From: Sasha Levin Date: Sun, 1 Dec 2019 15:05:10 +0000 (-0500) Subject: fixes for 5.3 X-Git-Tag: v5.4.2~66 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ef373a33795f34174d98d74dd21ac203735c8114;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.3 Signed-off-by: Sasha Levin --- diff --git a/queue-5.3/alsa-hda-hdmi-add-tigerlake-support.patch b/queue-5.3/alsa-hda-hdmi-add-tigerlake-support.patch new file mode 100644 index 00000000000..d2e3a2e8b5d --- /dev/null +++ b/queue-5.3/alsa-hda-hdmi-add-tigerlake-support.patch @@ -0,0 +1,56 @@ +From 734c804811562ec5b44fda7642a3e0eb40efa1bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 18:10:53 +0200 +Subject: ALSA: hda: hdmi - add Tigerlake support + +From: Kai Vehmanen + +[ Upstream commit 9a11ba7388f165762549903492fc34d29bbb3c04 ] + +Add Tigerlake HDMI codec support. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=205379 +BugLink: https://bugs.freedesktop.org/show_bug.cgi?id=112171 +Cc: Pan Xiuli +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20191105161053.22958-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_hdmi.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 00796c7727ea2..ff99f5feaace9 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2703,6 +2703,18 @@ static int patch_i915_icl_hdmi(struct hda_codec *codec) + return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map)); + } + ++static int patch_i915_tgl_hdmi(struct hda_codec *codec) ++{ ++ /* ++ * pin to port mapping table where the value indicate the pin number and ++ * the index indicate the port number with 1 base. ++ */ ++ static const int map[] = {0x4, 0x6, 0x8, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf}; ++ ++ return intel_hsw_common_init(codec, 0x02, map, ARRAY_SIZE(map)); ++} ++ ++ + /* Intel Baytrail and Braswell; with eld notifier */ + static int patch_i915_byt_hdmi(struct hda_codec *codec) + { +@@ -3960,6 +3972,7 @@ HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI", patch_i915_hsw_hdmi), + HDA_CODEC_ENTRY(0x8086280c, "Cannonlake HDMI", patch_i915_glk_hdmi), + HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_glk_hdmi), + HDA_CODEC_ENTRY(0x8086280f, "Icelake HDMI", patch_i915_icl_hdmi), ++HDA_CODEC_ENTRY(0x80862812, "Tigerlake HDMI", patch_i915_tgl_hdmi), + HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi), + HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi), + HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI", patch_i915_byt_hdmi), +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch b/queue-5.3/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch new file mode 100644 index 00000000000..24eb03fdedb --- /dev/null +++ b/queue-5.3/arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch @@ -0,0 +1,99 @@ +From 465780ef7ce01491a9b235e4400c44e578ba0bf9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 17:43:43 -0300 +Subject: ARM: dts: imx6qdl-sabreauto: Fix storm of accelerometer interrupts + +From: Fabio Estevam + +[ Upstream commit 7e5d0bf6afcc7bd72f78e7f33570e2e0945624f0 ] + +Since commit a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors") +a storm of accelerometer interrupts is seen: + +[ 114.211283] irq 260: nobody cared (try booting with the "irqpoll" option) +[ 114.218108] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.3.4 #1 +[ 114.223960] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 114.230531] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 114.238301] [] (show_stack) from [] (dump_stack+0xd8/0x110) +[ 114.245644] [] (dump_stack) from [] (__report_bad_irq+0x30/0xc0) +[ 114.253417] [] (__report_bad_irq) from [] (note_interrupt+0x108/0x298) +[ 114.261707] [] (note_interrupt) from [] (handle_irq_event_percpu+0x70/0x80) +[ 114.270433] [] (handle_irq_event_percpu) from [] (handle_irq_event+0x38/0x5c) +[ 114.279326] [] (handle_irq_event) from [] (handle_level_irq+0xc8/0x154) +[ 114.287701] [] (handle_level_irq) from [] (generic_handle_irq+0x20/0x34) +[ 114.296166] [] (generic_handle_irq) from [] (mxc_gpio_irq_handler+0x30/0xf0) +[ 114.304975] [] (mxc_gpio_irq_handler) from [] (mx3_gpio_irq_handler+0x60/0xb0) +[ 114.313955] [] (mx3_gpio_irq_handler) from [] (generic_handle_irq+0x20/0x34) +[ 114.322762] [] (generic_handle_irq) from [] (__handle_domain_irq+0x64/0xe0) +[ 114.331485] [] (__handle_domain_irq) from [] (gic_handle_irq+0x4c/0xa8) +[ 114.339862] [] (gic_handle_irq) from [] (__irq_svc+0x70/0x98) +[ 114.347361] Exception stack(0xc1301ec0 to 0xc1301f08) +[ 114.352435] 1ec0: 00000001 00000006 00000000 c130c340 00000001 c130f688 9785636d c13ea2e8 +[ 114.360635] 1ee0: 9784907d 0000001a eaf99d78 0000001a 00000000 c1301f10 c0182b00 c0878de4 +[ 114.368830] 1f00: 20000013 ffffffff +[ 114.372349] [] (__irq_svc) from [] (cpuidle_enter_state+0x168/0x5f4) +[ 114.380464] [] (cpuidle_enter_state) from [] (cpuidle_enter+0x28/0x38) +[ 114.388751] [] (cpuidle_enter) from [] (do_idle+0x224/0x2a8) +[ 114.396168] [] (do_idle) from [] (cpu_startup_entry+0x18/0x20) +[ 114.403765] [] (cpu_startup_entry) from [] (start_kernel+0x43c/0x500) +[ 114.411958] handlers: +[ 114.414302] [] irq_default_primary_handler threaded [] mma8452_interrupt +[ 114.422974] Disabling IRQ #260 + + CPU0 CPU1 +.... +260: 100001 0 gpio-mxc 31 Level mma8451 + +The MMA8451 interrupt triggers as low level, so the GPIO6_IO31 pin +needs to activate its pull up, otherwise it will stay always at low level +generating multiple interrupts. + +The current device tree does not configure the IOMUX for this pin, so +it uses whathever comes configured from the bootloader. + +The IOMUXC_SW_PAD_CTL_PAD_EIM_BCLK register value comes as 0x8000 from +the bootloader, which has PKE bit cleared, hence disabling the +pull-up. + +Instead of relying on a previous configuration from the bootloader, +configure the GPIO6_IO31 pin with pull-up enabled in order to fix +this problem. + +Fixes: a211b8c55f3c ("ARM: dts: imx6qdl-sabreauto: Add sensors") +Signed-off-by: Fabio Estevam +Reviewed-By: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-sabreauto.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi +index f3404dd105377..cf628465cd0a3 100644 +--- a/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-sabreauto.dtsi +@@ -230,6 +230,8 @@ + accelerometer@1c { + compatible = "fsl,mma8451"; + reg = <0x1c>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_mma8451_int>; + interrupt-parent = <&gpio6>; + interrupts = <31 IRQ_TYPE_LEVEL_LOW>; + }; +@@ -628,6 +630,12 @@ + >; + }; + ++ pinctrl_mma8451_int: mma8451intgrp { ++ fsl,pins = < ++ MX6QDL_PAD_EIM_BCLK__GPIO6_IO31 0xb0b1 ++ >; ++ }; ++ + pinctrl_pwm3: pwm1grp { + fsl,pins = < + MX6QDL_PAD_SD4_DAT1__PWM3_OUT 0x1b0b1 +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-stm32-fix-can-ram-mapping-on-stm32mp157c.patch b/queue-5.3/arm-dts-stm32-fix-can-ram-mapping-on-stm32mp157c.patch new file mode 100644 index 00000000000..b379e120074 --- /dev/null +++ b/queue-5.3/arm-dts-stm32-fix-can-ram-mapping-on-stm32mp157c.patch @@ -0,0 +1,47 @@ +From 80a3c64a9d8ea6c228e0515aa296a3732e388cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 15:31:45 +0100 +Subject: ARM: dts: stm32: Fix CAN RAM mapping on stm32mp157c + +From: Christophe Roullier + +[ Upstream commit 9df50c2e16de7fd739d11d37303afec9e573b46f ] + +Split the 10Kbytes CAN message RAM to be able to use simultaneously +FDCAN1 and FDCAN2 instances. +First 5Kbytes are allocated to FDCAN1 and last 5Kbytes are used for +FDCAN2. To do so, set the offset to 0x1400 in mram-cfg for FDCAN2. + +Fixes: d44d6e021301 ("ARM: dts: stm32: change CAN RAM mapping on stm32mp157c") +Signed-off-by: Christophe Roullier +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c.dtsi b/arch/arm/boot/dts/stm32mp157c.dtsi +index 0c4e6ebc35291..31556bea2c933 100644 +--- a/arch/arm/boot/dts/stm32mp157c.dtsi ++++ b/arch/arm/boot/dts/stm32mp157c.dtsi +@@ -914,7 +914,7 @@ + interrupt-names = "int0", "int1"; + clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>; + clock-names = "hclk", "cclk"; +- bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>; ++ bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>; + status = "disabled"; + }; + +@@ -927,7 +927,7 @@ + interrupt-names = "int0", "int1"; + clocks = <&rcc CK_HSE>, <&rcc FDCAN_K>; + clock-names = "hclk", "cclk"; +- bosch,mram-cfg = <0x0 0 0 32 0 0 2 2>; ++ bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>; + status = "disabled"; + }; + +-- +2.20.1 + diff --git a/queue-5.3/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch b/queue-5.3/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch new file mode 100644 index 00000000000..40d870d63c6 --- /dev/null +++ b/queue-5.3/arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch @@ -0,0 +1,44 @@ +From fe9baf0ad487a99d17c35262ee8320bb521faf76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 22:58:58 +0100 +Subject: ARM: dts: sun8i-a83t-tbs-a711: Fix WiFi resume from suspend + +From: Ondrej Jirman + +[ Upstream commit e614f341253f8541baf0230a8dc6a016b544b1e2 ] + +Without enabling keep-power-in-suspend, we can't wake the device +up using WOL packet, and the log is flooded with these messages +on resume: + +sunxi-mmc 1c10000.mmc: send stop command failed +sunxi-mmc 1c10000.mmc: data error, sending stop command +sunxi-mmc 1c10000.mmc: send stop command failed +sunxi-mmc 1c10000.mmc: data error, sending stop command + +So to make the WiFi really a wakeup-source, we need to keep it powered +during suspend. + +Fixes: 0e23372080def7 ("arm: dts: sun8i: Add the TBS A711 tablet devicetree") +Signed-off-by: Ondrej Jirman +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts +index 568b90ece3427..3bec3e0a81b2c 100644 +--- a/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts ++++ b/arch/arm/boot/dts/sun8i-a83t-tbs-a711.dts +@@ -192,6 +192,7 @@ + vqmmc-supply = <®_dldo1>; + non-removable; + wakeup-source; ++ keep-power-in-suspend; + status = "okay"; + + brcmf: wifi@1 { +-- +2.20.1 + diff --git a/queue-5.3/arm64-dts-imx8mm-fix-compatible-string-for-sdma.patch b/queue-5.3/arm64-dts-imx8mm-fix-compatible-string-for-sdma.patch new file mode 100644 index 00000000000..1bc6cd8acc3 --- /dev/null +++ b/queue-5.3/arm64-dts-imx8mm-fix-compatible-string-for-sdma.patch @@ -0,0 +1,54 @@ +From a12c0a85a9eaf769c50ca4dff12c8e49306e222e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 16:39:23 +0800 +Subject: arm64: dts: imx8mm: fix compatible string for sdma + +From: Shengjiu Wang + +[ Upstream commit e346ff93f02b1ba81e976d4e67ec56582dbdf7f1 ] + +SDMA in i.MX8MM should use same configuration as i.MX8MQ +So need to change compatible string to be "fsl,imx8mq-sdma". + +Fixes: a05ea40eb384 ("arm64: dts: imx: Add i.mx8mm dtsi support") +Signed-off-by: Shengjiu Wang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm.dtsi b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +index 0d0a6543e5db2..a9824b862c419 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm.dtsi +@@ -370,7 +370,7 @@ + }; + + sdma2: dma-controller@302c0000 { +- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma"; ++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma"; + reg = <0x302c0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MM_CLK_SDMA2_ROOT>, +@@ -381,7 +381,7 @@ + }; + + sdma3: dma-controller@302b0000 { +- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma"; ++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma"; + reg = <0x302b0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MM_CLK_SDMA3_ROOT>, +@@ -693,7 +693,7 @@ + }; + + sdma1: dma-controller@30bd0000 { +- compatible = "fsl,imx8mm-sdma", "fsl,imx7d-sdma"; ++ compatible = "fsl,imx8mm-sdma", "fsl,imx8mq-sdma"; + reg = <0x30bd0000 0x10000>; + interrupts = ; + clocks = <&clk IMX8MM_CLK_SDMA1_ROOT>, +-- +2.20.1 + diff --git a/queue-5.3/arm64-dts-ls1028a-fix-a-compatible-issue.patch b/queue-5.3/arm64-dts-ls1028a-fix-a-compatible-issue.patch new file mode 100644 index 00000000000..b98fa13fd63 --- /dev/null +++ b/queue-5.3/arm64-dts-ls1028a-fix-a-compatible-issue.patch @@ -0,0 +1,38 @@ +From 77fba1d08e6c5623bb03aae52733bdc01280d504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Oct 2019 16:33:34 +0800 +Subject: arm64: dts: ls1028a: fix a compatible issue + +From: Yuantian Tang + +[ Upstream commit 7eb3894b2fac978f811684e3ccb3cb0ad7820bef ] + +The I2C multiplexer used on ls1028aqds is PCA9547, not PCA9847. +If the wrong compatible was used, this chip will not be able to +be probed correctly and hence fail to work. + +Signed-off-by: Yuantian Tang +Acked-by: Li Yang +Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts +index de6ef39f3118a..fce9343dc017a 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts +@@ -99,7 +99,7 @@ + status = "okay"; + + i2c-mux@77 { +- compatible = "nxp,pca9847"; ++ compatible = "nxp,pca9547"; + reg = <0x77>; + #address-cells = <1>; + #size-cells = <0>; +-- +2.20.1 + diff --git a/queue-5.3/arm64-dts-zii-ultra-fix-arm-regulator-gpio-handle.patch b/queue-5.3/arm64-dts-zii-ultra-fix-arm-regulator-gpio-handle.patch new file mode 100644 index 00000000000..170febf74fd --- /dev/null +++ b/queue-5.3/arm64-dts-zii-ultra-fix-arm-regulator-gpio-handle.patch @@ -0,0 +1,37 @@ +From fd47565b791b76ac8c24aa7c03c6521e5dc8199e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 17:46:23 +0100 +Subject: arm64: dts: zii-ultra: fix ARM regulator