask |= BIT(pwm->hwpwm); +-- +2.20.1 + diff --git a/queue-4.14/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch b/queue-4.14/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch new file mode 100644 index 00000000000..bcd184a06b0 --- /dev/null +++ b/queue-4.14/qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch @@ -0,0 +1,80 @@ +From 5e2d58984b84fb3152299fb725ff4839bbafc5a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jun 2019 11:29:40 +0300 +Subject: qed: iWARP - Use READ_ONCE and smp_store_release to access ep->state + +From: Michal Kalderon + +[ Upstream commit 6117561e1bb30b2fe7f51e1961f34dbedd0bec8a ] + +Destroy QP waits for it's ep object state to be set to CLOSED +before proceeding. ep->state can be updated from a different +context. Add smp_store_release/READ_ONCE to synchronize. + +Fixes: fc4c6065e661 ("qed: iWARP implement disconnect flows") +Signed-off-by: Ariel Elior +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +index bb09f5a9846f6..38d0f62bf037a 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +@@ -509,7 +509,8 @@ int qed_iwarp_destroy_qp(struct qed_hwfn *p_hwfn, struct qed_rdma_qp *qp) + + /* Make sure ep is closed before returning and freeing memory. */ + if (ep) { +- while (ep->state != QED_IWARP_EP_CLOSED && wait_count++ < 200) ++ while (READ_ONCE(ep->state) != QED_IWARP_EP_CLOSED && ++ wait_count++ < 200) + msleep(100); + + if (ep->state != QED_IWARP_EP_CLOSED) +@@ -991,8 +992,6 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn, + + params.ep_context = ep; + +- ep->state = QED_IWARP_EP_CLOSED; +- + switch (fw_return_code) { + case RDMA_RETURN_OK: + ep->qp->max_rd_atomic_req = ep->cm_info.ord; +@@ -1052,6 +1051,10 @@ qed_iwarp_mpa_complete(struct qed_hwfn *p_hwfn, + break; + } + ++ if (fw_return_code != RDMA_RETURN_OK) ++ /* paired with READ_ONCE in destroy_qp */ ++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED); ++ + ep->event_cb(ep->cb_context, ¶ms); + + /* on passive side, if there is no associated QP (REJECT) we need to +@@ -2069,7 +2072,9 @@ void qed_iwarp_qp_in_error(struct qed_hwfn *p_hwfn, + params.status = (fw_return_code == IWARP_QP_IN_ERROR_GOOD_CLOSE) ? + 0 : -ECONNRESET; + +- ep->state = QED_IWARP_EP_CLOSED; ++ /* paired with READ_ONCE in destroy_qp */ ++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED); ++ + spin_lock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock); + list_del(&ep->list_entry); + spin_unlock_bh(&p_hwfn->p_rdma_info->iwarp.iw_lock); +@@ -2157,7 +2162,8 @@ qed_iwarp_tcp_connect_unsuccessful(struct qed_hwfn *p_hwfn, + params.event = QED_IWARP_EVENT_ACTIVE_COMPLETE; + params.ep_context = ep; + params.cm_info = &ep->cm_info; +- ep->state = QED_IWARP_EP_CLOSED; ++ /* paired with READ_ONCE in destroy_qp */ ++ smp_store_release(&ep->state, QED_IWARP_EP_CLOSED); + + switch (fw_return_code) { + case IWARP_CONN_ERROR_TCP_CONNECT_INVALID_PACKET: +-- +2.20.1 + diff --git a/queue-4.14/qed-reduce-maximum-stack-frame-size.patch b/queue-4.14/qed-reduce-maximum-stack-frame-size.patch new file mode 100644 index 00000000000..66b33bf841d --- /dev/null +++ b/queue-4.14/qed-reduce-maximum-stack-frame-size.patch @@ -0,0 +1,103 @@ +From 410bd2847e23081a07acf1dc55e8036932fc1529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 17:01:23 +0200 +Subject: qed: reduce maximum stack frame size + +From: Arnd Bergmann + +[ Upstream commit 7c116e02a4a7575c8c62bfd2106e3e3ec8fb99dc ] + +clang warns about an overly large stack frame in one function +when it decides to inline all __qed_get_vport_*() functions into +__qed_get_vport_stats(): + +drivers/net/ethernet/qlogic/qed/qed_l2.c:1889:13: error: stack frame size of 1128 bytes in function '_qed_get_vport_stats' [-Werror,-Wframe-larger-than=] + +Use a noinline_for_stack annotation to prevent clang from inlining +these, which keeps the maximum stack usage at around half of that +in the worst case, similar to what we get with gcc. + +Fixes: 86622ee75312 ("qed: Move statistics to L2 code") +Signed-off-by: Arnd Bergmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_l2.c | 34 +++++++++++------------- + 1 file changed, 15 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 62cde3854a5cd..5d7adedac68d2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -1629,10 +1629,9 @@ static void __qed_get_vport_pstats_addrlen(struct qed_hwfn *p_hwfn, + } + } + +-static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_eth_stats *p_stats, +- u16 statistics_bin) ++static noinline_for_stack void ++__qed_get_vport_pstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ struct qed_eth_stats *p_stats, u16 statistics_bin) + { + struct eth_pstorm_per_queue_stat pstats; + u32 pstats_addr = 0, pstats_len = 0; +@@ -1659,10 +1658,9 @@ static void __qed_get_vport_pstats(struct qed_hwfn *p_hwfn, + HILO_64_REGPAIR(pstats.error_drop_pkts); + } + +-static void __qed_get_vport_tstats(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_eth_stats *p_stats, +- u16 statistics_bin) ++static noinline_for_stack void ++__qed_get_vport_tstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ struct qed_eth_stats *p_stats, u16 statistics_bin) + { + struct tstorm_per_port_stat tstats; + u32 tstats_addr, tstats_len; +@@ -1705,10 +1703,9 @@ static void __qed_get_vport_ustats_addrlen(struct qed_hwfn *p_hwfn, + } + } + +-static void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_eth_stats *p_stats, +- u16 statistics_bin) ++static noinline_for_stack ++void __qed_get_vport_ustats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ struct qed_eth_stats *p_stats, u16 statistics_bin) + { + struct eth_ustorm_per_queue_stat ustats; + u32 ustats_addr = 0, ustats_len = 0; +@@ -1747,10 +1744,9 @@ static void __qed_get_vport_mstats_addrlen(struct qed_hwfn *p_hwfn, + } + } + +-static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_eth_stats *p_stats, +- u16 statistics_bin) ++static noinline_for_stack void ++__qed_get_vport_mstats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ struct qed_eth_stats *p_stats, u16 statistics_bin) + { + struct eth_mstorm_per_queue_stat mstats; + u32 mstats_addr = 0, mstats_len = 0; +@@ -1776,9 +1772,9 @@ static void __qed_get_vport_mstats(struct qed_hwfn *p_hwfn, + HILO_64_REGPAIR(mstats.tpa_coalesced_bytes); + } + +-static void __qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, +- struct qed_ptt *p_ptt, +- struct qed_eth_stats *p_stats) ++static noinline_for_stack void ++__qed_get_vport_port_stats(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt, ++ struct qed_eth_stats *p_stats) + { + struct qed_eth_stats_common *p_common = &p_stats->common; + struct port_stats port_stats; +-- +2.20.1 + diff --git a/queue-4.14/rdma-cma-fix-false-error-message.patch b/queue-4.14/rdma-cma-fix-false-error-message.patch new file mode 100644 index 00000000000..6d665027aea --- /dev/null +++ b/queue-4.14/rdma-cma-fix-false-error-message.patch @@ -0,0 +1,44 @@ +From 1de16cad50c0e6c8f9d7bb32b1cfe1eb9571048e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Sep 2019 11:27:31 +0200 +Subject: RDMA/cma: Fix false error message +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit a6e4d254c19b541a58caced322111084b27a7788 ] + +In addr_handler(), assuming status == 0 and the device already has been +acquired (id_priv->cma_dev != NULL), we get the following incorrect +"error" message: + +RDMA CM: ADDR_ERROR: failed to resolve IP. status 0 + +Fixes: 498683c6a7ee ("IB/cma: Add debug messages to error flows") +Link: https://lore.kernel.org/r/20190902092731.1055757-1-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index fc4630e4acdd6..1614f6f3677c0 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2789,7 +2789,7 @@ static void addr_handler(int status, struct sockaddr *src_addr, + if (status) + pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to acquire device. status %d\n", + status); +- } else { ++ } else if (status) { + pr_debug_ratelimited("RDMA CM: ADDR_ERROR: failed to resolve IP. status %d\n", status); + } + +-- +2.20.1 + diff --git a/queue-4.14/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch b/queue-4.14/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch new file mode 100644 index 00000000000..688dfc77a82 --- /dev/null +++ b/queue-4.14/rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch @@ -0,0 +1,48 @@ +From c9e2ea7f20e554ae4c6ed9044c088db316beed81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jun 2019 19:47:51 +0800 +Subject: RDMA/hns: Fixs hw access invalid dma memory error + +From: Xi Wang + +[ Upstream commit ec5bc2cc69b4fc494e04d10fc5226f6f9cf67c56 ] + +When smmu is enable, if execute the perftest command and then use 'kill +-9' to exit, follow this operation repeatedly, the kernel will have a high +probability to print the following smmu event: + + arm-smmu-v3 arm-smmu-v3.1.auto: event 0x10 received: + arm-smmu-v3 arm-smmu-v3.1.auto: 0x00007d0000000010 + arm-smmu-v3 arm-smmu-v3.1.auto: 0x0000020900000080 + arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000 + arm-smmu-v3 arm-smmu-v3.1.auto: 0x00000000f47cf000 + +This is because the hw will periodically refresh the qpc cache until the +next reset. + +This patch fixed it by removing the action that release qpc memory in the +'hns_roce_qp_free' function. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Xi Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 3a37d26889df1..281e9987ffc83 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -241,7 +241,6 @@ void hns_roce_qp_free(struct hns_roce_dev *hr_dev, struct hns_roce_qp *hr_qp) + + if ((hr_qp->ibqp.qp_type) != IB_QPT_GSI) { + hns_roce_table_put(hr_dev, &qp_table->irrl_table, hr_qp->qpn); +- hns_roce_table_put(hr_dev, &qp_table->qp_table, hr_qp->qpn); + } + } + +-- +2.20.1 + diff --git a/queue-4.14/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch b/queue-4.14/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch new file mode 100644 index 00000000000..fbc31a58f4b --- /dev/null +++ b/queue-4.14/rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch @@ -0,0 +1,57 @@ +From 8ddc2360d66aba1779e083dd22a593fd4d1a0865 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jan 2019 20:27:18 +0530 +Subject: RDMA/iw_cxgb4: Fix the unchecked ep dereference + +From: Raju Rangoju + +[ Upstream commit 3352976c892301fd576a2e9ff0ac7337b2e2ca48 ] + +The patch 944661dd97f4: "RDMA/iw_cxgb4: atomically lookup ep and get a +reference" from May 6, 2016, leads to the following Smatch complaint: + + drivers/infiniband/hw/cxgb4/cm.c:2953 terminate() + error: we previously assumed 'ep' could be null (see line 2945) + +Fixes: 944661dd97f4 ("RDMA/iw_cxgb4: atomically lookup ep and get a reference") +Reported-by: Dan Carpenter +Signed-off-by: Raju Rangoju +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index bb36cdf82a8d6..3668cc71b47e2 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2923,15 +2923,18 @@ static int terminate(struct c4iw_dev *dev, struct sk_buff *skb) + ep = get_ep_from_tid(dev, tid); + BUG_ON(!ep); + +- if (ep && ep->com.qp) { +- pr_warn("TERM received tid %u qpid %u\n", +- tid, ep->com.qp->wq.sq.qid); +- attrs.next_state = C4IW_QP_STATE_TERMINATE; +- c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp, +- C4IW_QP_ATTR_NEXT_STATE, &attrs, 1); ++ if (ep) { ++ if (ep->com.qp) { ++ pr_warn("TERM received tid %u qpid %u\n", tid, ++ ep->com.qp->wq.sq.qid); ++ attrs.next_state = C4IW_QP_STATE_TERMINATE; ++ c4iw_modify_qp(ep->com.qp->rhp, ep->com.qp, ++ C4IW_QP_ATTR_NEXT_STATE, &attrs, 1); ++ } ++ ++ c4iw_put_ep(&ep->com); + } else + pr_warn("TERM received tid %u no ep/qp\n", tid); +- c4iw_put_ep(&ep->com); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch b/queue-4.14/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch new file mode 100644 index 00000000000..a10d6371d70 --- /dev/null +++ b/queue-4.14/rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch @@ -0,0 +1,36 @@ +From daef0a04e3a7ff678d54d53a5e120f02047fa83d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jan 2019 17:27:55 +0200 +Subject: RDMA/ocrdma: Fix out of bounds index check in query pkey + +From: Gal Pressman + +[ Upstream commit b188940796c7be31c1b8c25a9a0e0842c2e7a49e ] + +The pkey table size is one element, index should be tested for > 0 instead +of > 1. + +Fixes: fe2caefcdf58 ("RDMA/ocrdma: Add driver for Emulex OneConnect IBoE RDMA adapter") +Signed-off-by: Gal Pressman +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +index 27d5e8d9f08d3..7683d13dad3d5 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +@@ -55,7 +55,7 @@ + + int ocrdma_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey) + { +- if (index > 1) ++ if (index > 0) + return -EINVAL; + + *pkey = 0xffff; +-- +2.20.1 + diff --git a/queue-4.14/rdma-qedr-fix-incorrect-device-rate.patch b/queue-4.14/rdma-qedr-fix-incorrect-device-rate.patch new file mode 100644 index 00000000000..a322403f839 --- /dev/null +++ b/queue-4.14/rdma-qedr-fix-incorrect-device-rate.patch @@ -0,0 +1,95 @@ +From 5ffb2c9635c478d800c30be4bb0f45dfd0419a6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 May 2019 12:33:20 +0300 +Subject: RDMA/qedr: Fix incorrect device rate. + +From: Sagiv Ozeri + +[ Upstream commit 69054666df0a9b4e8331319f98b6b9a88bc3fcc4 ] + +Use the correct enum value introduced in commit 12113a35ada6 ("IB/core: +Add HDR speed enum") Prior to this change a 50Gbps port would show 40Gbps. + +This patch also cleaned up the redundant redefiniton of ib speeds for +qedr. + +Fixes: 12113a35ada6 ("IB/core: Add HDR speed enum") +Signed-off-by: Sagiv Ozeri +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 8bfe9073da78c..6ae72accae3db 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -178,54 +178,47 @@ int qedr_query_device(struct ib_device *ibdev, + return 0; + } + +-#define QEDR_SPEED_SDR (1) +-#define QEDR_SPEED_DDR (2) +-#define QEDR_SPEED_QDR (4) +-#define QEDR_SPEED_FDR10 (8) +-#define QEDR_SPEED_FDR (16) +-#define QEDR_SPEED_EDR (32) +- + static inline void get_link_speed_and_width(int speed, u8 *ib_speed, + u8 *ib_width) + { + switch (speed) { + case 1000: +- *ib_speed = QEDR_SPEED_SDR; ++ *ib_speed = IB_SPEED_SDR; + *ib_width = IB_WIDTH_1X; + break; + case 10000: +- *ib_speed = QEDR_SPEED_QDR; ++ *ib_speed = IB_SPEED_QDR; + *ib_width = IB_WIDTH_1X; + break; + + case 20000: +- *ib_speed = QEDR_SPEED_DDR; ++ *ib_speed = IB_SPEED_DDR; + *ib_width = IB_WIDTH_4X; + break; + + case 25000: +- *ib_speed = QEDR_SPEED_EDR; ++ *ib_speed = IB_SPEED_EDR; + *ib_width = IB_WIDTH_1X; + break; + + case 40000: +- *ib_speed = QEDR_SPEED_QDR; ++ *ib_speed = IB_SPEED_QDR; + *ib_width = IB_WIDTH_4X; + break; + + case 50000: +- *ib_speed = QEDR_SPEED_QDR; +- *ib_width = IB_WIDTH_4X; ++ *ib_speed = IB_SPEED_HDR; ++ *ib_width = IB_WIDTH_1X; + break; + + case 100000: +- *ib_speed = QEDR_SPEED_EDR; ++ *ib_speed = IB_SPEED_EDR; + *ib_width = IB_WIDTH_4X; + break; + + default: + /* Unsupported */ +- *ib_speed = QEDR_SPEED_SDR; ++ *ib_speed = IB_SPEED_SDR; + *ib_width = IB_WIDTH_1X; + } + } +-- +2.20.1 + diff --git a/queue-4.14/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch b/queue-4.14/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch new file mode 100644 index 00000000000..fccfbac6a36 --- /dev/null +++ b/queue-4.14/rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch @@ -0,0 +1,37 @@ +From 3913c7e8169c615a41af5c318fccfb30a00945b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jan 2019 17:27:56 +0200 +Subject: RDMA/qedr: Fix out of bounds index check in query pkey + +From: Gal Pressman + +[ Upstream commit dbe30dae487e1a232158c24b432d45281c2805b7 ] + +The pkey table size is QEDR_ROCE_PKEY_TABLE_LEN, index should be tested +for >= QEDR_ROCE_PKEY_TABLE_LEN instead of > QEDR_ROCE_PKEY_TABLE_LEN. + +Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs") +Signed-off-by: Gal Pressman +Acked-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 656e7c1a4449f..8bfe9073da78c 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -63,7 +63,7 @@ static inline int qedr_ib_copy_to_udata(struct ib_udata *udata, void *src, + + int qedr_query_pkey(struct ib_device *ibdev, u8 port, u16 index, u16 *pkey) + { +- if (index > QEDR_ROCE_PKEY_TABLE_LEN) ++ if (index >= QEDR_ROCE_PKEY_TABLE_LEN) + return -EINVAL; + + *pkey = QEDR_ROCE_PKEY_DEFAULT; +-- +2.20.1 + diff --git a/queue-4.14/regulator-fixed-default-enable-high-on-dt-regulators.patch b/queue-4.14/regulator-fixed-default-enable-high-on-dt-regulators.patch new file mode 100644 index 00000000000..c0e3dee9023 --- /dev/null +++ b/queue-4.14/regulator-fixed-default-enable-high-on-dt-regulators.patch @@ -0,0 +1,67 @@ +From 2211535df238bcc0f170cdb1f3b727e72f13999e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 22:43:46 +0200 +Subject: regulator: fixed: Default enable high on DT regulators + +From: Linus Walleij + +[ Upstream commit 28be5f15df2ee6882b0a122693159c96a28203c7 ] + +commit efdfeb079cc3 +("regulator: fixed: Convert to use GPIO descriptor only") +switched to use gpiod_get() to look up the regulator from the +gpiolib core whether that is device tree or boardfile. + +This meant that we activate the code in +a603a2b8d86e ("gpio: of: Add special quirk to parse regulator flags") +which means the descriptors coming from the device tree already +have the right inversion and open drain semantics set up from +the gpiolib core. + +As the fixed regulator was inspected again we got the +inverted inversion and things broke. + +Fix it by ignoring the config in the device tree for now: the +later patches in the series will push all inversion handling +over to the gpiolib core and set it up properly in the +boardfiles for legacy devices, but I did not finish that +for this kernel cycle. + +Fixes: commit efdfeb079cc3 ("regulator: fixed: Convert to use GPIO descriptor only") +Reported-by: Leonard Crestez +Reported-by: Fabio Estevam +Reported-by: John Stultz +Reported-by: Anders Roxell +Signed-off-by: Linus Walleij +Tested-by: John Stultz +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/fixed.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index 988a7472c2ab5..d68ff65a5adc9 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -84,9 +84,14 @@ of_get_fixed_voltage_config(struct device *dev, + + of_property_read_u32(np, "startup-delay-us", &config->startup_delay); + +- config->enable_high = of_property_read_bool(np, "enable-active-high"); +- config->gpio_is_open_drain = of_property_read_bool(np, +- "gpio-open-drain"); ++ /* ++ * FIXME: we pulled active low/high and open drain handling into ++ * gpiolib so it will be handled there. Delete this in the second ++ * step when we also remove the custom inversion handling for all ++ * legacy boardfiles. ++ */ ++ config->enable_high = 1; ++ config->gpio_is_open_drain = 0; + + if (of_find_property(np, "vin-supply", NULL)) + config->input_supply = "vin"; +-- +2.20.1 + diff --git a/queue-4.14/regulator-lp87565-fix-missing-register-for-lp87565_b.patch b/queue-4.14/regulator-lp87565-fix-missing-register-for-lp87565_b.patch new file mode 100644 index 00000000000..1dfbdee1272 --- /dev/null +++ b/queue-4.14/regulator-lp87565-fix-missing-register-for-lp87565_b.patch @@ -0,0 +1,36 @@ +From 1eebe8b7873e8ae54e4d50bf37539bdeaf82a29d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2019 14:16:40 +0800 +Subject: regulator: lp87565: Fix missing register for LP87565_BUCK_0 + +From: Axel Lin + +[ Upstream commit d1a6cbdf1e597917cb642c655512d91b71a35d22 ] + +LP87565_BUCK_0 is missed, fix it. + +Fixes: f0168a9bf ("regulator: lp87565: Add support for lp87565 PMIC regulators") +Signed-off-by: Axel Lin +Reviewed-by: Keerthy +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/lp87565-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/lp87565-regulator.c b/drivers/regulator/lp87565-regulator.c +index cfdbe294fb6af..32d4e6ec2e198 100644 +--- a/drivers/regulator/lp87565-regulator.c ++++ b/drivers/regulator/lp87565-regulator.c +@@ -188,7 +188,7 @@ static int lp87565_regulator_probe(struct platform_device *pdev) + struct lp87565 *lp87565 = dev_get_drvdata(pdev->dev.parent); + struct regulator_config config = { }; + struct regulator_dev *rdev; +- int i, min_idx = LP87565_BUCK_1, max_idx = LP87565_BUCK_3; ++ int i, min_idx = LP87565_BUCK_0, max_idx = LP87565_BUCK_3; + + platform_set_drvdata(pdev, lp87565); + +-- +2.20.1 + diff --git a/queue-4.14/regulator-pv88060-fix-array-out-of-bounds-access.patch b/queue-4.14/regulator-pv88060-fix-array-out-of-bounds-access.patch new file mode 100644 index 00000000000..98c7427c485 --- /dev/null +++ b/queue-4.14/regulator-pv88060-fix-array-out-of-bounds-access.patch @@ -0,0 +1,36 @@ +From a2372d11e95ffd7f64a0a3737bdc926c08914225 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Feb 2019 18:00:00 +0800 +Subject: regulator: pv88060: Fix array out-of-bounds access + +From: Axel Lin + +[ Upstream commit 7cd415f875591bc66c5ecb49bf84ef97e80d7b0e ] + +Fix off-by-one while iterating current_limits array. +The valid index should be 0 ~ n_current_limits -1. + +Fixes: f307a7e9b7af ("regulator: pv88060: new regulator driver") +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pv88060-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/pv88060-regulator.c b/drivers/regulator/pv88060-regulator.c +index a9446056435f9..1f2d8180506bc 100644 +--- a/drivers/regulator/pv88060-regulator.c ++++ b/drivers/regulator/pv88060-regulator.c +@@ -135,7 +135,7 @@ static int pv88060_set_current_limit(struct regulator_dev *rdev, int min, + int i; + + /* search for closest to maximum */ +- for (i = info->n_current_limits; i >= 0; i--) { ++ for (i = info->n_current_limits - 1; i >= 0; i--) { + if (min <= info->current_limits[i] + && max >= info->current_limits[i]) { + return regmap_update_bits(rdev->regmap, +-- +2.20.1 + diff --git a/queue-4.14/regulator-pv88080-fix-array-out-of-bounds-access.patch b/queue-4.14/regulator-pv88080-fix-array-out-of-bounds-access.patch new file mode 100644 index 00000000000..c09a3e15b35 --- /dev/null +++ b/queue-4.14/regulator-pv88080-fix-array-out-of-bounds-access.patch @@ -0,0 +1,36 @@ +From 13454fcef34b0deaef67c8b27e3c66248515ce96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Feb 2019 18:00:01 +0800 +Subject: regulator: pv88080: Fix array out-of-bounds access + +From: Axel Lin + +[ Upstream commit 3c413f594c4f9df40061445667ca11a12bc8ee34 ] + +Fix off-by-one while iterating current_limits array. +The valid index should be 0 ~ n_current_limits -1. + +Fixes: 99cf3af5e2d5 ("regulator: pv88080: new regulator driver") +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pv88080-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/pv88080-regulator.c b/drivers/regulator/pv88080-regulator.c +index 9a08cb2de501e..6770e4de20978 100644 +--- a/drivers/regulator/pv88080-regulator.c ++++ b/drivers/regulator/pv88080-regulator.c +@@ -279,7 +279,7 @@ static int pv88080_set_current_limit(struct regulator_dev *rdev, int min, + int i; + + /* search for closest to maximum */ +- for (i = info->n_current_limits; i >= 0; i--) { ++ for (i = info->n_current_limits - 1; i >= 0; i--) { + if (min <= info->current_limits[i] + && max >= info->current_limits[i]) { + return regmap_update_bits(rdev->regmap, +-- +2.20.1 + diff --git a/queue-4.14/regulator-pv88090-fix-array-out-of-bounds-access.patch b/queue-4.14/regulator-pv88090-fix-array-out-of-bounds-access.patch new file mode 100644 index 00000000000..6b6e8524b40 --- /dev/null +++ b/queue-4.14/regulator-pv88090-fix-array-out-of-bounds-access.patch @@ -0,0 +1,36 @@ +From a427e5a35c7f30a61c1e87585d1e4488bfc2a1bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Feb 2019 18:00:02 +0800 +Subject: regulator: pv88090: Fix array out-of-bounds access + +From: Axel Lin + +[ Upstream commit a5455c9159414748bed4678184bf69989a4f7ba3 ] + +Fix off-by-one while iterating current_limits array. +The valid index should be 0 ~ n_current_limits -1. + +Fixes: c90456e36d9c ("regulator: pv88090: new regulator driver") +Signed-off-by: Axel Lin +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pv88090-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/pv88090-regulator.c b/drivers/regulator/pv88090-regulator.c +index 7a0c15957bd0b..2302b0df7630f 100644 +--- a/drivers/regulator/pv88090-regulator.c ++++ b/drivers/regulator/pv88090-regulator.c +@@ -157,7 +157,7 @@ static int pv88090_set_current_limit(struct regulator_dev *rdev, int min, + int i; + + /* search for closest to maximum */ +- for (i = info->n_current_limits; i >= 0; i--) { ++ for (i = info->n_current_limits - 1; i >= 0; i--) { + if (min <= info->current_limits[i] + && max >= info->current_limits[i]) { + return regmap_update_bits(rdev->regmap, +-- +2.20.1 + diff --git a/queue-4.14/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch b/queue-4.14/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch new file mode 100644 index 00000000000..2c8abbcc101 --- /dev/null +++ b/queue-4.14/regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch @@ -0,0 +1,45 @@ +From 13c3446c902045c02bd582e39d1ec5c63b6843fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Mar 2019 16:57:52 +0800 +Subject: regulator: tps65086: Fix tps65086_ldoa1_ranges for selector 0xB + +From: Axel Lin + +[ Upstream commit e69b394703e032e56a140172440ec4f9890b536d ] + +selector 0xB (1011) should be 2.6V rather than 2.7V, fit ix. + +Table 5-4. LDOA1 Output Voltage Options +VID Bits VOUT VID Bits VOUT VID Bits VOUT VID Bits VOUT +0000 1.35 0100 1.8 1000 2.3 1100 2.85 +0001 1.5 0101 1.9 1001 2.4 1101 3.0 +0010 1.6 0110 2.0 1010 2.5 1110 3.3 +0011 1.7 0111 2.1 1011 2.6 1111 Not Used + +Fixes: d2a2e729a666 ("regulator: tps65086: Add regulator driver for the TPS65086 PMIC") +Signed-off-by: Axel Lin +Acked-by: Andrew F. Davis +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/tps65086-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/tps65086-regulator.c b/drivers/regulator/tps65086-regulator.c +index 45e96e1546900..5a5e9b5bf4bea 100644 +--- a/drivers/regulator/tps65086-regulator.c ++++ b/drivers/regulator/tps65086-regulator.c +@@ -90,8 +90,8 @@ static const struct regulator_linear_range tps65086_buck345_25mv_ranges[] = { + static const struct regulator_linear_range tps65086_ldoa1_ranges[] = { + REGULATOR_LINEAR_RANGE(1350000, 0x0, 0x0, 0), + REGULATOR_LINEAR_RANGE(1500000, 0x1, 0x7, 100000), +- REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xA, 100000), +- REGULATOR_LINEAR_RANGE(2700000, 0xB, 0xD, 150000), ++ REGULATOR_LINEAR_RANGE(2300000, 0x8, 0xB, 100000), ++ REGULATOR_LINEAR_RANGE(2850000, 0xC, 0xD, 150000), + REGULATOR_LINEAR_RANGE(3300000, 0xE, 0xE, 0), + }; + +-- +2.20.1 + diff --git a/queue-4.14/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch b/queue-4.14/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch new file mode 100644 index 00000000000..06d5be7de81 --- /dev/null +++ b/queue-4.14/regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch @@ -0,0 +1,40 @@ +From 59fe720ce405b40cc1bff40dc5267b8b13436d0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Feb 2019 21:16:51 +0800 +Subject: regulator: wm831x-dcdc: Fix list of wm831x_dcdc_ilim from mA to uA + +From: Axel Lin + +[ Upstream commit c25d47888f0fb3d836d68322d4aea2caf31a75a6 ] + +The wm831x_dcdc_ilim entries needs to be uA because it is used to compare +with min_uA and max_uA. +While at it also make the array const and change to use unsigned int. + +Fixes: e4ee831f949a ("regulator: Add WM831x DC-DC buck convertor support") +Signed-off-by: Axel Lin +Acked-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/wm831x-dcdc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c +index 5a5bc4bb08d26..df591435d12a3 100644 +--- a/drivers/regulator/wm831x-dcdc.c ++++ b/drivers/regulator/wm831x-dcdc.c +@@ -327,8 +327,8 @@ static int wm831x_buckv_get_voltage_sel(struct regulator_dev *rdev) + } + + /* Current limit options */ +-static u16 wm831x_dcdc_ilim[] = { +- 125, 250, 375, 500, 625, 750, 875, 1000 ++static const unsigned int wm831x_dcdc_ilim[] = { ++ 125000, 250000, 375000, 500000, 625000, 750000, 875000, 1000000 + }; + + static int wm831x_buckv_set_current_limit(struct regulator_dev *rdev, +-- +2.20.1 + diff --git a/queue-4.14/rtc-88pm80x-fix-unintended-sign-extension.patch b/queue-4.14/rtc-88pm80x-fix-unintended-sign-extension.patch new file mode 100644 index 00000000000..3feef4279fb --- /dev/null +++ b/queue-4.14/rtc-88pm80x-fix-unintended-sign-extension.patch @@ -0,0 +1,93 @@ +From 0a846a7f0278e4f7c0bf414c4367c813d55973be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Feb 2019 10:08:11 +0000 +Subject: rtc: 88pm80x: fix unintended sign extension + +From: Colin Ian King + +[ Upstream commit fb0b322537a831b5b0cb948c56f8f958ce493d3a ] + +Shifting a u8 by 24 will cause the value to be promoted to an integer. If +the top bit of the u8 is set then the following conversion to an unsigned +long will sign extend the value causing the upper 32 bits to be set in +the result. + +Fix this by casting the u8 value to an unsigned long before the shift. + +Detected by CoverityScan, CID#714646-714649 ("Unintended sign extension") + +Fixes: 2985c29c1964 ("rtc: Add rtc support to 88PM80X PMIC") +Signed-off-by: Colin Ian King +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-88pm80x.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/rtc/rtc-88pm80x.c b/drivers/rtc/rtc-88pm80x.c +index 466bf7f9a285a..7da2a1fb50f89 100644 +--- a/drivers/rtc/rtc-88pm80x.c ++++ b/drivers/rtc/rtc-88pm80x.c +@@ -116,12 +116,14 @@ static int pm80x_rtc_read_time(struct device *dev, struct rtc_time *tm) + unsigned char buf[4]; + unsigned long ticks, base, data; + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); + + /* load 32-bit read-only counter */ + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -144,7 +146,8 @@ static int pm80x_rtc_set_time(struct device *dev, struct rtc_time *tm) + + /* load 32-bit read-only counter */ + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + base = ticks - data; + dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -165,11 +168,13 @@ static int pm80x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + int ret; + + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); + + regmap_raw_read(info->map, PM800_RTC_EXPIRE1_1, buf, 4); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -192,12 +197,14 @@ static int pm80x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) + regmap_update_bits(info->map, PM800_RTC_CONTROL, PM800_ALARM1_EN, 0); + + regmap_raw_read(info->map, PM800_RTC_EXPIRE2_1, buf, 4); +- base = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ base = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + dev_dbg(info->dev, "%x-%x-%x-%x\n", buf[0], buf[1], buf[2], buf[3]); + + /* load 32-bit read-only counter */ + regmap_raw_read(info->map, PM800_RTC_COUNTER1, buf, 4); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +-- +2.20.1 + diff --git a/queue-4.14/rtc-88pm860x-fix-unintended-sign-extension.patch b/queue-4.14/rtc-88pm860x-fix-unintended-sign-extension.patch new file mode 100644 index 00000000000..37e6fc70e28 --- /dev/null +++ b/queue-4.14/rtc-88pm860x-fix-unintended-sign-extension.patch @@ -0,0 +1,90 @@ +From dc1e611bd68c5194cef51c7a674b92954d89e7b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Feb 2019 09:50:53 +0000 +Subject: rtc: 88pm860x: fix unintended sign extension + +From: Colin Ian King + +[ Upstream commit dc9e47160626cdb58d5c39a4f43dcfdb27a5c004 ] + +Shifting a u8 by 24 will cause the value to be promoted to an integer. If +the top bit of the u8 is set then the following conversion to an unsigned +long will sign extend the value causing the upper 32 bits to be set in +the result. + +Fix this by casting the u8 value to an unsigned long before the shift. + +Detected by CoverityScan, CID#144925-144928 ("Unintended sign extension") + +Fixes: 008b30408c40 ("mfd: Add rtc support to 88pm860x") +Signed-off-by: Colin Ian King +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-88pm860x.c | 21 ++++++++++++++------- + 1 file changed, 14 insertions(+), 7 deletions(-) + +diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c +index 166faae3a59cd..7d3e5168fcefc 100644 +--- a/drivers/rtc/rtc-88pm860x.c ++++ b/drivers/rtc/rtc-88pm860x.c +@@ -115,11 +115,13 @@ static int pm860x_rtc_read_time(struct device *dev, struct rtc_time *tm) + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | ++ (buf[5] << 8) | buf[7]; + + /* load 32-bit read-only counter */ + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -145,7 +147,8 @@ static int pm860x_rtc_set_time(struct device *dev, struct rtc_time *tm) + + /* load 32-bit read-only counter */ + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + base = ticks - data; + dev_dbg(info->dev, "set base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -170,10 +173,12 @@ static int pm860x_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | ++ (buf[5] << 8) | buf[7]; + + pm860x_bulk_read(info->i2c, PM8607_RTC_EXPIRE1, 4, buf); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +@@ -198,11 +203,13 @@ static int pm860x_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm) + pm860x_page_bulk_read(info->i2c, REG0_ADDR, 8, buf); + dev_dbg(info->dev, "%x-%x-%x-%x-%x-%x-%x-%x\n", buf[0], buf[1], + buf[2], buf[3], buf[4], buf[5], buf[6], buf[7]); +- base = (buf[1] << 24) | (buf[3] << 16) | (buf[5] << 8) | buf[7]; ++ base = ((unsigned long)buf[1] << 24) | (buf[3] << 16) | ++ (buf[5] << 8) | buf[7]; + + /* load 32-bit read-only counter */ + pm860x_bulk_read(info->i2c, PM8607_RTC_COUNTER1, 4, buf); +- data = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ data = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + ticks = base + data; + dev_dbg(info->dev, "get base:0x%lx, RO count:0x%lx, ticks:0x%lx\n", + base, data, ticks); +-- +2.20.1 + diff --git a/queue-4.14/rtc-cmos-ignore-bogus-century-byte.patch b/queue-4.14/rtc-cmos-ignore-bogus-century-byte.patch new file mode 100644 index 00000000000..63ba8ffdcd4 --- /dev/null +++ b/queue-4.14/rtc-cmos-ignore-bogus-century-byte.patch @@ -0,0 +1,45 @@ +From fbdb67466134aef56e6bd8578d41571339843cf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jan 2019 08:21:03 +0000 +Subject: rtc: cmos: ignore bogus century byte + +From: Eric Wong + +[ Upstream commit 2a4daadd4d3e507138f8937926e6a4df49c6bfdc ] + +Older versions of Libreboot and Coreboot had an invalid value +(`3' in my case) in the century byte affecting the GM45 in +the Thinkpad X200. Not everybody's updated their firmwares, +and Linux <= 4.2 was able to read the RTC without problems, +so workaround this by ignoring invalid values. + +Fixes: 3c217e51d8a272b9 ("rtc: cmos: century support") + +Cc: Alexandre Belloni +Cc: Alessandro Zummo +Cc: Sylvain Chouleur +Cc: Patrick McDermott +Cc: linux-rtc@vger.kernel.org +Signed-off-by: Eric Wong +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-mc146818-lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c +index 2f1772a358ca5..18a6f15e313d8 100644 +--- a/drivers/rtc/rtc-mc146818-lib.c ++++ b/drivers/rtc/rtc-mc146818-lib.c +@@ -82,7 +82,7 @@ unsigned int mc146818_get_time(struct rtc_time *time) + time->tm_year += real_year - 72; + #endif + +- if (century) ++ if (century > 20) + time->tm_year += (century - 19) * 100; + + /* +-- +2.20.1 + diff --git a/queue-4.14/rtc-ds1307-rx8130-fix-alarm-handling.patch b/queue-4.14/rtc-ds1307-rx8130-fix-alarm-handling.patch new file mode 100644 index 00000000000..0ba2fc9ad34 --- /dev/null +++ b/queue-4.14/rtc-ds1307-rx8130-fix-alarm-handling.patch @@ -0,0 +1,57 @@ +From 23622715301033a8ff46988f08ca7e1444c92319 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jan 2019 15:35:58 +0100 +Subject: rtc: ds1307: rx8130: Fix alarm handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 3f929cad943380370b6db31fcb7a38d898d91089 ] + +When the EXTENSION.WADA bit is set, register 0x19 contains a bitmap of +week days, not a day of month. As Linux only handles a single alarm +without repetition using day of month is more flexible, so clear this +bit. (Otherwise a value depending on time.tm_wday would have to be +written to register 0x19.) + +Also optimize setting the AIE bit to use a single register write instead +of a bulk write of three registers. + +Fixes: ee0981be7704 ("rtc: ds1307: Add support for Epson RX8130CE") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ds1307.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c +index e7d9215c9201b..8d45d93b1db67 100644 +--- a/drivers/rtc/rtc-ds1307.c ++++ b/drivers/rtc/rtc-ds1307.c +@@ -733,8 +733,8 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t) + if (ret < 0) + return ret; + +- ctl[0] &= ~RX8130_REG_EXTENSION_WADA; +- ctl[1] |= RX8130_REG_FLAG_AF; ++ ctl[0] &= RX8130_REG_EXTENSION_WADA; ++ ctl[1] &= ~RX8130_REG_FLAG_AF; + ctl[2] &= ~RX8130_REG_CONTROL0_AIE; + + ret = regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl, +@@ -757,8 +757,7 @@ static int rx8130_set_alarm(struct device *dev, struct rtc_wkalrm *t) + + ctl[2] |= RX8130_REG_CONTROL0_AIE; + +- return regmap_bulk_write(ds1307->regmap, RX8130_REG_EXTENSION, ctl, +- sizeof(ctl)); ++ return regmap_write(ds1307->regmap, RX8130_REG_CONTROL0, ctl[2]); + } + + static int rx8130_alarm_irq_enable(struct device *dev, unsigned int enabled) +-- +2.20.1 + diff --git a/queue-4.14/rtc-ds1672-fix-unintended-sign-extension.patch b/queue-4.14/rtc-ds1672-fix-unintended-sign-extension.patch new file mode 100644 index 00000000000..611bebe7e76 --- /dev/null +++ b/queue-4.14/rtc-ds1672-fix-unintended-sign-extension.patch @@ -0,0 +1,43 @@ +From 947314277b23738fdc17636e77bcf41015f4b285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Feb 2019 18:04:49 +0000 +Subject: rtc: ds1672: fix unintended sign extension + +From: Colin Ian King + +[ Upstream commit f0c04c276739ed8acbb41b4868e942a55b128dca ] + +Shifting a u8 by 24 will cause the value to be promoted to an integer. If +the top bit of the u8 is set then the following conversion to an unsigned +long will sign extend the value causing the upper 32 bits to be set in +the result. + +Fix this by casting the u8 value to an unsigned long before the shift. + +Detected by CoverityScan, CID#138801 ("Unintended sign extension") + +Fixes: edf1aaa31fc5 ("[PATCH] RTC subsystem: DS1672 driver") +Signed-off-by: Colin Ian King +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ds1672.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c +index 9caaccccaa575..b1ebca099b0df 100644 +--- a/drivers/rtc/rtc-ds1672.c ++++ b/drivers/rtc/rtc-ds1672.c +@@ -58,7 +58,8 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm) + "%s: raw read data - counters=%02x,%02x,%02x,%02x\n", + __func__, buf[0], buf[1], buf[2], buf[3]); + +- time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0]; ++ time = ((unsigned long)buf[3] << 24) | (buf[2] << 16) | ++ (buf[1] << 8) | buf[0]; + + rtc_time_to_tm(time, tm); + +-- +2.20.1 + diff --git a/queue-4.14/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch b/queue-4.14/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch new file mode 100644 index 00000000000..48f4c0e7c1a --- /dev/null +++ b/queue-4.14/rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch @@ -0,0 +1,91 @@ +From fb033393a13dfac545a7018c89d227df655f0ca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Aug 2019 15:19:34 +0200 +Subject: rtc: pcf2127: bugfix: read rtc disables watchdog + +From: Bruno Thomsen + +[ Upstream commit 7f43020e3bdb63d65661ed377682702f8b34d3ea ] + +The previous fix listed bulk read of registers as root cause of +accendential disabling of watchdog, since the watchdog counter +register (WD_VAL) was zeroed. + +Fixes: 3769a375ab83 rtc: pcf2127: bulk read only date and time registers. + +Tested with the same PCF2127 chip as Sean reveled root cause +of WD_VAL register value zeroing was caused by reading CTRL2 +register which is one of the watchdog feature control registers. + +So the solution is to not read the first two control registers +(CTRL1 and CTRL2) in pcf2127_rtc_read_time as they are not +needed anyway. Size of local buf variable is kept to allow +easy usage of register defines to improve readability of code. + +Debug trace line was updated after CTRL1 and CTRL2 are no longer +read from the chip. Also replaced magic numbers in buf access +with register defines. + +Signed-off-by: Bruno Thomsen +Link: https://lore.kernel.org/r/20190822131936.18772-3-bruno.thomsen@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 32 ++++++++++++-------------------- + 1 file changed, 12 insertions(+), 20 deletions(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 9f1b14bf91aed..367e0f803440c 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -52,20 +52,14 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm) + struct pcf2127 *pcf2127 = dev_get_drvdata(dev); + unsigned char buf[10]; + int ret; +- int i; + +- for (i = 0; i <= PCF2127_REG_CTRL3; i++) { +- ret = regmap_read(pcf2127->regmap, PCF2127_REG_CTRL1 + i, +- (unsigned int *)(buf + i)); +- if (ret) { +- dev_err(dev, "%s: read error\n", __func__); +- return ret; +- } +- } +- +- ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_SC, +- (buf + PCF2127_REG_SC), +- ARRAY_SIZE(buf) - PCF2127_REG_SC); ++ /* ++ * Avoid reading CTRL2 register as it causes WD_VAL register ++ * value to reset to 0 which means watchdog is stopped. ++ */ ++ ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_CTRL3, ++ (buf + PCF2127_REG_CTRL3), ++ ARRAY_SIZE(buf) - PCF2127_REG_CTRL3); + if (ret) { + dev_err(dev, "%s: read error\n", __func__); + return ret; +@@ -86,14 +80,12 @@ static int pcf2127_rtc_read_time(struct device *dev, struct rtc_time *tm) + } + + dev_dbg(dev, +- "%s: raw data is cr1=%02x, cr2=%02x, cr3=%02x, " +- "sec=%02x, min=%02x, hr=%02x, " ++ "%s: raw data is cr3=%02x, sec=%02x, min=%02x, hr=%02x, " + "mday=%02x, wday=%02x, mon=%02x, year=%02x\n", +- __func__, +- buf[0], buf[1], buf[2], +- buf[3], buf[4], buf[5], +- buf[6], buf[7], buf[8], buf[9]); +- ++ __func__, buf[PCF2127_REG_CTRL3], buf[PCF2127_REG_SC], ++ buf[PCF2127_REG_MN], buf[PCF2127_REG_HR], ++ buf[PCF2127_REG_DM], buf[PCF2127_REG_DW], ++ buf[PCF2127_REG_MO], buf[PCF2127_REG_YR]); + + tm->tm_sec = bcd2bin(buf[PCF2127_REG_SC] & 0x7F); + tm->tm_min = bcd2bin(buf[PCF2127_REG_MN] & 0x7F); +-- +2.20.1 + diff --git a/queue-4.14/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch b/queue-4.14/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch new file mode 100644 index 00000000000..2e167ca709e --- /dev/null +++ b/queue-4.14/rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch @@ -0,0 +1,61 @@ +From 3aa72f793900aad639041f9bfa7d2a058c5126ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2019 12:23:36 +0800 +Subject: rtc: pcf8563: Clear event flags and disable interrupts before + requesting irq + +From: Chen-Yu Tsai + +[ Upstream commit 3572e8aea3bf925dac1dbf86127657c39fe5c254 ] + +Besides the alarm, the PCF8563 also has a timer triggered interrupt. +In cases where the previous system left the timer and interrupts on, +or somehow the bits got enabled, the interrupt would keep triggering +as the kernel doesn't know about it. + +Clear both the alarm and timer event flags, and disable the interrupts, +before requesting the interrupt line. + +Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support") +Fixes: a45d528aab8b ("rtc: pcf8563: clear expired alarm at boot time") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf8563.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c +index ef04472dde1d2..4d0b81f9805f8 100644 +--- a/drivers/rtc/rtc-pcf8563.c ++++ b/drivers/rtc/rtc-pcf8563.c +@@ -563,7 +563,6 @@ static int pcf8563_probe(struct i2c_client *client, + struct pcf8563 *pcf8563; + int err; + unsigned char buf; +- unsigned char alm_pending; + + dev_dbg(&client->dev, "%s\n", __func__); + +@@ -587,13 +586,13 @@ static int pcf8563_probe(struct i2c_client *client, + return err; + } + +- err = pcf8563_get_alarm_mode(client, NULL, &alm_pending); +- if (err) { +- dev_err(&client->dev, "%s: read error\n", __func__); ++ /* Clear flags and disable interrupts */ ++ buf = 0; ++ err = pcf8563_write_block_data(client, PCF8563_REG_ST2, 1, &buf); ++ if (err < 0) { ++ dev_err(&client->dev, "%s: write error\n", __func__); + return err; + } +- if (alm_pending) +- pcf8563_set_alarm_mode(client, 0); + + pcf8563->rtc = devm_rtc_device_register(&client->dev, + pcf8563_driver.driver.name, +-- +2.20.1 + diff --git a/queue-4.14/rtc-pcf8563-fix-interrupt-trigger-method.patch b/queue-4.14/rtc-pcf8563-fix-interrupt-trigger-method.patch new file mode 100644 index 00000000000..3d3ec905957 --- /dev/null +++ b/queue-4.14/rtc-pcf8563-fix-interrupt-trigger-method.patch @@ -0,0 +1,38 @@ +From c7ed98475a4f37a77768a3ecd96166e7103713c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Jun 2019 12:23:35 +0800 +Subject: rtc: pcf8563: Fix interrupt trigger method + +From: Chen-Yu Tsai + +[ Upstream commit 65f662cbf829834fa4d94190eb7691e5a9cb92d8 ] + +The PCF8563 datasheet says the interrupt line is active low and stays +active until the events are cleared, i.e. a level trigger interrupt. + +Fix the flags used to request the interrupt. + +Fixes: ede3e9d47cca ("drivers/rtc/rtc-pcf8563.c: add alarm support") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf8563.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c +index 8c836c51a508f..ef04472dde1d2 100644 +--- a/drivers/rtc/rtc-pcf8563.c ++++ b/drivers/rtc/rtc-pcf8563.c +@@ -605,7 +605,7 @@ static int pcf8563_probe(struct i2c_client *client, + if (client->irq > 0) { + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, pcf8563_irq, +- IRQF_SHARED|IRQF_ONESHOT|IRQF_TRIGGER_FALLING, ++ IRQF_SHARED | IRQF_ONESHOT | IRQF_TRIGGER_LOW, + pcf8563_driver.driver.name, client); + if (err) { + dev_err(&client->dev, "unable to request IRQ %d\n", +-- +2.20.1 + diff --git a/queue-4.14/rtc-pm8xxx-fix-unintended-sign-extension.patch b/queue-4.14/rtc-pm8xxx-fix-unintended-sign-extension.patch new file mode 100644 index 00000000000..67f1f15f20c --- /dev/null +++ b/queue-4.14/rtc-pm8xxx-fix-unintended-sign-extension.patch @@ -0,0 +1,53 @@ +From 06f85130aa3994e9a6feb37756d63cd4a33d3e83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Feb 2019 10:31:02 +0000 +Subject: rtc: pm8xxx: fix unintended sign extension + +From: Colin Ian King + +[ Upstream commit e42280886018c6f77f0a90190f7cba344b0df3e0 ] + +Shifting a u8 by 24 will cause the value to be promoted to an integer. If +the top bit of the u8 is set then the following conversion to an unsigned +long will sign extend the value causing the upper 32 bits to be set in +the result. + +Fix this by casting the u8 value to an unsigned long before the shift. + +Detected by CoverityScan, CID#1309693 ("Unintended sign extension") + +Fixes: 9a9a54ad7aa2 ("drivers/rtc: add support for Qualcomm PMIC8xxx RTC") +Signed-off-by: Colin Ian King +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pm8xxx.