From: Sasha Levin Date: Fri, 23 Nov 2018 12:45:32 +0000 (-0500) Subject: AUTOSEL patches for 4.19 X-Git-Tag: v3.18.127~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c45ea28525a655099d4a1e990af1d211a03c458a;p=thirdparty%2Fkernel%2Fstable-queue.git AUTOSEL patches for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/afs-handle-eio-from-delivery-function.patch b/queue-4.19/afs-handle-eio-from-delivery-function.patch new file mode 100644 index 00000000000..5e9ef84e30f --- /dev/null +++ b/queue-4.19/afs-handle-eio-from-delivery-function.patch @@ -0,0 +1,62 @@ +From c4843be46aee68b819009209ca0ce03acd98a852 Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Sat, 20 Oct 2018 00:57:57 +0100 +Subject: afs: Handle EIO from delivery function + +[ Upstream commit 4ac15ea53622272c01954461b4814892b7481b40 ] + +Fix afs_deliver_to_call() to handle -EIO being returned by the operation +delivery function, indicating that the call found itself in the wrong +state, by printing an error and aborting the call. + +Currently, an assertion failure will occur. This can happen, say, if the +delivery function falls off the end without calling afs_extract_data() with +the want_more parameter set to false to collect the end of the Rx phase of +a call. + +The assertion failure looks like: + + AFS: Assertion failed + 4 == 7 is false + 0x4 == 0x7 is false + ------------[ cut here ]------------ + kernel BUG at fs/afs/rxrpc.c:462! + +and is matched in the trace buffer by a line like: + +kworker/7:3-3226 [007] ...1 85158.030203: afs_io_error: c=0003be0c r=-5 CM_REPLY + +Fixes: 98bf40cd99fc ("afs: Protect call->state changes against signals") +Reported-by: Marc Dionne +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/rxrpc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index 77a83790a31f..2543f24d23f8 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -500,7 +500,6 @@ static void afs_deliver_to_call(struct afs_call *call) + case -EINPROGRESS: + case -EAGAIN: + goto out; +- case -EIO: + case -ECONNABORTED: + ASSERTCMP(state, ==, AFS_CALL_COMPLETE); + goto done; +@@ -509,6 +508,10 @@ static void afs_deliver_to_call(struct afs_call *call) + rxrpc_kernel_abort_call(call->net->socket, call->rxcall, + abort_code, ret, "KIV"); + goto local_abort; ++ case -EIO: ++ pr_err("kAFS: Call %u in bad state %u\n", ++ call->debug_id, state); ++ /* Fall through */ + case -ENODATA: + case -EBADMSG: + case -EMSGSIZE: +-- +2.17.1 + diff --git a/queue-4.19/apparmor-fix-uninitialized-value-in-aa_split_fqname.patch b/queue-4.19/apparmor-fix-uninitialized-value-in-aa_split_fqname.patch new file mode 100644 index 00000000000..5581777fc4c --- /dev/null +++ b/queue-4.19/apparmor-fix-uninitialized-value-in-aa_split_fqname.patch @@ -0,0 +1,73 @@ +From 1c81663c63a3ff691e2388b53fa93279529a79ad Mon Sep 17 00:00:00 2001 +From: Zubin Mithra +Date: Thu, 27 Sep 2018 14:49:17 -0700 +Subject: apparmor: Fix uninitialized value in aa_split_fqname + +[ Upstream commit 250f2da49cb8e582215a65c03f50e8ddf5cd119c ] + +Syzkaller reported a OOB-read with the stacktrace below. This occurs +inside __aa_lookupn_ns as `n` is not initialized. `n` is obtained from +aa_splitn_fqname. In cases where `name` is invalid, aa_splitn_fqname +returns without initializing `ns_name` and `ns_len`. + +Fix this by always initializing `ns_name` and `ns_len`. + + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 + print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 + kasan_report_error mm/kasan/report.c:354 [inline] + kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 + __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:430 + memcmp+0xe3/0x160 lib/string.c:861 + strnstr+0x4b/0x70 lib/string.c:934 + __aa_lookupn_ns+0xc1/0x570 security/apparmor/policy_ns.c:209 + aa_lookupn_ns+0x88/0x1e0 security/apparmor/policy_ns.c:240 + aa_fqlookupn_profile+0x1b9/0x1010 security/apparmor/policy.c:468 + fqlookupn_profile+0x80/0xc0 security/apparmor/label.c:1844 + aa_label_strn_parse+0xa3a/0x1230 security/apparmor/label.c:1908 + aa_label_parse+0x42/0x50 security/apparmor/label.c:1943 + aa_change_profile+0x513/0x3510 security/apparmor/domain.c:1362 + apparmor_setprocattr+0xaa4/0x1150 security/apparmor/lsm.c:658 + security_setprocattr+0x66/0xc0 security/security.c:1298 + proc_pid_attr_write+0x301/0x540 fs/proc/base.c:2555 + __vfs_write+0x119/0x9f0 fs/read_write.c:485 + vfs_write+0x1fc/0x560 fs/read_write.c:549 + ksys_write+0x101/0x260 fs/read_write.c:598 + __do_sys_write fs/read_write.c:610 [inline] + __se_sys_write fs/read_write.c:607 [inline] + __x64_sys_write+0x73/0xb0 fs/read_write.c:607 + do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Fixes: 3b0aaf5866bf ("apparmor: add lib fn to find the "split" for fqnames") +Reported-by: syzbot+61e4b490d9d2da591b50@syzkaller.appspotmail.com +Signed-off-by: Zubin Mithra +Reviewed-by: Kees Cook +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +--- + security/apparmor/lib.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/security/apparmor/lib.c b/security/apparmor/lib.c +index 974affe50531..76491e7f4177 100644 +--- a/security/apparmor/lib.c ++++ b/security/apparmor/lib.c +@@ -90,10 +90,12 @@ const char *aa_splitn_fqname(const char *fqname, size_t n, const char **ns_name, + const char *end = fqname + n; + const char *name = skipn_spaces(fqname, n); + +- if (!name) +- return NULL; + *ns_name = NULL; + *ns_len = 0; ++ ++ if (!name) ++ return NULL; ++ + if (name[0] == ':') { + char *split = strnchr(&name[1], end - &name[1], ':'); + *ns_name = skipn_spaces(&name[1], end - &name[1]); +-- +2.17.1 + diff --git a/queue-4.19/arm-dts-fsl-fix-improperly-quoted-stdout-path-values.patch b/queue-4.19/arm-dts-fsl-fix-improperly-quoted-stdout-path-values.patch new file mode 100644 index 00000000000..90d250b115f --- /dev/null +++ b/queue-4.19/arm-dts-fsl-fix-improperly-quoted-stdout-path-values.patch @@ -0,0 +1,61 @@ +From f6039c831038953257ec81f261ada35a2c8c23d3 Mon Sep 17 00:00:00 2001 +From: Rob Herring +Date: Tue, 30 Oct 2018 20:02:30 -0500 +Subject: ARM: dts: fsl: Fix improperly quoted stdout-path values + +[ Upstream commit 1af6ab3bac8458fc2e92ad7bb97b62de4a1fddef ] + +A quoted label reference doesn't expand to the node path and is taken as +a literal string. Dropping the quotes can fix this unless the baudrate +string is appended in which case we have to use the alias. + +At least on VF610, the problem was masked by setting the console in +bootargs. Use the alias syntax with baudrate parameter so we can drop +setting the console in bootargs. + +Cc: Shawn Guo +Cc: Sascha Hauer +Cc: Pengutronix Kernel Team +Cc: NXP Linux Team +Cc: Mark Rutland +Reviewed-by: Fabio Estevam +Reviewed-by: Stefan Agner +Signed-off-by: Rob Herring +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-ppd.dts | 2 +- + arch/arm/boot/dts/vf610m4-colibri.dts | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-ppd.dts b/arch/arm/boot/dts/imx53-ppd.dts +index cdb90bee7b4a..f202396e3f2a 100644 +--- a/arch/arm/boot/dts/imx53-ppd.dts ++++ b/arch/arm/boot/dts/imx53-ppd.dts +@@ -55,7 +55,7 @@ + }; + + chosen { +- stdout-path = "&uart1:115200n8"; ++ stdout-path = "serial0:115200n8"; + }; + + memory@70000000 { +diff --git a/arch/arm/boot/dts/vf610m4-colibri.dts b/arch/arm/boot/dts/vf610m4-colibri.dts +index 41ec66a96990..ca6249558760 100644 +--- a/arch/arm/boot/dts/vf610m4-colibri.dts ++++ b/arch/arm/boot/dts/vf610m4-colibri.dts +@@ -50,8 +50,8 @@ + compatible = "fsl,vf610m4"; + + chosen { +- bootargs = "console=ttyLP2,115200 clk_ignore_unused init=/linuxrc rw"; +- stdout-path = "&uart2"; ++ bootargs = "clk_ignore_unused init=/linuxrc rw"; ++ stdout-path = "serial2:115200"; + }; + + memory@8c000000 { +-- +2.17.1 + diff --git a/queue-4.19/arm-dts-imx6sll-fix-typo-for-fsl-imx6sll-i2c-node.patch b/queue-4.19/arm-dts-imx6sll-fix-typo-for-fsl-imx6sll-i2c-node.patch new file mode 100644 index 00000000000..1e52cfc3ed6 --- /dev/null +++ b/queue-4.19/arm-dts-imx6sll-fix-typo-for-fsl-imx6sll-i2c-node.patch @@ -0,0 +1,37 @@ +From 5b7e7844da7402e67d154b9e5734e5ac5536ab13 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Thu, 18 Oct 2018 13:26:13 +0200 +Subject: ARM: dts: imx6sll: fix typo for fsl,imx6sll-i2c node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 438ad09af5581b7024850b5dbb6353c7f2f7d8a9 ] + +Fix the type of compatible string "fs,imx6sll-i2c" which should be +"fsl,imx6sll-i2c". + +Signed-off-by: Oleksij Rempel +Acked-by: Uwe Kleine-König +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6sll.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6sll.dtsi b/arch/arm/boot/dts/imx6sll.dtsi +index 000e6136a9d6..3e6ffaf5f104 100644 +--- a/arch/arm/boot/dts/imx6sll.dtsi ++++ b/arch/arm/boot/dts/imx6sll.dtsi +@@ -709,7 +709,7 @@ + i2c1: i2c@21a0000 { + #address-cells = <1>; + #size-cells = <0>; +- compatible = "fs,imx6sll-i2c", "fsl,imx21-i2c"; ++ compatible = "fsl,imx6sll-i2c", "fsl,imx21-i2c"; + reg = <0x021a0000 0x4000>; + interrupts = ; + clocks = <&clks IMX6SLL_CLK_I2C1>; +-- +2.17.1 + diff --git a/queue-4.19/arm64-dts-renesas-condor-switch-from-etheravb-to-get.patch b/queue-4.19/arm64-dts-renesas-condor-switch-from-etheravb-to-get.patch new file mode 100644 index 00000000000..d15b9f42d47 --- /dev/null +++ b/queue-4.19/arm64-dts-renesas-condor-switch-from-etheravb-to-get.patch @@ -0,0 +1,108 @@ +From fd9da87bacf271b839f75e6dbf15a5e906968d75 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Thu, 18 Oct 2018 19:48:53 +0300 +Subject: arm64: dts: renesas: condor: switch from EtherAVB to GEther + +[ Upstream commit eab53fdfd60a84b0cc514d4f1f5d79226c76df01 ] + +The "official" Condor boards have always been wired to mount NFS via +GEther, not EtherAVB -- the boards resoldered for EtherAVB were local +to Cogent Embedded, so we've been having an unpleasant situation where +a "normal" Condor board still can't mount NFS (unless an EtherAVB PHY +extension board is plugged in). Switch from EtherAVB to GEther at last! + +Fixes: 8091788f3d38 ("arm64: dts: renesas: condor: add EtherAVB support") +Signed-off-by: Sergei Shtylyov +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + .../boot/dts/renesas/r8a77980-condor.dts | 47 ++++++++++--------- + 1 file changed, 24 insertions(+), 23 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts +index 9f25c407dfd7..e830b6162375 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77980-condor.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77980-condor.dts +@@ -15,7 +15,7 @@ + + aliases { + serial0 = &scif0; +- ethernet0 = &avb; ++ ethernet0 = &gether; + }; + + chosen { +@@ -47,23 +47,6 @@ + }; + }; + +-&avb { +- pinctrl-0 = <&avb_pins>; +- pinctrl-names = "default"; +- +- phy-mode = "rgmii-id"; +- phy-handle = <&phy0>; +- renesas,no-ether-link; +- status = "okay"; +- +- phy0: ethernet-phy@0 { +- rxc-skew-ps = <1500>; +- reg = <0>; +- interrupt-parent = <&gpio1>; +- interrupts = <17 IRQ_TYPE_LEVEL_LOW>; +- }; +-}; +- + &canfd { + pinctrl-0 = <&canfd0_pins>; + pinctrl-names = "default"; +@@ -82,6 +65,23 @@ + clock-frequency = <32768>; + }; + ++&gether { ++ pinctrl-0 = <&gether_pins>; ++ pinctrl-names = "default"; ++ ++ phy-mode = "rgmii-id"; ++ phy-handle = <&phy0>; ++ renesas,no-ether-link; ++ status = "okay"; ++ ++ phy0: ethernet-phy@0 { ++ rxc-skew-ps = <1500>; ++ reg = <0>; ++ interrupt-parent = <&gpio4>; ++ interrupts = <23 IRQ_TYPE_LEVEL_LOW>; ++ }; ++}; ++ + &i2c0 { + pinctrl-0 = <&i2c0_pins>; + pinctrl-names = "default"; +@@ -118,16 +118,17 @@ + }; + + &pfc { +- avb_pins: avb { +- groups = "avb_mdio", "avb_rgmii"; +- function = "avb"; +- }; +- + canfd0_pins: canfd0 { + groups = "canfd0_data_a"; + function = "canfd0"; + }; + ++ gether_pins: gether { ++ groups = "gether_mdio_a", "gether_rgmii", ++ "gether_txcrefclk", "gether_txcrefclk_mega"; ++ function = "gether"; ++ }; ++ + i2c0_pins: i2c0 { + groups = "i2c0"; + function = "i2c0"; +-- +2.17.1 + diff --git a/queue-4.19/arm64-dts-renesas-r8a7795-add-missing-dma-names-on-h.patch b/queue-4.19/arm64-dts-renesas-r8a7795-add-missing-dma-names-on-h.patch new file mode 100644 index 00000000000..225d9716471 --- /dev/null +++ b/queue-4.19/arm64-dts-renesas-r8a7795-add-missing-dma-names-on-h.patch @@ -0,0 +1,36 @@ +From 4a0979c371b6ad798ed681687881847059dfb2dc Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Fri, 28 Sep 2018 02:38:36 +0000 +Subject: arm64: dts: renesas: r8a7795: add missing dma-names on hscif2 + +[ Upstream commit aab7a2414ba0d5c3d0571a90031b535adba7146a ] + +hscif2 has 4 dmas, but has only 2 dma-names. +This patch add missing dma-names. + +Signed-off-by: Kuninori Morimoto +Reviewed-by: Geert Uytterhoeven +Fixes: e0f0bda79337701a ("arm64: dts: renesas: r8a7795: sort subnodes +of the soc node") +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a7795.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a7795.dtsi b/arch/arm64/boot/dts/renesas/r8a7795.dtsi +index fb9d08ad7659..c87eed77de2c 100644 +--- a/arch/arm64/boot/dts/renesas/r8a7795.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a7795.dtsi +@@ -662,7 +662,7 @@ + clock-names = "fck", "brg_int", "scif_clk"; + dmas = <&dmac1 0x35>, <&dmac1 0x34>, + <&dmac2 0x35>, <&dmac2 0x34>; +- dma-names = "tx", "rx"; ++ dma-names = "tx", "rx", "tx", "rx"; + power-domains = <&sysc R8A7795_PD_ALWAYS_ON>; + resets = <&cpg 518>; + status = "disabled"; +-- +2.17.1 + diff --git a/queue-4.19/arm64-kprobe-make-page-to-ro-mode-when-allocate-it.patch b/queue-4.19/arm64-kprobe-make-page-to-ro-mode-when-allocate-it.patch new file mode 100644 index 00000000000..4d47508a404 --- /dev/null +++ b/queue-4.19/arm64-kprobe-make-page-to-ro-mode-when-allocate-it.patch @@ -0,0 +1,123 @@ +From 3c42c37c1d007a773e2915983d23b295be702aad Mon Sep 17 00:00:00 2001 +From: Anders Roxell +Date: Tue, 30 Oct 2018 12:38:50 +0100 +Subject: arm64: kprobe: make page to RO mode when allocate it + +[ Upstream commit 966866892cf89d606544bca22d584ba2ef9ec208 ] + +Commit 1404d6f13e47 ("arm64: dump: Add checking for writable and exectuable pages") +has successfully identified code that leaves a page with W+X +permissions. + +[ 3.245140] arm64/mm: Found insecure W+X mapping at address (____ptrval____)/0xffff000000d90000 +[ 3.245771] WARNING: CPU: 0 PID: 1 at ../arch/arm64/mm/dump.c:232 note_page+0x410/0x420 +[ 3.246141] Modules linked in: +[ 3.246653] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0-rc5-next-20180928-00001-ge70ae259b853-dirty #62 +[ 3.247008] Hardware name: linux,dummy-virt (DT) +[ 3.247347] pstate: 80000005 (Nzcv daif -PAN -UAO) +[ 3.247623] pc : note_page+0x410/0x420 +[ 3.247898] lr : note_page+0x410/0x420 +[ 3.248071] sp : ffff00000804bcd0 +[ 3.248254] x29: ffff00000804bcd0 x28: ffff000009274000 +[ 3.248578] x27: ffff00000921a000 x26: ffff80007dfff000 +[ 3.248845] x25: ffff0000093f5000 x24: ffff000009526f6a +[ 3.249109] x23: 0000000000000004 x22: ffff000000d91000 +[ 3.249396] x21: ffff000000d90000 x20: 0000000000000000 +[ 3.249661] x19: ffff00000804bde8 x18: 0000000000000400 +[ 3.249924] x17: 0000000000000000 x16: 0000000000000000 +[ 3.250271] x15: ffffffffffffffff x14: 295f5f5f5f6c6176 +[ 3.250594] x13: 7274705f5f5f5f28 x12: 2073736572646461 +[ 3.250941] x11: 20746120676e6970 x10: 70616d20582b5720 +[ 3.251252] x9 : 6572756365736e69 x8 : 3039643030303030 +[ 3.251519] x7 : 306666666678302f x6 : ffff0000095467b2 +[ 3.251802] x5 : 0000000000000000 x4 : 0000000000000000 +[ 3.252060] x3 : 0000000000000000 x2 : ffffffffffffffff +[ 3.252323] x1 : 4d151327adc50b00 x0 : 0000000000000000 +[ 3.252664] Call trace: +[ 3.252953] note_page+0x410/0x420 +[ 3.253186] walk_pgd+0x12c/0x238 +[ 3.253417] ptdump_check_wx+0x68/0xf8 +[ 3.253637] mark_rodata_ro+0x68/0x98 +[ 3.253847] kernel_init+0x38/0x160 +[ 3.254103] ret_from_fork+0x10/0x18 + +kprobes allocates a writable executable page with module_alloc() in +order to store executable code. +Reworked to that when allocate a page it sets mode RO. Inspired by +commit 63fef14fc98a ("kprobes/x86: Make insn buffer always ROX and use text_poke()"). + +Suggested-by: Arnd Bergmann +Suggested-by: Ard Biesheuvel +Acked-by: Will Deacon +Acked-by: Masami Hiramatsu +Reviewed-by: Laura Abbott +Signed-off-by: Anders Roxell +[catalin.marinas@arm.com: removed unnecessary casts] +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/probes/kprobes.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c +index e78c3ef04d95..b5a367d4bba6 100644 +--- a/arch/arm64/kernel/probes/kprobes.c ++++ b/arch/arm64/kernel/probes/kprobes.c +@@ -23,7 +23,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + #include + #include +@@ -42,10 +44,21 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk); + static void __kprobes + post_kprobe_handler(struct kprobe_ctlblk *, struct pt_regs *); + ++static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode) ++{ ++ void *addrs[1]; ++ u32 insns[1]; ++ ++ addrs[0] = addr; ++ insns[0] = opcode; ++ ++ return aarch64_insn_patch_text(addrs, insns, 1); ++} ++ + static void __kprobes arch_prepare_ss_slot(struct kprobe *p) + { + /* prepare insn slot */ +- p->ainsn.api.insn[0] = cpu_to_le32(p->opcode); ++ patch_text(p->ainsn.api.insn, p->opcode); + + flush_icache_range((uintptr_t) (p->ainsn.api.insn), + (uintptr_t) (p->ainsn.api.insn) + +@@ -118,15 +131,15 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p) + return 0; + } + +-static int __kprobes patch_text(kprobe_opcode_t *addr, u32 opcode) ++void *alloc_insn_page(void) + { +- void *addrs[1]; +- u32 insns[1]; ++ void *page; + +- addrs[0] = (void *)addr; +- insns[0] = (u32)opcode; ++ page = vmalloc_exec(PAGE_SIZE); ++ if (page) ++ set_memory_ro((unsigned long)page, 1); + +- return aarch64_insn_patch_text(addrs, insns, 1); ++ return page; + } + + /* arm kprobe: install breakpoint in text */ +-- +2.17.1 + diff --git a/queue-4.19/arm64-percpu-initialize-ret-in-the-default-case.patch b/queue-4.19/arm64-percpu-initialize-ret-in-the-default-case.patch new file mode 100644 index 00000000000..d324a732561 --- /dev/null +++ b/queue-4.19/arm64-percpu-initialize-ret-in-the-default-case.patch @@ -0,0 +1,70 @@ +From 6848d3bf5765c9b358adec5bdf570d59e223d573 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Tue, 25 Sep 2018 12:44:59 -0700 +Subject: arm64: percpu: Initialize ret in the default case + +[ Upstream commit b5bb425871186303e6936fa2581521bdd1964a58 ] + +Clang warns that if the default case is taken, ret will be +uninitialized. + +./arch/arm64/include/asm/percpu.h:196:2: warning: variable 'ret' is used +uninitialized whenever switch default is taken +[-Wsometimes-uninitialized] + default: + ^~~~~~~ +./arch/arm64/include/asm/percpu.h:200:9: note: uninitialized use occurs +here + return ret; + ^~~ +./arch/arm64/include/asm/percpu.h:157:19: note: initialize the variable +'ret' to silence this warning + unsigned long ret, loop; + ^ + = 0 + +This warning appears several times while building the erofs filesystem. +While it's not strictly wrong, the BUILD_BUG will prevent this from +becoming a true problem. Initialize ret to 0 in the default case right +before the BUILD_BUG to silence all of these warnings. + +Reported-by: Prasad Sodagudi +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Dennis Zhou +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/percpu.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h +index 9234013e759e..21a81b59a0cc 100644 +--- a/arch/arm64/include/asm/percpu.h ++++ b/arch/arm64/include/asm/percpu.h +@@ -96,6 +96,7 @@ static inline unsigned long __percpu_##op(void *ptr, \ + : [val] "Ir" (val)); \ + break; \ + default: \ ++ ret = 0; \ + BUILD_BUG(); \ + } \ + \ +@@ -125,6 +126,7 @@ static inline unsigned long __percpu_read(void *ptr, int size) + ret = READ_ONCE(*(u64 *)ptr); + break; + default: ++ ret = 0; + BUILD_BUG(); + } + +@@ -194,6 +196,7 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val, + : [val] "r" (val)); + break; + default: ++ ret = 0; + BUILD_BUG(); + } + +-- +2.17.1 + diff --git a/queue-4.19/block-brd-associate-with-queue-until-adding-disk.patch b/queue-4.19/block-brd-associate-with-queue-until-adding-disk.patch new file mode 100644 index 00000000000..471d7b36319 --- /dev/null +++ b/queue-4.19/block-brd-associate-with-queue-until-adding-disk.patch @@ -0,0 +1,105 @@ +From 17c7e5f062e59266899834e94185118819e16dd6 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Fri, 2 Nov 2018 08:50:51 +0800 +Subject: block: brd: associate with queue until adding disk + +[ Upstream commit 153fcd5f6d93b8e1e4040b1337f564a10f8d93af ] + +brd_free() may be called in failure path on one brd instance which +disk isn't added yet, so release handler of gendisk may free the +associated request_queue early and causes the following use-after-free[1]. + +This patch fixes this issue by associating gendisk with request_queue +just before adding disk. + +[1] KASAN: use-after-free Read in del_timer_syncNon-volatile memory driver v1.3 +Linux agpgart interface v0.103 +[drm] Initialized vgem 1.0.0 20120112 for virtual device on minor 0 +usbcore: registered new interface driver udl +================================================================== +BUG: KASAN: use-after-free in __lock_acquire+0x36d9/0x4c20 +kernel/locking/lockdep.c:3218 +Read of size 8 at addr ffff8801d1b6b540 by task swapper/0/1 + +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.0+ #88 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS +Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x244/0x39d lib/dump_stack.c:113 + print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256 + kasan_report_error mm/kasan/report.c:354 [inline] + kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412 + __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 + __lock_acquire+0x36d9/0x4c20 kernel/locking/lockdep.c:3218 + lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 + del_timer_sync+0xb7/0x270 kernel/time/timer.c:1283 + blk_cleanup_queue+0x413/0x710 block/blk-core.c:809 + brd_free+0x5d/0x71 drivers/block/brd.c:422 + brd_init+0x2eb/0x393 drivers/block/brd.c:518 + do_one_initcall+0x145/0x957 init/main.c:890 + do_initcall_level init/main.c:958 [inline] + do_initcalls init/main.c:966 [inline] + do_basic_setup init/main.c:984 [inline] + kernel_init_freeable+0x5c6/0x6b9 init/main.c:1148 + kernel_init+0x11/0x1ae init/main.c:1068 + ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:350 + +Reported-by: syzbot+3701447012fe951dabb2@syzkaller.appspotmail.com +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/brd.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/brd.c b/drivers/block/brd.c +index df8103dd40ac..c18586fccb6f 100644 +--- a/drivers/block/brd.c ++++ b/drivers/block/brd.c +@@ -396,15 +396,14 @@ static struct brd_device *brd_alloc(int i) + disk->first_minor = i * max_part; + disk->fops = &brd_fops; + disk->private_data = brd; +- disk->queue = brd->brd_queue; + disk->flags = GENHD_FL_EXT_DEVT; + sprintf(disk->disk_name, "ram%d", i); + set_capacity(disk, rd_size * 2); +- disk->queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO; ++ brd->brd_queue->backing_dev_info->capabilities |= BDI_CAP_SYNCHRONOUS_IO; + + /* Tell the block layer that this is not a rotational device */ +- blk_queue_flag_set(QUEUE_FLAG_NONROT, disk->queue); +- blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, disk->queue); ++ blk_queue_flag_set(QUEUE_FLAG_NONROT, brd->brd_queue); ++ blk_queue_flag_clear(QUEUE_FLAG_ADD_RANDOM, brd->brd_queue); + + return brd; + +@@ -436,6 +435,7 @@ static struct brd_device *brd_init_one(int i, bool *new) + + brd = brd_alloc(i); + if (brd) { ++ brd->brd_disk->queue = brd->brd_queue; + add_disk(brd->brd_disk); + list_add_tail(&brd->brd_list, &brd_devices); + } +@@ -503,8 +503,14 @@ static int __init brd_init(void) + + /* point of no return */ + +- list_for_each_entry(brd, &brd_devices, brd_list) ++ list_for_each_entry(brd, &brd_devices, brd_list) { ++ /* ++ * associate with queue just before adding disk for ++ * avoiding to mess up failure path ++ */ ++ brd->brd_disk->queue = brd->brd_queue; + add_disk(brd->brd_disk); ++ } + + blk_register_region(MKDEV(RAMDISK_MAJOR, 0), 1UL << MINORBITS, + THIS_MODULE, brd_probe, NULL, NULL); +-- +2.17.1 + diff --git a/queue-4.19/block-clear-kernel-memory-before-copying-to-user.patch b/queue-4.19/block-clear-kernel-memory-before-copying-to-user.patch new file mode 100644 index 00000000000..1a07ec8aca9 --- /dev/null +++ b/queue-4.19/block-clear-kernel-memory-before-copying-to-user.patch @@ -0,0 +1,34 @@ +From 00f148a94ad5dfb291904e167ffc6a87d87da631 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Wed, 7 Nov 2018 07:37:45 -0700 +Subject: block: Clear kernel memory before copying to user + +[ Upstream commit f3587d76da05f68098ddb1cb3c98cc6a9e8a402c ] + +If the kernel allocates a bounce buffer for user read data, this memory +needs to be cleared before copying it to the user, otherwise it may leak +kernel memory to user space. + +Laurence Oberman +Signed-off-by: Keith Busch +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/block/bio.c b/block/bio.c +index 0093bed81c0e..41173710430c 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1261,6 +1261,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q, + if (ret) + goto cleanup; + } else { ++ zero_fill_bio(bio); + iov_iter_advance(iter, bio->bi_iter.bi_size); + } + +-- +2.17.1 + diff --git a/queue-4.19/bpf-fix-bpf_prog_get_info_by_fd-to-return-0-func_len.patch b/queue-4.19/bpf-fix-bpf_prog_get_info_by_fd-to-return-0-func_len.patch new file mode 100644 index 00000000000..f2f865f0f4f --- /dev/null +++ b/queue-4.19/bpf-fix-bpf_prog_get_info_by_fd-to-return-0-func_len.patch @@ -0,0 +1,39 @@ +From 66ddd04876824ffdcaab9b7f0679cda476e31d15 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 2 Nov 2018 11:35:46 +0100 +Subject: bpf: fix bpf_prog_get_info_by_fd to return 0 func_lens for unpriv + +[ Upstream commit 28c2fae726bf5003cd209b0d5910a642af98316f ] + +While dbecd7388476 ("bpf: get kernel symbol addresses via syscall") +zeroed info.nr_jited_ksyms in bpf_prog_get_info_by_fd() for queries +from unprivileged users, commit 815581c11cc2 ("bpf: get JITed image +lengths of functions via syscall") forgot about doing so and therefore +returns the #elems of the user set up buffer which is incorrect. It +also needs to indicate a info.nr_jited_func_lens of zero. + +Fixes: 815581c11cc2 ("bpf: get JITed image lengths of functions via syscall") +Signed-off-by: Daniel Borkmann +Cc: Sandipan Das +Cc: Song Liu +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/syscall.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 675eb6d36e47..382c09dddf93 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1974,6 +1974,7 @@ static int bpf_prog_get_info_by_fd(struct bpf_prog *prog, + info.jited_prog_len = 0; + info.xlated_prog_len = 0; + info.nr_jited_ksyms = 0; ++ info.nr_jited_func_lens = 0; + goto done; + } + +-- +2.17.1 + diff --git a/queue-4.19/ceph-quota-fix-null-pointer-dereference-in-quota-che.patch b/queue-4.19/ceph-quota-fix-null-pointer-dereference-in-quota-che.patch new file mode 100644 index 00000000000..4bdebe844e3 --- /dev/null +++ b/queue-4.19/ceph-quota-fix-null-pointer-dereference-in-quota-che.patch @@ -0,0 +1,44 @@ +From 5967a3e6b612cddf7e0abc6129f08300b0df5253 Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Mon, 5 Nov 2018 19:00:52 +0000 +Subject: ceph: quota: fix null pointer dereference in quota check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 71f2cc64d027d712f29bf8d09d3e123302d5f245 ] + +This patch fixes a possible null pointer dereference in +check_quota_exceeded, detected by the static checker smatch, with the +following warning: + +   fs/ceph/quota.c:240 check_quota_exceeded() +    error: we previously assumed 'realm' could be null (see line 188) + +Fixes: b7a2921765cf ("ceph: quota: support for ceph.quota.max_files") +Reported-by: Dan Carpenter +Signed-off-by: Luis Henriques +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/quota.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/quota.c b/fs/ceph/quota.c +index 32d4f13784ba..03f4d24db8fe 100644 +--- a/fs/ceph/quota.c ++++ b/fs/ceph/quota.c +@@ -237,7 +237,8 @@ static bool check_quota_exceeded(struct inode *inode, enum quota_check_op op, + ceph_put_snap_realm(mdsc, realm); + realm = next; + } +- ceph_put_snap_realm(mdsc, realm); ++ if (realm) ++ ceph_put_snap_realm(mdsc, realm); + up_read(&mdsc->snap_rwsem); + + return exceeded; +-- +2.17.1 + diff --git a/queue-4.19/cifs-don-t-dereference-smb_file_target-before-null-c.patch b/queue-4.19/cifs-don-t-dereference-smb_file_target-before-null-c.patch new file mode 100644 index 00000000000..7d63bdb5cd8 --- /dev/null +++ b/queue-4.19/cifs-don-t-dereference-smb_file_target-before-null-c.patch @@ -0,0 +1,54 @@ +From e12b02ede28bfcd5b4550ea6c3c6e47bed983879 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 1 Nov 2018 13:14:30 +0000 +Subject: cifs: don't dereference smb_file_target before null check + +[ Upstream commit 8c6c9bed8773375b1d54ccca2911ec892c59db5d ] + +There is a null check on dst_file->private data which suggests +it can be potentially null. However, before this check, pointer +smb_file_target is derived from dst_file->private and dereferenced +in the call to tlink_tcon, hence there is a potential null pointer +deference. + +Fix this by assigning smb_file_target and target_tcon after the +null pointer sanity checks. + +Detected by CoverityScan, CID#1475302 ("Dereference before null check") + +Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") +Signed-off-by: Colin Ian King +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsfs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 7065426b3280..fb32f3d6925e 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -981,8 +981,8 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, + struct inode *src_inode = file_inode(src_file); + struct inode *target_inode = file_inode(dst_file); + struct cifsFileInfo *smb_file_src = src_file->private_data; +- struct cifsFileInfo *smb_file_target = dst_file->private_data; +- struct cifs_tcon *target_tcon = tlink_tcon(smb_file_target->tlink); ++ struct cifsFileInfo *smb_file_target; ++ struct cifs_tcon *target_tcon; + unsigned int xid; + int rc; + +@@ -996,6 +996,9 @@ static int cifs_clone_file_range(struct file *src_file, loff_t off, + goto out; + } + ++ smb_file_target = dst_file->private_data; ++ target_tcon = tlink_tcon(smb_file_target->tlink); ++ + /* + * Note: cifs case is easier than btrfs since server responsible for + * checks for proper open modes and file type and if it wants +-- +2.17.1 + diff --git a/queue-4.19/cifs-fix-return-value-for-cifs_listxattr.patch b/queue-4.19/cifs-fix-return-value-for-cifs_listxattr.patch new file mode 100644 index 00000000000..9fb1f22bfac --- /dev/null +++ b/queue-4.19/cifs-fix-return-value-for-cifs_listxattr.patch @@ -0,0 +1,63 @@ +From 7a8bc3c4b821aaff843ef8d8f09b46994ac397bd Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Thu, 25 Oct 2018 15:43:36 +1000 +Subject: cifs: fix return value for cifs_listxattr + +[ Upstream commit 0c5d6cb6643f48ad3775322f3ebab6c7eb67484e ] + +If the application buffer was too small to fit all the names +we would still count the number of bytes and return this for +listxattr. This would then trigger a BUG in usercopy.c + +Fix the computation of the size so that we return -ERANGE +correctly when the buffer is too small. + +This fixes the kernel BUG for xfstest generic/377 + +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Reviewed-by: Aurelien Aptel +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 89985a0a6819..812da3e56a22 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -686,6 +686,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + int rc = 0; + unsigned int ea_name_len = ea_name ? strlen(ea_name) : 0; + char *name, *value; ++ size_t buf_size = dst_size; + size_t name_len, value_len, user_name_len; + + while (src_size > 0) { +@@ -721,9 +722,10 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + /* 'user.' plus a terminating null */ + user_name_len = 5 + 1 + name_len; + +- rc += user_name_len; +- +- if (dst_size >= user_name_len) { ++ if (buf_size == 0) { ++ /* skip copy - calc size only */ ++ rc += user_name_len; ++ } else if (dst_size >= user_name_len) { + dst_size -= user_name_len; + memcpy(dst, "user.", 5); + dst += 5; +@@ -731,8 +733,7 @@ move_smb2_ea_to_cifs(char *dst, size_t dst_size, + dst += name_len; + *dst = 0; + ++dst; +- } else if (dst_size == 0) { +- /* skip copy - calc size only */ ++ rc += user_name_len; + } else { + /* stop before overrun buffer */ + rc = -ERANGE; +-- +2.17.1 + diff --git a/queue-4.19/clk-fixed-factor-fix-of_node_get-put-imbalance.patch b/queue-4.19/clk-fixed-factor-fix-of_node_get-put-imbalance.patch new file mode 100644 index 00000000000..db26357389e --- /dev/null +++ b/queue-4.19/clk-fixed-factor-fix-of_node_get-put-imbalance.patch @@ -0,0 +1,36 @@ +From 952cc26527530514ba6788ba32aea38a5ccf4ad1 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda Delgado +Date: Thu, 1 Nov 2018 14:15:49 +0100 +Subject: clk: fixed-factor: fix of_node_get-put imbalance + +[ Upstream commit f98e8a572bddbf27032114127d2fcc78fa5e6a9d ] + +When the fixed factor clock is created by devicetree, +of_clk_add_provider is called. Add a call to +of_clk_del_provider in the remove function to balance +it out. + +Reported-by: Alan Tull +Fixes: 971451b3b15d ("clk: fixed-factor: Convert into a module platform driver") +Signed-off-by: Ricardo Ribalda Delgado +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-fixed-factor.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c +index 20724abd38bd..7df6b5b1e7ee 100644 +--- a/drivers/clk/clk-fixed-factor.c ++++ b/drivers/clk/clk-fixed-factor.c +@@ -210,6 +210,7 @@ static int of_fixed_factor_clk_remove(struct platform_device *pdev) + { + struct clk *clk = platform_get_drvdata(pdev); + ++ of_clk_del_provider(pdev->dev.of_node); + clk_unregister_fixed_factor(clk); + + return 0; +-- +2.17.1 + diff --git a/queue-4.19/clk-fixed-rate-fix-of_node_get-put-imbalance.patch b/queue-4.19/clk-fixed-rate-fix-of_node_get-put-imbalance.patch new file mode 100644 index 00000000000..b53b07aadde --- /dev/null +++ b/queue-4.19/clk-fixed-rate-fix-of_node_get-put-imbalance.patch @@ -0,0 +1,35 @@ +From 846af2bfc8b52e556892e58675e256e22ceb7b9f Mon Sep 17 00:00:00 2001 +From: Alan Tull +Date: Thu, 18 Oct 2018 14:54:11 -0500 +Subject: clk: fixed-rate: fix of_node_get-put imbalance + +[ Upstream commit 52091c256bdcad0d01e2852a63f19cd2cce6af96 ] + +When the fixed rate clock is created by devicetree, +of_clk_add_provider is called. Add a call to +of_clk_del_provider in the remove function to balance +it out. + +Signed-off-by: Alan Tull +Fixes: 435779fe1336 ("clk: fixed-rate: Convert into a module platform driver") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-fixed-rate.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c +index b5c46b3f8764..6d6475c32ee5 100644 +--- a/drivers/clk/clk-fixed-rate.c ++++ b/drivers/clk/clk-fixed-rate.c +@@ -200,6 +200,7 @@ static int of_fixed_clk_remove(struct platform_device *pdev) + { + struct clk *clk = platform_get_drvdata(pdev); + ++ of_clk_del_provider(pdev->dev.of_node); + clk_unregister_fixed_rate(clk); + + return 0; +-- +2.17.1 + diff --git a/queue-4.19/clk-meson-axg-pcie-drop-the-mpll3-clock-parent.patch b/queue-4.19/clk-meson-axg-pcie-drop-the-mpll3-clock-parent.patch new file mode 100644 index 00000000000..14e7ccc7c10 --- /dev/null +++ b/queue-4.19/clk-meson-axg-pcie-drop-the-mpll3-clock-parent.patch @@ -0,0 +1,44 @@ +From cdb0bb213c80582381090f2e9f174d46b92f2d11 Mon Sep 17 00:00:00 2001 +From: Yixun Lan +Date: Wed, 1 Aug 2018 12:16:24 +0000 +Subject: clk: meson-axg: pcie: drop the mpll3 clock parent + +[ Upstream commit 69b93104c7ec5668019caf5d2dbfd0e182df06db ] + +We found the PCIe driver doesn't really work with +the mpll3 clock which is actually reserved for debug, +So drop it from the mux list. + +Fixes: 33b89db68236 ("clk: meson-axg: add clocks required by pcie driver") +Tested-by: Jianxin Qin +Signed-off-by: Yixun Lan +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/axg.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index 8cf74fc423e6..baabcf7c0a24 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -713,12 +713,14 @@ static struct clk_regmap axg_pcie_mux = { + .offset = HHI_PCIE_PLL_CNTL6, + .mask = 0x1, + .shift = 2, ++ /* skip the parent mpll3, reserved for debug */ ++ .table = (u32[]){ 1 }, + }, + .hw.init = &(struct clk_init_data){ + .name = "pcie_mux", + .ops = &clk_regmap_mux_ops, +- .parent_names = (const char *[]){ "mpll3", "pcie_pll" }, +- .num_parents = 2, ++ .parent_names = (const char *[]){ "pcie_pll" }, ++ .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + }, + }; +-- +2.17.1 + diff --git a/queue-4.19/clk-meson-clk-pll-drop-clk_get_rate_nocache-where-un.patch b/queue-4.19/clk-meson-clk-pll-drop-clk_get_rate_nocache-where-un.patch new file mode 100644 index 00000000000..a830d859d8f --- /dev/null +++ b/queue-4.19/clk-meson-clk-pll-drop-clk_get_rate_nocache-where-un.patch @@ -0,0 +1,125 @@ +From 2ccdef959392ac042d56a3fd4afe8fd09909890a Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Wed, 1 Aug 2018 16:00:51 +0200 +Subject: clk: meson: clk-pll: drop CLK_GET_RATE_NOCACHE where unnecessary + +[ Upstream commit 2303a9ca693e585a558497ad737728fec97e2b8a ] + +CLK_GET_RATE_NOCACHE should only be necessary when the registers +controlling the rate of clock may change outside of CCF. On Amlogic, +it should only be the case for the hdmi pll which is directly controlled +by the display driver (WIP to fix this). + +The other plls should not require this flag. + +Reviewed-by: Martin Blumenstingl +Tested-by: Martin Blumenstingl +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/axg.c | 1 - + drivers/clk/meson/gxbb.c | 12 ++++++++---- + drivers/clk/meson/meson8b.c | 3 --- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/meson/axg.c b/drivers/clk/meson/axg.c +index baabcf7c0a24..02229d051d77 100644 +--- a/drivers/clk/meson/axg.c ++++ b/drivers/clk/meson/axg.c +@@ -96,7 +96,6 @@ static struct clk_regmap axg_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index 6435d86118f1..6628ffa31383 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -213,7 +213,6 @@ static struct clk_regmap gxbb_fixed_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -276,6 +275,10 @@ static struct clk_regmap gxbb_hdmi_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "hdmi_pll_pre_mult" }, + .num_parents = 1, ++ /* ++ * Display directly handle hdmi pll registers ATM, we need ++ * NOCACHE to keep our view of the clock as accurate as possible ++ */ + .flags = CLK_GET_RATE_NOCACHE, + }, + }; +@@ -334,6 +337,10 @@ static struct clk_regmap gxl_hdmi_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, ++ /* ++ * Display directly handle hdmi pll registers ATM, we need ++ * NOCACHE to keep our view of the clock as accurate as possible ++ */ + .flags = CLK_GET_RATE_NOCACHE, + }, + }; +@@ -371,7 +378,6 @@ static struct clk_regmap gxbb_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -418,7 +424,6 @@ static struct clk_regmap gxbb_gp0_pll = { + .ops = &meson_clk_pll_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -472,7 +477,6 @@ static struct clk_regmap gxl_gp0_pll = { + .ops = &meson_clk_pll_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 7447d96a265f..74697e145dde 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -132,7 +132,6 @@ static struct clk_regmap meson8b_fixed_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -169,7 +168,6 @@ static struct clk_regmap meson8b_vid_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +@@ -207,7 +205,6 @@ static struct clk_regmap meson8b_sys_pll = { + .ops = &meson_clk_pll_ro_ops, + .parent_names = (const char *[]){ "xtal" }, + .num_parents = 1, +- .flags = CLK_GET_RATE_NOCACHE, + }, + }; + +-- +2.17.1 + diff --git a/queue-4.19/clk-renesas-r9a06g032-fix-uart34567-clock-rate.patch b/queue-4.19/clk-renesas-r9a06g032-fix-uart34567-clock-rate.patch new file mode 100644 index 00000000000..349ec52f4cd --- /dev/null +++ b/queue-4.19/clk-renesas-r9a06g032-fix-uart34567-clock-rate.patch @@ -0,0 +1,50 @@ +From fb4c3bbcb39199a7cf1e59ec6040c71e65d36887 Mon Sep 17 00:00:00 2001 +From: Phil Edworthy +Date: Fri, 31 Aug 2018 12:26:36 +0100 +Subject: clk: renesas: r9a06g032: Fix UART34567 clock rate + +[ Upstream commit ee02950d53eee0d4c7f1c08a35272b77d24b9459 ] + +The clock for UARTs 0 through 2 is UART012, the clock for UARTs 3 through +7 is UART34567. +For UART012, we stop the clock driver from changing the clock rate. This +is because the Synopsys UART driver simply sets the reference clock to 16x +the baud rate, but doesn't check if the actual rate is within the required +tolerance. The RZ/N1 clock divider can't provide this (we have to rely on +the UART's internal divider to set the correct clock rate), so you end up +with a clock rate that is way off what you wanted. + +In addition, since the clock is shared between multiple UARTs, you don't +want the driver trying to change the clock rate as it may affect the other +UARTs (which may not have been configured yet, so you don't know what baud +rate they will use). Normally, the clock rate is set early on before Linux +to some very high rate that supports all of the clock rates you want. + +This change stops the UART34567 clock rate from changing for the same +reasons. + +Signed-off-by: Phil Edworthy +Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a06g032-clocks.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index a0b6ecdc63dd..6d2b56891559 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -539,7 +539,8 @@ r9a06g032_div_round_rate(struct clk_hw *hw, + * several uarts attached to this divider, and changing this impacts + * everyone. + */ +- if (clk->index == R9A06G032_DIV_UART) { ++ if (clk->index == R9A06G032_DIV_UART || ++ clk->index == R9A06G032_DIV_P2_PG) { + pr_devel("%s div uart hack!\n", __func__); + return clk_get_rate(hw->clk); + } +-- +2.17.1 + diff --git a/queue-4.19/clk-samsung-exynos5420-enable-peris-clocks-for-suspe.patch b/queue-4.19/clk-samsung-exynos5420-enable-peris-clocks-for-suspe.patch new file mode 100644 index 00000000000..f9af0918fdb --- /dev/null +++ b/queue-4.19/clk-samsung-exynos5420-enable-peris-clocks-for-suspe.patch @@ -0,0 +1,34 @@ +From 60048167293c62d58ecc4ac6af32a356ddb2cb3f Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Mon, 24 Sep 2018 13:01:20 +0200 +Subject: clk: samsung: exynos5420: Enable PERIS clocks for suspend + +[ Upstream commit b33228029d842269e17bba591609e83ed422005d ] + +Ensure that clocks for core SoC modules (including TZPC0..9 modules) +are enabled for suspend/resume cycle. This fixes suspend/resume +support on Exynos5422-based Odroid XU3/XU4 boards. + +Suggested-by: Joonyoung Shim +Signed-off-by: Marek Szyprowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos5420.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index 95e1bf69449b..d4f77c4eb277 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -281,6 +281,7 @@ static const struct samsung_clk_reg_dump exynos5420_set_clksrc[] = { + { .offset = GATE_BUS_TOP, .value = 0xffffffff, }, + { .offset = GATE_BUS_DISP1, .value = 0xffffffff, }, + { .offset = GATE_IP_PERIC, .value = 0xffffffff, }, ++ { .offset = GATE_IP_PERIS, .value = 0xffffffff, }, + }; + + static int exynos5420_clk_suspend(void) +-- +2.17.1 + diff --git a/queue-4.19/clk-ti-fix-of-child-node-lookup.patch b/queue-4.19/clk-ti-fix-of-child-node-lookup.patch new file mode 100644 index 00000000000..a1c29123ec2 --- /dev/null +++ b/queue-4.19/clk-ti-fix-of-child-node-lookup.patch @@ -0,0 +1,67 @@ +From 8758186c636915c13be1fe2354a6d54a7677cc77 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 22 Aug 2018 11:03:19 +0200 +Subject: clk: ti: fix OF child-node lookup + +[ Upstream commit 00a461cc32ec27fa7bd9c874a7b36b0c6c542c12 ] + +Fix child-node lookup which by using the wrong OF helper was searching +the whole tree depth-first, something which could end up matching an +unrelated node. + +Also fix the related node-reference leaks. + +Fixes: 5b385a45e001 ("clk: ti: add support for clkctrl aliases") +Signed-off-by: Johan Hovold +Acked-by: Tero Kristo +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/ti/clk.c b/drivers/clk/ti/clk.c +index 7d22e1af2247..27e0979b3158 100644 +--- a/drivers/clk/ti/clk.c ++++ b/drivers/clk/ti/clk.c +@@ -129,7 +129,7 @@ int ti_clk_setup_ll_ops(struct ti_clk_ll_ops *ops) + void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + { + struct ti_dt_clk *c; +- struct device_node *node; ++ struct device_node *node, *parent; + struct clk *clk; + struct of_phandle_args clkspec; + char buf[64]; +@@ -164,8 +164,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + continue; + + node = of_find_node_by_name(NULL, buf); +- if (num_args) +- node = of_find_node_by_name(node, "clk"); ++ if (num_args) { ++ parent = node; ++ node = of_get_child_by_name(parent, "clk"); ++ of_node_put(parent); ++ } ++ + clkspec.np = node; + clkspec.args_count = num_args; + for (i = 0; i < num_args; i++) { +@@ -173,11 +177,12 @@ void __init ti_dt_clocks_register(struct ti_dt_clk oclks[]) + if (ret) { + pr_warn("Bad tag in %s at %d: %s\n", + c->node_name, i, tags[i]); ++ of_node_put(node); + return; + } + } + clk = of_clk_get_from_provider(&clkspec); +- ++ of_node_put(node); + if (!IS_ERR(clk)) { + c->lk.clk = clk; + clkdev_add(&c->lk); +-- +2.17.1 + diff --git a/queue-4.19/drm-amd-amdgpu-dm-fix-dm_dp_create_fake_mst_encoder.patch b/queue-4.19/drm-amd-amdgpu-dm-fix-dm_dp_create_fake_mst_encoder.patch new file mode 100644 index 00000000000..c5086f44ecd --- /dev/null +++ b/queue-4.19/drm-amd-amdgpu-dm-fix-dm_dp_create_fake_mst_encoder.patch @@ -0,0 +1,91 @@ +From d0300243cc7b218d03edb058c5fb638ed8325450 Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Thu, 1 Nov 2018 21:51:49 -0400 +Subject: drm/amd/amdgpu/dm: Fix dm_dp_create_fake_mst_encoder() + +[ Upstream commit 63237f8748bdf46dccf79ef8f98f05e9fe799162 ] + +[why] +Removing connector reusage from DM to match the rest of the tree ended +up revealing an issue that was surprisingly subtle. The original amdgpu +code for DC that was submitted appears to have left a chunk in +dm_dp_create_fake_mst_encoder() that tries to find a "master encoder", +the likes of which isn't actually used or stored anywhere. It does so at +the wrong time as well by trying to access parts of the drm_connector +from the encoder init before it's actually been initialized. This +results in a NULL pointer deref on MST hotplugs: + +[ 160.696613] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 +[ 160.697234] PGD 0 P4D 0 +[ 160.697814] Oops: 0010 [#1] SMP PTI +[ 160.698430] CPU: 2 PID: 64 Comm: kworker/2:1 Kdump: loaded Tainted: G O 4.19.0Lyude-Test+ #2 +[ 160.699020] Hardware name: HP HP ZBook 15 G4/8275, BIOS P70 Ver. 01.22 05/17/2018 +[ 160.699672] Workqueue: events_long drm_dp_mst_link_probe_work [drm_kms_helper] +[ 160.700322] RIP: 0010: (null) +[ 160.700920] Code: Bad RIP value. +[ 160.701541] RSP: 0018:ffffc9000029fc78 EFLAGS: 00010206 +[ 160.702183] RAX: 0000000000000000 RBX: ffff8804440ed468 RCX: ffff8804440e9158 +[ 160.702778] RDX: 0000000000000000 RSI: ffff8804556c5700 RDI: ffff8804440ed000 +[ 160.703408] RBP: ffff880458e21800 R08: 0000000000000002 R09: 000000005fca0a25 +[ 160.704002] R10: ffff88045a077a3d R11: ffff88045a077a3c R12: ffff8804440ed000 +[ 160.704614] R13: ffff880458e21800 R14: ffff8804440e9000 R15: ffff8804440e9000 +[ 160.705260] FS: 0000000000000000(0000) GS:ffff88045f280000(0000) knlGS:0000000000000000 +[ 160.705854] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 160.706478] CR2: ffffffffffffffd6 CR3: 000000000200a001 CR4: 00000000003606e0 +[ 160.707124] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 160.707724] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 160.708372] Call Trace: +[ 160.708998] ? dm_dp_add_mst_connector+0xed/0x1d0 [amdgpu] +[ 160.709625] ? drm_dp_add_port+0x2fa/0x470 [drm_kms_helper] +[ 160.710284] ? wake_up_q+0x54/0x70 +[ 160.710877] ? __mutex_unlock_slowpath.isra.18+0xb3/0x110 +[ 160.711512] ? drm_dp_dpcd_access+0xe7/0x110 [drm_kms_helper] +[ 160.712161] ? drm_dp_send_link_address+0x155/0x1e0 [drm_kms_helper] +[ 160.712762] ? drm_dp_check_and_send_link_address+0xa3/0xd0 [drm_kms_helper] +[ 160.713408] ? drm_dp_mst_link_probe_work+0x4b/0x80 [drm_kms_helper] +[ 160.714013] ? process_one_work+0x1a1/0x3a0 +[ 160.714667] ? worker_thread+0x30/0x380 +[ 160.715326] ? wq_update_unbound_numa+0x10/0x10 +[ 160.715939] ? kthread+0x112/0x130 +[ 160.716591] ? kthread_create_worker_on_cpu+0x70/0x70 +[ 160.717262] ? ret_from_fork+0x35/0x40 +[ 160.717886] Modules linked in: amdgpu(O) vfat fat snd_hda_codec_generic joydev i915 chash gpu_sched ttm i2c_algo_bit drm_kms_helper snd_hda_codec_hdmi hp_wmi syscopyarea iTCO_wdt sysfillrect sparse_keymap sysimgblt fb_sys_fops snd_hda_intel usbhid wmi_bmof drm snd_hda_codec btusb snd_hda_core intel_rapl btrtl x86_pkg_temp_thermal btbcm btintel coretemp snd_pcm crc32_pclmul bluetooth psmouse snd_timer snd pcspkr i2c_i801 mei_me i2c_core soundcore mei tpm_tis wmi tpm_tis_core hp_accel ecdh_generic lis3lv02d tpm video rfkill acpi_pad input_polldev hp_wireless pcc_cpufreq crc32c_intel serio_raw tg3 xhci_pci xhci_hcd [last unloaded: amdgpu] +[ 160.720141] CR2: 0000000000000000 + +Somehow the connector reusage DM was using for MST connectors managed to +paper over this issue entirely; hence why this was never caught until +now. + +[how] +Since this code isn't used anywhere and seems useless anyway, we can +just drop it entirely. This appears to fix the issue on my HP ZBook with +an AMD WX4150. + +Signed-off-by: Lyude Paul +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 4b08359e18bd..4cc45a1d21db 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -317,12 +317,7 @@ dm_dp_create_fake_mst_encoder(struct amdgpu_dm_connector *connector) + struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_encoder *amdgpu_encoder; + struct drm_encoder *encoder; +- const struct drm_connector_helper_funcs *connector_funcs = +- connector->base.helper_private; +- struct drm_encoder *enc_master = +- connector_funcs->best_encoder(&connector->base); + +- DRM_DEBUG_KMS("enc master is %p\n", enc_master); + amdgpu_encoder = kzalloc(sizeof(*amdgpu_encoder), GFP_KERNEL); + if (!amdgpu_encoder) + return NULL; +-- +2.17.1 + diff --git a/queue-4.19/drm-amd-display-drop-reusing-drm-connector-for-mst.patch b/queue-4.19/drm-amd-display-drop-reusing-drm-connector-for-mst.patch new file mode 100644 index 00000000000..9d785f6580d --- /dev/null +++ b/queue-4.19/drm-amd-display-drop-reusing-drm-connector-for-mst.patch @@ -0,0 +1,142 @@ +From a54bbeb5a5adda47d97ac30ad584f32387e24d3d Mon Sep 17 00:00:00 2001 +From: "Jerry (Fangzhi) Zuo" +Date: Tue, 30 Oct 2018 14:37:16 -0400 +Subject: drm/amd/display: Drop reusing drm connector for MST + +[ Upstream commit 0e6613e46fed29316f33acf86e1d1568288638b5 ] + +[why] +It is not safe to keep existing connector while entire topology +has been removed. Could lead potential impact to uapi. +Entirely unregister all the connectors on the topology, +and use a new set of connectors when the topology is plugged back +on. + +[How] +Remove the drm connector entirely each time when the +corresponding MST topology is gone. +When hotunplug a connector (e.g., DP2) +1. Remove connector from userspace. +2. Drop it's reference. +When hotplug back on: +1. Detect new topology, and create new connectors. +2. Notify userspace with sysfs hotplug event. +3. Reprobe new connectors, and reassign CRTC from old (e.g., DP2) +to new (e.g., DP3) connector. + +Signed-off-by: Jerry (Fangzhi) Zuo +Reviewed-by: Harry Wentland +Reviewed-by: Lyude Paul +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h | 2 - + .../display/amdgpu_dm/amdgpu_dm_mst_types.c | 40 ++++--------------- + 2 files changed, 7 insertions(+), 35 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +index a29dc35954c9..aba2c5c1d2f8 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h +@@ -173,8 +173,6 @@ struct amdgpu_dm_connector { + struct mutex hpd_lock; + + bool fake_enable; +- +- bool mst_connected; + }; + + #define to_amdgpu_dm_connector(x) container_of(x, struct amdgpu_dm_connector, base) +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 9a300732ba37..4b08359e18bd 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -352,25 +352,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_dm_connector *aconnector; + struct drm_connector *connector; +- struct drm_connector_list_iter conn_iter; +- +- drm_connector_list_iter_begin(dev, &conn_iter); +- drm_for_each_connector_iter(connector, &conn_iter) { +- aconnector = to_amdgpu_dm_connector(connector); +- if (aconnector->mst_port == master +- && !aconnector->port) { +- DRM_INFO("DM_MST: reusing connector: %p [id: %d] [master: %p]\n", +- aconnector, connector->base.id, aconnector->mst_port); +- +- aconnector->port = port; +- drm_connector_set_path_property(connector, pathprop); +- +- drm_connector_list_iter_end(&conn_iter); +- aconnector->mst_connected = true; +- return &aconnector->base; +- } +- } +- drm_connector_list_iter_end(&conn_iter); + + aconnector = kzalloc(sizeof(*aconnector), GFP_KERNEL); + if (!aconnector) +@@ -419,8 +400,6 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + */ + amdgpu_dm_connector_funcs_reset(connector); + +- aconnector->mst_connected = true; +- + DRM_INFO("DM_MST: added connector: %p [id: %d] [master: %p]\n", + aconnector, connector->base.id, aconnector->mst_port); + +@@ -432,6 +411,9 @@ dm_dp_add_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct drm_connector *connector) + { ++ struct amdgpu_dm_connector *master = container_of(mgr, struct amdgpu_dm_connector, mst_mgr); ++ struct drm_device *dev = master->base.dev; ++ struct amdgpu_device *adev = dev->dev_private; + struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector); + + DRM_INFO("DM_MST: Disabling connector: %p [id: %d] [master: %p]\n", +@@ -445,7 +427,10 @@ static void dm_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + aconnector->dc_sink = NULL; + } + +- aconnector->mst_connected = false; ++ drm_connector_unregister(connector); ++ if (adev->mode_info.rfbdev) ++ drm_fb_helper_remove_one_connector(&adev->mode_info.rfbdev->helper, connector); ++ drm_connector_put(connector); + } + + static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr) +@@ -456,18 +441,10 @@ static void dm_dp_mst_hotplug(struct drm_dp_mst_topology_mgr *mgr) + drm_kms_helper_hotplug_event(dev); + } + +-static void dm_dp_mst_link_status_reset(struct drm_connector *connector) +-{ +- mutex_lock(&connector->dev->mode_config.mutex); +- drm_connector_set_link_status_property(connector, DRM_MODE_LINK_STATUS_BAD); +- mutex_unlock(&connector->dev->mode_config.mutex); +-} +- + static void dm_dp_mst_register_connector(struct drm_connector *connector) + { + struct drm_device *dev = connector->dev; + struct amdgpu_device *adev = dev->dev_private; +- struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector); + + if (adev->mode_info.rfbdev) + drm_fb_helper_add_one_connector(&adev->mode_info.rfbdev->helper, connector); +@@ -475,9 +452,6 @@ static void dm_dp_mst_register_connector(struct drm_connector *connector) + DRM_ERROR("adev->mode_info.rfbdev is NULL\n"); + + drm_connector_register(connector); +- +- if (aconnector->mst_connected) +- dm_dp_mst_link_status_reset(connector); + } + + static const struct drm_dp_mst_topology_cbs dm_mst_cbs = { +-- +2.17.1 + diff --git a/queue-4.19/drm-amd-display-stop-leaking-planes.patch b/queue-4.19/drm-amd-display-stop-leaking-planes.patch new file mode 100644 index 00000000000..4944ddb97c1 --- /dev/null +++ b/queue-4.19/drm-amd-display-stop-leaking-planes.patch @@ -0,0 +1,37 @@ +From a3cf2f0be83c26907abbb2523b946d2a3bd4ca80 Mon Sep 17 00:00:00 2001 +From: Harry Wentland +Date: Sun, 7 Oct 2018 10:01:23 -0400 +Subject: drm/amd/display: Stop leaking planes + +[ Upstream commit 02680efbb10be0d2c867fe722ae23d588f6bebef ] + +[Why] +drm_plane_cleanup does not free the plane. + +[How] +Call drm_primary_helper_destroy which will also free the plane. + +Signed-off-by: Harry Wentland +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6903fe6c894b..ef5c6af4d964 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3167,7 +3167,7 @@ void dm_drm_plane_destroy_state(struct drm_plane *plane, + static const struct drm_plane_funcs dm_plane_funcs = { + .update_plane = drm_atomic_helper_update_plane, + .disable_plane = drm_atomic_helper_disable_plane, +- .destroy = drm_plane_cleanup, ++ .destroy = drm_primary_helper_destroy, + .reset = dm_drm_plane_reset, + .atomic_duplicate_state = dm_drm_plane_duplicate_state, + .atomic_destroy_state = dm_drm_plane_destroy_state, +-- +2.17.1 + diff --git a/queue-4.19/drm-edid-add-6-bpc-quirk-for-boe-panel.patch b/queue-4.19/drm-edid-add-6-bpc-quirk-for-boe-panel.patch new file mode 100644 index 00000000000..e5ac179c90f --- /dev/null +++ b/queue-4.19/drm-edid-add-6-bpc-quirk-for-boe-panel.patch @@ -0,0 +1,42 @@ +From b8fea58273027054bd612f066db5668ba67c732b Mon Sep 17 00:00:00 2001 +From: "Lee, Shawn C" +Date: Sun, 28 Oct 2018 22:49:33 -0700 +Subject: drm/edid: Add 6 bpc quirk for BOE panel. + +[ Upstream commit 922dceff8dc1fb4dafc9af78139ba65671408103 ] + +BOE panel (ID: 0x0771) that reports "DFP 1.x compliant TMDS". +But it's 6bpc panel only instead of 8 bpc. + +Add panel ID to edid quirk list and set 6 bpc as default to +work around this issue. + +Cc: Jani Nikula +Cc: Maarten Lankhorst +Cc: Gustavo Padovan +Cc: Cooper Chiou +Signed-off-by: Lee, Shawn C > +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/1540792173-7288-1-git-send-email-shawn.c.lee@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index ff0bfc65a8c1..b506e3622b08 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -122,6 +122,9 @@ static const struct edid_quirk { + /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ + { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, + ++ /* BOE model 0x0771 reports 8 bpc, but is a 6 bpc panel */ ++ { "BOE", 0x0771, EDID_QUIRK_FORCE_6BPC }, ++ + /* Belinea 10 15 55 */ + { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, + { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, +-- +2.17.1 + diff --git a/queue-4.19/fs-exofs-fix-potential-memory-leak-in-mount-option-p.patch b/queue-4.19/fs-exofs-fix-potential-memory-leak-in-mount-option-p.patch new file mode 100644 index 00000000000..6d0826c6982 --- /dev/null +++ b/queue-4.19/fs-exofs-fix-potential-memory-leak-in-mount-option-p.patch @@ -0,0 +1,44 @@ +From b44b35a01c98e3a0b54738cc670974c1c20664d6 Mon Sep 17 00:00:00 2001 +From: Chengguang Xu +Date: Wed, 13 Jun 2018 12:05:13 +0800 +Subject: fs/exofs: fix potential memory leak in mount option parsing + +[ Upstream commit 515f1867addaba49c1c6ac73abfaffbc192c1db4 ] + +There are some cases can cause memory leak when parsing +option 'osdname'. + +Signed-off-by: Chengguang Xu +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/exofs/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/exofs/super.c b/fs/exofs/super.c +index 41cf2fbee50d..7d61e3fa378c 100644 +--- a/fs/exofs/super.c ++++ b/fs/exofs/super.c +@@ -101,6 +101,7 @@ static int parse_options(char *options, struct exofs_mountopt *opts) + token = match_token(p, tokens, args); + switch (token) { + case Opt_name: ++ kfree(opts->dev_name); + opts->dev_name = match_strdup(&args[0]); + if (unlikely(!opts->dev_name)) { + EXOFS_ERR("Error allocating dev_name"); +@@ -866,8 +867,10 @@ static struct dentry *exofs_mount(struct file_system_type *type, + int ret; + + ret = parse_options(data, &opts); +- if (ret) ++ if (ret) { ++ kfree(opts.dev_name); + return ERR_PTR(ret); ++ } + + if (!opts.dev_name) + opts.dev_name = dev_name; +-- +2.17.1 + diff --git a/queue-4.19/hfs-prevent-btree-data-loss-on-root-split.patch b/queue-4.19/hfs-prevent-btree-data-loss-on-root-split.patch new file mode 100644 index 00000000000..c0557d41f1c --- /dev/null +++ b/queue-4.19/hfs-prevent-btree-data-loss-on-root-split.patch @@ -0,0 +1,49 @@ +From 6265c924b716794df1fd72b73f4977b4d009229e Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?= + +Date: Tue, 30 Oct 2018 15:06:07 -0700 +Subject: hfs: prevent btree data loss on root split +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit d057c036672f33d43a5f7344acbb08cf3a8a0c09 ] + +This bug is triggered whenever hfs_brec_update_parent() needs to split +the root node. The height of the btree is not increased, which leaves +the new node orphaned and its records lost. It is not possible for this +to happen on a valid hfs filesystem because the index nodes have fixed +length keys. + +For reasons I ignore, the hfs module does have support for a number of +hfsplus features. A corrupt btree header may report variable length +keys and trigger this bug, so it's better to fix it. + +Link: http://lkml.kernel.org/r/9750b1415685c4adca10766895f6d5ef12babdb0.1535682463.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfs/brec.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c +index 9a8772465a90..da25c49203cc 100644 +--- a/fs/hfs/brec.c ++++ b/fs/hfs/brec.c +@@ -425,6 +425,10 @@ skip: + if (new_node) { + __be32 cnid; + ++ if (!new_node->parent) { ++ hfs_btree_inc_height(tree); ++ new_node->parent = tree->root; ++ } + fd->bnode = hfs_bnode_find(tree, new_node->parent); + /* create index key and entry */ + hfs_bnode_read_key(new_node, fd->search_key, 14); +-- +2.17.1 + diff --git a/queue-4.19/hfsplus-prevent-btree-data-loss-on-root-split.patch b/queue-4.19/hfsplus-prevent-btree-data-loss-on-root-split.patch new file mode 100644 index 00000000000..80be0b6e94e --- /dev/null +++ b/queue-4.19/hfsplus-prevent-btree-data-loss-on-root-split.patch @@ -0,0 +1,63 @@ +From a493f31781a5c186243b9e53a9f0ee9e5746c240 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?= + +Date: Tue, 30 Oct 2018 15:06:00 -0700 +Subject: hfsplus: prevent btree data loss on root split +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 0a3021d4f5295aa073c7bf5c5e4de60a2e292578 ] + +Creating, renaming or deleting a file may cause catalog corruption and +data loss. This bug is randomly triggered by xfstests generic/027, but +here is a faster reproducer: + + truncate -s 50M fs.iso + mkfs.hfsplus fs.iso + mount fs.iso /mnt + i=100 + while [ $i -le 150 ]; do + touch /mnt/$i &>/dev/null + ((++i)) + done + i=100 + while [ $i -le 150 ]; do + mv /mnt/$i /mnt/$(perl -e "print $i x82") &>/dev/null + ((++i)) + done + umount /mnt + fsck.hfsplus -n fs.iso + +The bug is triggered whenever hfs_brec_update_parent() needs to split the +root node. The height of the btree is not increased, which leaves the new +node orphaned and its records lost. + +Link: http://lkml.kernel.org/r/26d882184fc43043a810114258f45277752186c7.1535682461.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfsplus/brec.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c +index ed8eacb34452..aa17a392b414 100644 +--- a/fs/hfsplus/brec.c ++++ b/fs/hfsplus/brec.c +@@ -429,6 +429,10 @@ skip: + if (new_node) { + __be32 cnid; + ++ if (!new_node->parent) { ++ hfs_btree_inc_height(tree); ++ new_node->parent = tree->root; ++ } + fd->bnode = hfs_bnode_find(tree, new_node->parent); + /* create index key and entry */ + hfs_bnode_read_key(new_node, fd->search_key, 14); +-- +2.17.1 + diff --git a/queue-4.19/hid-alps-allow-incoming-reports-when-only-the-tracks.patch b/queue-4.19/hid-alps-allow-incoming-reports-when-only-the-tracks.patch new file mode 100644 index 00000000000..375748c66da --- /dev/null +++ b/queue-4.19/hid-alps-allow-incoming-reports-when-only-the-tracks.patch @@ -0,0 +1,61 @@ +From b163b31a53eaa14f25cb71a6b59fd12b03c1d860 Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Fri, 12 Oct 2018 16:05:25 +0200 +Subject: HID: alps: allow incoming reports when only the trackstick is opened + +[ Upstream commit 7dd8db68949a7acc5bd528ee0ecb8f8720f49921 ] + +If userspace only reads the trackstick node, and no one is listening to +the touchpad nor the hidraw node then, the device is not powered on. + +Add open/close callbacks to allow users to disable the touchpad in Gnome +while keeping the trackstick active. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1559632 +Link: https://gitlab.gnome.org/GNOME/mutter/issues/128 +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index aec253b44156..3cd7229b6e54 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -660,6 +660,20 @@ exit: + return ret; + } + ++static int alps_sp_open(struct input_dev *dev) ++{ ++ struct hid_device *hid = input_get_drvdata(dev); ++ ++ return hid_hw_open(hid); ++} ++ ++static void alps_sp_close(struct input_dev *dev) ++{ ++ struct hid_device *hid = input_get_drvdata(dev); ++ ++ hid_hw_close(hid); ++} ++ + static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi) + { + struct alps_dev *data = hid_get_drvdata(hdev); +@@ -733,6 +747,10 @@ static int alps_input_configured(struct hid_device *hdev, struct hid_input *hi) + input2->id.version = input->id.version; + input2->dev.parent = input->dev.parent; + ++ input_set_drvdata(input2, hdev); ++ input2->open = alps_sp_open; ++ input2->close = alps_sp_close; ++ + __set_bit(EV_KEY, input2->evbit); + data->sp_btn_cnt = (data->sp_btn_info & 0x0F); + for (i = 0; i < data->sp_btn_cnt; i++) +-- +2.17.1 + diff --git a/queue-4.19/hid-i2c-hid-add-a-small-delay-after-sleep-command-fo.patch b/queue-4.19/hid-i2c-hid-add-a-small-delay-after-sleep-command-fo.patch new file mode 100644 index 00000000000..113bad29bd8 --- /dev/null +++ b/queue-4.19/hid-i2c-hid-add-a-small-delay-after-sleep-command-fo.patch @@ -0,0 +1,107 @@ +From 2f3fe5151b95202cd889b96234dc5f5af7bc0eb5 Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Fri, 5 Oct 2018 12:46:29 +0800 +Subject: HID: i2c-hid: Add a small delay after sleep command for Raydium + touchpanel + +[ Upstream commit 00b790ea545b6ef30221adef6e9c3707e03b82b5 ] + +Raydium touchpanel (2386:4B33) sometimes does not work in desktop session +although it works in display manager. + +During user logging, the display manager exits, close the HID device, +then the device gets runtime suspended and powered off. The desktop +session begins shortly after, opens the HID device, then the device gets +runtime resumed and powered on. + +If the trasition from display manager to desktop sesesion is fast, the +touchpanel cannot switch from powered off to powered on in short +timeframe. So add a small delay to workaround the issue. + +Signed-off-by: Kai-Heng Feng +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/i2c-hid/i2c-hid.c | 19 +++++++++++++++++++ + 2 files changed, 22 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index bc49909aba8e..636b9d903b26 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -921,6 +921,9 @@ + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3003 0x3003 + #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008 + ++#define I2C_VENDOR_ID_RAYDIUM 0x2386 ++#define I2C_PRODUCT_ID_RAYDIUM_4B33 0x4b33 ++ + #define USB_VENDOR_ID_RAZER 0x1532 + #define USB_DEVICE_ID_RAZER_BLADE_14 0x011D + +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 4e3592e7a3f7..88daa388e1f6 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -48,6 +48,7 @@ + #define I2C_HID_QUIRK_SET_PWR_WAKEUP_DEV BIT(0) + #define I2C_HID_QUIRK_NO_IRQ_AFTER_RESET BIT(1) + #define I2C_HID_QUIRK_NO_RUNTIME_PM BIT(2) ++#define I2C_HID_QUIRK_DELAY_AFTER_SLEEP BIT(3) + + /* flags */ + #define I2C_HID_STARTED 0 +@@ -157,6 +158,8 @@ struct i2c_hid { + + bool irq_wake_enabled; + struct mutex reset_lock; ++ ++ unsigned long sleep_delay; + }; + + static const struct i2c_hid_quirks { +@@ -171,6 +174,8 @@ static const struct i2c_hid_quirks { + { I2C_VENDOR_ID_HANTICK, I2C_PRODUCT_ID_HANTICK_5288, + I2C_HID_QUIRK_NO_IRQ_AFTER_RESET | + I2C_HID_QUIRK_NO_RUNTIME_PM }, ++ { I2C_VENDOR_ID_RAYDIUM, I2C_PRODUCT_ID_RAYDIUM_4B33, ++ I2C_HID_QUIRK_DELAY_AFTER_SLEEP }, + { 0, 0 } + }; + +@@ -386,6 +391,7 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) + { + struct i2c_hid *ihid = i2c_get_clientdata(client); + int ret; ++ unsigned long now, delay; + + i2c_hid_dbg(ihid, "%s\n", __func__); + +@@ -403,9 +409,22 @@ static int i2c_hid_set_power(struct i2c_client *client, int power_state) + goto set_pwr_exit; + } + ++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP && ++ power_state == I2C_HID_PWR_ON) { ++ now = jiffies; ++ if (time_after(ihid->sleep_delay, now)) { ++ delay = jiffies_to_usecs(ihid->sleep_delay - now); ++ usleep_range(delay, delay + 1); ++ } ++ } ++ + ret = __i2c_hid_command(client, &hid_set_power_cmd, power_state, + 0, NULL, 0, NULL, 0); + ++ if (ihid->quirks & I2C_HID_QUIRK_DELAY_AFTER_SLEEP && ++ power_state == I2C_HID_PWR_SLEEP) ++ ihid->sleep_delay = jiffies + msecs_to_jiffies(20); ++ + if (ret) + dev_err(&client->dev, "failed to change power setting.\n"); + +-- +2.17.1 + diff --git a/queue-4.19/hwmon-ibmpowernv-remove-bogus-__init-annotations.patch b/queue-4.19/hwmon-ibmpowernv-remove-bogus-__init-annotations.patch new file mode 100644 index 00000000000..615dec3cbd7 --- /dev/null +++ b/queue-4.19/hwmon-ibmpowernv-remove-bogus-__init-annotations.patch @@ -0,0 +1,53 @@ +From 2efe380bf0d96610f62a1d16aa125f25d3a088dc Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Sun, 28 Oct 2018 18:16:51 +0100 +Subject: hwmon: (ibmpowernv) Remove bogus __init annotations + +[ Upstream commit e3e61f01d755188cb6c2dcf5a244b9c0937c258e ] + +If gcc decides not to inline make_sensor_label(): + + WARNING: vmlinux.o(.text+0x4df549c): Section mismatch in reference from the function .create_device_attrs() to the function .init.text:.make_sensor_label() + The function .create_device_attrs() references + the function __init .make_sensor_label(). + This is often because .create_device_attrs lacks a __init + annotation or the annotation of .make_sensor_label is wrong. + +As .probe() can be called after freeing of __init memory, all __init +annotiations in the driver are bogus, and should be removed. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ibmpowernv.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c +index 83472808c816..64d05edff130 100644 +--- a/drivers/hwmon/ibmpowernv.c ++++ b/drivers/hwmon/ibmpowernv.c +@@ -181,7 +181,7 @@ static ssize_t show_label(struct device *dev, struct device_attribute *devattr, + return sprintf(buf, "%s\n", sdata->label); + } + +-static int __init get_logical_cpu(int hwcpu) ++static int get_logical_cpu(int hwcpu) + { + int cpu; + +@@ -192,9 +192,8 @@ static int __init get_logical_cpu(int hwcpu) + return -ENOENT; + } + +-static void __init make_sensor_label(struct device_node *np, +- struct sensor_data *sdata, +- const char *label) ++static void make_sensor_label(struct device_node *np, ++ struct sensor_data *sdata, const char *label) + { + u32 id; + size_t n; +-- +2.17.1 + diff --git a/queue-4.19/i2c-omap-enable-for-arch_k3.patch b/queue-4.19/i2c-omap-enable-for-arch_k3.patch new file mode 100644 index 00000000000..c77f870b2fa --- /dev/null +++ b/queue-4.19/i2c-omap-enable-for-arch_k3.patch @@ -0,0 +1,33 @@ +From f375d6526ea7159c9a29509b08f1ea084ddd8987 Mon Sep 17 00:00:00 2001 +From: Vignesh R +Date: Fri, 9 Nov 2018 16:44:11 +0530 +Subject: i2c: omap: Enable for ARCH_K3 + +[ Upstream commit 5b277402deac0691226a947df71c581686bd4020 ] + +Allow I2C_OMAP to be built for K3 platforms. + +Signed-off-by: Vignesh R +Reviewed-by: Grygorii Strashko +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index 451d4ae50e66..ac4b09642f63 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -751,7 +751,7 @@ config I2C_OCORES + + config I2C_OMAP + tristate "OMAP I2C adapter" +- depends on ARCH_OMAP ++ depends on ARCH_OMAP || ARCH_K3 + default y if MACH_OMAP_H3 || MACH_OMAP_OSK + help + If you say yes to this option, support will be included for the +-- +2.17.1 + diff --git a/queue-4.19/i2c-qcom-geni-fix-runtime-pm-mismatch-with-child-dev.patch b/queue-4.19/i2c-qcom-geni-fix-runtime-pm-mismatch-with-child-dev.patch new file mode 100644 index 00000000000..19c8118513c --- /dev/null +++ b/queue-4.19/i2c-qcom-geni-fix-runtime-pm-mismatch-with-child-dev.patch @@ -0,0 +1,78 @@ +From 6869d7a8040b6fe687af120968c439811fb81e3d Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Fri, 2 Nov 2018 13:57:32 -0700 +Subject: i2c: qcom-geni: Fix runtime PM mismatch with child devices + +[ Upstream commit 848bd3f3de9d44950c00eda6c115e8e9785440da ] + +We need to enable runtime PM on this i2c controller before populating +child devices with i2c_add_adapter(). Otherwise, if a child device uses +runtime PM and stays runtime PM enabled we'll get the following warning +at boot. + + Enabling runtime PM for inactive device (a98000.i2c) with active children + +[...] + + Call trace: + pm_runtime_enable+0xd8/0xf8 + geni_i2c_probe+0x440/0x460 + platform_drv_probe+0x74/0xc8 +[...] + +Let's move the runtime PM enabling and setup to before we add the +adapter, so that this device can respond to runtime PM requests from +children. + +Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") +Signed-off-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-qcom-geni.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index 9f2eb02481d3..d7329177b0ea 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -590,18 +590,19 @@ static int geni_i2c_probe(struct platform_device *pdev) + + dev_dbg(&pdev->dev, "i2c fifo/se-dma mode. fifo depth:%d\n", tx_depth); + +- ret = i2c_add_adapter(&gi2c->adap); +- if (ret) { +- dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret); +- return ret; +- } +- + gi2c->suspended = 1; + pm_runtime_set_suspended(gi2c->se.dev); + pm_runtime_set_autosuspend_delay(gi2c->se.dev, I2C_AUTO_SUSPEND_DELAY); + pm_runtime_use_autosuspend(gi2c->se.dev); + pm_runtime_enable(gi2c->se.dev); + ++ ret = i2c_add_adapter(&gi2c->adap); ++ if (ret) { ++ dev_err(&pdev->dev, "Error adding i2c adapter %d\n", ret); ++ pm_runtime_disable(gi2c->se.dev); ++ return ret; ++ } ++ + return 0; + } + +@@ -609,8 +610,8 @@ static int geni_i2c_remove(struct platform_device *pdev) + { + struct geni_i2c_dev *gi2c = platform_get_drvdata(pdev); + +- pm_runtime_disable(gi2c->se.dev); + i2c_del_adapter(&gi2c->adap); ++ pm_runtime_disable(gi2c->se.dev); + return 0; + } + +-- +2.17.1 + diff --git a/queue-4.19/i40e-restore-netif_f_gso_ipxip-46-to-netdev-features.patch b/queue-4.19/i40e-restore-netif_f_gso_ipxip-46-to-netdev-features.patch new file mode 100644 index 00000000000..32c651170cc --- /dev/null +++ b/queue-4.19/i40e-restore-netif_f_gso_ipxip-46-to-netdev-features.patch @@ -0,0 +1,48 @@ +From f0b25607fbe9b7c589a4e13564c13e1dd15b980c Mon Sep 17 00:00:00 2001 +From: Jacob Keller +Date: Mon, 29 Oct 2018 10:52:42 -0700 +Subject: i40e: restore NETIF_F_GSO_IPXIP[46] to netdev features + +[ Upstream commit ba766b8b99c30ad3c55ed8cf224d1185ecff1476 ] + +Since commit bacd75cfac8a ("i40e/i40evf: Add capability exchange for +outer checksum", 2017-04-06) the i40e driver has not reported support +for IP-in-IP offloads. This likely occurred due to a bad rebase, as the +commit extracts hw_enc_features into its own variable. As part of this +change, it dropped the NETIF_F_FSO_IPXIP flags from the +netdev->hw_enc_features. This was unfortunately not caught during code +review. + +Fix this by adding back the missing feature flags. + +For reference, NETIF_F_GSO_IPXIP4 was added in commit 7e13318daa4a +("net: define gso types for IPx over IPv4 and IPv6", 2016-05-20), +replacing NETIF_F_GSO_IPIP and NETIF_F_GSO_SIT. + +NETIF_F_GSO_IPXIP6 was added in commit bf2d1df39502 ("intel: Add support +for IPv6 IP-in-IP offload", 2016-05-20). + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index ac685ad4d877..6eccfa82ca94 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -11926,6 +11926,8 @@ static int i40e_config_netdev(struct i40e_vsi *vsi) + NETIF_F_GSO_GRE | + NETIF_F_GSO_GRE_CSUM | + NETIF_F_GSO_PARTIAL | ++ NETIF_F_GSO_IPXIP4 | ++ NETIF_F_GSO_IPXIP6 | + NETIF_F_GSO_UDP_TUNNEL | + NETIF_F_GSO_UDP_TUNNEL_CSUM | + NETIF_F_SCTP_CRC | +-- +2.17.1 + diff --git a/queue-4.19/ice-change-req_speeds-to-be-u16.patch b/queue-4.19/ice-change-req_speeds-to-be-u16.patch new file mode 100644 index 00000000000..198f2cbb1f9 --- /dev/null +++ b/queue-4.19/ice-change-req_speeds-to-be-u16.patch @@ -0,0 +1,44 @@ +From 8b535a73a40220374f468447cf6051bec36bf8b2 Mon Sep 17 00:00:00 2001 +From: Chinh T Cao +Date: Mon, 5 Nov 2018 12:18:35 -0800 +Subject: ice: Change req_speeds to be u16 + +[ Upstream commit ffe498237b36ee42624e139b21efa05da4ff1f48 ] + +Since the req_speeds field in struct ice_link_status is a u8, +req_speeds & ICE_AQ_LINK_SPEED_40GB always returns 0. This was caught +by a coverity scan. + +Fix this by changing req_speeds to be u16. + +Reported-by: Bruce Allan +Signed-off-by: Chinh T Cao +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_type.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_type.h b/drivers/net/ethernet/intel/ice/ice_type.h +index 97c366e0ca59..ba11b5898833 100644 +--- a/drivers/net/ethernet/intel/ice/ice_type.h ++++ b/drivers/net/ethernet/intel/ice/ice_type.h +@@ -83,12 +83,12 @@ struct ice_link_status { + u64 phy_type_low; + u16 max_frame_size; + u16 link_speed; ++ u16 req_speeds; + u8 lse_ena; /* Link Status Event notification */ + u8 link_info; + u8 an_info; + u8 ext_info; + u8 pacing; +- u8 req_speeds; + /* Refer to #define from module_type[ICE_MODULE_TYPE_TOTAL_BYTE] of + * ice_aqc_get_phy_caps structure + */ +-- +2.17.1 + diff --git a/queue-4.19/ice-fix-dead-device-link-issue-with-flow-control.patch b/queue-4.19/ice-fix-dead-device-link-issue-with-flow-control.patch new file mode 100644 index 00000000000..da8290f57c8 --- /dev/null +++ b/queue-4.19/ice-fix-dead-device-link-issue-with-flow-control.patch @@ -0,0 +1,43 @@ +From ad0f741158aee440dd7fd8fc468ebb205fa55d57 Mon Sep 17 00:00:00 2001 +From: Akeem G Abodunrin +Date: Fri, 26 Oct 2018 10:40:52 -0700 +Subject: ice: Fix dead device link issue with flow control + +[ Upstream commit 0f5d4c21a50716f8bd4e220544b82dca7408d113 ] + +Setting Rx or Tx pause parameter currently results in link loss on the +interface, requiring the platform/host to be cold power cycled. Fix it. + +Signed-off-by: Akeem G Abodunrin +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c +index 9d6754f65a1a..4c5c87b158f5 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -797,10 +797,15 @@ ice_set_pauseparam(struct net_device *netdev, struct ethtool_pauseparam *pause) + } + + if (!test_bit(__ICE_DOWN, pf->state)) { +- /* Give it a little more time to try to come back */ ++ /* Give it a little more time to try to come back. If still ++ * down, restart autoneg link or reinitialize the interface. ++ */ + msleep(75); + if (!test_bit(__ICE_DOWN, pf->state)) + return ice_nway_reset(netdev); ++ ++ ice_down(vsi); ++ ice_up(vsi); + } + + return err; +-- +2.17.1 + diff --git a/queue-4.19/ice-fix-the-bytecount-sent-to-netdev_tx_sent_queue.patch b/queue-4.19/ice-fix-the-bytecount-sent-to-netdev_tx_sent_queue.patch new file mode 100644 index 00000000000..6b9c3aea089 --- /dev/null +++ b/queue-4.19/ice-fix-the-bytecount-sent-to-netdev_tx_sent_queue.patch @@ -0,0 +1,41 @@ +From fd297df63a0a2bcff13cd9a692bd9051ec667b91 Mon Sep 17 00:00:00 2001 +From: Brett Creeley +Date: Fri, 26 Oct 2018 10:40:59 -0700 +Subject: ice: Fix the bytecount sent to netdev_tx_sent_queue + +[ Upstream commit d944b46992f8e99b6bdc721e44b02e5ca294fa2b ] + +Currently if the driver does a TSO offload the bytecount sent to +netdev_tx_sent_queue will be incorrect. This is because in ice_tso we +overwrite the initial value that we set in ice_tx_map. This creates a +mismatch between the Tx and Tx clean flow. In the Tx clean flow we +calculate the bytecount (called total_bytes) as we clean the +descriptors so the value used in the Tx clean path is correct. Fix this +by using += in ice_tso instead of =. This fixes the mismatch in +bytecount mentioned above. + +Signed-off-by: Brett Creeley +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c +index 6481e3d86374..0c95c8f83432 100644 +--- a/drivers/net/ethernet/intel/ice/ice_txrx.c ++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c +@@ -1519,7 +1519,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off) + + /* update gso_segs and bytecount */ + first->gso_segs = skb_shinfo(skb)->gso_segs; +- first->bytecount = (first->gso_segs - 1) * off->header_len; ++ first->bytecount += (first->gso_segs - 1) * off->header_len; + + cd_tso_len = skb->len - off->header_len; + cd_mss = skb_shinfo(skb)->gso_size; +-- +2.17.1 + diff --git a/queue-4.19/ixgbe-fix-mac-anti-spoofing-filter-after-vflr.patch b/queue-4.19/ixgbe-fix-mac-anti-spoofing-filter-after-vflr.patch new file mode 100644 index 00000000000..4673afe3995 --- /dev/null +++ b/queue-4.19/ixgbe-fix-mac-anti-spoofing-filter-after-vflr.patch @@ -0,0 +1,42 @@ +From 10d22dcbed9f66ca6186907491021bbb1d6be404 Mon Sep 17 00:00:00 2001 +From: Radoslaw Tyl +Date: Mon, 22 Oct 2018 08:44:31 +0200 +Subject: ixgbe: fix MAC anti-spoofing filter after VFLR + +[ Upstream commit 6702185c1ffec3421181b5e24491e3fac920cb61 ] + +This change resolves a driver bug where the driver is logging a +message that says "Spoofed packets detected". This can occur on the PF +(host) when a VF has VLAN+MACVLAN enabled and is re-started with a +different MAC address. + +MAC and VLAN anti-spoofing filters are to be enabled together. + +Signed-off-by: Radoslaw Tyl +Tested-by: Andrew Bowers +Acked-by: Piotr Skajewski +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +index 3c6f01c41b78..eea63a99f29c 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +@@ -721,8 +721,10 @@ static inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf) + ixgbe_set_vmvir(adapter, vfinfo->pf_vlan, + adapter->default_up, vf); + +- if (vfinfo->spoofchk_enabled) ++ if (vfinfo->spoofchk_enabled) { + hw->mac.ops.set_vlan_anti_spoofing(hw, true, vf); ++ hw->mac.ops.set_mac_anti_spoofing(hw, true, vf); ++ } + } + + /* reset multicast table array for vf */ +-- +2.17.1 + diff --git a/queue-4.19/kbuild-deb-pkg-fix-too-low-build-version-number.patch b/queue-4.19/kbuild-deb-pkg-fix-too-low-build-version-number.patch new file mode 100644 index 00000000000..d5f7af13443 --- /dev/null +++ b/queue-4.19/kbuild-deb-pkg-fix-too-low-build-version-number.patch @@ -0,0 +1,59 @@ +From b6a35eb1d428cb7b005b7354de21357833b39db0 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Tue, 6 Nov 2018 13:18:05 +0900 +Subject: kbuild: deb-pkg: fix too low build version number + +[ Upstream commit bbcde0a7241261cd0ca8d8e6b94a4113a4b71443 ] + +Since commit b41d920acff8 ("kbuild: deb-pkg: split generating packaging +and build"), the build version of the kernel contained in a deb package +is too low by 1. + +Prior to the bad commit, the kernel was built first, then the number +in .version file was read out, and written into the debian control file. + +Now, the debian control file is created before the kernel is actually +compiled, which is causing the version number mismatch. + +Let the mkdebian script pass KBUILD_BUILD_VERSION=${revision} to require +the build system to use the specified version number. + +Fixes: b41d920acff8 ("kbuild: deb-pkg: split generating packaging and build") +Reported-by: Doug Smythies +Signed-off-by: Masahiro Yamada +Tested-by: Doug Smythies +Signed-off-by: Sasha Levin +--- + scripts/package/mkdebian | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index 663a7f343b42..edcad61fe3cd 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -88,6 +88,7 @@ set_debarch() { + version=$KERNELRELEASE + if [ -n "$KDEB_PKGVERSION" ]; then + packageversion=$KDEB_PKGVERSION ++ revision=${packageversion##*-} + else + revision=$(cat .version 2>/dev/null||echo 1) + packageversion=$version-$revision +@@ -205,10 +206,12 @@ cat < debian/rules + #!$(command -v $MAKE) -f + + build: +- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= ++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ ++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= + + binary-arch: +- \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} KBUILD_SRC= intdeb-pkg ++ \$(MAKE) KERNELRELEASE=${version} ARCH=${ARCH} \ ++ KBUILD_BUILD_VERSION=${revision} KBUILD_SRC= intdeb-pkg + + clean: + rm -rf debian/*tmp debian/files +-- +2.17.1 + diff --git a/queue-4.19/lib-raid6-fix-arm64-test-build.patch b/queue-4.19/lib-raid6-fix-arm64-test-build.patch new file mode 100644 index 00000000000..b87d9458bdc --- /dev/null +++ b/queue-4.19/lib-raid6-fix-arm64-test-build.patch @@ -0,0 +1,46 @@ +From 51b7cbc382f37f81d5764af60f6ee682c7838c29 Mon Sep 17 00:00:00 2001 +From: Jeremy Linton +Date: Mon, 5 Nov 2018 18:14:41 -0600 +Subject: lib/raid6: Fix arm64 test build + +[ Upstream commit 313a06e636808387822af24c507cba92703568b1 ] + +The lib/raid6/test fails to build the neon objects +on arm64 because the correct machine type is 'aarch64'. + +Once this is correctly enabled, the neon recovery objects +need to be added to the build. + +Reviewed-by: Ard Biesheuvel +Signed-off-by: Jeremy Linton +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + lib/raid6/test/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index 5d73f5cb4d8a..79777645cac9 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -27,7 +27,7 @@ ifeq ($(ARCH),arm) + CFLAGS += -I../../../arch/arm/include -mfpu=neon + HAS_NEON = yes + endif +-ifeq ($(ARCH),arm64) ++ifeq ($(ARCH),aarch64) + CFLAGS += -I../../../arch/arm64/include + HAS_NEON = yes + endif +@@ -41,7 +41,7 @@ ifeq ($(IS_X86),yes) + gcc -c -x assembler - >&/dev/null && \ + rm ./-.o && echo -DCONFIG_AS_AVX512=1) + else ifeq ($(HAS_NEON),yes) +- OBJS += neon.o neon1.o neon2.o neon4.o neon8.o ++ OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else + HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ +-- +2.17.1 + diff --git a/queue-4.19/mtd-nand-fix-nanddev_pos_next_page-kernel-doc-header.patch b/queue-4.19/mtd-nand-fix-nanddev_pos_next_page-kernel-doc-header.patch new file mode 100644 index 00000000000..42d54ef9c63 --- /dev/null +++ b/queue-4.19/mtd-nand-fix-nanddev_pos_next_page-kernel-doc-header.patch @@ -0,0 +1,33 @@ +From 7cf54720d9241a9e259ac1077a8a4164ad4491ce Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Tue, 6 Nov 2018 17:25:37 +0100 +Subject: mtd: nand: Fix nanddev_pos_next_page() kernel-doc header + +[ Upstream commit 98ee3fc7ef8395f8b7a379e6608aee91efc66d48 ] + +Function name is wrong in the kernel-doc header. + +Fixes: 9c3736a3de21 ("mtd: nand: Add core infrastructure to deal with NAND devices") +Signed-off-by: Boris Brezillon +Reviewed-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + include/linux/mtd/nand.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index 78b86dea2f29..7f53ece2c039 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -568,7 +568,7 @@ static inline void nanddev_pos_next_eraseblock(struct nand_device *nand, + } + + /** +- * nanddev_pos_next_eraseblock() - Move a position to the next page ++ * nanddev_pos_next_page() - Move a position to the next page + * @nand: NAND device + * @pos: the position to update + * +-- +2.17.1 + diff --git a/queue-4.19/net-aquantia-fix-potential-iommu-fault-after-driver-.patch b/queue-4.19/net-aquantia-fix-potential-iommu-fault-after-driver-.patch new file mode 100644 index 00000000000..1f4bd4dbe92 --- /dev/null +++ b/queue-4.19/net-aquantia-fix-potential-iommu-fault-after-driver-.patch @@ -0,0 +1,112 @@ +From ee294a8ae4de0b18fe0515300debb08aad03d3e1 Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Fri, 9 Nov 2018 11:53:57 +0000 +Subject: net: aquantia: fix potential IOMMU fault after driver unbind + +[ Upstream commit 7a1bb49461b12b2e6332a4d054256835f45203f3 ] + +IOMMU fault may occurr on unbind/bind or if_down/if_up sequence. + +Although driver disables the rings on down, this is not enough. +Due to internal HW design, during subsequent initialization +NIC sometimes may reuse RX descriptors cache and write to the +host memory from the descriptor cache. +That's get catched by IOMMU on host. + +This patch invalidates the descriptor cache in NIC on interface down +to prevent writing to the cached descriptors and to the memory pointed +in those descriptors. + +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 6 ++++++ + .../aquantia/atlantic/hw_atl/hw_atl_llh.c | 8 ++++++++ + .../aquantia/atlantic/hw_atl/hw_atl_llh.h | 3 +++ + .../atlantic/hw_atl/hw_atl_llh_internal.h | 18 ++++++++++++++++++ + 4 files changed, 35 insertions(+) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 1d44a386e7d3..0271a0fdfee8 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -915,6 +915,12 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self) + static int hw_atl_b0_hw_stop(struct aq_hw_s *self) + { + hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK); ++ ++ /* Invalidate Descriptor Cache to prevent writing to the cached ++ * descriptors and to the data pointer of those descriptors ++ */ ++ hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1); ++ + return aq_hw_err_from_flags(self); + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c +index 10ba035dadb1..10ec5dc88e24 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c +@@ -619,6 +619,14 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(struct aq_hw_s *aq_hw, u32 rx_flow_ctl_mode + HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode); + } + ++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init) ++{ ++ aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT, ++ init); ++} ++ + void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw, + u32 rx_pkt_buff_size_per_tc, u32 buffer) + { +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h +index dfb426f2dc2c..b3bf64b48b93 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h +@@ -325,6 +325,9 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw, + u32 rx_pkt_buff_size_per_tc, + u32 buffer); + ++/* set rdm rx dma descriptor cache init */ ++void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init); ++ + /* set rx xoff enable (per tc) */ + void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc, + u32 buffer); +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +index e0cf70120f1d..e2ecdb1c5a5c 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +@@ -293,6 +293,24 @@ + /* default value of bitfield desc{d}_reset */ + #define HW_ATL_RDM_DESCDRESET_DEFAULT 0x0 + ++/* rdm_desc_init_i bitfield definitions ++ * preprocessor definitions for the bitfield rdm_desc_init_i. ++ * port="pif_rdm_desc_init_i" ++ */ ++ ++/* register address for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR 0x00005a00 ++/* bitmask for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK 0xffffffff ++/* inverted bitmask for bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSKN 0x00000000 ++/* lower bit position of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT 0 ++/* width of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_WIDTH 32 ++/* default value of bitfield rdm_desc_init_i */ ++#define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0 ++ + /* rx int_desc_wrb_en bitfield definitions + * preprocessor definitions for the bitfield "int_desc_wrb_en". + * port="pif_rdm_int_desc_wrb_en_i" +-- +2.17.1 + diff --git a/queue-4.19/net-aquantia-fixed-enable-unicast-on-32-macvlan.patch b/queue-4.19/net-aquantia-fixed-enable-unicast-on-32-macvlan.patch new file mode 100644 index 00000000000..99f87eed71c --- /dev/null +++ b/queue-4.19/net-aquantia-fixed-enable-unicast-on-32-macvlan.patch @@ -0,0 +1,39 @@ +From 1caf287359877cf9f849f64276cdd20f97c78b11 Mon Sep 17 00:00:00 2001 +From: Igor Russkikh +Date: Fri, 9 Nov 2018 11:53:59 +0000 +Subject: net: aquantia: fixed enable unicast on 32 macvlan + +[ Upstream commit bfaa9f8553d5c20703781e63f4fc8cb4792f18fd ] + +Fixed a condition mistake due to which macvlans unicast +item number 32 was not added in the unicast filter. + +The consequence is that when exactly 32 macvlans are created +on NIC, the last created macvlan receives no traffic because +its MAC was not registered in HW. + +Fixes: 94b3b542303f ("net: aquantia: vlan unicast address list correct handling") +Signed-off-by: Igor Russkikh +Tested-by: Nikita Danilov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 26dc6782b475..4f34808f1e06 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -590,7 +590,7 @@ int aq_nic_set_multicast_list(struct aq_nic_s *self, struct net_device *ndev) + } + } + +- if (i > 0 && i < AQ_HW_MULTICAST_ADDRESS_MAX) { ++ if (i > 0 && i <= AQ_HW_MULTICAST_ADDRESS_MAX) { + packet_filter |= IFF_MULTICAST; + self->mc_list.count = i; + self->aq_hw_ops->hw_multicast_list_set(self->aq_hw, +-- +2.17.1 + diff --git a/queue-4.19/net-aquantia-invalid-checksumm-offload-implementatio.patch b/queue-4.19/net-aquantia-invalid-checksumm-offload-implementatio.patch new file mode 100644 index 00000000000..3f7e6e9ec43 --- /dev/null +++ b/queue-4.19/net-aquantia-invalid-checksumm-offload-implementatio.patch @@ -0,0 +1,144 @@ +From 81558db486f097ba3a251514fd4ae3c0cafee5bb Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Fri, 9 Nov 2018 11:54:01 +0000 +Subject: net: aquantia: invalid checksumm offload implementation + +[ Upstream commit ad703c2b9127f9acdef697ec4755f6da4beaa266 ] + +Packets with marked invalid IP/UDP/TCP checksums were considered as good +by the driver. The error was in a logic, processing offload bits in +RX descriptor. + +Signed-off-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/aquantia/atlantic/aq_ring.c | 35 +++++++++++------- + .../aquantia/atlantic/hw_atl/hw_atl_b0.c | 36 +++++++++---------- + 2 files changed, 41 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index d1e1a0ba8615..7134d0d4cdf7 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -172,6 +172,27 @@ bool aq_ring_tx_clean(struct aq_ring_s *self) + return !!budget; + } + ++static void aq_rx_checksum(struct aq_ring_s *self, ++ struct aq_ring_buff_s *buff, ++ struct sk_buff *skb) ++{ ++ if (!(self->aq_nic->ndev->features & NETIF_F_RXCSUM)) ++ return; ++ ++ if (unlikely(buff->is_cso_err)) { ++ ++self->stats.rx.errors; ++ skb->ip_summed = CHECKSUM_NONE; ++ return; ++ } ++ if (buff->is_ip_cso) { ++ __skb_incr_checksum_unnecessary(skb); ++ if (buff->is_udp_cso || buff->is_tcp_cso) ++ __skb_incr_checksum_unnecessary(skb); ++ } else { ++ skb->ip_summed = CHECKSUM_NONE; ++ } ++} ++ + #define AQ_SKB_ALIGN SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) + int aq_ring_rx_clean(struct aq_ring_s *self, + struct napi_struct *napi, +@@ -267,18 +288,8 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + } + + skb->protocol = eth_type_trans(skb, ndev); +- if (unlikely(buff->is_cso_err)) { +- ++self->stats.rx.errors; +- skb->ip_summed = CHECKSUM_NONE; +- } else { +- if (buff->is_ip_cso) { +- __skb_incr_checksum_unnecessary(skb); +- if (buff->is_udp_cso || buff->is_tcp_cso) +- __skb_incr_checksum_unnecessary(skb); +- } else { +- skb->ip_summed = CHECKSUM_NONE; +- } +- } ++ ++ aq_rx_checksum(self, buff, skb); + + skb_set_hash(skb, buff->rss_hash, + buff->is_hash_l4 ? PKT_HASH_TYPE_L4 : +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 0271a0fdfee8..88705dee5b95 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -655,9 +655,9 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + struct hw_atl_rxd_wb_s *rxd_wb = (struct hw_atl_rxd_wb_s *) + &ring->dx_ring[ring->hw_head * HW_ATL_B0_RXD_SIZE]; + +- unsigned int is_err = 1U; + unsigned int is_rx_check_sum_enabled = 0U; + unsigned int pkt_type = 0U; ++ u8 rx_stat = 0U; + + if (!(rxd_wb->status & 0x1U)) { /* RxD is not done */ + break; +@@ -665,35 +665,35 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + + buff = &ring->buff_ring[ring->hw_head]; + +- is_err = (0x0000003CU & rxd_wb->status); ++ rx_stat = (0x0000003CU & rxd_wb->status) >> 2; + + is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19); +- is_err &= ~0x20U; /* exclude validity bit */ + + pkt_type = 0xFFU & (rxd_wb->type >> 4); + +- if (is_rx_check_sum_enabled) { +- if (0x0U == (pkt_type & 0x3U)) +- buff->is_ip_cso = (is_err & 0x08U) ? 0U : 1U; ++ if (is_rx_check_sum_enabled & BIT(0) && ++ (0x0U == (pkt_type & 0x3U))) ++ buff->is_ip_cso = (rx_stat & BIT(1)) ? 0U : 1U; + ++ if (is_rx_check_sum_enabled & BIT(1)) { + if (0x4U == (pkt_type & 0x1CU)) +- buff->is_udp_cso = buff->is_cso_err ? 0U : 1U; ++ buff->is_udp_cso = (rx_stat & BIT(2)) ? 0U : ++ !!(rx_stat & BIT(3)); + else if (0x0U == (pkt_type & 0x1CU)) +- buff->is_tcp_cso = buff->is_cso_err ? 0U : 1U; +- +- /* Checksum offload workaround for small packets */ +- if (rxd_wb->pkt_len <= 60) { +- buff->is_ip_cso = 0U; +- buff->is_cso_err = 0U; +- } ++ buff->is_tcp_cso = (rx_stat & BIT(2)) ? 0U : ++ !!(rx_stat & BIT(3)); ++ } ++ buff->is_cso_err = !!(rx_stat & 0x6); ++ /* Checksum offload workaround for small packets */ ++ if (unlikely(rxd_wb->pkt_len <= 60)) { ++ buff->is_ip_cso = 0U; ++ buff->is_cso_err = 0U; + } +- +- is_err &= ~0x18U; + + dma_unmap_page(ndev, buff->pa, buff->len, DMA_FROM_DEVICE); + +- if (is_err || rxd_wb->type & 0x1000U) { +- /* status error or DMA error */ ++ if ((rx_stat & BIT(0)) || rxd_wb->type & 0x1000U) { ++ /* MAC error or DMA error */ + buff->is_error = 1U; + } else { + if (self->aq_nic_cfg->is_rss) { +-- +2.17.1 + diff --git a/queue-4.19/net-hns3-bugfix-for-handling-mailbox-while-the-comma.patch b/queue-4.19/net-hns3-bugfix-for-handling-mailbox-while-the-comma.patch new file mode 100644 index 00000000000..e51e4a6d66c --- /dev/null +++ b/queue-4.19/net-hns3-bugfix-for-handling-mailbox-while-the-comma.patch @@ -0,0 +1,45 @@ +From ec784e6849aab6b8d28bbf3e0be0123f21a657fd Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 30 Oct 2018 21:50:51 +0800 +Subject: net: hns3: bugfix for handling mailbox while the command queue + reinitialized + +[ Upstream commit 3c88ed1d798da355859ca083d3884a16ce0841f2 ] + +In a multi-core machine, the mailbox service and reset service +will be executed at the same time. The reset service will re-initialize +the command queue, before that, the mailbox handler can only get some +invalid messages. + +The HCLGE_STATE_CMD_DISABLE flag means that the command queue is not +available and needs to be reinitialized. Therefore, when the mailbox +handler recognizes this flag, it should not process the command. + +Fixes: dde1a86e93ca ("net: hns3: Add mailbox support to PF driver") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index f34851c91eb3..e08e82020402 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -458,6 +458,12 @@ void hclge_mbx_handler(struct hclge_dev *hdev) + + /* handle all the mailbox requests in the queue */ + while (!hclge_cmd_crq_empty(&hdev->hw)) { ++ if (test_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state)) { ++ dev_warn(&hdev->pdev->dev, ++ "command queue needs re-initializing\n"); ++ return; ++ } ++ + desc = &crq->desc[crq->next_to_use]; + req = (struct hclge_mbx_vf_to_pf_cmd *)desc->data; + +-- +2.17.1 + diff --git a/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclge_r.patch b/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclge_r.patch new file mode 100644 index 00000000000..cd87e17db68 --- /dev/null +++ b/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclge_r.patch @@ -0,0 +1,45 @@ +From 691446aad65abb5622ff54f27304f4e4448cffb0 Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 30 Oct 2018 21:50:52 +0800 +Subject: net: hns3: bugfix for rtnl_lock's range in the hclge_reset() + +[ Upstream commit a963052e539887df481d4d3a6ad4c92ca6461852 ] + +Since hclge_reset_wait() is used to wait for the hardware to complete +the reset, it is not necessary to hold the rtnl_lock during +hclge_reset_wait(). So this patch releases the lock for the duration +of hclge_reset_wait(). + +Fixes: 6d4fab39533f ("net: hns3: Reset net device with rtnl_lock") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index db763450e5e3..340baf6a470c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2804,14 +2804,17 @@ static void hclge_reset(struct hclge_dev *hdev) + handle = &hdev->vport[0].nic; + rtnl_lock(); + hclge_notify_client(hdev, HNAE3_DOWN_CLIENT); ++ rtnl_unlock(); + + if (!hclge_reset_wait(hdev)) { ++ rtnl_lock(); + hclge_notify_client(hdev, HNAE3_UNINIT_CLIENT); + hclge_reset_ae_dev(hdev->ae_dev); + hclge_notify_client(hdev, HNAE3_INIT_CLIENT); + + hclge_clear_reset_cause(hdev); + } else { ++ rtnl_lock(); + /* schedule again to check pending resets later */ + set_bit(hdev->reset_type, &hdev->reset_pending); + hclge_reset_task_schedule(hdev); +-- +2.17.1 + diff --git a/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclgevf.patch b/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclgevf.patch new file mode 100644 index 00000000000..e535178467b --- /dev/null +++ b/queue-4.19/net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclgevf.patch @@ -0,0 +1,52 @@ +From 31cdf923231b0da3e23e2529086e73c051e5cc0e Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 30 Oct 2018 21:50:53 +0800 +Subject: net: hns3: bugfix for rtnl_lock's range in the hclgevf_reset() + +[ Upstream commit 29118ab962d5476fdc65fae312ac38db68092d78 ] + +Since hclgevf_reset_wait() is used to wait for the hardware to complete +the reset, it is not necessary to hold the rtnl_lock during +hclgevf_reset_wait(). So this patch releases the lock for the duration +of hclgevf_reset_wait(). + +Fixes: 6988eb2a9b77 ("net: hns3: Add support to reset the enet/ring mgmt layer") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 320043e87fc6..5570fb5dc2eb 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1065,6 +1065,8 @@ static int hclgevf_reset(struct hclgevf_dev *hdev) + /* bring down the nic to stop any ongoing TX/RX */ + hclgevf_notify_client(hdev, HNAE3_DOWN_CLIENT); + ++ rtnl_unlock(); ++ + /* check if VF could successfully fetch the hardware reset completion + * status from the hardware + */ +@@ -1076,12 +1078,15 @@ static int hclgevf_reset(struct hclgevf_dev *hdev) + ret); + + dev_warn(&hdev->pdev->dev, "VF reset failed, disabling VF!\n"); ++ rtnl_lock(); + hclgevf_notify_client(hdev, HNAE3_UNINIT_CLIENT); + + rtnl_unlock(); + return ret; + } + ++ rtnl_lock(); ++ + /* now, re-initialize the nic client and ae device*/ + ret = hclgevf_reset_stack(hdev); + if (ret) +-- +2.17.1 + diff --git a/queue-4.19/net-hns3-bugfix-for-the-initialization-of-command-qu.patch b/queue-4.19/net-hns3-bugfix-for-the-initialization-of-command-qu.patch new file mode 100644 index 00000000000..8104ac9a3d1 --- /dev/null +++ b/queue-4.19/net-hns3-bugfix-for-the-initialization-of-command-qu.patch @@ -0,0 +1,64 @@ +From 0861d1b4a85475a62ce6d232b4727970263584a3 Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 30 Oct 2018 21:50:46 +0800 +Subject: net: hns3: bugfix for the initialization of command queue's spin lock + +[ Upstream commit b2f74dbaf12bf59ff35d451005b3cdee78232ff0 ] + +The spin lock of the command queue only need to be initialized once +when the driver initializes the command queue. It is not necessary to +initialize the spin lock when resetting. At the same time, the +modification of the queue member should be performed after acquiring +the lock. + +Fixes: 3efb960f056d ("net: hns3: Refactor the initialization of command queue") +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +index ac13cb2b168e..68026a5ad7e7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.c +@@ -304,6 +304,10 @@ int hclge_cmd_queue_init(struct hclge_dev *hdev) + { + int ret; + ++ /* Setup the lock for command queue */ ++ spin_lock_init(&hdev->hw.cmq.csq.lock); ++ spin_lock_init(&hdev->hw.cmq.crq.lock); ++ + /* Setup the queue entries for use cmd queue */ + hdev->hw.cmq.csq.desc_num = HCLGE_NIC_CMQ_DESC_NUM; + hdev->hw.cmq.crq.desc_num = HCLGE_NIC_CMQ_DESC_NUM; +@@ -337,18 +341,20 @@ int hclge_cmd_init(struct hclge_dev *hdev) + u32 version; + int ret; + ++ spin_lock_bh(&hdev->hw.cmq.csq.lock); ++ spin_lock_bh(&hdev->hw.cmq.crq.lock); ++ + hdev->hw.cmq.csq.next_to_clean = 0; + hdev->hw.cmq.csq.next_to_use = 0; + hdev->hw.cmq.crq.next_to_clean = 0; + hdev->hw.cmq.crq.next_to_use = 0; + +- /* Setup the lock for command queue */ +- spin_lock_init(&hdev->hw.cmq.csq.lock); +- spin_lock_init(&hdev->hw.cmq.crq.lock); +- + hclge_cmd_init_regs(&hdev->hw); + clear_bit(HCLGE_STATE_CMD_DISABLE, &hdev->state); + ++ spin_unlock_bh(&hdev->hw.cmq.crq.lock); ++ spin_unlock_bh(&hdev->hw.cmq.csq.lock); ++ + ret = hclge_cmd_query_firmware_version(&hdev->hw, &version); + if (ret) { + dev_err(&hdev->pdev->dev, +-- +2.17.1 + diff --git a/queue-4.19/net-hns3-fix-for-out-of-bounds-access-when-setting-p.patch b/queue-4.19/net-hns3-fix-for-out-of-bounds-access-when-setting-p.patch new file mode 100644 index 00000000000..22407abd40f --- /dev/null +++ b/queue-4.19/net-hns3-fix-for-out-of-bounds-access-when-setting-p.patch @@ -0,0 +1,99 @@ +From 81253370b2ddfabd9a772ef0fc73a6fd8de17cf6 Mon Sep 17 00:00:00 2001 +From: Yunsheng Lin +Date: Fri, 2 Nov 2018 17:47:48 +0800 +Subject: net: hns3: Fix for out-of-bounds access when setting pfc back + pressure + +[ Upstream commit e8ccbb7d2f53c62e14b889faaa3f6f809b657278 ] + +The vport should be initialized to hdev->vport for each bp group, +otherwise it will cause out-of-bounds access and bp setting not +correct problem. + +[ 35.254124] BUG: KASAN: slab-out-of-bounds in hclge_pause_setup_hw+0x2a0/0x3f8 [hclge] +[ 35.254126] Read of size 2 at addr ffff803b6651581a by task kworker/0:1/14 + +[ 35.254132] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.0-rc7-hulk+ #85 +[ 35.254133] Hardware name: Huawei D06/D06, BIOS Hisilicon D06 UEFI RC0 - B052 (V0.52) 09/14/2018 +[ 35.254141] Workqueue: events work_for_cpu_fn +[ 35.254144] Call trace: +[ 35.254147] dump_backtrace+0x0/0x2f0 +[ 35.254149] show_stack+0x24/0x30 +[ 35.254154] dump_stack+0x110/0x184 +[ 35.254157] print_address_description+0x168/0x2b0 +[ 35.254160] kasan_report+0x184/0x310 +[ 35.254162] __asan_load2+0x7c/0xa0 +[ 35.254170] hclge_pause_setup_hw+0x2a0/0x3f8 [hclge] +[ 35.254177] hclge_tm_init_hw+0x794/0x9f0 [hclge] +[ 35.254184] hclge_tm_schd_init+0x48/0x58 [hclge] +[ 35.254191] hclge_init_ae_dev+0x778/0x1168 [hclge] +[ 35.254196] hnae3_register_ae_dev+0x14c/0x298 [hnae3] +[ 35.254206] hns3_probe+0x88/0xa8 [hns3] +[ 35.254210] local_pci_probe+0x7c/0xf0 +[ 35.254212] work_for_cpu_fn+0x34/0x50 +[ 35.254214] process_one_work+0x4d4/0xa38 +[ 35.254216] worker_thread+0x55c/0x8d8 +[ 35.254219] kthread+0x1b0/0x1b8 +[ 35.254222] ret_from_fork+0x10/0x1c + +[ 35.254224] The buggy address belongs to the page: +[ 35.254228] page:ffff7e00ed994400 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 +[ 35.273835] flags: 0xfffff8000008000(head) +[ 35.282007] raw: 0fffff8000008000 dead000000000100 dead000000000200 0000000000000000 +[ 35.282010] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 +[ 35.282012] page dumped because: kasan: bad access detected + +[ 35.282014] Memory state around the buggy address: +[ 35.282017] ffff803b66515700: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe +[ 35.282019] ffff803b66515780: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe +[ 35.282021] >ffff803b66515800: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe +[ 35.282022] ^ +[ 35.282024] ffff803b66515880: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe +[ 35.282026] ffff803b66515900: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe +[ 35.282028] ================================================================== +[ 35.282029] Disabling lock debugging due to kernel taint +[ 35.282747] hclge driver initialization finished. + +Fixes: 67bf2541f4b9 ("net: hns3: Fixes the back pressure setting when sriov is enabled") +Signed-off-by: Yunsheng Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index 5db70a1451c5..48235dc2dd56 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -1167,14 +1167,14 @@ static int hclge_pfc_setup_hw(struct hclge_dev *hdev) + */ + static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + { +- struct hclge_vport *vport = hdev->vport; +- u32 i, k, qs_bitmap; +- int ret; ++ int i; + + for (i = 0; i < HCLGE_BP_GRP_NUM; i++) { +- qs_bitmap = 0; ++ u32 qs_bitmap = 0; ++ int k, ret; + + for (k = 0; k < hdev->num_alloc_vport; k++) { ++ struct hclge_vport *vport = &hdev->vport[k]; + u16 qs_id = vport->qs_offset + tc; + u8 grp, sub_grp; + +@@ -1184,8 +1184,6 @@ static int hclge_bp_setup_hw(struct hclge_dev *hdev, u8 tc) + HCLGE_BP_SUB_GRP_ID_S); + if (i == grp) + qs_bitmap |= (1 << sub_grp); +- +- vport++; + } + + ret = hclge_tm_qs_bp_cfg(hdev, tc, i, qs_bitmap); +-- +2.17.1 + diff --git a/queue-4.19/net-stmmac-fix-rx-packet-size-8191.patch b/queue-4.19/net-stmmac-fix-rx-packet-size-8191.patch new file mode 100644 index 00000000000..890fab81315 --- /dev/null +++ b/queue-4.19/net-stmmac-fix-rx-packet-size-8191.patch @@ -0,0 +1,101 @@ +From dfc566f6ec0ac43624afa9866b934c9cbd761270 Mon Sep 17 00:00:00 2001 +From: Thor Thayer +Date: Thu, 8 Nov 2018 11:42:14 -0600 +Subject: net: stmmac: Fix RX packet size > 8191 + +[ Upstream commit 8137b6ef0ce469154e5cf19f8e7fe04d9a72ac5e ] + +Ping problems with packets > 8191 as shown: + +PING 192.168.1.99 (192.168.1.99) 8150(8178) bytes of data. +8158 bytes from 192.168.1.99: icmp_seq=1 ttl=64 time=0.669 ms +wrong data byte 8144 should be 0xd0 but was 0x0 +16 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f + 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f +%< ---------------snip-------------------------------------- +8112 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf + c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf +8144 0 0 0 0 d0 d1 + ^^^^^^^ +Notice the 4 bytes of 0 before the expected byte of d0. + +Databook notes that the RX buffer must be a multiple of 4/8/16 +bytes [1]. + +Update the DMA Buffer size define to 8188 instead of 8192. Remove +the -1 from the RX buffer size allocations and use the new +DMA Buffer size directly. + +[1] Synopsys DesignWare Cores Ethernet MAC Universal v3.70a + [section 8.4.2 - Table 8-24] + +Tested on SoCFPGA Stratix10 with ping sweep from 100 to 8300 byte packets. + +Fixes: 286a83721720 ("stmmac: add CHAINED descriptor mode support (V4)") +Suggested-by: Jose Abreu +Signed-off-by: Thor Thayer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 3 ++- + drivers/net/ethernet/stmicro/stmmac/descs_com.h | 2 +- + drivers/net/ethernet/stmicro/stmmac/enh_desc.c | 2 +- + drivers/net/ethernet/stmicro/stmmac/ring_mode.c | 2 +- + 4 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index b1b305f8f414..272b9ca66314 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -365,7 +365,8 @@ struct dma_features { + + /* GMAC TX FIFO is 8K, Rx FIFO is 16K */ + #define BUF_SIZE_16KiB 16384 +-#define BUF_SIZE_8KiB 8192 ++/* RX Buffer size must be < 8191 and multiple of 4/8/16 bytes */ ++#define BUF_SIZE_8KiB 8188 + #define BUF_SIZE_4KiB 4096 + #define BUF_SIZE_2KiB 2048 + +diff --git a/drivers/net/ethernet/stmicro/stmmac/descs_com.h b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +index ca9d7e48034c..40d6356a7e73 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/descs_com.h ++++ b/drivers/net/ethernet/stmicro/stmmac/descs_com.h +@@ -31,7 +31,7 @@ + /* Enhanced descriptors */ + static inline void ehn_desc_rx_set_on_ring(struct dma_desc *p, int end) + { +- p->des1 |= cpu_to_le32(((BUF_SIZE_8KiB - 1) ++ p->des1 |= cpu_to_le32((BUF_SIZE_8KiB + << ERDES1_BUFFER2_SIZE_SHIFT) + & ERDES1_BUFFER2_SIZE_MASK); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index 77914c89d749..5ef91a790f9d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -262,7 +262,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, int disable_rx_ic, + int mode, int end) + { + p->des0 |= cpu_to_le32(RDES0_OWN); +- p->des1 |= cpu_to_le32((BUF_SIZE_8KiB - 1) & ERDES1_BUFFER1_SIZE_MASK); ++ p->des1 |= cpu_to_le32(BUF_SIZE_8KiB & ERDES1_BUFFER1_SIZE_MASK); + + if (mode == STMMAC_CHAIN_MODE) + ehn_desc_rx_set_on_chain(p); +diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +index a7ffc73fffe8..bc83ced94e1b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c ++++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c +@@ -140,7 +140,7 @@ static void clean_desc3(void *priv_ptr, struct dma_desc *p) + static int set_16kib_bfsize(int mtu) + { + int ret = 0; +- if (unlikely(mtu >= BUF_SIZE_8KiB)) ++ if (unlikely(mtu > BUF_SIZE_8KiB)) + ret = BUF_SIZE_16KiB; + return ret; + } +-- +2.17.1 + diff --git a/queue-4.19/netfilter-bridge-define-int_min-int_max-in-userspace.patch b/queue-4.19/netfilter-bridge-define-int_min-int_max-in-userspace.patch new file mode 100644 index 00000000000..39a83668fe6 --- /dev/null +++ b/queue-4.19/netfilter-bridge-define-int_min-int_max-in-userspace.patch @@ -0,0 +1,50 @@ +From 072552f5d8390596453f2b239852e54d0e37b602 Mon Sep 17 00:00:00 2001 +From: Jiri Slaby +Date: Wed, 24 Oct 2018 13:54:03 +0200 +Subject: netfilter: bridge: define INT_MIN & INT_MAX in userspace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 5a8de47b3c250521dd632cdedaac6db88367defa ] + +With 4.19, programs like ebtables fail to build when they include +"linux/netfilter_bridge.h". It is caused by commit 94276fa8a2a4 which +added a use of INT_MIN and INT_MAX to the header: +: In file included from /usr/include/linux/netfilter_bridge/ebtables.h:18, +: from include/ebtables_u.h:28, +: from communication.c:23: +: /usr/include/linux/netfilter_bridge.h:30:20: error: 'INT_MIN' undeclared here (not in a function) +: NF_BR_PRI_FIRST = INT_MIN, +: ^~~~~~~ + +Define these constants by including "limits.h" when !__KERNEL__ (the +same way as for other netfilter_* headers). + +Fixes: 94276fa8a2a4 ("netfilter: bridge: Expose nf_tables bridge hook priorities through uapi") +Signed-off-by: Jiri Slaby +Acked-by: Máté Eckl +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter_bridge.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/uapi/linux/netfilter_bridge.h b/include/uapi/linux/netfilter_bridge.h +index 156ccd089df1..1610fdbab98d 100644 +--- a/include/uapi/linux/netfilter_bridge.h ++++ b/include/uapi/linux/netfilter_bridge.h +@@ -11,6 +11,10 @@ + #include + #include + ++#ifndef __KERNEL__ ++#include /* for INT_MIN, INT_MAX */ ++#endif ++ + /* Bridge Hooks */ + /* After promisc drops, checksum checks. */ + #define NF_BR_PRE_ROUTING 0 +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipset-actually-allow-allowable-cidr-0-in-h.patch b/queue-4.19/netfilter-ipset-actually-allow-allowable-cidr-0-in-h.patch new file mode 100644 index 00000000000..aca6ce26f26 --- /dev/null +++ b/queue-4.19/netfilter-ipset-actually-allow-allowable-cidr-0-in-h.patch @@ -0,0 +1,90 @@ +From 5361d4011cf0dc629fc991ce1366ce0dd1584919 Mon Sep 17 00:00:00 2001 +From: Eric Westbrook +Date: Tue, 28 Aug 2018 15:14:42 -0600 +Subject: netfilter: ipset: actually allow allowable CIDR 0 in + hash:net,port,net + +[ Upstream commit 886503f34d63e681662057448819edb5b1057a97 ] + +Allow /0 as advertised for hash:net,port,net sets. + +For "hash:net,port,net", ipset(8) says that "either subnet +is permitted to be a /0 should you wish to match port +between all destinations." + +Make that statement true. + +Before: + + # ipset create cidrzero hash:net,port,net + # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0 + ipset v6.34: The value of the CIDR parameter of the IP address is invalid + + # ipset create cidrzero6 hash:net,port,net family inet6 + # ipset add cidrzero6 ::/0,12345,::/0 + ipset v6.34: The value of the CIDR parameter of the IP address is invalid + +After: + + # ipset create cidrzero hash:net,port,net + # ipset add cidrzero 0.0.0.0/0,12345,0.0.0.0/0 + # ipset test cidrzero 192.168.205.129,12345,172.16.205.129 + 192.168.205.129,tcp:12345,172.16.205.129 is in set cidrzero. + + # ipset create cidrzero6 hash:net,port,net family inet6 + # ipset add cidrzero6 ::/0,12345,::/0 + # ipset test cidrzero6 fe80::1,12345,ff00::1 + fe80::1,tcp:12345,ff00::1 is in set cidrzero6. + +See also: + + https://bugzilla.kernel.org/show_bug.cgi?id=200897 + https://github.com/ewestbrook/linux/commit/df7ff6efb0934ab6acc11f003ff1a7580d6c1d9c + +Signed-off-by: Eric Westbrook +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_netportnet.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c +index d391485a6acd..613e18e720a4 100644 +--- a/net/netfilter/ipset/ip_set_hash_netportnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netportnet.c +@@ -213,13 +213,13 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); +- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) ++ if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); +- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) ++ if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + +@@ -493,13 +493,13 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[], + + if (tb[IPSET_ATTR_CIDR]) { + e.cidr[0] = nla_get_u8(tb[IPSET_ATTR_CIDR]); +- if (!e.cidr[0] || e.cidr[0] > HOST_MASK) ++ if (e.cidr[0] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + + if (tb[IPSET_ATTR_CIDR2]) { + e.cidr[1] = nla_get_u8(tb[IPSET_ATTR_CIDR2]); +- if (!e.cidr[1] || e.cidr[1] > HOST_MASK) ++ if (e.cidr[1] > HOST_MASK) + return -IPSET_ERR_INVALID_CIDR; + } + +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipset-correct-rcu_dereference-call-in-ip_s.patch b/queue-4.19/netfilter-ipset-correct-rcu_dereference-call-in-ip_s.patch new file mode 100644 index 00000000000..0dfce411cd1 --- /dev/null +++ b/queue-4.19/netfilter-ipset-correct-rcu_dereference-call-in-ip_s.patch @@ -0,0 +1,39 @@ +From 285c4f9167eb1e4536bcc7867416d515bd5570a1 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Fri, 19 Oct 2018 19:35:19 +0200 +Subject: netfilter: ipset: Correct rcu_dereference() call in + ip_set_put_comment() + +[ Upstream commit 17b8b74c0f8dbf9b9e3301f9ca5b65dd1c079951 ] + +The function is called when rcu_read_lock() is held and not +when rcu_read_lock_bh() is held. + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/ipset/ip_set_comment.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/netfilter/ipset/ip_set_comment.h b/include/linux/netfilter/ipset/ip_set_comment.h +index 8e2bab1e8e90..70877f8de7e9 100644 +--- a/include/linux/netfilter/ipset/ip_set_comment.h ++++ b/include/linux/netfilter/ipset/ip_set_comment.h +@@ -43,11 +43,11 @@ ip_set_init_comment(struct ip_set *set, struct ip_set_comment *comment, + rcu_assign_pointer(comment->c, c); + } + +-/* Used only when dumping a set, protected by rcu_read_lock_bh() */ ++/* Used only when dumping a set, protected by rcu_read_lock() */ + static inline int + ip_set_put_comment(struct sk_buff *skb, const struct ip_set_comment *comment) + { +- struct ip_set_comment_rcu *c = rcu_dereference_bh(comment->c); ++ struct ip_set_comment_rcu *c = rcu_dereference(comment->c); + + if (!c) + return 0; +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipset-fix-calling-ip_set-macro-at-dumping.patch b/queue-4.19/netfilter-ipset-fix-calling-ip_set-macro-at-dumping.patch new file mode 100644 index 00000000000..9da53fb53d9 --- /dev/null +++ b/queue-4.19/netfilter-ipset-fix-calling-ip_set-macro-at-dumping.patch @@ -0,0 +1,62 @@ +From 6ddec6a83123c3aafb5282c637c845ec5c29eddc Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Tue, 30 Oct 2018 22:43:42 +0100 +Subject: netfilter: ipset: Fix calling ip_set() macro at dumping + +[ Upstream commit 8a02bdd50b2ecb6d62121d2958d3ea186cc88ce7 ] + +The ip_set() macro is called when either ip_set_ref_lock held only +or no lock/nfnl mutex is held at dumping. Take this into account +properly. Also, use Pablo's suggestion to use rcu_dereference_raw(), +the ref_netlink protects the set. + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 68db946df151..1577f2f76060 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -55,11 +55,15 @@ MODULE_AUTHOR("Jozsef Kadlecsik "); + MODULE_DESCRIPTION("core IP set support"); + MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_IPSET); + +-/* When the nfnl mutex is held: */ ++/* When the nfnl mutex or ip_set_ref_lock is held: */ + #define ip_set_dereference(p) \ +- rcu_dereference_protected(p, lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET)) ++ rcu_dereference_protected(p, \ ++ lockdep_nfnl_is_held(NFNL_SUBSYS_IPSET) || \ ++ lockdep_is_held(&ip_set_ref_lock)) + #define ip_set(inst, id) \ + ip_set_dereference((inst)->ip_set_list)[id] ++#define ip_set_ref_netlink(inst,id) \ ++ rcu_dereference_raw((inst)->ip_set_list)[id] + + /* The set types are implemented in modules and registered set types + * can be found in ip_set_type_list. Adding/deleting types is +@@ -1251,7 +1255,7 @@ ip_set_dump_done(struct netlink_callback *cb) + struct ip_set_net *inst = + (struct ip_set_net *)cb->args[IPSET_CB_NET]; + ip_set_id_t index = (ip_set_id_t)cb->args[IPSET_CB_INDEX]; +- struct ip_set *set = ip_set(inst, index); ++ struct ip_set *set = ip_set_ref_netlink(inst, index); + + if (set->variant->uref) + set->variant->uref(set, cb, false); +@@ -1440,7 +1444,7 @@ next_set: + release_refcount: + /* If there was an error or set is done, release set */ + if (ret || !cb->args[IPSET_CB_ARG0]) { +- set = ip_set(inst, index); ++ set = ip_set_ref_netlink(inst, index); + if (set->variant->uref) + set->variant->uref(set, cb, false); + pr_debug("release set %s\n", set->name); +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipset-fix-ip_set_list-allocation-failure.patch b/queue-4.19/netfilter-ipset-fix-ip_set_list-allocation-failure.patch new file mode 100644 index 00000000000..e0249a3ba21 --- /dev/null +++ b/queue-4.19/netfilter-ipset-fix-ip_set_list-allocation-failure.patch @@ -0,0 +1,84 @@ +From dcd440dae67976b1599fc5cc1b7263027f769311 Mon Sep 17 00:00:00 2001 +From: Andrey Ryabinin +Date: Mon, 22 Oct 2018 23:30:40 +0200 +Subject: netfilter: ipset: fix ip_set_list allocation failure + +[ Upstream commit ed956f3947a01ff9875cd908d7c1ef1fe7f47bf0 ] + +ip_set_create() and ip_set_net_init() attempt to allocate physically +contiguous memory for ip_set_list. If memory is fragmented, the +allocations could easily fail: + + vzctl: page allocation failure: order:7, mode:0xc0d0 + + Call Trace: + dump_stack+0x19/0x1b + warn_alloc_failed+0x110/0x180 + __alloc_pages_nodemask+0x7bf/0xc60 + alloc_pages_current+0x98/0x110 + kmalloc_order+0x18/0x40 + kmalloc_order_trace+0x26/0xa0 + __kmalloc+0x279/0x290 + ip_set_net_init+0x4b/0x90 [ip_set] + ops_init+0x3b/0xb0 + setup_net+0xbb/0x170 + copy_net_ns+0xf1/0x1c0 + create_new_namespaces+0xf9/0x180 + copy_namespaces+0x8e/0xd0 + copy_process+0xb61/0x1a00 + do_fork+0x91/0x320 + +Use kvcalloc() to fallback to 0-order allocations if high order +page isn't available. + +Signed-off-by: Andrey Ryabinin +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_core.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index fa15a831aeee..68db946df151 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -960,7 +960,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, + /* Wraparound */ + goto cleanup; + +- list = kcalloc(i, sizeof(struct ip_set *), GFP_KERNEL); ++ list = kvcalloc(i, sizeof(struct ip_set *), GFP_KERNEL); + if (!list) + goto cleanup; + /* nfnl mutex is held, both lists are valid */ +@@ -972,7 +972,7 @@ static int ip_set_create(struct net *net, struct sock *ctnl, + /* Use new list */ + index = inst->ip_set_max; + inst->ip_set_max = i; +- kfree(tmp); ++ kvfree(tmp); + ret = 0; + } else if (ret) { + goto cleanup; +@@ -2058,7 +2058,7 @@ ip_set_net_init(struct net *net) + if (inst->ip_set_max >= IPSET_INVALID_ID) + inst->ip_set_max = IPSET_INVALID_ID - 1; + +- list = kcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL); ++ list = kvcalloc(inst->ip_set_max, sizeof(struct ip_set *), GFP_KERNEL); + if (!list) + return -ENOMEM; + inst->is_deleted = false; +@@ -2086,7 +2086,7 @@ ip_set_net_exit(struct net *net) + } + } + nfnl_unlock(NFNL_SUBSYS_IPSET); +- kfree(rcu_dereference_protected(inst->ip_set_list, 1)); ++ kvfree(rcu_dereference_protected(inst->ip_set_list, 1)); + } + + static struct pernet_operations ip_set_net_ops = { +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipset-list-set-decrease-refcount-synchrono.patch b/queue-4.19/netfilter-ipset-list-set-decrease-refcount-synchrono.patch new file mode 100644 index 00000000000..ae61161262a --- /dev/null +++ b/queue-4.19/netfilter-ipset-list-set-decrease-refcount-synchrono.patch @@ -0,0 +1,191 @@ +From 90d7474a400f3f7125bdd4c91db6e6d91a458035 Mon Sep 17 00:00:00 2001 +From: Stefano Brivio +Date: Sat, 14 Jul 2018 21:59:43 +0200 +Subject: netfilter: ipset: list:set: Decrease refcount synchronously on + deletion and replace + +[ Upstream commit 439cd39ea136d2c026805264d58a91f36b6b64ca ] + +Commit 45040978c899 ("netfilter: ipset: Fix set:list type crash +when flush/dump set in parallel") postponed decreasing set +reference counters to the RCU callback. + +An 'ipset del' command can terminate before the RCU grace period +is elapsed, and if sets are listed before then, the reference +counter shown in userspace will be wrong: + + # ipset create h hash:ip; ipset create l list:set; ipset add l + # ipset del l h; ipset list h + Name: h + Type: hash:ip + Revision: 4 + Header: family inet hashsize 1024 maxelem 65536 + Size in memory: 88 + References: 1 + Number of entries: 0 + Members: + # sleep 1; ipset list h + Name: h + Type: hash:ip + Revision: 4 + Header: family inet hashsize 1024 maxelem 65536 + Size in memory: 88 + References: 0 + Number of entries: 0 + Members: + +Fix this by making the reference count update synchronous again. + +As a result, when sets are listed, ip_set_name_byindex() might +now fetch a set whose reference count is already zero. Instead +of relying on the reference count to protect against concurrent +set renaming, grab ip_set_ref_lock as reader and copy the name, +while holding the same lock in ip_set_rename() as writer +instead. + +Reported-by: Li Shuang +Fixes: 45040978c899 ("netfilter: ipset: Fix set:list type crash when flush/dump set in parallel") +Signed-off-by: Stefano Brivio +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/ipset/ip_set.h | 2 +- + net/netfilter/ipset/ip_set_core.c | 23 +++++++++++------------ + net/netfilter/ipset/ip_set_list_set.c | 17 +++++++++++------ + 3 files changed, 23 insertions(+), 19 deletions(-) + +diff --git a/include/linux/netfilter/ipset/ip_set.h b/include/linux/netfilter/ipset/ip_set.h +index 34fc80f3eb90..1d100efe74ec 100644 +--- a/include/linux/netfilter/ipset/ip_set.h ++++ b/include/linux/netfilter/ipset/ip_set.h +@@ -314,7 +314,7 @@ enum { + extern ip_set_id_t ip_set_get_byname(struct net *net, + const char *name, struct ip_set **set); + extern void ip_set_put_byindex(struct net *net, ip_set_id_t index); +-extern const char *ip_set_name_byindex(struct net *net, ip_set_id_t index); ++extern void ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name); + extern ip_set_id_t ip_set_nfnl_get_byindex(struct net *net, ip_set_id_t index); + extern void ip_set_nfnl_put(struct net *net, ip_set_id_t index); + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index bc4bd247bb7d..fa15a831aeee 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -693,21 +693,20 @@ ip_set_put_byindex(struct net *net, ip_set_id_t index) + EXPORT_SYMBOL_GPL(ip_set_put_byindex); + + /* Get the name of a set behind a set index. +- * We assume the set is referenced, so it does exist and +- * can't be destroyed. The set cannot be renamed due to +- * the referencing either. +- * ++ * Set itself is protected by RCU, but its name isn't: to protect against ++ * renaming, grab ip_set_ref_lock as reader (see ip_set_rename()) and copy the ++ * name. + */ +-const char * +-ip_set_name_byindex(struct net *net, ip_set_id_t index) ++void ++ip_set_name_byindex(struct net *net, ip_set_id_t index, char *name) + { +- const struct ip_set *set = ip_set_rcu_get(net, index); ++ struct ip_set *set = ip_set_rcu_get(net, index); + + BUG_ON(!set); +- BUG_ON(set->ref == 0); + +- /* Referenced, so it's safe */ +- return set->name; ++ read_lock_bh(&ip_set_ref_lock); ++ strncpy(name, set->name, IPSET_MAXNAMELEN); ++ read_unlock_bh(&ip_set_ref_lock); + } + EXPORT_SYMBOL_GPL(ip_set_name_byindex); + +@@ -1153,7 +1152,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, + if (!set) + return -ENOENT; + +- read_lock_bh(&ip_set_ref_lock); ++ write_lock_bh(&ip_set_ref_lock); + if (set->ref != 0) { + ret = -IPSET_ERR_REFERENCED; + goto out; +@@ -1170,7 +1169,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, + strncpy(set->name, name2, IPSET_MAXNAMELEN); + + out: +- read_unlock_bh(&ip_set_ref_lock); ++ write_unlock_bh(&ip_set_ref_lock); + return ret; + } + +diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c +index 072a658fde04..4eef55da0878 100644 +--- a/net/netfilter/ipset/ip_set_list_set.c ++++ b/net/netfilter/ipset/ip_set_list_set.c +@@ -148,9 +148,7 @@ __list_set_del_rcu(struct rcu_head * rcu) + { + struct set_elem *e = container_of(rcu, struct set_elem, rcu); + struct ip_set *set = e->set; +- struct list_set *map = set->data; + +- ip_set_put_byindex(map->net, e->id); + ip_set_ext_destroy(set, e); + kfree(e); + } +@@ -158,15 +156,21 @@ __list_set_del_rcu(struct rcu_head * rcu) + static inline void + list_set_del(struct ip_set *set, struct set_elem *e) + { ++ struct list_set *map = set->data; ++ + set->elements--; + list_del_rcu(&e->list); ++ ip_set_put_byindex(map->net, e->id); + call_rcu(&e->rcu, __list_set_del_rcu); + } + + static inline void +-list_set_replace(struct set_elem *e, struct set_elem *old) ++list_set_replace(struct ip_set *set, struct set_elem *e, struct set_elem *old) + { ++ struct list_set *map = set->data; ++ + list_replace_rcu(&old->list, &e->list); ++ ip_set_put_byindex(map->net, old->id); + call_rcu(&old->rcu, __list_set_del_rcu); + } + +@@ -298,7 +302,7 @@ list_set_uadd(struct ip_set *set, void *value, const struct ip_set_ext *ext, + INIT_LIST_HEAD(&e->list); + list_set_init_extensions(set, ext, e); + if (n) +- list_set_replace(e, n); ++ list_set_replace(set, e, n); + else if (next) + list_add_tail_rcu(&e->list, &next->list); + else if (prev) +@@ -486,6 +490,7 @@ list_set_list(const struct ip_set *set, + const struct list_set *map = set->data; + struct nlattr *atd, *nested; + u32 i = 0, first = cb->args[IPSET_CB_ARG0]; ++ char name[IPSET_MAXNAMELEN]; + struct set_elem *e; + int ret = 0; + +@@ -504,8 +509,8 @@ list_set_list(const struct ip_set *set, + nested = ipset_nest_start(skb, IPSET_ATTR_DATA); + if (!nested) + goto nla_put_failure; +- if (nla_put_string(skb, IPSET_ATTR_NAME, +- ip_set_name_byindex(map->net, e->id))) ++ ip_set_name_byindex(map->net, e->id, name); ++ if (nla_put_string(skb, IPSET_ATTR_NAME, name)) + goto nla_put_failure; + if (ip_set_put_extensions(skb, set, e, true)) + goto nla_put_failure; +-- +2.17.1 + diff --git a/queue-4.19/netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch b/queue-4.19/netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch new file mode 100644 index 00000000000..e2d89321862 --- /dev/null +++ b/queue-4.19/netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch @@ -0,0 +1,55 @@ +From c61346045b7b00ff8c2f29468d8a8b31e50f4a5a Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Tue, 23 Oct 2018 16:47:16 +0200 +Subject: netfilter: ipv6: fix oops when defragmenting locally generated + fragments +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 61792b677415b77c8db04991c22966bb8de7603e ] + +Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did +not save/restore skb->dst. + +This causes oops when handling locally generated ipv6 fragments, as +output path needs a valid dst. + +Reported-by: Maciej Å»enczykowski +Fixes: 84379c9afe01 ("netfilter: ipv6: nf_defrag: drop skb dst before queueing") +Signed-off-by: Florian Westphal +Reviewed-by: Eric Dumazet +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv6/netfilter/nf_conntrack_reasm.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 8f68a518d9db..f76bd4d15704 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + */ + ret = -EINPROGRESS; + if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && +- fq->q.meat == fq->q.len && +- nf_ct_frag6_reasm(fq, skb, dev)) +- ret = 0; +- else ++ fq->q.meat == fq->q.len) { ++ unsigned long orefdst = skb->_skb_refdst; ++ ++ skb->_skb_refdst = 0UL; ++ if (nf_ct_frag6_reasm(fq, skb, dev)) ++ ret = 0; ++ skb->_skb_refdst = orefdst; ++ } else { + skb_dst_drop(skb); ++ } + + out_unlock: + spin_unlock_bh(&fq->q.lock); +-- +2.17.1 + diff --git a/queue-4.19/netfilter-nft_compat-ebtables-nat-table-is-normal-ch.patch b/queue-4.19/netfilter-nft_compat-ebtables-nat-table-is-normal-ch.patch new file mode 100644 index 00000000000..93ef13b7b3a --- /dev/null +++ b/queue-4.19/netfilter-nft_compat-ebtables-nat-table-is-normal-ch.patch @@ -0,0 +1,76 @@ +From 7b1197491a6f34af0c7f31c6ac6b86f0b2176dd4 Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 2 Nov 2018 11:33:37 +0100 +Subject: netfilter: nft_compat: ebtables 'nat' table is normal chain type + +[ Upstream commit e4844c9c62a0fe47980d6c3d4b7a096a5d755925 ] + +Unlike ip(6)tables, the ebtables nat table has no special properties. +This bug causes 'ebtables -A' to fail when using a target such as +'snat' (ebt_snat target sets ".table = "nat"'). Targets that have +no table restrictions work fine. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_compat.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index 32535eea51b2..ad2fe6a7e47d 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -54,9 +54,11 @@ static bool nft_xt_put(struct nft_xt *xt) + return false; + } + +-static int nft_compat_chain_validate_dependency(const char *tablename, +- const struct nft_chain *chain) ++static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, ++ const char *tablename) + { ++ enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; ++ const struct nft_chain *chain = ctx->chain; + const struct nft_base_chain *basechain; + + if (!tablename || +@@ -64,9 +66,12 @@ static int nft_compat_chain_validate_dependency(const char *tablename, + return 0; + + basechain = nft_base_chain(chain); +- if (strcmp(tablename, "nat") == 0 && +- basechain->type->type != NFT_CHAIN_T_NAT) +- return -EINVAL; ++ if (strcmp(tablename, "nat") == 0) { ++ if (ctx->family != NFPROTO_BRIDGE) ++ type = NFT_CHAIN_T_NAT; ++ if (basechain->type->type != type) ++ return -EINVAL; ++ } + + return 0; + } +@@ -323,8 +328,7 @@ static int nft_target_validate(const struct nft_ctx *ctx, + if (target->hooks && !(hook_mask & target->hooks)) + return -EINVAL; + +- ret = nft_compat_chain_validate_dependency(target->table, +- ctx->chain); ++ ret = nft_compat_chain_validate_dependency(ctx, target->table); + if (ret < 0) + return ret; + } +@@ -570,8 +574,7 @@ static int nft_match_validate(const struct nft_ctx *ctx, + if (match->hooks && !(hook_mask & match->hooks)) + return -EINVAL; + +- ret = nft_compat_chain_validate_dependency(match->table, +- ctx->chain); ++ ret = nft_compat_chain_validate_dependency(ctx, match->table); + if (ret < 0) + return ret; + } +-- +2.17.1 + diff --git a/queue-4.19/netfilter-xt_idletimer-add-sysfs-filename-checking-r.patch b/queue-4.19/netfilter-xt_idletimer-add-sysfs-filename-checking-r.patch new file mode 100644 index 00000000000..ca3d719f2c9 --- /dev/null +++ b/queue-4.19/netfilter-xt_idletimer-add-sysfs-filename-checking-r.patch @@ -0,0 +1,82 @@ +From 717561792b6a79467acbfa5758cd4f4c5e7ef771 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sun, 21 Oct 2018 00:00:08 +0900 +Subject: netfilter: xt_IDLETIMER: add sysfs filename checking routine + +[ Upstream commit 54451f60c8fa061af9051a53be9786393947367c ] + +When IDLETIMER rule is added, sysfs file is created under +/sys/class/xt_idletimer/timers/ +But some label name shouldn't be used. +".", "..", "power", "uevent", "subsystem", etc... +So that sysfs filename checking routine is needed. + +test commands: + %iptables -I INPUT -j IDLETIMER --timeout 1 --label "power" + +splat looks like: +[95765.423132] sysfs: cannot create duplicate filename '/devices/virtual/xt_idletimer/timers/power' +[95765.433418] CPU: 0 PID: 8446 Comm: iptables Not tainted 4.19.0-rc6+ #20 +[95765.449755] Call Trace: +[95765.449755] dump_stack+0xc9/0x16b +[95765.449755] ? show_regs_print_info+0x5/0x5 +[95765.449755] sysfs_warn_dup+0x74/0x90 +[95765.449755] sysfs_add_file_mode_ns+0x352/0x500 +[95765.449755] sysfs_create_file_ns+0x179/0x270 +[95765.449755] ? sysfs_add_file_mode_ns+0x500/0x500 +[95765.449755] ? idletimer_tg_checkentry+0x3e5/0xb1b [xt_IDLETIMER] +[95765.449755] ? rcu_read_lock_sched_held+0x114/0x130 +[95765.449755] ? __kmalloc_track_caller+0x211/0x2b0 +[95765.449755] ? memcpy+0x34/0x50 +[95765.449755] idletimer_tg_checkentry+0x4e2/0xb1b [xt_IDLETIMER] +[ ... ] + +Fixes: 0902b469bd25 ("netfilter: xtables: idletimer target implementation") +Signed-off-by: Taehee Yoo +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/xt_IDLETIMER.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index 5ee859193783..25453a16385e 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -116,6 +116,22 @@ static void idletimer_tg_expired(struct timer_list *t) + schedule_work(&timer->work); + } + ++static int idletimer_check_sysfs_name(const char *name, unsigned int size) ++{ ++ int ret; ++ ++ ret = xt_check_proc_name(name, size); ++ if (ret < 0) ++ return ret; ++ ++ if (!strcmp(name, "power") || ++ !strcmp(name, "subsystem") || ++ !strcmp(name, "uevent")) ++ return -EINVAL; ++ ++ return 0; ++} ++ + static int idletimer_tg_create(struct idletimer_tg_info *info) + { + int ret; +@@ -126,6 +142,10 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) + goto out; + } + ++ ret = idletimer_check_sysfs_name(info->label, sizeof(info->label)); ++ if (ret < 0) ++ goto out_free_timer; ++ + sysfs_attr_init(&info->timer->attr.attr); + info->timer->attr.attr.name = kstrdup(info->label, GFP_KERNEL); + if (!info->timer->attr.attr.name) { +-- +2.17.1 + diff --git a/queue-4.19/nvme-make-sure-ns-head-inherits-underlying-device-li.patch b/queue-4.19/nvme-make-sure-ns-head-inherits-underlying-device-li.patch new file mode 100644 index 00000000000..85cec47f32e --- /dev/null +++ b/queue-4.19/nvme-make-sure-ns-head-inherits-underlying-device-li.patch @@ -0,0 +1,54 @@ +From abe1043e83dc129aeb30ceb6cb78406531e4ffa7 Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Fri, 2 Nov 2018 11:22:13 -0700 +Subject: nvme: make sure ns head inherits underlying device limits + +[ Upstream commit 8f676b8508c250bbe255096522fdefb73f1ea0b9 ] + +Whenever we update ns_head info, we need to make sure it is still +compatible with all underlying backing devices because although nvme +multipath doesn't have any explicit use of these limits, other devices +can still be stacked on top of it which may rely on the underlying limits. +Start with unlimited stacking limits, and every info update iterate over +siblings and adjust queue limits. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 4 +++- + drivers/nvme/host/multipath.c | 1 + + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 6bb9908bf46f..0ba301f7e8b4 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1519,8 +1519,10 @@ static void __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + if (ns->ndev) + nvme_nvm_update_nvm_info(ns); + #ifdef CONFIG_NVME_MULTIPATH +- if (ns->head->disk) ++ if (ns->head->disk) { + nvme_update_disk_info(ns->head->disk, ns, id); ++ blk_queue_stack_limits(ns->head->disk->queue, ns->queue); ++ } + #endif + } + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index b71c9ad1bf45..c27af277e14e 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -257,6 +257,7 @@ int nvme_mpath_alloc_disk(struct nvme_ctrl *ctrl, struct nvme_ns_head *head) + blk_queue_flag_set(QUEUE_FLAG_NONROT, q); + /* set to a default value for 512 until disk is validated */ + blk_queue_logical_block_size(q, 512); ++ blk_set_stacking_limits(&q->limits); + + /* we need to propagate up the VMC settings */ + if (ctrl->vwc & NVME_CTRL_VWC_PRESENT) +-- +2.17.1 + diff --git a/queue-4.19/nvme-pci-fix-conflicting-p2p-resource-adds.patch b/queue-4.19/nvme-pci-fix-conflicting-p2p-resource-adds.patch new file mode 100644 index 00000000000..103e35ad92f --- /dev/null +++ b/queue-4.19/nvme-pci-fix-conflicting-p2p-resource-adds.patch @@ -0,0 +1,76 @@ +From 7fda1c39674aff4b743da6cdca41c82cef741f40 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Wed, 31 Oct 2018 13:15:29 -0600 +Subject: nvme-pci: fix conflicting p2p resource adds + +[ Upstream commit 9fe5c59ff6a1e5e26a39b75489a1420e7eaaf0b1 ] + +The nvme pci driver had been adding its CMB resource to the P2P DMA +subsystem everytime on on a controller reset. This results in the +following warning: + + ------------[ cut here ]------------ + nvme 0000:00:03.0: Conflicting mapping in same section + WARNING: CPU: 7 PID: 81 at kernel/memremap.c:155 devm_memremap_pages+0xa6/0x380 + ... + Call Trace: + pci_p2pdma_add_resource+0x153/0x370 + nvme_reset_work+0x28c/0x17b1 [nvme] + ? add_timer+0x107/0x1e0 + ? dequeue_entity+0x81/0x660 + ? dequeue_entity+0x3b0/0x660 + ? pick_next_task_fair+0xaf/0x610 + ? __switch_to+0xbc/0x410 + process_one_work+0x1cf/0x350 + worker_thread+0x215/0x3d0 + ? process_one_work+0x350/0x350 + kthread+0x107/0x120 + ? kthread_park+0x80/0x80 + ret_from_fork+0x1f/0x30 + ---[ end trace f7ea76ac6ee72727 ]--- + nvme nvme0: failed to register the CMB + +This patch fixes this by registering the CMB with P2P only once. + +Signed-off-by: Keith Busch +Reviewed-by: Logan Gunthorpe +Signed-off-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index d668682f91df..da18e0ac9fa2 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1647,6 +1647,9 @@ static void nvme_map_cmb(struct nvme_dev *dev) + struct pci_dev *pdev = to_pci_dev(dev->dev); + int bar; + ++ if (dev->cmb_size) ++ return; ++ + dev->cmbsz = readl(dev->bar + NVME_REG_CMBSZ); + if (!dev->cmbsz) + return; +@@ -2129,7 +2132,6 @@ static void nvme_pci_disable(struct nvme_dev *dev) + { + struct pci_dev *pdev = to_pci_dev(dev->dev); + +- nvme_release_cmb(dev); + pci_free_irq_vectors(pdev); + + if (pci_is_enabled(pdev)) { +@@ -2577,6 +2579,7 @@ static void nvme_remove(struct pci_dev *pdev) + nvme_stop_ctrl(&dev->ctrl); + nvme_remove_namespaces(&dev->ctrl); + nvme_dev_disable(dev, true); ++ nvme_release_cmb(dev); + nvme_free_host_mem(dev); + nvme_dev_remove_admin(dev); + nvme_free_queues(dev, 0); +-- +2.17.1 + diff --git a/queue-4.19/of-device-really-only-set-bus-dma-mask-when-appropri.patch b/queue-4.19/of-device-really-only-set-bus-dma-mask-when-appropri.patch new file mode 100644 index 00000000000..f3d35765700 --- /dev/null +++ b/queue-4.19/of-device-really-only-set-bus-dma-mask-when-appropri.patch @@ -0,0 +1,50 @@ +From 6eafc68e2c3145eae7c7ecb64d977664a1539919 Mon Sep 17 00:00:00 2001 +From: Robin Murphy +Date: Wed, 7 Nov 2018 16:30:32 +0000 +Subject: of/device: Really only set bus DMA mask when appropriate + +[ Upstream commit 6778be4e520959659b27a441c06a84c9cb009085 ] + +of_dma_configure() was *supposed* to be following the same logic as +acpi_dma_configure() and only setting bus_dma_mask if some range was +specified by the firmware. However, it seems that subtlety got lost in +the process of fitting it into the differently-shaped control flow, and +as a result the force_dma==true case ends up always setting the bus mask +to the 32-bit default, which is not what anyone wants. + +Make sure we only touch it if the DT actually said so. + +Fixes: 6c2fb2ea7636 ("of/device: Set bus DMA mask as appropriate") +Reported-by: Aaro Koskinen +Reported-by: Jean-Philippe Brucker +Tested-by: Aaro Koskinen +Tested-by: John Stultz +Tested-by: Geert Uytterhoeven +Tested-by: Robert Richter +Signed-off-by: Robin Murphy +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/device.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/device.c b/drivers/of/device.c +index 5957cd4fa262..40b9051a7fce 100644 +--- a/drivers/of/device.c ++++ b/drivers/of/device.c +@@ -149,9 +149,11 @@ int of_dma_configure(struct device *dev, struct device_node *np, bool force_dma) + * set by the driver. + */ + mask = DMA_BIT_MASK(ilog2(dma_addr + size - 1) + 1); +- dev->bus_dma_mask = mask; + dev->coherent_dma_mask &= mask; + *dev->dma_mask &= mask; ++ /* ...but only set bus mask if we found valid dma-ranges earlier */ ++ if (!ret) ++ dev->bus_dma_mask = mask; + + coherent = of_dma_is_coherent(np); + dev_dbg(dev, "device is%sdma coherent\n", +-- +2.17.1 + diff --git a/queue-4.19/perf-symbols-set-plt-entry-header-sizes-properly-on-.patch b/queue-4.19/perf-symbols-set-plt-entry-header-sizes-properly-on-.patch new file mode 100644 index 00000000000..ef7fb27793b --- /dev/null +++ b/queue-4.19/perf-symbols-set-plt-entry-header-sizes-properly-on-.patch @@ -0,0 +1,60 @@ +From 480ba6b056e2bd701bbc0985119fab1adead4d64 Mon Sep 17 00:00:00 2001 +From: David Miller +Date: Wed, 17 Oct 2018 12:08:59 -0700 +Subject: perf symbols: Set PLT entry/header sizes properly on Sparc + +[ Upstream commit d6afa561e1471ccfdaf7191230c0c59a37e45a5b ] + +Using the sh_entsize for both values isn't correct. It happens to be +correct on x86... + +For both 32-bit and 64-bit sparc, there are four PLT entries in the PLT +section. + +Signed-off-by: David S. Miller +Cc: Alexander Shishkin +Cc: Alexis Berlemont +Cc: David Tolnay +Cc: Hanjun Guo +Cc: Hemant Kumar +Cc: Li Bin +Cc: Masami Hiramatsu +Cc: Milian Wolff +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Wang Nan +Cc: zhangmengting@huawei.com +Fixes: b2f7605076d6 ("perf symbols: Fix plt entry calculation for ARM and AARCH64") +Link: http://lkml.kernel.org/r/20181017.120859.2268840244308635255.davem@davemloft.net +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/symbol-elf.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c +index 29770ea61768..6e70cc00c161 100644 +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -324,7 +324,17 @@ int dso__synthesize_plt_symbols(struct dso *dso, struct symsrc *ss) + plt_entry_size = 16; + break; + +- default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/sparc/xtensa need to be checked */ ++ case EM_SPARC: ++ plt_header_size = 48; ++ plt_entry_size = 12; ++ break; ++ ++ case EM_SPARCV9: ++ plt_header_size = 128; ++ plt_entry_size = 32; ++ break; ++ ++ default: /* FIXME: s390/alpha/mips/parisc/poperpc/sh/xtensa need to be checked */ + plt_header_size = shdr_plt.sh_entsize; + plt_entry_size = shdr_plt.sh_entsize; + break; +-- +2.17.1 + diff --git a/queue-4.19/perf-tools-do-not-zero-sample_id_all-for-group-membe.patch b/queue-4.19/perf-tools-do-not-zero-sample_id_all-for-group-membe.patch new file mode 100644 index 00000000000..60ec53ba54e --- /dev/null +++ b/queue-4.19/perf-tools-do-not-zero-sample_id_all-for-group-membe.patch @@ -0,0 +1,56 @@ +From c5371021eea9795a69cbddc67d84cf1a86feab52 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Sun, 23 Sep 2018 17:04:20 +0200 +Subject: perf tools: Do not zero sample_id_all for group members + +[ Upstream commit 8e88c29b351ed4e09dd63f825f1c8260b0cb0ab3 ] + +Andi reported following malfunction: + + # perf record -e '{ref-cycles,cycles}:S' -a sleep 1 + # perf script + non matching sample_id_all + +That's because we disable sample_id_all bit for non-sampling group +members. We can't do that, because it needs to be the same over the +whole event list. This patch keeps it untouched again. + +Reported-by: Andi Kleen +Tested-by: Andi Kleen +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180923150420.27327-1-jolsa@kernel.org +Fixes: e9add8bac6c6 ("perf evsel: Disable write_backward for leader sampling group events") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/attr/test-record-group-sampling | 1 - + tools/perf/util/evsel.