GPIO handle + +From: Lucas Stach + +[ Upstream commit f852497c9a07ec9913bb3f3db5f096a8e2ab7e03 ] + +The GPIO handle is referencing the wrong GPIO, so the voltage did not +actually change as intended. The pinmux is already correct, so just +correct the GPIO number. + +Fixes: 4a13b3bec3b4 (arm64: dts: imx: add Zii Ultra board support) +Signed-off-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi +index 3faa652fdf20d..c25be32ba37e4 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq-zii-ultra.dtsi +@@ -100,7 +100,7 @@ + regulator-name = "0V9_ARM"; + regulator-min-microvolt = <900000>; + regulator-max-microvolt = <1000000>; +- gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>; ++ gpios = <&gpio3 16 GPIO_ACTIVE_HIGH>; + states = <1000000 0x1 + 900000 0x0>; + regulator-always-on; +-- +2.20.1 + diff --git a/queue-5.3/asoc-compress-fix-unsigned-integer-overflow-check.patch b/queue-5.3/asoc-compress-fix-unsigned-integer-overflow-check.patch new file mode 100644 index 00000000000..3781ecd1b74 --- /dev/null +++ b/queue-5.3/asoc-compress-fix-unsigned-integer-overflow-check.patch @@ -0,0 +1,38 @@ +From 7cc4a50da565d67ef11f78e11ea24c7983730579 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Oct 2019 10:54:32 +0100 +Subject: ASoC: compress: fix unsigned integer overflow check + +From: Xiaojun Sang + +[ Upstream commit d3645b055399538415586ebaacaedebc1e5899b0 ] + +Parameter fragments and fragment_size are type of u32. U32_MAX is +the correct check. + +Signed-off-by: Xiaojun Sang +Signed-off-by: Srinivas Kandagatla +Acked-by: Vinod Koul +Link: https://lore.kernel.org/r/20191021095432.5639-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 41905afada63f..f34ce564d92c4 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -528,7 +528,7 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments > U32_MAX / params->buffer.fragment_size || + params->buffer.fragments == 0) + return -EINVAL; + +-- +2.20.1 + diff --git a/queue-5.3/asoc-hdac_hda-fix-race-in-device-removal.patch b/queue-5.3/asoc-hdac_hda-fix-race-in-device-removal.patch new file mode 100644 index 00000000000..2d1f39352de --- /dev/null +++ b/queue-5.3/asoc-hdac_hda-fix-race-in-device-removal.patch @@ -0,0 +1,49 @@ +From 9a1b02e244bf71045d0190edf53678681ff8a3ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 12:06:35 -0500 +Subject: ASoC: hdac_hda: fix race in device removal + +From: Kai Vehmanen + +[ Upstream commit 5dc7d5bc9627eb26d33c7c7eefc467cf217f9326 ] + +When ASoC card instance is removed containing a HDA codec, +hdac_hda_codec_remove() may run in parallel with codec resume. +This will cause problems if the HDA link is freed with +snd_hdac_ext_bus_link_put() while the codec is still in +middle of its resume process. + +To fix this, change the order such that pm_runtime_disable() +is called before the link is freed. This will ensure any +pending runtime PM action is completed before proceeding +to free the link. + +This issue can be easily hit with e.g. SOF driver by loading and +unloading the drivers. + +Signed-off-by: Kai Vehmanen +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20191101170635.26389-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hda.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c +index 91242b6f8ea7a..4570f662fb48b 100644 +--- a/sound/soc/codecs/hdac_hda.c ++++ b/sound/soc/codecs/hdac_hda.c +@@ -410,8 +410,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component) + return; + } + +- snd_hdac_ext_bus_link_put(hdev->bus, hlink); + pm_runtime_disable(&hdev->dev); ++ snd_hdac_ext_bus_link_put(hdev->bus, hlink); + } + + static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = { +-- +2.20.1 + diff --git a/queue-5.3/asoc-kirkwood-fix-device-remove-ordering.patch b/queue-5.3/asoc-kirkwood-fix-device-remove-ordering.patch new file mode 100644 index 00000000000..65514cf5da4 --- /dev/null +++ b/queue-5.3/asoc-kirkwood-fix-device-remove-ordering.patch @@ -0,0 +1,61 @@ +From 7b62e8b789f8163f882dbf5ba7d5a4fe905cc926 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 14:46:49 +0100 +Subject: ASoC: kirkwood: fix device remove ordering + +From: Russell King + +[ Upstream commit dc39596a906d5b604f4e64597b6e904fc14625e8 ] + +The devm conversion of kirkwood was incorrect; on removal, devm takes +effect after the "remove" function has returned. So, the effect of +the conversion was to change the order during remove from: + + - snd_soc_unregister_component() (unpublishes interfaces) + - clk_disable_unprepare() + - cleanup resources + +After the conversion, this became: + + - clk_disable_unprepare() - while the device may still be active + - snd_soc_unregister_component() + - cleanup resources + +Hence, it introduces a bug, where the internal clock for the device +may be shut down before the device itself has been shut down. It is +known that Marvell SoCs, including Dove, locks up if registers for a +peripheral that has its clocks disabled are accessed. + +Fixes: f98fc0f8154e ("ASoC: kirkwood: replace platform to component") +Signed-off-by: Russell King +Link: https://lore.kernel.org/r/E1iNGyP-0004oN-BA@rmk-PC.armlinux.org.uk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-i2s.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c +index c323ae314b554..eb38cdb37f0ea 100644 +--- a/sound/soc/kirkwood/kirkwood-i2s.c ++++ b/sound/soc/kirkwood/kirkwood-i2s.c +@@ -591,7 +591,7 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + priv->ctl_rec |= KIRKWOOD_RECCTL_BURST_128; + } + +- err = devm_snd_soc_register_component(&pdev->dev, &kirkwood_soc_component, ++ err = snd_soc_register_component(&pdev->dev, &kirkwood_soc_component, + soc_dai, 2); + if (err) { + dev_err(&pdev->dev, "snd_soc_register_component failed\n"); +@@ -614,6 +614,7 @@ static int kirkwood_i2s_dev_remove(struct platform_device *pdev) + { + struct kirkwood_dma_data *priv = dev_get_drvdata(&pdev->dev); + ++ snd_soc_unregister_component(&pdev->dev); + if (!IS_ERR(priv->extclk)) + clk_disable_unprepare(priv->extclk); + clk_disable_unprepare(priv->clk); +-- +2.20.1 + diff --git a/queue-5.3/asoc-kirkwood-fix-external-clock-probe-defer.patch b/queue-5.3/asoc-kirkwood-fix-external-clock-probe-defer.patch new file mode 100644 index 00000000000..5136a294093 --- /dev/null +++ b/queue-5.3/asoc-kirkwood-fix-external-clock-probe-defer.patch @@ -0,0 +1,51 @@ +From ffdfb014c063c839b7163f5d7dc80b3cfaba9802 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 14:46:44 +0100 +Subject: ASoC: kirkwood: fix external clock probe defer + +From: Russell King + +[ Upstream commit 4523817d51bc3b2ef38da768d004fda2c8bc41de ] + +When our call to get the external clock fails, we forget to clean up +the enabled internal clock correctly. Enable the clock after we have +obtained all our resources. + +Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time") +Signed-off-by: Russell King +Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/kirkwood/kirkwood-i2s.c b/sound/soc/kirkwood/kirkwood-i2s.c +index 3446a113f482e..c323ae314b554 100644 +--- a/sound/soc/kirkwood/kirkwood-i2s.c ++++ b/sound/soc/kirkwood/kirkwood-i2s.c +@@ -559,10 +559,6 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + return PTR_ERR(priv->clk); + } + +- err = clk_prepare_enable(priv->clk); +- if (err < 0) +- return err; +- + priv->extclk = devm_clk_get(&pdev->dev, "extclk"); + if (IS_ERR(priv->extclk)) { + if (PTR_ERR(priv->extclk) == -EPROBE_DEFER) +@@ -578,6 +574,10 @@ static int kirkwood_i2s_dev_probe(struct platform_device *pdev) + } + } + ++ err = clk_prepare_enable(priv->clk); ++ if (err < 0) ++ return err; ++ + /* Some sensible defaults - this reflects the powerup values */ + priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24; + priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24; +-- +2.20.1 + diff --git a/queue-5.3/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch b/queue-5.3/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch new file mode 100644 index 00000000000..a184345e5fc --- /dev/null +++ b/queue-5.3/asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch @@ -0,0 +1,56 @@ +From 67658322ca38b83e8b7e0e4bea0f967d254539ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Oct 2019 17:30:06 +0200 +Subject: ASoC: msm8916-wcd-analog: Fix RX1 selection in RDAC2 MUX + +From: Stephan Gerhold + +[ Upstream commit 9110d1b0e229cebb1ffce0c04db2b22beffd513d ] + +According to the PM8916 Hardware Register Description, +CDC_D_CDC_CONN_HPHR_DAC_CTL has only a single bit (RX_SEL) +to switch between RX1 (0) and RX2 (1). It is not possible to +disable it entirely to achieve the "ZERO" state. + +However, at the moment the "RDAC2 MUX" mixer defines three possible +values ("ZERO", "RX2" and "RX1"). Setting the mixer to "ZERO" +actually configures it to RX1. Setting the mixer to "RX1" has +(seemingly) no effect. + +Remove "ZERO" and replace it with "RX1" to fix this. + +Fixes: 585e881e5b9e ("ASoC: codecs: Add msm8916-wcd analog codec") +Signed-off-by: Stephan Gerhold +Acked-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20191020153007.206070-1-stephan@gerhold.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/msm8916-wcd-analog.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 368b6c09474bb..aa9a8ac987dc0 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -306,7 +306,7 @@ struct pm8916_wcd_analog_priv { + }; + + static const char *const adc2_mux_text[] = { "ZERO", "INP2", "INP3" }; +-static const char *const rdac2_mux_text[] = { "ZERO", "RX2", "RX1" }; ++static const char *const rdac2_mux_text[] = { "RX1", "RX2" }; + static const char *const hph_text[] = { "ZERO", "Switch", }; + + static const struct soc_enum hph_enum = SOC_ENUM_SINGLE_VIRT( +@@ -321,7 +321,7 @@ static const struct soc_enum adc2_enum = SOC_ENUM_SINGLE_VIRT( + + /* RDAC2 MUX */ + static const struct soc_enum rdac2_mux_enum = SOC_ENUM_SINGLE( +- CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 3, rdac2_mux_text); ++ CDC_D_CDC_CONN_HPHR_DAC_CTL, 0, 2, rdac2_mux_text); + + static const struct snd_kcontrol_new spkr_switch[] = { + SOC_DAPM_SINGLE("Switch", CDC_A_SPKR_DAC_CTL, 7, 1, 0) +-- +2.20.1 + diff --git a/queue-5.3/asoc-rockchip-rockchip_max98090-enable-shdn-to-fix-h.patch b/queue-5.3/asoc-rockchip-rockchip_max98090-enable-shdn-to-fix-h.patch new file mode 100644 index 00000000000..0a42ec89f86 --- /dev/null +++ b/queue-5.3/asoc-rockchip-rockchip_max98090-enable-shdn-to-fix-h.patch @@ -0,0 +1,52 @@ +From 1081be20fc90c81652fd018eff06a8838203c10b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 17:52:29 +0800 +Subject: ASoC: rockchip: rockchip_max98090: Enable SHDN to fix headset + detection + +From: Cheng-Yi Chiang + +[ Upstream commit 07c1b73e2a027ea9a52677beeb6a943a3e357139 ] + +max98090 spec states that chip needs to be in turned-on state to supply +mic bias. Enable SHDN dapm widget along with MICBIAS widget to +actually turn on mic bias for proper headset button detection. +This is similar to cht_ti_jack_event in +sound/soc/intel/boards/cht_bsw_max98090_ti.c. + +Note that due to ts3a227e reports the jack event right away before the +notifier is registered, if headset is plugged on boot, headset button +will not get detected until headset is unplugged and plugged. This is +still an issue to be fixed. + +Signed-off-by: Cheng-Yi Chiang +Link: https://lore.kernel.org/r/20191028095229.99438-1-cychiang@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_max98090.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/rockchip/rockchip_max98090.c b/sound/soc/rockchip/rockchip_max98090.c +index 782e534d4c0dd..f2add1fe2e79d 100644 +--- a/sound/soc/rockchip/rockchip_max98090.c ++++ b/sound/soc/rockchip/rockchip_max98090.c +@@ -67,10 +67,13 @@ static int rk_jack_event(struct notifier_block *nb, unsigned long event, + struct snd_soc_jack *jack = (struct snd_soc_jack *)data; + struct snd_soc_dapm_context *dapm = &jack->card->dapm; + +- if (event & SND_JACK_MICROPHONE) ++ if (event & SND_JACK_MICROPHONE) { + snd_soc_dapm_force_enable_pin(dapm, "MICBIAS"); +- else ++ snd_soc_dapm_force_enable_pin(dapm, "SHDN"); ++ } else { + snd_soc_dapm_disable_pin(dapm, "MICBIAS"); ++ snd_soc_dapm_disable_pin(dapm, "SHDN"); ++ } + + snd_soc_dapm_sync(dapm); + +-- +2.20.1 + diff --git a/queue-5.3/asoc-sof-ipc-fix-memory-leak-in-sof_set_get_large_ct.patch b/queue-5.3/asoc-sof-ipc-fix-memory-leak-in-sof_set_get_large_ct.patch new file mode 100644 index 00000000000..8021749c3dc --- /dev/null +++ b/queue-5.3/asoc-sof-ipc-fix-memory-leak-in-sof_set_get_large_ct.patch @@ -0,0 +1,41 @@ +From e31bf2ff0f173a04fcdd17f5994fe843942da81e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Oct 2019 16:53:24 -0500 +Subject: ASoC: SOF: ipc: Fix memory leak in sof_set_get_large_ctrl_data + +From: Navid Emamdoost + +[ Upstream commit 45c1380358b12bf2d1db20a5874e9544f56b34ab ] + +In the implementation of sof_set_get_large_ctrl_data() there is a memory +leak in case an error. Release partdata if sof_get_ctrl_copy_params() +fails. + +Fixes: 54d198d5019d ("ASoC: SOF: Propagate sof_get_ctrl_copy_params() error properly") +Signed-off-by: Navid Emamdoost +Link: https://lore.kernel.org/r/20191027215330.12729-1-navid.emamdoost@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/ipc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/ipc.c b/sound/soc/sof/ipc.c +index 20dfca9c93b76..c4086186722f3 100644 +--- a/sound/soc/sof/ipc.c ++++ b/sound/soc/sof/ipc.c +@@ -578,8 +578,10 @@ static int sof_set_get_large_ctrl_data(struct snd_sof_dev *sdev, + else + err = sof_get_ctrl_copy_params(cdata->type, partdata, cdata, + sparams); +- if (err < 0) ++ if (err < 0) { ++ kfree(partdata); + return err; ++ } + + msg_bytes = sparams->msg_bytes; + pl_size = sparams->pl_size; +-- +2.20.1 + diff --git a/queue-5.3/asoc-sof-topology-fix-bytes-control-size-checks.patch b/queue-5.3/asoc-sof-topology-fix-bytes-control-size-checks.patch new file mode 100644 index 00000000000..e0a6e2a8936 --- /dev/null +++ b/queue-5.3/asoc-sof-topology-fix-bytes-control-size-checks.patch @@ -0,0 +1,60 @@ +From 2bfa7835c9b80ffad7f0e9bb118013035a60d51c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 08:58:16 -0600 +Subject: ASoC: SOF: topology: Fix bytes control size checks + +From: Dragos Tarcatu + +[ Upstream commit 9508ef5a980f5d847cad9b932b6ada8f2a3466c1 ] + +When using the example SOF amp widget topology, KASAN dumps this +when the AMP bytes kcontrol gets loaded: + +[ 9.579548] BUG: KASAN: slab-out-of-bounds in +sof_control_load+0x8cc/0xac0 [snd_sof] +[ 9.588194] Write of size 40 at addr ffff8882314559dc by task +systemd-udevd/2411 + +Fix that by rejecting the topology if the bytes data size > max_size + +Fixes: 311ce4fe7637d ("ASoC: SOF: Add support for loading topologies") +Reviewed-by: Jaska Uimonen +Reviewed-by: Ranjani Sridharan +Signed-off-by: Dragos Tarcatu +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20191106145816.9367-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/topology.