From: Greg Kroah-Hartman Date: Mon, 19 Nov 2018 10:59:31 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v4.19.3~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bc28d6291a5c2a21df4e18a386baf94f14d0db60;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: clk-s2mps11-fix-matching-when-built-as-module-and-dt-node-contains-compatible.patch libceph-bump-ceph_msg_max_data_len.patch mach64-fix-display-corruption-on-big-endian-machines.patch mach64-fix-image-corruption-due-to-reading-accelerator-registers.patch mtd-docg3-don-t-set-conflicting-bch_const_params-option.patch ocfs2-fix-a-misuse-a-of-brelse-after-failing-ocfs2_check_dir_entry.patch xtensa-fix-boot-parameters-address-translation.patch --- diff --git a/queue-3.18/clk-s2mps11-fix-matching-when-built-as-module-and-dt-node-contains-compatible.patch b/queue-3.18/clk-s2mps11-fix-matching-when-built-as-module-and-dt-node-contains-compatible.patch new file mode 100644 index 00000000000..cd0c03a7e41 --- /dev/null +++ b/queue-3.18/clk-s2mps11-fix-matching-when-built-as-module-and-dt-node-contains-compatible.patch @@ -0,0 +1,77 @@ +From 8985167ecf57f97061599a155bb9652c84ea4913 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 29 Aug 2018 21:20:10 +0200 +Subject: clk: s2mps11: Fix matching when built as module and DT node contains compatible + +From: Krzysztof Kozlowski + +commit 8985167ecf57f97061599a155bb9652c84ea4913 upstream. + +When driver is built as module and DT node contains clocks compatible +(e.g. "samsung,s2mps11-clk"), the module will not be autoloaded because +module aliases won't match. + +The modalias from uevent: of:NclocksTCsamsung,s2mps11-clk +The modalias from driver: platform:s2mps11-clk + +The devices are instantiated by parent's MFD. However both Device Tree +bindings and parent define the compatible for clocks devices. In case +of module matching this DT compatible will be used. + +The issue will not happen if this is a built-in (no need for module +matching) or when clocks DT node does not contain compatible (not +correct from bindings perspective but working for driver). + +Note when backporting to stable kernels: adjust the list of device ID +entries. + +Cc: +Fixes: 53c31b3437a6 ("mfd: sec-core: Add of_compatible strings for clock MFD cells") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Stephen Boyd +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-s2mps11.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -285,6 +285,36 @@ static const struct platform_device_id s + }; + MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); + ++#ifdef CONFIG_OF ++/* ++ * Device is instantiated through parent MFD device and device matching is done ++ * through platform_device_id. ++ * ++ * However if device's DT node contains proper clock compatible and driver is ++ * built as a module, then the *module* matching will be done trough DT aliases. ++ * This requires of_device_id table. In the same time this will not change the ++ * actual *device* matching so do not add .of_match_table. ++ */ ++static const struct of_device_id s2mps11_dt_match[] = { ++ { ++ .compatible = "samsung,s2mps11-clk", ++ .data = (void *)S2MPS11X, ++ }, { ++ .compatible = "samsung,s2mps13-clk", ++ .data = (void *)S2MPS13X, ++ }, { ++ .compatible = "samsung,s2mps14-clk", ++ .data = (void *)S2MPS14X, ++ }, { ++ .compatible = "samsung,s5m8767-clk", ++ .data = (void *)S5M8767X, ++ }, { ++ /* Sentinel */ ++ }, ++}; ++MODULE_DEVICE_TABLE(of, s2mps11_dt_match); ++#endif ++ + static struct platform_driver s2mps11_clk_driver = { + .driver = { + .name = "s2mps11-clk", diff --git a/queue-3.18/libceph-bump-ceph_msg_max_data_len.patch b/queue-3.18/libceph-bump-ceph_msg_max_data_len.patch new file mode 100644 index 00000000000..8556263c1f5 --- /dev/null +++ b/queue-3.18/libceph-bump-ceph_msg_max_data_len.patch @@ -0,0 +1,42 @@ +From 94e6992bb560be8bffb47f287194adf070b57695 Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Wed, 26 Sep 2018 18:03:16 +0200 +Subject: libceph: bump CEPH_MSG_MAX_DATA_LEN + +From: Ilya Dryomov + +commit 94e6992bb560be8bffb47f287194adf070b57695 upstream. + +If the read is large enough, we end up spinning in the messenger: + + libceph: osd0 192.168.122.1:6801 io error + libceph: osd0 192.168.122.1:6801 io error + libceph: osd0 192.168.122.1:6801 io error + +This is a receive side limit, so only reads were affected. + +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/ceph/libceph.h | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -67,7 +67,13 @@ struct