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c +index fac835530671f..a1b4b0ed1f196 100644 +--- a/drivers/rtc/rtc-pm8xxx.c ++++ b/drivers/rtc/rtc-pm8xxx.c +@@ -186,7 +186,8 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm) + } + } + +- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24); ++ secs = value[0] | (value[1] << 8) | (value[2] << 16) | ++ ((unsigned long)value[3] << 24); + + rtc_time_to_tm(secs, tm); + +@@ -267,7 +268,8 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm) + return rc; + } + +- secs = value[0] | (value[1] << 8) | (value[2] << 16) | (value[3] << 24); ++ secs = value[0] | (value[1] << 8) | (value[2] << 16) | ++ ((unsigned long)value[3] << 24); + + rtc_time_to_tm(secs, &alarm->time); + +-- +2.20.1 + diff --git a/queue-4.14/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch b/queue-4.14/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch new file mode 100644 index 00000000000..ec07f1c0e24 --- /dev/null +++ b/queue-4.14/rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch @@ -0,0 +1,52 @@ +From 7f7820566269d4620e6c15c9be22d06e698642da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2019 15:55:28 +0100 +Subject: rxrpc: Fix uninitialized error code in rxrpc_send_data_packet() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David Howells + +[ Upstream commit 3427beb6375d04e9627c67343872e79341a684ea ] + +With gcc 4.1: + + net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’: + net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function + +Indeed, if the first jump to the send_fragmentable label is made, and +the address family is not handled in the switch() statement, ret will be +used uninitialized. + +Fix this by BUG()'ing as is done in other places in rxrpc where internal +support for future address families will need adding. It should not be +possible to reach this normally as the address families are checked +up-front. + +Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs") +Reported-by: Geert Uytterhoeven +Signed-off-by: David Howells +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/output.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index 5b67cb5d47f0e..edddbacf33bc8 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -404,6 +404,9 @@ send_fragmentable: + } + break; + #endif ++ ++ default: ++ BUG(); + } + + up_write(&conn->params.local->defrag_sem); +-- +2.20.1 + diff --git a/queue-4.14/scsi-fnic-fix-msix-interrupt-allocation.patch b/queue-4.14/scsi-fnic-fix-msix-interrupt-allocation.patch new file mode 100644 index 00000000000..e13d3e72c78 --- /dev/null +++ b/queue-4.14/scsi-fnic-fix-msix-interrupt-allocation.patch @@ -0,0 +1,47 @@ +From 90ebd0ac75b9c1a304f71b6021c22b4f323ce432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Aug 2019 14:13:40 -0700 +Subject: scsi: fnic: fix msix interrupt allocation + +From: Govindarajulu Varadarajan + +[ Upstream commit 3ec24fb4c035e9cbb2f02a48640a09aa913442a2 ] + +pci_alloc_irq_vectors() returns number of vectors allocated. Fix the check +for error condition. + +Fixes: cca678dfbad49 ("scsi: fnic: switch to pci_alloc_irq_vectors") +Link: https://lore.kernel.org/r/20190827211340.1095-1-gvaradar@cisco.com +Signed-off-by: Govindarajulu Varadarajan +Acked-by: Satish Kharat +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fnic/fnic_isr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/fnic/fnic_isr.c b/drivers/scsi/fnic/fnic_isr.c +index 4e3a50202e8c5..d28088218c364 100644 +--- a/drivers/scsi/fnic/fnic_isr.c ++++ b/drivers/scsi/fnic/fnic_isr.c +@@ -254,7 +254,7 @@ int fnic_set_intr_mode(struct fnic *fnic) + int vecs = n + m + o + 1; + + if (pci_alloc_irq_vectors(fnic->pdev, vecs, vecs, +- PCI_IRQ_MSIX) < 0) { ++ PCI_IRQ_MSIX) == vecs) { + fnic->rq_count = n; + fnic->raw_wq_count = m; + fnic->wq_copy_count = o; +@@ -280,7 +280,7 @@ int fnic_set_intr_mode(struct fnic *fnic) + fnic->wq_copy_count >= 1 && + fnic->cq_count >= 3 && + fnic->intr_count >= 1 && +- pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) < 0) { ++ pci_alloc_irq_vectors(fnic->pdev, 1, 1, PCI_IRQ_MSI) == 1) { + fnic->rq_count = 1; + fnic->raw_wq_count = 1; + fnic->wq_copy_count = 1; +-- +2.20.1 + diff --git a/queue-4.14/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch b/queue-4.14/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch new file mode 100644 index 00000000000..49484c94832 --- /dev/null +++ b/queue-4.14/scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch @@ -0,0 +1,39 @@ +From 3da1c5e255d1358bb0f98729905a0375e37796e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Jul 2019 10:18:35 +0100 +Subject: scsi: libfc: fix null pointer dereference on a null lport + +From: Colin Ian King + +[ Upstream commit 41a6bf6529edd10a6def42e3b2c34a7474bcc2f5 ] + +Currently if lport is null then the null lport pointer is dereference when +printing out debug via the FC_LPORT_DB macro. Fix this by using the more +generic FC_LIBFC_DBG debug macro instead that does not use lport. + +Addresses-Coverity: ("Dereference after null check") +Fixes: 7414705ea4ae ("libfc: Add runtime debugging with debug_logging module parameter") +Signed-off-by: Colin Ian King +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libfc/fc_exch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index 42bcf7f3a0f90..6ba257cbc6d94 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -2603,7 +2603,7 @@ void fc_exch_recv(struct fc_lport *lport, struct fc_frame *fp) + + /* lport lock ? */ + if (!lport || lport->state == LPORT_ST_DISABLED) { +- FC_LPORT_DBG(lport, "Receiving frames for an lport that " ++ FC_LIBFC_DBG("Receiving frames for an lport that " + "has not been initialized correctly\n"); + fc_frame_free(fp); + return; +-- +2.20.1 + diff --git a/queue-4.14/scsi-megaraid_sas-reduce-module-load-time.patch b/queue-4.14/scsi-megaraid_sas-reduce-module-load-time.patch new file mode 100644 index 00000000000..27eac0737f4 --- /dev/null +++ b/queue-4.14/scsi-megaraid_sas-reduce-module-load-time.patch @@ -0,0 +1,67 @@ +From 58619cef8495083bddb9c985dd931319768e0f8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Mar 2019 06:46:28 -0800 +Subject: scsi: megaraid_sas: reduce module load time + +From: Steve Sistare + +[ Upstream commit 31b6a05f86e690e1818116fd23c3be915cc9d9ed ] + +megaraid_sas takes 1+ seconds to load while waiting for firmware: + +[2.822603] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state +[3.871003] megaraid_sas 0000:03:00.0: FW now in Ready state + +This is due to the following loop in megasas_transition_to_ready(), which +waits a minimum of 1 second, even though the FW becomes ready in tens of +millisecs: + + /* + * The cur_state should not last for more than max_wait secs + */ + for (i = 0; i < max_wait; i++) { + ... + msleep(1000); + ... + dev_info(&instance->pdev->dev, "FW now in Ready state\n"); + +This is a regression, caused by a change of the msleep granularity from 1 +to 1000 due to concern about waiting too long on systems with coarse +jiffies. + +To fix, increase iterations and use msleep(20), which results in: + +[2.670627] megaraid_sas 0000:03:00.0: Waiting for FW to come to ready state +[2.739386] megaraid_sas 0000:03:00.0: FW now in Ready state + +Fixes: fb2f3e96d80f ("scsi: megaraid_sas: Fix msleep granularity") +Signed-off-by: Steve Sistare +Acked-by: Sumit Saxena +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 577513649afbe..6abad63b127af 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3823,12 +3823,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr) + /* + * The cur_state should not last for more than max_wait secs + */ +- for (i = 0; i < max_wait; i++) { ++ for (i = 0; i < max_wait * 50; i++) { + curr_abs_state = instance->instancet-> + read_fw_status_reg(instance->reg_set); + + if (abs_state == curr_abs_state) { +- msleep(1000); ++ msleep(20); + } else + break; + } +-- +2.20.1 + diff --git a/queue-4.14/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch b/queue-4.14/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch new file mode 100644 index 00000000000..f110681156a --- /dev/null +++ b/queue-4.14/scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch @@ -0,0 +1,55 @@ +From 675b4ffaf93f4f5c9dd9ad55aa7a5067a8eee7ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2019 14:44:42 -0700 +Subject: scsi: qla2xxx: Avoid that qlt_send_resp_ctio() corrupts memory + +From: Bart Van Assche + +[ Upstream commit a861b49273578e255426a499842cf7f465456351 ] + +The "(&ctio->u.status1.sense_data)[i]" where i >= 0 expressions in +qlt_send_resp_ctio() are probably typos and should have been +"(&ctio->u.status1.sense_data[4 * i])" instead. Instead of only fixing +these typos, modify the code for storing sense data such that it becomes +easy to read. This patch fixes a Coverity complaint about accessing an +array outside its bounds. + +Cc: Himanshu Madhani +Cc: Giridhar Malavali +Fixes: be25152c0d9e ("qla2xxx: Improve T10-DIF/PI handling in driver.") # v4.11. +Signed-off-by: Bart Van Assche +Acked-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 1000422ef4f8a..21011c5fddebe 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -2122,14 +2122,14 @@ void qlt_send_resp_ctio(struct qla_qpair *qpair, struct qla_tgt_cmd *cmd, + ctio->u.status1.scsi_status |= + cpu_to_le16(SS_RESIDUAL_UNDER); + +- /* Response code and sense key */ +- put_unaligned_le32(((0x70 << 24) | (sense_key << 8)), +- (&ctio->u.status1.sense_data)[0]); ++ /* Fixed format sense data. */ ++ ctio->u.status1.sense_data[0] = 0x70; ++ ctio->u.status1.sense_data[2] = sense_key; + /* Additional sense length */ +- put_unaligned_le32(0x0a, (&ctio->u.status1.sense_data)[1]); ++ ctio->u.status1.sense_data[7] = 0xa; + /* ASC and ASCQ */ +- put_unaligned_le32(((asc << 24) | (ascq << 16)), +- (&ctio->u.status1.sense_data)[3]); ++ ctio->u.status1.sense_data[12] = asc; ++ ctio->u.status1.sense_data[13] = ascq; + + /* Memory Barrier */ + wmb(); +-- +2.20.1 + diff --git a/queue-4.14/scsi-qla2xxx-fix-a-format-specifier.patch b/queue-4.14/scsi-qla2xxx-fix-a-format-specifier.patch new file mode 100644 index 00000000000..4de8cc626b7 --- /dev/null +++ b/queue-4.14/scsi-qla2xxx-fix-a-format-specifier.patch @@ -0,0 +1,39 @@ +From 8d25f1aab292560f1f0e6c9e8841c9d0f07b6fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Apr 2019 14:44:11 -0700 +Subject: scsi: qla2xxx: Fix a format specifier + +From: Bart Van Assche + +[ Upstream commit 19ce192cd718e02f880197c0983404ca48236807 ] + +Since mcmd->sess->port_name is eight bytes long, use %8phC to format that +port name instead of %phC. + +Cc: Himanshu Madhani +Cc: Giridhar Malavali +Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery") # v4.11. +Signed-off-by: Bart Van Assche +Acked-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 55227d20496a0..1000422ef4f8a 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -2179,7 +2179,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd) + mcmd->orig_iocb.imm_ntfy.u.isp24.status_subcode == + ELS_TPRLO) { + ql_dbg(ql_dbg_disc, vha, 0x2106, +- "TM response logo %phC status %#x state %#x", ++ "TM response logo %8phC status %#x state %#x", + mcmd->sess->port_name, mcmd->fc_tm_rsp, + mcmd->flags); + qlt_schedule_sess_for_deletion_lock(mcmd->sess); +-- +2.20.1 + diff --git a/queue-4.14/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch b/queue-4.14/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch new file mode 100644 index 00000000000..296def2249a --- /dev/null +++ b/queue-4.14/scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch @@ -0,0 +1,100 @@ +From def9c80773c18647fdf5ab81556ded4f47409e45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Apr 2019 12:44:46 -0700 +Subject: scsi: qla2xxx: Unregister chrdev if module initialization fails + +From: Bart Van Assche + +[ Upstream commit c794d24ec9eb6658909955772e70f34bef5b5b91 ] + +If module initialization fails after the character device has been +registered, unregister the character device. Additionally, avoid +duplicating error path code. + +Cc: Himanshu Madhani +Cc: Giridhar Malavali +Fixes: 6a03b4cd78f3 ("[SCSI] qla2xxx: Add char device to increase driver use count") # v2.6.35. +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 34 +++++++++++++++++++++------------- + 1 file changed, 21 insertions(+), 13 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 5617bb18c2335..5f9d4dbc4a98e 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -6714,8 +6714,7 @@ qla2x00_module_init(void) + /* Initialize target kmem_cache and mem_pools */ + ret = qlt_init(); + if (ret < 0) { +- kmem_cache_destroy(srb_cachep); +- return ret; ++ goto destroy_cache; + } else if (ret > 0) { + /* + * If initiator mode is explictly disabled by qlt_init(), +@@ -6736,11 +6735,10 @@ qla2x00_module_init(void) + qla2xxx_transport_template = + fc_attach_transport(&qla2xxx_transport_functions); + if (!qla2xxx_transport_template) { +- kmem_cache_destroy(srb_cachep); + ql_log(ql_log_fatal, NULL, 0x0002, + "fc_attach_transport failed...Failing load!.\n"); +- qlt_exit(); +- return -ENODEV; ++ ret = -ENODEV; ++ goto qlt_exit; + } + + apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops); +@@ -6752,27 +6750,37 @@ qla2x00_module_init(void) + qla2xxx_transport_vport_template = + fc_attach_transport(&qla2xxx_transport_vport_functions); + if (!qla2xxx_transport_vport_template) { +- kmem_cache_destroy(srb_cachep); +- qlt_exit(); +- fc_release_transport(qla2xxx_transport_template); + ql_log(ql_log_fatal, NULL, 0x0004, + "fc_attach_transport vport failed...Failing load!.\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto unreg_chrdev; + } + ql_log(ql_log_info, NULL, 0x0005, + "QLogic Fibre Channel HBA Driver: %s.\n", + qla2x00_version_str); + ret = pci_register_driver(&qla2xxx_pci_driver); + if (ret) { +- kmem_cache_destroy(srb_cachep); +- qlt_exit(); +- fc_release_transport(qla2xxx_transport_template); +- fc_release_transport(qla2xxx_transport_vport_template); + ql_log(ql_log_fatal, NULL, 0x0006, + "pci_register_driver failed...ret=%d Failing load!.\n", + ret); ++ goto release_vport_transport; + } + return ret; ++ ++release_vport_transport: ++ fc_release_transport(qla2xxx_transport_vport_template); ++ ++unreg_chrdev: ++ if (apidev_major >= 0) ++ unregister_chrdev(apidev_major, QLA2XXX_APIDEV); ++ fc_release_transport(qla2xxx_transport_template); ++ ++qlt_exit: ++ qlt_exit(); ++ ++destroy_cache: ++ kmem_cache_destroy(srb_cachep); ++ return ret; + } + + /** +-- +2.20.1 + diff --git a/queue-4.14/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch b/queue-4.14/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch new file mode 100644 index 00000000000..5cd1aef20a6 --- /dev/null +++ b/queue-4.14/scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch @@ -0,0 +1,52 @@ +From dc1daaf43f15a19dc7e25b33d3771aa0e9f27ac7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Apr 2019 12:58:05 -0700 +Subject: scsi: target/core: Fix a race condition in the LUN lookup code + +From: Bart Van Assche + +[ Upstream commit 63f7479439c95bcd49b7dd4af809862c316c71a3 ] + +The rcu_dereference(deve->se_lun) expression occurs twice in the LUN lookup +functions. Since these expressions are not serialized against deve->se_lun +assignments each of these expressions may yield a different result. Avoid +that the wrong LUN pointer is stored in se_cmd by reading deve->se_lun only +once. + +Cc: Mike Christie +Cc: Christoph Hellwig +Cc: Hannes Reinecke +Cc: Nicholas Bellinger +Fixes: 29a05deebf6c ("target: Convert se_node_acl->device_list[] to RCU hlist") # v4.10 +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 92b52d2314b53..cebef8e5a43d1 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -85,7 +85,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun) + goto out_unlock; + } + +- se_cmd->se_lun = rcu_dereference(deve->se_lun); ++ se_cmd->se_lun = se_lun; + se_cmd->pr_res_key = deve->pr_res_key; + se_cmd->orig_fe_lun = unpacked_lun; + se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; +@@ -176,7 +176,7 @@ int transport_lookup_tmr_lun(struct se_cmd *se_cmd, u64 unpacked_lun) + goto out_unlock; + } + +- se_cmd->se_lun = rcu_dereference(deve->se_lun); ++ se_cmd->se_lun = se_lun; + se_cmd->pr_res_key = deve->pr_res_key; + se_cmd->orig_fe_lun = unpacked_lun; + se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; +-- +2.20.1 + diff --git a/queue-4.14/selftests-ipc-fix-msgque-compiler-warnings.patch b/queue-4.14/selftests-ipc-fix-msgque-compiler-warnings.patch new file mode 100644 index 00000000000..b96a3b926bb --- /dev/null +++ b/queue-4.14/selftests-ipc-fix-msgque-compiler-warnings.patch @@ -0,0 +1,76 @@ +From 29ffd9af3bb8ae4cdf72bc88f3824ebdca59944e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Apr 2019 10:13:44 -0700 +Subject: selftests/ipc: Fix msgque compiler warnings + +From: Kees Cook + +[ Upstream commit a147faa96f832f76e772b1e448e94ea84c774081 ] + +This fixes the various compiler warnings when building the msgque +selftest. The primary change is using sys/msg.h instead of linux/msg.h +directly to gain the API declarations. + +Fixes: 3a665531a3b7 ("selftests: IPC message queue copy feature test") +Signed-off-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/ipc/msgque.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/ipc/msgque.c b/tools/testing/selftests/ipc/msgque.c +index ee9382bdfadc8..c5587844fbb8c 100644 +--- a/tools/testing/selftests/ipc/msgque.c ++++ b/tools/testing/selftests/ipc/msgque.c +@@ -1,9 +1,10 @@ + // SPDX-License-Identifier: GPL-2.0 ++#define _GNU_SOURCE + #include + #include + #include + #include +-#include ++#include + #include + + #include "../kselftest.h" +@@ -73,7 +74,7 @@ int restore_queue(struct msgque_data *msgque) + return 0; + + destroy: +- if (msgctl(id, IPC_RMID, 0)) ++ if (msgctl(id, IPC_RMID, NULL)) + printf("Failed to destroy queue: %d\n", -errno); + return ret; + } +@@ -120,7 +121,7 @@ int check_and_destroy_queue(struct msgque_data *msgque) + + ret = 0; + err: +- if (msgctl(msgque->msq_id, IPC_RMID, 0)) { ++ if (msgctl(msgque->msq_id, IPC_RMID, NULL)) { + printf("Failed to destroy queue: %d\n", -errno); + return -errno; + } +@@ -129,7 +130,7 @@ err: + + int dump_queue(struct msgque_data *msgque) + { +- struct msqid64_ds ds; ++ struct msqid_ds ds; + int kern_id; + int i, ret; + +@@ -246,7 +247,7 @@ int main(int argc, char **argv) + return ksft_exit_pass(); + + err_destroy: +- if (msgctl(msgque.msq_id, IPC_RMID, 0)) { ++ if (msgctl(msgque.msq_id, IPC_RMID, NULL)) { + printf("Failed to destroy queue: %d\n", -errno); + return ksft_exit_fail(); + } +-- +2.20.1 + diff --git a/queue-4.14/serial-stm32-add-support-of-tc-bit-status-check.patch b/queue-4.14/serial-stm32-add-support-of-tc-bit-status-check.patch new file mode 100644 index 00000000000..3db963d0d5e --- /dev/null +++ b/queue-4.14/serial-stm32-add-support-of-tc-bit-status-check.patch @@ -0,0 +1,97 @@ +From cf5a53d8b515af6a1c9df3686a9b50a5ffa9991b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 17:45:45 +0200 +Subject: serial: stm32: Add support of TC bit status check + +From: Erwan Le Ray + +[ Upstream commit 64c32eab660386f9904bb295a104c9c425e9f8b2 ] + +Adds a check on the Transmission Complete bit status before closing the +com port. Prevents the port closure before the end of the transmission. +TC poll loop is moved from stm32_tx_dma_complete to stm32_shutdown +routine, in order to check TC before shutdown in both dma and +PIO tx modes. +TC clear is added in stm32_transmit_char routine, in order to be cleared +before transmitting in both dma and PIO tx modes. + +Fixes: 3489187204eb ("serial: stm32: adding dma support") +Signed-off-by: Erwan Le Ray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index a1e31913bcf9a..2384f786b76d1 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -180,21 +180,6 @@ static void stm32_tx_dma_complete(void *arg) + struct uart_port *port = arg; + struct stm32_port *stm32port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32port->info->ofs; +- unsigned int isr; +- int ret; +- +- ret = readl_relaxed_poll_timeout_atomic(port->membase + ofs->isr, +- isr, +- (isr & USART_SR_TC), +- 10, 100000); +- +- if (ret) +- dev_err(port->dev, "terminal count not set\n"); +- +- if (ofs->icr == UNDEF_REG) +- stm32_clr_bits(port, ofs->isr, USART_SR_TC); +- else +- stm32_set_bits(port, ofs->icr, USART_CR_TC); + + stm32_clr_bits(port, ofs->cr3, USART_CR3_DMAT); + stm32port->tx_dma_busy = false; +@@ -286,7 +271,6 @@ static void stm32_transmit_chars_dma(struct uart_port *port) + /* Issue pending DMA TX requests */ + dma_async_issue_pending(stm32port->tx_ch); + +- stm32_clr_bits(port, ofs->isr, USART_SR_TC); + stm32_set_bits(port, ofs->cr3, USART_CR3_DMAT); + + xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1); +@@ -315,6 +299,11 @@ static void stm32_transmit_chars(struct uart_port *port) + return; + } + ++ if (ofs->icr == UNDEF_REG) ++ stm32_clr_bits(port, ofs->isr, USART_SR_TC); ++ else ++ stm32_set_bits(port, ofs->icr, USART_ICR_TCCF); ++ + if (stm32_port->tx_ch) + stm32_transmit_chars_dma(port); + else +@@ -491,12 +480,21 @@ static void stm32_shutdown(struct uart_port *port) + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; + struct stm32_usart_config *cfg = &stm32_port->info->cfg; +- u32 val; ++ u32 val, isr; ++ int ret; + + val = USART_CR1_TXEIE | USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE; + val |= BIT(cfg->uart_enable_bit); + if (stm32_port->fifoen) + val |= USART_CR1_FIFOEN; ++ ++ ret = readl_relaxed_poll_timeout(port->membase + ofs->isr, ++ isr, (isr & USART_SR_TC), ++ 10, 100000); ++ ++ if (ret) ++ dev_err(port->dev, "transmission complete not set\n"); ++ + stm32_clr_bits(port, ofs->cr1, val); + + dev_pm_clear_wake_irq(port->dev); +-- +2.20.1 + diff --git a/queue-4.14/serial-stm32-fix-clearing-interrupt-error-flags.patch b/queue-4.14/serial-stm32-fix-clearing-interrupt-error-flags.patch new file mode 100644 index 00000000000..a4cf3797276 --- /dev/null +++ b/queue-4.14/serial-stm32-fix-clearing-interrupt-error-flags.patch @@ -0,0 +1,52 @@ +From 884351c1f7b9a0745586f55043cc48308d1155f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2019 09:10:49 +0100 +Subject: serial: stm32: fix clearing interrupt error flags + +From: Fabrice Gasnier + +[ Upstream commit 1250ed7114a977cdc2a67a0c09d6cdda63970eb9 ] + +The interrupt clear flag register is a "write 1 to clear" register. +So, only writing ones allows to clear flags: +- Replace buggy stm32_clr_bits() by a simple write to clear error flags +- Replace useless read/modify/write stm32_set_bits() routine by a + simple write to clear TC (transfer complete) flag. + +Fixes: 4f01d833fdcd ("serial: stm32: fix rx error handling") +Signed-off-by: Fabrice Gasnier +Cc: stable +Link: https://lore.kernel.org/r/1574323849-1909-1-git-send-email-fabrice.gasnier@st.