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/sof/topology.c b/sound/soc/sof/topology.c +index 96230329e678f..355f04663f576 100644 +--- a/sound/soc/sof/topology.c ++++ b/sound/soc/sof/topology.c +@@ -533,15 +533,16 @@ static int sof_control_load_bytes(struct snd_soc_component *scomp, + struct soc_bytes_ext *sbe = (struct soc_bytes_ext *)kc->private_value; + int max_size = sbe->max; + +- if (le32_to_cpu(control->priv.size) > max_size) { ++ /* init the get/put bytes data */ ++ scontrol->size = sizeof(struct sof_ipc_ctrl_data) + ++ le32_to_cpu(control->priv.size); ++ ++ if (scontrol->size > max_size) { + dev_err(sdev->dev, "err: bytes data size %d exceeds max %d.\n", +- control->priv.size, max_size); ++ scontrol->size, max_size); + return -EINVAL; + } + +- /* init the get/put bytes data */ +- scontrol->size = sizeof(struct sof_ipc_ctrl_data) + +- le32_to_cpu(control->priv.size); + scontrol->control_data = kzalloc(max_size, GFP_KERNEL); + cdata = scontrol->control_data; + if (!scontrol->control_data) +-- +2.20.1 + diff --git a/queue-5.3/asoc-stm32-sai-add-restriction-on-mmap-support.patch b/queue-5.3/asoc-stm32-sai-add-restriction-on-mmap-support.patch new file mode 100644 index 00000000000..bbe23053eb8 --- /dev/null +++ b/queue-5.3/asoc-stm32-sai-add-restriction-on-mmap-support.patch @@ -0,0 +1,54 @@ +From 7a0863db181385c05d826e4c2ec93f4c56017427 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 14:36:54 +0100 +Subject: ASoC: stm32: sai: add restriction on mmap support + +From: Olivier Moysan + +[ Upstream commit eaf072e512d54c95b0977eda06cbca3151ace1e5 ] + +Do not support mmap in S/PDIF mode. In S/PDIF mode +the buffer has to be copied, to allow the channel status +bits insertion. + +Signed-off-by: Olivier Moysan +Link: https://lore.kernel.org/r/20191104133654.28750-1-olivier.moysan@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/stm/stm32_sai_sub.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/stm/stm32_sai_sub.c b/sound/soc/stm/stm32_sai_sub.c +index d7501f88aaa63..34e73071d4db8 100644 +--- a/sound/soc/stm/stm32_sai_sub.c ++++ b/sound/soc/stm/stm32_sai_sub.c +@@ -1217,6 +1217,16 @@ static int stm32_sai_pcm_process_spdif(struct snd_pcm_substream *substream, + return 0; + } + ++/* No support of mmap in S/PDIF mode */ ++static const struct snd_pcm_hardware stm32_sai_pcm_hw_spdif = { ++ .info = SNDRV_PCM_INFO_INTERLEAVED, ++ .buffer_bytes_max = 8 * PAGE_SIZE, ++ .period_bytes_min = 1024, ++ .period_bytes_max = PAGE_SIZE, ++ .periods_min = 2, ++ .periods_max = 8, ++}; ++ + static const struct snd_pcm_hardware stm32_sai_pcm_hw = { + .info = SNDRV_PCM_INFO_INTERLEAVED | SNDRV_PCM_INFO_MMAP, + .buffer_bytes_max = 8 * PAGE_SIZE, +@@ -1269,7 +1279,7 @@ static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config = { + }; + + static const struct snd_dmaengine_pcm_config stm32_sai_pcm_config_spdif = { +- .pcm_hardware = &stm32_sai_pcm_hw, ++ .pcm_hardware = &stm32_sai_pcm_hw_spdif, + .prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config, + .process = stm32_sai_pcm_process_spdif, + }; +-- +2.20.1 + diff --git a/queue-5.3/asoc-ti-sdma-pcm-add-back-the-flags-parameter-for-no.patch b/queue-5.3/asoc-ti-sdma-pcm-add-back-the-flags-parameter-for-no.patch new file mode 100644 index 00000000000..ebdbbd0ff92 --- /dev/null +++ b/queue-5.3/asoc-ti-sdma-pcm-add-back-the-flags-parameter-for-no.patch @@ -0,0 +1,39 @@ +From edd6d0de5dcf0bfa31ba4fc241398cf51974a765 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 13:52:07 +0200 +Subject: ASoC: ti: sdma-pcm: Add back the flags parameter for non standard dma + names + +From: Peter Ujfalusi + +[ Upstream commit dd7e8d903e1eef5a9234a2d69663dcbfeab79571 ] + +When non standard names are used it is possible that one of the directions +are not provided, thus the flags needs to be present to tell the core that +we have half duplex setup. + +Fixes: 642aafea8889 ("ASoC: ti: remove compat dma probing") +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20191028115207.5142-1-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/sdma-pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/ti/sdma-pcm.c b/sound/soc/ti/sdma-pcm.c +index a236350beb102..2b0bc234e1b69 100644 +--- a/sound/soc/ti/sdma-pcm.c ++++ b/sound/soc/ti/sdma-pcm.c +@@ -62,7 +62,7 @@ int sdma_pcm_platform_register(struct device *dev, + config->chan_names[0] = txdmachan; + config->chan_names[1] = rxdmachan; + +- return devm_snd_dmaengine_pcm_register(dev, config, 0); ++ return devm_snd_dmaengine_pcm_register(dev, config, flags); + } + EXPORT_SYMBOL_GPL(sdma_pcm_platform_register); + +-- +2.20.1 + diff --git a/queue-5.3/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch b/queue-5.3/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch new file mode 100644 index 00000000000..cfdf0daf6f3 --- /dev/null +++ b/queue-5.3/block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch @@ -0,0 +1,35 @@ +From c7b4e2e0f336f135f51c83ee9a67f9f8d0c2476d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 10:48:47 +0300 +Subject: block: drbd: remove a stray unlock in __drbd_send_protocol() + +From: Dan Carpenter + +[ Upstream commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 ] + +There are two callers of this function and they both unlock the mutex so +this ends up being a double unlock. + +Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf") +Signed-off-by: Dan Carpenter +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_main.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c +index 5b248763a6724..a18155cdce416 100644 +--- a/drivers/block/drbd/drbd_main.c ++++ b/drivers/block/drbd/drbd_main.c +@@ -786,7 +786,6 @@ int __drbd_send_protocol(struct drbd_connection *connection, enum drbd_packet cm + + if (nc->tentative && connection->agreed_pro_version < 92) { + rcu_read_unlock(); +- mutex_unlock(&sock->mutex); + drbd_err(connection, "--dry-run is not supported by peer"); + return -EOPNOTSUPP; + } +-- +2.20.1 + diff --git a/queue-5.3/bpf-allow-narrow-loads-of-bpf_sysctl-fields-with-off.patch b/queue-5.3/bpf-allow-narrow-loads-of-bpf_sysctl-fields-with-off.patch new file mode 100644 index 00000000000..adab2e5bd33 --- /dev/null +++ b/queue-5.3/bpf-allow-narrow-loads-of-bpf_sysctl-fields-with-off.patch @@ -0,0 +1,95 @@ +From 331ea66dc2ef884df1de4ad2983a43425ee661e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 13:29:02 +0100 +Subject: bpf: Allow narrow loads of bpf_sysctl fields with offset > 0 + +From: Ilya Leoshkevich + +[ Upstream commit 7541c87c9b7a7e07c84481f37f2c19063b44469b ] + +"ctx:file_pos sysctl:read read ok narrow" works on s390 by accident: it +reads the wrong byte, which happens to have the expected value of 0. +Improve the test by seeking to the 4th byte and expecting 4 instead of +0. + +This makes the latent problem apparent: the test attempts to read the +first byte of bpf_sysctl.file_pos, assuming this is the least-significant +byte, which is not the case on big-endian machines: a non-zero offset is +needed. + +The point of the test is to verify narrow loads, so we cannot cheat our +way out by simply using BPF_W. The existence of the test means that such +loads have to be supported, most likely because llvm can generate them. +Fix the test by adding a big-endian variant, which uses an offset to +access the least-significant byte of bpf_sysctl.file_pos. + +This reveals the final problem: verifier rejects accesses to bpf_sysctl +fields with offset > 0. Such accesses are already allowed for a wide +range of structs: __sk_buff, bpf_sock_addr and sk_msg_md to name a few. +Extend this support to bpf_sysctl by using bpf_ctx_range instead of +offsetof when matching field offsets. + +Fixes: 7b146cebe30c ("bpf: Sysctl hook") +Fixes: e1550bfe0de4 ("bpf: Add file_pos field to bpf_sysctl ctx") +Fixes: 9a1027e52535 ("selftests/bpf: Test file_pos field in bpf_sysctl ctx") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Alexei Starovoitov +Acked-by: Andrey Ignatov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20191028122902.9763-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/cgroup.c | 4 ++-- + tools/testing/selftests/bpf/test_sysctl.c | 8 +++++++- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c +index 0a00eaca6fae6..9ad7cd3267f52 100644 +--- a/kernel/bpf/cgroup.c ++++ b/kernel/bpf/cgroup.c +@@ -1302,12 +1302,12 @@ static bool sysctl_is_valid_access(int off, int size, enum bpf_access_type type, + return false; + + switch (off) { +- case offsetof(struct bpf_sysctl, write): ++ case bpf_ctx_range(struct bpf_sysctl, write): + if (type != BPF_READ) + return false; + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); +- case offsetof(struct bpf_sysctl, file_pos): ++ case bpf_ctx_range(struct bpf_sysctl, file_pos): + if (type == BPF_READ) { + bpf_ctx_record_field_size(info, size_default); + return bpf_ctx_narrow_access_ok(off, size, size_default); +diff --git a/tools/testing/selftests/bpf/test_sysctl.c b/tools/testing/selftests/bpf/test_sysctl.c +index a3bebd7c68ddc..c938f1767ca72 100644 +--- a/tools/testing/selftests/bpf/test_sysctl.c ++++ b/tools/testing/selftests/bpf/test_sysctl.c +@@ -158,9 +158,14 @@ static struct sysctl_test tests[] = { + .descr = "ctx:file_pos sysctl:read read ok narrow", + .insns = { + /* If (file_pos == X) */ ++#if __BYTE_ORDER == __LITTLE_ENDIAN + BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1, + offsetof(struct bpf_sysctl, file_pos)), +- BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0, 2), ++#else ++ BPF_LDX_MEM(BPF_B, BPF_REG_7, BPF_REG_1, ++ offsetof(struct bpf_sysctl, file_pos) + 3), ++#endif ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 4, 2), + + /* return ALLOW; */ + BPF_MOV64_IMM(BPF_REG_0, 1), +@@ -173,6 +178,7 @@ static struct sysctl_test tests[] = { + .attach_type = BPF_CGROUP_SYSCTL, + .sysctl = "kernel/ostype", + .open_flags = O_RDONLY, ++ .seek = 4, + .result = SUCCESS, + }, + { +-- +2.20.1 + diff --git a/queue-5.3/bpf-change-size-to-u64-for-bpf_map_-area_alloc-charg.patch b/queue-5.3/bpf-change-size-to-u64-for-bpf_map_-area_alloc-charg.patch new file mode 100644 index 00000000000..f99bc4e9ac8 --- /dev/null +++ b/queue-5.3/bpf-change-size-to-u64-for-bpf_map_-area_alloc-charg.patch @@ -0,0 +1,91 @@ +From 41b2e881ee05eb3f8f6797f46fdc07d8ad03b1ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 16:43:07 +0100 +Subject: bpf: Change size to u64 for bpf_map_{area_alloc, charge_init}() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit ff1c08e1f74b6864854c39be48aa799a6a2e4d2b ] + +The functions bpf_map_area_alloc() and bpf_map_charge_init() prior +this commit passed the size parameter as size_t. In this commit this +is changed to u64. + +All users of these functions avoid size_t overflows on 32-bit systems, +by explicitly using u64 when calculating the allocation size and +memory charge cost. However, since the result was narrowed by the +size_t when passing size and cost to the functions, the overflow +handling was in vain. + +Instead of changing all call sites to size_t and handle overflow at +the call site, the parameter is changed to u64 and checked in the +functions above. + +Fixes: d407bd25a204 ("bpf: don't trigger OOM killer under pressure with map alloc") +Fixes: c85d69135a91 ("bpf: move memory size checks to bpf_map_charge_init()") +Signed-off-by: Björn Töpel +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Kicinski +Link: https://lore.kernel.org/bpf/20191029154307.23053-1-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + include/linux/bpf.h | 4 ++-- + kernel/bpf/syscall.c | 7 +++++-- + 2 files changed, 7 insertions(+), 4 deletions(-) + +diff --git a/include/linux/bpf.h b/include/linux/bpf.h +index 18f4cc2c6acd4..5d177c0c7fe37 