ceph_options { + + #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024) + #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) +-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) ++ ++/* ++ * Handle the largest possible rbd object in one message. ++ * There is no limit on the size of cephfs objects, but it has to obey ++ * rsize and wsize mount options anyway. ++ */ ++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024) + + #define CEPH_AUTH_NAME_DEFAULT "guest" + diff --git a/queue-3.18/mach64-fix-display-corruption-on-big-endian-machines.patch b/queue-3.18/mach64-fix-display-corruption-on-big-endian-machines.patch new file mode 100644 index 00000000000..6cf377bf1ed --- /dev/null +++ b/queue-3.18/mach64-fix-display-corruption-on-big-endian-machines.patch @@ -0,0 +1,59 @@ +From 3c6c6a7878d00a3ac997a779c5b9861ff25dfcc8 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 8 Oct 2018 12:57:34 +0200 +Subject: mach64: fix display corruption on big endian machines +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mikulas Patocka + +commit 3c6c6a7878d00a3ac997a779c5b9861ff25dfcc8 upstream. + +The code for manual bit triple is not endian-clean. It builds the variable +"hostdword" using byte accesses, therefore we must read the variable with +"le32_to_cpu". + +The patch also enables (hardware or software) bit triple only if the image +is monochrome (image->depth). If we want to blit full-color image, we +shouldn't use the triple code. + +Signed-off-by: Mikulas Patocka +Reviewed-by: Ville Syrjälä +Cc: stable@vger.kernel.org +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/aty/mach64_accel.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/fbdev/aty/mach64_accel.c ++++ b/drivers/video/fbdev/aty/mach64_accel.c +@@ -344,7 +344,7 @@ void atyfb_imageblit(struct fb_info *inf + * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit + * this hwaccelerated triple has an issue with not aligned data + */ +- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0) ++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0) + pix_width |= DP_HOST_TRIPLE_EN; + } + +@@ -381,7 +381,7 @@ void atyfb_imageblit(struct fb_info *inf + src_bytes = (((image->width * image->depth) + 7) / 8) * image->height; + + /* manual triple each pixel */ +- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { ++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { + int inbit, outbit, mult24, byte_id_in_dword, width; + u8 *pbitmapin = (u8*)image->data, *pbitmapout; + u32 hostdword; +@@ -414,7 +414,7 @@ void atyfb_imageblit(struct fb_info *inf + } + } + wait_for_fifo(1, par); +- aty_st_le32(HOST_DATA0, hostdword, par); ++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par); + } + } else { + u32 *pbitmap, dwords = (src_bytes + 3) / 4; diff --git a/queue-3.18/mach64-fix-image-corruption-due-to-reading-accelerator-registers.patch b/queue-3.18/mach64-fix-image-corruption-due-to-reading-accelerator-registers.patch new file mode 100644 index 00000000000..96b3927e8e5 --- /dev/null +++ b/queue-3.18/mach64-fix-image-corruption-due-to-reading-accelerator-registers.patch @@ -0,0 +1,114 @@ +From c09bcc91bb94ed91f1391bffcbe294963d605732 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Mon, 8 Oct 2018 12:57:35 +0200 +Subject: mach64: fix image corruption due to reading accelerator registers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mikulas Patocka + +commit c09bcc91bb94ed91f1391bffcbe294963d605732 upstream. + +Reading the registers without waiting for engine idle returns +unpredictable values. These unpredictable values result in display +corruption - if atyfb_imageblit reads the content of DP_PIX_WIDTH with the +bit DP_HOST_TRIPLE_EN set (from previous invocation), the driver would +never ever clear the bit, resulting in display corruption. + +We don't want to wait for idle because it would degrade performance, so +this patch modifies the driver so that it never reads accelerator +registers. + +HOST_CNTL doesn't have to be read, we can just write it with +HOST_BYTE_ALIGN because no other part of the driver cares if +HOST_BYTE_ALIGN is set. + +DP_PIX_WIDTH is written in the functions atyfb_copyarea and atyfb_fillrect +with the default value and in atyfb_imageblit with the value set according +to the source image data. + +Signed-off-by: Mikulas Patocka +Reviewed-by: Ville Syrjälä +Cc: stable@vger.kernel.org +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/video/fbdev/aty/mach64_accel.c | 22 +++++++++------------- + 1 file changed, 9 insertions(+), 