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index f8f3f8fafd9f0..1e854e1851fbb 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -132,8 +132,8 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + * cleared by the sequence [read SR - read DR]. + */ + if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG) +- stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF | +- USART_ICR_PECF | USART_ICR_FECF); ++ writel_relaxed(sr & USART_SR_ERR_MASK, ++ port->membase + ofs->icr); + + c = stm32_get_char(port, &sr, &stm32_port->last_res); + port->icount.rx++; +@@ -302,7 +302,7 @@ static void stm32_transmit_chars(struct uart_port *port) + if (ofs->icr == UNDEF_REG) + stm32_clr_bits(port, ofs->isr, USART_SR_TC); + else +- stm32_set_bits(port, ofs->icr, USART_ICR_TCCF); ++ writel_relaxed(USART_ICR_TCCF, port->membase + ofs->icr); + + if (stm32_port->tx_ch) + stm32_transmit_chars_dma(port); +-- +2.20.1 + diff --git a/queue-4.14/serial-stm32-fix-rx-error-handling.patch b/queue-4.14/serial-stm32-fix-rx-error-handling.patch new file mode 100644 index 00000000000..2c0e99cb427 --- /dev/null +++ b/queue-4.14/serial-stm32-fix-rx-error-handling.patch @@ -0,0 +1,164 @@ +From 73049368ed8b10ceab693dc294bcd8fea754638c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 17:45:42 +0200 +Subject: serial: stm32: fix rx error handling + +From: Erwan Le Ray + +[ Upstream commit 4f01d833fdcdd6f9b85d9e5d5d7568eb683626a7 ] + +- Fixes parity and framing error bit by clearing parity and framing error + flag. The current implementation doesn't clear the error bits when an + error is detected. +- Fixes the incorrect name of framing error clearing flag in header file. +- Fixes misalignement between data frame and errors status. The status + read for "n" frame was the status of "n+1" frame". +- Fixes break detection was not triggered by the expected register. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 54 +++++++++++++++++++++----------- + drivers/tty/serial/stm32-usart.h | 10 ++---- + 2 files changed, 37 insertions(+), 27 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 03a583264d9ec..c435900773723 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -118,35 +118,51 @@ static void stm32_receive_chars(struct uart_port *port, bool threaded) + + while (stm32_pending_rx(port, &sr, &stm32_port->last_res, threaded)) { + sr |= USART_SR_DUMMY_RX; +- c = stm32_get_char(port, &sr, &stm32_port->last_res); + flag = TTY_NORMAL; +- port->icount.rx++; + ++ /* ++ * Status bits has to be cleared before reading the RDR: ++ * In FIFO mode, reading the RDR will pop the next data ++ * (if any) along with its status bits into the SR. ++ * Not doing so leads to misalignement between RDR and SR, ++ * and clear status bits of the next rx data. ++ * ++ * Clear errors flags for stm32f7 and stm32h7 compatible ++ * devices. On stm32f4 compatible devices, the error bit is ++ * cleared by the sequence [read SR - read DR]. ++ */ ++ if ((sr & USART_SR_ERR_MASK) && ofs->icr != UNDEF_REG) ++ stm32_clr_bits(port, ofs->icr, USART_ICR_ORECF | ++ USART_ICR_PECF | USART_ICR_FECF); ++ ++ c = stm32_get_char(port, &sr, &stm32_port->last_res); ++ port->icount.rx++; + if (sr & USART_SR_ERR_MASK) { +- if (sr & USART_SR_LBD) { +- port->icount.brk++; +- if (uart_handle_break(port)) +- continue; +- } else if (sr & USART_SR_ORE) { +- if (ofs->icr != UNDEF_REG) +- writel_relaxed(USART_ICR_ORECF, +- port->membase + +- ofs->icr); ++ if (sr & USART_SR_ORE) { + port->icount.overrun++; + } else if (sr & USART_SR_PE) { + port->icount.parity++; + } else if (sr & USART_SR_FE) { +- port->icount.frame++; ++ /* Break detection if character is null */ ++ if (!c) { ++ port->icount.brk++; ++ if (uart_handle_break(port)) ++ continue; ++ } else { ++ port->icount.frame++; ++ } + } + + sr &= port->read_status_mask; + +- if (sr & USART_SR_LBD) +- flag = TTY_BREAK; +- else if (sr & USART_SR_PE) ++ if (sr & USART_SR_PE) { + flag = TTY_PARITY; +- else if (sr & USART_SR_FE) +- flag = TTY_FRAME; ++ } else if (sr & USART_SR_FE) { ++ if (!c) ++ flag = TTY_BREAK; ++ else ++ flag = TTY_FRAME; ++ } + } + + if (uart_handle_sysrq_char(port, c)) +@@ -569,14 +585,14 @@ static void stm32_set_termios(struct uart_port *port, struct ktermios *termios, + if (termios->c_iflag & INPCK) + port->read_status_mask |= USART_SR_PE | USART_SR_FE; + if (termios->c_iflag & (IGNBRK | BRKINT | PARMRK)) +- port->read_status_mask |= USART_SR_LBD; ++ port->read_status_mask |= USART_SR_FE; + + /* Characters to ignore */ + port->ignore_status_mask = 0; + if (termios->c_iflag & IGNPAR) + port->ignore_status_mask = USART_SR_PE | USART_SR_FE; + if (termios->c_iflag & IGNBRK) { +- port->ignore_status_mask |= USART_SR_LBD; ++ port->ignore_status_mask |= USART_SR_FE; + /* + * If we're ignoring parity and break indicators, + * ignore overruns too (for real raw support). +diff --git a/drivers/tty/serial/stm32-usart.h b/drivers/tty/serial/stm32-usart.h +index ffc0c5285e511..9d087881913aa 100644 +--- a/drivers/tty/serial/stm32-usart.h ++++ b/drivers/tty/serial/stm32-usart.h +@@ -108,7 +108,6 @@ struct stm32_usart_info stm32h7_info = { + #define USART_SR_RXNE BIT(5) + #define USART_SR_TC BIT(6) + #define USART_SR_TXE BIT(7) +-#define USART_SR_LBD BIT(8) + #define USART_SR_CTSIF BIT(9) + #define USART_SR_CTS BIT(10) /* F7 */ + #define USART_SR_RTOF BIT(11) /* F7 */ +@@ -120,8 +119,7 @@ struct stm32_usart_info stm32h7_info = { + #define USART_SR_SBKF BIT(18) /* F7 */ + #define USART_SR_WUF BIT(20) /* H7 */ + #define USART_SR_TEACK BIT(21) /* F7 */ +-#define USART_SR_ERR_MASK (USART_SR_LBD | USART_SR_ORE | \ +- USART_SR_FE | USART_SR_PE) ++#define USART_SR_ERR_MASK (USART_SR_ORE | USART_SR_FE | USART_SR_PE) + /* Dummy bits */ + #define USART_SR_DUMMY_RX BIT(16) + +@@ -166,8 +164,6 @@ struct stm32_usart_info stm32h7_info = { + /* USART_CR2 */ + #define USART_CR2_ADD_MASK GENMASK(3, 0) /* F4 */ + #define USART_CR2_ADDM7 BIT(4) /* F7 */ +-#define USART_CR2_LBDL BIT(5) +-#define USART_CR2_LBDIE BIT(6) + #define USART_CR2_LBCL BIT(8) + #define USART_CR2_CPHA BIT(9) + #define USART_CR2_CPOL BIT(10) +@@ -224,12 +220,10 @@ struct stm32_usart_info stm32h7_info = { + + /* USART_ICR */ + #define USART_ICR_PECF BIT(0) /* F7 */ +-#define USART_ICR_FFECF BIT(1) /* F7 */ +-#define USART_ICR_NCF BIT(2) /* F7 */ ++#define USART_ICR_FECF BIT(1) /* F7 */ + #define USART_ICR_ORECF BIT(3) /* F7 */ + #define USART_ICR_IDLECF BIT(4) /* F7 */ + #define USART_ICR_TCCF BIT(6) /* F7 */ +-#define USART_ICR_LBDCF BIT(8) /* F7 */ + #define USART_ICR_CTSCF BIT(9) /* F7 */ + #define USART_ICR_RTOCF BIT(11) /* F7 */ + #define USART_ICR_EOBCF BIT(12) /* F7 */ +-- +2.20.1 + diff --git a/queue-4.14/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch b/queue-4.14/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch new file mode 100644 index 00000000000..40b400db343 --- /dev/null +++ b/queue-4.14/serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch @@ -0,0 +1,52 @@ +From 45b18b9c311cf2803c867f97578a56912bd6887c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 17:45:44 +0200 +Subject: serial: stm32: fix transmit_chars when tx is stopped + +From: Erwan Le Ray + +[ Upstream commit b83b957c91f68e53f0dc596e129e8305761f2a32 ] + +Disables the tx irq when the transmission is ended and updates stop_tx +conditions for code cleanup. + +Fixes: 48a6092fb41f ("serial: stm32-usart: Add STM32 USART Driver") +Signed-off-by: Erwan Le Ray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index c435900773723..a1e31913bcf9a 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -310,13 +310,8 @@ static void stm32_transmit_chars(struct uart_port *port) + return; + } + +- if (uart_tx_stopped(port)) { +- stm32_stop_tx(port); +- return; +- } +- +- if (uart_circ_empty(xmit)) { +- stm32_stop_tx(port); ++ if (uart_circ_empty(xmit) || uart_tx_stopped(port)) { ++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE); + return; + } + +@@ -329,7 +324,7 @@ static void stm32_transmit_chars(struct uart_port *port) + uart_write_wakeup(port); + + if (uart_circ_empty(xmit)) +- stm32_stop_tx(port); ++ stm32_clr_bits(port, ofs->cr1, USART_CR1_TXEIE); + } + + static irqreturn_t stm32_interrupt(int irq, void *ptr) +-- +2.20.1 + diff --git a/queue-4.14/serial-stm32-fix-wakeup-source-initialization.patch b/queue-4.14/serial-stm32-fix-wakeup-source-initialization.patch new file mode 100644 index 00000000000..93d4a380469 --- /dev/null +++ b/queue-4.14/serial-stm32-fix-wakeup-source-initialization.patch @@ -0,0 +1,102 @@ +From 527448fc28b9f8e9fd2afef788d70335afdd8158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 May 2019 17:45:46 +0200 +Subject: serial: stm32: fix wakeup source initialization + +From: Erwan Le Ray + +[ Upstream commit 5297f274e8b61ceb9676cba6649d3de9d03387ad ] + +Fixes dedicated_irq_wakeup issue and deactivated uart as wakeup source by +default. + +Fixes: 270e5a74fe4c ("serial: stm32: add wakeup mechanism") +Signed-off-by: Erwan Le Ray +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 28 +++++++++++++++------------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 2384f786b76d1..f8f3f8fafd9f0 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -447,7 +447,6 @@ static int stm32_startup(struct uart_port *port) + { + struct stm32_port *stm32_port = to_stm32_port(port); + struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- struct stm32_usart_config *cfg = &stm32_port->info->cfg; + const char *name = to_platform_device(port->dev)->name; + u32 val; + int ret; +@@ -458,15 +457,6 @@ static int stm32_startup(struct uart_port *port) + if (ret) + return ret; + +- if (cfg->has_wakeup && stm32_port->wakeirq >= 0) { +- ret = dev_pm_set_dedicated_wake_irq(port->dev, +- stm32_port->wakeirq); +- if (ret) { +- free_irq(port->irq, port); +- return ret; +- } +- } +- + val = USART_CR1_RXNEIE | USART_CR1_TE | USART_CR1_RE; + if (stm32_port->fifoen) + val |= USART_CR1_FIFOEN; +@@ -497,7 +487,6 @@ static void stm32_shutdown(struct uart_port *port) + + stm32_clr_bits(port, ofs->cr1, val); + +- dev_pm_clear_wake_irq(port->dev); + free_irq(port->irq, port); + } + +@@ -904,11 +893,18 @@ static int stm32_serial_probe(struct platform_device *pdev) + ret = device_init_wakeup(&pdev->dev, true); + if (ret) + goto err_uninit; ++ ++ ret = dev_pm_set_dedicated_wake_irq(&pdev->dev, ++ stm32port->wakeirq); ++ if (ret) ++ goto err_nowup; ++ ++ device_set_wakeup_enable(&pdev->dev, false); + } + + ret = uart_add_one_port(&stm32_usart_driver, &stm32port->port); + if (ret) +- goto err_nowup; ++ goto err_wirq; + + ret = stm32_of_dma_rx_probe(stm32port, pdev); + if (ret) +@@ -922,6 +918,10 @@ static int stm32_serial_probe(struct platform_device *pdev) + + return 0; + ++err_wirq: ++ if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0) ++ dev_pm_clear_wake_irq(&pdev->dev); ++ + err_nowup: + if (stm32port->info->cfg.has_wakeup && stm32port->wakeirq >= 0) + device_init_wakeup(&pdev->dev, false); +@@ -959,8 +959,10 @@ static int stm32_serial_remove(struct platform_device *pdev) + TX_BUF_L, stm32_port->tx_buf, + stm32_port->tx_dma_buf); + +- if (cfg->has_wakeup && stm32_port->wakeirq >= 0) ++ if (cfg->has_wakeup && stm32_port->wakeirq >= 0) { ++ dev_pm_clear_wake_irq(&pdev->dev); + device_init_wakeup(&pdev->dev, false); ++ } + + clk_disable_unprepare(stm32_port->clk); + +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index 13e8a486c87..8e751f1504b 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -5,3 +5,339 @@ tipc-fix-wrong-timeout-input-for-tipc_wait_for_cond.patch mt7601u-fix-bbp-version-check-in-mt7601u_wait_bbp_ready.patch crypto-sun4i-ss-fix-big-endian-issues.patch leds-tlc591xx-update-the-maximum-brightness.patch +drm-sti-do-not-remove-the-drm_bridge-that-was-never-.patch +drm-virtio-fix-bounds-check-in-virtio_gpu_cmd_get_ca.patch +alsa-hda-fix-unused-variable-warning.patch +apparmor-don-t-try-to-replace-stale-label-in-ptrace-.patch +pci-iproc-remove-paxc-slot-check-to-allow-vf-support.patch +drm-hisilicon-hibmc-don-t-overwrite-fb-helper-surfac.patch +ib-rxe-replace-kvfree-with-vfree.patch +ib-hfi1-add-mtu-check-for-operational-data-vls.patch +regulator-fixed-default-enable-high-on-dt-regulators.patch +alsa-usb-audio-update-quirk-for-b-w-px-to-remove-mic.patch +staging-comedi-ni_mio_common-protect-register-write-.patch +pwm-lpss-release-runtime-pm-reference-from-the-drive.patch +powerpc-kgdb-add-kgdb_arch_set-remove_breakpoint.patch +drm-sun4i-hdmi-fix-double-flag-assignation.patch +mlxsw-reg-qeec-add-minimum-shaper-fields.patch +ntb-ntb_hw_idt-replace-is_err_or_null-with-regular-n.patch +pcrypt-use-format-specifier-in-kobject_add.patch +exportfs-fix-passing-zero-to-err_ptr-warning.patch +drm-dp_mst-skip-validating-ports-during-destruction-.patch +net-phy-fix-not-to-call-phy_resume-if-phy-is-not-att.patch +ib-rxe-fix-incorrect-cache-cleanup-in-error-flow.patch +staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch +switchtec-remove-immediate-status-check-after-submit.patch +pinctrl-sh-pfc-r8a7740-add-missing-ref125ck-pin-to-g.patch +pinctrl-sh-pfc-r8a7740-add-missing-lcd0-marks-to-lcd.patch +pinctrl-sh-pfc-r8a7791-remove-bogus-ctrl-marks-from-.patch +pinctrl-sh-pfc-r8a7791-remove-bogus-marks-from-vin1_.patch +pinctrl-sh-pfc-sh73a0-add-missing-to-pin-to-tpu4_to3.patch +pinctrl-sh-pfc-r8a7794-remove-bogus-ipsr9-field.patch +pinctrl-sh-pfc-sh7734-add-missing-ipsr11-field.patch +pinctrl-sh-pfc-r8a77995-remove-bogus-sel_pwm-0-3-_3-.patch +pinctrl-sh-pfc-sh7269-add-missing-pcior0-field.patch +pinctrl-sh-pfc-sh7734-remove-bogus-ipsr10-value.patch +vxlan-changelink-fix-handling-of-default-remotes.patch +input-nomadik-ske-keypad-fix-a-loop-timeout-test.patch +clk-highbank-fix-refcount-leak-in-hb_clk_init.patch +clk-qoriq-fix-refcount-leak-in-clockgen_init.patch +clk-socfpga-fix-refcount-leak.patch +clk-samsung-exynos4-fix-refcount-leak-in-exynos4_get.patch +clk-imx6q-fix-refcount-leak-in-imx6q_clocks_init.patch +clk-imx6sx-fix-refcount-leak-in-imx6sx_clocks_init.patch +clk-imx7d-fix-refcount-leak-in-imx7d_clocks_init.patch +clk-vf610-fix-refcount-leak-in-vf610_clocks_init.patch +clk-armada-370-fix-refcount-leak-in-a370_clk_init.patch +clk-kirkwood-fix-refcount-leak-in-kirkwood_clk_init.patch +clk-armada-xp-fix-refcount-leak-in-axp_clk_init.patch +clk-mv98dx3236-fix-refcount-leak-in-mv98dx3236_clk_i.patch +clk-dove-fix-refcount-leak-in-dove_clk_init.patch +mips-bcm63xx-drop-unused-and-broken-dsp-platform-dev.patch +ib-usnic-fix-out-of-bounds-index-check-in-query-pkey.patch +rdma-ocrdma-fix-out-of-bounds-index-check-in-query-p.patch +rdma-qedr-fix-out-of-bounds-index-check-in-query-pke.patch +drm-shmob-fix-return-value-check-in-shmob_drm_probe.patch +arm64-dts-apq8016-sbc-increase-load-on-l11-for-sdcar.patch +spi-cadence-correct-initialisation-of-runtime-pm.patch +rdma-iw_cxgb4-fix-the-unchecked-ep-dereference.patch +drm-etnaviv-null-vs-is_err-buf-in-etnaviv_core_dump.patch +media-s5p-jpeg-correct-step-and-max-values-for-v4l2_.patch +kbuild-mark-prepare0-as-phony-to-fix-external-module.patch +crypto-brcm-fix-some-set-but-not-used-warning.patch +crypto-tgr192-fix-unaligned-memory-access.patch +asoc-imx-sgtl5000-put-of-nodes-if-finding-codec-fail.patch +ib-iser-pass-the-correct-number-of-entries-for-dma-m.patch +rtc-cmos-ignore-bogus-century-byte.patch +spi-topcliff_pch-fix-potential-null-dereference-on-a.patch +clk-sunxi-ng-sun8i-a23-enable-pll-mipi-ldos-when-ung.patch +iwlwifi-mvm-avoid-possible-access-out-of-array.patch +net-mlx5-take-lock-with-irqs-disabled-to-avoid-deadl.patch +iwlwifi-mvm-fix-a-mpdu-reference-assignment.patch +tty-ipwireless-fix-potential-null-pointer-dereferenc.patch +driver-uio-fix-possible-memory-leak-in-__uio_registe.patch +driver-uio-fix-possible-use-after-free-in-__uio_regi.patch +crypto-crypto4xx-fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch +driver-core-do-not-resume-suppliers-under-device_lin.patch +arm-dts-lpc32xx-add-required-clocks-property-to-keyp.patch +arm-dts-lpc32xx-reparent-keypad-controller-to-sic1.patch +arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-var.patch +arm-dts-lpc32xx-fix-arm-primecell-lcd-controller-clo.patch +arm-dts-lpc32xx-phy3250-fix-sd-card-regulator-voltag.patch +iwlwifi-mvm-fix-rss-config-command.patch +staging-most-cdev-add-missing-check-for-cdev_add-fai.patch +rtc-ds1672-fix-unintended-sign-extension.patch +thermal-mediatek-fix-register-index-error.patch +net-phy-fixed_phy-fix-fixed_phy-not-checking-gpio.patch +rtc-ds1307-rx8130-fix-alarm-handling.patch +rtc-88pm860x-fix-unintended-sign-extension.patch +rtc-88pm80x-fix-unintended-sign-extension.patch +rtc-pm8xxx-fix-unintended-sign-extension.patch +fbdev-chipsfb-remove-set-but-not-used-variable-size.patch +iw_cxgb4-use-tos-when-importing-the-endpoint.patch +iw_cxgb4-use-tos-when-finding-ipv6-routes.patch +drm-etnaviv-potential-null-dereference.patch +pinctrl-sh-pfc-emev2-add-missing-pinmux-functions.patch +pinctrl-sh-pfc-r8a7791-fix-scifb2_data_c-pin-group.patch +pinctrl-sh-pfc-r8a7792-fix-vin1_data18_b-pin-group.patch +pinctrl-sh-pfc-sh73a0-fix-fsic_spdif-pin-groups.patch +pci-endpoint-functions-use-memcpy_fromio-memcpy_toio.patch +usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch +block-don-t-use-bio-bi_vcnt-to-figure-out-segment-nu.patch +keys-timestamp-new-keys.patch +vfio_pci-enable-memory-accesses-before-calling-pci_m.patch +hwmon-pmbus-tps53679-fix-driver-info-initialization-.patch +kvm-ppc-release-all-hardware-tce-tables-attached-to-.patch +staging-r8822be-check-kzalloc-return-or-bail.patch +dmaengine-mv_xor-use-correct-device-for-dma-api.patch +cdc-wdm-pass-return-value-of-recover_from_urb_loss.patch +regulator-pv88060-fix-array-out-of-bounds-access.patch +regulator-pv88080-fix-array-out-of-bounds-access.patch +regulator-pv88090-fix-array-out-of-bounds-access.patch +net-dsa-qca8k-enable-delay-for-rgmii_id-mode.patch +drm-nouveau-bios-ramcfg-fix-missing-parentheses-when.patch +drm-nouveau-pmu-don-t-print-reply-values-if-exec-is-.patch +asoc-qcom-fix-of-node-refcount-unbalance-in-apq8016_.patch +fs-nfs-fix-nfs_parse_devname-to-not-modify-it-s-argu.patch +staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch +powerpc-64s-fix-logic-when-handling-unknown-cpu-feat.patch +nfs-fix-a-soft-lockup-in-the-delegation-recovery-cod.patch +clocksource-drivers-sun5i-fail-gracefully-when-clock.patch +clocksource-drivers-exynos_mct-fix-error-path-in-tim.patch +platform-x86-wmi-fix-potential-null-pointer-derefere.patch +nfs-pnfs-bulk-destroy-of-layouts-needs-to-be-safe-w..patch +mmc-sdhci-brcmstb-handle-mmc_of_parse-errors-during-.patch +arm-8847-1-pm-fix-hyp-svc-mode-mismatch-when-mcpm-is.patch +arm-8848-1-virt-align-gic-version-check-with-arm64-c.patch +regulator-wm831x-dcdc-fix-list-of-wm831x_dcdc_ilim-f.patch +netfilter-nft_set_hash-fix-lookups-with-fixed-size-h.patch +nfsv4-flexfiles-fix-invalid-deref-in-ff_layout_devid.patch +net-aquantia-fixed-instack-structure-overflow.patch +powerpc-mm-check-secondary-hash-page-table.patch +nios2-ksyms-add-missing-symbol-exports.patch +x86-mm-remove-unused-variable-cpu.patch +scsi-megaraid_sas-reduce-module-load-time.patch +drivers-rapidio-rio_cm.c-fix-potential-oops-in-riocm.patch +xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch +net-sh_eth-fix-a-missing-check-of-of_get_phy_mode.patch +regulator-lp87565-fix-missing-register-for-lp87565_b.patch +media-ivtv-update-pos-correctly-in-ivtv_read_pos.patch +media-cx18-update-pos-correctly-in-cx18_read_pos.patch +media-wl128x-fix-an-error-code-in-fm_download_firmwa.patch +media-cx23885-check-allocation-return.patch +regulator-tps65086-fix-tps65086_ldoa1_ranges-for-sel.patch +jfs-fix-bogus-variable-self-initialization.patch +tipc-tipc-clang-warning.patch +m68k-mac-fix-via-timer-counter-accesses.patch +arm64-dts-allwinner-a64-add-missing-pio-clocks.patch +arm-omap2-fix-potentially-uninitialized-return-value.patch +media-davinci-isif-avoid-uninitialized-variable-use.patch +media-tw5864-fix-possible-null-pointer-dereference-i.patch +spi-tegra114-clear-packed-bit-for-unpacked-mode.patch +spi-tegra114-fix-for-unpacked-mode-transfers.patch +spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch +spi-tegra114-flush-fifos.patch +spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch +soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch +spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch +ehea-fix-a-copy-paste-err-in-ehea_init_port_res.patch +scsi-qla2xxx-unregister-chrdev-if-module-initializat.patch +scsi-target-core-fix-a-race-condition-in-the-lun-loo.patch +arm-pxa-ssp-fix-warning-invalid-free-of-devm_-alloca.patch +net-hns3-fix-for-vport-bw_limit-overflow-problem.patch +hwmon-w83627hf-use-request_muxed_region-for-super-io.patch +platform-x86-alienware-wmi-fix-kfree-on-potentially-.patch +tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch +selftests-ipc-fix-msgque-compiler-warnings.patch +powerpc-vdso-make-vdso32-installation-conditional-in.patch +arm-dts-ls1021-fix-sgmii-pcs-link-remaining-down-aft.patch +media-ov2659-fix-unbalanced-mutex_lock-unlock.patch +6lowpan-off-by-one-handling-nexthdr.patch +dmaengine-axi-dmac-don-t-check-the-number-of-frames-.patch +alsa-usb-audio-handle-the-error-from-snd_usb_mixer_a.patch +nfs-don-t-interrupt-file-writeout-due-to-fatal-error.patch +irqchip-gic-v3-its-fix-some-definitions-of-inner-cac.patch +scsi-qla2xxx-fix-a-format-specifier.patch +scsi-qla2xxx-avoid-that-qlt_send_resp_ctio-corrupts-.patch +packet-in-recvmsg-msg_name-return-at-least-sizeof-so.patch +asoc-fix-valid-stream-condition.patch +usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch +dwc2-gadget-fix-completed-transfer-size-calculation-.patch +ib-mlx5-add-missing-xrc-options-to-qp-optional-param.patch +iommu-vt-d-make-kernel-parameter-igfx_off-work-with-.patch +net-ena-fix-swapped-parameters-when-calling-ena_com_.patch +net-ena-fix-free-napi-resources-when-ena_up-fails.patch +net-ena-fix-incorrect-test-of-supported-hash-functio.patch +net-ena-fix-ena_com_fill_hash_function-implementatio.patch +dmaengine-tegra210-adma-restore-channel-status.patch +mmc-core-fix-possible-use-after-free-of-host.patch +lightnvm-pblk-fix-lock-order-in-pblk_rb_tear_down_ch.patch +afs-fix-the-afs.cell-and-afs.volume-xattr-handlers.patch +vfio-mdev-avoid-release-parent-reference-during-erro.patch +vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch +l2tp-fix-possible-null-pointer-dereference.patch +media-omap_vout-potential-buffer-overflow-in-vidioc_.patch +media-davinci-vpbe-array-underflow-in-vpbe_enum_outp.patch +platform-x86-alienware-wmi-printing-the-wrong-error-.patch +crypto-caam-fix-caam_dump_sg-that-iterates-through-s.patch +netfilter-ebtables-config_compat-reject-trailing-dat.patch +pwm-meson-consider-128-a-valid-pre-divider.patch +pwm-meson-don-t-disable-pwm-when-setting-duty-repeat.patch +arm-riscpc-fix-lack-of-keyboard-interrupts-after-irq.patch +kdb-do-a-sanity-check-on-the-cpu-in-kdb_per_cpu.patch +backlight-lm3630a-return-0-on-success-in-update_stat.patch +thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch +edac-mc-fix-edac_mc_find-in-case-no-device-is-found.patch +arm-dts-sun8i-h3-fix-wifi-in-beelink-x2-dt.patch +dmaengine-tegra210-adma-fix-crash-during-probe.patch +arm64-dts-meson-libretech-cc-set-emmc-as-removable.patch +rdma-qedr-fix-incorrect-device-rate.patch +spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch +crypto-ccp-fix-aes-cfb-error-exposed-by-new-test-vec.patch +crypto-ccp-fix-3des-complaint-from-ccp-crypto-module.patch +serial-stm32-fix-rx-error-handling.patch +serial-stm32-fix-transmit_chars-when-tx-is-stopped.patch +serial-stm32-add-support-of-tc-bit-status-check.patch +serial-stm32-fix-wakeup-source-initialization.patch +misc-sgi-xp-properly-initialize-buf-in-xpc_get_rsvd_.patch +pci-pm-avoid-possible-suspend-to-idle-issue.patch +iommu-use-right-function-to-get-group-for-device.patch +signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch +inet-frags-call-inet_frags_fini-after-unregister_per.patch +netvsc-unshare-skb-in-vf-rx-handler.patch +cpufreq-brcmstb-avs-cpufreq-fix-initial-command-chec.patch +cpufreq-brcmstb-avs-cpufreq-fix-types-for-voltage-fr.patch +media-vivid-fix-incorrect-assignment-operation-when-.patch +mpls-fix-warning-with-multi-label-encap.patch +iommu-vt-d-duplicate-iommu_resv_region-objects-per-d.patch +qed-iwarp-use-read_once-and-smp_store_release-to-acc.patch +powerpc-cacheinfo-add-cacheinfo_teardown-cacheinfo_r.patch +powerpc-pseries-mobility-rebuild-cacheinfo-hierarchy.patch +drm-msm-mdp5-fix-mdp5_cfg_init-error-return.patch +net-netem-fix-backlog-accounting-for-corrupted-gso-f.patch +net-af_iucv-always-register-net_device-notifier.patch +asoc-ti-davinci-mcasp-fix-slot-mask-settings-when-us.patch +rtc-pcf8563-fix-interrupt-trigger-method.patch +rtc-pcf8563-clear-event-flags-and-disable-interrupts.patch +drm-msm-a3xx-remove-tpl1-regs-from-snapshot.patch +perf-ioctl-add-check-for-the-sample_period-value.patch +dmaengine-hsu-revert-set-hsu_ch_mtsr-to-memory-width.patch +clk-qcom-fix-wunused-const-variable.patch +nvmem-imx-ocotp-ensure-wait-bits-are-preserved-when-.patch +bnxt_en-fix-ethtool-selftest-crash-under-error-condi.patch +iommu-amd-make-iommu_disable-safer.patch +mfd-intel-lpss-release-ida-resources.patch +rxrpc-fix-uninitialized-error-code-in-rxrpc_send_dat.patch +devres-allow-const-resource-arguments.patch +rdma-hns-fixs-hw-access-invalid-dma-memory-error.patch +net-pasemi-fix-an-use-after-free-in-pasemi_mac_phy_i.patch +scsi-libfc-fix-null-pointer-dereference-on-a-null-lp.patch +clk-sunxi-ng-v3s-add-the-missing-pll_ddr1.patch +pm-sleep-fix-possible-overflow-in-pm_system_cancel_w.patch +libertas_tf-use-correct-channel-range-in-lbtf_geo_in.patch +qed-reduce-maximum-stack-frame-size.patch +usb-host-xhci-hub-fix-extra-endianness-conversion.patch +mic-avoid-statically-declaring-a-struct-device.patch +x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch +crypto-ccp-reduce-maximum-stack-usage.patch +alsa-aoa-onyx-always-initialize-register-read-value.patch +tipc-reduce-risk-of-wakeup-queue-starvation.patch +arm-dts-stm32-add-missing-vdda-supply-to-adc-on-stm3.patch +net-mlx5-fix-mlx5_ifc_query_lag_out_bits.patch +cifs-fix-rmmod-regression-in-cifs.ko-caused-by-force.patch +crypto-caam-free-resources-in-case-caam_rng-registra.patch +ext4-set-error-return-correctly-when-ext4_htree_stor.patch +asoc-es8328-fix-copy-paste-error-in-es8328_right_lin.patch +asoc-cs4349-use-pm-ops-cs4349_runtime_pm.patch +asoc-wm8737-fix-copy-paste-error-in-wm8737_snd_contr.patch +net-rds-add-a-few-missing-rds_stat_names-entries.patch +bnxt_en-fix-handling-frag_err-when-nvm_install_updat.patch +signal-allow-cifs-and-drbd-to-receive-their-terminat.patch +asoc-sun4i-i2s-rx-and-tx-counter-registers-are-swapp.patch +dmaengine-dw-platform-switch-to-acpi_dma_controller_.patch +mac80211-minstrel_ht-fix-per-group-max-throughput-ra.patch +media-atmel-atmel-isi-fix-timeout-value-for-stop-str.patch +rtc-pcf2127-bugfix-read-rtc-disables-watchdog.patch +mips-avoid-explicit-ub-in-assignment-of-mips_io_port.patch +iommu-mediatek-fix-iova_to_phys-pa-start-for-4gb-mod.patch +ahci-do-not-export-local-variable-ahci_em_messages.patch +partially-revert-kfifo-fix-kfifo_alloc-and-kfifo_ini.patch +hwmon-lm75-fix-write-operations-for-negative-tempera.patch +power-supply-init-device-wakeup-after-device_add.patch +x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch +staging-greybus-light-fix-a-couple-double-frees.patch +irqdomain-add-the-missing-assignment-of-domain-fwnod.patch +bcma-fix-incorrect-update-of-bcma_core_pci_mdio_data.patch +iio-dac-ad5380-fix-incorrect-assignment-to-val.patch +ath9k-dynack-fix-possible-deadlock-in-ath_dynack_nod.patch +tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch +net-sonic-return-netdev_tx_ok-if-failed-to-map-buffe.patch +scsi-fnic-fix-msix-interrupt-allocation.patch +btrfs-fix-hang-when-loading-existing-inode-cache-off.patch +btrfs-fix-inode-cache-waiters-hanging-on-failure-to-.patch +btrfs-fix-inode-cache-waiters-hanging-on-path-alloca.patch +btrfs-use-correct-count-in-btrfs_file_write_iter.patch +ixgbe-sync-the-first-fragment-unconditionally.patch +hwmon-shtc1-fix-shtc1-and-shtw1-id-mask.patch +net-sonic-replace-dev_kfree_skb-in-sonic_send_packet.patch +pinctrl-iproc-gpio-fix-incorrect-pinconf-configurati.patch +ath10k-adjust-skb-length-in-ath10k_sdio_mbox_rx_pack.patch +rdma-cma-fix-false-error-message.patch +net-rds-fix-ib_evt_handler_call-element-in-rds_ib_st.patch +iommu-amd-wait-for-completion-of-iotlb-flush-in-atta.patch +net-aquantia-fix-aq_vec_isr_legacy-return-value.patch +net-hisilicon-fix-signedness-bug-in-hix5hd2_dev_prob.patch +net-broadcom-bcmsysport-fix-signedness-in-bcm_syspor.patch +net-stmmac-dwmac-meson8b-fix-signedness-bug-in-probe.patch +net-axienet-fix-a-signedness-bug-in-probe.patch +of-mdio-fix-a-signedness-bug-in-of_phy_get_and_conne.patch +net-ethernet-stmmac-fix-signedness-bug-in-ipq806x_gm.patch +nvme-retain-split-access-workaround-for-capability-r.patch +net-stmmac-gmac4-not-all-unicast-addresses-may-be-av.patch +mac80211-accept-deauth-frames-in-ibss-mode.patch +llc-fix-another-potential-sk_buff-leak-in-llc_ui_sen.patch +llc-fix-sk_buff-refcounting-in-llc_conn_state_proces.patch +net-stmmac-fix-length-of-ptp-clock-s-name-string.patch +act_mirred-fix-mirred_init_module-error-handling.patch +net-avoid-possible-false-sharing-in-sk_leave_memory_.patch +net-add-read-write-_once-annotations-on-rskq_accept_.patch +tcp-annotate-lockless-access-to-tcp_memory_pressure.patch +drm-msm-dsi-implement-reset-correctly.patch +dmaengine-imx-sdma-fix-size-check-for-sdma-script_nu.patch +net-netem-fix-error-path-for-corrupted-gso-frames.patch +net-netem-correct-the-parent-s-backlog-when-corrupte.patch +net-qca_spi-move-reset_count-to-struct-qcaspi.patch +afs-fix-large-file-support.patch +mips-loongson-fix-return-value-of-loongson_hwmon_ini.patch +hv_netvsc-flag-software-created-hash-value.patch +net-neigh-use-long-type-to-store-jiffies-delta.patch +packet-fix-data-race-in-fanout_flow_is_huge.patch +mmc-sdio-fix-wl1251-vendor-id.patch +mmc-core-fix-wl1251-sdio-quirks.patch +affs-fix-a-memory-leak-in-affs_remount.patch +dmaengine-ti-edma-fix-missed-failure-handling.patch +drm-radeon-fix-bad-dma-from-interrupt_cntl2.patch +arm64-dts-juno-fix-uart-frequency.patch +ib-iser-fix-dma_nents-type-definition.patch +serial-stm32-fix-clearing-interrupt-error-flags.patch +m68k-call-timer_interrupt-with-interrupts-disabled.patch diff --git a/queue-4.14/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch b/queue-4.14/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch new file mode 100644 index 00000000000..6ab593a6668 --- /dev/null +++ b/queue-4.14/signal-allow-cifs-and-drbd-to-receive-their-terminat.patch @@ -0,0 +1,136 @@ +From 096f2b518aabc4a5f4416919c7d8dcb66bf26dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Aug 2019 12:33:54 -0500 +Subject: signal: Allow cifs and drbd to receive their terminating signals +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eric W. Biederman + +[ Upstream commit 33da8e7c814f77310250bb54a9db36a44c5de784 ] + +My recent to change to only use force_sig for a synchronous events +wound up breaking signal reception cifs and drbd. I had overlooked +the fact that by default kthreads start out with all signals set to +SIG_IGN. So a change I thought was safe turned out to have made it +impossible for those kernel thread to catch their signals. + +Reverting the work on force_sig is a bad idea because what the code +was doing was very much a misuse of force_sig. As the way force_sig +ultimately allowed the signal to happen was to change the signal +handler to SIG_DFL. Which after the first signal will allow userspace +to send signals to these kernel threads. At least for +wake_ack_receiver in drbd that does not appear actively wrong. + +So correct this problem by adding allow_kernel_signal that will allow +signals whose siginfo reports they were sent by the kernel through, +but will not allow userspace generated signals, and update cifs and +drbd to call allow_kernel_signal in an appropriate place so that their +thread can receive this signal. + +Fixing things this way ensures that userspace won't be able to send +signals and cause problems, that it is clear which signals the +threads are expecting to receive, and it guarantees that nothing +else in the system will be affected. + +This change was partly inspired by similar cifs and drbd patches that +added allow_signal. + +Reported-by: ronnie sahlberg +Reported-by: Christoph Böhmwalder +Tested-by: Christoph Böhmwalder +Cc: Steve French +Cc: Philipp Reisner +Cc: David Laight +Fixes: 247bc9470b1e ("cifs: fix rmmod regression in cifs.ko caused by force_sig changes") +Fixes: 72abe3bcf091 ("signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of force_sig") +Fixes: fee109901f39 ("signal/drbd: Use send_sig not force_sig") +Fixes: 3cf5d076fb4d ("signal: Remove task parameter from force_sig") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 2 ++ + fs/cifs/connect.c | 2 +- + include/linux/signal.h | 15 ++++++++++++++- + kernel/signal.c | 5 +++++ + 4 files changed, 22 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 7ea13b5497fdc..b998e3abca7ab 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -334,6 +334,8 @@ static int drbd_thread_setup(void *arg) + thi->name[0], + resource->name); + ++ allow_kernel_signal(DRBD_SIGKILL); ++ allow_kernel_signal(SIGXCPU); + restart: + retval = thi->function(thi); + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index ed4a0352ea90e..f0b1279a7de66 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -921,7 +921,7 @@ cifs_demultiplex_thread(void *p) + mempool_resize(cifs_req_poolp, length + cifs_min_rcv); + + set_freezable(); +- allow_signal(SIGKILL); ++ allow_kernel_signal(SIGKILL); + while (server->tcpStatus != CifsExiting) { + if (try_to_freeze()) + continue; +diff --git a/include/linux/signal.h b/include/linux/signal.h +index 843bd62b1eadf..c4e3eb89a6229 100644 +--- a/include/linux/signal.h ++++ b/include/linux/signal.h +@@ -268,6 +268,9 @@ extern void signal_setup_done(int failed, struct ksignal *ksig, int stepping); + extern void exit_signals(struct task_struct *tsk); + extern void kernel_sigaction(int, __sighandler_t); + ++#define SIG_KTHREAD ((__force __sighandler_t)2) ++#define SIG_KTHREAD_KERNEL ((__force __sighandler_t)3) ++ + static inline void allow_signal(int sig) + { + /* +@@ -275,7 +278,17 @@ static inline void allow_signal(int sig) + * know it'll be handled, so that they don't get converted to + * SIGKILL or just silently dropped. + */ +- kernel_sigaction(sig, (__force __sighandler_t)2); ++ kernel_sigaction(sig, SIG_KTHREAD); ++} ++ ++static inline void allow_kernel_signal(int sig) ++{ ++ /* ++ * Kernel threads handle their own signals. Let the signal code ++ * know signals sent by the kernel will be handled, so that they ++ * don't get silently dropped. ++ */ ++ kernel_sigaction(sig, SIG_KTHREAD_KERNEL); + } + + static inline void disallow_signal(int sig) +diff --git a/kernel/signal.c b/kernel/signal.c +index c9b203875001e..8fee1f2eba2f9 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -85,6 +85,11 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force) + handler == SIG_DFL && !(force && sig_kernel_only(sig))) + return 1; + ++ /* Only allow kernel generated signals to this kthread */ ++ if (unlikely((t->flags & PF_KTHREAD) && ++ (handler == SIG_KTHREAD_KERNEL) && !force)) ++ return true; ++ + return sig_handler_ignored(handler, sig); + } + +-- +2.20.1 + diff --git a/queue-4.14/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch b/queue-4.14/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch new file mode 100644 index 00000000000..fd07212d8d5 --- /dev/null +++ b/queue-4.14/signal-cifs-fix-cifs_put_tcp_session-to-call-send_si.patch @@ -0,0 +1,54 @@ +From 766b9b9896d7fb260f21d3850aa88ee23aaf8426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 May 2019 12:33:50 -0500 +Subject: signal/cifs: Fix cifs_put_tcp_session to call send_sig instead of + force_sig + +From: Eric W. Biederman + +[ Upstream commit 72abe3bcf0911d69b46c1e8bdb5612675e0ac42c ] + +The locking in force_sig_info is not prepared to deal with a task that +exits or execs (as sighand may change). The is not a locking problem +in force_sig as force_sig is only built to handle synchronous +exceptions. + +Further the function force_sig_info changes the signal state if the +signal is ignored, or blocked or if SIGNAL_UNKILLABLE will prevent the +delivery of the signal. The signal SIGKILL can not be ignored and can +not be blocked and SIGNAL_UNKILLABLE won't prevent it from being +delivered. + +So using force_sig rather than send_sig for SIGKILL is confusing +and pointless. + +Because it won't impact the sending of the signal and and because +using force_sig is wrong, replace force_sig with send_sig. + +Cc: Namjae Jeon +Cc: Jeff Layton +Cc: Steve French +Fixes: a5c3e1c725af ("Revert "cifs: No need to send SIGKILL to demux_thread during umount"") +Fixes: e7ddee9037e7 ("cifs: disable sharing session and tcon and add new TCP sharing code") +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +--- + fs/cifs/connect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index f523a9ca9574f..51bbb1c0b71ae 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2320,7 +2320,7 @@ cifs_put_tcp_session(struct TCP_Server_Info *server, int from_reconnect) + + task = xchg(&server->tsk, NULL); + if (task) +- force_sig(SIGKILL, task); ++ send_sig(SIGKILL, task, 1); + } + + static struct TCP_Server_Info * +-- +2.20.1 + diff --git a/queue-4.14/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch b/queue-4.14/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch new file mode 100644 index 00000000000..cbd4499fdf4 --- /dev/null +++ b/queue-4.14/soc-fsl-qe-fix-an-error-code-in-qe_pin_request.patch @@ -0,0 +1,38 @@ +From 19c164db920e5ecab0f800d8942a3f9c11aac9bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Mar 2019 17:18:41 +0300 +Subject: soc/fsl/qe: Fix an error code in qe_pin_request() + +From: Dan Carpenter + +[ Upstream commit 5674a92ca4b7e5a6a19231edd10298d30324cd27 ] + +We forgot to set "err" on this error path. + +Fixes: 1a2d397a6eb5 ("gpio/powerpc: Eliminate duplication of of_get_named_gpio_flags()") +Signed-off-by: Dan Carpenter +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qe/gpio.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c +index 3b27075c21a7f..5cbc5ce5ac159 100644 +--- a/drivers/soc/fsl/qe/gpio.c ++++ b/drivers/soc/fsl/qe/gpio.c +@@ -152,8 +152,10 @@ struct qe_pin *qe_pin_request(struct device_node *np, int index) + if (err < 0) + goto err0; + gc = gpio_to_chip(err); +- if (WARN_ON(!gc)) ++ if (WARN_ON(!gc)) { ++ err = -ENODEV; + goto err0; ++ } + + if (!of_device_is_compatible(gc->of_node, "fsl,mpc8323-qe-pario-bank")) { + pr_debug("%s: tried to get a non-qe pin\n", __func__); +-- +2.20.1 + diff --git a/queue-4.14/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch b/queue-4.14/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch new file mode 100644 index 00000000000..c7a875d54d5 --- /dev/null +++ b/queue-4.14/spi-bcm2835aux-fix-driver-to-not-allow-65535-1-cs-gp.patch @@ -0,0 +1,61 @@ +From 0023aa2d18602a841e9ebaa83750481704c6131b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Mar 2019 09:31:02 +0000 +Subject: spi: bcm2835aux: fix driver to not allow 65535 (=-1) cs-gpios + +From: Martin Sperl + +[ Upstream commit 509c583620e9053e43d611bf1614fc3d3abafa96 ] + +The original driver by default defines num_chipselects as -1. +This actually allicates an array of 65535 entries in +of_spi_register_master. + +There is a side-effect for buggy device trees that (contrary to +dt-binding documentation) have no cs-gpio defined. + +This mode was never supported by the driver due to limitations +of native cs and additional code complexity and is explicitly +not stated to be implemented. + +To keep backwards compatibility with such buggy DTs we limit +the number of chip_selects to 1, as for all practical purposes +it is only ever realistic to use a single chip select in +native cs mode without negative side-effects. + +Fixes: 1ea29b39f4c812ec ("spi: bcm2835aux: add bcm2835 auxiliary spi device...") +Signed-off-by: Martin Sperl +Acked-by: Stefan Wahren +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm2835aux.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index 5c89bbb05441b..e075712c501e8 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -416,7 +416,18 @@ static int bcm2835aux_spi_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, master); + master->mode_bits = (SPI_CPOL | SPI_CS_HIGH | SPI_NO_CS); + master->bits_per_word_mask = SPI_BPW_MASK(8); +- master->num_chipselect = -1; ++ /* even though the driver never officially supported native CS ++ * allow a single native CS for legacy DT support purposes when ++ * no cs-gpio is configured. ++ * Known limitations for native cs are: ++ * * multiple chip-selects: cs0-cs2 are all simultaniously asserted ++ * whenever there is a transfer - this even includes SPI_NO_CS ++ * * SPI_CS_HIGH: is ignores - cs are always asserted low ++ * * cs_change: cs is deasserted after each spi_transfer ++ * * cs_delay_usec: cs is always deasserted one SCK cycle after ++ * a spi_transfer ++ */ ++ master->num_chipselect = 1; + master->transfer_one = bcm2835aux_spi_transfer_one; + master->handle_err = bcm2835aux_spi_handle_err; + master->prepare_message = bcm2835aux_spi_prepare_message; +-- +2.20.1 + diff --git a/queue-4.14/spi-cadence-correct-initialisation-of-runtime-pm.patch b/queue-4.14/spi-cadence-correct-initialisation-of-runtime-pm.patch new file mode 100644 index 00000000000..e5b10706b4d --- /dev/null +++ b/queue-4.14/spi-cadence-correct-initialisation-of-runtime-pm.patch @@ -0,0 +1,63 @@ +From 9dc89c103aefd3ab47ffad4a37637420ac442176 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jan 2019 18:08:09 +0000 +Subject: spi: cadence: Correct initialisation of runtime PM + +From: Charles Keepax + +[ Upstream commit 734882a8bf984c2ac8a57d8ac3ee53230bd0bed8 ] + +Currently the driver calls pm_runtime_put_autosuspend but without ever +having done a pm_runtime_get, this causes the reference count in the pm +runtime core to become -1. The bad reference count causes the core to +sometimes suspend whilst an active SPI transfer is in progress. + +arizona spi0.1: SPI transfer timed out +spi_master spi0: failed to transfer one message from queue + +The correct proceedure is to do all the initialisation that requires the +hardware to be powered up before enabling the PM runtime, then enable +the PM runtime having called pm_runtime_set_active to inform it that the +hardware is currently powered up. The core will then power it down at +it's leisure and no explicit pm_runtime_put is required. + +Fixes: d36ccd9f7ea4 ("spi: cadence: Runtime pm adaptation") +Signed-off-by: Charles Keepax +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-cadence.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index 02bd1eba045b8..d08ad93d97a15 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -584,11 +584,6 @@ static int cdns_spi_probe(struct platform_device *pdev) + goto clk_dis_apb; + } + +- pm_runtime_use_autosuspend(&pdev->dev); +- pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT); +- pm_runtime_set_active(&pdev->dev); +- pm_runtime_enable(&pdev->dev); +- + ret = of_property_read_u32(pdev->dev.of_node, "num-cs", &num_cs); + if (ret < 0) + master->num_chipselect = CDNS_SPI_DEFAULT_NUM_CS; +@@ -603,8 +598,10 @@ static int cdns_spi_probe(struct platform_device *pdev) + /* SPI controller initializations */ + cdns_spi_init_hw(xspi); + +- pm_runtime_mark_last_busy(&pdev->dev); +- pm_runtime_put_autosuspend(&pdev->dev); ++ pm_runtime_set_active(&pdev->dev); ++ pm_runtime_enable(&pdev->dev); ++ pm_runtime_use_autosuspend(&pdev->dev); ++ pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT); + + irq = platform_get_irq(pdev, 0); + if (irq <= 0) { +-- +2.20.1 + diff --git a/queue-4.14/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch b/queue-4.14/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch new file mode 100644 index 00000000000..60d34e8d2df --- /dev/null +++ b/queue-4.14/spi-spi-fsl-spi-call-spi_finalize_current_message-at.patch @@ -0,0 +1,44 @@ +From f92be49d047d814fbf497afaf7ad1e6eb8b26d08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 May 2019 11:00:36 +0000 +Subject: spi: spi-fsl-spi: call spi_finalize_current_message() at the end + +From: Christophe Leroy + +[ Upstream commit 44a042182cb1e9f7916e015c836967bf638b33c4 ] + +spi_finalize_current_message() shall be called once all +actions are finished, otherwise the last actions might +step over a newly started transfer. + +Fixes: c592becbe704 ("spi: fsl-(e)spi: migrate to generic master queueing") +Signed-off-by: Christophe Leroy +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsl-spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 8b79e36fab21c..cd784552de7f1 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -407,7 +407,6 @@ static int fsl_spi_do_one_msg(struct spi_master *master, + } + + m->status = status; +- spi_finalize_current_message(master); + + if (status || !cs_change) { + ndelay(nsecs); +@@ -415,6 +414,7 @@ static int fsl_spi_do_one_msg(struct spi_master *master, + } + + fsl_spi_setup_transfer(spi, NULL); ++ spi_finalize_current_message(master); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch b/queue-4.14/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch new file mode 100644 index 00000000000..b6c814b014e --- /dev/null +++ b/queue-4.14/spi-tegra114-clear-packed-bit-for-unpacked-mode.patch @@ -0,0 +1,38 @@ +From 3536b770494183bda695324e16d14200f0e63c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 22:56:23 -0700 +Subject: spi: tegra114: clear packed bit for unpacked mode + +From: Sowjanya Komatineni + +[ Upstream commit 7b3d10cdf54b8bc1dc0da21faed9789ac4da3684 ] + +Fixes: Clear packed bit when not using packed mode. + +Packed bit is not cleared when not using packed mode. This results +in transfer timeouts for the unpacked mode transfers followed by the +packed mode transfers. + +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 2ad04796ef298..3a6b202dfffe0 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -730,6 +730,8 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi, + + if (tspi->is_packed) + command1 |= SPI_PACKED; ++ else ++ command1 &= ~SPI_PACKED; + + command1 &= ~(SPI_CS_SEL_MASK | SPI_TX_EN | SPI_RX_EN); + tspi->cur_direction = 0; +-- +2.20.1 + diff --git a/queue-4.14/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch b/queue-4.14/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch new file mode 100644 index 00000000000..53f1beb42b0 --- /dev/null +++ b/queue-4.14/spi-tegra114-configure-dma-burst-size-to-fifo-trig-l.patch @@ -0,0 +1,135 @@ +From 5eef684bd61fc331485da921d2a8278b1be7a351 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 22:56:29 -0700 +Subject: spi: tegra114: configure dma burst size to fifo trig level + +From: Sowjanya Komatineni + +[ Upstream commit f4ce428c41fb22e3ed55496dded94df44cb920fa ] + +Fixes: Configure DMA burst size to be same as SPI TX/RX trigger levels +to avoid mismatch. + +SPI FIFO trigger levels are calculated based on the transfer length. +So this patch moves DMA slave configuration to happen before start +of DMAs. + +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 52 ++++++++++++++++++++++---------------- + 1 file changed, 30 insertions(+), 22 deletions(-) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 18dfbd57c61f2..84ff0c507f0b6 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -529,6 +529,8 @@ static int tegra_spi_start_dma_based_transfer( + u32 val; + unsigned int len; + int ret = 0; ++ u8 dma_burst; ++ struct dma_slave_config dma_sconfig = {0}; + + val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1); + tegra_spi_writel(tspi, val, SPI_DMA_BLK); +@@ -540,12 +542,16 @@ static int tegra_spi_start_dma_based_transfer( + len = tspi->curr_dma_words * 4; + + /* Set attention level based on length of transfer */ +- if (len & 0xF) ++ if (len & 0xF) { + val |= SPI_TX_TRIG_1 | SPI_RX_TRIG_1; +- else if (((len) >> 4) & 0x1) ++ dma_burst = 1; ++ } else if (((len) >> 4) & 0x1) { + val |= SPI_TX_TRIG_4 | SPI_RX_TRIG_4; +- else ++ dma_burst = 4; ++ } else { + val |= SPI_TX_TRIG_8 | SPI_RX_TRIG_8; ++ dma_burst = 8; ++ } + + if (tspi->cur_direction & DATA_DIR_TX) + val |= SPI_IE_TX; +@@ -556,7 +562,18 @@ static int tegra_spi_start_dma_based_transfer( + tegra_spi_writel(tspi, val, SPI_DMA_CTL); + tspi->dma_control_reg = val; + ++ dma_sconfig.device_fc = true; + if (tspi->cur_direction & DATA_DIR_TX) { ++ dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO; ++ dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; ++ dma_sconfig.dst_maxburst = dma_burst; ++ ret = dmaengine_slave_config(tspi->tx_dma_chan, &dma_sconfig); ++ if (ret < 0) { ++ dev_err(tspi->dev, ++ "DMA slave config failed: %d\n", ret); ++ return ret; ++ } ++ + tegra_spi_copy_client_txbuf_to_spi_txbuf(tspi, t); + ret = tegra_spi_start_tx_dma(tspi, len); + if (ret < 0) { +@@ -567,6 +584,16 @@ static int tegra_spi_start_dma_based_transfer( + } + + if (tspi->cur_direction & DATA_DIR_RX) { ++ dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO; ++ dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; ++ dma_sconfig.src_maxburst = dma_burst; ++ ret = dmaengine_slave_config(tspi->rx_dma_chan, &dma_sconfig); ++ if (ret < 0) { ++ dev_err(tspi->dev, ++ "DMA slave config failed: %d\n", ret); ++ return ret; ++ } ++ + /* Make the dma buffer to read by dma */ + dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys, + tspi->dma_buf_size, DMA_FROM_DEVICE); +@@ -626,7 +653,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi, + u32 *dma_buf; + dma_addr_t dma_phys; + int ret; +- struct dma_slave_config dma_sconfig; + + dma_chan = dma_request_slave_channel_reason(tspi->dev, + dma_to_memory ? "rx" : "tx"); +@@ -646,19 +672,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi, + return -ENOMEM; + } + +- if (dma_to_memory) { +- dma_sconfig.src_addr = tspi->phys + SPI_RX_FIFO; +- dma_sconfig.