100644 +--- a/include/linux/bpf.h ++++ b/include/linux/bpf.h +@@ -651,11 +651,11 @@ void bpf_map_put_with_uref(struct bpf_map *map); + void bpf_map_put(struct bpf_map *map); + int bpf_map_charge_memlock(struct bpf_map *map, u32 pages); + void bpf_map_uncharge_memlock(struct bpf_map *map, u32 pages); +-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size); ++int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size); + void bpf_map_charge_finish(struct bpf_map_memory *mem); + void bpf_map_charge_move(struct bpf_map_memory *dst, + struct bpf_map_memory *src); +-void *bpf_map_area_alloc(size_t size, int numa_node); ++void *bpf_map_area_alloc(u64 size, int numa_node); + void bpf_map_area_free(void *base); + void bpf_map_init_from_attr(struct bpf_map *map, union bpf_attr *attr); + +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index aac966b32c42e..ee3087462bc97 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -126,7 +126,7 @@ static struct bpf_map *find_and_alloc_map(union bpf_attr *attr) + return map; + } + +-void *bpf_map_area_alloc(size_t size, int numa_node) ++void *bpf_map_area_alloc(u64 size, int numa_node) + { + /* We really just want to fail instead of triggering OOM killer + * under memory pressure, therefore we set __GFP_NORETRY to kmalloc, +@@ -141,6 +141,9 @@ void *bpf_map_area_alloc(size_t size, int numa_node) + const gfp_t flags = __GFP_NOWARN | __GFP_ZERO; + void *area; + ++ if (size >= SIZE_MAX) ++ return NULL; ++ + if (size <= (PAGE_SIZE << PAGE_ALLOC_COSTLY_ORDER)) { + area = kmalloc_node(size, GFP_USER | __GFP_NORETRY | flags, + numa_node); +@@ -197,7 +200,7 @@ static void bpf_uncharge_memlock(struct user_struct *user, u32 pages) + atomic_long_sub(pages, &user->locked_vm); + } + +-int bpf_map_charge_init(struct bpf_map_memory *mem, size_t size) ++int bpf_map_charge_init(struct bpf_map_memory *mem, u64 size) + { + u32 pages = round_up(size, PAGE_SIZE) >> PAGE_SHIFT; + struct user_struct *user; +-- +2.20.1 + diff --git a/queue-5.3/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch b/queue-5.3/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch new file mode 100644 index 00000000000..a2ca4ffd1f9 --- /dev/null +++ b/queue-5.3/bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch @@ -0,0 +1,66 @@ +From 9e426331ecc115bf0e84b92e1c98679f59a20238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2019 20:54:28 +0100 +Subject: bridge: ebtables: don't crash when using dnat target in output chains +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Florian Westphal + +[ Upstream commit b23c0742c2ce7e33ed79d10e451f70fdb5ca85d1 ] + +xt_in() returns NULL in the output hook, skip the pkt_type change for +that case, redirection only makes sense in broute/prerouting hooks. + +Reported-by: Tom Yan +Cc: Linus Lüssing +Fixes: cf3cb246e277d ("bridge: ebtables: fix reception of frames DNAT-ed to bridge device/port") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebt_dnat.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c +index ed91ea31978af..12a4f4d936810 100644 +--- a/net/bridge/netfilter/ebt_dnat.c ++++ b/net/bridge/netfilter/ebt_dnat.c +@@ -20,7 +20,6 @@ static unsigned int + ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_nat_info *info = par->targinfo; +- struct net_device *dev; + + if (skb_ensure_writable(skb, ETH_ALEN)) + return EBT_DROP; +@@ -33,10 +32,22 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + else + skb->pkt_type = PACKET_MULTICAST; + } else { +- if (xt_hooknum(par) != NF_BR_BROUTING) +- dev = br_port_get_rcu(xt_in(par))->br->dev; +- else ++ const struct net_device *dev; ++ ++ switch (xt_hooknum(par)) { ++ case NF_BR_BROUTING: + dev = xt_in(par); ++ break; ++ case NF_BR_PRE_ROUTING: ++ dev = br_port_get_rcu(xt_in(par))->br->dev; ++ break; ++ default: ++ dev = NULL; ++ break; ++ } ++ ++ if (!dev) /* NF_BR_LOCAL_OUT */ ++ return info->target; + + if (ether_addr_equal(info->mac, dev->dev_addr)) + skb->pkt_type = PACKET_HOST; +-- +2.20.1 + diff --git a/queue-5.3/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch b/queue-5.3/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch new file mode 100644 index 00000000000..2af762f6874 --- /dev/null +++ b/queue-5.3/can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch @@ -0,0 +1,79 @@ +From 4a3b70f586e6dcf1f799e04746c1a88b92aaace5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 21:01:20 +0000 +Subject: can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on + open + +From: Jeroen Hofstee + +[ Upstream commit 23c5a9488f076bab336177cd1d1a366bd8ddf087 ] + +When the CAN interface is closed it the hardwre is put in power down +mode, but does not reset the error counters / state. Reset the D_CAN on +open, so the reported state and the actual state match. + +According to [1], the C_CAN module doesn't have the software reset. + +[1] http://www.bosch-semiconductors.com/media/ip_modules/pdf_2/c_can_fd8/users_manual_c_can_fd8_r210_1.pdf + +Signed-off-by: Jeroen Hofstee +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/c_can/c_can.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index 9b61bfbea6cd1..24c6015f6c92b 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -52,6 +52,7 @@ + #define CONTROL_EX_PDR BIT(8) + + /* control register */ ++#define CONTROL_SWR BIT(15) + #define CONTROL_TEST BIT(7) + #define CONTROL_CCE BIT(6) + #define CONTROL_DISABLE_AR BIT(5) +@@ -572,6 +573,26 @@ static void c_can_configure_msg_objects(struct net_device *dev) + IF_MCONT_RCV_EOB); + } + ++static int c_can_software_reset(struct net_device *dev) ++{ ++ struct c_can_priv *priv = netdev_priv(dev); ++ int retry = 0; ++ ++ if (priv->type != BOSCH_D_CAN) ++ return 0; ++ ++ priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_SWR | CONTROL_INIT); ++ while (priv->read_reg(priv, C_CAN_CTRL_REG) & CONTROL_SWR) { ++ msleep(20); ++ if (retry++ > 100) { ++ netdev_err(dev, "CCTRL: software reset failed\n"); ++ return -EIO; ++ } ++ } ++ ++ return 0; ++} ++ + /* + * Configure C_CAN chip: + * - enable/disable auto-retransmission +@@ -581,6 +602,11 @@ static void c_can_configure_msg_objects(struct net_device *dev) + static int c_can_chip_config(struct net_device *dev) + { + struct c_can_priv *priv = netdev_priv(dev); ++ int err; ++ ++ err = c_can_software_reset(dev); ++ if (err) ++ return err; + + /* enable automatic retransmission */ + priv->write_reg(priv, C_CAN_CTRL_REG, CONTROL_ENABLE_AR); +-- +2.20.1 + diff --git a/queue-5.3/can-flexcan-increase-error-counters-if-skb-enqueuein.patch b/queue-5.3/can-flexcan-increase-error-counters-if-skb-enqueuein.patch new file mode 100644 index 00000000000..3e77317f4d3 --- /dev/null +++ b/queue-5.3/can-flexcan-increase-error-counters-if-skb-enqueuein.patch @@ -0,0 +1,72 @@ +From a7ed4b386c51d5dbe54c41dd46506fb3b5fc5b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jul 2019 20:53:08 +0200 +Subject: can: flexcan: increase error counters if skb enqueueing via + can_rx_offload_queue_sorted() fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marc Kleine-Budde + +[ Upstream commit 758124335a9dd649ab820bfb5b328170919ee7dc ] + +The call to can_rx_offload_queue_sorted() may fail and return an error +(in the current implementation due to resource shortage). The passed skb +is consumed. + +This patch adds incrementing of the appropriate error counters to let +the device statistics reflect that there's a problem. + +Reported-by: Martin Hundebøll +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 56fa98d7aa90c..a4f0fa94d136a 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -658,6 +658,7 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr) + struct can_frame *cf; + bool rx_errors = false, tx_errors = false; + u32 timestamp; ++ int err; + + timestamp = priv->read(®s->timer) << 16; + +@@ -706,7 +707,9 @@ static void flexcan_irq_bus_err(struct net_device *dev, u32 reg_esr) + if (tx_errors) + dev->stats.tx_errors++; + +- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); ++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); ++ if (err) ++ dev->stats.rx_fifo_errors++; + } + + static void flexcan_irq_state(struct net_device *dev, u32 reg_esr) +@@ -719,6 +722,7 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr) + int flt; + struct can_berr_counter bec; + u32 timestamp; ++ int err; + + timestamp = priv->read(®s->timer) << 16; + +@@ -750,7 +754,9 @@ static void flexcan_irq_state(struct net_device *dev, u32 reg_esr) + if (unlikely(new_state == CAN_STATE_BUS_OFF)) + can_bus_off(dev); + +- can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); ++ err = can_rx_offload_queue_sorted(&priv->offload, skb, timestamp); ++ if (err) ++ dev->stats.rx_fifo_errors++; + } + + static inline struct flexcan_priv *rx_offload_to_priv(struct can_rx_offload *offload) +-- +2.20.1 + diff --git a/queue-5.3/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch b/queue-5.3/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch new file mode 100644 index 00000000000..6bdd4a8384a --- /dev/null +++ b/queue-5.3/can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch @@ -0,0 +1,50 @@ +From bdc62cb3fa0ed10d568b412f1cd323cf1930fc54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2019 15:38:19 +0200 +Subject: can: mcp251x: mcp251x_restart_work_handler(): Fix potential + force_quit race condition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timo Schlüßler + +[ Upstream commit 27a0e54bae09d2dd023a01254db506d61cc50ba1 ] + +In mcp251x_restart_work_handler() the variable to stop the interrupt +handler (priv->force_quit) is reset after the chip is restarted and thus +a interrupt might occur. + +This patch fixes the potential race condition by resetting force_quit +before enabling interrupts. + +Signed-off-by: Timo Schlüßler +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c +index 5d6f8977df3f8..c0ee0fa909702 100644 +--- a/drivers/net/can/spi/mcp251x.c ++++ b/drivers/net/can/spi/mcp251x.c +@@ -759,6 +759,7 @@ static void mcp251x_restart_work_handler(struct work_struct *ws) + if (priv->after_suspend) { + mcp251x_hw_reset(spi); + mcp251x_setup(net, spi); ++ priv->force_quit = 0; + if (priv->after_suspend & AFTER_SUSPEND_RESTART) { + mcp251x_set_normal_mode(spi); + } else if (priv->after_suspend & AFTER_SUSPEND_UP) { +@@ -770,7 +771,6 @@ static void mcp251x_restart_work_handler(struct work_struct *ws) + mcp251x_hw_sleep(spi); + } + priv->after_suspend = 0; +- priv->force_quit = 0; + } + + if (priv->restart_tx) { +-- +2.20.1 + diff --git a/queue-5.3/can-peak_usb-report-bus-recovery-as-well.patch b/queue-5.3/can-peak_usb-report-bus-recovery-as-well.patch new file mode 100644 index 00000000000..725fd7b4387 --- /dev/null +++ b/queue-5.3/can-peak_usb-report-bus-recovery-as-well.patch @@ -0,0 +1,67 @@ +From 1eadcb53e4299ea38ec7d2d050ea85f197bd987a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Sep 2019 08:58:45 +0000 +Subject: can: peak_usb: report bus recovery as well + +From: Jeroen Hofstee + +[ Upstream commit 128a1b87d3ceb2ba449d5aadb222fe22395adeb0 ] + +While the state changes are reported when the error counters increase +and decrease, there is no event when the bus recovers and the error +counters decrease again. So add those as well. + +Change the state going downward to be ERROR_PASSIVE -> ERROR_WARNING -> +ERROR_ACTIVE instead of directly to ERROR_ACTIVE again. + +Signed-off-by: Jeroen Hofstee +Cc: Stephane Grosjean +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb.c b/drivers/net/can/usb/peak_usb/pcan_usb.c +index 5a66c9f53aae6..d2539c95adb65 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb.c +@@ -436,8 +436,8 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + if ((n & PCAN_USB_ERROR_BUS_LIGHT) == 0) { + /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ new_state = CAN_STATE_ERROR_ACTIVE; ++ break; + } + break; + +@@ -460,9 +460,9 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + } + + if ((n & PCAN_USB_ERROR_BUS_HEAVY) == 0) { +- /* no error (back to active state) */ +- mc->pdev->dev.can.state = CAN_STATE_ERROR_ACTIVE; +- return 0; ++ /* no error (back to warning state) */ ++ new_state = CAN_STATE_ERROR_WARNING; ++ break; + } + break; + +@@ -501,6 +501,11 @@ static int pcan_usb_decode_error(struct pcan_usb_msg_context *mc, u8 n, + mc->pdev->dev.can.can_stats.error_warning++; + break; + ++ case CAN_STATE_ERROR_ACTIVE: ++ cf->can_id |= CAN_ERR_CRTL; ++ cf->data[1] = CAN_ERR_CRTL_ACTIVE; ++ break; ++ + default: + /* CAN_STATE_MAX (trick to handle other errors) */ + cf->can_id |= CAN_ERR_CRTL; +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch b/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch new file mode 100644 index 00000000000..6d6a8dff316 --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch @@ -0,0 +1,55 @@ +From 4d3115622e80135603714b3679aa018025d2465f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 18:45:38 +0000 +Subject: can: rx-offload: can_rx_offload_irq_offload_fifo(): continue on error + +From: Marc Kleine-Budde + +[ Upstream commit 1f7f504dcd9d1262437bdcf4fa071e41dec1af03 ] + +In case of a resource shortage, i.e. the rx_offload queue will overflow +or a skb fails to be allocated (due to OOM), +can_rx_offload_offload_one() will call mailbox_read() to discard the +mailbox and return an ERR_PTR. + +If the hardware FIFO is empty can_rx_offload_offload_one() will return +NULL. + +In case a CAN frame was read from the hardware, +can_rx_offload_offload_one() returns the skb containing it. + +Without this patch can_rx_offload_irq_offload_fifo() bails out if no skb +returned, regardless of the reason. + +Similar to can_rx_offload_irq_offload_timestamp() in case of a resource +shortage the whole FIFO should be discarded, to avoid an IRQ storm and +give the system some time to recover. However if the FIFO is empty the +loop can be left. + +With this patch the loop is left in case of empty FIFO, but not on +errors. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 2ea8676579a9c..84cae167e42f6 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -248,7 +248,9 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + + while (1) { + skb = can_rx_offload_offload_one(offload, 0); +- if (IS_ERR_OR_NULL(skb)) ++ if (IS_ERR(skb)) ++ continue; ++ if (!skb) + break; + + skb_queue_tail(&offload->skb_queue, skb); +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch b/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch new file mode 100644 index 00000000000..c12b22339c3 --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch @@ -0,0 +1,46 @@ +From f0f27a98990406f1f1fe6cf494f227f6faea4b95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 18:45:38 +0000 +Subject: can: rx-offload: can_rx_offload_irq_offload_timestamp(): continue on + error + +From: Jeroen Hofstee + +[ Upstream commit c2a9f74c9d18acfdcabd3361adc7eac82c537a66 ] + +In case of a resource shortage, i.e. the rx_offload queue will overflow +or a skb fails to be allocated (due to OOM), +can_rx_offload_offload_one() will call mailbox_read() to discard the +mailbox and return an ERR_PTR. + +However can_rx_offload_irq_offload_timestamp() bails out in the error +case. In case of a resource shortage all mailboxes should be discarded, +to avoid an IRQ storm and give the system some time to recover. + +Since can_rx_offload_irq_offload_timestamp() is typically called from a +while loop, all message will eventually be discarded. So let's continue +on error instead to discard them directly. + +Signed-off-by: Jeroen Hofstee +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 3f5e040f0c712..2ea8676579a9c 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -216,7 +216,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen + + skb = can_rx_offload_offload_one(offload, i); + if (IS_ERR_OR_NULL(skb)) +- break; ++ continue; + + __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); + } +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch new file mode 100644 index 00000000000..0fef0141f48 --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch @@ -0,0 +1,43 @@ +From edea258ced89e3d5912c3585cd298f24aaddf730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 16:03:18 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): do not increase the + skb_queue beyond skb_queue_len_max + +From: Marc Kleine-Budde + +[ Upstream commit a2dc3f5e1022a5ede8af9ab89a144f1e69db8636 ] + +The skb_queue is a linked list, holding the skb to be processed in the +next NAPI call. + +Without this patch, the queue length in can_rx_offload_offload_one() is +limited to skb_queue_len_max + 1. As the skb_queue is a linked list, no +array or other resources are accessed out-of-bound, however this +behaviour is counterintuitive. + +This patch limits the rx-offload skb_queue length to skb_queue_len_max. + +Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index d1c8634099450..bdc27481b57f9 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -115,7 +115,7 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload + int ret; + + /* If queue is full or skb not available, read to discard mailbox */ +- if (likely(skb_queue_len(&offload->skb_queue) <= ++ if (likely(skb_queue_len(&offload->skb_queue) < + offload->skb_queue_len_max)) + skb = alloc_can_skb(offload->dev, &cf); + +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_offload_one-increment-.patch b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-increment-.patch new file mode 100644 index 00000000000..df85fcb1fd2 --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-increment-.patch @@ -0,0 +1,40 @@ +From c82f748709d467ec7898ae30220ebd8b97bdd529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:15:07 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): increment + rx_fifo_errors on queue overflow or OOM + +From: Marc Kleine-Budde + +[ Upstream commit 4e9016bee3bf0c24963097edace034ff205b565c ] + +If the rx-offload skb_queue is full or the skb allocation fails (due to OOM), +the mailbox contents is discarded. + +This patch adds the incrementing of the rx_fifo_errors statistics counter. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index bdc27481b57f9..e224530a06300 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -125,8 +125,10 @@ static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload + + ret = offload->mailbox_read(offload, &cf_overflow, + ×tamp, n); +- if (ret) ++ if (ret) { + offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ } + + return NULL; + } +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch new file mode 100644 index 00000000000..9f641dae80d --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch @@ -0,0 +1,166 @@ +From 0edfe975e13425fe6dc53814f5cc10615d34a59b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 21:00:32 +0200 +Subject: can: rx-offload: can_rx_offload_offload_one(): use ERR_PTR() to + propagate error value in case of errors + +From: Marc Kleine-Budde + +[ Upstream commit d763ab3044f0bf50bd0e6179f6b2cf1c125d1d94 ] + +Before this patch can_rx_offload_offload_one() returns a pointer to a +skb containing the read CAN frame or a NULL pointer. + +However the meaning of the NULL pointer is ambiguous, it can either mean +the requested mailbox is empty or there was an error. + +This patch fixes this situation by returning: +- pointer to skb on success +- NULL pointer if mailbox is empty +- ERR_PTR() in case of an error + +All users of can_rx_offload_offload_one() have been adopted, no +functional change intended. + +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 86 ++++++++++++++++++++++++++++++------ + 1 file changed, 73 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index e224530a06300..3f5e040f0c712 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -107,39 +107,95 @@ static int can_rx_offload_compare(struct sk_buff *a, struct sk_buff *b) + return cb_b->timestamp - cb_a->timestamp; + } + +-static struct sk_buff *can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) ++/** ++ * can_rx_offload_offload_one() - Read one CAN frame from HW ++ * @offload: pointer to rx_offload context ++ * @n: number of mailbox to read ++ * ++ * The task of this function is to read a CAN frame from mailbox @n ++ * from the device and return the mailbox's content as a struct ++ * sk_buff. ++ * ++ * If the struct can_rx_offload::skb_queue exceeds the maximal queue ++ * length (struct can_rx_offload::skb_queue_len_max) or no skb can be ++ * allocated, the mailbox contents is discarded by reading it into an ++ * overflow buffer. This way the mailbox is marked as free by the ++ * driver. ++ * ++ * Return: A pointer to skb containing the CAN frame on success. ++ * ++ * NULL if the mailbox @n is empty. ++ * ++ * ERR_PTR() in case of an error ++ */ ++static struct sk_buff * ++can_rx_offload_offload_one(struct can_rx_offload *offload, unsigned int n) + { +- struct sk_buff *skb = NULL; ++ struct sk_buff *skb = NULL, *skb_error = NULL; + struct can_rx_offload_cb *cb; + struct can_frame *cf; + int ret; + +- /* If queue is full or skb not available, read to discard mailbox */ + if (likely(skb_queue_len(&offload->skb_queue) < +- offload->skb_queue_len_max)) ++ offload->skb_queue_len_max)) { + skb = alloc_can_skb(offload->dev, &cf); ++ if (unlikely(!skb)) ++ skb_error = ERR_PTR(-ENOMEM); /* skb alloc failed */ ++ } else { ++ skb_error = ERR_PTR(-ENOBUFS); /* skb_queue is full */ ++ } + +- if (!skb) { ++ /* If queue is full or skb not available, drop by reading into ++ * overflow buffer. ++ */ ++ if (unlikely(skb_error)) { + struct can_frame cf_overflow; + u32 timestamp; + + ret = offload->mailbox_read(offload, &cf_overflow, + ×tamp, n); +- if (ret) { +- offload->dev->stats.rx_dropped++; +- offload->dev->stats.rx_fifo_errors++; +- } + +- return NULL; ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) ++ return NULL; ++ ++ /* Mailbox has been read and we're dropping it or ++ * there was a problem reading the mailbox. ++ * ++ * Increment error counters in any case. ++ */ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ /* There was a problem reading the mailbox, propagate ++ * error value. ++ */ ++ if (unlikely(ret < 0)) ++ return ERR_PTR(ret); ++ ++ return skb_error; + } + + cb = can_rx_offload_get_cb(skb); + ret = offload->mailbox_read(offload, cf, &cb->timestamp, n); +- if (!ret) { ++ ++ /* Mailbox was empty. */ ++ if (unlikely(!ret)) { + kfree_skb(skb); + return NULL; + } + ++ /* There was a problem reading the mailbox, propagate error value. */ ++ if (unlikely(ret < 0)) { ++ kfree_skb(skb); ++ ++ offload->dev->stats.rx_dropped++; ++ offload->dev->stats.rx_fifo_errors++; ++ ++ return ERR_PTR(ret); ++ } ++ ++ /* Mailbox was read. */ + return skb; + } + +@@ -159,7 +215,7 @@ int can_rx_offload_irq_offload_timestamp(struct can_rx_offload *offload, u64 pen + continue; + + skb = can_rx_offload_offload_one(offload, i); +- if (!skb) ++ if (IS_ERR_OR_NULL(skb)) + break; + + __skb_queue_add_sort(&skb_queue, skb, can_rx_offload_compare); +@@ -190,7 +246,11 @@ int can_rx_offload_irq_offload_fifo(struct can_rx_offload *offload) + struct sk_buff *skb; + int received = 0; + +- while ((skb = can_rx_offload_offload_one(offload, 0))) { ++ while (1) { ++ skb = can_rx_offload_offload_one(offload, 0); ++ if (IS_ERR_OR_NULL(skb)) ++ break; ++ + skb_queue_tail(&offload->skb_queue, skb); + received++; + } +-- +2.20.1 + diff --git a/queue-5.3/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch b/queue-5.3/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch new file mode 100644 index 00000000000..4558ba8fe10 --- /dev/null +++ b/queue-5.3/can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch @@ -0,0 +1,51 @@ +From ff1b45a76b42e697278769f877872d97552662d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:48:48 +0200 +Subject: can: rx-offload: can_rx_offload_queue_tail(): fix error handling, + avoid skb mem leak + +From: Marc Kleine-Budde + +[ Upstream commit 6caf8a6d6586d44fd72f4aa1021d14aa82affafb ] + +If the rx-offload skb_queue is full can_rx_offload_queue_tail() will not +queue the skb and return with an error. + +This patch frees the skb in case of a full queue, which brings +can_rx_offload_queue_tail() in line with the +can_rx_offload_queue_sorted() function, which has been adjusted in the +previous patch. + +The return value is adjusted to -ENOBUFS to better reflect the actual +problem. + +The device stats handling is left to the caller. + +Fixes: d254586c3453 ("can: rx-offload: Add support for HW fifo based irq offloading") +Reported-by: Kurt Van Dijck +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rx-offload.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/rx-offload.c b/drivers/net/can/rx-offload.c +index 663697439d1c7..d1c8634099450 100644 +--- a/drivers/net/can/rx-offload.c ++++ b/drivers/net/can/rx-offload.c +@@ -252,8 +252,10 @@ int can_rx_offload_queue_tail(struct can_rx_offload *offload, + struct sk_buff *skb) + { + if (skb_queue_len(&offload->skb_queue) > +- offload->skb_queue_len_max) +- return -ENOMEM; ++ offload->skb_queue_len_max) { ++ kfree_skb(skb); ++ return -ENOBUFS; ++ } + + skb_queue_tail(&offload->skb_queue, skb); + can_rx_offload_schedule(offload); +-- +2.20.1 + diff --git a/queue-5.3/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch b/queue-5.3/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch new file mode 100644 index 00000000000..1b9794808bc --- /dev/null +++ b/queue-5.3/ceph-return-einval-if-given-fsc-mount-option-on-kern.patch @@ -0,0 +1,65 @@ +From 9d2967f848025d777acf0a34ed876154a8f22213 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 09:39:32 -0500 +Subject: ceph: return -EINVAL if given fsc mount option on kernel w/o support + +From: Jeff Layton + +[ Upstream commit ff29fde84d1fc82f233c7da0daa3574a3942bec7 ] + +If someone requests fscache on the mount, and the kernel doesn't +support it, it should fail the mount. + +[ Drop ceph prefix -- it's provided by pr_err. ] + +Signed-off-by: Jeff Layton +Reviewed-by: Ilya Dryomov +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/super.