From: Sasha Levin Date: Sat, 9 Feb 2019 17:52:47 +0000 (-0500) Subject: autosel patches for 4.20 X-Git-Tag: v4.9.156~51 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=eadbac203b3a3ae47cb08a1276b01cdba5b772f3;p=thirdparty%2Fkernel%2Fstable-queue.git autosel patches for 4.20 Signed-off-by: Sasha Levin --- diff --git a/queue-4.20/acpi-apei-clear-ghes-block_status-before-panic.patch b/queue-4.20/acpi-apei-clear-ghes-block_status-before-panic.patch new file mode 100644 index 00000000000..ca062c1d3b9 --- /dev/null +++ b/queue-4.20/acpi-apei-clear-ghes-block_status-before-panic.patch @@ -0,0 +1,42 @@ +From f7701b2c62d88c7ea57e900fe1f4ca474ae4142a Mon Sep 17 00:00:00 2001 +From: Lenny Szubowicz +Date: Wed, 19 Dec 2018 11:50:52 -0500 +Subject: ACPI/APEI: Clear GHES block_status before panic() + +[ Upstream commit 98cff8b23ed1c763a029ee81ea300df0d153d07d ] + +In __ghes_panic() clear the block status in the APEI generic +error status block for that generic hardware error source before +calling panic() to prevent a second panic() in the crash kernel +for exactly the same fatal error. + +Otherwise ghes_probe(), running in the crash kernel, would see +an unhandled error in the APEI generic error status block and +panic again, thereby precluding any crash dump. + +Signed-off-by: Lenny Szubowicz +Signed-off-by: David Arcari +Tested-by: Tyler Baicar +Acked-by: Borislav Petkov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 02c6fd9caff7..f008ba7c9ced 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -691,6 +691,8 @@ static void __ghes_panic(struct ghes *ghes) + { + __ghes_print_estatus(KERN_EMERG, ghes->generic, ghes->estatus); + ++ ghes_clear_estatus(ghes); ++ + /* reboot to log the error! */ + if (!panic_timeout) + panic_timeout = ghes_panic_timeout; +-- +2.19.1 + diff --git a/queue-4.20/acpi-spcr-consider-baud-rate-0-as-preconfigured-stat.patch b/queue-4.20/acpi-spcr-consider-baud-rate-0-as-preconfigured-stat.patch new file mode 100644 index 00000000000..8dd9cfe3598 --- /dev/null +++ b/queue-4.20/acpi-spcr-consider-baud-rate-0-as-preconfigured-stat.patch @@ -0,0 +1,52 @@ +From ac500467cf421e97d5b74edc493addc7ab8ce8ef Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Wed, 21 Nov 2018 15:43:37 +0200 +Subject: ACPI: SPCR: Consider baud rate 0 as preconfigured state + +[ Upstream commit b413b1abeb21b4a152c0bf8d1379efa30759b6e3 ] + +Since SPCR 1.04 [1] the baud rate of 0 means a preconfigured state of UART. +Assume firmware or bootloader configures console correctly. + +[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table + +Signed-off-by: Andy Shevchenko +Reviewed-by: Prarit Bhargava +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/spcr.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/acpi/spcr.c b/drivers/acpi/spcr.c +index 9d52743080a4..c336784d0bcb 100644 +--- a/drivers/acpi/spcr.c ++++ b/drivers/acpi/spcr.c +@@ -148,6 +148,13 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console) + } + + switch (table->baud_rate) { ++ case 0: ++ /* ++ * SPCR 1.04 defines 0 as a preconfigured state of UART. ++ * Assume firmware or bootloader configures console correctly. ++ */ ++ baud_rate = 0; ++ break; + case 3: + baud_rate = 9600; + break; +@@ -196,6 +203,10 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console) + * UART so don't attempt to change to the baud rate state + * in the table because driver cannot calculate the dividers + */ ++ baud_rate = 0; ++ } ++ ++ if (!baud_rate) { + snprintf(opts, sizeof(opts), "%s,%s,0x%llx", uart, iotype, + table->serial_port.address); + } else { +-- +2.19.1 + diff --git a/queue-4.20/arch-sh-boards-mach-kfr2r09-setup.c-fix-struct-mtd_o.patch b/queue-4.20/arch-sh-boards-mach-kfr2r09-setup.c-fix-struct-mtd_o.patch new file mode 100644 index 00000000000..4cca481e19f --- /dev/null +++ b/queue-4.20/arch-sh-boards-mach-kfr2r09-setup.c-fix-struct-mtd_o.patch @@ -0,0 +1,49 @@ +From 5fd7ffb8ffc9fdea06caabf14e93df7127e933f1 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Fri, 28 Dec 2018 00:31:39 -0800 +Subject: arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build + warning + +[ Upstream commit 440e7b379f91acd245d5c8de94d533f40f5dffb3 ] + +arch/sh/boards/mach-kfr2r09/setup.c does not need to #include +, and doing so causes a build warning, so drop that header +file. + +In file included from ../arch/sh/boards/mach-kfr2r09/setup.c:28: +../include/linux/mtd/onenand.h:225:12: warning: 'struct mtd_oob_ops' declared inside parameter list will not be visible outside of this definition or declaration + struct mtd_oob_ops *ops); + +Link: http://lkml.kernel.org/r/702f0a25-c63e-6912-4640-6ab0f00afbc7@infradead.org +Fixes: f3590dc32974 ("media: arch: sh: kfr2r09: Use new renesas-ceu camera driver") + +Signed-off-by: Randy Dunlap +Reported-by: Geert Uytterhoeven +Suggested-by: Miquel Raynal +Reviewed-by: Miquel Raynal +Cc: Yoshinori Sato +Cc: Rich Felker +Cc: Jacopo Mondi +Cc: Magnus Damm +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/sh/boards/mach-kfr2r09/setup.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c +index e59c577ed871..c70bc7809dda 100644 +--- a/arch/sh/boards/mach-kfr2r09/setup.c ++++ b/arch/sh/boards/mach-kfr2r09/setup.c +@@ -25,7 +25,6 @@ + #include + #include + #include +-#include + #include + #include + #include +-- +2.19.1 + diff --git a/queue-4.20/arm-8808-1-kexec-offline-panic_smp_self_stop-cpu.patch b/queue-4.20/arm-8808-1-kexec-offline-panic_smp_self_stop-cpu.patch new file mode 100644 index 00000000000..b0f4a15dcb9 --- /dev/null +++ b/queue-4.20/arm-8808-1-kexec-offline-panic_smp_self_stop-cpu.patch @@ -0,0 +1,63 @@ +From 3f4dcee062c975c649321bb5350efde7b40dc42d Mon Sep 17 00:00:00 2001 +From: Yufen Wang +Date: Fri, 2 Nov 2018 11:51:31 +0100 +Subject: ARM: 8808/1: kexec:offline panic_smp_self_stop CPU + +[ Upstream commit 82c08c3e7f171aa7f579b231d0abbc1d62e91974 ] + +In case panic() and panic() called at the same time on different CPUS. +For example: +CPU 0: + panic() + __crash_kexec + machine_crash_shutdown + crash_smp_send_stop + machine_kexec + BUG_ON(num_online_cpus() > 1); + +CPU 1: + panic() + local_irq_disable + panic_smp_self_stop + +If CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop(), kdump +fails. CPU1 can't receive the ipi irq, CPU1 will be always online. +To fix this problem, this patch split out the panic_smp_self_stop() +and add set_cpu_online(smp_processor_id(), false). + +Signed-off-by: Yufen Wang +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/smp.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 12a6172263c0..3bf82232b1be 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -724,6 +724,21 @@ void smp_send_stop(void) + pr_warn("SMP: failed to stop secondary CPUs\n"); + } + ++/* In case panic() and panic() called at the same time on CPU1 and CPU2, ++ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop() ++ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online, ++ * kdump fails. So split out the panic_smp_self_stop() and add ++ * set_cpu_online(smp_processor_id(), false). ++ */ ++void panic_smp_self_stop(void) ++{ ++ pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n", ++ smp_processor_id()); ++ set_cpu_online(smp_processor_id(), false); ++ while (1) ++ cpu_relax(); ++} ++ + /* + * not supported here + */ +-- +2.19.1 + diff --git a/queue-4.20/arm-dts-aspeed-add-missing-memory-unit-address.patch b/queue-4.20/arm-dts-aspeed-add-missing-memory-unit-address.patch new file mode 100644 index 00000000000..e56a695c72f --- /dev/null +++ b/queue-4.20/arm-dts-aspeed-add-missing-memory-unit-address.patch @@ -0,0 +1,90 @@ +From 79e464cdabfc177c1bf192ac96bfe1293980a690 Mon Sep 17 00:00:00 2001 +From: Rob Herring +Date: Thu, 29 Nov 2018 19:52:51 -0600 +Subject: ARM: dts: aspeed: add missing memory unit-address + +[ Upstream commit 8ef86955fe59f7912a40d57ae4c6d511f0187b4d ] + +The base aspeed-g5.dtsi already defines a '/memory@80000000' node, so +'/memory' in the board files create a duplicate node. We're probably +getting lucky that the bootloader fixes up the memory node that the +kernel ends up using. Add the unit-address so it's merged with the base +node. + +Found with DT json-schema checks. + +Cc: Joel Stanley +Cc: Andrew Jeffery +Cc: devicetree@vger.kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-aspeed@lists.ozlabs.org +Signed-off-by: Rob Herring +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts | 2 +- + arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 2 +- + arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts | 3 +-- + arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts | 2 +- + 4 files changed, 4 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts +index df1227613d48..c2ece0b91885 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts +@@ -13,7 +13,7 @@ + bootargs = "console=ttyS4,115200 earlyprintk"; + }; + +- memory { ++ memory@80000000 { + reg = <0x80000000 0x40000000>; + }; + +diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts +index 7a291de02543..22dade6393d0 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts +@@ -13,7 +13,7 @@ + bootargs = "earlyprintk"; + }; + +- memory { ++ memory@80000000 { + reg = <0x80000000 0x20000000>; + }; + +diff --git a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts +index d598b6391362..024e52a6cd0f 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts +@@ -14,7 +14,7 @@ + bootargs = "console=ttyS4,115200 earlyprintk"; + }; + +- memory { ++ memory@80000000 { + reg = <0x80000000 0x40000000>; + }; + +@@ -322,4 +322,3 @@ + &adc { + status = "okay"; + }; +- +diff --git a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts +index 43ed13963d35..33d704541de6 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts +@@ -17,7 +17,7 @@ + bootargs = "console=ttyS4,115200 earlyprintk"; + }; + +- memory { ++ memory@80000000 { + reg = <0x80000000 0x20000000>; + }; + +-- +2.19.1 + diff --git a/queue-4.20/arm-dts-fix-omap4430-sdp-ethernet-startup.patch b/queue-4.20/arm-dts-fix-omap4430-sdp-ethernet-startup.patch new file mode 100644 index 00000000000..93eb0160303 --- /dev/null +++ b/queue-4.20/arm-dts-fix-omap4430-sdp-ethernet-startup.patch @@ -0,0 +1,65 @@ +From 9d523825319b77b82e7e4d56f75b71a89b804fe4 Mon Sep 17 00:00:00 2001 +From: Russell King - ARM Linux +Date: Fri, 7 Dec 2018 09:17:07 -0800 +Subject: ARM: dts: Fix OMAP4430 SDP Ethernet startup + +[ Upstream commit 84fb6c7feb1494ebb7d1ec8b95cfb7ada0264465 ] + +It was noticed that unbinding and rebinding the KSZ8851 ethernet +resulted in the driver reporting "failed to read device ID" at probe. +Probing the reset line with a 'scope while repeatedly attempting to +bind the driver in a shell loop revealed that the KSZ8851 RSTN pin is +constantly held at zero, meaning the device is held in reset, and +does not respond on the SPI bus. + +Experimentation with the startup delay on the regulator set to 50ms +shows that the reset is positively released after 20ms. + +Schematics for this board are not available, and the traces are buried +in the inner layers of the board which makes tracing where the RSTN pin +extremely difficult. We can only guess that the RSTN pin is wired to a +reset generator chip driven off the ethernet supply, which fits the +observed behaviour. + +Include this delay in the regulator startup delay - effectively +treating the reset as a "supply stable" indicator. + +This can not be modelled as a delay in the KSZ8851 driver since the +reset generation is board specific - if the RSTN pin had been wired to +a GPIO, reset could be released earlier via the already provided support +in the KSZ8851 driver. + +This also got confirmed by Peter Ujfalusi based +on Blaze schematics that should be very close to SDP4430: + +TPS22902YFPR is used as the regulator switch (gpio48 controlled): +Convert arm boot_lock to raw The VOUT is routed to TPS3808G01DBV. +(SCH Note: Threshold set at 90%. Vsense: 0.405V). + +According to the TPS3808 data sheet the RESET delay time when Ct is +open (this is the case in the schema): MIN/TYP/MAX: 12/20/28 ms. + +Signed-off-by: Russell King +Reviewed-by: Peter Ujfalusi +[tony@atomide.com: updated with notes from schematics from Peter] +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap4-sdp.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/omap4-sdp.dts b/arch/arm/boot/dts/omap4-sdp.dts +index 490726b52216..9dc7ec7655cb 100644 +--- a/arch/arm/boot/dts/omap4-sdp.dts ++++ b/arch/arm/boot/dts/omap4-sdp.dts +@@ -33,6 +33,7 @@ + gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>; /* gpio line 48 */ + enable-active-high; + regulator-boot-on; ++ startup-delay-us = <25000>; + }; + + vbat: fixedregulator-vbat { +-- +2.19.1 + diff --git a/queue-4.20/arm-dts-fix-up-the-d-link-dir-685-mtd-partition-info.patch b/queue-4.20/arm-dts-fix-up-the-d-link-dir-685-mtd-partition-info.patch new file mode 100644 index 00000000000..5da2ea4f818 --- /dev/null +++ b/queue-4.20/arm-dts-fix-up-the-d-link-dir-685-mtd-partition-info.patch @@ -0,0 +1,74 @@ +From f86f631669853ac752ada7987440a30e455822e9 Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 17 May 2018 17:00:10 +0200 +Subject: ARM: dts: Fix up the D-Link DIR-685 MTD partition info + +[ Upstream commit 738a05e673435afb986b53da43befd83ad87ec3b ] + +The vendor firmware was analyzed to get the right idea about +this flash layout. /proc/mtd contains: + +dev: size erasesize name +mtd0: 01e7ff40 00020000 "rootfs" +mtd1: 01f40000 00020000 "upgrade" +mtd2: 00040000 00020000 "rgdb" +mtd3: 00020000 00020000 "nvram" +mtd4: 00040000 00020000 "RedBoot" +mtd5: 00020000 00020000 "LangPack" +mtd6: 02000000 00020000 "flash" + +Here "flash" is obviously the whole device and we know "rootfs" +is a bogus hack to point to a squashfs rootfs inside of the main +"upgrade partition". We know "RedBoot" is the first 0x40000 of +the flash and the "upgrade" partition follows from 0x40000 to +0x1f8000. So we have mtd0, 1, 4 and 6 covered. + +Remains: +mtd2: 00040000 00020000 "rgdb" +mtd3: 00020000 00020000 "nvram" +mtd5: 00020000 00020000 "LangPack" + +Inspecting the flash at 0x1f8000 and 0x1fa000 reveals each of +these starting with "RGCFG1" so we assume 0x1f8000-1fbfff is +"rgdb" of 0x40000. + +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/gemini-dlink-dir-685.dts | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/gemini-dlink-dir-685.dts b/arch/arm/boot/dts/gemini-dlink-dir-685.dts +index 6f258b50eb44..502a361d1fe9 100644 +--- a/arch/arm/boot/dts/gemini-dlink-dir-685.dts ++++ b/arch/arm/boot/dts/gemini-dlink-dir-685.dts +@@ -274,20 +274,16 @@ + read-only; + }; + /* +- * Between the boot loader and the rootfs is the kernel +- * in a custom Storlink format flashed from the boot +- * menu. The rootfs is in squashfs format. ++ * This firmware image contains the kernel catenated ++ * with the squashfs root filesystem. For some reason ++ * this is called "upgrade" on the vendor system. + */ +- partition@1800c0 { +- label = "rootfs"; +- reg = <0x001800c0 0x01dbff40>; +- read-only; +- }; +- partition@1f40000 { ++ partition@40000 { + label = "upgrade"; +- reg = <0x01f40000 0x00040000>; ++ reg = <0x00040000 0x01f40000>; + read-only; + }; ++ /* RGDB, Residental Gateway Database? */ + partition@1f80000 { + label = "rgdb"; + reg = <0x01f80000 0x00040000>; +-- +2.19.1 + diff --git a/queue-4.20/arm-dts-imx51-zii-rdu1-do-not-specify-power-gpio-for.patch b/queue-4.20/arm-dts-imx51-zii-rdu1-do-not-specify-power-gpio-for.patch new file mode 100644 index 00000000000..0342c2becfb --- /dev/null +++ b/queue-4.20/arm-dts-imx51-zii-rdu1-do-not-specify-power-gpio-for.patch @@ -0,0 +1,66 @@ +From ce4c26088de3c5c7937677a571bb08e5a1711198 Mon Sep 17 00:00:00 2001 +From: Andrey Smirnov +Date: Thu, 6 Dec 2018 21:41:17 -0200 +Subject: ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1 + +[ Upstream commit 79da07dec740a42c70963ebacbd2bf8866af9e20 ] + +TPA6130A2 SD pin on RDU1 is not really controlled by SoC and instead +is only meant to notify the system that audio was "muted" by external +actors. To accommodate that, drop "power-gpio" property of hpa1 node as +well as specify a name for that GPIO so that userspace can access it. + +Signed-off-by: Andrey Smirnov +Signed-off-by: Fabio Estevam +Tested-by: Chris Healy +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx51-zii-rdu1.dts | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/imx51-zii-rdu1.dts b/arch/arm/boot/dts/imx51-zii-rdu1.dts +index 69d753cac89a..44985f61c0ba 100644 +--- a/arch/arm/boot/dts/imx51-zii-rdu1.dts ++++ b/arch/arm/boot/dts/imx51-zii-rdu1.dts +@@ -477,6 +477,15 @@ + }; + + &gpio1 { ++ gpio-line-names = "", "", "", "", ++ "", "", "", "", ++ "", "hp-amp-shutdown-b", "", "", ++ "", "", "", "", ++ "", "", "", "", ++ "", "", "", "", ++ "", "", "", "", ++ "", "", "", ""; ++ + unused-sd3-wp-gpio { + /* + * See pinctrl_esdhc1 below for more details on this +@@ -495,9 +504,6 @@ + hpa1: amp@60 { + compatible = "ti,tpa6130a2"; + reg = <0x60>; +- pinctrl-names = "default"; +- pinctrl-0 = <&pinctrl_ampgpio>; +- power-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>; + Vdd-supply = <®_3p3v>; + }; + +@@ -671,7 +677,10 @@ + }; + + &iomuxc { +- pinctrl_ampgpio: ampgpiogrp { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_hog>; ++ ++ pinctrl_hog: hoggrp { + fsl,pins = < + MX51_PAD_GPIO1_9__GPIO1_9 0x5e + >; +-- +2.19.1 + diff --git a/queue-4.20/arm-dts-mmp2-fix-twsi2.patch b/queue-4.20/arm-dts-mmp2-fix-twsi2.patch new file mode 100644 index 00000000000..ac23300eac5 --- /dev/null +++ b/queue-4.20/arm-dts-mmp2-fix-twsi2.patch @@ -0,0 +1,56 @@ +From e470876cb5c1114c228abd49a5e85364aa8a7921 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Wed, 28 Nov 2018 18:53:10 +0100 +Subject: ARM: dts: mmp2: fix TWSI2 + +[ Upstream commit 1147e05ac9fc2ef86a3691e7ca5c2db7602d81dd ] + +Marvell keeps their MMP2 datasheet secret, but there are good clues +that TWSI2 is not on 0xd4025000 on that platform, not does it use +IRQ 58. In fact, the IRQ 58 on MMP2 seems to be a signal processor: + + arch/arm/mach-mmp/irqs.h:#define IRQ_MMP2_MSP 58 + +I'm taking a somewhat educated guess that is probably a copy & paste +error from PXA168 or PXA910 and that the real controller in fact hides +at address 0xd4031000 and uses an interrupt line multiplexed via IRQ 17. + +I'm also copying some properties from TWSI1 that were missing or +incorrect. + +Tested on a OLPC XO 1.75 machine, where the RTC is on TWSI2. + +Signed-off-by: Lubomir Rintel +Tested-by: Pavel Machek +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mmp2.dtsi | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi +index 766bbb8495b6..47e5b63339d1 100644 +--- a/arch/arm/boot/dts/mmp2.dtsi ++++ b/arch/arm/boot/dts/mmp2.dtsi +@@ -220,12 +220,15 @@ + status = "disabled"; + }; + +- twsi2: i2c@d4025000 { ++ twsi2: i2c@d4031000 { + compatible = "mrvl,mmp-twsi"; +- reg = <0xd4025000 0x1000>; +- interrupts = <58>; ++ reg = <0xd4031000 0x1000>; ++ interrupt-parent = <&intcmux17>; ++ interrupts = <0>; + clocks = <&soc_clocks MMP2_CLK_TWSI1>; + resets = <&soc_clocks MMP2_CLK_TWSI1>; ++ #address-cells = <1>; ++ #size-cells = <0>; + status = "disabled"; + }; + +-- +2.19.1 + diff --git a/queue-4.20/arm-mmp-fix-timer_init-calls.patch b/queue-4.20/arm-mmp-fix-timer_init-calls.patch new file mode 100644 index 00000000000..b514aae3faf --- /dev/null +++ b/queue-4.20/arm-mmp-fix-timer_init-calls.patch @@ -0,0 +1,112 @@ +From 48b14d36de26e61a479a22e34efdd9fdb21d1708 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 10 Dec 2018 21:43:01 +0100 +Subject: ARM: mmp: fix timer_init calls + +[ Upstream commit 12d3a30db4a3b3df5fbadf5974b9cf50544a9950 ] + +The change to passing the timer frequency as a function argument +was a good idea, but caused a build failure for one user that +was missed in the update: + +arch/arm/mach-mmp/time.c: In function 'mmp_dt_init_timer': +arch/arm/mach-mmp/time.c:242:2: error: implicit declaration of function 'timer_init'; did you mean 'hrtimer_init'? [-Werror=implicit-function-declaration] + +Change that as well to fix the build error, and rename the +function to put it into a proper namespace and make it clearer +what is actually going on. + +I saw that the high 6500000 HZ frequency was previously only +set with CONFIG_MMP2, but is now also used with MMP (pxa910), +so I'm changing that back here. Please make sure that the +frequencies are all correct now. + +Fixes: f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock") +Signed-off-by: Arnd Bergmann +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mmp/common.h | 2 +- + arch/arm/mach-mmp/mmp2.c | 2 +- + arch/arm/mach-mmp/pxa168.c | 2 +- + arch/arm/mach-mmp/pxa910.c | 2 +- + arch/arm/mach-mmp/time.c | 4 ++-- + 5 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/arm/mach-mmp/common.h b/arch/arm/mach-mmp/common.h +index 5ac2851ef5d3..483b8b6d3005 100644 +--- a/arch/arm/mach-mmp/common.h ++++ b/arch/arm/mach-mmp/common.h +@@ -2,7 +2,7 @@ + #include + #define ARRAY_AND_SIZE(x) (x), ARRAY_SIZE(x) + +-extern void timer_init(int irq, unsigned long rate); ++extern void mmp_timer_init(int irq, unsigned long rate); + + extern void __init mmp_map_io(void); + extern void mmp_restart(enum reboot_mode, const char *); +diff --git a/arch/arm/mach-mmp/mmp2.c b/arch/arm/mach-mmp/mmp2.c +index fb3e7e32c882..726c1a642dea 100644 +--- a/arch/arm/mach-mmp/mmp2.c ++++ b/arch/arm/mach-mmp/mmp2.c +@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void) + clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1); + __raw_writel(clk_rst, APBC_TIMERS); + +- timer_init(IRQ_MMP2_TIMER1, 6500000); ++ mmp_timer_init(IRQ_MMP2_TIMER1, 6500000); + } + + /* on-chip devices */ +diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c +index 77a358165a56..cdcf65ace3f9 100644 +--- a/arch/arm/mach-mmp/pxa168.c ++++ b/arch/arm/mach-mmp/pxa168.c +@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void) + /* 3.25MHz, bus/functional clock enabled, release reset */ + __raw_writel(TIMER_CLK_RST, APBC_TIMERS); + +- timer_init(IRQ_PXA168_TIMER1, 6500000); ++ mmp_timer_init(IRQ_PXA168_TIMER1, 3250000); + } + + void pxa168_clear_keypad_wakeup(void) +diff --git a/arch/arm/mach-mmp/pxa910.c b/arch/arm/mach-mmp/pxa910.c +index 1ccbba9ac495..d30a7d12bc98 100644 +--- a/arch/arm/mach-mmp/pxa910.c ++++ b/arch/arm/mach-mmp/pxa910.c +@@ -116,7 +116,7 @@ void __init pxa910_timer_init(void) + __raw_writel(APBC_APBCLK | APBC_RST, APBC_TIMERS); + __raw_writel(TIMER_CLK_RST, APBC_TIMERS); + +- timer_init(IRQ_PXA910_AP1_TIMER1); ++ mmp_timer_init(IRQ_PXA910_AP1_TIMER1, 3250000); + } + + /* on-chip devices */ +diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c +index eab0fd8a7343..f9c295154b94 100644 +--- a/arch/arm/mach-mmp/time.c ++++ b/arch/arm/mach-mmp/time.c +@@ -184,7 +184,7 @@ static struct irqaction timer_irq = { + .dev_id = &ckevt, + }; + +-void __init timer_init(int irq, unsigned long rate) ++void __init mmp_timer_init(int irq, unsigned long rate) + { + timer_config(); + +@@ -239,7 +239,7 @@ void __init mmp_dt_init_timer(void) + ret = -ENOMEM; + goto out; + } +- timer_init(irq, rate); ++ mmp_timer_init(irq, rate); + return; + out: + pr_err("Failed to get timer from device tree with error:%d\n", ret); +-- +2.19.1 + diff --git a/queue-4.20/arm-mmp-mmp2-dt-enable-the-clock.patch b/queue-4.20/arm-mmp-mmp2-dt-enable-the-clock.patch new file mode 100644 index 00000000000..d7fff9c8cdd --- /dev/null +++ b/queue-4.20/arm-mmp-mmp2-dt-enable-the-clock.patch @@ -0,0 +1,153 @@ +From 34ed2fa16180c38b85f398809e6a02defa3a247c Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Wed, 28 Nov 2018 18:53:20 +0100 +Subject: ARM: mmp/mmp2: dt: enable the clock + +[ Upstream commit f36797ee43802b367e59f0f9a9805304a4ff0c98 ] + +The device-tree booted MMP2 needs to enable the timer clock, otherwise +it would stop ticking when the boot finishes. + +It can also use the clock rate from the clk, the non-DT boards need to +keep using the hardcoded rates. + +Signed-off-by: Lubomir Rintel +Acked-by: Pavel Machek +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mmp/common.h | 2 +- + arch/arm/mach-mmp/mmp2.c | 2 +- + arch/arm/mach-mmp/pxa168.c | 2 +- + arch/arm/mach-mmp/time.c | 32 ++++++++++++++++++++------------ + 4 files changed, 23 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/mach-mmp/common.h b/arch/arm/mach-mmp/common.h +index 7e284d9c429f..5ac2851ef5d3 100644 +--- a/arch/arm/mach-mmp/common.h ++++ b/arch/arm/mach-mmp/common.h +@@ -2,7 +2,7 @@ + #include + #define ARRAY_AND_SIZE(x) (x), ARRAY_SIZE(x) + +-extern void timer_init(int irq); ++extern void timer_init(int irq, unsigned long rate); + + extern void __init mmp_map_io(void); + extern void mmp_restart(enum reboot_mode, const char *); +diff --git a/arch/arm/mach-mmp/mmp2.c b/arch/arm/mach-mmp/mmp2.c +index afba5460cdaf..fb3e7e32c882 100644 +--- a/arch/arm/mach-mmp/mmp2.c ++++ b/arch/arm/mach-mmp/mmp2.c +@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void) + clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1); + __raw_writel(clk_rst, APBC_TIMERS); + +- timer_init(IRQ_MMP2_TIMER1); ++ timer_init(IRQ_MMP2_TIMER1, 6500000); + } + + /* on-chip devices */ +diff --git a/arch/arm/mach-mmp/pxa168.c b/arch/arm/mach-mmp/pxa168.c +index 0f5f16fb8c66..77a358165a56 100644 +--- a/arch/arm/mach-mmp/pxa168.c ++++ b/arch/arm/mach-mmp/pxa168.c +@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void) + /* 3.25MHz, bus/functional clock enabled, release reset */ + __raw_writel(TIMER_CLK_RST, APBC_TIMERS); + +- timer_init(IRQ_PXA168_TIMER1); ++ timer_init(IRQ_PXA168_TIMER1, 6500000); + } + + void pxa168_clear_keypad_wakeup(void) +diff --git a/arch/arm/mach-mmp/time.c b/arch/arm/mach-mmp/time.c +index 96ad1db0b04b..eab0fd8a7343 100644 +--- a/arch/arm/mach-mmp/time.c ++++ b/arch/arm/mach-mmp/time.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -38,12 +39,6 @@ + #include "cputype.h" + #include "clock.h" + +-#ifdef CONFIG_CPU_MMP2 +-#define MMP_CLOCK_FREQ 6500000 +-#else +-#define MMP_CLOCK_FREQ 3250000 +-#endif +- + #define TIMERS_VIRT_BASE TIMERS1_VIRT_BASE + + #define MAX_DELTA (0xfffffffe) +@@ -189,19 +184,18 @@ static struct irqaction timer_irq = { + .dev_id = &ckevt, + }; + +-void __init timer_init(int irq) ++void __init timer_init(int irq, unsigned long rate) + { + timer_config(); + +- sched_clock_register(mmp_read_sched_clock, 32, MMP_CLOCK_FREQ); ++ sched_clock_register(mmp_read_sched_clock, 32, rate); + + ckevt.cpumask = cpumask_of(0); + + setup_irq(irq, &timer_irq); + +- clocksource_register_hz(&cksrc, MMP_CLOCK_FREQ); +- clockevents_config_and_register(&ckevt, MMP_CLOCK_FREQ, +- MIN_DELTA, MAX_DELTA); ++ clocksource_register_hz(&cksrc, rate); ++ clockevents_config_and_register(&ckevt, rate, MIN_DELTA, MAX_DELTA); + } + + #ifdef CONFIG_OF +@@ -213,7 +207,9 @@ static const struct of_device_id mmp_timer_dt_ids[] = { + void __init mmp_dt_init_timer(void) + { + struct device_node *np; ++ struct clk *clk; + int irq, ret; ++ unsigned long rate; + + np = of_find_matching_node(NULL, mmp_timer_dt_ids); + if (!np) { +@@ -221,6 +217,18 @@ void __init mmp_dt_init_timer(void) + goto out; + } + ++ clk = of_clk_get(np, 0); ++ if (!IS_ERR(clk)) { ++ ret = clk_prepare_enable(clk); ++ if (ret) ++ goto out; ++ rate = clk_get_rate(clk) / 2; ++ } else if (cpu_is_pj4()) { ++ rate = 6500000; ++ } else { ++ rate = 3250000; ++ } ++ + irq = irq_of_parse_and_map(np, 0); + if (!irq) { + ret = -EINVAL; +@@ -231,7 +239,7 @@ void __init mmp_dt_init_timer(void) + ret = -ENOMEM; + goto out; + } +- timer_init(irq); ++ timer_init(irq, rate); + return; + out: + pr_err("Failed to get timer from device tree with error:%d\n", ret); +-- +2.19.1 + diff --git a/queue-4.20/arm-omap1-ams-delta-fix-audio-permanently-muted.patch b/queue-4.20/arm-omap1-ams-delta-fix-audio-permanently-muted.patch new file mode 100644 index 00000000000..27164467cfd --- /dev/null +++ b/queue-4.20/arm-omap1-ams-delta-fix-audio-permanently-muted.patch @@ -0,0 +1,64 @@ +From 199eeed10bf0fe0e87180f02ef1840193c52ebfd Mon Sep 17 00:00:00 2001 +From: Janusz Krzysztofik +Date: Fri, 23 Nov 2018 12:19:45 +0100 +Subject: ARM: OMAP1: ams-delta: Fix audio permanently muted + +[ Upstream commit 2afdb4c41d7876e430b9bc6e2d7e2fe28609fd6a ] + +Since commit 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused +GPIOs"), on-board audio has appeared muted. Believed to be unused GPIO +pin "hookflash1", apparently set high regardless of the corresponding +bit of "latch2" port attempted to be set low during .init_machine(), +has been identified as the reason. + +According to Amstrad E3 wiki, the purpose of the pin hasn't been +clearly identified. Original Amstrad software used to produce a high +pulse on it when the phone was taken off hook or recall was pressed. +With the current finding, we can assume the pin provides a kind of +audio mute function. + +Proper resolution of the issue should be done in two steps: +- resolution of an issue with the pin state not reflecting the value + the corresponding bit of the port was attempted to be initialized + with, +- extension of on-board audio driver with a new control. + +For now, rename the pin to "audio_mute" to reflect its function and, +as a quick fix, hogg it as output low so on-board audio can produce +audible sound again. + +Fixes: 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused GPIOs") +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/board-ams-delta.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c +index 17886744dbe6..55bf73710a59 100644 +--- a/arch/arm/mach-omap1/board-ams-delta.c ++++ b/arch/arm/mach-omap1/board-ams-delta.c +@@ -247,8 +247,8 @@ static struct platform_device latch2_gpio_device = { + #define LATCH2_PIN_SCARD_CMDVCC 11 + #define LATCH2_PIN_MODEM_NRESET 12 + #define LATCH2_PIN_MODEM_CODEC 13 +-#define LATCH2_PIN_HOOKFLASH1 14 +-#define LATCH2_PIN_HOOKFLASH2 15 ++#define LATCH2_PIN_AUDIO_MUTE 14 ++#define LATCH2_PIN_HOOKFLASH 15 + + static struct regulator_consumer_supply modem_nreset_consumers[] = { + REGULATOR_SUPPLY("RESET#", "serial8250.1"), +@@ -588,6 +588,8 @@ static int gpiochip_match_by_label(struct gpio_chip *chip, void *data) + static struct gpiod_hog ams_delta_gpio_hogs[] = { + GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_KEYBRD_DATAOUT, "keybrd_dataout", + GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW), ++ GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_AUDIO_MUTE, "audio_mute", ++ GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW), + {}, + }; + +-- +2.19.1 + diff --git a/queue-4.20/arm-omap2-hwmod-fix-some-section-annotations.patch b/queue-4.20/arm-omap2-hwmod-fix-some-section-annotations.patch new file mode 100644 index 00000000000..c3a39526c5c --- /dev/null +++ b/queue-4.20/arm-omap2-hwmod-fix-some-section-annotations.patch @@ -0,0 +1,76 @@ +From 87586490b3d183c5f2d90f07bd70c43a42d889d2 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 17 Oct 2018 17:52:07 -0700 +Subject: ARM: OMAP2+: hwmod: Fix some section annotations + +[ Upstream commit c10b26abeb53cabc1e6271a167d3f3d396ce0218 ] + +When building the kernel with Clang, the following section mismatch +warnings appears: + +WARNING: vmlinux.o(.text+0x2d398): Section mismatch in reference from +the function _setup() to the function .init.text:_setup_iclk_autoidle() +The function _setup() references +the function __init _setup_iclk_autoidle(). +This is often because _setup lacks a __init +annotation or the annotation of _setup_iclk_autoidle is wrong. + +WARNING: vmlinux.o(.text+0x2d3a0): Section mismatch in reference from +the function _setup() to the function .init.text:_setup_reset() +The function _setup() references +the function __init _setup_reset(). +This is often because _setup lacks a __init +annotation or the annotation of _setup_reset is wrong. + +WARNING: vmlinux.o(.text+0x2d408): Section mismatch in reference from +the function _setup() to the function .init.text:_setup_postsetup() +The function _setup() references +the function __init _setup_postsetup(). +This is often because _setup lacks a __init +annotation or the annotation of _setup_postsetup is wrong. + +_setup is used in omap_hwmod_allocate_module, which isn't marked __init +and looks like it shouldn't be, meaning to fix these warnings, those +functions must be moved out of the init section, which this patch does. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index 083dcd9942ce..921c9aaee63f 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -2413,7 +2413,7 @@ static int __init _init(struct omap_hwmod *oh, void *data) + * a stub; implementing this properly requires iclk autoidle usecounting in + * the clock code. No return value. + */ +-static void __init _setup_iclk_autoidle(struct omap_hwmod *oh) ++static void _setup_iclk_autoidle(struct omap_hwmod *oh) + { + struct omap_hwmod_ocp_if *os; + +@@ -2444,7 +2444,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh) + * reset. Returns 0 upon success or a negative error code upon + * failure. + */ +-static int __init _setup_reset(struct omap_hwmod *oh) ++static int _setup_reset(struct omap_hwmod *oh) + { + int r; + +@@ -2505,7 +2505,7 @@ static int __init _setup_reset(struct omap_hwmod *oh) + * + * No return value. + */ +-static void __init _setup_postsetup(struct omap_hwmod *oh) ++static void _setup_postsetup(struct omap_hwmod *oh) + { + u8 postsetup_state; + +-- +2.19.1 + diff --git a/queue-4.20/arm-pxa-avoid-section-mismatch-warning.patch b/queue-4.20/arm-pxa-avoid-section-mismatch-warning.patch new file mode 100644 index 00000000000..7a69945d1be --- /dev/null +++ b/queue-4.20/arm-pxa-avoid-section-mismatch-warning.patch @@ -0,0 +1,76 @@ +From c8bdba4e2a3d7f7f6535f8107264eba3f3356592 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 10 Dec 2018 22:58:39 +0100 +Subject: ARM: pxa: avoid section mismatch warning + +[ Upstream commit 88af3209aa0881aa5ffd99664b6080a4be5f24e5 ] + +WARNING: vmlinux.o(.text+0x19f90): Section mismatch in reference from the function littleton_init_lcd() to the function .init.text:pxa_set_fb_info() +The function littleton_init_lcd() references +the function __init pxa_set_fb_info(). +This is often because littleton_init_lcd lacks a __init +annotation or the annotation of pxa_set_fb_info is wrong. + +WARNING: vmlinux.o(.text+0xf824): Section mismatch in reference from the function zeus_register_ohci() to the function .init.text:pxa_set_ohci_info() +The function zeus_register_ohci() references +the function __init pxa_set_ohci_info(). +This is often because zeus_register_ohci lacks a __init +annotation or the annotation of pxa_set_ohci_info is wrong. + +WARNING: vmlinux.o(.text+0xf95c): Section mismatch in reference from the function cm_x300_init_u2d() to the function .init.text:pxa3xx_set_u2d_info() +The function cm_x300_init_u2d() references +the function __init pxa3xx_set_u2d_info(). +This is often because cm_x300_init_u2d lacks a __init +annotation or the annotation of pxa3xx_set_u2d_info is wrong. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/mach-pxa/cm-x300.c | 2 +- + arch/arm/mach-pxa/littleton.c | 2 +- + arch/arm/mach-pxa/zeus.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c +index c5c0ab8ac9f9..024c1fbcc55a 100644 +--- a/arch/arm/mach-pxa/cm-x300.c ++++ b/arch/arm/mach-pxa/cm-x300.c +@@ -558,7 +558,7 @@ static struct pxa3xx_u2d_platform_data cm_x300_u2d_platform_data = { + .exit = cm_x300_u2d_exit, + }; + +-static void cm_x300_init_u2d(void) ++static void __init cm_x300_init_u2d(void) + { + pxa3xx_set_u2d_info(&cm_x300_u2d_platform_data); + } +diff --git a/arch/arm/mach-pxa/littleton.c b/arch/arm/mach-pxa/littleton.c +index 9e132b3e48c6..9960ea158829 100644 +--- a/arch/arm/mach-pxa/littleton.c ++++ b/arch/arm/mach-pxa/littleton.c +@@ -184,7 +184,7 @@ static struct pxafb_mach_info littleton_lcd_info = { + .lcd_conn = LCD_COLOR_TFT_16BPP, + }; + +-static void littleton_init_lcd(void) ++static void __init littleton_init_lcd(void) + { + pxa_set_fb_info(NULL, &littleton_lcd_info); + } +diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c +index d53ea12fc766..54a32f0433a2 100644 +--- a/arch/arm/mach-pxa/zeus.c ++++ b/arch/arm/mach-pxa/zeus.c +@@ -576,7 +576,7 @@ static struct pxaohci_platform_data zeus_ohci_platform_data = { + .flags = ENABLE_PORT_ALL | POWER_SENSE_LOW, + }; + +-static void zeus_register_ohci(void) ++static void __init zeus_register_ohci(void) + { + /* Port 2 is shared between host and client interface. */ + UP2OCR = UP2OCR_HXOE | UP2OCR_HXS | UP2OCR_DMPDE | UP2OCR_DPPDE; +-- +2.19.1 + diff --git a/queue-4.20/arm64-dts-meson-fix-irq-trigger-type-for-macirq.patch b/queue-4.20/arm64-dts-meson-fix-irq-trigger-type-for-macirq.patch new file mode 100644 index 00000000000..ff5b1dffc37 --- /dev/null +++ b/queue-4.20/arm64-dts-meson-fix-irq-trigger-type-for-macirq.patch @@ -0,0 +1,91 @@ +From 38b18f429830052d4483c2ee3581ea5dcf681e5c Mon Sep 17 00:00:00 2001 +From: Carlo Caione +Date: Fri, 7 Dec 2018 10:52:30 +0000 +Subject: arm64: dts: meson: Fix IRQ trigger type for macirq + +[ Upstream commit 8b3e6f8999f8d704fccce225b9455b3fa639d1c9 ] + +A long running stress test on a custom board shipping an AXG SoCs and a +Realtek RTL8211F PHY revealed that after a few hours the connection +speed would drop drastically, from ~1000Mbps to ~3Mbps. At the same time +the 'macirq' (eth0) IRQ would stop being triggered at all and as +consequence the GMAC IRQs never ACKed. + +After a painful investigation the problem seemed to be due to a wrong +defined IRQ type for the GMAC IRQ that should be LEVEL_HIGH instead of +EDGE_RISING. + +The change in the macirq IRQ type also solved another long standing +issue affecting this SoC/PHY where EEE was causing the network +connection to die after stressing it with iperf3 (even though much +sooner). It's now possible to remove the 'eee-broken-1000t' quirk as +well. + +Fixes: feb3cbea0946 ("ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage") +Fixes: 6d28d577510f ("ARM64: dts: meson-axg: fix ethernet stability issue") +Reviewed-by: Jerome Brunet +Tested-by: Jerome Brunet +Acked-by: Neil Armstrong +Signed-off-by: Carlo Caione +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-axg.dtsi | 2 +- + arch/arm64/boot/dts/amlogic/meson-gx.dtsi | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 1 - + arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 1 - + 4 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +index df017dbd2e57..b1a42e99cb67 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-axg.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-axg.dtsi +@@ -143,7 +143,7 @@ + compatible = "amlogic,meson-axg-dwmac", "snps,dwmac"; + reg = <0x0 0xff3f0000 0x0 0x10000 + 0x0 0xff634540 0x0 0x8>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "macirq"; + clocks = <&clkc CLKID_ETH>, + <&clkc CLKID_FCLK_DIV2>, +diff --git a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +index f1e5cdbade5e..58e6bcaac1d8 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gx.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gx.dtsi +@@ -462,7 +462,7 @@ + compatible = "amlogic,meson-gx-dwmac", "amlogic,meson-gxbb-dwmac", "snps,dwmac"; + reg = <0x0 0xc9410000 0x0 0x10000 + 0x0 0xc8834540 0x0 0x4>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "macirq"; + status = "disabled"; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index 54954b314a45..f8d1cedbe600 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -143,7 +143,6 @@ + interrupt-parent = <&gpio_intc>; + /* MAC_INTR on GPIOZ_15 */ + interrupts = <29 IRQ_TYPE_LEVEL_LOW>; +- eee-broken-1000t; + }; + }; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +index 70325b273bd2..ec09bb5792b7 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +@@ -142,7 +142,6 @@ + eth_phy0: ethernet-phy@0 { + /* Realtek RTL8211F (0x001cc916) */ + reg = <0>; +- eee-broken-1000t; + }; + }; + }; +-- +2.19.1 + diff --git a/queue-4.20/arm64-dts-rockchip-fix-rk3399-rockpro64-regulator-gp.patch b/queue-4.20/arm64-dts-rockchip-fix-rk3399-rockpro64-regulator-gp.patch new file mode 100644 index 00000000000..17ca2d8e873 --- /dev/null +++ b/queue-4.20/arm64-dts-rockchip-fix-rk3399-rockpro64-regulator-gp.patch @@ -0,0 +1,101 @@ +From 7c05169f0b7cd69d1041162e839ee7b837b1fc99 Mon Sep 17 00:00:00 2001 +From: Oskari Lemmela +Date: Sat, 1 Dec 2018 12:08:16 +0200 +Subject: arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios + +[ Upstream commit 690e16bada6029694740d5501025faf483d14339 ] + +Rockpro64 is not able boot if GPIO1_C1 pin is pulled high +before loading linux kernel. + +In rockpro64 GPIO1_C1 pin is connected vdd_cpu_b regulator +VSEL pin. Pin should be pulled down in normal operation and +pulled high in suspend. + +PMIC LDO_REG2 is connected to touch panel connector. +Rename regulator and set it to correct voltage. + +PCIe power is controller by GPIO1_D0. + +Schematics can be downloaded from: +http://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf + +Signed-off-by: Oskari Lemmela +Acked-by: Akash Gajjar +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + .../boot/dts/rockchip/rk3399-rockpro64.dts | 20 +++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts +index 1d35f5406b5e..5bd4d69914bd 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts +@@ -97,7 +97,7 @@ + vcc3v3_pcie: vcc3v3-pcie-regulator { + compatible = "regulator-fixed"; + enable-active-high; +- gpio = <&gpio1 RK_PC1 GPIO_ACTIVE_HIGH>; ++ gpio = <&gpio1 RK_PD0 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&pcie_pwr_en>; + regulator-name = "vcc3v3_pcie"; +@@ -293,12 +293,12 @@ + }; + }; + +- vcc2v8_dvp: LDO_REG2 { +- regulator-name = "vcc2v8_dvp"; ++ vcc3v0_touch: LDO_REG2 { ++ regulator-name = "vcc3v0_touch"; + regulator-always-on; + regulator-boot-on; +- regulator-min-microvolt = <2800000>; +- regulator-max-microvolt = <2800000>; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; + regulator-state-mem { + regulator-off-in-suspend; + }; +@@ -397,7 +397,9 @@ + vdd_cpu_b: regulator@40 { + compatible = "silergy,syr827"; + reg = <0x40>; +- fcs,suspend-voltage-selector = <0>; ++ fcs,suspend-voltage-selector = <1>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&vsel1_gpio>; + regulator-name = "vdd_cpu_b"; + regulator-min-microvolt = <712500>; + regulator-max-microvolt = <1500000>; +@@ -415,6 +417,8 @@ + compatible = "silergy,syr828"; + reg = <0x41>; + fcs,suspend-voltage-selector = <1>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&vsel2_gpio>; + regulator-name = "vdd_gpu"; + regulator-min-microvolt = <712500>; + regulator-max-microvolt = <1500000>; +@@ -519,7 +523,7 @@ + + pcie { + pcie_pwr_en: pcie-pwr-en { +- rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_none>; ++ rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>; + }; + }; + +@@ -529,7 +533,7 @@ + }; + + vsel1_gpio: vsel1-gpio { +- rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>; ++ rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>; + }; + + vsel2_gpio: vsel2-gpio { +-- +2.19.1 + diff --git a/queue-4.20/arm64-ftrace-don-t-adjust-the-lr-value.patch b/queue-4.20/arm64-ftrace-don-t-adjust-the-lr-value.patch new file mode 100644 index 00000000000..4466418ea84 --- /dev/null +++ b/queue-4.20/arm64-ftrace-don-t-adjust-the-lr-value.patch @@ -0,0 +1,53 @@ +From 8333de6029c829543c686e31f365cbf67b49e80a Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Thu, 15 Nov 2018 22:42:01 +0000 +Subject: arm64: ftrace: don't adjust the LR value + +[ Upstream commit 6e803e2e6e367db9a0d6ecae1bd24bb5752011bd ] + +The core ftrace code requires that when it is handed the PC of an +instrumented function, this PC is the address of the instrumented +instruction. This is necessary so that the core ftrace code can identify +the specific instrumentation site. Since the instrumented function will +be a BL, the address of the instrumented function is LR - 4 at entry to +the ftrace code. + +This fixup is applied in the mcount_get_pc and mcount_get_pc0 helpers, +which acquire the PC of the instrumented function. + +The mcount_get_lr helper is used to acquire the LR of the instrumented +function, whose value does not require this adjustment, and cannot be +adjusted to anything meaningful. No adjustment of this value is made on +other architectures, including arm. However, arm64 adjusts this value by +4. + +This patch brings arm64 in line with other architectures and removes the +adjustment of the LR value. + +Signed-off-by: Mark Rutland +Cc: AKASHI Takahiro +Cc: Ard Biesheuvel +Cc: Catalin Marinas +Cc: Torsten Duwe +Cc: Will Deacon +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/entry-ftrace.S | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/kernel/entry-ftrace.S b/arch/arm64/kernel/entry-ftrace.S +index 1175f5827ae1..295951f3172e 100644 +--- a/arch/arm64/kernel/entry-ftrace.S ++++ b/arch/arm64/kernel/entry-ftrace.S +@@ -79,7 +79,6 @@ + .macro mcount_get_lr reg + ldr \reg, [x29] + ldr \reg, [\reg, #8] +- mcount_adjust_addr \reg, \reg + .endm + + .macro mcount_get_lr_addr reg +-- +2.19.1 + diff --git a/queue-4.20/arm64-io-ensure-calls-to-delay-routines-are-ordered-.patch b/queue-4.20/arm64-io-ensure-calls-to-delay-routines-are-ordered-.patch new file mode 100644 index 00000000000..feec6348962 --- /dev/null +++ b/queue-4.20/arm64-io-ensure-calls-to-delay-routines-are-ordered-.patch @@ -0,0 +1,99 @@ +From 826a38b024f6a09d0e14af8786e9d0e4943edf7c Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Wed, 7 Nov 2018 23:06:15 +0000 +Subject: arm64: io: Ensure calls to delay routines are ordered against prior + readX() + +[ Upstream commit 6460d32014717686d3b7963595950ba2c6d1bb5e ] + +A relatively standard idiom for ensuring that a pair of MMIO writes to a +device arrive at that device with a specified minimum delay between them +is as follows: + + writel_relaxed(42, dev_base + CTL1); + readl(dev_base + CTL1); + udelay(10); + writel_relaxed(42, dev_base + CTL2); + +the intention being that the read-back from the device will push the +prior write to CTL1, and the udelay will hold up the write to CTL1 until +at least 10us have elapsed. + +Unfortunately, on arm64 where the underlying delay loop is implemented +as a read of the architected counter, the CPU does not guarantee +ordering from the readl() to the delay loop and therefore the delay loop +could in theory be speculated and not provide the desired interval +between the two writes. + +Fix this in a similar manner to PowerPC by introducing a dummy control +dependency on the output of readX() which, combined with the ISB in the +read of the architected counter, guarantees that a subsequent delay loop +can not be executed until the readX() has returned its result. + +Cc: Benjamin Herrenschmidt +Cc: Arnd Bergmann +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/io.h | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h +index 9f8b915af3a7..d42d00d8d5b6 100644 +--- a/arch/arm64/include/asm/io.h ++++ b/arch/arm64/include/asm/io.h +@@ -104,7 +104,22 @@ static inline u64 __raw_readq(const volatile void __iomem *addr) + } + + /* IO barriers */ +-#define __iormb() rmb() ++#define __iormb(v) \ ++({ \ ++ unsigned long tmp; \ ++ \ ++ rmb(); \ ++ \ ++ /* \ ++ * Create a dummy control dependency from the IO read to any \ ++ * later instructions. This ensures that a subsequent call to \ ++ * udelay() will be ordered due to the ISB in get_cycles(). \ ++ */ \ ++ asm volatile("eor %0, %1, %1\n" \ ++ "cbnz %0, ." \ ++ : "=r" (tmp) : "r" (v) : "memory"); \ ++}) ++ + #define __iowmb() wmb() + + #define mmiowb() do { } while (0) +@@ -129,10 +144,10 @@ static inline u64 __raw_readq(const volatile void __iomem *addr) + * following Normal memory access. Writes are ordered relative to any prior + * Normal memory access. + */ +-#define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; }) +-#define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; }) +-#define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; }) +-#define readq(c) ({ u64 __v = readq_relaxed(c); __iormb(); __v; }) ++#define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(__v); __v; }) ++#define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(__v); __v; }) ++#define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(__v); __v; }) ++#define readq(c) ({ u64 __v = readq_relaxed(c); __iormb(__v); __v; }) + + #define writeb(v,c) ({ __iowmb(); writeb_relaxed((v),(c)); }) + #define writew(v,c) ({ __iowmb(); writew_relaxed((v),(c)); }) +@@ -183,9 +198,9 @@ extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size); + /* + * io{read,write}{16,32,64}be() macros + */ +-#define ioread16be(p) ({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; }) +-#define ioread32be(p) ({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; }) +-#define ioread64be(p) ({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(); __v; }) ++#define ioread16be(p) ({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(__v); __v; }) ++#define ioread32be(p) ({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(__v); __v; }) ++#define ioread64be(p) ({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(__v); __v; }) + + #define iowrite16be(v,p) ({ __iowmb(); __raw_writew((__force __u16)cpu_to_be16(v), p); }) + #define iowrite32be(v,p) ({ __iowmb(); __raw_writel((__force __u32)cpu_to_be32(v), p); }) +-- +2.19.1 + diff --git a/queue-4.20/arm64-io-ensure-value-passed-to-__iormb-is-held-in-a.patch b/queue-4.20/arm64-io-ensure-value-passed-to-__iormb-is-held-in-a.patch new file mode 100644 index 00000000000..b3a18fdecca --- /dev/null +++ b/queue-4.20/arm64-io-ensure-value-passed-to-__iormb-is-held-in-a.patch @@ -0,0 +1,53 @@ +From 0cdbf6fb9b0d4be12b0174b22a05cf98d874f0b9 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Thu, 29 Nov 2018 16:31:04 +0000 +Subject: arm64: io: Ensure value passed to __iormb() is held in a 64-bit + register + +[ Upstream commit 1b57ec8c75279b873639eb44a215479236f93481 ] + +As of commit 6460d3201471 ("arm64: io: Ensure calls to delay routines +are ordered against prior readX()"), MMIO reads smaller than 64 bits +fail to compile under clang because we end up mixing 32-bit and 64-bit +register operands for the same data processing instruction: + +./include/asm-generic/io.h:695:9: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths] + return readb(addr); + ^ +./arch/arm64/include/asm/io.h:147:58: note: expanded from macro 'readb' + ^ +./include/asm-generic/io.h:695:9: note: use constraint modifier "w" +./arch/arm64/include/asm/io.h:147:50: note: expanded from macro 'readb' + ^ +./arch/arm64/include/asm/io.h:118:24: note: expanded from macro '__iormb' + asm volatile("eor %0, %1, %1\n" \ + ^ + +Fix the build by casting the macro argument to 'unsigned long' when used +as an input to the inline asm. + +Reported-by: Nick Desaulniers +Reported-by: Nathan Chancellor +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/io.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h +index d42d00d8d5b6..ee723835c1f4 100644 +--- a/arch/arm64/include/asm/io.h ++++ b/arch/arm64/include/asm/io.h +@@ -117,7 +117,8 @@ static inline u64 __raw_readq(const volatile void __iomem *addr) + */ \ + asm volatile("eor %0, %1, %1\n" \ + "cbnz %0, ." \ +- : "=r" (tmp) : "r" (v) : "memory"); \ ++ : "=r" (tmp) : "r" ((unsigned long)(v)) \ ++ : "memory"); \ + }) + + #define __iowmb() wmb() +-- +2.19.1 + diff --git a/queue-4.20/arm64-kvm-skip-mmio-insn-after-emulation.patch b/queue-4.20/arm64-kvm-skip-mmio-insn-after-emulation.patch new file mode 100644 index 00000000000..89dfeb5db82 --- /dev/null +++ b/queue-4.20/arm64-kvm-skip-mmio-insn-after-emulation.patch @@ -0,0 +1,63 @@ +From 54314eda1b5c2b38c530de8858621c94fa29d6a6 Mon Sep 17 00:00:00 2001 +From: Mark Rutland +Date: Fri, 9 Nov 2018 15:07:10 +0000 +Subject: arm64: KVM: Skip MMIO insn after emulation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 0d640732dbebed0f10f18526de21652931f0b2f2 ] + +When we emulate an MMIO instruction, we advance the CPU state within +decode_hsr(), before emulating the instruction effects. + +Having this logic in decode_hsr() is opaque, and advancing the state +before emulation is problematic. It gets in the way of applying +consistent single-step logic, and it prevents us from being able to fail +an MMIO instruction with a synchronous exception. + +Clean this up by only advancing the CPU state *after* the effects of the +instruction are emulated. + +Cc: Peter Maydell +Reviewed-by: Alex Bennée +Reviewed-by: Christoffer Dall +Signed-off-by: Mark Rutland +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + virt/kvm/arm/mmio.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/virt/kvm/arm/mmio.c b/virt/kvm/arm/mmio.c +index dac7ceb1a677..08443a15e6be 100644 +--- a/virt/kvm/arm/mmio.c ++++ b/virt/kvm/arm/mmio.c +@@ -117,6 +117,12 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) + vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data); + } + ++ /* ++ * The MMIO instruction is emulated and should not be re-executed ++ * in the guest. ++ */ ++ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); ++ + return 0; + } + +@@ -144,11 +150,6 @@ static int decode_hsr(struct kvm_vcpu *vcpu, bool *is_write, int *len) + vcpu->arch.mmio_decode.sign_extend = sign_extend; + vcpu->arch.mmio_decode.rt = rt; + +- /* +- * The MMIO instruction is emulated and should not be re-executed +- * in the guest. +- */ +- kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/arm64-sve-ptrace-fix-sve_pt_regs_offset-definition.patch b/queue-4.20/arm64-sve-ptrace-fix-sve_pt_regs_offset-definition.patch new file mode 100644 index 00000000000..b0bf333d590 --- /dev/null +++ b/queue-4.20/arm64-sve-ptrace-fix-sve_pt_regs_offset-definition.patch @@ -0,0 +1,44 @@ +From ff7540f85e65ecd5049e2c7aeab4830e42930ef7 Mon Sep 17 00:00:00 2001 +From: Dave Martin +Date: Fri, 4 Jan 2019 13:09:50 +0000 +Subject: arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition + +[ Upstream commit ee1b465b303591d3a04d403122bbc0d7026520fb ] + +SVE_PT_REGS_OFFSET is supposed to indicate the offset for skipping +over the ptrace NT_ARM_SVE header (struct user_sve_header) to the +start of the SVE register data proper. + +However, currently SVE_PT_REGS_OFFSET is defined in terms of struct +sve_context, which is wrong: that structure describes the SVE +header in the signal frame, not in the ptrace regset. + +This patch fixes the definition to use the ptrace header structure +struct user_sve_header instead. + +By good fortune, the two structures are the same size anyway, so +there is no functional or ABI change. + +Signed-off-by: Dave Martin +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/uapi/asm/ptrace.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h +index a36227fdb084..65ef8b0fdb0e 100644 +--- a/arch/arm64/include/uapi/asm/ptrace.h ++++ b/arch/arm64/include/uapi/asm/ptrace.h +@@ -131,7 +131,7 @@ struct user_sve_header { + + /* Offset from the start of struct user_sve_header to the register data */ + #define SVE_PT_REGS_OFFSET \ +- ((sizeof(struct sve_context) + (SVE_VQ_BYTES - 1)) \ ++ ((sizeof(struct user_sve_header) + (SVE_VQ_BYTES - 1)) \ + / SVE_VQ_BYTES * SVE_VQ_BYTES) + + /* +-- +2.19.1 + diff --git a/queue-4.20/asoc-fsl-fix-snd_soc_eukrea_tlv320-build-error-on-i..patch b/queue-4.20/asoc-fsl-fix-snd_soc_eukrea_tlv320-build-error-on-i..patch new file mode 100644 index 00000000000..5f97fee22c9 --- /dev/null +++ b/queue-4.20/asoc-fsl-fix-snd_soc_eukrea_tlv320-build-error-on-i..patch @@ -0,0 +1,45 @@ +From c57d170bb00345f5a8b2debe9ee4ee8da1fae6eb Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Thu, 13 Dec 2018 00:08:38 -0200 +Subject: ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M + +[ Upstream commit add6883619a9e3bf9658eaff1a547354131bbcd9 ] + +eukrea-tlv320.c machine driver runs on non-DT platforms +and include header file in order to be able +to use some machine_is_eukrea_xxx() macros. + +Building it for ARM64 causes the following build error: + +sound/soc/fsl/eukrea-tlv320.c:28:10: fatal error: asm/mach-types.h: No such file or directory + +Avoid this error by not allowing to build the SND_SOC_EUKREA_TLV320 +driver when ARM64 is selected. + +This is needed in preparation for the i.MX8M support. + +Reported-by: kbuild test robot +Signed-off-by: Fabio Estevam +Acked-by: Shawn Guo +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/fsl/Kconfig b/sound/soc/fsl/Kconfig +index 6ec19fb4a934..2e75b5bc5f1d 100644 +--- a/sound/soc/fsl/Kconfig ++++ b/sound/soc/fsl/Kconfig +@@ -221,7 +221,7 @@ config SND_SOC_PHYCORE_AC97 + + config SND_SOC_EUKREA_TLV320 + tristate "Eukrea TLV320" +- depends on ARCH_MXC && I2C ++ depends on ARCH_MXC && !ARM64 && I2C + select SND_SOC_TLV320AIC23_I2C + select SND_SOC_IMX_AUDMUX + select SND_SOC_IMX_SSI +-- +2.19.1 + diff --git a/queue-4.20/asoc-intel-mrfld-fix-uninitialized-variable-access.patch b/queue-4.20/asoc-intel-mrfld-fix-uninitialized-variable-access.patch new file mode 100644 index 00000000000..380b1bc6f38 --- /dev/null +++ b/queue-4.20/asoc-intel-mrfld-fix-uninitialized-variable-access.patch @@ -0,0 +1,54 @@ +From 94ff0f461819fff28fdad80b825d803a34e184a7 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Sat, 3 Nov 2018 22:21:22 +0100 +Subject: ASoC: Intel: mrfld: fix uninitialized variable access + +[ Upstream commit 1539c7f23f256120f89f8b9ec53160790bce9ed2 ] + +Randconfig testing revealed a very old bug, with gcc-8: + +sound/soc/intel/atom/sst/sst_loader.c: In function 'sst_load_fw': +sound/soc/intel/atom/sst/sst_loader.c:357:5: error: 'fw' may be used uninitialized in this function [-Werror=maybe-uninitialized] + if (fw == NULL) { + ^ +sound/soc/intel/atom/sst/sst_loader.c:354:25: note: 'fw' was declared here + const struct firmware *fw; + +We must check the return code of request_firmware() before we look at the +pointer result that may be uninitialized when the function fails. + +Fixes: 9012c9544eea ("ASoC: Intel: mrfld - Add DSP load and management") +Signed-off-by: Arnd Bergmann +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/atom/sst/sst_loader.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/intel/atom/sst/sst_loader.c b/sound/soc/intel/atom/sst/sst_loader.c +index 27413ebae956..b8c456753f01 100644 +--- a/sound/soc/intel/atom/sst/sst_loader.c ++++ b/sound/soc/intel/atom/sst/sst_loader.c +@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst) + const struct firmware *fw; + + retval = request_firmware(&fw, sst->firmware_name, sst->dev); +- if (fw == NULL) { +- dev_err(sst->dev, "fw is returning as null\n"); +- return -EINVAL; +- } + if (retval) { + dev_err(sst->dev, "request fw failed %d\n", retval); + return retval; + } ++ if (fw == NULL) { ++ dev_err(sst->dev, "fw is returning as null\n"); ++ return -EINVAL; ++ } + mutex_lock(&sst->sst_lock); + retval = sst_cache_and_parse_fw(sst, fw); + mutex_unlock(&sst->sst_lock); +-- +2.19.1 + diff --git a/queue-4.20/asoc-sunxi-sun50i-codec-analog-add-support-for-cpvdd.patch b/queue-4.20/asoc-sunxi-sun50i-codec-analog-add-support-for-cpvdd.patch new file mode 100644 index 00000000000..82c9d3ac3a7 --- /dev/null +++ b/queue-4.20/asoc-sunxi-sun50i-codec-analog-add-support-for-cpvdd.patch @@ -0,0 +1,46 @@ +From 1e311200eee602c762a9d0bb8cd86896e08de784 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Thu, 22 Nov 2018 18:23:19 +0800 +Subject: ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator + supply + +[ Upstream commit ca0412a05756cd0b94751ca4d54fe6522f00b1f4 ] + +On the Allwinner A64 SoCs, the audio codec has a built-in headphone +amplifier. This amplifier has a power supply separate from the rest of +the analog audio circuitry, labeled cpvdd. + +This patch adds a DAPM widget for this supply, and ties it to the +headphone amp widget. + +Signed-off-by: Chen-Yu Tsai +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun50i-codec-analog.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sunxi/sun50i-codec-analog.c b/sound/soc/sunxi/sun50i-codec-analog.c +index 8f5f999df631..df1fed0aa001 100644 +--- a/sound/soc/sunxi/sun50i-codec-analog.c ++++ b/sound/soc/sunxi/sun50i-codec-analog.c +@@ -274,6 +274,7 @@ static const struct snd_soc_dapm_widget sun50i_a64_codec_widgets[] = { + * stream widgets at the card level. + */ + ++ SND_SOC_DAPM_REGULATOR_SUPPLY("hpvcc", 0, 0), + SND_SOC_DAPM_MUX("Headphone Source Playback Route", + SND_SOC_NOPM, 0, 0, sun50i_codec_hp_src), + SND_SOC_DAPM_OUT_DRV("Headphone Amp", SUN50I_ADDA_HP_CTRL, +@@ -361,6 +362,7 @@ static const struct snd_soc_dapm_route sun50i_a64_codec_routes[] = { + { "Headphone Source Playback Route", "Mixer", "Left Mixer" }, + { "Headphone Source Playback Route", "Mixer", "Right Mixer" }, + { "Headphone Amp", NULL, "Headphone Source Playback Route" }, ++ { "Headphone Amp", NULL, "hpvcc" }, + { "HP", NULL, "Headphone Amp" }, + + /* Microphone Routes */ +-- +2.19.1 + diff --git a/queue-4.20/ath10k-assign-n_cipher_suites-for-wcn3990.patch b/queue-4.20/ath10k-assign-n_cipher_suites-for-wcn3990.patch new file mode 100644 index 00000000000..f8af8a7f251 --- /dev/null +++ b/queue-4.20/ath10k-assign-n_cipher_suites-for-wcn3990.patch @@ -0,0 +1,42 @@ +From 07fb1efa7c06c3b9cb0132f505dcb4d200e3b38c Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Fri, 2 Nov 2018 10:17:47 -0700 +Subject: ath10k: assign 'n_cipher_suites' for WCN3990 + +[ Upstream commit 2bd345cd2bfc0bd44528896313c0b45f087bdf67 ] + +Commit 2ea9f12cefe4 ("ath10k: add new cipher suite support") added a new +n_cipher_suites HW param with a fallback value and a warning log. Commit +03a72288c546 ("ath10k: wmi: add hw params entry for wcn3990") later +added WCN3990 HW entries, but it missed the n_cipher_suites. + +Rather than seeing this warning every boot + + ath10k_snoc 18800000.wifi: invalid hw_params.n_cipher_suites 0 + +let's provide the appropriate value. + +Cc: Rakesh Pillai +Cc: Govind Singh +Signed-off-by: Brian Norris +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c +index d210b0ed59be..59fdda67f89f 100644 +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -561,6 +561,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { + .hw_ops = &wcn3990_ops, + .decap_align_bytes = 1, + .num_peers = TARGET_HL_10_TLV_NUM_PEERS, ++ .n_cipher_suites = 8, + .ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT, + .num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES, + .target_64bit = true, +-- +2.19.1 + diff --git a/queue-4.20/ath10k-fix-kernel-panic-due-to-use-after-free.patch b/queue-4.20/ath10k-fix-kernel-panic-due-to-use-after-free.patch new file mode 100644 index 00000000000..c23248098d9 --- /dev/null +++ b/queue-4.20/ath10k-fix-kernel-panic-due-to-use-after-free.patch @@ -0,0 +1,105 @@ +From 1fef42d31c351a94c8787ab1dfb42a0399480b3d Mon Sep 17 00:00:00 2001 +From: Karthikeyan Periyasamy +Date: Thu, 20 Dec 2018 09:53:17 +0200 +Subject: ath10k: fix kernel panic due to use after free + +[ Upstream commit 553a7cca769d551f1317186760631487c47e23bf ] + +This issue arise in a race condition between ath10k_sta_state() and +ath10k_htt_fetch_peer_stats(), explained in below scenario + +Steps: +1. In ath10k_sta_state(), arsta->tx_stats get deallocated before peer deletion + when the station moves from IEEE80211_STA_NONE to IEEE80211_STA_NOTEXIST + state. +2. Meanwhile ath10k receive HTT_T2H_MSG_TYPE_PEER_STATS message. + In ath10k_htt_fetch_peer_stats(), arsta->tx_stats get accessed after + the peer validation check. + +Since arsta->tx_stats get freed before the peer deletion [1]. +ath10k_htt_fetch_peer_stats() ended up in "use after free" situation. + +Fixed this issue by moving the arsta->tx_stats free handling after the +peer deletion. so that ath10k_htt_fetch_peer_stats() will not end up in +"use after free" situation. + +Kernel Panic: + +Unable to handle kernel NULL pointer dereference at virtual address 00000286 +pgd = d8754000 +[00000286] *pgd=00000000 +Internal error: Oops: 5 [#1] PREEMPT SMP ARM +... +CPU: 0 PID: 6245 Comm: hostapd Not tainted +task: dc44cac0 ti: d4a38000 task.ti: d4a38000 +PC is at kmem_cache_alloc+0x7c/0x114 +LR is at ath10k_sta_state+0x190/0xd58 [ath10k_core] +pc : [] lr : [] psr: 20000013 +sp : d4a39b88 ip : 00000000 fp : 00000001 +r10: 00000000 r9 : 1d3bc000 r8 : 00000dc0 +r7 : 000080d0 r6 : d4a38000 r5 : dd401b00 r4 : 00000286 +r3 : 00000000 r2 : d4a39ba0 r1 : 000080d0 r0 : dd401b00 +Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +Control: 10c5787d Table: 5a75406a DAC: 00000015 +Process hostapd (pid: 6245, stack limit = 0xd4a38238) +Stack: (0xd4a39b88 to 0xd4a3a000) +... +[] (kmem_cache_alloc) from [] (ath10k_sta_state+0x190/0xd58 [ath10k_core]) +[] (ath10k_sta_state [ath10k_core]) from [] (sta_info_insert_rcu+0x418/0x61c [mac80211]) +[] (sta_info_insert_rcu [mac80211]) from [] (ieee80211_add_station+0xf0/0x134 [mac80211]) +[] (ieee80211_add_station [mac80211]) from [] (nl80211_new_station+0x330/0x36c [cfg80211]) +[] (nl80211_new_station [cfg80211]) from [] (extack_doit+0x2c/0x74 [compat]) +[] (extack_doit [compat]) from [] (genl_rcv_msg+0x274/0x30c) +[] (genl_rcv_msg) from [] (netlink_rcv_skb+0x58/0xac) +[] (netlink_rcv_skb) from [] (genl_rcv+0x20/0x34) +[] (genl_rcv) from [] (netlink_unicast+0x11c/0x204) +[] (netlink_unicast) from [] (netlink_sendmsg+0x30c/0x370) +[] (netlink_sendmsg) from [] (sock_sendmsg+0x70/0x84) +[] (sock_sendmsg) from [] (___sys_sendmsg.part.3+0x188/0x228) +[] (___sys_sendmsg.part.3) from [] (__sys_sendmsg+0x4c/0x70) +[] (__sys_sendmsg) from [] (ret_fast_syscall+0x0/0x44) +Code: ebfffec1 e1a04000 ea00001b e5953014 (e7940003) +ath10k_pci 0000:01:00.0: SWBA overrun on vdev 0, skipped old beacon + +Hardware tested: QCA9984 +Firmware tested: 10.4-3.6.0.1-00004 + +Fixes: a904417fc ("ath10k: add extended per sta tx statistics support") +Signed-off-by: Karthikeyan Periyasamy +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index b4764fee4751..6436dc229be5 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6387,11 +6387,6 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + "mac vdev %d peer delete %pM sta %pK (sta gone)\n", + arvif->vdev_id, sta->addr, sta); + +- if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { +- kfree(arsta->tx_stats); +- arsta->tx_stats = NULL; +- } +- + if (sta->tdls) { + ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, + sta, +@@ -6431,6 +6426,11 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + } + spin_unlock_bh(&ar->data_lock); + ++ if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { ++ kfree(arsta->tx_stats); ++ arsta->tx_stats = NULL; ++ } ++ + for (i = 0; i < ARRAY_SIZE(sta->txq); i++) + ath10k_mac_txq_unref(ar, sta->txq[i]); + +-- +2.19.1 + diff --git a/queue-4.20/ath10k-fix-tx_stats-memory-leak.patch b/queue-4.20/ath10k-fix-tx_stats-memory-leak.patch new file mode 100644 index 00000000000..1e57aaf3e59 --- /dev/null +++ b/queue-4.20/ath10k-fix-tx_stats-memory-leak.patch @@ -0,0 +1,89 @@ +From 2a03003e2d16e99ab8dd32b10d67520baeb78c1f Mon Sep 17 00:00:00 2001 +From: Zhi Chen +Date: Thu, 20 Dec 2018 14:25:18 +0200 +Subject: ath10k: fix tx_stats memory leak + +[ Upstream commit 386f97e3b201d18578abb0e7037b85a1ae50c0a3 ] + +Memory of tx_stats was allocated when a STA was added. But it's not freed +if the STA failed to be added to driver. This issue could be seen in MDK3 +attack case when STA number reached the limit. + +Tested: QCA9984 with firmware ver 10.4-3.9.0.1-00005 +Signed-off-by: Zhi Chen +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 6436dc229be5..400495858e4e 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6293,15 +6293,6 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + ar->num_stations + 1, ar->max_num_stations, + ar->num_peers + 1, ar->max_num_peers); + +- if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { +- arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), +- GFP_KERNEL); +- if (!arsta->tx_stats) { +- ret = -ENOMEM; +- goto exit; +- } +- } +- + num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif); + num_tdls_vifs = ath10k_mac_tdls_vifs_count(hw); + +@@ -6323,12 +6314,22 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + goto exit; + } + ++ if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { ++ arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), ++ GFP_KERNEL); ++ if (!arsta->tx_stats) { ++ ret = -ENOMEM; ++ goto exit; ++ } ++ } ++ + ret = ath10k_peer_create(ar, vif, sta, arvif->vdev_id, + sta->addr, peer_type); + if (ret) { + ath10k_warn(ar, "failed to add peer %pM for vdev %d when adding a new sta: %i\n", + sta->addr, arvif->vdev_id, ret); + ath10k_mac_dec_num_stations(arvif, sta); ++ kfree(arsta->tx_stats); + goto exit; + } + +@@ -6341,6 +6342,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + spin_unlock_bh(&ar->data_lock); + ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + ath10k_mac_dec_num_stations(arvif, sta); ++ kfree(arsta->tx_stats); + ret = -ENOENT; + goto exit; + } +@@ -6361,6 +6363,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + ath10k_peer_delete(ar, arvif->vdev_id, + sta->addr); + ath10k_mac_dec_num_stations(arvif, sta); ++ kfree(arsta->tx_stats); + goto exit; + } + +@@ -6372,6 +6375,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + sta->addr, arvif->vdev_id, ret); + ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + ath10k_mac_dec_num_stations(arvif, sta); ++ kfree(arsta->tx_stats); + + if (num_tdls_stations != 0) + goto exit; +-- +2.19.1 + diff --git a/queue-4.20/ath10k-fixup-extended-per-sta-tx-statistics.patch b/queue-4.20/ath10k-fixup-extended-per-sta-tx-statistics.patch new file mode 100644 index 00000000000..10f1cee5990 --- /dev/null +++ b/queue-4.20/ath10k-fixup-extended-per-sta-tx-statistics.patch @@ -0,0 +1,52 @@ +From c4331b4722042d885dcfadf75ba26c4ba89c22b1 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 18 Oct 2018 10:36:19 +0300 +Subject: ath10k: fixup extended per sta tx statistics + +[ Upstream commit 539b44e70c5b4ad82d2c0c97a4dfb37523d891f6 ] + +I had a couple concerns with this code. First, we definitely need to +set the error code if the kzalloc() fails. Secondly, I was worried that +if we didn't set "arsta->tx_stats" to NULL after freeing it, then it +looks to me like it might lead to a use after free. I can't test that, +but it's harmless to set it to NULL so I did. + +Fixes: a904417fc876 ("ath10k: add extended per sta tx statistics support") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 7e49342bae38..b4764fee4751 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6296,8 +6296,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { + arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats), + GFP_KERNEL); +- if (!arsta->tx_stats) ++ if (!arsta->tx_stats) { ++ ret = -ENOMEM; + goto exit; ++ } + } + + num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif); +@@ -6385,8 +6387,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + "mac vdev %d peer delete %pM sta %pK (sta gone)\n", + arvif->vdev_id, sta->addr, sta); + +- if (ath10k_debug_is_extd_tx_stats_enabled(ar)) ++ if (ath10k_debug_is_extd_tx_stats_enabled(ar)) { + kfree(arsta->tx_stats); ++ arsta->tx_stats = NULL; ++ } + + if (sta->tdls) { + ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, +-- +2.19.1 + diff --git a/queue-4.20/ath9k-dynack-use-authentication-messages-for-late-ac.patch b/queue-4.20/ath9k-dynack-use-authentication-messages-for-late-ac.patch new file mode 100644 index 00000000000..1878fa77482 --- /dev/null +++ b/queue-4.20/ath9k-dynack-use-authentication-messages-for-late-ac.patch @@ -0,0 +1,39 @@ +From ee7717bebd251cb54402e04bcc2adc76592321ec Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Fri, 2 Nov 2018 21:49:55 +0100 +Subject: ath9k: dynack: use authentication messages for 'late' ack + +[ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ] + +In order to properly support dynack in ad-hoc mode running +wpa_supplicant, take into account authentication frames for +'late ack' detection. This patch has been tested on devices +mounted on offshore high-voltage stations connected through +~24Km link + +Reported-by: Koen Vandeputte +Tested-by: Koen Vandeputte +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/dynack.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/dynack.c b/drivers/net/wireless/ath/ath9k/dynack.c +index 7334c9b09e82..cc0dc966c512 100644 +--- a/drivers/net/wireless/ath/ath9k/dynack.c ++++ b/drivers/net/wireless/ath/ath9k/dynack.c +@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb, + /* late ACK */ + if (ts->ts_status & ATH9K_TXERR_XRETRY) { + if (ieee80211_is_assoc_req(hdr->frame_control) || +- ieee80211_is_assoc_resp(hdr->frame_control)) { ++ ieee80211_is_assoc_resp(hdr->frame_control) || ++ ieee80211_is_auth(hdr->frame_control)) { + ath_dbg(common, DYNACK, "late ack\n"); + ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2); + ath9k_hw_set_ack_timeout(ah, LATEACK_TO); +-- +2.19.1 + diff --git a/queue-4.20/block-swim3-fix-ebusy-error-when-re-opening-device-a.patch b/queue-4.20/block-swim3-fix-ebusy-error-when-re-opening-device-a.patch new file mode 100644 index 00000000000..5e23e6ca4c3 --- /dev/null +++ b/queue-4.20/block-swim3-fix-ebusy-error-when-re-opening-device-a.patch @@ -0,0 +1,42 @@ +From ab30ab4f980cc7b418ff5242d218af2e2d5855c4 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Mon, 31 Dec 2018 16:44:09 +1100 +Subject: block/swim3: Fix -EBUSY error when re-opening device after unmount + +[ Upstream commit 296dcc40f2f2e402facf7cd26cf3f2c8f4b17d47 ] + +When the block device is opened with FMODE_EXCL, ref_count is set to -1. +This value doesn't get reset when the device is closed which means the +device cannot be opened again. Fix this by checking for refcount <= 0 +in the release method. + +Reported-and-tested-by: Stan Johnson +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Finn Thain +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/swim3.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c +index c1c676a33e4a..3f6df3f1f5d9 100644 +--- a/drivers/block/swim3.c ++++ b/drivers/block/swim3.c +@@ -995,7 +995,11 @@ static void floppy_release(struct gendisk *disk, fmode_t mode) + struct swim3 __iomem *sw = fs->swim3; + + mutex_lock(&swim3_mutex); +- if (fs->ref_count > 0 && --fs->ref_count == 0) { ++ if (fs->ref_count > 0) ++ --fs->ref_count; ++ else if (fs->ref_count == -1) ++ fs->ref_count = 0; ++ if (fs->ref_count == 0) { + swim3_action(fs, MOTOR_OFF); + out_8(&sw->control_bic, 0xff); + swim3_select(fs, RELAX); +-- +2.19.1 + diff --git a/queue-4.20/block-swim3-fix-regression-on-powerbook-g3.patch b/queue-4.20/block-swim3-fix-regression-on-powerbook-g3.patch new file mode 100644 index 00000000000..567ec652106 --- /dev/null +++ b/queue-4.20/block-swim3-fix-regression-on-powerbook-g3.patch @@ -0,0 +1,128 @@ +From 3ab6177fbf4fecb71a41cd51e9f05fbb7b1346e9 Mon Sep 17 00:00:00 2001 +From: Finn Thain +Date: Mon, 31 Dec 2018 16:44:09 +1100 +Subject: block/swim3: Fix regression on PowerBook G3 + +[ Upstream commit 427c5ce4417cba0801fbf79c8525d1330704759c ] + +As of v4.20, the swim3 driver crashes when loaded on a PowerBook G3 +(Wallstreet). + +MacIO PCI driver attached to Gatwick chipset +MacIO PCI driver attached to Heathrow chipset +swim3 0.00015000:floppy: [fd0] SWIM3 floppy controller in media bay +0.00013020:ch-a: ttyS0 at MMIO 0xf3013020 (irq = 16, base_baud = 230400) is a Z85c30 ESCC - Serial port +0.00013000:ch-b: ttyS1 at MMIO 0xf3013000 (irq = 17, base_baud = 230400) is a Z85c30 ESCC - Infrared port +macio: fixed media-bay irq on gatwick +macio: fixed left floppy irqs +swim3 1.00015000:floppy: [fd1] Couldn't request interrupt +Unable to handle kernel paging request for data at address 0x00000024 +Faulting instruction address: 0xc02652f8 +Oops: Kernel access of bad area, sig: 11 [#1] +BE SMP NR_CPUS=2 PowerMac +Modules linked in: +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.20.0 #2 +NIP: c02652f8 LR: c026915c CTR: c0276d1c +REGS: df43ba10 TRAP: 0300 Not tainted (4.20.0) +MSR: 00009032 CR: 28228288 XER: 00000100 +DAR: 00000024 DSISR: 40000000 +GPR00: c026915c df43bac0 df439060 c0731524 df494700 00000000 c06e1c08 00000001 +GPR08: 00000001 00000000 df5ff220 00001032 28228282 00000000 c0004ca4 00000000 +GPR16: 00000000 00000000 00000000 c073144c dfffe064 c0731524 00000120 c0586108 +GPR24: c073132c c073143c c073143c 00000000 c0731524 df67cd70 df494700 00000001 +NIP [c02652f8] blk_mq_free_rqs+0x28/0xf8 +LR [c026915c] blk_mq_sched_tags_teardown+0x58/0x84 +Call Trace: +[df43bac0] [c0045f50] flush_workqueue_prep_pwqs+0x178/0x1c4 (unreliable) +[df43bae0] [c026915c] blk_mq_sched_tags_teardown+0x58/0x84 +[df43bb00] [c02697f0] blk_mq_exit_sched+0x9c/0xb8 +[df43bb20] [c0252794] elevator_exit+0x84/0xa4 +[df43bb40] [c0256538] blk_exit_queue+0x30/0x50 +[df43bb50] [c0256640] blk_cleanup_queue+0xe8/0x184 +[df43bb70] [c034732c] swim3_attach+0x330/0x5f0 +[df43bbb0] [c034fb24] macio_device_probe+0x58/0xec +[df43bbd0] [c032ba88] really_probe+0x1e4/0x2f4 +[df43bc00] [c032bd28] driver_probe_device+0x64/0x204 +[df43bc20] [c0329ac4] bus_for_each_drv+0x60/0xac +[df43bc50] [c032b824] __device_attach+0xe8/0x160 +[df43bc80] [c032ab38] bus_probe_device+0xa0/0xbc +[df43bca0] [c0327338] device_add+0x3d8/0x630 +[df43bcf0] [c0350848] macio_add_one_device+0x444/0x48c +[df43bd50] [c03509f8] macio_pci_add_devices+0x168/0x1bc +[df43bd90] [c03500ec] macio_pci_probe+0xc0/0x10c +[df43bda0] [c02ad884] pci_device_probe+0xd4/0x184 +[df43bdd0] [c032ba88] really_probe+0x1e4/0x2f4 +[df43be00] [c032bd28] driver_probe_device+0x64/0x204 +[df43be20] [c032bfcc] __driver_attach+0x104/0x108 +[df43be40] [c0329a00] bus_for_each_dev+0x64/0xb4 +[df43be70] [c032add8] bus_add_driver+0x154/0x238 +[df43be90] [c032ca24] driver_register+0x84/0x148 +[df43bea0] [c0004aa0] do_one_initcall+0x40/0x188 +[df43bf00] [c0690100] kernel_init_freeable+0x138/0x1d4 +[df43bf30] [c0004cbc] kernel_init+0x18/0x10c +[df43bf40] [c00121e4] ret_from_kernel_thread+0x14/0x1c +Instruction dump: +5484d97e 4bfff4f4 9421ffe0 7c0802a6 bf410008 7c9e2378 90010024 8124005c +2f890000 419e0078 81230004 7c7c1b78 <81290024> 2f890000 419e0064 81440000 +---[ end trace 12025ab921a9784c ]--- + +Reverting commit 8ccb8cb1892b ("swim3: convert to blk-mq") resolves the +problem. + +That commit added a struct blk_mq_tag_set to struct floppy_state and +initialized it with a blk_mq_init_sq_queue() call. Unfortunately, there +is a memset() in swim3_add_device() that subsequently clears the +floppy_state struct. That means fs->tag_set->ops is a NULL pointer, and +it gets dereferenced by blk_mq_free_rqs() which gets called in the +request_irq() error path. Move the memset() to fix this bug. + +BTW, the request_irq() failure for the left mediabay floppy (fd1) is not +a regression. I don't know why it happens. The right media bay floppy +(fd0) works fine however. + +Reported-and-tested-by: Stan Johnson +Fixes: 8ccb8cb1892b ("swim3: convert to blk-mq") +Cc: linuxppc-dev@lists.ozlabs.org +Signed-off-by: Finn Thain + +Signed-off-by: Jens Axboe + +Signed-off-by: Sasha Levin +--- + drivers/block/swim3.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c +index 3f6df3f1f5d9..1046459f172b 100644 +--- a/drivers/block/swim3.c ++++ b/drivers/block/swim3.c +@@ -1091,8 +1091,6 @@ static int swim3_add_device(struct macio_dev *mdev, int index) + struct floppy_state *fs = &floppy_states[index]; + int rc = -EBUSY; + +- /* Do this first for message macros */ +- memset(fs, 0, sizeof(*fs)); + fs->mdev = mdev; + fs->index = index; + +@@ -1192,14 +1190,15 @@ static int swim3_attach(struct macio_dev *mdev, + return rc; + } + +- fs = &floppy_states[floppy_count]; +- + disk = alloc_disk(1); + if (disk == NULL) { + rc = -ENOMEM; + goto out_unregister; + } + ++ fs = &floppy_states[floppy_count]; ++ memset(fs, 0, sizeof(*fs)); ++ + disk->queue = blk_mq_init_sq_queue(&fs->tag_set, &swim3_mq_ops, 2, + BLK_MQ_F_SHOULD_MERGE); + if (IS_ERR(disk->queue)) { +-- +2.19.1 + diff --git a/queue-4.20/bluetooth-hci_bcm-handle-deferred-probing-for-the-cl.patch b/queue-4.20/bluetooth-hci_bcm-handle-deferred-probing-for-the-cl.patch new file mode 100644 index 00000000000..3bab4907547 --- /dev/null +++ b/queue-4.20/bluetooth-hci_bcm-handle-deferred-probing-for-the-cl.patch @@ -0,0 +1,40 @@ +From ffe65846baf679082ad5de103d513bcb5326b538 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Mon, 17 Dec 2018 12:04:39 +0800 +Subject: Bluetooth: hci_bcm: Handle deferred probing for the clock supply + +[ Upstream commit 28ac03b9ac3f784c2f048a910c8d0a7a87483b66 ] + +On some systems that actually have the bluetooth controller wired up +with an extra clock signal, it's possible the bluetooth controller +probes before the clock provider. clk_get would return a defer probe +error, which was not handled by this driver. + +Handle this properly, so that these systems can work reliably. + +Tested-by: Ondrej Jirman +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_bcm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index ddbd8c6a0ceb..800132369134 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -907,6 +907,10 @@ static int bcm_get_resources(struct bcm_device *dev) + + dev->clk = devm_clk_get(dev->dev, NULL); + ++ /* Handle deferred probing */ ++ if (dev->clk == ERR_PTR(-EPROBE_DEFER)) ++ return PTR_ERR(dev->clk); ++ + dev->device_wakeup = devm_gpiod_get_optional(dev->dev, "device-wakeup", + GPIOD_OUT_LOW); + if (IS_ERR(dev->device_wakeup)) +-- +2.19.1 + diff --git a/queue-4.20/bnxt_en-disable-msix-before-re-reserving-nqs-cmpl-ri.patch b/queue-4.20/bnxt_en-disable-msix-before-re-reserving-nqs-cmpl-ri.patch new file mode 100644 index 00000000000..b45017b76bb --- /dev/null +++ b/queue-4.20/bnxt_en-disable-msix-before-re-reserving-nqs-cmpl-ri.patch @@ -0,0 +1,66 @@ +From 55d6b79b51e6094ee62e6aba0dfe21d3234ecc90 Mon Sep 17 00:00:00 2001 +From: Michael Chan +Date: Sun, 16 Dec 2018 18:46:24 -0500 +Subject: bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings. + +[ Upstream commit 36d65be9a88052cdfc8524eb591baf0e6c878408 ] + +When bringing up a device, the code checks to see if the number of +MSIX has changed. pci_disable_msix() should be called first before +changing the number of reserved NQs/CMPL rings. This ensures that +the MSIX vectors associated with the NQs/CMPL rings are still +properly mapped when pci_disable_msix() masks the vectors. + +This patch will prevent errors when RDMA support is added for the new +57500 chips. When the RDMA driver shuts down, the number of NQs is +decreased and we must use the new sequence to prevent MSIX errors. + +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 5d21c14853ac..50a4c3ddf977 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -7203,23 +7203,26 @@ static void bnxt_clear_int_mode(struct bnxt *bp) + int bnxt_reserve_rings(struct bnxt *bp) + { + int tcs = netdev_get_num_tc(bp->dev); ++ bool reinit_irq = false; + int rc; + + if (!bnxt_need_reserve_rings(bp)) + return 0; + +- rc = __bnxt_reserve_rings(bp); +- if (rc) { +- netdev_err(bp->dev, "ring reservation failure rc: %d\n", rc); +- return rc; +- } + if (BNXT_NEW_RM(bp) && (bnxt_get_num_msix(bp) != bp->total_irqs)) { + bnxt_ulp_irq_stop(bp); + bnxt_clear_int_mode(bp); +- rc = bnxt_init_int_mode(bp); ++ reinit_irq = true; ++ } ++ rc = __bnxt_reserve_rings(bp); ++ if (reinit_irq) { ++ if (!rc) ++ rc = bnxt_init_int_mode(bp); + bnxt_ulp_irq_restart(bp, rc); +- if (rc) +- return rc; ++ } ++ if (rc) { ++ netdev_err(bp->dev, "ring reservation/IRQ init failure rc: %d\n", rc); ++ return rc; + } + if (tcs && (bp->tx_nr_rings_per_tc * tcs != bp->tx_nr_rings)) { + netdev_err(bp->dev, "tx ring reservation failure\n"); +-- +2.19.1 + diff --git a/queue-4.20/bpf-libbpf-retry-map-creation-without-the-name.patch b/queue-4.20/bpf-libbpf-retry-map-creation-without-the-name.patch new file mode 100644 index 00000000000..6880525a0b8 --- /dev/null +++ b/queue-4.20/bpf-libbpf-retry-map-creation-without-the-name.patch @@ -0,0 +1,55 @@ +From d2732db839e3c53c66d19d476717abbcb28e0b44 Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Mon, 19 Nov 2018 14:49:01 -0800 +Subject: bpf: libbpf: retry map creation without the name + +[ Upstream commit 23499442c319412aa8e54e7a939e2eb531bdd77d ] + +Since commit 88cda1c9da02 ("bpf: libbpf: Provide basic API support +to specify BPF obj name"), libbpf unconditionally sets bpf_attr->name +for maps. Pre v4.14 kernels don't know about map names and return an +error about unexpected non-zero data. Retry sys_bpf without a map +name to cover older kernels. + +v2 changes: +* check for errno == EINVAL as suggested by Daniel Borkmann + +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/bpf.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/bpf.c b/tools/lib/bpf/bpf.c +index 03f9bcc4ef50..961e1b9fc592 100644 +--- a/tools/lib/bpf/bpf.c ++++ b/tools/lib/bpf/bpf.c +@@ -69,6 +69,7 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr) + { + __u32 name_len = create_attr->name ? strlen(create_attr->name) : 0; + union bpf_attr attr; ++ int ret; + + memset(&attr, '\0', sizeof(attr)); + +@@ -86,7 +87,15 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr) + attr.map_ifindex = create_attr->map_ifindex; + attr.inner_map_fd = create_attr->inner_map_fd; + +- return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr)); ++ ret = sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr)); ++ if (ret < 0 && errno == EINVAL && create_attr->name) { ++ /* Retry the same syscall, but without the name. ++ * Pre v4.14 kernels don't support map names. ++ */ ++ memset(attr.map_name, 0, sizeof(attr.map_name)); ++ return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr)); ++ } ++ return ret; + } + + int bpf_create_map_node(enum bpf_map_type map_type, const char *name, +-- +2.19.1 + diff --git a/queue-4.20/bpf-sk_msg-fix-socket-data_ready-events.patch b/queue-4.20/bpf-sk_msg-fix-socket-data_ready-events.patch new file mode 100644 index 00000000000..2a13f2afda7 --- /dev/null +++ b/queue-4.20/bpf-sk_msg-fix-socket-data_ready-events.patch @@ -0,0 +1,96 @@ +From 8c73a4ac9f3687ecb1f6cabf7fa7ec7da3fd0d14 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Thu, 20 Dec 2018 11:35:33 -0800 +Subject: bpf: sk_msg, fix socket data_ready events + +[ Upstream commit 552de91068828daef50a227a665068cf8dde835e ] + +When a skb verdict program is in-use and either another BPF program +redirects to that socket or the new SK_PASS support is used the +data_ready callback does not wake up application. Instead because +the stream parser/verdict is using the sk data_ready callback we wake +up the stream parser/verdict block. + +Fix this by adding a helper to check if the stream parser block is +enabled on the sk and if so call the saved pointer which is the +upper layers wake up function. + +This fixes application stalls observed when an application is waiting +for data in a blocking read(). + +Fixes: d829e9c4112b ("tls: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + include/linux/skmsg.h | 8 ++++++++ + net/core/skmsg.c | 6 +++--- + net/ipv4/tcp_bpf.c | 2 +- + 3 files changed, 12 insertions(+), 4 deletions(-) + +diff --git a/include/linux/skmsg.h b/include/linux/skmsg.h +index 2a11e9d91dfa..36bd85863081 100644 +--- a/include/linux/skmsg.h ++++ b/include/linux/skmsg.h +@@ -416,6 +416,14 @@ static inline void sk_psock_put(struct sock *sk, struct sk_psock *psock) + sk_psock_drop(sk, psock); + } + ++static inline void sk_psock_data_ready(struct sock *sk, struct sk_psock *psock) ++{ ++ if (psock->parser.enabled) ++ psock->parser.saved_data_ready(sk); ++ else ++ sk->sk_data_ready(sk); ++} ++ + static inline void psock_set_prog(struct bpf_prog **pprog, + struct bpf_prog *prog) + { +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index fc7d59f1c57c..54d854807630 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -406,7 +406,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb) + msg->skb = skb; + + sk_psock_queue_msg(psock, msg); +- sk->sk_data_ready(sk); ++ sk_psock_data_ready(sk, psock); + return copied; + } + +@@ -739,7 +739,7 @@ static int sk_psock_strp_parse(struct strparser *strp, struct sk_buff *skb) + } + + /* Called with socket lock held. */ +-static void sk_psock_data_ready(struct sock *sk) ++static void sk_psock_strp_data_ready(struct sock *sk) + { + struct sk_psock *psock; + +@@ -787,7 +787,7 @@ void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock) + return; + + parser->saved_data_ready = sk->sk_data_ready; +- sk->sk_data_ready = sk_psock_data_ready; ++ sk->sk_data_ready = sk_psock_strp_data_ready; + sk->sk_write_space = sk_psock_write_space; + parser->enabled = true; + } +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 3b45fe530f91..2d6bd7a59b2c 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -198,7 +198,7 @@ static int bpf_tcp_ingress(struct sock *sk, struct sk_psock *psock, + msg->sg.start = i; + msg->sg.size -= apply_bytes; + sk_psock_queue_msg(psock, tmp); +- sk->sk_data_ready(sk); ++ sk_psock_data_ready(sk, psock); + } else { + sk_msg_free(sk, tmp); + kfree(tmp); +-- +2.19.1 + diff --git a/queue-4.20/bpf-sk_msg-zap-ingress-queue-on-psock-down.patch b/queue-4.20/bpf-sk_msg-zap-ingress-queue-on-psock-down.patch new file mode 100644 index 00000000000..e6f5ad7eaf8 --- /dev/null +++ b/queue-4.20/bpf-sk_msg-zap-ingress-queue-on-psock-down.patch @@ -0,0 +1,42 @@ +From e92913dd1a7c911de04943609dd985909c9dc2a2 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Thu, 20 Dec 2018 11:35:34 -0800 +Subject: bpf: sk_msg, zap ingress queue on psock down + +[ Upstream commit a136678c0bdbb650daff5df5eec1dab960e074a7 ] + +In addition to releasing any cork'ed data on a psock when the psock +is removed we should also release any skb's in the ingress work queue. +Otherwise the skb's eventually get free'd but late in the tear +down process so we see the WARNING due to non-zero sk_forward_alloc. + + void sk_stream_kill_queues(struct sock *sk) + { + ... + WARN_ON(sk->sk_forward_alloc); + ... + } + +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index b7dbb3c976cd..fc7d59f1c57c 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -575,6 +575,7 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock) + { + rcu_assign_sk_user_data(sk, NULL); + sk_psock_cork_free(psock); ++ sk_psock_zap_ingress(psock); + sk_psock_restore_proto(sk, psock); + + write_lock_bh(&sk->sk_callback_lock); +-- +2.19.1 + diff --git a/queue-4.20/bpftool-improve-handling-of-enoent-on-map-dumps.patch b/queue-4.20/bpftool-improve-handling-of-enoent-on-map-dumps.patch new file mode 100644 index 00000000000..367577276d6 --- /dev/null +++ b/queue-4.20/bpftool-improve-handling-of-enoent-on-map-dumps.patch @@ -0,0 +1,95 @@ +From 2867975908677b97b9bcd4ae999a19d74660d7f1 Mon Sep 17 00:00:00 2001 +From: David Ahern +Date: Thu, 8 Nov 2018 13:00:07 -0800 +Subject: bpftool: Improve handling of ENOENT on map dumps + +[ Upstream commit bf598a8f0f771302d4ecb0ef0003c54732221597 ] + +bpftool output is not user friendly when dumping a map with only a few +populated entries: + + $ bpftool map + 1: devmap name tx_devmap flags 0x0 + key 4B value 4B max_entries 64 memlock 4096B + 2: array name tx_idxmap flags 0x0 + key 4B value 4B max_entries 64 memlock 4096B + + $ bpftool map dump id 1 + key: + 00 00 00 00 + value: + No such file or directory + key: + 01 00 00 00 + value: + No such file or directory + key: + 02 00 00 00 + value: + No such file or directory + key: 03 00 00 00 value: 03 00 00 00 + +Handle ENOENT by keeping the line format sane and dumping +"" for the value + + $ bpftool map dump id 1 + key: 00 00 00 00 value: + key: 01 00 00 00 value: + key: 02 00 00 00 value: + key: 03 00 00 00 value: 03 00 00 00 + ... + +Signed-off-by: David Ahern +Acked-by: Jakub Kicinski +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/map.