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +- dma_sconfig.src_maxburst = 0; +- } else { +- dma_sconfig.dst_addr = tspi->phys + SPI_TX_FIFO; +- dma_sconfig.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; +- dma_sconfig.dst_maxburst = 0; +- } +- +- ret = dmaengine_slave_config(dma_chan, &dma_sconfig); +- if (ret) +- goto scrub; + if (dma_to_memory) { + tspi->rx_dma_chan = dma_chan; + tspi->rx_dma_buf = dma_buf; +@@ -669,11 +682,6 @@ static int tegra_spi_init_dma_param(struct tegra_spi_data *tspi, + tspi->tx_dma_phys = dma_phys; + } + return 0; +- +-scrub: +- dma_free_coherent(tspi->dev, tspi->dma_buf_size, dma_buf, dma_phys); +- dma_release_channel(dma_chan); +- return ret; + } + + static void tegra_spi_deinit_dma_param(struct tegra_spi_data *tspi, +-- +2.20.1 + diff --git a/queue-4.14/spi-tegra114-fix-for-unpacked-mode-transfers.patch b/queue-4.14/spi-tegra114-fix-for-unpacked-mode-transfers.patch new file mode 100644 index 00000000000..bd98b5dded8 --- /dev/null +++ b/queue-4.14/spi-tegra114-fix-for-unpacked-mode-transfers.patch @@ -0,0 +1,164 @@ +From 241a99b4ed8401808d165bbdb9b253afbbc3613e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 22:56:24 -0700 +Subject: spi: tegra114: fix for unpacked mode transfers + +From: Sowjanya Komatineni + +[ Upstream commit 1a89ac5b91895127f7c586ec5075c3753ca25501 ] + +Fixes: computation of actual bytes to fill/receive in/from FIFO in unpacked +mode when transfer length is not a multiple of requested bits per word. + +unpacked mode transfers fails when the transfer includes partial bytes in +the last word. + +Total words to be written/read to/from FIFO is computed based on transfer +length and bits per word. Unpacked mode includes 0 padding bytes for partial +words to align with bits per word and these extra bytes are also accounted +for calculating bytes left to transfer in the current driver. + +This causes extra bytes access of tx/rx buffers along with buffer index +position crossing actual length where remain_len becomes negative and due to +unsigned type, negative value is a 32 bit representation of signed value +and transferred bytes never meets the actual transfer length resulting in +transfer timeout and a hang. + +This patch fixes this with proper computation of the actual bytes to fill in +FIFO during transmit and the actual bytes to read from FIFO during receive +ignoring 0 padded bytes. + +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 43 +++++++++++++++++++++++++++++++------- + 1 file changed, 36 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 3a6b202dfffe0..c6674b01e0fd6 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -307,10 +307,16 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf( + x |= (u32)(*tx_buf++) << (i * 8); + tegra_spi_writel(tspi, x, SPI_TX_FIFO); + } ++ ++ tspi->cur_tx_pos += written_words * tspi->bytes_per_word; + } else { ++ unsigned int write_bytes; + max_n_32bit = min(tspi->curr_dma_words, tx_empty_count); + written_words = max_n_32bit; + nbytes = written_words * tspi->bytes_per_word; ++ if (nbytes > t->len - tspi->cur_pos) ++ nbytes = t->len - tspi->cur_pos; ++ write_bytes = nbytes; + for (count = 0; count < max_n_32bit; count++) { + u32 x = 0; + +@@ -319,8 +325,10 @@ static unsigned tegra_spi_fill_tx_fifo_from_client_txbuf( + x |= (u32)(*tx_buf++) << (i * 8); + tegra_spi_writel(tspi, x, SPI_TX_FIFO); + } ++ ++ tspi->cur_tx_pos += write_bytes; + } +- tspi->cur_tx_pos += written_words * tspi->bytes_per_word; ++ + return written_words; + } + +@@ -344,20 +352,27 @@ static unsigned int tegra_spi_read_rx_fifo_to_client_rxbuf( + for (i = 0; len && (i < 4); i++, len--) + *rx_buf++ = (x >> i*8) & 0xFF; + } +- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + read_words += tspi->curr_dma_words; ++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + } else { + u32 rx_mask = ((u32)1 << t->bits_per_word) - 1; ++ u8 bytes_per_word = tspi->bytes_per_word; ++ unsigned int read_bytes; + ++ len = rx_full_count * bytes_per_word; ++ if (len > t->len - tspi->cur_pos) ++ len = t->len - tspi->cur_pos; ++ read_bytes = len; + for (count = 0; count < rx_full_count; count++) { + u32 x = tegra_spi_readl(tspi, SPI_RX_FIFO) & rx_mask; + +- for (i = 0; (i < tspi->bytes_per_word); i++) ++ for (i = 0; len && (i < bytes_per_word); i++, len--) + *rx_buf++ = (x >> (i*8)) & 0xFF; + } +- tspi->cur_rx_pos += rx_full_count * tspi->bytes_per_word; + read_words += rx_full_count; ++ tspi->cur_rx_pos += read_bytes; + } ++ + return read_words; + } + +@@ -372,12 +387,17 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf( + unsigned len = tspi->curr_dma_words * tspi->bytes_per_word; + + memcpy(tspi->tx_dma_buf, t->tx_buf + tspi->cur_pos, len); ++ tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + } else { + unsigned int i; + unsigned int count; + u8 *tx_buf = (u8 *)t->tx_buf + tspi->cur_tx_pos; + unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word; ++ unsigned int write_bytes; + ++ if (consume > t->len - tspi->cur_pos) ++ consume = t->len - tspi->cur_pos; ++ write_bytes = consume; + for (count = 0; count < tspi->curr_dma_words; count++) { + u32 x = 0; + +@@ -386,8 +406,9 @@ static void tegra_spi_copy_client_txbuf_to_spi_txbuf( + x |= (u32)(*tx_buf++) << (i * 8); + tspi->tx_dma_buf[count] = x; + } ++ ++ tspi->cur_tx_pos += write_bytes; + } +- tspi->cur_tx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + + /* Make the dma buffer to read by dma */ + dma_sync_single_for_device(tspi->dev, tspi->tx_dma_phys, +@@ -405,20 +426,28 @@ static void tegra_spi_copy_spi_rxbuf_to_client_rxbuf( + unsigned len = tspi->curr_dma_words * tspi->bytes_per_word; + + memcpy(t->rx_buf + tspi->cur_rx_pos, tspi->rx_dma_buf, len); ++ tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + } else { + unsigned int i; + unsigned int count; + unsigned char *rx_buf = t->rx_buf + tspi->cur_rx_pos; + u32 rx_mask = ((u32)1 << t->bits_per_word) - 1; ++ unsigned consume = tspi->curr_dma_words * tspi->bytes_per_word; ++ unsigned int read_bytes; + ++ if (consume > t->len - tspi->cur_pos) ++ consume = t->len - tspi->cur_pos; ++ read_bytes = consume; + for (count = 0; count < tspi->curr_dma_words; count++) { + u32 x = tspi->rx_dma_buf[count] & rx_mask; + +- for (i = 0; (i < tspi->bytes_per_word); i++) ++ for (i = 0; consume && (i < tspi->bytes_per_word); ++ i++, consume--) + *rx_buf++ = (x >> (i*8)) & 0xFF; + } ++ ++ tspi->cur_rx_pos += read_bytes; + } +- tspi->cur_rx_pos += tspi->curr_dma_words * tspi->bytes_per_word; + + /* Make the dma buffer to read by dma */ + dma_sync_single_for_device(tspi->dev, tspi->rx_dma_phys, +-- +2.20.1 + diff --git a/queue-4.14/spi-tegra114-flush-fifos.patch b/queue-4.14/spi-tegra114-flush-fifos.patch new file mode 100644 index 00000000000..812601c082e --- /dev/null +++ b/queue-4.14/spi-tegra114-flush-fifos.patch @@ -0,0 +1,107 @@ +From 5a56b3a28031aedb6a64bef8cbd7a2908c6e379d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 22:56:28 -0700 +Subject: spi: tegra114: flush fifos + +From: Sowjanya Komatineni + +[ Upstream commit c4fc9e5b28ff787e35137c2cc13316bb11d7657b ] + +Fixes: Flush TX and RX FIFOs before start of new transfer and on FIFO +overflow or underrun errors. + +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 39 +++++++++++++++++++++++++++++--------- + 1 file changed, 30 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 4878d5e00c669..18dfbd57c61f2 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -499,22 +499,37 @@ static int tegra_spi_start_rx_dma(struct tegra_spi_data *tspi, int len) + return 0; + } + +-static int tegra_spi_start_dma_based_transfer( +- struct tegra_spi_data *tspi, struct spi_transfer *t) ++static int tegra_spi_flush_fifos(struct tegra_spi_data *tspi) + { +- u32 val; +- unsigned int len; +- int ret = 0; ++ unsigned long timeout = jiffies + HZ; + u32 status; + +- /* Make sure that Rx and Tx fifo are empty */ + status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); + if ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) { +- dev_err(tspi->dev, "Rx/Tx fifo are not empty status 0x%08x\n", +- (unsigned)status); +- return -EIO; ++ status |= SPI_RX_FIFO_FLUSH | SPI_TX_FIFO_FLUSH; ++ tegra_spi_writel(tspi, status, SPI_FIFO_STATUS); ++ while ((status & SPI_FIFO_EMPTY) != SPI_FIFO_EMPTY) { ++ status = tegra_spi_readl(tspi, SPI_FIFO_STATUS); ++ if (time_after(jiffies, timeout)) { ++ dev_err(tspi->dev, ++ "timeout waiting for fifo flush\n"); ++ return -EIO; ++ } ++ ++ udelay(1); ++ } + } + ++ return 0; ++} ++ ++static int tegra_spi_start_dma_based_transfer( ++ struct tegra_spi_data *tspi, struct spi_transfer *t) ++{ ++ u32 val; ++ unsigned int len; ++ int ret = 0; ++ + val = SPI_DMA_BLK_SET(tspi->curr_dma_words - 1); + tegra_spi_writel(tspi, val, SPI_DMA_BLK); + +@@ -779,6 +794,9 @@ static int tegra_spi_start_transfer_one(struct spi_device *spi, + dev_dbg(tspi->dev, "The def 0x%x and written 0x%x\n", + tspi->def_command1_reg, (unsigned)command1); + ++ ret = tegra_spi_flush_fifos(tspi); ++ if (ret < 0) ++ return ret; + if (total_fifo_words > SPI_FIFO_DEPTH) + ret = tegra_spi_start_dma_based_transfer(tspi, t); + else +@@ -876,6 +894,7 @@ static int tegra_spi_transfer_one_message(struct spi_master *master, + (tspi->cur_direction & DATA_DIR_RX)) + dmaengine_terminate_all(tspi->rx_dma_chan); + ret = -EIO; ++ tegra_spi_flush_fifos(tspi); + reset_control_assert(tspi->rst); + udelay(2); + reset_control_deassert(tspi->rst); +@@ -929,6 +948,7 @@ static irqreturn_t handle_cpu_based_xfer(struct tegra_spi_data *tspi) + tspi->status_reg); + dev_err(tspi->dev, "CpuXfer 0x%08x:0x%08x\n", + tspi->command1_reg, tspi->dma_control_reg); ++ tegra_spi_flush_fifos(tspi); + reset_control_assert(tspi->rst); + udelay(2); + reset_control_deassert(tspi->rst); +@@ -1001,6 +1021,7 @@ static irqreturn_t handle_dma_based_xfer(struct tegra_spi_data *tspi) + tspi->status_reg); + dev_err(tspi->dev, "DmaXfer 0x%08x:0x%08x\n", + tspi->command1_reg, tspi->dma_control_reg); ++ tegra_spi_flush_fifos(tspi); + reset_control_assert(tspi->rst); + udelay(2); + reset_control_deassert(tspi->rst); +-- +2.20.1 + diff --git a/queue-4.14/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch b/queue-4.14/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch new file mode 100644 index 00000000000..83b4e7d8ddf --- /dev/null +++ b/queue-4.14/spi-tegra114-terminate-dma-and-reset-on-transfer-tim.patch @@ -0,0 +1,43 @@ +From 5d8cc80bd37888d06391a9cf289d393cc5c2e7ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Mar 2019 22:56:27 -0700 +Subject: spi: tegra114: terminate dma and reset on transfer timeout + +From: Sowjanya Komatineni + +[ Upstream commit 32bd1a9551cae34e6889afa235c7afdfede9aeac ] + +Fixes: terminate DMA and perform controller reset on transfer timeout +to clear the FIFO's and errors. + +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index c6674b01e0fd6..4878d5e00c669 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -869,7 +869,16 @@ static int tegra_spi_transfer_one_message(struct spi_master *master, + if (WARN_ON(ret == 0)) { + dev_err(tspi->dev, + "spi transfer timeout, err %d\n", ret); ++ if (tspi->is_curr_dma_xfer && ++ (tspi->cur_direction & DATA_DIR_TX)) ++ dmaengine_terminate_all(tspi->tx_dma_chan); ++ if (tspi->is_curr_dma_xfer && ++ (tspi->cur_direction & DATA_DIR_RX)) ++ dmaengine_terminate_all(tspi->rx_dma_chan); + ret = -EIO; ++ reset_control_assert(tspi->rst); ++ udelay(2); ++ reset_control_deassert(tspi->rst); + goto complete_xfer; + } + +-- +2.20.1 + diff --git a/queue-4.14/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch b/queue-4.14/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch new file mode 100644 index 00000000000..453b9fd68cf --- /dev/null +++ b/queue-4.14/spi-topcliff_pch-fix-potential-null-dereference-on-a.patch @@ -0,0 +1,47 @@ +From 292ee30d515d468be660835ae6a411724637f630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jan 2019 20:00:22 +0800 +Subject: spi/topcliff_pch: Fix potential NULL dereference on allocation error + +From: YueHaibing + +[ Upstream commit e902cdcb5112b89ee445588147964723fd69ffb4 ] + +In pch_spi_handle_dma, it doesn't check for NULL returns of kcalloc +so it would result in an Oops. + +Fixes: c37f3c2749b5 ("spi/topcliff_pch: DMA support") +Signed-off-by: YueHaibing +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-topcliff-pch.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c +index 4389ab80c23e6..fa730a871d252 100644 +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -1008,6 +1008,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) + + /* RX */ + dma->sg_rx_p = kcalloc(num, sizeof(*dma->sg_rx_p), GFP_ATOMIC); ++ if (!dma->sg_rx_p) ++ return; ++ + sg_init_table(dma->sg_rx_p, num); /* Initialize SG table */ + /* offset, length setting */ + sg = dma->sg_rx_p; +@@ -1068,6 +1071,9 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw) + } + + dma->sg_tx_p = kcalloc(num, sizeof(*dma->sg_tx_p), GFP_ATOMIC); ++ if (!dma->sg_tx_p) ++ return; ++ + sg_init_table(dma->sg_tx_p, num); /* Initialize SG table */ + /* offset, length setting */ + sg = dma->sg_tx_p; +-- +2.20.1 + diff --git a/queue-4.14/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch b/queue-4.14/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch new file mode 100644 index 00000000000..332d20ff6a9 --- /dev/null +++ b/queue-4.14/staging-bcm2835-camera-abort-probe-if-there-is-no-ca.patch @@ -0,0 +1,53 @@ +From b518d1454564735c111ec4d369d4f402f677a59f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 19:28:51 +0100 +Subject: staging: bcm2835-camera: Abort probe if there is no camera + +From: Stefan Wahren + +[ Upstream commit 7566f39dfdc11f8a97d5810c6e6295a88f97ef91 ] + +Abort the probing of the camera driver in case there isn't a camera +actually connected to the Raspberry Pi. This solution also avoids a +NULL ptr dereference of mmal instance on driver unload. + +Fixes: 7b3ad5abf027 ("staging: Import the BCM2835 MMAL-based V4L2 camera driver.") +Signed-off-by: Stefan Wahren +Reviewed-by: Nicolas Saenz Julienne +Reviewed-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../vc04_services/bcm2835-camera/bcm2835-camera.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c +index 377da037f31c3..b521752d9aa01 100644 +--- a/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c ++++ b/drivers/staging/vc04_services/bcm2835-camera/bcm2835-camera.c +@@ -1849,6 +1849,12 @@ static int __init bm2835_mmal_init(void) + num_cameras = get_num_cameras(instance, + resolutions, + MAX_BCM2835_CAMERAS); ++ ++ if (num_cameras < 1) { ++ ret = -ENODEV; ++ goto cleanup_mmal; ++ } ++ + if (num_cameras > MAX_BCM2835_CAMERAS) + num_cameras = MAX_BCM2835_CAMERAS; + +@@ -1948,6 +1954,9 @@ cleanup_gdev: + pr_info("%s: error %d while loading driver\n", + BM2835_MMAL_MODULE_NAME, ret); + ++cleanup_mmal: ++ vchiq_mmal_finalise(instance); ++ + return ret; + } + +-- +2.20.1 + diff --git a/queue-4.14/staging-comedi-ni_mio_common-protect-register-write-.patch b/queue-4.14/staging-comedi-ni_mio_common-protect-register-write-.patch new file mode 100644 index 00000000000..2e0ee21c26d --- /dev/null +++ b/queue-4.14/staging-comedi-ni_mio_common-protect-register-write-.patch @@ -0,0 +1,90 @@ +From 676ab3710714aaada96df2b55b195d0b8d3c7794 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 14:54:16 -0600 +Subject: staging: comedi: ni_mio_common: protect register write overflow + +From: Spencer E. Olson + +[ Upstream commit 1cbca5852d6c16e85a21487a15d211195aacd4a1 ] + +Fixes two problems introduced as early as +commit 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code"): +(1) Ensures that the last four bits of NISTC_RTSI_TRIGB_OUT_REG register is + not unduly overwritten on e-series devices. On e-series devices, the + first three of the last four bits are reserved. The last bit defines + the output selection of the RGOUT0 pin, otherwise known as + RTSI_Sub_Selection. For m-series devices, these last four bits are + indeed used as the output selection of the RTSI7 pin (and the + RTSI_Sub_Selection bit for the RGOUT0 pin is moved to the + RTSI_Trig_Direction register. +(2) Allows all 4 RTSI_BRD lines to be treated as valid sources for RTSI + lines. + +This patch also cleans up the ni_get_rtsi_routing command for readability. + +Fixes: 03aef4b6dc12 ("Staging: comedi: add ni_mio_common code") +Signed-off-by: Spencer E. Olson +Reviewed-by: Ian Abbott +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../staging/comedi/drivers/ni_mio_common.c | 24 +++++++++++++------ + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 36361bdf934ac..2f82dcb1fd062 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -4991,7 +4991,10 @@ static int ni_valid_rtsi_output_source(struct comedi_device *dev, + case NI_RTSI_OUTPUT_G_SRC0: + case NI_RTSI_OUTPUT_G_GATE0: + case NI_RTSI_OUTPUT_RGOUT0: +- case NI_RTSI_OUTPUT_RTSI_BRD_0: ++ case NI_RTSI_OUTPUT_RTSI_BRD(0): ++ case NI_RTSI_OUTPUT_RTSI_BRD(1): ++ case NI_RTSI_OUTPUT_RTSI_BRD(2): ++ case NI_RTSI_OUTPUT_RTSI_BRD(3): + return 1; + case NI_RTSI_OUTPUT_RTSI_OSC: + return (devpriv->is_m_series) ? 1 : 0; +@@ -5012,11 +5015,18 @@ static int ni_set_rtsi_routing(struct comedi_device *dev, + devpriv->rtsi_trig_a_output_reg |= NISTC_RTSI_TRIG(chan, src); + ni_stc_writew(dev, devpriv->rtsi_trig_a_output_reg, + NISTC_RTSI_TRIGA_OUT_REG); +- } else if (chan < 8) { ++ } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) { + devpriv->rtsi_trig_b_output_reg &= ~NISTC_RTSI_TRIG_MASK(chan); + devpriv->rtsi_trig_b_output_reg |= NISTC_RTSI_TRIG(chan, src); + ni_stc_writew(dev, devpriv->rtsi_trig_b_output_reg, + NISTC_RTSI_TRIGB_OUT_REG); ++ } else if (chan != NISTC_RTSI_TRIG_OLD_CLK_CHAN) { ++ /* probably should never reach this, since the ++ * ni_valid_rtsi_output_source above errors out if chan is too ++ * high ++ */ ++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__); ++ return -EINVAL; + } + return 2; + } +@@ -5032,12 +5042,12 @@ static unsigned int ni_get_rtsi_routing(struct comedi_device *dev, + } else if (chan < NISTC_RTSI_TRIG_NUM_CHAN(devpriv->is_m_series)) { + return NISTC_RTSI_TRIG_TO_SRC(chan, + devpriv->rtsi_trig_b_output_reg); +- } else { +- if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) +- return NI_RTSI_OUTPUT_RTSI_OSC; +- dev_err(dev->class_dev, "bug! should never get here?\n"); +- return 0; ++ } else if (chan == NISTC_RTSI_TRIG_OLD_CLK_CHAN) { ++ return NI_RTSI_OUTPUT_RTSI_OSC; + } ++ ++ dev_err(dev->class_dev, "%s: unknown rtsi channel\n", __func__); ++ return -EINVAL; + } + + static int ni_rtsi_insn_config(struct comedi_device *dev, +-- +2.20.1 + diff --git a/queue-4.14/staging-greybus-light-fix-a-couple-double-frees.patch b/queue-4.14/staging-greybus-light-fix-a-couple-double-frees.patch new file mode 100644 index 00000000000..e53018cae68 --- /dev/null +++ b/queue-4.14/staging-greybus-light-fix-a-couple-double-frees.patch @@ -0,0 +1,69 @@ +From 67578658cdf5d515da995180beebacceee5d3b22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Aug 2019 15:28:39 +0300 +Subject: staging: greybus: light: fix a couple double frees + +From: Dan Carpenter + +[ Upstream commit 329101244f214952606359d254ae883b7109e1a5 ] + +The problem is in gb_lights_request_handler(). If we get a request to +change the config then we release the light with gb_lights_light_release() +and re-allocated it. However, if the allocation fails part way through +then we call gb_lights_light_release() again. This can lead to a couple +different double frees where we haven't cleared out the original values: + + gb_lights_light_v4l2_unregister(light); + ... + kfree(light->channels); + kfree(light->name); + +I also made a small change to how we set "light->channels_count = 0;". +The original code handled this part fine and did not cause a use after +free but it was sort of complicated to read. + +Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") +Signed-off-by: Dan Carpenter +Acked-by: Rui Miguel Silva +Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/light.