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index ab4868c7308ec..b565c55ed0648 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -255,6 +255,7 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + break; + case Opt_fscache_uniq: ++#ifdef CONFIG_CEPH_FSCACHE + kfree(fsopt->fscache_uniq); + fsopt->fscache_uniq = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, +@@ -263,7 +264,10 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + break; +- /* misc */ ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_wsize: + if (intval < (int)PAGE_SIZE || intval > CEPH_MAX_WRITE_SIZE) + return -EINVAL; +@@ -340,10 +344,15 @@ static int parse_fsopt_token(char *c, void *private) + fsopt->flags &= ~CEPH_MOUNT_OPT_INO32; + break; + case Opt_fscache: ++#ifdef CONFIG_CEPH_FSCACHE + fsopt->flags |= CEPH_MOUNT_OPT_FSCACHE; + kfree(fsopt->fscache_uniq); + fsopt->fscache_uniq = NULL; + break; ++#else ++ pr_err("fscache support is disabled\n"); ++ return -EINVAL; ++#endif + case Opt_nofscache: + fsopt->flags &= ~CEPH_MOUNT_OPT_FSCACHE; + kfree(fsopt->fscache_uniq); +-- +2.20.1 + diff --git a/queue-5.3/clk-at91-avoid-sleeping-early.patch b/queue-5.3/clk-at91-avoid-sleeping-early.patch new file mode 100644 index 00000000000..c1e6c383651 --- /dev/null +++ b/queue-5.3/clk-at91-avoid-sleeping-early.patch @@ -0,0 +1,104 @@ +From 3f15ee676b5610a11256b19fa4a6b2ef68fd4bcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Sep 2019 17:39:06 +0200 +Subject: clk: at91: avoid sleeping early +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +[ Upstream commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 ] + +It is not allowed to sleep to early in the boot process and this may lead +to kernel issues if the bootloader didn't prepare the slow clock and main +clock. + +This results in the following error and dump stack on the AriettaG25: + bad: scheduling from the idle thread! + +Ensure it is possible to sleep, else simply have a delay. + +Reported-by: Uwe Kleine-König +Signed-off-by: Alexandre Belloni +Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com +Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver") +Tested-by: Uwe Kleine-König +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-main.c | 5 ++++- + drivers/clk/at91/sckc.c | 20 ++++++++++++++++---- + 2 files changed, 20 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c +index 311cea0c3ae2b..54b2b2dd2bb57 100644 +--- a/drivers/clk/at91/clk-main.c ++++ b/drivers/clk/at91/clk-main.c +@@ -297,7 +297,10 @@ static int clk_main_probe_frequency(struct regmap *regmap) + regmap_read(regmap, AT91_CKGR_MCFR, &mcfr); + if (mcfr & AT91_PMC_MAINRDY) + return 0; +- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(MAINF_LOOP_MIN_WAIT); ++ else ++ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT); + } while (time_before(prep_time, timeout)); + + return -ETIMEDOUT; +diff --git a/drivers/clk/at91/sckc.c b/drivers/clk/at91/sckc.c +index 9bfe9a28294a7..fac0ca56d42d9 100644 +--- a/drivers/clk/at91/sckc.c ++++ b/drivers/clk/at91/sckc.c +@@ -76,7 +76,10 @@ static int clk_slow_osc_prepare(struct clk_hw *hw) + + writel(tmp | osc->bits->cr_osc32en, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -187,7 +190,10 @@ static int clk_slow_rc_osc_prepare(struct clk_hw *hw) + + writel(readl(sckcr) | osc->bits->cr_rcen, sckcr); + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + + return 0; + } +@@ -288,7 +294,10 @@ static int clk_sam9x5_slow_set_parent(struct clk_hw *hw, u8 index) + + writel(tmp, sckcr); + +- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(SLOWCK_SW_TIME_USEC); ++ else ++ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1); + + return 0; + } +@@ -533,7 +542,10 @@ static int clk_sama5d4_slow_osc_prepare(struct clk_hw *hw) + return 0; + } + +- usleep_range(osc->startup_usec, osc->startup_usec + 1); ++ if (system_state < SYSTEM_RUNNING) ++ udelay(osc->startup_usec); ++ else ++ usleep_range(osc->startup_usec, osc->startup_usec + 1); + osc->prepared = true; + + return 0; +-- +2.20.1 + diff --git a/queue-5.3/clk-at91-sam9x60-fix-programmable-clock.patch b/queue-5.3/clk-at91-sam9x60-fix-programmable-clock.patch new file mode 100644 index 00000000000..eeaad490a0a --- /dev/null +++ b/queue-5.3/clk-at91-sam9x60-fix-programmable-clock.patch @@ -0,0 +1,40 @@ +From 4a6167374b8748547e44d994990d4c5825fa912c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Sep 2019 10:39:09 +0000 +Subject: clk: at91: sam9x60: fix programmable clock + +From: Eugen Hristev + +[ Upstream commit 2200ab6a7403f4fcd052c55ca328fc942f9392b6 ] + +The prescaler mask for sam9x60 must be 0xff (8 bits). +Being set to 0, means that we cannot set any prescaler, thus the +programmable clocks do not work (except the case with prescaler 0) +Set the mask accordingly in layout struct. + +Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver") +Signed-off-by: Eugen Hristev +Link: https://lkml.kernel.org/r/1569321191-27606-1-git-send-email-eugen.hristev@microchip.com +Acked-by: Nicolas Ferre +Acked-by: Alexandre Belloni +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/sam9x60.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c +index 9790ddfa5b3cb..86238d5ecb4da 100644 +--- a/drivers/clk/at91/sam9x60.c ++++ b/drivers/clk/at91/sam9x60.c +@@ -43,6 +43,7 @@ static const struct clk_pll_characteristics upll_characteristics = { + }; + + static const struct clk_programmable_layout sam9x60_programmable_layout = { ++ .pres_mask = 0xff, + .pres_shift = 8, + .css_mask = 0x1f, + .have_slck_mck = 0, +-- +2.20.1 + diff --git a/queue-5.3/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch b/queue-5.3/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch new file mode 100644 index 00000000000..8f3a5dd8f8b --- /dev/null +++ b/queue-5.3/clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch @@ -0,0 +1,41 @@ +From a896f30d4be55e1d79bf22097a0338f779d4a940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Sep 2019 17:04:11 +0200 +Subject: clk: meson: gxbb: let sar_adc_clk_div set the parent clock rate + +From: Martin Blumenstingl + +[ Upstream commit 44b09b11b813b8550e6b976ea51593bc23bba8d1 ] + +The meson-saradc driver manually sets the input clock for +sar_adc_clk_sel. Update the GXBB clock driver (which is used on GXBB, +GXL and GXM) so the rate settings on sar_adc_clk_div are propagated up +to sar_adc_clk_sel which will let the common clock framework select the +best matching parent clock if we want that. + +This makes sar_adc_clk_div consistent with the axg-aoclk and g12a-aoclk +drivers, which both also specify CLK_SET_RATE_PARENT. + +Fixes: 33d0fcdfe0e870 ("clk: gxbb: add the SAR ADC clocks and expose them") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/gxbb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index dab16d9b1af8b..9834eb2c1b674 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -866,6 +866,7 @@ static struct clk_regmap gxbb_sar_adc_clk_div = { + .ops = &clk_regmap_divider_ops, + .parent_names = (const char *[]){ "sar_adc_clk_sel" }, + .num_parents = 1, ++ .flags = CLK_SET_RATE_PARENT, + }, + }; + +-- +2.20.1 + diff --git a/queue-5.3/clk-samsung-exynos5420-preserve-pll-configuration-du.patch b/queue-5.3/clk-samsung-exynos5420-preserve-pll-configuration-du.patch new file mode 100644 index 00000000000..57fa4c69137 --- /dev/null +++ b/queue-5.3/clk-samsung-exynos5420-preserve-pll-configuration-du.patch @@ -0,0 +1,51 @@ +From 4dc2085522eb08551f4020245a2e8e6ebde48ff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 11:02:01 +0200 +Subject: clk: samsung: exynos5420: Preserve PLL configuration during + suspend/resume + +From: Marek Szyprowski + +[ Upstream commit e9323b664ce29547d996195e8a6129a351c39108 ] + +Properly save and restore all top PLL related configuration registers +during suspend/resume cycle. So far driver only handled EPLL and RPLL +clocks, all other were reset to default values after suspend/resume cycle. +This caused for example lower G3D (MALI Panfrost) performance after system +resume, even if performance governor has been selected. + +Reported-by: Reported-by: Marian Mihailescu +Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list") +Signed-off-by: Marek Szyprowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos5420.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index dfa862d55246e..31466cd1842f8 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -165,12 +165,18 @@ static const unsigned long exynos5x_clk_regs[] __initconst = { + GATE_BUS_CPU, + GATE_SCLK_CPU, + CLKOUT_CMU_CPU, ++ CPLL_CON0, ++ DPLL_CON0, + EPLL_CON0, + EPLL_CON1, + EPLL_CON2, + RPLL_CON0, + RPLL_CON1, + RPLL_CON2, ++ IPLL_CON0, ++ SPLL_CON0, ++ VPLL_CON0, ++ MPLL_CON0, + SRC_TOP0, + SRC_TOP1, + SRC_TOP2, +-- +2.20.1 + diff --git a/queue-5.3/clk-samsung-exynos542x-move-g3d-subsystem-clocks-to-.patch b/queue-5.3/clk-samsung-exynos542x-move-g3d-subsystem-clocks-to-.patch new file mode 100644 index 00000000000..fc8f3adc3ca --- /dev/null +++ b/queue-5.3/clk-samsung-exynos542x-move-g3d-subsystem-clocks-to-.patch @@ -0,0 +1,93 @@ +From af66b74cc6d04c5432f1ef7a569b3e59c352923f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 09:41:18 +0200 +Subject: clk: samsung: exynos542x: Move G3D subsystem clocks to its sub-CMU + +From: Marek Szyprowski + +[ Upstream commit c9f7567aff31348a3dcf54845f7e389f5df0c0c1 ] + +G3D clocks require special handling of their parent bus clock during power +domain on/off sequences. Those clocks were not initially added to the +sub-CMU handler, because that time there was no open-source driver for the +G3D (MALI Panfrost) hardware module and it was not possible to test it. + +This patch fixes this issue. Parent clock for G3D hardware block is now +properly preserved during G3D power domain on/off sequence. This restores +proper MALI Panfrost performance broken by commit 8686764fc071 +("ARM: dts: exynos: Add G3D power domain to Exynos542x"). + +Reported-by: Marian Mihailescu +Fixes: b06a532bf1fa ("clk: samsung: Add Exynos5 sub-CMU clock driver") +Signed-off-by: Marek Szyprowski +Tested-by: Marian Mihailescu +Acked-by: Krzysztof Kozlowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos5420.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/samsung/clk-exynos5420.c b/drivers/clk/samsung/clk-exynos5420.c +index 7670cc596c742..dfa862d55246e 100644 +--- a/drivers/clk/samsung/clk-exynos5420.c ++++ b/drivers/clk/samsung/clk-exynos5420.c +@@ -1172,8 +1172,6 @@ static const struct samsung_gate_clock exynos5x_gate_clks[] __initconst = { + GATE(CLK_SCLK_ISP_SENSOR2, "sclk_isp_sensor2", "dout_isp_sensor2", + GATE_TOP_SCLK_ISP, 12, CLK_SET_RATE_PARENT, 0), + +- GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0), +- + /* CDREX */ + GATE(CLK_CLKM_PHY0, "clkm_phy0", "dout_sclk_cdrex", + GATE_BUS_CDREX0, 0, 0, 0), +@@ -1248,6 +1246,15 @@ static struct exynos5_subcmu_reg_dump exynos5x_gsc_suspend_regs[] = { + { DIV2_RATIO0, 0, 0x30 }, /* DIV dout_gscl_blk_300 */ + }; + ++static const struct samsung_gate_clock exynos5x_g3d_gate_clks[] __initconst = { ++ GATE(CLK_G3D, "g3d", "mout_user_aclk_g3d", GATE_IP_G3D, 9, 0, 0), ++}; ++ ++static struct exynos5_subcmu_reg_dump exynos5x_g3d_suspend_regs[] = { ++ { GATE_IP_G3D, 0x3ff, 0x3ff }, /* G3D gates */ ++ { SRC_TOP5, 0, BIT(16) }, /* MUX mout_user_aclk_g3d */ ++}; ++ + static const struct samsung_div_clock exynos5x_mfc_div_clks[] __initconst = { + DIV(0, "dout_mfc_blk", "mout_user_aclk333", DIV4_RATIO, 0, 2), + }; +@@ -1320,6 +1327,14 @@ static const struct exynos5_subcmu_info exynos5x_gsc_subcmu = { + .pd_name = "GSC", + }; + ++static const struct exynos5_subcmu_info exynos5x_g3d_subcmu = { ++ .gate_clks = exynos5x_g3d_gate_clks, ++ .nr_gate_clks = ARRAY_SIZE(exynos5x_g3d_gate_clks), ++ .suspend_regs = exynos5x_g3d_suspend_regs, ++ .nr_suspend_regs = ARRAY_SIZE(exynos5x_g3d_suspend_regs), ++ .pd_name = "G3D", ++}; ++ + static const struct exynos5_subcmu_info exynos5x_mfc_subcmu = { + .div_clks = exynos5x_mfc_div_clks, + .nr_div_clks = ARRAY_SIZE(exynos5x_mfc_div_clks), +@@ -1351,6 +1366,7 @@ static const struct exynos5_subcmu_info exynos5800_mau_subcmu = { + static const struct exynos5_subcmu_info *exynos5x_subcmus[] = { + &exynos5x_disp_subcmu, + &exynos5x_gsc_subcmu, ++ &exynos5x_g3d_subcmu, + &exynos5x_mfc_subcmu, + &exynos5x_mscl_subcmu, + }; +@@ -1358,6 +1374,7 @@ static const struct exynos5_subcmu_info *exynos5x_subcmus[] = { + static const struct exynos5_subcmu_info *exynos5800_subcmus[] = { + &exynos5x_disp_subcmu, + &exynos5x_gsc_subcmu, ++ &exynos5x_g3d_subcmu, + &exynos5x_mfc_subcmu, + &exynos5x_mscl_subcmu, + &exynos5800_mau_subcmu, +-- +2.20.1 + diff --git a/queue-5.3/clk-samsung-exynos5433-fix-error-paths.patch b/queue-5.3/clk-samsung-exynos5433-fix-error-paths.patch new file mode 100644 index 00000000000..067adfa31aa --- /dev/null +++ b/queue-5.3/clk-samsung-exynos5433-fix-error-paths.patch @@ -0,0 +1,71 @@ +From d71648b3355643772480e725701af8d3a21f25c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 10:53:09 +0200 +Subject: clk: samsung: exynos5433: Fix error paths + +From: Marek Szyprowski + +[ Upstream commit faac3604d05e8015567124e5ee79edc3f1568a89 ] + +Add checking the value returned by samsung_clk_alloc_reg_dump() and +devm_kcalloc(). While fixing this, also release all gathered clocks. + +Fixes: 523d3de41f02 ("clk: samsung: exynos5433: Add support for runtime PM") +Signed-off-by: Marek Szyprowski +Reviewed-by: Krzysztof Kozlowski +Acked-by: Chanwoo Choi +[s.nawrocki: squashed patch from K. Kozlowski adding missing slab.h header] +Reported-by: kbuild test robot +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-exynos5433.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c +index 7824c2ba3d8e6..4b1aa9382ad28 100644 +--- a/drivers/clk/samsung/clk-exynos5433.c ++++ b/drivers/clk/samsung/clk-exynos5433.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + + #include + +@@ -5584,6 +5585,8 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev) + + data->clk_save = samsung_clk_alloc_reg_dump(info->clk_regs, + info->nr_clk_regs); ++ if (!data->clk_save) ++ return -ENOMEM; + data->nr_clk_save = info->nr_clk_regs; + data->clk_suspend = info->suspend_regs; + data->nr_clk_suspend = info->nr_suspend_regs; +@@ -5592,12 +5595,19 @@ static int __init exynos5433_cmu_probe(struct platform_device *pdev) + if (data->nr_pclks > 0) { + data->pclks = devm_kcalloc(dev, sizeof(struct clk *), + data->nr_pclks, GFP_KERNEL); +- ++ if (!data->pclks) { ++ kfree(data->clk_save); ++ return -ENOMEM; ++ } + for (i = 0; i < data->nr_pclks; i++) { + struct clk *clk = of_clk_get(dev->of_node, i); + +- if (IS_ERR(clk)) ++ if (IS_ERR(clk)) { ++ kfree(data->clk_save); ++ while (--i >= 0) ++ clk_put(data->pclks[i]); + return PTR_ERR(clk); ++ } + data->pclks[i] = clk; + } + } +-- +2.20.1 + diff --git a/queue-5.3/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch b/queue-5.3/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch new file mode 100644 index 00000000000..1d7b05688cc --- /dev/null +++ b/queue-5.3/clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch @@ -0,0 +1,61 @@ +From 3245a9222278994c94cdb8ef6637ba035151c0e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 09:50:54 -0700 +Subject: clk: sunxi: Fix operator precedence in sunxi_divs_clk_setup + +From: Nathan Chancellor + +[ Upstream commit afdc74ed2d57e86c10b1d6831339770a802bab9a ] + +r375326 in Clang exposes an issue with operator precedence in +sunxi_div_clk_setup: + +drivers/clk/sunxi/clk-sunxi.c:1083:30: warning: operator '?:' has lower +precedence than '|'; '|' will be evaluated first +[-Wbitwise-conditional-parentheses] + data->div[i].critical ? + ~~~~~~~~~~~~~~~~~~~~~ ^ +drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around +the '|' expression to silence this warning + data->div[i].critical ? + ^ + ) +drivers/clk/sunxi/clk-sunxi.c:1083:30: note: place parentheses around +the '?:' expression to evaluate it first + data->div[i].critical ? + ^ + ( +1 warning generated. + +It appears that the intention was for ?: to be evaluated first so that +CLK_IS_CRITICAL could be added to clkflags if the critical boolean was +set; right now, | is being evaluated first. Add parentheses around the +?: block to have it be evaluated first. + +Fixes: 9919d44ff297 ("clk: sunxi: Use CLK_IS_CRITICAL flag for critical clks") +Link: https://github.com/ClangBuiltLinux/linux/issues/745 +Signed-off-by: Nathan Chancellor +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi/clk-sunxi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/sunxi/clk-sunxi.c b/drivers/clk/sunxi/clk-sunxi.c +index d3a43381a7927..27201fd26e442 100644 +--- a/drivers/clk/sunxi/clk-sunxi.c ++++ b/drivers/clk/sunxi/clk-sunxi.c +@@ -1080,8 +1080,8 @@ static struct clk ** __init sunxi_divs_clk_setup(struct device_node *node, + rate_hw, rate_ops, + gate_hw, &clk_gate_ops, + clkflags | +- data->div[i].critical ? +- CLK_IS_CRITICAL : 0); ++ (data->div[i].critical ? ++ CLK_IS_CRITICAL : 0)); + + WARN_ON(IS_ERR(clk_data->clks[i])); + } +-- +2.20.1 + diff --git a/queue-5.3/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch b/queue-5.3/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch new file mode 100644 index 00000000000..de6b8baca63 --- /dev/null +++ b/queue-5.3/clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch @@ -0,0 +1,39 @@ +From 88b2dcd84417ec945f3ba33ee72ed35718e758de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 12:28:09 +0100 +Subject: clk: sunxi-ng: a80: fix the zero'ing of bits 16 and 18 + +From: Colin Ian King + +[ Upstream commit cdfc2e2086bf9c465f44e2db25561373b084a113 ] + +The zero'ing of bits 16 and 18 is incorrect. Currently the code +is masking with the bitwise-and of BIT(16) & BIT(18) which is +0, so the updated value for val is always zero. Fix this by bitwise +and-ing value with the correct mask that will zero bits 16 and 18. + +Addresses-Coverity: (" Suspicious &= or |= constant expression") +Fixes: b8eb71dcdd08 ("clk: sunxi-ng: Add A80 CCU") +Signed-off-by: Colin Ian King +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun9i-a80.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +index dcac1391767f6..ef29582676f6e 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun9i-a80.c ++++ b/drivers/clk/sunxi-ng/ccu-sun9i-a80.c +@@ -1224,7 +1224,7 @@ static int sun9i_a80_ccu_probe(struct platform_device *pdev) + + /* Enforce d1 = 0, d2 = 0 for Audio PLL */ + val = readl(reg + SUN9I_A80_PLL_AUDIO_REG); +- val &= (BIT(16) & BIT(18)); ++ val &= ~(BIT(16) | BIT(18)); + writel(val, reg + SUN9I_A80_PLL_AUDIO_REG); + + /* Enforce P = 1 for both CPU cluster PLLs */ +-- +2.20.1 + diff --git a/queue-5.3/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch b/queue-5.3/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch new file mode 100644 index 00000000000..dfa47728b9a --- /dev/null +++ b/queue-5.3/clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch @@ -0,0 +1,56 @@ +From f6d656d4a1a3ef9a5ddf61a006ef1f0fb66b1ddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Sep 2019 08:40:01 -0700 +Subject: clk: ti: clkctrl: Fix failed to enable error with double udelay + timeout + +From: Tony Lindgren + +[ Upstream commit 81a41901ffd46bac6df4c95b8290ac259e0feda8 ] + +Commit 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if +timekeeping is suspended") added handling for cases when timekeeping is +suspended. But looks like we can still get occasional "failed to enable" +errors on the PM runtime resume path with udelay() returning faster than +expected. + +With ti-sysc interconnect target module driver this leads into device +failure with PM runtime failing with "failed to enable" clkctrl error. + +Let's fix the issue with a delay of two times the desired delay as in +often done for udelay() to account for the inaccuracy. + +Fixes: 3d8598fb9c5a ("clk: ti: clkctrl: use fallback udelay approach if timekeeping is suspended") +Cc: Keerthy +Cc: Tero Kristo +Signed-off-by: Tony Lindgren +Link: https://lkml.kernel.org/r/20190930154001.46581-1-tony@atomide.com +Tested-by: Keerthy +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clkctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/ti/clkctrl.c b/drivers/clk/ti/clkctrl.c +index 975995eea15cb..b0c0690a5a121 100644 +--- a/drivers/clk/ti/clkctrl.c ++++ b/drivers/clk/ti/clkctrl.c +@@ -100,11 +100,12 @@ static bool _omap4_is_timeout(union omap4_timeout *time, u32 timeout) + * can be from a timer that requires pm_runtime access, which + * will eventually bring us here with timekeeping_suspended, + * during both suspend entry and resume paths. This happens +- * at least on am43xx platform. ++ * at least on am43xx platform. Account for flakeyness ++ * with udelay() by multiplying the timeout value by 2. + */ + if (unlikely(_early_timeout || timekeeping_suspended)) { + if (time->cycles++ < timeout) { +- udelay(1); ++ udelay(1 * 2); + return false; + } + } else { +-- +2.20.1 + diff --git a/queue-5.3/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch b/queue-5.3/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch new file mode 100644 index 00000000000..31ab2bdc1a8 --- /dev/null +++ b/queue-5.3/clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch @@ -0,0 +1,47 @@ +From f9b3ad804a214665cd6516603c958d2b4a03f725 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Oct 2019 11:34:36 +0300 +Subject: clk: ti: dra7-atl-clock: Remove ti_clk_add_alias call + +From: Peter Ujfalusi + +[ Upstream commit 9982b0f69b49931b652d35f86f519be2ccfc7027 ] + +ti_clk_register() calls it already so the driver should not create +duplicated alias. + +Signed-off-by: Peter Ujfalusi +Link: https://lkml.kernel.org/r/20191002083436.10194-1-peter.ujfalusi@ti.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/clk-dra7-atl.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c +index a01ca9395179a..f65e16c4f3c4b 100644 +--- a/drivers/clk/ti/clk-dra7-atl.c ++++ b/drivers/clk/ti/clk-dra7-atl.c +@@ -174,7 +174,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + struct clk_init_data init = { NULL }; + const char **parent_names = NULL; + struct clk *clk; +- int ret; + + clk_hw = kzalloc(sizeof(*clk_hw), GFP_KERNEL); + if (!clk_hw) { +@@ -207,11 +206,6 @@ static void __init of_dra7_atl_clock_setup(struct device_node *node) + clk = ti_clk_register(NULL, &clk_hw->hw, node->name); + + if (!IS_ERR(clk)) { +- ret = ti_clk_add_alias(NULL, clk, node->name); +- if (ret) { +- clk_unregister(clk); +- goto cleanup; +- } + of_clk_add_provider(node, of_clk_src_simple_get, clk); + kfree(parent_names); + return; +-- +2.20.1 + diff --git a/queue-5.3/clocksource-drivers-mediatek-fix-error-handling.patch b/queue-5.3/clocksource-drivers-mediatek-fix-error-handling.patch new file mode 100644 index 00000000000..71bea3d7720 --- /dev/null +++ b/queue-5.3/clocksource-drivers-mediatek-fix-error-handling.patch @@ -0,0 +1,139 @@ +From 21bbe7dadbfd43ac6006fdc81d995c141bcd103a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2019 21:13:15 +0200 +Subject: clocksource/drivers/mediatek: Fix error handling + +From: Fabien Parent + +[ Upstream commit 41d49e7939de5ec532d86494185b2ca2e99c848a ] + +When timer_of_init fails, it cleans up after itself by undoing +everything it did during the initialization function. + +mtk_syst_init and mtk_gpt_init both call timer_of_cleanup if +timer_of_init fails. timer_of_cleanup try to release the resource +taken. Since these resources have already been cleaned up by +timer_of_init, we end up getting a few warnings printed: + +[ 0.001935] WARNING: CPU: 0 PID: 0 at __clk_put+0xe8/0x128 +[ 0.002650] Modules linked in: +[ 0.003058] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.67+ #1 +[ 0.003852] Hardware name: MediaTek MT8183 (DT) +[ 0.004446] pstate: 20400085 (nzCv daIf +PAN -UAO) +[ 0.005073] pc : __clk_put+0xe8/0x128 +[ 0.005555] lr : clk_put+0xc/0x14 +[ 0.005988] sp : ffffff80090b3ea0 +[ 0.006422] x29: ffffff80090b3ea0 x28: 0000000040e20018 +[ 0.007121] x27: ffffffc07bfff780 x26: 0000000000000001 +[ 0.007819] x25: ffffff80090bda80 x24: ffffff8008ec5828 +[ 0.008517] x23: ffffff80090bd000 x22: ffffff8008d8b2e8 +[ 0.009216] x21: 0000000000000001 x20: fffffffffffffdfb +[ 0.009914] x19: ffffff8009166180 x18: 00000000002bffa8 +[ 0.010612] x17: ffffffc012996980 x16: 0000000000000000 +[ 0.011311] x15: ffffffbf004a6800 x14: 3536343038393334 +[ 0.012009] x13: 2079726576652073 x12: 7eb9c62c5c38f100 +[ 0.012707] x11: ffffff80090b3ba0 x10: ffffff80090b3ba0 +[ 0.013405] x9 : 0000000000000004 x8 : 0000000000000040 +[ 0.014103] x7 : ffffffc079400270 x6 : 0000000000000000 +[ 0.014801] x5 : ffffffc079400248 x4 : 0000000000000000 +[ 0.015499] x3 : 0000000000000000 x2 : 0000000000000000 +[ 0.016197] x1 : ffffff80091661c0 x0 : fffffffffffffdfb +[ 0.016896] Call trace: +[ 0.017218] __clk_put+0xe8/0x128 +[ 0.017654] clk_put+0xc/0x14 +[ 0.018048] timer_of_cleanup+0x60/0x7c +[ 0.018551] mtk_syst_init+0x8c/0x9c +[ 0.019020] timer_probe+0x6c/0xe0 +[ 0.019469] time_init+0x14/0x44 +[ 0.019893] start_kernel+0x2d0/0x46c +[ 0.020378] ---[ end trace 8c1efabea1267649 ]--- +[ 0.020982] ------------[ cut here ]------------ +[ 0.021586] Trying to vfree() nonexistent vm area ((____ptrval____)) +[ 0.022427] WARNING: CPU: 0 PID: 0 at __vunmap+0xd0/0xd8 +[ 0.023119] Modules linked in: +[ 0.023524] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G W 4.19.67+ #1 +[ 0.024498] Hardware name: MediaTek MT8183 (DT) +[ 0.025091] pstate: 60400085 (nZCv daIf +PAN -UAO) +[ 0.025718] pc : __vunmap+0xd0/0xd8 +[ 0.026176] lr : __vunmap+0xd0/0xd8 +[ 0.026632] sp : ffffff80090b3e90 +[ 0.027066] x29: ffffff80090b3e90 x28: 0000000040e20018 +[ 0.027764] x27: ffffffc07bfff780 x26: 0000000000000001 +[ 0.028462] x25: ffffff80090bda80 x24: ffffff8008ec5828 +[ 0.029160] x23: ffffff80090bd000 x22: ffffff8008d8b2e8 +[ 0.029858] x21: 0000000000000000 x20: 0000000000000000 +[ 0.030556] x19: ffffff800800d000 x18: 00000000002bffa8 +[ 0.031254] x17: 0000000000000000 x16: 0000000000000000 +[ 0.031952] x15: ffffffbf004a6800 x14: 3536343038393334 +[ 0.032651] x13: 2079726576652073 x12: 7eb9c62c5c38f100 +[ 0.033349] x11: ffffff80090b3b40 x10: ffffff80090b3b40 +[ 0.034047] x9 : 0000000000000005 x8 : 5f5f6c6176727470 +[ 0.034745] x7 : 5f5f5f5f28282061 x6 : ffffff80091c86ef +[ 0.035443] x5 : ffffff800852b690 x4 : 0000000000000000 +[ 0.036141] x3 : 0000000000000002 x2 : 0000000000000002 +[ 0.036839] x1 : 7eb9c62c5c38f100 x0 : 7eb9c62c5c38f100 +[ 0.037536] Call trace: +[ 0.037859] __vunmap+0xd0/0xd8 +[ 0.038271] vunmap+0x24/0x30 +[ 0.038664] __iounmap+0x2c/0x34 +[ 0.039088] timer_of_cleanup+0x70/0x7c +[ 0.039591] mtk_syst_init+0x8c/0x9c +[ 0.040060] timer_probe+0x6c/0xe0 +[ 0.040507] time_init+0x14/0x44 +[ 0.040932] start_kernel+0x2d0/0x46c + +This commit remove the calls to timer_of_cleanup when timer_of_init +fails since it is unnecessary and actually cause warnings to be printed. + +Fixes: a0858f937960 ("mediatek: Convert the driver to timer-of") +Signed-off-by: Fabien Parent +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/linux-arm-kernel/20190919191315.25190-1-fparent@baylibre.com/ +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-mediatek.