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/tools/bpf/bpftool/map.c b/tools/bpf/bpftool/map.c +index 7bf38f0e152e..9988d5c126b6 100644 +--- a/tools/bpf/bpftool/map.c ++++ b/tools/bpf/bpftool/map.c +@@ -383,7 +383,10 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key, + printf(single_line ? " " : "\n"); + + printf("value:%c", break_names ? '\n' : ' '); +- fprint_hex(stdout, value, info->value_size, " "); ++ if (value) ++ fprint_hex(stdout, value, info->value_size, " "); ++ else ++ printf(""); + + printf("\n"); + } else { +@@ -398,8 +401,11 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key, + for (i = 0; i < n; i++) { + printf("value (CPU %02d):%c", + i, info->value_size > 16 ? '\n' : ' '); +- fprint_hex(stdout, value + i * step, +- info->value_size, " "); ++ if (value) ++ fprint_hex(stdout, value + i * step, ++ info->value_size, " "); ++ else ++ printf(""); + printf("\n"); + } + } +@@ -731,7 +737,11 @@ static int dump_map_elem(int fd, void *key, void *value, + jsonw_string_field(json_wtr, "error", strerror(lookup_errno)); + jsonw_end_object(json_wtr); + } else { +- print_entry_error(map_info, key, strerror(lookup_errno)); ++ if (errno == ENOENT) ++ print_entry_plain(map_info, key, NULL); ++ else ++ print_entry_error(map_info, key, ++ strerror(lookup_errno)); + } + + return 0; +-- +2.19.1 + diff --git a/queue-4.20/btrfs-harden-agaist-duplicate-fsid-on-scanned-device.patch b/queue-4.20/btrfs-harden-agaist-duplicate-fsid-on-scanned-device.patch new file mode 100644 index 00000000000..03eeb88e5e2 --- /dev/null +++ b/queue-4.20/btrfs-harden-agaist-duplicate-fsid-on-scanned-device.patch @@ -0,0 +1,116 @@ +From d876e2686f43959f60c35d38f568aa856ae2d219 Mon Sep 17 00:00:00 2001 +From: Anand Jain +Date: Mon, 15 Oct 2018 10:45:17 +0800 +Subject: btrfs: harden agaist duplicate fsid on scanned devices + +[ Upstream commit a9261d4125c97ce8624e9941b75dee1b43ad5df9 ] + +It's not that impossible to imagine that a device OR a btrfs image is +copied just by using the dd or the cp command. Which in case both the +copies of the btrfs will have the same fsid. If on the system with +automount enabled, the copied FS gets scanned. + +We have a known bug in btrfs, that we let the device path be changed +after the device has been mounted. So using this loop hole the new +copied device would appears as if its mounted immediately after it's +been copied. + +For example: + +Initially.. /dev/mmcblk0p4 is mounted as / + + $ lsblk + NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT + mmcblk0 179:0 0 29.2G 0 disk + |-mmcblk0p4 179:4 0 4G 0 part / + |-mmcblk0p2 179:2 0 500M 0 part /boot + |-mmcblk0p3 179:3 0 256M 0 part [SWAP] + `-mmcblk0p1 179:1 0 256M 0 part /boot/efi + + $ btrfs fi show + Label: none uuid: 07892354-ddaa-4443-90ea-f76a06accaba + Total devices 1 FS bytes used 1.40GiB + devid 1 size 4.00GiB used 3.00GiB path /dev/mmcblk0p4 + +Copy mmcblk0 to sda + + $ dd if=/dev/mmcblk0 of=/dev/sda + +And immediately after the copy completes the change in the device +superblock is notified which the automount scans using btrfs device scan +and the new device sda becomes the mounted root device. + + $ lsblk + NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT + sda 8:0 1 14.9G 0 disk + |-sda4 8:4 1 4G 0 part / + |-sda2 8:2 1 500M 0 part + |-sda3 8:3 1 256M 0 part + `-sda1 8:1 1 256M 0 part + mmcblk0 179:0 0 29.2G 0 disk + |-mmcblk0p4 179:4 0 4G 0 part + |-mmcblk0p2 179:2 0 500M 0 part /boot + |-mmcblk0p3 179:3 0 256M 0 part [SWAP] + `-mmcblk0p1 179:1 0 256M 0 part /boot/efi + + $ btrfs fi show / + Label: none uuid: 07892354-ddaa-4443-90ea-f76a06accaba + Total devices 1 FS bytes used 1.40GiB + devid 1 size 4.00GiB used 3.00GiB path /dev/sda4 + +The bug is quite nasty that you can't either unmount /dev/sda4 or +/dev/mmcblk0p4. And the problem does not get solved until you take sda +out of the system on to another system to change its fsid using the +'btrfstune -u' command. + +Signed-off-by: Anand Jain +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/volumes.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index ea5fa9df9405..6f09f6032db3 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -850,6 +850,35 @@ static noinline struct btrfs_device *device_list_add(const char *path, + return ERR_PTR(-EEXIST); + } + ++ /* ++ * We are going to replace the device path for a given devid, ++ * make sure it's the same device if the device is mounted ++ */ ++ if (device->bdev) { ++ struct block_device *path_bdev; ++ ++ path_bdev = lookup_bdev(path); ++ if (IS_ERR(path_bdev)) { ++ mutex_unlock(&fs_devices->device_list_mutex); ++ return ERR_CAST(path_bdev); ++ } ++ ++ if (device->bdev != path_bdev) { ++ bdput(path_bdev); ++ mutex_unlock(&fs_devices->device_list_mutex); ++ btrfs_warn_in_rcu(device->fs_info, ++ "duplicate device fsid:devid for %pU:%llu old:%s new:%s", ++ disk_super->fsid, devid, ++ rcu_str_deref(device->name), path); ++ return ERR_PTR(-EEXIST); ++ } ++ bdput(path_bdev); ++ btrfs_info_in_rcu(device->fs_info, ++ "device fsid %pU devid %llu moved old:%s new:%s", ++ disk_super->fsid, devid, ++ rcu_str_deref(device->name), path); ++ } ++ + name = rcu_string_strdup(path, GFP_NOFS); + if (!name) { + mutex_unlock(&fs_devices->device_list_mutex); +-- +2.19.1 + diff --git a/queue-4.20/btrfs-reada-reorder-dev-replace-locks-before-radix-t.patch b/queue-4.20/btrfs-reada-reorder-dev-replace-locks-before-radix-t.patch new file mode 100644 index 00000000000..5a1843cfdd0 --- /dev/null +++ b/queue-4.20/btrfs-reada-reorder-dev-replace-locks-before-radix-t.patch @@ -0,0 +1,62 @@ +From 64a146e23196c0eea70cf82752cea35992c2e8fa Mon Sep 17 00:00:00 2001 +From: David Sterba +Date: Fri, 24 Aug 2018 19:35:04 +0200 +Subject: btrfs: reada: reorder dev-replace locks before radix tree preload + +[ Upstream commit ceb21a8db48559fd0809e03c4df9eb37743d9170 ] + +The device-replace read lock is going to use rw semaphore in followup +commits. The semaphore might sleep which is not possible in the radix +tree preload section. The lock nesting is now: + +* device replace + * radix tree preload + * readahead spinlock + +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/reada.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/btrfs/reada.c b/fs/btrfs/reada.c +index dec14b739b10..6f81f3e88b6d 100644 +--- a/fs/btrfs/reada.c ++++ b/fs/btrfs/reada.c +@@ -376,26 +376,28 @@ static struct reada_extent *reada_find_extent(struct btrfs_fs_info *fs_info, + goto error; + } + ++ /* Insert extent in reada tree + all per-device trees, all or nothing */ ++ btrfs_dev_replace_read_lock(&fs_info->dev_replace); + ret = radix_tree_preload(GFP_KERNEL); +- if (ret) ++ if (ret) { ++ btrfs_dev_replace_read_unlock(&fs_info->dev_replace); + goto error; ++ } + +- /* insert extent in reada_tree + all per-device trees, all or nothing */ +- btrfs_dev_replace_read_lock(&fs_info->dev_replace); + spin_lock(&fs_info->reada_lock); + ret = radix_tree_insert(&fs_info->reada_tree, index, re); + if (ret == -EEXIST) { + re_exist = radix_tree_lookup(&fs_info->reada_tree, index); + re_exist->refcnt++; + spin_unlock(&fs_info->reada_lock); +- btrfs_dev_replace_read_unlock(&fs_info->dev_replace); + radix_tree_preload_end(); ++ btrfs_dev_replace_read_unlock(&fs_info->dev_replace); + goto error; + } + if (ret) { + spin_unlock(&fs_info->reada_lock); +- btrfs_dev_replace_read_unlock(&fs_info->dev_replace); + radix_tree_preload_end(); ++ btrfs_dev_replace_read_unlock(&fs_info->dev_replace); + goto error; + } + radix_tree_preload_end(); +-- +2.19.1 + diff --git a/queue-4.20/btrfs-use-tagged-writepage-to-mitigate-livelock-of-s.patch b/queue-4.20/btrfs-use-tagged-writepage-to-mitigate-livelock-of-s.patch new file mode 100644 index 00000000000..7ab84b44408 --- /dev/null +++ b/queue-4.20/btrfs-use-tagged-writepage-to-mitigate-livelock-of-s.patch @@ -0,0 +1,181 @@ +From 19b7a9811c8ef51dc19b044b03cc7b8edab78384 Mon Sep 17 00:00:00 2001 +From: Ethan Lien +Date: Thu, 1 Nov 2018 14:49:03 +0800 +Subject: btrfs: use tagged writepage to mitigate livelock of snapshot + +[ Upstream commit 3cd24c698004d2f7668e0eb9fc1f096f533c791b ] + +Snapshot is expected to be fast. But if there are writers steadily +creating dirty pages in our subvolume, the snapshot may take a very long +time to complete. To fix the problem, we use tagged writepage for +snapshot flusher as we do in the generic write_cache_pages(), so we can +omit pages dirtied after the snapshot command. + +This does not change the semantics regarding which data get to the +snapshot, if there are pages being dirtied during the snapshotting +operation. There's a sync called before snapshot is taken in old/new +case, any IO in flight just after that may be in the snapshot but this +depends on other system effects that might still sync the IO. + +We do a simple snapshot speed test on a Intel D-1531 box: + +fio --ioengine=libaio --iodepth=32 --bs=4k --rw=write --size=64G +--direct=0 --thread=1 --numjobs=1 --time_based --runtime=120 +--filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5; +time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio + +original: 1m58sec +patched: 6.54sec + +This is the best case for this patch since for a sequential write case, +we omit nearly all pages dirtied after the snapshot command. + +For a multi writers, random write test: + +fio --ioengine=libaio --iodepth=32 --bs=4k --rw=randwrite --size=64G +--direct=0 --thread=1 --numjobs=4 --time_based --runtime=120 +--filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5; +time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio + +original: 15.83sec +patched: 10.35sec + +The improvement is smaller compared to the sequential write case, +since we omit only half of the pages dirtied after snapshot command. + +Reviewed-by: Nikolay Borisov +Signed-off-by: Ethan Lien +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/btrfs_inode.h | 1 + + fs/btrfs/ctree.h | 2 +- + fs/btrfs/extent_io.c | 17 +++++++++++++++-- + fs/btrfs/inode.c | 11 +++++++---- + fs/btrfs/ioctl.c | 2 +- + 5 files changed, 25 insertions(+), 8 deletions(-) + +diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h +index a0e230b31a88..20288b49718f 100644 +--- a/fs/btrfs/btrfs_inode.h ++++ b/fs/btrfs/btrfs_inode.h +@@ -29,6 +29,7 @@ enum { + BTRFS_INODE_IN_DELALLOC_LIST, + BTRFS_INODE_READDIO_NEED_LOCK, + BTRFS_INODE_HAS_PROPS, ++ BTRFS_INODE_SNAPSHOT_FLUSH, + }; + + /* in memory btrfs inode */ +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 68f322f600a0..131e90aad941 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -3141,7 +3141,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans, + struct inode *inode, u64 new_size, + u32 min_type); + +-int btrfs_start_delalloc_inodes(struct btrfs_root *root); ++int btrfs_start_delalloc_snapshot(struct btrfs_root *root); + int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr); + int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end, + unsigned int extra_bits, +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index d228f706ff3e..c8e886caacd7 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -3934,12 +3934,25 @@ static int extent_write_cache_pages(struct address_space *mapping, + range_whole = 1; + scanned = 1; + } +- if (wbc->sync_mode == WB_SYNC_ALL) ++ ++ /* ++ * We do the tagged writepage as long as the snapshot flush bit is set ++ * and we are the first one who do the filemap_flush() on this inode. ++ * ++ * The nr_to_write == LONG_MAX is needed to make sure other flushers do ++ * not race in and drop the bit. ++ */ ++ if (range_whole && wbc->nr_to_write == LONG_MAX && ++ test_and_clear_bit(BTRFS_INODE_SNAPSHOT_FLUSH, ++ &BTRFS_I(inode)->runtime_flags)) ++ wbc->tagged_writepages = 1; ++ ++ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages) + tag = PAGECACHE_TAG_TOWRITE; + else + tag = PAGECACHE_TAG_DIRTY; + retry: +- if (wbc->sync_mode == WB_SYNC_ALL) ++ if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages) + tag_pages_for_writeback(mapping, index, end); + done_index = index; + while (!done && !nr_to_write_done && (index <= end) && +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 561bffcb56a0..965a64bde6fd 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9988,7 +9988,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode + * some fairly slow code that needs optimization. This walks the list + * of all the inodes with pending delalloc and forces them to disk. + */ +-static int start_delalloc_inodes(struct btrfs_root *root, int nr) ++static int start_delalloc_inodes(struct btrfs_root *root, int nr, bool snapshot) + { + struct btrfs_inode *binode; + struct inode *inode; +@@ -10016,6 +10016,9 @@ static int start_delalloc_inodes(struct btrfs_root *root, int nr) + } + spin_unlock(&root->delalloc_lock); + ++ if (snapshot) ++ set_bit(BTRFS_INODE_SNAPSHOT_FLUSH, ++ &binode->runtime_flags); + work = btrfs_alloc_delalloc_work(inode); + if (!work) { + iput(inode); +@@ -10049,7 +10052,7 @@ out: + return ret; + } + +-int btrfs_start_delalloc_inodes(struct btrfs_root *root) ++int btrfs_start_delalloc_snapshot(struct btrfs_root *root) + { + struct btrfs_fs_info *fs_info = root->fs_info; + int ret; +@@ -10057,7 +10060,7 @@ int btrfs_start_delalloc_inodes(struct btrfs_root *root) + if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) + return -EROFS; + +- ret = start_delalloc_inodes(root, -1); ++ ret = start_delalloc_inodes(root, -1, true); + if (ret > 0) + ret = 0; + return ret; +@@ -10086,7 +10089,7 @@ int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr) + &fs_info->delalloc_roots); + spin_unlock(&fs_info->delalloc_root_lock); + +- ret = start_delalloc_inodes(root, nr); ++ ret = start_delalloc_inodes(root, nr, false); + btrfs_put_fs_root(root); + if (ret < 0) + goto out; +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 802a628e9f7d..87f4f0f65dbb 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -777,7 +777,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, + wait_event(root->subv_writers->wait, + percpu_counter_sum(&root->subv_writers->counter) == 0); + +- ret = btrfs_start_delalloc_inodes(root); ++ ret = btrfs_start_delalloc_snapshot(root); + if (ret) + goto dec_and_free; + +-- +2.19.1 + diff --git a/queue-4.20/cgroup-fix-parsing-empty-mount-option-string.patch b/queue-4.20/cgroup-fix-parsing-empty-mount-option-string.patch new file mode 100644 index 00000000000..773986b0502 --- /dev/null +++ b/queue-4.20/cgroup-fix-parsing-empty-mount-option-string.patch @@ -0,0 +1,45 @@ +From d4a50ba911700b20612adf589fd2689a504c229d Mon Sep 17 00:00:00 2001 +From: Ondrej Mosnacek +Date: Thu, 13 Dec 2018 15:17:37 +0100 +Subject: cgroup: fix parsing empty mount option string + +[ Upstream commit e250d91d65750a0c0c62483ac4f9f357e7317617 ] + +This fixes the case where all mount options specified are consumed by an +LSM and all that's left is an empty string. In this case cgroupfs should +accept the string and not fail. + +How to reproduce (with SELinux enabled): + + # umount /sys/fs/cgroup/unified + # mount -o context=system_u:object_r:cgroup_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified + mount: /sys/fs/cgroup/unified: wrong fs type, bad option, bad superblock on cgroup2, missing codepage or helper program, or other error. + # dmesg | tail -n 1 + [ 31.575952] cgroup: cgroup2: unknown option "" + +Fixes: 67e9c74b8a87 ("cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type") +[NOTE: should apply on top of commit 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option"), older versions need manual rebase] +Suggested-by: Stephen Smalley +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 1f84977fab47..498c6bcf992a 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -1744,7 +1744,7 @@ static int parse_cgroup_root_flags(char *data, unsigned int *root_flags) + + *root_flags = 0; + +- if (!data) ++ if (!data || *data == '\0') + return 0; + + while ((token = strsep(&data, ",")) != NULL) { +-- +2.19.1 + diff --git a/queue-4.20/cifs-check-ntwrk_buf_start-for-null-before-dereferen.patch b/queue-4.20/cifs-check-ntwrk_buf_start-for-null-before-dereferen.patch new file mode 100644 index 00000000000..dae039e1a1d --- /dev/null +++ b/queue-4.20/cifs-check-ntwrk_buf_start-for-null-before-dereferen.patch @@ -0,0 +1,48 @@ +From e68410998e2824a6ea54c94c9a8b6f81a2a31f2e Mon Sep 17 00:00:00 2001 +From: Ronnie Sahlberg +Date: Thu, 13 Dec 2018 08:06:16 +1000 +Subject: cifs: check ntwrk_buf_start for NULL before dereferencing it + +[ Upstream commit 59a63e479ce36a3f24444c3a36efe82b78e4a8e0 ] + +RHBZ: 1021460 + +There is an issue where when multiple threads open/close the same directory +ntwrk_buf_start might end up being NULL, causing the call to smbCalcSize +later to oops with a NULL deref. + +The real bug is why this happens and why this can become NULL for an +open cfile, which should not be allowed. +This patch tries to avoid a oops until the time when we fix the underlying +issue. + +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/readdir.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index e169e1a5fd35..3925a7bfc74d 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -655,7 +655,14 @@ find_cifs_entry(const unsigned int xid, struct cifs_tcon *tcon, loff_t pos, + /* scan and find it */ + int i; + char *cur_ent; +- char *end_of_smb = cfile->srch_inf.ntwrk_buf_start + ++ char *end_of_smb; ++ ++ if (cfile->srch_inf.ntwrk_buf_start == NULL) { ++ cifs_dbg(VFS, "ntwrk_buf_start is NULL during readdir\n"); ++ return -EIO; ++ } ++ ++ end_of_smb = cfile->srch_inf.ntwrk_buf_start + + server->ops->calc_smb_size( + cfile->srch_inf.ntwrk_buf_start, + server); +-- +2.19.1 + diff --git a/queue-4.20/clk-boston-fix-possible-memory-leak-in-clk_boston_se.patch b/queue-4.20/clk-boston-fix-possible-memory-leak-in-clk_boston_se.patch new file mode 100644 index 00000000000..02c38cd55de --- /dev/null +++ b/queue-4.20/clk-boston-fix-possible-memory-leak-in-clk_boston_se.patch @@ -0,0 +1,65 @@ +From f4ab773b317cf3a34f3995549f622d7a08cb2d51 Mon Sep 17 00:00:00 2001 +From: Yi Wang +Date: Wed, 31 Oct 2018 15:41:41 +0800 +Subject: clk: boston: fix possible memory leak in clk_boston_setup() + +[ Upstream commit 46fda5b5067a391912cf73bf3d32c26b6a22ad09 ] + +Smatch report warnings: +drivers/clk/imgtec/clk-boston.c:76 clk_boston_setup() warn: possible memory leak of 'onecell' +drivers/clk/imgtec/clk-boston.c:83 clk_boston_setup() warn: possible memory leak of 'onecell' +drivers/clk/imgtec/clk-boston.c:90 clk_boston_setup() warn: possible memory leak of 'onecell' + +'onecell' is malloced in clk_boston_setup(), but not be freed +before leaving from the error handling cases. + +Signed-off-by: Yi Wang +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imgtec/clk-boston.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/imgtec/clk-boston.c b/drivers/clk/imgtec/clk-boston.c +index 15af423cc0c9..f5d54a64d33c 100644 +--- a/drivers/clk/imgtec/clk-boston.c ++++ b/drivers/clk/imgtec/clk-boston.c +@@ -73,27 +73,32 @@ static void __init clk_boston_setup(struct device_node *np) + hw = clk_hw_register_fixed_rate(NULL, "input", NULL, 0, in_freq); + if (IS_ERR(hw)) { + pr_err("failed to register input clock: %ld\n", PTR_ERR(hw)); +- return; ++ goto error; + } + onecell->hws[BOSTON_CLK_INPUT] = hw; + + hw = clk_hw_register_fixed_rate(NULL, "sys", "input", 0, sys_freq); + if (IS_ERR(hw)) { + pr_err("failed to register sys clock: %ld\n", PTR_ERR(hw)); +- return; ++ goto error; + } + onecell->hws[BOSTON_CLK_SYS] = hw; + + hw = clk_hw_register_fixed_rate(NULL, "cpu", "input", 0, cpu_freq); + if (IS_ERR(hw)) { + pr_err("failed to register cpu clock: %ld\n", PTR_ERR(hw)); +- return; ++ goto error; + } + onecell->hws[BOSTON_CLK_CPU] = hw; + + err = of_clk_add_hw_provider(np, of_clk_hw_onecell_get, onecell); + if (err) + pr_err("failed to add DT provider: %d\n", err); ++ ++ return; ++ ++error: ++ kfree(onecell); + } + + /* +-- +2.19.1 + diff --git a/queue-4.20/clk-imx6sl-ensure-mmdc-ch0-handshake-is-bypassed.patch b/queue-4.20/clk-imx6sl-ensure-mmdc-ch0-handshake-is-bypassed.patch new file mode 100644 index 00000000000..e3da2e5ebd1 --- /dev/null +++ b/queue-4.20/clk-imx6sl-ensure-mmdc-ch0-handshake-is-bypassed.patch @@ -0,0 +1,46 @@ +From 33417bd308519e6814faab78b60192bec6531a52 Mon Sep 17 00:00:00 2001 +From: Anson Huang +Date: Fri, 30 Nov 2018 07:23:47 +0000 +Subject: clk: imx6sl: ensure MMDC CH0 handshake is bypassed + +[ Upstream commit 0efcc2c0fd2001a83240a8c3d71f67770484917e ] + +Same as other i.MX6 SoCs, ensure unused MMDC channel's +handshake is bypassed, this is to make sure no request +signal will be generated when periphe_clk_sel is changed +or SRC warm reset is triggered. + +Signed-off-by: Anson Huang +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6sl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/imx/clk-imx6sl.c b/drivers/clk/imx/clk-imx6sl.c +index 6fcfbbd907a5..e13d8814cfa4 100644 +--- a/drivers/clk/imx/clk-imx6sl.c ++++ b/drivers/clk/imx/clk-imx6sl.c +@@ -17,6 +17,8 @@ + + #include "clk.h" + ++#define CCDR 0x4 ++#define BM_CCM_CCDR_MMDC_CH0_MASK (1 << 17) + #define CCSR 0xc + #define BM_CCSR_PLL1_SW_CLK_SEL (1 << 2) + #define CACRR 0x10 +@@ -411,6 +413,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node) + clks[IMX6SL_CLK_USDHC3] = imx_clk_gate2("usdhc3", "usdhc3_podf", base + 0x80, 6); + clks[IMX6SL_CLK_USDHC4] = imx_clk_gate2("usdhc4", "usdhc4_podf", base + 0x80, 8); + ++ /* Ensure the MMDC CH0 handshake is bypassed */ ++ writel_relaxed(readl_relaxed(base + CCDR) | ++ BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR); ++ + imx_check_clocks(clks, ARRAY_SIZE(clks)); + + clk_data.clks = clks; +-- +2.19.1 + diff --git a/queue-4.20/clk-meson-meson8b-do-not-use-cpu_div3-for-cpu_scale_.patch b/queue-4.20/clk-meson-meson8b-do-not-use-cpu_div3-for-cpu_scale_.patch new file mode 100644 index 00000000000..1ed4c653f6b --- /dev/null +++ b/queue-4.20/clk-meson-meson8b-do-not-use-cpu_div3-for-cpu_scale_.patch @@ -0,0 +1,64 @@ +From 5756ecd3285586d705410ec0a89443a0ea3b0740 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Thu, 15 Nov 2018 23:40:44 +0100 +Subject: clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel + +[ Upstream commit a5ac1ead32c9aac285f6436e09b4f6111996e9b8 ] + +The cpu_div3 clock (cpu_in divided by 3) generates a signal with a duty +cycle of 33%. The CPU clock however requires a clock signal with a duty +cycle of 50% to run stable. +cpu_div3 was observed to be problematic when cycling through all +available CPU frequencies (with additional patches on top of this one) +while running "stress --cpu 4" in the background. This caused sporadic +hangs where the whole system would fully lock up. + +Amlogic's 3.10 kernel code also does not use the cpu_div3 clock either +when changing the CPU clock. + +Signed-off-by: Martin Blumenstingl +Reviewed-by: Jerome Brunet +Signed-off-by: Neil Armstrong +Link: https://lkml.kernel.org/r/20181115224048.13511-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/meson8b.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 1d39273d7a04..328fcf50d9e8 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -612,20 +612,27 @@ static struct clk_regmap meson8b_cpu_scale_div = { + }, + }; + ++static u32 mux_table_cpu_scale_out_sel[] = { 0, 1, 3 }; + static struct clk_regmap meson8b_cpu_scale_out_sel = { + .data = &(struct clk_regmap_mux_data){ + .offset = HHI_SYS_CPU_CLK_CNTL0, + .mask = 0x3, + .shift = 2, ++ .table = mux_table_cpu_scale_out_sel, + }, + .hw.init = &(struct clk_init_data){ + .name = "cpu_scale_out_sel", + .ops = &clk_regmap_mux_ro_ops, ++ /* ++ * NOTE: We are skipping the parent with value 0x2 (which is ++ * "cpu_div3") because it results in a duty cycle of 33% which ++ * makes the system unstable and can result in a lockup of the ++ * whole system. ++ */ + .parent_names = (const char *[]) { "cpu_in_sel", + "cpu_div2", +- "cpu_div3", + "cpu_scale_div" }, +- .num_parents = 4, ++ .num_parents = 3, + .flags = CLK_SET_RATE_PARENT, + }, + }; +-- +2.19.1 + diff --git a/queue-4.20/clk-meson-meson8b-fix-the-width-of-the-cpu_scale_div.patch b/queue-4.20/clk-meson-meson8b-fix-the-width-of-the-cpu_scale_div.patch new file mode 100644 index 00000000000..12fa9e4da5d --- /dev/null +++ b/queue-4.20/clk-meson-meson8b-fix-the-width-of-the-cpu_scale_div.patch @@ -0,0 +1,48 @@ +From e56846e256f250b328d29961d3ab7d92109c47df Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Thu, 27 Sep 2018 10:59:21 +0200 +Subject: clk: meson: meson8b: fix the width of the cpu_scale_div clock + +[ Upstream commit a8662eadd1032018f31e37deda811790b2326662 ] + +According to the public S805 datasheet HHI_SYS_CPU_CLK_CNTL1[29:20] is +the register for the CPU scale_div clock. This matches the code in +Amlogic's 3.10 GPL kernel sources: +N = (aml_read_reg32(P_HHI_SYS_CPU_CLK_CNTL1) >> 20) & 0x3FF; + +This means that the divider register is 10 bit wide instead of 9 bits. +So far this is not a problem since all u-boot versions I have seen are +not using the cpu_scale_div clock at all (instead they are configuring +the CPU clock to run off cpu_in_sel directly). + +The fixes tag points to the latest rework of the CPU clocks. However, +even before the rework it was wrong. Commit 7a29a869434e8b ("clk: meson: +Add support for Meson clock controller") defines MESON_N_WIDTH as 9 (in +drivers/clk/meson/clk-cpu.c). But since the old clk-cpu implementation +this only carries the fixes tag for the CPU clock rewordk. + +Fixes: 251b6fd38bcb9c ("clk: meson: rework meson8b cpu clock") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Neil Armstrong +Link: https://lkml.kernel.org/r/20180927085921.24627-3-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/meson8b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 328fcf50d9e8..9160a3b2e668 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -599,7 +599,7 @@ static struct clk_regmap meson8b_cpu_scale_div = { + .data = &(struct clk_regmap_div_data){ + .offset = HHI_SYS_CPU_CLK_CNTL1, + .shift = 20, +- .width = 9, ++ .width = 10, + .table = cpu_scale_table, + .flags = CLK_DIVIDER_ALLOW_ZERO, + }, +-- +2.19.1 + diff --git a/queue-4.20/clk-meson-meson8b-mark-the-cpu-clock-as-clk_is_criti.patch b/queue-4.20/clk-meson-meson8b-mark-the-cpu-clock-as-clk_is_criti.patch new file mode 100644 index 00000000000..5f8eef33cbf --- /dev/null +++ b/queue-4.20/clk-meson-meson8b-mark-the-cpu-clock-as-clk_is_criti.patch @@ -0,0 +1,51 @@ +From a554abfa70079294d39fbd2b3e9cfcade07d0781 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Thu, 15 Nov 2018 23:40:45 +0100 +Subject: clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL + +[ Upstream commit 0dad1ec65bc30a549aba38d34a727309bbf41bc8 ] + +We don't want the common clock framework to disable the "cpu_clk" if +it's not used by any device. The cpufreq-dt driver does not enable the +CPU clocks. However, even if it would we would still want the CPU clock +to be enabled at all times because the CPU clock is also required even +if we disable CPU frequency scaling on a specific board. + +The reason why we want the CPU clock to be enabled is a clock further up +in the tree: +Since commit 6f888e7bc7bd58 ("clk: meson: clk-pll: add enable bit") the +sys_pll can be disabled. However, since the CPU clock is derived from +sys_pll we don't want sys_pll to get disabled. The common clock +framework takes care of that for us by enabling all parent clocks of our +CPU clock when we mark the CPU clock with CLK_IS_CRITICAL. + +Until now this is not a problem yet because all clocks in the CPU +clock's tree (including sys_pll) are read-only. However, once we allow +modifications to the clocks in that tree we will need this. + +Signed-off-by: Martin Blumenstingl +Acked-by: Jerome Brunet +Signed-off-by: Neil Armstrong +Link: https://lkml.kernel.org/r/20181115224048.13511-4-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/meson8b.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/meson8b.c b/drivers/clk/meson/meson8b.c +index 9160a3b2e668..a3a826419c16 100644 +--- a/drivers/clk/meson/meson8b.c ++++ b/drivers/clk/meson/meson8b.c +@@ -650,7 +650,8 @@ static struct clk_regmap meson8b_cpu_clk = { + "cpu_scale_out_sel" }, + .num_parents = 2, + .flags = (CLK_SET_RATE_PARENT | +- CLK_SET_RATE_NO_REPARENT), ++ CLK_SET_RATE_NO_REPARENT | ++ CLK_IS_CRITICAL), + }, + }; + +-- +2.19.1 + diff --git a/queue-4.20/clk-qcom-leave-mmss-noc-on-for-8998.patch b/queue-4.20/clk-qcom-leave-mmss-noc-on-for-8998.patch new file mode 100644 index 00000000000..03724aab3b1 --- /dev/null +++ b/queue-4.20/clk-qcom-leave-mmss-noc-on-for-8998.patch @@ -0,0 +1,41 @@ +From ea9428c5aef70b8c4076038f46fefe7d3dd83c4f Mon Sep 17 00:00:00 2001 +From: Jeffrey Hugo +Date: Thu, 13 Dec 2018 15:43:40 -0700 +Subject: clk: qcom: Leave mmss noc on for 8998 + +[ Upstream commit 12eced09cd301aa7b1868a67c50a651c2aacd363 ] + +Similar to other qcom targets, gcc_mmss_noc_cfg_ahb_clk should not be +disabled. Any mmss access depends on this clock, and its been observed +that enabling mmssnoc_axi_rpm_clk with rpmcc results in an implicit +access to mmss and will crash the system if gcc_mmss_noc_cfg_ahb_clk is +disabled. + +Signed-off-by: Jeffrey Hugo +Fixes: 4807c71cc688 (arm64: dts: Add msm8998 SoC and MTP board support) +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8998.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-msm8998.c b/drivers/clk/qcom/gcc-msm8998.c +index 9f0ae403d5f5..cb714c3e2924 100644 +--- a/drivers/clk/qcom/gcc-msm8998.c ++++ b/drivers/clk/qcom/gcc-msm8998.c +@@ -2042,6 +2042,12 @@ static struct clk_branch gcc_mmss_noc_cfg_ahb_clk = { + .hw.init = &(struct clk_init_data){ + .name = "gcc_mmss_noc_cfg_ahb_clk", + .ops = &clk_branch2_ops, ++ /* ++ * Any access to mmss depends on this clock. ++ * Gating this clock has been shown to crash the system ++ * when mmssnoc_axi_rpm_clk is inited in rpmcc. ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }, + }; +-- +2.19.1 + diff --git a/queue-4.20/clk-sunxi-ng-a33-set-clk_set_rate_parent-for-all-aud.patch b/queue-4.20/clk-sunxi-ng-a33-set-clk_set_rate_parent-for-all-aud.patch new file mode 100644 index 00000000000..331d87c1570 --- /dev/null +++ b/queue-4.20/clk-sunxi-ng-a33-set-clk_set_rate_parent-for-all-aud.patch @@ -0,0 +1,54 @@ +From 1a7e74956f32c2377da4867a01414ed233a59076 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Wed, 5 Dec 2018 18:11:51 +0800 +Subject: clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module + clocks + +[ Upstream commit 6e6da2039c82271dd873b9ad2b902a692a7dd554 ] + +All the audio interfaces on Allwinner SoCs need to change their module +clocks during operation, to switch between support for 44.1 kHz and 48 +kHz family sample rates. The clock rate for the module clocks is +governed by their upstream audio PLL. The module clocks themselves only +have a gate, and sometimes a divider or mux. Thus any rate changes need +to be propagated upstream. + +Set the CLK_SET_RATE_PARENT flag for all audio module clocks to achieve +this. + +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c +index 13eb5b23c5e7..c40d572a7602 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a33.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a33.c +@@ -366,10 +366,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4, + static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x", + "pll-audio-2x", "pll-audio" }; + static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents, +- 0x0b0, 16, 2, BIT(31), 0); ++ 0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents, +- 0x0b4, 16, 2, BIT(31), 0); ++ 0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT); + + /* TODO: the parent for most of the USB clocks is not known */ + static SUNXI_CCU_GATE(usb_phy0_clk, "usb-phy0", "osc24M", +@@ -446,7 +446,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve", + static SUNXI_CCU_GATE(ac_dig_clk, "ac-dig", "pll-audio", + 0x140, BIT(31), CLK_SET_RATE_PARENT); + static SUNXI_CCU_GATE(ac_dig_4x_clk, "ac-dig-4x", "pll-audio-4x", +- 0x140, BIT(30), 0); ++ 0x140, BIT(30), CLK_SET_RATE_PARENT); + static SUNXI_CCU_GATE(avs_clk, "avs", "osc24M", + 0x144, BIT(31), 0); + +-- +2.19.1 + diff --git a/queue-4.20/clk-sunxi-ng-h6-set-video-plls-limits.patch b/queue-4.20/clk-sunxi-ng-h6-set-video-plls-limits.patch new file mode 100644 index 00000000000..c0a65fd7419 --- /dev/null +++ b/queue-4.20/clk-sunxi-ng-h6-set-video-plls-limits.patch @@ -0,0 +1,47 @@ +From 898ac4d32e9d2f11d87ad11680cde446319c4a5b Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Sun, 4 Nov 2018 19:26:41 +0100 +Subject: clk: sunxi-ng: h6: Set video PLLs limits + +[ Upstream commit ed4433419d45bf8b58aef34c4450a27e1c8699e8 ] + +Video PLL factors can be set in a way that final PLL rate is outside +stable range. H6 user manual specifically says that N factor should not +be below 12. While it doesn't says anything about maximum stable rate, it +is clear that PLL doesn't work at 6.096 GHz (254 * 24 MHz). + +Set minimum allowed PLL video rate to 288 MHz (12 * 24 MHz) and maximum +to 2.4 GHz, which is maximum in BSP driver. + +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +index 2193e1495086..19ff09f610e4 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-h6.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-h6.c +@@ -120,6 +120,8 @@ static struct ccu_nm pll_video0_clk = { + .n = _SUNXI_CCU_MULT_MIN(8, 8, 12), + .m = _SUNXI_CCU_DIV(1, 1), /* input divider */ + .fixed_post_div = 4, ++ .min_rate = 288000000, ++ .max_rate = 2400000000UL, + .common = { + .reg = 0x040, + .features = CCU_FEATURE_FIXED_POSTDIV, +@@ -136,6 +138,8 @@ static struct ccu_nm pll_video1_clk = { + .n = _SUNXI_CCU_MULT_MIN(8, 8, 12), + .m = _SUNXI_CCU_DIV(1, 1), /* input divider */ + .fixed_post_div = 4, ++ .min_rate = 288000000, ++ .max_rate = 2400000000UL, + .common = { + .reg = 0x048, + .features = CCU_FEATURE_FIXED_POSTDIV, +-- +2.19.1 + diff --git a/queue-4.20/cpuidle-big.little-fix-refcount-leak.patch b/queue-4.20/cpuidle-big.little-fix-refcount-leak.patch new file mode 100644 index 00000000000..a7f4813a4b4 --- /dev/null +++ b/queue-4.20/cpuidle-big.little-fix-refcount-leak.patch @@ -0,0 +1,47 @@ +From f86f04d7862c463eeb48377fd091b16673ceaeaf Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Mon, 10 Dec 2018 11:26:41 -0500 +Subject: cpuidle: big.LITTLE: fix refcount leak + +[ Upstream commit 9456823c842f346c74265fcd98d008d87a7eb6f5 ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +bl_idle_init() doesn't do that, so fix it. + +Signed-off-by: Yangtao Li +Acked-by: Daniel Lezcano +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpuidle/cpuidle-big_little.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpuidle/cpuidle-big_little.c b/drivers/cpuidle/cpuidle-big_little.c +index db2ede565f1a..b44476a1b7ad 100644 +--- a/drivers/cpuidle/cpuidle-big_little.c ++++ b/drivers/cpuidle/cpuidle-big_little.c +@@ -167,6 +167,7 @@ static int __init bl_idle_init(void) + { + int ret; + struct device_node *root = of_find_node_by_path("/"); ++ const struct of_device_id *match_id; + + if (!root) + return -ENODEV; +@@ -174,7 +175,11 @@ static int __init bl_idle_init(void) + /* + * Initialize the driver just for a compliant set of machines + */ +- if (!of_match_node(compatible_machine_match, root)) ++ match_id = of_match_node(compatible_machine_match, root); ++ ++ of_node_put(root); ++ ++ if (!match_id) + return -ENODEV; + + if (!mcpm_is_available()) +-- +2.19.1 + diff --git a/queue-4.20/crypto-aes_ti-disable-interrupts-while-accessing-s-b.patch b/queue-4.20/crypto-aes_ti-disable-interrupts-while-accessing-s-b.patch new file mode 100644 index 00000000000..52f62a86145 --- /dev/null +++ b/queue-4.20/crypto-aes_ti-disable-interrupts-while-accessing-s-b.patch @@ -0,0 +1,113 @@ +From 7bce1d7b18f1910764ea4ec6803d7476690a050e Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Wed, 17 Oct 2018 21:37:58 -0700 +Subject: crypto: aes_ti - disable interrupts while accessing S-box + +[ Upstream commit 0a6a40c2a8c184a2fb467efacfb1cd338d719e0b ] + +In the "aes-fixed-time" AES implementation, disable interrupts while +accessing the S-box, in order to make cache-timing attacks more +difficult. Previously it was possible for the CPU to be interrupted +while the S-box was loaded into L1 cache, potentially evicting the +cachelines and causing later table lookups to be time-variant. + +In tests I did on x86 and ARM, this doesn't affect performance +significantly. Responsiveness is potentially a concern, but interrupts +are only disabled for a single AES block. + +Note that even after this change, the implementation still isn't +necessarily guaranteed to be constant-time; see +https://cr.yp.to/antiforgery/cachetiming-20050414.pdf for a discussion +of the many difficulties involved in writing truly constant-time AES +software. But it's valuable to make such attacks more difficult. + +Reviewed-by: Ard Biesheuvel +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/Kconfig | 3 ++- + crypto/aes_ti.c | 18 ++++++++++++++++++ + 2 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/crypto/Kconfig b/crypto/Kconfig +index 05c91eb10ca1..4f24acac3d48 100644 +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -1006,7 +1006,8 @@ config CRYPTO_AES_TI + 8 for decryption), this implementation only uses just two S-boxes of + 256 bytes each, and attempts to eliminate data dependent latencies by + prefetching the entire table into the cache at the start of each +- block. ++ block. Interrupts are also disabled to avoid races where cachelines ++ are evicted when the CPU is interrupted to do something else. + + config CRYPTO_AES_586 + tristate "AES cipher algorithms (i586)" +diff --git a/crypto/aes_ti.c b/crypto/aes_ti.c +index 03023b2290e8..1ff9785b30f5 100644 +--- a/crypto/aes_ti.c ++++ b/crypto/aes_ti.c +@@ -269,6 +269,7 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + const u32 *rkp = ctx->key_enc + 4; + int rounds = 6 + ctx->key_length / 4; + u32 st0[4], st1[4]; ++ unsigned long flags; + int round; + + st0[0] = ctx->key_enc[0] ^ get_unaligned_le32(in); +@@ -276,6 +277,12 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + st0[2] = ctx->key_enc[2] ^ get_unaligned_le32(in + 8); + st0[3] = ctx->key_enc[3] ^ get_unaligned_le32(in + 12); + ++ /* ++ * Temporarily disable interrupts to avoid races where cachelines are ++ * evicted when the CPU is interrupted to do something else. ++ */ ++ local_irq_save(flags); ++ + st0[0] ^= __aesti_sbox[ 0] ^ __aesti_sbox[128]; + st0[1] ^= __aesti_sbox[32] ^ __aesti_sbox[160]; + st0[2] ^= __aesti_sbox[64] ^ __aesti_sbox[192]; +@@ -300,6 +307,8 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + put_unaligned_le32(subshift(st1, 1) ^ rkp[5], out + 4); + put_unaligned_le32(subshift(st1, 2) ^ rkp[6], out + 8); + put_unaligned_le32(subshift(st1, 3) ^ rkp[7], out + 12); ++ ++ local_irq_restore(flags); + } + + static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) +@@ -308,6 +317,7 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + const u32 *rkp = ctx->key_dec + 4; + int rounds = 6 + ctx->key_length / 4; + u32 st0[4], st1[4]; ++ unsigned long flags; + int round; + + st0[0] = ctx->key_dec[0] ^ get_unaligned_le32(in); +@@ -315,6 +325,12 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + st0[2] = ctx->key_dec[2] ^ get_unaligned_le32(in + 8); + st0[3] = ctx->key_dec[3] ^ get_unaligned_le32(in + 12); + ++ /* ++ * Temporarily disable interrupts to avoid races where cachelines are ++ * evicted when the CPU is interrupted to do something else. ++ */ ++ local_irq_save(flags); ++ + st0[0] ^= __aesti_inv_sbox[ 0] ^ __aesti_inv_sbox[128]; + st0[1] ^= __aesti_inv_sbox[32] ^ __aesti_inv_sbox[160]; + st0[2] ^= __aesti_inv_sbox[64] ^ __aesti_inv_sbox[192]; +@@ -339,6 +355,8 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in) + put_unaligned_le32(inv_subshift(st1, 1) ^ rkp[5], out + 4); + put_unaligned_le32(inv_subshift(st1, 2) ^ rkp[6], out + 8); + put_unaligned_le32(inv_subshift(st1, 3) ^ rkp[7], out + 12); ++ ++ local_irq_restore(flags); + } + + static struct crypto_alg aes_alg = { +-- +2.19.1 + diff --git a/queue-4.20/crypto-ux500-use-proper-enum-in-cryp_set_dma_transfe.patch b/queue-4.20/crypto-ux500-use-proper-enum-in-cryp_set_dma_transfe.patch new file mode 100644 index 00000000000..48fa88c8105 --- /dev/null +++ b/queue-4.20/crypto-ux500-use-proper-enum-in-cryp_set_dma_transfe.patch @@ -0,0 +1,62 @@ +From 60bae48ffad3a6c22387569c37ad8f5041f48719 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 10 Dec 2018 16:49:29 -0700 +Subject: crypto: ux500 - Use proper enum in cryp_set_dma_transfer + +[ Upstream commit 9d880c5945c748d8edcac30965f3349a602158c4 ] + +Clang warns when one enumerated type is implicitly converted to another: + +drivers/crypto/ux500/cryp/cryp_core.c:559:5: warning: implicit +conversion from enumeration type 'enum dma_data_direction' to different +enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] + direction, DMA_CTRL_ACK); + ^~~~~~~~~ +drivers/crypto/ux500/cryp/cryp_core.c:583:5: warning: implicit +conversion from enumeration type 'enum dma_data_direction' to different +enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] + direction, + ^~~~~~~~~ +2 warnings generated. + +dmaengine_prep_slave_sg expects an enum from dma_transfer_direction. +Because we know the value of the dma_data_direction enum from the +switch statement, we can just use the proper value from +dma_transfer_direction so there is no more conversion. + +DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1 +DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2 + +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ux500/cryp/cryp_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c +index d2663a4e1f5e..a92a66b1ff46 100644 +--- a/drivers/crypto/ux500/cryp/cryp_core.c ++++ b/drivers/crypto/ux500/cryp/cryp_core.c +@@ -556,7 +556,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx, + desc = dmaengine_prep_slave_sg(channel, + ctx->device->dma.sg_src, + ctx->device->dma.sg_src_len, +- direction, DMA_CTRL_ACK); ++ DMA_MEM_TO_DEV, DMA_CTRL_ACK); + break; + + case DMA_FROM_DEVICE: +@@ -580,7 +580,7 @@ static int cryp_set_dma_transfer(struct cryp_ctx *ctx, + desc = dmaengine_prep_slave_sg(channel, + ctx->device->dma.sg_dst, + ctx->device->dma.sg_dst_len, +- direction, ++ DMA_DEV_TO_MEM, + DMA_CTRL_ACK | + DMA_PREP_INTERRUPT); + +-- +2.19.1 + diff --git a/queue-4.20/crypto-ux500-use-proper-enum-in-hash_set_dma_transfe.patch b/queue-4.20/crypto-ux500-use-proper-enum-in-hash_set_dma_transfe.patch new file mode 100644 index 00000000000..56c7aeff4b1 --- /dev/null +++ b/queue-4.20/crypto-ux500-use-proper-enum-in-hash_set_dma_transfe.patch @@ -0,0 +1,47 @@ +From 4dba2be5a9576eba13faa50f3dabc3306397fead Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Mon, 10 Dec 2018 16:49:54 -0700 +Subject: crypto: ux500 - Use proper enum in hash_set_dma_transfer + +[ Upstream commit 5ac93f808338f4dd465402e91869702eb87db241 ] + +Clang warns when one enumerated type is implicitly converted to another: + +drivers/crypto/ux500/hash/hash_core.c:169:4: warning: implicit +conversion from enumeration type 'enum dma_data_direction' to different +enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] + direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); + ^~~~~~~~~ +1 warning generated. + +dmaengine_prep_slave_sg expects an enum from dma_transfer_direction. +We know that the only direction supported by this function is +DMA_TO_DEVICE because of the check at the top of this function so we can +just use the equivalent value from dma_transfer_direction. + +DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1 + +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ux500/hash/hash_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c +index 633321a8dd03..a0bb8a6eec3f 100644 +--- a/drivers/crypto/ux500/hash/hash_core.c ++++ b/drivers/crypto/ux500/hash/hash_core.c +@@ -166,7 +166,7 @@ static int hash_set_dma_transfer(struct hash_ctx *ctx, struct scatterlist *sg, + __func__); + desc = dmaengine_prep_slave_sg(channel, + ctx->device->dma.sg, ctx->device->dma.sg_len, +- direction, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); ++ DMA_MEM_TO_DEV, DMA_CTRL_ACK | DMA_PREP_INTERRUPT); + if (!desc) { + dev_err(ctx->device->dev, + "%s: dmaengine_prep_slave_sg() failed!\n", __func__); +-- +2.19.1 + diff --git a/queue-4.20/cw1200-fix-concurrency-use-after-free-bugs-in-cw1200.patch b/queue-4.20/cw1200-fix-concurrency-use-after-free-bugs-in-cw1200.patch new file mode 100644 index 00000000000..f761127a2ed --- /dev/null +++ b/queue-4.20/cw1200-fix-concurrency-use-after-free-bugs-in-cw1200.patch @@ -0,0 +1,81 @@ +From 30d0538f4d8d90b2be5276f33eec5963ae5e5387 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Fri, 14 Dec 2018 11:55:21 +0800 +Subject: cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan() + +[ Upstream commit 4f68ef64cd7feb1220232bd8f501d8aad340a099 ] + +The function cw1200_bss_info_changed() and cw1200_hw_scan() can be +concurrently executed. +The two functions both access a possible shared variable "frame.skb". + +This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(), +which is called by cw1200_bss_info_changed(). The free operation is +protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed(). + +In cw1200_hw_scan(), this shared variable is accessed without the +protection of the mutex lock "priv->conf_mutex". +Thus, concurrency use-after-free bugs may occur. + +To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and +mutex_unlock(&priv->conf_mutex) are moved to the places, which can +protect the accesses to the shared variable. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/st/cw1200/scan.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c +index 67213f11acbd..0a9eac93dd01 100644 +--- a/drivers/net/wireless/st/cw1200/scan.c ++++ b/drivers/net/wireless/st/cw1200/scan.c +@@ -78,6 +78,10 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, + if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS) + return -EINVAL; + ++ /* will be unlocked in cw1200_scan_work() */ ++ down(&priv->scan.lock); ++ mutex_lock(&priv->conf_mutex); ++ + frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0, + req->ie_len); + if (!frame.skb) +@@ -86,19 +90,15 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, + if (req->ie_len) + skb_put_data(frame.skb, req->ie, req->ie_len); + +- /* will be unlocked in cw1200_scan_work() */ +- down(&priv->scan.lock); +- mutex_lock(&priv->conf_mutex); +- + ret = wsm_set_template_frame(priv, &frame); + if (!ret) { + /* Host want to be the probe responder. */ + ret = wsm_set_probe_responder(priv, true); + } + if (ret) { ++ dev_kfree_skb(frame.skb); + mutex_unlock(&priv->conf_mutex); + up(&priv->scan.lock); +- dev_kfree_skb(frame.skb); + return ret; + } + +@@ -120,10 +120,9 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, + ++priv->scan.n_ssids; + } + +- mutex_unlock(&priv->conf_mutex); +- + if (frame.skb) + dev_kfree_skb(frame.skb); ++ mutex_unlock(&priv->conf_mutex); + queue_work(priv->workqueue, &priv->scan.work); + return 0; + } +-- +2.19.1 + diff --git a/queue-4.20/dlm-don-t-swamp-the-cpu-with-callbacks-queued-during.patch b/queue-4.20/dlm-don-t-swamp-the-cpu-with-callbacks-queued-during.patch new file mode 100644 index 00000000000..510775fcaa5 --- /dev/null +++ b/queue-4.20/dlm-don-t-swamp-the-cpu-with-callbacks-queued-during.patch @@ -0,0 +1,60 @@ +From adbab62bccaa17d7e3b328fa778e810349921f7a Mon Sep 17 00:00:00 2001 +From: Bob Peterson +Date: Thu, 8 Nov 2018 14:04:50 -0500 +Subject: dlm: Don't swamp the CPU with callbacks queued during recovery + +[ Upstream commit 216f0efd19b9cc32207934fd1b87a45f2c4c593e ] + +Before this patch, recovery would cause all callbacks to be delayed, +put on a queue, and afterward they were all queued to the callback +work queue. This patch does the same thing, but occasionally takes +a break after 25 of them so it won't swamp the CPU at the expense +of other RT processes like corosync. + +Signed-off-by: Bob Peterson +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/ast.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/dlm/ast.c b/fs/dlm/ast.c +index 562fa8c3edff..47ee66d70109 100644 +--- a/fs/dlm/ast.c ++++ b/fs/dlm/ast.c +@@ -292,6 +292,8 @@ void dlm_callback_suspend(struct dlm_ls *ls) + flush_workqueue(ls->ls_callback_wq); + } + ++#define MAX_CB_QUEUE 25 ++ + void dlm_callback_resume(struct dlm_ls *ls) + { + struct dlm_lkb *lkb, *safe; +@@ -302,15 +304,23 @@ void dlm_callback_resume(struct dlm_ls *ls) + if (!ls->ls_callback_wq) + return; + ++more: + mutex_lock(&ls->ls_cb_mutex); + list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) { + list_del_init(&lkb->lkb_cb_list); + queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work); + count++; ++ if (count == MAX_CB_QUEUE) ++ break; + } + mutex_unlock(&ls->ls_cb_mutex); + + if (count) + log_rinfo(ls, "dlm_callback_resume %d", count); ++ if (count == MAX_CB_QUEUE) { ++ count = 0; ++ cond_resched(); ++ goto more; ++ } + } + +-- +2.19.1 + diff --git a/queue-4.20/dmaengine-sprd-support-dma-link-list-cyclic-callback.patch b/queue-4.20/dmaengine-sprd-support-dma-link-list-cyclic-callback.patch new file mode 100644 index 00000000000..ade23060048 --- /dev/null +++ b/queue-4.20/dmaengine-sprd-support-dma-link-list-cyclic-callback.patch @@ -0,0 +1,73 @@ +From e9c8712d057ef7ff1fbb15488e2ed03fa9b8e844 Mon Sep 17 00:00:00 2001 +From: Eric Long +Date: Tue, 6 Nov 2018 13:01:35 +0800 +Subject: dmaengine: sprd: Support DMA link-list cyclic callback + +[ Upstream commit 97dbd6ea02beb3a7027c158e0a110b5095268d59 ] + +The Spreadtrum DMA link-list mode is always one cyclic transfer, +so we should clear the SPRD_DMA_LLIST_END flag for the link-list +configuration. Moreover add cyclic callback support for the cyclic +transfer. + +Signed-off-by: Eric Long +Signed-off-by: Baolin Wang +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sprd-dma.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c +index 38d4e4f07c66..f7da9ab31b7c 100644 +--- a/drivers/dma/sprd-dma.c ++++ b/drivers/dma/sprd-dma.c +@@ -450,7 +450,7 @@ static irqreturn_t dma_irq_handle(int irq, void *dev_id) + struct sprd_dma_desc *sdesc; + enum sprd_dma_req_mode req_type; + enum sprd_dma_int_type int_type; +- bool trans_done = false; ++ bool trans_done = false, cyclic = false; + u32 i; + + while (irq_status) { +@@ -465,13 +465,19 @@ static irqreturn_t dma_irq_handle(int irq, void *dev_id) + + sdesc = schan->cur_desc; + +- /* Check if the dma request descriptor is done. */ +- trans_done = sprd_dma_check_trans_done(sdesc, int_type, +- req_type); +- if (trans_done == true) { +- vchan_cookie_complete(&sdesc->vd); +- schan->cur_desc = NULL; +- sprd_dma_start(schan); ++ /* cyclic mode schedule callback */ ++ cyclic = schan->linklist.phy_addr ? true : false; ++ if (cyclic == true) { ++ vchan_cyclic_callback(&sdesc->vd); ++ } else { ++ /* Check if the dma request descriptor is done. */ ++ trans_done = sprd_dma_check_trans_done(sdesc, int_type, ++ req_type); ++ if (trans_done == true) { ++ vchan_cookie_complete(&sdesc->vd); ++ schan->cur_desc = NULL; ++ sprd_dma_start(schan); ++ } + } + spin_unlock(&schan->vc.lock); + } +@@ -674,9 +680,6 @@ static int sprd_dma_fill_desc(struct dma_chan *chan, + + /* link-list configuration */ + if (schan->linklist.phy_addr) { +- if (sg_index == sglen - 1) +- hw->frg_len |= SPRD_DMA_LLIST_END; +- + hw->cfg |= SPRD_DMA_LINKLIST_EN; + + /* link-list index */ +-- +2.19.1 + diff --git a/queue-4.20/dmaengine-xilinx_dma-remove-__aligned-attribute-on-z.patch b/queue-4.20/dmaengine-xilinx_dma-remove-__aligned-attribute-on-z.patch new file mode 100644 index 00000000000..06be806eae7 --- /dev/null +++ b/queue-4.20/dmaengine-xilinx_dma-remove-__aligned-attribute-on-z.patch @@ -0,0 +1,51 @@ +From 98a19550505ff38be45dceca089f81ec1b551271 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 25 Oct 2018 11:05:25 -0700 +Subject: dmaengine: xilinx_dma: Remove __aligned attribute on + zynqmp_dma_desc_ll + +[ Upstream commit aeaebcc17cdf37065d2693865eeb1ff1c7dc5bf3 ] + +Clang warns: + +drivers/dma/xilinx/zynqmp_dma.c:166:4: warning: attribute 'aligned' is +ignored, place it after "struct" to apply attribute to type declaration +[-Wignored-attributes] +}; __aligned(64) + ^ +./include/linux/compiler_types.h:200:38: note: expanded from macro +'__aligned' + ^ +1 warning generated. + +As Nick pointed out in the previous version of this patch, the author +likely intended for this struct to be 8-byte (64-bit) aligned, not +64-byte, which is the default. Remove the hanging __aligned attribute. + +Fixes: b0cc417c1637 ("dmaengine: Add Xilinx zynqmp dma engine driver support") +Reported-by: Nick Desaulniers +Suggested-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/zynqmp_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c +index c74a88b65039..73de6a6179fc 100644 +--- a/drivers/dma/xilinx/zynqmp_dma.c ++++ b/drivers/dma/xilinx/zynqmp_dma.c +@@ -163,7 +163,7 @@ struct zynqmp_dma_desc_ll { + u32 ctrl; + u64 nxtdscraddr; + u64 rsvd; +-}; __aligned(64) ++}; + + /** + * struct zynqmp_dma_desc_sw - Per Transaction structure +-- +2.19.1 + diff --git a/queue-4.20/dpaa2-ptp-defer-probe-when-portal-allocation-failed.patch b/queue-4.20/dpaa2-ptp-defer-probe-when-portal-allocation-failed.patch new file mode 100644 index 00000000000..510791a8f1c --- /dev/null +++ b/queue-4.20/dpaa2-ptp-defer-probe-when-portal-allocation-failed.patch @@ -0,0 +1,37 @@ +From a03f161bebeaa26a70ec5c4ec1e1f418d8cd925b Mon Sep 17 00:00:00 2001 +From: Ioana Ciornei +Date: Fri, 9 Nov 2018 15:26:46 +0000 +Subject: dpaa2-ptp: defer probe when portal allocation failed + +[ Upstream commit 5500598abbfb5b46201b9768bd9ea873a5eeaece ] + +The fsl_mc_portal_allocate can fail when the requested MC portals are +not yet probed by the fsl_mc_allocator. In this situation, the driver +should defer the probe. + +Signed-off-by: Ioana Ciornei +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +index 84b942b1eccc..9b150db3b510 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +@@ -140,7 +140,10 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev) + + err = fsl_mc_portal_allocate(mc_dev, 0, &mc_dev->mc_io); + if (err) { +- dev_err(dev, "fsl_mc_portal_allocate err %d\n", err); ++ if (err == -ENXIO) ++ err = -EPROBE_DEFER; ++ else ++ dev_err(dev, "fsl_mc_portal_allocate err %d\n", err); + goto err_exit; + } + +-- +2.19.1 + diff --git a/queue-4.20/drbd-avoid-clang-warning-about-pointless-switch-stat.patch b/queue-4.20/drbd-avoid-clang-warning-about-pointless-switch-stat.patch new file mode 100644 index 00000000000..77bfac580a1 --- /dev/null +++ b/queue-4.20/drbd-avoid-clang-warning-about-pointless-switch-stat.patch @@ -0,0 +1,72 @@ +From 350fe84c5ee3f6198ac01cbe07b146a8243ed368 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Thu, 20 Dec 2018 17:23:43 +0100 +Subject: drbd: Avoid Clang warning about pointless switch statment + +[ Upstream commit a52c5a16cf19d8a85831bb1b915a221dd4ffae3c ] + +There are several warnings from Clang about no case statement matching +the constant 0: + +In file included from drivers/block/drbd/drbd_receiver.c:48: +In file included from drivers/block/drbd/drbd_int.h:48: +In file included from ./include/linux/drbd_genl_api.h:54: +In file included from ./include/linux/genl_magic_struct.h:236: +./include/linux/drbd_genl.h:321:1: warning: no case matching constant +switch condition '0' +GENL_struct(DRBD_NLA_HELPER, 24, drbd_helper_info, +^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +./include/linux/genl_magic_struct.h:220:10: note: expanded from macro +'GENL_struct' + switch (0) { + ^ + +Silence this warning by adding a 'case 0:' statement. Additionally, +adjust the alignment of the statements in the ct_assert_unique macro to +avoid a checkpatch warning. + +This solution was originally sent by Arnd Bergmann with a default case +statement: https://lore.kernel.org/patchwork/patch/756723/ + +Link: https://github.com/ClangBuiltLinux/linux/issues/43 +Suggested-by: Lars Ellenberg +Signed-off-by: Nathan Chancellor +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/genl_magic_struct.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/linux/genl_magic_struct.h b/include/linux/genl_magic_struct.h +index 5972e4969197..eeae59d3ceb7 100644 +--- a/include/linux/genl_magic_struct.h ++++ b/include/linux/genl_magic_struct.h +@@ -191,6 +191,7 @@ static inline void ct_assert_unique_operations(void) + { + switch (0) { + #include GENL_MAGIC_INCLUDE_FILE ++ case 0: + ; + } + } +@@ -209,6 +210,7 @@ static inline void ct_assert_unique_top_level_attributes(void) + { + switch (0) { + #include GENL_MAGIC_INCLUDE_FILE ++ case 0: + ; + } + } +@@ -218,7 +220,8 @@ static inline void ct_assert_unique_top_level_attributes(void) + static inline void ct_assert_unique_ ## s_name ## _attributes(void) \ + { \ + switch (0) { \ +- s_fields \ ++ s_fields \ ++ case 0: \ + ; \ + } \ + } +-- +2.19.1 + diff --git a/queue-4.20/drbd-disconnect-if-the-wrong-uuids-are-attached-on-a.patch b/queue-4.20/drbd-disconnect-if-the-wrong-uuids-are-attached-on-a.patch new file mode 100644 index 00000000000..59d02c8fb05 --- /dev/null +++ b/queue-4.20/drbd-disconnect-if-the-wrong-uuids-are-attached-on-a.patch @@ -0,0 +1,46 @@ +From aad736b6c0cac3e3310e5c8cac8c785d7893a085 Mon Sep 17 00:00:00 2001 +From: Lars Ellenberg +Date: Thu, 20 Dec 2018 17:23:32 +0100 +Subject: drbd: disconnect, if the wrong UUIDs are attached on a connected peer + +[ Upstream commit b17b59602b6dcf8f97a7dc7bc489a48388d7063a ] + +With "on-no-data-accessible suspend-io", DRBD requires the next attach +or connect to be to the very same data generation uuid tag it lost last. + +If we first lost connection to the peer, +then later lost connection to our own disk, +we would usually refuse to re-connect to the peer, +because it presents the wrong data set. + +However, if the peer first connects without a disk, +and then attached its disk, we accepted that same wrong data set, +which would be "unexpected" by any user of that DRBD +and cause "undefined results" (read: very likely data corruption). + +The fix is to forcefully disconnect as soon as we notice that the peer +attached to the "wrong" dataset. + +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_receiver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 1b9822f264d2..e3da52b524d3 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -4143,7 +4143,7 @@ static int receive_uuids(struct drbd_connection *connection, struct packet_info + kfree(device->p_uuid); + device->p_uuid = p_uuid; + +- if (device->state.conn < C_CONNECTED && ++ if ((device->state.conn < C_CONNECTED || device->state.pdsk == D_DISKLESS) && + device->state.disk < D_INCONSISTENT && + device->state.role == R_PRIMARY && + (device->ed_uuid & ~((u64)1)) != (p_uuid[UI_CURRENT] & ~((u64)1))) { +-- +2.19.1 + diff --git a/queue-4.20/drbd-narrow-rcu_read_lock-in-drbd_sync_handshake.patch b/queue-4.20/drbd-narrow-rcu_read_lock-in-drbd_sync_handshake.patch new file mode 100644 index 00000000000..4bacd152e9d --- /dev/null +++ b/queue-4.20/drbd-narrow-rcu_read_lock-in-drbd_sync_handshake.patch @@ -0,0 +1,82 @@ +From 9a3ab9b28156bafdcf145405aca37e589aa34f9e Mon Sep 17 00:00:00 2001 +From: Roland Kammerer +Date: Thu, 20 Dec 2018 17:23:28 +0100 +Subject: drbd: narrow rcu_read_lock in drbd_sync_handshake + +[ Upstream commit d29e89e34952a9ad02c77109c71a80043544296e ] + +So far there was the possibility that we called +genlmsg_new(GFP_NOIO)/mutex_lock() while holding an rcu_read_lock(). + +This included cases like: + +drbd_sync_handshake (acquire the RCU lock) + drbd_asb_recover_1p + drbd_khelper + drbd_bcast_event + genlmsg_new(GFP_NOIO) --> may sleep + +drbd_sync_handshake (acquire the RCU lock) + drbd_asb_recover_1p + drbd_khelper + notify_helper + genlmsg_new(GFP_NOIO) --> may sleep + +drbd_sync_handshake (acquire the RCU lock) + drbd_asb_recover_1p + drbd_khelper + notify_helper + mutex_lock --> may sleep + +While using GFP_ATOMIC whould have been possible in the first two cases, +the real fix is to narrow the rcu_read_lock. + +Reported-by: Jia-Ju Bai +Reviewed-by: Lars Ellenberg +Signed-off-by: Roland Kammerer +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_receiver.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c +index 61c392752fe4..1b9822f264d2 100644 +--- a/drivers/block/drbd/drbd_receiver.c ++++ b/drivers/block/drbd/drbd_receiver.c +@@ -3364,7 +3364,7 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, + enum drbd_conns rv = C_MASK; + enum drbd_disk_state mydisk; + struct net_conf *nc; +- int hg, rule_nr, rr_conflict, tentative; ++ int hg, rule_nr, rr_conflict, tentative, always_asbp; + + mydisk = device->state.disk; + if (mydisk == D_NEGOTIATING) +@@ -3415,8 +3415,12 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, + + rcu_read_lock(); + nc = rcu_dereference(peer_device->connection->net_conf); ++ always_asbp = nc->always_asbp; ++ rr_conflict = nc->rr_conflict; ++ tentative = nc->tentative; ++ rcu_read_unlock(); + +- if (hg == 100 || (hg == -100 && nc->always_asbp)) { ++ if (hg == 100 || (hg == -100 && always_asbp)) { + int pcount = (device->state.role == R_PRIMARY) + + (peer_role == R_PRIMARY); + int forced = (hg == -100); +@@ -3455,9 +3459,6 @@ static enum drbd_conns drbd_sync_handshake(struct drbd_peer_device *peer_device, + "Sync from %s node\n", + (hg < 0) ? "peer" : "this"); + } +- rr_conflict = nc->rr_conflict; +- tentative = nc->tentative; +- rcu_read_unlock(); + + if (hg == -100) { + /* FIXME this log message is not correct if we end up here +-- +2.19.1 + diff --git a/queue-4.20/drbd-skip-spurious-timeout-ping-timeo-when-failing-p.patch b/queue-4.20/drbd-skip-spurious-timeout-ping-timeo-when-failing-p.patch new file mode 100644 index 00000000000..1e6734ef71c --- /dev/null +++ b/queue-4.20/drbd-skip-spurious-timeout-ping-timeo-when-failing-p.patch @@ -0,0 +1,60 @@ +From dae2d6620af630054be8be9adac6b8aa103f43ae Mon Sep 17 00:00:00 2001 +From: Lars Ellenberg +Date: Thu, 20 Dec 2018 17:23:41 +0100 +Subject: drbd: skip spurious timeout (ping-timeo) when failing promote + +[ Upstream commit 9848b6ddd8c92305252f94592c5e278574e7a6ac ] + +If you try to promote a Secondary while connected to a Primary +and allow-two-primaries is NOT set, we will wait for "ping-timeout" +to give this node a chance to detect a dead primary, +in case the cluster manager noticed faster than we did. + +But if we then are *still* connected to a Primary, +we fail (after an additional timeout of ping-timout). + +This change skips the spurious second timeout. + +Most people won't notice really, +since "ping-timeout" by default is half a second. + +But in some installations, ping-timeout may be 10 or 20 seconds or more, +and spuriously delaying the error return becomes annoying. + +Signed-off-by: Lars Ellenberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_nl.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index d15703b1ffe8..714503173150 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -668,14 +668,15 @@ drbd_set_role(struct drbd_device *const device, enum drbd_role new_role, int for + if (rv == SS_TWO_PRIMARIES) { + /* Maybe the peer is detected as dead very soon... + retry at most once more in this case. */ +- int timeo; +- rcu_read_lock(); +- nc = rcu_dereference(connection->net_conf); +- timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1; +- rcu_read_unlock(); +- schedule_timeout_interruptible(timeo); +- if (try < max_tries) ++ if (try < max_tries) { ++ int timeo; + try = max_tries - 1; ++ rcu_read_lock(); ++ nc = rcu_dereference(connection->net_conf); ++ timeo = nc ? (nc->ping_timeo + 1) * HZ / 10 : 1; ++ rcu_read_unlock(); ++ schedule_timeout_interruptible(timeo); ++ } + continue; + } + if (rv < SS_SUCCESS) { +-- +2.19.1 + diff --git a/queue-4.20/driver-core-move-async_synchronize_full-call.patch b/queue-4.20/driver-core-move-async_synchronize_full-call.patch new file mode 100644 index 00000000000..d551f00e38c --- /dev/null +++ b/queue-4.20/driver-core-move-async_synchronize_full-call.patch @@ -0,0 +1,58 @@ +From 2cdb7c54b49df07905ab823ded52d6b680f0a2f2 Mon Sep 17 00:00:00 2001 +From: Alexander Duyck +Date: Wed, 28 Nov 2018 16:32:11 -0800 +Subject: driver core: Move async_synchronize_full call + +[ Upstream commit c37d721c68ad88925ba0e72f6e14acb829a8c6bb ] + +Move the async_synchronize_full call out of __device_release_driver and +into driver_detach. + +The idea behind this is that the async_synchronize_full call will only +guarantee that any existing async operations are flushed. This doesn't do +anything to guarantee that a hotplug event that may occur while we are +doing the release of the driver will not be asynchronously scheduled. + +By moving this into the driver_detach path we can avoid potential deadlocks +as we aren't holding the device lock at this point and we should not have +the driver we want to flush loaded so the flush will take care of any +asynchronous events the driver we are detaching might have scheduled. + +Fixes: 765230b5f084 ("driver-core: add asynchronous probing support for drivers") +Reviewed-by: Bart Van Assche +Reviewed-by: Dan Williams +Signed-off-by: Alexander Duyck +Reviewed-by: Luis Chamberlain +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index dbba123e058d..9d6604b50d75 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -928,9 +928,6 @@ static void __device_release_driver(struct device *dev, struct device *parent) + + drv = dev->driver; + if (drv) { +- if (driver_allows_async_probing(drv)) +- async_synchronize_full(); +- + while (device_links_busy(dev)) { + device_unlock(dev); + if (parent && dev->bus->need_parent_lock) +@@ -1036,6 +1033,9 @@ void driver_detach(struct device_driver *drv) + struct device_private *dev_prv; + struct device *dev; + ++ if (driver_allows_async_probing(drv)) ++ async_synchronize_full(); ++ + for (;;) { + spin_lock(&drv->p->klist_devices.k_lock); + if (list_empty(&drv->p->klist_devices.k_list)) { +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-add-retry-to-read-ddc_clock-pin.patch b/queue-4.20/drm-amd-display-add-retry-to-read-ddc_clock-pin.patch new file mode 100644 index 00000000000..23b4def0090 --- /dev/null +++ b/queue-4.20/drm-amd-display-add-retry-to-read-ddc_clock-pin.patch @@ -0,0 +1,70 @@ +From e76ee9ba9a0cc7aae20bc877c6e20339269b696f Mon Sep 17 00:00:00 2001 +From: Paul Hsieh +Date: Thu, 22 Nov 2018 18:43:45 +0800 +Subject: drm/amd/display: Add retry to read ddc_clock pin + +[ Upstream commit bd4905a9583c760da31ded7256dca6f71483c3dc ] + +[WHY] +On customer board, there is one pluse (1v , < 1ms) on +DDC_CLK pin when plug / unplug DP cable. Driver will read +it and config DP to HDMI/DVI dongle. + +[HOW] +If there is a real dongle, DDC_CLK should be always pull high. +Try to read again to recovery this special case. Retry times = 3. +Need additional 3ms to detect DP passive dongle(3 failures) + +Signed-off-by: Paul Hsieh +Reviewed-by: Eric Yang +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 23 ++++++++++++++----- + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 5141c1401889..ef1b350a45e0 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -332,7 +332,7 @@ bool dc_link_is_dp_sink_present(struct dc_link *link) + { + enum gpio_result gpio_result; + uint32_t clock_pin = 0; +- ++ uint8_t retry = 0; + struct ddc *ddc; + + enum connector_id connector_id = +@@ -361,11 +361,22 @@ bool dc_link_is_dp_sink_present(struct dc_link *link) + return present; + } + +- /* Read GPIO: DP sink is present if both clock and data pins are zero */ +- /* [anaumov] in DAL2, there was no check for GPIO failure */ +- +- gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin); +- ASSERT(gpio_result == GPIO_RESULT_OK); ++ /* ++ * Read GPIO: DP sink is present if both clock and data pins are zero ++ * ++ * [W/A] plug-unplug DP cable, sometimes customer board has ++ * one short pulse on clk_pin(1V, < 1ms). DP will be config to HDMI/DVI ++ * then monitor can't br light up. Add retry 3 times ++ * But in real passive dongle, it need additional 3ms to detect ++ */ ++ do { ++ gpio_result = dal_gpio_get_value(ddc->pin_clock, &clock_pin); ++ ASSERT(gpio_result == GPIO_RESULT_OK); ++ if (clock_pin) ++ udelay(1000); ++ else ++ break; ++ } while (retry++ < 3); + + present = (gpio_result == GPIO_RESULT_OK) && !clock_pin; + +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-calculate-stream-phy_pix_clk-before-.patch b/queue-4.20/drm-amd-display-calculate-stream-phy_pix_clk-before-.patch new file mode 100644 index 00000000000..a0def3f654f --- /dev/null +++ b/queue-4.20/drm-amd-display-calculate-stream-phy_pix_clk-before-.patch @@ -0,0 +1,48 @@ +From 9e4de2d63765cec765e52fdaf2490c3081b7dd3b Mon Sep 17 00:00:00 2001 +From: Yogesh Mohan Marimuthu +Date: Sat, 20 Oct 2018 01:21:40 +0530 +Subject: drm/amd/display: calculate stream->phy_pix_clk before clock mapping + +[ Upstream commit 08e1c28dd521c7b08d1b0af0bae9fb22ccc012a4 ] + +[why] +phy_pix_clk is one of the variable used to check if one PLL can be shared +with displays having common mode set configuration. As of now +phy_pix_clock varialbe is calculated in function dc_validate_stream(). +dc_validate_stream() function is called after clocks are assigned for the +new display. Due to this during hotplug, when PLL sharing conditions are +checked for new display phy_pix_clk variable will be 0 and for displays +that are already enabled phy_pix_clk will have some value. Hence PLL will +not be shared and if the display hardware doesn't have any more PLL to +assign, mode set will fail due to resource unavailability. + +[how] +Instead of only calculating the phy_pix_clk variable after the PLL is +assigned for new display, this patch calculates phy_pix_clk also during +the before assigning the PLL for new display. + +Signed-off-by: Yogesh Mohan Marimuthu +Reviewed-by: Harry Wentland +Acked-by: Bhawanpreet Lakha +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index b6fe29b9fb65..8bd8f34b979c 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -2002,6 +2002,8 @@ enum dc_status resource_map_pool_resources( + } + */ + ++ calculate_phy_pix_clks(stream); ++ + /* acquire new resources */ + pipe_idx = acquire_first_free_pipe(&context->res_ctx, pool, stream); + +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-fix-gamma-not-being-applied-correctl.patch b/queue-4.20/drm-amd-display-fix-gamma-not-being-applied-correctl.patch new file mode 100644 index 00000000000..d5437a46282 --- /dev/null +++ b/queue-4.20/drm-amd-display-fix-gamma-not-being-applied-correctl.patch @@ -0,0 +1,42 @@ +From 7bd9a3f314839658ec710742146246235fd9e597 Mon Sep 17 00:00:00 2001 +From: Murton Liu +Date: Wed, 17 Oct 2018 14:47:45 -0400 +Subject: drm/amd/display: fix gamma not being applied correctly + +[ Upstream commit 8ce504b9389be846bcdf512ed5be8f661b3bf097 ] + +[why] +Gamma was always being set as identity on SDR monitor, +leading to no changes in gamma. This caused nightlight to +not apply correctly. + +[how] +Added a default gamma structure to compare against +in the sdr case. + +Signed-off-by: Murton Liu +Reviewed-by: Krunoslav Kovac +Acked-by: Bhawanpreet Lakha +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 193184affefb..32e4c653b1b4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -1226,7 +1226,8 @@ static bool dcn10_set_input_transfer_func(struct pipe_ctx *pipe_ctx, + tf = plane_state->in_transfer_func; + + if (plane_state->gamma_correction && +- !plane_state->gamma_correction->is_identity ++ !dpp_base->ctx->dc->debug.always_use_regamma ++ && !plane_state->gamma_correction->is_identity + && dce_use_lut(plane_state->format)) + dpp_base->funcs->dpp_program_input_lut(dpp_base, plane_state->gamma_correction); + +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-fix-potential-nullptr-error.patch b/queue-4.20/drm-amd-display-fix-potential-nullptr-error.patch new file mode 100644 index 00000000000..c7b84103ac6 --- /dev/null +++ b/queue-4.20/drm-amd-display-fix-potential-nullptr-error.patch @@ -0,0 +1,42 @@ +From cf748e71cd5437a299ac78def823beba9bc31178 Mon Sep 17 00:00:00 2001 +From: Bhawanpreet Lakha +Date: Tue, 9 Oct 2018 13:47:34 -0400 +Subject: drm/amd/display: Fix potential nullptr error + +[ Upstream commit 4f7129112c2a30331f3045a42026fad82e6cb72b ] + +[Why] +Fix surface/plane potential nullptr + +[How] +add null check + +Signed-off-by: Bhawanpreet Lakha +Reviewed-by: Aric Cyr +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 3118ae0e7a87..315a245aedc2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -5333,6 +5333,12 @@ enum surface_update_type dm_determine_update_type_for_commit(struct dc *dc, stru + struct dc_stream_update stream_update; + enum surface_update_type update_type = UPDATE_TYPE_FAST; + ++ if (!updates || !surface) { ++ DRM_ERROR("Plane or surface update failed to allocate"); ++ /* Set type to FULL to avoid crashing in DC*/ ++ update_type = UPDATE_TYPE_FULL; ++ goto ret; ++ } + + for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { + new_dm_crtc_state = to_dm_crtc_state(new_crtc_state); +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-fix-ycbcr420-blank-color.patch b/queue-4.20/drm-amd-display-fix-ycbcr420-blank-color.patch new file mode 100644 index 00000000000..1ad5ee45887 --- /dev/null +++ b/queue-4.20/drm-amd-display-fix-ycbcr420-blank-color.patch @@ -0,0 +1,78 @@ +From 6a4557850b03ef1bbdccafdb7657c15dc1a0d6d9 Mon Sep 17 00:00:00 2001 +From: Eric Yang +Date: Thu, 22 Nov 2018 02:07:06 -0500 +Subject: drm/amd/display: fix YCbCr420 blank color + +[ Upstream commit 12750d1647f118496f1da727146f255f5e44d500 ] + +[Why] +YCbCr420 packing format uses two chanels for luma, and 1 +channel for both chroma component. Our previous implementation +did not account for this and results in every other pixel having +very high luma value, showing greyish color instead of black. + +YCbCr444 = ; ..... +YCbCr420 = ; ..... + +[How] +Program the second channel with the black color value for luma +as well. + +Signed-off-by: Eric Yang +Reviewed-by: Hugo Hu +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 11 ++++++++++- + .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 9 +++++++++ + 2 files changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index a6bcb90e8419..4443a916a0fb 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -1268,10 +1268,19 @@ static void program_scaler(const struct dc *dc, + pipe_ctx->plane_res.scl_data.lb_params.depth, + &pipe_ctx->stream->bit_depth_params); + +- if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color) ++ if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color) { ++ /* ++ * The way 420 is packed, 2 channels carry Y component, 1 channel ++ * alternate between Cb and Cr, so both channels need the pixel ++ * value for Y ++ */ ++ if (pipe_ctx->stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420) ++ color.color_r_cr = color.color_g_y; ++ + pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color( + pipe_ctx->stream_res.tg, + &color); ++ } + + pipe_ctx->plane_res.xfm->funcs->transform_set_scaler(pipe_ctx->plane_res.xfm, + &pipe_ctx->plane_res.scl_data); +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +index 32e4c653b1b4..220ba828748d 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +@@ -2165,6 +2165,15 @@ static void dcn10_blank_pixel_data( + color_space = stream->output_color_space; + color_space_to_black_color(dc, color_space, &black_color); + ++ /* ++ * The way 420 is packed, 2 channels carry Y component, 1 channel ++ * alternate between Cb and Cr, so both channels need the pixel ++ * value for Y ++ */ ++ if (stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420) ++ black_color.color_r_cr = black_color.color_g_y; ++ ++ + if (stream_res->tg->funcs->set_blank_color) + stream_res->tg->funcs->set_blank_color( + stream_res->tg, +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-validate-extended-dongle-caps.patch b/queue-4.20/drm-amd-display-validate-extended-dongle-caps.patch new file mode 100644 index 00000000000..ddcd8db7e40 --- /dev/null +++ b/queue-4.20/drm-amd-display-validate-extended-dongle-caps.patch @@ -0,0 +1,44 @@ +From 53e2bb4b03cc3bd0d854baee3a43038fc3b793b3 Mon Sep 17 00:00:00 2001 +From: Wenjing Liu +Date: Wed, 5 Dec 2018 12:14:45 -0500 +Subject: drm/amd/display: validate extended dongle caps + +[ Upstream commit 99b922f9ed6a6313c0d2247cde8aa1e4a0bd67e4 ] + +[why] +Some dongle doesn't have a valid extended dongle caps, +but we still set the extended dongle caps to be valid. +This causes validation fails for all timing. + +[how] +If no dp_hdmi_max_pixel_clk is provided, +don't use extended dongle caps. + +Signed-off-by: Wenjing Liu +Reviewed-by: Aric Cyr +Reviewed-by: Jun Lei +Acked-by: Abdoulaye Berthe +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index d91df5ef0cb3..d33a5ebe990b 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -2240,7 +2240,8 @@ static void get_active_converter_info( + translate_dpcd_max_bpc( + hdmi_color_caps.bits.MAX_BITS_PER_COLOR_COMPONENT); + +- link->dpcd_caps.dongle_caps.extendedCapValid = true; ++ if (link->dpcd_caps.dongle_caps.dp_hdmi_max_pixel_clk != 0) ++ link->dpcd_caps.dongle_caps.extendedCapValid = true; + } + + break; +-- +2.19.1 + diff --git a/queue-4.20/drm-amd-display-wait-edp-hpd-to-high-in-detect_sink.patch b/queue-4.20/drm-amd-display-wait-edp-hpd-to-high-in-detect_sink.patch new file mode 100644 index 00000000000..c3b995401a3 --- /dev/null +++ b/queue-4.20/drm-amd-display-wait-edp-hpd-to-high-in-detect_sink.patch @@ -0,0 +1,44 @@ +From d9971aeada8eb65d27c209f6e3e456a39e7393a7 Mon Sep 17 00:00:00 2001 +From: Dale Zhao +Date: Thu, 22 Nov 2018 17:13:46 +0800 +Subject: drm/amd/display: Wait edp HPD to high in detect_sink + +[ Upstream commit 0a6414e75d231ee1bb7ffb2f5eb246b682a884cd ] + +[Why] +In 99% user case, edp will be post by vbios. +In 1% / current case: Lenovo don't light up edp panel in vbios +post stage, vbios won't be lit up. Thus in dal when we init DCN +10 hw, we power up edp, then we start detect_sink, but internal +time is too short, when we detect it, HPD is still low, so we don't +detect the edp, and edp shows black. + +[How] +When we init hw, we wait edp HPD to high after power up edp. + +Signed-off-by: Dale Zhao +Reviewed-by: Eric Yang +Acked-by: Leo Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index ef1b350a45e0..8b69913b6943 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -208,6 +208,9 @@ bool dc_link_detect_sink(struct dc_link *link, enum dc_connection_type *type) + return true; + } + ++ if (link->connector_signal == SIGNAL_TYPE_EDP) ++ link->dc->hwss.edp_wait_for_hpd_ready(link, true); ++ + /* todo: may need to lock gpio access */ + hpd_pin = get_hpd_gpio(link->ctx->dc_bios, link->link_id, link->ctx->gpio_service); + if (hpd_pin == NULL) +-- +2.19.1 + diff --git a/queue-4.20/drm-amdgpu-powerplay-fix-clock-stretcher-limits-on-p.patch b/queue-4.20/drm-amdgpu-powerplay-fix-clock-stretcher-limits-on-p.patch new file mode 100644 index 00000000000..4c03283092a --- /dev/null +++ b/queue-4.20/drm-amdgpu-powerplay-fix-clock-stretcher-limits-on-p.patch @@ -0,0 +1,49 @@ +From f62ea27af7c15d762bca00854654a93dea5696f0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Thu, 29 Nov 2018 19:22:07 -0500 +Subject: drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2) + +[ Upstream commit de4aaab5cc9770a8c4dc13d9bfb6a83b06bba57e ] + +Adjust limits for newer polaris variants. + +v2: fix polaris11 kicker (Jerry) + +Reviewed-by: Junwei Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/powerplay/smumgr/polaris10_smumgr.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c +index a1e0ac9ae248..90c1215c6f5e 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/polaris10_smumgr.c +@@ -1529,8 +1529,21 @@ static int polaris10_populate_clock_stretcher_data_table(struct pp_hwmgr *hwmgr) + efuse = efuse >> 24; + + if (hwmgr->chip_id == CHIP_POLARIS10) { +- min = 1000; +- max = 2300; ++ if (hwmgr->is_kicker) { ++ min = 1200; ++ max = 2500; ++ } else { ++ min = 1000; ++ max = 2300; ++ } ++ } else if (hwmgr->chip_id == CHIP_POLARIS11) { ++ if (hwmgr->is_kicker) { ++ min = 900; ++ max = 2100; ++ } else { ++ min = 1100; ++ max = 2100; ++ } + } else { + min = 1100; + max = 2100; +-- +2.19.1 + diff --git a/queue-4.20/drm-bufs-fix-spectre-v1-vulnerability.patch b/queue-4.20/drm-bufs-fix-spectre-v1-vulnerability.patch new file mode 100644 index 00000000000..c82ee317db9 --- /dev/null +++ b/queue-4.20/drm-bufs-fix-spectre-v1-vulnerability.patch @@ -0,0 +1,55 @@ +From c9430e3122f291b370c9910d0f3d7be3df6aa07d Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Tue, 16 Oct 2018 11:55:49 +0200 +Subject: drm/bufs: Fix Spectre v1 vulnerability + +[ Upstream commit a37805098900a6e73a55b3a43b7d3bcd987bb3f4 ] + +idx can be indirectly controlled by user-space, hence leading to a +potential exploitation of the Spectre variant 1 vulnerability. + +This issue was detected with the help of Smatch: + +drivers/gpu/drm/drm_bufs.c:1420 drm_legacy_freebufs() warn: potential +spectre issue 'dma->buflist' [r] (local cap) + +Fix this by sanitizing idx before using it to index dma->buflist + +Notice that given that speculation windows are large, the policy is +to kill the speculation on the first load and not worry if it can be +completed with a dependent load/store [1]. + +[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 + +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20181016095549.GA23586@embeddedor.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bufs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c +index 7412acaf3cde..d7d10cabb9bb 100644 +--- a/drivers/gpu/drm/drm_bufs.c ++++ b/drivers/gpu/drm/drm_bufs.c +@@ -36,6 +36,8 @@ + #include + #include "drm_legacy.h" + ++#include ++ + static struct drm_map_list *drm_find_matching_map(struct drm_device *dev, + struct drm_local_map *map) + { +@@ -1417,6 +1419,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data, + idx, dma->buf_count - 1); + return -EINVAL; + } ++ idx = array_index_nospec(idx, dma->buf_count); + buf = dma->buflist[idx]; + if (buf->file_priv != file_priv) { + DRM_ERROR("Process %d freeing buffer not owned\n", +-- +2.19.1 + diff --git a/queue-4.20/drm-clear-state-acquire_ctx-before-leaving-drm_atomi.patch b/queue-4.20/drm-clear-state-acquire_ctx-before-leaving-drm_atomi.patch new file mode 100644 index 00000000000..7e0e2c072fd --- /dev/null +++ b/queue-4.20/drm-clear-state-acquire_ctx-before-leaving-drm_atomi.patch @@ -0,0 +1,55 @@ +From b5b8a24f897d7572a4ac3fc4eaabf299d6ef93d7 Mon Sep 17 00:00:00 2001 +From: Sean Paul +Date: Thu, 29 Nov 2018 10:04:14 -0500 +Subject: drm: Clear state->acquire_ctx before leaving + drm_atomic_helper_commit_duplicated_state() + +[ Upstream commit aa394b0dd68cb00c483e151dcd84713d4d517ed1 ] + +drm_atomic_helper_commit_duplicated_state() sets state->acquire_ctx to +the context given in the argument and leaves it in state after it +quits. The lifetime of state and context are not guaranteed to be the +same, so we shouldn't leave that pointer hanging around. This patch +resets the context to NULL to avoid any oopses. + +Changes in v2: +- Added to the set + +Suggested-by: Daniel Vetter +Reviewed-by: Daniel Vetter +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20181129150423.239081-1-sean@poorly.run +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_atomic_helper.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index b4e292a56046..df86c2ebfc12 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -3212,7 +3212,7 @@ EXPORT_SYMBOL(drm_atomic_helper_suspend); + int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state, + struct drm_modeset_acquire_ctx *ctx) + { +- int i; ++ int i, ret; + struct drm_plane *plane; + struct drm_plane_state *new_plane_state; + struct drm_connector *connector; +@@ -3231,7 +3231,11 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state, + for_each_new_connector_in_state(state, connector, new_conn_state, i) + state->connectors[i].old_state = connector->state; + +- return drm_atomic_commit(state); ++ ret = drm_atomic_commit(state); ++ ++ state->acquire_ctx = NULL; ++ ++ return ret; + } + EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state); + +-- +2.19.1 + diff --git a/queue-4.20/drm-msm-dpu-only-check-flush-register-against-pendin.patch b/queue-4.20/drm-msm-dpu-only-check-flush-register-against-pendin.patch new file mode 100644 index 00000000000..dba3e43c2fb --- /dev/null +++ b/queue-4.20/drm-msm-dpu-only-check-flush-register-against-pendin.patch @@ -0,0 +1,44 @@ +From d6ba29d51304c94ce1b85d1a9ab2875f98a0cf7e Mon Sep 17 00:00:00 2001 +From: Sean Paul +Date: Tue, 30 Oct 2018 12:00:08 -0400 +Subject: drm/msm: dpu: Only check flush register against pending flushes + +[ Upstream commit 5f79e03b1f7c1b2cf0019ce6365fe5d52629813d ] + +There exists a case where a flush of a plane/dma may have been triggered +& started from an async commit. If that plane/dma is subsequently disabled +by the next commit, the flush register will continue to hold the flush +bit for the disabled plane. Since the bit remains active, +pending_kickoff_cnt will never decrement and we'll miss frame_done +events. + +This patch limits the check of flush_register to include only those bits +which have been updated with the latest commit. + +Changes in v2: +- None + +Reviewed-by: Jeykumar Sankaran +Signed-off-by: Sean Paul +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +index 84de385a9f62..60f146f02b77 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c +@@ -331,7 +331,7 @@ static void dpu_encoder_phys_vid_vblank_irq(void *arg, int irq_idx) + if (hw_ctl && hw_ctl->ops.get_flush_register) + flush_register = hw_ctl->ops.get_flush_register(hw_ctl); + +- if (flush_register == 0) ++ if (!(flush_register & hw_ctl->ops.get_pending_flush(hw_ctl))) + new_cnt = atomic_add_unless(&phys_enc->pending_kickoff_cnt, + -1, 0); + spin_unlock_irqrestore(phys_enc->enc_spinlock, lock_flags); +-- +2.19.1 + diff --git a/queue-4.20/drm-msm-dsi-fix-dsi-clock-names-in-dsi-10nm-pll-driv.patch b/queue-4.20/drm-msm-dsi-fix-dsi-clock-names-in-dsi-10nm-pll-driv.patch new file mode 100644 index 00000000000..d78d0fb7fe2 --- /dev/null +++ b/queue-4.20/drm-msm-dsi-fix-dsi-clock-names-in-dsi-10nm-pll-driv.patch @@ -0,0 +1,66 @@ +From 3727fcef7b21479fa4869c01f81e2ac342a5f90d Mon Sep 17 00:00:00 2001 +From: Abhinav Kumar +Date: Thu, 11 Oct 2018 10:18:57 -0700 +Subject: drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver + +[ Upstream commit c1866d44d149a1ea5c303632114fb6aa08cfd263 ] + +Fix the dsi clock names in the DSI 10nm PLL driver to +match the names in the dispcc driver as those are +according to the clock plan of the chipset. + +Changes in v2: +- Update the clock diagram with the new clock name + +Reviewed-by: Sean Paul +Signed-off-by: Abhinav Kumar +Signed-off-by: Sean Paul +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +index 41bec570c518..31205625c734 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +@@ -17,7 +17,7 @@ + * | | + * | | + * +---------+ | +----------+ | +----+ +- * dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0pllbyte ++ * dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk + * +---------+ | +----------+ | +----+ + * | | + * | | dsi0_pll_by_2_bit_clk +@@ -25,7 +25,7 @@ + * | | +----+ | |\ dsi0_pclk_mux + * | |--| /2 |--o--| \ | + * | | +----+ | \ | +---------+ +- * | --------------| |--o--| div_7_4 |-- dsi0pll ++ * | --------------| |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk + * |------------------------------| / +---------+ + * | +-----+ | / + * -----------| /4? |--o----------|/ +@@ -690,7 +690,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm) + + hws[num++] = hw; + +- snprintf(clk_name, 32, "dsi%dpllbyte", pll_10nm->id); ++ snprintf(clk_name, 32, "dsi%d_phy_pll_out_byteclk", pll_10nm->id); + snprintf(parent, 32, "dsi%d_pll_bit_clk", pll_10nm->id); + + /* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */ +@@ -739,7 +739,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm) + + hws[num++] = hw; + +- snprintf(clk_name, 32, "dsi%dpll", pll_10nm->id); ++ snprintf(clk_name, 32, "dsi%d_phy_pll_out_dsiclk", pll_10nm->id); + snprintf(parent, 32, "dsi%d_pclk_mux", pll_10nm->id); + + /* PIX CLK DIV : DIV_CTRL_7_4*/ +-- +2.19.1 + diff --git a/queue-4.20/drm-rcar-du-fix-external-clock-error-checks.patch b/queue-4.20/drm-rcar-du-fix-external-clock-error-checks.patch new file mode 100644 index 00000000000..e511661afa6 --- /dev/null +++ b/queue-4.20/drm-rcar-du-fix-external-clock-error-checks.patch @@ -0,0 +1,60 @@ +From 00c478b1aaf314bc0cf5ae28c4efd102458c9bc2 Mon Sep 17 00:00:00 2001 +From: Laurent Pinchart +Date: Tue, 6 Nov 2018 17:13:44 +0200 +Subject: drm: rcar-du: Fix external clock error checks + +[ Upstream commit 63a298f22a6183b5b7536a203596c6570dfcfe8e ] + +The rcar-du driver supports probe deferral for external clocks, but +implements it badly by checking the wrong pointer due to a bad copy and +paste. Fix it. + +While at it, reject invalid clocks outright for DU channels that have a +display PLL, as the external clock is mandatory in that case. This +avoids a WARN_ON() at runtime. + +Fixes: 1b30dbde8596 ("drm: rcar-du: Add support for external pixel clock") +Reported-by: Kuninori Morimoto +Signed-off-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index 17741843cf51..40a9afe818a8 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -226,9 +226,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + * system clock, and have no internal clock divider. + */ + +- if (WARN_ON(!rcrtc->extclock)) +- return; +- + /* + * The H3 ES1.x exhibits dot clock duty cycle stability issues. + * We can work around them by configuring the DPLL to twice the +@@ -1113,9 +1110,16 @@ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int swindex, + clk = devm_clk_get(rcdu->dev, clk_name); + if (!IS_ERR(clk)) { + rcrtc->extclock = clk; +- } else if (PTR_ERR(rcrtc->clock) == -EPROBE_DEFER) { +- dev_info(rcdu->dev, "can't get external clock %u\n", hwindex); ++ } else if (PTR_ERR(clk) == -EPROBE_DEFER) { + return -EPROBE_DEFER; ++ } else if (rcdu->info->dpll_mask & BIT(hwindex)) { ++ /* ++ * DU channels that have a display PLL can't use the internal ++ * system clock and thus require an external clock. ++ */ ++ ret = PTR_ERR(clk); ++ dev_err(rcdu->dev, "can't get dclkin.