13 deletions(-) + +--- a/drivers/video/fbdev/aty/mach64_accel.c ++++ b/drivers/video/fbdev/aty/mach64_accel.c +@@ -126,7 +126,7 @@ void aty_init_engine(struct atyfb_par *p + + /* set host attributes */ + wait_for_fifo(13, par); +- aty_st_le32(HOST_CNTL, 0, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + + /* set pattern attributes */ + aty_st_le32(PAT_REG0, 0, par); +@@ -232,7 +232,8 @@ void atyfb_copyarea(struct fb_info *info + rotation = rotation24bpp(dx, direction); + } + +- wait_for_fifo(4, par); ++ wait_for_fifo(5, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par); + aty_st_le32(SRC_Y_X, (sx << 16) | sy, par); + aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par); +@@ -268,7 +269,8 @@ void atyfb_fillrect(struct fb_info *info + rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT); + } + +- wait_for_fifo(3, par); ++ wait_for_fifo(4, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_FRGD_CLR, color, par); + aty_st_le32(DP_SRC, + BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE, +@@ -283,7 +285,7 @@ void atyfb_imageblit(struct fb_info *inf + { + struct atyfb_par *par = (struct atyfb_par *) info->par; + u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; +- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix; ++ u32 pix_width, rotation = 0, src, mix; + + if (par->asleep) + return; +@@ -295,8 +297,7 @@ void atyfb_imageblit(struct fb_info *inf + return; + } + +- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par); +- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN; ++ pix_width = par->crtc.dp_pix_width; + + switch (image->depth) { + case 1: +@@ -369,12 +370,11 @@ void atyfb_imageblit(struct fb_info *inf + mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D; + } + +- wait_for_fifo(6, par); +- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par); ++ wait_for_fifo(5, par); + aty_st_le32(DP_PIX_WIDTH, pix_width, par); + aty_st_le32(DP_MIX, mix, par); + aty_st_le32(DP_SRC, src, par); +- aty_st_le32(HOST_CNTL, host_cntl, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par); + + draw_rect(dx, dy, width, image->height, par); +@@ -423,8 +423,4 @@ void atyfb_imageblit(struct fb_info *inf + aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par); + } + } +- +- /* restore pix_width */ +- wait_for_fifo(1, par); +- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par); + } diff --git a/queue-3.18/mtd-docg3-don-t-set-conflicting-bch_const_params-option.patch b/queue-3.18/mtd-docg3-don-t-set-conflicting-bch_const_params-option.patch new file mode 100644 index 00000000000..a75b1dd9387 --- /dev/null +++ b/queue-3.18/mtd-docg3-don-t-set-conflicting-bch_const_params-option.patch @@ -0,0 +1,51 @@ +From be2e1c9dcf76886a83fb1c433a316e26d4ca2550 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Thu, 11 Oct 2018 13:06:16 +0200 +Subject: mtd: docg3: don't set conflicting BCH_CONST_PARAMS option + +From: Arnd Bergmann + +commit be2e1c9dcf76886a83fb1c433a316e26d4ca2550 upstream. + +I noticed during the creation of another bugfix that the BCH_CONST_PARAMS +option that is set by DOCG3 breaks setting variable parameters for any +other users of the BCH library code. + +The only other user we have today is the MTD_NAND software BCH +implementation (most flash controllers use hardware BCH these days +and are not affected). I considered removing BCH_CONST_PARAMS entirely +because of the inherent conflict, but according to the description in +lib/bch.c there is a significant performance benefit in keeping it. + +To avoid the immediate problem of the conflict between MTD_NAND_BCH +and DOCG3, this only sets the constant parameters if MTD_NAND_BCH +is disabled, which should fix the problem for all cases that +are affected. This should also work for all stable kernels. + +Note that there is only one machine that actually seems to use the +DOCG3 driver (arch/arm/mach-pxa/mioa701.c), so most users should have +the driver disabled, but it almost certainly shows up if we wanted +to test random kernels on machines that use software BCH in MTD. + +Fixes: d13d19ece39f ("mtd: docg3: add ECC correction code") +Cc: stable@vger.kernel.org +Cc: Robert Jarzmik +Signed-off-by: Arnd Bergmann +Signed-off-by: Boris Brezillon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mtd/devices/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/devices/Kconfig ++++ b/drivers/mtd/devices/Kconfig +@@ -200,7 +200,7 @@ comment "Disk-On-Chip Device Drivers" + config MTD_DOCG3 + tristate "M-Systems Disk-On-Chip G3" + select BCH +- select BCH_CONST_PARAMS ++ select BCH_CONST_PARAMS if !MTD_NAND_BCH + select BITREVERSE + ---help--- + This provides an MTD device driver for the M-Systems DiskOnChip diff --git a/queue-3.18/ocfs2-fix-a-misuse-a-of-brelse-after-failing-ocfs2_check_dir_entry.patch b/queue-3.18/ocfs2-fix-a-misuse-a-of-brelse-after-failing-ocfs2_check_dir_entry.patch new file mode 100644 index 00000000000..e88afd4a646 --- /dev/null +++ b/queue-3.18/ocfs2-fix-a-misuse-a-of-brelse-after-failing-ocfs2_check_dir_entry.patch @@ -0,0 +1,54 @@ +From 29aa30167a0a2e6045a0d6d2e89d8168132333d5 Mon Sep 17 00:00:00 2001 +From: Changwei Ge +Date: Fri, 2 Nov 2018 15:48:15 -0700 +Subject: ocfs2: fix a misuse a of brelse after failing ocfs2_check_dir_entry + +From: Changwei Ge + +commit 29aa30167a0a2e6045a0d6d2e89d8168132333d5 upstream. + +Somehow, file system metadata was corrupted, which causes +ocfs2_check_dir_entry() to fail in function ocfs2_dir_foreach_blk_el(). + +According to the original design intention, if above happens we should +skip the problematic block and continue to retrieve dir entry. But +there is obviouse misuse of brelse around related code. + +After failure of ocfs2_check_dir_entry(), current code just moves to +next position and uses the problematic buffer head again and again +during which the problematic buffer head is released for multiple times. +I suppose, this a serious issue which is long-lived in ocfs2. This may +cause other file systems which is also used in a the same host insane. + +So we should also consider about bakcporting this patch into linux +-stable. + +Link: http://lkml.kernel.org/r/HK2PR06MB045211675B43EED794E597B6D56E0@HK2PR06MB0452.apcprd06.prod.outlook.com +Signed-off-by: Changwei Ge +Suggested-by: Changkuo Shi +Reviewed-by: Andrew Morton +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ocfs2/dir.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -1906,8 +1906,7 @@ static int ocfs2_dir_foreach_blk_el(stru + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +- brelse(bh); +- continue; ++ break; + } + if (le64_to_cpu(de->inode)) { + unsigned char d_type = DT_UNKNOWN; diff --git a/queue-3.18/series b/queue-3.18/series index d2265ff5716..db0c7400faa 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -60,3 +60,10 @@ powerpc-boot-ensure-_zimage_start-is-a-weak-symbol.patch media-tvp5150-fix-width-alignment-during-set_selection.patch 9p-clear-dangling-pointers-in-p9stat_free.patch cdrom-fix-improper-type-cast-which-can-leat-to-information-leak.patch +xtensa-fix-boot-parameters-address-translation.patch +clk-s2mps11-fix-matching-when-built-as-module-and-dt-node-contains-compatible.patch +libceph-bump-ceph_msg_max_data_len.patch +mach64-fix-display-corruption-on-big-endian-machines.patch +mach64-fix-image-corruption-due-to-reading-accelerator-registers.patch +ocfs2-fix-a-misuse-a-of-brelse-after-failing-ocfs2_check_dir_entry.patch +mtd-docg3-don-t-set-conflicting-bch_const_params-option.patch diff --git a/queue-3.18/xtensa-fix-boot-parameters-address-translation.patch b/queue-3.18/xtensa-fix-boot-parameters-address-translation.patch new file mode 100644 index 00000000000..906f7206e2a --- /dev/null +++ b/queue-3.18/xtensa-fix-boot-parameters-address-translation.patch @@ -0,0 +1,43 @@ +From 40dc948f234b73497c3278875eb08a01d5854d3f Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 13 Nov 2018 23:46:42 -0800 +Subject: xtensa: fix boot parameters address translation + +From: Max Filippov + +commit 40dc948f234b73497c3278875eb08a01d5854d3f upstream. + +The bootloader may pass physical address of the boot parameters structure +to the MMUv3 kernel in the register a2. Code in the _SetupMMU block in +the arch/xtensa/kernel/head.S is supposed to map that physical address to +the virtual address in the configured virtual memory layout. + +This code haven't been updated when additional 256+256 and 512+512 +memory layouts were introduced and it may produce wrong addresses when +used with these layouts. + +Cc: stable@vger.kernel.org +Signed-off-by: Max Filippov +Signed-off-by: Greg Kroah-Hartman + +--- + arch/xtensa/kernel/head.S | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -88,9 +88,12 @@ _SetupMMU: + initialize_mmu + #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY + rsr a2, excsave1 +- movi a3, 0x08000000 ++ movi a3, XCHAL_KSEG_PADDR ++ bltu a2, a3, 1f ++ sub a2, a2, a3 ++ movi a3, XCHAL_KSEG_SIZE + bgeu a2, a3, 1f +- movi a3, 0xd0000000 ++ movi a3, XCHAL_KSEG_CACHED_VADDR + add a2, a2, a3 + wsr a2, excsave1 + 1: