From: Sasha Levin Date: Fri, 18 Oct 2019 22:29:09 +0000 (-0400) Subject: fixes for 5.3 X-Git-Tag: v4.4.198~59 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e6d6903df3253ee00ff19dde88649ca5931eb2f6;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.3 Signed-off-by: Sasha Levin --- diff --git a/queue-5.3/added-quirks-for-adata-xpg-sx8200-pro-512gb.patch b/queue-5.3/added-quirks-for-adata-xpg-sx8200-pro-512gb.patch new file mode 100644 index 00000000000..d4fc791d4ab --- /dev/null +++ b/queue-5.3/added-quirks-for-adata-xpg-sx8200-pro-512gb.patch @@ -0,0 +1,44 @@ +From 80fb18c08e45512818d7d0fabad6ecbe4f448454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2019 20:22:56 +0200 +Subject: Added QUIRKs for ADATA XPG SX8200 Pro 512GB + +From: Gabriel Craciunescu + +[ Upstream commit f03e42c6af60f778a6d1ccfb857db9b2ec835279 ] + +Booting with default_ps_max_latency_us >6000 makes the device fail. +Also SUBNQN is NULL and gives a warning on each boot/resume. + $ nvme id-ctrl /dev/nvme0 | grep ^subnqn + subnqn : (null) + +I use this device with an Acer Nitro 5 (AN515-43-R8BF) Laptop. +To be sure is not a Laptop issue only, I tested the device on +my server board with the same results. +( with 2x,4x link on the board and 4x link on a PCI-E card ). + +Signed-off-by: Gabriel Craciunescu +Reviewed-by: Sagi Grimberg +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 19458e85dab34..86763969e7cb0 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3041,6 +3041,9 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x10ec, 0x5762), /* ADATA SX6000LNP */ + .driver_data = NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ { PCI_DEVICE(0x1cc1, 0x8201), /* ADATA SX8200PNP 512GB */ ++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | ++ NVME_QUIRK_IGNORE_DEV_SUBNQN, }, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-am4372-set-memory-bandwidth-limit-for-dispc.patch b/queue-5.3/arm-dts-am4372-set-memory-bandwidth-limit-for-dispc.patch new file mode 100644 index 00000000000..85224918cec --- /dev/null +++ b/queue-5.3/arm-dts-am4372-set-memory-bandwidth-limit-for-dispc.patch @@ -0,0 +1,39 @@ +From d429af4978e3b6ebc4eaa1d281a093954a217d2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 11:54:50 +0300 +Subject: ARM: dts: am4372: Set memory bandwidth limit for DISPC + +From: Peter Ujfalusi + +[ Upstream commit f90ec6cdf674248dcad85bf9af6e064bf472b841 ] + +Set memory bandwidth limit to filter out resolutions above 720p@60Hz to +avoid underflow errors due to the bandwidth needs of higher resolutions. + +am43xx can not provide enough bandwidth to DISPC to correctly handle +'high' resolutions. + +Signed-off-by: Peter Ujfalusi +Signed-off-by: Tomi Valkeinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am4372.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi +index 848e2a8884e2c..14bbc438055fd 100644 +--- a/arch/arm/boot/dts/am4372.dtsi ++++ b/arch/arm/boot/dts/am4372.dtsi +@@ -337,6 +337,8 @@ + ti,hwmods = "dss_dispc"; + clocks = <&disp_clk>; + clock-names = "fck"; ++ ++ max-memory-bandwidth = <230000000>; + }; + + rfbi: rfbi@4832a800 { +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-fix-gpio0-flags-for-am335x-icev2.patch b/queue-5.3/arm-dts-fix-gpio0-flags-for-am335x-icev2.patch new file mode 100644 index 00000000000..dc37d89f15d --- /dev/null +++ b/queue-5.3/arm-dts-fix-gpio0-flags-for-am335x-icev2.patch @@ -0,0 +1,56 @@ +From 19ee4c5d542c993607e795a63d6fc8e44db3cba7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 09:24:28 -0700 +Subject: ARM: dts: Fix gpio0 flags for am335x-icev2 + +From: Tony Lindgren + +[ Upstream commit 4ef5d76b453908f21341e661a9b6f96862f6f589 ] + +The ti,no-idle-on-init and ti,no-reset-on-init flags need to be at +the interconnect target module level for the modules that have it +defined. Otherwise we get the following warnings: + +dts flag should be at module level for ti,no-idle-on-init +dts flag should be at module level for ti,no-reset-on-init + +Fixes: 87fc89ced3a7 ("ARM: dts: am335x: Move l4 child devices to probe them with ti-sysc") +Cc: Lokesh Vutla +Reported-by: Suman Anna +Reviewed-by: Lokesh Vutla +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-icev2.dts | 2 +- + arch/arm/boot/dts/am33xx-l4.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/am335x-icev2.dts b/arch/arm/boot/dts/am335x-icev2.dts +index 18f70b35da4c7..204bccfcc110a 100644 +--- a/arch/arm/boot/dts/am335x-icev2.dts ++++ b/arch/arm/boot/dts/am335x-icev2.dts +@@ -432,7 +432,7 @@ + pinctrl-0 = <&mmc0_pins_default>; + }; + +-&gpio0 { ++&gpio0_target { + /* Do not idle the GPIO used for holding the VTT regulator */ + ti,no-reset-on-init; + ti,no-idle-on-init; +diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi +index 46849d6ecb3e2..1515f4f914999 100644 +--- a/arch/arm/boot/dts/am33xx-l4.dtsi ++++ b/arch/arm/boot/dts/am33xx-l4.dtsi +@@ -127,7 +127,7 @@ + ranges = <0x0 0x5000 0x1000>; + }; + +- target-module@7000 { /* 0x44e07000, ap 14 20.0 */ ++ gpio0_target: target-module@7000 { /* 0x44e07000, ap 14 20.0 */ + compatible = "ti,sysc-omap2", "ti,sysc"; + ti,hwmods = "gpio1"; + reg = <0x7000 0x4>, +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-fix-wrong-clocks-for-dra7-mcasp.patch b/queue-5.3/arm-dts-fix-wrong-clocks-for-dra7-mcasp.patch new file mode 100644 index 00000000000..159b427b434 --- /dev/null +++ b/queue-5.3/arm-dts-fix-wrong-clocks-for-dra7-mcasp.patch @@ -0,0 +1,194 @@ +From ebf28cdf81d47740dd45efed5c5f00c8328ffa0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2019 10:32:38 -0700 +Subject: ARM: dts: Fix wrong clocks for dra7 mcasp + +From: Tony Lindgren + +[ Upstream commit 2d3c8ba3cffa00f76bedb713c8c2126c82d8cd13 ] + +The ahclkr clkctrl clock bit 28 only exists for mcasp 1 and 2 on dra7. +This causes the following warning on beagle-x15: + +ti-sysc 48468000.target-module: could not add child clock ahclkr: -19 + +Also the mcasp clkctrl clock bits are wrong: + +For mcasp1 and 2 we have four clocks at bits 28, 24, 22 and 0: + +bit 28 is ahclkr +bit 24 is ahclkx +bit 22 is auxclk +bit 0 is fck + +For mcasp3 to 8 we have three clocks at bits 24, 22 and 0. + +bit 24 is ahclkx +bit 22 is auxclk +bit 0 is fck + +We do not have currently mapped auxclk at bit 22 for the drivers, that can +be added if needed. + +Fixes: 5241ccbf2819 ("ARM: dts: Add missing ranges for dra7 mcasp l3 ports") +Cc: Suman Anna +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7-l4.dtsi | 48 +++++++++++++++------------------- + 1 file changed, 21 insertions(+), 27 deletions(-) + +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 21e5914fdd620..099d6fe2a57ad 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -2762,7 +2762,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 129 1>, <&edma_xbar 128 1>; + dma-names = "tx", "rx"; +- clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 22>, ++ clocks = <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 0>, + <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>, + <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 28>; + clock-names = "fck", "ahclkx", "ahclkr"; +@@ -2799,8 +2799,8 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 131 1>, <&edma_xbar 130 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 22>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 24>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 0>, ++ <&ipu_clkctrl DRA7_IPU_MCASP1_CLKCTRL 24>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP2_CLKCTRL 28>; + clock-names = "fck", "ahclkx", "ahclkr"; + status = "disabled"; +@@ -2818,9 +2818,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x68000 0x2000>, +@@ -2836,7 +2835,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 133 1>, <&edma_xbar 132 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP3_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +@@ -2854,9 +2853,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x6c000 0x2000>, +@@ -2872,7 +2870,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 135 1>, <&edma_xbar 134 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP4_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +@@ -2890,9 +2888,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x70000 0x2000>, +@@ -2908,7 +2905,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 137 1>, <&edma_xbar 136 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP5_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +@@ -2926,9 +2923,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x74000 0x2000>, +@@ -2944,7 +2940,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 139 1>, <&edma_xbar 138 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP6_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +@@ -2962,9 +2958,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x78000 0x2000>, +@@ -2980,7 +2975,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 141 1>, <&edma_xbar 140 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP7_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +@@ -2998,9 +2993,8 @@ + ; + /* Domains (P, C): l4per_pwrdm, l4per2_clkdm */ + clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>, +- <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 28>; +- clock-names = "fck", "ahclkx", "ahclkr"; ++ <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>; ++ clock-names = "fck", "ahclkx"; + #address-cells = <1>; + #size-cells = <1>; + ranges = <0x0 0x7c000 0x2000>, +@@ -3016,7 +3010,7 @@ + interrupt-names = "tx", "rx"; + dmas = <&edma_xbar 143 1>, <&edma_xbar 142 1>; + dma-names = "tx", "rx"; +- clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 22>, ++ clocks = <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 0>, + <&l4per2_clkctrl DRA7_L4PER2_MCASP8_CLKCTRL 24>; + clock-names = "fck", "ahclkx"; + status = "disabled"; +-- +2.20.1 + diff --git a/queue-5.3/arm-omap2-add-missing-lcdc-midlemode-for-am335x.patch b/queue-5.3/arm-omap2-add-missing-lcdc-midlemode-for-am335x.patch new file mode 100644 index 00000000000..2cbfd5dabda --- /dev/null +++ b/queue-5.3/arm-omap2-add-missing-lcdc-midlemode-for-am335x.patch @@ -0,0 +1,70 @@ +From 53a8efe3a426c5c879fedb60a6c9b80172f82674 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 09:25:51 -0700 +Subject: ARM: OMAP2+: Add missing LCDC midlemode for am335x + +From: Tony Lindgren + +[ Upstream commit 17529d43b21c72466e9109d602c6f5c360a1a9e8 ] + +TRM "Table 13-34. SYSCONFIG Register Field Descriptions" lists both +standbymode and idlemode that should be just the sidle and midle +registers where midle is currently unconfigured for lcdc_sysc. As +the dts data has been generated based on lcdc_sysc, we now have an +empty "ti,sysc-midle" property. + +And so we currently get a warning for lcdc because of a difference +with dts provided configuration compared to the legacy platform +data. This is because lcdc has SYSC_HAS_MIDLEMODE configured in +the platform data without configuring the modes. + +Let's fix the issue by adding the missing midlemode to lcdc_sysc, +and configuring the "ti,sysc-midle" property based on the TRM +values. + +Fixes: f711c575cfec ("ARM: dts: am335x: Add l4 interconnect hierarchy and ti-sysc data") +Cc: Jyri Sarha +Cc: Keerthy +Cc: Robert Nelson +Cc: Suman Anna +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am33xx-l4.dtsi | 4 +++- + arch/arm/mach-omap2/omap_hwmod_33xx_data.c | 5 +++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/am33xx-l4.dtsi b/arch/arm/boot/dts/am33xx-l4.dtsi +index 1515f4f914999..3287cf695b5a4 100644 +--- a/arch/arm/boot/dts/am33xx-l4.dtsi ++++ b/arch/arm/boot/dts/am33xx-l4.dtsi +@@ -2038,7 +2038,9 @@ + reg = <0xe000 0x4>, + <0xe054 0x4>; + reg-names = "rev", "sysc"; +- ti,sysc-midle ; ++ ti,sysc-midle = , ++ , ++ ; + ti,sysc-sidle = , + , + ; +diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c +index c965af275e341..81d9912f17c85 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_33xx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_data.c +@@ -231,8 +231,9 @@ static struct omap_hwmod am33xx_control_hwmod = { + static struct omap_hwmod_class_sysconfig lcdc_sysc = { + .rev_offs = 0x0, + .sysc_offs = 0x54, +- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE), +- .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART), ++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_MIDLEMODE, ++ .idlemodes = SIDLE_FORCE | SIDLE_NO | SIDLE_SMART | ++ MSTANDBY_FORCE | MSTANDBY_NO | MSTANDBY_SMART, + .sysc_fields = &omap_hwmod_sysc_type2, + }; + +-- +2.20.1 + diff --git a/queue-5.3/arm-omap2-fix-missing-reset-done-flag-for-am3-and-am.patch b/queue-5.3/arm-omap2-fix-missing-reset-done-flag-for-am3-and-am.patch new file mode 100644 index 00000000000..5f3a50a14a8 --- /dev/null +++ b/queue-5.3/arm-omap2-fix-missing-reset-done-flag-for-am3-and-am.patch @@ -0,0 +1,53 @@ +From be4b7e0198902d95c58948006237a8d100a52652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 09:25:52 -0700 +Subject: ARM: OMAP2+: Fix missing reset done flag for am3 and am43 + +From: Tony Lindgren + +[ Upstream commit 8ad8041b98c665b6147e607b749586d6e20ba73a ] + +For ti,sysc-omap4 compatible devices with no sysstatus register, we do have +reset done status available in the SOFTRESET bit that clears when the reset +is done. This is documented for example in am437x TRM for DMTIMER_TIOCP_CFG +register. The am335x TRM just says that SOFTRESET bit value 1 means reset is +ongoing, but it behaves the same way clearing after reset is done. + +With the ti-sysc driver handling this automatically based on no sysstatus +register defined, we see warnings if SYSC_HAS_RESET_STATUS is missing in the +legacy platform data: + +ti-sysc 48042000.target-module: sysc_flags 00000222 != 00000022 +ti-sysc 48044000.target-module: sysc_flags 00000222 != 00000022 +ti-sysc 48046000.target-module: sysc_flags 00000222 != 00000022 +... + +Let's fix these warnings by adding SYSC_HAS_RESET_STATUS. Let's also +remove the useless parentheses while at it. + +If it turns out we do have ti,sysc-omap4 compatible devices without a +working SOFTRESET bit we can set up additional quirk handling for it. + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c +index adb6271f819be..7773876d165f1 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c +@@ -811,7 +811,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = { + .rev_offs = 0x0000, + .sysc_offs = 0x0010, + .syss_offs = 0x0014, +- .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET), ++ .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET | ++ SYSC_HAS_RESET_STATUS, + .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART | + SIDLE_SMART_WKUP), + .sysc_fields = &omap_hwmod_sysc_type2, +-- +2.20.1 + diff --git a/queue-5.3/arm-omap2-fix-warnings-with-broken-omap2_set_init_vo.patch b/queue-5.3/arm-omap2-fix-warnings-with-broken-omap2_set_init_vo.patch new file mode 100644 index 00000000000..ec890b4e259 --- /dev/null +++ b/queue-5.3/arm-omap2-fix-warnings-with-broken-omap2_set_init_vo.patch @@ -0,0 +1,172 @@ +From bfe0f6387c0a3cd6aa146d5c7a4d3363a8418dd3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 16:19:00 -0700 +Subject: ARM: OMAP2+: Fix warnings with broken omap2_set_init_voltage() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Tony Lindgren + +[ Upstream commit cf395f7ddb9ebc6b2d28d83b53d18aa4e7c19701 ] + +This code is currently unable to find the dts opp tables as ti-cpufreq +needs to set them up first based on speed binning. + +We stopped initializing the opp tables with platform code years ago for +device tree based booting with commit 92d51856d740 ("ARM: OMAP3+: do not +register non-dt OPP tables for device tree boot"), and all of mach-omap2 +is now booting using device tree. + +We currently get the following errors on init: + +omap2_set_init_voltage: unable to find boot up OPP for vdd_mpu +omap2_set_init_voltage: unable to set vdd_mpu +omap2_set_init_voltage: unable to find boot up OPP for vdd_core +omap2_set_init_voltage: unable to set vdd_core +omap2_set_init_voltage: unable to find boot up OPP for vdd_iva +omap2_set_init_voltage: unable to set vdd_iva + +Let's just drop the unused code. Nowadays ti-cpufreq should be used to +to initialize things properly. + +Cc: Adam Ford +Cc: André Roth +Cc: "H. Nikolaus Schaller" +Cc: Nishanth Menon +Cc: Tero Kristo +Tested-by: Adam Ford #logicpd-torpedo-37xx-devkit +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/pm.c | 100 --------------------------------------- + 1 file changed, 100 deletions(-) + +diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c +index 1fde1bf53fb65..7ac9af56762df 100644 +--- a/arch/arm/mach-omap2/pm.c ++++ b/arch/arm/mach-omap2/pm.c +@@ -74,83 +74,6 @@ int omap_pm_clkdms_setup(struct clockdomain *clkdm, void *unused) + return 0; + } + +-/* +- * This API is to be called during init to set the various voltage +- * domains to the voltage as per the opp table. Typically we boot up +- * at the nominal voltage. So this function finds out the rate of +- * the clock associated with the voltage domain, finds out the correct +- * opp entry and sets the voltage domain to the voltage specified +- * in the opp entry +- */ +-static int __init omap2_set_init_voltage(char *vdd_name, char *clk_name, +- const char *oh_name) +-{ +- struct voltagedomain *voltdm; +- struct clk *clk; +- struct dev_pm_opp *opp; +- unsigned long freq, bootup_volt; +- struct device *dev; +- +- if (!vdd_name || !clk_name || !oh_name) { +- pr_err("%s: invalid parameters\n", __func__); +- goto exit; +- } +- +- if (!strncmp(oh_name, "mpu", 3)) +- /* +- * All current OMAPs share voltage rail and clock +- * source, so CPU0 is used to represent the MPU-SS. +- */ +- dev = get_cpu_device(0); +- else +- dev = omap_device_get_by_hwmod_name(oh_name); +- +- if (IS_ERR(dev)) { +- pr_err("%s: Unable to get dev pointer for hwmod %s\n", +- __func__, oh_name); +- goto exit; +- } +- +- voltdm = voltdm_lookup(vdd_name); +- if (!voltdm) { +- pr_err("%s: unable to get vdd pointer for vdd_%s\n", +- __func__, vdd_name); +- goto exit; +- } +- +- clk = clk_get(NULL, clk_name); +- if (IS_ERR(clk)) { +- pr_err("%s: unable to get clk %s\n", __func__, clk_name); +- goto exit; +- } +- +- freq = clk_get_rate(clk); +- clk_put(clk); +- +- opp = dev_pm_opp_find_freq_ceil(dev, &freq); +- if (IS_ERR(opp)) { +- pr_err("%s: unable to find boot up OPP for vdd_%s\n", +- __func__, vdd_name); +- goto exit; +- } +- +- bootup_volt = dev_pm_opp_get_voltage(opp); +- dev_pm_opp_put(opp); +- +- if (!bootup_volt) { +- pr_err("%s: unable to find voltage corresponding to the bootup OPP for vdd_%s\n", +- __func__, vdd_name); +- goto exit; +- } +- +- voltdm_scale(voltdm, bootup_volt); +- return 0; +- +-exit: +- pr_err("%s: unable to set vdd_%s\n", __func__, vdd_name); +- return -EINVAL; +-} +- + #ifdef CONFIG_SUSPEND + static int omap_pm_enter(suspend_state_t suspend_state) + { +@@ -208,25 +131,6 @@ void omap_common_suspend_init(void *pm_suspend) + } + #endif /* CONFIG_SUSPEND */ + +-static void __init omap3_init_voltages(void) +-{ +- if (!soc_is_omap34xx()) +- return; +- +- omap2_set_init_voltage("mpu_iva", "dpll1_ck", "mpu"); +- omap2_set_init_voltage("core", "l3_ick", "l3_main"); +-} +- +-static void __init omap4_init_voltages(void) +-{ +- if (!soc_is_omap44xx()) +- return; +- +- omap2_set_init_voltage("mpu", "dpll_mpu_ck", "mpu"); +- omap2_set_init_voltage("core", "l3_div_ck", "l3_main_1"); +- omap2_set_init_voltage("iva", "dpll_iva_m5x2_ck", "iva"); +-} +- + int __maybe_unused omap_pm_nop_init(void) + { + return 0; +@@ -246,10 +150,6 @@ int __init omap2_common_pm_late_init(void) + omap4_twl_init(); + omap_voltage_late_init(); + +- /* Initialize the voltages */ +- omap3_init_voltages(); +- omap4_init_voltages(); +- + /* Smartreflex device init */ + omap_devinit_smartreflex(); + +-- +2.20.1 + diff --git a/queue-5.3/blk-mq-honor-io-scheduler-for-multiqueue-devices.patch b/queue-5.3/blk-mq-honor-io-scheduler-for-multiqueue-devices.patch new file mode 100644 index 00000000000..8562a693d3c --- /dev/null +++ b/queue-5.3/blk-mq-honor-io-scheduler-for-multiqueue-devices.patch @@ -0,0 +1,61 @@ +From 3bb8a6691771a2166df9a095360822a8578affb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 15:24:30 +0800 +Subject: blk-mq: honor IO scheduler for multiqueue devices +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ming Lei + +[ Upstream commit a12de1d42d74ef3c80e9fb9a2da94daaef747869 ] + +If a device is using multiple queues, the IO scheduler may be bypassed. +This may hurt performance for some slow MQ devices, and it also breaks +zoned devices which depend on mq-deadline for respecting the write order +in one zone. + +Don't bypass io scheduler if we have one setup. + +This patch can double sequential write performance basically on MQ +scsi_debug when mq-deadline is applied. + +Cc: Bart Van Assche +Cc: Hannes Reinecke +Cc: Dave Chinner +Reviewed-by: Javier González +Reviewed-by: Damien Le Moal +Signed-off-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index a79b9ad1aba18..ed41cde93641c 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1998,6 +1998,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + } + + blk_add_rq_to_plug(plug, rq); ++ } else if (q->elevator) { ++ blk_mq_sched_insert_request(rq, false, true, true); + } else if (plug && !blk_queue_nomerges(q)) { + /* + * We do limited plugging. If the bio can be merged, do that. +@@ -2021,8 +2023,8 @@ static blk_qc_t blk_mq_make_request(struct request_queue *q, struct bio *bio) + blk_mq_try_issue_directly(data.hctx, same_queue_rq, + &cookie); + } +- } else if ((q->nr_hw_queues > 1 && is_sync) || (!q->elevator && +- !data.hctx->dispatch_busy)) { ++ } else if ((q->nr_hw_queues > 1 && is_sync) || ++ !data.hctx->dispatch_busy) { + blk_mq_try_issue_directly(data.hctx, rq, &cookie); + } else { + blk_mq_sched_insert_request(rq, false, true, true); +-- +2.20.1 + diff --git a/queue-5.3/clk-ti-dra7-fix-mcasp8-clock-bits.patch b/queue-5.3/clk-ti-dra7-fix-mcasp8-clock-bits.patch new file mode 100644 index 00000000000..889f52c0499 --- /dev/null +++ b/queue-5.3/clk-ti-dra7-fix-mcasp8-clock-bits.patch @@ -0,0 +1,53 @@ +From 49b172a770499fc9392d93e5bd95a20ba6f0b69e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2019 10:32:37 -0700 +Subject: clk: ti: dra7: Fix mcasp8 clock bits + +From: Tony Lindgren + +[ Upstream commit dd8882a255388ba66175098b1560d4f81c100d30 ] + +There's a typo for dra7 mcasp clkctrl bit, it should be 22 like the other +macasp instances, and not 24. And in dra7xx_clks[] we have the bits wrong +way around. + +Fixes: dffa9051d546 ("clk: ti: dra7: add new clkctrl data") +Cc: linux-clk@vger.kernel.org +Cc: Michael Turquette +Cc: Stephen Boyd +Cc: Suman Anna +Cc: Tero Kristo +Acked-by: Stephen Boyd +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-7xx.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/ti/clk-7xx.c b/drivers/clk/ti/clk-7xx.c +index b57fe09b428be..9dd6185a4b4e2 100644 +--- a/drivers/clk/ti/clk-7xx.c ++++ b/drivers/clk/ti/clk-7xx.c +@@ -683,7 +683,7 @@ static const struct omap_clkctrl_reg_data dra7_l4per2_clkctrl_regs[] __initconst + { DRA7_L4PER2_MCASP2_CLKCTRL, dra7_mcasp2_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0154:22" }, + { DRA7_L4PER2_MCASP3_CLKCTRL, dra7_mcasp3_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:015c:22" }, + { DRA7_L4PER2_MCASP5_CLKCTRL, dra7_mcasp5_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:016c:22" }, +- { DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:24" }, ++ { DRA7_L4PER2_MCASP8_CLKCTRL, dra7_mcasp8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:0184:22" }, + { DRA7_L4PER2_MCASP4_CLKCTRL, dra7_mcasp4_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:018c:22" }, + { DRA7_L4PER2_UART7_CLKCTRL, dra7_uart7_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01c4:24" }, + { DRA7_L4PER2_UART8_CLKCTRL, dra7_uart8_bit_data, CLKF_SW_SUP, "l4per2-clkctrl:01d4:24" }, +@@ -828,8 +828,8 @@ static struct ti_dt_clk dra7xx_clks[] = { + DT_CLK(NULL, "mcasp6_aux_gfclk_mux", "l4per2-clkctrl:01f8:22"), + DT_CLK(NULL, "mcasp7_ahclkx_mux", "l4per2-clkctrl:01fc:24"), + DT_CLK(NULL, "mcasp7_aux_gfclk_mux", "l4per2-clkctrl:01fc:22"), +- DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:22"), +- DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:24"), ++ DT_CLK(NULL, "mcasp8_ahclkx_mux", "l4per2-clkctrl:0184:24"), ++ DT_CLK(NULL, "mcasp8_aux_gfclk_mux", "l4per2-clkctrl:0184:22"), + DT_CLK(NULL, "mmc1_clk32k", "l3init-clkctrl:0008:8"), + DT_CLK(NULL, "mmc1_fclk_div", "l3init-clkctrl:0008:25"), + DT_CLK(NULL, "mmc1_fclk_mux", "l3init-clkctrl:0008:24"), +-- +2.20.1 + diff --git a/queue-5.3/convert-filldir-64-from-__put_user-to-unsafe_put_use.patch b/queue-5.3/convert-filldir-64-from-__put_user-to-unsafe_put_use.patch new file mode 100644 index 00000000000..140f2260644 --- /dev/null +++ b/queue-5.3/convert-filldir-64-from-__put_user-to-unsafe_put_use.patch @@ -0,0 +1,207 @@ +From 29d7cc8d183c55049640424456473c240a81fea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 May 2016 21:59:07 -0700 +Subject: Convert filldir[64]() from __put_user() to unsafe_put_user() + +From: Linus Torvalds + +[ Upstream commit 9f79b78ef74436c7507bac6bfb7b8b989263bccb ] + +We really should avoid the "__{get,put}_user()" functions entirely, +because they can easily be mis-used and the original intent of being +used for simple direct user accesses no longer holds in a post-SMAP/PAN +world. + +Manually optimizing away the user access range check makes no sense any +more, when the range check is generally much cheaper than the "enable +user accesses" code that the __{get,put}_user() functions still need. + +So instead of __put_user(), use the unsafe_put_user() interface with +user_access_{begin,end}() that really does generate better code these +days, and which is generally a nicer interface. Under some loads, the +multiple user writes that filldir() does are actually quite noticeable. + +This also makes the dirent name copy use unsafe_put_user() with a couple +of macros. We do not want to make function calls with SMAP/PAN +disabled, and the code this generates is quite good when the +architecture uses "asm goto" for unsafe_put_user() like x86 does. + +Note that this doesn't bother with the legacy cases. Nobody should use +them anyway, so performance doesn't really matter there. + +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/readdir.c | 128 +++++++++++++++++++++++++++++++++++++-------------- + 1 file changed, 93 insertions(+), 35 deletions(-) + +diff --git a/fs/readdir.c b/fs/readdir.c +index 2f6a4534e0dfe..579c8ea894ae3 100644 +--- a/fs/readdir.c ++++ b/fs/readdir.c +@@ -20,9 +20,63 @@ + #include + #include + #include +- + #include + ++#include ++ ++/* ++ * Note the "unsafe_put_user() semantics: we goto a ++ * label for errors. ++ * ++ * Also note how we use a "while()" loop here, even though ++ * only the biggest size needs to loop. The compiler (well, ++ * at least gcc) is smart enough to turn the smaller sizes ++ * into just if-statements, and this way we don't need to ++ * care whether 'u64' or 'u32' is the biggest size. ++ */ ++#define unsafe_copy_loop(dst, src, len, type, label) \ ++ while (len >= sizeof(type)) { \ ++ unsafe_put_user(get_unaligned((type *)src), \ ++ (type __user *)dst, label); \ ++ dst += sizeof(type); \ ++ src += sizeof(type); \ ++ len -= sizeof(type); \ ++ } ++ ++/* ++ * We avoid doing 64-bit copies on 32-bit architectures. They ++ * might be better, but the component names are mostly small, ++ * and the 64-bit cases can end up being much more complex and ++ * put much more register pressure on the code, so it's likely ++ * not worth the pain of unaligned accesses etc. ++ * ++ * So limit the copies to "unsigned long" size. I did verify ++ * that at least the x86-32 case is ok without this limiting, ++ * but I worry about random other legacy 32-bit cases that ++ * might not do as well. ++ */ ++#define unsafe_copy_type(dst, src, len, type, label) do { \ ++ if (sizeof(type) <= sizeof(unsigned long)) \ ++ unsafe_copy_loop(dst, src, len, type, label); \ ++} while (0) ++ ++/* ++ * Copy the dirent name to user space, and NUL-terminate ++ * it. This should not be a function call, since we're doing ++ * the copy inside a "user_access_begin/end()" section. ++ */ ++#define unsafe_copy_dirent_name(_dst, _src, _len, label) do { \ ++ char __user *dst = (_dst); \ ++ const char *src = (_src); \ ++ size_t len = (_len); \ ++ unsafe_copy_type(dst, src, len, u64, label); \ ++ unsafe_copy_type(dst, src, len, u32, label); \ ++ unsafe_copy_type(dst, src, len, u16, label); \ ++ unsafe_copy_type(dst, src, len, u8, label); \ ++ unsafe_put_user(0, dst, label); \ ++} while (0) ++ ++ + int iterate_dir(struct file *file, struct dir_context *ctx) + { + struct inode *inode = file_inode(file); +@@ -182,28 +236,31 @@ static int filldir(struct dir_context *ctx, const char *name, int namlen, + return -EOVERFLOW; + } + dirent = buf->previous; +- if (dirent) { +- if (signal_pending(current)) +- return -EINTR; +- if (__put_user(offset, &dirent->d_off)) +- goto efault; +- } +- dirent = buf->current_dir; +- if (__put_user(d_ino, &dirent->d_ino)) +- goto efault; +- if (__put_user(reclen, &dirent->d_reclen)) +- goto efault; +- if (copy_to_user(dirent->d_name, name, namlen)) +- goto efault; +- if (__put_user(0, dirent->d_name + namlen)) +- goto efault; +- if (__put_user(d_type, (char __user *) dirent + reclen - 1)) ++ if (dirent && signal_pending(current)) ++ return -EINTR; ++ ++ /* ++ * Note! This range-checks 'previous' (which may be NULL). ++ * The real range was checked in getdents ++ */ ++ if (!user_access_begin(dirent, sizeof(*dirent))) + goto efault; ++ if (dirent) ++ unsafe_put_user(offset, &dirent->d_off, efault_end); ++ dirent = buf->current_dir; ++ unsafe_put_user(d_ino, &dirent->d_ino, efault_end); ++ unsafe_put_user(reclen, &dirent->d_reclen, efault_end); ++ unsafe_put_user(d_type, (char __user *) dirent + reclen - 1, efault_end); ++ unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); ++ user_access_end(); ++ + buf->previous = dirent; + dirent = (void __user *)dirent + reclen; + buf->current_dir = dirent; + buf->count -= reclen; + return 0; ++efault_end: ++ user_access_end(); + efault: + buf->error = -EFAULT; + return -EFAULT; +@@ -263,30 +320,31 @@ static int filldir64(struct dir_context *ctx, const char *name, int namlen, + if (reclen > buf->count) + return -EINVAL; + dirent = buf->previous; +- if (dirent) { +- if (signal_pending(current)) +- return -EINTR; +- if (__put_user(offset, &dirent->d_off)) +- goto efault; +- } +- dirent = buf->current_dir; +- if (__put_user(ino, &dirent->d_ino)) +- goto efault; +- if (__put_user(0, &dirent->d_off)) +- goto efault; +- if (__put_user(reclen, &dirent->d_reclen)) +- goto efault; +- if (__put_user(d_type, &dirent->d_type)) +- goto efault; +- if (copy_to_user(dirent->d_name, name, namlen)) +- goto efault; +- if (__put_user(0, dirent->d_name + namlen)) ++ if (dirent && signal_pending(current)) ++ return -EINTR; ++ ++ /* ++ * Note! This range-checks 'previous' (which may be NULL). ++ * The real range was checked in getdents ++ */ ++ if (!user_access_begin(dirent, sizeof(*dirent))) + goto efault; ++ if (dirent) ++ unsafe_put_user(offset, &dirent->d_off, efault_end); ++ dirent = buf->current_dir; ++ unsafe_put_user(ino, &dirent->d_ino, efault_end); ++ unsafe_put_user(reclen, &dirent->d_reclen, efault_end); ++ unsafe_put_user(d_type, &dirent->d_type, efault_end); ++ unsafe_copy_dirent_name(dirent->d_name, name, namlen, efault_end); ++ user_access_end(); ++ + buf->previous = dirent; + dirent = (void __user *)dirent + reclen; + buf->current_dir = dirent; + buf->count -= reclen; + return 0; ++efault_end: ++ user_access_end(); + efault: + buf->error = -EFAULT; + return -EFAULT; +-- +2.20.1 + diff --git a/queue-5.3/drm-amd-display-memory-leak.patch b/queue-5.3/drm-amd-display-memory-leak.patch new file mode 100644 index 00000000000..5194e071bf4 --- /dev/null +++ b/queue-5.3/drm-amd-display-memory-leak.patch @@ -0,0 +1,112 @@ +From 799b6e85606d872eaa3cb00bf81dea4c2a33e420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 22:20:44 -0500 +Subject: drm/amd/display: memory leak + +From: Navid Emamdoost + +[ Upstream commit 055e547478a11a6360c7ce05e2afc3e366968a12 ] + +In dcn*_clock_source_create when dcn20_clk_src_construct fails allocated +clk_src needs release. + +Signed-off-by: Navid Emamdoost +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c | 1 + + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 1 + + 7 files changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +index 6248c84553140..45f74219e79ed 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce100/dce100_resource.c +@@ -668,6 +668,7 @@ struct clock_source *dce100_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c +index 764329264c3b4..0cb83b0e0e1ee 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_resource.c +@@ -714,6 +714,7 @@ struct clock_source *dce110_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c +index 7a04be74c9cf9..918455caa9a61 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce112/dce112_resource.c +@@ -687,6 +687,7 @@ struct clock_source *dce112_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c +index ae38c9c7277cf..49f3f0fad7633 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce120/dce120_resource.c +@@ -500,6 +500,7 @@ static struct clock_source *dce120_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c +index 860a524ebcfab..952440893fbb3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dce80/dce80_resource.c +@@ -701,6 +701,7 @@ struct clock_source *dce80_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +index a12530a3ab9ca..3f25e8da5396a 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_resource.c +@@ -786,6 +786,7 @@ struct clock_source *dcn10_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index b949e202d6cb7..5b7ff6c549f18 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -955,6 +955,7 @@ struct clock_source *dcn20_clock_source_create( + return &clk_src->base; + } + ++ kfree(clk_src); + BREAK_TO_DEBUGGER(); + return NULL; + } +-- +2.20.1 + diff --git a/queue-5.3/drm-amdgpu-fix-multiple-memory-leaks-in-acp_hw_init.patch b/queue-5.3/drm-amdgpu-fix-multiple-memory-leaks-in-acp_hw_init.patch new file mode 100644 index 00000000000..37c49a9856f --- /dev/null +++ b/queue-5.3/drm-amdgpu-fix-multiple-memory-leaks-in-acp_hw_init.patch @@ -0,0 +1,125 @@ +From 61df336468074da0784bd5aade25476fd977e2d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 22:46:07 -0500 +Subject: drm/amdgpu: fix multiple memory leaks in acp_hw_init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Navid Emamdoost + +[ Upstream commit 57be09c6e8747bf48704136d9e3f92bfb93f5725 ] + +In acp_hw_init there are some allocations that needs to be released in +case of failure: + +1- adev->acp.acp_genpd should be released if any allocation attemp for +adev->acp.acp_cell, adev->acp.acp_res or i2s_pdata fails. +2- all of those allocations should be released if +mfd_add_hotplug_devices or pm_genpd_add_device fail. +3- Release is needed in case of time out values expire. + +Reviewed-by: Christian König +Signed-off-by: Navid Emamdoost +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c | 34 ++++++++++++++++--------- + 1 file changed, 22 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +index eba42c752bca3..82155ac3288a0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acp.c +@@ -189,7 +189,7 @@ static int acp_hw_init(void *handle) + u32 val = 0; + u32 count = 0; + struct device *dev; +- struct i2s_platform_data *i2s_pdata; ++ struct i2s_platform_data *i2s_pdata = NULL; + + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + +@@ -231,20 +231,21 @@ static int acp_hw_init(void *handle) + adev->acp.acp_cell = kcalloc(ACP_DEVS, sizeof(struct mfd_cell), + GFP_KERNEL); + +- if (adev->acp.acp_cell == NULL) +- return -ENOMEM; ++ if (adev->acp.acp_cell == NULL) { ++ r = -ENOMEM; ++ goto failure; ++ } + + adev->acp.acp_res = kcalloc(5, sizeof(struct resource), GFP_KERNEL); + if (adev->acp.acp_res == NULL) { +- kfree(adev->acp.acp_cell); +- return -ENOMEM; ++ r = -ENOMEM; ++ goto failure; + } + + i2s_pdata = kcalloc(3, sizeof(struct i2s_platform_data), GFP_KERNEL); + if (i2s_pdata == NULL) { +- kfree(adev->acp.acp_res); +- kfree(adev->acp.acp_cell); +- return -ENOMEM; ++ r = -ENOMEM; ++ goto failure; + } + + switch (adev->asic_type) { +@@ -341,14 +342,14 @@ static int acp_hw_init(void *handle) + r = mfd_add_hotplug_devices(adev->acp.parent, adev->acp.acp_cell, + ACP_DEVS); + if (r) +- return r; ++ goto failure; + + for (i = 0; i < ACP_DEVS ; i++) { + dev = get_mfd_cell_dev(adev->acp.acp_cell[i].name, i); + r = pm_genpd_add_device(&adev->acp.acp_genpd->gpd, dev); + if (r) { + dev_err(dev, "Failed to add dev to genpd\n"); +- return r; ++ goto failure; + } + } + +@@ -367,7 +368,8 @@ static int acp_hw_init(void *handle) + break; + if (--count == 0) { + dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); +- return -ETIMEDOUT; ++ r = -ETIMEDOUT; ++ goto failure; + } + udelay(100); + } +@@ -384,7 +386,8 @@ static int acp_hw_init(void *handle) + break; + if (--count == 0) { + dev_err(&adev->pdev->dev, "Failed to reset ACP\n"); +- return -ETIMEDOUT; ++ r = -ETIMEDOUT; ++ goto failure; + } + udelay(100); + } +@@ -393,6 +396,13 @@ static int acp_hw_init(void *handle) + val &= ~ACP_SOFT_RESET__SoftResetAud_MASK; + cgs_write_register(adev->acp.cgs_device, mmACP_SOFT_RESET, val); + return 0; ++ ++failure: ++ kfree(i2s_pdata); ++ kfree(adev->acp.acp_res); ++ kfree(adev->acp.acp_cell); ++ kfree(adev->acp.acp_genpd); ++ return r; + } + + /** +-- +2.20.1 + diff --git a/queue-5.3/drm-clear-the-fence-pointer-when-writeback-job-signa.patch b/queue-5.3/drm-clear-the-fence-pointer-when-writeback-job-signa.patch new file mode 100644 index 00000000000..398091f6867 --- /dev/null +++ b/queue-5.3/drm-clear-the-fence-pointer-when-writeback-job-signa.patch @@ -0,0 +1,79 @@ +From 5680a63777add46b6ff725c6ef800b926facab35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 11:04:45 +0000 +Subject: drm: Clear the fence pointer when writeback job signaled + +From: Lowry Li (Arm Technology China) + +[ Upstream commit b1066a123538044117f0a78ba8c6a50cf5a04c86 ] + +During it signals the completion of a writeback job, after releasing +the out_fence, we'd clear the pointer. + +Check if fence left over in drm_writeback_cleanup_job(), release it. + +Signed-off-by: Lowry Li (Arm Technology China) +Reviewed-by: Brian Starkey +Reviewed-by: James Qian Wang (Arm Technology China) +Signed-off-by: james qian wang (Arm Technology China) +Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-3-git-send-email-lowry.li@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_writeback.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c +index ff138b6ec48ba..43d9e3bb3a943 100644 +--- a/drivers/gpu/drm/drm_writeback.c ++++ b/drivers/gpu/drm/drm_writeback.c +@@ -324,6 +324,9 @@ void drm_writeback_cleanup_job(struct drm_writeback_job *job) + if (job->fb) + drm_framebuffer_put(job->fb); + ++ if (job->out_fence) ++ dma_fence_put(job->out_fence); ++ + kfree(job); + } + EXPORT_SYMBOL(drm_writeback_cleanup_job); +@@ -366,25 +369,29 @@ drm_writeback_signal_completion(struct drm_writeback_connector *wb_connector, + { + unsigned long flags; + struct drm_writeback_job *job; ++ struct dma_fence *out_fence; + + spin_lock_irqsave(&wb_connector->job_lock, flags); + job = list_first_entry_or_null(&wb_connector->job_queue, + struct drm_writeback_job, + list_entry); +- if (job) { ++ if (job) + list_del(&job->list_entry); +- if (job->out_fence) { +- if (status) +- dma_fence_set_error(job->out_fence, status); +- dma_fence_signal(job->out_fence); +- dma_fence_put(job->out_fence); +- } +- } ++ + spin_unlock_irqrestore(&wb_connector->job_lock, flags); + + if (WARN_ON(!job)) + return; + ++ out_fence = job->out_fence; ++ if (out_fence) { ++ if (status) ++ dma_fence_set_error(out_fence, status); ++ dma_fence_signal(out_fence); ++ dma_fence_put(out_fence); ++ job->out_fence = NULL; ++ } ++ + INIT_WORK(&job->cleanup_work, cleanup_work); + queue_work(system_long_wq, &job->cleanup_work); + } +-- +2.20.1 + diff --git a/queue-5.3/drm-free-the-writeback_job-when-it-with-an-empty-fb.patch b/queue-5.3/drm-free-the-writeback_job-when-it-with-an-empty-fb.patch new file mode 100644 index 00000000000..fffa54ef06e --- /dev/null +++ b/queue-5.3/drm-free-the-writeback_job-when-it-with-an-empty-fb.patch @@ -0,0 +1,138 @@ +From c315cd08ccfccc653687508ea6f59b94975f4085 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Jul 2019 11:04:38 +0000 +Subject: drm: Free the writeback_job when it with an empty fb + +From: Lowry Li (Arm Technology China) + +[ Upstream commit 8581d51055a08cc6eb061c8856062290e8582ce4 ] + +Adds the check if the writeback_job with an empty fb, then it should +be freed in atomic_check phase. + +With this change, the driver users will not check empty fb case any more. +So refined accordingly. + +Signed-off-by: Lowry Li (Arm Technology China) +Reviewed-by: Liviu Dudau +Reviewed-by: James Qian Wang (Arm Technology China) +Signed-off-by: james qian wang (Arm Technology China) +Link: https://patchwork.freedesktop.org/patch/msgid/1564571048-15029-2-git-send-email-lowry.li@arm.com +Signed-off-by: Sasha Levin +--- + .../drm/arm/display/komeda/komeda_wb_connector.c | 3 +-- + drivers/gpu/drm/arm/malidp_mw.c | 4 ++-- + drivers/gpu/drm/drm_atomic.c | 13 +++++++++---- + drivers/gpu/drm/rcar-du/rcar_du_writeback.c | 4 ++-- + drivers/gpu/drm/vc4/vc4_txp.c | 5 ++--- + 5 files changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c +index 2851cac94d869..23fbee268119f 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c +@@ -43,9 +43,8 @@ komeda_wb_encoder_atomic_check(struct drm_encoder *encoder, + struct komeda_data_flow_cfg dflow; + int err; + +- if (!writeback_job || !writeback_job->fb) { ++ if (!writeback_job) + return 0; +- } + + if (!crtc_st->active) { + DRM_DEBUG_ATOMIC("Cannot write the composition result out on a inactive CRTC.\n"); +diff --git a/drivers/gpu/drm/arm/malidp_mw.c b/drivers/gpu/drm/arm/malidp_mw.c +index 2e812525025dd..a59227b2cdb55 100644 +--- a/drivers/gpu/drm/arm/malidp_mw.c ++++ b/drivers/gpu/drm/arm/malidp_mw.c +@@ -130,7 +130,7 @@ malidp_mw_encoder_atomic_check(struct drm_encoder *encoder, + struct drm_framebuffer *fb; + int i, n_planes; + +- if (!conn_state->writeback_job || !conn_state->writeback_job->fb) ++ if (!conn_state->writeback_job) + return 0; + + fb = conn_state->writeback_job->fb; +@@ -247,7 +247,7 @@ void malidp_mw_atomic_commit(struct drm_device *drm, + + mw_state = to_mw_state(conn_state); + +- if (conn_state->writeback_job && conn_state->writeback_job->fb) { ++ if (conn_state->writeback_job) { + struct drm_framebuffer *fb = conn_state->writeback_job->fb; + + DRM_DEV_DEBUG_DRIVER(drm->dev, +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 419381abbdd16..14aeaf7363210 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -430,10 +430,15 @@ static int drm_atomic_connector_check(struct drm_connector *connector, + return -EINVAL; + } + +- if (writeback_job->out_fence && !writeback_job->fb) { +- DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n", +- connector->base.id, connector->name); +- return -EINVAL; ++ if (!writeback_job->fb) { ++ if (writeback_job->out_fence) { ++ DRM_DEBUG_ATOMIC("[CONNECTOR:%d:%s] requesting out-fence without framebuffer\n", ++ connector->base.id, connector->name); ++ return -EINVAL; ++ } ++ ++ drm_writeback_cleanup_job(writeback_job); ++ state->writeback_job = NULL; + } + + return 0; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c +index ae07290bba6a4..04efa78d70b6e 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_writeback.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_writeback.c +@@ -147,7 +147,7 @@ static int rcar_du_wb_enc_atomic_check(struct drm_encoder *encoder, + struct drm_device *dev = encoder->dev; + struct drm_framebuffer *fb; + +- if (!conn_state->writeback_job || !conn_state->writeback_job->fb) ++ if (!conn_state->writeback_job) + return 0; + + fb = conn_state->writeback_job->fb; +@@ -221,7 +221,7 @@ void rcar_du_writeback_setup(struct rcar_du_crtc *rcrtc, + unsigned int i; + + state = rcrtc->writeback.base.state; +- if (!state || !state->writeback_job || !state->writeback_job->fb) ++ if (!state || !state->writeback_job) + return; + + fb = state->writeback_job->fb; +diff --git a/drivers/gpu/drm/vc4/vc4_txp.c b/drivers/gpu/drm/vc4/vc4_txp.c +index 96f91c1b4b6e6..e92fa12750343 100644 +--- a/drivers/gpu/drm/vc4/vc4_txp.c ++++ b/drivers/gpu/drm/vc4/vc4_txp.c +@@ -229,7 +229,7 @@ static int vc4_txp_connector_atomic_check(struct drm_connector *conn, + int i; + + conn_state = drm_atomic_get_new_connector_state(state, conn); +- if (!conn_state->writeback_job || !conn_state->writeback_job->fb) ++ if (!conn_state->writeback_job) + return 0; + + crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc); +@@ -269,8 +269,7 @@ static void vc4_txp_connector_atomic_commit(struct drm_connector *conn, + u32 ctrl; + int i; + +- if (WARN_ON(!conn_state->writeback_job || +- !conn_state->writeback_job->fb)) ++ if (WARN_ON(!conn_state->writeback_job)) + return; + + mode = &conn_state->crtc->state->adjusted_mode; +-- +2.20.1 + diff --git a/queue-5.3/drm-komeda-prevent-memory-leak-in-komeda_wb_connecto.patch b/queue-5.3/drm-komeda-prevent-memory-leak-in-komeda_wb_connecto.patch new file mode 100644 index 00000000000..b346cd051b0 --- /dev/null +++ b/queue-5.3/drm-komeda-prevent-memory-leak-in-komeda_wb_connecto.patch @@ -0,0 +1,40 @@ +From cedd7f21589a279c680be909d5408054544c7c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 23:30:30 -0500 +Subject: drm/komeda: prevent memory leak in komeda_wb_connector_add + +From: Navid Emamdoost + +[ Upstream commit a0ecd6fdbf5d648123a7315c695fb6850d702835 ] + +In komeda_wb_connector_add if drm_writeback_connector_init fails the +allocated memory for kwb_conn should be released. + +Signed-off-by: Navid Emamdoost +Reviewed-by: James Qian Wang (Arm Technology China) +Signed-off-by: james qian wang (Arm Technology China) +Link: https://patchwork.freedesktop.org/patch/msgid/20190925043031.32308-1-navid.emamdoost@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c +index 23fbee268119f..b72840c06ab76 100644 +--- a/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c ++++ b/drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c +@@ -165,8 +165,10 @@ static int komeda_wb_connector_add(struct komeda_kms_dev *kms, + &komeda_wb_encoder_helper_funcs, + formats, n_formats); + komeda_put_fourcc_list(formats); +- if (err) ++ if (err) { ++ kfree(kwb_conn); + return err; ++ } + + drm_connector_helper_add(&wb_conn->base, &komeda_wb_conn_helper_funcs); + +-- +2.20.1 + diff --git a/queue-5.3/elf-don-t-use-map_fixed_noreplace-for-elf-executable.patch b/queue-5.3/elf-don-t-use-map_fixed_noreplace-for-elf-executable.patch new file mode 100644 index 00000000000..28ca181733f --- /dev/null +++ b/queue-5.3/elf-don-t-use-map_fixed_noreplace-for-elf-executable.patch @@ -0,0 +1,106 @@ +From bf90247e7e05abd26e9cece3b348e140c385e4f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Oct 2019 13:53:27 -0700 +Subject: elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings + +From: Linus Torvalds + +[ Upstream commit b212921b13bda088a004328457c5c21458262fe2 ] + +In commit 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map") we +changed elf to use MAP_FIXED_NOREPLACE instead of MAP_FIXED for the +executable mappings. + +Then, people reported that it broke some binaries that had overlapping +segments from the same file, and commit ad55eac74f20 ("elf: enforce +MAP_FIXED on overlaying elf segments") re-instated MAP_FIXED for some +overlaying elf segment cases. But only some - despite the summary line +of that commit, it only did it when it also does a temporary brk vma for +one obvious overlapping case. + +Now Russell King reports another overlapping case with old 32-bit x86 +binaries, which doesn't trigger that limited case. End result: we had +better just drop MAP_FIXED_NOREPLACE entirely, and go back to MAP_FIXED. + +Yes, it's a sign of old binaries generated with old tool-chains, but we +do pride ourselves on not breaking existing setups. + +This still leaves MAP_FIXED_NOREPLACE in place for the load_elf_interp() +and the old load_elf_library() use-cases, because nobody has reported +breakage for those. Yet. + +Note that in all the cases seen so far, the overlapping elf sections +seem to be just re-mapping of the same executable with different section +attributes. We could possibly introduce a new MAP_FIXED_NOFILECHANGE +flag or similar, which acts like NOREPLACE, but allows just remapping +the same executable file using different protection flags. + +It's not clear that would make a huge difference to anything, but if +people really hate that "elf remaps over previous maps" behavior, maybe +at least a more limited form of remapping would alleviate some concerns. + +Alternatively, we should take a look at our elf_map() logic to see if we +end up not mapping things properly the first time. + +In the meantime, this is the minimal "don't do that then" patch while +people hopefully think about it more. + +Reported-by: Russell King +Fixes: 4ed28639519c ("fs, elf: drop MAP_FIXED usage from elf_map") +Fixes: ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments") +Cc: Michal Hocko +Cc: Kees Cook +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/binfmt_elf.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index f131651502b8a..c62903290f3a5 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -899,7 +899,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + the correct location in memory. */ + for(i = 0, elf_ppnt = elf_phdata; + i < loc->elf_ex.e_phnum; i++, elf_ppnt++) { +- int elf_prot, elf_flags, elf_fixed = MAP_FIXED_NOREPLACE; ++ int elf_prot, elf_flags; + unsigned long k, vaddr; + unsigned long total_size = 0; + +@@ -931,13 +931,6 @@ static int load_elf_binary(struct linux_binprm *bprm) + */ + } + } +- +- /* +- * Some binaries have overlapping elf segments and then +- * we have to forcefully map over an existing mapping +- * e.g. over this newly established brk mapping. +- */ +- elf_fixed = MAP_FIXED; + } + + elf_prot = make_prot(elf_ppnt->p_flags); +@@ -950,7 +943,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + * the ET_DYN load_addr calculations, proceed normally. + */ + if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { +- elf_flags |= elf_fixed; ++ elf_flags |= MAP_FIXED; + } else if (loc->elf_ex.e_type == ET_DYN) { + /* + * This logic is run once for the first LOAD Program +@@ -986,7 +979,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + load_bias = ELF_ET_DYN_BASE; + if (current->flags & PF_RANDOMIZE) + load_bias += arch_mmap_rnd(); +- elf_flags |= elf_fixed; ++ elf_flags |= MAP_FIXED; + } else + load_bias = 0; + +-- +2.20.1 + diff --git a/queue-5.3/ieee802154-ca8210-prevent-memory-leak.patch b/queue-5.3/ieee802154-ca8210-prevent-memory-leak.patch new file mode 100644 index 00000000000..eb1ca486e95 --- /dev/null +++ b/queue-5.3/ieee802154-ca8210-prevent-memory-leak.patch @@ -0,0 +1,42 @@ +From 04a7655844ebedd0d7db62e6e73007bc4a86707a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Sep 2019 17:47:12 -0500 +Subject: ieee802154: ca8210: prevent memory leak + +From: Navid Emamdoost + +[ Upstream commit 6402939ec86eaf226c8b8ae00ed983936b164908 ] + +In ca8210_probe the allocated pdata needs to be assigned to +spi_device->dev.platform_data before calling ca8210_get_platform_data. +Othrwise when ca8210_get_platform_data fails pdata cannot be released. + +Signed-off-by: Navid Emamdoost +Link: https://lore.kernel.org/r/20190917224713.26371-1-navid.emamdoost@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index b188fce3f6410..658b399ac9eac 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -3152,12 +3152,12 @@ static int ca8210_probe(struct spi_device *spi_device) + goto error; + } + ++ priv->spi->dev.platform_data = pdata; + ret = ca8210_get_platform_data(priv->spi, pdata); + if (ret) { + dev_crit(&spi_device->dev, "ca8210_get_platform_data failed\n"); + goto error; + } +- priv->spi->dev.platform_data = pdata; + + ret = ca8210_dev_com_init(priv); + if (ret) { +-- +2.20.1 + diff --git a/queue-5.3/lib-textsearch-fix-escapes-in-example-code.patch b/queue-5.3/lib-textsearch-fix-escapes-in-example-code.patch new file mode 100644 index 00000000000..5ad13d984e0 --- /dev/null +++ b/queue-5.3/lib-textsearch-fix-escapes-in-example-code.patch @@ -0,0 +1,42 @@ +From 8d9b32b6e148f0245115669117619b0bf78067f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 17:08:18 -0700 +Subject: lib: textsearch: fix escapes in example code + +From: Randy Dunlap + +[ Upstream commit 2105b52e30debe7f19f3218598d8ae777dcc6776 ] + +This textsearch code example does not need the '\' escapes and they can +be misleading to someone reading the example. Also, gcc and sparse warn +that the "\%d" is an unknown escape sequence. + +Fixes: 5968a70d7af5 ("textsearch: fix kernel-doc warnings and add kernel-api section") +Signed-off-by: Randy Dunlap +Cc: "David S. Miller" +Cc: netdev@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + lib/textsearch.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/textsearch.c b/lib/textsearch.c +index 4f16eec5d5544..f68dea8806be2 100644 +--- a/lib/textsearch.c ++++ b/lib/textsearch.c +@@ -89,9 +89,9 @@ + * goto errout; + * } + * +- * pos = textsearch_find_continuous(conf, \&state, example, strlen(example)); ++ * pos = textsearch_find_continuous(conf, &state, example, strlen(example)); + * if (pos != UINT_MAX) +- * panic("Oh my god, dancing chickens at \%d\n", pos); ++ * panic("Oh my god, dancing chickens at %d\n", pos); + * + * textsearch_destroy(conf); + */ +-- +2.20.1 + diff --git a/queue-5.3/loop-change-queue-block-size-to-match-when-using-dio.patch b/queue-5.3/loop-change-queue-block-size-to-match-when-using-dio.patch new file mode 100644 index 00000000000..9d4b09c5724 --- /dev/null +++ b/queue-5.3/loop-change-queue-block-size-to-match-when-using-dio.patch @@ -0,0 +1,48 @@ +From dd5d887fe9b34571edc3a0d2dfc646e37a861acd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Sep 2019 21:49:01 +0200 +Subject: loop: change queue block size to match when using DIO + +From: Martijn Coenen + +[ Upstream commit 85560117d00f5d528e928918b8f61cadcefff98b ] + +The loop driver assumes that if the passed in fd is opened with +O_DIRECT, the caller wants to use direct I/O on the loop device. +However, if the underlying block device has a different block size than +the loop block queue, direct I/O can't be enabled. Instead of requiring +userspace to manually change the blocksize and re-enable direct I/O, +just change the queue block sizes to match, as well as the io_min size. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Martijn Coenen +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 1410fa8936538..f6f77eaa7217e 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -994,6 +994,16 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, + if (!(lo_flags & LO_FLAGS_READ_ONLY) && file->f_op->fsync) + blk_queue_write_cache(lo->lo_queue, true, false); + ++ if (io_is_direct(lo->lo_backing_file) && inode->i_sb->s_bdev) { ++ /* In case of direct I/O, match underlying block size */ ++ unsigned short bsize = bdev_logical_block_size( ++ inode->i_sb->s_bdev); ++ ++ blk_queue_logical_block_size(lo->lo_queue, bsize); ++ blk_queue_physical_block_size(lo->lo_queue, bsize); ++ blk_queue_io_min(lo->lo_queue, bsize); ++ } ++ + loop_update_rotational(lo); + loop_update_dio(lo); + set_capacity(lo->lo_disk, size); +-- +2.20.1 + diff --git a/queue-5.3/mac80211-fix-txq-null-pointer-dereference.patch b/queue-5.3/mac80211-fix-txq-null-pointer-dereference.patch new file mode 100644 index 00000000000..702e644b43a --- /dev/null +++ b/queue-5.3/mac80211-fix-txq-null-pointer-dereference.patch @@ -0,0 +1,77 @@ +From cb094061b4bdc5269c76fc379a850e395507a916 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 10:03:16 +0800 +Subject: mac80211: fix txq null pointer dereference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miaoqing Pan + +[ Upstream commit 8ed31a264065ae92058ce54aa3cc8da8d81dc6d7 ] + +If the interface type is P2P_DEVICE or NAN, read the file of +'/sys/kernel/debug/ieee80211/phyx/netdev:wlanx/aqm' will get a +NULL pointer dereference. As for those interface type, the +pointer sdata->vif.txq is NULL. + +Unable to handle kernel NULL pointer dereference at virtual address 00000011 +CPU: 1 PID: 30936 Comm: cat Not tainted 4.14.104 #1 +task: ffffffc0337e4880 task.stack: ffffff800cd20000 +PC is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] +LR is at ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] +[...] +Process cat (pid: 30936, stack limit = 0xffffff800cd20000) +[...] +[] ieee80211_if_fmt_aqm+0x34/0xa0 [mac80211] +[] ieee80211_if_read+0x60/0xbc [mac80211] +[] ieee80211_if_read_aqm+0x28/0x30 [mac80211] +[] full_proxy_read+0x2c/0x48 +[] __vfs_read+0x2c/0xd4 +[] vfs_read+0x8c/0x108 +[] SyS_read+0x40/0x7c + +Signed-off-by: Miaoqing Pan +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/1569549796-8223-1-git-send-email-miaoqing@codeaurora.org +[trim useless data from commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/debugfs_netdev.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c +index b1438fd4d8760..64b544ae9966b 100644 +--- a/net/mac80211/debugfs_netdev.c ++++ b/net/mac80211/debugfs_netdev.c +@@ -487,9 +487,14 @@ static ssize_t ieee80211_if_fmt_aqm( + const struct ieee80211_sub_if_data *sdata, char *buf, int buflen) + { + struct ieee80211_local *local = sdata->local; +- struct txq_info *txqi = to_txq_info(sdata->vif.txq); ++ struct txq_info *txqi; + int len; + ++ if (!sdata->vif.txq) ++ return 0; ++ ++ txqi = to_txq_info(sdata->vif.txq); ++ + spin_lock_bh(&local->fq.lock); + rcu_read_lock(); + +@@ -658,7 +663,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata) + DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz); + DEBUGFS_ADD(hw_queues); + +- if (sdata->local->ops->wake_tx_queue) ++ if (sdata->local->ops->wake_tx_queue && ++ sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE && ++ sdata->vif.type != NL80211_IFTYPE_NAN) + DEBUGFS_ADD(aqm); + } + +-- +2.20.1 + diff --git a/queue-5.3/mips-dts-ar9331-fix-interrupt-controller-size.patch b/queue-5.3/mips-dts-ar9331-fix-interrupt-controller-size.patch new file mode 100644 index 00000000000..9514186488d --- /dev/null +++ b/queue-5.3/mips-dts-ar9331-fix-interrupt-controller-size.patch @@ -0,0 +1,42 @@ +From bd1c4c5e76ea9133404b9ec3a3c2f597d0072122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 11:39:52 +0200 +Subject: MIPS: dts: ar9331: fix interrupt-controller size + +From: Oleksij Rempel + +[ Upstream commit 0889d07f3e4b171c453b2aaf2b257f9074cdf624 ] + +It is two registers each of 4 byte. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Paul Burton +Cc: Rob Herring +Cc: Mark Rutland +Cc: Pengutronix Kernel Team +Cc: Ralf Baechle +Cc: James Hogan +Cc: devicetree@vger.kernel.org +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/qca/ar9331.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi +index 63a9f33aa43e8..5cfc9d347826a 100644 +--- a/arch/mips/boot/dts/qca/ar9331.dtsi ++++ b/arch/mips/boot/dts/qca/ar9331.dtsi +@@ -99,7 +99,7 @@ + + miscintc: interrupt-controller@18060010 { + compatible = "qca,ar7240-misc-intc"; +- reg = <0x18060010 0x4>; ++ reg = <0x18060010 0x8>; + + interrupt-parent = <&cpuintc>; + interrupts = <6>; +-- +2.20.1 + diff --git a/queue-5.3/mips-loongson-fix-the-link-time-qualifier-of-serial_.patch b/queue-5.3/mips-loongson-fix-the-link-time-qualifier-of-serial_.patch new file mode 100644 index 00000000000..ed1051fc7c5 --- /dev/null +++ b/queue-5.3/mips-loongson-fix-the-link-time-qualifier-of-serial_.patch @@ -0,0 +1,41 @@ +From 62b23946aee9ce3113cc092c6362b1071d795899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Sep 2019 05:59:07 +0200 +Subject: mips: Loongson: Fix the link time qualifier of 'serial_exit()' + +From: Christophe JAILLET + +[ Upstream commit 25b69a889b638b0b7e51e2c4fe717a66bec0e566 ] + +'exit' functions should be marked as __exit, not __init. + +Fixes: 85cc028817ef ("mips: make loongsoon serial driver explicitly modular") +Signed-off-by: Christophe JAILLET +Signed-off-by: Paul Burton +Cc: chenhc@lemote.com +Cc: ralf@linux-mips.org +Cc: jhogan@kernel.org +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Cc: kernel-janitors@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/loongson64/common/serial.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c +index ffefc1cb26121..98c3a7feb10f8 100644 +--- a/arch/mips/loongson64/common/serial.c ++++ b/arch/mips/loongson64/common/serial.c +@@ -110,7 +110,7 @@ static int __init serial_init(void) + } + module_init(serial_init); + +-static void __init serial_exit(void) ++static void __exit serial_exit(void) + { + platform_device_unregister(&uart8250_device); + } +-- +2.20.1 + diff --git a/queue-5.3/namespace-fix-namespace.pl-script-to-support-relativ.patch b/queue-5.3/namespace-fix-namespace.pl-script-to-support-relativ.patch new file mode 100644 index 00000000000..3aa6b8adb00 --- /dev/null +++ b/queue-5.3/namespace-fix-namespace.pl-script-to-support-relativ.patch @@ -0,0 +1,86 @@ +From 85b3dc399b5a90c500b754346914daa2af0a6262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 16:30:27 -0700 +Subject: namespace: fix namespace.pl script to support relative paths + +From: Jacob Keller + +[ Upstream commit 82fdd12b95727640c9a8233c09d602e4518e71f7 ] + +The namespace.pl script does not work properly if objtree is not set to +an absolute path. The do_nm function is run from within the find +function, which changes directories. + +Because of this, appending objtree, $File::Find::dir, and $source, will +return a path which is not valid from the current directory. + +This used to work when objtree was set to an absolute path when using +"make namespacecheck". It appears to have not worked when calling +./scripts/namespace.pl directly. + +This behavior was changed in 7e1c04779efd ("kbuild: Use relative path +for $(objtree)", 2014-05-14) + +Rather than fixing the Makefile to set objtree to an absolute path, just +fix namespace.pl to work when srctree and objtree are relative. Also fix +the script to use an absolute path for these by default. + +Use the File::Spec module for this purpose. It's been part of perl +5 since 5.005. + +The curdir() function is used to get the current directory when the +objtree and srctree aren't set in the environment. + +rel2abs() is used to convert possibly relative objtree and srctree +environment variables to absolute paths. + +Finally, the catfile() function is used instead of string appending +paths together, since this is more robust when joining paths together. + +Signed-off-by: Jacob Keller +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/namespace.pl | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/scripts/namespace.pl b/scripts/namespace.pl +index 6135574a6f394..1da7bca201a42 100755 +--- a/scripts/namespace.pl ++++ b/scripts/namespace.pl +@@ -65,13 +65,14 @@ + use warnings; + use strict; + use File::Find; ++use File::Spec; + + my $nm = ($ENV{'NM'} || "nm") . " -p"; + my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment"; +-my $srctree = ""; +-my $objtree = ""; +-$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'})); +-$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'})); ++my $srctree = File::Spec->curdir(); ++my $objtree = File::Spec->curdir(); ++$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'})); ++$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'})); + + if ($#ARGV != -1) { + print STDERR "usage: $0 takes no parameters\n"; +@@ -231,9 +232,9 @@ sub do_nm + } + ($source = $basename) =~ s/\.o$//; + if (-e "$source.c" || -e "$source.S") { +- $source = "$objtree$File::Find::dir/$source"; ++ $source = File::Spec->catfile($objtree, $File::Find::dir, $source) + } else { +- $source = "$srctree$File::Find::dir/$source"; ++ $source = File::Spec->catfile($srctree, $File::Find::dir, $source) + } + if (! -e "$source.c" && ! -e "$source.S") { + # No obvious source, exclude the object if it is conglomerate +-- +2.20.1 + diff --git a/queue-5.3/net-ag71xx-fix-mdio-subnode-support.patch b/queue-5.3/net-ag71xx-fix-mdio-subnode-support.patch new file mode 100644 index 00000000000..ca9ab8286e1 --- /dev/null +++ b/queue-5.3/net-ag71xx-fix-mdio-subnode-support.patch @@ -0,0 +1,56 @@ +From 3aa1f52c5cec2fb17f6cd57eb28dff03949045e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 08:41:47 +0200 +Subject: net: ag71xx: fix mdio subnode support + +From: Oleksij Rempel + +[ Upstream commit 569aad4fcd82cba64eb10ede235d330a00f0aa09 ] + +This patch is syncing driver with actual devicetree documentation: +Documentation/devicetree/bindings/net/qca,ar71xx.txt +|Optional subnodes: +|- mdio : specifies the mdio bus, used as a container for phy nodes +| according to phy.txt in the same directory + +The driver was working with fixed phy without any noticeable issues. This bug +was uncovered by introducing dsa ar9331-switch driver. +Since no one reported this bug until now, I assume no body is using it +and this patch should not brake existing system. + +Fixes: d51b6ce441d3 ("net: ethernet: add ag71xx driver") +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/ag71xx.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c +index 6703960c7cf50..d1101eea15c2a 100644 +--- a/drivers/net/ethernet/atheros/ag71xx.c ++++ b/drivers/net/ethernet/atheros/ag71xx.c +@@ -526,7 +526,7 @@ static int ag71xx_mdio_probe(struct ag71xx *ag) + struct device *dev = &ag->pdev->dev; + struct net_device *ndev = ag->ndev; + static struct mii_bus *mii_bus; +- struct device_node *np; ++ struct device_node *np, *mnp; + int err; + + np = dev->of_node; +@@ -571,7 +571,9 @@ static int ag71xx_mdio_probe(struct ag71xx *ag) + msleep(200); + } + +- err = of_mdiobus_register(mii_bus, np); ++ mnp = of_get_child_by_name(np, "mdio"); ++ err = of_mdiobus_register(mii_bus, mnp); ++ of_node_put(mnp); + if (err) + goto mdio_err_put_clk; + +-- +2.20.1 + diff --git a/queue-5.3/net-dsa-qca8k-use-up-to-7-ports-for-all-operations.patch b/queue-5.3/net-dsa-qca8k-use-up-to-7-ports-for-all-operations.patch new file mode 100644 index 00000000000..2eec7457cb4 --- /dev/null +++ b/queue-5.3/net-dsa-qca8k-use-up-to-7-ports-for-all-operations.patch @@ -0,0 +1,57 @@ +From 9356246509ec1808578fec03b06faae3c26c6917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 10:59:17 +0200 +Subject: net: dsa: qca8k: Use up to 7 ports for all operations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michal Vokáč + +[ Upstream commit 7ae6d93c8f052b7a77ba56ed0f654e22a2876739 ] + +The QCA8K family supports up to 7 ports. So use the existing +QCA8K_NUM_PORTS define to allocate the switch structure and limit all +operations with the switch ports. + +This was not an issue until commit 0394a63acfe2 ("net: dsa: enable and +disable all ports") disabled all unused ports. Since the unused ports 7-11 +are outside of the correct register range on this switch some registers +were rewritten with invalid content. + +Fixes: 6b93fb46480a ("net-next: dsa: add new driver for qca8xxx family") +Fixes: a0c02161ecfc ("net: dsa: variable number of ports") +Fixes: 0394a63acfe2 ("net: dsa: enable and disable all ports") +Signed-off-by: Michal Vokáč +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca8k.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index 16f15c93a102c..bbeeb8618c80c 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -705,7 +705,7 @@ qca8k_setup(struct dsa_switch *ds) + BIT(0) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S); + + /* Setup connection between CPU port & user ports */ +- for (i = 0; i < DSA_MAX_PORTS; i++) { ++ for (i = 0; i < QCA8K_NUM_PORTS; i++) { + /* CPU port gets connected to all user ports of the switch */ + if (dsa_is_cpu_port(ds, i)) { + qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT), +@@ -1074,7 +1074,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev) + if (id != QCA8K_ID_QCA8337) + return -ENODEV; + +- priv->ds = dsa_switch_alloc(&mdiodev->dev, DSA_MAX_PORTS); ++ priv->ds = dsa_switch_alloc(&mdiodev->dev, QCA8K_NUM_PORTS); + if (!priv->ds) + return -ENOMEM; + +-- +2.20.1 + diff --git a/queue-5.3/net-dsa-rtl8366rb-add-missing-of_node_put-after-call.patch b/queue-5.3/net-dsa-rtl8366rb-add-missing-of_node_put-after-call.patch new file mode 100644 index 00000000000..68c078190b9 --- /dev/null +++ b/queue-5.3/net-dsa-rtl8366rb-add-missing-of_node_put-after-call.patch @@ -0,0 +1,93 @@ +From 6351558fc53b99fe005cba967f0f79e6c3ab3607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 15:00:47 +0800 +Subject: net: dsa: rtl8366rb: add missing of_node_put after calling + of_get_child_by_name + +From: Wen Yang + +[ Upstream commit f32eb9d80470dab05df26b6efd02d653c72e6a11 ] + +of_node_put needs to be called when the device node which is got +from of_get_child_by_name finished using. +irq_domain_add_linear() also calls of_node_get() to increase refcount, +so irq_domain will not be affected when it is released. + +Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") +Signed-off-by: Wen Yang +Cc: Linus Walleij +Cc: Andrew Lunn +Cc: Vivien Didelot +Cc: Florian Fainelli +Cc: "David S. Miller" +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Reviewed-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/rtl8366rb.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c +index a268085ffad28..f5cc8b0a7c74c 100644 +--- a/drivers/net/dsa/rtl8366rb.c ++++ b/drivers/net/dsa/rtl8366rb.c +@@ -507,7 +507,8 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi) + irq = of_irq_get(intc, 0); + if (irq <= 0) { + dev_err(smi->dev, "failed to get parent IRQ\n"); +- return irq ? irq : -EINVAL; ++ ret = irq ? irq : -EINVAL; ++ goto out_put_node; + } + + /* This clears the IRQ status register */ +@@ -515,7 +516,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi) + &val); + if (ret) { + dev_err(smi->dev, "can't read interrupt status\n"); +- return ret; ++ goto out_put_node; + } + + /* Fetch IRQ edge information from the descriptor */ +@@ -537,7 +538,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi) + val); + if (ret) { + dev_err(smi->dev, "could not configure IRQ polarity\n"); +- return ret; ++ goto out_put_node; + } + + ret = devm_request_threaded_irq(smi->dev, irq, NULL, +@@ -545,7 +546,7 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi) + "RTL8366RB", smi); + if (ret) { + dev_err(smi->dev, "unable to request irq: %d\n", ret); +- return ret; ++ goto out_put_node; + } + smi->irqdomain = irq_domain_add_linear(intc, + RTL8366RB_NUM_INTERRUPT, +@@ -553,12 +554,15 @@ static int rtl8366rb_setup_cascaded_irq(struct realtek_smi *smi) + smi); + if (!smi->irqdomain) { + dev_err(smi->dev, "failed to create IRQ domain\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_put_node; + } + for (i = 0; i < smi->num_ports; i++) + irq_set_parent(irq_create_mapping(smi->irqdomain, i), irq); + +- return 0; ++out_put_node: ++ of_node_put(intc); ++ return ret; + } + + static int rtl8366rb_set_addr(struct realtek_smi *smi) +-- +2.20.1 + diff --git a/queue-5.3/net-hisilicon-fix-usage-of-uninitialized-variable-in.patch b/queue-5.3/net-hisilicon-fix-usage-of-uninitialized-variable-in.patch new file mode 100644 index 00000000000..87037df7c62 --- /dev/null +++ b/queue-5.3/net-hisilicon-fix-usage-of-uninitialized-variable-in.patch @@ -0,0 +1,46 @@ +From 2561f83437bf2b6868ff7395e58bb8e437a58570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 13:24:39 -0700 +Subject: net: hisilicon: Fix usage of uninitialized variable in function + mdio_sc_cfg_reg_write() + +From: Yizhuo + +[ Upstream commit 53de429f4e88f538f7a8ec2b18be8c0cd9b2c8e1 ] + +In function mdio_sc_cfg_reg_write(), variable "reg_value" could be +uninitialized if regmap_read() fails. However, "reg_value" is used +to decide the control flow later in the if statement, which is +potentially unsafe. + +Signed-off-by: Yizhuo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns_mdio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c +index 3e863a71c5136..7df5d7d211d47 100644 +--- a/drivers/net/ethernet/hisilicon/hns_mdio.c ++++ b/drivers/net/ethernet/hisilicon/hns_mdio.c +@@ -148,11 +148,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev, + { + u32 time_cnt; + u32 reg_value; ++ int ret; + + regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val); + + for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) { +- regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value); ++ ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, ®_value); ++ if (ret) ++ return ret; ++ + reg_value &= st_msk; + if ((!!check_st) == (!!reg_value)) + break; +-- +2.20.1 + diff --git a/queue-5.3/net-mscc-ocelot-add-missing-of_node_put-after-callin.patch b/queue-5.3/net-mscc-ocelot-add-missing-of_node_put-after-callin.patch new file mode 100644 index 00000000000..9303a71d364 --- /dev/null +++ b/queue-5.3/net-mscc-ocelot-add-missing-of_node_put-after-callin.patch @@ -0,0 +1,83 @@ +From 385fc6104c6b6b2304c093b1c1d249570b8dbbdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 14:54:24 +0800 +Subject: net: mscc: ocelot: add missing of_node_put after calling + of_get_child_by_name + +From: Wen Yang + +[ Upstream commit d2c50b1cd94528aea8c8e9abb4cce81590f32cc4 ] + +of_node_put needs to be called when the device node which is got +from of_get_child_by_name finished using. +In both cases of success and failure, we need to release 'ports', +so clean up the code using goto. + +fixes: a556c76adc05 ("net: mscc: Add initial Ocelot switch support") +Signed-off-by: Wen Yang +Cc: Alexandre Belloni +Cc: Microchip Linux Driver Support +Cc: "David S. Miller" +Cc: netdev@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_board.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_board.c b/drivers/net/ethernet/mscc/ocelot_board.c +index 2451d4a96490b..041fb9f38ecaa 100644 +--- a/drivers/net/ethernet/mscc/ocelot_board.c ++++ b/drivers/net/ethernet/mscc/ocelot_board.c +@@ -287,13 +287,14 @@ static int mscc_ocelot_probe(struct platform_device *pdev) + continue; + + phy = of_phy_find_device(phy_node); ++ of_node_put(phy_node); + if (!phy) + continue; + + err = ocelot_probe_port(ocelot, port, regs, phy); + if (err) { + of_node_put(portnp); +- return err; ++ goto out_put_ports; + } + + phy_mode = of_get_phy_mode(portnp); +@@ -321,7 +322,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev) + "invalid phy mode for port%d, (Q)SGMII only\n", + port); + of_node_put(portnp); +- return -EINVAL; ++ err = -EINVAL; ++ goto out_put_ports; + } + + serdes = devm_of_phy_get(ocelot->dev, portnp, NULL); +@@ -334,7 +336,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev) + "missing SerDes phys for port%d\n", + port); + +- goto err_probe_ports; ++ of_node_put(portnp); ++ goto out_put_ports; + } + + ocelot->ports[port]->serdes = serdes; +@@ -346,9 +349,8 @@ static int mscc_ocelot_probe(struct platform_device *pdev) + + dev_info(&pdev->dev, "Ocelot switch probed\n"); + +- return 0; +- +-err_probe_ports: ++out_put_ports: ++ of_node_put(ports); + return err; + } + +-- +2.20.1 + diff --git a/queue-5.3/net-phy-allow-for-reset-line-to-be-tied-to-a-sleepy-.patch b/queue-5.3/net-phy-allow-for-reset-line-to-be-tied-to-a-sleepy-.patch new file mode 100644 index 00000000000..55451d9f597 --- /dev/null +++ b/queue-5.3/net-phy-allow-for-reset-line-to-be-tied-to-a-sleepy-.patch @@ -0,0 +1,47 @@ +From 7eb510a600eaf1a571642e70d22a43b671454c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 15:53:32 +0200 +Subject: net: phy: allow for reset line to be tied to a sleepy GPIO controller + +From: Andrea Merello + +[ Upstream commit ea977d19d918324ad5b66953f051a6ed07d0a3c5 ] + +mdio_device_reset() makes use of the atomic-pretending API flavor for +handling the PHY reset GPIO line. + +I found no hint that mdio_device_reset() is called from atomic context +and indeed it uses usleep_range() since long time, so I would assume that +it is OK to sleep there. + +This patch switch to gpiod_set_value_cansleep() in mdio_device_reset(). +This is relevant if e.g. the PHY reset line is tied to a I2C GPIO +controller. + +This has been tested on a ZynqMP board running an upstream 4.19 kernel and +then hand-ported on current kernel tree. + +Signed-off-by: Andrea Merello +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_device.c b/drivers/net/phy/mdio_device.c +index e282600bd83e2..c1d345c3cab35 100644 +--- a/drivers/net/phy/mdio_device.c ++++ b/drivers/net/phy/mdio_device.c +@@ -121,7 +121,7 @@ void mdio_device_reset(struct mdio_device *mdiodev, int value) + return; + + if (mdiodev->reset_gpio) +- gpiod_set_value(mdiodev->reset_gpio, value); ++ gpiod_set_value_cansleep(mdiodev->reset_gpio, value); + + if (mdiodev->reset_ctrl) { + if (value) +-- +2.20.1 + diff --git a/queue-5.3/net-phy-fix-write-to-mii-ctrl1000-register.patch b/queue-5.3/net-phy-fix-write-to-mii-ctrl1000-register.patch new file mode 100644 index 00000000000..216068df39b --- /dev/null +++ b/queue-5.3/net-phy-fix-write-to-mii-ctrl1000-register.patch @@ -0,0 +1,65 @@ +From aebb06e1b2b1c77870f6d6d1eac045dd6fef170e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 17:05:58 +0100 +Subject: net: phy: fix write to mii-ctrl1000 register + +From: Russell King + +[ Upstream commit 4cf6c57e61fee954f7b7685de31b80ec26843d27 ] + +When userspace writes to the MII_ADVERTISE register, we update phylib's +advertising mask and trigger a renegotiation. However, writing to the +MII_CTRL1000 register, which contains the gigabit advertisement, does +neither. This can lead to phylib's copy of the advertisement becoming +de-synced with the values in the PHY register set, which can result in +incorrect negotiation resolution. + +Fixes: 5502b218e001 ("net: phy: use phy_resolve_aneg_linkmode in genphy_read_status") +Reviewed-by: Andrew Lunn +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy.c | 5 +++++ + include/linux/mii.h | 9 +++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 6b0f89369b460..0a314cf454080 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -457,6 +457,11 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd) + val); + change_autoneg = true; + break; ++ case MII_CTRL1000: ++ mii_ctrl1000_mod_linkmode_adv_t(phydev->advertising, ++ val); ++ change_autoneg = true; ++ break; + default: + /* do nothing */ + break; +diff --git a/include/linux/mii.h b/include/linux/mii.h +index 5cd824c1c0caa..4ce8901a1af65 100644 +--- a/include/linux/mii.h ++++ b/include/linux/mii.h +@@ -455,6 +455,15 @@ static inline void mii_lpa_mod_linkmode_lpa_t(unsigned long *lp_advertising, + lp_advertising, lpa & LPA_LPACK); + } + ++static inline void mii_ctrl1000_mod_linkmode_adv_t(unsigned long *advertising, ++ u32 ctrl1000) ++{ ++ linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT, advertising, ++ ctrl1000 & ADVERTISE_1000HALF); ++ linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, advertising, ++ ctrl1000 & ADVERTISE_1000FULL); ++} ++ + /** + * linkmode_adv_to_lcl_adv_t + * @advertising:pointer to linkmode advertising +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-avoid-deadlock-on-suspend-resume.patch b/queue-5.3/net-stmmac-avoid-deadlock-on-suspend-resume.patch new file mode 100644 index 00000000000..758c395570e --- /dev/null +++ b/queue-5.3/net-stmmac-avoid-deadlock-on-suspend-resume.patch @@ -0,0 +1,76 @@ +From 036834184933337f5269912e37dd42455498f947 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 16:49:46 +0200 +Subject: net: stmmac: Avoid deadlock on suspend/resume + +From: Thierry Reding + +[ Upstream commit 134cc4cefad34d8d24670d8a911b59c3b89c6731 ] + +The stmmac driver will try to acquire its private mutex during suspend +via phylink_resolve() -> stmmac_mac_link_down() -> stmmac_eee_init(). +However, the phylink configuration is updated with the private mutex +held already, which causes a deadlock during suspend. + +Fix this by moving the phylink configuration updates out of the region +of code protected by the private mutex. + +Fixes: 19e13cb27b99 ("net: stmmac: Hold rtnl lock in suspend/resume callbacks") +Suggested-by: Bitan Biswas +Signed-off-by: Thierry Reding +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 69cc9133336fc..8d5ec73e02d34 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4454,10 +4454,10 @@ int stmmac_suspend(struct device *dev) + if (!ndev || !netif_running(ndev)) + return 0; + +- mutex_lock(&priv->lock); +- + phylink_mac_change(priv->phylink, false); + ++ mutex_lock(&priv->lock); ++ + netif_device_detach(ndev); + stmmac_stop_all_queues(priv); + +@@ -4471,9 +4471,11 @@ int stmmac_suspend(struct device *dev) + stmmac_pmt(priv, priv->hw, priv->wolopts); + priv->irq_wake = 1; + } else { ++ mutex_unlock(&priv->lock); + rtnl_lock(); + phylink_stop(priv->phylink); + rtnl_unlock(); ++ mutex_lock(&priv->lock); + + stmmac_mac_set(priv, priv->ioaddr, false); + pinctrl_pm_select_sleep_state(priv->device); +@@ -4565,6 +4567,8 @@ int stmmac_resume(struct device *dev) + + stmmac_start_all_queues(priv); + ++ mutex_unlock(&priv->lock); ++ + if (!device_may_wakeup(priv->device)) { + rtnl_lock(); + phylink_start(priv->phylink); +@@ -4573,8 +4577,6 @@ int stmmac_resume(struct device *dev) + + phylink_mac_change(priv->phylink, true); + +- mutex_unlock(&priv->lock); +- + return 0; + } + EXPORT_SYMBOL_GPL(stmmac_resume); +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-correctly-take-timestamp-for-ptpv2.patch b/queue-5.3/net-stmmac-correctly-take-timestamp-for-ptpv2.patch new file mode 100644 index 00000000000..8f69962a234 --- /dev/null +++ b/queue-5.3/net-stmmac-correctly-take-timestamp-for-ptpv2.patch @@ -0,0 +1,35 @@ +From 16f82b82556ea7faa9d412a7c7510d754d99ee26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:19:09 +0200 +Subject: net: stmmac: Correctly take timestamp for PTPv2 + +From: Jose Abreu + +[ Upstream commit 14f347334bf232074616e29e29103dd0c7c54dec ] + +The case for PTPV2_EVENT requires event packets to be captured so add +this setting to the list of enabled captures. + +Fixes: 891434b18ec0 ("stmmac: add IEEE PTPv1 and PTPv2 support.") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 5c4408bdc843a..ade85ca9d8c7f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -626,6 +626,7 @@ static int stmmac_hwtstamp_set(struct net_device *dev, struct ifreq *ifr) + config.rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT; + ptp_v2 = PTP_TCR_TSVER2ENA; + snap_type_sel = PTP_TCR_SNAPTYPSEL_1; ++ ts_event_en = PTP_TCR_TSEVNTENA; + ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA; + ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA; + ptp_over_ethernet = PTP_TCR_TSIPENA; +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-do-not-stop-phy-if-wol-is-enabled.patch b/queue-5.3/net-stmmac-do-not-stop-phy-if-wol-is-enabled.patch new file mode 100644 index 00000000000..4a612651c3f --- /dev/null +++ b/queue-5.3/net-stmmac-do-not-stop-phy-if-wol-is-enabled.patch @@ -0,0 +1,67 @@ +From 7a749d0659267dd1333013864984fa37c3ad6b9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:19:10 +0200 +Subject: net: stmmac: Do not stop PHY if WoL is enabled + +From: Jose Abreu + +[ Upstream commit 3e2bf04fb0447aa4b967b8000125178f55ae7800 ] + +If WoL is enabled we can't really stop the PHY, otherwise we will not +receive the WoL packet. Fix this by telling phylink that only the MAC is +down and only stop the PHY if WoL is not enabled. + +Fixes: 74371272f97f ("net: stmmac: Convert to phylink and remove phylib logic") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index ade85ca9d8c7f..69cc9133336fc 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4456,9 +4456,7 @@ int stmmac_suspend(struct device *dev) + + mutex_lock(&priv->lock); + +- rtnl_lock(); +- phylink_stop(priv->phylink); +- rtnl_unlock(); ++ phylink_mac_change(priv->phylink, false); + + netif_device_detach(ndev); + stmmac_stop_all_queues(priv); +@@ -4473,6 +4471,10 @@ int stmmac_suspend(struct device *dev) + stmmac_pmt(priv, priv->hw, priv->wolopts); + priv->irq_wake = 1; + } else { ++ rtnl_lock(); ++ phylink_stop(priv->phylink); ++ rtnl_unlock(); ++ + stmmac_mac_set(priv, priv->ioaddr, false); + pinctrl_pm_select_sleep_state(priv->device); + /* Disable clock in case of PWM is off */ +@@ -4563,9 +4565,13 @@ int stmmac_resume(struct device *dev) + + stmmac_start_all_queues(priv); + +- rtnl_lock(); +- phylink_start(priv->phylink); +- rtnl_unlock(); ++ if (!device_may_wakeup(priv->device)) { ++ rtnl_lock(); ++ phylink_start(priv->phylink); ++ rtnl_unlock(); ++ } ++ ++ phylink_mac_change(priv->phylink, true); + + mutex_unlock(&priv->lock); + +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-dwmac4-always-update-the-mac-hash-filter.patch b/queue-5.3/net-stmmac-dwmac4-always-update-the-mac-hash-filter.patch new file mode 100644 index 00000000000..6c6d48d29bf --- /dev/null +++ b/queue-5.3/net-stmmac-dwmac4-always-update-the-mac-hash-filter.patch @@ -0,0 +1,73 @@ +From a1846370d2ffe2135c79831addc868b5c0ff9661 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:19:08 +0200 +Subject: net: stmmac: dwmac4: Always update the MAC Hash Filter + +From: Jose Abreu + +[ Upstream commit f79bfda3756c50a86c0ee65091935c42c5bbe0cb ] + +We need to always update the MAC Hash Filter so that previous entries +are invalidated. + +Found out while running stmmac selftests. + +Fixes: b8ef7020d6e5 ("net: stmmac: add support for hash table size 128/256 in dwmac4") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index fc9954e4a7729..9c73fb759b575 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -407,8 +407,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + int numhashregs = (hw->multicast_filter_bins >> 5); + int mcbitslog2 = hw->mcast_bits_log2; + unsigned int value; ++ u32 mc_filter[8]; + int i; + ++ memset(mc_filter, 0, sizeof(mc_filter)); ++ + value = readl(ioaddr + GMAC_PACKET_FILTER); + value &= ~GMAC_PACKET_FILTER_HMC; + value &= ~GMAC_PACKET_FILTER_HPF; +@@ -422,16 +425,13 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + /* Pass all multi */ + value |= GMAC_PACKET_FILTER_PM; + /* Set all the bits of the HASH tab */ +- for (i = 0; i < numhashregs; i++) +- writel(0xffffffff, ioaddr + GMAC_HASH_TAB(i)); ++ memset(mc_filter, 0xff, sizeof(mc_filter)); + } else if (!netdev_mc_empty(dev)) { + struct netdev_hw_addr *ha; +- u32 mc_filter[8]; + + /* Hash filter for multicast */ + value |= GMAC_PACKET_FILTER_HMC; + +- memset(mc_filter, 0, sizeof(mc_filter)); + netdev_for_each_mc_addr(ha, dev) { + /* The upper n bits of the calculated CRC are used to + * index the contents of the hash table. The number of +@@ -446,10 +446,11 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + */ + mc_filter[bit_nr >> 5] |= (1 << (bit_nr & 0x1f)); + } +- for (i = 0; i < numhashregs; i++) +- writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i)); + } + ++ for (i = 0; i < numhashregs; i++) ++ writel(mc_filter[i], ioaddr + GMAC_HASH_TAB(i)); ++ + value |= GMAC_PACKET_FILTER_HPF; + + /* Handle multiple unicast addresses */ +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-xgmac-not-all-unicast-addresses-may-be-av.patch b/queue-5.3/net-stmmac-xgmac-not-all-unicast-addresses-may-be-av.patch new file mode 100644 index 00000000000..1c0f180203b --- /dev/null +++ b/queue-5.3/net-stmmac-xgmac-not-all-unicast-addresses-may-be-av.patch @@ -0,0 +1,36 @@ +From 0c620fa5cb55dac35e04969efd40616f47383f22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 10:19:05 +0200 +Subject: net: stmmac: xgmac: Not all Unicast addresses may be available + +From: Jose Abreu + +[ Upstream commit 9a2ae7b3960eb2426a8560cbc3251e3453230d21 ] + +Some setups may not have all Unicast addresses filters available. Let's +check this before trying to setup filters. + +Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 85c68b7ee8c6a..46d74f407aab6 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -370,7 +370,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw, + dwxgmac2_set_mchash(ioaddr, mc_filter, mcbitslog2); + + /* Handle multiple unicast addresses */ +- if (netdev_uc_count(dev) > XGMAC_ADDR_MAX) { ++ if (netdev_uc_count(dev) > hw->unicast_filter_entries) { + value |= XGMAC_FILTER_PR; + } else { + struct netdev_hw_addr *ha; +-- +2.20.1 + diff --git a/queue-5.3/netfilter-nft_connlimit-disable-bh-on-garbage-collec.patch b/queue-5.3/netfilter-nft_connlimit-disable-bh-on-garbage-collec.patch new file mode 100644 index 00000000000..d33e2417699 --- /dev/null +++ b/queue-5.3/netfilter-nft_connlimit-disable-bh-on-garbage-collec.patch @@ -0,0 +1,70 @@ +From b80086f375ecd0debfcf8e61aae184c666d6f7ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 11:05:49 +0200 +Subject: netfilter: nft_connlimit: disable bh on garbage collection + +From: Pablo Neira Ayuso + +[ Upstream commit 34a4c95abd25ab41fb390b985a08a651b1fa0b0f ] + +BH must be disabled when invoking nf_conncount_gc_list() to perform +garbage collection, otherwise deadlock might happen. + + nf_conncount_add+0x1f/0x50 [nf_conncount] + nft_connlimit_eval+0x4c/0xe0 [nft_connlimit] + nft_dynset_eval+0xb5/0x100 [nf_tables] + nft_do_chain+0xea/0x420 [nf_tables] + ? sch_direct_xmit+0x111/0x360 + ? noqueue_init+0x10/0x10 + ? __qdisc_run+0x84/0x510 + ? tcp_packet+0x655/0x1610 [nf_conntrack] + ? ip_finish_output2+0x1a7/0x430 + ? tcp_error+0x130/0x150 [nf_conntrack] + ? nf_conntrack_in+0x1fc/0x4c0 [nf_conntrack] + nft_do_chain_ipv4+0x66/0x80 [nf_tables] + nf_hook_slow+0x44/0xc0 + ip_rcv+0xb5/0xd0 + ? ip_rcv_finish_core.isra.19+0x360/0x360 + __netif_receive_skb_one_core+0x52/0x70 + netif_receive_skb_internal+0x34/0xe0 + napi_gro_receive+0xba/0xe0 + e1000_clean_rx_irq+0x1e9/0x420 [e1000e] + e1000e_poll+0xbe/0x290 [e1000e] + net_rx_action+0x149/0x3b0 + __do_softirq+0xde/0x2d8 + irq_exit+0xba/0xc0 + do_IRQ+0x85/0xd0 + common_interrupt+0xf/0xf + + RIP: 0010:nf_conncount_gc_list+0x3b/0x130 [nf_conncount] + +Fixes: 2f971a8f4255 ("netfilter: nf_conncount: move all list iterations under spinlock") +Reported-by: Laura Garcia Liebana +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_connlimit.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c +index af1497ab94642..69d6173f91e2b 100644 +--- a/net/netfilter/nft_connlimit.c ++++ b/net/netfilter/nft_connlimit.c +@@ -218,8 +218,13 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx, + static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr) + { + struct nft_connlimit *priv = nft_expr_priv(expr); ++ bool ret; + +- return nf_conncount_gc_list(net, &priv->list); ++ local_bh_disable(); ++ ret = nf_conncount_gc_list(net, &priv->list); ++ local_bh_enable(); ++ ++ return ret; + } + + static struct nft_expr_type nft_connlimit_type; +-- +2.20.1 + diff --git a/queue-5.3/nl80211-fix-null-pointer-dereference.patch b/queue-5.3/nl80211-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..d647d98ba9c --- /dev/null +++ b/queue-5.3/nl80211-fix-null-pointer-dereference.patch @@ -0,0 +1,62 @@ +From 6c3081cdc9a5312be7a407b749724ca384a83046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Sep 2019 16:16:50 +0800 +Subject: nl80211: fix null pointer dereference + +From: Miaoqing Pan + +[ Upstream commit b501426cf86e70649c983c52f4c823b3c40d72a3 ] + +If the interface is not in MESH mode, the command 'iw wlanx mpath del' +will cause kernel panic. + +The root cause is null pointer access in mpp_flush_by_proxy(), as the +pointer 'sdata->u.mesh.mpp_paths' is NULL for non MESH interface. + +Unable to handle kernel NULL pointer dereference at virtual address 00000068 +[...] +PC is at _raw_spin_lock_bh+0x20/0x5c +LR is at mesh_path_del+0x1c/0x17c [mac80211] +[...] +Process iw (pid: 4537, stack limit = 0xd83e0238) +[...] +[] (_raw_spin_lock_bh) from [] (mesh_path_del+0x1c/0x17c [mac80211]) +[] (mesh_path_del [mac80211]) from [] (extack_doit+0x20/0x68 [compat]) +[] (extack_doit [compat]) from [] (genl_rcv_msg+0x274/0x30c) +[] (genl_rcv_msg) from [] (netlink_rcv_skb+0x58/0xac) +[] (netlink_rcv_skb) from [] (genl_rcv+0x20/0x34) +[] (genl_rcv) from [] (netlink_unicast+0x11c/0x204) +[] (netlink_unicast) from [] (netlink_sendmsg+0x30c/0x370) +[] (netlink_sendmsg) from [] (sock_sendmsg+0x70/0x84) +[] (sock_sendmsg) from [] (___sys_sendmsg.part.3+0x188/0x228) +[] (___sys_sendmsg.part.3) from [] (__sys_sendmsg+0x4c/0x70) +[] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x44) +Code: e2822c02 e2822001 e5832004 f590f000 (e1902f9f) +---[ end trace bbd717600f8f884d ]--- + +Signed-off-by: Miaoqing Pan +Link: https://lore.kernel.org/r/1569485810-761-1-git-send-email-miaoqing@codeaurora.org +[trim useless data from commit message] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index f03459ddc840a..c2ce582ea1437 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -6184,6 +6184,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) + if (!rdev->ops->del_mpath) + return -EOPNOTSUPP; + ++ if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) ++ return -EOPNOTSUPP; ++ + return rdev_del_mpath(rdev, dev, dst); + } + +-- +2.20.1 + diff --git a/queue-5.3/nvme-add-quirk-for-kingston-nvme-ssd-running-fw-e8fk.patch b/queue-5.3/nvme-add-quirk-for-kingston-nvme-ssd-running-fw-e8fk.patch new file mode 100644 index 00000000000..ca83da894aa --- /dev/null +++ b/queue-5.3/nvme-add-quirk-for-kingston-nvme-ssd-running-fw-e8fk.patch @@ -0,0 +1,46 @@ +From 97b83b613b88355cdcc1f74b8f592dfcc7a1c152 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 17:42:41 +0800 +Subject: nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T + +From: Jian-Hong Pan + +[ Upstream commit 19ea025e1d28c629b369c3532a85b3df478cc5c6 ] + +Kingston NVME SSD with firmware version E8FK11.T has no interrupt after +resume with actions related to suspend to idle. This patch applied +NVME_QUIRK_SIMPLE_SUSPEND quirk to fix this issue. + +Fixes: d916b1be94b6 ("nvme-pci: use host managed power state for suspend") +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=204887 +Signed-off-by: Jian-Hong Pan +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index ac2ac06d870b5..3304e2c8a448a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2270,6 +2270,16 @@ static const struct nvme_core_quirk_entry core_quirks[] = { + .vid = 0x14a4, + .fr = "22301111", + .quirks = NVME_QUIRK_SIMPLE_SUSPEND, ++ }, ++ { ++ /* ++ * This Kingston E8FK11.T firmware version has no interrupt ++ * after resume with actions related to suspend to idle ++ * https://bugzilla.kernel.org/show_bug.cgi?id=204887 ++ */ ++ .vid = 0x2646, ++ .fr = "E8FK11.T", ++ .quirks = NVME_QUIRK_SIMPLE_SUSPEND, + } + }; + +-- +2.20.1 + diff --git a/queue-5.3/nvme-allow-64-bit-results-in-passthru-commands.patch b/queue-5.3/nvme-allow-64-bit-results-in-passthru-commands.patch new file mode 100644 index 00000000000..9578558371d --- /dev/null +++ b/queue-5.3/nvme-allow-64-bit-results-in-passthru-commands.patch @@ -0,0 +1,238 @@ +From 6441e6445adbb8d01d095a79f362c3faf5b51728 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 15:14:52 +0200 +Subject: nvme: allow 64-bit results in passthru commands + +From: Marta Rybczynska + +[ Upstream commit 65e68edce0db433aa0c2b26d7dc14fbbbeb89fbb ] + +It is not possible to get 64-bit results from the passthru commands, +what prevents from getting for the Capabilities (CAP) property value. + +As a result, it is not possible to implement IOL's NVMe Conformance +test 4.3 Case 1 for Fabrics targets [1] (page 123). + +This issue has been already discussed [2], but without a solution. + +This patch solves the problem by adding new ioctls with a new +passthru structure, including 64-bit results. The older ioctls stay +unchanged. + +[1] https://www.iol.unh.edu/sites/default/files/testsuites/nvme/UNH-IOL_NVMe_Conformance_Test_Suite_v11.0.pdf +[2] http://lists.infradead.org/pipermail/linux-nvme/2018-June/018791.html + +Signed-off-by: Marta Rybczynska +Reviewed-by: Keith Busch +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 108 +++++++++++++++++++++++++++----- + include/uapi/linux/nvme_ioctl.h | 23 +++++++ + 2 files changed, 115 insertions(+), 16 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 3304e2c8a448a..36a5ed1eacbea 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -852,7 +852,7 @@ static void *nvme_add_user_metadata(struct bio *bio, void __user *ubuf, + static int nvme_submit_user_cmd(struct request_queue *q, + struct nvme_command *cmd, void __user *ubuffer, + unsigned bufflen, void __user *meta_buffer, unsigned meta_len, +- u32 meta_seed, u32 *result, unsigned timeout) ++ u32 meta_seed, u64 *result, unsigned timeout) + { + bool write = nvme_is_write(cmd); + struct nvme_ns *ns = q->queuedata; +@@ -893,7 +893,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, + else + ret = nvme_req(req)->status; + if (result) +- *result = le32_to_cpu(nvme_req(req)->result.u32); ++ *result = le64_to_cpu(nvme_req(req)->result.u64); + if (meta && !ret && !write) { + if (copy_to_user(meta_buffer, meta, meta_len)) + ret = -EFAULT; +@@ -1339,6 +1339,54 @@ static int nvme_user_cmd(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + struct nvme_command c; + unsigned timeout = 0; + u32 effects; ++ u64 result; ++ int status; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ if (copy_from_user(&cmd, ucmd, sizeof(cmd))) ++ return -EFAULT; ++ if (cmd.flags) ++ return -EINVAL; ++ ++ memset(&c, 0, sizeof(c)); ++ c.common.opcode = cmd.opcode; ++ c.common.flags = cmd.flags; ++ c.common.nsid = cpu_to_le32(cmd.nsid); ++ c.common.cdw2[0] = cpu_to_le32(cmd.cdw2); ++ c.common.cdw2[1] = cpu_to_le32(cmd.cdw3); ++ c.common.cdw10 = cpu_to_le32(cmd.cdw10); ++ c.common.cdw11 = cpu_to_le32(cmd.cdw11); ++ c.common.cdw12 = cpu_to_le32(cmd.cdw12); ++ c.common.cdw13 = cpu_to_le32(cmd.cdw13); ++ c.common.cdw14 = cpu_to_le32(cmd.cdw14); ++ c.common.cdw15 = cpu_to_le32(cmd.cdw15); ++ ++ if (cmd.timeout_ms) ++ timeout = msecs_to_jiffies(cmd.timeout_ms); ++ ++ effects = nvme_passthru_start(ctrl, ns, cmd.opcode); ++ status = nvme_submit_user_cmd(ns ? ns->queue : ctrl->admin_q, &c, ++ (void __user *)(uintptr_t)cmd.addr, cmd.data_len, ++ (void __user *)(uintptr_t)cmd.metadata, ++ cmd.metadata_len, 0, &result, timeout); ++ nvme_passthru_end(ctrl, effects); ++ ++ if (status >= 0) { ++ if (put_user(result, &ucmd->result)) ++ return -EFAULT; ++ } ++ ++ return status; ++} ++ ++static int nvme_user_cmd64(struct nvme_ctrl *ctrl, struct nvme_ns *ns, ++ struct nvme_passthru_cmd64 __user *ucmd) ++{ ++ struct nvme_passthru_cmd64 cmd; ++ struct nvme_command c; ++ unsigned timeout = 0; ++ u32 effects; + int status; + + if (!capable(CAP_SYS_ADMIN)) +@@ -1409,6 +1457,41 @@ static void nvme_put_ns_from_disk(struct nvme_ns_head *head, int idx) + srcu_read_unlock(&head->srcu, idx); + } + ++static bool is_ctrl_ioctl(unsigned int cmd) ++{ ++ if (cmd == NVME_IOCTL_ADMIN_CMD || cmd == NVME_IOCTL_ADMIN64_CMD) ++ return true; ++ if (is_sed_ioctl(cmd)) ++ return true; ++ return false; ++} ++ ++static int nvme_handle_ctrl_ioctl(struct nvme_ns *ns, unsigned int cmd, ++ void __user *argp, ++ struct nvme_ns_head *head, ++ int srcu_idx) ++{ ++ struct nvme_ctrl *ctrl = ns->ctrl; ++ int ret; ++ ++ nvme_get_ctrl(ns->ctrl); ++ nvme_put_ns_from_disk(head, srcu_idx); ++ ++ switch (cmd) { ++ case NVME_IOCTL_ADMIN_CMD: ++ ret = nvme_user_cmd(ctrl, NULL, argp); ++ break; ++ case NVME_IOCTL_ADMIN64_CMD: ++ ret = nvme_user_cmd64(ctrl, NULL, argp); ++ break; ++ default: ++ ret = sed_ioctl(ctrl->opal_dev, cmd, argp); ++ break; ++ } ++ nvme_put_ctrl(ctrl); ++ return ret; ++} ++ + static int nvme_ioctl(struct block_device *bdev, fmode_t mode, + unsigned int cmd, unsigned long arg) + { +@@ -1426,20 +1509,8 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode, + * seperately and drop the ns SRCU reference early. This avoids a + * deadlock when deleting namespaces using the passthrough interface. + */ +- if (cmd == NVME_IOCTL_ADMIN_CMD || is_sed_ioctl(cmd)) { +- struct nvme_ctrl *ctrl = ns->ctrl; +- +- nvme_get_ctrl(ns->ctrl); +- nvme_put_ns_from_disk(head, srcu_idx); +- +- if (cmd == NVME_IOCTL_ADMIN_CMD) +- ret = nvme_user_cmd(ctrl, NULL, argp); +- else +- ret = sed_ioctl(ctrl->opal_dev, cmd, argp); +- +- nvme_put_ctrl(ctrl); +- return ret; +- } ++ if (is_ctrl_ioctl(cmd)) ++ return nvme_handle_ctrl_ioctl(ns, cmd, argp, head, srcu_idx); + + switch (cmd) { + case NVME_IOCTL_ID: +@@ -1452,6 +1523,9 @@ static int nvme_ioctl(struct block_device *bdev, fmode_t mode, + case NVME_IOCTL_SUBMIT_IO: + ret = nvme_submit_io(ns, argp); + break; ++ case NVME_IOCTL_IO64_CMD: ++ ret = nvme_user_cmd64(ns->ctrl, ns, argp); ++ break; + default: + if (ns->ndev) + ret = nvme_nvm_ioctl(ns, cmd, arg); +@@ -2826,6 +2900,8 @@ static long nvme_dev_ioctl(struct file *file, unsigned int cmd, + switch (cmd) { + case NVME_IOCTL_ADMIN_CMD: + return nvme_user_cmd(ctrl, NULL, argp); ++ case NVME_IOCTL_ADMIN64_CMD: ++ return nvme_user_cmd64(ctrl, NULL, argp); + case NVME_IOCTL_IO_CMD: + return nvme_dev_user_cmd(ctrl, argp); + case NVME_IOCTL_RESET: +diff --git a/include/uapi/linux/nvme_ioctl.h b/include/uapi/linux/nvme_ioctl.h +index 1c215ea1798e6..e168dc59e9a0d 100644 +--- a/include/uapi/linux/nvme_ioctl.h ++++ b/include/uapi/linux/nvme_ioctl.h +@@ -45,6 +45,27 @@ struct nvme_passthru_cmd { + __u32 result; + }; + ++struct nvme_passthru_cmd64 { ++ __u8 opcode; ++ __u8 flags; ++ __u16 rsvd1; ++ __u32 nsid; ++ __u32 cdw2; ++ __u32 cdw3; ++ __u64 metadata; ++ __u64 addr; ++ __u32 metadata_len; ++ __u32 data_len; ++ __u32 cdw10; ++ __u32 cdw11; ++ __u32 cdw12; ++ __u32 cdw13; ++ __u32 cdw14; ++ __u32 cdw15; ++ __u32 timeout_ms; ++ __u64 result; ++}; ++ + #define nvme_admin_cmd nvme_passthru_cmd + + #define NVME_IOCTL_ID _IO('N', 0x40) +@@ -54,5 +75,7 @@ struct nvme_passthru_cmd { + #define NVME_IOCTL_RESET _IO('N', 0x44) + #define NVME_IOCTL_SUBSYS_RESET _IO('N', 0x45) + #define NVME_IOCTL_RESCAN _IO('N', 0x46) ++#define NVME_IOCTL_ADMIN64_CMD _IOWR('N', 0x47, struct nvme_passthru_cmd64) ++#define NVME_IOCTL_IO64_CMD _IOWR('N', 0x48, struct nvme_passthru_cmd64) + + #endif /* _UAPI_LINUX_NVME_IOCTL_H */ +-- +2.20.1 + diff --git a/queue-5.3/nvme-fix-an-error-code-in-nvme_init_subsystem.patch b/queue-5.3/nvme-fix-an-error-code-in-nvme_init_subsystem.patch new file mode 100644 index 00000000000..66f5970ddbc --- /dev/null +++ b/queue-5.3/nvme-fix-an-error-code-in-nvme_init_subsystem.patch @@ -0,0 +1,40 @@ +From 54a9131f733faf0940e84bd49d24e807688328b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Sep 2019 17:18:36 +0300 +Subject: nvme: fix an error code in nvme_init_subsystem() + +From: Dan Carpenter + +[ Upstream commit bc4f6e06a90ea016855fc67212b4d500145f0b8a ] + +"ret" should be a negative error code here, but it's either success or +possibly uninitialized. + +Fixes: 32fd90c40768 ("nvme: change locking for the per-subsystem controller list") +Signed-off-by: Dan Carpenter +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 28217cee5e762..ac2ac06d870b5 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2513,8 +2513,9 @@ static int nvme_init_subsystem(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + list_add_tail(&subsys->entry, &nvme_subsystems); + } + +- if (sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj, +- dev_name(ctrl->device))) { ++ ret = sysfs_create_link(&subsys->dev.kobj, &ctrl->device->kobj, ++ dev_name(ctrl->device)); ++ if (ret) { + dev_err(ctrl->device, + "failed to create sysfs link from subsystem.\n"); + goto out_put_subsystem; +-- +2.20.1 + diff --git a/queue-5.3/nvme-pci-fix-a-race-in-controller-removal.patch b/queue-5.3/nvme-pci-fix-a-race-in-controller-removal.patch new file mode 100644 index 00000000000..ab79ef080d5 --- /dev/null +++ b/queue-5.3/nvme-pci-fix-a-race-in-controller-removal.patch @@ -0,0 +1,46 @@ +From 066f74f2d2cdf63214a08695f6ef5ca324607bf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 00:27:20 +0000 +Subject: nvme-pci: Fix a race in controller removal + +From: Balbir Singh + +[ Upstream commit b224726de5e496dbf78147a66755c3d81e28bdd2 ] + +User space programs like udevd may try to read to partitions at the +same time the driver detects a namespace is unusable, and may deadlock +if revalidate_disk() is called while such a process is waiting to +enter the frozen queue. On detecting a dead namespace, move the disk +revalidate after unblocking dispatchers that may be holding bd_butex. + +changelog Suggested-by: Keith Busch +Signed-off-by: Balbir Singh +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index d3d6b7bd69033..28217cee5e762 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -103,10 +103,13 @@ static void nvme_set_queue_dying(struct nvme_ns *ns) + */ + if (!ns->disk || test_and_set_bit(NVME_NS_DEAD, &ns->flags)) + return; +- revalidate_disk(ns->disk); + blk_set_queue_dying(ns->queue); + /* Forcibly unquiesce queues to avoid blocking dispatch */ + blk_mq_unquiesce_queue(ns->queue); ++ /* ++ * Revalidate after unblocking dispatchers that may be holding bd_butex ++ */ ++ revalidate_disk(ns->disk); + } + + static void nvme_queue_scan(struct nvme_ctrl *ctrl) +-- +2.20.1 + diff --git a/queue-5.3/nvme-pci-save-pci-state-before-putting-drive-into-de.patch b/queue-5.3/nvme-pci-save-pci-state-before-putting-drive-into-de.patch new file mode 100644 index 00000000000..9f89b469048 --- /dev/null +++ b/queue-5.3/nvme-pci-save-pci-state-before-putting-drive-into-de.patch @@ -0,0 +1,74 @@ +From 5608332f2ae5b422b93819980155cef92b02fe42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 13:15:55 -0500 +Subject: nvme-pci: Save PCI state before putting drive into deepest state + +From: Mario Limonciello + +[ Upstream commit 7cbb5c6f9aa7cfda7175d82a9cf77a92965b0c5e ] + +The action of saving the PCI state will cause numerous PCI configuration +space reads which depending upon the vendor implementation may cause +the drive to exit the deepest NVMe state. + +In these cases ASPM will typically resolve the PCIe link state and APST +may resolve the NVMe power state. However it has also been observed +that this register access after quiesced will cause PC10 failure +on some device combinations. + +To resolve this, move the PCI state saving to before SetFeatures has been +called. This has been proven to resolve the issue across a 5000 sample +test on previously failing disk/system combinations. + +Signed-off-by: Mario Limonciello +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 732d5b63ec054..19458e85dab34 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2894,11 +2894,21 @@ static int nvme_suspend(struct device *dev) + if (ret < 0) + goto unfreeze; + ++ /* ++ * A saved state prevents pci pm from generically controlling the ++ * device's power. If we're using protocol specific settings, we don't ++ * want pci interfering. ++ */ ++ pci_save_state(pdev); ++ + ret = nvme_set_power_state(ctrl, ctrl->npss); + if (ret < 0) + goto unfreeze; + + if (ret) { ++ /* discard the saved state */ ++ pci_load_saved_state(pdev, NULL); ++ + /* + * Clearing npss forces a controller reset on resume. The + * correct value will be resdicovered then. +@@ -2906,14 +2916,7 @@ static int nvme_suspend(struct device *dev) + nvme_dev_disable(ndev, true); + ctrl->npss = 0; + ret = 0; +- goto unfreeze; + } +- /* +- * A saved state prevents pci pm from generically controlling the +- * device's power. If we're using protocol specific settings, we don't +- * want pci interfering. +- */ +- pci_save_state(pdev); + unfreeze: + nvme_unfreeze(ctrl); + return ret; +-- +2.20.1 + diff --git a/queue-5.3/nvme-rdma-fix-max_hw_sectors-calculation.patch b/queue-5.3/nvme-rdma-fix-max_hw_sectors-calculation.patch new file mode 100644 index 00000000000..d3aaa0c0989 --- /dev/null +++ b/queue-5.3/nvme-rdma-fix-max_hw_sectors-calculation.patch @@ -0,0 +1,81 @@ +From f7665ad184a62da83248004b09adb3181c753c73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Sep 2019 23:58:19 +0300 +Subject: nvme-rdma: Fix max_hw_sectors calculation + +From: Max Gurtovoy + +[ Upstream commit ff13c1b87c97275b82b2af99044b4abf6861b28f ] + +By default, the NVMe/RDMA driver should support max io_size of 1MiB (or +upto the maximum supported size by the HCA). Currently, one will see that +/sys/class/block//queue/max_hw_sectors_kb is 1020 instead of 1024. + +A non power of 2 value can cause performance degradation due to +unnecessary splitting of IO requests and unoptimized allocation units. + +The number of pages per MR has been fixed here, so there is no longer any +need to reduce max_sectors by 1. + +Reviewed-by: Sagi Grimberg +Signed-off-by: Max Gurtovoy +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 1a6449bc547b9..cc1956349a2af 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -427,7 +427,7 @@ static void nvme_rdma_destroy_queue_ib(struct nvme_rdma_queue *queue) + static int nvme_rdma_get_max_fr_pages(struct ib_device *ibdev) + { + return min_t(u32, NVME_RDMA_MAX_SEGMENTS, +- ibdev->attrs.max_fast_reg_page_list_len); ++ ibdev->attrs.max_fast_reg_page_list_len - 1); + } + + static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue) +@@ -437,7 +437,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue) + const int cq_factor = send_wr_factor + 1; /* + RECV */ + int comp_vector, idx = nvme_rdma_queue_idx(queue); + enum ib_poll_context poll_ctx; +- int ret; ++ int ret, pages_per_mr; + + queue->device = nvme_rdma_find_get_device(queue->cm_id); + if (!queue->device) { +@@ -479,10 +479,16 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue) + goto out_destroy_qp; + } + ++ /* ++ * Currently we don't use SG_GAPS MR's so if the first entry is ++ * misaligned we'll end up using two entries for a single data page, ++ * so one additional entry is required. ++ */ ++ pages_per_mr = nvme_rdma_get_max_fr_pages(ibdev) + 1; + ret = ib_mr_pool_init(queue->qp, &queue->qp->rdma_mrs, + queue->queue_size, + IB_MR_TYPE_MEM_REG, +- nvme_rdma_get_max_fr_pages(ibdev), 0); ++ pages_per_mr, 0); + if (ret) { + dev_err(queue->ctrl->ctrl.device, + "failed to initialize MR pool sized %d for QID %d\n", +@@ -824,8 +830,8 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, + if (error) + goto out_stop_queue; + +- ctrl->ctrl.max_hw_sectors = +- (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9); ++ ctrl->ctrl.max_segments = ctrl->max_fr_pages; ++ ctrl->ctrl.max_hw_sectors = ctrl->max_fr_pages << (ilog2(SZ_4K) - 9); + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +-- +2.20.1 + diff --git a/queue-5.3/nvme-rdma-fix-possible-use-after-free-in-connect-tim.patch b/queue-5.3/nvme-rdma-fix-possible-use-after-free-in-connect-tim.patch new file mode 100644 index 00000000000..9ab948abf44 --- /dev/null +++ b/queue-5.3/nvme-rdma-fix-possible-use-after-free-in-connect-tim.patch @@ -0,0 +1,37 @@ +From 307f46ab6cf0325e33ebdaf7d965316809eb8bc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 11:27:05 -0700 +Subject: nvme-rdma: fix possible use-after-free in connect timeout + +From: Sagi Grimberg + +[ Upstream commit 67b483dd03c4cd9e90e4c3943132dce514ea4e88 ] + +If the connect times out, we may have already destroyed the +queue in the timeout handler, so test if the queue is still +allocated in the connect error handler. + +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index cc1956349a2af..842ef876724f7 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -620,7 +620,8 @@ static int nvme_rdma_start_queue(struct nvme_rdma_ctrl *ctrl, int idx) + if (!ret) { + set_bit(NVME_RDMA_Q_LIVE, &queue->flags); + } else { +- __nvme_rdma_stop_queue(queue); ++ if (test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) ++ __nvme_rdma_stop_queue(queue); + dev_info(ctrl->ctrl.device, + "failed to connect queue: %d ret=%d\n", idx, ret); + } +-- +2.20.1 + diff --git a/queue-5.3/nvme-tcp-fix-wrong-stop-condition-in-io_work.patch b/queue-5.3/nvme-tcp-fix-wrong-stop-condition-in-io_work.patch new file mode 100644 index 00000000000..38f8a3ec214 --- /dev/null +++ b/queue-5.3/nvme-tcp-fix-wrong-stop-condition-in-io_work.patch @@ -0,0 +1,47 @@ +From 34ee4025663117bc5b71ba53787b5d16e445edf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 23:36:37 +0000 +Subject: nvme-tcp: fix wrong stop condition in io_work + +From: Wunderlich, Mark + +[ Upstream commit ddef29578a81a1d4d8f2b26a7adbfe21407ee3ea ] + +Allow the do/while statement to continue if current time +is not after the proposed time 'deadline'. Intent is to +allow loop to proceed for a specific time period. Currently +the loop, as coded, will exit after first pass. + +Signed-off-by: Mark Wunderlich +Reviewed-by: Sagi Grimberg +Signed-off-by: Sagi Grimberg +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 606b13d35d16f..bdadb27b28bbb 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1039,7 +1039,7 @@ static void nvme_tcp_io_work(struct work_struct *w) + { + struct nvme_tcp_queue *queue = + container_of(w, struct nvme_tcp_queue, io_work); +- unsigned long start = jiffies + msecs_to_jiffies(1); ++ unsigned long deadline = jiffies + msecs_to_jiffies(1); + + do { + bool pending = false; +@@ -1064,7 +1064,7 @@ static void nvme_tcp_io_work(struct work_struct *w) + if (!pending) + return; + +- } while (time_after(jiffies, start)); /* quota is exhausted */ ++ } while (!time_after(jiffies, deadline)); /* quota is exhausted */ + + queue_work_on(queue->io_cpu, nvme_tcp_wq, &queue->io_work); + } +-- +2.20.1 + diff --git a/queue-5.3/r8152-set-macpassthru-in-reset_resume-callback.patch b/queue-5.3/r8152-set-macpassthru-in-reset_resume-callback.patch new file mode 100644 index 00000000000..1746ffdae4e --- /dev/null +++ b/queue-5.3/r8152-set-macpassthru-in-reset_resume-callback.patch @@ -0,0 +1,46 @@ +From 5c8d425a1399fc033cd146d7c2341b9e4017eb8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Oct 2019 20:51:04 +0800 +Subject: r8152: Set macpassthru in reset_resume callback + +From: Kai-Heng Feng + +[ Upstream commit a54cdeeb04fc719e4c7f19d6e28dba7ea86cee5b ] + +r8152 may fail to establish network connection after resume from system +suspend. + +If the USB port connects to r8152 lost its power during system suspend, +the MAC address was written before is lost. The reason is that The MAC +address doesn't get written again in its reset_resume callback. + +So let's set MAC address again in reset_resume callback. Also remove +unnecessary lock as no other locking attempt will happen during +reset_resume. + +Signed-off-by: Kai-Heng Feng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 04137ac373b07..9eedc0714422c 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -4533,10 +4533,9 @@ static int rtl8152_reset_resume(struct usb_interface *intf) + struct r8152 *tp = usb_get_intfdata(intf); + + clear_bit(SELECTIVE_SUSPEND, &tp->flags); +- mutex_lock(&tp->control); + tp->rtl_ops.init(tp); + queue_delayed_work(system_long_wq, &tp->hw_phy_work, 0); +- mutex_unlock(&tp->control); ++ set_ethernet_addr(tp); + return rtl8152_resume(intf); + } + +-- +2.20.1 + diff --git a/queue-5.3/risc-v-clear-load-reservations-while-restoring-hart-.patch b/queue-5.3/risc-v-clear-load-reservations-while-restoring-hart-.patch new file mode 100644 index 00000000000..b0b77f87574 --- /dev/null +++ b/queue-5.3/risc-v-clear-load-reservations-while-restoring-hart-.patch @@ -0,0 +1,69 @@ +From 70d4560ea70a565ce7b72ace6c1a0a259dd5accb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 17:15:56 -0700 +Subject: RISC-V: Clear load reservations while restoring hart contexts + +From: Palmer Dabbelt + +[ Upstream commit 18856604b3e7090ce42d533995173ee70c24b1c9 ] + +This is almost entirely a comment. The bug is unlikely to manifest on +existing hardware because there is a timeout on load reservations, but +manifests on QEMU because there is no timeout. + +Signed-off-by: Palmer Dabbelt +Reviewed-by: Christoph Hellwig +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/include/asm/asm.h | 1 + + arch/riscv/kernel/entry.S | 21 ++++++++++++++++++++- + 2 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/include/asm/asm.h b/arch/riscv/include/asm/asm.h +index 5a02b7d509408..9c992a88d858f 100644 +--- a/arch/riscv/include/asm/asm.h ++++ b/arch/riscv/include/asm/asm.h +@@ -22,6 +22,7 @@ + + #define REG_L __REG_SEL(ld, lw) + #define REG_S __REG_SEL(sd, sw) ++#define REG_SC __REG_SEL(sc.d, sc.w) + #define SZREG __REG_SEL(8, 4) + #define LGREG __REG_SEL(3, 2) + +diff --git a/arch/riscv/kernel/entry.S b/arch/riscv/kernel/entry.S +index 9b60878a4469c..2a82e0a5af46e 100644 +--- a/arch/riscv/kernel/entry.S ++++ b/arch/riscv/kernel/entry.S +@@ -98,7 +98,26 @@ _save_context: + */ + .macro RESTORE_ALL + REG_L a0, PT_SSTATUS(sp) +- REG_L a2, PT_SEPC(sp) ++ /* ++ * The current load reservation is effectively part of the processor's ++ * state, in the sense that load reservations cannot be shared between ++ * different hart contexts. We can't actually save and restore a load ++ * reservation, so instead here we clear any existing reservation -- ++ * it's always legal for implementations to clear load reservations at ++ * any point (as long as the forward progress guarantee is kept, but ++ * we'll ignore that here). ++ * ++ * Dangling load reservations can be the result of taking a trap in the ++ * middle of an LR/SC sequence, but can also be the result of a taken ++ * forward branch around an SC -- which is how we implement CAS. As a ++ * result we need to clear reservations between the last CAS and the ++ * jump back to the new context. While it is unlikely the store ++ * completes, implementations are allowed to expand reservations to be ++ * arbitrarily large. ++ */ ++ REG_L a2, PT_SEPC(sp) ++ REG_SC x0, a2, PT_SEPC(sp) ++ + csrw CSR_SSTATUS, a0 + csrw CSR_SEPC, a2 + +-- +2.20.1 + diff --git a/queue-5.3/riscv-fix-memblock-reservation-for-device-tree-blob.patch b/queue-5.3/riscv-fix-memblock-reservation-for-device-tree-blob.patch new file mode 100644 index 00000000000..e0df55835c9 --- /dev/null +++ b/queue-5.3/riscv-fix-memblock-reservation-for-device-tree-blob.patch @@ -0,0 +1,102 @@ +From e92518801b2ad53aeb3d91762ef17d820be24735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 16:14:18 -0700 +Subject: riscv: Fix memblock reservation for device tree blob + +From: Albert Ou + +[ Upstream commit 922b0375fc93fb1a20c5617e37c389c26bbccb70 ] + +This fixes an error with how the FDT blob is reserved in memblock. +An incorrect physical address calculation exposed the FDT header to +unintended corruption, which typically manifested with of_fdt_raw_init() +faulting during late boot after fdt_totalsize() returned a wrong value. +Systems with smaller physical memory sizes more frequently trigger this +issue, as the kernel is more likely to allocate from the DMA32 zone +where bbl places the DTB after the kernel image. + +Commit 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") +changed the mapping of the DTB to reside in the fixmap area. +Consequently, early_init_fdt_reserve_self() cannot be used anymore in +setup_bootmem() since it relies on __pa() to derive a physical address, +which does not work with dtb_early_va that is no longer a valid kernel +logical address. + +The reserved[0x1] region shows the effect of the pointer underflow +resulting from the __pa(initial_boot_params) offset subtraction: + +[ 0.000000] MEMBLOCK configuration: +[ 0.000000] memory size = 0x000000001fe00000 reserved size = 0x0000000000a2e514 +[ 0.000000] memory.cnt = 0x1 +[ 0.000000] memory[0x0] [0x0000000080200000-0x000000009fffffff], 0x000000001fe00000 bytes flags: 0x0 +[ 0.000000] reserved.cnt = 0x2 +[ 0.000000] reserved[0x0] [0x0000000080200000-0x0000000080c2dfeb], 0x0000000000a2dfec bytes flags: 0x0 +[ 0.000000] reserved[0x1] [0xfffffff080100000-0xfffffff080100527], 0x0000000000000528 bytes flags: 0x0 + +With the fix applied: + +[ 0.000000] MEMBLOCK configuration: +[ 0.000000] memory size = 0x000000001fe00000 reserved size = 0x0000000000a2e514 +[ 0.000000] memory.cnt = 0x1 +[ 0.000000] memory[0x0] [0x0000000080200000-0x000000009fffffff], 0x000000001fe00000 bytes flags: 0x0 +[ 0.000000] reserved.cnt = 0x2 +[ 0.000000] reserved[0x0] [0x0000000080200000-0x0000000080c2dfeb], 0x0000000000a2dfec bytes flags: 0x0 +[ 0.000000] reserved[0x1] [0x0000000080e00000-0x0000000080e00527], 0x0000000000000528 bytes flags: 0x0 + +Fixes: 671f9a3e2e24 ("RISC-V: Setup initial page tables in two stages") +Signed-off-by: Albert Ou +Tested-by: Bin Meng +Reviewed-by: Anup Patel +Signed-off-by: Paul Walmsley +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 42bf939693d34..ed9cd9944d4f9 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -82,6 +83,8 @@ static void __init setup_initrd(void) + } + #endif /* CONFIG_BLK_DEV_INITRD */ + ++static phys_addr_t dtb_early_pa __initdata; ++ + void __init setup_bootmem(void) + { + struct memblock_region *reg; +@@ -117,7 +120,12 @@ void __init setup_bootmem(void) + setup_initrd(); + #endif /* CONFIG_BLK_DEV_INITRD */ + +- early_init_fdt_reserve_self(); ++ /* ++ * Avoid using early_init_fdt_reserve_self() since __pa() does ++ * not work for DTB pointers that are fixmap addresses ++ */ ++ memblock_reserve(dtb_early_pa, fdt_totalsize(dtb_early_va)); ++ + early_init_fdt_scan_reserved_mem(); + memblock_allow_resize(); + memblock_dump_all(); +@@ -393,6 +401,8 @@ asmlinkage void __init setup_vm(uintptr_t dtb_pa) + + /* Save pointer to DTB for early FDT parsing */ + dtb_early_va = (void *)fix_to_virt(FIX_FDT) + (dtb_pa & ~PAGE_MASK); ++ /* Save physical address for memblock reservation */ ++ dtb_early_pa = dtb_pa; + } + + static void __init setup_vm_final(void) +-- +2.20.1 + diff --git a/queue-5.3/s390-mm-fix-wunused-but-set-variable-warnings.patch b/queue-5.3/s390-mm-fix-wunused-but-set-variable-warnings.patch new file mode 100644 index 00000000000..940fdb2e4b8 --- /dev/null +++ b/queue-5.3/s390-mm-fix-wunused-but-set-variable-warnings.patch @@ -0,0 +1,78 @@ +From ae41386d9c73f3b2beff999e90641740e0e33db0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2019 17:36:36 -0400 +Subject: s390/mm: fix -Wunused-but-set-variable warnings + +From: Qian Cai + +[ Upstream commit 51ce02216d4ad4e8f6a58de81d6e803cf04c418e ] + +Convert two functions to static inline to get ride of W=1 GCC warnings +like, + +mm/gup.c: In function 'gup_pte_range': +mm/gup.c:1816:16: warning: variable 'ptem' set but not used +[-Wunused-but-set-variable] + pte_t *ptep, *ptem; + ^~~~ + +mm/mmap.c: In function 'acct_stack_growth': +mm/mmap.c:2322:16: warning: variable 'new_start' set but not used +[-Wunused-but-set-variable] + unsigned long new_start; + ^~~~~~~~~ + +Signed-off-by: Qian Cai +Link: https://lore.kernel.org/lkml/1570138596-11913-1-git-send-email-cai@lca.pw/ +Signed-off-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/hugetlb.h | 9 +++++++-- + arch/s390/include/asm/pgtable.h | 3 ++- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/include/asm/hugetlb.h b/arch/s390/include/asm/hugetlb.h +index bb59dd9645909..de8f0bf5f238c 100644 +--- a/arch/s390/include/asm/hugetlb.h ++++ b/arch/s390/include/asm/hugetlb.h +@@ -12,8 +12,6 @@ + #include + #include + +- +-#define is_hugepage_only_range(mm, addr, len) 0 + #define hugetlb_free_pgd_range free_pgd_range + #define hugepages_supported() (MACHINE_HAS_EDAT1) + +@@ -23,6 +21,13 @@ pte_t huge_ptep_get(pte_t *ptep); + pte_t huge_ptep_get_and_clear(struct mm_struct *mm, + unsigned long addr, pte_t *ptep); + ++static inline bool is_hugepage_only_range(struct mm_struct *mm, ++ unsigned long addr, ++ unsigned long len) ++{ ++ return false; ++} ++ + /* + * If the arch doesn't supply something else, assume that hugepage + * size aligned regions are ok without further preparation. +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 9b274fcaacb68..70ac23e50cae9 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -1268,7 +1268,8 @@ static inline pte_t *pte_offset(pmd_t *pmd, unsigned long address) + + #define pte_offset_kernel(pmd, address) pte_offset(pmd, address) + #define pte_offset_map(pmd, address) pte_offset_kernel(pmd, address) +-#define pte_unmap(pte) do { } while (0) ++ ++static inline void pte_unmap(pte_t *pte) { } + + static inline bool gup_fast_permitted(unsigned long start, unsigned long end) + { +-- +2.20.1 + diff --git a/queue-5.3/scsi-megaraid-disable-device-when-probe-failed-after.patch b/queue-5.3/scsi-megaraid-disable-device-when-probe-failed-after.patch new file mode 100644 index 00000000000..a3a3f39d3f5 --- /dev/null +++ b/queue-5.3/scsi-megaraid-disable-device-when-probe-failed-after.patch @@ -0,0 +1,42 @@ +From e70f18b55c4537760cbf76dde3bf52c8efe3de3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Sep 2019 09:07:30 +0800 +Subject: scsi: megaraid: disable device when probe failed after enabled device + +From: Xiang Chen + +[ Upstream commit 70054aa39a013fa52eff432f2223b8bd5c0048f8 ] + +For pci device, need to disable device when probe failed after enabled +device. + +Link: https://lore.kernel.org/r/1567818450-173315-1-git-send-email-chenxiang66@hisilicon.com +Signed-off-by: Xiang Chen +Reviewed-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 45a66048801be..ff6d4aa924213 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -4183,11 +4183,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + */ + if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ && + pdev->subsystem_device == 0xC000) +- return -ENODEV; ++ goto out_disable_device; + /* Now check the magic signature byte */ + pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic); + if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE) +- return -ENODEV; ++ goto out_disable_device; + /* Ok it is probably a megaraid */ + } + +-- +2.20.1 + diff --git a/queue-5.3/scsi-qla2xxx-fix-n2n-link-reset.patch b/queue-5.3/scsi-qla2xxx-fix-n2n-link-reset.patch new file mode 100644 index 00000000000..ac953d3e423 --- /dev/null +++ b/queue-5.3/scsi-qla2xxx-fix-n2n-link-reset.patch @@ -0,0 +1,311 @@ +From 17ad619002e4953a0d345314180e97a7b61bfe3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 11:09:09 -0700 +Subject: scsi: qla2xxx: Fix N2N link reset + +From: Quinn Tran + +[ Upstream commit 7f2a398d59d658818f3d219645164676fbbc88e8 ] + +Fix stalled link recovery for N2N with FC-NVMe connection. + +Link: https://lore.kernel.org/r/20190912180918.6436-6-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_def.h | 3 +- + drivers/scsi/qla2xxx/qla_init.c | 107 +++++++++++++++++++++++--------- + drivers/scsi/qla2xxx/qla_mbx.c | 23 ++++++- + drivers/scsi/qla2xxx/qla_os.c | 4 ++ + 4 files changed, 103 insertions(+), 34 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index bad2b12604f1b..a2922b17b55b0 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -2338,6 +2338,7 @@ typedef struct fc_port { + unsigned int query:1; + unsigned int id_changed:1; + unsigned int scan_needed:1; ++ unsigned int n2n_flag:1; + + struct completion nvme_del_done; + uint32_t nvme_prli_service_param; +@@ -2388,7 +2389,6 @@ typedef struct fc_port { + uint8_t fc4_type; + uint8_t fc4f_nvme; + uint8_t scan_state; +- uint8_t n2n_flag; + + unsigned long last_queue_full; + unsigned long last_ramp_up; +@@ -2979,6 +2979,7 @@ enum scan_flags_t { + enum fc4type_t { + FS_FC4TYPE_FCP = BIT_0, + FS_FC4TYPE_NVME = BIT_1, ++ FS_FCP_IS_N2N = BIT_7, + }; + + struct fab_scan_rp { +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 3fbe909744a8f..cd74cc9651dea 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -746,12 +746,15 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, + break; + default: + if ((id.b24 != fcport->d_id.b24 && +- fcport->d_id.b24) || ++ fcport->d_id.b24 && ++ fcport->loop_id != FC_NO_LOOP_ID) || + (fcport->loop_id != FC_NO_LOOP_ID && + fcport->loop_id != loop_id)) { + ql_dbg(ql_dbg_disc, vha, 0x20e3, + "%s %d %8phC post del sess\n", + __func__, __LINE__, fcport->port_name); ++ if (fcport->n2n_flag) ++ fcport->d_id.b24 = 0; + qlt_schedule_sess_for_deletion(fcport); + return; + } +@@ -759,6 +762,8 @@ static void qla24xx_handle_gnl_done_event(scsi_qla_host_t *vha, + } + + fcport->loop_id = loop_id; ++ if (fcport->n2n_flag) ++ fcport->d_id.b24 = id.b24; + + wwn = wwn_to_u64(fcport->port_name); + qlt_find_sess_invalidate_other(vha, wwn, +@@ -966,7 +971,7 @@ qla24xx_async_gnl_sp_done(void *s, int res) + wwn = wwn_to_u64(e->port_name); + + ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x20e8, +- "%s %8phC %02x:%02x:%02x state %d/%d lid %x \n", ++ "%s %8phC %02x:%02x:%02x CLS %x/%x lid %x \n", + __func__, (void *)&wwn, e->port_id[2], e->port_id[1], + e->port_id[0], e->current_login_state, e->last_login_state, + (loop_id & 0x7fff)); +@@ -1498,7 +1503,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + (fcport->fw_login_state == DSC_LS_PRLI_PEND))) + return 0; + +- if (fcport->fw_login_state == DSC_LS_PLOGI_COMP) { ++ if (fcport->fw_login_state == DSC_LS_PLOGI_COMP && ++ !N2N_TOPO(vha->hw)) { + if (time_before_eq(jiffies, fcport->plogi_nack_done_deadline)) { + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + return 0; +@@ -1569,8 +1575,9 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + qla24xx_post_gpdb_work(vha, fcport, 0); + } else { + ql_dbg(ql_dbg_disc, vha, 0x2118, +- "%s %d %8phC post NVMe PRLI\n", +- __func__, __LINE__, fcport->port_name); ++ "%s %d %8phC post %s PRLI\n", ++ __func__, __LINE__, fcport->port_name, ++ fcport->fc4f_nvme ? "NVME" : "FC"); + qla24xx_post_prli_work(vha, fcport); + } + break; +@@ -1924,17 +1931,38 @@ qla24xx_handle_prli_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + break; + } + +- if (ea->fcport->n2n_flag) { ++ if (ea->fcport->fc4f_nvme) { + ql_dbg(ql_dbg_disc, vha, 0x2118, + "%s %d %8phC post fc4 prli\n", + __func__, __LINE__, ea->fcport->port_name); + ea->fcport->fc4f_nvme = 0; +- ea->fcport->n2n_flag = 0; + qla24xx_post_prli_work(vha, ea->fcport); ++ return; ++ } ++ ++ /* at this point both PRLI NVME & PRLI FCP failed */ ++ if (N2N_TOPO(vha->hw)) { ++ if (ea->fcport->n2n_link_reset_cnt < 3) { ++ ea->fcport->n2n_link_reset_cnt++; ++ /* ++ * remote port is not sending Plogi. Reset ++ * link to kick start his state machine ++ */ ++ set_bit(N2N_LINK_RESET, &vha->dpc_flags); ++ } else { ++ ql_log(ql_log_warn, vha, 0x2119, ++ "%s %d %8phC Unable to reconnect\n", ++ __func__, __LINE__, ea->fcport->port_name); ++ } ++ } else { ++ /* ++ * switch connect. login failed. Take connection ++ * down and allow relogin to retrigger ++ */ ++ ea->fcport->flags &= ~FCF_ASYNC_SENT; ++ ea->fcport->keep_nport_handle = 0; ++ qlt_schedule_sess_for_deletion(ea->fcport); + } +- ql_dbg(ql_dbg_disc, vha, 0x2119, +- "%s %d %8phC unhandle event of %x\n", +- __func__, __LINE__, ea->fcport->port_name, ea->data[0]); + break; + } + } +@@ -5078,28 +5106,47 @@ qla2x00_configure_local_loop(scsi_qla_host_t *vha) + unsigned long flags; + + /* Inititae N2N login. */ +- if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) { +- /* borrowing */ +- u32 *bp, i, sz; +- +- memset(ha->init_cb, 0, ha->init_cb_size); +- sz = min_t(int, sizeof(struct els_plogi_payload), +- ha->init_cb_size); +- rval = qla24xx_get_port_login_templ(vha, ha->init_cb_dma, +- (void *)ha->init_cb, sz); +- if (rval == QLA_SUCCESS) { +- bp = (uint32_t *)ha->init_cb; +- for (i = 0; i < sz/4 ; i++, bp++) +- *bp = cpu_to_be32(*bp); ++ if (N2N_TOPO(ha)) { ++ if (test_and_clear_bit(N2N_LOGIN_NEEDED, &vha->dpc_flags)) { ++ /* borrowing */ ++ u32 *bp, i, sz; ++ ++ memset(ha->init_cb, 0, ha->init_cb_size); ++ sz = min_t(int, sizeof(struct els_plogi_payload), ++ ha->init_cb_size); ++ rval = qla24xx_get_port_login_templ(vha, ++ ha->init_cb_dma, (void *)ha->init_cb, sz); ++ if (rval == QLA_SUCCESS) { ++ bp = (uint32_t *)ha->init_cb; ++ for (i = 0; i < sz/4 ; i++, bp++) ++ *bp = cpu_to_be32(*bp); + +- memcpy(&ha->plogi_els_payld.data, (void *)ha->init_cb, +- sizeof(ha->plogi_els_payld.data)); +- set_bit(RELOGIN_NEEDED, &vha->dpc_flags); +- } else { +- ql_dbg(ql_dbg_init, vha, 0x00d1, +- "PLOGI ELS param read fail.\n"); ++ memcpy(&ha->plogi_els_payld.data, ++ (void *)ha->init_cb, ++ sizeof(ha->plogi_els_payld.data)); ++ set_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ } else { ++ ql_dbg(ql_dbg_init, vha, 0x00d1, ++ "PLOGI ELS param read fail.\n"); ++ goto skip_login; ++ } ++ } ++ ++ list_for_each_entry(fcport, &vha->vp_fcports, list) { ++ if (fcport->n2n_flag) { ++ qla24xx_fcport_handle_login(vha, fcport); ++ return QLA_SUCCESS; ++ } ++ } ++skip_login: ++ spin_lock_irqsave(&vha->work_lock, flags); ++ vha->scan.scan_retry++; ++ spin_unlock_irqrestore(&vha->work_lock, flags); ++ ++ if (vha->scan.scan_retry < MAX_SCAN_RETRIES) { ++ set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); ++ set_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags); + } +- return QLA_SUCCESS; + } + + found_devs = 0; +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 133f5f6270ffa..aadff0124f39f 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -2257,7 +2257,7 @@ qla2x00_lip_reset(scsi_qla_host_t *vha) + mbx_cmd_t mc; + mbx_cmd_t *mcp = &mc; + +- ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x105a, ++ ql_dbg(ql_dbg_disc, vha, 0x105a, + "Entered %s.\n", __func__); + + if (IS_CNA_CAPABLE(vha->hw)) { +@@ -3891,14 +3891,23 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + case TOPO_N2N: + ha->current_topology = ISP_CFG_N; + spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags); ++ list_for_each_entry(fcport, &vha->vp_fcports, list) { ++ fcport->scan_state = QLA_FCPORT_SCAN; ++ fcport->n2n_flag = 0; ++ } ++ + fcport = qla2x00_find_fcport_by_wwpn(vha, + rptid_entry->u.f1.port_name, 1); + spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); + + if (fcport) { + fcport->plogi_nack_done_deadline = jiffies + HZ; +- fcport->dm_login_expire = jiffies + 3*HZ; ++ fcport->dm_login_expire = jiffies + 2*HZ; + fcport->scan_state = QLA_FCPORT_FOUND; ++ fcport->n2n_flag = 1; ++ if (vha->flags.nvme_enabled) ++ fcport->fc4f_nvme = 1; ++ + switch (fcport->disc_state) { + case DSC_DELETED: + set_bit(RELOGIN_NEEDED, +@@ -3932,7 +3941,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + rptid_entry->u.f1.port_name, + rptid_entry->u.f1.node_name, + NULL, +- FC4_TYPE_UNKNOWN); ++ FS_FCP_IS_N2N); + } + + /* if our portname is higher then initiate N2N login */ +@@ -4031,6 +4040,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + + list_for_each_entry(fcport, &vha->vp_fcports, list) { + fcport->scan_state = QLA_FCPORT_SCAN; ++ fcport->n2n_flag = 0; + } + + fcport = qla2x00_find_fcport_by_wwpn(vha, +@@ -4040,6 +4050,13 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + fcport->login_retry = vha->hw->login_retry_count; + fcport->plogi_nack_done_deadline = jiffies + HZ; + fcport->scan_state = QLA_FCPORT_FOUND; ++ fcport->n2n_flag = 1; ++ fcport->d_id.b.domain = ++ rptid_entry->u.f2.remote_nport_id[2]; ++ fcport->d_id.b.area = ++ rptid_entry->u.f2.remote_nport_id[1]; ++ fcport->d_id.b.al_pa = ++ rptid_entry->u.f2.remote_nport_id[0]; + } + } + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 084e39e415ff5..12d5f50646fba 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -5050,6 +5050,10 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e) + + memcpy(fcport->port_name, e->u.new_sess.port_name, + WWN_SIZE); ++ ++ if (e->u.new_sess.fc4_type & FS_FCP_IS_N2N) ++ fcport->n2n_flag = 1; ++ + } else { + ql_dbg(ql_dbg_disc, vha, 0xffff, + "%s %8phC mem alloc fail.\n", +-- +2.20.1 + diff --git a/queue-5.3/scsi-qla2xxx-fix-n2n-link-up-fail.patch b/queue-5.3/scsi-qla2xxx-fix-n2n-link-up-fail.patch new file mode 100644 index 00000000000..1b2b4747c3b --- /dev/null +++ b/queue-5.3/scsi-qla2xxx-fix-n2n-link-up-fail.patch @@ -0,0 +1,64 @@ +From 2f26fedbb20554c1cc555ee9218aeba39d03aee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 11:09:10 -0700 +Subject: scsi: qla2xxx: Fix N2N link up fail + +From: Quinn Tran + +[ Upstream commit f3f1938bb673b1b5ad182c4608f5f8a24921eea3 ] + +During link up/bounce, qla driver would do command flush as part of +cleanup. In this case, the flush can intefere with FW state. This patch +allows FW to be in control of link up. + +Link: https://lore.kernel.org/r/20190912180918.6436-7-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 ++ + drivers/scsi/qla2xxx/qla_os.c | 6 ++---- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index aadff0124f39f..abfb9c800ce28 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3905,6 +3905,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + fcport->dm_login_expire = jiffies + 2*HZ; + fcport->scan_state = QLA_FCPORT_FOUND; + fcport->n2n_flag = 1; ++ fcport->keep_nport_handle = 1; + if (vha->flags.nvme_enabled) + fcport->fc4f_nvme = 1; + +@@ -4050,6 +4051,7 @@ qla24xx_report_id_acquisition(scsi_qla_host_t *vha, + fcport->login_retry = vha->hw->login_retry_count; + fcport->plogi_nack_done_deadline = jiffies + HZ; + fcport->scan_state = QLA_FCPORT_FOUND; ++ fcport->keep_nport_handle = 1; + fcport->n2n_flag = 1; + fcport->d_id.b.domain = + rptid_entry->u.f2.remote_nport_id[2]; +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 12d5f50646fba..2835afbd2edc7 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -5150,11 +5150,9 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e) + if (dfcp) + qlt_schedule_sess_for_deletion(tfcp); + +- +- if (N2N_TOPO(vha->hw)) +- fcport->flags &= ~FCF_FABRIC_DEVICE; +- + if (N2N_TOPO(vha->hw)) { ++ fcport->flags &= ~FCF_FABRIC_DEVICE; ++ fcport->keep_nport_handle = 1; + if (vha->flags.nvme_enabled) { + fcport->fc4f_nvme = 1; + fcport->n2n_flag = 1; +-- +2.20.1 + diff --git a/queue-5.3/scsi-qla2xxx-fix-stale-mem-access-on-driver-unload.patch b/queue-5.3/scsi-qla2xxx-fix-stale-mem-access-on-driver-unload.patch new file mode 100644 index 00000000000..cb06f597e20 --- /dev/null +++ b/queue-5.3/scsi-qla2xxx-fix-stale-mem-access-on-driver-unload.patch @@ -0,0 +1,98 @@ +From 62d4b720faf0eceef1a7a6768967f60d63cc3f84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 11:09:07 -0700 +Subject: scsi: qla2xxx: Fix stale mem access on driver unload + +From: Quinn Tran + +[ Upstream commit fd5564ba54e0d8a9e3e823d311b764232e09eb5f ] + +On driver unload, 'remove_one' thread was allowed to advance, while session +cleanup still lag behind. This patch ensures session deletion will finish +before remove_one can advance. + +Link: https://lore.kernel.org/r/20190912180918.6436-4-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 1 + + drivers/scsi/qla2xxx/qla_target.c | 21 ++++++++------------- + 2 files changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 4fda308c3ef5c..084e39e415ff5 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1153,6 +1153,7 @@ qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha) + qla2x00_mark_all_devices_lost(vha, 0); + + wait_event_timeout(vha->fcport_waitQ, test_fcport_count(vha), 10*HZ); ++ flush_workqueue(vha->hw->wq); + } + + /* +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index f77baf107024f..1bb0fc9324ead 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -954,7 +954,7 @@ void qlt_free_session_done(struct work_struct *work) + struct qla_hw_data *ha = vha->hw; + unsigned long flags; + bool logout_started = false; +- scsi_qla_host_t *base_vha; ++ scsi_qla_host_t *base_vha = pci_get_drvdata(ha->pdev); + struct qlt_plogi_ack_t *own = + sess->plogi_link[QLT_PLOGI_LINK_SAME_WWN]; + +@@ -1106,6 +1106,7 @@ void qlt_free_session_done(struct work_struct *work) + } + + spin_unlock_irqrestore(&ha->tgt.sess_lock, flags); ++ sess->free_pending = 0; + + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf001, + "Unregistration of sess %p %8phC finished fcp_cnt %d\n", +@@ -1114,17 +1115,8 @@ void qlt_free_session_done(struct work_struct *work) + if (tgt && (tgt->sess_count == 0)) + wake_up_all(&tgt->waitQ); + +- if (vha->fcport_count == 0) +- wake_up_all(&vha->fcport_waitQ); +- +- base_vha = pci_get_drvdata(ha->pdev); +- +- sess->free_pending = 0; +- +- if (test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags)) +- return; +- +- if ((!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) { ++ if (!test_bit(PFLG_DRIVER_REMOVING, &base_vha->pci_flags) && ++ (!tgt || !tgt->tgt_stop) && !LOOP_TRANSITION(vha)) { + switch (vha->host->active_mode) { + case MODE_INITIATOR: + case MODE_DUAL: +@@ -1137,6 +1129,9 @@ void qlt_free_session_done(struct work_struct *work) + break; + } + } ++ ++ if (vha->fcport_count == 0) ++ wake_up_all(&vha->fcport_waitQ); + } + + /* ha->tgt.sess_lock supposed to be held on entry */ +@@ -1166,7 +1161,7 @@ void qlt_unreg_sess(struct fc_port *sess) + sess->last_login_gen = sess->login_gen; + + INIT_WORK(&sess->free_work, qlt_free_session_done); +- schedule_work(&sess->free_work); ++ queue_work(sess->vha->hw->wq, &sess->free_work); + } + EXPORT_SYMBOL(qlt_unreg_sess); + +-- +2.20.1 + diff --git a/queue-5.3/scsi-qla2xxx-fix-unbound-sleep-in-fcport-delete-path.patch b/queue-5.3/scsi-qla2xxx-fix-unbound-sleep-in-fcport-delete-path.patch new file mode 100644 index 00000000000..4325aef8217 --- /dev/null +++ b/queue-5.3/scsi-qla2xxx-fix-unbound-sleep-in-fcport-delete-path.patch @@ -0,0 +1,47 @@ +From a1a82fa237686b3b7cf78cff20ce7286f59dbe1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 11:09:06 -0700 +Subject: scsi: qla2xxx: Fix unbound sleep in fcport delete path. + +From: Quinn Tran + +[ Upstream commit c3b6a1d397420a0fdd97af2f06abfb78adc370df ] + +There are instances, though rare, where a LOGO request cannot be sent out +and the thread in free session done can wait indefinitely. Fix this by +putting an upper bound to sleep. + +Link: https://lore.kernel.org/r/20190912180918.6436-3-hmadhani@marvell.com +Signed-off-by: Quinn Tran +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 459c28aa3b94a..f77baf107024f 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1021,6 +1021,7 @@ void qlt_free_session_done(struct work_struct *work) + + if (logout_started) { + bool traced = false; ++ u16 cnt = 0; + + while (!READ_ONCE(sess->logout_completed)) { + if (!traced) { +@@ -1030,6 +1031,9 @@ void qlt_free_session_done(struct work_struct *work) + traced = true; + } + msleep(100); ++ cnt++; ++ if (cnt > 200) ++ break; + } + + ql_dbg(ql_dbg_disc, vha, 0xf087, +-- +2.20.1 + diff --git a/queue-5.3/scsi-qla2xxx-silence-fwdump-template-message.patch b/queue-5.3/scsi-qla2xxx-silence-fwdump-template-message.patch new file mode 100644 index 00000000000..1e196e94682 --- /dev/null +++ b/queue-5.3/scsi-qla2xxx-silence-fwdump-template-message.patch @@ -0,0 +1,36 @@ +From 5f834edb67c1a9eda5c8b24761b7e102d3902dc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2019 11:09:05 -0700 +Subject: scsi: qla2xxx: Silence fwdump template message + +From: Himanshu Madhani + +[ Upstream commit 248a445adfc8c33ffd67cf1f2e336578e34f9e21 ] + +Print if fwdt template is present or not, only when +ql2xextended_error_logging is enabled. + +Link: https://lore.kernel.org/r/20190912180918.6436-2-hmadhani@marvell.com +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index afcd9a8858845..3fbe909744a8f 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -3268,7 +3268,7 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + + for (j = 0; j < 2; j++, fwdt++) { + if (!fwdt->template) { +- ql_log(ql_log_warn, vha, 0x00ba, ++ ql_dbg(ql_dbg_init, vha, 0x00ba, + "-> fwdt%u no template\n", j); + continue; + } +-- +2.20.1 + diff --git a/queue-5.3/scsi-ufs-skip-shutdown-if-hba-is-not-powered.patch b/queue-5.3/scsi-ufs-skip-shutdown-if-hba-is-not-powered.patch new file mode 100644 index 00000000000..351d3616f14 --- /dev/null +++ b/queue-5.3/scsi-ufs-skip-shutdown-if-hba-is-not-powered.patch @@ -0,0 +1,46 @@ +From 134ff85d99f1f6b0268b06c54c884d816216713a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Sep 2019 12:20:38 +0800 +Subject: scsi: ufs: skip shutdown if hba is not powered + +From: Stanley Chu + +[ Upstream commit f51913eef23f74c3bd07899dc7f1ed6df9e521d8 ] + +In some cases, hba may go through shutdown flow without successful +initialization and then make system hang. + +For example, if ufshcd_change_power_mode() gets error and leads to +ufshcd_hba_exit() to release resources of the host, future shutdown flow +may hang the system since the host register will be accessed in unpowered +state. + +To solve this issue, simply add checking to skip shutdown for above kind of +situation. + +Link: https://lore.kernel.org/r/1568780438-28753-1-git-send-email-stanley.chu@mediatek.com +Signed-off-by: Stanley Chu +Acked-by: Bean Huo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 029da74bb2f5c..e674f6148f698 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -8095,6 +8095,9 @@ int ufshcd_shutdown(struct ufs_hba *hba) + { + int ret = 0; + ++ if (!hba->is_powered) ++ goto out; ++ + if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba)) + goto out; + +-- +2.20.1 + diff --git a/queue-5.3/selftests-kvm-fix-libkvm-build-error.patch b/queue-5.3/selftests-kvm-fix-libkvm-build-error.patch new file mode 100644 index 00000000000..845fd2e344a --- /dev/null +++ b/queue-5.3/selftests-kvm-fix-libkvm-build-error.patch @@ -0,0 +1,55 @@ +From 31b782f9c3d539cc92304da4e144e9ad81af7bdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 17:14:30 -0600 +Subject: selftests: kvm: Fix libkvm build error + +From: Shuah Khan + +[ Upstream commit 6e06983dde969c15eb4fdab77f0eda8b18ea28e6 ] + +Fix the following build error from "make TARGETS=kvm kselftest": + +libkvm.a(assert.o): relocation R_X86_64_32 against `.rodata.str1.1' can not be used when making a PIE object; recompile with -fPIC + +This error is seen when build is done from the main Makefile using +kselftest target. In this case KBUILD_CPPFLAGS and CC_OPTION_CFLAGS +are defined. + +When build is invoked using: + +"make -C tools/testing/selftests/kvm" KBUILD_CPPFLAGS and CC_OPTION_CFLAGS +aren't defined. + +There is no need to pass in KBUILD_CPPFLAGS and CC_OPTION_CFLAGS for the +check to determine if --no-pie is necessary, which is the case when these +two aren't defined when "make -C tools/testing/selftests/kvm" runs. + +Fix it by simplifying the no-pie-option logic. With this change, both +build variations work. + +"make TARGETS=kvm kselftest" +"make -C tools/testing/selftests/kvm" + +Signed-off-by: Shuah Khan +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile +index ba78497519894..fc8aeb224c032 100644 +--- a/tools/testing/selftests/kvm/Makefile ++++ b/tools/testing/selftests/kvm/Makefile +@@ -46,7 +46,7 @@ CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \ + -I$(LINUX_HDR_PATH) -Iinclude -I$( +Date: Fri, 27 Sep 2019 16:49:20 +0100 +Subject: xen/efi: Set nonblocking callbacks + +From: Ross Lagerwall + +[ Upstream commit df359f0d09dc029829b66322707a2f558cb720f7 ] + +Other parts of the kernel expect these nonblocking EFI callbacks to +exist and crash when running under Xen. Since the implementations of +xen_efi_set_variable() and xen_efi_query_variable_info() do not take any +locks, use them for the nonblocking callbacks too. + +Signed-off-by: Ross Lagerwall +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/arm/xen/efi.c | 2 ++ + arch/x86/xen/efi.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/arch/arm/xen/efi.c b/arch/arm/xen/efi.c +index d687a73044bfa..cb2aaf98e243d 100644 +--- a/arch/arm/xen/efi.c ++++ b/arch/arm/xen/efi.c +@@ -19,7 +19,9 @@ void __init xen_efi_runtime_setup(void) + efi.get_variable = xen_efi_get_variable; + efi.get_next_variable = xen_efi_get_next_variable; + efi.set_variable = xen_efi_set_variable; ++ efi.set_variable_nonblocking = xen_efi_set_variable; + efi.query_variable_info = xen_efi_query_variable_info; ++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info; + efi.update_capsule = xen_efi_update_capsule; + efi.query_capsule_caps = xen_efi_query_capsule_caps; + efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count; +diff --git a/arch/x86/xen/efi.c b/arch/x86/xen/efi.c +index 0d3365cb64de0..7e3eb70f411ab 100644 +--- a/arch/x86/xen/efi.c ++++ b/arch/x86/xen/efi.c +@@ -65,7 +65,9 @@ static efi_system_table_t __init *xen_efi_probe(void) + efi.get_variable = xen_efi_get_variable; + efi.get_next_variable = xen_efi_get_next_variable; + efi.set_variable = xen_efi_set_variable; ++ efi.set_variable_nonblocking = xen_efi_set_variable; + efi.query_variable_info = xen_efi_query_variable_info; ++ efi.query_variable_info_nonblocking = xen_efi_query_variable_info; + efi.update_capsule = xen_efi_update_capsule; + efi.query_capsule_caps = xen_efi_query_capsule_caps; + efi.get_next_high_mono_count = xen_efi_get_next_high_mono_count; +-- +2.20.1 +