%u: %d\n", hwindex, ret); ++ return ret; + } + + init_waitqueue_head(&rcrtc->flip_wait); +-- +2.19.1 + diff --git a/queue-4.20/drm-rockchip-fix-for-mailbox-read-size.patch b/queue-4.20/drm-rockchip-fix-for-mailbox-read-size.patch new file mode 100644 index 00000000000..c9c62bb956b --- /dev/null +++ b/queue-4.20/drm-rockchip-fix-for-mailbox-read-size.patch @@ -0,0 +1,45 @@ +From 3fb31160c6d18545367a139152c097cd775b2f02 Mon Sep 17 00:00:00 2001 +From: Damian Kos +Date: Tue, 6 Nov 2018 15:37:05 +0000 +Subject: drm/rockchip: fix for mailbox read size + +[ Upstream commit fa68d4f8476bea4cdf441062b614b41bb85ef1da ] + +Some of the functions (like cdn_dp_dpcd_read, cdn_dp_get_edid_block) +allow to read 64KiB, but the cdn_dp_mailbox_read_receive, that is +used by them, can read only up to 255 bytes at once. Normally, it's +not a big issue as DPCD or EDID reads won't (hopefully) exceed that +value. +The real issue here is the revocation list read during the HDCP +authentication process. (problematic use case: +https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.4/drivers/gpu/drm/rockchip/cdn-dp-reg.c#1152) +The list can reach 127*5+4 bytes (num devs * 5 bytes per ID/Bksv + +4 bytes of an additional info). +In other words - CTSes with HDCP Repeater won't pass without this +fix. Oh, and the driver will most likely stop working (best case +scenario). + +Signed-off-by: Damian Kos +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/1541518625-25984-1-git-send-email-dkos@cadence.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +index 3105965fc260..5a485489a1e2 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp, + } + + static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp, +- u8 *buff, u8 buff_size) ++ u8 *buff, u16 buff_size) + { + u32 i; + int ret; +-- +2.19.1 + diff --git a/queue-4.20/drm-sun4i-initialize-registers-in-tcon-top-driver.patch b/queue-4.20/drm-sun4i-initialize-registers-in-tcon-top-driver.patch new file mode 100644 index 00000000000..f73061a5599 --- /dev/null +++ b/queue-4.20/drm-sun4i-initialize-registers-in-tcon-top-driver.patch @@ -0,0 +1,42 @@ +From 8224a867df9bcbcb76b5f8d66e0d1d29f9739212 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Sun, 4 Nov 2018 19:27:00 +0100 +Subject: drm/sun4i: Initialize registers in tcon-top driver + +[ Upstream commit c96d62215fb540e2ae61de44cb7caf4db50958e3 ] + +It turns out that TCON TOP registers in H6 SoC have non-zero reset +value. This may cause issues if bits are not changed during +configuration. + +To prevent that, initialize registers to 0. + +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20181104182705.18047-24-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_tcon_top.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c +index 3040a79f298f..37158548b447 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_tcon_top.c ++++ b/drivers/gpu/drm/sun4i/sun8i_tcon_top.c +@@ -167,6 +167,13 @@ static int sun8i_tcon_top_bind(struct device *dev, struct device *master, + goto err_assert_reset; + } + ++ /* ++ * At least on H6, some registers have some bits set by default ++ * which may cause issues. Clear them here. ++ */ ++ writel(0, regs + TCON_TOP_PORT_SEL_REG); ++ writel(0, regs + TCON_TOP_GATE_SRC_REG); ++ + /* + * TCON TOP has two muxes, which select parent clock for each TCON TV + * channel clock. Parent could be either TCON TV or TVE clock. For now +-- +2.19.1 + diff --git a/queue-4.20/drm-v3d-fix-a-use-after-free-race-accessing-the-sche.patch b/queue-4.20/drm-v3d-fix-a-use-after-free-race-accessing-the-sche.patch new file mode 100644 index 00000000000..51ef7f6ccc0 --- /dev/null +++ b/queue-4.20/drm-v3d-fix-a-use-after-free-race-accessing-the-sche.patch @@ -0,0 +1,81 @@ +From b3a369e3aace2ad80b80cc68d9fae372e247da93 Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Fri, 28 Sep 2018 16:21:23 -0700 +Subject: drm/v3d: Fix a use-after-free race accessing the scheduler's fences. + +[ Upstream commit 34c2c4f632f232ed2fdb66d4e42cc72d322273fe ] + +Once we push the job, the scheduler could run it and free it. So, if +we want to reference their fences, we need to grab them before then. +I haven't seen this happen in many days of conformance test runtime, +but let's still close the race. + +Signed-off-by: Eric Anholt +Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") +Link: https://patchwork.freedesktop.org/patch/254119/ +Reviewed-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_drv.h | 5 +++++ + drivers/gpu/drm/v3d/v3d_gem.c | 8 ++++++-- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/v3d/v3d_drv.h b/drivers/gpu/drm/v3d/v3d_drv.h +index e6fed696ad86..cbe5be0c47eb 100644 +--- a/drivers/gpu/drm/v3d/v3d_drv.h ++++ b/drivers/gpu/drm/v3d/v3d_drv.h +@@ -198,6 +198,11 @@ struct v3d_exec_info { + */ + struct dma_fence *bin_done_fence; + ++ /* Fence for when the scheduler considers the render to be ++ * done, for when the BOs reservations should be complete. ++ */ ++ struct dma_fence *render_done_fence; ++ + struct kref refcount; + + /* This is the array of BOs that were looked up at the start of exec. */ +diff --git a/drivers/gpu/drm/v3d/v3d_gem.c b/drivers/gpu/drm/v3d/v3d_gem.c +index 70c54774400b..2814c72cb090 100644 +--- a/drivers/gpu/drm/v3d/v3d_gem.c ++++ b/drivers/gpu/drm/v3d/v3d_gem.c +@@ -209,7 +209,7 @@ v3d_flush_caches(struct v3d_dev *v3d) + static void + v3d_attach_object_fences(struct v3d_exec_info *exec) + { +- struct dma_fence *out_fence = &exec->render.base.s_fence->finished; ++ struct dma_fence *out_fence = exec->render_done_fence; + struct v3d_bo *bo; + int i; + +@@ -409,6 +409,7 @@ v3d_exec_cleanup(struct kref *ref) + dma_fence_put(exec->render.done_fence); + + dma_fence_put(exec->bin_done_fence); ++ dma_fence_put(exec->render_done_fence); + + for (i = 0; i < exec->bo_count; i++) + drm_gem_object_put_unlocked(&exec->bo[i]->base); +@@ -572,6 +573,9 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, + if (ret) + goto fail_unreserve; + ++ exec->render_done_fence = ++ dma_fence_get(&exec->render.base.s_fence->finished); ++ + kref_get(&exec->refcount); /* put by scheduler job completion */ + drm_sched_entity_push_job(&exec->render.base, + &v3d_priv->sched_entity[V3D_RENDER]); +@@ -585,7 +589,7 @@ v3d_submit_cl_ioctl(struct drm_device *dev, void *data, + sync_out = drm_syncobj_find(file_priv, args->out_sync); + if (sync_out) { + drm_syncobj_replace_fence(sync_out, 0, +- &exec->render.base.s_fence->finished); ++ exec->render_done_fence); + drm_syncobj_put(sync_out); + } + +-- +2.19.1 + diff --git a/queue-4.20/drm-v3d-fix-prime-imports-of-buffers-from-other-driv.patch b/queue-4.20/drm-v3d-fix-prime-imports-of-buffers-from-other-driv.patch new file mode 100644 index 00000000000..cabab7da951 --- /dev/null +++ b/queue-4.20/drm-v3d-fix-prime-imports-of-buffers-from-other-driv.patch @@ -0,0 +1,38 @@ +From 2c832dde7dcfbe8e3ab8e283cf3a0ba472ff15df Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Wed, 28 Nov 2018 15:09:27 -0800 +Subject: drm/v3d: Fix prime imports of buffers from other drivers. + +[ Upstream commit 62d1a752874962f072de8a779e960fcd2ab4847b ] + +v3d_bo_get_pages() checks this to decide to map the imported buffer +instead of the backing shmem file. The caller was about to set this +value anyway, and there's no error path in between. Ideally we +wouldn't even allocate the shmem file for our imports, but that's a +more invasive fix. + +Signed-off-by: Eric Anholt +Fixes: 57692c94dcbe ("drm/v3d: Introduce a new DRM driver for Broadcom V3D V3.x+") +Link: https://patchwork.freedesktop.org/patch/msgid/20181128230927.10951-3-eric@anholt.net +Acked-by: Daniel Vetter +Reviewed-by: Dave Emett +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_bo.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/v3d/v3d_bo.c b/drivers/gpu/drm/v3d/v3d_bo.c +index 54d96518a131..a08766d39eab 100644 +--- a/drivers/gpu/drm/v3d/v3d_bo.c ++++ b/drivers/gpu/drm/v3d/v3d_bo.c +@@ -293,6 +293,7 @@ v3d_prime_import_sg_table(struct drm_device *dev, + bo->resv = attach->dmabuf->resv; + + bo->sgt = sgt; ++ obj->import_attach = attach; + v3d_bo_get_pages(bo); + + v3d_mmu_insert_ptes(bo); +-- +2.19.1 + diff --git a/queue-4.20/drm-vc4-x_scaling-1-should-never-be-set-to-vc4_scali.patch b/queue-4.20/drm-vc4-x_scaling-1-should-never-be-set-to-vc4_scali.patch new file mode 100644 index 00000000000..d3bd60dbb7d --- /dev/null +++ b/queue-4.20/drm-vc4-x_scaling-1-should-never-be-set-to-vc4_scali.patch @@ -0,0 +1,54 @@ +From 02b65de8e9bbd6229a53e0f17f946c05c1f31398 Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Fri, 9 Nov 2018 11:26:32 +0100 +Subject: drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE + +[ Upstream commit 0560054da5673b25d56bea6c57c8d069673af73b ] + +For the YUV conversion to work properly, ->x_scaling[1] should never +be set to VC4_SCALING_NONE, but vc4_get_scaling_mode() might return +VC4_SCALING_NONE if the horizontal scaling ratio exactly matches the +horizontal subsampling factor. Add a test to turn VC4_SCALING_NONE +into VC4_SCALING_PPF when that happens. + +The old ->x_scaling[0] adjustment is dropped as I couldn't find any +mention to this constraint in the spec and it's proven to be +unnecessary (I tested various multi-planar YUV formats with scaling +disabled, and all of them worked fine without this adjustment). + +Fixes: fc04023fafec ("drm/vc4: Add support for YUV planes.") +Signed-off-by: Boris Brezillon +Reviewed-by: Eric Anholt +Link: https://patchwork.freedesktop.org/patch/msgid/20181109102633.32603-1-boris.brezillon@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_plane.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index ae6254b0b1ae..ed8b0fc170ee 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -314,12 +314,14 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + vc4_get_scaling_mode(vc4_state->src_h[1], + vc4_state->crtc_h); + +- /* YUV conversion requires that horizontal scaling be enabled, +- * even on a plane that's otherwise 1:1. Looks like only PPF +- * works in that case, so let's pick that one. ++ /* YUV conversion requires that horizontal scaling be enabled ++ * on the UV plane even if vc4_get_scaling_mode() returned ++ * VC4_SCALING_NONE (which can happen when the down-scaling ++ * ratio is 0.5). Let's force it to VC4_SCALING_PPF in this ++ * case. + */ +- if (vc4_state->is_unity) +- vc4_state->x_scaling[0] = VC4_SCALING_PPF; ++ if (vc4_state->x_scaling[1] == VC4_SCALING_NONE) ++ vc4_state->x_scaling[1] = VC4_SCALING_PPF; + } else { + vc4_state->is_yuv = false; + vc4_state->x_scaling[1] = VC4_SCALING_NONE; +-- +2.19.1 + diff --git a/queue-4.20/drm-vgem-fix-vgem_init-to-get-drm-device-available.patch b/queue-4.20/drm-vgem-fix-vgem_init-to-get-drm-device-available.patch new file mode 100644 index 00000000000..66ff8a2adda --- /dev/null +++ b/queue-4.20/drm-vgem-fix-vgem_init-to-get-drm-device-available.patch @@ -0,0 +1,71 @@ +From ce1e446f1a926a997ac1c58d947dc97965d5e9f4 Mon Sep 17 00:00:00 2001 +From: Deepak Sharma +Date: Tue, 23 Oct 2018 17:35:48 +0100 +Subject: drm/vgem: Fix vgem_init to get drm device available. + +[ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ] + +Modify vgem_init to take platform dev as parent in drm_dev_init. +This will make drm device available at "/sys/devices/platform/vgem" +in x86 chromebook. + +v2: rebase, address checkpatch typo and line over 80 characters + +Cc: Daniel Vetter +Signed-off-by: Deepak Sharma +Reviewed-by: Sean Paul +Signed-off-by: Emil Velikov +Reviewed-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20181023163550.15211-1-emil.l.velikov@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_drv.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index ec6af8b920da..f1f7ab9dcdbf 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -471,31 +471,31 @@ static int __init vgem_init(void) + if (!vgem_device) + return -ENOMEM; + +- ret = drm_dev_init(&vgem_device->drm, &vgem_driver, NULL); +- if (ret) +- goto out_free; +- + vgem_device->platform = + platform_device_register_simple("vgem", -1, NULL, 0); + if (IS_ERR(vgem_device->platform)) { + ret = PTR_ERR(vgem_device->platform); +- goto out_fini; ++ goto out_free; + } + + dma_coerce_mask_and_coherent(&vgem_device->platform->dev, + DMA_BIT_MASK(64)); ++ ret = drm_dev_init(&vgem_device->drm, &vgem_driver, ++ &vgem_device->platform->dev); ++ if (ret) ++ goto out_unregister; + + /* Final step: expose the device/driver to userspace */ + ret = drm_dev_register(&vgem_device->drm, 0); + if (ret) +- goto out_unregister; ++ goto out_fini; + + return 0; + +-out_unregister: +- platform_device_unregister(vgem_device->platform); + out_fini: + drm_dev_fini(&vgem_device->drm); ++out_unregister: ++ platform_device_unregister(vgem_device->platform); + out_free: + kfree(vgem_device); + return ret; +-- +2.19.1 + diff --git a/queue-4.20/exec-load_script-don-t-blindly-truncate-shebang-stri.patch b/queue-4.20/exec-load_script-don-t-blindly-truncate-shebang-stri.patch new file mode 100644 index 00000000000..ea445e8efd4 --- /dev/null +++ b/queue-4.20/exec-load_script-don-t-blindly-truncate-shebang-stri.patch @@ -0,0 +1,54 @@ +From ccddeac875df1af473de8d06f2aa9e7a7c74127c Mon Sep 17 00:00:00 2001 +From: Oleg Nesterov +Date: Thu, 3 Jan 2019 15:28:07 -0800 +Subject: exec: load_script: don't blindly truncate shebang string + +[ Upstream commit 8099b047ecc431518b9bb6bdbba3549bbecdc343 ] + +load_script() simply truncates bprm->buf and this is very wrong if the +length of shebang string exceeds BINPRM_BUF_SIZE-2. This can silently +truncate i_arg or (worse) we can execute the wrong binary if buf[2:126] +happens to be the valid executable path. + +Change load_script() to return ENOEXEC if it can't find '\n' or zero in +bprm->buf. Note that '\0' can come from either +prepare_binprm()->memset() or from kernel_read(), we do not care. + +Link: http://lkml.kernel.org/r/20181112160931.GA28463@redhat.com +Signed-off-by: Oleg Nesterov +Acked-by: Kees Cook +Acked-by: Michal Hocko +Cc: Ben Woodard +Cc: "Eric W. Biederman" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/binfmt_script.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c +index 7cde3f46ad26..d0078cbb718b 100644 +--- a/fs/binfmt_script.c ++++ b/fs/binfmt_script.c +@@ -42,10 +42,14 @@ static int load_script(struct linux_binprm *bprm) + fput(bprm->file); + bprm->file = NULL; + +- bprm->buf[BINPRM_BUF_SIZE - 1] = '\0'; +- if ((cp = strchr(bprm->buf, '\n')) == NULL) +- cp = bprm->buf+BINPRM_BUF_SIZE-1; ++ for (cp = bprm->buf+2;; cp++) { ++ if (cp >= bprm->buf + BINPRM_BUF_SIZE) ++ return -ENOEXEC; ++ if (!*cp || (*cp == '\n')) ++ break; ++ } + *cp = '\0'; ++ + while (cp > bprm->buf) { + cp--; + if ((*cp == ' ') || (*cp == '\t')) +-- +2.19.1 + diff --git a/queue-4.20/f2fs-avoid-build-warn-of-fall_through.patch b/queue-4.20/f2fs-avoid-build-warn-of-fall_through.patch new file mode 100644 index 00000000000..5199de5aee9 --- /dev/null +++ b/queue-4.20/f2fs-avoid-build-warn-of-fall_through.patch @@ -0,0 +1,43 @@ +From f5f7792b95af25d45b68f759b2f58c497fe7f360 Mon Sep 17 00:00:00 2001 +From: Jaegeuk Kim +Date: Mon, 26 Nov 2018 14:20:32 -0800 +Subject: f2fs: avoid build warn of fall_through + +[ Upstream commit f5d5510e7389fa264337fb524346bac9eb93adc8 ] + +After merging the f2fs tree, today's linux-next build + (x86_64_allmodconfig) produced this warning: + + In file included from fs/f2fs/dir.c:11: + fs/f2fs/f2fs.h: In function '__mark_inode_dirty_flag': + fs/f2fs/f2fs.h:2388:6: warning: this statement may fall through [-Wimplicit-fallthrough=] + if (set) + ^ + fs/f2fs/f2fs.h:2390:2: note: here + case FI_DATA_EXIST: + ^~~~ + + Exposed by my use of -Wimplicit-fallthrough + +Reported-by: Stephen Rothwell +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 1e031971a466..ebad864c031c 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2370,6 +2370,7 @@ static inline void __mark_inode_dirty_flag(struct inode *inode, + case FI_NEW_INODE: + if (set) + return; ++ /* fall through */ + case FI_DATA_EXIST: + case FI_INLINE_DOTS: + case FI_PIN_FILE: +-- +2.19.1 + diff --git a/queue-4.20/f2fs-avoid-gc-causing-encrypted-file-corrupted.patch b/queue-4.20/f2fs-avoid-gc-causing-encrypted-file-corrupted.patch new file mode 100644 index 00000000000..2b4cbe1c7b5 --- /dev/null +++ b/queue-4.20/f2fs-avoid-gc-causing-encrypted-file-corrupted.patch @@ -0,0 +1,64 @@ +From 52df392ebeb2aac0359a6145ca0b52af4a44e037 Mon Sep 17 00:00:00 2001 +From: Yunlong Song +Date: Tue, 18 Sep 2018 20:39:53 +0800 +Subject: f2fs: avoid GC causing encrypted file corrupted + +[ Upstream commit 9bf1a3f73927492c8be127b642197125e9d52be8 ] + +The encrypted file may be corrupted by GC in following case: + +Time 1: | segment 1 blkaddr = A | GC -> | segment 2 blkaddr = B | +Encrypted block 1 is moved from blkaddr A of segment 1 to blkaddr B of +segment 2, + +Time 2: | segment 1 blkaddr = B | GC -> | segment 3 blkaddr = C | + +Before page 1 is written back and if segment 2 become a victim, then +page 1 is moved from blkaddr B of segment 2 to blkaddr Cof segment 3, +during the GC process of Time 2, f2fs should wait for page 1 written back +before reading it, or move_data_block will read a garbage block from +blkaddr B since page is not written back to blkaddr B yet. + +Commit 6aa58d8a ("f2fs: readahead encrypted block during GC") introduce +ra_data_block to read encrypted block, but it forgets to add +f2fs_wait_on_page_writeback to avoid racing between GC and flush. + +Signed-off-by: Yunlong Song +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index a07241fb8537..c96e7c6354ef 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -658,6 +658,14 @@ got_it: + fio.page = page; + fio.new_blkaddr = fio.old_blkaddr = dn.data_blkaddr; + ++ /* ++ * don't cache encrypted data into meta inode until previous dirty ++ * data were writebacked to avoid racing between GC and flush. ++ */ ++ f2fs_wait_on_page_writeback(page, DATA, true); ++ ++ f2fs_wait_on_block_writeback(inode, dn.data_blkaddr); ++ + fio.encrypted_page = f2fs_pagecache_get_page(META_MAPPING(sbi), + dn.data_blkaddr, + FGP_LOCK | FGP_CREAT, GFP_NOFS); +@@ -745,6 +753,8 @@ static int move_data_block(struct inode *inode, block_t bidx, + */ + f2fs_wait_on_page_writeback(page, DATA, true); + ++ f2fs_wait_on_block_writeback(inode, dn.data_blkaddr); ++ + err = f2fs_get_node_info(fio.sbi, dn.nid, &ni); + if (err) + goto put_out; +-- +2.19.1 + diff --git a/queue-4.20/f2fs-fix-race-between-write_checkpoint-and-write_beg.patch b/queue-4.20/f2fs-fix-race-between-write_checkpoint-and-write_beg.patch new file mode 100644 index 00000000000..0def67067c5 --- /dev/null +++ b/queue-4.20/f2fs-fix-race-between-write_checkpoint-and-write_beg.patch @@ -0,0 +1,90 @@ +From 8a4c92bbf3042aeb34fc56c2149183ad61884dcd Mon Sep 17 00:00:00 2001 +From: Sheng Yong +Date: Wed, 14 Nov 2018 19:34:28 +0800 +Subject: f2fs: fix race between write_checkpoint and write_begin + +[ Upstream commit 2866fb16d67992195b0526d19e65acb6640fb87f ] + +The following race could lead to inconsistent SIT bitmap: + +Task A Task B +====== ====== +f2fs_write_checkpoint + block_operations + f2fs_lock_all + down_write(node_change) + down_write(node_write) + ... sync ... + up_write(node_change) + f2fs_file_write_iter + set_inode_flag(FI_NO_PREALLOC) + ...... + f2fs_write_begin(index=0, has inline data) + prepare_write_begin + __do_map_lock(AIO) => down_read(node_change) + f2fs_convert_inline_page => update SIT + __do_map_lock(AIO) => up_read(node_change) + f2fs_flush_sit_entries <= inconsistent SIT + finish write checkpoint + sudden-power-off + +If SPO occurs after checkpoint is finished, SIT bitmap will be set +incorrectly. + +Signed-off-by: Sheng Yong +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 17049b030b6c..e90ca6aa3a00 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -2326,6 +2326,7 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi, + bool locked = false; + struct extent_info ei = {0,0,0}; + int err = 0; ++ int flag; + + /* + * we already allocated all the blocks, so we don't need to get +@@ -2335,9 +2336,15 @@ static int prepare_write_begin(struct f2fs_sb_info *sbi, + !is_inode_flag_set(inode, FI_NO_PREALLOC)) + return 0; + ++ /* f2fs_lock_op avoids race between write CP and convert_inline_page */ ++ if (f2fs_has_inline_data(inode) && pos + len > MAX_INLINE_DATA(inode)) ++ flag = F2FS_GET_BLOCK_DEFAULT; ++ else ++ flag = F2FS_GET_BLOCK_PRE_AIO; ++ + if (f2fs_has_inline_data(inode) || + (pos & PAGE_MASK) >= i_size_read(inode)) { +- __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, true); ++ __do_map_lock(sbi, flag, true); + locked = true; + } + restart: +@@ -2375,6 +2382,7 @@ restart: + f2fs_put_dnode(&dn); + __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, + true); ++ WARN_ON(flag != F2FS_GET_BLOCK_PRE_AIO); + locked = true; + goto restart; + } +@@ -2388,7 +2396,7 @@ out: + f2fs_put_dnode(&dn); + unlock_out: + if (locked) +- __do_map_lock(sbi, F2FS_GET_BLOCK_PRE_AIO, false); ++ __do_map_lock(sbi, flag, false); + return err; + } + +-- +2.19.1 + diff --git a/queue-4.20/f2fs-fix-sbi-extent_list-corruption-issue.patch b/queue-4.20/f2fs-fix-sbi-extent_list-corruption-issue.patch new file mode 100644 index 00000000000..2d6c2ba90b5 --- /dev/null +++ b/queue-4.20/f2fs-fix-sbi-extent_list-corruption-issue.patch @@ -0,0 +1,92 @@ +From 659ec4f67ae9fd2f3d590bcc421f95c3fb3ecd2a Mon Sep 17 00:00:00 2001 +From: Sahitya Tummala +Date: Tue, 18 Dec 2018 16:39:24 +0530 +Subject: f2fs: fix sbi->extent_list corruption issue + +[ Upstream commit e4589fa545e0020dbbc3c9bde35f35f949901392 ] + +When there is a failure in f2fs_fill_super() after/during +the recovery of fsync'd nodes, it frees the current sbi and +retries again. This time the mount is successful, but the files +that got recovered before retry, still holds the extent tree, +whose extent nodes list is corrupted since sbi and sbi->extent_list +is freed up. The list_del corruption issue is observed when the +file system is getting unmounted and when those recoverd files extent +node is being freed up in the below context. + +list_del corruption. prev->next should be fffffff1e1ef5480, but was (null) +<...> +kernel BUG at kernel/msm-4.14/lib/list_debug.c:53! +lr : __list_del_entry_valid+0x94/0xb4 +pc : __list_del_entry_valid+0x94/0xb4 +<...> +Call trace: +__list_del_entry_valid+0x94/0xb4 +__release_extent_node+0xb0/0x114 +__free_extent_tree+0x58/0x7c +f2fs_shrink_extent_tree+0xdc/0x3b0 +f2fs_leave_shrinker+0x28/0x7c +f2fs_put_super+0xfc/0x1e0 +generic_shutdown_super+0x70/0xf4 +kill_block_super+0x2c/0x5c +kill_f2fs_super+0x44/0x50 +deactivate_locked_super+0x60/0x8c +deactivate_super+0x68/0x74 +cleanup_mnt+0x40/0x78 +__cleanup_mnt+0x1c/0x28 +task_work_run+0x48/0xd0 +do_notify_resume+0x678/0xe98 +work_pending+0x8/0x14 + +Fix this by not creating extents for those recovered files if shrinker is +not registered yet. Once mount is successful and shrinker is registered, +those files can have extents again. + +Signed-off-by: Sahitya Tummala +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 11 ++++++++++- + fs/f2fs/shrinker.c | 2 +- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index ebad864c031c..6713060a59fb 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -2673,10 +2673,19 @@ static inline bool is_dot_dotdot(const struct qstr *str) + + static inline bool f2fs_may_extent_tree(struct inode *inode) + { +- if (!test_opt(F2FS_I_SB(inode), EXTENT_CACHE) || ++ struct f2fs_sb_info *sbi = F2FS_I_SB(inode); ++ ++ if (!test_opt(sbi, EXTENT_CACHE) || + is_inode_flag_set(inode, FI_NO_EXTENT)) + return false; + ++ /* ++ * for recovered files during mount do not create extents ++ * if shrinker is not registered. ++ */ ++ if (list_empty(&sbi->s_list)) ++ return false; ++ + return S_ISREG(inode->i_mode); + } + +diff --git a/fs/f2fs/shrinker.c b/fs/f2fs/shrinker.c +index 9e13db994fdf..a467aca29cfe 100644 +--- a/fs/f2fs/shrinker.c ++++ b/fs/f2fs/shrinker.c +@@ -135,6 +135,6 @@ void f2fs_leave_shrinker(struct f2fs_sb_info *sbi) + f2fs_shrink_extent_tree(sbi, __count_extent_cache(sbi)); + + spin_lock(&f2fs_list_lock); +- list_del(&sbi->s_list); ++ list_del_init(&sbi->s_list); + spin_unlock(&f2fs_list_lock); + } +-- +2.19.1 + diff --git a/queue-4.20/f2fs-fix-to-reorder-set_page_dirty-and-wait_on_page_.patch b/queue-4.20/f2fs-fix-to-reorder-set_page_dirty-and-wait_on_page_.patch new file mode 100644 index 00000000000..618736698e2 --- /dev/null +++ b/queue-4.20/f2fs-fix-to-reorder-set_page_dirty-and-wait_on_page_.patch @@ -0,0 +1,116 @@ +From 639861aee5681e416faa43a98d4b24dd66ef3d1c Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Wed, 12 Dec 2018 18:12:30 +0800 +Subject: f2fs: fix to reorder set_page_dirty and wait_on_page_writeback + +[ Upstream commit 8d64d365aed355b2e2465d19ba61df02462fff4d ] + +This patch reorders flow from + +- update page +- set_page_dirty +- wait_on_page_writeback + +to + +- wait_on_page_writeback +- update page +- set_page_dirty + +The reason is: +- set_page_dirty will increase reference of dirty page, the reference +should be cleared before wait_on_page_writeback to keep its consistency. +- some devices need stable page during page writebacking, so we +should not change page's data. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/checkpoint.c | 7 ++++--- + fs/f2fs/gc.c | 5 +++-- + fs/f2fs/node.c | 5 +++-- + fs/f2fs/segment.c | 3 ++- + 4 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 9c28ea439e0b..e5719fcac47d 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1290,11 +1290,12 @@ static void commit_checkpoint(struct f2fs_sb_info *sbi, + struct page *page = f2fs_grab_meta_page(sbi, blk_addr); + int err; + +- memcpy(page_address(page), src, PAGE_SIZE); +- set_page_dirty(page); +- + f2fs_wait_on_page_writeback(page, META, true); + f2fs_bug_on(sbi, PageWriteback(page)); ++ ++ memcpy(page_address(page), src, PAGE_SIZE); ++ ++ set_page_dirty(page); + if (unlikely(!clear_page_dirty_for_io(page))) + f2fs_bug_on(sbi, 1); + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index c96e7c6354ef..74f72dccab57 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -812,8 +812,8 @@ static int move_data_block(struct inode *inode, block_t bidx, + } + + write_page: +- set_page_dirty(fio.encrypted_page); + f2fs_wait_on_page_writeback(fio.encrypted_page, DATA, true); ++ set_page_dirty(fio.encrypted_page); + if (clear_page_dirty_for_io(fio.encrypted_page)) + dec_page_count(fio.sbi, F2FS_DIRTY_META); + +@@ -907,8 +907,9 @@ static int move_data_page(struct inode *inode, block_t bidx, int gc_type, + bool is_dirty = PageDirty(page); + + retry: +- set_page_dirty(page); + f2fs_wait_on_page_writeback(page, DATA, true); ++ ++ set_page_dirty(page); + if (clear_page_dirty_for_io(page)) { + inode_dec_dirty_pages(inode); + f2fs_remove_dirty_inode(inode); +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 88be946dedd4..33fb3f8aeafa 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1598,10 +1598,11 @@ int f2fs_move_node_page(struct page *node_page, int gc_type) + .for_reclaim = 0, + }; + +- set_page_dirty(node_page); + f2fs_wait_on_page_writeback(node_page, NODE, true); +- + f2fs_bug_on(F2FS_P_SB(node_page), PageWriteback(node_page)); ++ ++ set_page_dirty(node_page); ++ + if (!clear_page_dirty_for_io(node_page)) { + err = -EAGAIN; + goto out_page; +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 6edcf8391dd3..8f3578c5230e 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -387,8 +387,9 @@ static int __f2fs_commit_inmem_pages(struct inode *inode) + if (page->mapping == inode->i_mapping) { + trace_f2fs_commit_inmem_page(page, INMEM); + +- set_page_dirty(page); + f2fs_wait_on_page_writeback(page, DATA, true); ++ ++ set_page_dirty(page); + if (clear_page_dirty_for_io(page)) { + inode_dec_dirty_pages(inode); + f2fs_remove_dirty_inode(inode); +-- +2.19.1 + diff --git a/queue-4.20/f2fs-fix-use-after-free-issue-when-accessing-sbi-sta.patch b/queue-4.20/f2fs-fix-use-after-free-issue-when-accessing-sbi-sta.patch new file mode 100644 index 00000000000..4b6cecc331b --- /dev/null +++ b/queue-4.20/f2fs-fix-use-after-free-issue-when-accessing-sbi-sta.patch @@ -0,0 +1,120 @@ +From e712e9d3799e7975a3b66db78f5138b1860fc25c Mon Sep 17 00:00:00 2001 +From: Sahitya Tummala +Date: Wed, 26 Dec 2018 11:20:29 +0530 +Subject: f2fs: fix use-after-free issue when accessing sbi->stat_info + +[ Upstream commit 60aa4d5536ab7fe32433ca1173bd9d6633851f27 ] + +iput() on sbi->node_inode can update sbi->stat_info +in the below context, if the f2fs_write_checkpoint() +has failed with error. + +f2fs_balance_fs_bg+0x1ac/0x1ec +f2fs_write_node_pages+0x4c/0x260 +do_writepages+0x80/0xbc +__writeback_single_inode+0xdc/0x4ac +writeback_single_inode+0x9c/0x144 +write_inode_now+0xc4/0xec +iput+0x194/0x22c +f2fs_put_super+0x11c/0x1e8 +generic_shutdown_super+0x70/0xf4 +kill_block_super+0x2c/0x5c +kill_f2fs_super+0x44/0x50 +deactivate_locked_super+0x60/0x8c +deactivate_super+0x68/0x74 +cleanup_mnt+0x40/0x78 + +Fix this by moving f2fs_destroy_stats() further below iput() in +both f2fs_put_super() and f2fs_fill_super() paths. + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 855a622fb052..a239472f405a 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1058,9 +1058,6 @@ static void f2fs_put_super(struct super_block *sb) + f2fs_write_checkpoint(sbi, &cpc); + } + +- /* f2fs_write_checkpoint can update stat informaion */ +- f2fs_destroy_stats(sbi); +- + /* + * normally superblock is clean, so we need to release this. + * In addition, EIO will skip do checkpoint, we need this as well. +@@ -1080,6 +1077,12 @@ static void f2fs_put_super(struct super_block *sb) + iput(sbi->node_inode); + iput(sbi->meta_inode); + ++ /* ++ * iput() can update stat information, if f2fs_write_checkpoint() ++ * above failed with error. ++ */ ++ f2fs_destroy_stats(sbi); ++ + /* destroy f2fs internal modules */ + f2fs_destroy_node_manager(sbi); + f2fs_destroy_segment_manager(sbi); +@@ -3256,30 +3259,30 @@ try_onemore: + + f2fs_build_gc_manager(sbi); + ++ err = f2fs_build_stats(sbi); ++ if (err) ++ goto free_nm; ++ + /* get an inode for node space */ + sbi->node_inode = f2fs_iget(sb, F2FS_NODE_INO(sbi)); + if (IS_ERR(sbi->node_inode)) { + f2fs_msg(sb, KERN_ERR, "Failed to read node inode"); + err = PTR_ERR(sbi->node_inode); +- goto free_nm; ++ goto free_stats; + } + +- err = f2fs_build_stats(sbi); +- if (err) +- goto free_node_inode; +- + /* read root inode and dentry */ + root = f2fs_iget(sb, F2FS_ROOT_INO(sbi)); + if (IS_ERR(root)) { + f2fs_msg(sb, KERN_ERR, "Failed to read root inode"); + err = PTR_ERR(root); +- goto free_stats; ++ goto free_node_inode; + } + if (!S_ISDIR(root->i_mode) || !root->i_blocks || + !root->i_size || !root->i_nlink) { + iput(root); + err = -EINVAL; +- goto free_stats; ++ goto free_node_inode; + } + + sb->s_root = d_make_root(root); /* allocate root dentry */ +@@ -3403,12 +3406,12 @@ free_meta: + free_root_inode: + dput(sb->s_root); + sb->s_root = NULL; +-free_stats: +- f2fs_destroy_stats(sbi); + free_node_inode: + f2fs_release_ino_entry(sbi, true); + truncate_inode_pages_final(NODE_MAPPING(sbi)); + iput(sbi->node_inode); ++free_stats: ++ f2fs_destroy_stats(sbi); + free_nm: + f2fs_destroy_node_manager(sbi); + free_sm: +-- +2.19.1 + diff --git a/queue-4.20/f2fs-fix-wrong-return-value-of-f2fs_acl_create.patch b/queue-4.20/f2fs-fix-wrong-return-value-of-f2fs_acl_create.patch new file mode 100644 index 00000000000..60d207c23be --- /dev/null +++ b/queue-4.20/f2fs-fix-wrong-return-value-of-f2fs_acl_create.patch @@ -0,0 +1,61 @@ +From 008a7d71ef14f143c254d418d3e5e85c059946e2 Mon Sep 17 00:00:00 2001 +From: Tiezhu Yang +Date: Wed, 21 Nov 2018 07:21:38 +0800 +Subject: f2fs: fix wrong return value of f2fs_acl_create + +[ Upstream commit f6176473a0c7472380eef72ebeb330cf9485bf0a ] + +When call f2fs_acl_create_masq() failed, the caller f2fs_acl_create() +should return -EIO instead of -ENOMEM, this patch makes it consistent +with posix_acl_create() which has been fixed in commit beaf226b863a +("posix_acl: don't ignore return value of posix_acl_create_masq()"). + +Fixes: 83dfe53c185e ("f2fs: fix reference leaks in f2fs_acl_create") +Signed-off-by: Tiezhu Yang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/acl.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c +index fa707cdd4120..22f0d17cde43 100644 +--- a/fs/f2fs/acl.c ++++ b/fs/f2fs/acl.c +@@ -352,12 +352,14 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode, + return PTR_ERR(p); + + clone = f2fs_acl_clone(p, GFP_NOFS); +- if (!clone) +- goto no_mem; ++ if (!clone) { ++ ret = -ENOMEM; ++ goto release_acl; ++ } + + ret = f2fs_acl_create_masq(clone, mode); + if (ret < 0) +- goto no_mem_clone; ++ goto release_clone; + + if (ret == 0) + posix_acl_release(clone); +@@ -371,11 +373,11 @@ static int f2fs_acl_create(struct inode *dir, umode_t *mode, + + return 0; + +-no_mem_clone: ++release_clone: + posix_acl_release(clone); +-no_mem: ++release_acl: + posix_acl_release(p); +- return -ENOMEM; ++ return ret; + } + + int f2fs_init_acl(struct inode *inode, struct inode *dir, struct page *ipage, +-- +2.19.1 + diff --git a/queue-4.20/f2fs-move-dir-data-flush-to-write-checkpoint-process.patch b/queue-4.20/f2fs-move-dir-data-flush-to-write-checkpoint-process.patch new file mode 100644 index 00000000000..b5906fc300a --- /dev/null +++ b/queue-4.20/f2fs-move-dir-data-flush-to-write-checkpoint-process.patch @@ -0,0 +1,48 @@ +From f8cf36b66eedfb85af1bdd62e19e5af3d7c879ab Mon Sep 17 00:00:00 2001 +From: Yunlei He +Date: Tue, 6 Nov 2018 10:25:29 +0800 +Subject: f2fs: move dir data flush to write checkpoint process + +[ Upstream commit b61ac5b720146c619c7cdf17eff2551b934399e5 ] + +This patch move dir data flush to write checkpoint process, by +doing this, it may reduce some time for dir fsync. + +pre: + -f2fs_do_sync_file enter + -file_write_and_wait_range <- flush & wait + -write_checkpoint + -do_checkpoint <- wait all + -f2fs_do_sync_file exit + +now: + -f2fs_do_sync_file enter + -write_checkpoint + -block_operations <- flush dir & no wait + -do_checkpoint <- wait all + -f2fs_do_sync_file exit + +Signed-off-by: Yunlei He +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 88b124677189..9eaf07fd8b4c 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -216,6 +216,9 @@ static int f2fs_do_sync_file(struct file *file, loff_t start, loff_t end, + + trace_f2fs_sync_file_enter(inode); + ++ if (S_ISDIR(inode->i_mode)) ++ goto go_write; ++ + /* if fdatasync is triggered, let's do in-place-update */ + if (datasync || get_dirty_pages(inode) <= SM_I(sbi)->min_fsync_blocks) + set_inode_flag(inode, FI_NEED_IPU); +-- +2.19.1 + diff --git a/queue-4.20/fbdev-fbcon-fix-unregister-crash-when-more-than-one-.patch b/queue-4.20/fbdev-fbcon-fix-unregister-crash-when-more-than-one-.patch new file mode 100644 index 00000000000..dd331a72b25 --- /dev/null +++ b/queue-4.20/fbdev-fbcon-fix-unregister-crash-when-more-than-one-.patch @@ -0,0 +1,84 @@ +From 040aa40c7ce3a84ad1ed817d884ef0288bc126ea Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Noralf=20Tr=C3=B8nnes?= +Date: Thu, 20 Dec 2018 19:13:09 +0100 +Subject: fbdev: fbcon: Fix unregister crash when more than one framebuffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 2122b40580dd9d0620398739c773d07a7b7939d0 ] + +When unregistering fbdev using unregister_framebuffer(), any bound +console will unbind automatically. This is working fine if this is the +only framebuffer, resulting in a switch to the dummy console. However if +there is a fb0 and I unregister fb1 having a bound console, I eventually +get a crash. The fastest way for me to trigger the crash is to do a +reboot, resulting in this splat: + +[ 76.478825] WARNING: CPU: 0 PID: 527 at linux/kernel/workqueue.c:1442 __queue_work+0x2d4/0x41c +[ 76.478849] Modules linked in: raspberrypi_hwmon gpio_backlight backlight bcm2835_rng rng_core [last unloaded: tinydrm] +[ 76.478916] CPU: 0 PID: 527 Comm: systemd-udevd Not tainted 4.20.0-rc4+ #4 +[ 76.478933] Hardware name: BCM2835 +[ 76.478949] Backtrace: +[ 76.478995] [] (dump_backtrace) from [] (show_stack+0x20/0x24) +[ 76.479022] r6:00000000 r5:c0bc73be r4:00000000 r3:6fb5bf81 +[ 76.479060] [] (show_stack) from [] (dump_stack+0x20/0x28) +[ 76.479102] [] (dump_stack) from [] (__warn+0xec/0x12c) +[ 76.479134] [] (__warn) from [] (warn_slowpath_null+0x4c/0x58) +[ 76.479165] r9:c0eb6944 r8:00000001 r7:c0e927f8 r6:c0bc73be r5:000005a2 r4:c0139e84 +[ 76.479197] [] (warn_slowpath_null) from [] (__queue_work+0x2d4/0x41c) +[ 76.479222] r6:d7666a00 r5:c0e918ee r4:dbc4e700 +[ 76.479251] [] (__queue_work) from [] (queue_work_on+0x60/0x88) +[ 76.479281] r10:c0496bf8 r9:00000100 r8:c0e92ae0 r7:00000001 r6:d9403700 r5:d7666a00 +[ 76.479298] r4:20000113 +[ 76.479348] [] (queue_work_on) from [] (cursor_timer_handler+0x30/0x54) +[ 76.479374] r7:d8a8fabc r6:c0e08088 r5:d8afdc5c r4:d8a8fabc +[ 76.479413] [] (cursor_timer_handler) from [] (call_timer_fn+0x100/0x230) +[ 76.479435] r4:c0e9192f r3:d758a340 +[ 76.479465] [] (call_timer_fn) from [] (expire_timers+0x10c/0x12c) +[ 76.479495] r10:40000000 r9:c0e9192f r8:c0e92ae0 r7:d8afdccc r6:c0e19280 r5:c0496bf8 +[ 76.479513] r4:d8a8fabc +[ 76.479541] [] (expire_timers) from [] (run_timer_softirq+0xa8/0x184) +[ 76.479570] r9:00000001 r8:c0e19280 r7:00000000 r6:c0e08088 r5:c0e1a3e0 r4:c0e19280 +[ 76.479603] [] (run_timer_softirq) from [] (__do_softirq+0x1ac/0x3fc) +[ 76.479632] r10:c0e91680 r9:d8afc020 r8:0000000a r7:00000100 r6:00000001 r5:00000002 +[ 76.479650] r4:c0eb65ec +[ 76.479686] [] (__do_softirq) from [] (irq_exit+0xe8/0x168) +[ 76.479716] r10:d8d1a9b0 r9:d8afc000 r8:00000001 r7:d949c000 r6:00000000 r5:c0e8b3f0 +[ 76.479734] r4:00000000 +[ 76.479764] [] (irq_exit) from [] (__handle_domain_irq+0x94/0xb0) +[ 76.479793] [] (__handle_domain_irq) from [] (bcm2835_handle_irq+0x3c/0x48) +[ 76.479823] r8:d8afdebc r7:d8afddfc r6:ffffffff r5:c0e089f8 r4:d8afddc8 r3:d8afddc8 +[ 76.479851] [] (bcm2835_handle_irq) from [] (__irq_svc+0x70/0x98) + +The problem is in the console rebinding in fbcon_fb_unbind(). It uses the +virtual console index as the new framebuffer index to bind the console(s) +to. The correct way is to use the con2fb_map lookup table to find the +framebuffer index. + +Fixes: cfafca8067c6 ("fbdev: fbcon: console unregistration from unregister_framebuffer") +Signed-off-by: Noralf Trønnes +Reviewed-by: Mikulas Patocka +Acked-by: Daniel Vetter +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index 8958ccc8b1ac..8976190b6c1f 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -3064,7 +3064,7 @@ static int fbcon_fb_unbind(int idx) + for (i = first_fb_vc; i <= last_fb_vc; i++) { + if (con2fb_map[i] != idx && + con2fb_map[i] != -1) { +- new_idx = i; ++ new_idx = con2fb_map[i]; + break; + } + } +-- +2.19.1 + diff --git a/queue-4.20/fbdev-fbmem-behave-better-with-small-rotated-display.patch b/queue-4.20/fbdev-fbmem-behave-better-with-small-rotated-display.patch new file mode 100644 index 00000000000..e04dcae3e53 --- /dev/null +++ b/queue-4.20/fbdev-fbmem-behave-better-with-small-rotated-display.patch @@ -0,0 +1,62 @@ +From af742e5d70130b5b6f413a30394c20ae5d5c4c7c Mon Sep 17 00:00:00 2001 +From: Peter Rosin +Date: Thu, 20 Dec 2018 19:13:07 +0100 +Subject: fbdev: fbmem: behave better with small rotated displays and many CPUs + +[ Upstream commit f75df8d4b4fabfad7e3cba2debfad12741c6fde7 ] + +Blitting an image with "negative" offsets is not working since there +is no clipping. It hopefully just crashes. For the bootup logo, there +is protection so that blitting does not happen as the image is drawn +further and further to the right (ROTATE_UR) or further and further +down (ROTATE_CW). There is however no protection when drawing in the +opposite directions (ROTATE_UD and ROTATE_CCW). + +Add back this protection. + +The regression is 20-odd years old but the mindless warning-killing +mentality displayed in commit 34bdb666f4b2 ("fbdev: fbmem: remove +positive test on unsigned values") is also to blame, methinks. + +Fixes: 448d479747b8 ("fbdev: fb_do_show_logo() updates") +Signed-off-by: Peter Rosin +Cc: Tomi Valkeinen +Cc: Fabian Frederick +Cc: Geert Uytterhoeven +cc: Geoff Levand +Cc: James Simmons +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbmem.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index 861bf8081619..7dd6924feaa8 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -436,7 +436,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, + image->dx += image->width + 8; + } + } else if (rotate == FB_ROTATE_UD) { +- for (x = 0; x < num; x++) { ++ u32 dx = image->dx; ++ ++ for (x = 0; x < num && image->dx <= dx; x++) { + info->fbops->fb_imageblit(info, image); + image->dx -= image->width + 8; + } +@@ -448,7 +450,9 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image, + image->dy += image->height + 8; + } + } else if (rotate == FB_ROTATE_CCW) { +- for (x = 0; x < num; x++) { ++ u32 dy = image->dy; ++ ++ for (x = 0; x < num && image->dy <= dy; x++) { + info->fbops->fb_imageblit(info, image); + image->dy -= image->height + 8; + } +-- +2.19.1 + diff --git a/queue-4.20/firmware-efi-add-null-pointer-checks-in-efivars-api-.patch b/queue-4.20/firmware-efi-add-null-pointer-checks-in-efivars-api-.patch new file mode 100644 index 00000000000..1954f9f3d88 --- /dev/null +++ b/queue-4.20/firmware-efi-add-null-pointer-checks-in-efivars-api-.patch @@ -0,0 +1,318 @@ +From 76917eca06058970ef0cafb71a5a9024c5359585 Mon Sep 17 00:00:00 2001 +From: Arend van Spriel +Date: Thu, 29 Nov 2018 18:12:27 +0100 +Subject: firmware/efi: Add NULL pointer checks in efivars API functions + +[ Upstream commit ab2180a15ce54739fed381efb4cb12e78dfb1561 ] + +Since commit: + + ce2e6db554fa ("brcmfmac: Add support for getting nvram contents from EFI variables") + +we have a device driver accessing the efivars API. Several functions in +the efivars API assume __efivars is set, i.e., that they will be accessed +only after efivars_register() has been called. However, the following NULL +pointer access was reported calling efivar_entry_size() from the brcmfmac +device driver: + + Unable to handle kernel NULL pointer dereference at virtual address 00000008 + pgd = 60bfa5f1 + [00000008] *pgd=00000000 + Internal error: Oops: 5 [#1] SMP ARM + ... + Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) + Workqueue: events request_firmware_work_func + PC is at efivar_entry_size+0x28/0x90 + LR is at brcmf_fw_complete_request+0x3f8/0x8d4 [brcmfmac] + pc : [] lr : [] psr: a00d0113 + sp : ede7fe28 ip : ee983410 fp : c1787f30 + r10: 00000000 r9 : 00000000 r8 : bf2b2258 + r7 : ee983000 r6 : c1604c48 r5 : ede7fe88 r4 : edf337c0 + r3 : 00000000 r2 : 00000000 r1 : ede7fe88 r0 : c17712c8 + Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none + Control: 10c5387d Table: ad16804a DAC: 00000051 + +Disassembly showed that the local static variable __efivars is NULL, +which is not entirely unexpected given that it is a non-EFI platform. + +So add a NULL pointer check to efivar_entry_size(), and to related +functions while at it. In efivars_register() a couple of sanity checks +are added as well. + +Reported-by: Jon Hunter +Signed-off-by: Arend van Spriel +Signed-off-by: Ard Biesheuvel +Cc: Andy Lutomirski +Cc: Bhupesh Sharma +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: Eric Snowberg +Cc: Hans de Goede +Cc: Joe Perches +Cc: Julien Thierry +Cc: Linus Torvalds +Cc: Marc Zyngier +Cc: Matt Fleming +Cc: Nathan Chancellor +Cc: Peter Zijlstra +Cc: Sai Praneeth Prakhya +Cc: Sedat Dilek +Cc: Thomas Gleixner +Cc: YiFei Zhu +Cc: linux-efi@vger.kernel.org +Link: http://lkml.kernel.org/r/20181129171230.18699-9-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/vars.c | 99 +++++++++++++++++++++++++++++-------- + 1 file changed, 78 insertions(+), 21 deletions(-) + +diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c +index 9336ffdf6e2c..fceaafd67ec6 100644 +--- a/drivers/firmware/efi/vars.c ++++ b/drivers/firmware/efi/vars.c +@@ -318,7 +318,12 @@ EXPORT_SYMBOL_GPL(efivar_variable_is_removable); + static efi_status_t + check_var_size(u32 attributes, unsigned long size) + { +- const struct efivar_operations *fops = __efivars->ops; ++ const struct efivar_operations *fops; ++ ++ if (!__efivars) ++ return EFI_UNSUPPORTED; ++ ++ fops = __efivars->ops; + + if (!fops->query_variable_store) + return EFI_UNSUPPORTED; +@@ -329,7 +334,12 @@ check_var_size(u32 attributes, unsigned long size) + static efi_status_t + check_var_size_nonblocking(u32 attributes, unsigned long size) + { +- const struct efivar_operations *fops = __efivars->ops; ++ const struct efivar_operations *fops; ++ ++ if (!__efivars) ++ return EFI_UNSUPPORTED; ++ ++ fops = __efivars->ops; + + if (!fops->query_variable_store) + return EFI_UNSUPPORTED; +@@ -429,13 +439,18 @@ static void dup_variable_bug(efi_char16_t *str16, efi_guid_t *vendor_guid, + int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *), + void *data, bool duplicates, struct list_head *head) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + unsigned long variable_name_size = 1024; + efi_char16_t *variable_name; + efi_status_t status; + efi_guid_t vendor_guid; + int err = 0; + ++ if (!__efivars) ++ return -EFAULT; ++ ++ ops = __efivars->ops; ++ + variable_name = kzalloc(variable_name_size, GFP_KERNEL); + if (!variable_name) { + printk(KERN_ERR "efivars: Memory allocation failed.\n"); +@@ -583,12 +598,14 @@ static void efivar_entry_list_del_unlock(struct efivar_entry *entry) + */ + int __efivar_entry_delete(struct efivar_entry *entry) + { +- const struct efivar_operations *ops = __efivars->ops; + efi_status_t status; + +- status = ops->set_variable(entry->var.VariableName, +- &entry->var.VendorGuid, +- 0, 0, NULL); ++ if (!__efivars) ++ return -EINVAL; ++ ++ status = __efivars->ops->set_variable(entry->var.VariableName, ++ &entry->var.VendorGuid, ++ 0, 0, NULL); + + return efi_status_to_err(status); + } +@@ -607,12 +624,17 @@ EXPORT_SYMBOL_GPL(__efivar_entry_delete); + */ + int efivar_entry_delete(struct efivar_entry *entry) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_status_t status; + + if (down_interruptible(&efivars_lock)) + return -EINTR; + ++ if (!__efivars) { ++ up(&efivars_lock); ++ return -EINVAL; ++ } ++ ops = __efivars->ops; + status = ops->set_variable(entry->var.VariableName, + &entry->var.VendorGuid, + 0, 0, NULL); +@@ -650,13 +672,19 @@ EXPORT_SYMBOL_GPL(efivar_entry_delete); + int efivar_entry_set(struct efivar_entry *entry, u32 attributes, + unsigned long size, void *data, struct list_head *head) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_status_t status; + efi_char16_t *name = entry->var.VariableName; + efi_guid_t vendor = entry->var.VendorGuid; + + if (down_interruptible(&efivars_lock)) + return -EINTR; ++ ++ if (!__efivars) { ++ up(&efivars_lock); ++ return -EINVAL; ++ } ++ ops = __efivars->ops; + if (head && efivar_entry_find(name, vendor, head, false)) { + up(&efivars_lock); + return -EEXIST; +@@ -687,12 +715,17 @@ static int + efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor, + u32 attributes, unsigned long size, void *data) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_status_t status; + + if (down_trylock(&efivars_lock)) + return -EBUSY; + ++ if (!__efivars) { ++ up(&efivars_lock); ++ return -EINVAL; ++ } ++ + status = check_var_size_nonblocking(attributes, + size + ucs2_strsize(name, 1024)); + if (status != EFI_SUCCESS) { +@@ -700,6 +733,7 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor, + return -ENOSPC; + } + ++ ops = __efivars->ops; + status = ops->set_variable_nonblocking(name, &vendor, attributes, + size, data); + +@@ -727,9 +761,13 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor, + int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes, + bool block, unsigned long size, void *data) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_status_t status; + ++ if (!__efivars) ++ return -EINVAL; ++ ++ ops = __efivars->ops; + if (!ops->query_variable_store) + return -ENOSYS; + +@@ -829,13 +867,18 @@ EXPORT_SYMBOL_GPL(efivar_entry_find); + */ + int efivar_entry_size(struct efivar_entry *entry, unsigned long *size) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_status_t status; + + *size = 0; + + if (down_interruptible(&efivars_lock)) + return -EINTR; ++ if (!__efivars) { ++ up(&efivars_lock); ++ return -EINVAL; ++ } ++ ops = __efivars->ops; + status = ops->get_variable(entry->var.VariableName, + &entry->var.VendorGuid, NULL, size, NULL); + up(&efivars_lock); +@@ -861,12 +904,14 @@ EXPORT_SYMBOL_GPL(efivar_entry_size); + int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes, + unsigned long *size, void *data) + { +- const struct efivar_operations *ops = __efivars->ops; + efi_status_t status; + +- status = ops->get_variable(entry->var.VariableName, +- &entry->var.VendorGuid, +- attributes, size, data); ++ if (!__efivars) ++ return -EINVAL; ++ ++ status = __efivars->ops->get_variable(entry->var.VariableName, ++ &entry->var.VendorGuid, ++ attributes, size, data); + + return efi_status_to_err(status); + } +@@ -882,14 +927,19 @@ EXPORT_SYMBOL_GPL(__efivar_entry_get); + int efivar_entry_get(struct efivar_entry *entry, u32 *attributes, + unsigned long *size, void *data) + { +- const struct efivar_operations *ops = __efivars->ops; + efi_status_t status; + + if (down_interruptible(&efivars_lock)) + return -EINTR; +- status = ops->get_variable(entry->var.VariableName, +- &entry->var.VendorGuid, +- attributes, size, data); ++ ++ if (!__efivars) { ++ up(&efivars_lock); ++ return -EINVAL; ++ } ++ ++ status = __efivars->ops->get_variable(entry->var.VariableName, ++ &entry->var.VendorGuid, ++ attributes, size, data); + up(&efivars_lock); + + return efi_status_to_err(status); +@@ -921,7 +971,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_get); + int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes, + unsigned long *size, void *data, bool *set) + { +- const struct efivar_operations *ops = __efivars->ops; ++ const struct efivar_operations *ops; + efi_char16_t *name = entry->var.VariableName; + efi_guid_t *vendor = &entry->var.VendorGuid; + efi_status_t status; +@@ -940,6 +990,11 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes, + if (down_interruptible(&efivars_lock)) + return -EINTR; + ++ if (!__efivars) { ++ err = -EINVAL; ++ goto out; ++ } ++ + /* + * Ensure that the available space hasn't shrunk below the safe level + */ +@@ -956,6 +1011,8 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes, + } + } + ++ ops = __efivars->ops; ++ + status = ops->set_variable(name, vendor, attributes, *size, data); + if (status != EFI_SUCCESS) { + err = efi_status_to_err(status); +-- +2.19.1 + diff --git a/queue-4.20/fix-dma-buf-udmabuf-selftest.patch b/queue-4.20/fix-dma-buf-udmabuf-selftest.patch new file mode 100644 index 00000000000..206eb616970 --- /dev/null +++ b/queue-4.20/fix-dma-buf-udmabuf-selftest.patch @@ -0,0 +1,82 @@ +From 5641964e7d8e23b77020bdd8720a937ada8dda0e Mon Sep 17 00:00:00 2001 +From: Tom Murphy +Date: Tue, 27 Nov 2018 10:33:08 +0000 +Subject: fix dma-buf/udmabuf selftest + +[ Upstream commit 6edf2e3710f4ef2555ad7a2681dbeb4a69092b2d ] + +This patch fixes the udmabuf selftest. Currently the selftest is broken. +I fixed the selftest by setting the F_SEAL_SHRINK seal on the memfd +file descriptor which is required by udmabuf and added the test to +the selftest Makefile. + +Signed-off-by: Tom Murphy +Reviewed-by: Gerd Hoffmann +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/Makefile | 1 + + tools/testing/selftests/drivers/dma-buf/Makefile | 2 ++ + tools/testing/selftests/drivers/dma-buf/udmabuf.c | 11 +++++++++-- + 3 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index f0017c831e57..a43a07a09a98 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -6,6 +6,7 @@ TARGETS += capabilities + TARGETS += cgroup + TARGETS += cpufreq + TARGETS += cpu-hotplug ++TARGETS += drivers/dma-buf + TARGETS += efivarfs + TARGETS += exec + TARGETS += filesystems +diff --git a/tools/testing/selftests/drivers/dma-buf/Makefile b/tools/testing/selftests/drivers/dma-buf/Makefile +index 4154c3d7aa58..f22c3f7cf612 100644 +--- a/tools/testing/selftests/drivers/dma-buf/Makefile ++++ b/tools/testing/selftests/drivers/dma-buf/Makefile +@@ -2,4 +2,6 @@ CFLAGS += -I../../../../../usr/include/ + + TEST_GEN_PROGS := udmabuf + ++top_srcdir ?=../../../../.. ++ + include ../../lib.mk +diff --git a/tools/testing/selftests/drivers/dma-buf/udmabuf.c b/tools/testing/selftests/drivers/dma-buf/udmabuf.c +index 376b1d6730bd..4de902ea14d8 100644 +--- a/tools/testing/selftests/drivers/dma-buf/udmabuf.c ++++ b/tools/testing/selftests/drivers/dma-buf/udmabuf.c +@@ -4,7 +4,7 @@ + #include + #include + #include +-#include ++#include + #include + + #include +@@ -33,12 +33,19 @@ int main(int argc, char *argv[]) + exit(77); + } + +- memfd = memfd_create("udmabuf-test", MFD_CLOEXEC); ++ memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING); + if (memfd < 0) { + printf("%s: [skip,no-memfd]\n", TEST_PREFIX); + exit(77); + } + ++ ret = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK); ++ if (ret < 0) { ++ printf("%s: [skip,fcntl-add-seals]\n", TEST_PREFIX); ++ exit(77); ++ } ++ ++ + size = getpagesize() * NUM_PAGES; + ret = ftruncate(memfd, size); + if (ret == -1) { +-- +2.19.1 + diff --git a/queue-4.20/fpga-altera-cvp-fix-bad-io-access-on-x86_64.patch b/queue-4.20/fpga-altera-cvp-fix-bad-io-access-on-x86_64.patch new file mode 100644 index 00000000000..b4f968aee06 --- /dev/null +++ b/queue-4.20/fpga-altera-cvp-fix-bad-io-access-on-x86_64.patch @@ -0,0 +1,47 @@ +From 07d42713b8a9a2b2c965ec6d0f2ba53525f522c8 Mon Sep 17 00:00:00 2001 +From: Anatolij Gustschin +Date: Wed, 7 Nov 2018 11:51:45 -0600 +Subject: fpga: altera-cvp: fix 'bad IO access' on x86_64 + +[ Upstream commit 187fade88ca0ff2df9d360ca751d948d73db7095 ] + +If mapping the CvP BAR fails, we still can configure the FPGA via +PCI config space access. In this case the iomap pointer is NULL. +On x86_64, passing NULL address to pci_iounmap() generates +"Bad IO access at port 0x0" output with stack call trace. Fix it. + +Signed-off-by: Anatolij Gustschin +Acked-by: Alan Tull +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/altera-cvp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c +index 36d79b039c57..35c3aa5792e2 100644 +--- a/drivers/fpga/altera-cvp.c ++++ b/drivers/fpga/altera-cvp.c +@@ -478,7 +478,8 @@ static int altera_cvp_probe(struct pci_dev *pdev, + return 0; + + err_unmap: +- pci_iounmap(pdev, conf->map); ++ if (conf->map) ++ pci_iounmap(pdev, conf->map); + pci_release_region(pdev, CVP_BAR); + err_disable: + cmd &= ~PCI_COMMAND_MEMORY; +@@ -493,7 +494,8 @@ static void altera_cvp_remove(struct pci_dev *pdev) + u16 cmd; + + fpga_mgr_unregister(mgr); +- pci_iounmap(pdev, conf->map); ++ if (conf->map) ++ pci_iounmap(pdev, conf->map); + pci_release_region(pdev, CVP_BAR); + pci_read_config_word(pdev, PCI_COMMAND, &cmd); + cmd &= ~PCI_COMMAND_MEMORY; +-- +2.19.1 + diff --git a/queue-4.20/fpga-altera-cvp-fix-registration-for-cvp-incapable-d.patch b/queue-4.20/fpga-altera-cvp-fix-registration-for-cvp-incapable-d.patch new file mode 100644 index 00000000000..45abcac7c4d --- /dev/null +++ b/queue-4.20/fpga-altera-cvp-fix-registration-for-cvp-incapable-d.patch @@ -0,0 +1,52 @@ +From 20a0f4f72fe9eaee848ec1f67e4456302db0eca8 Mon Sep 17 00:00:00 2001 +From: Andreas Puhm +Date: Wed, 7 Nov 2018 11:51:47 -0600 +Subject: fpga: altera-cvp: Fix registration for CvP incapable devices + +[ Upstream commit 68f60538daa4bc3da5d0764d46f391916fba20fd ] + +The probe function needs to verify the CvP enable bit in order to +properly determine if FPGA Manager functionality can be safely +enabled. + +Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver") +Signed-off-by: Andreas Puhm +Signed-off-by: Anatolij Gustschin +Reviewed-by: Moritz Fischer +Acked-by: Alan Tull +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fpga/altera-cvp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c +index d9fa7d4bf11f..36d79b039c57 100644 +--- a/drivers/fpga/altera-cvp.c ++++ b/drivers/fpga/altera-cvp.c +@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev, + struct altera_cvp_conf *conf; + struct fpga_manager *mgr; + u16 cmd, val; ++ u32 regval; + int ret; + + /* +@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev, + return -ENODEV; + } + ++ pci_read_config_dword(pdev, VSE_CVP_STATUS, ®val); ++ if (!(regval & VSE_CVP_STATUS_CVP_EN)) { ++ dev_err(&pdev->dev, ++ "CVP is disabled for this device: CVP_STATUS Reg 0x%x\n", ++ regval); ++ return -ENODEV; ++ } ++ + conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL); + if (!conf) + return -ENOMEM; +-- +2.19.1 + diff --git a/queue-4.20/fs-epoll-drop-ovflist-branch-prediction.patch b/queue-4.20/fs-epoll-drop-ovflist-branch-prediction.patch new file mode 100644 index 00000000000..e8c07c9093b --- /dev/null +++ b/queue-4.20/fs-epoll-drop-ovflist-branch-prediction.patch @@ -0,0 +1,55 @@ +From 4096dc87bdf2968d7887cdab06688849d9aad89b Mon Sep 17 00:00:00 2001 +From: Davidlohr Bueso +Date: Thu, 3 Jan 2019 15:27:09 -0800 +Subject: fs/epoll: drop ovflist branch prediction + +[ Upstream commit 76699a67f3041ff4c7af6d6ee9be2bfbf1ffb671 ] + +The ep->ovflist is a secondary ready-list to temporarily store events +that might occur when doing sproc without holding the ep->wq.lock. This +accounts for every time we check for ready events and also send events +back to userspace; both callbacks, particularly the latter because of +copy_to_user, can account for a non-trivial time. + +As such, the unlikely() check to see if the pointer is being used, seems +both misleading and sub-optimal. In fact, we go to an awful lot of +trouble to sync both lists, and populating the ovflist is far from an +uncommon scenario. + +For example, profiling a concurrent epoll_wait(2) benchmark, with +CONFIG_PROFILE_ANNOTATED_BRANCHES shows that for a two threads a 33% +incorrect rate was seen; and when incrementally increasing the number of +epoll instances (which is used, for example for multiple queuing load +balancing models), up to a 90% incorrect rate was seen. + +Similarly, by deleting the prediction, 3% throughput boost was seen +across incremental threads. + +Link: http://lkml.kernel.org/r/20181108051006.18751-4-dave@stgolabs.net +Signed-off-by: Davidlohr Bueso +Reviewed-by: Andrew Morton +Cc: Al Viro +Cc: Jason Baron +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 42bbe6824b4b..58f48ea0db23 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1154,7 +1154,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v + * semantics). All the events that happen during that period of time are + * chained in ep->ovflist and requeued later on. + */ +- if (unlikely(ep->ovflist != EP_UNACTIVE_PTR)) { ++ if (ep->ovflist != EP_UNACTIVE_PTR) { + if (epi->next == EP_UNACTIVE_PTR) { + epi->next = ep->ovflist; + ep->ovflist = epi; +-- +2.19.1 + diff --git a/queue-4.20/fs-proc-base.c-use-ns_capable-instead-of-capable-for.patch b/queue-4.20/fs-proc-base.c-use-ns_capable-instead-of-capable-for.patch new file mode 100644 index 00000000000..36a8e0b356f --- /dev/null +++ b/queue-4.20/fs-proc-base.c-use-ns_capable-instead-of-capable-for.patch @@ -0,0 +1,77 @@ +From 3152c5232570b2d8b57bf8edfbe594c76c46e139 Mon Sep 17 00:00:00 2001 +From: Benjamin Gordon +Date: Thu, 3 Jan 2019 15:25:56 -0800 +Subject: fs/proc/base.c: use ns_capable instead of capable for timerslack_ns + +[ Upstream commit 8da0b4f692c6d90b09c91f271517db746a22ff67 ] + +Access to timerslack_ns is controlled by a process having CAP_SYS_NICE +in its effective capability set, but the current check looks in the root +namespace instead of the process' user namespace. Since a process is +allowed to do other activities controlled by CAP_SYS_NICE inside a +namespace, it should also be able to adjust timerslack_ns. + +Link: http://lkml.kernel.org/r/20181030180012.232896-1-bmgordon@google.com +Signed-off-by: Benjamin Gordon +Acked-by: "Eric W. Biederman" +Cc: John Stultz +Cc: "Eric W. Biederman" +Cc: Kees Cook +Cc: "Serge E. Hallyn" +Cc: Thomas Gleixner +Cc: Arjan van de Ven +Cc: Oren Laadan +Cc: Ruchi Kandoi +Cc: Rom Lemarchand +Cc: Todd Kjos +Cc: Colin Cross +Cc: Nick Kralevich +Cc: Dmitry Shmidt +Cc: Elliott Hughes +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/proc/base.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index ce3465479447..98525af0953e 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -2356,10 +2356,13 @@ static ssize_t timerslack_ns_write(struct file *file, const char __user *buf, + return -ESRCH; + + if (p != current) { +- if (!capable(CAP_SYS_NICE)) { ++ rcu_read_lock(); ++ if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { ++ rcu_read_unlock(); + count = -EPERM; + goto out; + } ++ rcu_read_unlock(); + + err = security_task_setscheduler(p); + if (err) { +@@ -2392,11 +2395,14 @@ static int timerslack_ns_show(struct seq_file *m, void *v) + return -ESRCH; + + if (p != current) { +- +- if (!capable(CAP_SYS_NICE)) { ++ rcu_read_lock(); ++ if (!ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE)) { ++ rcu_read_unlock(); + err = -EPERM; + goto out; + } ++ rcu_read_unlock(); ++ + err = security_task_getscheduler(p); + if (err) + goto out; +-- +2.19.1 + diff --git a/queue-4.20/fsl-fman-use-gfp_atomic-in-memac-tgec-_add_hash_mac_.patch b/queue-4.20/fsl-fman-use-gfp_atomic-in-memac-tgec-_add_hash_mac_.patch new file mode 100644 index 00000000000..fdc1e7453cc --- /dev/null +++ b/queue-4.20/fsl-fman-use-gfp_atomic-in-memac-tgec-_add_hash_mac_.patch @@ -0,0 +1,73 @@ +From 2c08d780ed8f9861ba21297480ce62c9e87b9353 Mon Sep 17 00:00:00 2001 +From: Scott Wood +Date: Thu, 27 Dec 2018 18:29:09 -0600 +Subject: fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address() + +[ Upstream commit 0d9c9a238faf925823bde866182c663b6d734f2e ] + +These functions are called from atomic context: + +[ 9.150239] BUG: sleeping function called from invalid context at /home/scott/git/linux/mm/slab.h:421 +[ 9.158159] in_atomic(): 1, irqs_disabled(): 0, pid: 4432, name: ip +[ 9.163128] CPU: 8 PID: 4432 Comm: ip Not tainted 4.20.0-rc2-00169-g63d86876f324 #29 +[ 9.163130] Call Trace: +[ 9.170701] [c0000002e899a980] [c0000000009c1068] .dump_stack+0xa8/0xec (unreliable) +[ 9.177140] [c0000002e899aa10] [c00000000007a7b4] .___might_sleep+0x138/0x164 +[ 9.184440] [c0000002e899aa80] [c0000000001d5bac] .kmem_cache_alloc_trace+0x238/0x30c +[ 9.191216] [c0000002e899ab40] [c00000000065ea1c] .memac_add_hash_mac_address+0x104/0x198 +[ 9.199464] [c0000002e899abd0] [c00000000065a788] .set_multi+0x1c8/0x218 +[ 9.206242] [c0000002e899ac80] [c0000000006615ec] .dpaa_set_rx_mode+0xdc/0x17c +[ 9.213544] [c0000002e899ad00] [c00000000083d2b0] .__dev_set_rx_mode+0x80/0xd4 +[ 9.219535] [c0000002e899ad90] [c00000000083d334] .dev_set_rx_mode+0x30/0x54 +[ 9.225271] [c0000002e899ae10] [c00000000083d4a0] .__dev_open+0x148/0x1c8 +[ 9.230751] [c0000002e899aeb0] [c00000000083d934] .__dev_change_flags+0x19c/0x1e0 +[ 9.230755] [c0000002e899af60] [c00000000083d9a4] .dev_change_flags+0x2c/0x80 +[ 9.242752] [c0000002e899aff0] [c0000000008554ec] .do_setlink+0x350/0xf08 +[ 9.248228] [c0000002e899b170] [c000000000857ad0] .rtnl_newlink+0x588/0x7e0 +[ 9.253965] [c0000002e899b740] [c000000000852424] .rtnetlink_rcv_msg+0x3e0/0x498 +[ 9.261440] [c0000002e899b820] [c000000000884790] .netlink_rcv_skb+0x134/0x14c +[ 9.267607] [c0000002e899b8e0] [c000000000851840] .rtnetlink_rcv+0x18/0x2c +[ 9.274558] [c0000002e899b950] [c000000000883c8c] .netlink_unicast+0x214/0x318 +[ 9.281163] [c0000002e899ba00] [c000000000884220] .netlink_sendmsg+0x348/0x444 +[ 9.287076] [c0000002e899bae0] [c00000000080d13c] .sock_sendmsg+0x2c/0x54 +[ 9.287080] [c0000002e899bb50] [c0000000008106c0] .___sys_sendmsg+0x2d0/0x2d8 +[ 9.298375] [c0000002e899bd30] [c000000000811a80] .__sys_sendmsg+0x5c/0xb0 +[ 9.303939] [c0000002e899be20] [c0000000000006b0] system_call+0x60/0x6c + +Signed-off-by: Scott Wood +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fman/fman_memac.c | 2 +- + drivers/net/ethernet/freescale/fman/fman_tgec.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fman/fman_memac.c b/drivers/net/ethernet/freescale/fman/fman_memac.c +index bc6eb30aa20f..41c6fa200e74 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_memac.c ++++ b/drivers/net/ethernet/freescale/fman/fman_memac.c +@@ -928,7 +928,7 @@ int memac_add_hash_mac_address(struct fman_mac *memac, enet_addr_t *eth_addr) + hash = get_mac_addr_hash_code(addr) & HASH_CTRL_ADDR_MASK; + + /* Create element to be added to the driver hash table */ +- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL); ++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC); + if (!hash_entry) + return -ENOMEM; + hash_entry->addr = addr; +diff --git a/drivers/net/ethernet/freescale/fman/fman_tgec.c b/drivers/net/ethernet/freescale/fman/fman_tgec.c +index 40705938eecc..f75b9c11b2d2 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_tgec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_tgec.c +@@ -553,7 +553,7 @@ int tgec_add_hash_mac_address(struct fman_mac *tgec, enet_addr_t *eth_addr) + hash = (crc >> TGEC_HASH_MCAST_SHIFT) & TGEC_HASH_ADR_MSK; + + /* Create element to be added to the driver hash table */ +- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL); ++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC); + if (!hash_entry) + return -ENOMEM; + hash_entry->addr = addr; +-- +2.19.1 + diff --git a/queue-4.20/gdrom-fix-a-memory-leak-bug.patch b/queue-4.20/gdrom-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..4a8ec1adff7 --- /dev/null +++ b/queue-4.20/gdrom-fix-a-memory-leak-bug.patch @@ -0,0 +1,39 @@ +From 49fc1751d3ca7070ab1bed094c99291df6fb3dfc Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Wed, 26 Dec 2018 20:15:13 -0600 +Subject: gdrom: fix a memory leak bug + +[ Upstream commit 093c48213ee37c3c3ff1cf5ac1aa2a9d8bc66017 ] + +In probe_gdrom(), the buffer pointed by 'gd.cd_info' is allocated through +kzalloc() and is used to hold the information of the gdrom device. To +register and unregister the device, the pointer 'gd.cd_info' is passed to +the functions register_cdrom() and unregister_cdrom(), respectively. +However, this buffer is not freed after it is used, which can cause a +memory leak bug. + +This patch simply frees the buffer 'gd.cd_info' in exit_gdrom() to fix the +above issue. + +Signed-off-by: Wenwen Wang +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/cdrom/gdrom.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index a5b8afe3609c..f8b7345fe1cb 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -873,6 +873,7 @@ static void __exit exit_gdrom(void) + platform_device_unregister(pd); + platform_driver_unregister(&gdrom_driver); + kfree(gd.toc); ++ kfree(gd.cd_info); + } + + module_init(init_gdrom); +-- +2.19.1 + diff --git a/queue-4.20/genirq-affinity-spread-irqs-to-all-available-numa-no.patch b/queue-4.20/genirq-affinity-spread-irqs-to-all-available-numa-no.patch new file mode 100644 index 00000000000..1ad189ab157 --- /dev/null +++ b/queue-4.20/genirq-affinity-spread-irqs-to-all-available-numa-no.patch @@ -0,0 +1,59 @@ +From e2f38fdac4440b75eedbf3341e8f48765ec745ea Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Fri, 2 Nov 2018 18:02:48 +0000 +Subject: genirq/affinity: Spread IRQs to all available NUMA nodes + +[ Upstream commit b82592199032bf7c778f861b936287e37ebc9f62 ] + +If the number of NUMA nodes exceeds the number of MSI/MSI-X interrupts +which are allocated for a device, the interrupt affinity spreading code +fails to spread them across all nodes. + +The reason is, that the spreading code starts from node 0 and continues up +to the number of interrupts requested for allocation. This leaves the nodes +past the last interrupt unused. + +This results in interrupt concentration on the first nodes which violates +the assumption of the block layer that all nodes are covered evenly. As a +consequence the NUMA nodes above the number of interrupts are all assigned +to hardware queue 0 and therefore NUMA node 0, which results in bad +performance and has CPU hotplug implications, because queue 0 gets shut +down when the last CPU of node 0 is offlined. + +Go over all NUMA nodes and assign them round-robin to all requested +interrupts to solve this. + +[ tglx: Massaged changelog ] + +Signed-off-by: Long Li +Signed-off-by: Thomas Gleixner +Reviewed-by: Ming Lei +Cc: Michael Kelley +Link: https://lkml.kernel.org/r/20181102180248.13583-1-longli@linuxonhyperv.com +Signed-off-by: Sasha Levin +--- + kernel/irq/affinity.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c +index f4f29b9d90ee..e12cdf637c71 100644 +--- a/kernel/irq/affinity.c ++++ b/kernel/irq/affinity.c +@@ -117,12 +117,11 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd, + */ + if (numvecs <= nodes) { + for_each_node_mask(n, nodemsk) { +- cpumask_copy(masks + curvec, node_to_cpumask[n]); +- if (++done == numvecs) +- break; ++ cpumask_or(masks + curvec, masks + curvec, node_to_cpumask[n]); + if (++curvec == last_affv) + curvec = affd->pre_vectors; + } ++ done = numvecs; + goto out; + } + +-- +2.19.1 + diff --git a/queue-4.20/gpio-mt7621-pass-mediatek_gpio_bank_probe-failure-up.patch b/queue-4.20/gpio-mt7621-pass-mediatek_gpio_bank_probe-failure-up.patch new file mode 100644 index 00000000000..2a20bf68afc --- /dev/null +++ b/queue-4.20/gpio-mt7621-pass-mediatek_gpio_bank_probe-failure-up.patch @@ -0,0 +1,50 @@ +From f691703c904e79b37bd3fc5772cd74d5b03b81f8 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Tue, 27 Nov 2018 18:00:18 +0100 +Subject: gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack + +[ Upstream commit a109c2dbb571b10bb9969285b646f57309c98251 ] + +The error cases of mediatek_gpio_bank_probe() would go unnoticed (except +for the dev_err() messages). The probe function should return an error +if one of the banks failed to initialize properly indicated by +not returning non-0. + +Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621") +Signed-off-by: Nicholas Mc Guire +Acked-by: Sean Wang +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mt7621.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c +index 1ec95bc18f5b..00e954f22bc9 100644 +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -297,6 +297,7 @@ mediatek_gpio_probe(struct platform_device *pdev) + struct device_node *np = dev->of_node; + struct mtk *mtk; + int i; ++ int ret; + + mtk = devm_kzalloc(dev, sizeof(*mtk), GFP_KERNEL); + if (!mtk) +@@ -311,8 +312,11 @@ mediatek_gpio_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, mtk); + mediatek_gpio_irq_chip.name = dev_name(dev); + +- for (i = 0; i < MTK_BANK_CNT; i++) +- mediatek_gpio_bank_probe(dev, np, i); ++ for (i = 0; i < MTK_BANK_CNT; i++) { ++ ret = mediatek_gpio_bank_probe(dev, np, i); ++ if (ret) ++ return ret; ++ } + + return 0; + } +-- +2.19.1 + diff --git a/queue-4.20/gpio-mt7621-report-failure-of-devm_kasprintf.patch b/queue-4.20/gpio-mt7621-report-failure-of-devm_kasprintf.patch new file mode 100644 index 00000000000..40ec29667ef --- /dev/null +++ b/queue-4.20/gpio-mt7621-report-failure-of-devm_kasprintf.patch @@ -0,0 +1,38 @@ +From 3fb8f5d248f39563fc6a549e0522ee73fa32b35b Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Wed, 21 Nov 2018 19:06:12 +0100 +Subject: gpio: mt7621: report failure of devm_kasprintf() + +[ Upstream commit 59d646c775d6ae688ee90fda9f2a4270c47b7490 ] + +kasprintf() may return NULL on failure of internal allocation thus the +assigned label is not safe if not explicitly checked. On error +mediatek_gpio_bank_probe() returns negative values so -ENOMEM in the +(unlikely) failure case should be fine here. + +Fixes: 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621") +Signed-off-by: Nicholas Mc Guire +Reviewed-by: Bartosz Golaszewski +Acked-by: Sean Wang +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mt7621.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpio/gpio-mt7621.c b/drivers/gpio/gpio-mt7621.c +index d72af6f6cdbd..1ec95bc18f5b 100644 +--- a/drivers/gpio/gpio-mt7621.c ++++ b/drivers/gpio/gpio-mt7621.c +@@ -244,6 +244,8 @@ mediatek_gpio_bank_probe(struct device *dev, + rg->chip.of_xlate = mediatek_gpio_xlate; + rg->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%s-bank%d", + dev_name(dev), bank); ++ if (!rg->chip.label) ++ return -ENOMEM; + + ret = devm_gpiochip_add_data(dev, &rg->chip, mtk); + if (ret < 0) { +-- +2.19.1 + diff --git a/queue-4.20/gpiolib-fix-possible-use-after-free-on-label.patch b/queue-4.20/gpiolib-fix-possible-use-after-free-on-label.patch new file mode 100644 index 00000000000..30538e836a8 --- /dev/null +++ b/queue-4.20/gpiolib-fix-possible-use-after-free-on-label.patch @@ -0,0 +1,122 @@ +From 041f10ae41d95429a5cdb461cd6eaaa6306f6531 Mon Sep 17 00:00:00 2001 +From: Muchun Song +Date: Thu, 1 Nov 2018 21:12:50 +0800 +Subject: gpiolib: Fix possible use after free on label + +[ Upstream commit 18534df419041e6c1f4b41af56ee7d41f757815c ] + +gpiod_request_commit() copies the pointer to the label passed as +an argument only to be used later. But there's a chance the caller +could immediately free the passed string(e.g., local variable). +This could trigger a use after free when we use gpio label(e.g., +gpiochip_unlock_as_irq(), gpiochip_is_requested()). + +To be on the safe side: duplicate the string with kstrdup_const() +so that if an unaware user passes an address to a stack-allocated +buffer, we won't get the arbitrary label. + +Also fix gpiod_set_consumer_name(). + +Signed-off-by: Muchun Song +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpiolib.c | 25 +++++++++++++++++++++---- + include/linux/gpio/consumer.h | 6 ++++-- + 2 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 76913e23cf3a..bd44be115cdd 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -2306,6 +2306,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) + unsigned long flags; + unsigned offset; + ++ if (label) { ++ label = kstrdup_const(label, GFP_KERNEL); ++ if (!label) ++ return -ENOMEM; ++ } ++ + spin_lock_irqsave(&gpio_lock, flags); + + /* NOTE: gpio_request() can be called in early boot, +@@ -2316,6 +2322,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) + desc_set_label(desc, label ? : "?"); + status = 0; + } else { ++ kfree_const(label); + status = -EBUSY; + goto done; + } +@@ -2332,6 +2339,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label) + + if (status < 0) { + desc_set_label(desc, NULL); ++ kfree_const(label); + clear_bit(FLAG_REQUESTED, &desc->flags); + goto done; + } +@@ -2427,6 +2435,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc) + chip->free(chip, gpio_chip_hwgpio(desc)); + spin_lock_irqsave(&gpio_lock, flags); + } ++ kfree_const(desc->label); + desc_set_label(desc, NULL); + clear_bit(FLAG_ACTIVE_LOW, &desc->flags); + clear_bit(FLAG_REQUESTED, &desc->flags); +@@ -3382,11 +3391,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep); + * @desc: gpio to set the consumer name on + * @name: the new consumer name + */ +-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) ++int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) + { +- VALIDATE_DESC_VOID(desc); +- /* Just overwrite whatever the previous name was */ +- desc->label = name; ++ VALIDATE_DESC(desc); ++ if (name) { ++ name = kstrdup_const(name, GFP_KERNEL); ++ if (!name) ++ return -ENOMEM; ++ } ++ ++ kfree_const(desc->label); ++ desc_set_label(desc, name); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(gpiod_set_consumer_name); + +diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h +index f2f887795d43..ed070512b40e 100644 +--- a/include/linux/gpio/consumer.h ++++ b/include/linux/gpio/consumer.h +@@ -162,7 +162,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc); + int gpiod_cansleep(const struct gpio_desc *desc); + + int gpiod_to_irq(const struct gpio_desc *desc); +-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name); ++int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name); + + /* Convert between the old gpio_ and new gpiod_ interfaces */ + struct gpio_desc *gpio_to_desc(unsigned gpio); +@@ -495,10 +495,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc) + return -EINVAL; + } + +-static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name) ++static inline int gpiod_set_consumer_name(struct gpio_desc *desc, ++ const char *name) + { + /* GPIO can never have been requested */ + WARN_ON(1); ++ return -EINVAL; + } + + static inline struct gpio_desc *gpio_to_desc(unsigned gpio) +-- +2.19.1 + diff --git a/queue-4.20/gpu-ipu-v3-image-convert-prevent-race-between-run-an.patch b/queue-4.20/gpu-ipu-v3-image-convert-prevent-race-between-run-an.patch new file mode 100644 index 00000000000..df0a3e84b05 --- /dev/null +++ b/queue-4.20/gpu-ipu-v3-image-convert-prevent-race-between-run-an.patch @@ -0,0 +1,72 @@ +From 0305dd4252740373b23f2f443956311d749e5d84 Mon Sep 17 00:00:00 2001 +From: Steve Longerbeam +Date: Wed, 19 Sep 2018 16:07:18 -0700 +Subject: gpu: ipu-v3: image-convert: Prevent race between run and unprepare + +[ Upstream commit 819bec35c8c9706185498c9222bd244e0781ad35 ] + +Prevent possible race by parallel threads between ipu_image_convert_run() +and ipu_image_convert_unprepare(). This involves setting ctx->aborting +to true unconditionally so that no new job runs can be queued during +unprepare, and holding the ctx->aborting flag until the context is freed. + +Note that the "normal" ipu_image_convert_abort() case (e.g. not during +context unprepare) should clear the ctx->aborting flag after aborting +any active run and clearing the context's pending queue. This is because +it should be possible to continue to use the conversion context and queue +more runs after an abort. + +Signed-off-by: Steve Longerbeam +Tested-by: Philipp Zabel +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-image-convert.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c +index f4081962784c..91653adc41cc 100644 +--- a/drivers/gpu/ipu-v3/ipu-image-convert.c ++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c +@@ -1524,7 +1524,7 @@ unlock: + EXPORT_SYMBOL_GPL(ipu_image_convert_queue); + + /* Abort any active or pending conversions for this context */ +-void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx) ++static void __ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx) + { + struct ipu_image_convert_chan *chan = ctx->chan; + struct ipu_image_convert_priv *priv = chan->priv; +@@ -1551,7 +1551,7 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx) + + need_abort = (run_count || active_run); + +- ctx->aborting = need_abort; ++ ctx->aborting = true; + + spin_unlock_irqrestore(&chan->irqlock, flags); + +@@ -1572,7 +1572,11 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx) + dev_warn(priv->ipu->dev, "%s: timeout\n", __func__); + force_abort(ctx); + } ++} + ++void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx) ++{ ++ __ipu_image_convert_abort(ctx); + ctx->aborting = false; + } + EXPORT_SYMBOL_GPL(ipu_image_convert_abort); +@@ -1586,7 +1590,7 @@ void ipu_image_convert_unprepare(struct ipu_image_convert_ctx *ctx) + bool put_res; + + /* make sure no runs are hanging around */ +- ipu_image_convert_abort(ctx); ++ __ipu_image_convert_abort(ctx); + + dev_dbg(priv->ipu->dev, "%s: task %u: removing ctx %p\n", __func__, + chan->ic_task, ctx); +-- +2.19.1 + diff --git a/queue-4.20/hid-lenovo-add-checks-to-fix-of_led_classdev_registe.patch b/queue-4.20/hid-lenovo-add-checks-to-fix-of_led_classdev_registe.patch new file mode 100644 index 00000000000..407b78d8fec --- /dev/null +++ b/queue-4.20/hid-lenovo-add-checks-to-fix-of_led_classdev_registe.patch @@ -0,0 +1,48 @@ +From 902ab423af03e7310b7cba51675748e3490fbaeb Mon Sep 17 00:00:00 2001 +From: Aditya Pakki +Date: Mon, 24 Dec 2018 15:39:14 -0600 +Subject: HID: lenovo: Add checks to fix of_led_classdev_register + +[ Upstream commit 6ae16dfb61bce538d48b7fe98160fada446056c5 ] + +In lenovo_probe_tpkbd(), the function of_led_classdev_register() could +return an error value that is unchecked. The fix adds these checks. + +Signed-off-by: Aditya Pakki +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-lenovo.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index 643b6eb54442..eacc76d2ab96 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -743,7 +743,9 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev) + data_pointer->led_mute.brightness_get = lenovo_led_brightness_get_tpkbd; + data_pointer->led_mute.brightness_set = lenovo_led_brightness_set_tpkbd; + data_pointer->led_mute.dev = dev; +- led_classdev_register(dev, &data_pointer->led_mute); ++ ret = led_classdev_register(dev, &data_pointer->led_mute); ++ if (ret < 0) ++ goto err; + + data_pointer->led_micmute.name = name_micmute; + data_pointer->led_micmute.brightness_get = +@@ -751,7 +753,11 @@ static int lenovo_probe_tpkbd(struct hid_device *hdev) + data_pointer->led_micmute.brightness_set = + lenovo_led_brightness_set_tpkbd; + data_pointer->led_micmute.dev = dev; +- led_classdev_register(dev, &data_pointer->led_micmute); ++ ret = led_classdev_register(dev, &data_pointer->led_micmute); ++ if (ret < 0) { ++ led_classdev_unregister(&data_pointer->led_mute); ++ goto err; ++ } + + lenovo_features_set_tpkbd(hdev); + +-- +2.19.1 + diff --git a/queue-4.20/hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-p.patch b/queue-4.20/hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-p.patch new file mode 100644 index 00000000000..1482a654767 --- /dev/null +++ b/queue-4.20/hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-p.patch @@ -0,0 +1,53 @@ +From 8f4416d421d837a0c05958034aee6b9106609380 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Fri, 21 Dec 2018 13:10:39 -0600 +Subject: hwmon: (lm80) fix a missing check of bus read in lm80 probe + +[ Upstream commit 9aa3aa15f4c2f74f47afd6c5db4b420fadf3f315 ] + +In lm80_probe(), if lm80_read_value() fails, it returns a negative +error number which is stored to data->fan[f_min] and will be further +used. We should avoid using the data if the read fails. + +The fix checks if lm80_read_value() fails, and if so, returns with the +error number. + +Signed-off-by: Kangjie Lu +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm80.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index 04f9df0d2341..0e30fa00204c 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -628,6 +628,7 @@ static int lm80_probe(struct i2c_client *client, + struct device *dev = &client->dev; + struct device *hwmon_dev; + struct lm80_data *data; ++ int rv; + + data = devm_kzalloc(dev, sizeof(struct lm80_data), GFP_KERNEL); + if (!data) +@@ -640,8 +641,14 @@ static int lm80_probe(struct i2c_client *client, + lm80_init_client(client); + + /* A few vars need to be filled upon startup */ +- data->fan[f_min][0] = lm80_read_value(client, LM80_REG_FAN_MIN(1)); +- data->fan[f_min][1] = lm80_read_value(client, LM80_REG_FAN_MIN(2)); ++ rv = lm80_read_value(client, LM80_REG_FAN_MIN(1)); ++ if (rv < 0) ++ return rv; ++ data->fan[f_min][0] = rv; ++ rv = lm80_read_value(client, LM80_REG_FAN_MIN(2)); ++ if (rv < 0) ++ return rv; ++ data->fan[f_min][1] = rv; + + hwmon_dev = devm_hwmon_device_register_with_groups(dev, client->name, + data, lm80_groups); +-- +2.19.1 + diff --git a/queue-4.20/hwmon-lm80-fix-a-missing-check-of-the-status-of-smbu.patch b/queue-4.20/hwmon-lm80-fix-a-missing-check-of-the-status-of-smbu.patch new file mode 100644 index 00000000000..09caa22a3a5 --- /dev/null +++ b/queue-4.20/hwmon-lm80-fix-a-missing-check-of-the-status-of-smbu.patch @@ -0,0 +1,58 @@ +From 11e5c0d7186d0f2a2df24b846e73defd5a99987c Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Fri, 21 Dec 2018 13:01:33 -0600 +Subject: hwmon: (lm80) fix a missing check of the status of SMBus read + +[ Upstream commit c9c63915519b1def7043b184680f33c24cd49d7b ] + +If lm80_read_value() fails, it returns a negative number instead of the +correct read data. Therefore, we should avoid using the data if it +fails. + +The fix checks if lm80_read_value() fails, and if so, returns with the +error number. + +Signed-off-by: Kangjie Lu +[groeck: One variable for return values is enough] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm80.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index 08e3945a6fbf..04f9df0d2341 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -360,9 +360,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, + struct i2c_client *client = data->client; + unsigned long min, val; + u8 reg; +- int err = kstrtoul(buf, 10, &val); +- if (err < 0) +- return err; ++ int rv; ++ ++ rv = kstrtoul(buf, 10, &val); ++ if (rv < 0) ++ return rv; + + /* Save fan_min */ + mutex_lock(&data->update_lock); +@@ -390,8 +392,11 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, + return -EINVAL; + } + +- reg = (lm80_read_value(client, LM80_REG_FANDIV) & +- ~(3 << (2 * (nr + 1)))) | (data->fan_div[nr] << (2 * (nr + 1))); ++ rv = lm80_read_value(client, LM80_REG_FANDIV); ++ if (rv < 0) ++ return rv; ++ reg = (rv & ~(3 << (2 * (nr + 1)))) ++ | (data->fan_div[nr] << (2 * (nr + 1))); + lm80_write_value(client, LM80_REG_FANDIV, reg); + + /* Restore fan_min */ +-- +2.19.1 + diff --git a/queue-4.20/i2c-axxia-check-for-error-conditions-first.patch b/queue-4.20/i2c-axxia-check-for-error-conditions-first.patch new file mode 100644 index 00000000000..e22a7331bba --- /dev/null +++ b/queue-4.20/i2c-axxia-check-for-error-conditions-first.patch @@ -0,0 +1,85 @@ +From ad1a04bbd3024fa968f85eae50e1295e24085639 Mon Sep 17 00:00:00 2001 +From: "Adamski, Krzysztof (Nokia - PL/Wroclaw)" +Date: Mon, 10 Dec 2018 15:01:27 +0000 +Subject: i2c-axxia: check for error conditions first + +[ Upstream commit 4f5c85fe3a60ace555d09898166af372547f97fc ] + +It was observed that when using seqentional mode contrary to the +documentation, the SS bit (which is supposed to only be set if +automatic/sequence command completed normally), is sometimes set +together with NA (NAK in address phase) causing transfer to falsely be +considered successful. + +My assumption is that this does not happen during manual mode since the +controller is stopping its work the moment it sets NA/ND bit in status +register. This is not the case in Automatic/Sequentional mode where it +is still working to send STOP condition and the actual status we get +depends on the time when the ISR is run. + +This patch changes the order of checking status bits in ISR - error +conditions are checked first and only if none of them occurred, the +transfer may be considered successful. This is required to introduce +using of sequentional mode in next patch. + +Signed-off-by: Krzysztof Adamski +Reviewed-by: Alexander Sverdlin +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-axxia.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c +index 51d34959709b..fb5bac079e83 100644 +--- a/drivers/i2c/busses/i2c-axxia.c ++++ b/drivers/i2c/busses/i2c-axxia.c +@@ -296,22 +296,7 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) + i2c_int_disable(idev, MST_STATUS_TFL); + } + +- if (status & MST_STATUS_SCC) { +- /* Stop completed */ +- i2c_int_disable(idev, ~MST_STATUS_TSS); +- complete(&idev->msg_complete); +- } else if (status & MST_STATUS_SNS) { +- /* Transfer done */ +- i2c_int_disable(idev, ~MST_STATUS_TSS); +- if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) +- axxia_i2c_empty_rx_fifo(idev); +- complete(&idev->msg_complete); +- } else if (status & MST_STATUS_TSS) { +- /* Transfer timeout */ +- idev->msg_err = -ETIMEDOUT; +- i2c_int_disable(idev, ~MST_STATUS_TSS); +- complete(&idev->msg_complete); +- } else if (unlikely(status & MST_STATUS_ERR)) { ++ if (unlikely(status & MST_STATUS_ERR)) { + /* Transfer error */ + i2c_int_disable(idev, ~0); + if (status & MST_STATUS_AL) +@@ -328,6 +313,21 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) + readl(idev->base + MST_TX_BYTES_XFRD), + readl(idev->base + MST_TX_XFER)); + complete(&idev->msg_complete); ++ } else if (status & MST_STATUS_SCC) { ++ /* Stop completed */ ++ i2c_int_disable(idev, ~MST_STATUS_TSS); ++ complete(&idev->msg_complete); ++ } else if (status & MST_STATUS_SNS) { ++ /* Transfer done */ ++ i2c_int_disable(idev, ~MST_STATUS_TSS); ++ if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) ++ axxia_i2c_empty_rx_fifo(idev); ++ complete(&idev->msg_complete); ++ } else if (status & MST_STATUS_TSS) { ++ /* Transfer timeout */ ++ idev->msg_err = -ETIMEDOUT; ++ i2c_int_disable(idev, ~MST_STATUS_TSS); ++ complete(&idev->msg_complete); + } + + out: +-- +2.19.1 + diff --git a/queue-4.20/i2c-sh_mobile-add-support-for-r8a774c0-rz-g2e.patch b/queue-4.20/i2c-sh_mobile-add-support-for-r8a774c0-rz-g2e.patch new file mode 100644 index 00000000000..95a5719947a --- /dev/null +++ b/queue-4.20/i2c-sh_mobile-add-support-for-r8a774c0-rz-g2e.patch @@ -0,0 +1,38 @@ +From 13ff71318d9307aab196c1dbcde5c3569625d217 Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Thu, 13 Dec 2018 20:22:34 +0000 +Subject: i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E) + +[ Upstream commit 51243b73455f2d12cb82abffa7bc9028aec656e0 ] + +Similarly to R-Car E3, RZ/G2E doesn't come with automatic +transmission registers, as such it is not considered compatible +with the existing fallback bindings. + +Add SoC specific binding compatibility to allow for later +support for automatic transmission. + +Signed-off-by: Fabrizio Castro +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh_mobile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c +index 28db6b59c4ca..a64f2ff3cb49 100644 +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -800,6 +800,7 @@ static const struct sh_mobile_dt_config r8a7740_dt_config = { + static const struct of_device_id sh_mobile_i2c_dt_ids[] = { + { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config }, ++ { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7791", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7792", .data = &fast_clock_dt_config }, +-- +2.19.1 + diff --git a/queue-4.20/i2c-sh_mobile-add-support-for-r8a77990-r-car-e3.patch b/queue-4.20/i2c-sh_mobile-add-support-for-r8a77990-r-car-e3.patch new file mode 100644 index 00000000000..5d32c5d9adb --- /dev/null +++ b/queue-4.20/i2c-sh_mobile-add-support-for-r8a77990-r-car-e3.patch @@ -0,0 +1,41 @@ +From 613d8ec91452c2791dadc560d5cb8f4586c9a4ef Mon Sep 17 00:00:00 2001 +From: Simon Horman +Date: Wed, 21 Nov 2018 13:09:28 +0100 +Subject: i2c: sh_mobile: add support for r8a77990 (R-Car E3) + +[ Upstream commit 5eb316e636eb298c204f5b368526d4480b63c0ba ] + +Add support for the IIC code for the r8a77990 (R-Car E3). + +It is not considered compatible with existing fallback bindings +due to the documented absence of automatic transmission registers. + +These registers are currently not used by the driver and +thus the provides the same behaviour for "renesas,iic-r8a77990" and +"renesas,rcar-gen3-iic". The point of declaring incompatibility is +to allow for automatic transmission register support to be added to +"renesas,iic-r8a77990" and "renesas,rcar-gen3-iic" in future. + +Signed-off-by: Simon Horman +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh_mobile.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c +index a7a7a9c3bc7c..28db6b59c4ca 100644 +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -808,6 +808,7 @@ static const struct of_device_id sh_mobile_i2c_dt_ids[] = { + { .compatible = "renesas,rcar-gen2-iic", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7795", .data = &fast_clock_dt_config }, + { .compatible = "renesas,rcar-gen3-iic", .data = &fast_clock_dt_config }, ++ { .compatible = "renesas,iic-r8a77990", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-sh73a0", .data = &fast_clock_dt_config }, + { .compatible = "renesas,rmobile-iic", .data = &default_dt_config }, + {}, +-- +2.19.1 + diff --git a/queue-4.20/i40e-define-proper-net_device-neigh_priv_len.patch b/queue-4.20/i40e-define-proper-net_device-neigh_priv_len.patch new file mode 100644 index 00000000000..eba9ef1bd43 --- /dev/null +++ b/queue-4.20/i40e-define-proper-net_device-neigh_priv_len.patch @@ -0,0 +1,46 @@ +From 4fbc9946db880b9f7aec24668317a3721dd83f8e Mon Sep 17 00:00:00 2001 +From: Konstantin Khorenko +Date: Fri, 23 Nov 2018 19:10:28 +0300 +Subject: i40e: define proper net_device::neigh_priv_len + +[ Upstream commit 31389b53b3e0b535867af9090a5d19ec64768d55 ] + +Out of bound read reported by KASan. + +i40iw_net_event() reads unconditionally 16 bytes from +neigh->primary_key while the memory allocated for +"neighbour" struct is evaluated in neigh_alloc() as + + tbl->entry_size + dev->neigh_priv_len + +where "dev" is a net_device. + +But the driver does not setup dev->neigh_priv_len and +we read beyond the neigh entry allocated memory, +so the patch in the next mail fixes this. + +Signed-off-by: Konstantin Khorenko +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 419cf3faada6..f97c3d5ab884 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -12339,6 +12339,9 @@ static int i40e_config_netdev(struct i40e_vsi *vsi) + ether_addr_copy(netdev->dev_addr, mac_addr); + ether_addr_copy(netdev->perm_addr, mac_addr); + ++ /* i40iw_net_event() reads 16 bytes from neigh->primary_key */ ++ netdev->neigh_priv_len = sizeof(u32) * 4; ++ + netdev->priv_flags |= IFF_UNICAST_FLT; + netdev->priv_flags |= IFF_SUPP_NOFCS; + /* Setup netdev TC information */ +-- +2.19.1 + diff --git a/queue-4.20/i40e-prevent-overlapping-tx_timeout-recover.patch b/queue-4.20/i40e-prevent-overlapping-tx_timeout-recover.patch new file mode 100644 index 00000000000..6f44666f4fa --- /dev/null +++ b/queue-4.20/i40e-prevent-overlapping-tx_timeout-recover.patch @@ -0,0 +1,63 @@ +From 51f3d2e6aeebac4e3426bff1e395ef6959b6353e Mon Sep 17 00:00:00 2001 +From: Alan Brady +Date: Mon, 29 Oct 2018 11:27:21 -0700 +Subject: i40e: prevent overlapping tx_timeout recover + +[ Upstream commit d5585b7b6846a6d0f9517afe57be3843150719da ] + +If a TX hang occurs, we attempt to recover by incrementally resetting. +If we're starved for CPU time, it's possible the reset doesn't actually +complete (or even fire) before another tx_timeout fires causing us to +fly through the different resets without actually doing them. + +This adds a bit to set and check if a timeout recovery is already +pending and, if so, bail out of tx_timeout. The bit will get cleared at +the end of i40e_rebuild when reset is complete. + +Signed-off-by: Alan Brady +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 876cac317e79..8245ff12fd64 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -122,6 +122,7 @@ enum i40e_state_t { + __I40E_MDD_EVENT_PENDING, + __I40E_VFLR_EVENT_PENDING, + __I40E_RESET_RECOVERY_PENDING, ++ __I40E_TIMEOUT_RECOVERY_PENDING, + __I40E_MISC_IRQ_REQUESTED, + __I40E_RESET_INTR_RECEIVED, + __I40E_REINIT_REQUESTED, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 0e5dc74b4ef2..419cf3faada6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -338,6 +338,10 @@ static void i40e_tx_timeout(struct net_device *netdev) + (pf->tx_timeout_last_recovery + netdev->watchdog_timeo))) + return; /* don't do any new action before the next timeout */ + ++ /* don't kick off another recovery if one is already pending */ ++ if (test_and_set_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state)) ++ return; ++ + if (tx_ring) { + head = i40e_get_head(tx_ring); + /* Read interrupt register */ +@@ -9632,6 +9636,7 @@ end_core_reset: + clear_bit(__I40E_RESET_FAILED, pf->state); + clear_recovery: + clear_bit(__I40E_RESET_RECOVERY_PENDING, pf->state); ++ clear_bit(__I40E_TIMEOUT_RECOVERY_PENDING, pf->state); + } + + /** +-- +2.19.1 + diff --git a/queue-4.20/i40e-suppress-bogus-error-message.patch b/queue-4.20/i40e-suppress-bogus-error-message.patch new file mode 100644 index 00000000000..e075450d1f6 --- /dev/null +++ b/queue-4.20/i40e-suppress-bogus-error-message.patch @@ -0,0 +1,41 @@ +From 95dbcfe05b47cd545f049f1fc0ca0e9890ca2a34 Mon Sep 17 00:00:00 2001 +From: Mitch Williams +Date: Fri, 26 Oct 2018 14:33:33 -0700 +Subject: i40e: suppress bogus error message + +[ Upstream commit 7cd8eb0861981ad212ce4242a1870c4b5831ceff ] + +The i40e driver complains about unprivileged VFs trying to configure +promiscuous mode each time a VF reset occurs. This isn't the fault of +the poor VF driver - the PF driver itself is making the request. + +To fix this, skip the privilege check if the request is to disable all +promiscuous activity. This gets rid of the bogus message, but doesn't +affect privilege checks, since we really only care if the unprivileged +VF is trying to enable promiscuous mode. + +Signed-off-by: Mitch Williams +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index ac5698ed0b11..c41e8ada23d1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1112,7 +1112,8 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf, + if (!i40e_vc_isvalid_vsi_id(vf, vsi_id) || !vsi) + return I40E_ERR_PARAM; + +- if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) { ++ if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) && ++ (allmulti || alluni)) { + dev_err(&pf->pdev->dev, + "Unprivileged VF %d is attempting to configure promiscuous mode\n", + vf->vf_id); +-- +2.19.1 + diff --git a/queue-4.20/ib-hfi1-unreserve-a-reserved-request-when-it-is-comp.patch b/queue-4.20/ib-hfi1-unreserve-a-reserved-request-when-it-is-comp.patch new file mode 100644 index 00000000000..b151ff7938a --- /dev/null +++ b/queue-4.20/ib-hfi1-unreserve-a-reserved-request-when-it-is-comp.patch @@ -0,0 +1,46 @@ +From 4b4328d0253241a261eca0cc14709f4c19d9be8e Mon Sep 17 00:00:00 2001 +From: Kaike Wan +Date: Wed, 28 Nov 2018 10:22:09 -0800 +Subject: IB/hfi1: Unreserve a reserved request when it is completed + +[ Upstream commit ca95f802ef5139722acc8d30aeaab6fe5bbe939e ] + +Currently, When a reserved operation is completed, its entry in the send +queue will not be unreserved, which leads to the miscalculation of +qp->s_avail and thus the triggering of a WARN_ON call trace. This patch +fixes the problem by unreserving the reserved operation when it is +completed. + +Fixes: 856cc4c237ad ("IB/hfi1: Add the capability for reserved operations") +Reviewed-by: Mike Marciniszyn +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/rc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c +index 188aa4f686a0..ea3aac264df9 100644 +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -1157,6 +1157,7 @@ void hfi1_rc_send_complete(struct rvt_qp *qp, struct hfi1_opa_header *opah) + if (cmp_psn(wqe->lpsn, qp->s_sending_psn) >= 0 && + cmp_psn(qp->s_sending_psn, qp->s_sending_hpsn) <= 0) + break; ++ rvt_qp_wqe_unreserve(qp, wqe); + s_last = qp->s_last; + trace_hfi1_qp_send_completion(qp, wqe, s_last); + if (++s_last >= qp->s_size) +@@ -1209,6 +1210,7 @@ static struct rvt_swqe *do_rc_completion(struct rvt_qp *qp, + u32 s_last; + + rvt_put_swqe(wqe); ++ rvt_qp_wqe_unreserve(qp, wqe); + s_last = qp->s_last; + trace_hfi1_qp_send_completion(qp, wqe, s_last); + if (++s_last >= qp->s_size) +-- +2.19.1 + diff --git a/queue-4.20/ice-do-not-enable-napi-on-q_vectors-that-have-no-rin.patch b/queue-4.20/ice-do-not-enable-napi-on-q_vectors-that-have-no-rin.patch new file mode 100644 index 00000000000..add707e5c40 --- /dev/null +++ b/queue-4.20/ice-do-not-enable-napi-on-q_vectors-that-have-no-rin.patch @@ -0,0 +1,61 @@ +From 9df1b978391ba84c0497c1cabfa3eb8c91f70584 Mon Sep 17 00:00:00 2001 +From: Young Xiao +Date: Thu, 29 Nov 2018 01:54:10 +0000 +Subject: ice: Do not enable NAPI on q_vectors that have no rings + +[ Upstream commit eec903769b4ea476591ffff73bb7359f14f38c51 ] + +If ice driver has q_vectors w/ active NAPI that has no rings, +then this will result in a divide by zero error. To correct it +I am updating the driver code so that we only support NAPI on +q_vectors that have 1 or more rings allocated to them. + +See commit 13a8cd191a2b ("i40e: Do not enable NAPI on q_vectors +that have no rings") for detail. + +Signed-off-by: Young Xiao +Acked-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_main.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 333312a1d595..945000449279 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -2563,8 +2563,12 @@ static void ice_napi_enable_all(struct ice_vsi *vsi) + if (!vsi->netdev) + return; + +- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) +- napi_enable(&vsi->q_vectors[q_idx]->napi); ++ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) { ++ struct ice_q_vector *q_vector = vsi->q_vectors[q_idx]; ++ ++ if (q_vector->rx.ring || q_vector->tx.ring) ++ napi_enable(&q_vector->napi); ++ } + } + + /** +@@ -2931,8 +2935,12 @@ static void ice_napi_disable_all(struct ice_vsi *vsi) + if (!vsi->netdev) + return; + +- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) +- napi_disable(&vsi->q_vectors[q_idx]->napi); ++ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) { ++ struct ice_q_vector *q_vector = vsi->q_vectors[q_idx]; ++ ++ if (q_vector->rx.ring || q_vector->tx.ring) ++ napi_disable(&q_vector->napi); ++ } + } + + /** +-- +2.19.1 + diff --git a/queue-4.20/igb-fix-an-issue-that-pme-is-not-enabled-during-runt.patch b/queue-4.20/igb-fix-an-issue-that-pme-is-not-enabled-during-runt.patch new file mode 100644 index 00000000000..c8a35c8ec15 --- /dev/null +++ b/queue-4.20/igb-fix-an-issue-that-pme-is-not-enabled-during-runt.patch @@ -0,0 +1,48 @@ +From e8eb4afd2b0fcd7e8206b6f00e77a626b407701b Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 3 Dec 2018 13:54:38 +0800 +Subject: igb: Fix an issue that PME is not enabled during runtime suspend + +[ Upstream commit 1fb3a7a75e2efcc83ef21f2434069cddd6fae6f5 ] + +I210 ethernet card doesn't wakeup when a cable gets plugged. It's +because its PME is not set. + +Since commit 42eca2302146 ("PCI: Don't touch card regs after runtime +suspend D3"), if the PCI state is saved, pci_pm_runtime_suspend() stops +calling pci_finish_runtime_suspend(), which enables the PCI PME. + +To fix the issue, let's not to save PCI states when it's runtime +suspend, to let the PCI subsystem enables PME. + +Fixes: 42eca2302146 ("PCI: Don't touch card regs after runtime suspend D3") +Signed-off-by: Kai-Heng Feng +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 5df88ad8ac81..93f150784cfc 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8770,9 +8770,11 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, + rtnl_unlock(); + + #ifdef CONFIG_PM +- retval = pci_save_state(pdev); +- if (retval) +- return retval; ++ if (!runtime) { ++ retval = pci_save_state(pdev); ++ if (retval) ++ return retval; ++ } + #endif + + status = rd32(E1000_STATUS); +-- +2.19.1 + diff --git a/queue-4.20/iio-accel-kxcjk1013-add-kiox010a-acpi-hardware-id.patch b/queue-4.20/iio-accel-kxcjk1013-add-kiox010a-acpi-hardware-id.patch new file mode 100644 index 00000000000..6a59fbd0f61 --- /dev/null +++ b/queue-4.20/iio-accel-kxcjk1013-add-kiox010a-acpi-hardware-id.patch @@ -0,0 +1,38 @@ +From 63f8d42d05e36a54a3c3c546860339fad0806255 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 20 Nov 2018 12:10:14 +0100 +Subject: iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID + +[ Upstream commit 7f6232e69539971cf9eaed07a6c14ab4a2361133 ] + +Various 2-in-1's use KIOX010A and KIOX020A as HIDs for 2 KXCJ91008 +accelerometers. The KIOX010A HID is for the one in the base and the +KIOX020A for the accelerometer in the keyboard. + +Since userspace does not have a way yet to deal with (or ignore) the +accelerometer in the keyboard, this commit just adds the KIOX010A HID +for now so that display rotation will work. + +Related: https://github.com/hadess/iio-sensor-proxy/issues/166 +Signed-off-by: Hans de Goede +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/kxcjk-1013.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c +index af53a1084ee5..471caa5323e4 100644 +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -1490,6 +1490,7 @@ static const struct acpi_device_id kx_acpi_match[] = { + {"KXCJ1008", KXCJ91008}, + {"KXCJ9000", KXCJ91008}, + {"KIOX000A", KXCJ91008}, ++ {"KIOX010A", KXCJ91008}, /* KXCJ91008 inside the display of a 2-in-1 */ + {"KXTJ1009", KXTJ21009}, + {"SMO8500", KXCJ91008}, + { }, +-- +2.19.1 + diff --git a/queue-4.20/iio-adc-meson-saradc-check-for-devm_kasprintf-failur.patch b/queue-4.20/iio-adc-meson-saradc-check-for-devm_kasprintf-failur.patch new file mode 100644 index 00000000000..0815a6386f9 --- /dev/null +++ b/queue-4.20/iio-adc-meson-saradc-check-for-devm_kasprintf-failur.patch @@ -0,0 +1,49 @@ +From cd95c9c866d29fb5b8d632190cb7bf63167a3e59 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Thu, 22 Nov 2018 08:46:43 +0100 +Subject: iio: adc: meson-saradc: check for devm_kasprintf failure + +[ Upstream commit aad172b017617994343e36d8659c69e14cd694fd ] + +devm_kasprintf() may return NULL on failure of internal allocation thus +the assignments to init.name are not safe if not checked. On error +meson_sar_adc_clk_init() returns negative values so -ENOMEM in the +(unlikely) failure case of devm_kasprintf() should be fine here. + +Signed-off-by: Nicholas Mc Guire +Fixes: 3adbf3427330 ("iio: adc: add a driver for the SAR ADC found in Amlogic Meson SoCs") +Acked-by: Martin Blumenstingl +Tested-by: Martin Blumenstingl +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/meson_saradc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 028ccd218f82..672a5dee4a9d 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -589,6 +589,9 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev, + + init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div", + indio_dev->dev.of_node); ++ if (!init.name) ++ return -ENOMEM; ++ + init.flags = 0; + init.ops = &clk_divider_ops; + clk_parents[0] = __clk_get_name(priv->clkin); +@@ -608,6 +611,9 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev, + + init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en", + indio_dev->dev.of_node); ++ if (!init.name) ++ return -ENOMEM; ++ + init.flags = CLK_SET_RATE_PARENT; + init.ops = &clk_gate_ops; + clk_parents[0] = __clk_get_name(priv->adc_div_clk); +-- +2.19.1 + diff --git a/queue-4.20/iio-adc-meson-saradc-fix-internal-clock-names.patch b/queue-4.20/iio-adc-meson-saradc-fix-internal-clock-names.patch new file mode 100644 index 00000000000..85641282bf8 --- /dev/null +++ b/queue-4.20/iio-adc-meson-saradc-fix-internal-clock-names.patch @@ -0,0 +1,64 @@ +From 14a2849b07f043c19aad306fd73285d1be4e72ad Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Thu, 22 Nov 2018 23:01:11 +0100 +Subject: iio: adc: meson-saradc: fix internal clock names + +[ Upstream commit 50314f98b0ac468218e7c9af8c99f215a35436df ] + +Before this patch we are registering the internal clocks (for example on +Meson8b, where the SAR ADC IP block implements the divider and gate +clocks) with the following names: +- /soc/cbus@c1100000/adc@8680#adc_div +- /soc/cbus@c1100000/adc@8680#adc_en + +This is bad because the common clock framework uses the clock to create +a directory in /clk. With such name, the directory creation +(silently) fails and the debugfs entry ends up being created at the +debugfs root. + +With this change, the new clock names are: +- c1108680.adc#adc_div +- c1108680.adc#adc_en + +This matches the clock naming scheme used in the PWM, Ethernet and MMC +drivers. It also fixes the problem with debugfs. +The idea is shamelessly taken from commit b96e9eb62841c5 ("pwm: meson: +Fix mux clock names"). + +Fixes: 3921db46a8c5bc ("iio: Convert to using %pOF instead of full_name") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/meson_saradc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 672a5dee4a9d..ba4b42429a2a 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -587,8 +587,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev, + struct clk_init_data init; + const char *clk_parents[1]; + +- init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div", +- indio_dev->dev.of_node); ++ init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_div", ++ dev_name(indio_dev->dev.parent)); + if (!init.name) + return -ENOMEM; + +@@ -609,8 +609,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev, + if (WARN_ON(IS_ERR(priv->adc_div_clk))) + return PTR_ERR(priv->adc_div_clk); + +- init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en", +- indio_dev->dev.of_node); ++ init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_en", ++ dev_name(indio_dev->dev.parent)); + if (!init.name) + return -ENOMEM; + +-- +2.19.1 + diff --git a/queue-4.20/iommu-amd-fix-amd_iommu-force_isolation.patch b/queue-4.20/iommu-amd-fix-amd_iommu-force_isolation.patch new file mode 100644 index 00000000000..3e749d98ce9 --- /dev/null +++ b/queue-4.20/iommu-amd-fix-amd_iommu-force_isolation.patch @@ -0,0 +1,55 @@ +From db86e62a3671ff380e22c97c5adbba51b6871ed4 Mon Sep 17 00:00:00 2001 +From: Yu Zhao +Date: Thu, 6 Dec 2018 14:39:15 -0700 +Subject: iommu/amd: Fix amd_iommu=force_isolation + +[ Upstream commit c12b08ebbe16f0d3a96a116d86709b04c1ee8e74 ] + +The parameter is still there but it's ignored. We need to check its +value before deciding to go into passthrough mode for AMD IOMMU v2 +capable device. + +We occasionally use this parameter to force v2 capable device into +translation mode to debug memory corruption that we suspect is +caused by DMA writes. + +To address the following comment from Joerg Roedel on the first +version, v2 capability of device is completely ignored. +> This breaks the iommu_v2 use-case, as it needs a direct mapping for the +> devices that support it. + +And from Documentation/admin-guide/kernel-parameters.txt: + This option does not override iommu=pt + +Fixes: aafd8ba0ca74 ("iommu/amd: Implement add_device and remove_device") + +Signed-off-by: Yu Zhao +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 1167ff0416cf..325f3bad118b 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -438,7 +438,14 @@ static int iommu_init_device(struct device *dev) + + dev_data->alias = get_alias(dev); + +- if (dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) { ++ /* ++ * By default we use passthrough mode for IOMMUv2 capable device. ++ * But if amd_iommu=force_isolation is set (e.g. to debug DMA to ++ * invalid address), we ignore the capability for the device so ++ * it'll be forced to go into translation mode. ++ */ ++ if ((iommu_pass_through || !amd_iommu_force_isolation) && ++ dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) { + struct amd_iommu *iommu; + + iommu = amd_iommu_rlookup_table[dev_data->devid]; +-- +2.19.1 + diff --git a/queue-4.20/iommu-arm-smmu-add-support-for-qcom-smmu-v2-variant.patch b/queue-4.20/iommu-arm-smmu-add-support-for-qcom-smmu-v2-variant.patch new file mode 100644 index 00000000000..d973fb454a8 --- /dev/null +++ b/queue-4.20/iommu-arm-smmu-add-support-for-qcom-smmu-v2-variant.patch @@ -0,0 +1,55 @@ +From e9eb6b833b3e4de41af9f874ee2cb4535e5179fd Mon Sep 17 00:00:00 2001 +From: Vivek Gautam +Date: Tue, 4 Dec 2018 11:52:13 +0530 +Subject: iommu/arm-smmu: Add support for qcom,smmu-v2 variant + +[ Upstream commit 89cddc563743cb1e0068867ac97013b2a5bf86aa ] + +qcom,smmu-v2 is an arm,smmu-v2 implementation with specific +clock and power requirements. +On msm8996, multiple cores, viz. mdss, video, etc. use this +smmu. On sdm845, this smmu is used with gpu. +Add bindings for the same. + +Signed-off-by: Vivek Gautam +Reviewed-by: Rob Herring +Reviewed-by: Tomasz Figa +Tested-by: Srinivas Kandagatla +Reviewed-by: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm-smmu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c +index 5a28ae892504..e23aa7f6c4ad 100644 +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -119,6 +119,7 @@ enum arm_smmu_implementation { + GENERIC_SMMU, + ARM_MMU500, + CAVIUM_SMMUV2, ++ QCOM_SMMUV2, + }; + + struct arm_smmu_s2cr { +@@ -1954,6 +1955,7 @@ ARM_SMMU_MATCH_DATA(smmu_generic_v2, ARM_SMMU_V2, GENERIC_SMMU); + ARM_SMMU_MATCH_DATA(arm_mmu401, ARM_SMMU_V1_64K, GENERIC_SMMU); + ARM_SMMU_MATCH_DATA(arm_mmu500, ARM_SMMU_V2, ARM_MMU500); + ARM_SMMU_MATCH_DATA(cavium_smmuv2, ARM_SMMU_V2, CAVIUM_SMMUV2); ++ARM_SMMU_MATCH_DATA(qcom_smmuv2, ARM_SMMU_V2, QCOM_SMMUV2); + + static const struct of_device_id arm_smmu_of_match[] = { + { .compatible = "arm,smmu-v1", .data = &smmu_generic_v1 }, +@@ -1962,6 +1964,7 @@ static const struct of_device_id arm_smmu_of_match[] = { + { .compatible = "arm,mmu-401", .data = &arm_mmu401 }, + { .compatible = "arm,mmu-500", .data = &arm_mmu500 }, + { .compatible = "cavium,smmu-v2", .data = &cavium_smmuv2 }, ++ { .compatible = "qcom,smmu-v2", .data = &qcom_smmuv2 }, + { }, + }; + MODULE_DEVICE_TABLE(of, arm_smmu_of_match); +-- +2.19.1 + diff --git a/queue-4.20/iommu-arm-smmu-v3-avoid-memory-corruption-from-hisil.patch b/queue-4.20/iommu-arm-smmu-v3-avoid-memory-corruption-from-hisil.patch new file mode 100644 index 00000000000..22a61b237c6 --- /dev/null +++ b/queue-4.20/iommu-arm-smmu-v3-avoid-memory-corruption-from-hisil.patch @@ -0,0 +1,55 @@ +From 547f4d93539a93b34a9dd20902fbeaa6231a6194 Mon Sep 17 00:00:00 2001 +From: Zhen Lei +Date: Wed, 31 Oct 2018 12:02:07 +0800 +Subject: iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI + payloads + +[ Upstream commit 84a9a75774961612d0c7dd34a1777e8f98a65abd ] + +The GITS_TRANSLATER MMIO doorbell register in the ITS hardware is +architected to be 4 bytes in size, yet on hi1620 and earlier, Hisilicon +have allocated the adjacent 4 bytes to carry some IMPDEF sideband +information which results in an 8-byte MSI payload being delivered when +signalling an interrupt: + +MSIAddr: + |----4bytes----|----4bytes----| + | MSIData | IMPDEF | + +This poses no problem for the ITS hardware because the adjacent 4 bytes +are reserved in the memory map. However, when delivering MSIs to memory, +as we do in the SMMUv3 driver for signalling the completion of a SYNC +command, the extended payload will corrupt the 4 bytes adjacent to the +"sync_count" member in struct arm_smmu_device. Fortunately, the current +layout allocates these bytes to padding, but this is fragile and we +should make this explicit. + +Reviewed-by: Robin Murphy +Signed-off-by: Zhen Lei +[will: Rewrote commit message and comment] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm-smmu-v3.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 71eda422c926..62ef4afc9ee5 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -576,7 +576,11 @@ struct arm_smmu_device { + + struct arm_smmu_strtab_cfg strtab_cfg; + +- u32 sync_count; ++ /* Hi16xx adds an extra 32 bits of goodness to its MSI payload */ ++ union { ++ u32 sync_count; ++ u64 padding; ++ }; + + /* IOMMU core code handle */ + struct iommu_device iommu; +-- +2.19.1 + diff --git a/queue-4.20/iommu-arm-smmu-v3-use-explicit-mb-when-moving-cons-p.patch b/queue-4.20/iommu-arm-smmu-v3-use-explicit-mb-when-moving-cons-p.patch new file mode 100644 index 00000000000..45fb07c04b7 --- /dev/null +++ b/queue-4.20/iommu-arm-smmu-v3-use-explicit-mb-when-moving-cons-p.patch @@ -0,0 +1,48 @@ +From 56d48eaddd1a53f267acc21fd8f7b724dca35d24 Mon Sep 17 00:00:00 2001 +From: Will Deacon +Date: Wed, 7 Nov 2018 22:58:24 +0000 +Subject: iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer + +[ Upstream commit a868e8530441286342f90c1fd9c5f24de3aa2880 ] + +After removing an entry from a queue (e.g. reading an event in +arm_smmu_evtq_thread()) it is necessary to advance the MMIO consumer +pointer to free the queue slot back to the SMMU. A memory barrier is +required here so that all reads targetting the queue entry have +completed before the consumer pointer is updated. + +The implementation of queue_inc_cons() relies on a writel() to complete +the previous reads, but this is incorrect because writel() is only +guaranteed to complete prior writes. This patch replaces the call to +writel() with an mb(); writel_relaxed() sequence, which gives us the +read->write ordering which we require. + +Cc: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm-smmu-v3.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 62ef4afc9ee5..11f528e727a1 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -679,7 +679,13 @@ static void queue_inc_cons(struct arm_smmu_queue *q) + u32 cons = (Q_WRP(q, q->cons) | Q_IDX(q, q->cons)) + 1; + + q->cons = Q_OVF(q, q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons); +- writel(q->cons, q->cons_reg); ++ ++ /* ++ * Ensure that all CPU accesses (reads and writes) to the queue ++ * are complete before we update the cons pointer. ++ */ ++ mb(); ++ writel_relaxed(q->cons, q->cons_reg); + } + + static int queue_sync_prod(struct arm_smmu_queue *q) +-- +2.19.1 + diff --git a/queue-4.20/ipv6-fix-handling-of-lla-with-vrf-and-sockets-bound-.patch b/queue-4.20/ipv6-fix-handling-of-lla-with-vrf-and-sockets-bound-.patch new file mode 100644 index 00000000000..32a36e9ab82 --- /dev/null +++ b/queue-4.20/ipv6-fix-handling-of-lla-with-vrf-and-sockets-bound-.patch @@ -0,0 +1,48 @@ +From 05472f946da85708d97a8b1967cf02a5926d8d38 Mon Sep 17 00:00:00 2001 +From: David Ahern +Date: Wed, 12 Dec 2018 15:27:38 -0800 +Subject: ipv6: Fix handling of LLA with VRF and sockets bound to VRF + +[ Upstream commit c2027d1e17582903e368abf5d4838b22a98f2b7b ] + +A recent commit allows sockets bound to a VRF to receive ipv6 link local +packets. However, it only works for UDP and worse TCP connection attempts +to the LLA with the only listener bound to the VRF just hang where as +before the client gets a reset and connection refused. Fix by adjusting +ir_iif for LL addresses and packets received through a device enslaved +to a VRF. + +Fixes: 6f12fa775530 ("vrf: mark skb for multicast or link-local as enslaved to VRF") +Reported-by: Donald Sharp +Cc: Mike Manning +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/tcp_ipv6.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 03e6b7a2bc53..f5c213001b05 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -734,6 +734,7 @@ static void tcp_v6_init_req(struct request_sock *req, + const struct sock *sk_listener, + struct sk_buff *skb) + { ++ bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags); + struct inet_request_sock *ireq = inet_rsk(req); + const struct ipv6_pinfo *np = inet6_sk(sk_listener); + +@@ -741,7 +742,7 @@ static void tcp_v6_init_req(struct request_sock *req, + ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr; + + /* So that link locals have meaning */ +- if (!sk_listener->sk_bound_dev_if && ++ if ((!sk_listener->sk_bound_dev_if || l3_slave) && + ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL) + ireq->ir_iif = tcp_v6_iif(skb); + +-- +2.19.1 + diff --git a/queue-4.20/isdn-hisax-hfc_pci-fix-a-possible-concurrency-use-af.patch b/queue-4.20/isdn-hisax-hfc_pci-fix-a-possible-concurrency-use-af.patch new file mode 100644 index 00000000000..bfdadf69683 --- /dev/null +++ b/queue-4.20/isdn-hisax-hfc_pci-fix-a-possible-concurrency-use-af.patch @@ -0,0 +1,53 @@ +From b9d04aaaa6ea66cb80c5655a8db58040b4baa26a Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Wed, 26 Dec 2018 22:09:34 +0800 +Subject: isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug + in HFCPCI_l1hw() + +[ Upstream commit 7418e6520f22a2e35815122fa5a53d5bbfa2c10f ] + +In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and +HFCPCI_l1hw() may be concurrently executed. + +HFCPCI_l1hw() + line 1173: if (!cs->tx_skb) + +hfcpci_interrupt() + line 942: spin_lock_irqsave(); + line 1066: dev_kfree_skb_irq(cs->tx_skb); + +Thus, a possible concurrency use-after-free bug may occur +in HFCPCI_l1hw(). + +To fix these bugs, the calls to spin_lock_irqsave() and +spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the +access to cs->tx_skb. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hisax/hfc_pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c +index ea0e4c6de3fb..0109e0e8bcb6 100644 +--- a/drivers/isdn/hisax/hfc_pci.c ++++ b/drivers/isdn/hisax/hfc_pci.c +@@ -1170,11 +1170,13 @@ HFCPCI_l1hw(struct PStack *st, int pr, void *arg) + if (cs->debug & L1_DEB_LAPD) + debugl1(cs, "-> PH_REQUEST_PULL"); + #endif ++ spin_lock_irqsave(&cs->lock, flags); + if (!cs->tx_skb) { + test_and_clear_bit(FLG_L1_PULL_REQ, &st->l1.Flags); + st->l1.l1l2(st, PH_PULL | CONFIRM, NULL); + } else + test_and_set_bit(FLG_L1_PULL_REQ, &st->l1.Flags); ++ spin_unlock_irqrestore(&cs->lock, flags); + break; + case (HW_RESET | REQUEST): + spin_lock_irqsave(&cs->lock, flags); +-- +2.19.1 + diff --git a/queue-4.20/iwlwifi-fw-do-not-set-sgi-bits-for-he-connection.patch b/queue-4.20/iwlwifi-fw-do-not-set-sgi-bits-for-he-connection.patch new file mode 100644 index 00000000000..9ce3a1e6b82 --- /dev/null +++ b/queue-4.20/iwlwifi-fw-do-not-set-sgi-bits-for-he-connection.patch @@ -0,0 +1,39 @@ +From 7d56e505ac2fe81ff647fb193cf06ad25d6f0859 Mon Sep 17 00:00:00 2001 +From: Naftali Goldstein +Date: Sun, 15 Jul 2018 15:26:27 +0300 +Subject: iwlwifi: fw: do not set sgi bits for HE connection + +[ Upstream commit 5c2dbebb446539eb9640bf59a02756d6e7f1fc53 ] + +If the association supports HE, HT/VHT rates will never be used for Tx +and therefore there's no need to set the sgi-per-channel-width-support +bits, so don't set them in this case. + +Fixes: 110b32f065f3 ("iwlwifi: mvm: rs: add basic implementation of the new RS API handlers") +Signed-off-by: Naftali Goldstein +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +index 7a98e1a1dc40..dabbc04853ac 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +@@ -98,8 +98,12 @@ static u8 rs_fw_sgi_cw_support(struct ieee80211_sta *sta) + { + struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap; + struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap; ++ struct ieee80211_sta_he_cap *he_cap = &sta->he_cap; + u8 supp = 0; + ++ if (he_cap && he_cap->has_he) ++ return 0; ++ + if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20) + supp |= BIT(IWL_TLC_MNG_CH_WIDTH_20MHZ); + if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40) +-- +2.19.1 + diff --git a/queue-4.20/iwlwifi-mvm-fix-setting-he-ppe-fw-config.patch b/queue-4.20/iwlwifi-mvm-fix-setting-he-ppe-fw-config.patch new file mode 100644 index 00000000000..3822d20cf4d --- /dev/null +++ b/queue-4.20/iwlwifi-mvm-fix-setting-he-ppe-fw-config.patch @@ -0,0 +1,60 @@ +From bf46f25738254a146936f7ba2b2a8934dec0d87d Mon Sep 17 00:00:00 2001 +From: Naftali Goldstein +Date: Wed, 22 Aug 2018 12:18:19 +0300 +Subject: iwlwifi: mvm: fix setting HE ppe FW config + +[ Upstream commit 189b8d441b0f7825f0b4278851c52afaa0515ed2 ] + +The FW expects to get the ppe value for each NSS-BW pair in the same +format as in the he phy capabilities IE, which means that a value of 0 +implies ppe should be used for BPSK (mcs 0). If there are no PPE +thresholds in the IE, or if for some NSS-RU pair there's no threshold +set for it (this could happen because it's a variable-sized field), it +means no PPE should not be used for that pair, so the value sent to FW +should be 7 which corresponds to "none". + +Fixes: 514c30696fbc ("iwlwifi: add support for IEEE802.11ax") +Signed-off-by: Naftali Goldstein +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/api/mac.h | 2 +- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +++++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h +index 1dd23f846fb9..f3ccd7948340 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/mac.h +@@ -442,7 +442,7 @@ struct iwl_he_backoff_conf { + * Support for Nss x BW (or RU) matrix: + * (0=SISO, 1=MIMO2) x (0-20MHz, 1-40MHz, 2-80MHz, 3-160MHz) + * Each entry contains 2 QAM thresholds for 8us and 16us: +- * 0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6/7=RES ++ * 0=BPSK, 1=QPSK, 2=16QAM, 3=64QAM, 4=256QAM, 5=1024QAM, 6=RES, 7=NONE + * i.e. QAM_th1 < QAM_th2 such if TX uses QAM_tx: + * QAM_tx < QAM_th1 --> PPE=0us + * QAM_th1 <= QAM_tx < QAM_th2 --> PPE=8us +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 00f831d88366..5a42c617c54c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -2005,7 +2005,13 @@ static void iwl_mvm_cfg_he_sta(struct iwl_mvm *mvm, + if (sta->he_cap.he_cap_elem.mac_cap_info[4] & IEEE80211_HE_MAC_CAP4_BQR) + sta_ctxt_cmd.htc_flags |= cpu_to_le32(IWL_HE_HTC_BQR_SUPP); + +- /* If PPE Thresholds exist, parse them into a FW-familiar format */ ++ /* ++ * Initialize the PPE thresholds to "None" (7), as described in Table ++ * 9-262ac of 80211.ax/D3.0. ++ */ ++ memset(&sta_ctxt_cmd.pkt_ext, 7, sizeof(sta_ctxt_cmd.pkt_ext)); ++ ++ /* If PPE Thresholds exist, parse them into a FW-familiar format. */ + if (sta->he_cap.he_cap_elem.phy_cap_info[6] & + IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) { + u8 nss = (sta->he_cap.ppe_thres[0] & +-- +2.19.1 + diff --git a/queue-4.20/kdb-don-t-back-trace-on-a-cpu-that-didn-t-round-up.patch b/queue-4.20/kdb-don-t-back-trace-on-a-cpu-that-didn-t-round-up.patch new file mode 100644 index 00000000000..73c0b5c2565 --- /dev/null +++ b/queue-4.20/kdb-don-t-back-trace-on-a-cpu-that-didn-t-round-up.patch @@ -0,0 +1,88 @@ +From 883281b4a023d14a42375870eb5449b0ad13274e Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Tue, 4 Dec 2018 19:38:28 -0800 +Subject: kdb: Don't back trace on a cpu that didn't round up + +[ Upstream commit 162bc7f5afd75b72acbe3c5f3488ef7e64a3fe36 ] + +If you have a CPU that fails to round up and then run 'btc' you'll end +up crashing in kdb becaue we dereferenced NULL. Let's add a check. +It's wise to also set the task to NULL when leaving the debugger so +that if we fail to round up on a later entry into the debugger we +won't backtrace a stale task. + +Signed-off-by: Douglas Anderson +Acked-by: Daniel Thompson +Signed-off-by: Daniel Thompson +Signed-off-by: Sasha Levin +--- + kernel/debug/debug_core.c | 4 ++++ + kernel/debug/kdb/kdb_bt.c | 11 ++++++++++- + kernel/debug/kdb/kdb_debugger.c | 7 ------- + 3 files changed, 14 insertions(+), 8 deletions(-) + +diff --git a/kernel/debug/debug_core.c b/kernel/debug/debug_core.c +index 65c0f1363788..94aa9ae0007a 100644 +--- a/kernel/debug/debug_core.c ++++ b/kernel/debug/debug_core.c +@@ -535,6 +535,8 @@ return_normal: + arch_kgdb_ops.correct_hw_break(); + if (trace_on) + tracing_on(); ++ kgdb_info[cpu].debuggerinfo = NULL; ++ kgdb_info[cpu].task = NULL; + kgdb_info[cpu].exception_state &= + ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE); + kgdb_info[cpu].enter_kgdb--; +@@ -667,6 +669,8 @@ kgdb_restore: + if (trace_on) + tracing_on(); + ++ kgdb_info[cpu].debuggerinfo = NULL; ++ kgdb_info[cpu].task = NULL; + kgdb_info[cpu].exception_state &= + ~(DCPU_WANT_MASTER | DCPU_IS_SLAVE); + kgdb_info[cpu].enter_kgdb--; +diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c +index 7921ae4fca8d..7e2379aa0a1e 100644 +--- a/kernel/debug/kdb/kdb_bt.c ++++ b/kernel/debug/kdb/kdb_bt.c +@@ -186,7 +186,16 @@ kdb_bt(int argc, const char **argv) + kdb_printf("btc: cpu status: "); + kdb_parse("cpu\n"); + for_each_online_cpu(cpu) { +- sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); ++ void *kdb_tsk = KDB_TSK(cpu); ++ ++ /* If a CPU failed to round up we could be here */ ++ if (!kdb_tsk) { ++ kdb_printf("WARNING: no task for cpu %ld\n", ++ cpu); ++ continue; ++ } ++ ++ sprintf(buf, "btt 0x%px\n", kdb_tsk); + kdb_parse(buf); + touch_nmi_watchdog(); + } +diff --git a/kernel/debug/kdb/kdb_debugger.c b/kernel/debug/kdb/kdb_debugger.c +index 15e1a7af5dd0..53a0df6e4d92 100644 +--- a/kernel/debug/kdb/kdb_debugger.c ++++ b/kernel/debug/kdb/kdb_debugger.c +@@ -118,13 +118,6 @@ int kdb_stub(struct kgdb_state *ks) + kdb_bp_remove(); + KDB_STATE_CLEAR(DOING_SS); + KDB_STATE_SET(PAGER); +- /* zero out any offline cpu data */ +- for_each_present_cpu(i) { +- if (!cpu_online(i)) { +- kgdb_info[i].debuggerinfo = NULL; +- kgdb_info[i].task = NULL; +- } +- } + if (ks->err_code == DIE_OOPS || reason == KDB_REASON_OOPS) { + ks->pass_exception = 1; + KDB_FLAG_SET(CATASTROPHIC); +-- +2.19.1 + diff --git a/queue-4.20/kernel-hung_task.c-break-rcu-locks-based-on-jiffies.patch b/queue-4.20/kernel-hung_task.c-break-rcu-locks-based-on-jiffies.patch new file mode 100644 index 00000000000..47bddb57665 --- /dev/null +++ b/queue-4.20/kernel-hung_task.c-break-rcu-locks-based-on-jiffies.patch @@ -0,0 +1,69 @@ +From b2a7d40b7d3e14b78591fa2c3abdf260b4baf95d Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Thu, 3 Jan 2019 15:26:31 -0800 +Subject: kernel/hung_task.c: break RCU locks based on jiffies + +[ Upstream commit 304ae42739b108305f8d7b3eb3c1aec7c2b643a9 ] + +check_hung_uninterruptible_tasks() is currently calling rcu_lock_break() +for every 1024 threads. But check_hung_task() is very slow if printk() +was called, and is very fast otherwise. + +If many threads within some 1024 threads called printk(), the RCU grace +period might be extended enough to trigger RCU stall warnings. +Therefore, calling rcu_lock_break() for every some fixed jiffies will be +safer. + +Link: http://lkml.kernel.org/r/1544800658-11423-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp +Signed-off-by: Tetsuo Handa +Acked-by: Paul E. McKenney +Cc: Petr Mladek +Cc: Sergey Senozhatsky +Cc: Dmitry Vyukov +Cc: "Rafael J. Wysocki" +Cc: Vitaly Kuznetsov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/hung_task.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/hung_task.c b/kernel/hung_task.c +index cb8e3e8ac7b9..444b8b5dd69f 100644 +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -34,7 +34,7 @@ int __read_mostly sysctl_hung_task_check_count = PID_MAX_LIMIT; + * is disabled during the critical section. It also controls the size of + * the RCU grace period. So it needs to be upper-bound. + */ +-#define HUNG_TASK_BATCHING 1024 ++#define HUNG_TASK_LOCK_BREAK (HZ / 10) + + /* + * Zero means infinite timeout - no checking done: +@@ -173,7 +173,7 @@ static bool rcu_lock_break(struct task_struct *g, struct task_struct *t) + static void check_hung_uninterruptible_tasks(unsigned long timeout) + { + int max_count = sysctl_hung_task_check_count; +- int batch_count = HUNG_TASK_BATCHING; ++ unsigned long last_break = jiffies; + struct task_struct *g, *t; + + /* +@@ -188,10 +188,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout) + for_each_process_thread(g, t) { + if (!max_count--) + goto unlock; +- if (!--batch_count) { +- batch_count = HUNG_TASK_BATCHING; ++ if (time_after(jiffies, last_break + HUNG_TASK_LOCK_BREAK)) { + if (!rcu_lock_break(g, t)) + goto unlock; ++ last_break = jiffies; + } + /* use "==" to skip the TASK_KILLABLE tasks waiting on NFS */ + if (t->state == TASK_UNINTERRUPTIBLE) +-- +2.19.1 + diff --git a/queue-4.20/kernel-hung_task.c-force-console-verbose-before-pani.patch b/queue-4.20/kernel-hung_task.c-force-console-verbose-before-pani.patch new file mode 100644 index 00000000000..edc46656a15 --- /dev/null +++ b/queue-4.20/kernel-hung_task.c-force-console-verbose-before-pani.patch @@ -0,0 +1,77 @@ +From 3f1b2cc2704771575ece19aedc37d6c09a7131e1 Mon Sep 17 00:00:00 2001 +From: "Liu, Chuansheng" +Date: Thu, 3 Jan 2019 15:26:27 -0800 +Subject: kernel/hung_task.c: force console verbose before panic + +[ Upstream commit 168e06f7937d96c7222037d8a05565e8a6eb00fe ] + +Based on commit 401c636a0eeb ("kernel/hung_task.c: show all hung tasks +before panic"), we could get the call stack of hung task. + +However, if the console loglevel is not high, we still can not see the +useful panic information in practice, and in most cases users don't set +console loglevel to high level. + +This patch is to force console verbose before system panic, so that the +real useful information can be seen in the console, instead of being +like the following, which doesn't have hung task information. + + INFO: task init:1 blocked for more than 120 seconds. + Tainted: G U W 4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1 + "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + Kernel panic - not syncing: hung_task: blocked tasks + CPU: 2 PID: 479 Comm: khungtaskd Tainted: G U W 4.19.0-quilt-2e5dc0ac-g51b6c21d76cc #1 + Call Trace: + dump_stack+0x4f/0x65 + panic+0xde/0x231 + watchdog+0x290/0x410 + kthread+0x12c/0x150 + ret_from_fork+0x35/0x40 + reboot: panic mode set: p,w + Kernel Offset: 0x34000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) + +Link: http://lkml.kernel.org/r/27240C0AC20F114CBF8149A2696CBE4A6015B675@SHSMSX101.ccr.corp.intel.com +Signed-off-by: Chuansheng Liu +Reviewed-by: Petr Mladek +Reviewed-by: Sergey Senozhatsky +Cc: Tetsuo Handa +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/hung_task.c | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/kernel/hung_task.c b/kernel/hung_task.c +index 444b8b5dd69f..4a9191617076 100644 +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -112,8 +112,11 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout) + + trace_sched_process_hang(t); + +- if (!sysctl_hung_task_warnings && !sysctl_hung_task_panic) +- return; ++ if (sysctl_hung_task_panic) { ++ console_verbose(); ++ hung_task_show_lock = true; ++ hung_task_call_panic = true; ++ } + + /* + * Ok, the task did not get scheduled for more than 2 minutes, +@@ -135,11 +138,6 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout) + } + + touch_nmi_watchdog(); +- +- if (sysctl_hung_task_panic) { +- hung_task_show_lock = true; +- hung_task_call_panic = true; +- } + } + + /* +-- +2.19.1 + diff --git a/queue-4.20/kernel-kcov.c-mark-write_comp_data-as-notrace.patch b/queue-4.20/kernel-kcov.c-mark-write_comp_data-as-notrace.patch new file mode 100644 index 00000000000..1b99f34c466 --- /dev/null +++ b/queue-4.20/kernel-kcov.c-mark-write_comp_data-as-notrace.patch @@ -0,0 +1,60 @@ +From 04e8b443ab837d5b8b05de03d6d9953da98e3121 Mon Sep 17 00:00:00 2001 +From: Anders Roxell +Date: Thu, 3 Jan 2019 15:28:24 -0800 +Subject: kernel/kcov.c: mark write_comp_data() as notrace + +[ Upstream commit 634724431607f6f46c495dfef801a1c8b44a96d9 ] + +Since __sanitizer_cov_trace_const_cmp4 is marked as notrace, the +function called from __sanitizer_cov_trace_const_cmp4 shouldn't be +traceable either. ftrace_graph_caller() gets called every time func +write_comp_data() gets called if it isn't marked 'notrace'. This is the +backtrace from gdb: + + #0 ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:179 + #1 0xffffff8010201920 in ftrace_caller () at ../arch/arm64/kernel/entry-ftrace.S:151 + #2 0xffffff8010439714 in write_comp_data (type=5, arg1=0, arg2=0, ip=18446743524224276596) at ../kernel/kcov.c:116 + #3 0xffffff8010439894 in __sanitizer_cov_trace_const_cmp4 (arg1=, arg2=) at ../kernel/kcov.c:188 + #4 0xffffff8010201874 in prepare_ftrace_return (self_addr=18446743524226602768, parent=0xffffff801014b918, frame_pointer=18446743524223531344) at ./include/generated/atomic-instrumented.h:27 + #5 0xffffff801020194c in ftrace_graph_caller () at ../arch/arm64/kernel/entry-ftrace.S:182 + +Rework so that write_comp_data() that are called from +__sanitizer_cov_trace_*_cmp*() are marked as 'notrace'. + +Commit 903e8ff86753 ("kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace") +missed to mark write_comp_data() as 'notrace'. When that patch was +created gcc-7 was used. In lib/Kconfig.debug +config KCOV_ENABLE_COMPARISONS + depends on $(cc-option,-fsanitize-coverage=trace-cmp) + +That code path isn't hit with gcc-7. However, it were that with gcc-8. + +Link: http://lkml.kernel.org/r/20181206143011.23719-1-anders.roxell@linaro.org +Signed-off-by: Anders Roxell +Signed-off-by: Arnd Bergmann +Co-developed-by: Arnd Bergmann +Acked-by: Steven Rostedt (VMware) +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/kcov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/kcov.c b/kernel/kcov.c +index 97959d7b77e2..c2277dbdbfb1 100644 +--- a/kernel/kcov.c ++++ b/kernel/kcov.c +@@ -112,7 +112,7 @@ void notrace __sanitizer_cov_trace_pc(void) + EXPORT_SYMBOL(__sanitizer_cov_trace_pc); + + #ifdef CONFIG_KCOV_ENABLE_COMPARISONS +-static void write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip) ++static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip) + { + struct task_struct *t; + u64 *area; +-- +2.19.1 + diff --git a/queue-4.20/kobject-return-error-code-if-writing-sys-.-uevent-fa.patch b/queue-4.20/kobject-return-error-code-if-writing-sys-.-uevent-fa.patch new file mode 100644 index 00000000000..de8d054f919 --- /dev/null +++ b/queue-4.20/kobject-return-error-code-if-writing-sys-.-uevent-fa.patch @@ -0,0 +1,95 @@ +From 34895607f7892b2c542b2a0ba936bf12b449c574 Mon Sep 17 00:00:00 2001 +From: Peter Rajnoha +Date: Wed, 5 Dec 2018 12:27:44 +0100 +Subject: kobject: return error code if writing /sys/.../uevent fails + +[ Upstream commit df44b479654f62b478c18ee4d8bc4e9f897a9844 ] + +Propagate error code back to userspace if writing the /sys/.../uevent +file fails. Before, the write operation always returned with success, +even if we failed to recognize the input string or if we failed to +generate the uevent itself. + +With the error codes properly propagated back to userspace, we are +able to react in userspace accordingly by not assuming and awaiting +a uevent that is not delivered. + +Signed-off-by: Peter Rajnoha +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/bus.c | 12 ++++++++---- + drivers/base/core.c | 8 +++++++- + kernel/module.c | 6 ++++-- + 3 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/base/bus.c b/drivers/base/bus.c +index 585e2e1c9c8f..e06a57936cc9 100644 +--- a/drivers/base/bus.c ++++ b/drivers/base/bus.c +@@ -614,8 +614,10 @@ static void remove_probe_files(struct bus_type *bus) + static ssize_t uevent_store(struct device_driver *drv, const char *buf, + size_t count) + { +- kobject_synth_uevent(&drv->p->kobj, buf, count); +- return count; ++ int rc; ++ ++ rc = kobject_synth_uevent(&drv->p->kobj, buf, count); ++ return rc ? rc : count; + } + static DRIVER_ATTR_WO(uevent); + +@@ -831,8 +833,10 @@ static void klist_devices_put(struct klist_node *n) + static ssize_t bus_uevent_store(struct bus_type *bus, + const char *buf, size_t count) + { +- kobject_synth_uevent(&bus->p->subsys.kobj, buf, count); +- return count; ++ int rc; ++ ++ rc = kobject_synth_uevent(&bus->p->subsys.kobj, buf, count); ++ return rc ? rc : count; + } + static BUS_ATTR(uevent, S_IWUSR, NULL, bus_uevent_store); + +diff --git a/drivers/base/core.c b/drivers/base/core.c +index 04bbcd779e11..92e2c32c2227 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1067,8 +1067,14 @@ out: + static ssize_t uevent_store(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) + { +- if (kobject_synth_uevent(&dev->kobj, buf, count)) ++ int rc; ++ ++ rc = kobject_synth_uevent(&dev->kobj, buf, count); ++ ++ if (rc) { + dev_err(dev, "uevent: failed to send synthetic uevent\n"); ++ return rc; ++ } + + return count; + } +diff --git a/kernel/module.c b/kernel/module.c +index 49a405891587..0812a7f80fa7 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -1207,8 +1207,10 @@ static ssize_t store_uevent(struct module_attribute *mattr, + struct module_kobject *mk, + const char *buffer, size_t count) + { +- kobject_synth_uevent(&mk->kobj, buffer, count); +- return count; ++ int rc; ++ ++ rc = kobject_synth_uevent(&mk->kobj, buffer, count); ++ return rc ? rc : count; + } + + struct module_attribute module_uevent = +-- +2.19.1 + diff --git a/queue-4.20/kvm-change-offset-in-kvm_write_guest_offset_cached-t.patch b/queue-4.20/kvm-change-offset-in-kvm_write_guest_offset_cached-t.patch new file mode 100644 index 00000000000..196c09c5a2b --- /dev/null +++ b/queue-4.20/kvm-change-offset-in-kvm_write_guest_offset_cached-t.patch @@ -0,0 +1,63 @@ +From 4d79839ee33bdde26f6e86ead8caa925ca4bc2b1 Mon Sep 17 00:00:00 2001 +From: Jim Mattson +Date: Fri, 14 Dec 2018 14:34:43 -0800 +Subject: kvm: Change offset in kvm_write_guest_offset_cached to unsigned +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 7a86dab8cf2f0fdf508f3555dddfc236623bff60 ] + +Since the offset is added directly to the hva from the +gfn_to_hva_cache, a negative offset could result in an out of bounds +write. The existing BUG_ON only checks for addresses beyond the end of +the gfn_to_hva_cache, not for addresses before the start of the +gfn_to_hva_cache. + +Note that all current call sites have non-negative offsets. + +Fixes: 4ec6e8636256 ("kvm: Introduce kvm_write_guest_offset_cached()") +Reported-by: Cfir Cohen +Signed-off-by: Jim Mattson +Reviewed-by: Cfir Cohen +Reviewed-by: Peter Shier +Reviewed-by: Krish Sadhukhan +Reviewed-by: Sean Christopherson +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +--- + include/linux/kvm_host.h | 3 ++- + virt/kvm/kvm_main.c | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index c926698040e0..a03d5e264e5e 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -694,7 +694,8 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data, + int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc, + void *data, unsigned long len); + int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc, +- void *data, int offset, unsigned long len); ++ void *data, unsigned int offset, ++ unsigned long len); + int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc, + gpa_t gpa, unsigned long len); + int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len); +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 2679e476b6c3..065ee2fb4034 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1965,7 +1965,8 @@ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc, + EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init); + + int kvm_write_guest_offset_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc, +- void *data, int offset, unsigned long len) ++ void *data, unsigned int offset, ++ unsigned long len) + { + struct kvm_memslots *slots = kvm_memslots(kvm); + int r; +-- +2.19.1 + diff --git a/queue-4.20/kvm-ppc-book3s-only-report-kvm_cap_spapr_tce_vfio-on.patch b/queue-4.20/kvm-ppc-book3s-only-report-kvm_cap_spapr_tce_vfio-on.patch new file mode 100644 index 00000000000..60761d54a60 --- /dev/null +++ b/queue-4.20/kvm-ppc-book3s-only-report-kvm_cap_spapr_tce_vfio-on.patch @@ -0,0 +1,45 @@ +From c4d57f6d32a27b6449b38f460c1fcd13bcd40642 Mon Sep 17 00:00:00 2001 +From: Suraj Jitindar Singh +Date: Fri, 14 Dec 2018 16:29:03 +1100 +Subject: KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv + machines + +[ Upstream commit 693ac10a88a2219bde553b2e8460dbec97e594e6 ] + +The kvm capability KVM_CAP_SPAPR_TCE_VFIO is used to indicate the +availability of in kernel tce acceleration for vfio. However it is +currently the case that this is only available on a powernv machine, +not for a pseries machine. + +Thus make this capability dependent on having the cpu feature +CPU_FTR_HVMODE. + +[paulus@ozlabs.org - fixed compilation for Book E.] + +Signed-off-by: Suraj Jitindar Singh +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/powerpc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 2869a299c4ed..75e2e471442f 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -543,8 +543,11 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) + #ifdef CONFIG_PPC_BOOK3S_64 + case KVM_CAP_SPAPR_TCE: + case KVM_CAP_SPAPR_TCE_64: +- /* fallthrough */ ++ r = 1; ++ break; + case KVM_CAP_SPAPR_TCE_VFIO: ++ r = !!cpu_has_feature(CPU_FTR_HVMODE); ++ break; + case KVM_CAP_PPC_RTAS: + case KVM_CAP_PPC_FIXUP_HCALL: + case KVM_CAP_PPC_ENABLE_HCALL: +-- +2.19.1 + diff --git a/queue-4.20/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch b/queue-4.20/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch new file mode 100644 index 00000000000..7df497168d8 --- /dev/null +++ b/queue-4.20/kvm-s390-unregister-debug-feature-on-failing-arch-in.patch @@ -0,0 +1,65 @@ +From 97cbeb24612a45f7756d78107bae0683c909bff2 Mon Sep 17 00:00:00 2001 +From: Michael Mueller +Date: Fri, 30 Nov 2018 15:32:06 +0100 +Subject: KVM: s390: unregister debug feature on failing arch init + +[ Upstream commit 308c3e6673b012beecb96ef04cc65f4a0e7cdd99 ] + +Make sure the debug feature and its allocated resources get +released upon unsuccessful architecture initialization. + +A related indication of the issue will be reported as kernel +message. + +Signed-off-by: Michael Mueller +Reviewed-by: Cornelia Huck +Reviewed-by: Pierre Morel +Reviewed-by: David Hildenbrand +Message-Id: <20181130143215.69496-2-mimu@linux.ibm.com> +Signed-off-by: Christian Borntraeger +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index fe24150ff666..d8d8e0788157 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -417,19 +417,30 @@ static void kvm_s390_cpu_feat_init(void) + + int kvm_arch_init(void *opaque) + { ++ int rc; ++ + kvm_s390_dbf = debug_register("kvm-trace", 32, 1, 7 * sizeof(long)); + if (!kvm_s390_dbf) + return -ENOMEM; + + if (debug_register_view(kvm_s390_dbf, &debug_sprintf_view)) { +- debug_unregister(kvm_s390_dbf); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto out_debug_unreg; + } + + kvm_s390_cpu_feat_init(); + + /* Register floating interrupt controller interface. */ +- return kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ rc = kvm_register_device_ops(&kvm_flic_ops, KVM_DEV_TYPE_FLIC); ++ if (rc) { ++ pr_err("Failed to register FLIC rc=%d\n", rc); ++ goto out_debug_unreg; ++ } ++ return 0; ++ ++out_debug_unreg: ++ debug_unregister(kvm_s390_dbf); ++ return rc; + } + + void kvm_arch_exit(void) +-- +2.19.1 + diff --git a/queue-4.20/kvm-x86-svm-report-msr_ia32_mcg_ext_ctl-as-unsupport.patch b/queue-4.20/kvm-x86-svm-report-msr_ia32_mcg_ext_ctl-as-unsupport.patch new file mode 100644 index 00000000000..873ffa80116 --- /dev/null +++ b/queue-4.20/kvm-x86-svm-report-msr_ia32_mcg_ext_ctl-as-unsupport.patch @@ -0,0 +1,45 @@ +From 7f6c730c05535c47c5d20b19f080b725594aa888 Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Wed, 19 Dec 2018 12:06:13 +0100 +Subject: KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit e87555e550cef4941579cd879759a7c0dee24e68 ] + +AMD doesn't seem to implement MSR_IA32_MCG_EXT_CTL and svm code in kvm +knows nothing about it, however, this MSR is among emulated_msrs and +thus returned with KVM_GET_MSR_INDEX_LIST. The consequent KVM_GET_MSRS, +of course, fails. + +Report the MSR as unsupported to not confuse userspace. + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 101f53ccf571..11641d9e7f6f 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -5836,6 +5836,13 @@ static bool svm_cpu_has_accelerated_tpr(void) + + static bool svm_has_emulated_msr(int index) + { ++ switch (index) { ++ case MSR_IA32_MCG_EXT_CTL: ++ return false; ++ default: ++ break; ++ } ++ + return true; + } + +-- +2.19.1 + diff --git a/queue-4.20/lightnvm-fix-uninitialized-return-value-in-nvm_get_c.patch b/queue-4.20/lightnvm-fix-uninitialized-return-value-in-nvm_get_c.patch new file mode 100644 index 00000000000..cf300168e3c --- /dev/null +++ b/queue-4.20/lightnvm-fix-uninitialized-return-value-in-nvm_get_c.patch @@ -0,0 +1,67 @@ +From 2c23c4c9ebd6be1f808aa3babd13cb3da8633eb5 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Tue, 11 Dec 2018 20:16:08 +0100 +Subject: lightnvm: Fix uninitialized return value in nvm_get_chunk_meta() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 55e58c5e78aad9d3246f57e7718cf5ee7adde9e3 ] + +With gcc 4.1: + + drivers/lightnvm/core.c: In function ‘nvm_get_bb_meta’: + drivers/lightnvm/core.c:977: warning: ‘ret’ may be used uninitialized in this function + +and + + drivers/nvme/host/lightnvm.c: In function ‘nvme_nvm_get_chk_meta’: + drivers/nvme/host/lightnvm.c:580: warning: ‘ret’ may be used uninitialized in this function + +Indeed, if (for the former) the number of channels or LUNs is zero, or +(for both) the passed number of chunks is zero, ret will be returned +uninitialized. + +Fix this by preinitializing ret to zero. + +Fixes: aff3fb18f957de93 ("lightnvm: move bad block and chunk state logic to core") +Fixes: a294c199455187d1 ("lightnvm: implement get log report chunk helpers") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/lightnvm/core.c | 2 +- + drivers/nvme/host/lightnvm.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c +index efb976a863d2..73ab3cf26868 100644 +--- a/drivers/lightnvm/core.c ++++ b/drivers/lightnvm/core.c +@@ -974,7 +974,7 @@ static int nvm_get_bb_meta(struct nvm_dev *dev, sector_t slba, + struct ppa_addr ppa; + u8 *blks; + int ch, lun, nr_blks; +- int ret; ++ int ret = 0; + + ppa.ppa = slba; + ppa = dev_to_generic_addr(dev, ppa); +diff --git a/drivers/nvme/host/lightnvm.c b/drivers/nvme/host/lightnvm.c +index a4f3b263cd6c..d64805dc8efb 100644 +--- a/drivers/nvme/host/lightnvm.c ++++ b/drivers/nvme/host/lightnvm.c +@@ -577,7 +577,8 @@ static int nvme_nvm_get_chk_meta(struct nvm_dev *ndev, + struct ppa_addr ppa; + size_t left = nchks * sizeof(struct nvme_nvm_chk_meta); + size_t log_pos, offset, len; +- int ret, i, max_len; ++ int i, max_len; ++ int ret = 0; + + /* + * limit requests to maximum 256K to avoid issuing arbitrary large +-- +2.19.1 + diff --git a/queue-4.20/lightnvm-pblk-add-lock-protection-to-list-operations.patch b/queue-4.20/lightnvm-pblk-add-lock-protection-to-list-operations.patch new file mode 100644 index 00000000000..2b0ff146f22 --- /dev/null +++ b/queue-4.20/lightnvm-pblk-add-lock-protection-to-list-operations.patch @@ -0,0 +1,56 @@ +From f0da188fd0f5d27f2e6443fd41082223f90f3dcc Mon Sep 17 00:00:00 2001 +From: Hua Su +Date: Tue, 11 Dec 2018 20:16:18 +0100 +Subject: lightnvm: pblk: add lock protection to list operations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit fde201a466c6ad5efd72cb54fdf2cefa8b6c6ad7 ] + +Protect the list_add on the pblk_line_init_bb() error +path in case this code is used for some other purpose +in the future. + +Signed-off-by: Hua Su +Reviewed-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/lightnvm/pblk-core.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/lightnvm/pblk-core.c b/drivers/lightnvm/pblk-core.c +index 6944aac43b01..247112e1db94 100644 +--- a/drivers/lightnvm/pblk-core.c ++++ b/drivers/lightnvm/pblk-core.c +@@ -1295,15 +1295,22 @@ int pblk_line_recov_alloc(struct pblk *pblk, struct pblk_line *line) + + ret = pblk_line_alloc_bitmaps(pblk, line); + if (ret) +- return ret; ++ goto fail; + + if (!pblk_line_init_bb(pblk, line, 0)) { +- list_add(&line->list, &l_mg->free_list); +- return -EINTR; ++ ret = -EINTR; ++ goto fail; + } + + pblk_rl_free_lines_dec(&pblk->rl, line, true); + return 0; ++ ++fail: ++ spin_lock(&l_mg->free_lock); ++ list_add(&line->list, &l_mg->free_list); ++ spin_unlock(&l_mg->free_lock); ++ ++ return ret; + } + + void pblk_line_recov_close(struct pblk *pblk, struct pblk_line *line) +-- +2.19.1 + diff --git a/queue-4.20/lightnvm-pblk-fix-resubmission-of-overwritten-write-.patch b/queue-4.20/lightnvm-pblk-fix-resubmission-of-overwritten-write-.patch new file mode 100644 index 00000000000..a6bb48ae3b5 --- /dev/null +++ b/queue-4.20/lightnvm-pblk-fix-resubmission-of-overwritten-write-.patch @@ -0,0 +1,48 @@ +From 9a80c0658a21ef213c635c009ce4a6cfd3521bd6 Mon Sep 17 00:00:00 2001 +From: Hans Holmberg +Date: Tue, 11 Dec 2018 20:16:10 +0100 +Subject: lightnvm: pblk: fix resubmission of overwritten write err lbas +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit c12fa401ac8c94a74aff68bb5736b3f1dc695fa8 ] + +Make sure we only look up valid lba addresses on the resubmission path. + +If an lba is invalidated in the write buffer, that sector will be +submitted to disk (as it is already mapped to a ppa), and that write +might fail, resulting in a crash when trying to look up the lba in the +mapping table (as the lba is marked as invalid). + +Signed-off-by: Hans Holmberg +Reviewed-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/lightnvm/pblk-write.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/lightnvm/pblk-write.c b/drivers/lightnvm/pblk-write.c +index fa8726493b39..3ddd16f47106 100644 +--- a/drivers/lightnvm/pblk-write.c ++++ b/drivers/lightnvm/pblk-write.c +@@ -148,9 +148,11 @@ static void pblk_prepare_resubmit(struct pblk *pblk, unsigned int sentry, + w_ctx = &entry->w_ctx; + + /* Check if the lba has been overwritten */ +- ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba); +- if (!pblk_ppa_comp(ppa_l2p, entry->cacheline)) +- w_ctx->lba = ADDR_EMPTY; ++ if (w_ctx->lba != ADDR_EMPTY) { ++ ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba); ++ if (!pblk_ppa_comp(ppa_l2p, entry->cacheline)) ++ w_ctx->lba = ADDR_EMPTY; ++ } + + /* Mark up the entry as submittable again */ + flags = READ_ONCE(w_ctx->flags); +-- +2.19.1 + diff --git a/queue-4.20/livepatch-check-kzalloc-return-values.patch b/queue-4.20/livepatch-check-kzalloc-return-values.patch new file mode 100644 index 00000000000..7528892ad44 --- /dev/null +++ b/queue-4.20/livepatch-check-kzalloc-return-values.patch @@ -0,0 +1,59 @@ +From 9963052ec9e615815e93833effa1e10dae783c1c Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Fri, 14 Dec 2018 17:56:10 +0100 +Subject: livepatch: check kzalloc return values + +[ Upstream commit 5f30b2e823484ce6a79f2b59901b6351c15effa6 ] + +kzalloc() return should always be checked - notably in example code +where this may be seen as reference. On failure of allocation in +livepatch_fix1_dummy_alloc() respectively dummy_alloc() previous +allocation is freed (thanks to Petr Mladek for +catching this) and NULL returned. + +Signed-off-by: Nicholas Mc Guire +Fixes: 439e7271dc2b ("livepatch: introduce shadow variable API") +Acked-by: Joe Lawrence +Reviewed-by: Petr Mladek +Acked-by: Miroslav Benes +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + samples/livepatch/livepatch-shadow-fix1.c | 5 +++++ + samples/livepatch/livepatch-shadow-mod.c | 4 ++++ + 2 files changed, 9 insertions(+) + +diff --git a/samples/livepatch/livepatch-shadow-fix1.c b/samples/livepatch/livepatch-shadow-fix1.c +index 49b13553eaae..e8f1bd6b29b1 100644 +--- a/samples/livepatch/livepatch-shadow-fix1.c ++++ b/samples/livepatch/livepatch-shadow-fix1.c +@@ -89,6 +89,11 @@ struct dummy *livepatch_fix1_dummy_alloc(void) + * pointer to handle resource release. + */ + leak = kzalloc(sizeof(int), GFP_KERNEL); ++ if (!leak) { ++ kfree(d); ++ return NULL; ++ } ++ + klp_shadow_alloc(d, SV_LEAK, sizeof(leak), GFP_KERNEL, + shadow_leak_ctor, leak); + +diff --git a/samples/livepatch/livepatch-shadow-mod.c b/samples/livepatch/livepatch-shadow-mod.c +index 4c54b250332d..4aa8a88d3cd6 100644 +--- a/samples/livepatch/livepatch-shadow-mod.c ++++ b/samples/livepatch/livepatch-shadow-mod.c +@@ -118,6 +118,10 @@ noinline struct dummy *dummy_alloc(void) + + /* Oops, forgot to save leak! */ + leak = kzalloc(sizeof(int), GFP_KERNEL); ++ if (!leak) { ++ kfree(d); ++ return NULL; ++ } + + pr_info("%s: dummy @ %p, expires @ %lx\n", + __func__, d, d->jiffies_expire); +-- +2.19.1 + diff --git a/queue-4.20/mac80211-fix-deauth-tx-when-we-disconnect.patch b/queue-4.20/mac80211-fix-deauth-tx-when-we-disconnect.patch new file mode 100644 index 00000000000..78d8534edd5 --- /dev/null +++ b/queue-4.20/mac80211-fix-deauth-tx-when-we-disconnect.patch @@ -0,0 +1,180 @@ +From 5445e83d324dd91ea22435529845fd877ea49dcf Mon Sep 17 00:00:00 2001 +From: Emmanuel Grumbach +Date: Mon, 3 Dec 2018 21:15:49 +0200 +Subject: mac80211: fix deauth TX when we disconnect + +[ Upstream commit f6c7f03f69f7422bc237bc79599e152d390b74e0 ] + +The iTXQs stop/wake queue mechanism involves a whole bunch +of locks and this is probably why the call to +ieee80211_wake_txqs is deferred to a tasklet when called from +__ieee80211_wake_queue. + +Another advantage of that is that ieee80211_wake_txqs might +call the wake_tx_queue() callback and then the driver may +call mac80211 which will call it back in the same context. + +The bug I saw is that when we send a deauth frame as a +station we do: + +flush(drop=1) +tx deauth +flush(drop=0) + +While we flush we stop the queues and wake them up +immediately after we finished flushing. The problem here is +that the tasklet that de-facto enables the queue may not have +run until we send the deauth. Then the deauth frame is sent +to the driver (which is surprising by itself), but the driver +won't get anything useful from ieee80211_tx_dequeue because +the queue is stopped (or more precisely because +vif->txqs_stopped[0] is true). +Then the deauth is not sent. Later on, the tasklet will run, +but that'll be too late. We'll already have removed all the +vif etc... + +Fix this by calling ieee80211_wake_txqs synchronously if we +are not waking up the queues from the driver (we check the +reason to determine that). This makes the code really +convoluted because we may call ieee80211_wake_txqs from +__ieee80211_wake_queue. The latter assumes that +queue_stop_reason_lock has been taken by the caller and +ieee80211_wake_txqs may release the lock to send the frames. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/util.c | 49 ++++++++++++++++++++++++++++++++------------- + 1 file changed, 35 insertions(+), 14 deletions(-) + +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index bec424316ea4..dddfff7cf44f 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -299,16 +299,16 @@ out: + spin_unlock_bh(&fq->lock); + } + +-void ieee80211_wake_txqs(unsigned long data) ++static void ++__releases(&local->queue_stop_reason_lock) ++__acquires(&local->queue_stop_reason_lock) ++_ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags) + { +- struct ieee80211_local *local = (struct ieee80211_local *)data; + struct ieee80211_sub_if_data *sdata; + int n_acs = IEEE80211_NUM_ACS; +- unsigned long flags; + int i; + + rcu_read_lock(); +- spin_lock_irqsave(&local->queue_stop_reason_lock, flags); + + if (local->hw.queues < IEEE80211_NUM_ACS) + n_acs = 1; +@@ -317,7 +317,7 @@ void ieee80211_wake_txqs(unsigned long data) + if (local->queue_stop_reasons[i]) + continue; + +- spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); ++ spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags); + list_for_each_entry_rcu(sdata, &local->interfaces, list) { + int ac; + +@@ -329,13 +329,22 @@ void ieee80211_wake_txqs(unsigned long data) + __ieee80211_wake_txqs(sdata, ac); + } + } +- spin_lock_irqsave(&local->queue_stop_reason_lock, flags); ++ spin_lock_irqsave(&local->queue_stop_reason_lock, *flags); + } + +- spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + rcu_read_unlock(); + } + ++void ieee80211_wake_txqs(unsigned long data) ++{ ++ struct ieee80211_local *local = (struct ieee80211_local *)data; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&local->queue_stop_reason_lock, flags); ++ _ieee80211_wake_txqs(local, &flags); ++ spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); ++} ++ + void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue) + { + struct ieee80211_sub_if_data *sdata; +@@ -371,7 +380,8 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue) + + static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue, + enum queue_stop_reason reason, +- bool refcounted) ++ bool refcounted, ++ unsigned long *flags) + { + struct ieee80211_local *local = hw_to_local(hw); + +@@ -405,8 +415,19 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue, + } else + tasklet_schedule(&local->tx_pending_tasklet); + +- if (local->ops->wake_tx_queue) +- tasklet_schedule(&local->wake_txqs_tasklet); ++ /* ++ * Calling _ieee80211_wake_txqs here can be a problem because it may ++ * release queue_stop_reason_lock which has been taken by ++ * __ieee80211_wake_queue's caller. It is certainly not very nice to ++ * release someone's lock, but it is fine because all the callers of ++ * __ieee80211_wake_queue call it right before releasing the lock. ++ */ ++ if (local->ops->wake_tx_queue) { ++ if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER) ++ tasklet_schedule(&local->wake_txqs_tasklet); ++ else ++ _ieee80211_wake_txqs(local, flags); ++ } + } + + void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue, +@@ -417,7 +438,7 @@ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue, + unsigned long flags; + + spin_lock_irqsave(&local->queue_stop_reason_lock, flags); +- __ieee80211_wake_queue(hw, queue, reason, refcounted); ++ __ieee80211_wake_queue(hw, queue, reason, refcounted, &flags); + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + } + +@@ -514,7 +535,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local, + false); + __skb_queue_tail(&local->pending[queue], skb); + __ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD, +- false); ++ false, &flags); + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + } + +@@ -547,7 +568,7 @@ void ieee80211_add_pending_skbs(struct ieee80211_local *local, + for (i = 0; i < hw->queues; i++) + __ieee80211_wake_queue(hw, i, + IEEE80211_QUEUE_STOP_REASON_SKB_ADD, +- false); ++ false, &flags); + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + } + +@@ -605,7 +626,7 @@ void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw, + spin_lock_irqsave(&local->queue_stop_reason_lock, flags); + + for_each_set_bit(i, &queues, hw->queues) +- __ieee80211_wake_queue(hw, i, reason, refcounted); ++ __ieee80211_wake_queue(hw, i, reason, refcounted, &flags); + + spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); + } +-- +2.19.1 + diff --git a/queue-4.20/mac80211-fix-radiotap-vendor-presence-bitmap-handlin.patch b/queue-4.20/mac80211-fix-radiotap-vendor-presence-bitmap-handlin.patch new file mode 100644 index 00000000000..95fd7ba79a9 --- /dev/null +++ b/queue-4.20/mac80211-fix-radiotap-vendor-presence-bitmap-handlin.patch @@ -0,0 +1,50 @@ +From 37aee38a8c5ce1afe43196d79078eae0d578bb0d Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Sat, 15 Dec 2018 11:03:12 +0200 +Subject: mac80211: fix radiotap vendor presence bitmap handling + +[ Upstream commit efc38dd7d5fa5c8cdd0c917c5d00947aa0539443 ] + +Due to the alignment handling, it actually matters where in the code +we add the 4 bytes for the presence bitmap to the length; the first +field is the timestamp with 8 byte alignment so we need to add the +space for the extra vendor namespace presence bitmap *before* we do +any alignment for the fields. + +Move the presence bitmap length accounting to the right place to fix +the alignment for the data properly. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 77d996a60f12..85c365fc7a0c 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -143,6 +143,9 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, + /* allocate extra bitmaps */ + if (status->chains) + len += 4 * hweight8(status->chains); ++ /* vendor presence bitmap */ ++ if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) ++ len += 4; + + if (ieee80211_have_rx_timestamp(status)) { + len = ALIGN(len, 8); +@@ -207,8 +210,6 @@ ieee80211_rx_radiotap_hdrlen(struct ieee80211_local *local, + if (status->flag & RX_FLAG_RADIOTAP_VENDOR_DATA) { + struct ieee80211_vendor_radiotap *rtap = (void *)skb->data; + +- /* vendor presence bitmap */ +- len += 4; + /* alignment for fixed 6-byte vendor data header */ + len = ALIGN(len, 2); + /* vendor data header */ +-- +2.19.1 + diff --git a/queue-4.20/mac80211-properly-handle-skb-with-radiotap-only.patch b/queue-4.20/mac80211-properly-handle-skb-with-radiotap-only.patch new file mode 100644 index 00000000000..760f916012f --- /dev/null +++ b/queue-4.20/mac80211-properly-handle-skb-with-radiotap-only.patch @@ -0,0 +1,81 @@ +From a35815142eb2fd72a1272b9b974ccc6b3a9298ff Mon Sep 17 00:00:00 2001 +From: Ilan Peer +Date: Sat, 15 Dec 2018 11:03:17 +0200 +Subject: mac80211: Properly handle SKB with radiotap only + +[ Upstream commit 8020919a9b99d6c990dc6a50e8215e291fbbe5a6 ] + +The monitor interface Rx handling of SKBs that contain only +radiotap information was buggy as it tried to access the +SKB assuming it contains a frame. + +To fix this, check the RX_FLAG_NO_PSDU flag in the Rx status +(indicting that the SKB contains only radiotap information), +and do not perform data path specific processing when the flag +is set. + +Signed-off-by: Ilan Peer +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 26 +++++++++++++++++--------- + 1 file changed, 17 insertions(+), 9 deletions(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 428f7ad5f9b5..77d996a60f12 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -753,6 +753,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, + struct ieee80211_sub_if_data *monitor_sdata = + rcu_dereference(local->monitor_sdata); + bool only_monitor = false; ++ unsigned int min_head_len; + + if (status->flag & RX_FLAG_RADIOTAP_HE) + rtap_space += sizeof(struct ieee80211_radiotap_he); +@@ -766,6 +767,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, + rtap_space += sizeof(*rtap) + rtap->len + rtap->pad; + } + ++ min_head_len = rtap_space; ++ + /* + * First, we may need to make a copy of the skb because + * (1) we need to modify it for radiotap (if not present), and +@@ -775,18 +778,23 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb, + * the SKB because it has a bad FCS/PLCP checksum. + */ + +- if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { +- if (unlikely(origskb->len <= FCS_LEN)) { +- /* driver bug */ +- WARN_ON(1); +- dev_kfree_skb(origskb); +- return NULL; ++ if (!(status->flag & RX_FLAG_NO_PSDU)) { ++ if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) { ++ if (unlikely(origskb->len <= FCS_LEN + rtap_space)) { ++ /* driver bug */ ++ WARN_ON(1); ++ dev_kfree_skb(origskb); ++ return NULL; ++ } ++ present_fcs_len = FCS_LEN; + } +- present_fcs_len = FCS_LEN; ++ ++ /* also consider the hdr->frame_control */ ++ min_head_len += 2; + } + +- /* ensure hdr->frame_control and vendor radiotap data are in skb head */ +- if (!pskb_may_pull(origskb, 2 + rtap_space)) { ++ /* ensure that the expected data elements are in skb head */ ++ if (!pskb_may_pull(origskb, min_head_len)) { + dev_kfree_skb(origskb); + return NULL; + } +-- +2.19.1 + diff --git a/queue-4.20/md-fix-raid10-hang-issue-caused-by-barrier.patch b/queue-4.20/md-fix-raid10-hang-issue-caused-by-barrier.patch new file mode 100644 index 00000000000..3b7778ebb84 --- /dev/null +++ b/queue-4.20/md-fix-raid10-hang-issue-caused-by-barrier.patch @@ -0,0 +1,127 @@ +From 01f8bca5e7af8d55b08383e7b830a6426c29c2c6 Mon Sep 17 00:00:00 2001 +From: Guoqing Jiang +Date: Wed, 19 Dec 2018 14:19:25 +0800 +Subject: md: fix raid10 hang issue caused by barrier +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit e820d55cb99dd93ac2dc949cf486bb187e5cd70d ] + +When both regular IO and resync IO happen at the same time, +and if we also need to split regular. Then we can see tasks +hang due to barrier. + +1. resync thread +[ 1463.757205] INFO: task md1_resync:5215 blocked for more than 480 seconds. +[ 1463.757207] Not tainted 4.19.5-1-default #1 +[ 1463.757209] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1463.757212] md1_resync D 0 5215 2 0x80000000 +[ 1463.757216] Call Trace: +[ 1463.757223] ? __schedule+0x29a/0x880 +[ 1463.757231] ? raise_barrier+0x8d/0x140 [raid10] +[ 1463.757236] schedule+0x78/0x110 +[ 1463.757243] raise_barrier+0x8d/0x140 [raid10] +[ 1463.757248] ? wait_woken+0x80/0x80 +[ 1463.757257] raid10_sync_request+0x1f6/0x1e30 [raid10] +[ 1463.757265] ? _raw_spin_unlock_irq+0x22/0x40 +[ 1463.757284] ? is_mddev_idle+0x125/0x137 [md_mod] +[ 1463.757302] md_do_sync.cold.78+0x404/0x969 [md_mod] +[ 1463.757311] ? wait_woken+0x80/0x80 +[ 1463.757336] ? md_rdev_init+0xb0/0xb0 [md_mod] +[ 1463.757351] md_thread+0xe9/0x140 [md_mod] +[ 1463.757358] ? _raw_spin_unlock_irqrestore+0x2e/0x60 +[ 1463.757364] ? __kthread_parkme+0x4c/0x70 +[ 1463.757369] kthread+0x112/0x130 +[ 1463.757374] ? kthread_create_worker_on_cpu+0x40/0x40 +[ 1463.757380] ret_from_fork+0x3a/0x50 + +2. regular IO +[ 1463.760679] INFO: task kworker/0:8:5367 blocked for more than 480 seconds. +[ 1463.760683] Not tainted 4.19.5-1-default #1 +[ 1463.760684] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 1463.760687] kworker/0:8 D 0 5367 2 0x80000000 +[ 1463.760718] Workqueue: md submit_flushes [md_mod] +[ 1463.760721] Call Trace: +[ 1463.760731] ? __schedule+0x29a/0x880 +[ 1463.760741] ? wait_barrier+0xdd/0x170 [raid10] +[ 1463.760746] schedule+0x78/0x110 +[ 1463.760753] wait_barrier+0xdd/0x170 [raid10] +[ 1463.760761] ? wait_woken+0x80/0x80 +[ 1463.760768] raid10_write_request+0xf2/0x900 [raid10] +[ 1463.760774] ? wait_woken+0x80/0x80 +[ 1463.760778] ? mempool_alloc+0x55/0x160 +[ 1463.760795] ? md_write_start+0xa9/0x270 [md_mod] +[ 1463.760801] ? try_to_wake_up+0x44/0x470 +[ 1463.760810] raid10_make_request+0xc1/0x120 [raid10] +[ 1463.760816] ? wait_woken+0x80/0x80 +[ 1463.760831] md_handle_request+0x121/0x190 [md_mod] +[ 1463.760851] md_make_request+0x78/0x190 [md_mod] +[ 1463.760860] generic_make_request+0x1c6/0x470 +[ 1463.760870] raid10_write_request+0x77a/0x900 [raid10] +[ 1463.760875] ? wait_woken+0x80/0x80 +[ 1463.760879] ? mempool_alloc+0x55/0x160 +[ 1463.760895] ? md_write_start+0xa9/0x270 [md_mod] +[ 1463.760904] raid10_make_request+0xc1/0x120 [raid10] +[ 1463.760910] ? wait_woken+0x80/0x80 +[ 1463.760926] md_handle_request+0x121/0x190 [md_mod] +[ 1463.760931] ? _raw_spin_unlock_irq+0x22/0x40 +[ 1463.760936] ? finish_task_switch+0x74/0x260 +[ 1463.760954] submit_flushes+0x21/0x40 [md_mod] + +So resync io is waiting for regular write io to complete to +decrease nr_pending (conf->barrier++ is called before waiting). +The regular write io splits another bio after call wait_barrier +which call nr_pending++, then the splitted bio would continue +with raid10_write_request -> wait_barrier, so the splitted bio +has to wait for barrier to be zero, then deadlock happens as +follows. + + resync io regular io + + raise_barrier + wait_barrier + generic_make_request + wait_barrier + +To resolve the issue, we need to call allow_barrier to decrease +nr_pending before generic_make_request since regular IO is not +issued to underlying devices, and wait_barrier is called again +to ensure no internal IO happening. + +Fixes: fc9977dd069e ("md/raid10: simplify the splitting of requests.") +Reported-and-tested-by: SiniÅ¡a Bandin +Signed-off-by: Guoqing Jiang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +--- + drivers/md/raid10.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index b98e746e7fc4..12cf8a04e839 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1209,7 +1209,9 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, + struct bio *split = bio_split(bio, max_sectors, + gfp, &conf->bio_split); + bio_chain(split, bio); ++ allow_barrier(conf); + generic_make_request(bio); ++ wait_barrier(conf); + bio = split; + r10_bio->master_bio = bio; + r10_bio->sectors = max_sectors; +@@ -1514,7 +1516,9 @@ retry_write: + struct bio *split = bio_split(bio, r10_bio->sectors, + GFP_NOIO, &conf->bio_split); + bio_chain(split, bio); ++ allow_barrier(conf); + generic_make_request(bio); ++ wait_barrier(conf); + bio = split; + r10_bio->master_bio = bio; + } +-- +2.19.1 + diff --git a/queue-4.20/media-adv-tc358743-ths8200-fill-in-min-width-height-.patch b/queue-4.20/media-adv-tc358743-ths8200-fill-in-min-width-height-.patch new file mode 100644 index 00000000000..3eeab7b8c43 --- /dev/null +++ b/queue-4.20/media-adv-tc358743-ths8200-fill-in-min-width-height-.patch @@ -0,0 +1,131 @@ +From 51a798696405db7357db3bf828ffff1f7023c7f9 Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Thu, 8 Nov 2018 04:51:51 -0500 +Subject: media: adv*/tc358743/ths8200: fill in min width/height/pixelclock + +[ Upstream commit 2912289a518077ddb8214e05336700148e97e235 ] + +The v4l2_dv_timings_cap struct is used to do sanity checks when setting and +enumerating DV timings, ensuring that only valid timings as per the HW +capabilities are allowed. + +However, many drivers just filled in 0 for the minimum width, height or +pixelclock frequency. This can cause timings with e.g. 0 as width and height +to be accepted, which will in turn lead to a potential division by zero. + +Fill in proper values are minimum boundaries. 640x350 was chosen since it is +the smallest resolution in v4l2-dv-timings.h. Same for 13 MHz as the lowest +pixelclock frequency (it's slightly below the minimum of 13.5 MHz in the +v4l2-dv-timings.h header). + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ad9389b.c | 2 +- + drivers/media/i2c/adv7511.c | 2 +- + drivers/media/i2c/adv7604.c | 4 ++-- + drivers/media/i2c/adv7842.c | 4 ++-- + drivers/media/i2c/tc358743.c | 2 +- + drivers/media/i2c/ths8200.c | 2 +- + 6 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/media/i2c/ad9389b.c b/drivers/media/i2c/ad9389b.c +index 5b008b0002c0..aa8b04cfed0f 100644 +--- a/drivers/media/i2c/ad9389b.c ++++ b/drivers/media/i2c/ad9389b.c +@@ -578,7 +578,7 @@ static const struct v4l2_dv_timings_cap ad9389b_timings_cap = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | +diff --git a/drivers/media/i2c/adv7511.c b/drivers/media/i2c/adv7511.c +index f3899cc84e27..88349b5053cc 100644 +--- a/drivers/media/i2c/adv7511.c ++++ b/drivers/media/i2c/adv7511.c +@@ -130,7 +130,7 @@ static const struct v4l2_dv_timings_cap adv7511_timings_cap = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT, ++ V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT, + ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index 9eb7c70a7712..ff28f5692986 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -766,7 +766,7 @@ static const struct v4l2_dv_timings_cap adv7604_timings_cap_analog = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | +@@ -777,7 +777,7 @@ static const struct v4l2_dv_timings_cap adv76xx_timings_cap_digital = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index 4721d49dcf0f..5305c3ad80e6 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -663,7 +663,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | +@@ -674,7 +674,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING | +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 41d470d9ca94..00dc930e049f 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -59,7 +59,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = { + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, + /* Pixel clock from REF_01 p. 20. Min/max height/width are unknown */ +- V4L2_INIT_BT_TIMINGS(1, 10000, 1, 10000, 0, 165000000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 13000000, 165000000, + V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT | + V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT, + V4L2_DV_BT_CAP_PROGRESSIVE | +diff --git a/drivers/media/i2c/ths8200.c b/drivers/media/i2c/ths8200.c +index 498ad2368cbc..f5ee28058ea2 100644 +--- a/drivers/media/i2c/ths8200.c ++++ b/drivers/media/i2c/ths8200.c +@@ -49,7 +49,7 @@ static const struct v4l2_dv_timings_cap ths8200_timings_cap = { + .type = V4L2_DV_BT_656_1120, + /* keep this initialization for compatibility with GCC < 4.4.6 */ + .reserved = { 0 }, +- V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000, ++ V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1080, 25000000, 148500000, + V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE) + }; + +-- +2.19.1 + diff --git a/queue-4.20/media-coda-fix-h.264-deblocking-filter-controls.patch b/queue-4.20/media-coda-fix-h.264-deblocking-filter-controls.patch new file mode 100644 index 00000000000..314cddac3e4 --- /dev/null +++ b/queue-4.20/media-coda-fix-h.264-deblocking-filter-controls.patch @@ -0,0 +1,134 @@ +From 4e1cd880b6389e632ad0dc3b781ce2b985433e73 Mon Sep 17 00:00:00 2001 +From: Philipp Zabel +Date: Wed, 28 Nov 2018 08:01:22 -0500 +Subject: media: coda: fix H.264 deblocking filter controls + +[ Upstream commit 75fa6e4f83a0923fe753827d354998d448b4fd6a ] + +Add support for the third loop filter mode +V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY, +and fix V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA and +V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA controls. + +The filter offset controls are signed values in the -6 to 6 range and +are stored into the slice header fields slice_alpha_c0_offset_div2 and +slice_beta_offset_div2. The actual filter offsets FilterOffsetA/B are +double their value, in range of -12 to 12. + +Rename variables to more closely match the nomenclature in the H.264 +specification. + +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-bit.c | 19 +++++++++---------- + drivers/media/platform/coda/coda-common.c | 15 +++++++-------- + drivers/media/platform/coda/coda.h | 6 +++--- + drivers/media/platform/coda/coda_regs.h | 2 +- + 4 files changed, 20 insertions(+), 22 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-bit.c b/drivers/media/platform/coda/coda-bit.c +index d26c2d85a009..d20d3df5778b 100644 +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -991,16 +991,15 @@ static int coda_start_encoding(struct coda_ctx *ctx) + else + coda_write(dev, CODA_STD_H264, + CODA_CMD_ENC_SEQ_COD_STD); +- if (ctx->params.h264_deblk_enabled) { +- value = ((ctx->params.h264_deblk_alpha & +- CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) << +- CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) | +- ((ctx->params.h264_deblk_beta & +- CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) << +- CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET); +- } else { +- value = 1 << CODA_264PARAM_DISABLEDEBLK_OFFSET; +- } ++ value = ((ctx->params.h264_disable_deblocking_filter_idc & ++ CODA_264PARAM_DISABLEDEBLK_MASK) << ++ CODA_264PARAM_DISABLEDEBLK_OFFSET) | ++ ((ctx->params.h264_slice_alpha_c0_offset_div2 & ++ CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK) << ++ CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET) | ++ ((ctx->params.h264_slice_beta_offset_div2 & ++ CODA_264PARAM_DEBLKFILTEROFFSETBETA_MASK) << ++ CODA_264PARAM_DEBLKFILTEROFFSETBETA_OFFSET); + coda_write(dev, value, CODA_CMD_ENC_SEQ_264_PARA); + break; + case V4L2_PIX_FMT_JPEG: +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 2848ea5f464d..d0b36d6eb86e 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -1792,14 +1792,13 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl) + ctx->params.h264_max_qp = ctrl->val; + break; + case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA: +- ctx->params.h264_deblk_alpha = ctrl->val; ++ ctx->params.h264_slice_alpha_c0_offset_div2 = ctrl->val; + break; + case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA: +- ctx->params.h264_deblk_beta = ctrl->val; ++ ctx->params.h264_slice_beta_offset_div2 = ctrl->val; + break; + case V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE: +- ctx->params.h264_deblk_enabled = (ctrl->val == +- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED); ++ ctx->params.h264_disable_deblocking_filter_idc = ctrl->val; + break; + case V4L2_CID_MPEG_VIDEO_H264_PROFILE: + /* TODO: switch between baseline and constrained baseline */ +@@ -1881,13 +1880,13 @@ static void coda_encode_ctrls(struct coda_ctx *ctx) + v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_MAX_QP, 0, 51, 1, 51); + v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops, +- V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, 0, 15, 1, 0); ++ V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_ALPHA, -6, 6, 1, 0); + v4l2_ctrl_new_std(&ctx->ctrls, &coda_ctrl_ops, +- V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, 0, 15, 1, 0); ++ V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_BETA, -6, 6, 1, 0); + v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_LOOP_FILTER_MODE, +- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED, 0x0, +- V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED); ++ V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_DISABLED_AT_SLICE_BOUNDARY, ++ 0x0, V4L2_MPEG_VIDEO_H264_LOOP_FILTER_MODE_ENABLED); + v4l2_ctrl_new_std_menu(&ctx->ctrls, &coda_ctrl_ops, + V4L2_CID_MPEG_VIDEO_H264_PROFILE, + V4L2_MPEG_VIDEO_H264_PROFILE_BASELINE, 0x0, +diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h +index 19ac0b9dc6eb..2469ca1dc598 100644 +--- a/drivers/media/platform/coda/coda.h ++++ b/drivers/media/platform/coda/coda.h +@@ -115,9 +115,9 @@ struct coda_params { + u8 h264_inter_qp; + u8 h264_min_qp; + u8 h264_max_qp; +- u8 h264_deblk_enabled; +- u8 h264_deblk_alpha; +- u8 h264_deblk_beta; ++ u8 h264_disable_deblocking_filter_idc; ++ s8 h264_slice_alpha_c0_offset_div2; ++ s8 h264_slice_beta_offset_div2; + u8 h264_profile_idc; + u8 h264_level_idc; + u8 mpeg4_intra_qp; +diff --git a/drivers/media/platform/coda/coda_regs.h b/drivers/media/platform/coda/coda_regs.h +index 5e7b00a97671..e675e38f3475 100644 +--- a/drivers/media/platform/coda/coda_regs.h ++++ b/drivers/media/platform/coda/coda_regs.h +@@ -292,7 +292,7 @@ + #define CODA_264PARAM_DEBLKFILTEROFFSETALPHA_OFFSET 8 + #define CODA_264PARAM_DEBLKFILTEROFFSETALPHA_MASK 0x0f + #define CODA_264PARAM_DISABLEDEBLK_OFFSET 6 +-#define CODA_264PARAM_DISABLEDEBLK_MASK 0x01 ++#define CODA_264PARAM_DISABLEDEBLK_MASK 0x03 + #define CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_OFFSET 5 + #define CODA_264PARAM_CONSTRAINEDINTRAPREDFLAG_MASK 0x01 + #define CODA_264PARAM_CHROMAQPOFFSET_OFFSET 0 +-- +2.19.1 + diff --git a/queue-4.20/media-davinci-vpbe-fix-error-handling-in-vpbe_initia.patch b/queue-4.20/media-davinci-vpbe-fix-error-handling-in-vpbe_initia.patch new file mode 100644 index 00000000000..654b6ac8cdf --- /dev/null +++ b/queue-4.20/media-davinci-vpbe-fix-error-handling-in-vpbe_initia.patch @@ -0,0 +1,55 @@ +From 5951e9145c3ee43f892a32d50ff06afd0869fc2d Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Fri, 23 Nov 2018 16:56:26 -0500 +Subject: media: DaVinci-VPBE: fix error handling in vpbe_initialize() + +[ Upstream commit aa35dc3c71950e3fec3e230c06c27c0fbd0067f8 ] + +If vpbe_set_default_output() or vpbe_set_default_mode() fails, +vpbe_initialize() returns error code without releasing resources. + +The patch adds error handling for that case. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/vpbe.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/davinci/vpbe.c b/drivers/media/platform/davinci/vpbe.c +index 18c035ef84cf..df1ae6b5c854 100644 +--- a/drivers/media/platform/davinci/vpbe.c ++++ b/drivers/media/platform/davinci/vpbe.c +@@ -740,7 +740,7 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev) + if (ret) { + v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default output %s", + def_output); +- return ret; ++ goto fail_kfree_amp; + } + + printk(KERN_NOTICE "Setting default mode to %s\n", def_mode); +@@ -748,12 +748,15 @@ static int vpbe_initialize(struct device *dev, struct vpbe_device *vpbe_dev) + if (ret) { + v4l2_err(&vpbe_dev->v4l2_dev, "Failed to set default mode %s", + def_mode); +- return ret; ++ goto fail_kfree_amp; + } + vpbe_dev->initialized = 1; + /* TBD handling of bootargs for default output and mode */ + return 0; + ++fail_kfree_amp: ++ mutex_lock(&vpbe_dev->lock); ++ kfree(vpbe_dev->amp); + fail_kfree_encoders: + kfree(vpbe_dev->encoders); + fail_dev_unregister: +-- +2.19.1 + diff --git a/queue-4.20/media-i2c-tda1997x-select-config_hdmi.patch b/queue-4.20/media-i2c-tda1997x-select-config_hdmi.patch new file mode 100644 index 00000000000..0f78f90b729 --- /dev/null +++ b/queue-4.20/media-i2c-tda1997x-select-config_hdmi.patch @@ -0,0 +1,44 @@ +From b4b327904ec0d8eba546609c1e831ce881adcc55 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 2 Oct 2018 17:12:43 -0400 +Subject: media: i2c: TDA1997x: select CONFIG_HDMI + +[ Upstream commit 79e89e36dc8a47ef965a35b484d737a5227feed1 ] + +Without CONFIG_HDMI, we get a link error for this driver: + +drivers/media/i2c/tda1997x.o: In function `tda1997x_parse_infoframe': +tda1997x.c:(.text+0x2195): undefined reference to `hdmi_infoframe_unpack' +tda1997x.c:(.text+0x21b6): undefined reference to `hdmi_infoframe_log' +drivers/media/i2c/tda1997x.o: In function `tda1997x_log_infoframe': +tda1997x.c:(.text.unlikely+0x13d3): undefined reference to `hdmi_infoframe_unpack' +tda1997x.c:(.text.unlikely+0x1426): undefined reference to `hdmi_infoframe_log' + +All other drivers in this directory that use HDMI select CONFIG_HDMI, +so do the same here: + +Fixes: 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver") + +Signed-off-by: Arnd Bergmann +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index 704af210e270..f4714bd6fef0 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -61,6 +61,7 @@ config VIDEO_TDA1997X + depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API + depends on SND_SOC + select SND_PCM ++ select HDMI + ---help--- + V4L2 subdevice driver for the NXP TDA1997x HDMI receivers. + +-- +2.19.1 + diff --git a/queue-4.20/media-imx274-select-regmap_i2c.patch b/queue-4.20/media-imx274-select-regmap_i2c.patch new file mode 100644 index 00000000000..ef0f6a58f82 --- /dev/null +++ b/queue-4.20/media-imx274-select-regmap_i2c.patch @@ -0,0 +1,46 @@ +From 52c4ffac8a0d9e815c448f121c208362275b8cba Mon Sep 17 00:00:00 2001 +From: Luca Ceresoli +Date: Tue, 27 Nov 2018 03:34:45 -0500 +Subject: media: imx274: select REGMAP_I2C +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 4f9d7225c70dd9d3f406b79e60f8dbd2cd5ae743 ] + +The imx274 driver uses regmap and the build will fail without it. + +Fixes: + + drivers/media/i2c/imx274.c:142:21: error: variable ‘imx274_regmap_config’ has initializer but incomplete type + static const struct regmap_config imx274_regmap_config = { + ^~~~~~~~~~~~~ + drivers/media/i2c/imx274.c:1869:19: error: implicit declaration of function ‘devm_regmap_init_i2c’ [-Werror=implicit-function-declaration] + imx274->regmap = devm_regmap_init_i2c(client, &imx274_regmap_config); + ^~~~~~~~~~~~~~~~~~~~ + +and others. + +Signed-off-by: Luca Ceresoli +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index f4714bd6fef0..421e2fd2481d 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -611,6 +611,7 @@ config VIDEO_IMX274 + tristate "Sony IMX274 sensor support" + depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API + depends on MEDIA_CAMERA_SUPPORT ++ select REGMAP_I2C + ---help--- + This is a V4L2 sensor driver for the Sony IMX274 + CMOS image sensor. +-- +2.19.1 + diff --git a/queue-4.20/media-mtk-vcodec-release-device-nodes-in-mtk_vcodec_.patch b/queue-4.20/media-mtk-vcodec-release-device-nodes-in-mtk_vcodec_.patch new file mode 100644 index 00000000000..85c5aa0a8d5 --- /dev/null +++ b/queue-4.20/media-mtk-vcodec-release-device-nodes-in-mtk_vcodec_.patch @@ -0,0 +1,62 @@ +From b64e53f853ac72d503170001bd71d1cd4d874981 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Sat, 20 Oct 2018 13:50:19 -0400 +Subject: media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm() + +[ Upstream commit 8ea0f2ba0fa3f91ea1b8d823a54b042026ada6b3 ] + +of_parse_phandle() returns the device node with refcount incremented. +There are two nodes that are used temporary in mtk_vcodec_init_enc_pm(), +but their refcounts are not decremented. + +The patch adds one of_node_put() and fixes returning error codes. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c +index 3e73e9db781f..7c025045ea90 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c +@@ -41,25 +41,27 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev) + node = of_parse_phandle(dev->of_node, "mediatek,larb", 0); + if (!node) { + mtk_v4l2_err("no mediatek,larb found"); +- return -1; ++ return -ENODEV; + } + pdev = of_find_device_by_node(node); ++ of_node_put(node); + if (!pdev) { + mtk_v4l2_err("no mediatek,larb device found"); +- return -1; ++ return -ENODEV; + } + pm->larbvenc = &pdev->dev; + + node = of_parse_phandle(dev->of_node, "mediatek,larb", 1); + if (!node) { + mtk_v4l2_err("no mediatek,larb found"); +- return -1; ++ return -ENODEV; + } + + pdev = of_find_device_by_node(node); ++ of_node_put(node); + if (!pdev) { + mtk_v4l2_err("no mediatek,larb device found"); +- return -1; ++ return -ENODEV; + } + + pm->larbvenclt = &pdev->dev; +-- +2.19.1 + diff --git a/queue-4.20/media-rc-ensure-close-is-called-on-rc_unregister_dev.patch b/queue-4.20/media-rc-ensure-close-is-called-on-rc_unregister_dev.patch new file mode 100644 index 00000000000..f087e466d6d --- /dev/null +++ b/queue-4.20/media-rc-ensure-close-is-called-on-rc_unregister_dev.patch @@ -0,0 +1,37 @@ +From a7e008c106d342f6e4c5ebfacb27f6778ee9cc32 Mon Sep 17 00:00:00 2001 +From: Sean Young +Date: Sun, 4 Nov 2018 05:12:09 -0500 +Subject: media: rc: ensure close() is called on rc_unregister_device + +[ Upstream commit 8e782fcf78275f505194e767c515202d4fd274bc ] + +If userspace has an open file descriptor on the rc input device or lirc +device when rc_unregister_device() is called, then the rc close() is +never called. + +This ensures that the receiver is turned off on the nuvoton-cir driver +during shutdown. + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/rc-main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c +index 877978dbd409..66a174979b3c 100644 +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1952,6 +1952,8 @@ void rc_unregister_device(struct rc_dev *dev) + rc_free_rx_device(dev); + + mutex_lock(&dev->lock); ++ if (dev->users && dev->close) ++ dev->close(dev); + dev->registered = false; + mutex_unlock(&dev->lock); + +-- +2.19.1 + diff --git a/queue-4.20/media-v4l2-device-link-subdevices-to-their-parent-de.patch b/queue-4.20/media-v4l2-device-link-subdevices-to-their-parent-de.patch new file mode 100644 index 00000000000..389e0dea474 --- /dev/null +++ b/queue-4.20/media-v4l2-device-link-subdevices-to-their-parent-de.patch @@ -0,0 +1,47 @@ +From 8d37330dd13bcea83023d0118b893b991607c9f9 Mon Sep 17 00:00:00 2001 +From: Tomasz Figa +Date: Thu, 14 Dec 2017 23:32:21 -0500 +Subject: media: v4l2-device: Link subdevices to their parent devices if + available + +[ Upstream commit ee494cf377e142f65f202fadf0d859f8e12119fb ] + +Currently v4l2_device_register_subdev_nodes() does not initialize the +dev_parent field of the video_device structs it creates for subdevices +being registered. This leads to __video_register_device() falling back +to the parent device of associated v4l2_device struct, which often does +not match the physical device the subdevice is registered for. + +Due to the problem above, the links between real devices and v4l-subdev +nodes cannot be obtained from sysfs, which might be confusing for the +userspace trying to identify the hardware. + +Fix this by initializing the dev_parent field of the video_device struct +with the value of dev field of the v4l2_subdev struct. In case of +subdevices without a parent struct device, the field will be NULL and the +old behavior will be preserved by the semantics of +__video_register_device(). + +Signed-off-by: Tomasz Figa +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-device.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/v4l2-core/v4l2-device.c b/drivers/media/v4l2-core/v4l2-device.c +index df0ac38c4050..e0ddb9a52bd1 100644 +--- a/drivers/media/v4l2-core/v4l2-device.c ++++ b/drivers/media/v4l2-core/v4l2-device.c +@@ -247,6 +247,7 @@ int v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev) + + video_set_drvdata(vdev, sd); + strscpy(vdev->name, sd->name, sizeof(vdev->name)); ++ vdev->dev_parent = sd->dev; + vdev->v4l2_dev = v4l2_dev; + vdev->fops = &v4l2_subdev_fops; + vdev->release = v4l2_device_release_subdev_node; +-- +2.19.1 + diff --git a/queue-4.20/media-video-i2c-avoid-accessing-released-memory-area.patch b/queue-4.20/media-video-i2c-avoid-accessing-released-memory-area.patch new file mode 100644 index 00000000000..8d5ec2ffbfe --- /dev/null +++ b/queue-4.20/media-video-i2c-avoid-accessing-released-memory-area.patch @@ -0,0 +1,63 @@ +From 4c2b77b7ec1d3a48a0d355a593322ecf5036e0c4 Mon Sep 17 00:00:00 2001 +From: Akinobu Mita +Date: Sat, 20 Oct 2018 10:26:23 -0400 +Subject: media: video-i2c: avoid accessing released memory area when removing + driver + +[ Upstream commit c764da98a600a4b068d25c77164f092f159cecec ] + +The video device release() callback for video-i2c driver frees the whole +struct video_i2c_data. If there is no user left for the video device +when video_unregister_device() is called, the release callback is executed. + +However, in video_i2c_remove() some fields (v4l2_dev, lock, and queue_lock) +in struct video_i2c_data are still accessed after video_unregister_device() +is called. + +This fixes the use after free by moving the code from video_i2c_remove() +to the release() callback. + +Fixes: 5cebaac60974 ("media: video-i2c: add video-i2c driver") + +Reviewed-by: Matt Ranostay +Signed-off-by: Akinobu Mita +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/video-i2c.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/video-i2c.c b/drivers/media/i2c/video-i2c.c +index 4d49af86c15e..ec0758dca2fc 100644 +--- a/drivers/media/i2c/video-i2c.c ++++ b/drivers/media/i2c/video-i2c.c +@@ -510,7 +510,12 @@ static const struct v4l2_ioctl_ops video_i2c_ioctl_ops = { + + static void video_i2c_release(struct video_device *vdev) + { +- kfree(video_get_drvdata(vdev)); ++ struct video_i2c_data *data = video_get_drvdata(vdev); ++ ++ v4l2_device_unregister(&data->v4l2_dev); ++ mutex_destroy(&data->lock); ++ mutex_destroy(&data->queue_lock); ++ kfree(data); + } + + static int video_i2c_probe(struct i2c_client *client, +@@ -608,10 +613,6 @@ static int video_i2c_remove(struct i2c_client *client) + struct video_i2c_data *data = i2c_get_clientdata(client); + + video_unregister_device(&data->vdev); +- v4l2_device_unregister(&data->v4l2_dev); +- +- mutex_destroy(&data->lock); +- mutex_destroy(&data->queue_lock); + + return 0; + } +-- +2.19.1 + diff --git a/queue-4.20/media-vivid-fill-in-media_device-bus_info.patch b/queue-4.20/media-vivid-fill-in-media_device-bus_info.patch new file mode 100644 index 00000000000..fdb96d8b2a3 --- /dev/null +++ b/queue-4.20/media-vivid-fill-in-media_device-bus_info.patch @@ -0,0 +1,35 @@ +From 2d348153bb3cc196210dd1c73afd183e009304fd Mon Sep 17 00:00:00 2001 +From: Hans Verkuil +Date: Tue, 6 Nov 2018 09:06:41 -0500 +Subject: media: vivid: fill in media_device bus_info + +[ Upstream commit e10b40f3304360d3a2d07d690ff12197f828f2c8 ] + +If you create multiple vivid instances, each with their own media +device, then there was no way to tell them apart. + +Fill in the bus_info so each instance has a unique bus_info string. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c +index 626e2b24a403..ec1b1a8ea775 100644 +--- a/drivers/media/platform/vivid/vivid-core.c ++++ b/drivers/media/platform/vivid/vivid-core.c +@@ -669,6 +669,8 @@ static int vivid_create_instance(struct platform_device *pdev, int inst) + + /* Initialize media device */ + strlcpy(dev->mdev.model, VIVID_MODULE_NAME, sizeof(dev->mdev.model)); ++ snprintf(dev->mdev.bus_info, sizeof(dev->mdev.bus_info), ++ "platform:%s-%03d", VIVID_MODULE_NAME, inst); + dev->mdev.dev = &pdev->dev; + media_device_init(&dev->mdev); + dev->mdev.ops = &vivid_media_ops; +-- +2.19.1 + diff --git a/queue-4.20/memstick-prevent-memstick-host-from-getting-runtime-.patch b/queue-4.20/memstick-prevent-memstick-host-from-getting-runtime-.patch new file mode 100644 index 00000000000..1c7bebb8724 --- /dev/null +++ b/queue-4.20/memstick-prevent-memstick-host-from-getting-runtime-.patch @@ -0,0 +1,57 @@ +From a06cc16051c66ab7223a599d7297b3d14474653f Mon Sep 17 00:00:00 2001 +From: Kai-Heng Feng +Date: Mon, 5 Nov 2018 16:45:04 +0800 +Subject: memstick: Prevent memstick host from getting runtime suspended during + card detection + +[ Upstream commit e03e303edf1c63e6dd455ccd568c74e93ef3ba8c ] + +We can use MEMSTICK_POWER_{ON,OFF} along with pm_runtime_{get,put} +helpers to let memstick host support runtime pm. + +The rpm count may go down to zero before the memstick host powers on, so +the host can be runtime suspended. + +So before doing card detection, increment the rpm count to avoid the +host gets runtime suspended. Balance the rpm count after card detection +is done. + +Signed-off-by: Kai-Heng Feng +Tested-by: Oleksandr Natalenko +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/core/memstick.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c +index 76382c858c35..1246d69ba187 100644 +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #define DRIVER_NAME "memstick" + +@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work) + struct memstick_dev *card; + + dev_dbg(&host->dev, "memstick_check started\n"); ++ pm_runtime_get_noresume(host->dev.parent); + mutex_lock(&host->lock); + if (!host->card) { + if (memstick_power_on(host)) +@@ -479,6 +481,7 @@ out_power_off: + host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF); + + mutex_unlock(&host->lock); ++ pm_runtime_put(host->dev.parent); + dev_dbg(&host->dev, "memstick_check finished\n"); + } + +-- +2.19.1 + diff --git a/queue-4.20/mips-boston-disable-eg20t-prefetch.patch b/queue-4.20/mips-boston-disable-eg20t-prefetch.patch new file mode 100644 index 00000000000..bb76b722183 --- /dev/null +++ b/queue-4.20/mips-boston-disable-eg20t-prefetch.patch @@ -0,0 +1,49 @@ +From 68f778e09dbff1e5b8663d5988a8c66fb51116f0 Mon Sep 17 00:00:00 2001 +From: Paul Burton +Date: Sat, 10 Nov 2018 00:12:06 +0000 +Subject: MIPS: Boston: Disable EG20T prefetch + +[ Upstream commit 5ec17af7ead09701e23d2065e16db6ce4e137289 ] + +The Intel EG20T Platform Controller Hub used on the MIPS Boston +development board supports prefetching memory to optimize DMA transfers. +Unfortunately for unknown reasons this doesn't work well with some MIPS +CPUs such as the P6600, particularly when using an I/O Coherence Unit +(IOCU) to provide cache-coherent DMA. In these systems it is common for +DMA data to be lost, resulting in broken access to EG20T devices such as +the MMC or SATA controllers. + +Support for a DT property to configure the prefetching was added a while +back by commit 549ce8f134bd ("misc: pch_phub: Read prefetch value from +device tree if passed") but we never added the DT snippet to make use of +it. Add that now in order to disable the prefetching & fix DMA on the +affected systems. + +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/21068/ +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/img/boston.dts | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts +index 65af3f6ba81c..84328afa3a55 100644 +--- a/arch/mips/boot/dts/img/boston.dts ++++ b/arch/mips/boot/dts/img/boston.dts +@@ -141,6 +141,12 @@ + #size-cells = <2>; + #interrupt-cells = <1>; + ++ eg20t_phub@2,0,0 { ++ compatible = "pci8086,8801"; ++ reg = <0x00020000 0 0 0 0>; ++ intel,eg20t-prefetch = <0>; ++ }; ++ + eg20t_mac@2,0,1 { + compatible = "pci8086,8802"; + reg = <0x00020100 0 0 0 0>; +-- +2.19.1 + diff --git a/queue-4.20/mips-bpf-fix-encoding-bug-for-mm_srlv32_op.patch b/queue-4.20/mips-bpf-fix-encoding-bug-for-mm_srlv32_op.patch new file mode 100644 index 00000000000..dc9dbde9750 --- /dev/null +++ b/queue-4.20/mips-bpf-fix-encoding-bug-for-mm_srlv32_op.patch @@ -0,0 +1,47 @@ +From 506a4eb1f7ceef4d55c8f0da71c66dd259be361b Mon Sep 17 00:00:00 2001 +From: Jiong Wang +Date: Mon, 3 Dec 2018 17:27:54 -0500 +Subject: mips: bpf: fix encoding bug for mm_srlv32_op + +[ Upstream commit 17f6c83fb5ebf7db4fcc94a5be4c22d5a7bfe428 ] + +For micro-mips, srlv inside POOL32A encoding space should use 0x50 +sub-opcode, NOT 0x90. + +Some early version ISA doc describes the encoding as 0x90 for both srlv and +srav, this looks to me was a typo. I checked Binutils libopcode +implementation which is using 0x50 for srlv and 0x90 for srav. + +v1->v2: + - Keep mm_srlv32_op sorted by value. + +Fixes: f31318fdf324 ("MIPS: uasm: Add srlv uasm instruction") +Cc: Markos Chandras +Cc: Paul Burton +Cc: linux-mips@vger.kernel.org +Acked-by: Jakub Kicinski +Acked-by: Song Liu +Signed-off-by: Jiong Wang +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/mips/include/uapi/asm/inst.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/uapi/asm/inst.h b/arch/mips/include/uapi/asm/inst.h +index c05dcf5ab414..273ef58f4d43 100644 +--- a/arch/mips/include/uapi/asm/inst.h ++++ b/arch/mips/include/uapi/asm/inst.h +@@ -369,8 +369,8 @@ enum mm_32a_minor_op { + mm_ext_op = 0x02c, + mm_pool32axf_op = 0x03c, + mm_srl32_op = 0x040, ++ mm_srlv32_op = 0x050, + mm_sra_op = 0x080, +- mm_srlv32_op = 0x090, + mm_rotr_op = 0x0c0, + mm_lwxs_op = 0x118, + mm_addu32_op = 0x150, +-- +2.19.1 + diff --git a/queue-4.20/mips-ralink-select-config_cpu_mipsr2_irq_vi-on-mt762.patch b/queue-4.20/mips-ralink-select-config_cpu_mipsr2_irq_vi-on-mt762.patch new file mode 100644 index 00000000000..a90af85ef51 --- /dev/null +++ b/queue-4.20/mips-ralink-select-config_cpu_mipsr2_irq_vi-on-mt762.patch @@ -0,0 +1,54 @@ +From 5da2fade35ccb17e68d11dd7d642d7d5c938b0b3 Mon Sep 17 00:00:00 2001 +From: Stefan Roese +Date: Mon, 17 Dec 2018 10:47:48 +0100 +Subject: MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 + +[ Upstream commit 0b15394475e3bcaf35ca4bf22fc55d56df67224e ] + +Testing has shown, that when using mainline U-Boot on MT7688 based +boards, the system may hang or crash while mounting the root-fs. The +main issue here is that mainline U-Boot configures EBase to a value +near the end of system memory. And with CONFIG_CPU_MIPSR2_IRQ_VI +disabled, trap_init() will not allocate a new area to place the +exception handler. The original value will be used and the handler +will be copied to this location, which might already be used by some +userspace application. + +The MT7688 supports VI - its config3 register is 0x00002420, so VInt +(Bit 5) is set. But without setting CONFIG_CPU_MIPSR2_IRQ_VI this +bit will not be evaluated to result in "cpu_has_vi" being set. This +patch now selects CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8 which results +trap_init() to allocate some memory for the exception handler. + +Please note that this issue was not seen with the Mediatek U-Boot +version, as it does not touch EBase (stays at default of 0x8000.0000). +This is strictly also not correct as the kernel (_text) resides +here. + +Signed-off-by: Stefan Roese +[paul.burton@mips.com: s/beeing/being/] +Signed-off-by: Paul Burton +Cc: John Crispin +Cc: Daniel Schwierzeck +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/ralink/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/ralink/Kconfig b/arch/mips/ralink/Kconfig +index 1f9cb0e3c79a..613d61763433 100644 +--- a/arch/mips/ralink/Kconfig ++++ b/arch/mips/ralink/Kconfig +@@ -38,6 +38,7 @@ choice + + config SOC_MT7620 + bool "MT7620/8" ++ select CPU_MIPSR2_IRQ_VI + select HW_HAS_PCI + + config SOC_MT7621 +-- +2.19.1 + diff --git a/queue-4.20/mlx5-update-timecounter-at-least-twice-per-counter-o.patch b/queue-4.20/mlx5-update-timecounter-at-least-twice-per-counter-o.patch new file mode 100644 index 00000000000..e57d6d49737 --- /dev/null +++ b/queue-4.20/mlx5-update-timecounter-at-least-twice-per-counter-o.patch @@ -0,0 +1,54 @@ +From 7a3588b2bcf6ce3452c724cd81abbebc5fd674af Mon Sep 17 00:00:00 2001 +From: Miroslav Lichvar +Date: Mon, 3 Dec 2018 13:59:41 +0100 +Subject: mlx5: update timecounter at least twice per counter overflow + +[ Upstream commit 5d8678365c90b9ce1fd2243ff5ea562609f6cec1 ] + +The timecounter needs to be updated at least once in half of the +cyclecounter interval to prevent timecounter_cyc2time() interpreting a +new timestamp as an old value and causing a backward jump. + +This would be an issue if the timecounter multiplier was so small that +the update interval would not be limited by the 64-bit overflow in +multiplication. + +Shorten the calculated interval to make sure the timecounter is updated +in time even when the system clock is slowed down by up to 10%, the +multiplier is increased by up to 10%, and the scheduled overflow check +is late by 15%. + +Cc: Richard Cochran +Cc: Ariel Levkovich +Cc: Saeed Mahameed +Signed-off-by: Miroslav Lichvar +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index 0d90b1b4a3d3..2d6168ee99e8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -511,14 +511,14 @@ void mlx5_init_clock(struct mlx5_core_dev *mdev) + ktime_to_ns(ktime_get_real())); + + /* Calculate period in seconds to call the overflow watchdog - to make +- * sure counter is checked at least once every wrap around. ++ * sure counter is checked at least twice every wrap around. + * The period is calculated as the minimum between max HW cycles count + * (The clock source mask) and max amount of cycles that can be + * multiplied by clock multiplier where the result doesn't exceed + * 64bits. + */ + overflow_cycles = div64_u64(~0ULL >> 1, clock->cycles.mult); +- overflow_cycles = min(overflow_cycles, clock->cycles.mask >> 1); ++ overflow_cycles = min(overflow_cycles, div_u64(clock->cycles.mask, 3)); + + ns = cyclecounter_cyc2ns(&clock->cycles, overflow_cycles, + frac, &frac); +-- +2.19.1 + diff --git a/queue-4.20/mlxsw-spectrum-properly-cleanup-lag-uppers-when-remo.patch b/queue-4.20/mlxsw-spectrum-properly-cleanup-lag-uppers-when-remo.patch new file mode 100644 index 00000000000..23d60eeb490 --- /dev/null +++ b/queue-4.20/mlxsw-spectrum-properly-cleanup-lag-uppers-when-remo.patch @@ -0,0 +1,127 @@ +From 391a7177f80ea5c1bc7db5b428b5cfe2cf7c6948 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 19 Dec 2018 06:08:45 +0000 +Subject: mlxsw: spectrum: Properly cleanup LAG uppers when removing port from + LAG + +[ Upstream commit be2d6f421f680e01d58f7cd452646e0d8586d49b ] + +When a LAG device or a VLAN device on top of it is enslaved to a bridge, +the driver propagates the CHANGEUPPER event to the LAG's slaves. + +This causes each physical port to increase the reference count of the +internal representation of the bridge port by calling +mlxsw_sp_port_bridge_join(). + +However, when a port is removed from a LAG, the corresponding leave() +function is not called and the reference count is not decremented. This +leads to ugly hacks such as mlxsw_sp_bridge_port_should_destroy() that +try to understand if the bridge port should be destroyed even when its +reference count is not 0. + +Instead, make sure that when a port is unlinked from a LAG it would see +the same events as if the LAG (or its uppers) were unlinked from a +bridge. + +The above is achieved by walking the LAG's uppers when a port is +unlinked and calling mlxsw_sp_port_bridge_leave() for each upper that is +enslaved to a bridge. + +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum.c | 23 ++++++++++++++++ + .../mellanox/mlxsw/spectrum_switchdev.c | 27 +------------------ + 2 files changed, 24 insertions(+), 26 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 124aee09e953..8f1180fff955 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -4298,6 +4298,25 @@ void mlxsw_sp_port_dev_put(struct mlxsw_sp_port *mlxsw_sp_port) + dev_put(mlxsw_sp_port->dev); + } + ++static void ++mlxsw_sp_port_lag_uppers_cleanup(struct mlxsw_sp_port *mlxsw_sp_port, ++ struct net_device *lag_dev) ++{ ++ struct net_device *br_dev = netdev_master_upper_dev_get(lag_dev); ++ struct net_device *upper_dev; ++ struct list_head *iter; ++ ++ if (netif_is_bridge_port(lag_dev)) ++ mlxsw_sp_port_bridge_leave(mlxsw_sp_port, lag_dev, br_dev); ++ ++ netdev_for_each_upper_dev_rcu(lag_dev, upper_dev, iter) { ++ if (!netif_is_bridge_port(upper_dev)) ++ continue; ++ br_dev = netdev_master_upper_dev_get(upper_dev); ++ mlxsw_sp_port_bridge_leave(mlxsw_sp_port, upper_dev, br_dev); ++ } ++} ++ + static int mlxsw_sp_lag_create(struct mlxsw_sp *mlxsw_sp, u16 lag_id) + { + char sldr_pl[MLXSW_REG_SLDR_LEN]; +@@ -4490,6 +4509,10 @@ static void mlxsw_sp_port_lag_leave(struct mlxsw_sp_port *mlxsw_sp_port, + + /* Any VLANs configured on the port are no longer valid */ + mlxsw_sp_port_vlan_flush(mlxsw_sp_port); ++ /* Make the LAG and its directly linked uppers leave bridges they ++ * are memeber in ++ */ ++ mlxsw_sp_port_lag_uppers_cleanup(mlxsw_sp_port, lag_dev); + + if (lag->ref_count == 1) + mlxsw_sp_lag_destroy(mlxsw_sp, lag_id); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 69f556ddb934..c514af438fc2 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -292,30 +292,6 @@ mlxsw_sp_bridge_port_destroy(struct mlxsw_sp_bridge_port *bridge_port) + kfree(bridge_port); + } + +-static bool +-mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port * +- bridge_port) +-{ +- struct net_device *dev = bridge_port->dev; +- struct mlxsw_sp *mlxsw_sp; +- +- if (is_vlan_dev(dev)) +- mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev)); +- else +- mlxsw_sp = mlxsw_sp_lower_get(dev); +- +- /* In case ports were pulled from out of a bridged LAG, then +- * it's possible the reference count isn't zero, yet the bridge +- * port should be destroyed, as it's no longer an upper of ours. +- */ +- if (!mlxsw_sp && list_empty(&bridge_port->vlans_list)) +- return true; +- else if (bridge_port->ref_count == 0) +- return true; +- else +- return false; +-} +- + static struct mlxsw_sp_bridge_port * + mlxsw_sp_bridge_port_get(struct mlxsw_sp_bridge *bridge, + struct net_device *brport_dev) +@@ -353,8 +329,7 @@ static void mlxsw_sp_bridge_port_put(struct mlxsw_sp_bridge *bridge, + { + struct mlxsw_sp_bridge_device *bridge_device; + +- bridge_port->ref_count--; +- if (!mlxsw_sp_bridge_port_should_destroy(bridge_port)) ++ if (--bridge_port->ref_count != 0) + return; + bridge_device = bridge_port->bridge_device; + mlxsw_sp_bridge_port_destroy(bridge_port); +-- +2.19.1 + diff --git a/queue-4.20/mlxsw-spectrum_acl-limit-priority-value.patch b/queue-4.20/mlxsw-spectrum_acl-limit-priority-value.patch new file mode 100644 index 00000000000..d691cf25c8c --- /dev/null +++ b/queue-4.20/mlxsw-spectrum_acl-limit-priority-value.patch @@ -0,0 +1,45 @@ +From 6a4cd30b370df8f1454bbc9c01eff126772930fe Mon Sep 17 00:00:00 2001 +From: Nir Dotan +Date: Mon, 10 Dec 2018 07:11:44 +0000 +Subject: mlxsw: spectrum_acl: Limit priority value + +[ Upstream commit d7263ab35be25505ab57ebecd93cbc5dba8be717 ] + +In Spectrum-2, higher priority value wins and priority valid values are in +the range of {1,cap_kvd_size-1}. mlxsw_sp_acl_tcam_priority_get converts +from lower-bound priorities alike tc flower to Spectrum-2 HW range. Up +until now tc flower did not provide priority 0 or reached the maximal +value, however multicast routing does provide priority 0. + +Therefore, Change mlxsw_sp_acl_tcam_priority_get to verify priority is in +the correct range. Make sure priority is never set to zero and never +exceeds the maximal allowed value. + +Signed-off-by: Nir Dotan +Reviewed-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index e171513bb32a..30931a2c025b 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -95,8 +95,9 @@ int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp, + if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, KVD_SIZE)) + return -EIO; + +- max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE); +- if (rulei->priority > max_priority) ++ /* Priority range is 1..cap_kvd_size-1. */ ++ max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE) - 1; ++ if (rulei->priority >= max_priority) + return -EINVAL; + + /* Unlike in TC, in HW, higher number means higher priority. */ +-- +2.19.1 + diff --git a/queue-4.20/mm-page_alloc.c-don-t-call-kasan_free_pages-at-defer.patch b/queue-4.20/mm-page_alloc.c-don-t-call-kasan_free_pages-at-defer.patch new file mode 100644 index 00000000000..8bfcd741fba --- /dev/null +++ b/queue-4.20/mm-page_alloc.c-don-t-call-kasan_free_pages-at-defer.patch @@ -0,0 +1,138 @@ +From 986ab9e53ea9bef4d629105209b82e1d81f3847d Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Fri, 28 Dec 2018 00:38:51 -0800 +Subject: mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init + +[ Upstream commit 3c0c12cc8f00ca5f81acb010023b8eb13e9a7004 ] + +When CONFIG_KASAN is enabled on large memory SMP systems, the deferrred +pages initialization can take a long time. Below were the reported init +times on a 8-socket 96-core 4TB IvyBridge system. + + 1) Non-debug kernel without CONFIG_KASAN + [ 8.764222] node 1 initialised, 132086516 pages in 7027ms + + 2) Debug kernel with CONFIG_KASAN + [ 146.288115] node 1 initialised, 132075466 pages in 143052ms + +So the page init time in a debug kernel was 20X of the non-debug kernel. +The long init time can be problematic as the page initialization is done +with interrupt disabled. In this particular case, it caused the +appearance of following warning messages as well as NMI backtraces of all +the cores that were doing the initialization. + +[ 68.240049] rcu: INFO: rcu_sched detected stalls on CPUs/tasks: +[ 68.241000] rcu: 25-...0: (100 ticks this GP) idle=b72/1/0x4000000000000000 softirq=915/915 fqs=16252 +[ 68.241000] rcu: 44-...0: (95 ticks this GP) idle=49a/1/0x4000000000000000 softirq=788/788 fqs=16253 +[ 68.241000] rcu: 54-...0: (104 ticks this GP) idle=03a/1/0x4000000000000000 softirq=721/825 fqs=16253 +[ 68.241000] rcu: 60-...0: (103 ticks this GP) idle=cbe/1/0x4000000000000000 softirq=637/740 fqs=16253 +[ 68.241000] rcu: 72-...0: (105 ticks this GP) idle=786/1/0x4000000000000000 softirq=536/641 fqs=16253 +[ 68.241000] rcu: 84-...0: (99 ticks this GP) idle=292/1/0x4000000000000000 softirq=537/537 fqs=16253 +[ 68.241000] rcu: 111-...0: (104 ticks this GP) idle=bde/1/0x4000000000000000 softirq=474/476 fqs=16253 +[ 68.241000] rcu: (detected by 13, t=65018 jiffies, g=249, q=2) + +The long init time was mainly caused by the call to kasan_free_pages() to +poison the newly initialized pages. On a 4TB system, we are talking about +almost 500GB of memory probably on the same node. + +In reality, we may not need to poison the newly initialized pages before +they are ever allocated. So KASAN poisoning of freed pages before the +completion of deferred memory initialization is now disabled. Those pages +will be properly poisoned when they are allocated or freed after deferred +pages initialization is done. + +With this change, the new page initialization time became: + +[ 21.948010] node 1 initialised, 132075466 pages in 18702ms + +This was still about double the non-debug kernel time, but was much +better than before. + +Link: http://lkml.kernel.org/r/1544459388-8736-1-git-send-email-longman@redhat.com +Signed-off-by: Waiman Long +Reviewed-by: Andrew Morton +Cc: Andrey Ryabinin +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Michal Hocko +Cc: Pasha Tatashin +Cc: Oscar Salvador +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 37 +++++++++++++++++++++++++++++-------- + 1 file changed, 29 insertions(+), 8 deletions(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 995d1079f958..a29043ea9212 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -294,6 +294,32 @@ EXPORT_SYMBOL(nr_online_nodes); + int page_group_by_mobility_disabled __read_mostly; + + #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT ++/* ++ * During boot we initialize deferred pages on-demand, as needed, but once ++ * page_alloc_init_late() has finished, the deferred pages are all initialized, ++ * and we can permanently disable that path. ++ */ ++static DEFINE_STATIC_KEY_TRUE(deferred_pages); ++ ++/* ++ * Calling kasan_free_pages() only after deferred memory initialization ++ * has completed. Poisoning pages during deferred memory init will greatly ++ * lengthen the process and cause problem in large memory systems as the ++ * deferred pages initialization is done with interrupt disabled. ++ * ++ * Assuming that there will be no reference to those newly initialized ++ * pages before they are ever allocated, this should have no effect on ++ * KASAN memory tracking as the poison will be properly inserted at page ++ * allocation time. The only corner case is when pages are allocated by ++ * on-demand allocation and then freed again before the deferred pages ++ * initialization is done, but this is not likely to happen. ++ */ ++static inline void kasan_free_nondeferred_pages(struct page *page, int order) ++{ ++ if (!static_branch_unlikely(&deferred_pages)) ++ kasan_free_pages(page, order); ++} ++ + /* Returns true if the struct page for the pfn is uninitialised */ + static inline bool __meminit early_page_uninitialised(unsigned long pfn) + { +@@ -335,6 +361,8 @@ defer_init(int nid, unsigned long pfn, unsigned long end_pfn) + return false; + } + #else ++#define kasan_free_nondeferred_pages(p, o) kasan_free_pages(p, o) ++ + static inline bool early_page_uninitialised(unsigned long pfn) + { + return false; +@@ -1037,7 +1065,7 @@ static __always_inline bool free_pages_prepare(struct page *page, + arch_free_page(page, order); + kernel_poison_pages(page, 1 << order, 0); + kernel_map_pages(page, 1 << order, 0); +- kasan_free_pages(page, order); ++ kasan_free_nondeferred_pages(page, order); + + return true; + } +@@ -1605,13 +1633,6 @@ static int __init deferred_init_memmap(void *data) + return 0; + } + +-/* +- * During boot we initialize deferred pages on-demand, as needed, but once +- * page_alloc_init_late() has finished, the deferred pages are all initialized, +- * and we can permanently disable that path. +- */ +-static DEFINE_STATIC_KEY_TRUE(deferred_pages); +- + /* + * If this zone has deferred pages, try to grow it by initializing enough + * deferred pages to satisfy the allocation specified by order, rounded up to +-- +2.19.1 + diff --git a/queue-4.20/mmc-bcm2835-recover-from-mmc_send_ext_csd.patch b/queue-4.20/mmc-bcm2835-recover-from-mmc_send_ext_csd.patch new file mode 100644 index 00000000000..00f621d46ad --- /dev/null +++ b/queue-4.20/mmc-bcm2835-recover-from-mmc_send_ext_csd.patch @@ -0,0 +1,56 @@ +From 8e1249b96fbb123c615aa11fdc27a5196b429965 Mon Sep 17 00:00:00 2001 +From: Phil Elwell +Date: Sun, 11 Nov 2018 21:23:54 +0100 +Subject: mmc: bcm2835: Recover from MMC_SEND_EXT_CSD + +[ Upstream commit 07d405769afea5718529fc9e341f0b13b3189b6f ] + +If the user issues an "mmc extcsd read", the SD controller receives +what it thinks is a SEND_IF_COND command with an unexpected data block. +The resulting operations leave the FSM stuck in READWAIT, a state which +persists until the MMC framework resets the controller, by which point +the root filesystem is likely to have been unmounted. + +A less heavyweight solution is to detect the condition and nudge the +FSM by asserting the (self-clearing) FORCE_DATA_MODE bit. + +Link: https://github.com/raspberrypi/linux/issues/2728 +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Acked-by: Eric Anholt +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/bcm2835.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c +index 0d3b7473bc21..abf1f3c8b0c3 100644 +--- a/drivers/mmc/host/bcm2835.c ++++ b/drivers/mmc/host/bcm2835.c +@@ -772,6 +772,8 @@ static void bcm2835_finish_command(struct bcm2835_host *host) + + if (!(sdhsts & SDHSTS_CRC7_ERROR) || + (host->cmd->opcode != MMC_SEND_OP_COND)) { ++ u32 edm, fsm; ++ + if (sdhsts & SDHSTS_CMD_TIME_OUT) { + host->cmd->error = -ETIMEDOUT; + } else { +@@ -780,6 +782,13 @@ static void bcm2835_finish_command(struct bcm2835_host *host) + bcm2835_dumpregs(host); + host->cmd->error = -EILSEQ; + } ++ edm = readl(host->ioaddr + SDEDM); ++ fsm = edm & SDEDM_FSM_MASK; ++ if (fsm == SDEDM_FSM_READWAIT || ++ fsm == SDEDM_FSM_WRITESTART1) ++ /* Kick the FSM out of its wait */ ++ writel(edm | SDEDM_FORCE_DATA_MODE, ++ host->ioaddr + SDEDM); + bcm2835_finish_request(host); + return; + } +-- +2.19.1 + diff --git a/queue-4.20/mmc-bcm2835-reset-host-on-timeout.patch b/queue-4.20/mmc-bcm2835-reset-host-on-timeout.patch new file mode 100644 index 00000000000..5cbe7debdfe --- /dev/null +++ b/queue-4.20/mmc-bcm2835-reset-host-on-timeout.patch @@ -0,0 +1,48 @@ +From 30b68b73af2a9501bc597e697b0181f4e4aaeb84 Mon Sep 17 00:00:00 2001 +From: Michal Suchanek +Date: Sun, 11 Nov 2018 21:23:53 +0100 +Subject: mmc: bcm2835: reset host on timeout + +[ Upstream commit f6000a4eb34e6462bc0dd39809c1bb99f9633269 ] + +The bcm2835 mmc host tends to lock up for unknown reason so reset it on +timeout. The upper mmc block layer tries retransimitting with single +blocks which tends to work out after a long wait. + +This is better than giving up and leaving the machine broken for no +obvious reason. + +Fixes: 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.") +Signed-off-by: Michal Suchanek +Signed-off-by: Stefan Wahren +Acked-by: Eric Anholt +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/bcm2835.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mmc/host/bcm2835.c b/drivers/mmc/host/bcm2835.c +index abf1f3c8b0c3..5301302fb531 100644 +--- a/drivers/mmc/host/bcm2835.c ++++ b/drivers/mmc/host/bcm2835.c +@@ -286,6 +286,7 @@ static void bcm2835_reset(struct mmc_host *mmc) + + if (host->dma_chan) + dmaengine_terminate_sync(host->dma_chan); ++ host->dma_chan = NULL; + bcm2835_reset_internal(host); + } + +@@ -846,6 +847,8 @@ static void bcm2835_timeout(struct work_struct *work) + dev_err(dev, "timeout waiting for hardware interrupt.\n"); + bcm2835_dumpregs(host); + ++ bcm2835_reset(host->mmc); ++ + if (host->data) { + host->data->error = -ETIMEDOUT; + bcm2835_finish_data(host); +-- +2.19.1 + diff --git a/queue-4.20/mmc-jz4740-get-cd-wp-gpios-from-descriptors.patch b/queue-4.20/mmc-jz4740-get-cd-wp-gpios-from-descriptors.patch new file mode 100644 index 00000000000..319e980df07 --- /dev/null +++ b/queue-4.20/mmc-jz4740-get-cd-wp-gpios-from-descriptors.patch @@ -0,0 +1,119 @@ +From 62c48d061ddd8e9bec8edee6dd3d7015027d4bad Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Mon, 12 Nov 2018 15:12:31 +0100 +Subject: mmc: jz4740: Get CD/WP GPIOs from descriptors + +[ Upstream commit 0c901c0566fb4edc2631c3786e5085a037be91f8 ] + +Modifty the JZ4740 driver to retrieve card detect and write +protect GPIO pins from GPIO descriptors instead of hard-coded +global numbers. Augment the only board file using this in the +process and cut down on passed in platform data. + +Preserve the code setting the caps2 flags for CD and WP +as active low or high since the slot GPIO code currently +ignores the gpiolib polarity inversion semantice and uses +the raw accessors to read the GPIO lines, but set the right +polarity flags in the descriptor table for jz4740. + +Cc: Paul Cercueil +Cc: linux-mips@linux-mips.org +Signed-off-by: Linus Walleij +Acked-by: Paul Burton +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + .../mips/include/asm/mach-jz4740/jz4740_mmc.h | 2 -- + arch/mips/jz4740/board-qi_lb60.c | 12 ++++++++--- + drivers/mmc/host/jz4740_mmc.c | 20 +++++++++---------- + 3 files changed, 19 insertions(+), 15 deletions(-) + +diff --git a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h +index e9cc62cfac99..ff50aeb1a933 100644 +--- a/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h ++++ b/arch/mips/include/asm/mach-jz4740/jz4740_mmc.h +@@ -4,8 +4,6 @@ + + struct jz4740_mmc_platform_data { + int gpio_power; +- int gpio_card_detect; +- int gpio_read_only; + unsigned card_detect_active_low:1; + unsigned read_only_active_low:1; + unsigned power_active_low:1; +diff --git a/arch/mips/jz4740/board-qi_lb60.c b/arch/mips/jz4740/board-qi_lb60.c +index af0c8ace0141..705593d40d12 100644 +--- a/arch/mips/jz4740/board-qi_lb60.c ++++ b/arch/mips/jz4740/board-qi_lb60.c +@@ -43,7 +43,6 @@ + #include "clock.h" + + /* GPIOs */ +-#define QI_LB60_GPIO_SD_CD JZ_GPIO_PORTD(0) + #define QI_LB60_GPIO_SD_VCC_EN_N JZ_GPIO_PORTD(2) + + #define QI_LB60_GPIO_KEYOUT(x) (JZ_GPIO_PORTC(10) + (x)) +@@ -386,12 +385,18 @@ static struct platform_device qi_lb60_gpio_keys = { + }; + + static struct jz4740_mmc_platform_data qi_lb60_mmc_pdata = { +- .gpio_card_detect = QI_LB60_GPIO_SD_CD, +- .gpio_read_only = -1, + .gpio_power = QI_LB60_GPIO_SD_VCC_EN_N, + .power_active_low = 1, + }; + ++static struct gpiod_lookup_table qi_lb60_mmc_gpio_table = { ++ .dev_id = "jz4740-mmc.0", ++ .table = { ++ GPIO_LOOKUP("GPIOD", 0, "cd", GPIO_ACTIVE_HIGH), ++ { }, ++ }, ++}; ++ + /* beeper */ + static struct pwm_lookup qi_lb60_pwm_lookup[] = { + PWM_LOOKUP("jz4740-pwm", 4, "pwm-beeper", NULL, 0, +@@ -500,6 +505,7 @@ static int __init qi_lb60_init_platform_devices(void) + gpiod_add_lookup_table(&qi_lb60_audio_gpio_table); + gpiod_add_lookup_table(&qi_lb60_nand_gpio_table); + gpiod_add_lookup_table(&qi_lb60_spigpio_gpio_table); ++ gpiod_add_lookup_table(&qi_lb60_mmc_gpio_table); + + spi_register_board_info(qi_lb60_spi_board_info, + ARRAY_SIZE(qi_lb60_spi_board_info)); +diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c +index 0c1efd5100b7..44ea452add8e 100644 +--- a/drivers/mmc/host/jz4740_mmc.c ++++ b/drivers/mmc/host/jz4740_mmc.c +@@ -983,17 +983,17 @@ static int jz4740_mmc_request_gpios(struct mmc_host *mmc, + if (!pdata->read_only_active_low) + mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH; + +- if (gpio_is_valid(pdata->gpio_card_detect)) { +- ret = mmc_gpio_request_cd(mmc, pdata->gpio_card_detect, 0); +- if (ret) +- return ret; +- } ++ /* ++ * Get optional card detect and write protect GPIOs, ++ * only back out on probe deferral. ++ */ ++ ret = mmc_gpiod_request_cd(mmc, "cd", 0, false, 0, NULL); ++ if (ret == -EPROBE_DEFER) ++ return ret; + +- if (gpio_is_valid(pdata->gpio_read_only)) { +- ret = mmc_gpio_request_ro(mmc, pdata->gpio_read_only); +- if (ret) +- return ret; +- } ++ ret = mmc_gpiod_request_ro(mmc, "wp", 0, false, 0, NULL); ++ if (ret == -EPROBE_DEFER) ++ return ret; + + return jz4740_mmc_request_gpio(&pdev->dev, pdata->gpio_power, + "MMC read only", true, pdata->power_active_low); +-- +2.19.1 + diff --git a/queue-4.20/mmc-meson-mx-sdio-check-devm_kasprintf-for-failure.patch b/queue-4.20/mmc-meson-mx-sdio-check-devm_kasprintf-for-failure.patch new file mode 100644 index 00000000000..8c73edfa578 --- /dev/null +++ b/queue-4.20/mmc-meson-mx-sdio-check-devm_kasprintf-for-failure.patch @@ -0,0 +1,48 @@ +From 89e6e2575047aaf5090623bf326dc24b196bfd94 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Thu, 22 Nov 2018 10:35:19 +0100 +Subject: mmc: meson-mx-sdio: check devm_kasprintf for failure + +[ Upstream commit b0d06f1cb0e2079a3c64fb6e27c19d9a55c723a1 ] + +devm_kasprintf() may return NULL on failure of internal allocation thus +the assignments to init.name are not safe if not checked. On error +meson_mx_mmc_register_clks() returns negative values so -ENOMEM in the +(unlikely) failure case of devm_kasprintf() should be fine here. + +Signed-off-by: Nicholas Mc Guire +Fixes: ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meson8 and Meson8b SoCs") +Acked-by: Martin Blumenstingl +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/meson-mx-sdio.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mmc/host/meson-mx-sdio.c b/drivers/mmc/host/meson-mx-sdio.c +index abe253c262a2..ec980bda071c 100644 +--- a/drivers/mmc/host/meson-mx-sdio.c ++++ b/drivers/mmc/host/meson-mx-sdio.c +@@ -596,6 +596,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host) + init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL, + "%s#fixed_factor", + dev_name(host->controller_dev)); ++ if (!init.name) ++ return -ENOMEM; ++ + init.ops = &clk_fixed_factor_ops; + init.flags = 0; + init.parent_names = &clk_fixed_factor_parent; +@@ -612,6 +615,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host) + clk_div_parent = __clk_get_name(host->fixed_factor_clk); + init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL, + "%s#div", dev_name(host->controller_dev)); ++ if (!init.name) ++ return -ENOMEM; ++ + init.ops = &clk_divider_ops; + init.flags = CLK_SET_RATE_PARENT; + init.parent_names = &clk_div_parent; +-- +2.19.1 + diff --git a/queue-4.20/mmc-sdhci-of-esdhc-fix-timeout-checks.patch b/queue-4.20/mmc-sdhci-of-esdhc-fix-timeout-checks.patch new file mode 100644 index 00000000000..5c7a2558122 --- /dev/null +++ b/queue-4.20/mmc-sdhci-of-esdhc-fix-timeout-checks.patch @@ -0,0 +1,54 @@ +From 06661354759575acb88ffa80e0a4678fb78c7daa Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 10 Dec 2018 10:56:24 +0200 +Subject: mmc: sdhci-of-esdhc: Fix timeout checks + +[ Upstream commit ea6d027312111c6d96309ad1a684b33cb37e6764 ] + +Always check the wait condition before returning timeout. + +Signed-off-by: Adrian Hunter +Reviewed-by: Yangbo Lu +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-esdhc.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c +index 86fc9f022002..d111bf62acd9 100644 +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -528,8 +528,12 @@ static void esdhc_clock_enable(struct sdhci_host *host, bool enable) + /* Wait max 20 ms */ + timeout = ktime_add_ms(ktime_get(), 20); + val = ESDHC_CLOCK_STABLE; +- while (!(sdhci_readl(host, ESDHC_PRSSTAT) & val)) { +- if (ktime_after(ktime_get(), timeout)) { ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ if (sdhci_readl(host, ESDHC_PRSSTAT) & val) ++ break; ++ if (timedout) { + pr_err("%s: Internal clock never stabilised.\n", + mmc_hostname(host->mmc)); + break; +@@ -594,8 +598,12 @@ static void esdhc_of_set_clock(struct sdhci_host *host, unsigned int clock) + + /* Wait max 20 ms */ + timeout = ktime_add_ms(ktime_get(), 20); +- while (!(sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE)) { +- if (ktime_after(ktime_get(), timeout)) { ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ if (sdhci_readl(host, ESDHC_PRSSTAT) & ESDHC_CLOCK_STABLE) ++ break; ++ if (timedout) { + pr_err("%s: Internal clock never stabilised.\n", + mmc_hostname(host->mmc)); + return; +-- +2.19.1 + diff --git a/queue-4.20/mmc-sdhci-omap-fix-timeout-checks.patch b/queue-4.20/mmc-sdhci-omap-fix-timeout-checks.patch new file mode 100644 index 00000000000..8725bcbe2dd --- /dev/null +++ b/queue-4.20/mmc-sdhci-omap-fix-timeout-checks.patch @@ -0,0 +1,54 @@ +From 255461044b54c6af1f7af175b7a19295f1b67d9f Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 10 Dec 2018 10:56:25 +0200 +Subject: mmc: sdhci-omap: Fix timeout checks + +[ Upstream commit 9f0ea0bda1d06120b053bb0c283f54afec59293d ] + +Always check the wait condition before returning timeout. + +Signed-off-by: Adrian Hunter +Acked-by: Kishon Vijay Abraham I +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-omap.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-omap.c b/drivers/mmc/host/sdhci-omap.c +index d264391616f9..d02f5cf76b3d 100644 +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -220,8 +220,12 @@ static void sdhci_omap_conf_bus_power(struct sdhci_omap_host *omap_host, + + /* wait 1ms */ + timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT); +- while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP)) { +- if (WARN_ON(ktime_after(ktime_get(), timeout))) ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ if (sdhci_omap_readl(omap_host, SDHCI_OMAP_HCTL) & HCTL_SDBP) ++ break; ++ if (WARN_ON(timedout)) + return; + usleep_range(5, 10); + } +@@ -653,8 +657,12 @@ static void sdhci_omap_init_74_clocks(struct sdhci_host *host, u8 power_mode) + + /* wait 1ms */ + timeout = ktime_add_ms(ktime_get(), SDHCI_OMAP_TIMEOUT); +- while (!(sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN)) { +- if (WARN_ON(ktime_after(ktime_get(), timeout))) ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ if (sdhci_omap_readl(omap_host, SDHCI_OMAP_STAT) & INT_CC_EN) ++ break; ++ if (WARN_ON(timedout)) + return; + usleep_range(5, 10); + } +-- +2.19.1 + diff --git a/queue-4.20/mmc-sdhci-xenon-fix-timeout-checks.patch b/queue-4.20/mmc-sdhci-xenon-fix-timeout-checks.patch new file mode 100644 index 00000000000..fe3ce7e5ac2 --- /dev/null +++ b/queue-4.20/mmc-sdhci-xenon-fix-timeout-checks.patch @@ -0,0 +1,63 @@ +From 82219957cb9c4aa28bf6ad6f94cecc8fa799df62 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Mon, 10 Dec 2018 10:56:26 +0200 +Subject: mmc: sdhci-xenon: Fix timeout checks + +[ Upstream commit 0e6e7c2ff397e1bbebc882ca3132148aaaef1ddd ] + +Always check the wait condition before returning timeout. + +Signed-off-by: Adrian Hunter +Reviewed-by: Zhoujie Wu +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-xenon-phy.c | 10 +++++++--- + drivers/mmc/host/sdhci-xenon.c | 10 +++++++--- + 2 files changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/mmc/host/sdhci-xenon-phy.c b/drivers/mmc/host/sdhci-xenon-phy.c +index 5956e90380e8..5b5eb53a63d2 100644 +--- a/drivers/mmc/host/sdhci-xenon-phy.c ++++ b/drivers/mmc/host/sdhci-xenon-phy.c +@@ -357,9 +357,13 @@ static int xenon_emmc_phy_enable_dll(struct sdhci_host *host) + + /* Wait max 32 ms */ + timeout = ktime_add_ms(ktime_get(), 32); +- while (!(sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) & +- XENON_DLL_LOCK_STATE)) { +- if (ktime_after(ktime_get(), timeout)) { ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ if (sdhci_readw(host, XENON_SLOT_EXT_PRESENT_STATE) & ++ XENON_DLL_LOCK_STATE) ++ break; ++ if (timedout) { + dev_err(mmc_dev(host->mmc), "Wait for DLL Lock time-out\n"); + return -ETIMEDOUT; + } +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index 4d0791f6ec23..a0b5089b3274 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -34,9 +34,13 @@ static int xenon_enable_internal_clk(struct sdhci_host *host) + sdhci_writel(host, reg, SDHCI_CLOCK_CONTROL); + /* Wait max 20 ms */ + timeout = ktime_add_ms(ktime_get(), 20); +- while (!((reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL)) +- & SDHCI_CLOCK_INT_STABLE)) { +- if (ktime_after(ktime_get(), timeout)) { ++ while (1) { ++ bool timedout = ktime_after(ktime_get(), timeout); ++ ++ reg = sdhci_readw(host, SDHCI_CLOCK_CONTROL); ++ if (reg & SDHCI_CLOCK_INT_STABLE) ++ break; ++ if (timedout) { + dev_err(mmc_dev(host->mmc), "Internal clock never stabilised.\n"); + return -ETIMEDOUT; + } +-- +2.19.1 + diff --git a/queue-4.20/modpost-validate-symbol-names-also-in-find_elf_symbo.patch b/queue-4.20/modpost-validate-symbol-names-also-in-find_elf_symbo.patch new file mode 100644 index 00000000000..8579ba1f41c --- /dev/null +++ b/queue-4.20/modpost-validate-symbol-names-also-in-find_elf_symbo.patch @@ -0,0 +1,102 @@ +From 8599ed05847761596e7c5c423092d8c786cd55d8 Mon Sep 17 00:00:00 2001 +From: Sami Tolvanen +Date: Tue, 23 Oct 2018 15:15:35 -0700 +Subject: modpost: validate symbol names also in find_elf_symbol + +[ Upstream commit 5818c683a619c534c113e1f66d24f636defc29bc ] + +If an ARM mapping symbol shares an address with a valid symbol, +find_elf_symbol can currently return the mapping symbol instead, as the +symbol is not validated. This can result in confusing warnings: + + WARNING: vmlinux.o(.text+0x18f4028): Section mismatch in reference + from the function set_reset_devices() to the variable .init.text:$x.0 + +This change adds a call to is_valid_name to find_elf_symbol, similarly +to how it's already used in find_elf_symbol2. + +Signed-off-by: Sami Tolvanen +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 50 ++++++++++++++++++++++--------------------- + 1 file changed, 26 insertions(+), 24 deletions(-) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 5a5b3780456f..5a77efd39b3f 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1204,6 +1204,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + return 1; + } + ++static inline int is_arm_mapping_symbol(const char *str) ++{ ++ return str[0] == '$' && strchr("axtd", str[1]) ++ && (str[2] == '\0' || str[2] == '.'); ++} ++ ++/* ++ * If there's no name there, ignore it; likewise, ignore it if it's ++ * one of the magic symbols emitted used by current ARM tools. ++ * ++ * Otherwise if find_symbols_between() returns those symbols, they'll ++ * fail the whitelist tests and cause lots of false alarms ... fixable ++ * only by merging __exit and __init sections into __text, bloating ++ * the kernel (which is especially evil on embedded platforms). ++ */ ++static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) ++{ ++ const char *name = elf->strtab + sym->st_name; ++ ++ if (!name || !strlen(name)) ++ return 0; ++ return !is_arm_mapping_symbol(name); ++} ++ + /** + * Find symbol based on relocation record info. + * In some cases the symbol supplied is a valid symbol so +@@ -1229,6 +1253,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + continue; + if (ELF_ST_TYPE(sym->st_info) == STT_SECTION) + continue; ++ if (!is_valid_name(elf, sym)) ++ continue; + if (sym->st_value == addr) + return sym; + /* Find a symbol nearby - addr are maybe negative */ +@@ -1247,30 +1273,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr, + return NULL; + } + +-static inline int is_arm_mapping_symbol(const char *str) +-{ +- return str[0] == '$' && strchr("axtd", str[1]) +- && (str[2] == '\0' || str[2] == '.'); +-} +- +-/* +- * If there's no name there, ignore it; likewise, ignore it if it's +- * one of the magic symbols emitted used by current ARM tools. +- * +- * Otherwise if find_symbols_between() returns those symbols, they'll +- * fail the whitelist tests and cause lots of false alarms ... fixable +- * only by merging __exit and __init sections into __text, bloating +- * the kernel (which is especially evil on embedded platforms). +- */ +-static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym) +-{ +- const char *name = elf->strtab + sym->st_name; +- +- if (!name || !strlen(name)) +- return 0; +- return !is_arm_mapping_symbol(name); +-} +- + /* + * Find symbols before or equal addr and after addr - in the section sec. + * If we find two symbols with equal offset prefer one with a valid name. +-- +2.19.1 + diff --git a/queue-4.20/mt76x0-dfs-fix-ibi_r11-configuration-on-non-radar-ch.patch b/queue-4.20/mt76x0-dfs-fix-ibi_r11-configuration-on-non-radar-ch.patch new file mode 100644 index 00000000000..ef8e238c136 --- /dev/null +++ b/queue-4.20/mt76x0-dfs-fix-ibi_r11-configuration-on-non-radar-ch.patch @@ -0,0 +1,49 @@ +From 64d035c48bddd710f49abd301e8ba6161a13ba0d Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Mon, 5 Nov 2018 00:18:26 +0100 +Subject: mt76x0: dfs: fix IBI_R11 configuration on non-radar channels + +[ Upstream commit 6bf4a8e902aad7df55d7f2b10b850cfa3f880996 ] + +Fix IBI_R11 configuration on non-radar channels for mt76x0e +driver. This patch improve system stability under heavy load. +Moreover use IBI_R11 name and remove magic numbers for +0x212c register + +Fixes: 0c3b3abc9251 ("mt76x0: pci: add DFS support") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c +index b56febae8945..764528c9f48a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c +@@ -800,7 +800,7 @@ static void mt76x2_dfs_set_bbp_params(struct mt76x02_dev *dev) + + /* enable detection*/ + mt76_wr(dev, MT_BBP(DFS, 0), MT_DFS_CH_EN << 16); +- mt76_wr(dev, 0x212c, 0x0c350001); ++ mt76_wr(dev, MT_BBP(IBI, 11), 0x0c350001); + } + + void mt76x2_dfs_adjust_agc(struct mt76x02_dev *dev) +@@ -843,7 +843,11 @@ void mt76x2_dfs_init_params(struct mt76x02_dev *dev) + mt76_wr(dev, MT_BBP(DFS, 0), 0); + /* clear detector status */ + mt76_wr(dev, MT_BBP(DFS, 1), 0xf); +- mt76_wr(dev, 0x212c, 0); ++ if (mt76_chip(&dev->mt76) == 0x7610 || ++ mt76_chip(&dev->mt76) == 0x7630) ++ mt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081); ++ else ++ mt76_wr(dev, MT_BBP(IBI, 11), 0); + + mt76x02_irq_disable(dev, MT_INT_GPTIMER); + mt76_rmw_field(dev, MT_INT_TIMER_EN, +-- +2.19.1 + diff --git a/queue-4.20/nds32-fix-gcc-8.0-compiler-option-incompatible.patch b/queue-4.20/nds32-fix-gcc-8.0-compiler-option-incompatible.patch new file mode 100644 index 00000000000..42e9ac0f811 --- /dev/null +++ b/queue-4.20/nds32-fix-gcc-8.0-compiler-option-incompatible.patch @@ -0,0 +1,38 @@ +From f032d03ab987a62ddffb24dd1226135d33679c7d Mon Sep 17 00:00:00 2001 +From: Nickhu +Date: Thu, 18 Oct 2018 16:37:55 +0800 +Subject: nds32: Fix gcc 8.0 compiler option incompatible. + +[ Upstream commit 4c3d6174e0e17599549f636ec48ddf78627a17fe ] + +When the kernel configs of ftrace and frame pointer options are +choosed, the compiler option of kernel will incompatible. + Error message: + nds32le-linux-gcc: error: -pg and -fomit-frame-pointer are incompatible + +Signed-off-by: Nickhu +Signed-off-by: Zong Li +Acked-by: Greentime Hu +Signed-off-by: Greentime Hu +Signed-off-by: Sasha Levin +--- + arch/nds32/mm/Makefile | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/nds32/mm/Makefile b/arch/nds32/mm/Makefile +index 6b6855852223..7c5c15ad854a 100644 +--- a/arch/nds32/mm/Makefile ++++ b/arch/nds32/mm/Makefile +@@ -4,4 +4,8 @@ obj-y := extable.o tlb.o \ + + obj-$(CONFIG_ALIGNMENT_TRAP) += alignment.o + obj-$(CONFIG_HIGHMEM) += highmem.o +-CFLAGS_proc-n13.o += -fomit-frame-pointer ++ ++ifdef CONFIG_FUNCTION_TRACER ++CFLAGS_REMOVE_proc.o = $(CC_FLAGS_FTRACE) ++endif ++CFLAGS_proc.o += -fomit-frame-pointer +-- +2.19.1 + diff --git a/queue-4.20/net-aquantia-return-err-if-set-mpi_deinit-state-fail.patch b/queue-4.20/net-aquantia-return-err-if-set-mpi_deinit-state-fail.patch new file mode 100644 index 00000000000..f07013f539f --- /dev/null +++ b/queue-4.20/net-aquantia-return-err-if-set-mpi_deinit-state-fail.patch @@ -0,0 +1,39 @@ +From 69e52cbec626a4fcc96c7ea1316033dc70204ac7 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Sat, 24 Nov 2018 18:16:41 +0800 +Subject: net: aquantia: return 'err' if set MPI_DEINIT state fails + +[ Upstream commit 4e3c7c00bba0636b97eb23d582c20b0f5d95ce20 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c:260:7: + warning: variable 'err' set but not used [-Wunused-but-set-variable] + +'err' should be returned while set MPI_DEINIT state fails +in hw_atl_utils_soft_reset. + +Fixes: cce96d1883da ("net: aquantia: Regression on reset with 1.x firmware") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +index 7def1cb8ab9d..22cbf8dc6fa9 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +@@ -263,6 +263,8 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self) + AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) & + HW_ATL_MPI_STATE_MSK) == MPI_DEINIT, + 10, 1000U); ++ if (err) ++ return err; + } + + if (self->rbl_enabled) +-- +2.19.1 + diff --git a/queue-4.20/net-hns3-add-max-vector-number-check-for-pf.patch b/queue-4.20/net-hns3-add-max-vector-number-check-for-pf.patch new file mode 100644 index 00000000000..6cd83887eca --- /dev/null +++ b/queue-4.20/net-hns3-add-max-vector-number-check-for-pf.patch @@ -0,0 +1,46 @@ +From 4268e04b74ee06adccd983458c9224e5e9fe4871 Mon Sep 17 00:00:00 2001 +From: Jian Shen +Date: Thu, 20 Dec 2018 11:52:01 +0800 +Subject: net: hns3: add max vector number check for pf + +[ Upstream commit 75edb610860fda65ceedb017fc69afabd2806b8b ] + +Each pf supports max 64 vectors and 128 tqps. For 2p/4p core scenario, +there may be more than 64 cpus online. So the result of min_t(u16, +num_Online_cpus(), tqp_num) may be more than 64. This patch adds check +for the vector number. + +Fixes: dd38c72604dc ("net: hns3: fix for coalesce configuration lost during reset") +Signed-off-by: Jian Shen +Signed-off-by: Peng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 85d534a24f2c..beb5dbd5e98d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2902,6 +2902,8 @@ map_ring_fail: + + static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv) + { ++#define HNS3_VECTOR_PF_MAX_NUM 64 ++ + struct hnae3_handle *h = priv->ae_handle; + struct hns3_enet_tqp_vector *tqp_vector; + struct hnae3_vector_info *vector; +@@ -2914,6 +2916,8 @@ static int hns3_nic_alloc_vector_data(struct hns3_nic_priv *priv) + /* RSS size, cpu online and vector_num should be the same */ + /* Should consider 2p/4p later */ + vector_num = min_t(u16, num_online_cpus(), tqp_num); ++ vector_num = min_t(u16, vector_num, HNS3_VECTOR_PF_MAX_NUM); ++ + vector = devm_kcalloc(&pdev->dev, vector_num, sizeof(*vector), + GFP_KERNEL); + if (!vector) +-- +2.19.1 + diff --git a/queue-4.20/net-hns3-don-t-restore-rules-when-flow-director-is-d.patch b/queue-4.20/net-hns3-don-t-restore-rules-when-flow-director-is-d.patch new file mode 100644 index 00000000000..b1daf1146e3 --- /dev/null +++ b/queue-4.20/net-hns3-don-t-restore-rules-when-flow-director-is-d.patch @@ -0,0 +1,40 @@ +From 8734dc83f8339c103e9db3ff921288f595b7a74b Mon Sep 17 00:00:00 2001 +From: Jian Shen +Date: Thu, 20 Dec 2018 11:52:04 +0800 +Subject: net: hns3: don't restore rules when flow director is disabled + +[ Upstream commit 8edc2285b7285c5fbffe438dc8113260d3e76656 ] + +When user disables flow director, all the rules will be disabled. But +when reset happens, it will restore all the rules again. It's not +reasonable. This patch fixes it by add flow director status check before +restore fules. + +Fixes: 6871af29b3ab ("net: hns3: Add reset handle for flow director") +Fixes: c17852a8932f ("net: hns3: Add support for enable/disable flow director") +Signed-off-by: Jian Shen +Signed-off-by: Peng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index ffdd96020860..a7895aefe291 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4339,6 +4339,10 @@ static int hclge_restore_fd_entries(struct hnae3_handle *handle) + if (!hnae3_dev_fd_supported(hdev)) + return -EOPNOTSUPP; + ++ /* if fd is disabled, should not restore it when reset */ ++ if (!hdev->fd_cfg.fd_en) ++ return 0; ++ + hlist_for_each_entry_safe(rule, node, &hdev->fd_rule_list, rule_node) { + ret = hclge_config_action(hdev, HCLGE_FD_STAGE_1, rule); + if (!ret) +-- +2.19.1 + diff --git a/queue-4.20/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch b/queue-4.20/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch new file mode 100644 index 00000000000..2eca121c1b5 --- /dev/null +++ b/queue-4.20/net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch @@ -0,0 +1,53 @@ +From 113eba3971b3fa0eedfa1806f6435f2c92c2b855 Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 18 Dec 2018 19:37:48 +0800 +Subject: net: hns3: fix error handling int the hns3_get_vector_ring_chain + +[ Upstream commit cda69d244585bc4497d3bb878c22fe2b6ad647c1 ] + +When hns3_get_vector_ring_chain() failed in the +hns3_nic_init_vector_data(), it should do the error handling instead +of return directly. + +Also, cur_chain should be freed instead of chain and head->next should +be set to NULL in error handling of hns3_get_vector_ring_chain. + +This patch fixes them. + +Fixes: 73b907a083b8 ("net: hns3: bugfix for buffer not free problem during resetting") +Signed-off-by: Huazhong Tan +Signed-off-by: Peng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 20fcf0d1c2ce..4aea3f57586e 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2783,9 +2783,10 @@ err_free_chain: + cur_chain = head->next; + while (cur_chain) { + chain = cur_chain->next; +- devm_kfree(&pdev->dev, chain); ++ devm_kfree(&pdev->dev, cur_chain); + cur_chain = chain; + } ++ head->next = NULL; + + return -ENOMEM; + } +@@ -2876,7 +2877,7 @@ static int hns3_nic_init_vector_data(struct hns3_nic_priv *priv) + ret = hns3_get_vector_ring_chain(tqp_vector, + &vector_ring_chain); + if (ret) +- return ret; ++ goto map_ring_fail; + + ret = h->ae_algo->ops->map_ring_to_vector(h, + tqp_vector->vector_irq, &vector_ring_chain); +-- +2.19.1 + diff --git a/queue-4.20/net-hns3-fix-incomplete-uninitialization-of-irq-in-t.patch b/queue-4.20/net-hns3-fix-incomplete-uninitialization-of-irq-in-t.patch new file mode 100644 index 00000000000..dfd1e5a8605 --- /dev/null +++ b/queue-4.20/net-hns3-fix-incomplete-uninitialization-of-irq-in-t.patch @@ -0,0 +1,48 @@ +From 59d17e811c03699dc8bba9752e5389c0ad319620 Mon Sep 17 00:00:00 2001 +From: Huazhong Tan +Date: Tue, 18 Dec 2018 19:37:53 +0800 +Subject: net: hns3: fix incomplete uninitialization of IRQ in the + hns3_nic_uninit_vector_data() + +[ Upstream commit ae6017a71115ebc4e5c1a3f0f451319ab3f5c447 ] + +In the hns3_nic_uninit_vector_data(), the procedure of uninitializing +the tqp_vector's IRQ has not set affinity_notify to NULL and changes +its init flag. This patch fixes it. And for simplificaton, local +variable tqp_vector is used instead of priv->tqp_vector[i]. + +Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC") +Signed-off-by: Huazhong Tan +Signed-off-by: Peng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 4aea3f57586e..85d534a24f2c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2971,12 +2971,12 @@ static int hns3_nic_uninit_vector_data(struct hns3_nic_priv *priv) + + hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain); + +- if (priv->tqp_vector[i].irq_init_flag == HNS3_VECTOR_INITED) { +- (void)irq_set_affinity_hint( +- priv->tqp_vector[i].vector_irq, +- NULL); +- free_irq(priv->tqp_vector[i].vector_irq, +- &priv->tqp_vector[i]); ++ if (tqp_vector->irq_init_flag == HNS3_VECTOR_INITED) { ++ irq_set_affinity_notifier(tqp_vector->vector_irq, ++ NULL); ++ irq_set_affinity_hint(tqp_vector->vector_irq, NULL); ++ free_irq(tqp_vector->vector_irq, tqp_vector); ++ tqp_vector->irq_init_flag = HNS3_VECTOR_NOT_INITED; + } + + priv->ring_data[i].ring->irq_init_flag = HNS3_VECTOR_NOT_INITED; +-- +2.19.1 + diff --git a/queue-4.20/net-hns3-fix-the-descriptor-index-when-get-rss-type.patch b/queue-4.20/net-hns3-fix-the-descriptor-index-when-get-rss-type.patch new file mode 100644 index 00000000000..4f143851871 --- /dev/null +++ b/queue-4.20/net-hns3-fix-the-descriptor-index-when-get-rss-type.patch @@ -0,0 +1,46 @@ +From c79cb1114307d2b1795a59daa00d0e7617f856cf Mon Sep 17 00:00:00 2001 +From: Peng Li +Date: Thu, 20 Dec 2018 11:52:05 +0800 +Subject: net: hns3: fix the descriptor index when get rss type + +[ Upstream commit 31a16f99e02c2e0b40a5fb05d66f5e56721027e2 ] + +Driver gets rss information from the last descriptor of the packet. +When driver handle the rss type, ring->next_to_clean indicates the +first descriptor of next packet. + +This patch fix the descriptor index with "ring->next_to_clean - 1". + +Fixes: 232fc64b6e62 ("net: hns3: Add HW RSS hash information to RX skb") +Signed-off-by: Peng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index beb5dbd5e98d..d424d5bc0507 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -2332,9 +2332,16 @@ static bool hns3_parse_vlan_tag(struct hns3_enet_ring *ring, + static void hns3_set_rx_skb_rss_type(struct hns3_enet_ring *ring, + struct sk_buff *skb) + { +- struct hns3_desc *desc = &ring->desc[ring->next_to_clean]; + struct hnae3_handle *handle = ring->tqp->handle; + enum pkt_hash_types rss_type; ++ struct hns3_desc *desc; ++ int last_bd; ++ ++ /* When driver handle the rss type, ring->next_to_clean indicates the ++ * first descriptor of next packet, need -1 here. ++ */ ++ last_bd = (ring->next_to_clean - 1 + ring->desc_num) % ring->desc_num; ++ desc = &ring->desc[last_bd]; + + if (le32_to_cpu(desc->rx.rss_hash)) + rss_type = handle->kinfo.rss_type; +-- +2.19.1 + diff --git a/queue-4.20/net-mlx5-eq-use-the-right-place-to-store-read-irq-af.patch b/queue-4.20/net-mlx5-eq-use-the-right-place-to-store-read-irq-af.patch new file mode 100644 index 00000000000..3971d52bb37 --- /dev/null +++ b/queue-4.20/net-mlx5-eq-use-the-right-place-to-store-read-irq-af.patch @@ -0,0 +1,97 @@ +From 85ff5550d9dc5980b3638212d422de8710920efc Mon Sep 17 00:00:00 2001 +From: Saeed Mahameed +Date: Mon, 19 Nov 2018 10:52:31 -0800 +Subject: net/mlx5: EQ, Use the right place to store/read IRQ affinity hint + +[ Upstream commit 1e86ace4c140fd5a693e266c9b23409358f25381 ] + +Currently the cpu affinity hint mask for completion EQs is stored and +read from the wrong place, since reading and storing is done from the +same index, there is no actual issue with that, but internal irq_info +for completion EQs stars at MLX5_EQ_VEC_COMP_BASE offset in irq_info +array, this patch changes the code to use the correct offset to store +and read the IRQ affinity hint. + +Signed-off-by: Saeed Mahameed +Reviewed-by: Leon Romanovsky +Reviewed-by: Tariq Toukan +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 2 +- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 14 ++++++++------ + include/linux/mlx5/driver.h | 2 +- + 3 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index b70cb6fd164c..9577d0657839 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -1771,7 +1771,7 @@ static void mlx5e_close_cq(struct mlx5e_cq *cq) + + static int mlx5e_get_cpu(struct mlx5e_priv *priv, int ix) + { +- return cpumask_first(priv->mdev->priv.irq_info[ix].mask); ++ return cpumask_first(priv->mdev->priv.irq_info[ix + MLX5_EQ_VEC_COMP_BASE].mask); + } + + static int mlx5e_open_tx_cqs(struct mlx5e_channel *c, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 28132c7dc05f..d5cea0a36e6a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -640,18 +640,19 @@ u64 mlx5_read_internal_timer(struct mlx5_core_dev *dev) + static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i) + { + struct mlx5_priv *priv = &mdev->priv; +- int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i); ++ int vecidx = MLX5_EQ_VEC_COMP_BASE + i; ++ int irq = pci_irq_vector(mdev->pdev, vecidx); + +- if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) { ++ if (!zalloc_cpumask_var(&priv->irq_info[vecidx].mask, GFP_KERNEL)) { + mlx5_core_warn(mdev, "zalloc_cpumask_var failed"); + return -ENOMEM; + } + + cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node), +- priv->irq_info[i].mask); ++ priv->irq_info[vecidx].mask); + + if (IS_ENABLED(CONFIG_SMP) && +- irq_set_affinity_hint(irq, priv->irq_info[i].mask)) ++ irq_set_affinity_hint(irq, priv->irq_info[vecidx].mask)) + mlx5_core_warn(mdev, "irq_set_affinity_hint failed, irq 0x%.4x", irq); + + return 0; +@@ -659,11 +660,12 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i) + + static void mlx5_irq_clear_affinity_hint(struct mlx5_core_dev *mdev, int i) + { ++ int vecidx = MLX5_EQ_VEC_COMP_BASE + i; + struct mlx5_priv *priv = &mdev->priv; +- int irq = pci_irq_vector(mdev->pdev, MLX5_EQ_VEC_COMP_BASE + i); ++ int irq = pci_irq_vector(mdev->pdev, vecidx); + + irq_set_affinity_hint(irq, NULL); +- free_cpumask_var(priv->irq_info[i].mask); ++ free_cpumask_var(priv->irq_info[vecidx].mask); + } + + static int mlx5_irq_set_affinity_hints(struct mlx5_core_dev *mdev) +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index aa5963b5d38e..7d4ed995b4ce 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1309,7 +1309,7 @@ enum { + static inline const struct cpumask * + mlx5_get_vector_affinity_hint(struct mlx5_core_dev *dev, int vector) + { +- return dev->priv.irq_info[vector].mask; ++ return dev->priv.irq_info[vector + MLX5_EQ_VEC_COMP_BASE].mask; + } + + #endif /* MLX5_DRIVER_H */ +-- +2.19.1 + diff --git a/queue-4.20/nfs-nfs_compare_mount_options-always-compare-auth-fl.patch b/queue-4.20/nfs-nfs_compare_mount_options-always-compare-auth-fl.patch new file mode 100644 index 00000000000..7c658ef3836 --- /dev/null +++ b/queue-4.20/nfs-nfs_compare_mount_options-always-compare-auth-fl.patch @@ -0,0 +1,55 @@ +From cba521e12fb5bf34b59ba9316d08c6e1bc4d27d5 Mon Sep 17 00:00:00 2001 +From: Chris Perl +Date: Mon, 17 Dec 2018 10:56:38 -0500 +Subject: NFS: nfs_compare_mount_options always compare auth flavors. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 594d1644cd59447f4fceb592448d5cd09eb09b5e ] + +This patch removes the check from nfs_compare_mount_options to see if a +`sec' option was passed for the current mount before comparing auth +flavors and instead just always compares auth flavors. + +Consider the following scenario: + +You have a server with the address 192.168.1.1 and two exports /export/a +and /export/b. The first export supports `sys' and `krb5' security, the +second just `sys'. + +Assume you start with no mounts from the server. + +The following results in EIOs being returned as the kernel nfs client +incorrectly thinks it can share the underlying `struct nfs_server's: + +$ mkdir /tmp/{a,b} +$ sudo mount -t nfs -o vers=3,sec=krb5 192.168.1.1:/export/a /tmp/a +$ sudo mount -t nfs -o vers=3 192.168.1.1:/export/b /tmp/b +$ df >/dev/null +df: ‘/tmp/b’: Input/output error + +Signed-off-by: Chris Perl +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/super.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index ac4b2f005778..5ef2c71348bd 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2409,8 +2409,7 @@ static int nfs_compare_mount_options(const struct super_block *s, const struct n + goto Ebusy; + if (a->acdirmax != b->acdirmax) + goto Ebusy; +- if (b->auth_info.flavor_len > 0 && +- clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor) ++ if (clnt_a->cl_auth->au_flavor != clnt_b->cl_auth->au_flavor) + goto Ebusy; + return 1; + Ebusy: +-- +2.19.1 + diff --git a/queue-4.20/nfsd4-fix-crash-on-writing-v4_end_grace-before-nfsd-.patch b/queue-4.20/nfsd4-fix-crash-on-writing-v4_end_grace-before-nfsd-.patch new file mode 100644 index 00000000000..e92bc49a0a5 --- /dev/null +++ b/queue-4.20/nfsd4-fix-crash-on-writing-v4_end_grace-before-nfsd-.patch @@ -0,0 +1,40 @@ +From bfdac6b231358fa69a66c2bce3f4d5d82ae4d7ad Mon Sep 17 00:00:00 2001 +From: "J. Bruce Fields" +Date: Tue, 27 Nov 2018 15:54:17 -0500 +Subject: nfsd4: fix crash on writing v4_end_grace before nfsd startup + +[ Upstream commit 62a063b8e7d1db684db3f207261a466fa3194e72 ] + +Anatoly Trosinenko reports that this: + +1) Checkout fresh master Linux branch (tested with commit e195ca6cb) +2) Copy x84_64-config-4.14 to .config, then enable NFS server v4 and build +3) From `kvm-xfstests shell`: + +results in NULL dereference in locks_end_grace. + +Check that nfsd has been started before trying to end the grace period. + +Reported-by: Anatoly Trosinenko +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfsctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c +index 6384c9b94898..b33f9785b756 100644 +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1126,6 +1126,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) + case 'Y': + case 'y': + case '1': ++ if (nn->nfsd_serv) ++ return -EBUSY; + nfsd4_end_grace(nn); + break; + default: +-- +2.19.1 + diff --git a/queue-4.20/niu-fix-missing-checks-of-niu_pci_eeprom_read.patch b/queue-4.20/niu-fix-missing-checks-of-niu_pci_eeprom_read.patch new file mode 100644 index 00000000000..327628314ca --- /dev/null +++ b/queue-4.20/niu-fix-missing-checks-of-niu_pci_eeprom_read.patch @@ -0,0 +1,49 @@ +From 56f767c53c66f38d153801d744202a473b9dda85 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Tue, 25 Dec 2018 01:56:14 -0600 +Subject: niu: fix missing checks of niu_pci_eeprom_read + +[ Upstream commit 26fd962bde0b15e54234fe762d86bc0349df1de4 ] + +niu_pci_eeprom_read() may fail, so we should check its return value +before using the read data. + +Signed-off-by: Kangjie Lu +Acked-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sun/niu.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 9319d84bf49f..d84501441edd 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -8100,6 +8100,8 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + start += 3; + + prop_len = niu_pci_eeprom_read(np, start + 4); ++ if (prop_len < 0) ++ return prop_len; + err = niu_pci_vpd_get_propname(np, start + 5, namebuf, 64); + if (err < 0) + return err; +@@ -8144,8 +8146,12 @@ static int niu_pci_vpd_scan_props(struct niu *np, u32 start, u32 end) + netif_printk(np, probe, KERN_DEBUG, np->dev, + "VPD_SCAN: Reading in property [%s] len[%d]\n", + namebuf, prop_len); +- for (i = 0; i < prop_len; i++) +- *prop_buf++ = niu_pci_eeprom_read(np, off + i); ++ for (i = 0; i < prop_len; i++) { ++ err = niu_pci_eeprom_read(np, off + i); ++ if (err >= 0) ++ *prop_buf = err; ++ ++prop_buf; ++ } + } + + start += len; +-- +2.19.1 + diff --git a/queue-4.20/ocfs2-don-t-clear-bh-uptodate-for-block-read.patch b/queue-4.20/ocfs2-don-t-clear-bh-uptodate-for-block-read.patch new file mode 100644 index 00000000000..f116e2fc4a3 --- /dev/null +++ b/queue-4.20/ocfs2-don-t-clear-bh-uptodate-for-block-read.patch @@ -0,0 +1,68 @@ +From 2ff28e09779e694fb2e79cc958c0f373f5b94282 Mon Sep 17 00:00:00 2001 +From: Junxiao Bi +Date: Fri, 28 Dec 2018 00:32:57 -0800 +Subject: ocfs2: don't clear bh uptodate for block read + +[ Upstream commit 70306d9dce75abde855cefaf32b3f71eed8602a3 ] + +For sync io read in ocfs2_read_blocks_sync(), first clear bh uptodate flag +and submit the io, second wait io done, last check whether bh uptodate, if +not return io error. + +If two sync io for the same bh were issued, it could be the first io done +and set uptodate flag, but just before check that flag, the second io came +in and cleared uptodate, then ocfs2_read_blocks_sync() for the first io +will return IO error. + +Indeed it's not necessary to clear uptodate flag, as the io end handler +end_buffer_read_sync() will set or clear it based on io succeed or failed. + +The following message was found from a nfs server but the underlying +storage returned no error. + +[4106438.567376] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2780 ERROR: read block 1238823695 failed -5 +[4106438.567569] (nfsd,7146,3):ocfs2_get_suballoc_slot_bit:2812 ERROR: status = -5 +[4106438.567611] (nfsd,7146,3):ocfs2_test_inode_bit:2894 ERROR: get alloc slot and bit failed -5 +[4106438.567643] (nfsd,7146,3):ocfs2_test_inode_bit:2932 ERROR: status = -5 +[4106438.567675] (nfsd,7146,3):ocfs2_get_dentry:94 ERROR: test inode bit failed -5 + +Same issue in non sync read ocfs2_read_blocks(), fixed it as well. + +Link: http://lkml.kernel.org/r/20181121020023.3034-4-junxiao.bi@oracle.com +Signed-off-by: Junxiao Bi +Reviewed-by: Changwei Ge +Reviewed-by: Yiwen Jiang +Cc: Joel Becker +Cc: Joseph Qi +Cc: Jun Piao +Cc: Mark Fasheh +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/buffer_head_io.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c +index 4ebbd57cbf84..f9b84f7a3e4b 100644 +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -161,7 +161,6 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, + #endif + } + +- clear_buffer_uptodate(bh); + get_bh(bh); /* for end_buffer_read_sync() */ + bh->b_end_io = end_buffer_read_sync; + submit_bh(REQ_OP_READ, 0, bh); +@@ -341,7 +340,6 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + continue; + } + +- clear_buffer_uptodate(bh); + get_bh(bh); /* for end_buffer_read_sync() */ + if (validate) + set_buffer_needs_validate(bh); +-- +2.19.1 + diff --git a/queue-4.20/ocfs2-improve-ocfs2-makefile.patch b/queue-4.20/ocfs2-improve-ocfs2-makefile.patch new file mode 100644 index 00000000000..096917cb58f --- /dev/null +++ b/queue-4.20/ocfs2-improve-ocfs2-makefile.patch @@ -0,0 +1,72 @@ +From b546e4a4ff1ae63a583e570f1f2f48211bd3f63b Mon Sep 17 00:00:00 2001 +From: Larry Chen +Date: Fri, 28 Dec 2018 00:32:46 -0800 +Subject: ocfs2: improve ocfs2 Makefile + +[ Upstream commit 9e6aea22802b5684c7e1d69822aeb0844dd01953 ] + +Included file path was hard-wired in the ocfs2 makefile, which might +causes some confusion when compiling ocfs2 as an external module. + +Say if we compile ocfs2 module as following. +cp -r /kernel/tree/fs/ocfs2 /other/dir/ocfs2 +cd /other/dir/ocfs2 +make -C /path/to/kernel_source M=`pwd` modules + +Acutally, the compiler wil try to find included file in +/kernel/tree/fs/ocfs2, rather than the directory /other/dir/ocfs2. + +To fix this little bug, we introduce the var $(src) provided by kbuild. +$(src) means the absolute path of the running kbuild file. + +Link: http://lkml.kernel.org/r/20181108085546.15149-1-lchen@suse.com +Signed-off-by: Larry Chen +Reviewed-by: Andrew Morton +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/Makefile | 2 +- + fs/ocfs2/dlm/Makefile | 2 +- + fs/ocfs2/dlmfs/Makefile | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/ocfs2/Makefile b/fs/ocfs2/Makefile +index 99ee093182cb..cc9b32b9db7c 100644 +--- a/fs/ocfs2/Makefile ++++ b/fs/ocfs2/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0 +-ccflags-y := -Ifs/ocfs2 ++ccflags-y := -I$(src) + + obj-$(CONFIG_OCFS2_FS) += \ + ocfs2.o \ +diff --git a/fs/ocfs2/dlm/Makefile b/fs/ocfs2/dlm/Makefile +index bd1aab1f49a4..ef2854422a6e 100644 +--- a/fs/ocfs2/dlm/Makefile ++++ b/fs/ocfs2/dlm/Makefile +@@ -1,4 +1,4 @@ +-ccflags-y := -Ifs/ocfs2 ++ccflags-y := -I$(src)/.. + + obj-$(CONFIG_OCFS2_FS_O2CB) += ocfs2_dlm.o + +diff --git a/fs/ocfs2/dlmfs/Makefile b/fs/ocfs2/dlmfs/Makefile +index eed3db8c5b49..33431a0296a3 100644 +--- a/fs/ocfs2/dlmfs/Makefile ++++ b/fs/ocfs2/dlmfs/Makefile +@@ -1,4 +1,4 @@ +-ccflags-y := -Ifs/ocfs2 ++ccflags-y := -I$(src)/.. + + obj-$(CONFIG_OCFS2_FS) += ocfs2_dlmfs.o + +-- +2.19.1 + diff --git a/queue-4.20/opp-use-opp_table-regulators-to-verify-no-regulator-.patch b/queue-4.20/opp-use-opp_table-regulators-to-verify-no-regulator-.patch new file mode 100644 index 00000000000..38f2e5bc900 --- /dev/null +++ b/queue-4.20/opp-use-opp_table-regulators-to-verify-no-regulator-.patch @@ -0,0 +1,65 @@ +From 73ffb1bcbc59ecbffd0748631ce1b5a32ad23604 Mon Sep 17 00:00:00 2001 +From: Viresh Kumar +Date: Tue, 11 Dec 2018 16:32:47 +0530 +Subject: OPP: Use opp_table->regulators to verify no regulator case + +[ Upstream commit 90e3577b5feb42bac1269e16bb3d2bdd8f6df40f ] + +The value of opp_table->regulator_count is not very consistent right now +and it may end up being 0 while we do have a "opp-microvolt" property in +the OPP table. It was kept that way as we used to check if any +regulators are set with the OPP core for a device or not using value of +regulator_count. + +Lets use opp_table->regulators for that purpose as the meaning of +regulator_count is going to change in the later patches. + +Reported-by: Quentin Perret +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 9280f51f1ce6..82baed4b80d4 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -196,12 +196,12 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev) + if (IS_ERR(opp_table)) + return 0; + +- count = opp_table->regulator_count; +- + /* Regulator may not be required for the device */ +- if (!count) ++ if (!opp_table->regulators) + goto put_opp_table; + ++ count = opp_table->regulator_count; ++ + uV = kmalloc_array(count, sizeof(*uV), GFP_KERNEL); + if (!uV) + goto put_opp_table; +@@ -1102,6 +1102,9 @@ static bool _opp_supported_by_regulators(struct dev_pm_opp *opp, + struct regulator *reg; + int i; + ++ if (!opp_table->regulators) ++ return true; ++ + for (i = 0; i < opp_table->regulator_count; i++) { + reg = opp_table->regulators[i]; + +@@ -1386,7 +1389,7 @@ static int _allocate_set_opp_data(struct opp_table *opp_table) + struct dev_pm_set_opp_data *data; + int len, count = opp_table->regulator_count; + +- if (WARN_ON(!count)) ++ if (WARN_ON(!opp_table->regulators)) + return -EINVAL; + + /* space for set_opp_data */ +-- +2.19.1 + diff --git a/queue-4.20/pci-imx-enable-msi-from-downstream-components.patch b/queue-4.20/pci-imx-enable-msi-from-downstream-components.patch new file mode 100644 index 00000000000..1a557c86142 --- /dev/null +++ b/queue-4.20/pci-imx-enable-msi-from-downstream-components.patch @@ -0,0 +1,75 @@ +From c3e7e4bf120f4189389aa817dfb2cf785a7b259f Mon Sep 17 00:00:00 2001 +From: Richard Zhu +Date: Fri, 21 Dec 2018 04:33:38 +0000 +Subject: PCI: imx: Enable MSI from downstream components + +[ Upstream commit 75cb8d20c112aba70f23d98e3f8d0a38ace16006 ] + +The MSI Enable bit in the MSI Capability (PCIe r4.0, sec 7.7.1.2) controls +whether a Function can request service using MSI. + +i.MX6 Root Ports implement the MSI Capability and may use MSI to request +service for events like PME, hotplug, AER, etc. In addition, on i.MX6, the +MSI Enable bit controls delivery of MSI interrupts from components below +the Root Port. + +Prior to f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of +CONFIG_PCIEPORTBUS"), enabling CONFIG_PCI_IMX6 automatically also enabled +CONFIG_PCIEPORTBUS, and when portdrv claimed the Root Ports, it set the MSI +Enable bit so it could use PME, hotplug, AER, etc. As a side effect, that +also enabled delivery of MSI interrupts from downstream components. + +The imx6q-pcie driver itself does not depend on portdrv, so set MSI Enable +in imx6q-pcie so MSI from downstream components works even if nobody uses +MSI for the Root Port events. + +Fixes: f3fdfc4ac3a2 ("PCI: Remove host driver Kconfig selection of CONFIG_PCIEPORTBUS") +Signed-off-by: Richard Zhu +Signed-off-by: Bjorn Helgaas +Tested-by: Sven Van Asbroeck +Tested-by: Trent Piepho +Reviewed-by: Lucas Stach +Acked-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pci-imx6.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c +index 88af6bff945f..6b54528b5f0c 100644 +--- a/drivers/pci/controller/dwc/pci-imx6.c ++++ b/drivers/pci/controller/dwc/pci-imx6.c +@@ -67,6 +67,7 @@ struct imx6_pcie { + #define PHY_PLL_LOCK_WAIT_USLEEP_MAX 200 + + /* PCIe Root Complex registers (memory-mapped) */ ++#define PCIE_RC_IMX6_MSI_CAP 0x50 + #define PCIE_RC_LCR 0x7c + #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN1 0x1 + #define PCIE_RC_LCR_MAX_LINK_SPEEDS_GEN2 0x2 +@@ -840,6 +841,7 @@ static int imx6_pcie_probe(struct platform_device *pdev) + struct resource *dbi_base; + struct device_node *node = dev->of_node; + int ret; ++ u16 val; + + imx6_pcie = devm_kzalloc(dev, sizeof(*imx6_pcie), GFP_KERNEL); + if (!imx6_pcie) +@@ -981,6 +983,14 @@ static int imx6_pcie_probe(struct platform_device *pdev) + if (ret < 0) + return ret; + ++ if (pci_msi_enabled()) { ++ val = dw_pcie_readw_dbi(pci, PCIE_RC_IMX6_MSI_CAP + ++ PCI_MSI_FLAGS); ++ val |= PCI_MSI_FLAGS_ENABLE; ++ dw_pcie_writew_dbi(pci, PCIE_RC_IMX6_MSI_CAP + PCI_MSI_FLAGS, ++ val); ++ } ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/percpu-convert-spin_lock_irq-to-spin_lock_irqsave.patch b/queue-4.20/percpu-convert-spin_lock_irq-to-spin_lock_irqsave.patch new file mode 100644 index 00000000000..6e60b5e2b3c --- /dev/null +++ b/queue-4.20/percpu-convert-spin_lock_irq-to-spin_lock_irqsave.patch @@ -0,0 +1,57 @@ +From 52d396113c15cd448fe89734ff2519f63cc2e966 Mon Sep 17 00:00:00 2001 +From: Dennis Zhou +Date: Tue, 18 Dec 2018 08:42:27 -0800 +Subject: percpu: convert spin_lock_irq to spin_lock_irqsave. + +[ Upstream commit 6ab7d47bcbf0144a8cb81536c2cead4cde18acfe ] + +From Michael Cree: + "Bisection lead to commit b38d08f3181c ("percpu: restructure + locking") as being the cause of lockups at initial boot on + the kernel built for generic Alpha. + + On a suggestion by Tejun Heo that: + + So, the only thing I can think of is that it's calling + spin_unlock_irq() while irq handling isn't set up yet. + Can you please try the followings? + + 1. Convert all spin_[un]lock_irq() to + spin_lock_irqsave/unlock_irqrestore()." + +Fixes: b38d08f3181c ("percpu: restructure locking") +Reported-and-tested-by: Michael Cree +Acked-by: Tejun Heo +Signed-off-by: Dennis Zhou +Signed-off-by: Sasha Levin +--- + mm/percpu-km.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/mm/percpu-km.c b/mm/percpu-km.c +index 38de70ab1a0d..0f643dc2dc65 100644 +--- a/mm/percpu-km.c ++++ b/mm/percpu-km.c +@@ -50,6 +50,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT; + struct pcpu_chunk *chunk; + struct page *pages; ++ unsigned long flags; + int i; + + chunk = pcpu_alloc_chunk(gfp); +@@ -68,9 +69,9 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + chunk->data = pages; + chunk->base_addr = page_address(pages) - pcpu_group_offsets[0]; + +- spin_lock_irq(&pcpu_lock); ++ spin_lock_irqsave(&pcpu_lock, flags); + pcpu_chunk_populated(chunk, 0, nr_pages, false); +- spin_unlock_irq(&pcpu_lock); ++ spin_unlock_irqrestore(&pcpu_lock, flags); + + pcpu_stats_chunk_alloc(); + trace_percpu_create_chunk(chunk->base_addr); +-- +2.19.1 + diff --git a/queue-4.20/perf-arm_spe-handle-devm_kasprintf-failure.patch b/queue-4.20/perf-arm_spe-handle-devm_kasprintf-failure.patch new file mode 100644 index 00000000000..e12972f70f0 --- /dev/null +++ b/queue-4.20/perf-arm_spe-handle-devm_kasprintf-failure.patch @@ -0,0 +1,44 @@ +From 43fa61d4e69f9d185da26c2c372c2c1b361ec5f9 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Wed, 28 Nov 2018 12:24:47 +0100 +Subject: perf: arm_spe: handle devm_kasprintf() failure + +[ Upstream commit 754a58db6a556e6e5f5e32f3e84e7d67b5bf9c8e ] + +devm_kasprintf() may return NULL on failure of internal allocation +thus the assignment to 'name' is not safe if unchecked. If NULL +is passed in for name then perf_pmu_register() would not fail +but rather silently jump to skip_type which is not the intent +here. As perf_pmu_register() may also return -ENOMEM returning +-ENOMEM in the (unlikely) failure case of devm_kasprintf() should +be fine here as well. + +Acked-by: Mark Rutland +Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") +Signed-off-by: Nicholas Mc Guire +[will: reworded error message] +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_spe_pmu.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c +index 54ec278d2fc4..e1a77b2de78a 100644 +--- a/drivers/perf/arm_spe_pmu.c ++++ b/drivers/perf/arm_spe_pmu.c +@@ -927,6 +927,11 @@ static int arm_spe_pmu_perf_init(struct arm_spe_pmu *spe_pmu) + + idx = atomic_inc_return(&pmu_idx); + name = devm_kasprintf(dev, GFP_KERNEL, "%s_%d", PMUNAME, idx); ++ if (!name) { ++ dev_err(dev, "failed to allocate name for pmu %d\n", idx); ++ return -ENOMEM; ++ } ++ + return perf_pmu_register(&spe_pmu->pmu, name, -1); + } + +-- +2.19.1 + diff --git a/queue-4.20/perf-build-don-t-unconditionally-link-the-libbfd-fea.patch b/queue-4.20/perf-build-don-t-unconditionally-link-the-libbfd-fea.patch new file mode 100644 index 00000000000..69111041bfe --- /dev/null +++ b/queue-4.20/perf-build-don-t-unconditionally-link-the-libbfd-fea.patch @@ -0,0 +1,173 @@ +From 3ac37d19eb4f5d920fc18d2339c07ba773e09ece Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Thu, 15 Nov 2018 16:32:01 -0800 +Subject: perf build: Don't unconditionally link the libbfd feature test to + -liberty and -lz + +[ Upstream commit 14541b1e7e723859ff2c75c6fc10cdbbec6b8c34 ] + +Current libbfd feature test unconditionally links against -liberty and -lz. +While it's required on some systems (e.g. opensuse), it's completely +unnecessary on the others, where only -lbdf is sufficient (debian). +This patch streamlines (and renames) the following feature checks: + +feature-libbfd - only link against -lbfd (debian), + see commit 2cf9040714f3 ("perf tools: Fix bfd + dependency libraries detection") +feature-libbfd-liberty - link against -lbfd and -liberty +feature-libbfd-liberty-z - link against -lbfd, -liberty and -lz (opensuse), + see commit 280e7c48c3b8 ("perf tools: fix BFD + detection on opensuse") + +(feature-liberty{,-z} were renamed to feature-libbfd-liberty{,z} +for clarity) + +The main motivation is to fix this feature test for bpftool which is +currently broken on debian (libbfd feature shows OFF, but we still +unconditionally link against -lbfd and it works). + +Tested on debian with only -lbfd installed (without -liberty); I'd +appreciate if somebody on the other systems can test this new detection +method. + +Signed-off-by: Stanislav Fomichev +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Mathieu Poirier +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/4dfc634cfcfb236883971b5107cf3c28ec8a31be.1542328222.git.sdf@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.feature | 4 ++-- + tools/build/feature/Makefile | 10 ++++---- + tools/perf/Makefile.config | 44 +++++++++++++++++++----------------- + 3 files changed, 30 insertions(+), 28 deletions(-) + +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index d74bb9414d7c..81dda411e9d3 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -80,8 +80,8 @@ FEATURE_TESTS_EXTRA := \ + cplus-demangle \ + hello \ + libbabeltrace \ +- liberty \ +- liberty-z \ ++ libbfd-liberty \ ++ libbfd-liberty-z \ + libunwind-debug-frame \ + libunwind-debug-frame-arm \ + libunwind-debug-frame-aarch64 \ +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 304b984f11b9..912b82d4b70a 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -16,8 +16,8 @@ FILES= \ + test-libbfd.bin \ + test-disassembler-four-args.bin \ + test-reallocarray.bin \ +- test-liberty.bin \ +- test-liberty-z.bin \ ++ test-libbfd-liberty.bin \ ++ test-libbfd-liberty-z.bin \ + test-cplus-demangle.bin \ + test-libelf.bin \ + test-libelf-getphdrnum.bin \ +@@ -204,7 +204,7 @@ $(OUTPUT)test-libpython-version.bin: + $(BUILD) + + $(OUTPUT)test-libbfd.bin: +- $(BUILD) -DPACKAGE='"perf"' -lbfd -lz -liberty -ldl ++ $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl + + $(OUTPUT)test-disassembler-four-args.bin: + $(BUILD) -DPACKAGE='"perf"' -lbfd -lopcodes +@@ -212,10 +212,10 @@ $(OUTPUT)test-disassembler-four-args.bin: + $(OUTPUT)test-reallocarray.bin: + $(BUILD) + +-$(OUTPUT)test-liberty.bin: ++$(OUTPUT)test-libbfd-liberty.bin: + $(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty + +-$(OUTPUT)test-liberty-z.bin: ++$(OUTPUT)test-libbfd-liberty-z.bin: + $(CC) $(CFLAGS) -Wall -Werror -o $@ test-libbfd.c -DPACKAGE='"perf"' $(LDFLAGS) -lbfd -ldl -liberty -lz + + $(OUTPUT)test-cplus-demangle.bin: +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index acbb657f7ce2..a0f366c7a318 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -693,18 +693,20 @@ endif + + ifeq ($(feature-libbfd), 1) + EXTLIBS += -lbfd ++else ++ # we are on a system that requires -liberty and (maybe) -lz ++ # to link against -lbfd; test each case individually here + + # call all detections now so we get correct + # status in VF output +- $(call feature_check,liberty) +- $(call feature_check,liberty-z) +- $(call feature_check,cplus-demangle) ++ $(call feature_check,libbfd-liberty) ++ $(call feature_check,libbfd-liberty-z) + +- ifeq ($(feature-liberty), 1) +- EXTLIBS += -liberty ++ ifeq ($(feature-libbfd-liberty), 1) ++ EXTLIBS += -lbfd -liberty + else +- ifeq ($(feature-liberty-z), 1) +- EXTLIBS += -liberty -lz ++ ifeq ($(feature-libbfd-liberty-z), 1) ++ EXTLIBS += -lbfd -liberty -lz + endif + endif + endif +@@ -714,24 +716,24 @@ ifdef NO_DEMANGLE + else + ifdef HAVE_CPLUS_DEMANGLE_SUPPORT + EXTLIBS += -liberty +- CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT + else +- ifneq ($(feature-libbfd), 1) +- ifneq ($(feature-liberty), 1) +- ifneq ($(feature-liberty-z), 1) +- # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT +- # or any of 'bfd iberty z' trinity +- ifeq ($(feature-cplus-demangle), 1) +- EXTLIBS += -liberty +- CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT +- else +- msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling) +- CFLAGS += -DNO_DEMANGLE +- endif +- endif ++ ifeq ($(filter -liberty,$(EXTLIBS)),) ++ $(call feature_check,cplus-demangle) ++ ++ # we dont have neither HAVE_CPLUS_DEMANGLE_SUPPORT ++ # or any of 'bfd iberty z' trinity ++ ifeq ($(feature-cplus-demangle), 1) ++ EXTLIBS += -liberty ++ else ++ msg := $(warning No bfd.h/libbfd found, please install binutils-dev[el]/zlib-static/libiberty-dev to gain symbol demangling) ++ CFLAGS += -DNO_DEMANGLE + endif + endif + endif ++ ++ ifneq ($(filter -liberty,$(EXTLIBS)),) ++ CFLAGS += -DHAVE_CPLUS_DEMANGLE_SUPPORT ++ endif + endif + + ifneq ($(filter -lbfd,$(EXTLIBS)),) +-- +2.19.1 + diff --git a/queue-4.20/perf-dso-fix-unchecked-usage-of-strncpy.patch b/queue-4.20/perf-dso-fix-unchecked-usage-of-strncpy.patch new file mode 100644 index 00000000000..1ede3fb2393 --- /dev/null +++ b/queue-4.20/perf-dso-fix-unchecked-usage-of-strncpy.patch @@ -0,0 +1,49 @@ +From c8db30e844a11b8ebb250c1bbcf8e37975d46fa2 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 6 Dec 2018 10:49:46 -0300 +Subject: perf dso: Fix unchecked usage of strncpy() + +[ Upstream commit fca5085c15255bbde203b7322c15f07ebb12f63e ] + +The strncpy() function may leave the destination string buffer +unterminated, better use strlcpy() that we have a __weak fallback +implementation for systems without it. + +This fixes this warning on an Alpine Linux Edge system with gcc 8.2: + + In function 'decompress_kmodule', + inlined from 'dso__decompress_kmodule_fd' at util/dso.c:305:9: + util/dso.c:298:3: error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation] + strncpy(pathname, tmpbuf, len); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CC /tmp/build/perf/util/values.o + CC /tmp/build/perf/util/debug.o + cc1: all warnings being treated as errors + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Fixes: c9a8a6131fb6 ("perf tools: Move the temp file processing into decompress_kmodule") +Link: https://lkml.kernel.org/n/tip-tl2hdxj64tt4k8btbi6a0ugw@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/dso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index bbed90e5d9bb..cee717a3794f 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -295,7 +295,7 @@ static int decompress_kmodule(struct dso *dso, const char *name, + unlink(tmpbuf); + + if (pathname && (fd >= 0)) +- strncpy(pathname, tmpbuf, len); ++ strlcpy(pathname, tmpbuf, len); + + return fd; + } +-- +2.19.1 + diff --git a/queue-4.20/perf-header-fix-unchecked-usage-of-strncpy.patch b/queue-4.20/perf-header-fix-unchecked-usage-of-strncpy.patch new file mode 100644 index 00000000000..7b7d573e3af --- /dev/null +++ b/queue-4.20/perf-header-fix-unchecked-usage-of-strncpy.patch @@ -0,0 +1,48 @@ +From 6366446977a7d440840620b198678ab8860783d1 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 6 Dec 2018 11:02:57 -0300 +Subject: perf header: Fix unchecked usage of strncpy() + +[ Upstream commit 7572588085a13d5db02bf159542189f52fdb507e ] + +The strncpy() function may leave the destination string buffer +unterminated, better use strlcpy() that we have a __weak fallback +implementation for systems without it. + +This fixes this warning on an Alpine Linux Edge system with gcc 8.2: + + util/header.c: In function 'perf_event__synthesize_event_update_unit': + util/header.c:3586:2: error: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation] + strncpy(ev->data, evsel->unit, size); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + util/header.c:3579:16: note: length computed here + size_t size = strlen(evsel->unit); + ^~~~~~~~~~~~~~~~~~~ + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Fixes: a6e5281780d1 ("perf tools: Add event_update event unit type") +Link: https://lkml.kernel.org/n/tip-fiikh5nay70bv4zskw2aa858@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 4fd45be95a43..13a2251a37c5 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -3544,7 +3544,7 @@ perf_event__synthesize_event_update_unit(struct perf_tool *tool, + if (ev == NULL) + return -ENOMEM; + +- strncpy(ev->data, evsel->unit, size); ++ strlcpy(ev->data, evsel->unit, size + 1); + err = process(tool, (union perf_event *)ev, NULL, NULL); + free(ev); + return err; +-- +2.19.1 + diff --git a/queue-4.20/perf-header-fix-up-argument-to-ctime.patch b/queue-4.20/perf-header-fix-up-argument-to-ctime.patch new file mode 100644 index 00000000000..0d1bd6595d5 --- /dev/null +++ b/queue-4.20/perf-header-fix-up-argument-to-ctime.patch @@ -0,0 +1,55 @@ +From 14f1e44ce71e4ef38768ad58d85b9688edf18059 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Tue, 11 Dec 2018 16:11:54 -0300 +Subject: perf header: Fix up argument to ctime() + +[ Upstream commit 0afcf29bab35d3785204cd9bd51693b231ad7181 ] + +Reducing this noise when cross building to the Android NDK: + + util/header.c: In function 'perf_header__fprintf_info': + util/header.c:2710:45: warning: pointer targets in passing argument 1 of 'ctime' differ in signedness [-Wpointer-sign] + fprintf(fp, "# captured on : %s", ctime(&st.st_ctime)); + ^ + In file included from util/../perf.h:5:0, + from util/evlist.h:11, + from util/header.c:22: + /opt/android-ndk-r15c/platforms/android-26/arch-arm/usr/include/time.h:81:14: note: expected 'const time_t *' but argument is of type 'long unsigned int *' + extern char* ctime(const time_t*) __LIBC_ABI_PUBLIC__; + ^ + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Link: https://lkml.kernel.org/n/tip-6bz74zp080yhmtiwb36enso9@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/header.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c +index 13a2251a37c5..05f40bb51a88 100644 +--- a/tools/perf/util/header.c ++++ b/tools/perf/util/header.c +@@ -2659,6 +2659,7 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full) + struct perf_header *header = &session->header; + int fd = perf_data__fd(session->data); + struct stat st; ++ time_t stctime; + int ret, bit; + + hd.fp = fp; +@@ -2668,7 +2669,8 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full) + if (ret == -1) + return -1; + +- fprintf(fp, "# captured on : %s", ctime(&st.st_ctime)); ++ stctime = st.st_ctime; ++ fprintf(fp, "# captured on : %s", ctime(&stctime)); + + fprintf(fp, "# header version : %u\n", header->version); + fprintf(fp, "# data offset : %" PRIu64 "\n", header->data_offset); +-- +2.19.1 + diff --git a/queue-4.20/perf-probe-fix-unchecked-usage-of-strncpy.patch b/queue-4.20/perf-probe-fix-unchecked-usage-of-strncpy.patch new file mode 100644 index 00000000000..4cf9b5c8ff6 --- /dev/null +++ b/queue-4.20/perf-probe-fix-unchecked-usage-of-strncpy.patch @@ -0,0 +1,53 @@ +From fb1e0d133376bffe16df91ee5b11a1e3a7a19eb0 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 6 Dec 2018 11:50:08 -0300 +Subject: perf probe: Fix unchecked usage of strncpy() + +[ Upstream commit bef0b8970f27da5ca223e522a174d03e2587761d ] + +The strncpy() function may leave the destination string buffer +unterminated, better use strlcpy() that we have a __weak fallback +implementation for systems without it. + +In this case the 'target' buffer is coming from a list of build-ids that +are expected to have a len of at most (SBUILD_ID_SIZE - 1) chars, so +probably we're safe, but since we're using strncpy() here, use strlcpy() +instead to provide the intended safety checking without the using the +problematic strncpy() function. + +This fixes this warning on an Alpine Linux Edge system with gcc 8.2: + + util/probe-file.c: In function 'probe_cache__open.isra.5': + util/probe-file.c:427:3: error: 'strncpy' specified bound 41 equals destination size [-Werror=stringop-truncation] + strncpy(sbuildid, target, SBUILD_ID_SIZE); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + cc1: all warnings being treated as errors + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Fixes: 1f3736c9c833 ("perf probe: Show all cached probes") +Link: https://lkml.kernel.org/n/tip-l7n8ggc9kl38qtdlouke5yp5@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c +index aac7817d9e14..0b1195cad0e5 100644 +--- a/tools/perf/util/probe-file.c ++++ b/tools/perf/util/probe-file.c +@@ -424,7 +424,7 @@ static int probe_cache__open(struct probe_cache *pcache, const char *target, + + if (target && build_id_cache__cached(target)) { + /* This is a cached buildid */ +- strncpy(sbuildid, target, SBUILD_ID_SIZE); ++ strlcpy(sbuildid, target, SBUILD_ID_SIZE); + dir_name = build_id_cache__linkname(sbuildid, NULL, 0); + goto found; + } +-- +2.19.1 + diff --git a/queue-4.20/perf-python-do-not-force-closing-original-perf-descr.patch b/queue-4.20/perf-python-do-not-force-closing-original-perf-descr.patch new file mode 100644 index 00000000000..51a3caf389e --- /dev/null +++ b/queue-4.20/perf-python-do-not-force-closing-original-perf-descr.patch @@ -0,0 +1,64 @@ +From f1a93c2df0bdbf66930da3e21c3b0e09439f9108 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Wed, 26 Dec 2018 12:21:21 +0100 +Subject: perf python: Do not force closing original perf descriptor in + evlist.get_pollfd() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit a389aece97938966616ce0336466b98b0351ef10 ] + +Ondřej reported that when compiled with python3, the python extension +regresses in evlist.get_pollfd function behaviour. + +The evlist.get_pollfd function creates file objects from evlist's fds +and returns them in a list. The python3 version also sets them to 'close +the original descriptor' when the object dies (is closed), by passing +True via the 'closefd' arg in the PyFile_FromFd call. + +The python's closefd doc says: + + If closefd is False, the underlying file descriptor will be kept open + when the file is closed. + +That's why the following line in python3 closes all evlist fds: + + evlist.get_pollfd() + +the returned list is immediately destroyed and that takes down the +original events fds. + +Passing closefd as False to PyFile_FromFd to fix this. + +Reported-by: Ondřej Lysoněk +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Jaroslav Å karvada +Cc: Namhyung Kim +Cc: Peter Zijlstra +Fixes: 66dfdff03d19 ("perf tools: Add Python 3 support") +Link: http://lkml.kernel.org/r/20181226112121.5285-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/python.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c +index 50150dfc0cdf..4dd8fd05a260 100644 +--- a/tools/perf/util/python.c ++++ b/tools/perf/util/python.c +@@ -939,7 +939,8 @@ static PyObject *pyrf_evlist__get_pollfd(struct pyrf_evlist *pevlist, + + file = PyFile_FromFile(fp, "perf", "r", NULL); + #else +- file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1, NULL, NULL, NULL, 1); ++ file = PyFile_FromFd(evlist->pollfd.entries[i].fd, "perf", "r", -1, ++ NULL, NULL, NULL, 0); + #endif + if (file == NULL) + goto free_list; +-- +2.19.1 + diff --git a/queue-4.20/perf-stat-fix-csv-mode-column-output-for-non-cgroup-.patch b/queue-4.20/perf-stat-fix-csv-mode-column-output-for-non-cgroup-.patch new file mode 100644 index 00000000000..d23e4b4aa04 --- /dev/null +++ b/queue-4.20/perf-stat-fix-csv-mode-column-output-for-non-cgroup-.patch @@ -0,0 +1,97 @@ +From 124f424fbc3d634f14acd13a405493698f431392 Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Wed, 7 Nov 2018 02:50:45 -0800 +Subject: perf stat: Fix CSV mode column output for non-cgroup events + +[ Upstream commit bc4da38a4789e7819fca4c7723ded0b86aea27c0 ] + +When using the -x option, perf stat prints CSV-style output with one +event per line. For each event, it prints the count, the unit, the +event name, the cgroup, and a bunch of other event specific fields (such +as insn per cycles). + +When you use CSV-style mode, you expect a normalized output where each +event is printed with the same number of fields regardless of what it is +so it can easily be imported into a spreadsheet or parsed. + +For instance, if an event does not have a unit, then print an empty +field for it. + +Although this approach was implemented for the unit, it was not for the +cgroup. + +When mixing cgroup and non-cgroup events, then non-cgroup events would +not show an empty field, instead the next field was printed, make +columns not line up correctly. + +This patch fixes the cgroup output issues by forcing an empty field +for non-cgroup events as soon as one event has cgroup. + +Before: + + @ @cycles @foo @ 0 @100.00@@ + 2531614 @ @cycles @6420922@100.00@ @ + +foo cgroup lines up with time_running! + +After: + + @ @cycles @foo @0 @100.00@@ + 2594834 @ @cycles @ @5287372 @100.00@@ + +Fields line up. + +Signed-off-by: Stephane Eranian +Acked-by: Jiri Olsa +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1541587845-9150-1-git-send-email-eranian@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/stat-display.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/tools/perf/util/stat-display.c b/tools/perf/util/stat-display.c +index e7b4c44ebb62..665ee374fc01 100644 +--- a/tools/perf/util/stat-display.c ++++ b/tools/perf/util/stat-display.c +@@ -59,6 +59,15 @@ static void print_noise(struct perf_stat_config *config, + print_noise_pct(config, stddev_stats(&ps->res_stats[0]), avg); + } + ++static void print_cgroup(struct perf_stat_config *config, struct perf_evsel *evsel) ++{ ++ if (nr_cgroups) { ++ const char *cgrp_name = evsel->cgrp ? evsel->cgrp->name : ""; ++ fprintf(config->output, "%s%s", config->csv_sep, cgrp_name); ++ } ++} ++ ++ + static void aggr_printout(struct perf_stat_config *config, + struct perf_evsel *evsel, int id, int nr) + { +@@ -336,8 +345,7 @@ static void abs_printout(struct perf_stat_config *config, + + fprintf(output, "%-*s", config->csv_output ? 0 : 25, perf_evsel__name(evsel)); + +- if (evsel->cgrp) +- fprintf(output, "%s%s", config->csv_sep, evsel->cgrp->name); ++ print_cgroup(config, evsel); + } + + static bool is_mixed_hw_group(struct perf_evsel *counter) +@@ -431,9 +439,7 @@ static void printout(struct perf_stat_config *config, int id, int nr, + config->csv_output ? 0 : -25, + perf_evsel__name(counter)); + +- if (counter->cgrp) +- fprintf(config->output, "%s%s", +- config->csv_sep, counter->cgrp->name); ++ print_cgroup(config, counter); + + if (!config->csv_output) + pm(config, &os, NULL, NULL, "", 0); +-- +2.19.1 + diff --git a/queue-4.20/perf-test-fix-perf_event_attr-test-failure.patch b/queue-4.20/perf-test-fix-perf_event_attr-test-failure.patch new file mode 100644 index 00000000000..545519fefda --- /dev/null +++ b/queue-4.20/perf-test-fix-perf_event_attr-test-failure.patch @@ -0,0 +1,46 @@ +From e5943a5f25d5ad5e79c204fd35a04db7e05cf8c2 Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 22 Nov 2018 16:04:56 +0200 +Subject: perf test: Fix perf_event_attr test failure + +[ Upstream commit 741dad88dde296999da30332157ca47f0543747d ] + +Fix inconsistent use of tabs and spaces error: + + # perf test 16 -v + 16: Setup struct perf_event_attr : + --- start --- + test child forked, pid 20224 + File "/usr/libexec/perf-core/tests/attr.py", line 119 + log.warning("expected %s=%s, got %s" % (t, self[t], other[t])) + ^ + TabError: inconsistent use of tabs and spaces in indentation + test child finished with -1 + ---- end ---- + Setup struct perf_event_attr: FAILED! + +Signed-off-by: Adrian Hunter +Cc: Jiri Olsa +Link: http://lkml.kernel.org/r/20181122140456.16817-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/attr.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/attr.py b/tools/perf/tests/attr.py +index ff9b60b99f52..44090a9a19f3 100644 +--- a/tools/perf/tests/attr.py ++++ b/tools/perf/tests/attr.py +@@ -116,7 +116,7 @@ class Event(dict): + if not self.has_key(t) or not other.has_key(t): + continue + if not data_equal(self[t], other[t]): +- log.warning("expected %s=%s, got %s" % (t, self[t], other[t])) ++ log.warning("expected %s=%s, got %s" % (t, self[t], other[t])) + + # Test file description needs to have following sections: + # [config] +-- +2.19.1 + diff --git a/queue-4.20/perf-tools-add-hygon-dhyana-support.patch b/queue-4.20/perf-tools-add-hygon-dhyana-support.patch new file mode 100644 index 00000000000..00ad8ae0155 --- /dev/null +++ b/queue-4.20/perf-tools-add-hygon-dhyana-support.patch @@ -0,0 +1,42 @@ +From 85ec1c6bf84e95da396fc642aebe36c6a90a36d2 Mon Sep 17 00:00:00 2001 +From: Pu Wen +Date: Mon, 12 Nov 2018 15:40:51 +0800 +Subject: perf tools: Add Hygon Dhyana support + +[ Upstream commit 4787eff3fa88f62fede6ed7afa06477ae6bf984d ] + +The tool perf is useful for the performance analysis on the Hygon Dhyana +platform. But right now there is no Hygon support for it to analyze the +KVM guest os data. So add Hygon Dhyana support to it by checking vendor +string to share the code path of AMD. + +Signed-off-by: Pu Wen +Acked-by: Borislav Petkov +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1542008451-31735-1-git-send-email-puwen@hygon.cn +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/arch/x86/util/kvm-stat.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/arch/x86/util/kvm-stat.c b/tools/perf/arch/x86/util/kvm-stat.c +index b32409a0e546..081353d7b095 100644 +--- a/tools/perf/arch/x86/util/kvm-stat.c ++++ b/tools/perf/arch/x86/util/kvm-stat.c +@@ -156,7 +156,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid) + if (strstr(cpuid, "Intel")) { + kvm->exit_reasons = vmx_exit_reasons; + kvm->exit_reasons_isa = "VMX"; +- } else if (strstr(cpuid, "AMD")) { ++ } else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) { + kvm->exit_reasons = svm_exit_reasons; + kvm->exit_reasons_isa = "SVM"; + } else +-- +2.19.1 + diff --git a/queue-4.20/perf-tools-cast-off_t-to-s64-to-avoid-warning-on-bio.patch b/queue-4.20/perf-tools-cast-off_t-to-s64-to-avoid-warning-on-bio.patch new file mode 100644 index 00000000000..628ff634981 --- /dev/null +++ b/queue-4.20/perf-tools-cast-off_t-to-s64-to-avoid-warning-on-bio.patch @@ -0,0 +1,47 @@ +From b70b1a44ab5b4a82b33a6870c5b2c1c6f85c6f82 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Tue, 11 Dec 2018 16:43:40 -0300 +Subject: perf tools: Cast off_t to s64 to avoid warning on bionic libc + +[ Upstream commit 866053bb644f754d1a93aaa9db9998fecf7a8978 ] + +To avoid this warning: + + CC /tmp/build/perf/util/s390-cpumsf.o + util/s390-cpumsf.c: In function 's390_cpumsf_samples': + util/s390-cpumsf.c:508:3: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'off_t' [-Wformat=] + pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n", + ^ + +Now the various Android cross toolchains used in the perf tools +container test builds are all clean and we can remove this: + + export EXTRA_MAKE_ARGS="WERROR=0" + +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Thomas Richter +Link: https://lkml.kernel.org/n/tip-5rav4ccyb0sjciysz2i4p3sx@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/s390-cpumsf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/s390-cpumsf.c b/tools/perf/util/s390-cpumsf.c +index a2eeebbfb25f..68b2570304ec 100644 +--- a/tools/perf/util/s390-cpumsf.c ++++ b/tools/perf/util/s390-cpumsf.c +@@ -506,7 +506,7 @@ static int s390_cpumsf_samples(struct s390_cpumsf_queue *sfq, u64 *ts) + aux_ts = get_trailer_time(buf); + if (!aux_ts) { + pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n", +- sfq->buffer->data_offset); ++ (s64)sfq->buffer->data_offset); + aux_ts = ~0ULL; + goto out; + } +-- +2.19.1 + diff --git a/queue-4.20/phy-sun4i-usb-add-support-for-missing-usb-phy-index.patch b/queue-4.20/phy-sun4i-usb-add-support-for-missing-usb-phy-index.patch new file mode 100644 index 00000000000..29533682613 --- /dev/null +++ b/queue-4.20/phy-sun4i-usb-add-support-for-missing-usb-phy-index.patch @@ -0,0 +1,55 @@ +From 2e4ad932e2100cf35ce78dba3ba8d611448e7049 Mon Sep 17 00:00:00 2001 +From: Icenowy Zheng +Date: Thu, 4 Oct 2018 20:28:47 +0800 +Subject: phy: sun4i-usb: add support for missing USB PHY index + +[ Upstream commit 2659392e5c08dff626e6db1d739adff58a94604d ] + +The new Allwinner H6 SoC's USB2 PHY has two holes -- USB1 (which is a +3.0 port with dedicated PHY) and USB2 (which doesn't exist at all). + +Add support for this kind of missing USB PHY index. + +Signed-off-by: Icenowy Zheng +Reviewed-by: Chen-Yu Tsai +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/allwinner/phy-sun4i-usb.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c +index d4dcd39b8d76..881078ff73f6 100644 +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -126,6 +126,7 @@ struct sun4i_usb_phy_cfg { + bool dedicated_clocks; + bool enable_pmu_unk1; + bool phy0_dual_route; ++ int missing_phys; + }; + + struct sun4i_usb_phy_data { +@@ -646,6 +647,9 @@ static struct phy *sun4i_usb_phy_xlate(struct device *dev, + if (args->args[0] >= data->cfg->num_phys) + return ERR_PTR(-ENODEV); + ++ if (data->cfg->missing_phys & BIT(args->args[0])) ++ return ERR_PTR(-ENODEV); ++ + return data->phys[args->args[0]].phy; + } + +@@ -741,6 +745,9 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev) + struct sun4i_usb_phy *phy = data->phys + i; + char name[16]; + ++ if (data->cfg->missing_phys & BIT(i)) ++ continue; ++ + snprintf(name, sizeof(name), "usb%d_vbus", i); + phy->vbus = devm_regulator_get_optional(dev, name); + if (IS_ERR(phy->vbus)) { +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-bcm2835-use-raw-spinlock-for-rt-compatibilit.patch b/queue-4.20/pinctrl-bcm2835-use-raw-spinlock-for-rt-compatibilit.patch new file mode 100644 index 00000000000..97f44e6a031 --- /dev/null +++ b/queue-4.20/pinctrl-bcm2835-use-raw-spinlock-for-rt-compatibilit.patch @@ -0,0 +1,102 @@ +From c8b3f7ac14acb974ab6c38cdd16e10042255b602 Mon Sep 17 00:00:00 2001 +From: Lukas Wunner +Date: Sat, 27 Oct 2018 10:15:33 +0200 +Subject: pinctrl: bcm2835: Use raw spinlock for RT compatibility + +[ Upstream commit 3c7b30f704b6f5e53eed6bf89cf2c8d1b38b02c0 ] + +The BCM2835 pinctrl driver acquires a spinlock in its ->irq_enable, +->irq_disable and ->irq_set_type callbacks. Spinlocks become sleeping +locks with CONFIG_PREEMPT_RT_FULL=y, therefore invocation of one of the +callbacks in atomic context may cause a hard lockup if at least two GPIO +pins in the same bank are used as interrupts. The issue doesn't occur +with just a single interrupt pin per bank because the lock is never +contended. I'm experiencing such lockups with GPIO 8 and 28 used as +level-triggered interrupts, i.e. with ->irq_disable being invoked on +reception of every IRQ. + +The critical section protected by the spinlock is very small (one bitop +and one RMW of an MMIO register), hence converting to a raw spinlock +seems a better trade-off than converting the driver to threaded IRQ +handling (which would increase latency to handle an interrupt). + +Cc: Mathias Duckeck +Signed-off-by: Lukas Wunner +Acked-by: Julia Cartwright +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/pinctrl-bcm2835.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +index fa530913a2c8..08925d24180b 100644 +--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c ++++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c +@@ -90,7 +90,7 @@ struct bcm2835_pinctrl { + struct gpio_chip gpio_chip; + struct pinctrl_gpio_range gpio_range; + +- spinlock_t irq_lock[BCM2835_NUM_BANKS]; ++ raw_spinlock_t irq_lock[BCM2835_NUM_BANKS]; + }; + + /* pins are just named GPIO0..GPIO53 */ +@@ -461,10 +461,10 @@ static void bcm2835_gpio_irq_enable(struct irq_data *data) + unsigned bank = GPIO_REG_OFFSET(gpio); + unsigned long flags; + +- spin_lock_irqsave(&pc->irq_lock[bank], flags); ++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags); + set_bit(offset, &pc->enabled_irq_map[bank]); + bcm2835_gpio_irq_config(pc, gpio, true); +- spin_unlock_irqrestore(&pc->irq_lock[bank], flags); ++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags); + } + + static void bcm2835_gpio_irq_disable(struct irq_data *data) +@@ -476,12 +476,12 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data) + unsigned bank = GPIO_REG_OFFSET(gpio); + unsigned long flags; + +- spin_lock_irqsave(&pc->irq_lock[bank], flags); ++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags); + bcm2835_gpio_irq_config(pc, gpio, false); + /* Clear events that were latched prior to clearing event sources */ + bcm2835_gpio_set_bit(pc, GPEDS0, gpio); + clear_bit(offset, &pc->enabled_irq_map[bank]); +- spin_unlock_irqrestore(&pc->irq_lock[bank], flags); ++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags); + } + + static int __bcm2835_gpio_irq_set_type_disabled(struct bcm2835_pinctrl *pc, +@@ -584,7 +584,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type) + unsigned long flags; + int ret; + +- spin_lock_irqsave(&pc->irq_lock[bank], flags); ++ raw_spin_lock_irqsave(&pc->irq_lock[bank], flags); + + if (test_bit(offset, &pc->enabled_irq_map[bank])) + ret = __bcm2835_gpio_irq_set_type_enabled(pc, gpio, type); +@@ -596,7 +596,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type) + else + irq_set_handler_locked(data, handle_level_irq); + +- spin_unlock_irqrestore(&pc->irq_lock[bank], flags); ++ raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags); + + return ret; + } +@@ -1047,7 +1047,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev) + for_each_set_bit(offset, &events, 32) + bcm2835_gpio_wr(pc, GPEDS0 + i * 4, BIT(offset)); + +- spin_lock_init(&pc->irq_lock[i]); ++ raw_spin_lock_init(&pc->irq_lock[i]); + } + + err = gpiochip_add_data(&pc->gpio_chip, pc); +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-meson-meson8-fix-the-gpio-function-for-the-g.patch b/queue-4.20/pinctrl-meson-meson8-fix-the-gpio-function-for-the-g.patch new file mode 100644 index 00000000000..46f1aa7f8ef --- /dev/null +++ b/queue-4.20/pinctrl-meson-meson8-fix-the-gpio-function-for-the-g.patch @@ -0,0 +1,49 @@ +From bde53ae6187b96989c939c390c65d14fa689115f Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Sun, 9 Dec 2018 20:50:50 +0100 +Subject: pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins + +[ Upstream commit 42f9b48cc5402be11d2364275eb18c257d2a79e8 ] + +The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N) +only belong to the pin controller in the AO domain. With the current +definition these pins cannot be referred to in .dts files as group +(which is possible on GXBB and GXL for example). + +Add a separate "gpio_aobus" function to fix the mapping between the pin +controller and the GPIO pins in the AO domain. This is similar to how +the GXBB and GXL drivers implement this functionality. + +Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson8.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c +index 86466173114d..e482672e833a 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8.c +@@ -807,7 +807,9 @@ static const char * const gpio_groups[] = { + "BOOT_5", "BOOT_6", "BOOT_7", "BOOT_8", "BOOT_9", + "BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14", + "BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18", ++}; + ++static const char * const gpio_aobus_groups[] = { + "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3", + "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7", + "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11", +@@ -1030,6 +1032,7 @@ static struct meson_pmx_func meson8_cbus_functions[] = { + }; + + static struct meson_pmx_func meson8_aobus_functions[] = { ++ FUNCTION(gpio_aobus), + FUNCTION(uart_ao), + FUNCTION(remote), + FUNCTION(i2c_slave_ao), +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-meson-meson8b-fix-the-gpio-function-for-the-.patch b/queue-4.20/pinctrl-meson-meson8b-fix-the-gpio-function-for-the-.patch new file mode 100644 index 00000000000..ca0ec1c8606 --- /dev/null +++ b/queue-4.20/pinctrl-meson-meson8b-fix-the-gpio-function-for-the-.patch @@ -0,0 +1,63 @@ +From cd1b2d379e7894a77c4a26d3c043a20800c74c0a Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Sun, 9 Dec 2018 20:50:51 +0100 +Subject: pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins + +[ Upstream commit 2b745ac3cceb8fc1d9985990c8241a821ea97e53 ] + +The GPIOAO pins (as well as the two exotic GPIO_BSD_EN and GPIO_TEST_N) +only belong to the pin controller in the AO domain. With the current +definition these pins cannot be referred to in .dts files as group +(which is possible on GXBB and GXL for example). + +Add a separate "gpio_aobus" function to fix the mapping between the pin +controller and the GPIO pins in the AO domain. This is similar to how +the GXBB and GXL drivers implement this functionality. + +Fixes: 9dab1868ec0db4 ("pinctrl: amlogic: Make driver independent from two-domain configuration") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson8b.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c +index 647ad15d5c3c..91cffc051055 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8b.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c +@@ -646,16 +646,18 @@ static const char * const gpio_groups[] = { + "BOOT_10", "BOOT_11", "BOOT_12", "BOOT_13", "BOOT_14", + "BOOT_15", "BOOT_16", "BOOT_17", "BOOT_18", + +- "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3", +- "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7", +- "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11", +- "GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N", +- + "DIF_0_P", "DIF_0_N", "DIF_1_P", "DIF_1_N", + "DIF_2_P", "DIF_2_N", "DIF_3_P", "DIF_3_N", + "DIF_4_P", "DIF_4_N" + }; + ++static const char * const gpio_aobus_groups[] = { ++ "GPIOAO_0", "GPIOAO_1", "GPIOAO_2", "GPIOAO_3", ++ "GPIOAO_4", "GPIOAO_5", "GPIOAO_6", "GPIOAO_7", ++ "GPIOAO_8", "GPIOAO_9", "GPIOAO_10", "GPIOAO_11", ++ "GPIOAO_12", "GPIOAO_13", "GPIO_BSD_EN", "GPIO_TEST_N" ++}; ++ + static const char * const sd_a_groups[] = { + "sd_d0_a", "sd_d1_a", "sd_d2_a", "sd_d3_a", "sd_clk_a", + "sd_cmd_a" +@@ -871,6 +873,7 @@ static struct meson_pmx_func meson8b_cbus_functions[] = { + }; + + static struct meson_pmx_func meson8b_aobus_functions[] = { ++ FUNCTION(gpio_aobus), + FUNCTION(uart_ao), + FUNCTION(uart_ao_b), + FUNCTION(i2c_slave_ao), +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-nuvoton-check-for-devm_kasprintf-failure.patch b/queue-4.20/pinctrl-nuvoton-check-for-devm_kasprintf-failure.patch new file mode 100644 index 00000000000..7cf17d1feef --- /dev/null +++ b/queue-4.20/pinctrl-nuvoton-check-for-devm_kasprintf-failure.patch @@ -0,0 +1,37 @@ +From 384cc5d0c83e68fb76a29ca3e4ba5c127205f1d3 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Fri, 23 Nov 2018 17:12:58 +0100 +Subject: pinctrl: nuvoton: check for devm_kasprintf() failure + +[ Upstream commit 4be1eaf322f07bb9694618fd2763a3a1f0a3dd25 ] + +devm_kasprintf() may return NULL on failure of internal allocation thus +the assignment to .label is not safe if not checked. On error +npcm7xx_gpio_of() returns negative values so -ENOMEM in the +(unlikely) failure case of devm_kasprintf() should be fine here. + +Signed-off-by: Nicholas Mc Guire +Fixes: 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver") +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +index 7ad50d9268aa..3bda620d18bb 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +@@ -1932,6 +1932,9 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl) + pctrl->gpio_bank[id].gc.label = + devm_kasprintf(pctrl->dev, GFP_KERNEL, "%pOF", + np); ++ if (pctrl->gpio_bank[id].gc.label == NULL) ++ return -ENOMEM; ++ + pctrl->gpio_bank[id].gc.dbg_show = npcmgpio_dbg_show; + pctrl->gpio_bank[id].direction_input = + pctrl->gpio_bank[id].gc.direction_input; +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-rza1-handle-devm_kasprintf-failure-cases.patch b/queue-4.20/pinctrl-rza1-handle-devm_kasprintf-failure-cases.patch new file mode 100644 index 00000000000..5266c0ea9e4 --- /dev/null +++ b/queue-4.20/pinctrl-rza1-handle-devm_kasprintf-failure-cases.patch @@ -0,0 +1,47 @@ +From ac0df8bddd1887ee33e1a2568f33f5fcf1ec0358 Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Fri, 7 Dec 2018 11:34:27 +0100 +Subject: pinctrl: rza1: Handle devm_kasprintf() failure cases + +[ Upstream commit db221412cd2014506642967155698825ad80f6b6 ] + +devm_kasprintf() may return NULL on failure of internal allocation +thus the assignments are not safe if not checked. On error +rza1_pinctrl_register() respectively rza1_parse_gpiochip() return +negative values so -ENOMEM in the (unlikely) failure case of +devm_kasprintf() should be fine here. + +Signed-off-by: Nicholas Mc Guire +Fixes: 5a49b644b307 ("pinctrl: Renesas RZ/A1 pin and gpio controller") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rza1.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-rza1.c b/drivers/pinctrl/pinctrl-rza1.c +index 14eb576c04a2..9cfe9d0520ac 100644 +--- a/drivers/pinctrl/pinctrl-rza1.c ++++ b/drivers/pinctrl/pinctrl-rza1.c +@@ -1225,6 +1225,9 @@ static int rza1_parse_gpiochip(struct rza1_pinctrl *rza1_pctl, + chip->base = -1; + chip->label = devm_kasprintf(rza1_pctl->dev, GFP_KERNEL, "%pOFn", + np); ++ if (!chip->label) ++ return -ENOMEM; ++ + chip->ngpio = of_args.args[2]; + chip->of_node = np; + chip->parent = rza1_pctl->dev; +@@ -1326,6 +1329,8 @@ static int rza1_pinctrl_register(struct rza1_pinctrl *rza1_pctl) + pins[i].number = i; + pins[i].name = devm_kasprintf(rza1_pctl->dev, GFP_KERNEL, + "P%u-%u", port, pin); ++ if (!pins[i].name) ++ return -ENOMEM; + + if (i % RZA1_PINS_PER_PORT == 0) { + /* +-- +2.19.1 + diff --git a/queue-4.20/pinctrl-sx150x-handle-failure-case-of-devm_kstrdup.patch b/queue-4.20/pinctrl-sx150x-handle-failure-case-of-devm_kstrdup.patch new file mode 100644 index 00000000000..779e56ba31a --- /dev/null +++ b/queue-4.20/pinctrl-sx150x-handle-failure-case-of-devm_kstrdup.patch @@ -0,0 +1,64 @@ +From f835f4284296801624c40236976fade4631e0a9e Mon Sep 17 00:00:00 2001 +From: Nicholas Mc Guire +Date: Sun, 2 Dec 2018 11:04:17 +0100 +Subject: pinctrl: sx150x: handle failure case of devm_kstrdup + +[ Upstream commit a9d9f6b83f1bb05da849b3540e6d1f70ef1c2343 ] + +devm_kstrdup() may return NULL if internal allocation failed. +Thus using label, name is unsafe without checking. Therefor +in the unlikely case of allocation failure, sx150x_probe() simply +returns -ENOMEM. + +Signed-off-by: Nicholas Mc Guire +Fixes: 9e80f9064e73 ("pinctrl: Add SX150X GPIO Extender Pinctrl Driver") +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-sx150x.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-sx150x.c b/drivers/pinctrl/pinctrl-sx150x.c +index cbf58a10113d..4d87d75b9c6e 100644 +--- a/drivers/pinctrl/pinctrl-sx150x.c ++++ b/drivers/pinctrl/pinctrl-sx150x.c +@@ -1166,7 +1166,6 @@ static int sx150x_probe(struct i2c_client *client, + } + + /* Register GPIO controller */ +- pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL); + pctl->gpio.base = -1; + pctl->gpio.ngpio = pctl->data->npins; + pctl->gpio.get_direction = sx150x_gpio_get_direction; +@@ -1180,6 +1179,10 @@ static int sx150x_probe(struct i2c_client *client, + pctl->gpio.of_node = dev->of_node; + #endif + pctl->gpio.can_sleep = true; ++ pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL); ++ if (!pctl->gpio.label) ++ return -ENOMEM; ++ + /* + * Setting multiple pins is not safe when all pins are not + * handled by the same regmap register. The oscio pin (present +@@ -1200,13 +1203,15 @@ static int sx150x_probe(struct i2c_client *client, + + /* Add Interrupt support if an irq is specified */ + if (client->irq > 0) { +- pctl->irq_chip.name = devm_kstrdup(dev, client->name, +- GFP_KERNEL); + pctl->irq_chip.irq_mask = sx150x_irq_mask; + pctl->irq_chip.irq_unmask = sx150x_irq_unmask; + pctl->irq_chip.irq_set_type = sx150x_irq_set_type; + pctl->irq_chip.irq_bus_lock = sx150x_irq_bus_lock; + pctl->irq_chip.irq_bus_sync_unlock = sx150x_irq_bus_sync_unlock; ++ pctl->irq_chip.name = devm_kstrdup(dev, client->name, ++ GFP_KERNEL); ++ if (!pctl->irq_chip.name) ++ return -ENOMEM; + + pctl->irq.masked = ~0; + pctl->irq.sense = 0; +-- +2.19.1 + diff --git a/queue-4.20/platform-chrome-don-t-report-ec_mkbp_event_sensor_fi.patch b/queue-4.20/platform-chrome-don-t-report-ec_mkbp_event_sensor_fi.patch new file mode 100644 index 00000000000..bdd78b97d06 --- /dev/null +++ b/queue-4.20/platform-chrome-don-t-report-ec_mkbp_event_sensor_fi.patch @@ -0,0 +1,74 @@ +From 5c5d42a61ec2cd56a19de623822f759bdd7e8b62 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 7 Nov 2018 18:49:39 -0800 +Subject: platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup + +[ Upstream commit 6ad16b78a039b45294b1ad5d69c14ac57b2fe706 ] + +EC_MKBP_EVENT_SENSOR_FIFO events can be triggered for a variety of +reasons, and there are very few cases in which they should be treated as +wakeup interrupts (particularly, when a certain +MOTIONSENSE_MODULE_FLAG_* is set, but this is not even supported in the +mainline cros_ec_sensor driver yet). Most of the time, they are benign +sensor readings. In any case, the top-level cros_ec device doesn't know +enough to determine that they should wake the system, and so it should +not report the event. This would be the job of the cros_ec_sensors +driver to parse. + +This patch adds checks to cros_ec_get_next_event() such that it doesn't +signal 'wakeup' for events of type EC_MKBP_EVENT_SENSOR_FIFO. + +This patch is particularly relevant on devices like Scarlet (Rockchip +RK3399 tablet, known as Acer Chromebook Tab 10), where the EC firmware +reports sensor events much more frequently. This was causing +/sys/power/wakeup_count to increase very frequently, often needlessly +interrupting our ability to suspend the system. + +Signed-off-by: Brian Norris +Signed-off-by: Benson Leung +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_proto.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index b6fd4838f60f..e5d5b1adb5a9 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -575,6 +575,7 @@ static int get_keyboard_state_event(struct cros_ec_device *ec_dev) + + int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event) + { ++ u8 event_type; + u32 host_event; + int ret; + +@@ -594,11 +595,22 @@ int cros_ec_get_next_event(struct cros_ec_device *ec_dev, bool *wake_event) + return ret; + + if (wake_event) { ++ event_type = ec_dev->event_data.event_type; + host_event = cros_ec_get_host_event(ec_dev); + +- /* Consider non-host_event as wake event */ +- *wake_event = !host_event || +- !!(host_event & ec_dev->host_event_wake_mask); ++ /* ++ * Sensor events need to be parsed by the sensor sub-device. ++ * Defer them, and don't report the wakeup here. ++ */ ++ if (event_type == EC_MKBP_EVENT_SENSOR_FIFO) ++ *wake_event = false; ++ /* Masked host-events should not count as wake events. */ ++ else if (host_event && ++ !(host_event & ec_dev->host_event_wake_mask)) ++ *wake_event = false; ++ /* Consider all other events as wake events. */ ++ else ++ *wake_event = true; + } + + return ret; +-- +2.19.1 + diff --git a/queue-4.20/platform-x86-fix-config-space-access-for-intel_atomi.patch b/queue-4.20/platform-x86-fix-config-space-access-for-intel_atomi.patch new file mode 100644 index 00000000000..8be7e49fc2a --- /dev/null +++ b/queue-4.20/platform-x86-fix-config-space-access-for-intel_atomi.patch @@ -0,0 +1,157 @@ +From b8780c93bf7a5a09ca10b2ede32a1a284638a9e5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 29 Nov 2018 19:44:45 +0200 +Subject: platform/x86: Fix config space access for intel_atomisp2_pm +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 6a31061833a52a79c99221b6251db08cf377470e ] + +We lose even config space access when we power gate the ISP +via the PUNIT. That makes lspci & co. produce gibberish. + +To fix that let's try to implement actual runtime pm hooks +and inform the pci core that the device always goes to +D3cold. That will cause the pci core to resume the device +before attempting config space access. + +This introduces another annoyance though. We get the +following error every time we try to resume the device: +intel_atomisp2_pm 0000:00:03.0: Refused to change power state, currently in D3 + +The reason being that the pci core tries to put the device +back into D0 via the standard PCI PM mechanism before +calling the driver resume hook. To fix this properly +we'd need to infiltrate the platform pm hooks (could +turn ugly real fast), or use pm domains (which don't +seem to exist on x86), or some extra early resume +hook for the driver (which doesn't exist either). +So maybe we just choose to live with the error? + +Cc: Hans de Goede +Cc: Alan Cox +Cc: Andy Shevchenko +Cc: Darren Hart +Signed-off-by: Ville Syrjälä +Signed-off-by: Andy Shevchenko +Reviewed-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_atomisp2_pm.c | 68 +++++++++++++++++------- + 1 file changed, 48 insertions(+), 20 deletions(-) + +diff --git a/drivers/platform/x86/intel_atomisp2_pm.c b/drivers/platform/x86/intel_atomisp2_pm.c +index 9371603a0ac9..2a8c7a4cea35 100644 +--- a/drivers/platform/x86/intel_atomisp2_pm.c ++++ b/drivers/platform/x86/intel_atomisp2_pm.c +@@ -33,46 +33,45 @@ + #define ISPSSPM0_IUNIT_POWER_ON 0x0 + #define ISPSSPM0_IUNIT_POWER_OFF 0x3 + +-static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id) ++static int isp_set_power(struct pci_dev *dev, bool enable) + { + unsigned long timeout; +- u32 val; +- +- pci_write_config_dword(dev, PCI_INTERRUPT_CTRL, 0); +- +- /* +- * MRFLD IUNIT DPHY is located in an always-power-on island +- * MRFLD HW design need all CSI ports are disabled before +- * powering down the IUNIT. +- */ +- pci_read_config_dword(dev, PCI_CSI_CONTROL, &val); +- val |= PCI_CSI_CONTROL_PORTS_OFF_MASK; +- pci_write_config_dword(dev, PCI_CSI_CONTROL, val); ++ u32 val = enable ? ISPSSPM0_IUNIT_POWER_ON : ++ ISPSSPM0_IUNIT_POWER_OFF; + +- /* Write 0x3 to ISPSSPM0 bit[1:0] to power off the IUNIT */ ++ /* Write to ISPSSPM0 bit[1:0] to power on/off the IUNIT */ + iosf_mbi_modify(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, +- ISPSSPM0_IUNIT_POWER_OFF, ISPSSPM0_ISPSSC_MASK); ++ val, ISPSSPM0_ISPSSC_MASK); + + /* + * There should be no IUNIT access while power-down is + * in progress HW sighting: 4567865 + * Wait up to 50 ms for the IUNIT to shut down. ++ * And we do the same for power on. + */ + timeout = jiffies + msecs_to_jiffies(50); + while (1) { +- /* Wait until ISPSSPM0 bit[25:24] shows 0x3 */ +- iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &val); +- val = (val & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET; +- if (val == ISPSSPM0_IUNIT_POWER_OFF) ++ u32 tmp; ++ ++ /* Wait until ISPSSPM0 bit[25:24] shows the right value */ ++ iosf_mbi_read(BT_MBI_UNIT_PMC, MBI_REG_READ, ISPSSPM0, &tmp); ++ tmp = (tmp & ISPSSPM0_ISPSSS_MASK) >> ISPSSPM0_ISPSSS_OFFSET; ++ if (tmp == val) + break; + + if (time_after(jiffies, timeout)) { +- dev_err(&dev->dev, "IUNIT power-off timeout.\n"); ++ dev_err(&dev->dev, "IUNIT power-%s timeout.\n", ++ enable ? "on" : "off"); + return -EBUSY; + } + usleep_range(1000, 2000); + } + ++ return 0; ++} ++ ++static int isp_probe(struct pci_dev *dev, const struct pci_device_id *id) ++{ + pm_runtime_allow(&dev->dev); + pm_runtime_put_sync_suspend(&dev->dev); + +@@ -87,11 +86,40 @@ static void isp_remove(struct pci_dev *dev) + + static int isp_pci_suspend(struct device *dev) + { ++ struct pci_dev *pdev = to_pci_dev(dev); ++ u32 val; ++ ++ pci_write_config_dword(pdev, PCI_INTERRUPT_CTRL, 0); ++ ++ /* ++ * MRFLD IUNIT DPHY is located in an always-power-on island ++ * MRFLD HW design need all CSI ports are disabled before ++ * powering down the IUNIT. ++ */ ++ pci_read_config_dword(pdev, PCI_CSI_CONTROL, &val); ++ val |= PCI_CSI_CONTROL_PORTS_OFF_MASK; ++ pci_write_config_dword(pdev, PCI_CSI_CONTROL, val); ++ ++ /* ++ * We lose config space access when punit power gates ++ * the ISP. Can't use pci_set_power_state() because ++ * pmcsr won't actually change when we write to it. ++ */ ++ pci_save_state(pdev); ++ pdev->current_state = PCI_D3cold; ++ isp_set_power(pdev, false); ++ + return 0; + } + + static int isp_pci_resume(struct device *dev) + { ++ struct pci_dev *pdev = to_pci_dev(dev); ++ ++ isp_set_power(pdev, true); ++ pdev->current_state = PCI_D0; ++ pci_restore_state(pdev); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/platform-x86-mlx-platform-fix-tachometer-registers.patch b/queue-4.20/platform-x86-mlx-platform-fix-tachometer-registers.patch new file mode 100644 index 00000000000..b08f5a1d3c5 --- /dev/null +++ b/queue-4.20/platform-x86-mlx-platform-fix-tachometer-registers.patch @@ -0,0 +1,52 @@ +From 3413cc6a2b50cb9e5d7e6c5b3932409f111142b9 Mon Sep 17 00:00:00 2001 +From: Vadim Pasternak +Date: Thu, 15 Nov 2018 17:26:56 +0000 +Subject: platform/x86: mlx-platform: Fix tachometer registers + +[ Upstream commit edd45cba5ed7f53974475ddc9a1453c2c87b3328 ] + +Shift by one the registers for tachometers (7 - 12). + +This fix is relevant for the same new systems MQMB7, MSN37, MSN34, +which are about to be released to the customers. +At the moment, none of them is at customers sites. The customers will +not suffer from this change. +This fix is necessary, because register used before for tachometer 7 +has been than reserved for the second PWM for newer systems, which are +not supported yet in mlx-platform driver. So registers of tachometers +7-12 have been shifted by one. + +Fixes: 0378123c5800 ("platform/x86: mlx-platform: Add mlxreg-fan platform driver activation") +Signed-off-by: Vadim Pasternak +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index c2c3a1a19879..14f88bfabd5d 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -83,12 +83,12 @@ + #define MLXPLAT_CPLD_LPC_REG_TACHO4_OFFSET 0xe7 + #define MLXPLAT_CPLD_LPC_REG_TACHO5_OFFSET 0xe8 + #define MLXPLAT_CPLD_LPC_REG_TACHO6_OFFSET 0xe9 +-#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET 0xea +-#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET 0xeb +-#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET 0xec +-#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET 0xed +-#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET 0xee +-#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET 0xef ++#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET 0xeb ++#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET 0xec ++#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET 0xed ++#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET 0xee ++#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET 0xef ++#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET 0xf0 + #define MLXPLAT_CPLD_LPC_IO_RANGE 0x100 + #define MLXPLAT_CPLD_LPC_I2C_CH1_OFF 0xdb + #define MLXPLAT_CPLD_LPC_I2C_CH2_OFF 0xda +-- +2.19.1 + diff --git a/queue-4.20/powerpc-32-add-.data.lubsan_data-.data.lubsan_type-s.patch b/queue-4.20/powerpc-32-add-.data.lubsan_data-.data.lubsan_type-s.patch new file mode 100644 index 00000000000..3539ee7b8c7 --- /dev/null +++ b/queue-4.20/powerpc-32-add-.data.lubsan_data-.data.lubsan_type-s.patch @@ -0,0 +1,50 @@ +From d8cd6b9b476e53917f1c846a5867c27aa7e2c0c8 Mon Sep 17 00:00:00 2001 +From: Mathieu Malaterre +Date: Wed, 31 Oct 2018 13:31:56 +0100 +Subject: powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections + explicitly + +[ Upstream commit beba24ac59133cb36ecd03f9af9ccb11971ee20e ] + +When both `CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y` and `CONFIG_UBSAN=y` +are set, link step typically produce numberous warnings about orphan +section: + + + powerpc-linux-gnu-ld -EB -m elf32ppc -Bstatic --orphan-handling=warn --build-id --gc-sections -X -o .tmp_vmlinux1 -T ./arch/powerpc/kernel/vmlinux.lds --who + le-archive built-in.a --no-whole-archive --start-group lib/lib.a --end-group + powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_data393' from `init/main.o' being placed in section `.data..Lubsan_data393'. + powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_data394' from `init/main.o' being placed in section `.data..Lubsan_data394'. + ... + powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_type11' from `init/main.o' being placed in section `.data..Lubsan_type11'. + powerpc-linux-gnu-ld: warning: orphan section `.data..Lubsan_type12' from `init/main.o' being placed in section `.data..Lubsan_type12'. + ... + +This commit remove those warnings produced at W=1. + +Link: https://www.mail-archive.com/linuxppc-dev@lists.ozlabs.org/msg135407.html +Suggested-by: Nicholas Piggin +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vmlinux.lds.S | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 434581bcd5b4..1148c3c60c3b 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -308,6 +308,10 @@ SECTIONS + #ifdef CONFIG_PPC32 + .data : AT(ADDR(.data) - LOAD_OFFSET) { + DATA_DATA ++#ifdef CONFIG_UBSAN ++ *(.data..Lubsan_data*) ++ *(.data..Lubsan_type*) ++#endif + *(.data.rel*) + *(SDATA_MAIN) + *(.sdata2) +-- +2.19.1 + diff --git a/queue-4.20/powerpc-fadump-do-not-allow-hot-remove-memory-from-f.patch b/queue-4.20/powerpc-fadump-do-not-allow-hot-remove-memory-from-f.patch new file mode 100644 index 00000000000..90f98e44028 --- /dev/null +++ b/queue-4.20/powerpc-fadump-do-not-allow-hot-remove-memory-from-f.patch @@ -0,0 +1,89 @@ +From 54c312734a53120c28c40a758a947bc7b9de07df Mon Sep 17 00:00:00 2001 +From: Mahesh Salgaonkar +Date: Mon, 20 Aug 2018 13:47:32 +0530 +Subject: powerpc/fadump: Do not allow hot-remove memory from fadump reserved + area. + +[ Upstream commit 0db6896ff6332ba694f1e61b93ae3b2640317633 ] + +For fadump to work successfully there should not be any holes in reserved +memory ranges where kernel has asked firmware to move the content of old +kernel memory in event of crash. Now that fadump uses CMA for reserved +area, this memory area is now not protected from hot-remove operations +unless it is cma allocated. Hence, fadump service can fail to re-register +after the hot-remove operation, if hot-removed memory belongs to fadump +reserved region. To avoid this make sure that memory from fadump reserved +area is not hot-removable if fadump is registered. + +However, if user still wants to remove that memory, he can do so by +manually stopping fadump service before hot-remove operation. + +Signed-off-by: Mahesh Salgaonkar +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/fadump.h | 2 +- + arch/powerpc/kernel/fadump.c | 10 ++++++++-- + arch/powerpc/platforms/pseries/hotplug-memory.c | 7 +++++-- + 3 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/fadump.h b/arch/powerpc/include/asm/fadump.h +index 1e7a33592e29..15bc07a31c46 100644 +--- a/arch/powerpc/include/asm/fadump.h ++++ b/arch/powerpc/include/asm/fadump.h +@@ -200,7 +200,7 @@ struct fad_crash_memory_ranges { + unsigned long long size; + }; + +-extern int is_fadump_boot_memory_area(u64 addr, ulong size); ++extern int is_fadump_memory_area(u64 addr, ulong size); + extern int early_init_dt_scan_fw_dump(unsigned long node, + const char *uname, int depth, void *data); + extern int fadump_reserve_mem(void); +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 761b28b1427d..7fd9b3e1fa39 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -118,13 +118,19 @@ int __init early_init_dt_scan_fw_dump(unsigned long node, + + /* + * If fadump is registered, check if the memory provided +- * falls within boot memory area. ++ * falls within boot memory area and reserved memory area. + */ +-int is_fadump_boot_memory_area(u64 addr, ulong size) ++int is_fadump_memory_area(u64 addr, ulong size) + { ++ u64 d_start = fw_dump.reserve_dump_area_start; ++ u64 d_end = d_start + fw_dump.reserve_dump_area_size; ++ + if (!fw_dump.dump_registered) + return 0; + ++ if (((addr + size) > d_start) && (addr <= d_end)) ++ return 1; ++ + return (addr + size) > RMA_START && addr <= fw_dump.boot_memory_size; + } + +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 2a983b5a52e1..2318ab29d5dd 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -355,8 +355,11 @@ static bool lmb_is_removable(struct drmem_lmb *lmb) + phys_addr = lmb->base_addr; + + #ifdef CONFIG_FA_DUMP +- /* Don't hot-remove memory that falls in fadump boot memory area */ +- if (is_fadump_boot_memory_area(phys_addr, block_sz)) ++ /* ++ * Don't hot-remove memory that falls in fadump boot memory area ++ * and memory that is reserved for capturing old kernel memory. ++ */ ++ if (is_fadump_memory_area(phys_addr, block_sz)) + return false; + #endif + +-- +2.19.1 + diff --git a/queue-4.20/powerpc-mm-fix-reporting-of-kernel-execute-faults-on.patch b/queue-4.20/powerpc-mm-fix-reporting-of-kernel-execute-faults-on.patch new file mode 100644 index 00000000000..6c8264e0c08 --- /dev/null +++ b/queue-4.20/powerpc-mm-fix-reporting-of-kernel-execute-faults-on.patch @@ -0,0 +1,39 @@ +From 8d52c5aef5cf1d64b2c2c7f5d3daa8567eeb04e9 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Wed, 28 Nov 2018 09:27:04 +0000 +Subject: powerpc/mm: Fix reporting of kernel execute faults on the 8xx + +[ Upstream commit ffca395b11c4a5a6df6d6345f794b0e3d578e2d0 ] + +On the 8xx, no-execute is set via PPP bits in the PTE. Therefore +a no-exec fault generates DSISR_PROTFAULT error bits, +not DSISR_NOEXEC_OR_G. + +This patch adds DSISR_PROTFAULT in the test mask. + +Fixes: d3ca587404b3 ("powerpc/mm: Fix reporting of kernel execute faults") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/fault.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 1697e903bbf2..50e5c790d11e 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -226,7 +226,9 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, + static bool bad_kernel_fault(bool is_exec, unsigned long error_code, + unsigned long address) + { +- if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT))) { ++ /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */ ++ if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT | ++ DSISR_PROTFAULT))) { + printk_ratelimited(KERN_CRIT "kernel tried to execute" + " exec-protected page (%lx) -" + "exploit attempt? (uid: %d)\n", +-- +2.19.1 + diff --git a/queue-4.20/powerpc-perf-fix-thresholding-counter-data-for-unkno.patch b/queue-4.20/powerpc-perf-fix-thresholding-counter-data-for-unkno.patch new file mode 100644 index 00000000000..98753a6b767 --- /dev/null +++ b/queue-4.20/powerpc-perf-fix-thresholding-counter-data-for-unkno.patch @@ -0,0 +1,44 @@ +From 7029912490e637d97267065a7cbeb704bb701f3a Mon Sep 17 00:00:00 2001 +From: Madhavan Srinivasan +Date: Sun, 9 Dec 2018 14:48:15 +0530 +Subject: powerpc/perf: Fix thresholding counter data for unknown type + +[ Upstream commit 17cfccc91545682513541924245abb876d296063 ] + +MMCRA[34:36] and MMCRA[38:44] expose the thresholding counter value. +Thresholding counter can be used to count latency cycles such as +load miss to reload. But threshold counter value is not relevant +when the sampled instruction type is unknown or reserved. Patch to +fix the thresholding counter value to zero when sampled instruction +type is unknown or reserved. + +Fixes: 170a315f41c6('powerpc/perf: Support to export MMCRA[TEC*] field to userspace') +Signed-off-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/isa207-common.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 177de814286f..6a2f65d3d088 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -226,8 +226,13 @@ void isa207_get_mem_weight(u64 *weight) + u64 mmcra = mfspr(SPRN_MMCRA); + u64 exp = MMCRA_THR_CTR_EXP(mmcra); + u64 mantissa = MMCRA_THR_CTR_MANT(mmcra); ++ u64 sier = mfspr(SPRN_SIER); ++ u64 val = (sier & ISA207_SIER_TYPE_MASK) >> ISA207_SIER_TYPE_SHIFT; + +- *weight = mantissa << (2 * exp); ++ if (val == 0 || val == 7) ++ *weight = 0; ++ else ++ *weight = mantissa << (2 * exp); + } + + int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) +-- +2.19.1 + diff --git a/queue-4.20/powerpc-powernv-ioda-allocate-indirect-tce-levels-of.patch b/queue-4.20/powerpc-powernv-ioda-allocate-indirect-tce-levels-of.patch new file mode 100644 index 00000000000..ca3d4f9aa8f --- /dev/null +++ b/queue-4.20/powerpc-powernv-ioda-allocate-indirect-tce-levels-of.patch @@ -0,0 +1,44 @@ +From 31c046807300df89a2080bef91e5777f5f04b475 Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Fri, 28 Sep 2018 16:45:39 +1000 +Subject: powerpc/powernv/ioda: Allocate indirect TCE levels of cached + userspace addresses on demand + +[ Upstream commit bdbf649efe21173cae63b4b71db84176420f9039 ] + +The powernv platform maintains 2 TCE tables for VFIO - a hardware TCE +table and a table with userspace addresses; the latter is used for +marking pages dirty when corresponging TCEs are unmapped from +the hardware table. + +a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels +on demand") enabled on-demand allocation of the hardware table, +however it missed the other table so it has still been fully allocated +at the boot time. This fixes the issue by allocating a single level, +just like we do for the hardware table. + +Fixes: a68bd1267b72 ("powerpc/powernv/ioda: Allocate indirect TCE levels on demand") +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: David Gibson +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/pci-ioda-tce.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/powernv/pci-ioda-tce.c b/arch/powerpc/platforms/powernv/pci-ioda-tce.c +index fe9691040f54..7639b2168755 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda-tce.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda-tce.c +@@ -299,7 +299,7 @@ long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, + if (alloc_userspace_copy) { + offset = 0; + uas = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift, +- levels, tce_table_size, &offset, ++ tmplevels, tce_table_size, &offset, + &total_allocated_uas); + if (!uas) + goto free_tces_exit; +-- +2.19.1 + diff --git a/queue-4.20/powerpc-pseries-add-of_node_put-in-dlpar_detach_node.patch b/queue-4.20/powerpc-pseries-add-of_node_put-in-dlpar_detach_node.patch new file mode 100644 index 00000000000..994f673f953 --- /dev/null +++ b/queue-4.20/powerpc-pseries-add-of_node_put-in-dlpar_detach_node.patch @@ -0,0 +1,45 @@ +From 827b9b1208ccf40571c0ce35fda544d72277f748 Mon Sep 17 00:00:00 2001 +From: Frank Rowand +Date: Thu, 4 Oct 2018 20:27:16 -0700 +Subject: powerpc/pseries: add of_node_put() in dlpar_detach_node() + +[ Upstream commit 5b3f5c408d8cc59b87e47f1ab9803dbd006e4a91 ] + +The previous commit, "of: overlay: add missing of_node_get() in +__of_attach_node_sysfs" added a missing of_node_get() to +__of_attach_node_sysfs(). This results in a refcount imbalance +for nodes attached with dlpar_attach_node(). The calling sequence +from dlpar_attach_node() to __of_attach_node_sysfs() is: + + dlpar_attach_node() + of_attach_node() + __of_attach_node_sysfs() + +For more detailed description of the node refcount, see +commit 68baf692c435 ("powerpc/pseries: Fix of_node_put() underflow +during DLPAR remove"). + +Tested-by: Alan Tull +Acked-by: Michael Ellerman +Signed-off-by: Frank Rowand +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/dlpar.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index 7625546caefd..17958043e7f7 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -270,6 +270,8 @@ int dlpar_detach_node(struct device_node *dn) + if (rc) + return rc; + ++ of_node_put(dn); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.20/powerpc-uaccess-fix-warning-error-with-access_ok.patch b/queue-4.20/powerpc-uaccess-fix-warning-error-with-access_ok.patch new file mode 100644 index 00000000000..fd7937277fe --- /dev/null +++ b/queue-4.20/powerpc-uaccess-fix-warning-error-with-access_ok.patch @@ -0,0 +1,45 @@ +From 636aeff08981e36c644da907fa76727cc109d0cc Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 10 Dec 2018 06:50:09 +0000 +Subject: powerpc/uaccess: fix warning/error with access_ok() + +[ Upstream commit 05a4ab823983d9136a460b7b5e0d49ee709a6f86 ] + +With the following piece of code, the following compilation warning +is encountered: + + if (_IOC_DIR(ioc) != _IOC_NONE) { + int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ; + + if (!access_ok(verify, ioarg, _IOC_SIZE(ioc))) { + +drivers/platform/test/dev.c: In function 'my_ioctl': +drivers/platform/test/dev.c:219:7: warning: unused variable 'verify' [-Wunused-variable] + int verify = _IOC_DIR(ioc) & _IOC_READ ? VERIFY_WRITE : VERIFY_READ; + +This patch fixes it by referencing 'type' in the macro allthough +doing nothing with it. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/uaccess.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index 15bea9a0f260..ebc0b916dcf9 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -63,7 +63,7 @@ static inline int __access_ok(unsigned long addr, unsigned long size, + #endif + + #define access_ok(type, addr, size) \ +- (__chk_user_ptr(addr), \ ++ (__chk_user_ptr(addr), (void)(type), \ + __access_ok((__force unsigned long)(addr), (size), get_fs())) + + /* +-- +2.19.1 + diff --git a/queue-4.20/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch b/queue-4.20/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch new file mode 100644 index 00000000000..89885317937 --- /dev/null +++ b/queue-4.20/proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch @@ -0,0 +1,104 @@ +From 4644e6bb8dfce5c79c2dcb32bc8d6aec442c67cb Mon Sep 17 00:00:00 2001 +From: Cheng Lin +Date: Thu, 3 Jan 2019 15:26:13 -0800 +Subject: proc/sysctl: fix return error for proc_doulongvec_minmax() + +[ Upstream commit 09be178400829dddc1189b50a7888495dd26aa84 ] + +If the number of input parameters is less than the total parameters, an +EINVAL error will be returned. + +For example, we use proc_doulongvec_minmax to pass up to two parameters +with kern_table: + +{ + .procname = "monitor_signals", + .data = &monitor_sigs, + .maxlen = 2*sizeof(unsigned long), + .mode = 0644, + .proc_handler = proc_doulongvec_minmax, +}, + +Reproduce: + +When passing two parameters, it's work normal. But passing only one +parameter, an error "Invalid argument"(EINVAL) is returned. + + [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals + [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals + 1 2 + [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals + -bash: echo: write error: Invalid argument + [root@cl150 ~]# echo $? + 1 + [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals + 3 2 + [root@cl150 ~]# + +The following is the result after apply this patch. No error is +returned when the number of input parameters is less than the total +parameters. + + [root@cl150 ~]# echo 1 2 > /proc/sys/kernel/monitor_signals + [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals + 1 2 + [root@cl150 ~]# echo 3 > /proc/sys/kernel/monitor_signals + [root@cl150 ~]# echo $? + 0 + [root@cl150 ~]# cat /proc/sys/kernel/monitor_signals + 3 2 + [root@cl150 ~]# + +There are three processing functions dealing with digital parameters, +__do_proc_dointvec/__do_proc_douintvec/__do_proc_doulongvec_minmax. + +This patch deals with __do_proc_doulongvec_minmax, just as +__do_proc_dointvec does, adding a check for parameters 'left'. In +__do_proc_douintvec, its code implementation explicitly does not support +multiple inputs. + +static int __do_proc_douintvec(...){ + ... + /* + * Arrays are not supported, keep this simple. *Do not* add + * support for them. + */ + if (vleft != 1) { + *lenp = 0; + return -EINVAL; + } + ... +} + +So, just __do_proc_doulongvec_minmax has the problem. And most use of +proc_doulongvec_minmax/proc_doulongvec_ms_jiffies_minmax just have one +parameter. + +Link: http://lkml.kernel.org/r/1544081775-15720-1-git-send-email-cheng.lin130@zte.com.cn +Signed-off-by: Cheng Lin +Acked-by: Luis Chamberlain +Reviewed-by: Kees Cook +Cc: Alexey Dobriyan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/sysctl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 5fc724e4e454..9ee261fce89e 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2779,6 +2779,8 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int + bool neg; + + left -= proc_skip_spaces(&p); ++ if (!left) ++ break; + + err = proc_get_long(&p, &left, &val, &neg, + proc_wspace_sep, +-- +2.19.1 + diff --git a/queue-4.20/ptp-check-gettime64-return-code-in-ptp_sys_offset-io.patch b/queue-4.20/ptp-check-gettime64-return-code-in-ptp_sys_offset-io.patch new file mode 100644 index 00000000000..e3d6119199a --- /dev/null +++ b/queue-4.20/ptp-check-gettime64-return-code-in-ptp_sys_offset-io.patch @@ -0,0 +1,45 @@ +From 14136ea393ecd78b723ebcb81dea5625d06ec5c2 Mon Sep 17 00:00:00 2001 +From: Miroslav Lichvar +Date: Fri, 9 Nov 2018 11:14:43 +0100 +Subject: ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl + +[ Upstream commit 83d0bdc7390b890905634186baaa294475cd6a06 ] + +If a gettime64 call fails, return the error and avoid copying data back +to user. + +Cc: Richard Cochran +Cc: Jacob Keller +Signed-off-by: Miroslav Lichvar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_chardev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 2012551d93e0..796eeffdf93b 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -228,7 +228,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) + pct->sec = ts.tv_sec; + pct->nsec = ts.tv_nsec; + pct++; +- ptp->info->gettime64(ptp->info, &ts); ++ err = ptp->info->gettime64(ptp->info, &ts); ++ if (err) ++ goto out; + pct->sec = ts.tv_sec; + pct->nsec = ts.tv_nsec; + pct++; +@@ -281,6 +283,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg) + break; + } + ++out: + kfree(sysoff); + return err; + } +-- +2.19.1 + diff --git a/queue-4.20/ptp-fix-pass-zero-to-err_ptr-in-ptp_clock_register.patch b/queue-4.20/ptp-fix-pass-zero-to-err_ptr-in-ptp_clock_register.patch new file mode 100644 index 00000000000..32a62029251 --- /dev/null +++ b/queue-4.20/ptp-fix-pass-zero-to-err_ptr-in-ptp_clock_register.patch @@ -0,0 +1,51 @@ +From f67400172331cf536aa5ea046d61ca89329a7d11 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 23 Nov 2018 09:54:55 +0800 +Subject: ptp: Fix pass zero to ERR_PTR() in ptp_clock_register + +[ Upstream commit aea0a897af9e44c258e8ab9296fad417f1bc063a ] + +Fix smatch warning: + +drivers/ptp/ptp_clock.c:298 ptp_clock_register() warn: + passing zero to 'ERR_PTR' + +'err' should be set while device_create_with_groups and +pps_register_source fails + +Fixes: 85a66e550195 ("ptp: create "pins" together with the rest of attributes") +Signed-off-by: YueHaibing +Acked-by: Richard Cochran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_clock.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c +index 5419a89d300e..9b8aa6718ee7 100644 +--- a/drivers/ptp/ptp_clock.c ++++ b/drivers/ptp/ptp_clock.c +@@ -249,8 +249,10 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid, + ptp, ptp->pin_attr_groups, + "ptp%d", ptp->index); +- if (IS_ERR(ptp->dev)) ++ if (IS_ERR(ptp->dev)) { ++ err = PTR_ERR(ptp->dev); + goto no_device; ++ } + + /* Register a new PPS source. */ + if (info->pps) { +@@ -261,6 +263,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, + pps.owner = info->owner; + ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS); + if (!ptp->pps_source) { ++ err = -EINVAL; + pr_err("failed to register pps source\n"); + goto no_pps; + } +-- +2.19.1 + diff --git a/queue-4.20/rdma-core-sync-unregistration-with-netlink-commands.patch b/queue-4.20/rdma-core-sync-unregistration-with-netlink-commands.patch new file mode 100644 index 00000000000..b47073f298b --- /dev/null +++ b/queue-4.20/rdma-core-sync-unregistration-with-netlink-commands.patch @@ -0,0 +1,264 @@ +From 244bb527d07901eb275b048e2388ac8074fca6b9 Mon Sep 17 00:00:00 2001 +From: Parav Pandit +Date: Fri, 16 Nov 2018 03:50:57 +0200 +Subject: RDMA/core: Sync unregistration with netlink commands + +[ Upstream commit 01b671170d7f82b959dad6d5dbb44d7a915e647d ] + +When the rdma device is getting removed, get resource info can race with +device removal, as below: + + CPU-0 CPU-1 + -------- -------- + rdma_nl_rcv_msg() + nldev_res_get_cq_dumpit() + mutex_lock(device_lock); + get device reference + mutex_unlock(device_lock); [..] + ib_unregister_device() + /* Valid reference to + * device->dev exists. + */ + ib_dealloc_device() + + [..] + provider->fill_res_entry(); + +Even though device object is not freed, fill_res_entry() can get called on +device which doesn't have a driver anymore. Kernel core device reference +count is not sufficient, as this only keeps the structure valid, and +doesn't guarantee the driver is still loaded. + +Similar race can occur with device renaming and device removal, where +device_rename() tries to rename a unregistered device. While this is fine +for devices of a class which are not net namespace aware, but it is +incorrect for net namespace aware class coming in subsequent series. If a +class is net namespace aware, then the below [1] call trace is observed in +above situation. + +Therefore, to avoid the race, keep a reference count and let device +unregistration wait until all netlink users drop the reference. + +[1] Call trace: +kernfs: ns required in 'infiniband' for 'mlx5_0' +WARNING: CPU: 18 PID: 44270 at fs/kernfs/dir.c:842 kernfs_find_ns+0x104/0x120 +libahci i2c_core mlxfw libata dca [last unloaded: devlink] +RIP: 0010:kernfs_find_ns+0x104/0x120 +Call Trace: +kernfs_find_and_get_ns+0x2e/0x50 +sysfs_rename_link_ns+0x40/0xb0 +device_rename+0xb2/0xf0 +ib_device_rename+0xb3/0x100 [ib_core] +nldev_set_doit+0x165/0x190 [ib_core] +rdma_nl_rcv_msg+0x249/0x250 [ib_core] +? netlink_deliver_tap+0x8f/0x3e0 +rdma_nl_rcv+0xd6/0x120 [ib_core] +netlink_unicast+0x17c/0x230 +netlink_sendmsg+0x2f0/0x3e0 +sock_sendmsg+0x30/0x40 +__sys_sendto+0xdc/0x160 + +Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking") +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/core_priv.h | 1 + + drivers/infiniband/core/device.c | 26 ++++++++++++++++++++++---- + drivers/infiniband/core/nldev.c | 20 ++++++++++---------- + include/rdma/ib_verbs.h | 8 +++++++- + 4 files changed, 40 insertions(+), 15 deletions(-) + +diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h +index bb9007a0cca7..d97d39a7537c 100644 +--- a/drivers/infiniband/core/core_priv.h ++++ b/drivers/infiniband/core/core_priv.h +@@ -296,6 +296,7 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map, + #endif + + struct ib_device *ib_device_get_by_index(u32 ifindex); ++void ib_device_put(struct ib_device *device); + /* RDMA device netlink */ + void nldev_init(void); + void nldev_exit(void); +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 87eb4f2cdd7d..0027b0d79b09 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -145,7 +145,8 @@ static struct ib_device *__ib_device_get_by_index(u32 index) + } + + /* +- * Caller is responsible to return refrerence count by calling put_device() ++ * Caller must perform ib_device_put() to return the device reference count ++ * when ib_device_get_by_index() returns valid device pointer. + */ + struct ib_device *ib_device_get_by_index(u32 index) + { +@@ -153,13 +154,21 @@ struct ib_device *ib_device_get_by_index(u32 index) + + down_read(&lists_rwsem); + device = __ib_device_get_by_index(index); +- if (device) +- get_device(&device->dev); +- ++ if (device) { ++ /* Do not return a device if unregistration has started. */ ++ if (!refcount_inc_not_zero(&device->refcount)) ++ device = NULL; ++ } + up_read(&lists_rwsem); + return device; + } + ++void ib_device_put(struct ib_device *device) ++{ ++ if (refcount_dec_and_test(&device->refcount)) ++ complete(&device->unreg_completion); ++} ++ + static struct ib_device *__ib_device_get_by_name(const char *name) + { + struct ib_device *device; +@@ -293,6 +302,8 @@ struct ib_device *ib_alloc_device(size_t size) + rwlock_init(&device->client_data_lock); + INIT_LIST_HEAD(&device->client_data_list); + INIT_LIST_HEAD(&device->port_list); ++ refcount_set(&device->refcount, 1); ++ init_completion(&device->unreg_completion); + + return device; + } +@@ -641,6 +652,13 @@ void ib_unregister_device(struct ib_device *device) + struct ib_client_data *context, *tmp; + unsigned long flags; + ++ /* ++ * Wait for all netlink command callers to finish working on the ++ * device. ++ */ ++ ib_device_put(device); ++ wait_for_completion(&device->unreg_completion); ++ + mutex_lock(&device_mutex); + + down_write(&lists_rwsem); +diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c +index ff6468e7fe79..77a0f1e1576f 100644 +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -632,13 +632,13 @@ static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + + nlmsg_end(msg, nlh); + +- put_device(&device->dev); ++ ib_device_put(device); + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); + + err_free: + nlmsg_free(msg); + err: +- put_device(&device->dev); ++ ib_device_put(device); + return err; + } + +@@ -668,7 +668,7 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + err = ib_device_rename(device, name); + } + +- put_device(&device->dev); ++ ib_device_put(device); + return err; + } + +@@ -752,14 +752,14 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + goto err_free; + + nlmsg_end(msg, nlh); +- put_device(&device->dev); ++ ib_device_put(device); + + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); + + err_free: + nlmsg_free(msg); + err: +- put_device(&device->dev); ++ ib_device_put(device); + return err; + } + +@@ -816,7 +816,7 @@ static int nldev_port_get_dumpit(struct sk_buff *skb, + } + + out: +- put_device(&device->dev); ++ ib_device_put(device); + cb->args[0] = idx; + return skb->len; + } +@@ -855,13 +855,13 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + goto err_free; + + nlmsg_end(msg, nlh); +- put_device(&device->dev); ++ ib_device_put(device); + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); + + err_free: + nlmsg_free(msg); + err: +- put_device(&device->dev); ++ ib_device_put(device); + return ret; + } + +@@ -1054,7 +1054,7 @@ next: idx++; + if (!filled) + goto err; + +- put_device(&device->dev); ++ ib_device_put(device); + return skb->len; + + res_err: +@@ -1065,7 +1065,7 @@ err: + nlmsg_cancel(skb, nlh); + + err_index: +- put_device(&device->dev); ++ ib_device_put(device); + return ret; + } + +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 9c0c2132a2d6..64626b32107b 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -56,7 +56,7 @@ + #include + #include + #include +- ++#include + #include + #include + #include +@@ -2605,6 +2605,12 @@ struct ib_device { + + const struct uverbs_object_tree_def *const *driver_specs; + enum rdma_driver_id driver_id; ++ /* ++ * Provides synchronization between device unregistration and netlink ++ * commands on a device. To be used only by core. ++ */ ++ refcount_t refcount; ++ struct completion unreg_completion; + }; + + struct ib_client { +-- +2.19.1 + diff --git a/queue-4.20/s390-qeth-utilize-virtual-mac-for-layer2-osd-devices.patch b/queue-4.20/s390-qeth-utilize-virtual-mac-for-layer2-osd-devices.patch new file mode 100644 index 00000000000..90301c4daaa --- /dev/null +++ b/queue-4.20/s390-qeth-utilize-virtual-mac-for-layer2-osd-devices.patch @@ -0,0 +1,148 @@ +From df031b54e31824620484622efa690b41d7ba661b Mon Sep 17 00:00:00 2001 +From: Julian Wiedmann +Date: Thu, 8 Nov 2018 15:06:15 +0100 +Subject: s390/qeth: utilize virtual MAC for Layer2 OSD devices + +[ Upstream commit b144b99fff69a5bc0d34c8e168bedb88c68ca23d ] + +By default, READ MAC on a Layer2 OSD device returns the adapter's +burnt-in MAC address. Given the default scenario of many virtual devices +on the same adapter, qeth can't make any use of this address and +therefore skips the READ MAC call for this device type. + +But in some configurations, the READ MAC command for a Layer2 OSD device +actually returns a pre-provisioned, virtual MAC address. So enable the +READ MAC code to detect this situation, and let the L2 subdriver +call READ MAC for OSD devices. + +This also removes the QETH_LAYER2_MAC_READ flag, which protects L2 +devices against calling READ MAC multiple times. Instead protect the +whole call to qeth_l2_request_initial_mac(). + +Signed-off-by: Julian Wiedmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core.h | 1 - + drivers/s390/net/qeth_core_main.c | 12 +++++++----- + drivers/s390/net/qeth_core_mpc.h | 25 +++++++++++++++---------- + drivers/s390/net/qeth_l2_main.c | 10 ++++------ + 4 files changed, 26 insertions(+), 22 deletions(-) + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 04e294d1d16d..99af1a0a3314 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -665,7 +665,6 @@ struct qeth_card_blkt { + + #define QETH_BROADCAST_WITH_ECHO 0x01 + #define QETH_BROADCAST_WITHOUT_ECHO 0x02 +-#define QETH_LAYER2_MAC_READ 0x01 + #define QETH_LAYER2_MAC_REGISTERED 0x02 + struct qeth_card_info { + unsigned short unit_addr2; +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 254065271867..0c9a5250dd93 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -4235,16 +4235,18 @@ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card, + struct qeth_reply *reply, unsigned long data) + { + struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data; ++ struct qeth_ipacmd_setadpparms *adp_cmd; + + QETH_CARD_TEXT(card, 4, "chgmaccb"); + if (qeth_setadpparms_inspect_rc(cmd)) + return 0; + +- if (IS_LAYER3(card) || !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) { +- ether_addr_copy(card->dev->dev_addr, +- cmd->data.setadapterparms.data.change_addr.addr); +- card->info.mac_bits |= QETH_LAYER2_MAC_READ; +- } ++ adp_cmd = &cmd->data.setadapterparms; ++ if (IS_LAYER2(card) && IS_OSD(card) && !IS_VM_NIC(card) && ++ !(adp_cmd->hdr.flags & QETH_SETADP_FLAGS_VIRTUAL_MAC)) ++ return 0; ++ ++ ether_addr_copy(card->dev->dev_addr, adp_cmd->data.change_addr.addr); + return 0; + } + +diff --git a/drivers/s390/net/qeth_core_mpc.h b/drivers/s390/net/qeth_core_mpc.h +index 3e54be201b27..10cc487c16d6 100644 +--- a/drivers/s390/net/qeth_core_mpc.h ++++ b/drivers/s390/net/qeth_core_mpc.h +@@ -80,7 +80,9 @@ enum qeth_card_types { + }; + + #define IS_IQD(card) ((card)->info.type == QETH_CARD_TYPE_IQD) ++#define IS_OSD(card) ((card)->info.type == QETH_CARD_TYPE_OSD) + #define IS_OSN(card) ((card)->info.type == QETH_CARD_TYPE_OSN) ++#define IS_VM_NIC(card) ((card)->info.guestlan) + + #define QETH_MPC_DIFINFO_LEN_INDICATES_LINK_TYPE 0x18 + /* only the first two bytes are looked at in qeth_get_cardname_short */ +@@ -529,17 +531,20 @@ struct qeth_query_switch_attributes { + __u8 reserved3[8]; + }; + ++#define QETH_SETADP_FLAGS_VIRTUAL_MAC 0x80 /* for CHANGE_ADDR_READ_MAC */ ++ + struct qeth_ipacmd_setadpparms_hdr { +- __u32 supp_hw_cmds; +- __u32 reserved1; +- __u16 cmdlength; +- __u16 reserved2; +- __u32 command_code; +- __u16 return_code; +- __u8 used_total; +- __u8 seq_no; +- __u32 reserved3; +-} __attribute__ ((packed)); ++ u32 supp_hw_cmds; ++ u32 reserved1; ++ u16 cmdlength; ++ u16 reserved2; ++ u32 command_code; ++ u16 return_code; ++ u8 used_total; ++ u8 seq_no; ++ u8 flags; ++ u8 reserved3[3]; ++}; + + struct qeth_ipacmd_setadpparms { + struct qeth_ipacmd_setadpparms_hdr hdr; +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 2914a1a69f83..8d3601891c62 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -461,12 +461,9 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card) + /* fall back to alternative mechanism: */ + } + +- if (card->info.type == QETH_CARD_TYPE_IQD || +- card->info.type == QETH_CARD_TYPE_OSM || +- card->info.type == QETH_CARD_TYPE_OSX || +- card->info.guestlan) { ++ if (!IS_OSN(card)) { + rc = qeth_setadpparms_change_macaddr(card); +- if (!rc) ++ if (!rc && is_valid_ether_addr(card->dev->dev_addr)) + goto out; + QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %x: %#x\n", + CARD_DEVID(card), rc); +@@ -917,7 +914,8 @@ static int qeth_l2_setup_netdev(struct qeth_card *card, bool carrier_ok) + PAGE_SIZE * (QDIO_MAX_ELEMENTS_PER_BUFFER - 1)); + } + +- qeth_l2_request_initial_mac(card); ++ if (!is_valid_ether_addr(card->dev->dev_addr)) ++ qeth_l2_request_initial_mac(card); + netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT); + rc = register_netdev(card->dev); + if (!rc && carrier_ok) +-- +2.19.1 + diff --git a/queue-4.20/s390-zcrypt-improve-special-ap-message-cmd-handling.patch b/queue-4.20/s390-zcrypt-improve-special-ap-message-cmd-handling.patch new file mode 100644 index 00000000000..21ccb566b4d --- /dev/null +++ b/queue-4.20/s390-zcrypt-improve-special-ap-message-cmd-handling.patch @@ -0,0 +1,67 @@ +From a9c0e5e4281ffd0ccab93af840051753a3628740 Mon Sep 17 00:00:00 2001 +From: Harald Freudenberger +Date: Mon, 19 Nov 2018 11:36:13 +0100 +Subject: s390/zcrypt: improve special ap message cmd handling + +[ Upstream commit be534791011100d204602e2e0496e9e6ce8edf63 ] + +There exist very few ap messages which need to have the 'special' flag +enabled. This flag tells the firmware layer to do some pre- and maybe +postprocessing. However, it may happen that this special flag is +enabled but the firmware is unable to deal with this kind of message +and thus returns with reply code 0x41. For example older firmware may +not know the newest messages triggered by the zcrypt device driver and +thus react with reject and the named reply code. Unfortunately this +reply code is not known to the zcrypt error routines and thus default +behavior is to switch the ap queue offline. + +This patch now makes the ap error routine aware of the reply code and +so userspace is informed about the bad processing result but the queue +is not switched to offline state any more. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/include/uapi/asm/zcrypt.h | 4 ++-- + drivers/s390/crypto/zcrypt_error.h | 2 ++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/uapi/asm/zcrypt.h b/arch/s390/include/uapi/asm/zcrypt.h +index 42c81a95e97b..494c34c50716 100644 +--- a/arch/s390/include/uapi/asm/zcrypt.h ++++ b/arch/s390/include/uapi/asm/zcrypt.h +@@ -150,8 +150,8 @@ struct ica_xcRB { + * @cprb_len: CPRB header length [0x0020] + * @cprb_ver_id: CPRB version id. [0x04] + * @pad_000: Alignment pad bytes +- * @flags: Admin cmd [0x80] or functional cmd [0x00] +- * @func_id: Function id / subtype [0x5434] ++ * @flags: Admin bit [0x80], Special bit [0x20] ++ * @func_id: Function id / subtype [0x5434] "T4" + * @source_id: Source id [originator id] + * @target_id: Target id [usage/ctrl domain id] + * @ret_code: Return code +diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h +index 240b27f3f5f6..f34ee41cbed8 100644 +--- a/drivers/s390/crypto/zcrypt_error.h ++++ b/drivers/s390/crypto/zcrypt_error.h +@@ -51,6 +51,7 @@ struct error_hdr { + #define REP82_ERROR_FORMAT_FIELD 0x29 + #define REP82_ERROR_INVALID_COMMAND 0x30 + #define REP82_ERROR_MALFORMED_MSG 0x40 ++#define REP82_ERROR_INVALID_SPECIAL_CMD 0x41 + #define REP82_ERROR_INVALID_DOMAIN_PRECHECK 0x42 + #define REP82_ERROR_RESERVED_FIELDO 0x50 /* old value */ + #define REP82_ERROR_WORD_ALIGNMENT 0x60 +@@ -89,6 +90,7 @@ static inline int convert_error(struct zcrypt_queue *zq, + case REP88_ERROR_MESSAGE_MALFORMD: + case REP82_ERROR_INVALID_DOMAIN_PRECHECK: + case REP82_ERROR_INVALID_DOMAIN_PENDING: ++ case REP82_ERROR_INVALID_SPECIAL_CMD: + // REP88_ERROR_INVALID_KEY // '82' CEX2A + // REP88_ERROR_OPERAND // '84' CEX2A + // REP88_ERROR_OPERAND_EVEN_MOD // '85' CEX2A +-- +2.19.1 + diff --git a/queue-4.20/sata_rcar-fix-deferred-probing.patch b/queue-4.20/sata_rcar-fix-deferred-probing.patch new file mode 100644 index 00000000000..98c7c8c26bd --- /dev/null +++ b/queue-4.20/sata_rcar-fix-deferred-probing.patch @@ -0,0 +1,41 @@ +From 883492062be60933ab057e72a1ca29e3e85bff70 Mon Sep 17 00:00:00 2001 +From: Sergei Shtylyov +Date: Sat, 24 Nov 2018 21:14:16 +0300 +Subject: sata_rcar: fix deferred probing + +[ Upstream commit 9f83cfdb1ace3ef268ecc6fda50058d2ec37d603 ] + +The driver overrides the error codes returned by platform_get_irq() to +-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Switch to propagating the +error code upstream, still checking/overriding IRQ0 as libata regards it +as "no IRQ" (thus polling) anyway... + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Reviewed-by: Simon Horman +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Sergei Shtylyov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_rcar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c +index 4b1ff5bc256a..59b2317acea9 100644 +--- a/drivers/ata/sata_rcar.c ++++ b/drivers/ata/sata_rcar.c +@@ -891,7 +891,9 @@ static int sata_rcar_probe(struct platform_device *pdev) + int ret = 0; + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) ++ if (irq < 0) ++ return irq; ++ if (!irq) + return -EINVAL; + + priv = devm_kzalloc(dev, sizeof(struct sata_rcar_priv), GFP_KERNEL); +-- +2.19.1 + diff --git a/queue-4.20/scripts-decode_stacktrace-only-strip-base-path-when-.patch b/queue-4.20/scripts-decode_stacktrace-only-strip-base-path-when-.patch new file mode 100644 index 00000000000..e4d8c8ca6a6 --- /dev/null +++ b/queue-4.20/scripts-decode_stacktrace-only-strip-base-path-when-.patch @@ -0,0 +1,48 @@ +From f2fdf572e23ce70de42bf76ab44e748df1cf18c9 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Fri, 28 Dec 2018 00:31:25 -0800 +Subject: scripts/decode_stacktrace: only strip base path when a prefix of the + path + +[ Upstream commit 67a28de47faa83585dd644bd4c31e5a1d9346c50 ] + +Running something like: + + decodecode vmlinux . + +leads to interested results where not only the leading "." gets stripped +from the displayed paths, but also anywhere in the string, displaying +something like: + + kvm_vcpu_check_block (arch/arm64/kvm/virt/kvm/kvm_mainc:2141) + +which doesn't help further processing. + +Fix it by only stripping the base path if it is a prefix of the path. + +Link: http://lkml.kernel.org/r/20181210174659.31054-3-marc.zyngier@arm.com +Signed-off-by: Marc Zyngier +Cc: Will Deacon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/decode_stacktrace.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/decode_stacktrace.sh b/scripts/decode_stacktrace.sh +index 64220e36ce3b..98a7d63a723e 100755 +--- a/scripts/decode_stacktrace.sh ++++ b/scripts/decode_stacktrace.sh +@@ -78,7 +78,7 @@ parse_symbol() { + fi + + # Strip out the base of the path +- code=${code//$basepath/""} ++ code=${code//^$basepath/""} + + # In the case of inlines, move everything to same line + code=${code//$'\n'/' '} +-- +2.19.1 + diff --git a/queue-4.20/scripts-gdb-fix-lx-version-string-output.patch b/queue-4.20/scripts-gdb-fix-lx-version-string-output.patch new file mode 100644 index 00000000000..fe4ee9dd2b5 --- /dev/null +++ b/queue-4.20/scripts-gdb-fix-lx-version-string-output.patch @@ -0,0 +1,56 @@ +From 9b575ab4ad83c449411d74490afdbe623c47f083 Mon Sep 17 00:00:00 2001 +From: Du Changbin +Date: Thu, 3 Jan 2019 15:28:27 -0800 +Subject: scripts/gdb: fix lx-version string output + +[ Upstream commit b058809bfc8faeb7b7cae047666e23375a060059 ] + +A bug is present in GDB which causes early string termination when +parsing variables. This has been reported [0], but we should ensure +that we can support at least basic printing of the core kernel strings. + +For current gdb version (has been tested with 7.3 and 8.1), 'lx-version' +only prints one character. + + (gdb) lx-version + L(gdb) + +This can be fixed by casting 'linux_banner' as (char *). + + (gdb) lx-version + Linux version 4.19.0-rc1+ (changbin@acer) (gcc version 7.3.0 (Ubuntu 7.3.0-16ubuntu3)) #21 SMP Sat Sep 1 21:43:30 CST 2018 + +[0] https://sourceware.org/bugzilla/show_bug.cgi?id=20077 + +[kbingham@kernel.org: add detail to commit message] +Link: http://lkml.kernel.org/r/20181111162035.8356-1-kieran.bingham@ideasonboard.com +Fixes: 2d061d999424 ("scripts/gdb: add version command") +Signed-off-by: Du Changbin +Signed-off-by: Kieran Bingham +Acked-by: Jan Kiszka +Cc: Jan Kiszka +Cc: Jason Wessel +Cc: Daniel Thompson +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/proc.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/proc.py b/scripts/gdb/linux/proc.py +index 086d27223c0c..0aebd7565b03 100644 +--- a/scripts/gdb/linux/proc.py ++++ b/scripts/gdb/linux/proc.py +@@ -41,7 +41,7 @@ class LxVersion(gdb.Command): + + def invoke(self, arg, from_tty): + # linux_banner should contain a newline +- gdb.write(gdb.parse_and_eval("linux_banner").string()) ++ gdb.write(gdb.parse_and_eval("(char *)linux_banner").string()) + + LxVersion() + +-- +2.19.1 + diff --git a/queue-4.20/scsi-cxgb4i-fix-thermal-configuration-dependencies.patch b/queue-4.20/scsi-cxgb4i-fix-thermal-configuration-dependencies.patch new file mode 100644 index 00000000000..0d975f86350 --- /dev/null +++ b/queue-4.20/scsi-cxgb4i-fix-thermal-configuration-dependencies.patch @@ -0,0 +1,54 @@ +From 6ab67ec79dffd0eb82a9b15d5edc1ddd79bb16a4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 2 Nov 2018 16:35:23 +0100 +Subject: scsi: cxgb4i: fix thermal configuration dependencies + +[ Upstream commit 8d0bb86e2cf6c96d88c3de56a2a29329872c454d ] + +I fixed a bug by adding a dependency in the network driver, but that fix +caused a related bug in the SCSI driver: + +WARNING: unmet direct dependencies detected for CHELSIO_T4 + Depends on [m]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_CHELSIO [=y] && PCI [=y] && (IPV6 [=y] || IPV6 [=y]=n) && (THERMAL [=m] || !THERMAL [=m]) + Selected by [y]: + - SCSI_CXGB4_ISCSI [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && INET [=y] && (IPV6 [=y] || IPV6 [=y]=n) +drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function `cxgb4_thermal_init': +cxgb4_thermal.c:(.text+0x158): undefined reference to `thermal_zone_device_register' +drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function `cxgb4_thermal_remove': +cxgb4_thermal.c:(.text+0x1d8): undefined reference to `thermal_zone_device_unregister' +/git/arm-soc/Makefile:1042: recipe for target 'vmlinux' failed + +The same dependency needs to be propagated here to make it work correctly +with CONFIG_THERMAL=m and SCSI_CXGB4_ISCSI=y. That change by itself causes +another problem with a circular dependency, as we use 'select NETDEVICES'. +This is something we really should not do anyway, as a driver symbol should +never select another major subsystem, so let's turn that into a 'depends +on'. I don't see any downsides of that, as NETDEVICES is only disabled in +rather obscure cases that are not relevant to the users of cxgb4i. + +Fixes: e70a57fa59bb ("cxgb4: fix thermal configuration dependencies") +Signed-off-by: Arnd Bergmann +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/cxgbi/cxgb4i/Kconfig | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/cxgbi/cxgb4i/Kconfig b/drivers/scsi/cxgbi/cxgb4i/Kconfig +index 594f593c8821..f36b76e8e12c 100644 +--- a/drivers/scsi/cxgbi/cxgb4i/Kconfig ++++ b/drivers/scsi/cxgbi/cxgb4i/Kconfig +@@ -1,8 +1,8 @@ + config SCSI_CXGB4_ISCSI + tristate "Chelsio T4 iSCSI support" + depends on PCI && INET && (IPV6 || IPV6=n) +- select NETDEVICES +- select ETHERNET ++ depends on THERMAL || !THERMAL ++ depends on ETHERNET + select NET_VENDOR_CHELSIO + select CHELSIO_T4 + select CHELSIO_LIB +-- +2.19.1 + diff --git a/queue-4.20/scsi-hisi_sas-change-the-time-of-sas-ssp-connection.patch b/queue-4.20/scsi-hisi_sas-change-the-time-of-sas-ssp-connection.patch new file mode 100644 index 00000000000..68fb8f69f62 --- /dev/null +++ b/queue-4.20/scsi-hisi_sas-change-the-time-of-sas-ssp-connection.patch @@ -0,0 +1,37 @@ +From ac449754f3f33567e14f5810e10d9e7b9cd3ca8d Mon Sep 17 00:00:00 2001 +From: Xiang Chen +Date: Fri, 9 Nov 2018 22:06:36 +0800 +Subject: scsi: hisi_sas: change the time of SAS SSP connection + +[ Upstream commit 15bc43f31a074076f114e0b87931e3b220b7bff1 ] + +Currently the time of SAS SSP connection is 1ms, which means the link +connection will fail if no IO response after this period. + +For some disks handling large IO (such as 512k), 1ms is not enough, so +change it to 5ms. + +Signed-off-by: Xiang Chen +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index a369450a1fa7..c3e0be90e19f 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -494,7 +494,7 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba) + hisi_sas_phy_write32(hisi_hba, i, PHYCTRL_OOB_RESTART_MSK, 0x1); + hisi_sas_phy_write32(hisi_hba, i, STP_LINK_TIMER, 0x7f7a120); + hisi_sas_phy_write32(hisi_hba, i, CON_CFG_DRIVER, 0x2a0a01); +- ++ hisi_sas_phy_write32(hisi_hba, i, SAS_SSP_CON_TIMER_CFG, 0x32); + /* used for 12G negotiate */ + hisi_sas_phy_write32(hisi_hba, i, COARSETUNE_TIME, 0x1e); + hisi_sas_phy_write32(hisi_hba, i, AIP_LIMIT, 0x2ffff); +-- +2.19.1 + diff --git a/queue-4.20/scsi-lpfc-correct-lcb-rjt-handling.patch b/queue-4.20/scsi-lpfc-correct-lcb-rjt-handling.patch new file mode 100644 index 00000000000..02e567b6270 --- /dev/null +++ b/queue-4.20/scsi-lpfc-correct-lcb-rjt-handling.patch @@ -0,0 +1,37 @@ +From d39ccd324d0935bc1ecabe0dbdf3d1f54dee8dd4 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Tue, 23 Oct 2018 13:41:07 -0700 +Subject: scsi: lpfc: Correct LCB RJT handling + +[ Upstream commit b114d9009d386276bfc3352289fc235781ae3353 ] + +When LCB's are rejected, if beaconing was already in progress, the +Reason Code Explanation was not being set. Should have been set to +command in progress. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index f1c1faa74b46..96e2f542734a 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -5701,6 +5701,9 @@ error: + stat = (struct ls_rjt *)(pcmd + sizeof(uint32_t)); + stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC; + ++ if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE) ++ stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS; ++ + elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp; + phba->fc_stat.elsXmitLSRJT++; + rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); +-- +2.19.1 + diff --git a/queue-4.20/scsi-lpfc-fix-logo-plogi-handling-when-triggerd-by-a.patch b/queue-4.20/scsi-lpfc-fix-logo-plogi-handling-when-triggerd-by-a.patch new file mode 100644 index 00000000000..f889516fc80 --- /dev/null +++ b/queue-4.20/scsi-lpfc-fix-logo-plogi-handling-when-triggerd-by-a.patch @@ -0,0 +1,189 @@ +From 374646f72764071a03c24428684ec7a543455717 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Tue, 23 Oct 2018 13:41:03 -0700 +Subject: scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout + event + +[ Upstream commit 30e196cacefdd9a38c857caed23cefc9621bc5c1 ] + +After a LOGO in response to an ABTS timeout, a PLOGI wasn't issued to +re-establish the login. An nlp_type check in the LOGO completion +handler failed to restart discovery for NVME targets. Revised the +nlp_type check for NVME as well as SCSI. + +While reviewing the LOGO handling a few other issues were seen and +were addressed: + +- Better lock synchronization around ndlp data types + +- When the ABTS times out, unregister the RPI before sending the LOGO + so that all local exchange contexts are cleared and nothing received + while awaiting LOGO/PLOGI handling will be accepted. + +- LOGO handling optimized to: + Wait only R_A_TOV for a response. + It doesn't need to be retried on timeout. If there wasn't a + response, a PLOGI will be sent, thus an implicit logout + applies as well when the other port sees it. + If there is a response, any kind of response is considered "good" + and the XRI quarantined for a exchange qualifier window. + +- PLOGI is issued as soon a LOGO state is resolved. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 49 +++++++++++++----------------- + drivers/scsi/lpfc/lpfc_nportdisc.c | 5 +++ + 2 files changed, 26 insertions(+), 28 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 96e2f542734a..c2dae02f193e 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -242,6 +242,8 @@ lpfc_prep_els_iocb(struct lpfc_vport *vport, uint8_t expectRsp, + icmd->ulpCommand = CMD_ELS_REQUEST64_CR; + if (elscmd == ELS_CMD_FLOGI) + icmd->ulpTimeout = FF_DEF_RATOV * 2; ++ else if (elscmd == ELS_CMD_LOGO) ++ icmd->ulpTimeout = phba->fc_ratov; + else + icmd->ulpTimeout = phba->fc_ratov * 2; + } else { +@@ -2682,16 +2684,15 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + goto out; + } + ++ /* The LOGO will not be retried on failure. A LOGO was ++ * issued to the remote rport and a ACC or RJT or no Answer are ++ * all acceptable. Note the failure and move forward with ++ * discovery. The PLOGI will retry. ++ */ + if (irsp->ulpStatus) { +- /* Check for retry */ +- if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { +- /* ELS command is being retried */ +- skip_recovery = 1; +- goto out; +- } + /* LOGO failed */ + lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, +- "2756 LOGO failure DID:%06X Status:x%x/x%x\n", ++ "2756 LOGO failure, No Retry DID:%06X Status:x%x/x%x\n", + ndlp->nlp_DID, irsp->ulpStatus, + irsp->un.ulpWord[4]); + /* Do not call DSM for lpfc_els_abort'ed ELS cmds */ +@@ -2737,7 +2738,8 @@ out: + * For any other port type, the rpi is unregistered as an implicit + * LOGO. + */ +- if ((ndlp->nlp_type & NLP_FCP_TARGET) && (skip_recovery == 0)) { ++ if (ndlp->nlp_type & (NLP_FCP_TARGET | NLP_NVME_TARGET) && ++ skip_recovery == 0) { + lpfc_cancel_retry_delay_tmo(vport, ndlp); + spin_lock_irqsave(shost->host_lock, flags); + ndlp->nlp_flag |= NLP_NPR_2B_DISC; +@@ -2770,6 +2772,8 @@ out: + * will be stored into the context1 field of the IOCB for the completion + * callback function to the LOGO ELS command. + * ++ * Callers of this routine are expected to unregister the RPI first ++ * + * Return code + * 0 - successfully issued logo + * 1 - failed to issue logo +@@ -2811,22 +2815,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + "Issue LOGO: did:x%x", + ndlp->nlp_DID, 0, 0); + +- /* +- * If we are issuing a LOGO, we may try to recover the remote NPort +- * by issuing a PLOGI later. Even though we issue ELS cmds by the +- * VPI, if we have a valid RPI, and that RPI gets unreg'ed while +- * that ELS command is in-flight, the HBA returns a IOERR_INVALID_RPI +- * for that ELS cmd. To avoid this situation, lets get rid of the +- * RPI right now, before any ELS cmds are sent. +- */ +- spin_lock_irq(shost->host_lock); +- ndlp->nlp_flag |= NLP_ISSUE_LOGO; +- spin_unlock_irq(shost->host_lock); +- if (lpfc_unreg_rpi(vport, ndlp)) { +- lpfc_els_free_iocb(phba, elsiocb); +- return 0; +- } +- + phba->fc_stat.elsXmitLOGO++; + elsiocb->iocb_cmpl = lpfc_cmpl_els_logo; + spin_lock_irq(shost->host_lock); +@@ -2834,7 +2822,6 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + ndlp->nlp_flag &= ~NLP_ISSUE_LOGO; + spin_unlock_irq(shost->host_lock); + rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); +- + if (rc == IOCB_ERROR) { + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~NLP_LOGO_SND; +@@ -2842,6 +2829,11 @@ lpfc_issue_els_logo(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + lpfc_els_free_iocb(phba, elsiocb); + return 1; + } ++ ++ spin_lock_irq(shost->host_lock); ++ ndlp->nlp_prev_state = ndlp->nlp_state; ++ spin_unlock_irq(shost->host_lock); ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE); + return 0; + } + +@@ -9508,7 +9500,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport, + "rport in state 0x%x\n", ndlp->nlp_state); + return; + } +- lpfc_printf_log(phba, KERN_INFO, LOG_SLI, ++ lpfc_printf_log(phba, KERN_ERR, ++ LOG_ELS | LOG_FCP_ERROR | LOG_NVME_IOERR, + "3094 Start rport recovery on shost id 0x%x " + "fc_id 0x%06x vpi 0x%x rpi 0x%x state 0x%x " + "flags 0x%x\n", +@@ -9521,8 +9514,8 @@ lpfc_sli_abts_recover_port(struct lpfc_vport *vport, + */ + spin_lock_irqsave(shost->host_lock, flags); + ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ ndlp->nlp_flag |= NLP_ISSUE_LOGO; + spin_unlock_irqrestore(shost->host_lock, flags); +- lpfc_issue_els_logo(vport, ndlp, 0); +- lpfc_nlp_set_state(vport, ndlp, NLP_STE_LOGO_ISSUE); ++ lpfc_unreg_rpi(vport, ndlp); + } + +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index 269808e8480f..394ffbe9cb6d 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -836,7 +836,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + struct Scsi_Host *shost = lpfc_shost_from_vport(vport); + + if (!(ndlp->nlp_flag & NLP_RPI_REGISTERED)) { ++ spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~NLP_NPR_ADISC; ++ spin_unlock_irq(shost->host_lock); + return 0; + } + +@@ -851,7 +853,10 @@ lpfc_disc_set_adisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) + return 1; + } + } ++ ++ spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~NLP_NPR_ADISC; ++ spin_unlock_irq(shost->host_lock); + lpfc_unreg_rpi(vport, ndlp); + return 0; + } +-- +2.19.1 + diff --git a/queue-4.20/scsi-mpt3sas-call-sas_remove_host-before-removing-th.patch b/queue-4.20/scsi-mpt3sas-call-sas_remove_host-before-removing-th.patch new file mode 100644 index 00000000000..cbd8e3fb289 --- /dev/null +++ b/queue-4.20/scsi-mpt3sas-call-sas_remove_host-before-removing-th.patch @@ -0,0 +1,72 @@ +From 313e89a8a216f7bba2c577ec82d98307a6b26d58 Mon Sep 17 00:00:00 2001 +From: Suganath Prabu +Date: Wed, 31 Oct 2018 18:53:35 +0530 +Subject: scsi: mpt3sas: Call sas_remove_host before removing the target + devices + +[ Upstream commit dc730212e8a378763cb182b889f90c8101331332 ] + +Call sas_remove_host() before removing the target devices in the driver's +.remove() callback function(i.e. during driver unload time). So that +driver can provide a way to allow SYNC CACHE, START STOP unit commands +etc. (which are issued from SML) to the target drives during driver unload +time. + +Once sas_remove_host() is called before removing the target drives then +driver can just clean up the resources allocated for target devices and no +need to call sas_port_delete_phy(), sas_port_delete() API's as these API's +internally called from sas_remove_host(). + +Signed-off-by: Suganath Prabu +Reviewed-by: Bjorn Helgaas +Reviewed-by: Andy Shevchenko +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- + drivers/scsi/mpt3sas/mpt3sas_transport.c | 7 +++++-- + 2 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 03c52847ed07..adac18ba84d4 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -9641,6 +9641,7 @@ static void scsih_remove(struct pci_dev *pdev) + + /* release all the volumes */ + _scsih_ir_shutdown(ioc); ++ sas_remove_host(shost); + list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list, + list) { + if (raid_device->starget) { +@@ -9682,7 +9683,6 @@ static void scsih_remove(struct pci_dev *pdev) + ioc->sas_hba.num_phys = 0; + } + +- sas_remove_host(shost); + mpt3sas_base_detach(ioc); + spin_lock(&gioc_lock); + list_del(&ioc->list); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_transport.c b/drivers/scsi/mpt3sas/mpt3sas_transport.c +index 6a8a3c09b4b1..8338b4db0e31 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_transport.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_transport.c +@@ -821,10 +821,13 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address, + mpt3sas_port->remote_identify.sas_address, + mpt3sas_phy->phy_id); + mpt3sas_phy->phy_belongs_to_port = 0; +- sas_port_delete_phy(mpt3sas_port->port, mpt3sas_phy->phy); ++ if (!ioc->remove_host) ++ sas_port_delete_phy(mpt3sas_port->port, ++ mpt3sas_phy->phy); + list_del(&mpt3sas_phy->port_siblings); + } +- sas_port_delete(mpt3sas_port->port); ++ if (!ioc->remove_host) ++ sas_port_delete(mpt3sas_port->port); + kfree(mpt3sas_port); + } + +-- +2.19.1 + diff --git a/queue-4.20/scsi-smartpqi-correct-host-serial-num-for-ssa.patch b/queue-4.20/scsi-smartpqi-correct-host-serial-num-for-ssa.patch new file mode 100644 index 00000000000..e0c751c1334 --- /dev/null +++ b/queue-4.20/scsi-smartpqi-correct-host-serial-num-for-ssa.patch @@ -0,0 +1,46 @@ +From 4194f7af0c96beb7a74acba655232b7442caa048 Mon Sep 17 00:00:00 2001 +From: Mahesh Rajashekhara +Date: Fri, 7 Dec 2018 16:28:29 -0600 +Subject: scsi: smartpqi: correct host serial num for ssa + +[ Upstream commit b2346b5030cf9458f30a84028d9fe904b8c942a7 ] + +Reviewed-by: Scott Benesh +Reviewed-by: Ajish Koshy +Reviewed-by: Murthy Bhat +Reviewed-by: Mahesh Rajashekhara +Reviewed-by: Dave Carroll +Reviewed-by: Scott Teel +Reviewed-by: Kevin Barnett +Signed-off-by: Mahesh Rajashekhara +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 6f4cb3be97aa..5a86dddbd8ba 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -640,6 +640,7 @@ struct bmic_host_wellness_driver_version { + u8 driver_version_tag[2]; + __le16 driver_version_length; + char driver_version[32]; ++ u8 dont_write_tag[2]; + u8 end_tag[2]; + }; + +@@ -669,6 +670,8 @@ static int pqi_write_driver_version_to_host_wellness( + strncpy(buffer->driver_version, "Linux " DRIVER_VERSION, + sizeof(buffer->driver_version) - 1); + buffer->driver_version[sizeof(buffer->driver_version) - 1] = '\0'; ++ buffer->dont_write_tag[0] = 'D'; ++ buffer->dont_write_tag[1] = 'W'; + buffer->end_tag[0] = 'Z'; + buffer->end_tag[1] = 'Z'; + +-- +2.19.1 + diff --git a/queue-4.20/scsi-smartpqi-correct-volume-status.patch b/queue-4.20/scsi-smartpqi-correct-volume-status.patch new file mode 100644 index 00000000000..956a1a67234 --- /dev/null +++ b/queue-4.20/scsi-smartpqi-correct-volume-status.patch @@ -0,0 +1,43 @@ +From 039576e87cd3b3b8ab52cd59e21768252e47ace3 Mon Sep 17 00:00:00 2001 +From: Dave Carroll +Date: Fri, 7 Dec 2018 16:29:45 -0600 +Subject: scsi: smartpqi: correct volume status + +[ Upstream commit 7ff44499bafbd376115f0bb6b578d980f56ee13b ] + +- fix race condition when a unit is deleted after an RLL, + and before we have gotten the LV_STATUS page of the unit. + - In this case we will get a standard inquiry, rather than + the desired page. This will result in a unit presented + which no longer exists. + - If we ask for LV_STATUS, insure we get LV_STATUS + +Reviewed-by: Murthy Bhat +Reviewed-by: Mahesh Rajashekhara +Reviewed-by: Scott Teel +Reviewed-by: Kevin Barnett +Signed-off-by: Dave Carroll +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_init.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index 5a86dddbd8ba..489e5cbbcbba 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -1168,6 +1168,9 @@ static void pqi_get_volume_status(struct pqi_ctrl_info *ctrl_info, + if (rc) + goto out; + ++ if (vpd->page_code != CISS_VPD_LV_STATUS) ++ goto out; ++ + page_length = offsetof(struct ciss_vpd_logical_volume_status, + volume_status) + vpd->page_length; + if (page_length < sizeof(*vpd)) +-- +2.19.1 + diff --git a/queue-4.20/scsi-smartpqi-increase-fw-status-register-read-timeo.patch b/queue-4.20/scsi-smartpqi-increase-fw-status-register-read-timeo.patch new file mode 100644 index 00000000000..3317ae10a9a --- /dev/null +++ b/queue-4.20/scsi-smartpqi-increase-fw-status-register-read-timeo.patch @@ -0,0 +1,46 @@ +From d9dd75b548f00699617dbd77ab1d5bbb2a0156ec Mon Sep 17 00:00:00 2001 +From: Mahesh Rajashekhara +Date: Tue, 18 Dec 2018 17:39:01 -0600 +Subject: scsi: smartpqi: increase fw status register read timeout + +[ Upstream commit 65111785acccb836ec75263b03b0e33f21e74f47 ] + +Problem: + - during the driver initialization, driver will poll fw + for KERNEL_UP in a 30 seconds timeout. + + - if the firmware is not ready after 30 seconds, + driver will not be loaded. + +Fix: + - change timeout from 30 seconds to 3 minutes. + +Reported-by: Feng Li +Reviewed-by: Ajish Koshy +Reviewed-by: Murthy Bhat +Reviewed-by: Dave Carroll +Reviewed-by: Kevin Barnett +Signed-off-by: Mahesh Rajashekhara +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi_sis.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi_sis.c b/drivers/scsi/smartpqi/smartpqi_sis.c +index ea91658c7060..9d3043df22af 100644 +--- a/drivers/scsi/smartpqi/smartpqi_sis.c ++++ b/drivers/scsi/smartpqi/smartpqi_sis.c +@@ -59,7 +59,7 @@ + + #define SIS_CTRL_KERNEL_UP 0x80 + #define SIS_CTRL_KERNEL_PANIC 0x100 +-#define SIS_CTRL_READY_TIMEOUT_SECS 30 ++#define SIS_CTRL_READY_TIMEOUT_SECS 180 + #define SIS_CTRL_READY_RESUME_TIMEOUT_SECS 90 + #define SIS_CTRL_READY_POLL_INTERVAL_MSECS 10 + +-- +2.19.1 + diff --git a/queue-4.20/selftests-bpf-use-__bpf_constant_htons-in-test_prog..patch b/queue-4.20/selftests-bpf-use-__bpf_constant_htons-in-test_prog..patch new file mode 100644 index 00000000000..0d357fde25c --- /dev/null +++ b/queue-4.20/selftests-bpf-use-__bpf_constant_htons-in-test_prog..patch @@ -0,0 +1,58 @@ +From 86ed064e6e2d6f70897938ab1beb12fdd007c36f Mon Sep 17 00:00:00 2001 +From: Stanislav Fomichev +Date: Tue, 11 Dec 2018 19:20:52 -0800 +Subject: selftests/bpf: use __bpf_constant_htons in test_prog.c + +[ Upstream commit a0517a0f7ef23550b4484c37e2b9c2d32abebf64 ] + +For some reason, my older GCC (< 4.8) isn't smart enough to optimize the +!__builtin_constant_p() branch in bpf_htons, I see: + error: implicit declaration of function '__builtin_bswap16' + +Let's use __bpf_constant_htons as suggested by Daniel Borkmann. + +I tried to use simple htons, but it produces the following: + test_progs.c:54:17: error: braced-group within expression allowed only + inside a function + .eth.h_proto = htons(ETH_P_IP), + +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_progs.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index 2d3c04f45530..6ac7232b0fde 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -51,10 +51,10 @@ static struct { + struct iphdr iph; + struct tcphdr tcp; + } __packed pkt_v4 = { +- .eth.h_proto = bpf_htons(ETH_P_IP), ++ .eth.h_proto = __bpf_constant_htons(ETH_P_IP), + .iph.ihl = 5, + .iph.protocol = 6, +- .iph.tot_len = bpf_htons(MAGIC_BYTES), ++ .iph.tot_len = __bpf_constant_htons(MAGIC_BYTES), + .tcp.urg_ptr = 123, + }; + +@@ -64,9 +64,9 @@ static struct { + struct ipv6hdr iph; + struct tcphdr tcp; + } __packed pkt_v6 = { +- .eth.h_proto = bpf_htons(ETH_P_IPV6), ++ .eth.h_proto = __bpf_constant_htons(ETH_P_IPV6), + .iph.nexthdr = 6, +- .iph.payload_len = bpf_htons(MAGIC_BYTES), ++ .iph.payload_len = __bpf_constant_htons(MAGIC_BYTES), + .tcp.urg_ptr = 123, + }; + +-- +2.19.1 + diff --git a/queue-4.20/selftests-kvm-report-failed-stage-when-exit-reason-i.patch b/queue-4.20/selftests-kvm-report-failed-stage-when-exit-reason-i.patch new file mode 100644 index 00000000000..b85cfc555ae --- /dev/null +++ b/queue-4.20/selftests-kvm-report-failed-stage-when-exit-reason-i.patch @@ -0,0 +1,63 @@ +From 0ca8c2b3796a28f5cb5ea817cc835f92cfd5dc70 Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Wed, 19 Dec 2018 12:15:18 +0100 +Subject: selftests: kvm: report failed stage when exit reason is unexpected +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit b85c32dd27495075380350fcd5d614a6b45311b8 ] + +When we get a report like + +==== Test Assertion Failure ==== + x86_64/state_test.c:157: run->exit_reason == KVM_EXIT_IO + pid=955 tid=955 - Success + 1 0x0000000000401350: main at state_test.c:154 + 2 0x00007fc31c9e9412: ?? ??:0 + 3 0x000000000040159d: _start at ??:? + Unexpected exit reason: 8 (SHUTDOWN), + +it is not obvious which particular stage failed. Add the info. + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/x86_64/evmcs_test.c | 4 ++-- + tools/testing/selftests/kvm/x86_64/state_test.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/kvm/x86_64/evmcs_test.c b/tools/testing/selftests/kvm/x86_64/evmcs_test.c +index 92c2cfd1b182..ea3c73e8f4f6 100644 +--- a/tools/testing/selftests/kvm/x86_64/evmcs_test.c ++++ b/tools/testing/selftests/kvm/x86_64/evmcs_test.c +@@ -113,8 +113,8 @@ int main(int argc, char *argv[]) + for (stage = 1;; stage++) { + _vcpu_run(vm, VCPU_ID); + TEST_ASSERT(run->exit_reason == KVM_EXIT_IO, +- "Unexpected exit reason: %u (%s),\n", +- run->exit_reason, ++ "Stage %d: unexpected exit reason: %u (%s),\n", ++ stage, run->exit_reason, + exit_reason_str(run->exit_reason)); + + memset(®s1, 0, sizeof(regs1)); +diff --git a/tools/testing/selftests/kvm/x86_64/state_test.c b/tools/testing/selftests/kvm/x86_64/state_test.c +index 03da41f0f736..4b3f556265f1 100644 +--- a/tools/testing/selftests/kvm/x86_64/state_test.c ++++ b/tools/testing/selftests/kvm/x86_64/state_test.c +@@ -152,8 +152,8 @@ int main(int argc, char *argv[]) + for (stage = 1;; stage++) { + _vcpu_run(vm, VCPU_ID); + TEST_ASSERT(run->exit_reason == KVM_EXIT_IO, +- "Unexpected exit reason: %u (%s),\n", +- run->exit_reason, ++ "Stage %d: unexpected exit reason: %u (%s),\n", ++ stage, run->exit_reason, + exit_reason_str(run->exit_reason)); + + memset(®s1, 0, sizeof(regs1)); +-- +2.19.1 + diff --git a/queue-4.20/seq_buf-make-seq_buf_puts-null-terminate-the-buffer.patch b/queue-4.20/seq_buf-make-seq_buf_puts-null-terminate-the-buffer.patch new file mode 100644 index 00000000000..3d166231f27 --- /dev/null +++ b/queue-4.20/seq_buf-make-seq_buf_puts-null-terminate-the-buffer.patch @@ -0,0 +1,69 @@ +From 5fd82504806ac1c979da924bc409304fe53567ae Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Fri, 19 Oct 2018 15:21:08 +1100 +Subject: seq_buf: Make seq_buf_puts() null-terminate the buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 0464ed24380905d640030d368cd84a4e4d1e15e2 ] + +Currently seq_buf_puts() will happily create a non null-terminated +string for you in the buffer. This is particularly dangerous if the +buffer is on the stack. + +For example: + + char buf[8]; + char secret = "secret"; + struct seq_buf s; + + seq_buf_init(&s, buf, sizeof(buf)); + seq_buf_puts(&s, "foo"); + printk("Message is %s\n", buf); + +Can result in: + + Message is fooªªªªªsecret + +We could require all users to memset() their buffer to zero before +use. But that seems likely to be forgotten and lead to bugs. + +Instead we can change seq_buf_puts() to always leave the buffer in a +null-terminated state. + +The only downside is that this makes the buffer 1 character smaller +for seq_buf_puts(), but that seems like a good trade off. + +Link: http://lkml.kernel.org/r/20181019042109.8064-1-mpe@ellerman.id.au + +Acked-by: Kees Cook +Signed-off-by: Michael Ellerman +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + lib/seq_buf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/lib/seq_buf.c b/lib/seq_buf.c +index 11f2ae0f9099..6aabb609dd87 100644 +--- a/lib/seq_buf.c ++++ b/lib/seq_buf.c +@@ -144,9 +144,13 @@ int seq_buf_puts(struct seq_buf *s, const char *str) + + WARN_ON(s->size == 0); + ++ /* Add 1 to len for the trailing null byte which must be there */ ++ len += 1; ++ + if (seq_buf_can_fit(s, len)) { + memcpy(s->buffer + s->len, str, len); +- s->len += len; ++ /* Don't count the trailing null byte against the capacity */ ++ s->len += len - 1; + return 0; + } + seq_buf_set_overflow(s); +-- +2.19.1 + diff --git a/queue-4.20/serial-fsl_lpuart-clear-parity-enable-bit-when-disab.patch b/queue-4.20/serial-fsl_lpuart-clear-parity-enable-bit-when-disab.patch new file mode 100644 index 00000000000..72a7049bb14 --- /dev/null +++ b/queue-4.20/serial-fsl_lpuart-clear-parity-enable-bit-when-disab.patch @@ -0,0 +1,49 @@ +From 81847bef5169d84fc09731fcd0333ae8677fe307 Mon Sep 17 00:00:00 2001 +From: Andy Duan +Date: Tue, 16 Oct 2018 07:32:22 +0000 +Subject: serial: fsl_lpuart: clear parity enable bit when disable parity +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 397bd9211fe014b347ca8f95a8f4e1017bac1aeb ] + +Current driver only enable parity enable bit and never clear it +when user set the termios. The fix clear the parity enable bit when +PARENB flag is not set in termios->c_cflag. + +Cc: Lukas Wunner +Signed-off-by: Andy Duan +Reviewed-by: Fabio Estevam +Acked-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 00c220e4f43c..086642ea4b26 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1479,6 +1479,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios, + else + cr1 &= ~UARTCR1_PT; + } ++ } else { ++ cr1 &= ~UARTCR1_PE; + } + + /* ask the core to calculate the divisor */ +@@ -1690,6 +1692,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + else + ctrl &= ~UARTCTRL_PT; + } ++ } else { ++ ctrl &= ~UARTCTRL_PE; + } + + /* ask the core to calculate the divisor */ +-- +2.19.1 + diff --git a/queue-4.20/serial-sh-sci-fix-locking-in-sci_submit_rx.patch b/queue-4.20/serial-sh-sci-fix-locking-in-sci_submit_rx.patch new file mode 100644 index 00000000000..7eea79fea6d --- /dev/null +++ b/queue-4.20/serial-sh-sci-fix-locking-in-sci_submit_rx.patch @@ -0,0 +1,93 @@ +From 239a5e3656738dca1a7c919a2e962fced8eda066 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 13 Dec 2018 19:44:41 +0100 +Subject: serial: sh-sci: Fix locking in sci_submit_rx() + +[ Upstream commit dd1f2250da95e87cb3e612858f94b14f99445a7c ] + +Some callers of sci_submit_rx() hold the port spinlock, others don't. +During fallback to PIO, the driver needs to obtain the port spinlock. +If the lock was already held, spinlock recursion is detected, causing a +deadlock: BUG: spinlock recursion on CPU#0. + +Fix this by adding a flag parameter to sci_submit_rx() for the caller to +indicate the port spinlock is already held, so spinlock recursion can be +avoided. + +Move the spin_lock_irqsave() up, so all DMA disable steps are protected, +which is safe as the recently introduced dmaengine_terminate_async() can +be called in atomic context. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index cc56cb3b3eca..613007d7165e 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1331,7 +1331,7 @@ static void sci_tx_dma_release(struct sci_port *s) + dma_release_channel(chan); + } + +-static void sci_submit_rx(struct sci_port *s) ++static void sci_submit_rx(struct sci_port *s, bool port_lock_held) + { + struct dma_chan *chan = s->chan_rx; + struct uart_port *port = &s->port; +@@ -1362,16 +1362,18 @@ static void sci_submit_rx(struct sci_port *s) + return; + + fail: ++ /* Switch to PIO */ ++ if (!port_lock_held) ++ spin_lock_irqsave(&port->lock, flags); + if (i) + dmaengine_terminate_async(chan); + for (i = 0; i < 2; i++) + s->cookie_rx[i] = -EINVAL; + s->active_rx = -EINVAL; +- /* Switch to PIO */ +- spin_lock_irqsave(&port->lock, flags); + s->chan_rx = NULL; + sci_start_rx(port); +- spin_unlock_irqrestore(&port->lock, flags); ++ if (!port_lock_held) ++ spin_unlock_irqrestore(&port->lock, flags); + } + + static void work_fn_tx(struct work_struct *work) +@@ -1491,7 +1493,7 @@ static enum hrtimer_restart rx_timer_fn(struct hrtimer *t) + } + + if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) +- sci_submit_rx(s); ++ sci_submit_rx(s, true); + + /* Direct new serial port interrupts back to CPU */ + scr = serial_port_in(port, SCSCR); +@@ -1617,7 +1619,7 @@ static void sci_request_dma(struct uart_port *port) + s->chan_rx_saved = s->chan_rx = chan; + + if (port->type == PORT_SCIFA || port->type == PORT_SCIFB) +- sci_submit_rx(s); ++ sci_submit_rx(s, false); + } + } + +@@ -1667,7 +1669,7 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr) + scr |= SCSCR_RDRQE; + } else { + scr &= ~SCSCR_RIE; +- sci_submit_rx(s); ++ sci_submit_rx(s, false); + } + serial_port_out(port, SCSCR, scr); + /* Clear current interrupt */ +-- +2.19.1 + diff --git a/queue-4.20/serial-sh-sci-resume-pio-in-sci_rx_interrupt-on-dma-.patch b/queue-4.20/serial-sh-sci-resume-pio-in-sci_rx_interrupt-on-dma-.patch new file mode 100644 index 00000000000..faf9a591ca1 --- /dev/null +++ b/queue-4.20/serial-sh-sci-resume-pio-in-sci_rx_interrupt-on-dma-.patch @@ -0,0 +1,77 @@ +From 23c1d1bec33b61baa21989fe28e9ca0626e6d825 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 13 Dec 2018 19:44:43 +0100 +Subject: serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure + +[ Upstream commit 71ab1c0336c71ace5725740f200beca9667a339f ] + +On (H)SCIF, sci_submit_rx() is called in the receive interrupt handler. +Hence if DMA submission fails, the interrupt handler should resume +handling reception using PIO, else no more data is received. + +Make sci_submit_rx() return an error indicator, so the receive interrupt +handler can act appropriately. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Acked-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/sh-sci.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 613007d7165e..21fd3f6ad28e 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -1331,7 +1331,7 @@ static void sci_tx_dma_release(struct sci_port *s) + dma_release_channel(chan); + } + +-static void sci_submit_rx(struct sci_port *s, bool port_lock_held) ++static int sci_submit_rx(struct sci_port *s, bool port_lock_held) + { + struct dma_chan *chan = s->chan_rx; + struct uart_port *port = &s->port; +@@ -1359,7 +1359,7 @@ static void sci_submit_rx(struct sci_port *s, bool port_lock_held) + s->active_rx = s->cookie_rx[0]; + + dma_async_issue_pending(chan); +- return; ++ return 0; + + fail: + /* Switch to PIO */ +@@ -1374,6 +1374,7 @@ fail: + sci_start_rx(port); + if (!port_lock_held) + spin_unlock_irqrestore(&port->lock, flags); ++ return -EAGAIN; + } + + static void work_fn_tx(struct work_struct *work) +@@ -1668,8 +1669,10 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr) + disable_irq_nosync(irq); + scr |= SCSCR_RDRQE; + } else { ++ if (sci_submit_rx(s, false) < 0) ++ goto handle_pio; ++ + scr &= ~SCSCR_RIE; +- sci_submit_rx(s, false); + } + serial_port_out(port, SCSCR, scr); + /* Clear current interrupt */ +@@ -1681,6 +1684,8 @@ static irqreturn_t sci_rx_interrupt(int irq, void *ptr) + + return IRQ_HANDLED; + } ++ ++handle_pio: + #endif + + if (s->rx_trigger > 1 && s->rx_fifo_timeout > 0) { +-- +2.19.1 + diff --git a/queue-4.20/series b/queue-4.20/series new file mode 100644 index 00000000000..2bd9efdb773 --- /dev/null +++ b/queue-4.20/series @@ -0,0 +1,290 @@ +drm-bufs-fix-spectre-v1-vulnerability.patch +drm-v3d-fix-a-use-after-free-race-accessing-the-sche.patch +staging-iio-adc-ad7280a-handle-error-from-__ad7280_r.patch +drm-vgem-fix-vgem_init-to-get-drm-device-available.patch +pinctrl-bcm2835-use-raw-spinlock-for-rt-compatibilit.patch +clk-sunxi-ng-h6-set-video-plls-limits.patch +asoc-intel-mrfld-fix-uninitialized-variable-access.patch +gpiolib-fix-possible-use-after-free-on-label.patch +drm-sun4i-initialize-registers-in-tcon-top-driver.patch +ath10k-fixup-extended-per-sta-tx-statistics.patch +genirq-affinity-spread-irqs-to-all-available-numa-no.patch +gpu-ipu-v3-image-convert-prevent-race-between-run-an.patch +drm-amd-display-fix-potential-nullptr-error.patch +nds32-fix-gcc-8.0-compiler-option-incompatible.patch +wil6210-fix-reset-flow-for-talyn-mb.patch +wil6210-fix-memory-leak-in-wil_find_tx_bcast_2.patch +ath10k-assign-n_cipher_suites-for-wcn3990.patch +ath9k-dynack-use-authentication-messages-for-late-ac.patch +scsi-lpfc-correct-lcb-rjt-handling.patch +scsi-mpt3sas-call-sas_remove_host-before-removing-th.patch +scsi-lpfc-fix-logo-plogi-handling-when-triggerd-by-a.patch +arm-8808-1-kexec-offline-panic_smp_self_stop-cpu.patch +clk-boston-fix-possible-memory-leak-in-clk_boston_se.patch +dlm-don-t-swamp-the-cpu-with-callbacks-queued-during.patch +x86-pci-fix-broadcom-cnb20le-unintended-sign-extensi.patch +powerpc-pseries-add-of_node_put-in-dlpar_detach_node.patch +bpftool-improve-handling-of-enoent-on-map-dumps.patch +s390-qeth-utilize-virtual-mac-for-layer2-osd-devices.patch +crypto-aes_ti-disable-interrupts-while-accessing-s-b.patch +drm-vc4-x_scaling-1-should-never-be-set-to-vc4_scali.patch +serial-fsl_lpuart-clear-parity-enable-bit-when-disab.patch +ptp-check-gettime64-return-code-in-ptp_sys_offset-io.patch +mips-boston-disable-eg20t-prefetch.patch +dpaa2-ptp-defer-probe-when-portal-allocation-failed.patch +iwlwifi-fw-do-not-set-sgi-bits-for-he-connection.patch +staging-iio-ad2s90-make-probe-handle-spi_setup-failu.patch +fpga-altera-cvp-fix-registration-for-cvp-incapable-d.patch +tools-hv-kvp-fix-a-warning-of-buffer-overflow-with-g.patch +fpga-altera-cvp-fix-bad-io-access-on-x86_64.patch +vbox-fix-link-error-with-gcc-og.patch +platform-chrome-don-t-report-ec_mkbp_event_sensor_fi.patch +i40e-suppress-bogus-error-message.patch +i40e-prevent-overlapping-tx_timeout-recover.patch +scsi-hisi_sas-change-the-time-of-sas-ssp-connection.patch +staging-iio-ad7780-update-voltage-on-read.patch +usbnet-smsc95xx-fix-rx-packet-alignment.patch +drm-rockchip-fix-for-mailbox-read-size.patch +arm-omap2-hwmod-fix-some-section-annotations.patch +drm-amd-display-fix-gamma-not-being-applied-correctl.patch +drm-amd-display-calculate-stream-phy_pix_clk-before-.patch +bpf-libbpf-retry-map-creation-without-the-name.patch +net-mlx5-eq-use-the-right-place-to-store-read-irq-af.patch +modpost-validate-symbol-names-also-in-find_elf_symbo.patch +perf-tools-add-hygon-dhyana-support.patch +scsi-cxgb4i-fix-thermal-configuration-dependencies.patch +soc-tegra-don-t-leak-device-tree-node-reference.patch +media-rc-ensure-close-is-called-on-rc_unregister_dev.patch +media-video-i2c-avoid-accessing-released-memory-area.patch +media-mtk-vcodec-release-device-nodes-in-mtk_vcodec_.patch +staging-erofs-fix-the-definition-of-dbg_bugon.patch +staging-erofs-fix-race-when-the-managed-cache-is-ena.patch +x86-resctrl-fixup-the-user-visible-strings.patch +media-vivid-fill-in-media_device-bus_info.patch +rdma-core-sync-unregistration-with-netlink-commands.patch +drm-rcar-du-fix-external-clock-error-checks.patch +asoc-sunxi-sun50i-codec-analog-add-support-for-cpvdd.patch +clk-meson-meson8b-do-not-use-cpu_div3-for-cpu_scale_.patch +clk-meson-meson8b-fix-the-width-of-the-cpu_scale_div.patch +clk-meson-meson8b-mark-the-cpu-clock-as-clk_is_criti.patch +ptp-fix-pass-zero-to-err_ptr-in-ptp_clock_register.patch +dmaengine-xilinx_dma-remove-__aligned-attribute-on-z.patch +powerpc-32-add-.data.lubsan_data-.data.lubsan_type-s.patch +iio-adc-meson-saradc-check-for-devm_kasprintf-failur.patch +iio-adc-meson-saradc-fix-internal-clock-names.patch +iio-accel-kxcjk1013-add-kiox010a-acpi-hardware-id.patch +media-adv-tc358743-ths8200-fill-in-min-width-height-.patch +acpi-spcr-consider-baud-rate-0-as-preconfigured-stat.patch +staging-pi433-fix-potential-null-dereference.patch +f2fs-avoid-gc-causing-encrypted-file-corrupted.patch +f2fs-move-dir-data-flush-to-write-checkpoint-process.patch +f2fs-avoid-build-warn-of-fall_through.patch +f2fs-fix-race-between-write_checkpoint-and-write_beg.patch +f2fs-fix-wrong-return-value-of-f2fs_acl_create.patch +i2c-sh_mobile-add-support-for-r8a77990-r-car-e3.patch +arm64-io-ensure-calls-to-delay-routines-are-ordered-.patch +net-aquantia-return-err-if-set-mpi_deinit-state-fail.patch +sunvdc-do-not-spin-in-an-infinite-loop-when-vio_ldc_.patch +soc-bcm-brcmstb-don-t-leak-device-tree-node-referenc.patch +nfsd4-fix-crash-on-writing-v4_end_grace-before-nfsd-.patch +drm-clear-state-acquire_ctx-before-leaving-drm_atomi.patch +perf-arm_spe-handle-devm_kasprintf-failure.patch +arm64-io-ensure-value-passed-to-__iormb-is-held-in-a.patch +thermal-do-not-clear-passive-state-during-system-sle.patch +thermal-fix-locking-in-cooling-device-sysfs-update-c.patch +firmware-efi-add-null-pointer-checks-in-efivars-api-.patch +s390-zcrypt-improve-special-ap-message-cmd-handling.patch +mt76x0-dfs-fix-ibi_r11-configuration-on-non-radar-ch.patch +arm64-ftrace-don-t-adjust-the-lr-value.patch +drm-v3d-fix-prime-imports-of-buffers-from-other-driv.patch +arm-dts-mmp2-fix-twsi2.patch +arm-mmp-mmp2-dt-enable-the-clock.patch +arm-dts-aspeed-add-missing-memory-unit-address.patch +spi-fix-spi-at91-usart.c-build-errors-when-pinctrl-i.patch +x86-fpu-add-might_fault-to-user_insn.patch +media-i2c-tda1997x-select-config_hdmi.patch +media-davinci-vpbe-fix-error-handling-in-vpbe_initia.patch +platform-x86-fix-config-space-access-for-intel_atomi.patch +smack-fix-access-permissions-for-keyring.patch +xtensa-xtfpga.dtsi-fix-dtc-warnings-about-spi.patch +usb-dwc3-correct-the-logic-for-checking-trb-full-in-.patch +dmaengine-sprd-support-dma-link-list-cyclic-callback.patch +usb-dwc2-disable-power-down-feature-on-samsung-socs.patch +usb-hub-delay-hub-autosuspend-if-usb3-port-is-still-.patch +timekeeping-use-proper-seqcount-initializer.patch +usb-mtu3-fix-the-issue-about-setfeature-u1-u2_enable.patch +clk-sunxi-ng-a33-set-clk_set_rate_parent-for-all-aud.patch +media-imx274-select-regmap_i2c.patch +mac80211-fix-deauth-tx-when-we-disconnect.patch +pinctrl-nuvoton-check-for-devm_kasprintf-failure.patch +drm-amdgpu-powerplay-fix-clock-stretcher-limits-on-p.patch +tipc-fix-node-keep-alive-interval-calculation.patch +arm64-dts-rockchip-fix-rk3399-rockpro64-regulator-gp.patch +driver-core-move-async_synchronize_full-call.patch +kobject-return-error-code-if-writing-sys-.-uevent-fa.patch +ib-hfi1-unreserve-a-reserved-request-when-it-is-comp.patch +usb-dwc3-trace-add-missing-break-statement-to-make-c.patch +gpio-mt7621-report-failure-of-devm_kasprintf.patch +gpio-mt7621-pass-mediatek_gpio_bank_probe-failure-up.patch +pinctrl-sx150x-handle-failure-case-of-devm_kstrdup.patch +iommu-amd-fix-amd_iommu-force_isolation.patch +media-v4l2-device-link-subdevices-to-their-parent-de.patch +arm-omap1-ams-delta-fix-audio-permanently-muted.patch +arm-dts-fix-omap4430-sdp-ethernet-startup.patch +mips-bpf-fix-encoding-bug-for-mm_srlv32_op.patch +media-coda-fix-h.264-deblocking-filter-controls.patch +arm64-dts-meson-fix-irq-trigger-type-for-macirq.patch +arm-dts-fix-up-the-d-link-dir-685-mtd-partition-info.patch +tracing-have-trace_stack-nr_entries-compare-not-be-s.patch +watchdog-renesas_wdt-don-t-set-divider-while-watchdo.patch +arm-dts-imx51-zii-rdu1-do-not-specify-power-gpio-for.patch +usb-dwc3-gadget-disable-csp-for-stream-out-ep.patch +iommu-arm-smmu-v3-avoid-memory-corruption-from-hisil.patch +iommu-arm-smmu-add-support-for-qcom-smmu-v2-variant.patch +iommu-arm-smmu-v3-use-explicit-mb-when-moving-cons-p.patch +sata_rcar-fix-deferred-probing.patch +clk-imx6sl-ensure-mmdc-ch0-handshake-is-bypassed.patch +platform-x86-mlx-platform-fix-tachometer-registers.patch +cpuidle-big.little-fix-refcount-leak.patch +opp-use-opp_table-regulators-to-verify-no-regulator-.patch +tee-optee-avoid-possible-double-list_del.patch +drm-msm-dsi-fix-dsi-clock-names-in-dsi-10nm-pll-driv.patch +drm-msm-dpu-only-check-flush-register-against-pendin.patch +lightnvm-pblk-fix-resubmission-of-overwritten-write-.patch +lightnvm-pblk-add-lock-protection-to-list-operations.patch +i2c-axxia-check-for-error-conditions-first.patch +lightnvm-fix-uninitialized-return-value-in-nvm_get_c.patch +phy-sun4i-usb-add-support-for-missing-usb-phy-index.patch +mlxsw-spectrum_acl-limit-priority-value.patch +udf-fix-bug-on-corrupted-inode.patch +switchtec-fix-switchtec_ioctl_event_idx_all-flags-ov.patch +selftests-bpf-use-__bpf_constant_htons-in-test_prog..patch +arm-pxa-avoid-section-mismatch-warning.patch +asoc-fsl-fix-snd_soc_eukrea_tlv320-build-error-on-i..patch +arm-mmp-fix-timer_init-calls.patch +fix-dma-buf-udmabuf-selftest.patch +clk-qcom-leave-mmss-noc-on-for-8998.patch +f2fs-fix-to-reorder-set_page_dirty-and-wait_on_page_.patch +ipv6-fix-handling-of-lla-with-vrf-and-sockets-bound-.patch +tools-bpftool-fix-wmissing-declaration-warnings.patch +kvm-ppc-book3s-only-report-kvm_cap_spapr_tce_vfio-on.patch +mmc-bcm2835-recover-from-mmc_send_ext_csd.patch +mmc-bcm2835-reset-host-on-timeout.patch +mmc-meson-mx-sdio-check-devm_kasprintf-for-failure.patch +memstick-prevent-memstick-host-from-getting-runtime-.patch +mmc-sdhci-of-esdhc-fix-timeout-checks.patch +mmc-sdhci-omap-fix-timeout-checks.patch +mmc-sdhci-xenon-fix-timeout-checks.patch +mmc-jz4740-get-cd-wp-gpios-from-descriptors.patch +usb-renesas_usbhs-add-support-for-rz-g2e.patch +btrfs-harden-agaist-duplicate-fsid-on-scanned-device.patch +btrfs-reada-reorder-dev-replace-locks-before-radix-t.patch +serial-sh-sci-fix-locking-in-sci_submit_rx.patch +serial-sh-sci-resume-pio-in-sci_rx_interrupt-on-dma-.patch +tty-serial-samsung-properly-set-flags-in-autocts-mod.patch +perf-stat-fix-csv-mode-column-output-for-non-cgroup-.patch +perf-test-fix-perf_event_attr-test-failure.patch +perf-dso-fix-unchecked-usage-of-strncpy.patch +perf-header-fix-unchecked-usage-of-strncpy.patch +btrfs-use-tagged-writepage-to-mitigate-livelock-of-s.patch +perf-probe-fix-unchecked-usage-of-strncpy.patch +i2c-sh_mobile-add-support-for-r8a774c0-rz-g2e.patch +bnxt_en-disable-msix-before-re-reserving-nqs-cmpl-ri.patch +kvm-s390-unregister-debug-feature-on-failing-arch-in.patch +tools-power-x86-intel_pstate_tracer-fix-non-root-exe.patch +pinctrl-rza1-handle-devm_kasprintf-failure-cases.patch +mac80211-properly-handle-skb-with-radiotap-only.patch +livepatch-check-kzalloc-return-values.patch +arm64-kvm-skip-mmio-insn-after-emulation.patch +usb-musb-dsps-fix-otg-state-machine.patch +usb-musb-dsps-fix-runtime-pm-for-peripheral-mode.patch +perf-header-fix-up-argument-to-ctime.patch +perf-tools-cast-off_t-to-s64-to-avoid-warning-on-bio.patch +percpu-convert-spin_lock_irq-to-spin_lock_irqsave.patch +net-hns3-fix-error-handling-int-the-hns3_get_vector_.patch +net-hns3-fix-incomplete-uninitialization-of-irq-in-t.patch +drm-amd-display-add-retry-to-read-ddc_clock-pin.patch +drm-amd-display-wait-edp-hpd-to-high-in-detect_sink.patch +bluetooth-hci_bcm-handle-deferred-probing-for-the-cl.patch +drm-amd-display-fix-ycbcr420-blank-color.patch +powerpc-uaccess-fix-warning-error-with-access_ok.patch +mac80211-fix-radiotap-vendor-presence-bitmap-handlin.patch +xfrm6_tunnel-fix-spi-check-in-__xfrm6_tunnel_alloc_s.patch +mlxsw-spectrum-properly-cleanup-lag-uppers-when-remo.patch +scsi-smartpqi-correct-host-serial-num-for-ssa.patch +scsi-smartpqi-correct-volume-status.patch +scsi-smartpqi-increase-fw-status-register-read-timeo.patch +cw1200-fix-concurrency-use-after-free-bugs-in-cw1200.patch +net-hns3-add-max-vector-number-check-for-pf.patch +net-hns3-fix-the-descriptor-index-when-get-rss-type.patch +net-hns3-don-t-restore-rules-when-flow-director-is-d.patch +powerpc-perf-fix-thresholding-counter-data-for-unkno.patch +iwlwifi-mvm-fix-setting-he-ppe-fw-config.patch +powerpc-powernv-ioda-allocate-indirect-tce-levels-of.patch +mlx5-update-timecounter-at-least-twice-per-counter-o.patch +drbd-narrow-rcu_read_lock-in-drbd_sync_handshake.patch +drbd-disconnect-if-the-wrong-uuids-are-attached-on-a.patch +drbd-skip-spurious-timeout-ping-timeo-when-failing-p.patch +drbd-avoid-clang-warning-about-pointless-switch-stat.patch +ath10k-fix-kernel-panic-due-to-use-after-free.patch +ath10k-fix-tx_stats-memory-leak.patch +drm-amd-display-validate-extended-dongle-caps.patch +video-clps711x-fb-release-disp-device-node-in-probe.patch +md-fix-raid10-hang-issue-caused-by-barrier.patch +fbdev-fbmem-behave-better-with-small-rotated-display.patch +i40e-define-proper-net_device-neigh_priv_len.patch +ice-do-not-enable-napi-on-q_vectors-that-have-no-rin.patch +igb-fix-an-issue-that-pme-is-not-enabled-during-runt.patch +acpi-apei-clear-ghes-block_status-before-panic.patch +fbdev-fbcon-fix-unregister-crash-when-more-than-one-.patch +bpf-sk_msg-zap-ingress-queue-on-psock-down.patch +powerpc-mm-fix-reporting-of-kernel-execute-faults-on.patch +bpf-sk_msg-fix-socket-data_ready-events.patch +pinctrl-meson-meson8-fix-the-gpio-function-for-the-g.patch +pinctrl-meson-meson8b-fix-the-gpio-function-for-the-.patch +kvm-x86-svm-report-msr_ia32_mcg_ext_ctl-as-unsupport.patch +powerpc-fadump-do-not-allow-hot-remove-memory-from-f.patch +selftests-kvm-report-failed-stage-when-exit-reason-i.patch +kvm-change-offset-in-kvm_write_guest_offset_cached-t.patch +nfs-nfs_compare_mount_options-always-compare-auth-fl.patch +perf-build-don-t-unconditionally-link-the-libbfd-fea.patch +hwmon-lm80-fix-a-missing-check-of-the-status-of-smbu.patch +hwmon-lm80-fix-a-missing-check-of-bus-read-in-lm80-p.patch +seq_buf-make-seq_buf_puts-null-terminate-the-buffer.patch +crypto-ux500-use-proper-enum-in-cryp_set_dma_transfe.patch +crypto-ux500-use-proper-enum-in-hash_set_dma_transfe.patch +mips-ralink-select-config_cpu_mipsr2_irq_vi-on-mt762.patch +cifs-check-ntwrk_buf_start-for-null-before-dereferen.patch +f2fs-fix-use-after-free-issue-when-accessing-sbi-sta.patch +um-avoid-marking-pages-with-changed-protection.patch +niu-fix-missing-checks-of-niu_pci_eeprom_read.patch +f2fs-fix-sbi-extent_list-corruption-issue.patch +cgroup-fix-parsing-empty-mount-option-string.patch +perf-python-do-not-force-closing-original-perf-descr.patch +scripts-decode_stacktrace-only-strip-base-path-when-.patch +arch-sh-boards-mach-kfr2r09-setup.c-fix-struct-mtd_o.patch +ocfs2-don-t-clear-bh-uptodate-for-block-read.patch +ocfs2-improve-ocfs2-makefile.patch +mm-page_alloc.c-don-t-call-kasan_free_pages-at-defer.patch +zram-fix-lockdep-warning-of-free-block-handling.patch +isdn-hisax-hfc_pci-fix-a-possible-concurrency-use-af.patch +gdrom-fix-a-memory-leak-bug.patch +fsl-fman-use-gfp_atomic-in-memac-tgec-_add_hash_mac_.patch +block-swim3-fix-ebusy-error-when-re-opening-device-a.patch +thermal-bcm2835-enable-hwmon-explicitly.patch +kdb-don-t-back-trace-on-a-cpu-that-didn-t-round-up.patch +thermal-tsens-qcom-do-not-create-duplicate-regmap-de.patch +pci-imx-enable-msi-from-downstream-components.patch +block-swim3-fix-regression-on-powerbook-g3.patch +thermal-generic-adc-fix-adc-to-temp-interpolation.patch +hid-lenovo-add-checks-to-fix-of_led_classdev_registe.patch +arm64-sve-ptrace-fix-sve_pt_regs_offset-definition.patch +fs-proc-base.c-use-ns_capable-instead-of-capable-for.patch +kernel-hung_task.c-break-rcu-locks-based-on-jiffies.patch +proc-sysctl-fix-return-error-for-proc_doulongvec_min.patch +kernel-hung_task.c-force-console-verbose-before-pani.patch +fs-epoll-drop-ovflist-branch-prediction.patch +exec-load_script-don-t-blindly-truncate-shebang-stri.patch +kernel-kcov.c-mark-write_comp_data-as-notrace.patch +scripts-gdb-fix-lx-version-string-output.patch +xprtrdma-don-t-wake-pending-tasks-until-disconnect-i.patch diff --git a/queue-4.20/smack-fix-access-permissions-for-keyring.patch b/queue-4.20/smack-fix-access-permissions-for-keyring.patch new file mode 100644 index 00000000000..d34faac38cc --- /dev/null +++ b/queue-4.20/smack-fix-access-permissions-for-keyring.patch @@ -0,0 +1,66 @@ +From 3f47fd2736fe3d1abef9fce3ff320db1f98fefde Mon Sep 17 00:00:00 2001 +From: Zoran Markovic +Date: Wed, 17 Oct 2018 16:25:44 -0700 +Subject: smack: fix access permissions for keyring + +[ Upstream commit 5b841bfab695e3b8ae793172a9ff7990f99cc3e2 ] + +Function smack_key_permission() only issues smack requests for the +following operations: + - KEY_NEED_READ (issues MAY_READ) + - KEY_NEED_WRITE (issues MAY_WRITE) + - KEY_NEED_LINK (issues MAY_WRITE) + - KEY_NEED_SETATTR (issues MAY_WRITE) +A blank smack request is issued in all other cases, resulting in +smack access being granted if there is any rule defined between +subject and object, or denied with -EACCES otherwise. + +Request MAY_READ access for KEY_NEED_SEARCH and KEY_NEED_VIEW. +Fix the logic in the unlikely case when both MAY_READ and +MAY_WRITE are needed. Validate access permission field for valid +contents. + +Signed-off-by: Zoran Markovic +Signed-off-by: Casey Schaufler +Cc: Casey Schaufler +Cc: James Morris +Cc: "Serge E. Hallyn" +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 81fb4c1631e9..cd720c06b78c 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -4333,6 +4333,12 @@ static int smack_key_permission(key_ref_t key_ref, + int request = 0; + int rc; + ++ /* ++ * Validate requested permissions ++ */ ++ if (perm & ~KEY_NEED_ALL) ++ return -EINVAL; ++ + keyp = key_ref_to_ptr(key_ref); + if (keyp == NULL) + return -EINVAL; +@@ -4356,10 +4362,10 @@ static int smack_key_permission(key_ref_t key_ref, + ad.a.u.key_struct.key = keyp->serial; + ad.a.u.key_struct.key_desc = keyp->description; + #endif +- if (perm & KEY_NEED_READ) +- request = MAY_READ; ++ if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW)) ++ request |= MAY_READ; + if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) +- request = MAY_WRITE; ++ request |= MAY_WRITE; + rc = smk_access(tkp, keyp->security, request, &ad); + rc = smk_bu_note("key access", tkp, keyp->security, request, rc); + return rc; +-- +2.19.1 + diff --git a/queue-4.20/soc-bcm-brcmstb-don-t-leak-device-tree-node-referenc.patch b/queue-4.20/soc-bcm-brcmstb-don-t-leak-device-tree-node-referenc.patch new file mode 100644 index 00000000000..3cd61eca1b8 --- /dev/null +++ b/queue-4.20/soc-bcm-brcmstb-don-t-leak-device-tree-node-referenc.patch @@ -0,0 +1,47 @@ +From 435b01998c3e8dbd000575a11ffb1fe62092e387 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Sat, 24 Nov 2018 09:52:23 -0500 +Subject: soc: bcm: brcmstb: Don't leak device tree node reference + +[ Upstream commit 1861a7f07e02292830a1ca256328d370deefea30 ] + +of_find_node_by_path() acquires a reference to the node returned by it +and that reference needs to be dropped by its caller. soc_is_brcmstb() +doesn't do that, so fix it. + +[treding: slightly rewrite to avoid inline comparison] + +Fixes: d52fad262041 ("soc: add stubs for brcmstb SoC's") +Signed-off-by: Yangtao Li +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + drivers/soc/bcm/brcmstb/common.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/bcm/brcmstb/common.c b/drivers/soc/bcm/brcmstb/common.c +index 14185451901d..bf9123f727e8 100644 +--- a/drivers/soc/bcm/brcmstb/common.c ++++ b/drivers/soc/bcm/brcmstb/common.c +@@ -31,13 +31,17 @@ static const struct of_device_id brcmstb_machine_match[] = { + + bool soc_is_brcmstb(void) + { ++ const struct of_device_id *match; + struct device_node *root; + + root = of_find_node_by_path("/"); + if (!root) + return false; + +- return of_match_node(brcmstb_machine_match, root) != NULL; ++ match = of_match_node(brcmstb_machine_match, root); ++ of_node_put(root); ++ ++ return match != NULL; + } + + u32 brcmstb_get_family_id(void) +-- +2.19.1 + diff --git a/queue-4.20/soc-tegra-don-t-leak-device-tree-node-reference.patch b/queue-4.20/soc-tegra-don-t-leak-device-tree-node-reference.patch new file mode 100644 index 00000000000..60f77002ad3 --- /dev/null +++ b/queue-4.20/soc-tegra-don-t-leak-device-tree-node-reference.patch @@ -0,0 +1,44 @@ +From 469f6d67780393c1da3c080fa8f0bf31262a3717 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Wed, 21 Nov 2018 07:49:12 -0500 +Subject: soc/tegra: Don't leak device tree node reference + +[ Upstream commit 9eb40fa2cd2d1f6829e7b49bb22692f754b9cfe0 ] + +of_find_node_by_path() acquires a reference to the node returned by it +and that reference needs to be dropped by its caller. soc_is_tegra() +doesn't do that, so fix it. + +Signed-off-by: Yangtao Li +Acked-by: Jon Hunter +[treding: slightly rewrite to avoid inline comparison] +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/soc/tegra/common.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/tegra/common.c b/drivers/soc/tegra/common.c +index cd8f41351add..7bfb154d6fa5 100644 +--- a/drivers/soc/tegra/common.c ++++ b/drivers/soc/tegra/common.c +@@ -22,11 +22,15 @@ static const struct of_device_id tegra_machine_match[] = { + + bool soc_is_tegra(void) + { ++ const struct of_device_id *match; + struct device_node *root; + + root = of_find_node_by_path("/"); + if (!root) + return false; + +- return of_match_node(tegra_machine_match, root) != NULL; ++ match = of_match_node(tegra_machine_match, root); ++ of_node_put(root); ++ ++ return match != NULL; + } +-- +2.19.1 + diff --git a/queue-4.20/spi-fix-spi-at91-usart.c-build-errors-when-pinctrl-i.patch b/queue-4.20/spi-fix-spi-at91-usart.c-build-errors-when-pinctrl-i.patch new file mode 100644 index 00000000000..d572bd4af26 --- /dev/null +++ b/queue-4.20/spi-fix-spi-at91-usart.c-build-errors-when-pinctrl-i.patch @@ -0,0 +1,44 @@ +From 3b82583a2120c75c6d3873d6fdb878c2adaed7c8 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Thu, 29 Nov 2018 14:34:15 -0800 +Subject: spi: fix spi-at91-usart.c build errors when PINCTRL is not set + +[ Upstream commit c2b142cc3939e932d4fa2210c2a5155df5736590 ] + +Fix build errors when CONFIG_PINCTRL is not enabled. +The header file handles both CONFIG_PINCTRL +enabled and disabled cases. + + CC [M] drivers/spi/spi-at91-usart.o +../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_suspend': +../drivers/spi/spi-at91-usart.c:409:2: error: implicit declaration of function 'pinctrl_pm_select_sleep_state' [-Werror=implicit-function-declaration] + pinctrl_pm_select_sleep_state(dev); +../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_resume': +../drivers/spi/spi-at91-usart.c:419:2: error: implicit declaration of function 'pinctrl_pm_select_default_state' [-Werror=implicit-function-declaration] + pinctrl_pm_select_default_state(dev); + +Signed-off-by: Randy Dunlap +Cc: Radu Pirea +Cc: Mark Brown +Cc: linux-spi@vger.kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-at91-usart.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-at91-usart.c b/drivers/spi/spi-at91-usart.c +index a924657642fa..08bcbd1f9aa2 100644 +--- a/drivers/spi/spi-at91-usart.c ++++ b/drivers/spi/spi-at91-usart.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + + #include +-- +2.19.1 + diff --git a/queue-4.20/staging-erofs-fix-race-when-the-managed-cache-is-ena.patch b/queue-4.20/staging-erofs-fix-race-when-the-managed-cache-is-ena.patch new file mode 100644 index 00000000000..5d806646dbc --- /dev/null +++ b/queue-4.20/staging-erofs-fix-race-when-the-managed-cache-is-ena.patch @@ -0,0 +1,225 @@ +From ab9b47977c12a19848f550c68ca600c94ddd650f Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Fri, 23 Nov 2018 01:16:00 +0800 +Subject: staging: erofs: fix race when the managed cache is enabled + +[ Upstream commit 51232df5e4b268936beccde5248f312a316800be ] + +When the managed cache is enabled, the last reference count +of a workgroup must be used for its workstation. + +Otherwise, it could lead to incorrect (un)freezes in +the reclaim path, and it would be harmful. + +A typical race as follows: + +Thread 1 (In the reclaim path) Thread 2 +workgroup_freeze(grp, 1) refcnt = 1 +... +workgroup_unfreeze(grp, 1) refcnt = 1 + workgroup_get(grp) refcnt = 2 (x) +workgroup_put(grp) refcnt = 1 (x) + ...unexpected behaviors + +* grp is detached but still used, which violates cache-managed + freeze constraint. + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/erofs/internal.h | 1 + + drivers/staging/erofs/utils.c | 134 ++++++++++++++++++++++--------- + 2 files changed, 96 insertions(+), 39 deletions(-) + +diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h +index 048fb034b5aa..3ac4599bbe01 100644 +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -250,6 +250,7 @@ repeat: + } + + #define __erofs_workgroup_get(grp) atomic_inc(&(grp)->refcount) ++#define __erofs_workgroup_put(grp) atomic_dec(&(grp)->refcount) + + extern int erofs_workgroup_put(struct erofs_workgroup *grp); + +diff --git a/drivers/staging/erofs/utils.c b/drivers/staging/erofs/utils.c +index ea8a962e5c95..d2e3ace91046 100644 +--- a/drivers/staging/erofs/utils.c ++++ b/drivers/staging/erofs/utils.c +@@ -83,12 +83,21 @@ int erofs_register_workgroup(struct super_block *sb, + + grp = xa_tag_pointer(grp, tag); + +- err = radix_tree_insert(&sbi->workstn_tree, +- grp->index, grp); ++ /* ++ * Bump up reference count before making this workgroup ++ * visible to other users in order to avoid potential UAF ++ * without serialized by erofs_workstn_lock. ++ */ ++ __erofs_workgroup_get(grp); + +- if (!err) { +- __erofs_workgroup_get(grp); +- } ++ err = radix_tree_insert(&sbi->workstn_tree, ++ grp->index, grp); ++ if (unlikely(err)) ++ /* ++ * it's safe to decrease since the workgroup isn't visible ++ * and refcount >= 2 (cannot be freezed). ++ */ ++ __erofs_workgroup_put(grp); + + erofs_workstn_unlock(sbi); + radix_tree_preload_end(); +@@ -97,19 +106,94 @@ int erofs_register_workgroup(struct super_block *sb, + + extern void erofs_workgroup_free_rcu(struct erofs_workgroup *grp); + ++static void __erofs_workgroup_free(struct erofs_workgroup *grp) ++{ ++ atomic_long_dec(&erofs_global_shrink_cnt); ++ erofs_workgroup_free_rcu(grp); ++} ++ + int erofs_workgroup_put(struct erofs_workgroup *grp) + { + int count = atomic_dec_return(&grp->refcount); + + if (count == 1) + atomic_long_inc(&erofs_global_shrink_cnt); +- else if (!count) { +- atomic_long_dec(&erofs_global_shrink_cnt); +- erofs_workgroup_free_rcu(grp); +- } ++ else if (!count) ++ __erofs_workgroup_free(grp); + return count; + } + ++#ifdef EROFS_FS_HAS_MANAGED_CACHE ++/* for cache-managed case, customized reclaim paths exist */ ++static void erofs_workgroup_unfreeze_final(struct erofs_workgroup *grp) ++{ ++ erofs_workgroup_unfreeze(grp, 0); ++ __erofs_workgroup_free(grp); ++} ++ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ /* ++ * for managed cache enabled, the refcount of workgroups ++ * themselves could be < 0 (freezed). So there is no guarantee ++ * that all refcount > 0 if managed cache is enabled. ++ */ ++ if (!erofs_workgroup_try_to_freeze(grp, 1)) ++ return false; ++ ++ /* ++ * note that all cached pages should be unlinked ++ * before delete it from the radix tree. ++ * Otherwise some cached pages of an orphan old workgroup ++ * could be still linked after the new one is available. ++ */ ++ if (erofs_try_to_free_all_cached_pages(sbi, grp)) { ++ erofs_workgroup_unfreeze(grp, 1); ++ return false; ++ } ++ ++ /* ++ * it is impossible to fail after the workgroup is freezed, ++ * however in order to avoid some race conditions, add a ++ * DBG_BUGON to observe this in advance. ++ */ ++ DBG_BUGON(xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree, ++ grp->index)) != grp); ++ ++ /* ++ * if managed cache is enable, the last refcount ++ * should indicate the related workstation. ++ */ ++ erofs_workgroup_unfreeze_final(grp); ++ return true; ++} ++ ++#else ++/* for nocache case, no customized reclaim path at all */ ++bool erofs_try_to_release_workgroup(struct erofs_sb_info *sbi, ++ struct erofs_workgroup *grp, ++ bool cleanup) ++{ ++ int cnt = atomic_read(&grp->refcount); ++ ++ DBG_BUGON(cnt <= 0); ++ DBG_BUGON(cleanup && cnt != 1); ++ ++ if (cnt > 1) ++ return false; ++ ++ DBG_BUGON(xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree, ++ grp->index)) != grp); ++ ++ /* (rarely) could be grabbed again when freeing */ ++ erofs_workgroup_put(grp); ++ return true; ++} ++ ++#endif ++ + unsigned long erofs_shrink_workstation(struct erofs_sb_info *sbi, + unsigned long nr_shrink, + bool cleanup) +@@ -126,42 +210,14 @@ repeat: + batch, first_index, PAGEVEC_SIZE); + + for (i = 0; i < found; ++i) { +- int cnt; + struct erofs_workgroup *grp = xa_untag_pointer(batch[i]); + + first_index = grp->index + 1; + +- cnt = atomic_read(&grp->refcount); +- BUG_ON(cnt <= 0); +- +- if (cleanup) +- BUG_ON(cnt != 1); +- +-#ifndef EROFS_FS_HAS_MANAGED_CACHE +- else if (cnt > 1) +-#else +- if (!erofs_workgroup_try_to_freeze(grp, 1)) +-#endif ++ /* try to shrink each valid workgroup */ ++ if (!erofs_try_to_release_workgroup(sbi, grp, cleanup)) + continue; + +- if (xa_untag_pointer(radix_tree_delete(&sbi->workstn_tree, +- grp->index)) != grp) { +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +-skip: +- erofs_workgroup_unfreeze(grp, 1); +-#endif +- continue; +- } +- +-#ifdef EROFS_FS_HAS_MANAGED_CACHE +- if (erofs_try_to_free_all_cached_pages(sbi, grp)) +- goto skip; +- +- erofs_workgroup_unfreeze(grp, 1); +-#endif +- /* (rarely) grabbed again when freeing */ +- erofs_workgroup_put(grp); +- + ++freed; + if (unlikely(!--nr_shrink)) + break; +-- +2.19.1 + diff --git a/queue-4.20/staging-erofs-fix-the-definition-of-dbg_bugon.patch b/queue-4.20/staging-erofs-fix-the-definition-of-dbg_bugon.patch new file mode 100644 index 00000000000..0722a55f34d --- /dev/null +++ b/queue-4.20/staging-erofs-fix-the-definition-of-dbg_bugon.patch @@ -0,0 +1,48 @@ +From f9a23a9ce545bfd0d70ace082298bf5b55fac097 Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Fri, 23 Nov 2018 01:15:59 +0800 +Subject: staging: erofs: fix the definition of DBG_BUGON + +[ Upstream commit eef168789866514e5d4316f030131c9fe65b643f ] + +It's better not to positively BUG_ON the kernel, however developers +need a way to locate issues as soon as possible. + +DBG_BUGON is introduced and it could only crash when EROFS_FS_DEBUG +(EROFS developping feature) is on. It is helpful for developers +to find and solve bugs quickly by eng builds. + +Previously, DBG_BUGON is defined as ((void)0) if EROFS_FS_DEBUG is off, +but some unused variable warnings as follows could occur: + +drivers/staging/erofs/unzip_vle.c: In function `init_alway:': +drivers/staging/erofs/unzip_vle.c:61:33: warning: unused variable `work' [-Wunused-variable] + struct z_erofs_vle_work *const work = + ^~~~ + +Fix it to #define DBG_BUGON(x) ((void)(x)). + +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/erofs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/erofs/internal.h b/drivers/staging/erofs/internal.h +index 57575c7f5635..048fb034b5aa 100644 +--- a/drivers/staging/erofs/internal.h ++++ b/drivers/staging/erofs/internal.h +@@ -39,7 +39,7 @@ + #define debugln(x, ...) ((void)0) + + #define dbg_might_sleep() ((void)0) +-#define DBG_BUGON(...) ((void)0) ++#define DBG_BUGON(x) ((void)(x)) + #endif + + enum { +-- +2.19.1 + diff --git a/queue-4.20/staging-iio-ad2s90-make-probe-handle-spi_setup-failu.patch b/queue-4.20/staging-iio-ad2s90-make-probe-handle-spi_setup-failu.patch new file mode 100644 index 00000000000..eabe234e7cd --- /dev/null +++ b/queue-4.20/staging-iio-ad2s90-make-probe-handle-spi_setup-failu.patch @@ -0,0 +1,46 @@ +From d81c9eae26d510ce35f3eaa33036a42f9655e3f5 Mon Sep 17 00:00:00 2001 +From: Matheus Tavares +Date: Sat, 3 Nov 2018 19:49:44 -0300 +Subject: staging:iio:ad2s90: Make probe handle spi_setup failure + +[ Upstream commit b3a3eafeef769c6982e15f83631dcbf8d1794efb ] + +Previously, ad2s90_probe ignored the return code from spi_setup, not +handling its possible failure. This patch makes ad2s90_probe check if +the code is an error code and, if so, do the following: + +- Call dev_err with an appropriate error message. +- Return the spi_setup's error code. + +Note: The 'return ret' statement could be out of the 'if' block, but +this whole block will be moved up in the function in the patch: +'staging:iio:ad2s90: Move device registration to the end of probe'. + +Signed-off-by: Matheus Tavares +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/staging/iio/resolver/ad2s90.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/iio/resolver/ad2s90.c b/drivers/staging/iio/resolver/ad2s90.c +index 59586947a936..51cda9151412 100644 +--- a/drivers/staging/iio/resolver/ad2s90.c ++++ b/drivers/staging/iio/resolver/ad2s90.c +@@ -85,7 +85,12 @@ static int ad2s90_probe(struct spi_device *spi) + /* need 600ns between CS and the first falling edge of SCLK */ + spi->max_speed_hz = 830000; + spi->mode = SPI_MODE_3; +- spi_setup(spi); ++ ret = spi_setup(spi); ++ ++ if (ret < 0) { ++ dev_err(&spi->dev, "spi_setup failed!\n"); ++ return ret; ++ } + + return 0; + } +-- +2.19.1 + diff --git a/queue-4.20/staging-iio-ad7780-update-voltage-on-read.patch b/queue-4.20/staging-iio-ad7780-update-voltage-on-read.patch new file mode 100644 index 00000000000..6cc2164c06f --- /dev/null +++ b/queue-4.20/staging-iio-ad7780-update-voltage-on-read.patch @@ -0,0 +1,44 @@ +From 8dffd69bf749b91d8f2230c9147cc75bdba410f8 Mon Sep 17 00:00:00 2001 +From: Renato Lui Geh +Date: Mon, 5 Nov 2018 17:14:58 -0200 +Subject: staging: iio: ad7780: update voltage on read + +[ Upstream commit 336650c785b62c3bea7c8cf6061c933a90241f67 ] + +The ad7780 driver previously did not read the correct device output, as +it read an outdated value set at initialization. It now updates its +voltage on read. + +Signed-off-by: Renato Lui Geh +Acked-by: Alexandru Ardelean +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/staging/iio/adc/ad7780.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/iio/adc/ad7780.c b/drivers/staging/iio/adc/ad7780.c +index b67412db0318..c7cb05cedbbc 100644 +--- a/drivers/staging/iio/adc/ad7780.c ++++ b/drivers/staging/iio/adc/ad7780.c +@@ -87,12 +87,16 @@ static int ad7780_read_raw(struct iio_dev *indio_dev, + long m) + { + struct ad7780_state *st = iio_priv(indio_dev); ++ int voltage_uv; + + switch (m) { + case IIO_CHAN_INFO_RAW: + return ad_sigma_delta_single_conversion(indio_dev, chan, val); + case IIO_CHAN_INFO_SCALE: +- *val = st->int_vref_mv * st->gain; ++ voltage_uv = regulator_get_voltage(st->reg); ++ if (voltage_uv < 0) ++ return voltage_uv; ++ *val = (voltage_uv / 1000) * st->gain; + *val2 = chan->scan_type.realbits - 1; + return IIO_VAL_FRACTIONAL_LOG2; + case IIO_CHAN_INFO_OFFSET: +-- +2.19.1 + diff --git a/queue-4.20/staging-iio-adc-ad7280a-handle-error-from-__ad7280_r.patch b/queue-4.20/staging-iio-adc-ad7280a-handle-error-from-__ad7280_r.patch new file mode 100644 index 00000000000..c14bd0abbab --- /dev/null +++ b/queue-4.20/staging-iio-adc-ad7280a-handle-error-from-__ad7280_r.patch @@ -0,0 +1,70 @@ +From a1d4753b74202a7a1b792d7eb923d1a858f82c47 Mon Sep 17 00:00:00 2001 +From: Slawomir Stepien +Date: Sat, 20 Oct 2018 23:04:11 +0200 +Subject: staging: iio: adc: ad7280a: handle error from __ad7280_read32() + +[ Upstream commit 0559ef7fde67bc6c83c6eb6329dbd6649528263e ] + +Inside __ad7280_read32(), the spi_sync_transfer() can fail with negative +error code. This change will ensure that this error is being passed up +in the call stack, so it can be handled. + +Signed-off-by: Slawomir Stepien +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/staging/iio/adc/ad7280a.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c +index 58420dcb406d..cbeb52485a31 100644 +--- a/drivers/staging/iio/adc/ad7280a.c ++++ b/drivers/staging/iio/adc/ad7280a.c +@@ -256,7 +256,9 @@ static int ad7280_read(struct ad7280_state *st, unsigned int devaddr, + if (ret) + return ret; + +- __ad7280_read32(st, &tmp); ++ ret = __ad7280_read32(st, &tmp); ++ if (ret) ++ return ret; + + if (ad7280_check_crc(st, tmp)) + return -EIO; +@@ -294,7 +296,9 @@ static int ad7280_read_channel(struct ad7280_state *st, unsigned int devaddr, + + ad7280_delay(st); + +- __ad7280_read32(st, &tmp); ++ ret = __ad7280_read32(st, &tmp); ++ if (ret) ++ return ret; + + if (ad7280_check_crc(st, tmp)) + return -EIO; +@@ -327,7 +331,9 @@ static int ad7280_read_all_channels(struct ad7280_state *st, unsigned int cnt, + ad7280_delay(st); + + for (i = 0; i < cnt; i++) { +- __ad7280_read32(st, &tmp); ++ ret = __ad7280_read32(st, &tmp); ++ if (ret) ++ return ret; + + if (ad7280_check_crc(st, tmp)) + return -EIO; +@@ -370,7 +376,10 @@ static int ad7280_chain_setup(struct ad7280_state *st) + return ret; + + for (n = 0; n <= AD7280A_MAX_CHAIN; n++) { +- __ad7280_read32(st, &val); ++ ret = __ad7280_read32(st, &val); ++ if (ret) ++ return ret; ++ + if (val == 0) + return n - 1; + +-- +2.19.1 + diff --git a/queue-4.20/staging-pi433-fix-potential-null-dereference.patch b/queue-4.20/staging-pi433-fix-potential-null-dereference.patch new file mode 100644 index 00000000000..93c767d00b9 --- /dev/null +++ b/queue-4.20/staging-pi433-fix-potential-null-dereference.patch @@ -0,0 +1,36 @@ +From 39196036a31517137dfdfdf3ada6119d21c2fe4c Mon Sep 17 00:00:00 2001 +From: Michael Straube +Date: Sun, 25 Nov 2018 10:22:25 +0100 +Subject: staging: pi433: fix potential null dereference + +[ Upstream commit 64c4c4ca6c129a4191e8e1e91b2d5d9b8d08c518 ] + +Add a test for successful call to cdev_alloc() to avoid +potential null dereference. Issue reported by smatch. + +Signed-off-by: Michael Straube +Fixes: 874bcba65f9a ("staging: pi433: New driver") +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/pi433/pi433_if.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/staging/pi433/pi433_if.c b/drivers/staging/pi433/pi433_if.c +index c85a805a1243..a497ec197872 100644 +--- a/drivers/staging/pi433/pi433_if.c ++++ b/drivers/staging/pi433/pi433_if.c +@@ -1255,6 +1255,10 @@ static int pi433_probe(struct spi_device *spi) + + /* create cdev */ + device->cdev = cdev_alloc(); ++ if (!device->cdev) { ++ dev_dbg(device->dev, "allocation of cdev failed"); ++ goto cdev_failed; ++ } + device->cdev->owner = THIS_MODULE; + cdev_init(device->cdev, &pi433_fops); + retval = cdev_add(device->cdev, device->devt, 1); +-- +2.19.1 + diff --git a/queue-4.20/sunvdc-do-not-spin-in-an-infinite-loop-when-vio_ldc_.patch b/queue-4.20/sunvdc-do-not-spin-in-an-infinite-loop-when-vio_ldc_.patch new file mode 100644 index 00000000000..ba2ef159fa8 --- /dev/null +++ b/queue-4.20/sunvdc-do-not-spin-in-an-infinite-loop-when-vio_ldc_.patch @@ -0,0 +1,54 @@ +From 8a82c971c86b3f39d4e71a6fd3916b197e5f5c30 Mon Sep 17 00:00:00 2001 +From: Young Xiao +Date: Wed, 28 Nov 2018 12:36:39 +0000 +Subject: sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns + EAGAIN + +[ Upstream commit a11f6ca9aef989b56cd31ff4ee2af4fb31a172ec ] + +__vdc_tx_trigger should only loop on EAGAIN a finite +number of times. + +See commit adddc32d6fde ("sunvnet: Do not spin in an +infinite loop when vio_ldc_send() returns EAGAIN") for detail. + +Signed-off-by: Young Xiao +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/sunvdc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c +index b54fa6726303..6b7b0d8a2acb 100644 +--- a/drivers/block/sunvdc.c ++++ b/drivers/block/sunvdc.c +@@ -45,6 +45,8 @@ MODULE_VERSION(DRV_MODULE_VERSION); + #define WAITING_FOR_GEN_CMD 0x04 + #define WAITING_FOR_ANY -1 + ++#define VDC_MAX_RETRIES 10 ++ + static struct workqueue_struct *sunvdc_wq; + + struct vdc_req_entry { +@@ -431,6 +433,7 @@ static int __vdc_tx_trigger(struct vdc_port *port) + .end_idx = dr->prod, + }; + int err, delay; ++ int retries = 0; + + hdr.seq = dr->snd_nxt; + delay = 1; +@@ -443,6 +446,8 @@ static int __vdc_tx_trigger(struct vdc_port *port) + udelay(delay); + if ((delay <<= 1) > 128) + delay = 128; ++ if (retries++ > VDC_MAX_RETRIES) ++ break; + } while (err == -EAGAIN); + + if (err == -ENOTCONN) +-- +2.19.1 + diff --git a/queue-4.20/switchtec-fix-switchtec_ioctl_event_idx_all-flags-ov.patch b/queue-4.20/switchtec-fix-switchtec_ioctl_event_idx_all-flags-ov.patch new file mode 100644 index 00000000000..54399cc3ffc --- /dev/null +++ b/queue-4.20/switchtec-fix-switchtec_ioctl_event_idx_all-flags-ov.patch @@ -0,0 +1,50 @@ +From 0d581935d9a93e0bb5bf4edb0d7f9a2d1dca7ff2 Mon Sep 17 00:00:00 2001 +From: Joey Zhang +Date: Mon, 10 Dec 2018 17:12:22 +0800 +Subject: switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite + +[ Upstream commit e4a7dca5de625018b29417ecc39dc5037d9a5a36 ] + +In the ioctl_event_ctl() SWITCHTEC_IOCTL_EVENT_IDX_ALL case, we call +event_ctl() several times with the same "ctl" struct. Each call clobbers +ctl.flags, which leads to the problem that we may not actually enable or +disable all events as the user requested. + +Preserve the event flag value with a temporary variable. + +Fixes: 52eabba5bcdb ("switchtec: Add IOCTLs to the Switchtec driver") +Signed-off-by: Joey Zhang +Signed-off-by: Wesley Sheng +[bhelgaas: changelog] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/pci/switch/switchtec.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/switch/switchtec.c b/drivers/pci/switch/switchtec.c +index 54a8b30dda38..37d0c15c9eeb 100644 +--- a/drivers/pci/switch/switchtec.c ++++ b/drivers/pci/switch/switchtec.c +@@ -800,6 +800,7 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev, + { + int ret; + int nr_idxs; ++ unsigned int event_flags; + struct switchtec_ioctl_event_ctl ctl; + + if (copy_from_user(&ctl, uctl, sizeof(ctl))) +@@ -821,7 +822,9 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev, + else + return -EINVAL; + ++ event_flags = ctl.flags; + for (ctl.index = 0; ctl.index < nr_idxs; ctl.index++) { ++ ctl.flags = event_flags; + ret = event_ctl(stdev, &ctl); + if (ret < 0) + return ret; +-- +2.19.1 + diff --git a/queue-4.20/tee-optee-avoid-possible-double-list_del.patch b/queue-4.20/tee-optee-avoid-possible-double-list_del.patch new file mode 100644 index 00000000000..1bb85513366 --- /dev/null +++ b/queue-4.20/tee-optee-avoid-possible-double-list_del.patch @@ -0,0 +1,102 @@ +From 41e8cf1fbb7188e2b9a8b44da7f210fd6c171fe7 Mon Sep 17 00:00:00 2001 +From: Zhizhou Zhang +Date: Wed, 21 Nov 2018 11:01:43 +0800 +Subject: tee: optee: avoid possible double list_del() + +[ Upstream commit b2d102bd0146d9eb1fa630ca0cd19a15ef2f74c8 ] + +This bug occurs when: + +- a new request arrives, one thread(let's call it A) is pending in + optee_supp_req() with req->busy is initial value false. + +- tee-supplicant is killed, then optee_supp_release() is called, this + function calls list_del(&req->link), and set supp->ctx to NULL. And + it also wake up process A. + +- process A continues, it firstly checks supp->ctx which is NULL, + then checks req->busy which is false, at last run list_del(&req->link). + This triggers double list_del() and results kernel panic. + +For solve this problem, we rename req->busy to req->in_queue, and +associate it with state of whether req is linked to supp->reqs. So we +can just only check req->in_queue to make decision calling list_del() +or not. + +Signed-off-by: Zhizhou Zhang +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/tee/optee/supp.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/tee/optee/supp.c b/drivers/tee/optee/supp.c +index df35fc01fd3e..43626e15703a 100644 +--- a/drivers/tee/optee/supp.c ++++ b/drivers/tee/optee/supp.c +@@ -19,7 +19,7 @@ + struct optee_supp_req { + struct list_head link; + +- bool busy; ++ bool in_queue; + u32 func; + u32 ret; + size_t num_params; +@@ -54,7 +54,6 @@ void optee_supp_release(struct optee_supp *supp) + + /* Abort all request retrieved by supplicant */ + idr_for_each_entry(&supp->idr, req, id) { +- req->busy = false; + idr_remove(&supp->idr, id); + req->ret = TEEC_ERROR_COMMUNICATION; + complete(&req->c); +@@ -63,6 +62,7 @@ void optee_supp_release(struct optee_supp *supp) + /* Abort all queued requests */ + list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) { + list_del(&req->link); ++ req->in_queue = false; + req->ret = TEEC_ERROR_COMMUNICATION; + complete(&req->c); + } +@@ -103,6 +103,7 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, + /* Insert the request in the request list */ + mutex_lock(&supp->mutex); + list_add_tail(&req->link, &supp->reqs); ++ req->in_queue = true; + mutex_unlock(&supp->mutex); + + /* Tell an eventual waiter there's a new request */ +@@ -130,9 +131,10 @@ u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params, + * will serve all requests in a timely manner and + * interrupting then wouldn't make sense. + */ +- interruptable = !req->busy; +- if (!req->busy) ++ if (req->in_queue) { + list_del(&req->link); ++ req->in_queue = false; ++ } + } + mutex_unlock(&supp->mutex); + +@@ -176,7 +178,7 @@ static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp, + return ERR_PTR(-ENOMEM); + + list_del(&req->link); +- req->busy = true; ++ req->in_queue = false; + + return req; + } +@@ -318,7 +320,6 @@ static struct optee_supp_req *supp_pop_req(struct optee_supp *supp, + if ((num_params - nm) != req->num_params) + return ERR_PTR(-EINVAL); + +- req->busy = false; + idr_remove(&supp->idr, id); + supp->req_id = -1; + *num_meta = nm; +-- +2.19.1 + diff --git a/queue-4.20/thermal-bcm2835-enable-hwmon-explicitly.patch b/queue-4.20/thermal-bcm2835-enable-hwmon-explicitly.patch new file mode 100644 index 00000000000..aece0b5a58b --- /dev/null +++ b/queue-4.20/thermal-bcm2835-enable-hwmon-explicitly.patch @@ -0,0 +1,51 @@ +From d935cd199b9f0f8143b78b683048e8a923234093 Mon Sep 17 00:00:00 2001 +From: Matthias Brugger +Date: Sun, 21 Oct 2018 23:58:48 +0200 +Subject: thermal: bcm2835: enable hwmon explicitly + +[ Upstream commit d56c19d07e0bc3ceff366a49b7d7a2440c967b1b ] + +By defaul of-based thermal driver do not enable hwmon. +This patch does this explicitly, so that the temperature can be read +through the common hwmon sysfs. + +Signed-off-by: Matthias Brugger +Acked-by: Stefan Wahren +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/broadcom/bcm2835_thermal.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c +index b9d90f0ed504..720760cd493f 100644 +--- a/drivers/thermal/broadcom/bcm2835_thermal.c ++++ b/drivers/thermal/broadcom/bcm2835_thermal.c +@@ -18,6 +18,8 @@ + #include + #include + ++#include "../thermal_hwmon.h" ++ + #define BCM2835_TS_TSENSCTL 0x00 + #define BCM2835_TS_TSENSSTAT 0x04 + +@@ -266,6 +268,15 @@ static int bcm2835_thermal_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, tz); + ++ /* ++ * Thermal_zone doesn't enable hwmon as default, ++ * enable it here ++ */ ++ tz->tzp->no_hwmon = false; ++ err = thermal_add_hwmon_sysfs(tz); ++ if (err) ++ goto err_tz; ++ + bcm2835_thermal_debugfs(pdev); + + return 0; +-- +2.19.1 + diff --git a/queue-4.20/thermal-do-not-clear-passive-state-during-system-sle.patch b/queue-4.20/thermal-do-not-clear-passive-state-during-system-sle.patch new file mode 100644 index 00000000000..ff037c368cc --- /dev/null +++ b/queue-4.20/thermal-do-not-clear-passive-state-during-system-sle.patch @@ -0,0 +1,68 @@ +From c1e5992ecd908dc88d7c6d85b604fb01a44211a3 Mon Sep 17 00:00:00 2001 +From: Wei Wang +Date: Wed, 7 Nov 2018 14:36:11 -0800 +Subject: Thermal: do not clear passive state during system sleep + +[ Upstream commit 964f4843a455d2ffb199512b08be8d5f077c4cac ] + +commit ff140fea847e ("Thermal: handle thermal zone device properly +during system sleep") added PM hook to call thermal zone reset during +sleep. However resetting thermal zone will also clear the passive state +and thus cancel the polling queue which leads the passive cooling device +state not being cleared properly after sleep. + +thermal_pm_notify => thermal_zone_device_reset set passive to 0 +thermal_zone_trip_update will skip update passive as `old_target == +instance->target'. +monitor_thermal_zone => thermal_zone_device_set_polling will cancel +tz->poll_queue, so the cooling device state will not be changed +afterwards. + +Reported-by: Kame Wang +Signed-off-by: Wei Wang +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_core.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c +index d6ebc1cf6aa9..3a014cd8daf0 100644 +--- a/drivers/thermal/thermal_core.c ++++ b/drivers/thermal/thermal_core.c +@@ -453,16 +453,20 @@ static void update_temperature(struct thermal_zone_device *tz) + tz->last_temperature, tz->temperature); + } + +-static void thermal_zone_device_reset(struct thermal_zone_device *tz) ++static void thermal_zone_device_init(struct thermal_zone_device *tz) + { + struct thermal_instance *pos; +- + tz->temperature = THERMAL_TEMP_INVALID; +- tz->passive = 0; + list_for_each_entry(pos, &tz->thermal_instances, tz_node) + pos->initialized = false; + } + ++static void thermal_zone_device_reset(struct thermal_zone_device *tz) ++{ ++ tz->passive = 0; ++ thermal_zone_device_init(tz); ++} ++ + void thermal_zone_device_update(struct thermal_zone_device *tz, + enum thermal_notify_event event) + { +@@ -1504,7 +1508,7 @@ static int thermal_pm_notify(struct notifier_block *nb, + case PM_POST_SUSPEND: + atomic_set(&in_suspend, 0); + list_for_each_entry(tz, &thermal_tz_list, node) { +- thermal_zone_device_reset(tz); ++ thermal_zone_device_init(tz); + thermal_zone_device_update(tz, + THERMAL_EVENT_UNSPECIFIED); + } +-- +2.19.1 + diff --git a/queue-4.20/thermal-fix-locking-in-cooling-device-sysfs-update-c.patch b/queue-4.20/thermal-fix-locking-in-cooling-device-sysfs-update-c.patch new file mode 100644 index 00000000000..49a8cf35a54 --- /dev/null +++ b/queue-4.20/thermal-fix-locking-in-cooling-device-sysfs-update-c.patch @@ -0,0 +1,46 @@ +From 5593fb06ed6328dbdfcb02d3152ec159f26ff304 Mon Sep 17 00:00:00 2001 +From: Thara Gopinath +Date: Tue, 27 Nov 2018 17:43:11 -0500 +Subject: thermal: Fix locking in cooling device sysfs update cur_state + +[ Upstream commit 68000a0d983f539c95ebe5dccd4f29535c7ac0af ] + +Sysfs interface to update cooling device cur_state does not +currently holding cooling device lock sometimes leading to +stale values in cur_state if getting updated simultanelously +from user space and thermal framework. Adding the proper locking +code fixes this issue. + +Signed-off-by: Thara Gopinath +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal_sysfs.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal_sysfs.c b/drivers/thermal/thermal_sysfs.c +index 2241ceae7d7f..aa99edb4dff7 100644 +--- a/drivers/thermal/thermal_sysfs.c ++++ b/drivers/thermal/thermal_sysfs.c +@@ -712,11 +712,14 @@ cur_state_store(struct device *dev, struct device_attribute *attr, + if ((long)state < 0) + return -EINVAL; + ++ mutex_lock(&cdev->lock); ++ + result = cdev->ops->set_cur_state(cdev, state); +- if (result) +- return result; +- thermal_cooling_device_stats_update(cdev, state); +- return count; ++ if (!result) ++ thermal_cooling_device_stats_update(cdev, state); ++ ++ mutex_unlock(&cdev->lock); ++ return result ? result : count; + } + + static struct device_attribute +-- +2.19.1 + diff --git a/queue-4.20/thermal-generic-adc-fix-adc-to-temp-interpolation.patch b/queue-4.20/thermal-generic-adc-fix-adc-to-temp-interpolation.patch new file mode 100644 index 00000000000..1c80307d45c --- /dev/null +++ b/queue-4.20/thermal-generic-adc-fix-adc-to-temp-interpolation.patch @@ -0,0 +1,63 @@ +From 4a11218d4332e4a91071852f51db47f0b6936a05 Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Sun, 23 Dec 2018 23:26:44 -0800 +Subject: thermal: generic-adc: Fix adc to temp interpolation + +[ Upstream commit 9d216211fded20fff301d0317af3238d8383634c ] + +First correct the edge case to return the last element if we're +outside the range, rather than at the last element, so that +interpolation is not omitted for points between the two last entries in +the table. + +Then correct the formula to perform linear interpolation based the two +points surrounding the read ADC value. The indices for temp are kept as +"hi" and "lo" to pair with the adc indices, but there's no requirement +that the temperature is provided in descendent order. mult_frac() is +used to prevent issues with overflowing the int. + +Cc: Laxman Dewangan +Signed-off-by: Bjorn Andersson +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/thermal-generic-adc.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/thermal-generic-adc.c b/drivers/thermal/thermal-generic-adc.c +index bf1c628d4a7a..e22fc60ad36d 100644 +--- a/drivers/thermal/thermal-generic-adc.c ++++ b/drivers/thermal/thermal-generic-adc.c +@@ -26,7 +26,7 @@ struct gadc_thermal_info { + + static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val) + { +- int temp, adc_hi, adc_lo; ++ int temp, temp_hi, temp_lo, adc_hi, adc_lo; + int i; + + for (i = 0; i < gti->nlookup_table; i++) { +@@ -36,13 +36,17 @@ static int gadc_thermal_adc_to_temp(struct gadc_thermal_info *gti, int val) + + if (i == 0) { + temp = gti->lookup_table[0]; +- } else if (i >= (gti->nlookup_table - 1)) { ++ } else if (i >= gti->nlookup_table) { + temp = gti->lookup_table[2 * (gti->nlookup_table - 1)]; + } else { + adc_hi = gti->lookup_table[2 * i - 1]; + adc_lo = gti->lookup_table[2 * i + 1]; +- temp = gti->lookup_table[2 * i]; +- temp -= ((val - adc_lo) * 1000) / (adc_hi - adc_lo); ++ ++ temp_hi = gti->lookup_table[2 * i - 2]; ++ temp_lo = gti->lookup_table[2 * i]; ++ ++ temp = temp_hi + mult_frac(temp_lo - temp_hi, val - adc_hi, ++ adc_lo - adc_hi); + } + + return temp; +-- +2.19.1 + diff --git a/queue-4.20/thermal-tsens-qcom-do-not-create-duplicate-regmap-de.patch b/queue-4.20/thermal-tsens-qcom-do-not-create-duplicate-regmap-de.patch new file mode 100644 index 00000000000..69cd77c8a6b --- /dev/null +++ b/queue-4.20/thermal-tsens-qcom-do-not-create-duplicate-regmap-de.patch @@ -0,0 +1,58 @@ +From e1d7577baa817b53506559ea6ff15af3b73d9ab0 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Thu, 15 Nov 2018 17:43:30 +0000 +Subject: thermal: tsens: qcom: do not create duplicate regmap debugfs entries + +[ Upstream commit 4ab248b3b10a58e379e2d32333fff99ea5ca256c ] + +Regmap would use device name to create debugfs entries. If the device +has multiple regmaps it is recommended to use name field in regmap_config. +Fix this by providing name to the regmap configs correctly. + +Without this patch we would see below error on DB820c. + +qcom-tsens 4a9000.thermal-sensor: Failed to create 4a9000.thermal-sensor +debugfs directory + +Signed-off-by: Srinivas Kandagatla +Acked-by: Amit Kucheria +Tested-by: Amit Kucheria +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-common.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-common.c b/drivers/thermal/qcom/tsens-common.c +index 3be4be2e0465..78652cac7f3d 100644 +--- a/drivers/thermal/qcom/tsens-common.c ++++ b/drivers/thermal/qcom/tsens-common.c +@@ -114,6 +114,14 @@ int get_temp_common(struct tsens_device *tmdev, int id, int *temp) + } + + static const struct regmap_config tsens_config = { ++ .name = "tm", ++ .reg_bits = 32, ++ .val_bits = 32, ++ .reg_stride = 4, ++}; ++ ++static const struct regmap_config tsens_srot_config = { ++ .name = "srot", + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, +@@ -139,8 +147,8 @@ int __init init_common(struct tsens_device *tmdev) + if (IS_ERR(srot_base)) + return PTR_ERR(srot_base); + +- tmdev->srot_map = devm_regmap_init_mmio(tmdev->dev, +- srot_base, &tsens_config); ++ tmdev->srot_map = devm_regmap_init_mmio(tmdev->dev, srot_base, ++ &tsens_srot_config); + if (IS_ERR(tmdev->srot_map)) + return PTR_ERR(tmdev->srot_map); + +-- +2.19.1 + diff --git a/queue-4.20/timekeeping-use-proper-seqcount-initializer.patch b/queue-4.20/timekeeping-use-proper-seqcount-initializer.patch new file mode 100644 index 00000000000..2cc063a9c4b --- /dev/null +++ b/queue-4.20/timekeeping-use-proper-seqcount-initializer.patch @@ -0,0 +1,45 @@ +From e5fddd6d2a4923e219a426410f9f04d55a274ef6 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Wed, 28 Nov 2018 15:43:09 -0800 +Subject: timekeeping: Use proper seqcount initializer + +[ Upstream commit ce10a5b3954f2514af726beb78ed8d7350c5e41c ] + +tk_core.seq is initialized open coded, but that misses to initialize the +lockdep map when lockdep is enabled. Lockdep splats involving tk_core seq +consequently lack a name and are hard to read. + +Use the proper initializer which takes care of the lockdep map +initialization. + +[ tglx: Massaged changelog ] + +Signed-off-by: Bart Van Assche +Signed-off-by: Thomas Gleixner +Cc: peterz@infradead.org +Cc: tj@kernel.org +Cc: johannes.berg@intel.com +Link: https://lkml.kernel.org/r/20181128234325.110011-12-bvanassche@acm.org +Signed-off-by: Sasha Levin +--- + kernel/time/timekeeping.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 2d110c948805..6c9493495538 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -50,7 +50,9 @@ enum timekeeping_adv_mode { + static struct { + seqcount_t seq; + struct timekeeper timekeeper; +-} tk_core ____cacheline_aligned; ++} tk_core ____cacheline_aligned = { ++ .seq = SEQCNT_ZERO(tk_core.seq), ++}; + + static DEFINE_RAW_SPINLOCK(timekeeper_lock); + static struct timekeeper shadow_timekeeper; +-- +2.19.1 + diff --git a/queue-4.20/tipc-fix-node-keep-alive-interval-calculation.patch b/queue-4.20/tipc-fix-node-keep-alive-interval-calculation.patch new file mode 100644 index 00000000000..8e5cbdb575d --- /dev/null +++ b/queue-4.20/tipc-fix-node-keep-alive-interval-calculation.patch @@ -0,0 +1,73 @@ +From ddba928ca32416d6da946e7d073999f78ebd4241 Mon Sep 17 00:00:00 2001 +From: Hoang Le +Date: Thu, 6 Dec 2018 09:00:09 +0700 +Subject: tipc: fix node keep alive interval calculation + +[ Upstream commit f5d6c3e5a359c0507800e7ac68d565c21de9b5a1 ] + +When setting LINK tolerance, node timer interval will be calculated +base on the LINK with lowest tolerance. + +But when calculated, the old node timer interval only updated if current +setting value (tolerance/4) less than old ones regardless of number of +links as well as links' lowest tolerance value. + +This caused to two cases missing if tolerance changed as following: +Case 1: +1.1/ There is one link (L1) available in the system +1.2/ Set L1's tolerance from 1500ms => lower (i.e 500ms) +1.3/ Then, fallback to default (1500ms) or higher (i.e 2000ms) + +Expected: + node timer interval is 1500/4=375ms after 1.3 + +Result: +node timer interval will not being updated after changing tolerance at 1.3 +since its value 1500/4=375ms is not less than 500/4=125ms at 1.2. + +Case 2: +2.1/ There are two links (L1, L2) available in the system +2.2/ L1 and L2 tolerance value are 2000ms as initial +2.3/ Set L2's tolerance from 2000ms => lower 1500ms +2.4/ Disable link L2 (bring down its bearer) + +Expected: + node timer interval is 2000ms/4=500ms after 2.4 + +Result: +node timer interval will not being updated after disabling L2 since +its value 2000ms/4=500ms is still not less than 1500/4=375ms at 2.3 +although L2 is already not available in the system. + +To fix this, we start the node interval calculation by initializing it to +a value larger than any conceivable calculated value. This way, the link +with the lowest tolerance will always determine the calculated value. + +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/node.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 488019766433..32556f480a60 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -624,6 +624,12 @@ static void tipc_node_timeout(struct timer_list *t) + + __skb_queue_head_init(&xmitq); + ++ /* Initial node interval to value larger (10 seconds), then it will be ++ * recalculated with link lowest tolerance ++ */ ++ tipc_node_read_lock(n); ++ n->keepalive_intv = 10000; ++ tipc_node_read_unlock(n); + for (bearer_id = 0; remains && (bearer_id < MAX_BEARERS); bearer_id++) { + tipc_node_read_lock(n); + le = &n->links[bearer_id]; +-- +2.19.1 + diff --git a/queue-4.20/tools-bpftool-fix-wmissing-declaration-warnings.patch b/queue-4.20/tools-bpftool-fix-wmissing-declaration-warnings.patch new file mode 100644 index 00000000000..301c653d90b --- /dev/null +++ b/queue-4.20/tools-bpftool-fix-wmissing-declaration-warnings.patch @@ -0,0 +1,137 @@ +From ab99ad58dd9969580c5178497dfef8cf0f3ea2e9 Mon Sep 17 00:00:00 2001 +From: Quentin Monnet +Date: Fri, 14 Dec 2018 13:56:01 +0000 +Subject: tools: bpftool: fix -Wmissing declaration warnings + +[ Upstream commit c101189bc9680675a2686bafe908015a07a0da51 ] + +Help compiler check arguments for several utility functions used to +print items to the console by adding the "printf" attribute when +declaring those functions. + +Also, declare as "static" two functions that are only used in prog.c. + +All of them discovered by compiling bpftool with +-Wmissing-format-attribute -Wmissing-declarations. + +Signed-off-by: Quentin Monnet +Reviewed-by: Jakub Kicinski +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/common.c | 4 ++-- + tools/bpf/bpftool/json_writer.c | 6 ++++-- + tools/bpf/bpftool/prog.c | 4 ++-- + tools/bpf/bpftool/xlated_dumper.c | 7 ++++--- + 4 files changed, 12 insertions(+), 9 deletions(-) + +diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c +index 70fd48d79f61..05d715e6b128 100644 +--- a/tools/bpf/bpftool/common.c ++++ b/tools/bpf/bpftool/common.c +@@ -58,7 +58,7 @@ + #define BPF_FS_MAGIC 0xcafe4a11 + #endif + +-void p_err(const char *fmt, ...) ++void __printf(1, 2) p_err(const char *fmt, ...) + { + va_list ap; + +@@ -76,7 +76,7 @@ void p_err(const char *fmt, ...) + va_end(ap); + } + +-void p_info(const char *fmt, ...) ++void __printf(1, 2) p_info(const char *fmt, ...) + { + va_list ap; + +diff --git a/tools/bpf/bpftool/json_writer.c b/tools/bpf/bpftool/json_writer.c +index c6eef76322ae..4e4149421d07 100644 +--- a/tools/bpf/bpftool/json_writer.c ++++ b/tools/bpf/bpftool/json_writer.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + #include "json_writer.h" + +@@ -156,7 +157,8 @@ void jsonw_name(json_writer_t *self, const char *name) + putc(' ', self->out); + } + +-void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap) ++void __printf(2, 0) ++jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap) + { + jsonw_eor(self); + putc('"', self->out); +@@ -164,7 +166,7 @@ void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap) + putc('"', self->out); + } + +-void jsonw_printf(json_writer_t *self, const char *fmt, ...) ++void __printf(2, 3) jsonw_printf(json_writer_t *self, const char *fmt, ...) + { + va_list ap; + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index ccee180dfb76..69b01a6158bd 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -84,7 +84,7 @@ static const char * const attach_type_strings[] = { + [__MAX_BPF_ATTACH_TYPE] = NULL, + }; + +-enum bpf_attach_type parse_attach_type(const char *str) ++static enum bpf_attach_type parse_attach_type(const char *str) + { + enum bpf_attach_type type; + +@@ -713,7 +713,7 @@ struct map_replace { + char *name; + }; + +-int map_replace_compar(const void *p1, const void *p2) ++static int map_replace_compar(const void *p1, const void *p2) + { + const struct map_replace *a = p1, *b = p2; + +diff --git a/tools/bpf/bpftool/xlated_dumper.c b/tools/bpf/bpftool/xlated_dumper.c +index 3284759df98a..98083e4dc0f9 100644 +--- a/tools/bpf/bpftool/xlated_dumper.c ++++ b/tools/bpf/bpftool/xlated_dumper.c +@@ -114,7 +114,7 @@ struct kernel_sym *kernel_syms_search(struct dump_data *dd, + sizeof(*dd->sym_mapping), kernel_syms_cmp) : NULL; + } + +-static void print_insn(void *private_data, const char *fmt, ...) ++static void __printf(2, 3) print_insn(void *private_data, const char *fmt, ...) + { + va_list args; + +@@ -123,7 +123,7 @@ static void print_insn(void *private_data, const char *fmt, ...) + va_end(args); + } + +-static void ++static void __printf(2, 3) + print_insn_for_graph(void *private_data, const char *fmt, ...) + { + char buf[64], *p; +@@ -154,7 +154,8 @@ print_insn_for_graph(void *private_data, const char *fmt, ...) + printf("%s", buf); + } + +-static void print_insn_json(void *private_data, const char *fmt, ...) ++static void __printf(2, 3) ++print_insn_json(void *private_data, const char *fmt, ...) + { + unsigned int l = strlen(fmt); + char chomped_fmt[l]; +-- +2.19.1 + diff --git a/queue-4.20/tools-hv-kvp-fix-a-warning-of-buffer-overflow-with-g.patch b/queue-4.20/tools-hv-kvp-fix-a-warning-of-buffer-overflow-with-g.patch new file mode 100644 index 00000000000..ef5654a9f3d --- /dev/null +++ b/queue-4.20/tools-hv-kvp-fix-a-warning-of-buffer-overflow-with-g.patch @@ -0,0 +1,65 @@ +From 23bedee35fdaa47c575f02a269f54cfd40526aa6 Mon Sep 17 00:00:00 2001 +From: Dexuan Cui +Date: Thu, 18 Oct 2018 05:09:32 +0000 +Subject: Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1 + +[ Upstream commit 4fcba7802c3e15a6e56e255871d6c72f829b9dd8 ] + +The patch fixes: + +hv_kvp_daemon.c: In function 'kvp_set_ip_info': +hv_kvp_daemon.c:1305:2: note: 'snprintf' output between 41 and 4136 bytes +into a destination of size 4096 + +The "(unsigned int)str_len" is to avoid: + +hv_kvp_daemon.c:1309:30: warning: comparison of integer expressions of +different signedness: 'int' and 'long unsigned int' [-Wsign-compare] + +Signed-off-by: Dexuan Cui +Cc: K. Y. Srinivasan +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + tools/hv/hv_kvp_daemon.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index bbb2a8ef367c..d7e06fe0270e 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val) + FILE *file; + char cmd[PATH_MAX]; + char *mac_addr; ++ int str_len; + + /* + * Set the configuration for the specified interface with +@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val) + * invoke the external script to do its magic. + */ + +- snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s", +- "hv_set_ifconfig", if_file); ++ str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s", ++ "hv_set_ifconfig", if_file); ++ /* ++ * This is a little overcautious, but it's necessary to suppress some ++ * false warnings from gcc 8.0.1. ++ */ ++ if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) { ++ syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long", ++ cmd, str_len); ++ return HV_E_FAIL; ++ } ++ + if (system(cmd)) { + syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s", + cmd, errno, strerror(errno)); +-- +2.19.1 + diff --git a/queue-4.20/tools-power-x86-intel_pstate_tracer-fix-non-root-exe.patch b/queue-4.20/tools-power-x86-intel_pstate_tracer-fix-non-root-exe.patch new file mode 100644 index 00000000000..cbd16d10687 --- /dev/null +++ b/queue-4.20/tools-power-x86-intel_pstate_tracer-fix-non-root-exe.patch @@ -0,0 +1,47 @@ +From 084748fe9db74a555d7fdab95f27ec20533d4409 Mon Sep 17 00:00:00 2001 +From: Doug Smythies +Date: Mon, 17 Dec 2018 23:34:04 -0800 +Subject: tools/power/x86/intel_pstate_tracer: Fix non root execution for post + processing a trace file + +[ Upstream commit 663546903c835fe46308b1b1e53d32d1f2b33da9 ] + +This script is supposed to be allowed to run with regular user +privileges if a previously captured trace is being post processed. + +Commit fbe313884d7d (tools/power/x86/intel_pstate_tracer: Free the +trace buffer memory) introduced a bug that breaks that option. + +Commit 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add +optional setting of trace buffer memory allocation) moved the code +but kept the bug. + +This patch fixes the issue. + +Fixes: 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional ...) +Signed-off-by: Doug Smythies +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py +index 84e2b648e622..2fa3c5757bcb 100755 +--- a/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py ++++ b/tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py +@@ -585,9 +585,9 @@ current_max_cpu = 0 + + read_trace_data(filename) + +-clear_trace_file() +-# Free the memory + if interval: ++ clear_trace_file() ++ # Free the memory + free_trace_buffer() + + if graph_data_present == False: +-- +2.19.1 + diff --git a/queue-4.20/tracing-have-trace_stack-nr_entries-compare-not-be-s.patch b/queue-4.20/tracing-have-trace_stack-nr_entries-compare-not-be-s.patch new file mode 100644 index 00000000000..80893e8ebb5 --- /dev/null +++ b/queue-4.20/tracing-have-trace_stack-nr_entries-compare-not-be-s.patch @@ -0,0 +1,65 @@ +From 165423a2a8ad0c5ffc0155bce8c52d791c29f6b5 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 20 Jun 2018 14:08:00 +0300 +Subject: tracing: Have trace_stack nr_entries compare not be so subtle + +[ Upstream commit ca16b0fbb05242f18da9d810c07d3882ffed831c ] + +Dan Carpenter reviewed the trace_stack.c code and figured he found an off by +one bug. + + "From reviewing the code, it seems possible for + stack_trace_max.nr_entries to be set to .max_entries and in that case we + would be reading one element beyond the end of the stack_dump_trace[] + array. If it's not set to .max_entries then the bug doesn't affect + runtime." + +Although it looks to be the case, it is not. Because we have: + + static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] = + { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX }; + + struct stack_trace stack_trace_max = { + .max_entries = STACK_TRACE_ENTRIES - 1, + .entries = &stack_dump_trace[0], + }; + +And: + + stack_trace_max.nr_entries = x; + for (; x < i; x++) + stack_dump_trace[x] = ULONG_MAX; + +Even if nr_entries equals max_entries, indexing with it into the +stack_dump_trace[] array will not overflow the array. But if it is the case, +the second part of the conditional that tests stack_dump_trace[nr_entries] +to ULONG_MAX will always be true. + +By applying Dan's patch, it removes the subtle aspect of it and makes the if +conditional slightly more efficient. + +Link: http://lkml.kernel.org/r/20180620110758.crunhd5bfep7zuiz@kili.mountain + +Signed-off-by: Dan Carpenter +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_stack.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c +index 2b0d1ee3241c..e2a153fc1afc 100644 +--- a/kernel/trace/trace_stack.c ++++ b/kernel/trace/trace_stack.c +@@ -286,7 +286,7 @@ __next(struct seq_file *m, loff_t *pos) + { + long n = *pos - 1; + +- if (n > stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX) ++ if (n >= stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX) + return NULL; + + m->private = (void *)n; +-- +2.19.1 + diff --git a/queue-4.20/tty-serial-samsung-properly-set-flags-in-autocts-mod.patch b/queue-4.20/tty-serial-samsung-properly-set-flags-in-autocts-mod.patch new file mode 100644 index 00000000000..14266a6693c --- /dev/null +++ b/queue-4.20/tty-serial-samsung-properly-set-flags-in-autocts-mod.patch @@ -0,0 +1,45 @@ +From 21fbf6f80a1deca78fc0e19f9159a22d29d2a7bd Mon Sep 17 00:00:00 2001 +From: Beomho Seo +Date: Fri, 14 Dec 2018 12:34:08 +0100 +Subject: tty: serial: samsung: Properly set flags in autoCTS mode + +[ Upstream commit 31e933645742ee6719d37573a27cce0761dcf92b ] + +Commit 391f93f2ec9f ("serial: core: Rework hw-assited flow control support") +has changed the way the autoCTS mode is handled. + +According to that change, serial drivers which enable H/W autoCTS mode must +set UPSTAT_AUTOCTS to prevent the serial core from inadvertently disabling +TX. This patch adds proper handling of UPSTAT_AUTOCTS flag. + +Signed-off-by: Beomho Seo +[mszyprow: rephrased commit message] +Signed-off-by: Marek Szyprowski +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/samsung.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index da1bd4bba8a9..2a49b6d876b8 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1365,11 +1365,14 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + wr_regl(port, S3C2410_ULCON, ulcon); + wr_regl(port, S3C2410_UBRDIV, quot); + ++ port->status &= ~UPSTAT_AUTOCTS; ++ + umcon = rd_regl(port, S3C2410_UMCON); + if (termios->c_cflag & CRTSCTS) { + umcon |= S3C2410_UMCOM_AFC; + /* Disable RTS when RX FIFO contains 63 bytes */ + umcon &= ~S3C2412_UMCON_AFC_8; ++ port->status = UPSTAT_AUTOCTS; + } else { + umcon &= ~S3C2410_UMCOM_AFC; + } +-- +2.19.1 + diff --git a/queue-4.20/udf-fix-bug-on-corrupted-inode.patch b/queue-4.20/udf-fix-bug-on-corrupted-inode.patch new file mode 100644 index 00000000000..0a0e4afd6fe --- /dev/null +++ b/queue-4.20/udf-fix-bug-on-corrupted-inode.patch @@ -0,0 +1,38 @@ +From 4b302e2419a913516f01981d37f85ebdaa891466 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 12 Dec 2018 14:29:20 +0100 +Subject: udf: Fix BUG on corrupted inode + +[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ] + +When inode is corrupted so that extent type is invalid, some functions +(such as udf_truncate_extents()) will just BUG. Check that extent type +is valid when loading the inode to memory. + +Reported-by: Anatoly Trosinenko +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/inode.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index 5df554a9f9c9..ae796e10f68b 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -1357,6 +1357,12 @@ reread: + + iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) & + ICBTAG_FLAG_AD_MASK; ++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT && ++ iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG && ++ iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) { ++ ret = -EIO; ++ goto out; ++ } + iinfo->i_unique = 0; + iinfo->i_lenEAttr = 0; + iinfo->i_lenExtents = 0; +-- +2.19.1 + diff --git a/queue-4.20/um-avoid-marking-pages-with-changed-protection.patch b/queue-4.20/um-avoid-marking-pages-with-changed-protection.patch new file mode 100644 index 00000000000..50c8fb32b9c --- /dev/null +++ b/queue-4.20/um-avoid-marking-pages-with-changed-protection.patch @@ -0,0 +1,56 @@ +From 9fa088635fe68b5a32296640a8e95c775c046a84 Mon Sep 17 00:00:00 2001 +From: Anton Ivanov +Date: Wed, 5 Dec 2018 12:37:41 +0000 +Subject: um: Avoid marking pages with "changed protection" + +[ Upstream commit 8892d8545f2d0342b9c550defbfb165db237044b ] + +Changing protection is a very high cost operation in UML +because in addition to an extra syscall it also interrupts +mmap merge sequences generated by the tlb. + +While the condition is not particularly common it is worth +avoiding. + +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/include/asm/pgtable.h | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/arch/um/include/asm/pgtable.h b/arch/um/include/asm/pgtable.h +index 7485398d0737..9c04562310b3 100644 +--- a/arch/um/include/asm/pgtable.h ++++ b/arch/um/include/asm/pgtable.h +@@ -197,12 +197,17 @@ static inline pte_t pte_mkold(pte_t pte) + + static inline pte_t pte_wrprotect(pte_t pte) + { +- pte_clear_bits(pte, _PAGE_RW); ++ if (likely(pte_get_bits(pte, _PAGE_RW))) ++ pte_clear_bits(pte, _PAGE_RW); ++ else ++ return pte; + return(pte_mknewprot(pte)); + } + + static inline pte_t pte_mkread(pte_t pte) + { ++ if (unlikely(pte_get_bits(pte, _PAGE_USER))) ++ return pte; + pte_set_bits(pte, _PAGE_USER); + return(pte_mknewprot(pte)); + } +@@ -221,6 +226,8 @@ static inline pte_t pte_mkyoung(pte_t pte) + + static inline pte_t pte_mkwrite(pte_t pte) + { ++ if (unlikely(pte_get_bits(pte, _PAGE_RW))) ++ return pte; + pte_set_bits(pte, _PAGE_RW); + return(pte_mknewprot(pte)); + } +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc2-disable-power-down-feature-on-samsung-socs.patch b/queue-4.20/usb-dwc2-disable-power-down-feature-on-samsung-socs.patch new file mode 100644 index 00000000000..9fcbd4f4a1b --- /dev/null +++ b/queue-4.20/usb-dwc2-disable-power-down-feature-on-samsung-socs.patch @@ -0,0 +1,53 @@ +From 964a39ccf0f09f9f7041fed4ec4f29b9df4573da Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Tue, 20 Nov 2018 16:38:15 +0100 +Subject: usb: dwc2: Disable power down feature on Samsung SoCs + +[ Upstream commit 35a6054132286a4ab92b536595093b82e6bdfcbc ] + +Power down feature of DWC2 module integrated in Samsung SoCs doesn't work +properly or needs some additional handling in PHY or SoC glue layer, so +disable it for now. Without disabling power down, DWC2 causes random memory +trashes and fails enumeration if there is no USB link to host on driver +probe. + +Fixes: 03ea6d6e9e1ff1 ("usb: dwc2: Enable power down") +Acked-by: Minas Harutyunyan +Signed-off-by: Marek Szyprowski +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/params.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c +index 38c813b1d203..24ff5f21cb25 100644 +--- a/drivers/usb/dwc2/params.c ++++ b/drivers/usb/dwc2/params.c +@@ -71,6 +71,13 @@ static void dwc2_set_his_params(struct dwc2_hsotg *hsotg) + p->power_down = false; + } + ++static void dwc2_set_s3c6400_params(struct dwc2_hsotg *hsotg) ++{ ++ struct dwc2_core_params *p = &hsotg->params; ++ ++ p->power_down = 0; ++} ++ + static void dwc2_set_rk_params(struct dwc2_hsotg *hsotg) + { + struct dwc2_core_params *p = &hsotg->params; +@@ -152,7 +159,8 @@ const struct of_device_id dwc2_of_match_table[] = { + { .compatible = "lantiq,arx100-usb", .data = dwc2_set_ltq_params }, + { .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params }, + { .compatible = "snps,dwc2" }, +- { .compatible = "samsung,s3c6400-hsotg" }, ++ { .compatible = "samsung,s3c6400-hsotg", ++ .data = dwc2_set_s3c6400_params }, + { .compatible = "amlogic,meson8-usb", + .data = dwc2_set_amlogic_params }, + { .compatible = "amlogic,meson8b-usb", +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc3-correct-the-logic-for-checking-trb-full-in-.patch b/queue-4.20/usb-dwc3-correct-the-logic-for-checking-trb-full-in-.patch new file mode 100644 index 00000000000..4a23287f31c --- /dev/null +++ b/queue-4.20/usb-dwc3-correct-the-logic-for-checking-trb-full-in-.patch @@ -0,0 +1,74 @@ +From 6f804c4ac370d7f03729733c883384c60630eaf3 Mon Sep 17 00:00:00 2001 +From: Anurag Kumar Vulisha +Date: Sat, 1 Dec 2018 16:43:29 +0530 +Subject: usb: dwc3: Correct the logic for checking TRB full in + __dwc3_prepare_one_trb() + +[ Upstream commit b7a4fbe2300a8965ea760c7e871507b84aea17f6 ] + +Availability of TRB's is calculated using dwc3_calc_trbs_left(), which +determines total available TRB's based on the HWO bit set in a TRB. + +In the present code, __dwc3_prepare_one_trb() is called with a TRB which +needs to be prepared for transfer. This __dwc3_prepare_one_trb() calls +dwc3_calc_trbs_left() to determine total available TRBs and set IOC bit +if the total available TRBs are zero. Since the present working TRB (which +is passed as an argument to __dwc3_prepare_one_trb() ) doesn't yet have +the HWO bit set before calling dwc3_calc_trbs_left(), there are chances +that dwc3_calc_trbs_left() wrongly calculates this present working TRB +as free(since the HWO bit is not yet set) and returns the total available +TRBs as greater than zero (including the present working TRB). This could +be a problem. + +This patch corrects the above mentioned problem in __dwc3_prepare_one_trb() +by increementing the dep->trb_enqueue at the last (after preparing the TRB) +instead of increementing at the start and setting the IOC bit only if the +total available TRBs returned by dwc3_calc_trbs_left() is 1 . Since we are +increementing the dep->trb_enqueue at the last, the present working TRB is +also considered as available by dwc3_calc_trbs_left() and non zero value is +returned . So, according to the modified logic, when the total available +TRBs is equal to 1 that means the total available TRBs in the pool are 0. + +Signed-off-by: Anurag Kumar Vulisha +Reviewed-by: Thinh Nguyen +Tested-by: Tejas Joglekar +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 2a4ea9a1b1e3..88f69d823be5 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -921,8 +921,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, + struct usb_gadget *gadget = &dwc->gadget; + enum usb_device_speed speed = gadget->speed; + +- dwc3_ep_inc_enq(dep); +- + trb->size = DWC3_TRB_SIZE_LENGTH(length); + trb->bpl = lower_32_bits(dma); + trb->bph = upper_32_bits(dma); +@@ -1001,7 +999,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, + } + + if ((!no_interrupt && !chain) || +- (dwc3_calc_trbs_left(dep) == 0)) ++ (dwc3_calc_trbs_left(dep) == 1)) + trb->ctrl |= DWC3_TRB_CTRL_IOC; + + if (chain) +@@ -1012,6 +1010,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, + + trb->ctrl |= DWC3_TRB_CTRL_HWO; + ++ dwc3_ep_inc_enq(dep); ++ + trace_dwc3_prepare_trb(dep, trb); + } + +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc3-gadget-disable-csp-for-stream-out-ep.patch b/queue-4.20/usb-dwc3-gadget-disable-csp-for-stream-out-ep.patch new file mode 100644 index 00000000000..930d601f2a9 --- /dev/null +++ b/queue-4.20/usb-dwc3-gadget-disable-csp-for-stream-out-ep.patch @@ -0,0 +1,50 @@ +From 5114bcc9b99242540cb95d10972f47202efdc41b Mon Sep 17 00:00:00 2001 +From: Tejas Joglekar +Date: Mon, 10 Dec 2018 16:08:13 +0530 +Subject: usb: dwc3: gadget: Disable CSP for stream OUT ep + +[ Upstream commit 244add8ebfb231c39db9e33b204bd0ce8f24f782 ] + +In stream mode, when fast-forwarding TRBs, the stream number +is not cleared causing the new stream to not get assigned. So +we don't want controller to carry on transfers when short packet +is received. So disable the CSP for stream capable endpoint. + +This is based on the 3.30a Programming guide, where table 3-1 +device descriptor structure field definitions says for CSP bit +If this bit is 0, the controller generates an XferComplete event +and remove the stream. So if we keep CSP as 1 then switching between +streams would not happen as in stream mode, when fast-forwarding +TRBs, the stream number is not cleared causing the new stream to not get +assigned. + +Signed-off-by: Tejas Joglekar +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 88f69d823be5..357a2b330137 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -990,9 +990,13 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb, + usb_endpoint_type(dep->endpoint.desc)); + } + +- /* always enable Continue on Short Packet */ ++ /* ++ * Enable Continue on Short Packet ++ * when endpoint is not a stream capable ++ */ + if (usb_endpoint_dir_out(dep->endpoint.desc)) { +- trb->ctrl |= DWC3_TRB_CTRL_CSP; ++ if (!dep->stream_capable) ++ trb->ctrl |= DWC3_TRB_CTRL_CSP; + + if (short_not_ok) + trb->ctrl |= DWC3_TRB_CTRL_ISP_IMI; +-- +2.19.1 + diff --git a/queue-4.20/usb-dwc3-trace-add-missing-break-statement-to-make-c.patch b/queue-4.20/usb-dwc3-trace-add-missing-break-statement-to-make-c.patch new file mode 100644 index 00000000000..cc4d3d49c0a --- /dev/null +++ b/queue-4.20/usb-dwc3-trace-add-missing-break-statement-to-make-c.patch @@ -0,0 +1,51 @@ +From 581da36f65716737bf89d1b978dc8fa85d418d12 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 3 Dec 2018 11:28:47 +0200 +Subject: usb: dwc3: trace: add missing break statement to make compiler happy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 54d48183d21e03f780053d7129312049cb5dd591 ] + +The missed break statement in the outer switch makes the code fall through +always and thus always same value will be printed. + +Besides that, compiler warns about missed fall through marker: + +drivers/usb/dwc3/./trace.h: In function ‘trace_raw_output_dwc3_log_trb’: +drivers/usb/dwc3/./trace.h:246:4: warning: this statement may fall through [-Wimplicit-fallthrough=] + switch (pcm) { + ^~~~~~ + +Add the missing break statement to work correctly without compilation +warnings. + +Fixes: fa8d965d736b ("usb: dwc3: trace: pretty print high-bandwidth transfers too") +Cc: Felipe Balbi +Signed-off-by: Andy Shevchenko +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/trace.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h +index f22714cce070..f27c5cbe285c 100644 +--- a/drivers/usb/dwc3/trace.h ++++ b/drivers/usb/dwc3/trace.h +@@ -251,9 +251,11 @@ DECLARE_EVENT_CLASS(dwc3_log_trb, + s = "2x "; + break; + case 3: ++ default: + s = "3x "; + break; + } ++ break; + default: + s = ""; + } s; }), +-- +2.19.1 + diff --git a/queue-4.20/usb-hub-delay-hub-autosuspend-if-usb3-port-is-still-.patch b/queue-4.20/usb-hub-delay-hub-autosuspend-if-usb3-port-is-still-.patch new file mode 100644 index 00000000000..43a1f1e4c42 --- /dev/null +++ b/queue-4.20/usb-hub-delay-hub-autosuspend-if-usb3-port-is-still-.patch @@ -0,0 +1,49 @@ +From 359f421b3eda53696cee355a5aa6b381d80fd9a6 Mon Sep 17 00:00:00 2001 +From: Mathias Nyman +Date: Wed, 28 Nov 2018 15:55:21 +0200 +Subject: usb: hub: delay hub autosuspend if USB3 port is still link training + +[ Upstream commit e86108940e541febf35813402ff29fa6f4a9ac0b ] + +When initializing a hub we want to give a USB3 port in link training +the same debounce delay time before autosuspening the hub as already +trained, connected enabled ports. + +USB3 ports won't reach the enabled state with "current connect status" and +"connect status change" bits set until the USB3 link training finishes. + +Catching the port in link training (polling) and adding the debounce delay +prevents unnecessary failed attempts to autosuspend the hub. + +Signed-off-by: Mathias Nyman +Acked-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/hub.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index f76b2e0aba9d..1d1e61e980f3 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1112,6 +1112,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + USB_PORT_FEAT_ENABLE); + } + ++ /* ++ * Add debounce if USB3 link is in polling/link training state. ++ * Link will automatically transition to Enabled state after ++ * link training completes. ++ */ ++ if (hub_is_superspeed(hdev) && ++ ((portstatus & USB_PORT_STAT_LINK_STATE) == ++ USB_SS_PORT_LS_POLLING)) ++ need_debounce_delay = true; ++ + /* Clear status-change flags; we'll debounce later */ + if (portchange & USB_PORT_STAT_C_CONNECTION) { + need_debounce_delay = true; +-- +2.19.1 + diff --git a/queue-4.20/usb-mtu3-fix-the-issue-about-setfeature-u1-u2_enable.patch b/queue-4.20/usb-mtu3-fix-the-issue-about-setfeature-u1-u2_enable.patch new file mode 100644 index 00000000000..749bc307e7a --- /dev/null +++ b/queue-4.20/usb-mtu3-fix-the-issue-about-setfeature-u1-u2_enable.patch @@ -0,0 +1,68 @@ +From 7ac574374d7cc07f246a52f516179c2f362e0167 Mon Sep 17 00:00:00 2001 +From: Chunfeng Yun +Date: Thu, 29 Nov 2018 10:34:34 +0800 +Subject: usb: mtu3: fix the issue about SetFeature(U1/U2_Enable) + +[ Upstream commit a0678e2eed41e81004308693ac84ea95614b0920 ] + +Fix the issue: device doesn't accept LGO_U1/U2: +1. set SW_U1/U2_ACCEPT_ENABLE to eanble controller to accept LGO_U1/U2 + by default; +2. enable/disable controller to initiate requests for transition into + U1/U2 by SW_U1/U2_REQUEST_ENABLE instead of SW_U1/U2_ACCEPT_ENABLE; + +Signed-off-by: Chunfeng Yun +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_core.c | 4 +++- + drivers/usb/mtu3/mtu3_gadget_ep0.c | 8 ++++---- + 2 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/usb/mtu3/mtu3_core.c b/drivers/usb/mtu3/mtu3_core.c +index ae70b9bfd797..860693520132 100644 +--- a/drivers/usb/mtu3/mtu3_core.c ++++ b/drivers/usb/mtu3/mtu3_core.c +@@ -578,8 +578,10 @@ static void mtu3_regs_init(struct mtu3 *mtu) + if (mtu->is_u3_ip) { + /* disable LGO_U1/U2 by default */ + mtu3_clrbits(mbase, U3D_LINK_POWER_CONTROL, +- SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE | + SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE); ++ /* enable accept LGO_U1/U2 link command from host */ ++ mtu3_setbits(mbase, U3D_LINK_POWER_CONTROL, ++ SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE); + /* device responses to u3_exit from host automatically */ + mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN); + /* automatically build U2 link when U3 detect fail */ +diff --git a/drivers/usb/mtu3/mtu3_gadget_ep0.c b/drivers/usb/mtu3/mtu3_gadget_ep0.c +index 25216e79cd6e..3c464d8ae023 100644 +--- a/drivers/usb/mtu3/mtu3_gadget_ep0.c ++++ b/drivers/usb/mtu3/mtu3_gadget_ep0.c +@@ -336,9 +336,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu, + + lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL); + if (set) +- lpc |= SW_U1_ACCEPT_ENABLE; ++ lpc |= SW_U1_REQUEST_ENABLE; + else +- lpc &= ~SW_U1_ACCEPT_ENABLE; ++ lpc &= ~SW_U1_REQUEST_ENABLE; + mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc); + + mtu->u1_enable = !!set; +@@ -351,9 +351,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu, + + lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL); + if (set) +- lpc |= SW_U2_ACCEPT_ENABLE; ++ lpc |= SW_U2_REQUEST_ENABLE; + else +- lpc &= ~SW_U2_ACCEPT_ENABLE; ++ lpc &= ~SW_U2_REQUEST_ENABLE; + mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc); + + mtu->u2_enable = !!set; +-- +2.19.1 + diff --git a/queue-4.20/usb-musb-dsps-fix-otg-state-machine.patch b/queue-4.20/usb-musb-dsps-fix-otg-state-machine.patch new file mode 100644 index 00000000000..eda9dd24982 --- /dev/null +++ b/queue-4.20/usb-musb-dsps-fix-otg-state-machine.patch @@ -0,0 +1,51 @@ +From 3e926c14d427eeb3b4c4bf486e0f13a51055672d Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 18 Dec 2018 07:58:04 -0600 +Subject: usb: musb: dsps: fix otg state machine + +[ Upstream commit 6010abf2c2c0e382d7e8ee44bd11f343aae90cce ] + +Due to lack of ID pin interrupt event on AM335x devices, the musb dsps +driver uses polling to detect usb device attach for dual-role port. + +But in the case if a micro-A cable adapter is attached without a USB device +attached to the cable, the musb state machine gets stuck in a_wait_vrise +state waiting for the MUSB_CONNECT interrupt which won't happen due to the +usb device is not attached. The state is stuck in a_wait_vrise even after +the micro-A cable is detached, which could cause VBUS retention if then the +dual-role port is attached to a host port. + +To fix the problem, make a_wait_vrise as a transient state, then move the +state to either a_wait_bcon for host port or a_idle state for dual-role +port, if no usb device is attached to the port. + +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/musb_dsps.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c +index 23a0df79ef21..1e6d78b1334e 100644 +--- a/drivers/usb/musb/musb_dsps.c ++++ b/drivers/usb/musb/musb_dsps.c +@@ -227,8 +227,13 @@ static int dsps_check_status(struct musb *musb, void *unused) + + switch (musb->xceiv->otg->state) { + case OTG_STATE_A_WAIT_VRISE: +- dsps_mod_timer_optional(glue); +- break; ++ if (musb->port_mode == MUSB_HOST) { ++ musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON; ++ dsps_mod_timer_optional(glue); ++ break; ++ } ++ /* fall through */ ++ + case OTG_STATE_A_WAIT_BCON: + /* keep VBUS on for host-only mode */ + if (musb->port_mode == MUSB_HOST) { +-- +2.19.1 + diff --git a/queue-4.20/usb-musb-dsps-fix-runtime-pm-for-peripheral-mode.patch b/queue-4.20/usb-musb-dsps-fix-runtime-pm-for-peripheral-mode.patch new file mode 100644 index 00000000000..6e91e48d35e --- /dev/null +++ b/queue-4.20/usb-musb-dsps-fix-runtime-pm-for-peripheral-mode.patch @@ -0,0 +1,57 @@ +From 76d55e149340ebc9b50284fce610d001f84786c5 Mon Sep 17 00:00:00 2001 +From: Bin Liu +Date: Tue, 18 Dec 2018 07:58:05 -0600 +Subject: usb: musb: dsps: fix runtime pm for peripheral mode + +[ Upstream commit 54578ee883e34d2d1c518d48f1c1e2dd3f387188 ] + +Since the runtime PM support was added in musb, dsps relies on the timer +calling otg_timer() to activate the usb subsystem. However the driver +doesn't enable the timer for peripheral port, then the peripheral port is +unable to be enumerated by a host if the other usb port is disabled or in +peripheral mode too. + +So let's start the timer for peripheral port too. + +Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") +Acked-by: Tony Lindgren +Signed-off-by: Bin Liu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/musb_dsps.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c +index 1e6d78b1334e..403eb97915f8 100644 +--- a/drivers/usb/musb/musb_dsps.c ++++ b/drivers/usb/musb/musb_dsps.c +@@ -181,9 +181,11 @@ static void dsps_musb_enable(struct musb *musb) + + musb_writel(reg_base, wrp->epintr_set, epmask); + musb_writel(reg_base, wrp->coreintr_set, coremask); +- /* start polling for ID change in dual-role idle mode */ +- if (musb->xceiv->otg->state == OTG_STATE_B_IDLE && +- musb->port_mode == MUSB_OTG) ++ /* ++ * start polling for runtime PM active and idle, ++ * and for ID change in dual-role idle mode. ++ */ ++ if (musb->xceiv->otg->state == OTG_STATE_B_IDLE) + dsps_mod_timer(glue, -1); + } + +@@ -254,6 +256,10 @@ static int dsps_check_status(struct musb *musb, void *unused) + musb->xceiv->otg->state = OTG_STATE_A_IDLE; + MUSB_HST_MODE(musb); + } ++ ++ if (musb->port_mode == MUSB_PERIPHERAL) ++ skip_session = 1; ++ + if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session) + musb_writeb(mregs, MUSB_DEVCTL, + MUSB_DEVCTL_SESSION); +-- +2.19.1 + diff --git a/queue-4.20/usb-renesas_usbhs-add-support-for-rz-g2e.patch b/queue-4.20/usb-renesas_usbhs-add-support-for-rz-g2e.patch new file mode 100644 index 00000000000..189bcfca9e2 --- /dev/null +++ b/queue-4.20/usb-renesas_usbhs-add-support-for-rz-g2e.patch @@ -0,0 +1,40 @@ +From f39b970a031f956ad8f87943a1e2c4f9ee5fb291 Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Fri, 14 Dec 2018 08:27:03 +0000 +Subject: usb: renesas_usbhs: add support for RZ/G2E + +[ Upstream commit 1d6e81a288e28d8d0e38e0501a324216f79bba35 ] + +HS-USB found in RZ/G2E (a.k.a. r8a774c0) is very similar to the +one found in R-Car E3 (a.k.a. r8a77990), as it needs to release +the PLL reset by the UGCTRL register like R-Car E3, therefore add +r8a774c0 support in a similar fashion to what was done for the +r8a77990. + +Signed-off-by: Fabrizio Castro +Reviewed-by: Simon Horman +Acked-by: Yoshihiro Shimoda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/renesas_usbhs/common.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c +index a3e1290d682d..1de333be9353 100644 +--- a/drivers/usb/renesas_usbhs/common.c ++++ b/drivers/usb/renesas_usbhs/common.c +@@ -539,6 +539,10 @@ static int usbhsc_drvcllbck_notify_hotplug(struct platform_device *pdev) + * platform functions + */ + static const struct of_device_id usbhs_of_match[] = { ++ { ++ .compatible = "renesas,usbhs-r8a774c0", ++ .data = (void *)USBHS_TYPE_RCAR_GEN3_WITH_PLL, ++ }, + { + .compatible = "renesas,usbhs-r8a7790", + .data = (void *)USBHS_TYPE_RCAR_GEN2, +-- +2.19.1 + diff --git a/queue-4.20/usbnet-smsc95xx-fix-rx-packet-alignment.patch b/queue-4.20/usbnet-smsc95xx-fix-rx-packet-alignment.patch new file mode 100644 index 00000000000..b628e9c920f --- /dev/null +++ b/queue-4.20/usbnet-smsc95xx-fix-rx-packet-alignment.patch @@ -0,0 +1,39 @@ +From 6d9bd1574420812325ab065f957c0d4cbdb6ede7 Mon Sep 17 00:00:00 2001 +From: Ben Dooks +Date: Wed, 14 Nov 2018 11:50:19 +0000 +Subject: usbnet: smsc95xx: fix rx packet alignment + +[ Upstream commit 810eeb1f41a9a272eedc94ca18c072e75678ede4 ] + +The smsc95xx driver already takes into account the NET_IP_ALIGN +parameter when setting up the receive packet data, which means +we do not need to worry about aligning the packets in the usbnet +driver. + +Adding the EVENT_NO_IP_ALIGN means that the IPv4 header is now +passed to the ip_rcv() routine with the start on an aligned address. + +Tested on Raspberry Pi B3. + +Signed-off-by: Ben Dooks +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index f2d01cb6f958..6e971628bb50 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1295,6 +1295,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + dev->net->features |= NETIF_F_RXCSUM; + + dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM; ++ set_bit(EVENT_NO_IP_ALIGN, &dev->flags); + + smsc95xx_init_mac_address(dev); + +-- +2.19.1 + diff --git a/queue-4.20/vbox-fix-link-error-with-gcc-og.patch b/queue-4.20/vbox-fix-link-error-with-gcc-og.patch new file mode 100644 index 00000000000..bbed005cd30 --- /dev/null +++ b/queue-4.20/vbox-fix-link-error-with-gcc-og.patch @@ -0,0 +1,43 @@ +From 1ac5333f00043251cc8613b2c7c5bd4f96d93a72 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 2 Nov 2018 16:38:53 +0100 +Subject: vbox: fix link error with 'gcc -Og' + +[ Upstream commit b8ae30a7020d61e0504529adf45abb08fa5c59f5 ] + +With the new CONFIG_CC_OPTIMIZE_FOR_DEBUGGING option, we get a link +error in the vboxguest driver, when that fails to optimize out the +call to the compat handler: + +drivers/virt/vboxguest/vboxguest_core.o: In function `vbg_ioctl_hgcm_call': +vboxguest_core.c:(.text+0x1f6e): undefined reference to `vbg_hgcm_call32' + +Another compile-time check documents better what we want and avoids +the error. + +Acked-by: Randy Dunlap +Tested-by: Randy Dunlap +Signed-off-by: Arnd Bergmann +Reviewed-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/virt/vboxguest/vboxguest_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/virt/vboxguest/vboxguest_core.c b/drivers/virt/vboxguest/vboxguest_core.c +index 3093655c7b92..1475ed5ffcde 100644 +--- a/drivers/virt/vboxguest/vboxguest_core.c ++++ b/drivers/virt/vboxguest/vboxguest_core.c +@@ -1312,7 +1312,7 @@ static int vbg_ioctl_hgcm_call(struct vbg_dev *gdev, + return -EINVAL; + } + +- if (f32bit) ++ if (IS_ENABLED(CONFIG_COMPAT) && f32bit) + ret = vbg_hgcm_call32(gdev, client_id, + call->function, call->timeout_ms, + VBG_IOCTL_HGCM_CALL_PARMS32(call), +-- +2.19.1 + diff --git a/queue-4.20/video-clps711x-fb-release-disp-device-node-in-probe.patch b/queue-4.20/video-clps711x-fb-release-disp-device-node-in-probe.patch new file mode 100644 index 00000000000..b75d856d983 --- /dev/null +++ b/queue-4.20/video-clps711x-fb-release-disp-device-node-in-probe.patch @@ -0,0 +1,47 @@ +From 9e95347ae70a2b48c88705bfcdf6747b49888f90 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Thu, 20 Dec 2018 19:13:07 +0100 +Subject: video: clps711x-fb: release disp device node in probe() + +[ Upstream commit fdac751355cd76e049f628afe6acb8ff4b1399f7 ] + +clps711x_fb_probe() increments refcnt of disp device node by +of_parse_phandle() and leaves it undecremented on both +successful and error paths. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Cc: Alexander Shiyan +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/clps711x-fb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/clps711x-fb.c b/drivers/video/fbdev/clps711x-fb.c +index ff561073ee4e..42f909618f04 100644 +--- a/drivers/video/fbdev/clps711x-fb.c ++++ b/drivers/video/fbdev/clps711x-fb.c +@@ -287,14 +287,17 @@ static int clps711x_fb_probe(struct platform_device *pdev) + } + + ret = of_get_fb_videomode(disp, &cfb->mode, OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ of_node_put(disp); + goto out_fb_release; ++ } + + of_property_read_u32(disp, "ac-prescale", &cfb->ac_prescale); + cfb->cmap_invert = of_property_read_bool(disp, "cmap-invert"); + + ret = of_property_read_u32(disp, "bits-per-pixel", + &info->var.bits_per_pixel); ++ of_node_put(disp); + if (ret) + goto out_fb_release; + +-- +2.19.1 + diff --git a/queue-4.20/watchdog-renesas_wdt-don-t-set-divider-while-watchdo.patch b/queue-4.20/watchdog-renesas_wdt-don-t-set-divider-while-watchdo.patch new file mode 100644 index 00000000000..00d6a5872ee --- /dev/null +++ b/queue-4.20/watchdog-renesas_wdt-don-t-set-divider-while-watchdo.patch @@ -0,0 +1,48 @@ +From d728828b5f2910c8fa1ca85195ba2da7acf2af19 Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Wed, 7 Nov 2018 20:46:02 +0100 +Subject: watchdog: renesas_wdt: don't set divider while watchdog is running + +[ Upstream commit e990e12741877e9bfac402ca468f4007a75f6e2a ] + +The datasheet says we must stop the timer before changing the clock +divider. This can happen when the restart handler is called while the +watchdog is running. + +Signed-off-by: Wolfram Sang +Reviewed-by: Fabrizio Castro +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/renesas_wdt.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/renesas_wdt.c b/drivers/watchdog/renesas_wdt.c +index 0d74c3e48979..55c9eb6c6e51 100644 +--- a/drivers/watchdog/renesas_wdt.c ++++ b/drivers/watchdog/renesas_wdt.c +@@ -74,12 +74,17 @@ static int rwdt_init_timeout(struct watchdog_device *wdev) + static int rwdt_start(struct watchdog_device *wdev) + { + struct rwdt_priv *priv = watchdog_get_drvdata(wdev); ++ u8 val; + + pm_runtime_get_sync(wdev->parent); + +- rwdt_write(priv, 0, RWTCSRB); +- rwdt_write(priv, priv->cks, RWTCSRA); ++ /* Stop the timer before we modify any register */ ++ val = readb_relaxed(priv->base + RWTCSRA) & ~RWTCSRA_TME; ++ rwdt_write(priv, val, RWTCSRA); ++ + rwdt_init_timeout(wdev); ++ rwdt_write(priv, priv->cks, RWTCSRA); ++ rwdt_write(priv, 0, RWTCSRB); + + while (readb_relaxed(priv->base + RWTCSRA) & RWTCSRA_WRFLG) + cpu_relax(); +-- +2.19.1 + diff --git a/queue-4.20/wil6210-fix-memory-leak-in-wil_find_tx_bcast_2.patch b/queue-4.20/wil6210-fix-memory-leak-in-wil_find_tx_bcast_2.patch new file mode 100644 index 00000000000..566e543eb7e --- /dev/null +++ b/queue-4.20/wil6210-fix-memory-leak-in-wil_find_tx_bcast_2.patch @@ -0,0 +1,35 @@ +From c7016cb465cb8e7302225573a6cb4bcd032ac0b9 Mon Sep 17 00:00:00 2001 +From: Lior David +Date: Wed, 31 Oct 2018 10:52:14 +0200 +Subject: wil6210: fix memory leak in wil_find_tx_bcast_2 + +[ Upstream commit 664497400c89a4d40aee51bcf48bbd2e4dc71104 ] + +A successful call to wil_tx_ring takes skb reference so +it will only be freed in wil_tx_complete. Consume the skb +in wil_find_tx_bcast_2 to prevent memory leak. + +Signed-off-by: Lior David +Signed-off-by: Maya Erez +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wil6210/txrx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c +index cc5f263cc965..005c4ba9e823 100644 +--- a/drivers/net/wireless/ath/wil6210/txrx.c ++++ b/drivers/net/wireless/ath/wil6210/txrx.c +@@ -1403,6 +1403,8 @@ found: + wil_dbg_txrx(wil, "BCAST DUP -> ring %d\n", i); + wil_set_da_for_vring(wil, skb2, i); + wil_tx_ring(wil, vif, v2, skb2); ++ /* successful call to wil_tx_ring takes skb2 ref */ ++ dev_kfree_skb_any(skb2); + } else { + wil_err(wil, "skb_copy failed\n"); + } +-- +2.19.1 + diff --git a/queue-4.20/wil6210-fix-reset-flow-for-talyn-mb.patch b/queue-4.20/wil6210-fix-reset-flow-for-talyn-mb.patch new file mode 100644 index 00000000000..98669443a71 --- /dev/null +++ b/queue-4.20/wil6210-fix-reset-flow-for-talyn-mb.patch @@ -0,0 +1,48 @@ +From 4aae39d5aa3d5d8e032734bc2ce7fdca84728c71 Mon Sep 17 00:00:00 2001 +From: Alexei Avshalom Lazar +Date: Wed, 31 Oct 2018 10:52:10 +0200 +Subject: wil6210: fix reset flow for Talyn-mb + +[ Upstream commit d083b2e2b7db5cca1791643d036e6597af27f49b ] + +With current reset flow, Talyn sometimes get stuck causing PCIe +enumeration to fail. Fix this by removing some reset flow operations +that are not relevant for Talyn. +Setting bit 15 in RGF_HP_CTRL is WBE specific and is not in use for +all wil6210 devices. +For Sparrow, BIT_HPAL_PERST_FROM_PAD and BIT_CAR_PERST_RST were set +as a WA an HW issue. + +Signed-off-by: Alexei Avshalom Lazar +Signed-off-by: Maya Erez +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wil6210/main.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c +index 398900a1c29e..c54b008996ee 100644 +--- a/drivers/net/wireless/ath/wil6210/main.c ++++ b/drivers/net/wireless/ath/wil6210/main.c +@@ -998,10 +998,13 @@ static int wil_target_reset(struct wil6210_priv *wil, int no_flash) + + wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name); + +- /* Clear MAC link up */ +- wil_s(wil, RGF_HP_CTRL, BIT(15)); +- wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_HPAL_PERST_FROM_PAD); +- wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST); ++ if (wil->hw_version < HW_VER_TALYN) { ++ /* Clear MAC link up */ ++ wil_s(wil, RGF_HP_CTRL, BIT(15)); ++ wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, ++ BIT_HPAL_PERST_FROM_PAD); ++ wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST); ++ } + + wil_halt_cpu(wil); + +-- +2.19.1 + diff --git a/queue-4.20/x86-fpu-add-might_fault-to-user_insn.patch b/queue-4.20/x86-fpu-add-might_fault-to-user_insn.patch new file mode 100644 index 00000000000..3c60e452c3f --- /dev/null +++ b/queue-4.20/x86-fpu-add-might_fault-to-user_insn.patch @@ -0,0 +1,54 @@ +From f16845f1c4e163c52674ab1c2fa5306f860787ce Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Wed, 28 Nov 2018 23:20:11 +0100 +Subject: x86/fpu: Add might_fault() to user_insn() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 6637401c35b2f327a35d27f44bda05e327f2f017 ] + +Every user of user_insn() passes an user memory pointer to this macro. + +Add might_fault() to user_insn() so we can spot users which are using +this macro in sections where page faulting is not allowed. + + [ bp: Space it out to make it more visible. ] + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Borislav Petkov +Reviewed-by: Rik van Riel +Cc: "H. Peter Anvin" +Cc: "Jason A. Donenfeld" +Cc: Andy Lutomirski +Cc: Dave Hansen +Cc: Ingo Molnar +Cc: Jann Horn +Cc: Paolo Bonzini +Cc: Radim Krčmář +Cc: Thomas Gleixner +Cc: kvm ML +Cc: x86-ml +Link: https://lkml.kernel.org/r/20181128222035.2996-6-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/fpu/internal.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index 69dcdf195b61..fa2c93cb42a2 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -106,6 +106,9 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu); + #define user_insn(insn, output, input...) \ + ({ \ + int err; \ ++ \ ++ might_fault(); \ ++ \ + asm volatile(ASM_STAC "\n" \ + "1:" #insn "\n\t" \ + "2: " ASM_CLAC "\n" \ +-- +2.19.1 + diff --git a/queue-4.20/x86-pci-fix-broadcom-cnb20le-unintended-sign-extensi.patch b/queue-4.20/x86-pci-fix-broadcom-cnb20le-unintended-sign-extensi.patch new file mode 100644 index 00000000000..801ee3bd97c --- /dev/null +++ b/queue-4.20/x86-pci-fix-broadcom-cnb20le-unintended-sign-extensi.patch @@ -0,0 +1,42 @@ +From 35ffc03e611ce8ac195a4371c8c810f0f315d5e1 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Thu, 25 Oct 2018 14:52:31 +0100 +Subject: x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux) + +[ Upstream commit 53bb565fc5439f2c8c57a786feea5946804aa3e9 ] + +In the expression "word1 << 16", word1 starts as u16, but is promoted to a +signed int, then sign-extended to resource_size_t, which is probably not +what was intended. Cast to resource_size_t to avoid the sign extension. + +This fixes an identical issue as fixed by commit 0b2d70764bb3 ("x86/PCI: +Fix Broadcom CNB20LE unintended sign extension") back in 2014. + +Detected by CoverityScan, CID#138749, 138750 ("Unintended sign extension") + +Fixes: 3f6ea84a3035 ("PCI: read memory ranges out of Broadcom CNB20LE host bridge") +Signed-off-by: Colin Ian King +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + arch/x86/pci/broadcom_bus.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c +index 526536c81ddc..ca1e8e6dccc8 100644 +--- a/arch/x86/pci/broadcom_bus.c ++++ b/arch/x86/pci/broadcom_bus.c +@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func) + word1 = read_pci_config_16(bus, slot, func, 0xc0); + word2 = read_pci_config_16(bus, slot, func, 0xc2); + if (word1 != word2) { +- res.start = (word1 << 16) | 0x0000; +- res.end = (word2 << 16) | 0xffff; ++ res.start = ((resource_size_t) word1 << 16) | 0x0000; ++ res.end = ((resource_size_t) word2 << 16) | 0xffff; + res.flags = IORESOURCE_MEM; + update_res(info, res.start, res.end, res.flags, 0); + } +-- +2.19.1 + diff --git a/queue-4.20/x86-resctrl-fixup-the-user-visible-strings.patch b/queue-4.20/x86-resctrl-fixup-the-user-visible-strings.patch new file mode 100644 index 00000000000..e40180e96d7 --- /dev/null +++ b/queue-4.20/x86-resctrl-fixup-the-user-visible-strings.patch @@ -0,0 +1,466 @@ +From 0933af3d24f1c0811babcdbe6660c1ee03d8d5e5 Mon Sep 17 00:00:00 2001 +From: Babu Moger +Date: Wed, 21 Nov 2018 20:28:43 +0000 +Subject: x86/resctrl: Fixup the user-visible strings + +[ Upstream commit 723f1a0dd8e26a7523ba068204bee11c95ded38d ] + +Fix the messages in rdt_last_cmd_printf() and rdt_last_cmd_puts() to +make them more meaningful and consistent. + + [ bp: s/cpu/CPU/; s/mem\W/memory ] + +Signed-off-by: Babu Moger +Signed-off-by: Borislav Petkov +Cc: Andrew Morton +Cc: Andy Lutomirski +Cc: Arnd Bergmann +Cc: Brijesh Singh +Cc: "Chang S. Bae" +Cc: David Miller +Cc: David Woodhouse +Cc: Dmitry Safonov +Cc: Fenghua Yu +Cc: Greg Kroah-Hartman +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: Jann Horn +Cc: Joerg Roedel +Cc: Jonathan Corbet +Cc: Josh Poimboeuf +Cc: Kate Stewart +Cc: "Kirill A. Shutemov" +Cc: +Cc: Mauro Carvalho Chehab +Cc: Paolo Bonzini +Cc: Peter Zijlstra +Cc: Philippe Ombredanne +Cc: Pu Wen +Cc: +Cc: "Rafael J. Wysocki" +Cc: Reinette Chatre +Cc: Rian Hunter +Cc: Sherry Hurwitz +Cc: Suravee Suthikulpanit +Cc: Thomas Gleixner +Cc: Thomas Lendacky +Cc: Tony Luck +Cc: Vitaly Kuznetsov +Cc: +Link: https://lkml.kernel.org/r/20181121202811.4492-11-babu.moger@amd.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 22 ++++++------- + arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c | 34 +++++++++---------- + arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 36 ++++++++++----------- + 3 files changed, 46 insertions(+), 46 deletions(-) + +diff --git a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +index c8b72aff55e0..6e76ada71211 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c ++++ b/arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +@@ -71,7 +71,7 @@ int parse_bw(struct rdt_parse_data *data, struct rdt_resource *r, + unsigned long bw_val; + + if (d->have_new_ctrl) { +- rdt_last_cmd_printf("duplicate domain %d\n", d->id); ++ rdt_last_cmd_printf("Duplicate domain %d\n", d->id); + return -EINVAL; + } + +@@ -97,12 +97,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r) + + ret = kstrtoul(buf, 16, &val); + if (ret) { +- rdt_last_cmd_printf("non-hex character in mask %s\n", buf); ++ rdt_last_cmd_printf("Non-hex character in the mask %s\n", buf); + return false; + } + + if (val == 0 || val > r->default_ctrl) { +- rdt_last_cmd_puts("mask out of range\n"); ++ rdt_last_cmd_puts("Mask out of range\n"); + return false; + } + +@@ -110,12 +110,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r) + zero_bit = find_next_zero_bit(&val, cbm_len, first_bit); + + if (find_next_bit(&val, cbm_len, zero_bit) < cbm_len) { +- rdt_last_cmd_printf("mask %lx has non-consecutive 1-bits\n", val); ++ rdt_last_cmd_printf("The mask %lx has non-consecutive 1-bits\n", val); + return false; + } + + if ((zero_bit - first_bit) < r->cache.min_cbm_bits) { +- rdt_last_cmd_printf("Need at least %d bits in mask\n", ++ rdt_last_cmd_printf("Need at least %d bits in the mask\n", + r->cache.min_cbm_bits); + return false; + } +@@ -135,7 +135,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r, + u32 cbm_val; + + if (d->have_new_ctrl) { +- rdt_last_cmd_printf("duplicate domain %d\n", d->id); ++ rdt_last_cmd_printf("Duplicate domain %d\n", d->id); + return -EINVAL; + } + +@@ -145,7 +145,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r, + */ + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP && + rdtgroup_pseudo_locked_in_hierarchy(d)) { +- rdt_last_cmd_printf("pseudo-locked region in hierarchy\n"); ++ rdt_last_cmd_printf("Pseudo-locked region in hierarchy\n"); + return -EINVAL; + } + +@@ -164,14 +164,14 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r, + * either is exclusive. + */ + if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, true)) { +- rdt_last_cmd_printf("overlaps with exclusive group\n"); ++ rdt_last_cmd_printf("Overlaps with exclusive group\n"); + return -EINVAL; + } + + if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, false)) { + if (rdtgrp->mode == RDT_MODE_EXCLUSIVE || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { +- rdt_last_cmd_printf("overlaps with other group\n"); ++ rdt_last_cmd_printf("0verlaps with other group\n"); + return -EINVAL; + } + } +@@ -293,7 +293,7 @@ static int rdtgroup_parse_resource(char *resname, char *tok, + if (!strcmp(resname, r->name) && rdtgrp->closid < r->num_closid) + return parse_line(tok, r, rdtgrp); + } +- rdt_last_cmd_printf("unknown/unsupported resource name '%s'\n", resname); ++ rdt_last_cmd_printf("Unknown or unsupported resource name '%s'\n", resname); + return -EINVAL; + } + +@@ -326,7 +326,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of, + */ + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) { + ret = -EINVAL; +- rdt_last_cmd_puts("resource group is pseudo-locked\n"); ++ rdt_last_cmd_puts("Resource group is pseudo-locked\n"); + goto out; + } + +diff --git a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c +index 815b4e92522c..cde746d64600 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c ++++ b/arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c +@@ -213,7 +213,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr) + for_each_cpu(cpu, &plr->d->cpu_mask) { + pm_req = kzalloc(sizeof(*pm_req), GFP_KERNEL); + if (!pm_req) { +- rdt_last_cmd_puts("fail allocating mem for PM QoS\n"); ++ rdt_last_cmd_puts("Failure to allocate memory for PM QoS\n"); + ret = -ENOMEM; + goto out_err; + } +@@ -222,7 +222,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr) + DEV_PM_QOS_RESUME_LATENCY, + 30); + if (ret < 0) { +- rdt_last_cmd_printf("fail to add latency req cpu%d\n", ++ rdt_last_cmd_printf("Failed to add latency req CPU%d\n", + cpu); + kfree(pm_req); + ret = -1; +@@ -289,7 +289,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr) + plr->cpu = cpumask_first(&plr->d->cpu_mask); + + if (!cpu_online(plr->cpu)) { +- rdt_last_cmd_printf("cpu %u associated with cache not online\n", ++ rdt_last_cmd_printf("CPU %u associated with cache not online\n", + plr->cpu); + ret = -ENODEV; + goto out_region; +@@ -307,7 +307,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr) + } + + ret = -1; +- rdt_last_cmd_puts("unable to determine cache line size\n"); ++ rdt_last_cmd_puts("Unable to determine cache line size\n"); + out_region: + pseudo_lock_region_clear(plr); + return ret; +@@ -361,14 +361,14 @@ static int pseudo_lock_region_alloc(struct pseudo_lock_region *plr) + * KMALLOC_MAX_SIZE. + */ + if (plr->size > KMALLOC_MAX_SIZE) { +- rdt_last_cmd_puts("requested region exceeds maximum size\n"); ++ rdt_last_cmd_puts("Requested region exceeds maximum size\n"); + ret = -E2BIG; + goto out_region; + } + + plr->kmem = kzalloc(plr->size, GFP_KERNEL); + if (!plr->kmem) { +- rdt_last_cmd_puts("unable to allocate memory\n"); ++ rdt_last_cmd_puts("Unable to allocate memory\n"); + ret = -ENOMEM; + goto out_region; + } +@@ -665,7 +665,7 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp) + * default closid associated with it. + */ + if (rdtgrp == &rdtgroup_default) { +- rdt_last_cmd_puts("cannot pseudo-lock default group\n"); ++ rdt_last_cmd_puts("Cannot pseudo-lock default group\n"); + return -EINVAL; + } + +@@ -707,17 +707,17 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp) + */ + prefetch_disable_bits = get_prefetch_disable_bits(); + if (prefetch_disable_bits == 0) { +- rdt_last_cmd_puts("pseudo-locking not supported\n"); ++ rdt_last_cmd_puts("Pseudo-locking not supported\n"); + return -EINVAL; + } + + if (rdtgroup_monitor_in_progress(rdtgrp)) { +- rdt_last_cmd_puts("monitoring in progress\n"); ++ rdt_last_cmd_puts("Monitoring in progress\n"); + return -EINVAL; + } + + if (rdtgroup_tasks_assigned(rdtgrp)) { +- rdt_last_cmd_puts("tasks assigned to resource group\n"); ++ rdt_last_cmd_puts("Tasks assigned to resource group\n"); + return -EINVAL; + } + +@@ -727,13 +727,13 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp) + } + + if (rdtgroup_locksetup_user_restrict(rdtgrp)) { +- rdt_last_cmd_puts("unable to modify resctrl permissions\n"); ++ rdt_last_cmd_puts("Unable to modify resctrl permissions\n"); + return -EIO; + } + + ret = pseudo_lock_init(rdtgrp); + if (ret) { +- rdt_last_cmd_puts("unable to init pseudo-lock region\n"); ++ rdt_last_cmd_puts("Unable to init pseudo-lock region\n"); + goto out_release; + } + +@@ -770,7 +770,7 @@ int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp) + if (rdt_mon_capable) { + ret = alloc_rmid(); + if (ret < 0) { +- rdt_last_cmd_puts("out of RMIDs\n"); ++ rdt_last_cmd_puts("Out of RMIDs\n"); + return ret; + } + rdtgrp->mon.rmid = ret; +@@ -1304,7 +1304,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp) + "pseudo_lock/%u", plr->cpu); + if (IS_ERR(thread)) { + ret = PTR_ERR(thread); +- rdt_last_cmd_printf("locking thread returned error %d\n", ret); ++ rdt_last_cmd_printf("Locking thread returned error %d\n", ret); + goto out_cstates; + } + +@@ -1322,13 +1322,13 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp) + * the cleared, but not freed, plr struct resulting in an + * empty pseudo-locking loop. + */ +- rdt_last_cmd_puts("locking thread interrupted\n"); ++ rdt_last_cmd_puts("Locking thread interrupted\n"); + goto out_cstates; + } + + ret = pseudo_lock_minor_get(&new_minor); + if (ret < 0) { +- rdt_last_cmd_puts("unable to obtain a new minor number\n"); ++ rdt_last_cmd_puts("Unable to obtain a new minor number\n"); + goto out_cstates; + } + +@@ -1360,7 +1360,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp) + + if (IS_ERR(dev)) { + ret = PTR_ERR(dev); +- rdt_last_cmd_printf("failed to create character device: %d\n", ++ rdt_last_cmd_printf("Failed to create character device: %d\n", + ret); + goto out_debugfs; + } +diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +index 951c61367688..17b63a4748bf 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c ++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +@@ -345,7 +345,7 @@ static int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask, + /* Check whether cpus belong to parent ctrl group */ + cpumask_andnot(tmpmask, newmask, &prgrp->cpu_mask); + if (cpumask_weight(tmpmask)) { +- rdt_last_cmd_puts("can only add CPUs to mongroup that belong to parent\n"); ++ rdt_last_cmd_puts("Can only add CPUs to mongroup that belong to parent\n"); + return -EINVAL; + } + +@@ -470,14 +470,14 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of, + rdt_last_cmd_clear(); + if (!rdtgrp) { + ret = -ENOENT; +- rdt_last_cmd_puts("directory was removed\n"); ++ rdt_last_cmd_puts("Directory was removed\n"); + goto unlock; + } + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; +- rdt_last_cmd_puts("pseudo-locking in progress\n"); ++ rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + +@@ -487,7 +487,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of, + ret = cpumask_parse(buf, newmask); + + if (ret) { +- rdt_last_cmd_puts("bad cpu list/mask\n"); ++ rdt_last_cmd_puts("Bad CPU list/mask\n"); + goto unlock; + } + +@@ -495,7 +495,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of, + cpumask_andnot(tmpmask, newmask, cpu_online_mask); + if (cpumask_weight(tmpmask)) { + ret = -EINVAL; +- rdt_last_cmd_puts("can only assign online cpus\n"); ++ rdt_last_cmd_puts("Can only assign online CPUs\n"); + goto unlock; + } + +@@ -574,7 +574,7 @@ static int __rdtgroup_move_task(struct task_struct *tsk, + */ + atomic_dec(&rdtgrp->waitcount); + kfree(callback); +- rdt_last_cmd_puts("task exited\n"); ++ rdt_last_cmd_puts("Task exited\n"); + } else { + /* + * For ctrl_mon groups move both closid and rmid. +@@ -692,7 +692,7 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of, + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; +- rdt_last_cmd_puts("pseudo-locking in progress\n"); ++ rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + +@@ -1158,14 +1158,14 @@ static bool rdtgroup_mode_test_exclusive(struct rdtgroup *rdtgrp) + list_for_each_entry(d, &r->domains, list) { + if (rdtgroup_cbm_overlaps(r, d, d->ctrl_val[closid], + rdtgrp->closid, false)) { +- rdt_last_cmd_puts("schemata overlaps\n"); ++ rdt_last_cmd_puts("Schemata overlaps\n"); + return false; + } + } + } + + if (!has_cache) { +- rdt_last_cmd_puts("cannot be exclusive without CAT/CDP\n"); ++ rdt_last_cmd_puts("Cannot be exclusive without CAT/CDP\n"); + return false; + } + +@@ -1206,7 +1206,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of, + goto out; + + if (mode == RDT_MODE_PSEUDO_LOCKED) { +- rdt_last_cmd_printf("cannot change pseudo-locked group\n"); ++ rdt_last_cmd_printf("Cannot change pseudo-locked group\n"); + ret = -EINVAL; + goto out; + } +@@ -1235,7 +1235,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of, + goto out; + rdtgrp->mode = RDT_MODE_PSEUDO_LOCKSETUP; + } else { +- rdt_last_cmd_printf("unknown/unsupported mode\n"); ++ rdt_last_cmd_printf("Unknown orunsupported mode\n"); + ret = -EINVAL; + } + +@@ -2540,7 +2540,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp) + tmp_cbm = d->new_ctrl; + if (bitmap_weight(&tmp_cbm, r->cache.cbm_len) < + r->cache.min_cbm_bits) { +- rdt_last_cmd_printf("no space on %s:%d\n", ++ rdt_last_cmd_printf("No space on %s:%d\n", + r->name, d->id); + return -ENOSPC; + } +@@ -2557,7 +2557,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp) + continue; + ret = update_domains(r, rdtgrp->closid); + if (ret < 0) { +- rdt_last_cmd_puts("failed to initialize allocations\n"); ++ rdt_last_cmd_puts("Failed to initialize allocations\n"); + return ret; + } + rdtgrp->mode = RDT_MODE_SHAREABLE; +@@ -2580,7 +2580,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + rdt_last_cmd_clear(); + if (!prdtgrp) { + ret = -ENODEV; +- rdt_last_cmd_puts("directory was removed\n"); ++ rdt_last_cmd_puts("Directory was removed\n"); + goto out_unlock; + } + +@@ -2588,7 +2588,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + (prdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP || + prdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)) { + ret = -EINVAL; +- rdt_last_cmd_puts("pseudo-locking in progress\n"); ++ rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto out_unlock; + } + +@@ -2596,7 +2596,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + rdtgrp = kzalloc(sizeof(*rdtgrp), GFP_KERNEL); + if (!rdtgrp) { + ret = -ENOSPC; +- rdt_last_cmd_puts("kernel out of memory\n"); ++ rdt_last_cmd_puts("Kernel out of memory\n"); + goto out_unlock; + } + *r = rdtgrp; +@@ -2637,7 +2637,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, + if (rdt_mon_capable) { + ret = alloc_rmid(); + if (ret < 0) { +- rdt_last_cmd_puts("out of RMIDs\n"); ++ rdt_last_cmd_puts("Out of RMIDs\n"); + goto out_destroy; + } + rdtgrp->mon.rmid = ret; +@@ -2725,7 +2725,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn, + kn = rdtgrp->kn; + ret = closid_alloc(); + if (ret < 0) { +- rdt_last_cmd_puts("out of CLOSIDs\n"); ++ rdt_last_cmd_puts("Out of CLOSIDs\n"); + goto out_common_fail; + } + closid = ret; +-- +2.19.1 + diff --git a/queue-4.20/xfrm6_tunnel-fix-spi-check-in-__xfrm6_tunnel_alloc_s.patch b/queue-4.20/xfrm6_tunnel-fix-spi-check-in-__xfrm6_tunnel_alloc_s.patch new file mode 100644 index 00000000000..b7cbb772014 --- /dev/null +++ b/queue-4.20/xfrm6_tunnel-fix-spi-check-in-__xfrm6_tunnel_alloc_s.patch @@ -0,0 +1,39 @@ +From 381c7d332307083549c240f1dfee00ab37da6c2d Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Wed, 19 Dec 2018 14:45:09 +0800 +Subject: xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi + +[ Upstream commit fa89a4593b927b3f59c3b69379f31d3b22272e4e ] + +gcc warn this: + +net/ipv6/xfrm6_tunnel.c:143 __xfrm6_tunnel_alloc_spi() warn: + always true condition '(spi <= 4294967295) => (0-u32max <= u32max)' + +'spi' is u32, which always not greater than XFRM6_TUNNEL_SPI_MAX +because of wrap around. So the second forloop will never reach. + +Signed-off-by: YueHaibing +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv6/xfrm6_tunnel.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c +index 4a46df8441c9..f5b4febeaa25 100644 +--- a/net/ipv6/xfrm6_tunnel.c ++++ b/net/ipv6/xfrm6_tunnel.c +@@ -144,6 +144,9 @@ static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr) + index = __xfrm6_tunnel_spi_check(net, spi); + if (index >= 0) + goto alloc_spi; ++ ++ if (spi == XFRM6_TUNNEL_SPI_MAX) ++ break; + } + for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) { + index = __xfrm6_tunnel_spi_check(net, spi); +-- +2.19.1 + diff --git a/queue-4.20/xprtrdma-don-t-wake-pending-tasks-until-disconnect-i.patch b/queue-4.20/xprtrdma-don-t-wake-pending-tasks-until-disconnect-i.patch new file mode 100644 index 00000000000..74132a1acbb --- /dev/null +++ b/queue-4.20/xprtrdma-don-t-wake-pending-tasks-until-disconnect-i.patch @@ -0,0 +1,198 @@ +From 8bd78eea49199979017c8fe34db96eeeb5b188d8 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 19 Dec 2018 10:58:40 -0500 +Subject: xprtrdma: Don't wake pending tasks until disconnect is done + +[ Upstream commit 0c0829bcf51aef713806e49b8ea2bac7962f54e2 ] + +Transport disconnect processing does a "wake pending tasks" at +various points. + +Suppose an RPC Reply is being processed. The RPC task that Reply +goes with is waiting on the pending queue. If a disconnect wake-up +happens before reply processing is done, that reply, even if it is +good, is thrown away, and the RPC has to be sent again. + +This window apparently does not exist for socket transports because +there is a lock held while a reply is being received which prevents +the wake-up call until after reply processing is done. + +To resolve this, all RPC replies being processed on an RPC-over-RDMA +transport have to complete before pending tasks are awoken due to a +transport disconnect. + +Callers that already hold the transport write lock may invoke +->ops->close directly. Others use a generic helper that schedules +a close when the write lock can be taken safely. + +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/backchannel.c | 13 +++++++------ + net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 8 +++++--- + net/sunrpc/xprtrdma/transport.c | 17 ++++++++++------- + net/sunrpc/xprtrdma/verbs.c | 1 - + net/sunrpc/xprtrdma/xprt_rdma.h | 1 + + 5 files changed, 23 insertions(+), 17 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c +index e5b367a3e517..88fde80b9347 100644 +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -193,14 +193,15 @@ static int rpcrdma_bc_marshal_reply(struct rpc_rqst *rqst) + */ + int xprt_rdma_bc_send_reply(struct rpc_rqst *rqst) + { +- struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(rqst->rq_xprt); ++ struct rpc_xprt *xprt = rqst->rq_xprt; ++ struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt); + struct rpcrdma_req *req = rpcr_to_rdmar(rqst); + int rc; + +- if (!xprt_connected(rqst->rq_xprt)) +- goto drop_connection; ++ if (!xprt_connected(xprt)) ++ return -ENOTCONN; + +- if (!xprt_request_get_cong(rqst->rq_xprt, rqst)) ++ if (!xprt_request_get_cong(xprt, rqst)) + return -EBADSLT; + + rc = rpcrdma_bc_marshal_reply(rqst); +@@ -216,7 +217,7 @@ failed_marshal: + if (rc != -ENOTCONN) + return rc; + drop_connection: +- xprt_disconnect_done(rqst->rq_xprt); ++ xprt_rdma_close(xprt); + return -ENOTCONN; + } + +@@ -339,7 +340,7 @@ void rpcrdma_bc_receive_call(struct rpcrdma_xprt *r_xprt, + + out_overflow: + pr_warn("RPC/RDMA backchannel overflow\n"); +- xprt_disconnect_done(xprt); ++ xprt_force_disconnect(xprt); + /* This receive buffer gets reposted automatically + * when the connection is re-established. + */ +diff --git a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c +index f3c147d70286..b908f2ca08fd 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c +@@ -200,11 +200,10 @@ rpcrdma_bc_send_request(struct svcxprt_rdma *rdma, struct rpc_rqst *rqst) + svc_rdma_send_ctxt_put(rdma, ctxt); + goto drop_connection; + } +- return rc; ++ return 0; + + drop_connection: + dprintk("svcrdma: failed to send bc call\n"); +- xprt_disconnect_done(xprt); + return -ENOTCONN; + } + +@@ -225,8 +224,11 @@ xprt_rdma_bc_send_request(struct rpc_rqst *rqst) + + ret = -ENOTCONN; + rdma = container_of(sxprt, struct svcxprt_rdma, sc_xprt); +- if (!test_bit(XPT_DEAD, &sxprt->xpt_flags)) ++ if (!test_bit(XPT_DEAD, &sxprt->xpt_flags)) { + ret = rpcrdma_bc_send_request(rdma, rqst); ++ if (ret == -ENOTCONN) ++ svc_close_xprt(sxprt); ++ } + + mutex_unlock(&sxprt->xpt_mutex); + +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index ae2a83828953..e7683d3b1e6c 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -437,8 +437,7 @@ out1: + * Caller holds @xprt's send lock to prevent activity on this + * transport while the connection is torn down. + */ +-static void +-xprt_rdma_close(struct rpc_xprt *xprt) ++void xprt_rdma_close(struct rpc_xprt *xprt) + { + struct rpcrdma_xprt *r_xprt = rpcx_to_rdmax(xprt); + struct rpcrdma_ep *ep = &r_xprt->rx_ep; +@@ -449,13 +448,13 @@ xprt_rdma_close(struct rpc_xprt *xprt) + if (test_and_clear_bit(RPCRDMA_IAF_REMOVING, &ia->ri_flags)) { + xprt_clear_connected(xprt); + rpcrdma_ia_remove(ia); +- return; ++ goto out; + } ++ + if (ep->rep_connected == -ENODEV) + return; + if (ep->rep_connected > 0) + xprt->reestablish_timeout = 0; +- xprt_disconnect_done(xprt); + rpcrdma_ep_disconnect(ep, ia); + + /* Prepare @xprt for the next connection by reinitializing +@@ -463,6 +462,10 @@ xprt_rdma_close(struct rpc_xprt *xprt) + */ + r_xprt->rx_buf.rb_credits = 1; + xprt->cwnd = RPC_CWNDSHIFT; ++ ++out: ++ ++xprt->connect_cookie; ++ xprt_disconnect_done(xprt); + } + + /** +@@ -713,7 +716,7 @@ xprt_rdma_send_request(struct rpc_rqst *rqst) + #endif /* CONFIG_SUNRPC_BACKCHANNEL */ + + if (!xprt_connected(xprt)) +- goto drop_connection; ++ return -ENOTCONN; + + if (!xprt_request_get_cong(xprt, rqst)) + return -EBADSLT; +@@ -745,8 +748,8 @@ failed_marshal: + if (rc != -ENOTCONN) + return rc; + drop_connection: +- xprt_disconnect_done(xprt); +- return -ENOTCONN; /* implies disconnect */ ++ xprt_rdma_close(xprt); ++ return -ENOTCONN; + } + + void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq) +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index b9bc7f9f6bb9..919fddec0197 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -316,7 +316,6 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) + ep->rep_connected = -EAGAIN; + goto disconnected; + case RDMA_CM_EVENT_DISCONNECTED: +- ++xprt->connect_cookie; + ep->rep_connected = -ECONNABORTED; + disconnected: + xprt_force_disconnect(xprt); +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index a13ccb643ce0..0af75b1405f8 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -653,6 +653,7 @@ static inline void rpcrdma_set_xdrlen(struct xdr_buf *xdr, size_t len) + extern unsigned int xprt_rdma_max_inline_read; + void xprt_rdma_format_addresses(struct rpc_xprt *xprt, struct sockaddr *sap); + void xprt_rdma_free_addresses(struct rpc_xprt *xprt); ++void xprt_rdma_close(struct rpc_xprt *xprt); + void xprt_rdma_print_stats(struct rpc_xprt *xprt, struct seq_file *seq); + int xprt_rdma_init(void); + void xprt_rdma_cleanup(void); +-- +2.19.1 + diff --git a/queue-4.20/xtensa-xtfpga.dtsi-fix-dtc-warnings-about-spi.patch b/queue-4.20/xtensa-xtfpga.dtsi-fix-dtc-warnings-about-spi.patch new file mode 100644 index 00000000000..91bd714ca71 --- /dev/null +++ b/queue-4.20/xtensa-xtfpga.dtsi-fix-dtc-warnings-about-spi.patch @@ -0,0 +1,53 @@ +From ddfc0563cc3566e8f81a23ea9406b3792a6147f1 Mon Sep 17 00:00:00 2001 +From: Max Filippov +Date: Tue, 4 Dec 2018 16:08:20 -0800 +Subject: xtensa: xtfpga.dtsi: fix dtc warnings about SPI + +[ Upstream commit f37598be4e3896359e87c824be57ddddc280cc3f ] + +Rename SPI controller node in the XTFPGA DTS to spi@... +This fixes the following build warnings: + +arch/xtensa/boot/dts/kc705_nommu.dtb: Warning (spi_bus_bridge): + /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi' +arch/xtensa/boot/dts/kc705_nommu.dtb: Warning (spi_bus_reg): + Failed prerequisite 'spi_bus_bridge' +arch/xtensa/boot/dts/lx200mx.dtb: Warning (spi_bus_bridge): + /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi' +arch/xtensa/boot/dts/lx200mx.dtb: Warning (spi_bus_reg): + Failed prerequisite 'spi_bus_bridge' +arch/xtensa/boot/dts/kc705.dtb: Warning (spi_bus_bridge): + /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi' +arch/xtensa/boot/dts/kc705.dtb: Warning (spi_bus_reg): + Failed prerequisite 'spi_bus_bridge' +arch/xtensa/boot/dts/ml605.dtb: Warning (spi_bus_bridge): + /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi' +arch/xtensa/boot/dts/ml605.dtb: Warning (spi_bus_reg): + Failed prerequisite 'spi_bus_bridge' +arch/xtensa/boot/dts/lx60.dtb: Warning (spi_bus_bridge): + /soc/spi-master@0d0a0000: node name for SPI buses should be 'spi' +arch/xtensa/boot/dts/lx60.dtb: Warning (spi_bus_reg): + Failed prerequisite 'spi_bus_bridge' + +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/boot/dts/xtfpga.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/xtensa/boot/dts/xtfpga.dtsi b/arch/xtensa/boot/dts/xtfpga.dtsi +index 1090528825ec..e46ae07bab05 100644 +--- a/arch/xtensa/boot/dts/xtfpga.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga.dtsi +@@ -103,7 +103,7 @@ + }; + }; + +- spi0: spi-master@0d0a0000 { ++ spi0: spi@0d0a0000 { + compatible = "cdns,xtfpga-spi"; + #address-cells = <1>; + #size-cells = <0>; +-- +2.19.1 + diff --git a/queue-4.20/zram-fix-lockdep-warning-of-free-block-handling.patch b/queue-4.20/zram-fix-lockdep-warning-of-free-block-handling.patch new file mode 100644 index 00000000000..b8c01fa9cb1 --- /dev/null +++ b/queue-4.20/zram-fix-lockdep-warning-of-free-block-handling.patch @@ -0,0 +1,246 @@ +From 3c8d9831a026bb999baa2652bc5ef5ea8d6f2882 Mon Sep 17 00:00:00 2001 +From: Minchan Kim +Date: Fri, 28 Dec 2018 00:36:33 -0800 +Subject: zram: fix lockdep warning of free block handling + +[ Upstream commit 3c9959e025472122a61faebb208525cf26b305d1 ] + +Patch series "zram idle page writeback", v3. + +Inherently, swap device has many idle pages which are rare touched since +it was allocated. It is never problem if we use storage device as swap. +However, it's just waste for zram-swap. + +This patchset supports zram idle page writeback feature. + +* Admin can define what is idle page "no access since X time ago" +* Admin can define when zram should writeback them +* Admin can define when zram should stop writeback to prevent wearout + +Details are in each patch's description. + +This patch (of 7): + + ================================ + WARNING: inconsistent lock state + 4.19.0+ #390 Not tainted + -------------------------------- + inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. + zram_verify/2095 [HC0[0]:SC1[1]:HE1:SE0] takes: + 00000000b1828693 (&(&zram->bitmap_lock)->rlock){+.?.}, at: put_entry_bdev+0x1e/0x50 + {SOFTIRQ-ON-W} state was registered at: + _raw_spin_lock+0x2c/0x40 + zram_make_request+0x755/0xdc9 + generic_make_request+0x373/0x6a0 + submit_bio+0x6c/0x140 + __swap_writepage+0x3a8/0x480 + shrink_page_list+0x1102/0x1a60 + shrink_inactive_list+0x21b/0x3f0 + shrink_node_memcg.constprop.99+0x4f8/0x7e0 + shrink_node+0x7d/0x2f0 + do_try_to_free_pages+0xe0/0x300 + try_to_free_pages+0x116/0x2b0 + __alloc_pages_slowpath+0x3f4/0xf80 + __alloc_pages_nodemask+0x2a2/0x2f0 + __handle_mm_fault+0x42e/0xb50 + handle_mm_fault+0x55/0xb0 + __do_page_fault+0x235/0x4b0 + page_fault+0x1e/0x30 + irq event stamp: 228412 + hardirqs last enabled at (228412): [] __slab_free+0x3e6/0x600 + hardirqs last disabled at (228411): [] __slab_free+0x1c5/0x600 + softirqs last enabled at (228396): [] __do_softirq+0x31e/0x427 + softirqs last disabled at (228403): [] irq_exit+0xd1/0xe0 + + other info that might help us debug this: + Possible unsafe locking scenario: + + CPU0 + ---- + lock(&(&zram->bitmap_lock)->rlock); + + lock(&(&zram->bitmap_lock)->rlock); + + *** DEADLOCK *** + + no locks held by zram_verify/2095. + + stack backtrace: + CPU: 5 PID: 2095 Comm: zram_verify Not tainted 4.19.0+ #390 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 + Call Trace: + + dump_stack+0x67/0x9b + print_usage_bug+0x1bd/0x1d3 + mark_lock+0x4aa/0x540 + __lock_acquire+0x51d/0x1300 + lock_acquire+0x90/0x180 + _raw_spin_lock+0x2c/0x40 + put_entry_bdev+0x1e/0x50 + zram_free_page+0xf6/0x110 + zram_slot_free_notify+0x42/0xa0 + end_swap_bio_read+0x5b/0x170 + blk_update_request+0x8f/0x340 + scsi_end_request+0x2c/0x1e0 + scsi_io_completion+0x98/0x650 + blk_done_softirq+0x9e/0xd0 + __do_softirq+0xcc/0x427 + irq_exit+0xd1/0xe0 + do_IRQ+0x93/0x120 + common_interrupt+0xf/0xf + + +With writeback feature, zram_slot_free_notify could be called in softirq +context by end_swap_bio_read. However, bitmap_lock is not aware of that +so lockdep yell out: + + get_entry_bdev + spin_lock(bitmap->lock); + irq + softirq + end_swap_bio_read + zram_slot_free_notify + zram_slot_lock <-- deadlock prone + zram_free_page + put_entry_bdev + spin_lock(bitmap->lock); <-- deadlock prone + +With akpm's suggestion (i.e. bitmap operation is already atomic), we +could remove bitmap lock. It might fail to find a empty slot if serious +contention happens. However, it's not severe problem because huge page +writeback has already possiblity to fail if there is severe memory +pressure. Worst case is just keeping the incompressible in memory, not +storage. + +The other problem is zram_slot_lock in zram_slot_slot_free_notify. To +make it safe is this patch introduces zram_slot_trylock where +zram_slot_free_notify uses it. Although it's rare to be contented, this +patch adds new debug stat "miss_free" to keep monitoring how often it +happens. + +Link: http://lkml.kernel.org/r/20181127055429.251614-2-minchan@kernel.org +Signed-off-by: Minchan Kim +Reviewed-by: Sergey Senozhatsky +Reviewed-by: Joey Pabalinas +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/block/zram/zram_drv.c | 38 +++++++++++++++++++---------------- + drivers/block/zram/zram_drv.h | 2 +- + 2 files changed, 22 insertions(+), 18 deletions(-) + +diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c +index 8e6a0db6555f..d1459cc1159f 100644 +--- a/drivers/block/zram/zram_drv.c ++++ b/drivers/block/zram/zram_drv.c +@@ -53,6 +53,11 @@ static size_t huge_class_size; + + static void zram_free_page(struct zram *zram, size_t index); + ++static int zram_slot_trylock(struct zram *zram, u32 index) ++{ ++ return bit_spin_trylock(ZRAM_LOCK, &zram->table[index].value); ++} ++ + static void zram_slot_lock(struct zram *zram, u32 index) + { + bit_spin_lock(ZRAM_LOCK, &zram->table[index].value); +@@ -401,7 +406,6 @@ static ssize_t backing_dev_store(struct device *dev, + goto out; + + reset_bdev(zram); +- spin_lock_init(&zram->bitmap_lock); + + zram->old_block_size = old_block_size; + zram->bdev = bdev; +@@ -445,29 +449,24 @@ out: + + static unsigned long get_entry_bdev(struct zram *zram) + { +- unsigned long entry; +- +- spin_lock(&zram->bitmap_lock); ++ unsigned long blk_idx = 1; ++retry: + /* skip 0 bit to confuse zram.handle = 0 */ +- entry = find_next_zero_bit(zram->bitmap, zram->nr_pages, 1); +- if (entry == zram->nr_pages) { +- spin_unlock(&zram->bitmap_lock); ++ blk_idx = find_next_zero_bit(zram->bitmap, zram->nr_pages, blk_idx); ++ if (blk_idx == zram->nr_pages) + return 0; +- } + +- set_bit(entry, zram->bitmap); +- spin_unlock(&zram->bitmap_lock); ++ if (test_and_set_bit(blk_idx, zram->bitmap)) ++ goto retry; + +- return entry; ++ return blk_idx; + } + + static void put_entry_bdev(struct zram *zram, unsigned long entry) + { + int was_set; + +- spin_lock(&zram->bitmap_lock); + was_set = test_and_clear_bit(entry, zram->bitmap); +- spin_unlock(&zram->bitmap_lock); + WARN_ON_ONCE(!was_set); + } + +@@ -888,9 +887,10 @@ static ssize_t debug_stat_show(struct device *dev, + + down_read(&zram->init_lock); + ret = scnprintf(buf, PAGE_SIZE, +- "version: %d\n%8llu\n", ++ "version: %d\n%8llu %8llu\n", + version, +- (u64)atomic64_read(&zram->stats.writestall)); ++ (u64)atomic64_read(&zram->stats.writestall), ++ (u64)atomic64_read(&zram->stats.miss_free)); + up_read(&zram->init_lock); + + return ret; +@@ -1402,10 +1402,14 @@ static void zram_slot_free_notify(struct block_device *bdev, + + zram = bdev->bd_disk->private_data; + +- zram_slot_lock(zram, index); ++ atomic64_inc(&zram->stats.notify_free); ++ if (!zram_slot_trylock(zram, index)) { ++ atomic64_inc(&zram->stats.miss_free); ++ return; ++ } ++ + zram_free_page(zram, index); + zram_slot_unlock(zram, index); +- atomic64_inc(&zram->stats.notify_free); + } + + static int zram_rw_page(struct block_device *bdev, sector_t sector, +diff --git a/drivers/block/zram/zram_drv.h b/drivers/block/zram/zram_drv.h +index 72c8584b6dff..d1095dfdffa8 100644 +--- a/drivers/block/zram/zram_drv.h ++++ b/drivers/block/zram/zram_drv.h +@@ -79,6 +79,7 @@ struct zram_stats { + atomic64_t pages_stored; /* no. of pages currently stored */ + atomic_long_t max_used_pages; /* no. of maximum pages stored */ + atomic64_t writestall; /* no. of write slow paths */ ++ atomic64_t miss_free; /* no. of missed free */ + }; + + struct zram { +@@ -110,7 +111,6 @@ struct zram { + unsigned int old_block_size; + unsigned long *bitmap; + unsigned long nr_pages; +- spinlock_t bitmap_lock; + #endif + #ifdef CONFIG_ZRAM_MEMORY_TRACKING + struct dentry *debugfs_dir; +-- +2.19.1 +