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c +index 0f538b8c3a076..4e7575147775d 100644 +--- a/drivers/staging/greybus/light.c ++++ b/drivers/staging/greybus/light.c +@@ -1103,21 +1103,21 @@ static void gb_lights_channel_release(struct gb_channel *channel) + static void gb_lights_light_release(struct gb_light *light) + { + int i; +- int count; + + light->ready = false; + +- count = light->channels_count; +- + if (light->has_flash) + gb_lights_light_v4l2_unregister(light); ++ light->has_flash = false; + +- for (i = 0; i < count; i++) { ++ for (i = 0; i < light->channels_count; i++) + gb_lights_channel_release(&light->channels[i]); +- light->channels_count--; +- } ++ light->channels_count = 0; ++ + kfree(light->channels); ++ light->channels = NULL; + kfree(light->name); ++ light->name = NULL; + } + + static void gb_lights_release(struct gb_lights *glights) +-- +2.20.1 + diff --git a/queue-4.14/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch b/queue-4.14/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch new file mode 100644 index 00000000000..5195f51fb0d --- /dev/null +++ b/queue-4.14/staging-most-cdev-add-missing-check-for-cdev_add-fai.patch @@ -0,0 +1,49 @@ +From 58ed3ebdf548c0de8516b53470aa59c98283037b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Feb 2019 22:34:49 +0000 +Subject: staging: most: cdev: add missing check for cdev_add failure + +From: Colin Ian King + +[ Upstream commit 5ae890780e1b4d08f2c0c5d4ea96fc3928fc0ee9 ] + +Currently the call to cdev_add is missing a check for failure. Fix this by +checking for failure and exiting via a new error path that ensures the +allocated comp_channel struct is kfree'd. + +Detected by CoverityScan, CID#1462359 ("Unchecked return value") + +Fixes: 9bc79bbcd0c5 ("Staging: most: add MOST driver's aim-cdev module") +Signed-off-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/most/aim-cdev/cdev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/most/aim-cdev/cdev.c b/drivers/staging/most/aim-cdev/cdev.c +index 1e5cbc893496a..d000b6ff8a7d2 100644 +--- a/drivers/staging/most/aim-cdev/cdev.c ++++ b/drivers/staging/most/aim-cdev/cdev.c +@@ -455,7 +455,9 @@ static int aim_probe(struct most_interface *iface, int channel_id, + c->devno = MKDEV(major, current_minor); + cdev_init(&c->cdev, &channel_fops); + c->cdev.owner = THIS_MODULE; +- cdev_add(&c->cdev, c->devno, 1); ++ retval = cdev_add(&c->cdev, c->devno, 1); ++ if (retval < 0) ++ goto err_free_c; + c->iface = iface; + c->cfg = cfg; + c->channel_id = channel_id; +@@ -491,6 +493,7 @@ error_create_device: + list_del(&c->list); + error_alloc_kfifo: + cdev_del(&c->cdev); ++err_free_c: + kfree(c); + error_alloc_channel: + ida_simple_remove(&minor_id, current_minor); +-- +2.20.1 + diff --git a/queue-4.14/staging-r8822be-check-kzalloc-return-or-bail.patch b/queue-4.14/staging-r8822be-check-kzalloc-return-or-bail.patch new file mode 100644 index 00000000000..2da696a1957 --- /dev/null +++ b/queue-4.14/staging-r8822be-check-kzalloc-return-or-bail.patch @@ -0,0 +1,41 @@ +From cfeed8def9abd15408a1ad1f01984a3c1e163848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Feb 2019 10:24:22 +0100 +Subject: staging: r8822be: check kzalloc return or bail + +From: Nicholas Mc Guire + +[ Upstream commit e4b08e16b7d9d030b6475ef48f94d734a39f3c81 ] + +The kzalloc() in halmac_parse_psd_data_88xx() can fail and return NULL +so check the psd_set->data after allocation and if allocation failed +return HALMAC_CMD_PROCESS_ERROR. + +Signed-off-by: Nicholas Mc Guire +Fixes: 938a0447f094 ("staging: r8822be: Add code for halmac sub-drive") +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + .../staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c +index 544f638ed3efb..15091ee587dbf 100644 +--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c ++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c +@@ -2492,8 +2492,11 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf, + segment_size = (u8)PSD_DATA_GET_SEGMENT_SIZE(c2h_buf); + psd_set->data_size = total_size; + +- if (!psd_set->data) ++ if (!psd_set->data) { + psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL); ++ if (!psd_set->data) ++ return HALMAC_CMD_PROCESS_ERROR; ++ } + + if (segment_id == 0) + psd_set->segment_size = segment_size; +-- +2.20.1 + diff --git a/queue-4.14/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch b/queue-4.14/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch new file mode 100644 index 00000000000..44acb63d532 --- /dev/null +++ b/queue-4.14/staging-rtlwifi-use-proper-enum-for-return-in-halmac.patch @@ -0,0 +1,49 @@ +From 9a9199fb5b4c9a7153fd10d8a7eb0111d4a195c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Feb 2019 22:25:24 -0700 +Subject: staging: rtlwifi: Use proper enum for return in + halmac_parse_psd_data_88xx + +From: Nathan Chancellor + +[ Upstream commit e8edc32d70a4e09160835792eb5d1af71a0eec14 ] + +Clang warns: + +drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c:2472:11: +warning: implicit conversion from enumeration type 'enum +halmac_cmd_process_status' to different enumeration type 'enum +halmac_ret_status' [-Wenum-conversion] + return HALMAC_CMD_PROCESS_ERROR; + ~~~~~~ ^~~~~~~~~~~~~~~~~~~~~~~~ +1 warning generated. + +Fix this by using the proper enum for allocation failures, +HALMAC_RET_MALLOC_FAIL, which is used in the rest of this file. + +Fixes: e4b08e16b7d9 ("staging: r8822be: check kzalloc return or bail") +Link: https://github.com/ClangBuiltLinux/linux/issues/375 +Signed-off-by: Nathan Chancellor +Reviewed-by: Nicholas Mc Guire +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c +index 15091ee587dbf..65edd14a1147a 100644 +--- a/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c ++++ b/drivers/staging/rtlwifi/halmac/halmac_88xx/halmac_func_88xx.c +@@ -2495,7 +2495,7 @@ halmac_parse_psd_data_88xx(struct halmac_adapter *halmac_adapter, u8 *c2h_buf, + if (!psd_set->data) { + psd_set->data = kzalloc(psd_set->data_size, GFP_KERNEL); + if (!psd_set->data) +- return HALMAC_CMD_PROCESS_ERROR; ++ return HALMAC_RET_MALLOC_FAIL; + } + + if (segment_id == 0) +-- +2.20.1 + diff --git a/queue-4.14/switchtec-remove-immediate-status-check-after-submit.patch b/queue-4.14/switchtec-remove-immediate-status-check-after-submit.patch new file mode 100644 index 00000000000..621d6a4d20b --- /dev/null +++ b/queue-4.14/switchtec-remove-immediate-status-check-after-submit.patch @@ -0,0 +1,53 @@ +From 76cf2945c2e9765d78261b48a7eed108a7349b3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Dec 2018 17:12:20 +0800 +Subject: switchtec: Remove immediate status check after submitting MRPC + command + +From: Kelvin Cao + +[ Upstream commit 526180408b815aa7b96fd48bd23cdd33ef04e38e ] + +After submitting a Firmware Download MRPC command, Switchtec firmware will +delay Management EP BAR MemRd TLP responses by more than 10ms. This is a +firmware limitation. Delayed MemRd completions are a problem for systems +with a low Completion Timeout (CTO). + +The current driver checks the MRPC status immediately after submitting an +MRPC command, which results in a delayed MemRd completion that may cause a +Completion Timeout. + +Remove the immediate status check and rely on the check after receiving an +interrupt or timing out. + +This is only a software workaround to the READ issue and a proper fix of +this should be done in firmware. + +Fixes: 080b47def5e5 ("MicroSemi Switchtec management interface driver") +Signed-off-by: Kelvin Cao +Signed-off-by: Wesley Sheng +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/pci/switch/switchtec.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 0941555b84a52..73dba2739849b 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -399,10 +399,6 @@ static void mrpc_cmd_submit(struct switchtec_dev *stdev) + stuser->data, stuser->data_len); + iowrite32(stuser->cmd, &stdev->mmio_mrpc->cmd); + +- stuser->status = ioread32(&stdev->mmio_mrpc->status); +- if (stuser->status != SWITCHTEC_MRPC_STATUS_INPROGRESS) +- mrpc_complete_cmd(stdev); +- + schedule_delayed_work(&stdev->mrpc_timeout, + msecs_to_jiffies(500)); + } +-- +2.20.1 + diff --git a/queue-4.14/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch b/queue-4.14/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch new file mode 100644 index 00000000000..ce64b1e6952 --- /dev/null +++ b/queue-4.14/tcp-annotate-lockless-access-to-tcp_memory_pressure.patch @@ -0,0 +1,63 @@ +From 8be3a03bdee12d15139267363f81bff0346801a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:10:15 -0700 +Subject: tcp: annotate lockless access to tcp_memory_pressure + +From: Eric Dumazet + +[ Upstream commit 1f142c17d19a5618d5a633195a46f2c8be9bf232 ] + +tcp_memory_pressure is read without holding any lock, +and its value could be changed on other cpus. + +Use READ_ONCE() to annotate these lockless reads. + +The write side is already using atomic ops. + +Fixes: b8da51ebb1aa ("tcp: introduce tcp_under_memory_pressure()") +Signed-off-by: Eric Dumazet +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 2 +- + net/ipv4/tcp.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 00d10f0e11949..c963023103149 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -289,7 +289,7 @@ static inline bool tcp_under_memory_pressure(const struct sock *sk) + mem_cgroup_under_socket_pressure(sk->sk_memcg)) + return true; + +- return tcp_memory_pressure; ++ return READ_ONCE(tcp_memory_pressure); + } + /* + * The next routines deal with comparing 32 bit unsigned ints +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 8f07655718f34..db1eceda2359c 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -328,7 +328,7 @@ void tcp_enter_memory_pressure(struct sock *sk) + { + unsigned long val; + +- if (tcp_memory_pressure) ++ if (READ_ONCE(tcp_memory_pressure)) + return; + val = jiffies; + +@@ -343,7 +343,7 @@ void tcp_leave_memory_pressure(struct sock *sk) + { + unsigned long val; + +- if (!tcp_memory_pressure) ++ if (!READ_ONCE(tcp_memory_pressure)) + return; + val = xchg(&tcp_memory_pressure, 0); + if (val) +-- +2.20.1 + diff --git a/queue-4.14/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch b/queue-4.14/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch new file mode 100644 index 00000000000..79b0287e0c2 --- /dev/null +++ b/queue-4.14/thermal-cpu_cooling-actually-trace-cpu-load-in-therm.patch @@ -0,0 +1,59 @@ +From bb978f3442a408348838410a17fe413676d0e2aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 May 2019 11:32:38 -0700 +Subject: thermal: cpu_cooling: Actually trace CPU load in + thermal_power_cpu_get_power + +From: Matthias Kaehlcke + +[ Upstream commit bf45ac18b78038e43af3c1a273cae4ab5704d2ce ] + +The CPU load values passed to the thermal_power_cpu_get_power +tracepoint are zero for all CPUs, unless, unless the +thermal_power_cpu_limit tracepoint is enabled too: + + irq/41-rockchip-98 [000] .... 290.972410: thermal_power_cpu_get_power: + cpus=0000000f freq=1800000 load={{0x0,0x0,0x0,0x0}} dynamic_power=4815 + +vs + + irq/41-rockchip-96 [000] .... 95.773585: thermal_power_cpu_get_power: + cpus=0000000f freq=1800000 load={{0x56,0x64,0x64,0x5e}} dynamic_power=4959 + irq/41-rockchip-96 [000] .... 95.773596: thermal_power_cpu_limit: + cpus=0000000f freq=408000 cdev_state=10 power=416 + +There seems to be no good reason for omitting the CPU load information +depending on another tracepoint. My guess is that the intention was to +check whether thermal_power_cpu_get_power is (still) enabled, however +'load_cpu != NULL' already indicates that it was at least enabled when +cpufreq_get_requested_power() was entered, there seems little gain +from omitting the assignment if the tracepoint was just disabled, so +just remove the check. + +Fixes: 6828a4711f99 ("thermal: add trace events to the power allocator governor") +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Daniel Lezcano +Acked-by: Javi Merino +Acked-by: Viresh Kumar +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/cpu_cooling.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c +index 908a8014cf767..aed995ec2c909 100644 +--- a/drivers/thermal/cpu_cooling.c ++++ b/drivers/thermal/cpu_cooling.c +@@ -514,7 +514,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev, + load = 0; + + total_load += load; +- if (trace_thermal_power_cpu_limit_enabled() && load_cpu) ++ if (load_cpu) + load_cpu[i] = load; + + i++; +-- +2.20.1 + diff --git a/queue-4.14/thermal-mediatek-fix-register-index-error.patch b/queue-4.14/thermal-mediatek-fix-register-index-error.patch new file mode 100644 index 00000000000..8b5d58f3cac --- /dev/null +++ b/queue-4.14/thermal-mediatek-fix-register-index-error.patch @@ -0,0 +1,47 @@ +From 0b714ea36c92f4fafacdc6cd3d39e0d45e491c25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Feb 2019 15:38:07 +0800 +Subject: thermal: mediatek: fix register index error + +From: Michael Kao + +[ Upstream commit eb9aecd90d1a39601e91cd08b90d5fee51d321a6 ] + +The index of msr and adcpnp should match the sensor +which belongs to the selected bank in the for loop. + +Fixes: b7cf0053738c ("thermal: Add Mediatek thermal driver for mt2701.") +Signed-off-by: Michael Kao +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/mtk_thermal.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/mtk_thermal.c b/drivers/thermal/mtk_thermal.c +index 1e61c09153c9a..76b92083744c9 100644 +--- a/drivers/thermal/mtk_thermal.c ++++ b/drivers/thermal/mtk_thermal.c +@@ -407,7 +407,8 @@ static int mtk_thermal_bank_temperature(struct mtk_thermal_bank *bank) + u32 raw; + + for (i = 0; i < conf->bank_data[bank->id].num_sensors; i++) { +- raw = readl(mt->thermal_base + conf->msr[i]); ++ raw = readl(mt->thermal_base + ++ conf->msr[conf->bank_data[bank->id].sensors[i]]); + + temp = raw_to_mcelsius(mt, + conf->bank_data[bank->id].sensors[i], +@@ -544,7 +545,8 @@ static void mtk_thermal_init_bank(struct mtk_thermal *mt, int num, + + for (i = 0; i < conf->bank_data[num].num_sensors; i++) + writel(conf->sensor_mux_values[conf->bank_data[num].sensors[i]], +- mt->thermal_base + conf->adcpnp[i]); ++ mt->thermal_base + ++ conf->adcpnp[conf->bank_data[num].sensors[i]]); + + writel((1 << conf->bank_data[num].num_sensors) - 1, + mt->thermal_base + TEMP_MONCTL0); +-- +2.20.1 + diff --git a/queue-4.14/tipc-reduce-risk-of-wakeup-queue-starvation.patch b/queue-4.14/tipc-reduce-risk-of-wakeup-queue-starvation.patch new file mode 100644 index 00000000000..f82c6afcbf8 --- /dev/null +++ b/queue-4.14/tipc-reduce-risk-of-wakeup-queue-starvation.patch @@ -0,0 +1,86 @@ +From 198f180d550d3e2981a59b920b6a5eef7d9eac24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jul 2019 16:23:18 +0200 +Subject: tipc: reduce risk of wakeup queue starvation + +From: Jon Maloy + +[ Upstream commit 7c5b42055964f587e55bd87ef334c3a27e95d144 ] + +In commit 365ad353c256 ("tipc: reduce risk of user starvation during +link congestion") we allowed senders to add exactly one list of extra +buffers to the link backlog queues during link congestion (aka +"oversubscription"). However, the criteria for when to stop adding +wakeup messages to the input queue when the overload abates is +inaccurate, and may cause starvation problems during very high load. + +Currently, we stop adding wakeup messages after 10 total failed attempts +where we find that there is no space left in the backlog queue for a +certain importance level. The counter for this is accumulated across all +levels, which may lead the algorithm to leave the loop prematurely, +although there may still be plenty of space available at some levels. +The result is sometimes that messages near the wakeup queue tail are not +added to the input queue as they should be. + +We now introduce a more exact algorithm, where we keep adding wakeup +messages to a level as long as the backlog queue has free slots for +the corresponding level, and stop at the moment there are no more such +slots or when there are no more wakeup messages to dequeue. + +Fixes: 365ad35 ("tipc: reduce risk of user starvation during link congestion") +Reported-by: Tung Nguyen +Acked-by: Ying Xue +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/link.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/net/tipc/link.c b/net/tipc/link.c +index da749916faac4..82e4e0e152d16 100644 +--- a/net/tipc/link.c ++++ b/net/tipc/link.c +@@ -811,18 +811,31 @@ static int link_schedule_user(struct tipc_link *l, struct tipc_msg *hdr) + */ + void link_prepare_wakeup(struct tipc_link *l) + { ++ struct sk_buff_head *wakeupq = &l->wakeupq; ++ struct sk_buff_head *inputq = l->inputq; + struct sk_buff *skb, *tmp; +- int imp, i = 0; ++ struct sk_buff_head tmpq; ++ int avail[5] = {0,}; ++ int imp = 0; ++ ++ __skb_queue_head_init(&tmpq); + +- skb_queue_walk_safe(&l->wakeupq, skb, tmp) { ++ for (; imp <= TIPC_SYSTEM_IMPORTANCE; imp++) ++ avail[imp] = l->backlog[imp].limit - l->backlog[imp].len; ++ ++ skb_queue_walk_safe(wakeupq, skb, tmp) { + imp = TIPC_SKB_CB(skb)->chain_imp; +- if (l->backlog[imp].len < l->backlog[imp].limit) { +- skb_unlink(skb, &l->wakeupq); +- skb_queue_tail(l->inputq, skb); +- } else if (i++ > 10) { +- break; +- } ++ if (avail[imp] <= 0) ++ continue; ++ avail[imp]--; ++ __skb_unlink(skb, wakeupq); ++ __skb_queue_tail(&tmpq, skb); + } ++ ++ spin_lock_bh(&inputq->lock); ++ skb_queue_splice_tail(&tmpq, inputq); ++ spin_unlock_bh(&inputq->lock); ++ + } + + void tipc_link_reset(struct tipc_link *l) +-- +2.20.1 + diff --git a/queue-4.14/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch b/queue-4.14/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch new file mode 100644 index 00000000000..2e0daeb6198 --- /dev/null +++ b/queue-4.14/tipc-set-sysctl_tipc_rmem-and-named_timeout-right-ra.patch @@ -0,0 +1,60 @@ +From f94374d3b8f185e052732fc473ddd682bb93e4cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2019 13:10:09 +0800 +Subject: tipc: set sysctl_tipc_rmem and named_timeout right range + +From: Jie Liu + +[ Upstream commit 4bcd4ec1017205644a2697bccbc3b5143f522f5f ] + +We find that sysctl_tipc_rmem and named_timeout do not have the right minimum +setting. sysctl_tipc_rmem should be larger than zero, like sysctl_tcp_rmem. +And named_timeout as a timeout setting should be not less than zero. + +Fixes: cc79dd1ba9c10 ("tipc: change socket buffer overflow control to respect sk_rcvbuf") +Fixes: a5325ae5b8bff ("tipc: add name distributor resiliency queue") +Signed-off-by: Jie Liu +Reported-by: Qiang Ning +Reviewed-by: Zhiqiang Liu +Reviewed-by: Miaohe Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/sysctl.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/net/tipc/sysctl.c b/net/tipc/sysctl.c +index 1a779b1e85100..40f6d82083d7b 100644 +--- a/net/tipc/sysctl.c ++++ b/net/tipc/sysctl.c +@@ -37,6 +37,8 @@ + + #include + ++static int zero; ++static int one = 1; + static struct ctl_table_header *tipc_ctl_hdr; + + static struct ctl_table tipc_table[] = { +@@ -45,14 +47,16 @@ static struct ctl_table tipc_table[] = { + .data = &sysctl_tipc_rmem, + .maxlen = sizeof(sysctl_tipc_rmem), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &one, + }, + { + .procname = "named_timeout", + .data = &sysctl_tipc_named_timeout, + .maxlen = sizeof(sysctl_tipc_named_timeout), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &zero, + }, + {} + }; +-- +2.20.1 + diff --git a/queue-4.14/tipc-tipc-clang-warning.patch b/queue-4.14/tipc-tipc-clang-warning.patch new file mode 100644 index 00000000000..b830d42d664 --- /dev/null +++ b/queue-4.14/tipc-tipc-clang-warning.patch @@ -0,0 +1,69 @@ +From fcb471930c951e6427547cd4125f1842e26c64c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Mar 2019 15:03:51 +0100 +Subject: tipc: tipc clang warning + +From: Jon Maloy + +[ Upstream commit 737889efe9713a0f20a75fd0de952841d9275e6b ] + +When checking the code with clang -Wsometimes-uninitialized we get the +following warning: + +if (!tipc_link_is_establishing(l)) { + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +net/tipc/node.c:847:46: note: uninitialized use occurs here + tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr); + +net/tipc/node.c:831:2: note: remove the 'if' if its condition is always +true +if (!tipc_link_is_establishing(l)) { + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +net/tipc/node.c:821:31: note: initialize the variable 'maddr' to silence +this warning +struct tipc_media_addr *maddr; + +We fix this by initializing 'maddr' to NULL. For the matter of clarity, +we also test if 'xmitq' is non-empty before we use it and 'maddr' +further down in the function. It will never happen that 'xmitq' is non- +empty at the same time as 'maddr' is NULL, so this is a sufficient test. + +Fixes: 598411d70f85 ("tipc: make resetting of links non-atomic") +Reported-by: Nathan Chancellor +Signed-off-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/node.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 42e9bdcc4bb6e..82f8f69f4d6b0 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -688,10 +688,10 @@ static void __tipc_node_link_down(struct tipc_node *n, int *bearer_id, + static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete) + { + struct tipc_link_entry *le = &n->links[bearer_id]; ++ struct tipc_media_addr *maddr = NULL; + struct tipc_link *l = le->link; +- struct tipc_media_addr *maddr; +- struct sk_buff_head xmitq; + int old_bearer_id = bearer_id; ++ struct sk_buff_head xmitq; + + if (!l) + return; +@@ -713,7 +713,8 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete) + tipc_node_write_unlock(n); + if (delete) + tipc_mon_remove_peer(n->net, n->addr, old_bearer_id); +- tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr); ++ if (!skb_queue_empty(&xmitq)) ++ tipc_bearer_xmit(n->net, bearer_id, &xmitq, maddr); + tipc_sk_rcv(n->net, &le->inputq); + } + +-- +2.20.1 + diff --git a/queue-4.14/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch b/queue-4.14/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch new file mode 100644 index 00000000000..0919f70b4cd --- /dev/null +++ b/queue-4.14/tty-ipwireless-fix-potential-null-pointer-dereferenc.patch @@ -0,0 +1,36 @@ +From 1aa5b42ce2cd1e6faa7dc0b6c59054bca8e3e98c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jan 2019 18:30:51 +0800 +Subject: tty: ipwireless: Fix potential NULL pointer dereference + +From: YueHaibing + +[ Upstream commit 7dd50e205b3348dc7784efbdf85723551de64a25 ] + +There is a potential NULL pointer dereference in case +alloc_ctrl_packet() fails and returns NULL. + +Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem") +Signed-off-by: YueHaibing +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/ipwireless/hardware.