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/tools/perf/tests/attr/test-record-group-sampling b/tools/perf/tests/attr/test-record-group-sampling +index 8a33ca4f9e1f..f0729c454f16 100644 +--- a/tools/perf/tests/attr/test-record-group-sampling ++++ b/tools/perf/tests/attr/test-record-group-sampling +@@ -37,4 +37,3 @@ sample_freq=0 + sample_period=0 + freq=0 + write_backward=0 +-sample_id_all=0 +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index e596ae358c4d..03a72310315f 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -952,7 +952,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + attr->sample_freq = 0; + attr->sample_period = 0; + attr->write_backward = 0; +- attr->sample_id_all = 0; + } + + if (opts->no_samples) +-- +2.17.1 + diff --git a/queue-4.19/perf-tools-fix-undefined-symbol-scnprintf-in-libperf.patch b/queue-4.19/perf-tools-fix-undefined-symbol-scnprintf-in-libperf.patch new file mode 100644 index 00000000000..90300cdebac --- /dev/null +++ b/queue-4.19/perf-tools-fix-undefined-symbol-scnprintf-in-libperf.patch @@ -0,0 +1,135 @@ +From 23d720ab8f56ba87689b46c76274535a30d5709b Mon Sep 17 00:00:00 2001 +From: Gustavo Romero +Date: Thu, 1 Nov 2018 20:13:21 -0400 +Subject: perf tools: Fix undefined symbol scnprintf in libperf-jvmti.so + +[ Upstream commit 6ac2226229d931153331a93d90655a3de05b9290 ] + +Currently jvmti agent can not be used because function scnprintf is not +present in the agent libperf-jvmti.so. As a result the JVM when using +such agent to record JITed code profiling information will fail on +looking up scnprintf: + + java: symbol lookup error: lib/libperf-jvmti.so: undefined symbol: scnprintf + +This commit fixes that by reverting to the use of snprintf, that can be +looked up, instead of scnprintf, adding a proper check for the returned +value in order to print a better error message when the jitdump file +pathname is too long. Checking the returned value also helps to comply +with some recent gcc versions, like gcc8, which will fail due to +truncated writing checks related to the -Werror=format-truncation= flag. + +Signed-off-by: Gustavo Romero +Acked-by: Jiri Olsa +LPU-Reference: 1541117601-18937-2-git-send-email-gromero@linux.vnet.ibm.com +Link: https://lkml.kernel.org/n/tip-mvpxxxy7wnzaj74cq75muw3f@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/jvmti/jvmti_agent.c | 49 ++++++++++++++++++++++++++-------- + 1 file changed, 38 insertions(+), 11 deletions(-) + +diff --git a/tools/perf/jvmti/jvmti_agent.c b/tools/perf/jvmti/jvmti_agent.c +index ac1bcdc17dae..f7eb63cbbc65 100644 +--- a/tools/perf/jvmti/jvmti_agent.c ++++ b/tools/perf/jvmti/jvmti_agent.c +@@ -125,7 +125,7 @@ perf_get_timestamp(void) + } + + static int +-debug_cache_init(void) ++create_jit_cache_dir(void) + { + char str[32]; + char *base, *p; +@@ -144,8 +144,13 @@ debug_cache_init(void) + + strftime(str, sizeof(str), JIT_LANG"-jit-%Y%m%d", &tm); + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/", base); +- ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/", base); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because %s/.debug/" ++ " is too long, please check the cwd, JITDUMPDIR, and" ++ " HOME variables", base); ++ return -1; ++ } + ret = mkdir(jit_path, 0755); + if (ret == -1) { + if (errno != EEXIST) { +@@ -154,20 +159,32 @@ debug_cache_init(void) + } + } + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit", base); ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit", base); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because" ++ " %s/.debug/jit is too long, please check the cwd," ++ " JITDUMPDIR, and HOME variables", base); ++ return -1; ++ } + ret = mkdir(jit_path, 0755); + if (ret == -1) { + if (errno != EEXIST) { +- warn("cannot create jit cache dir %s", jit_path); ++ warn("jvmti: cannot create jit cache dir %s", jit_path); + return -1; + } + } + +- snprintf(jit_path, PATH_MAX - 1, "%s/.debug/jit/%s.XXXXXXXX", base, str); +- ++ ret = snprintf(jit_path, PATH_MAX, "%s/.debug/jit/%s.XXXXXXXX", base, str); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jit cache dir because" ++ " %s/.debug/jit/%s.XXXXXXXX is too long, please check" ++ " the cwd, JITDUMPDIR, and HOME variables", ++ base, str); ++ return -1; ++ } + p = mkdtemp(jit_path); + if (p != jit_path) { +- warn("cannot create jit cache dir %s", jit_path); ++ warn("jvmti: cannot create jit cache dir %s", jit_path); + return -1; + } + +@@ -228,7 +245,7 @@ void *jvmti_open(void) + { + char dump_path[PATH_MAX]; + struct jitheader header; +- int fd; ++ int fd, ret; + FILE *fp; + + init_arch_timestamp(); +@@ -245,12 +262,22 @@ void *jvmti_open(void) + + memset(&header, 0, sizeof(header)); + +- debug_cache_init(); ++ /* ++ * jitdump file dir ++ */ ++ if (create_jit_cache_dir() < 0) ++ return NULL; + + /* + * jitdump file name + */ +- scnprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ ret = snprintf(dump_path, PATH_MAX, "%s/jit-%i.dump", jit_path, getpid()); ++ if (ret >= PATH_MAX) { ++ warnx("jvmti: cannot generate jitdump file full path because" ++ " %s/jit-%i.dump is too long, please check the cwd," ++ " JITDUMPDIR, and HOME variables", jit_path, getpid()); ++ return NULL; ++ } + + fd = open(dump_path, O_CREAT|O_TRUNC|O_RDWR, 0666); + if (fd == -1) +-- +2.17.1 + diff --git a/queue-4.19/perf-unwind-take-pgoff-into-account-when-reporting-e.patch b/queue-4.19/perf-unwind-take-pgoff-into-account-when-reporting-e.patch new file mode 100644 index 00000000000..a711132ee7c --- /dev/null +++ b/queue-4.19/perf-unwind-take-pgoff-into-account-when-reporting-e.patch @@ -0,0 +1,197 @@ +From 59bb8b38758e9dfb2f7980b009361b3aa926f8d5 Mon Sep 17 00:00:00 2001 +From: Milian Wolff +Date: Mon, 29 Oct 2018 15:16:44 +0100 +Subject: perf unwind: Take pgoff into account when reporting elf to libdwfl + +[ Upstream commit 1fe627da30331024f453faef04d500079b901107 ] + +libdwfl parses an ELF file itself and creates mappings for the +individual sections. perf on the other hand sees raw mmap events which +represent individual sections. When we encounter an address pointing +into a mapping with pgoff != 0, we must take that into account and +report the file at the non-offset base address. + +This fixes unwinding with libdwfl in some cases. E.g. for a file like: + +``` + +using namespace std; + +mutex g_mutex; + +double worker() +{ + lock_guard guard(g_mutex); + uniform_real_distribution uniform(-1E5, 1E5); + default_random_engine engine; + double s = 0; + for (int i = 0; i < 1000; ++i) { + s += norm(complex(uniform(engine), uniform(engine))); + } + cout << s << endl; + return s; +} + +int main() +{ + vector> results; + for (int i = 0; i < 10000; ++i) { + results.push_back(async(launch::async, worker)); + } + return 0; +} +``` + +Compile it with `g++ -g -O2 -lpthread cpp-locking.cpp -o cpp-locking`, +then record it with `perf record --call-graph dwarf -e +sched:sched_switch`. + +When you analyze it with `perf script` and libunwind, you should see: + +``` +cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) + 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) + 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so) + 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so) + 7f38e42569e5 __GI___libc_malloc+0x115 (inlined) + 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined) + 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined) + 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined) + 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined) + 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined) + 7f38e463fa6d std::basic_streambuf >::sputn(char const*, long)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator >::_M_put(char const*, long)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator > std::__write(std::ostreambuf_iterator >, char const*, int)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator > std::num_put > >::_M_insert_float(std::ostreambuf_iterator + 7f38e464bd70 std::num_put > >::put(std::ostreambuf_iterator >, std::ios_base&, char, double) const+0x90 (inl> + 7f38e464bd70 std::ostream& std::ostream::_M_insert(double)+0x90 (/usr/lib/libstdc++.so.6.0.25) + 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined) + 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking) + 563b9cb506fb double std::__invoke_impl(std::__invoke_other, double (*&&)())+0x2b (inlined) + 563b9cb506fb std::__invoke_result::type std::__invoke(double (*&&)())+0x2b (inlined) + 563b9cb506fb decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker >::_M_invoke<0ul>(std::_Index_tuple<0ul>)+0x2b (inlined) + 563b9cb506fb std::thread::_Invoker >::operator()()+0x2b (inlined) + 563b9cb506fb std::__future_base::_Task_setter, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker >, dou> + 563b9cb506fb std::_Function_handler (), std::__future_base::_Task_setter + 563b9cb507e8 std::function ()>::operator()() const+0x28 (inlined) + 563b9cb507e8 std::__future_base::_State_baseV2::_M_do_set(std::function ()>*, bool*)+0x28 (/ssd/milian/> + 7f38e46d24fe __pthread_once_slow+0xbe (/usr/lib/libpthread-2.28.so) + 563b9cb51149 __gthread_once+0xe9 (inlined) + 563b9cb51149 void std::call_once ()>*, bool*)> + 563b9cb51149 std::__future_base::_State_baseV2::_M_set_result(std::function ()>, bool)+0xe9 (inlined) + 563b9cb51149 std::__future_base::_Async_state_impl >, double>::_Async_state_impl(std::thread::_Invoker >&&)::{lambda()#1}::op> + 563b9cb51149 void std::__invoke_impl >, double>::_Async_state_impl(std::thread::_Invoker + 563b9cb51149 std::__invoke_result >, double>::_Async_state_impl(std::thread::_Invoker >> + 563b9cb51149 decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker >, double>::_Async_state_> + 563b9cb51149 std::thread::_Invoker >, double>::_Async_state_impl(std::thread::_Invoker + 563b9cb51149 std::thread::_State_impl >, double>::_Async_state_impl(std::thread> + 7f38e45f0062 execute_native_thread_routine+0x12 (/usr/lib/libstdc++.so.6.0.25) + 7f38e46caa9c start_thread+0xfc (/usr/lib/libpthread-2.28.so) + 7f38e42ccb22 __GI___clone+0x42 (inlined) +``` + +Before this patch, using libdwfl, you would see: + +``` +cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) + 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) + a041161e77950c5c [unknown] ([unknown]) +``` + +With this patch applied, we get a bit further in unwinding: + +``` +cpp-locking 20038 [005] 54830.236589: sched:sched_switch: prev_comm=cpp-locking prev_pid=20038 prev_prio=120 prev_state=T ==> next_comm=swapper/5 next_pid=0 next_prio=120 + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb166fec5 __sched_text_start+0x545 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1670208 schedule+0x28 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb16737cc rwsem_down_read_failed+0xec (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1665e04 call_rwsem_down_read_failed+0x14 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb1672a03 down_read+0x13 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb106bd85 __do_page_fault+0x445 (/lib/modules/4.14.78-1-lts/build/vmlinux) + ffffffffb18015f5 page_fault+0x45 (/lib/modules/4.14.78-1-lts/build/vmlinux) + 7f38e4252591 new_heap+0x101 (/usr/lib/libc-2.28.so) + 7f38e4252d0b arena_get2.part.4+0x2fb (/usr/lib/libc-2.28.so) + 7f38e4255b1c tcache_init.part.6+0xec (/usr/lib/libc-2.28.so) + 7f38e42569e5 __GI___libc_malloc+0x115 (inlined) + 7f38e4241790 __GI__IO_file_doallocate+0x90 (inlined) + 7f38e424fbbf __GI__IO_doallocbuf+0x4f (inlined) + 7f38e424ee47 __GI__IO_file_overflow+0x197 (inlined) + 7f38e424df36 _IO_new_file_xsputn+0x116 (inlined) + 7f38e4242bfb __GI__IO_fwrite+0xdb (inlined) + 7f38e463fa6d std::basic_streambuf >::sputn(char const*, long)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator >::_M_put(char const*, long)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator > std::__write(std::ostreambuf_iterator >, char const*, int)+0x1cd (inlined) + 7f38e463fa6d std::ostreambuf_iterator > std::num_put > >::_M_insert_float(std::ostreambuf_iterator + 7f38e464bd70 std::num_put > >::put(std::ostreambuf_iterator >, std::ios_base&, char, double) const+0x90 (inl> + 7f38e464bd70 std::ostream& std::ostream::_M_insert(double)+0x90 (/usr/lib/libstdc++.so.6.0.25) + 563b9cb502f7 std::ostream::operator<<(double)+0xb7 (inlined) + 563b9cb502f7 worker()+0xb7 (/ssd/milian/projects/kdab/rnd/hotspot/build/tests/test-clients/cpp-locking/cpp-locking) + 6eab825c1ee3e4ff [unknown] ([unknown]) +``` + +Note that the backtrace is still stopping too early, when compared to +the nice results obtained via libunwind. It's unclear so far what the +reason for that is. + +Committer note: + +Further comment by Milian on the thread started on the Link: tag below: + + --- +The remaining issue is due to a bug in elfutils: + +https://sourceware.org/ml/elfutils-devel/2018-q4/msg00089.html + +With both patches applied, libunwind and elfutils produce the same output for +the above scenario. + --- + +Signed-off-by: Milian Wolff +Acked-by: Jiri Olsa +Link: http://lkml.kernel.org/r/20181029141644.3907-1-milian.wolff@kdab.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/unwind-libdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c +index 6f318b15950e..5eff9bfc5758 100644 +--- a/tools/perf/util/unwind-libdw.c ++++ b/tools/perf/util/unwind-libdw.c +@@ -45,13 +45,13 @@ static int __report_module(struct addr_location *al, u64 ip, + Dwarf_Addr s; + + dwfl_module_info(mod, NULL, &s, NULL, NULL, NULL, NULL, NULL); +- if (s != al->map->start) ++ if (s != al->map->start - al->map->pgoff) + mod = 0; + } + + if (!mod) + mod = dwfl_report_elf(ui->dwfl, dso->short_name, +- (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start, ++ (dso->symsrc_filename ? dso->symsrc_filename : dso->long_name), -1, al->map->start - al->map->pgoff, + false); + + return mod && dwfl_addrmodule(ui->dwfl, ip) == mod ? 0 : -1; +-- +2.17.1 + diff --git a/queue-4.19/platform-x86-acerhdf-add-bios-entry-for-gateway-lt31.patch b/queue-4.19/platform-x86-acerhdf-add-bios-entry-for-gateway-lt31.patch new file mode 100644 index 00000000000..d89f5c2679b --- /dev/null +++ b/queue-4.19/platform-x86-acerhdf-add-bios-entry-for-gateway-lt31.patch @@ -0,0 +1,41 @@ +From 8a0b59921f985fc484d4b3c1b871ef60410f22c1 Mon Sep 17 00:00:00 2001 +From: Paul Gortmaker +Date: Thu, 20 Sep 2018 21:44:19 -0400 +Subject: platform/x86: acerhdf: Add BIOS entry for Gateway LT31 v1.3307 + +[ Upstream commit 684238d79ad85c5e19a71bb5818e77e329912fbc ] + +To fix: + + acerhdf: unknown (unsupported) BIOS version Gateway /LT31 /v1.3307 , please report, aborting! + +As can be seen in the context, the BIOS registers haven't changed in +the previous versions, so the assumption is they won't have changed +in this last update for this somewhat older platform either. + +Cc: Peter Feuerer +Cc: Darren Hart +Cc: Andy Shevchenko +Signed-off-by: Paul Gortmaker +Signed-off-by: Andy Shevchenko +Reviewed-by: Peter Feuerer +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/acerhdf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/acerhdf.c b/drivers/platform/x86/acerhdf.c +index ea22591ee66f..53dfe67807e3 100644 +--- a/drivers/platform/x86/acerhdf.c ++++ b/drivers/platform/x86/acerhdf.c +@@ -233,6 +233,7 @@ static const struct bios_settings bios_tbl[] = { + {"Gateway", "LT31", "v1.3201", 0x55, 0x58, {0x9e, 0x00}, 0}, + {"Gateway", "LT31", "v1.3302", 0x55, 0x58, {0x9e, 0x00}, 0}, + {"Gateway", "LT31", "v1.3303t", 0x55, 0x58, {0x9e, 0x00}, 0}, ++ {"Gateway", "LT31", "v1.3307", 0x55, 0x58, {0x9e, 0x00}, 0}, + /* Packard Bell */ + {"Packard Bell", "DOA150", "v0.3104", 0x55, 0x58, {0x21, 0x00}, 0}, + {"Packard Bell", "DOA150", "v0.3105", 0x55, 0x58, {0x20, 0x00}, 0}, +-- +2.17.1 + diff --git a/queue-4.19/platform-x86-intel_telemetry-report-debugfs-failure.patch b/queue-4.19/platform-x86-intel_telemetry-report-debugfs-failure.patch new file mode 100644 index 00000000000..54f6342b33e --- /dev/null +++ b/queue-4.19/platform-x86-intel_telemetry-report-debugfs-failure.patch @@ -0,0 +1,61 @@ +From 40119a31096a035630085d80ee3c14640470bb73 Mon Sep 17 00:00:00 2001 +From: Rajneesh Bhardwaj +Date: Sat, 6 Oct 2018 12:21:13 +0530 +Subject: platform/x86: intel_telemetry: report debugfs failure + +[ Upstream commit 8d98b1ef368feeb7720b8b9b6f3bd93f2ad892bc ] + +On some Goldmont based systems such as ASRock J3455M the BIOS may not +enable the IPC1 device that provides access to the PMC and PUNIT. In +such scenarios, the IOSS and PSS resources from the platform device can +not be obtained and result in a invalid telemetry_plt_config which is an +internal data structure that holds platform config and is maintained by +the telemetry platform driver. + +This is also applicable to the platforms where the BIOS supports IPC1 +device under debug configurations but IPC1 is disabled by user or the +policy. + +This change allows user to know the reason for not seeing entries under +/sys/kernel/debug/telemetry/* when there is no apparent failure at boot. + +Cc: Matt Turner +Cc: Len Brown +Cc: Souvik Kumar Chakravarty +Cc: Kuppuswamy Sathyanarayanan + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=198779 +Acked-by: Matt Turner +Signed-off-by: Rajneesh Bhardwaj +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_telemetry_debugfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel_telemetry_debugfs.c b/drivers/platform/x86/intel_telemetry_debugfs.c +index ffd0474b0531..1423fa8710fd 100644 +--- a/drivers/platform/x86/intel_telemetry_debugfs.c ++++ b/drivers/platform/x86/intel_telemetry_debugfs.c +@@ -951,12 +951,16 @@ static int __init telemetry_debugfs_init(void) + debugfs_conf = (struct telemetry_debugfs_conf *)id->driver_data; + + err = telemetry_pltconfig_valid(); +- if (err < 0) ++ if (err < 0) { ++ pr_info("Invalid pltconfig, ensure IPC1 device is enabled in BIOS\n"); + return -ENODEV; ++ } + + err = telemetry_debugfs_check_evts(); +- if (err < 0) ++ if (err < 0) { ++ pr_info("telemetry_debugfs_check_evts failed\n"); + return -EINVAL; ++ } + + register_pm_notifier(&pm_notifier); + +-- +2.17.1 + diff --git a/queue-4.19/qed-fix-blocking-unlimited-spq-entries-leak.patch b/queue-4.19/qed-fix-blocking-unlimited-spq-entries-leak.patch new file mode 100644 index 00000000000..089458e348e --- /dev/null +++ b/queue-4.19/qed-fix-blocking-unlimited-spq-entries-leak.patch @@ -0,0 +1,146 @@ +From db355e4ed765bb298b241c7fceceb4fc96c95e16 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 8 Nov 2018 16:46:09 +0200 +Subject: qed: Fix blocking/unlimited SPQ entries leak + +[ Upstream commit 2632f22ebd08da249c2017962a199a0cfb2324bf ] + +When there are no SPQ entries left in the free_pool, new entries are +allocated and are added to the unlimited list. When an entry in the pool +is available, the content is copied from the original entry, and the new +entry is sent to the device. qed_spq_post() is not aware of that, so the +additional entry is stored in the original entry as p_post_ent, which can +later be returned to the pool. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_sp.h | 3 ++ + drivers/net/ethernet/qlogic/qed/qed_spq.c | 57 ++++++++++++----------- + 2 files changed, 33 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h +index e95431f6acd4..04259df8a5c2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h +@@ -167,6 +167,9 @@ struct qed_spq_entry { + enum spq_mode comp_mode; + struct qed_spq_comp_cb comp_cb; + struct qed_spq_comp_done comp_done; /* SPQ_MODE_EBLOCK */ ++ ++ /* Posted entry for unlimited list entry in EBLOCK mode */ ++ struct qed_spq_entry *post_ent; + }; + + struct qed_eq { +diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c +index 1673fc90027f..43619b6bb232 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c +@@ -685,6 +685,8 @@ static int qed_spq_add_entry(struct qed_hwfn *p_hwfn, + /* EBLOCK responsible to free the allocated p_ent */ + if (p_ent->comp_mode != QED_SPQ_MODE_EBLOCK) + kfree(p_ent); ++ else ++ p_ent->post_ent = p_en2; + + p_ent = p_en2; + } +@@ -768,6 +770,25 @@ static int qed_spq_pend_post(struct qed_hwfn *p_hwfn) + SPQ_HIGH_PRI_RESERVE_DEFAULT); + } + ++/* Avoid overriding of SPQ entries when getting out-of-order completions, by ++ * marking the completions in a bitmap and increasing the chain consumer only ++ * for the first successive completed entries. ++ */ ++static void qed_spq_comp_bmap_update(struct qed_hwfn *p_hwfn, __le16 echo) ++{ ++ u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; ++ struct qed_spq *p_spq = p_hwfn->p_spq; ++ ++ __set_bit(pos, p_spq->p_comp_bitmap); ++ while (test_bit(p_spq->comp_bitmap_idx, ++ p_spq->p_comp_bitmap)) { ++ __clear_bit(p_spq->comp_bitmap_idx, ++ p_spq->p_comp_bitmap); ++ p_spq->comp_bitmap_idx++; ++ qed_chain_return_produced(&p_spq->chain); ++ } ++} ++ + int qed_spq_post(struct qed_hwfn *p_hwfn, + struct qed_spq_entry *p_ent, u8 *fw_return_code) + { +@@ -825,11 +846,12 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, + p_ent->queue == &p_spq->unlimited_pending); + + if (p_ent->queue == &p_spq->unlimited_pending) { +- /* This is an allocated p_ent which does not need to +- * return to pool. +- */ ++ struct qed_spq_entry *p_post_ent = p_ent->post_ent; ++ + kfree(p_ent); +- return rc; ++ ++ /* Return the entry which was actually posted */ ++ p_ent = p_post_ent; + } + + if (rc) +@@ -843,7 +865,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, + spq_post_fail2: + spin_lock_bh(&p_spq->lock); + list_del(&p_ent->list); +- qed_chain_return_produced(&p_spq->chain); ++ qed_spq_comp_bmap_update(p_hwfn, p_ent->elem.hdr.echo); + + spq_post_fail: + /* return to the free pool */ +@@ -875,25 +897,8 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + spin_lock_bh(&p_spq->lock); + list_for_each_entry_safe(p_ent, tmp, &p_spq->completion_pending, list) { + if (p_ent->elem.hdr.echo == echo) { +- u16 pos = le16_to_cpu(echo) % SPQ_RING_SIZE; +- + list_del(&p_ent->list); +- +- /* Avoid overriding of SPQ entries when getting +- * out-of-order completions, by marking the completions +- * in a bitmap and increasing the chain consumer only +- * for the first successive completed entries. +- */ +- __set_bit(pos, p_spq->p_comp_bitmap); +- +- while (test_bit(p_spq->comp_bitmap_idx, +- p_spq->p_comp_bitmap)) { +- __clear_bit(p_spq->comp_bitmap_idx, +- p_spq->p_comp_bitmap); +- p_spq->comp_bitmap_idx++; +- qed_chain_return_produced(&p_spq->chain); +- } +- ++ qed_spq_comp_bmap_update(p_hwfn, echo); + p_spq->comp_count++; + found = p_ent; + break; +@@ -932,11 +937,9 @@ int qed_spq_completion(struct qed_hwfn *p_hwfn, + QED_MSG_SPQ, + "Got a completion without a callback function\n"); + +- if ((found->comp_mode != QED_SPQ_MODE_EBLOCK) || +- (found->queue == &p_spq->unlimited_pending)) ++ if (found->comp_mode != QED_SPQ_MODE_EBLOCK) + /* EBLOCK is responsible for returning its own entry into the +- * free list, unless it originally added the entry into the +- * unlimited pending list. ++ * free list. + */ + qed_spq_return_entry(p_hwfn, found); + +-- +2.17.1 + diff --git a/queue-4.19/qed-fix-memory-entry-leak-in-qed_init_sp_request.patch b/queue-4.19/qed-fix-memory-entry-leak-in-qed_init_sp_request.patch new file mode 100644 index 00000000000..0ed84b89a78 --- /dev/null +++ b/queue-4.19/qed-fix-memory-entry-leak-in-qed_init_sp_request.patch @@ -0,0 +1,62 @@ +From f1a5ed0e6d08ef47bf07ce3a8ef6acae081ba3e6 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 8 Nov 2018 16:46:08 +0200 +Subject: qed: Fix memory/entry leak in qed_init_sp_request() + +[ Upstream commit 39477551df940ddb1339203817de04f5caaacf7a ] + +Free the allocated SPQ entry or return the acquired SPQ entry to the free +list in error flows. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/qlogic/qed/qed_sp_commands.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +index 77b6248ad3b9..e86a1ea23613 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +@@ -80,7 +80,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + + case QED_SPQ_MODE_BLOCK: + if (!p_data->p_comp_data) +- return -EINVAL; ++ goto err; + + p_ent->comp_cb.cookie = p_data->p_comp_data->cookie; + break; +@@ -95,7 +95,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + default: + DP_NOTICE(p_hwfn, "Unknown SPQE completion mode %d\n", + p_ent->comp_mode); +- return -EINVAL; ++ goto err; + } + + DP_VERBOSE(p_hwfn, QED_MSG_SPQ, +@@ -109,6 +109,18 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + memset(&p_ent->ramrod, 0, sizeof(p_ent->ramrod)); + + return 0; ++ ++err: ++ /* qed_spq_get_entry() can either get an entry from the free_pool, ++ * or, if no entries are left, allocate a new entry and add it to ++ * the unlimited_pending list. ++ */ ++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) ++ kfree(p_ent); ++ else ++ qed_spq_return_entry(p_hwfn, p_ent); ++ ++ return -EINVAL; + } + + static enum tunnel_clss qed_tunn_clss_to_fw_clss(u8 type) +-- +2.17.1 + diff --git a/queue-4.19/qed-fix-potential-memory-corruption.patch b/queue-4.19/qed-fix-potential-memory-corruption.patch new file mode 100644 index 00000000000..6a115c7a02c --- /dev/null +++ b/queue-4.19/qed-fix-potential-memory-corruption.patch @@ -0,0 +1,58 @@ +From 03521501d8b60d44c6f5b428c1409131fc6626ef Mon Sep 17 00:00:00 2001 +From: Sagiv Ozeri +Date: Thu, 8 Nov 2018 16:46:11 +0200 +Subject: qed: Fix potential memory corruption + +[ Upstream commit fa5c448d98f0df660bfcad3dd5facc027ef84cd3 ] + +A stuck ramrod should be deleted from the completion_pending list, +otherwise it will be added again in the future and corrupt the list. + +Return error value to inform that ramrod is stuck and should be deleted. + +Signed-off-by: Sagiv Ozeri +Signed-off-by: Denis Bolotin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_spq.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_spq.c b/drivers/net/ethernet/qlogic/qed/qed_spq.c +index 43619b6bb232..7106ad17afe2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_spq.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_spq.c +@@ -142,6 +142,7 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn, + + DP_INFO(p_hwfn, "Ramrod is stuck, requesting MCP drain\n"); + rc = qed_mcp_drain(p_hwfn, p_ptt); ++ qed_ptt_release(p_hwfn, p_ptt); + if (rc) { + DP_NOTICE(p_hwfn, "MCP drain failed\n"); + goto err; +@@ -150,18 +151,15 @@ static int qed_spq_block(struct qed_hwfn *p_hwfn, + /* Retry after drain */ + rc = __qed_spq_block(p_hwfn, p_ent, p_fw_ret, true); + if (!rc) +- goto out; ++ return 0; + + comp_done = (struct qed_spq_comp_done *)p_ent->comp_cb.cookie; +- if (comp_done->done == 1) ++ if (comp_done->done == 1) { + if (p_fw_ret) + *p_fw_ret = comp_done->fw_return_code; +-out: +- qed_ptt_release(p_hwfn, p_ptt); +- return 0; +- ++ return 0; ++ } + err: +- qed_ptt_release(p_hwfn, p_ptt); + DP_NOTICE(p_hwfn, + "Ramrod is stuck [CID %08x cmd %02x protocol %02x echo %04x]\n", + le32_to_cpu(p_ent->elem.hdr.cid), +-- +2.17.1 + diff --git a/queue-4.19/qed-fix-spq-entries-not-returned-to-pool-in-error-fl.patch b/queue-4.19/qed-fix-spq-entries-not-returned-to-pool-in-error-fl.patch new file mode 100644 index 00000000000..8e28417b9e7 --- /dev/null +++ b/queue-4.19/qed-fix-spq-entries-not-returned-to-pool-in-error-fl.patch @@ -0,0 +1,229 @@ +From 8ed8a0f4e8bb1a935857990f55d3c6f131ac0555 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 8 Nov 2018 16:46:10 +0200 +Subject: qed: Fix SPQ entries not returned to pool in error flows + +[ Upstream commit fb5e7438e7a3c8966e04ccb0760170e9e06f3699 ] + +qed_sp_destroy_request() API was added for SPQ users that need to +free/return the entry they acquired in their error flows. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_fcoe.c | 11 +++++++--- + drivers/net/ethernet/qlogic/qed/qed_iscsi.c | 1 + + drivers/net/ethernet/qlogic/qed/qed_l2.c | 12 ++++++---- + drivers/net/ethernet/qlogic/qed/qed_rdma.c | 1 + + drivers/net/ethernet/qlogic/qed/qed_roce.c | 1 + + drivers/net/ethernet/qlogic/qed/qed_sp.h | 11 ++++++++++ + .../net/ethernet/qlogic/qed/qed_sp_commands.c | 22 ++++++++++++------- + drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + + 8 files changed, 45 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c +index cc1b373c0ace..46dc93d3b9b5 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c +@@ -147,7 +147,8 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + "Cannot satisfy CQ amount. CQs requested %d, CQs available %d. Aborting function start\n", + fcoe_pf_params->num_cqs, + p_hwfn->hw_info.feat_num[QED_FCOE_CQ]); +- return -EINVAL; ++ rc = -EINVAL; ++ goto err; + } + + p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu); +@@ -156,14 +157,14 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + + rc = qed_cxt_acquire_cid(p_hwfn, PROTOCOLID_FCOE, &dummy_cid); + if (rc) +- return rc; ++ goto err; + + cxt_info.iid = dummy_cid; + rc = qed_cxt_get_cid_info(p_hwfn, &cxt_info); + if (rc) { + DP_NOTICE(p_hwfn, "Cannot find context info for dummy cid=%d\n", + dummy_cid); +- return rc; ++ goto err; + } + p_cxt = cxt_info.p_cxt; + SET_FIELD(p_cxt->tstorm_ag_context.flags3, +@@ -240,6 +241,10 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn, + rc = qed_spq_post(p_hwfn, p_ent, NULL); + + return rc; ++ ++err: ++ qed_sp_destroy_request(p_hwfn, p_ent); ++ return rc; + } + + static int +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c +index 1135387bd99d..4f8a685d1a55 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c +@@ -200,6 +200,7 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn, + "Cannot satisfy CQ amount. Queues requested %d, CQs available %d. Aborting function start\n", + p_params->num_queues, + p_hwfn->hw_info.feat_num[QED_ISCSI_CQ]); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 82a1bd1f8a8c..67c02ea93906 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -740,8 +740,7 @@ int qed_sp_vport_update(struct qed_hwfn *p_hwfn, + + rc = qed_sp_vport_update_rss(p_hwfn, p_ramrod, p_rss_params); + if (rc) { +- /* Return spq entry which is taken in qed_sp_init_request()*/ +- qed_spq_return_entry(p_hwfn, p_ent); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + +@@ -1355,6 +1354,7 @@ qed_filter_ucast_common(struct qed_hwfn *p_hwfn, + DP_NOTICE(p_hwfn, + "%d is not supported yet\n", + p_filter_cmd->opcode); ++ qed_sp_destroy_request(p_hwfn, *pp_ent); + return -EINVAL; + } + +@@ -2056,13 +2056,13 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn, + } else { + rc = qed_fw_vport(p_hwfn, p_params->vport_id, &abs_vport_id); + if (rc) +- return rc; ++ goto err; + + if (p_params->qid != QED_RFS_NTUPLE_QID_RSS) { + rc = qed_fw_l2_queue(p_hwfn, p_params->qid, + &abs_rx_q_id); + if (rc) +- return rc; ++ goto err; + + p_ramrod->rx_qid_valid = 1; + p_ramrod->rx_qid = cpu_to_le16(abs_rx_q_id); +@@ -2083,6 +2083,10 @@ qed_configure_rfs_ntuple_filter(struct qed_hwfn *p_hwfn, + (u64)p_params->addr, p_params->length); + + return qed_spq_post(p_hwfn, p_ent, NULL); ++ ++err: ++ qed_sp_destroy_request(p_hwfn, p_ent); ++ return rc; + } + + int qed_get_rxq_coalesce(struct qed_hwfn *p_hwfn, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index c71391b9c757..62113438c880 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -1514,6 +1514,7 @@ qed_rdma_register_tid(void *rdma_cxt, + default: + rc = -EINVAL; + DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "rc = %d\n", rc); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + SET_FIELD(p_ramrod->flags1, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c +index f9167d1354bb..e49fada85410 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c +@@ -745,6 +745,7 @@ static int qed_roce_sp_destroy_qp_responder(struct qed_hwfn *p_hwfn, + DP_NOTICE(p_hwfn, + "qed destroy responder failed: cannot allocate memory (ramrod). rc = %d\n", + rc); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return rc; + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp.h b/drivers/net/ethernet/qlogic/qed/qed_sp.h +index 04259df8a5c2..3157c0d99441 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp.h +@@ -399,6 +399,17 @@ struct qed_sp_init_data { + struct qed_spq_comp_cb *p_comp_data; + }; + ++/** ++ * @brief Returns a SPQ entry to the pool / frees the entry if allocated. ++ * Should be called on in error flows after initializing the SPQ entry ++ * and before posting it. ++ * ++ * @param p_hwfn ++ * @param p_ent ++ */ ++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn, ++ struct qed_spq_entry *p_ent); ++ + int qed_sp_init_request(struct qed_hwfn *p_hwfn, + struct qed_spq_entry **pp_ent, + u8 cmd, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +index e86a1ea23613..888274fa208b 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sp_commands.c +@@ -47,6 +47,19 @@ + #include "qed_sp.h" + #include "qed_sriov.h" + ++void qed_sp_destroy_request(struct qed_hwfn *p_hwfn, ++ struct qed_spq_entry *p_ent) ++{ ++ /* qed_spq_get_entry() can either get an entry from the free_pool, ++ * or, if no entries are left, allocate a new entry and add it to ++ * the unlimited_pending list. ++ */ ++ if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) ++ kfree(p_ent); ++ else ++ qed_spq_return_entry(p_hwfn, p_ent); ++} ++ + int qed_sp_init_request(struct qed_hwfn *p_hwfn, + struct qed_spq_entry **pp_ent, + u8 cmd, u8 protocol, struct qed_sp_init_data *p_data) +@@ -111,14 +124,7 @@ int qed_sp_init_request(struct qed_hwfn *p_hwfn, + return 0; + + err: +- /* qed_spq_get_entry() can either get an entry from the free_pool, +- * or, if no entries are left, allocate a new entry and add it to +- * the unlimited_pending list. +- */ +- if (p_ent->queue == &p_hwfn->p_spq->unlimited_pending) +- kfree(p_ent); +- else +- qed_spq_return_entry(p_hwfn, p_ent); ++ qed_sp_destroy_request(p_hwfn, p_ent); + + return -EINVAL; + } +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 9b08a9d9e151..ca6290fa0f30 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -101,6 +101,7 @@ static int qed_sp_vf_start(struct qed_hwfn *p_hwfn, struct qed_vf_info *p_vf) + default: + DP_NOTICE(p_hwfn, "Unknown VF personality %d\n", + p_hwfn->hw_info.personality); ++ qed_sp_destroy_request(p_hwfn, p_ent); + return -EINVAL; + } + +-- +2.17.1 + diff --git a/queue-4.19/reiserfs-propagate-errors-from-fill_with_dentries-pr.patch b/queue-4.19/reiserfs-propagate-errors-from-fill_with_dentries-pr.patch new file mode 100644 index 00000000000..69373ccc8ff --- /dev/null +++ b/queue-4.19/reiserfs-propagate-errors-from-fill_with_dentries-pr.patch @@ -0,0 +1,76 @@ +From 82ea944c6cd51f5d86710ab589953e65e938c159 Mon Sep 17 00:00:00 2001 +From: Jann Horn +Date: Tue, 30 Oct 2018 15:06:38 -0700 +Subject: reiserfs: propagate errors from fill_with_dentries() properly + +[ Upstream commit b10298d56c9623f9b173f19959732d3184b35f4f ] + +fill_with_dentries() failed to propagate errors up to +reiserfs_for_each_xattr() properly. Plumb them through. + +Note that reiserfs_for_each_xattr() is only used by +reiserfs_delete_xattrs() and reiserfs_chown_xattrs(). The result of +reiserfs_delete_xattrs() is discarded anyway, the only difference there is +whether a warning is printed to dmesg. The result of +reiserfs_chown_xattrs() does matter because it can block chowning of the +file to which the xattrs belong; but either way, the resulting state can +have misaligned ownership, so my patch doesn't improve things greatly. + +Credit for making me look at this code goes to Al Viro, who pointed out +that the ->actor calling convention is suboptimal and should be changed. + +Link: http://lkml.kernel.org/r/20180802163335.83312-1-jannh@google.com +Signed-off-by: Jann Horn +Reviewed-by: Andrew Morton +Cc: Jeff Mahoney +Cc: Eric Biggers +Cc: Al Viro +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/reiserfs/xattr.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index 48cdfc81fe10..32d8986c26fb 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -185,6 +185,7 @@ struct reiserfs_dentry_buf { + struct dir_context ctx; + struct dentry *xadir; + int count; ++ int err; + struct dentry *dentries[8]; + }; + +@@ -207,6 +208,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, + + dentry = lookup_one_len(name, dbuf->xadir, namelen); + if (IS_ERR(dentry)) { ++ dbuf->err = PTR_ERR(dentry); + return PTR_ERR(dentry); + } else if (d_really_is_negative(dentry)) { + /* A directory entry exists, but no file? */ +@@ -215,6 +217,7 @@ fill_with_dentries(struct dir_context *ctx, const char *name, int namelen, + "not found for file %pd.\n", + dentry, dbuf->xadir); + dput(dentry); ++ dbuf->err = -EIO; + return -EIO; + } + +@@ -262,6 +265,10 @@ static int reiserfs_for_each_xattr(struct inode *inode, + err = reiserfs_readdir_inode(d_inode(dir), &buf.ctx); + if (err) + break; ++ if (buf.err) { ++ err = buf.err; ++ break; ++ } + if (!buf.count) + break; + for (i = 0; !err && i < buf.count && buf.dentries[i]; i++) { +-- +2.17.1 + diff --git a/queue-4.19/revert-drm-exynos-decon5433-implement-frame-counter.patch b/queue-4.19/revert-drm-exynos-decon5433-implement-frame-counter.patch new file mode 100644 index 00000000000..20a657006a4 --- /dev/null +++ b/queue-4.19/revert-drm-exynos-decon5433-implement-frame-counter.patch @@ -0,0 +1,107 @@ +From 26ddba964b8bdf7925f1db1eb6efdb0d619a241a Mon Sep 17 00:00:00 2001 +From: Inki Dae +Date: Fri, 5 Oct 2018 11:50:20 +0900 +Subject: Revert "drm/exynos/decon5433: implement frame counter" + +[ Upstream commit 6ca469e22a30992b4478d2ab88737c70667c1e00 ] + +This reverts commit 0586feba322e1de05075700eb4b835c8b683e62b + +This patch makes it to need get_vblank_counter callback in crtc +to get frame counter from decon driver. + +However, drm_dev->max_vblank_count is a member unique to +vendor's DRM driver but in case of ARM DRM, some CRTC devices +don't provide the frame counter value. As a result, this patch +made extension and clone mode not working. + +Instead of this patch, we may need separated max_vblank_count +which belongs to each CRTC device, or need to implement frame +counter emulation for them who don't support HW frame counter. + +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/exynos/exynos5433_drm_decon.c | 9 --------- + drivers/gpu/drm/exynos/exynos_drm_crtc.c | 11 ----------- + drivers/gpu/drm/exynos/exynos_drm_drv.h | 1 - + 3 files changed, 21 deletions(-) + +diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +index 94529aa82339..aef487dd8731 100644 +--- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c ++++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c +@@ -164,13 +164,6 @@ static u32 decon_get_frame_count(struct decon_context *ctx, bool end) + return frm; + } + +-static u32 decon_get_vblank_counter(struct exynos_drm_crtc *crtc) +-{ +- struct decon_context *ctx = crtc->ctx; +- +- return decon_get_frame_count(ctx, false); +-} +- + static void decon_setup_trigger(struct decon_context *ctx) + { + if (!ctx->crtc->i80_mode && !(ctx->out_type & I80_HW_TRG)) +@@ -536,7 +529,6 @@ static const struct exynos_drm_crtc_ops decon_crtc_ops = { + .disable = decon_disable, + .enable_vblank = decon_enable_vblank, + .disable_vblank = decon_disable_vblank, +- .get_vblank_counter = decon_get_vblank_counter, + .atomic_begin = decon_atomic_begin, + .update_plane = decon_update_plane, + .disable_plane = decon_disable_plane, +@@ -554,7 +546,6 @@ static int decon_bind(struct device *dev, struct device *master, void *data) + int ret; + + ctx->drm_dev = drm_dev; +- drm_dev->max_vblank_count = 0xffffffff; + + for (win = ctx->first_win; win < WINDOWS_NR; win++) { + ctx->configs[win].pixel_formats = decon_formats; +diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +index eea90251808f..2696289ecc78 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c +@@ -162,16 +162,6 @@ static void exynos_drm_crtc_disable_vblank(struct drm_crtc *crtc) + exynos_crtc->ops->disable_vblank(exynos_crtc); + } + +-static u32 exynos_drm_crtc_get_vblank_counter(struct drm_crtc *crtc) +-{ +- struct exynos_drm_crtc *exynos_crtc = to_exynos_crtc(crtc); +- +- if (exynos_crtc->ops->get_vblank_counter) +- return exynos_crtc->ops->get_vblank_counter(exynos_crtc); +- +- return 0; +-} +- + static const struct drm_crtc_funcs exynos_crtc_funcs = { + .set_config = drm_atomic_helper_set_config, + .page_flip = drm_atomic_helper_page_flip, +@@ -181,7 +171,6 @@ static const struct drm_crtc_funcs exynos_crtc_funcs = { + .atomic_destroy_state = drm_atomic_helper_crtc_destroy_state, + .enable_vblank = exynos_drm_crtc_enable_vblank, + .disable_vblank = exynos_drm_crtc_disable_vblank, +- .get_vblank_counter = exynos_drm_crtc_get_vblank_counter, + }; + + struct exynos_drm_crtc *exynos_drm_crtc_create(struct drm_device *drm_dev, +diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h +index c737c4bd2c19..630f1edc5de2 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h ++++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h +@@ -133,7 +133,6 @@ struct exynos_drm_crtc_ops { + void (*disable)(struct exynos_drm_crtc *crtc); + int (*enable_vblank)(struct exynos_drm_crtc *crtc); + void (*disable_vblank)(struct exynos_drm_crtc *crtc); +- u32 (*get_vblank_counter)(struct exynos_drm_crtc *crtc); + enum drm_mode_status (*mode_valid)(struct exynos_drm_crtc *crtc, + const struct drm_display_mode *mode); + bool (*mode_fixup)(struct exynos_drm_crtc *crtc, +-- +2.17.1 + diff --git a/queue-4.19/revert-hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch b/queue-4.19/revert-hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch new file mode 100644 index 00000000000..1022134b254 --- /dev/null +++ b/queue-4.19/revert-hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch @@ -0,0 +1,43 @@ +From 9148770e7be077af9cc3a3ed21060e730ad2f1ba Mon Sep 17 00:00:00 2001 +From: Benjamin Tissoires +Date: Wed, 17 Oct 2018 09:01:53 +0200 +Subject: Revert "HID: add NOGET quirk for Eaton Ellipse MAX UPS" + +[ Upstream commit 6298944d8f57f40ee2a3e6dcea1253e78d7a9969 ] + +This reverts commit 67ddbb3e6568fb1820b2cc45b00c50702b114801. + +67ddbb3e656 ("HID: add NOGET quirk for Eaton Ellipse MAX UPS") was reported +by Laurent Bigonville. It turns out that a later model Laurent got +doesn't need the quirk after all. + +My take is that Eaton upgraded their firmwares, so we don't need it +anymore. + +The old model was from 2012, so better make sure the new line works +properly by removing the quirk. This allows upower to actually fetch +the current data. + +Reported-by: Laurent Bigonville +Signed-off-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-quirks.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 249d49b6b16c..caafbea94882 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -106,7 +106,6 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C05A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_MOUSE_C06A), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_MCS, USB_DEVICE_ID_MCS_GAMEPADBLOCK), HID_QUIRK_MULTI_INPUT }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_SURFACE_PRO_2), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2), HID_QUIRK_NO_INIT_REPORTS }, +-- +2.17.1 + diff --git a/queue-4.19/revert-netfilter-nft_numgen-add-map-lookups-for-numg.patch b/queue-4.19/revert-netfilter-nft_numgen-add-map-lookups-for-numg.patch new file mode 100644 index 00000000000..d8f56f84fca --- /dev/null +++ b/queue-4.19/revert-netfilter-nft_numgen-add-map-lookups-for-numg.patch @@ -0,0 +1,250 @@ +From bb23b22e6a600e77a4891644d97dd05d94d57474 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Fri, 26 Oct 2018 11:14:28 +0200 +Subject: Revert "netfilter: nft_numgen: add map lookups for numgen random + operations" + +[ Upstream commit 4269fea768a11a447d8de620ce420f2214d4685c ] + +Laura found a better way to do this from userspace without requiring +kernel infrastructure, revert this. + +Fixes: 978d8f9055c3 ("netfilter: nft_numgen: add map lookups for numgen random operations") +Signed-off-by: Laura Garcia Liebana +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/uapi/linux/netfilter/nf_tables.h | 4 +- + net/netfilter/nft_numgen.c | 127 ----------------------- + 2 files changed, 2 insertions(+), 129 deletions(-) + +diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h +index e23290ffdc77..325ec6ef0a76 100644 +--- a/include/uapi/linux/netfilter/nf_tables.h ++++ b/include/uapi/linux/netfilter/nf_tables.h +@@ -1581,8 +1581,8 @@ enum nft_ng_attributes { + NFTA_NG_MODULUS, + NFTA_NG_TYPE, + NFTA_NG_OFFSET, +- NFTA_NG_SET_NAME, +- NFTA_NG_SET_ID, ++ NFTA_NG_SET_NAME, /* deprecated */ ++ NFTA_NG_SET_ID, /* deprecated */ + __NFTA_NG_MAX + }; + #define NFTA_NG_MAX (__NFTA_NG_MAX - 1) +diff --git a/net/netfilter/nft_numgen.c b/net/netfilter/nft_numgen.c +index 649d1700ec5b..3cc1b3dc3c3c 100644 +--- a/net/netfilter/nft_numgen.c ++++ b/net/netfilter/nft_numgen.c +@@ -24,7 +24,6 @@ struct nft_ng_inc { + u32 modulus; + atomic_t counter; + u32 offset; +- struct nft_set *map; + }; + + static u32 nft_ng_inc_gen(struct nft_ng_inc *priv) +@@ -48,34 +47,11 @@ static void nft_ng_inc_eval(const struct nft_expr *expr, + regs->data[priv->dreg] = nft_ng_inc_gen(priv); + } + +-static void nft_ng_inc_map_eval(const struct nft_expr *expr, +- struct nft_regs *regs, +- const struct nft_pktinfo *pkt) +-{ +- struct nft_ng_inc *priv = nft_expr_priv(expr); +- const struct nft_set *map = priv->map; +- const struct nft_set_ext *ext; +- u32 result; +- bool found; +- +- result = nft_ng_inc_gen(priv); +- found = map->ops->lookup(nft_net(pkt), map, &result, &ext); +- +- if (!found) +- return; +- +- nft_data_copy(®s->data[priv->dreg], +- nft_set_ext_data(ext), map->dlen); +-} +- + static const struct nla_policy nft_ng_policy[NFTA_NG_MAX + 1] = { + [NFTA_NG_DREG] = { .type = NLA_U32 }, + [NFTA_NG_MODULUS] = { .type = NLA_U32 }, + [NFTA_NG_TYPE] = { .type = NLA_U32 }, + [NFTA_NG_OFFSET] = { .type = NLA_U32 }, +- [NFTA_NG_SET_NAME] = { .type = NLA_STRING, +- .len = NFT_SET_MAXNAMELEN - 1 }, +- [NFTA_NG_SET_ID] = { .type = NLA_U32 }, + }; + + static int nft_ng_inc_init(const struct nft_ctx *ctx, +@@ -101,22 +77,6 @@ static int nft_ng_inc_init(const struct nft_ctx *ctx, + NFT_DATA_VALUE, sizeof(u32)); + } + +-static int nft_ng_inc_map_init(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nlattr * const tb[]) +-{ +- struct nft_ng_inc *priv = nft_expr_priv(expr); +- u8 genmask = nft_genmask_next(ctx->net); +- +- nft_ng_inc_init(ctx, expr, tb); +- +- priv->map = nft_set_lookup_global(ctx->net, ctx->table, +- tb[NFTA_NG_SET_NAME], +- tb[NFTA_NG_SET_ID], genmask); +- +- return PTR_ERR_OR_ZERO(priv->map); +-} +- + static int nft_ng_dump(struct sk_buff *skb, enum nft_registers dreg, + u32 modulus, enum nft_ng_types type, u32 offset) + { +@@ -143,27 +103,10 @@ static int nft_ng_inc_dump(struct sk_buff *skb, const struct nft_expr *expr) + priv->offset); + } + +-static int nft_ng_inc_map_dump(struct sk_buff *skb, +- const struct nft_expr *expr) +-{ +- const struct nft_ng_inc *priv = nft_expr_priv(expr); +- +- if (nft_ng_dump(skb, priv->dreg, priv->modulus, +- NFT_NG_INCREMENTAL, priv->offset) || +- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) +- goto nla_put_failure; +- +- return 0; +- +-nla_put_failure: +- return -1; +-} +- + struct nft_ng_random { + enum nft_registers dreg:8; + u32 modulus; + u32 offset; +- struct nft_set *map; + }; + + static u32 nft_ng_random_gen(struct nft_ng_random *priv) +@@ -183,25 +126,6 @@ static void nft_ng_random_eval(const struct nft_expr *expr, + regs->data[priv->dreg] = nft_ng_random_gen(priv); + } + +-static void nft_ng_random_map_eval(const struct nft_expr *expr, +- struct nft_regs *regs, +- const struct nft_pktinfo *pkt) +-{ +- struct nft_ng_random *priv = nft_expr_priv(expr); +- const struct nft_set *map = priv->map; +- const struct nft_set_ext *ext; +- u32 result; +- bool found; +- +- result = nft_ng_random_gen(priv); +- found = map->ops->lookup(nft_net(pkt), map, &result, &ext); +- if (!found) +- return; +- +- nft_data_copy(®s->data[priv->dreg], +- nft_set_ext_data(ext), map->dlen); +-} +- + static int nft_ng_random_init(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]) +@@ -226,21 +150,6 @@ static int nft_ng_random_init(const struct nft_ctx *ctx, + NFT_DATA_VALUE, sizeof(u32)); + } + +-static int nft_ng_random_map_init(const struct nft_ctx *ctx, +- const struct nft_expr *expr, +- const struct nlattr * const tb[]) +-{ +- struct nft_ng_random *priv = nft_expr_priv(expr); +- u8 genmask = nft_genmask_next(ctx->net); +- +- nft_ng_random_init(ctx, expr, tb); +- priv->map = nft_set_lookup_global(ctx->net, ctx->table, +- tb[NFTA_NG_SET_NAME], +- tb[NFTA_NG_SET_ID], genmask); +- +- return PTR_ERR_OR_ZERO(priv->map); +-} +- + static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) + { + const struct nft_ng_random *priv = nft_expr_priv(expr); +@@ -249,22 +158,6 @@ static int nft_ng_random_dump(struct sk_buff *skb, const struct nft_expr *expr) + priv->offset); + } + +-static int nft_ng_random_map_dump(struct sk_buff *skb, +- const struct nft_expr *expr) +-{ +- const struct nft_ng_random *priv = nft_expr_priv(expr); +- +- if (nft_ng_dump(skb, priv->dreg, priv->modulus, +- NFT_NG_RANDOM, priv->offset) || +- nla_put_string(skb, NFTA_NG_SET_NAME, priv->map->name)) +- goto nla_put_failure; +- +- return 0; +- +-nla_put_failure: +- return -1; +-} +- + static struct nft_expr_type nft_ng_type; + static const struct nft_expr_ops nft_ng_inc_ops = { + .type = &nft_ng_type, +@@ -274,14 +167,6 @@ static const struct nft_expr_ops nft_ng_inc_ops = { + .dump = nft_ng_inc_dump, + }; + +-static const struct nft_expr_ops nft_ng_inc_map_ops = { +- .type = &nft_ng_type, +- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_inc)), +- .eval = nft_ng_inc_map_eval, +- .init = nft_ng_inc_map_init, +- .dump = nft_ng_inc_map_dump, +-}; +- + static const struct nft_expr_ops nft_ng_random_ops = { + .type = &nft_ng_type, + .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), +@@ -290,14 +175,6 @@ static const struct nft_expr_ops nft_ng_random_ops = { + .dump = nft_ng_random_dump, + }; + +-static const struct nft_expr_ops nft_ng_random_map_ops = { +- .type = &nft_ng_type, +- .size = NFT_EXPR_SIZE(sizeof(struct nft_ng_random)), +- .eval = nft_ng_random_map_eval, +- .init = nft_ng_random_map_init, +- .dump = nft_ng_random_map_dump, +-}; +- + static const struct nft_expr_ops * + nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) + { +@@ -312,12 +189,8 @@ nft_ng_select_ops(const struct nft_ctx *ctx, const struct nlattr * const tb[]) + + switch (type) { + case NFT_NG_INCREMENTAL: +- if (tb[NFTA_NG_SET_NAME]) +- return &nft_ng_inc_map_ops; + return &nft_ng_inc_ops; + case NFT_NG_RANDOM: +- if (tb[NFTA_NG_SET_NAME]) +- return &nft_ng_random_map_ops; + return &nft_ng_random_ops; + } + +-- +2.17.1 + diff --git a/queue-4.19/revert-scripts-setlocalversion-git-make-dirty-check-.patch b/queue-4.19/revert-scripts-setlocalversion-git-make-dirty-check-.patch new file mode 100644 index 00000000000..8fb6ed7e5c1 --- /dev/null +++ b/queue-4.19/revert-scripts-setlocalversion-git-make-dirty-check-.patch @@ -0,0 +1,52 @@ +From 770f6a6ae966096d20738439cb4e99ff6014dbc6 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 6 Nov 2018 10:10:38 -0800 +Subject: Revert "scripts/setlocalversion: git: Make -dirty check more robust" + +[ Upstream commit 8ef14c2c41d962756d314f1d7dc972b0ea7a180f ] + +This reverts commit 6147b1cf19651c7de297e69108b141fb30aa2349. + +The reverted patch results in attempted write access to the source +repository, even if that repository is mounted read-only. + +Output from "strace git status -uno --porcelain": + +getcwd("/tmp/linux-test", 129) = 16 +open("/tmp/linux-test/.git/index.lock", O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, 0666) = + -1 EROFS (Read-only file system) + +While git appears to be able to handle this situation, a monitored +build environment (such as the one used for Chrome OS kernel builds) +may detect it and bail out with an access violation error. On top of +that, the attempted write access suggests that git _will_ write to the +file even if a build output directory is specified. Users may have the +reasonable expectation that the source repository remains untouched in +that situation. + +Fixes: 6147b1cf19651 ("scripts/setlocalversion: git: Make -dirty check more robust" +Cc: Genki Sky +Signed-off-by: Guenter Roeck +Reviewed-by: Brian Norris +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/setlocalversion | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/setlocalversion b/scripts/setlocalversion +index 79f7dd57d571..71f39410691b 100755 +--- a/scripts/setlocalversion ++++ b/scripts/setlocalversion +@@ -74,7 +74,7 @@ scm_version() + fi + + # Check for uncommitted changes +- if git status -uno --porcelain | grep -qv '^.. scripts/package'; then ++ if git diff-index --name-only HEAD | grep -qv "^scripts/package"; then + printf '%s' -dirty + fi + +-- +2.17.1 + diff --git a/queue-4.19/s390-decompressor-add-missing-force-to-build-targets.patch b/queue-4.19/s390-decompressor-add-missing-force-to-build-targets.patch new file mode 100644 index 00000000000..21c42941fa2 --- /dev/null +++ b/queue-4.19/s390-decompressor-add-missing-force-to-build-targets.patch @@ -0,0 +1,60 @@ +From 94dc28d0eb0869420bd5dd4ab98aa172465535bf Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Fri, 19 Oct 2018 13:37:46 +0200 +Subject: s390/decompressor: add missing FORCE to build targets + +[ Upstream commit ef5febae1543f35a45f01614123e829d77326d0f ] + +According to Documentation/kbuild/makefiles.txt all build targets +using if_changed should use FORCE as well. Add missing FORCE to make +sure vmlinux decompressor targets are rebuild properly when not just +immediate prerequisites have changed but also when build command differs. + +Reviewed-by: Philipp Rudo +Signed-off-by: Vasily Gorbik +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/boot/compressed/Makefile | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/boot/compressed/Makefile b/arch/s390/boot/compressed/Makefile +index 04609478d18b..b375c6c5ae7b 100644 +--- a/arch/s390/boot/compressed/Makefile ++++ b/arch/s390/boot/compressed/Makefile +@@ -20,7 +20,7 @@ KBUILD_CFLAGS := $(KBUILD_CFLAGS_DECOMPRESSOR) + OBJECTS := $(addprefix $(obj)/,$(obj-y)) + + LDFLAGS_vmlinux := --oformat $(LD_BFD) -e startup -T +-$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) ++$(obj)/vmlinux: $(obj)/vmlinux.lds $(objtree)/arch/s390/boot/startup.a $(OBJECTS) FORCE + $(call if_changed,ld) + + # extract required uncompressed vmlinux symbols and adjust them to reflect offsets inside vmlinux.bin +@@ -51,17 +51,17 @@ suffix-$(CONFIG_KERNEL_LZMA) := .lzma + suffix-$(CONFIG_KERNEL_LZO) := .lzo + suffix-$(CONFIG_KERNEL_XZ) := .xz + +-$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.gz: $(vmlinux.bin.all-y) FORCE + $(call if_changed,gzip) +-$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.bz2: $(vmlinux.bin.all-y) FORCE + $(call if_changed,bzip2) +-$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lz4: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lz4) +-$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lzma: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lzma) +-$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.lzo: $(vmlinux.bin.all-y) FORCE + $(call if_changed,lzo) +-$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) ++$(obj)/vmlinux.bin.xz: $(vmlinux.bin.all-y) FORCE + $(call if_changed,xzkern) + + LDFLAGS_piggy.o := -r --format binary --oformat $(LD_BFD) -T +-- +2.17.1 + diff --git a/queue-4.19/s390-mm-fix-error-__node_distance-undefined.patch b/queue-4.19/s390-mm-fix-error-__node_distance-undefined.patch new file mode 100644 index 00000000000..78f03971f8b --- /dev/null +++ b/queue-4.19/s390-mm-fix-error-__node_distance-undefined.patch @@ -0,0 +1,36 @@ +From 6513279a6385d1f98a2cb84d39b133e0322e0ba8 Mon Sep 17 00:00:00 2001 +From: "Justin M. Forbes" +Date: Wed, 31 Oct 2018 13:02:03 -0500 +Subject: s390/mm: Fix ERROR: "__node_distance" undefined! + +[ Upstream commit a541f0ebcc08ed8bc0cc492eec9a86cb280a9f24 ] + +Fixes: +ERROR: "__node_distance" [drivers/nvme/host/nvme-core.ko] undefined! +make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 +make: *** [Makefile:1275: modules] Error 2 ++ exit 1 + +Signed-off-by: Justin M. Forbes +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/numa/numa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/numa/numa.c b/arch/s390/numa/numa.c +index 5bd374491f94..6c151b42e65d 100644 +--- a/arch/s390/numa/numa.c ++++ b/arch/s390/numa/numa.c +@@ -54,6 +54,7 @@ int __node_distance(int a, int b) + { + return mode->distance ? mode->distance(a, b) : 0; + } ++EXPORT_SYMBOL(__node_distance); + + int numa_debug_enabled; + +-- +2.17.1 + diff --git a/queue-4.19/s390-mm-fix-mis-accounting-of-pgtable_bytes.patch b/queue-4.19/s390-mm-fix-mis-accounting-of-pgtable_bytes.patch new file mode 100644 index 00000000000..1bbf182004b --- /dev/null +++ b/queue-4.19/s390-mm-fix-mis-accounting-of-pgtable_bytes.patch @@ -0,0 +1,161 @@ +From 0985ca9dca4be938ad9fc283b1dcf6d3c405d1a2 Mon Sep 17 00:00:00 2001 +From: Martin Schwidefsky +Date: Mon, 15 Oct 2018 11:09:16 +0200 +Subject: s390/mm: fix mis-accounting of pgtable_bytes + +[ Upstream commit e12e4044aede97974f2222eb7f0ed726a5179a32 ] + +In case a fork or a clone system fails in copy_process and the error +handling does the mmput() at the bad_fork_cleanup_mm label, the +following warning messages will appear on the console: + + BUG: non-zero pgtables_bytes on freeing mm: 16384 + +The reason for that is the tricks we play with mm_inc_nr_puds() and +mm_inc_nr_pmds() in init_new_context(). + +A normal 64-bit process has 3 levels of page table, the p4d level and +the pud level are folded. On process termination the free_pud_range() +function in mm/memory.c will subtract 16KB from pgtable_bytes with a +mm_dec_nr_puds() call, but there actually is not really a pud table. + +One issue with this is the fact that pgtable_bytes is usually off +by a few kilobytes, but the more severe problem is that for a failed +fork or clone the free_pgtables() function is not called. In this case +there is no mm_dec_nr_puds() or mm_dec_nr_pmds() that go together with +the mm_inc_nr_puds() and mm_inc_nr_pmds in init_new_context(). +The pgtable_bytes will be off by 16384 or 32768 bytes and we get the +BUG message. The message itself is purely cosmetic, but annoying. + +To fix this override the mm_pmd_folded, mm_pud_folded and mm_p4d_folded +function to check for the true size of the address space. + +Reported-by: Li Wang +Tested-by: Li Wang +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/mmu_context.h | 5 ----- + arch/s390/include/asm/pgalloc.h | 6 +++--- + arch/s390/include/asm/pgtable.h | 18 ++++++++++++++++++ + arch/s390/include/asm/tlb.h | 6 +++--- + arch/s390/mm/pgalloc.c | 1 + + 5 files changed, 25 insertions(+), 11 deletions(-) + +diff --git a/arch/s390/include/asm/mmu_context.h b/arch/s390/include/asm/mmu_context.h +index 0717ee76885d..f1ab9420ccfb 100644 +--- a/arch/s390/include/asm/mmu_context.h ++++ b/arch/s390/include/asm/mmu_context.h +@@ -45,8 +45,6 @@ static inline int init_new_context(struct task_struct *tsk, + mm->context.asce_limit = STACK_TOP_MAX; + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_REGION3; +- /* pgd_alloc() did not account this pud */ +- mm_inc_nr_puds(mm); + break; + case -PAGE_SIZE: + /* forked 5-level task, set new asce with new_mm->pgd */ +@@ -62,9 +60,6 @@ static inline int init_new_context(struct task_struct *tsk, + /* forked 2-level compat task, set new asce with new mm->pgd */ + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_SEGMENT; +- /* pgd_alloc() did not account this pmd */ +- mm_inc_nr_pmds(mm); +- mm_inc_nr_puds(mm); + } + crst_table_init((unsigned long *) mm->pgd, pgd_entry_type(mm)); + return 0; +diff --git a/arch/s390/include/asm/pgalloc.h b/arch/s390/include/asm/pgalloc.h +index f0f9bcf94c03..5ee733720a57 100644 +--- a/arch/s390/include/asm/pgalloc.h ++++ b/arch/s390/include/asm/pgalloc.h +@@ -36,11 +36,11 @@ static inline void crst_table_init(unsigned long *crst, unsigned long entry) + + static inline unsigned long pgd_entry_type(struct mm_struct *mm) + { +- if (mm->context.asce_limit <= _REGION3_SIZE) ++ if (mm_pmd_folded(mm)) + return _SEGMENT_ENTRY_EMPTY; +- if (mm->context.asce_limit <= _REGION2_SIZE) ++ if (mm_pud_folded(mm)) + return _REGION3_ENTRY_EMPTY; +- if (mm->context.asce_limit <= _REGION1_SIZE) ++ if (mm_p4d_folded(mm)) + return _REGION2_ENTRY_EMPTY; + return _REGION1_ENTRY_EMPTY; + } +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 0e7cb0dc9c33..de05466ce50c 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -485,6 +485,24 @@ static inline int is_module_addr(void *addr) + _REGION_ENTRY_PROTECT | \ + _REGION_ENTRY_NOEXEC) + ++static inline bool mm_p4d_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION1_SIZE; ++} ++#define mm_p4d_folded(mm) mm_p4d_folded(mm) ++ ++static inline bool mm_pud_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION2_SIZE; ++} ++#define mm_pud_folded(mm) mm_pud_folded(mm) ++ ++static inline bool mm_pmd_folded(struct mm_struct *mm) ++{ ++ return mm->context.asce_limit <= _REGION3_SIZE; ++} ++#define mm_pmd_folded(mm) mm_pmd_folded(mm) ++ + static inline int mm_has_pgste(struct mm_struct *mm) + { + #ifdef CONFIG_PGSTE +diff --git a/arch/s390/include/asm/tlb.h b/arch/s390/include/asm/tlb.h +index 457b7ba0fbb6..b31c779cf581 100644 +--- a/arch/s390/include/asm/tlb.h ++++ b/arch/s390/include/asm/tlb.h +@@ -136,7 +136,7 @@ static inline void pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte, + static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION3_SIZE) ++ if (mm_pmd_folded(tlb->mm)) + return; + pgtable_pmd_page_dtor(virt_to_page(pmd)); + tlb_remove_table(tlb, pmd); +@@ -152,7 +152,7 @@ static inline void pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd, + static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION1_SIZE) ++ if (mm_p4d_folded(tlb->mm)) + return; + tlb_remove_table(tlb, p4d); + } +@@ -167,7 +167,7 @@ static inline void p4d_free_tlb(struct mmu_gather *tlb, p4d_t *p4d, + static inline void pud_free_tlb(struct mmu_gather *tlb, pud_t *pud, + unsigned long address) + { +- if (tlb->mm->context.asce_limit <= _REGION2_SIZE) ++ if (mm_pud_folded(tlb->mm)) + return; + tlb_remove_table(tlb, pud); + } +diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c +index 76d89ee8b428..814f26520aa2 100644 +--- a/arch/s390/mm/pgalloc.c ++++ b/arch/s390/mm/pgalloc.c +@@ -101,6 +101,7 @@ int crst_table_upgrade(struct mm_struct *mm, unsigned long end) + mm->context.asce_limit = _REGION1_SIZE; + mm->context.asce = __pa(mm->pgd) | _ASCE_TABLE_LENGTH | + _ASCE_USER_BITS | _ASCE_TYPE_REGION2; ++ mm_inc_nr_puds(mm); + } else { + crst_table_init(table, _REGION1_ENTRY_EMPTY); + pgd_populate(mm, (pgd_t *) table, (p4d_t *) pgd); +-- +2.17.1 + diff --git a/queue-4.19/s390-perf-change-cpum_cf-return-code-in-event-init-f.patch b/queue-4.19/s390-perf-change-cpum_cf-return-code-in-event-init-f.patch new file mode 100644 index 00000000000..0ee5209185d --- /dev/null +++ b/queue-4.19/s390-perf-change-cpum_cf-return-code-in-event-init-f.patch @@ -0,0 +1,39 @@ +From 03f958ca0f48f7e9fbbf31dc0d47ab9c14b21871 Mon Sep 17 00:00:00 2001 +From: Thomas Richter +Date: Mon, 29 Oct 2018 08:11:33 +0000 +Subject: s390/perf: Change CPUM_CF return code in event init function + +[ Upstream commit 0bb2ae1b26e1fb7543ec7474cdd374ac4b88c4da ] + +The function perf_init_event() creates a new event and +assignes it to a PMU. This a done in a loop over all existing +PMUs. For each listed PMU the event init function is called +and if this function does return any other error than -ENOENT, +the loop is terminated the creation of the event fails. + +If the event is invalid, return -ENOENT to try other PMUs. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_cf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c +index cc085e2d2ce9..74091fd3101e 100644 +--- a/arch/s390/kernel/perf_cpum_cf.c ++++ b/arch/s390/kernel/perf_cpum_cf.c +@@ -373,7 +373,7 @@ static int __hw_perf_event_init(struct perf_event *event) + return -ENOENT; + + if (ev > PERF_CPUM_CF_MAX_CTR) +- return -EINVAL; ++ return -ENOENT; + + /* Obtain the counter set to which the specified counter belongs */ + set = get_counter_set(ev); +-- +2.17.1 + diff --git a/queue-4.19/s390-qeth-fix-hipersockets-sniffer.patch b/queue-4.19/s390-qeth-fix-hipersockets-sniffer.patch new file mode 100644 index 00000000000..d3bfb87b4c2 --- /dev/null +++ b/queue-4.19/s390-qeth-fix-hipersockets-sniffer.patch @@ -0,0 +1,70 @@ +From 187bf1ff5933d24e510a63cda94082d61cec6fc2 Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Fri, 2 Nov 2018 19:04:09 +0100 +Subject: s390/qeth: fix HiperSockets sniffer + +[ Upstream commit bd74a7f9cc033cf4d405788f80292268987dc0c5 ] + +Sniffing mode for L3 HiperSockets requires that no IP addresses are +registered with the HW. The preferred way to achieve this is for +userspace to delete all the IPs on the interface. But qeth is expected +to also tolerate a configuration where that is not the case, by skipping +the IP registration when in sniffer mode. +Since commit 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") +reworked the IP registration logic in the L3 subdriver, this no longer +works. When the qeth device is set online, qeth_l3_recover_ip() now +unconditionally registers all unicast addresses from our internal +IP table. + +While we could fix this particular problem by skipping +qeth_l3_recover_ip() on a sniffer device, the more future-proof change +is to skip the IP address registration at the lowest level. This way we +a) catch any future code path that attempts to register an IP address + without considering the sniffer scenario, and +b) continue to build up our internal IP table, so that if sniffer mode + is switched off later we can operate just like normal. + +Fixes: 5f78e29ceebf ("qeth: optimize IP handling in rx_mode callback") +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_l3_main.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index ada258c01a08..17e2fd584fbf 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -279,9 +279,6 @@ static void qeth_l3_clear_ip_htable(struct qeth_card *card, int recover) + + QETH_CARD_TEXT(card, 4, "clearip"); + +- if (recover && card->options.sniffer) +- return; +- + spin_lock_bh(&card->ip_lock); + + hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { +@@ -664,6 +661,8 @@ static int qeth_l3_register_addr_entry(struct qeth_card *card, + int rc = 0; + int cnt = 3; + ++ if (card->options.sniffer) ++ return 0; + + if (addr->proto == QETH_PROT_IPV4) { + QETH_CARD_TEXT(card, 2, "setaddr4"); +@@ -698,6 +697,9 @@ static int qeth_l3_deregister_addr_entry(struct qeth_card *card, + { + int rc = 0; + ++ if (card->options.sniffer) ++ return 0; ++ + if (addr->proto == QETH_PROT_IPV4) { + QETH_CARD_TEXT(card, 2, "deladdr4"); + QETH_CARD_HEX(card, 3, &addr->u.a4.addr, sizeof(int)); +-- +2.17.1 + diff --git a/queue-4.19/s390-qeth-unregister-netdevice-only-when-registered.patch b/queue-4.19/s390-qeth-unregister-netdevice-only-when-registered.patch new file mode 100644 index 00000000000..c91bd767897 --- /dev/null +++ b/queue-4.19/s390-qeth-unregister-netdevice-only-when-registered.patch @@ -0,0 +1,91 @@ +From 4ebfa97b196cfdc06834cf2e6433d952c03a409c Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Fri, 2 Nov 2018 19:04:10 +0100 +Subject: s390/qeth: unregister netdevice only when registered + +[ Upstream commit 30356d08159d7899438e94503ae322a8b881e205 ] + +qeth only registers its netdevice when the qeth device is first set +online. Thus a device that has never been set online will trigger +a WARN ("network todo 'hsi%d' but state 0") in unregister_netdev() when +removed. + +Fix this by protecting the unregister step, just like we already protect +against repeated registering of the netdevice. + +Fixes: d3d1b205e89f ("s390/qeth: allocate netdevice early") +Reported-by: Karsten Graul +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core.h | 5 +++++ + drivers/s390/net/qeth_l2_main.c | 5 +++-- + drivers/s390/net/qeth_l3_main.c | 5 +++-- + 3 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 34e0d476c5c6..970654fcc48d 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -826,6 +826,11 @@ struct qeth_trap_id { + /*some helper functions*/ + #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "") + ++static inline bool qeth_netdev_is_registered(struct net_device *dev) ++{ ++ return dev->netdev_ops != NULL; ++} ++ + static inline void qeth_scrub_qdio_buffer(struct qdio_buffer *buf, + unsigned int elements) + { +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index b5e38531733f..76b2fba5fba2 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -854,7 +854,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) + + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l2_set_offline(cgdev); +- unregister_netdev(card->dev); ++ if (qeth_netdev_is_registered(card->dev)) ++ unregister_netdev(card->dev); + } + + static const struct ethtool_ops qeth_l2_ethtool_ops = { +@@ -894,7 +895,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card) + { + int rc; + +- if (card->dev->netdev_ops) ++ if (qeth_netdev_is_registered(card->dev)) + return 0; + + card->dev->priv_flags |= IFF_UNICAST_FLT; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 17e2fd584fbf..b7f6a8384543 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -2514,7 +2514,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card) + { + int rc; + +- if (card->dev->netdev_ops) ++ if (qeth_netdev_is_registered(card->dev)) + return 0; + + if (card->info.type == QETH_CARD_TYPE_OSD || +@@ -2611,7 +2611,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) + if (cgdev->state == CCWGROUP_ONLINE) + qeth_l3_set_offline(cgdev); + +- unregister_netdev(card->dev); ++ if (qeth_netdev_is_registered(card->dev)) ++ unregister_netdev(card->dev); + qeth_l3_clear_ip_htable(card, 0); + qeth_l3_clear_ipato_list(card); + } +-- +2.17.1 + diff --git a/queue-4.19/s390-vdso-add-missing-force-to-build-targets.patch b/queue-4.19/s390-vdso-add-missing-force-to-build-targets.patch new file mode 100644 index 00000000000..56003cb9ee4 --- /dev/null +++ b/queue-4.19/s390-vdso-add-missing-force-to-build-targets.patch @@ -0,0 +1,80 @@ +From cbc8681cbc19ee498b3fbf418a9873f41da02945 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Fri, 19 Oct 2018 15:37:01 +0200 +Subject: s390/vdso: add missing FORCE to build targets + +[ Upstream commit b44b136a3773d8a9c7853f8df716bd1483613cbb ] + +According to Documentation/kbuild/makefiles.txt all build targets using +if_changed should use FORCE as well. Add missing FORCE to make sure +vdso targets are rebuild properly when not just immediate prerequisites +have changed but also when build command differs. + +Reviewed-by: Philipp Rudo +Signed-off-by: Vasily Gorbik +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vdso32/Makefile | 6 +++--- + arch/s390/kernel/vdso64/Makefile | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile +index c5c856f320bc..04dd3e2c3bd9 100644 +--- a/arch/s390/kernel/vdso32/Makefile ++++ b/arch/s390/kernel/vdso32/Makefile +@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n + $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so + + # link rule for the .so file, .lds has to be first +-$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) ++$(obj)/vdso32.so.dbg: $(src)/vdso32.lds $(obj-vdso32) FORCE + $(call if_changed,vdso32ld) + + # strip rule for the .so file +@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + $(call if_changed,objcopy) + + # assembly rules for the .S files +-$(obj-vdso32): %.o: %.S ++$(obj-vdso32): %.o: %.S FORCE + $(call if_changed_dep,vdso32as) + + # actual build commands + quiet_cmd_vdso32ld = VDSO32L $@ +- cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ ++ cmd_vdso32ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ + quiet_cmd_vdso32as = VDSO32A $@ + cmd_vdso32as = $(CC) $(a_flags) -c -o $@ $< + +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 15b1ceafc4c1..ddebc26cd949 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -36,7 +36,7 @@ UBSAN_SANITIZE := n + $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so + + # link rule for the .so file, .lds has to be first +-$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) ++$(obj)/vdso64.so.dbg: $(src)/vdso64.lds $(obj-vdso64) FORCE + $(call if_changed,vdso64ld) + + # strip rule for the .so file +@@ -45,12 +45,12 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE + $(call if_changed,objcopy) + + # assembly rules for the .S files +-$(obj-vdso64): %.o: %.S ++$(obj-vdso64): %.o: %.S FORCE + $(call if_changed_dep,vdso64as) + + # actual build commands + quiet_cmd_vdso64ld = VDSO64L $@ +- cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $^ -o $@ ++ cmd_vdso64ld = $(CC) $(c_flags) -Wl,-T $(filter %.lds %.o,$^) -o $@ + quiet_cmd_vdso64as = VDSO64A $@ + cmd_vdso64as = $(CC) $(a_flags) -c -o $@ $< + +-- +2.17.1 + diff --git a/queue-4.19/sched-core-take-the-hotplug-lock-in-sched_init_smp.patch b/queue-4.19/sched-core-take-the-hotplug-lock-in-sched_init_smp.patch new file mode 100644 index 00000000000..d73c2e1bff2 --- /dev/null +++ b/queue-4.19/sched-core-take-the-hotplug-lock-in-sched_init_smp.patch @@ -0,0 +1,85 @@ +From e191124695dc19780026800e54c2c5d21db070f7 Mon Sep 17 00:00:00 2001 +From: Valentin Schneider +Date: Tue, 23 Oct 2018 14:37:31 +0100 +Subject: sched/core: Take the hotplug lock in sched_init_smp() + +[ Upstream commit 40fa3780bac2b654edf23f6b13f4e2dd550aea10 ] + +When running on linux-next (8c60c36d0b8c ("Add linux-next specific files +for 20181019")) + CONFIG_PROVE_LOCKING=y on a big.LITTLE system (e.g. +Juno or HiKey960), we get the following report: + + [ 0.748225] Call trace: + [ 0.750685] lockdep_assert_cpus_held+0x30/0x40 + [ 0.755236] static_key_enable_cpuslocked+0x20/0xc8 + [ 0.760137] build_sched_domains+0x1034/0x1108 + [ 0.764601] sched_init_domains+0x68/0x90 + [ 0.768628] sched_init_smp+0x30/0x80 + [ 0.772309] kernel_init_freeable+0x278/0x51c + [ 0.776685] kernel_init+0x10/0x108 + [ 0.780190] ret_from_fork+0x10/0x18 + +The static_key in question is 'sched_asym_cpucapacity' introduced by +commit: + + df054e8445a4 ("sched/topology: Add static_key for asymmetric CPU capacity optimizations") + +In this particular case, we enable it because smp_prepare_cpus() will +end up fetching the capacity-dmips-mhz entry from the devicetree, +so we already have some asymmetry detected when entering sched_init_smp(). + +This didn't get detected in tip/sched/core because we were missing: + + commit cb538267ea1e ("jump_label/lockdep: Assert we hold the hotplug lock for _cpuslocked() operations") + +Calls to build_sched_domains() post sched_init_smp() will hold the +hotplug lock, it just so happens that this very first call is a +special case. As stated by a comment in sched_init_smp(), "There's no +userspace yet to cause hotplug operations" so this is a harmless +warning. + +However, to both respect the semantics of underlying +callees and make lockdep happy, take the hotplug lock in +sched_init_smp(). This also satisfies the comment atop +sched_init_domains() that says "Callers must hold the hotplug lock". + +Reported-by: Sudeep Holla +Tested-by: Sudeep Holla +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Cc: Dietmar.Eggemann@arm.com +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: morten.rasmussen@arm.com +Cc: quentin.perret@arm.com +Link: http://lkml.kernel.org/r/1540301851-3048-1-git-send-email-valentin.schneider@arm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index ad97f3ba5ec5..35551110d277 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5854,11 +5854,14 @@ void __init sched_init_smp(void) + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +- * happen. ++ * happen. The hotplug lock is nevertheless taken to satisfy lockdep, ++ * but there won't be any contention on it. + */ ++ cpus_read_lock(); + mutex_lock(&sched_domains_mutex); + sched_init_domains(cpu_active_mask); + mutex_unlock(&sched_domains_mutex); ++ cpus_read_unlock(); + + /* Move init over to a non-isolated CPU */ + if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0) +-- +2.17.1 + diff --git a/queue-4.19/serial-sh-sci-fix-receive-on-scifa-scifb-variants-wi.patch b/queue-4.19/serial-sh-sci-fix-receive-on-scifa-scifb-variants-wi.patch new file mode 100644 index 00000000000..48626de8802 --- /dev/null +++ b/queue-4.19/serial-sh-sci-fix-receive-on-scifa-scifb-variants-wi.patch @@ -0,0 +1,48 @@ +From d925b9a93b3ba0c8e181057b6c9efe2ce0656df4 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 9 Oct 2018 19:41:58 +0200 +Subject: serial: sh-sci: Fix receive on SCIFA/SCIFB variants with DMA + +[ Upstream commit 202dc3cc10b4d37e5251431acf8d5040a8876c7d ] + +On SCIFA and SCIFB serial ports with DMA support (i.e. some ports on +R-Car Gen2 and RZ/G1 SoCs), receive DMA operations are submitted before +the DMA channel pointer is initialized. Hence this fails, and the +driver tries to fall back to PIO. However, at this early phase in the +initialization sequence, fallback to PIO does not work, leading to a +serial port that cannot receive any data. + +Fix this by calling sci_submit_rx() after initialization of the DMA +channel pointer. + +Reported-by: Yoshihiro Shimoda +Fixes: 2c4ee23530ffc022 ("serial: sh-sci: Postpone DMA release when falling back to PIO") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Wolfram Sang +Tested-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 3649b83ef863..effba6ce0caa 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1614,10 +1614,10 @@ static void sci_request_dma(struct uart_port *port) + hrtimer_init(&s->rx_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + s->rx_timer.function = rx_timer_fn; + ++ s->chan_rx_saved = s->chan_rx = chan; ++ + if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) + sci_submit_rx(s); +- +- s->chan_rx_saved = s->chan_rx = chan; + } + } + +-- +2.17.1 + diff --git a/queue-4.19/series b/queue-4.19/series index e04fbe14b76..81dd288dfe5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1 +1,90 @@ drm-i915-replace-some-page_size-with-i915_gtt_page_size.patch +cifs-don-t-dereference-smb_file_target-before-null-c.patch +cifs-fix-return-value-for-cifs_listxattr.patch +arm64-kprobe-make-page-to-ro-mode-when-allocate-it.patch +nvme-pci-fix-conflicting-p2p-resource-adds.patch +block-brd-associate-with-queue-until-adding-disk.patch +net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclgevf.patch +net-hns3-bugfix-for-rtnl_lock-s-range-in-the-hclge_r.patch +net-hns3-bugfix-for-handling-mailbox-while-the-comma.patch +net-hns3-bugfix-for-the-initialization-of-command-qu.patch +ixgbe-fix-mac-anti-spoofing-filter-after-vflr.patch +reiserfs-propagate-errors-from-fill_with_dentries-pr.patch +hfs-prevent-btree-data-loss-on-root-split.patch +hfsplus-prevent-btree-data-loss-on-root-split.patch +perf-unwind-take-pgoff-into-account-when-reporting-e.patch +um-give-start_idle_thread-a-return-code.patch +drm-edid-add-6-bpc-quirk-for-boe-panel.patch +afs-handle-eio-from-delivery-function.patch +platform-x86-intel_telemetry-report-debugfs-failure.patch +clk-fixed-rate-fix-of_node_get-put-imbalance.patch +perf-symbols-set-plt-entry-header-sizes-properly-on-.patch +fs-exofs-fix-potential-memory-leak-in-mount-option-p.patch +clk-samsung-exynos5420-enable-peris-clocks-for-suspe.patch +apparmor-fix-uninitialized-value-in-aa_split_fqname.patch +x86-earlyprintk-add-a-force-option-for-pciserial-dev.patch +platform-x86-acerhdf-add-bios-entry-for-gateway-lt31.patch +clk-meson-axg-pcie-drop-the-mpll3-clock-parent.patch +arm64-percpu-initialize-ret-in-the-default-case.patch +clk-meson-clk-pll-drop-clk_get_rate_nocache-where-un.patch +clk-renesas-r9a06g032-fix-uart34567-clock-rate.patch +clk-ti-fix-of-child-node-lookup.patch +serial-sh-sci-fix-receive-on-scifa-scifb-variants-wi.patch +netfilter-ipv6-fix-oops-when-defragmenting-locally-g.patch +netfilter-bridge-define-int_min-int_max-in-userspace.patch +s390-decompressor-add-missing-force-to-build-targets.patch +s390-vdso-add-missing-force-to-build-targets.patch +hid-i2c-hid-add-a-small-delay-after-sleep-command-fo.patch +revert-hid-add-noget-quirk-for-eaton-ellipse-max-ups.patch +hid-alps-allow-incoming-reports-when-only-the-tracks.patch +revert-netfilter-nft_numgen-add-map-lookups-for-numg.patch +netfilter-ipset-list-set-decrease-refcount-synchrono.patch +netfilter-ipset-actually-allow-allowable-cidr-0-in-h.patch +netfilter-ipset-fix-ip_set_list-allocation-failure.patch +s390-mm-fix-mis-accounting-of-pgtable_bytes.patch +s390-mm-fix-error-__node_distance-undefined.patch +bpf-fix-bpf_prog_get_info_by_fd-to-return-0-func_len.patch +netfilter-ipset-correct-rcu_dereference-call-in-ip_s.patch +netfilter-xt_idletimer-add-sysfs-filename-checking-r.patch +netfilter-ipset-fix-calling-ip_set-macro-at-dumping.patch +netfilter-nft_compat-ebtables-nat-table-is-normal-ch.patch +s390-qeth-fix-hipersockets-sniffer.patch +s390-qeth-unregister-netdevice-only-when-registered.patch +net-hns3-fix-for-out-of-bounds-access-when-setting-p.patch +hwmon-ibmpowernv-remove-bogus-__init-annotations.patch +arm-dts-imx6sll-fix-typo-for-fsl-imx6sll-i2c-node.patch +arm-dts-fsl-fix-improperly-quoted-stdout-path-values.patch +revert-drm-exynos-decon5433-implement-frame-counter.patch +arm64-dts-renesas-r8a7795-add-missing-dma-names-on-h.patch +arm64-dts-renesas-condor-switch-from-etheravb-to-get.patch +xen-grant-table-fix-incorrect-gnttab_dma_free_pages-.patch +clk-fixed-factor-fix-of_node_get-put-imbalance.patch +mtd-nand-fix-nanddev_pos_next_page-kernel-doc-header.patch +lib-raid6-fix-arm64-test-build.patch +drm-amd-display-stop-leaking-planes.patch +block-clear-kernel-memory-before-copying-to-user.patch +drm-amd-display-drop-reusing-drm-connector-for-mst.patch +drm-amd-amdgpu-dm-fix-dm_dp_create_fake_mst_encoder.patch +s390-perf-change-cpum_cf-return-code-in-event-init-f.patch +ceph-quota-fix-null-pointer-dereference-in-quota-che.patch +of-device-really-only-set-bus-dma-mask-when-appropri.patch +nvme-make-sure-ns-head-inherits-underlying-device-li.patch +i2c-omap-enable-for-arch_k3.patch +i2c-qcom-geni-fix-runtime-pm-mismatch-with-child-dev.patch +sched-core-take-the-hotplug-lock-in-sched_init_smp.patch +perf-tools-fix-undefined-symbol-scnprintf-in-libperf.patch +perf-tools-do-not-zero-sample_id_all-for-group-membe.patch +ice-fix-dead-device-link-issue-with-flow-control.patch +ice-fix-the-bytecount-sent-to-netdev_tx_sent_queue.patch +ice-change-req_speeds-to-be-u16.patch +i40e-restore-netif_f_gso_ipxip-46-to-netdev-features.patch +qed-fix-memory-entry-leak-in-qed_init_sp_request.patch +qed-fix-blocking-unlimited-spq-entries-leak.patch +qed-fix-spq-entries-not-returned-to-pool-in-error-fl.patch +qed-fix-potential-memory-corruption.patch +net-stmmac-fix-rx-packet-size-8191.patch +net-aquantia-fix-potential-iommu-fault-after-driver-.patch +net-aquantia-fixed-enable-unicast-on-32-macvlan.patch +net-aquantia-invalid-checksumm-offload-implementatio.patch +kbuild-deb-pkg-fix-too-low-build-version-number.patch +revert-scripts-setlocalversion-git-make-dirty-check-.patch diff --git a/queue-4.19/um-give-start_idle_thread-a-return-code.patch b/queue-4.19/um-give-start_idle_thread-a-return-code.patch new file mode 100644 index 00000000000..b8e8b10bdd7 --- /dev/null +++ b/queue-4.19/um-give-start_idle_thread-a-return-code.patch @@ -0,0 +1,40 @@ +From 95495cb17d0ae94ef8a750beaf97512c0093b4f4 Mon Sep 17 00:00:00 2001 +From: Richard Weinberger +Date: Fri, 15 Jun 2018 16:42:56 +0200 +Subject: um: Give start_idle_thread() a return code + +[ Upstream commit 7ff1e34bbdc15acab823b1ee4240e94623d50ee8 ] + +Fixes: +arch/um/os-Linux/skas/process.c:613:1: warning: control reaches end of +non-void function [-Wreturn-type] + +longjmp() never returns but gcc still warns that the end of the function +can be reached. +Add a return code and debug aid to detect this impossible case. + +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/skas/process.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c +index c94c3bd70ccd..df4a985716eb 100644 +--- a/arch/um/os-Linux/skas/process.c ++++ b/arch/um/os-Linux/skas/process.c +@@ -610,6 +610,11 @@ int start_idle_thread(void *stack, jmp_buf *switch_buf) + fatal_sigsegv(); + } + longjmp(*switch_buf, 1); ++ ++ /* unreachable */ ++ printk(UM_KERN_ERR "impossible long jump!"); ++ fatal_sigsegv(); ++ return 0; + } + + void initial_thread_cb_skas(void (*proc)(void *), void *arg) +-- +2.17.1 + diff --git a/queue-4.19/x86-earlyprintk-add-a-force-option-for-pciserial-dev.patch b/queue-4.19/x86-earlyprintk-add-a-force-option-for-pciserial-dev.patch new file mode 100644 index 00000000000..7ac6e71f970 --- /dev/null +++ b/queue-4.19/x86-earlyprintk-add-a-force-option-for-pciserial-dev.patch @@ -0,0 +1,149 @@ +From 254c904607a6c4bce6996accff51c8065e8612c6 Mon Sep 17 00:00:00 2001 +From: Feng Tang +Date: Wed, 3 Oct 2018 00:49:21 +0800 +Subject: x86/earlyprintk: Add a force option for pciserial device + +[ Upstream commit d2266bbfa9e3e32e3b642965088ca461bd24a94f ] + +The "pciserial" earlyprintk variant helps much on many modern x86 +platforms, but unfortunately there are still some platforms with PCI +UART devices which have the wrong PCI class code. In that case, the +current class code check does not allow for them to be used for logging. + +Add a sub-option "force" which overrides the class code check and thus +the use of such device can be enforced. + + [ bp: massage formulations. ] + +Suggested-by: Borislav Petkov +Signed-off-by: Feng Tang +Signed-off-by: Borislav Petkov +Cc: "H. Peter Anvin" +Cc: "Stuart R . Anderson" +Cc: Bjorn Helgaas +Cc: David Rientjes +Cc: Feng Tang +Cc: Frederic Weisbecker +Cc: Greg Kroah-Hartman +Cc: H Peter Anvin +Cc: Ingo Molnar +Cc: Jiri Kosina +Cc: Jonathan Corbet +Cc: Kai-Heng Feng +Cc: Kate Stewart +Cc: Konrad Rzeszutek Wilk +Cc: Peter Zijlstra +Cc: Philippe Ombredanne +Cc: Thomas Gleixner +Cc: Thymo van Beers +Cc: alan@linux.intel.com +Cc: linux-doc@vger.kernel.org +Link: http://lkml.kernel.org/r/20181002164921.25833-1-feng.tang@intel.com +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 6 +++- + arch/x86/kernel/early_printk.c | 29 ++++++++++++------- + 2 files changed, 24 insertions(+), 11 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 92eb1f42240d..34e6800dea0e 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1063,7 +1063,7 @@ + earlyprintk=serial[,0x...[,baudrate]] + earlyprintk=ttySn[,baudrate] + earlyprintk=dbgp[debugController#] +- earlyprintk=pciserial,bus:device.function[,baudrate] ++ earlyprintk=pciserial[,force],bus:device.function[,baudrate] + earlyprintk=xdbc[xhciController#] + + earlyprintk is useful when the kernel crashes before +@@ -1095,6 +1095,10 @@ + + The sclp output can only be used on s390. + ++ The optional "force" to "pciserial" enables use of a ++ PCI device even when its classcode is not of the ++ UART class. ++ + edac_report= [HW,EDAC] Control how to report EDAC event + Format: {"on" | "off" | "force"} + on: enable EDAC to report H/W event. May be overridden +diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c +index 5e801c8c8ce7..374a52fa5296 100644 +--- a/arch/x86/kernel/early_printk.c ++++ b/arch/x86/kernel/early_printk.c +@@ -213,8 +213,9 @@ static unsigned int mem32_serial_in(unsigned long addr, int offset) + * early_pci_serial_init() + * + * This function is invoked when the early_printk param starts with "pciserial" +- * The rest of the param should be ",B:D.F,baud" where B, D & F describe the +- * location of a PCI device that must be a UART device. ++ * The rest of the param should be "[force],B:D.F,baud", where B, D & F describe ++ * the location of a PCI device that must be a UART device. "force" is optional ++ * and overrides the use of an UART device with a wrong PCI class code. + */ + static __init void early_pci_serial_init(char *s) + { +@@ -224,17 +225,23 @@ static __init void early_pci_serial_init(char *s) + u32 classcode, bar0; + u16 cmdreg; + char *e; ++ int force = 0; + +- +- /* +- * First, part the param to get the BDF values +- */ + if (*s == ',') + ++s; + + if (*s == 0) + return; + ++ /* Force the use of an UART device with wrong class code */ ++ if (!strncmp(s, "force,", 6)) { ++ force = 1; ++ s += 6; ++ } ++ ++ /* ++ * Part the param to get the BDF values ++ */ + bus = (u8)simple_strtoul(s, &e, 16); + s = e; + if (*s != ':') +@@ -253,7 +260,7 @@ static __init void early_pci_serial_init(char *s) + s++; + + /* +- * Second, find the device from the BDF ++ * Find the device from the BDF + */ + cmdreg = read_pci_config(bus, slot, func, PCI_COMMAND); + classcode = read_pci_config(bus, slot, func, PCI_CLASS_REVISION); +@@ -264,8 +271,10 @@ static __init void early_pci_serial_init(char *s) + */ + if (((classcode >> 16 != PCI_CLASS_COMMUNICATION_MODEM) && + (classcode >> 16 != PCI_CLASS_COMMUNICATION_SERIAL)) || +- (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ +- return; ++ (((classcode >> 8) & 0xff) != 0x02)) /* 16550 I/F at BAR0 */ { ++ if (!force) ++ return; ++ } + + /* + * Determine if it is IO or memory mapped +@@ -289,7 +298,7 @@ static __init void early_pci_serial_init(char *s) + } + + /* +- * Lastly, initialize the hardware ++ * Initialize the hardware + */ + if (*s) { + if (strcmp(s, "nocfg") == 0) +-- +2.17.1 + diff --git a/queue-4.19/xen-grant-table-fix-incorrect-gnttab_dma_free_pages-.patch b/queue-4.19/xen-grant-table-fix-incorrect-gnttab_dma_free_pages-.patch new file mode 100644 index 00000000000..53ff6a45c3f --- /dev/null +++ b/queue-4.19/xen-grant-table-fix-incorrect-gnttab_dma_free_pages-.patch @@ -0,0 +1,39 @@ +From 25f5c9093c4d9837a258de80f149fa1f538eec88 Mon Sep 17 00:00:00 2001 +From: Liam Merwick +Date: Fri, 2 Nov 2018 14:04:23 +0000 +Subject: xen/grant-table: Fix incorrect gnttab_dma_free_pages() pr_debug + message + +[ Upstream commit d9cccfa7c4d1d9ef967ec9308df7304a18609b30 ] + +If a call to xenmem_reservation_increase() in gnttab_dma_free_pages() +fails it triggers a message "Failed to decrease reservation..." which +should be "Failed to increase reservation..." + +Fixes: 9bdc7304f536 ('xen/grant-table: Allow allocating buffers suitable for DMA') +Reported-by: Ross Philipson +Signed-off-by: Liam Merwick +Reviewed-by: Mark Kanda +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + drivers/xen/grant-table.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c +index 84575baceebc..97341fa75458 100644 +--- a/drivers/xen/grant-table.c ++++ b/drivers/xen/grant-table.c +@@ -914,7 +914,7 @@ int gnttab_dma_free_pages(struct gnttab_dma_alloc_args *args) + + ret = xenmem_reservation_increase(args->nr_pages, args->frames); + if (ret != args->nr_pages) { +- pr_debug("Failed to decrease reservation for DMA buffer\n"); ++ pr_debug("Failed to increase reservation for DMA buffer\n"); + ret = -EFAULT; + } else { + ret = 0; +-- +2.17.1 +