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c +index a6b8240af6cdd..960e9375a1a9e 100644 +--- a/drivers/tty/ipwireless/hardware.c ++++ b/drivers/tty/ipwireless/hardware.c +@@ -1516,6 +1516,8 @@ static void ipw_send_setup_packet(struct ipw_hardware *hw) + sizeof(struct ipw_setup_get_version_query_packet), + ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP, + TL_SETUP_SIGNO_GET_VERSION_QRY); ++ if (!ver_packet) ++ return; + ver_packet->header.length = sizeof(struct tl_setup_get_version_qry); + + /* +-- +2.20.1 + diff --git a/queue-4.14/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch b/queue-4.14/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch new file mode 100644 index 00000000000..8c689131452 --- /dev/null +++ b/queue-4.14/tty-serial-fsl_lpuart-use-appropriate-lpuart32_-i-o-.patch @@ -0,0 +1,100 @@ +From 782da2e4b013a4086dfb9477d227aa7fc3e6e4d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jul 2019 12:52:15 -0700 +Subject: tty: serial: fsl_lpuart: Use appropriate lpuart32_* I/O funcs + +From: Andrey Smirnov + +[ Upstream commit 1da17d7cf8e2c4b60163d54300f72c02f510327c ] + +When dealing with 32-bit variant of LPUART IP block appropriate I/O +helpers have to be used to properly deal with endianness +differences. Change all of the offending code to do that. + +Fixes: a5fa2660d787 ("tty/serial/fsl_lpuart: Add CONSOLE_POLL support +for lpuart32.") +Signed-off-by: Andrey Smirnov +Cc: Stefan Agner +Cc: Bhuvanchandra DV +Cc: Chris Healy +Cc: Cory Tusar +Cc: Lucas Stach +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: linux-imx@nxp.com +Cc: linux-serial@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Link: https://lore.kernel.org/r/20190729195226.8862-14-andrew.smirnov@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index fb2dcb3f85911..16422987ab0f3 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -532,26 +532,26 @@ static int lpuart32_poll_init(struct uart_port *port) + spin_lock_irqsave(&sport->port.lock, flags); + + /* Disable Rx & Tx */ +- writel(0, sport->port.membase + UARTCTRL); ++ lpuart32_write(&sport->port, UARTCTRL, 0); + +- temp = readl(sport->port.membase + UARTFIFO); ++ temp = lpuart32_read(&sport->port, UARTFIFO); + + /* Enable Rx and Tx FIFO */ +- writel(temp | UARTFIFO_RXFE | UARTFIFO_TXFE, +- sport->port.membase + UARTFIFO); ++ lpuart32_write(&sport->port, UARTFIFO, ++ temp | UARTFIFO_RXFE | UARTFIFO_TXFE); + + /* flush Tx and Rx FIFO */ +- writel(UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH, +- sport->port.membase + UARTFIFO); ++ lpuart32_write(&sport->port, UARTFIFO, ++ UARTFIFO_TXFLUSH | UARTFIFO_RXFLUSH); + + /* explicitly clear RDRF */ +- if (readl(sport->port.membase + UARTSTAT) & UARTSTAT_RDRF) { +- readl(sport->port.membase + UARTDATA); +- writel(UARTFIFO_RXUF, sport->port.membase + UARTFIFO); ++ if (lpuart32_read(&sport->port, UARTSTAT) & UARTSTAT_RDRF) { ++ lpuart32_read(&sport->port, UARTDATA); ++ lpuart32_write(&sport->port, UARTFIFO, UARTFIFO_RXUF); + } + + /* Enable Rx and Tx */ +- writel(UARTCTRL_RE | UARTCTRL_TE, sport->port.membase + UARTCTRL); ++ lpuart32_write(&sport->port, UARTCTRL, UARTCTRL_RE | UARTCTRL_TE); + spin_unlock_irqrestore(&sport->port.lock, flags); + + return 0; +@@ -559,18 +559,18 @@ static int lpuart32_poll_init(struct uart_port *port) + + static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c) + { +- while (!(readl(port->membase + UARTSTAT) & UARTSTAT_TDRE)) ++ while (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_TDRE)) + barrier(); + +- writel(c, port->membase + UARTDATA); ++ lpuart32_write(port, UARTDATA, c); + } + + static int lpuart32_poll_get_char(struct uart_port *port) + { +- if (!(readl(port->membase + UARTSTAT) & UARTSTAT_RDRF)) ++ if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF)) + return NO_POLL_CHAR; + +- return readl(port->membase + UARTDATA); ++ return lpuart32_read(port, UARTDATA); + } + #endif + +-- +2.20.1 + diff --git a/queue-4.14/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch b/queue-4.14/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch new file mode 100644 index 00000000000..e69ad93459b --- /dev/null +++ b/queue-4.14/usb-gadget-fsl-fix-link-error-against-usb-gadget-mod.patch @@ -0,0 +1,41 @@ +From 4bbe79babf6257027dfa636af192184a22a39661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Apr 2019 14:25:32 +0200 +Subject: usb: gadget: fsl: fix link error against usb-gadget module + +From: Arnd Bergmann + +[ Upstream commit 2100e3ca3676e894fa48b8f6f01d01733387fe81 ] + +The dependency to ensure this driver links correctly fails since +it can not be a loadable module: + +drivers/usb/phy/phy-fsl-usb.o: In function `fsl_otg_set_peripheral': +phy-fsl-usb.c:(.text+0x2224): undefined reference to `usb_gadget_vbus_disconnect' + +Make the option 'tristate' so it can work correctly. + +Fixes: 5a8d651a2bde ("usb: gadget: move gadget API functions to udc-core") +Signed-off-by: Arnd Bergmann +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig +index 85a92d0813dd0..440238061eddf 100644 +--- a/drivers/usb/phy/Kconfig ++++ b/drivers/usb/phy/Kconfig +@@ -20,7 +20,7 @@ config AB8500_USB + in host mode, low speed. + + config FSL_USB2_OTG +- bool "Freescale USB OTG Transceiver Driver" ++ tristate "Freescale USB OTG Transceiver Driver" + depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_OTG_FSM=y && PM + depends on USB_GADGET || !USB_GADGET # if USB_GADGET=m, this can't be 'y' + select USB_PHY +-- +2.20.1 + diff --git a/queue-4.14/usb-host-xhci-hub-fix-extra-endianness-conversion.patch b/queue-4.14/usb-host-xhci-hub-fix-extra-endianness-conversion.patch new file mode 100644 index 00000000000..2acec50e914 --- /dev/null +++ b/queue-4.14/usb-host-xhci-hub-fix-extra-endianness-conversion.patch @@ -0,0 +1,44 @@ +From 0511297fe62f0865d5268131f9175d3b609073db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jul 2019 15:17:19 +0300 +Subject: usb: host: xhci-hub: fix extra endianness conversion + +From: Ruslan Bilovol + +[ Upstream commit 6269e4c76eacabaea0d0099200ae1a455768d208 ] + +Don't do extra cpu_to_le32 conversion for +put_unaligned_le32 because it is already implemented +in this function. + +Fixes sparse error: +xhci-hub.c:1152:44: warning: incorrect type in argument 1 (different base types) +xhci-hub.c:1152:44: expected unsigned int [usertype] val +xhci-hub.c:1152:44: got restricted __le32 [usertype] + +Fixes: 395f540 "xhci: support new USB 3.1 hub request to get extended port status" +Cc: Mathias Nyman +Signed-off-by: Ruslan Bilovol +Link: https://lore.kernel.org/r/1562501839-26522-1-git-send-email-ruslan.bilovol@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci-hub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index d1363f3fabfa6..3bb38d9dc45bf 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1118,7 +1118,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + } + port_li = readl(port_array[wIndex] + PORTLI); + status = xhci_get_ext_port_status(temp, port_li); +- put_unaligned_le32(cpu_to_le32(status), &buf[4]); ++ put_unaligned_le32(status, &buf[4]); + } + break; + case SetPortFeature: +-- +2.20.1 + diff --git a/queue-4.14/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch b/queue-4.14/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch new file mode 100644 index 00000000000..07bfdb697b8 --- /dev/null +++ b/queue-4.14/usb-phy-twl6030-usb-fix-possible-use-after-free-on-r.patch @@ -0,0 +1,41 @@ +From 9236f2277c25da5f55a643b12279ee43a628cfb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Feb 2019 10:04:26 -0500 +Subject: usb: phy: twl6030-usb: fix possible use-after-free on remove + +From: Sven Van Asbroeck + +[ Upstream commit 5895d311d28f2605e2f71c1a3e043ed38f3ac9d2 ] + +In remove(), use cancel_delayed_work_sync() to cancel the +delayed work. Otherwise there's a chance that this work +will continue to run until after the device has been removed. + +This issue was detected with the help of Coccinelle. + +Cc: Tony Lindgren +Cc: Bin Liu +Fixes: b6a619a883c3 ("usb: phy: Check initial state for twl6030") +Signed-off-by: Sven Van Asbroeck +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/phy/phy-twl6030-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/phy/phy-twl6030-usb.c b/drivers/usb/phy/phy-twl6030-usb.c +index b5dc077ed7d3c..8e14fa2211912 100644 +--- a/drivers/usb/phy/phy-twl6030-usb.c ++++ b/drivers/usb/phy/phy-twl6030-usb.c +@@ -413,7 +413,7 @@ static int twl6030_usb_remove(struct platform_device *pdev) + { + struct twl6030_usb *twl = platform_get_drvdata(pdev); + +- cancel_delayed_work(&twl->get_status_work); ++ cancel_delayed_work_sync(&twl->get_status_work); + twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK, + REG_INT_MSK_LINE_C); + twl6030_interrupt_mask(TWL6030_USBOTG_INT_MASK, +-- +2.20.1 + diff --git a/queue-4.14/vfio-mdev-avoid-release-parent-reference-during-erro.patch b/queue-4.14/vfio-mdev-avoid-release-parent-reference-during-erro.patch new file mode 100644 index 00000000000..f35a039154f --- /dev/null +++ b/queue-4.14/vfio-mdev-avoid-release-parent-reference-during-erro.patch @@ -0,0 +1,40 @@ +From b527df804f2b394940a4171e4bf3508e1b0e9c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2019 17:49:28 -0500 +Subject: vfio/mdev: Avoid release parent reference during error path + +From: Parav Pandit + +[ Upstream commit 60e7f2c3fe9919cee9534b422865eed49f4efb15 ] + +During mdev parent registration in mdev_register_device(), +if parent device is duplicate, it releases the reference of existing +parent device. +This is incorrect. Existing parent device should not be touched. + +Fixes: 7b96953bc640 ("vfio: Mediated device Core driver") +Reviewed-by: Cornelia Huck +Reviewed-by: Kirti Wankhede +Reviewed-by: Maxim Levitsky +Signed-off-by: Parav Pandit +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/mdev/mdev_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c +index 0212f0ee8aea7..8cfa712308773 100644 +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -182,6 +182,7 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops) + /* Check for duplicate */ + parent = __find_parent_device(dev); + if (parent) { ++ parent = NULL; + ret = -EEXIST; + goto add_dev_err; + } +-- +2.20.1 + diff --git a/queue-4.14/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch b/queue-4.14/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch new file mode 100644 index 00000000000..226dad61fed --- /dev/null +++ b/queue-4.14/vfio-mdev-fix-aborting-mdev-child-device-removal-if-.patch @@ -0,0 +1,77 @@ +From 36cd079a13e4c4e96f89f05185b5facd8fcb5309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Apr 2019 17:49:33 -0500 +Subject: vfio/mdev: Fix aborting mdev child device removal if one fails + +From: Parav Pandit + +[ Upstream commit 6093e348a5e2475c5bb2e571346460f939998670 ] + +device_for_each_child() stops executing callback function for remaining +child devices, if callback hits an error. +Each child mdev device is independent of each other. +While unregistering parent device, mdev core must remove all child mdev +devices. +Therefore, mdev_device_remove_cb() always returns success so that +device_for_each_child doesn't abort if one child removal hits error. + +While at it, improve remove and unregister functions for below simplicity. + +There isn't need to pass forced flag pointer during mdev parent +removal which invokes mdev_device_remove(). So simplify the flow. + +mdev_device_remove() is called from two paths. +1. mdev_unregister_driver() + mdev_device_remove_cb() + mdev_device_remove() +2. remove_store() + mdev_device_remove() + +Fixes: 7b96953bc640 ("vfio: Mediated device Core driver") +Reviewed-by: Maxim Levitsky +Signed-off-by: Parav Pandit +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/mdev/mdev_core.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c +index 8cfa712308773..e052f62fdea7e 100644 +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -150,10 +150,10 @@ static int mdev_device_remove_ops(struct mdev_device *mdev, bool force_remove) + + static int mdev_device_remove_cb(struct device *dev, void *data) + { +- if (!dev_is_mdev(dev)) +- return 0; ++ if (dev_is_mdev(dev)) ++ mdev_device_remove(dev, true); + +- return mdev_device_remove(dev, data ? *(bool *)data : true); ++ return 0; + } + + /* +@@ -241,7 +241,6 @@ EXPORT_SYMBOL(mdev_register_device); + void mdev_unregister_device(struct device *dev) + { + struct mdev_parent *parent; +- bool force_remove = true; + + mutex_lock(&parent_list_lock); + parent = __find_parent_device(dev); +@@ -255,8 +254,7 @@ void mdev_unregister_device(struct device *dev) + list_del(&parent->next); + class_compat_remove_link(mdev_bus_compat_class, dev, NULL); + +- device_for_each_child(dev, (void *)&force_remove, +- mdev_device_remove_cb); ++ device_for_each_child(dev, NULL, mdev_device_remove_cb); + + parent_remove_sysfs_files(parent); + +-- +2.20.1 + diff --git a/queue-4.14/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch b/queue-4.14/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch new file mode 100644 index 00000000000..3b386779ae7 --- /dev/null +++ b/queue-4.14/vfio_pci-enable-memory-accesses-before-calling-pci_m.patch @@ -0,0 +1,69 @@ +From d5b525fdd4adabacc8ebfcacbdce34a44654cbbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Feb 2019 17:16:06 +0100 +Subject: vfio_pci: Enable memory accesses before calling pci_map_rom + +From: Eric Auger + +[ Upstream commit 0cfd027be1d6def4a462cdc180c055143af24069 ] + +pci_map_rom/pci_get_rom_size() performs memory access in the ROM. +In case the Memory Space accesses were disabled, readw() is likely +to trigger a synchronous external abort on some platforms. + +In case memory accesses were disabled, re-enable them before the +call and disable them back again just after. + +Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") +Signed-off-by: Eric Auger +Suggested-by: Alex Williamson +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 9bd3e7911af2b..550ab7707b57f 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -717,6 +717,7 @@ static long vfio_pci_ioctl(void *device_data, + { + void __iomem *io; + size_t size; ++ u16 orig_cmd; + + info.offset = VFIO_PCI_INDEX_TO_OFFSET(info.index); + info.flags = 0; +@@ -732,15 +733,23 @@ static long vfio_pci_ioctl(void *device_data, + break; + } + +- /* Is it really there? */ ++ /* ++ * Is it really there? Enable memory decode for ++ * implicit access in pci_map_rom(). ++ */ ++ pci_read_config_word(pdev, PCI_COMMAND, &orig_cmd); ++ pci_write_config_word(pdev, PCI_COMMAND, ++ orig_cmd | PCI_COMMAND_MEMORY); ++ + io = pci_map_rom(pdev, &size); +- if (!io || !size) { ++ if (io) { ++ info.flags = VFIO_REGION_INFO_FLAG_READ; ++ pci_unmap_rom(pdev, io); ++ } else { + info.size = 0; +- break; + } +- pci_unmap_rom(pdev, io); + +- info.flags = VFIO_REGION_INFO_FLAG_READ; ++ pci_write_config_word(pdev, PCI_COMMAND, orig_cmd); + break; + } + case VFIO_PCI_VGA_REGION_INDEX: +-- +2.20.1 + diff --git a/queue-4.14/vxlan-changelink-fix-handling-of-default-remotes.patch b/queue-4.14/vxlan-changelink-fix-handling-of-default-remotes.patch new file mode 100644 index 00000000000..b20e4983b27 --- /dev/null +++ b/queue-4.14/vxlan-changelink-fix-handling-of-default-remotes.patch @@ -0,0 +1,94 @@ +From 1c9df81aaa6cfe46c8a37c04e2ff67c3ebcd61ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Dec 2018 13:16:02 +0000 +Subject: vxlan: changelink: Fix handling of default remotes + +From: Petr Machata + +[ Upstream commit ce5e098f7a10b4bf8e948c12fa350320c5c3afad ] + +Default remotes are stored as FDB entries with an Ethernet address of +00:00:00:00:00:00. When a request is made to change a remote address of +a VXLAN device, vxlan_changelink() first deletes the existing default +remote, and then creates a new FDB entry. + +This works well as long as the list of default remotes matches exactly +the configuration of a VXLAN remote address. Thus when the VXLAN device +has a remote of X, there should be exactly one default remote FDB entry +X. If the VXLAN device has no remote address, there should be no such +entry. + +Besides using "ip link set", it is possible to manipulate the list of +default remotes by using the "bridge fdb". It is therefore easy to break +the above condition. Under such circumstances, the __vxlan_fdb_delete() +call doesn't delete the FDB entry itself, but just one remote. The +following vxlan_fdb_create() then creates a new FDB entry, leading to a +situation where two entries exist for the address 00:00:00:00:00:00, +each with a different subset of default remotes. + +An even more obvious breakage rooted in the same cause can be observed +when a remote address is configured for a VXLAN device that did not have +one before. In that case vxlan_changelink() doesn't remove any remote, +and just creates a new FDB entry for the new address: + +$ ip link add name vx up type vxlan id 2000 dstport 4789 +$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.20 self permanent +$ bridge fdb ap dev vx 00:00:00:00:00:00 dst 192.0.2.30 self permanent +$ ip link set dev vx type vxlan remote 192.0.2.30 +$ bridge fdb sh dev vx | grep 00:00:00:00:00:00 +00:00:00:00:00:00 dst 192.0.2.30 self permanent <- new entry, 1 rdst +00:00:00:00:00:00 dst 192.0.2.20 self permanent <- orig. entry, 2 rdsts +00:00:00:00:00:00 dst 192.0.2.30 self permanent + +To fix this, instead of calling vxlan_fdb_create() directly, defer to +vxlan_fdb_update(). That has logic to handle the duplicates properly. +Additionally, it also handles notifications, so drop that call from +changelink as well. + +Fixes: 0241b836732f ("vxlan: fix default fdb entry netlink notify ordering during netdev create") +Signed-off-by: Petr Machata +Acked-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 5aa7d5091f4d0..4d97a7b5fe3ca 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3494,7 +3494,6 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + struct vxlan_rdst *dst = &vxlan->default_dst; + struct vxlan_rdst old_dst; + struct vxlan_config conf; +- struct vxlan_fdb *f = NULL; + int err; + + err = vxlan_nl2conf(tb, data, +@@ -3520,19 +3519,19 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + old_dst.remote_ifindex, 0); + + if (!vxlan_addr_any(&dst->remote_ip)) { +- err = vxlan_fdb_create(vxlan, all_zeros_mac, ++ err = vxlan_fdb_update(vxlan, all_zeros_mac, + &dst->remote_ip, + NUD_REACHABLE | NUD_PERMANENT, ++ NLM_F_APPEND | NLM_F_CREATE, + vxlan->cfg.dst_port, + dst->remote_vni, + dst->remote_vni, + dst->remote_ifindex, +- NTF_SELF, &f); ++ NTF_SELF); + if (err) { + spin_unlock_bh(&vxlan->hash_lock); + return err; + } +- vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH); + } + spin_unlock_bh(&vxlan->hash_lock); + } +-- +2.20.1 + diff --git a/queue-4.14/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch b/queue-4.14/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch new file mode 100644 index 00000000000..e709f258a6c --- /dev/null +++ b/queue-4.14/x86-kgbd-use-nmi_vector-not-apic_dm_nmi.patch @@ -0,0 +1,41 @@ +From 7a2f04c8ea59c01b2ff0cea183d896b11e374eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jul 2019 20:47:06 +0200 +Subject: x86/kgbd: Use NMI_VECTOR not APIC_DM_NMI + +From: Thomas Gleixner + +[ Upstream commit 2591bc4e8d70b4e1330d327fb7e3921f4e070a51 ] + +apic->send_IPI_allbutself() takes a vector number as argument. + +APIC_DM_NMI is clearly not a vector number. It's defined to 0x400 which is +outside the vector space. + +Use NMI_VECTOR instead as that's what it is intended to be. + +Fixes: 82da3ff89dc2 ("x86: kgdb support") +Signed-off-by: Thomas Gleixner +Acked-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20190722105218.855189979@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kgdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c +index 8e36f249646e2..904e18bb38c52 100644 +--- a/arch/x86/kernel/kgdb.c ++++ b/arch/x86/kernel/kgdb.c +@@ -438,7 +438,7 @@ static void kgdb_disable_hw_debug(struct pt_regs *regs) + */ + void kgdb_roundup_cpus(unsigned long flags) + { +- apic->send_IPI_allbutself(APIC_DM_NMI); ++ apic->send_IPI_allbutself(NMI_VECTOR); + } + #endif + +-- +2.20.1 + diff --git a/queue-4.14/x86-mm-remove-unused-variable-cpu.patch b/queue-4.14/x86-mm-remove-unused-variable-cpu.patch new file mode 100644 index 00000000000..735ff41414d --- /dev/null +++ b/queue-4.14/x86-mm-remove-unused-variable-cpu.patch @@ -0,0 +1,50 @@ +From 90f82d48874eb51c30b644b892d9d52d9ae995ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Feb 2019 17:01:55 -0500 +Subject: x86/mm: Remove unused variable 'cpu' + +From: Qian Cai + +[ Upstream commit 3609e31bc8dc03b701390f79c74fc7fe92b95039 ] + +The commit a2055abe9c67 ("x86/mm: Pass flush_tlb_info to +flush_tlb_others() etc") removed the unnecessary cpu parameter from +uv_flush_tlb_others() but left an unused variable. + +arch/x86/mm/tlb.c: In function 'native_flush_tlb_others': +arch/x86/mm/tlb.c:688:16: warning: variable 'cpu' set but not used +[-Wunused-but-set-variable] + unsigned int cpu; + ^~~ + +Fixes: a2055abe9c67 ("x86/mm: Pass flush_tlb_info to flush_tlb_others() etc") +Signed-off-by: Qian Cai +Signed-off-by: Thomas Gleixner +Acked-by: Andyt Lutomirski +Cc: dave.hansen@linux.intel.com +Cc: peterz@infradead.org +Cc: bp@alien8.de +Cc: hpa@zytor.com +Link: https://lkml.kernel.org/r/20190228220155.88124-1-cai@lca.pw +Signed-off-by: Sasha Levin +--- + arch/x86/mm/tlb.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c +index 5400a24e1a8c0..c5d7b4ae17cab 100644 +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -651,9 +651,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask, + * that UV should be updated so that smp_call_function_many(), + * etc, are optimal on UV. + */ +- unsigned int cpu; +- +- cpu = smp_processor_id(); + cpumask = uv_flush_tlb_others(cpumask, info); + if (cpumask) + smp_call_function_many(cpumask, flush_tlb_func_remote, +-- +2.20.1 + diff --git a/queue-4.14/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch b/queue-4.14/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch new file mode 100644 index 00000000000..cf4415b8d58 --- /dev/null +++ b/queue-4.14/x86-perf-fix-the-dependency-of-the-x86-insn-decoder-.patch @@ -0,0 +1,40 @@ +From c2828aceaade3b53131b28f17c06447330481439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Sep 2019 12:03:08 +0900 +Subject: x86, perf: Fix the dependency of the x86 insn decoder selftest + +From: Masami Hiramatsu + +[ Upstream commit 7720804a2ae46c90265a32c81c45fb6f8d2f4e8b ] + +Since x86 instruction decoder is not only for kprobes, +it should be tested when the insn.c is compiled. +(e.g. perf is enabled but kprobes is disabled) + +Signed-off-by: Masami Hiramatsu +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: cbe5c34c8c1f ("x86: Compile insn.c and inat.c only for KPROBES") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug +index 6293a8768a912..bec0952c55958 100644 +--- a/arch/x86/Kconfig.debug ++++ b/arch/x86/Kconfig.debug +@@ -189,7 +189,7 @@ config HAVE_MMIOTRACE_SUPPORT + + config X86_DECODER_SELFTEST + bool "x86 instruction decoder selftest" +- depends on DEBUG_KERNEL && KPROBES ++ depends on DEBUG_KERNEL && INSTRUCTION_DECODER + depends on !COMPILE_TEST + ---help--- + Perform x86 instruction decoder selftests at build time. +-- +2.20.1 + diff --git a/queue-4.14/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch b/queue-4.14/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch new file mode 100644 index 00000000000..8708ab3bbf5 --- /dev/null +++ b/queue-4.14/xen-cpu_hotplug-prevent-an-out-of-bounds-access.patch @@ -0,0 +1,38 @@ +From 4b2032f7180971f25bb626e5fcaa4277b4301fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Mar 2019 08:41:22 +0300 +Subject: xen, cpu_hotplug: Prevent an out of bounds access + +From: Dan Carpenter + +[ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ] + +The "cpu" variable comes from the sscanf() so Smatch marks it as +untrusted data. We can't pass a higher value than "nr_cpu_ids" to +cpu_possible() or it results in an out of bounds access. + +Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging") +Signed-off-by: Dan Carpenter +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/cpu_hotplug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c +index b1357aa4bc552..f192b6f42da9f 100644 +--- a/drivers/xen/cpu_hotplug.c ++++ b/drivers/xen/cpu_hotplug.c +@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu) + } + static void vcpu_hotplug(unsigned int cpu) + { +- if (!cpu_possible(cpu)) ++ if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) + return; + + switch (vcpu_online(cpu)) { +-- +2.20.1 +