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/clocksource/timer-mediatek.c b/drivers/clocksource/timer-mediatek.c +index a562f491b0f8d..9318edcd89635 100644 +--- a/drivers/clocksource/timer-mediatek.c ++++ b/drivers/clocksource/timer-mediatek.c +@@ -268,15 +268,12 @@ static int __init mtk_syst_init(struct device_node *node) + + ret = timer_of_init(node, &to); + if (ret) +- goto err; ++ return ret; + + clockevents_config_and_register(&to.clkevt, timer_of_rate(&to), + TIMER_SYNC_TICKS, 0xffffffff); + + return 0; +-err: +- timer_of_cleanup(&to); +- return ret; + } + + static int __init mtk_gpt_init(struct device_node *node) +@@ -293,7 +290,7 @@ static int __init mtk_gpt_init(struct device_node *node) + + ret = timer_of_init(node, &to); + if (ret) +- goto err; ++ return ret; + + /* Configure clock source */ + mtk_gpt_setup(&to, TIMER_CLK_SRC, GPT_CTRL_OP_FREERUN); +@@ -311,9 +308,6 @@ static int __init mtk_gpt_init(struct device_node *node) + mtk_gpt_enable_irq(&to, TIMER_CLK_EVT); + + return 0; +-err: +- timer_of_cleanup(&to); +- return ret; + } + TIMER_OF_DECLARE(mtk_mt6577, "mediatek,mt6577-timer", mtk_gpt_init); + TIMER_OF_DECLARE(mtk_mt6765, "mediatek,mt6765-timer", mtk_syst_init); +-- +2.20.1 + diff --git a/queue-5.3/drm-amd-swsmu-fix-smu-workload-bit-map-error.patch b/queue-5.3/drm-amd-swsmu-fix-smu-workload-bit-map-error.patch new file mode 100644 index 00000000000..53914252a68 --- /dev/null +++ b/queue-5.3/drm-amd-swsmu-fix-smu-workload-bit-map-error.patch @@ -0,0 +1,53 @@ +From 09e8dbba9e3823bf89792dc99c37ae7180ad6b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 18:16:38 +0800 +Subject: drm/amd/swSMU: fix smu workload bit map error + +From: Kevin Wang + +[ Upstream commit 38264de0dce80d223f358ce47512378fae0de586 ] + +fix workload bit (WORKLOAD_PPLIB_COMPUTE_BIT) map error +on vega20 and navi asic. + +fix commit: +drm/amd/powerplay: add function get_workload_type_map for swsmu + +Signed-off-by: Kevin Wang +Reviewed-by: Kenneth Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/navi10_ppt.c | 2 +- + drivers/gpu/drm/amd/powerplay/vega20_ppt.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +index 8bf9f541e7fe7..a0ef44d025d61 100644 +--- a/drivers/gpu/drm/amd/powerplay/navi10_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/navi10_ppt.c +@@ -205,7 +205,7 @@ static int navi10_workload_map[] = { + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING, WORKLOAD_PPLIB_POWER_SAVING_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO, WORKLOAD_PPLIB_VIDEO_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR, WORKLOAD_PPLIB_VR_BIT), +- WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_CUSTOM_BIT), ++ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_COMPUTE_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM, WORKLOAD_PPLIB_CUSTOM_BIT), + }; + +diff --git a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +index 6a14497257e43..33ca6c581f219 100644 +--- a/drivers/gpu/drm/amd/powerplay/vega20_ppt.c ++++ b/drivers/gpu/drm/amd/powerplay/vega20_ppt.c +@@ -219,7 +219,7 @@ static int vega20_workload_map[] = { + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_POWERSAVING, WORKLOAD_PPLIB_POWER_SAVING_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VIDEO, WORKLOAD_PPLIB_VIDEO_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_VR, WORKLOAD_PPLIB_VR_BIT), +- WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_CUSTOM_BIT), ++ WORKLOAD_MAP(PP_SMC_POWER_PROFILE_COMPUTE, WORKLOAD_PPLIB_COMPUTE_BIT), + WORKLOAD_MAP(PP_SMC_POWER_PROFILE_CUSTOM, WORKLOAD_PPLIB_CUSTOM_BIT), + }; + +-- +2.20.1 + diff --git a/queue-5.3/drm-amdgpu-add-warning-for-grbm-1-cycle-delay-issue-.patch b/queue-5.3/drm-amdgpu-add-warning-for-grbm-1-cycle-delay-issue-.patch new file mode 100644 index 00000000000..a15cb19ba2c --- /dev/null +++ b/queue-5.3/drm-amdgpu-add-warning-for-grbm-1-cycle-delay-issue-.patch @@ -0,0 +1,45 @@ +From e648d5b4bfd24488027d171145a8eec24d99ea2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 18:29:12 +0800 +Subject: drm/amdgpu: add warning for GRBM 1-cycle delay issue in gfx9 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: changzhu + +[ Upstream commit 440a7a54e7ec012ec8b27c27e460dfd6f9a24ddb ] + +It needs to add warning to update firmware in gfx9 +in case that firmware is too old to have function to +realize dummy read in cp firmware. + +Signed-off-by: changzhu +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 75faa56f243a4..b1388d3e72f74 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -538,6 +538,13 @@ static void gfx_v9_0_check_fw_write_wait(struct amdgpu_device *adev) + adev->gfx.me_fw_write_wait = false; + adev->gfx.mec_fw_write_wait = false; + ++ if ((adev->gfx.mec_fw_version < 0x000001a5) || ++ (adev->gfx.mec_feature_version < 46) || ++ (adev->gfx.pfp_fw_version < 0x000000b7) || ++ (adev->gfx.pfp_feature_version < 46)) ++ DRM_WARN_ONCE("Warning: check cp_fw_version and update it to realize \ ++ GRBM requires 1-cycle delay in cp firmware\n"); ++ + switch (adev->asic_type) { + case CHIP_VEGA10: + if ((adev->gfx.me_fw_version >= 0x0000009c) && +-- +2.20.1 + diff --git a/queue-5.3/drm-amdgpu-dont-schedule-jobs-while-in-reset.patch b/queue-5.3/drm-amdgpu-dont-schedule-jobs-while-in-reset.patch new file mode 100644 index 00000000000..b6467d10825 --- /dev/null +++ b/queue-5.3/drm-amdgpu-dont-schedule-jobs-while-in-reset.patch @@ -0,0 +1,56 @@ +From 8dea04a7af55ceb2593a9ccb2cab876bbb2872c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 14:20:46 +0530 +Subject: drm/amdgpu: dont schedule jobs while in reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shirish S + +[ Upstream commit f2efc6e60089c99c342a6b7da47f1037e06c4296 ] + +[Why] + +doing kthread_park()/unpark() from drm_sched_entity_fini +while GPU reset is in progress defeats all the purpose of +drm_sched_stop->kthread_park. +If drm_sched_entity_fini->kthread_unpark() happens AFTER +drm_sched_stop->kthread_park nothing prevents from another +(third) thread to keep submitting job to HW which will be +picked up by the unparked scheduler thread and try to submit +to HW but fail because the HW ring is deactivated. + +[How] +grab the reset lock before calling drm_sched_entity_fini() + +Signed-off-by: Shirish S +Suggested-by: Christian König +Reviewed-by: Christian König +Reviewed-by: Andrey Grodzovsky +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +index 7398b4850649b..b7633484d15f2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +@@ -597,8 +597,11 @@ void amdgpu_ctx_mgr_entity_fini(struct amdgpu_ctx_mgr *mgr) + continue; + } + +- for (i = 0; i < num_entities; i++) ++ for (i = 0; i < num_entities; i++) { ++ mutex_lock(&ctx->adev->lock_reset); + drm_sched_entity_fini(&ctx->entities[0][i].entity); ++ mutex_unlock(&ctx->adev->lock_reset); ++ } + } + } + +-- +2.20.1 + diff --git a/queue-5.3/drm-amdgpu-register-gpu-instance-before-fan-boost-fe.patch b/queue-5.3/drm-amdgpu-register-gpu-instance-before-fan-boost-fe.patch new file mode 100644 index 00000000000..353fcd262a0 --- /dev/null +++ b/queue-5.3/drm-amdgpu-register-gpu-instance-before-fan-boost-fe.patch @@ -0,0 +1,54 @@ +From 0f6298915397d3517c86a80034cb01f6990105a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 18:13:49 +0800 +Subject: drm/amdgpu: register gpu instance before fan boost feature enablment + +From: Evan Quan + +[ Upstream commit 6a299d7aaa97dfde5988d8f9e2fa2c046b5793ff ] + +Otherwise, the feature enablement will be skipped due to wrong count. + +Fixes: beff74bc6e0fa91 ("drm/amdgpu: fix a race in GPU reset with IB test (v2)") +Signed-off-by: Evan Quan +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 1 - + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index 5a7f893cf7244..2877ce84aef2b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2788,6 +2788,13 @@ fence_driver_init: + DRM_INFO("amdgpu: acceleration disabled, skipping benchmarks\n"); + } + ++ /* ++ * Register gpu instance before amdgpu_device_enable_mgpu_fan_boost. ++ * Otherwise the mgpu fan boost feature will be skipped due to the ++ * gpu instance is counted less. ++ */ ++ amdgpu_register_gpu_instance(adev); ++ + /* enable clockgating, etc. after ib tests, etc. since some blocks require + * explicit gating rather than handling it automatically. + */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index 65f6619f0c0c4..e531ba9195a0f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -190,7 +190,6 @@ int amdgpu_driver_load_kms(struct drm_device *dev, unsigned long flags) + pm_runtime_put_autosuspend(dev->dev); + } + +- amdgpu_register_gpu_instance(adev); + out: + if (r) { + /* balance pm_runtime_get_sync in amdgpu_driver_unload_kms */ +-- +2.20.1 + diff --git a/queue-5.3/fbdev-c2p-fix-link-failure-on-non-inlining.patch b/queue-5.3/fbdev-c2p-fix-link-failure-on-non-inlining.patch new file mode 100644 index 00000000000..9364db7437d --- /dev/null +++ b/queue-5.3/fbdev-c2p-fix-link-failure-on-non-inlining.patch @@ -0,0 +1,78 @@ +From ccd61312d80450e60121c4b771244abeeaf32edc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 11:47:08 +0200 +Subject: fbdev: c2p: Fix link failure on non-inlining + +From: Geert Uytterhoeven + +[ Upstream commit b330f3972f4f2a829d41fb9e9b552bec7d73a840 ] + +When the compiler decides not to inline the Chunky-to-Planar core +functions, the build fails with: + + c2p_planar.c:(.text+0xd6): undefined reference to `c2p_unsupported' + c2p_planar.c:(.text+0x1dc): undefined reference to `c2p_unsupported' + c2p_iplan2.c:(.text+0xc4): undefined reference to `c2p_unsupported' + c2p_iplan2.c:(.text+0x150): undefined reference to `c2p_unsupported' + +Fix this by marking the functions __always_inline. + +While this could be triggered before by manually enabling both +CONFIG_OPTIMIZE_INLINING and CONFIG_CC_OPTIMIZE_FOR_SIZE, it was exposed +in the m68k defconfig by commit ac7c3e4ff401b304 ("compiler: enable +CONFIG_OPTIMIZE_INLINING forcibly"). + +Fixes: 9012d011660ea5cf ("compiler: allow all arches to enable CONFIG_OPTIMIZE_INLINING") +Reported-by: noreply@ellerman.id.au +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Masahiro Yamada +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20190927094708.11563-1-geert@linux-m68k.org +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/c2p_core.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/video/fbdev/c2p_core.h b/drivers/video/fbdev/c2p_core.h +index e1035a865fb94..45a6d895a7d72 100644 +--- a/drivers/video/fbdev/c2p_core.h ++++ b/drivers/video/fbdev/c2p_core.h +@@ -29,7 +29,7 @@ static inline void _transp(u32 d[], unsigned int i1, unsigned int i2, + + extern void c2p_unsupported(void); + +-static inline u32 get_mask(unsigned int n) ++static __always_inline u32 get_mask(unsigned int n) + { + switch (n) { + case 1: +@@ -57,7 +57,7 @@ static inline u32 get_mask(unsigned int n) + * Transpose operations on 8 32-bit words + */ + +-static inline void transp8(u32 d[], unsigned int n, unsigned int m) ++static __always_inline void transp8(u32 d[], unsigned int n, unsigned int m) + { + u32 mask = get_mask(n); + +@@ -99,7 +99,7 @@ static inline void transp8(u32 d[], unsigned int n, unsigned int m) + * Transpose operations on 4 32-bit words + */ + +-static inline void transp4(u32 d[], unsigned int n, unsigned int m) ++static __always_inline void transp4(u32 d[], unsigned int n, unsigned int m) + { + u32 mask = get_mask(n); + +@@ -126,7 +126,7 @@ static inline void transp4(u32 d[], unsigned int n, unsigned int m) + * Transpose operations on 4 32-bit words (reverse order) + */ + +-static inline void transp4x(u32 d[], unsigned int n, unsigned int m) ++static __always_inline void transp4x(u32 d[], unsigned int n, unsigned int m) + { + u32 mask = get_mask(n); + +-- +2.20.1 + diff --git a/queue-5.3/i40e-fix-for-ethtool-m-issue-on-x722-nic.patch b/queue-5.3/i40e-fix-for-ethtool-m-issue-on-x722-nic.patch new file mode 100644 index 00000000000..199c6d5debc --- /dev/null +++ b/queue-5.3/i40e-fix-for-ethtool-m-issue-on-x722-nic.patch @@ -0,0 +1,45 @@ +From 39a7d44b1f2811fef7028f6230fa832c610815dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 06:24:04 -0800 +Subject: i40e: Fix for ethtool -m issue on X722 NIC + +From: Arkadiusz Kubalewski + +[ Upstream commit 4c9da6f2b8a029052c75bd4a61ae229135831177 ] + +This patch contains fix for a problem with command: +'ethtool -m ' +which breaks functionality of: +'ethtool ' +when called on X722 NIC + +Disallowed update of link phy_types on X722 NIC +Currently correct value cannot be obtained from FW +Previously wrong value returned by FW was used and was +a root cause for incorrect output of 'ethtool ' command + +Signed-off-by: Arkadiusz Kubalewski +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c b/drivers/net/ethernet/intel/i40e/i40e_common.c +index 906cf68d3453a..4a53bfc017b13 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_common.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c +@@ -1861,7 +1861,8 @@ i40e_status i40e_aq_get_link_info(struct i40e_hw *hw, + hw->aq.fw_min_ver < 40)) && hw_link_info->phy_type == 0xE) + hw_link_info->phy_type = I40E_PHY_TYPE_10GBASE_SFPP_CU; + +- if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE) { ++ if (hw->flags & I40E_HW_FLAG_AQ_PHY_ACCESS_CAPABLE && ++ hw->mac.type != I40E_MAC_X722) { + __le32 tmp; + + memcpy(&tmp, resp->link_type, sizeof(tmp)); +-- +2.20.1 + diff --git a/queue-5.3/iavf-initialize-itrn-registers-with-correct-values.patch b/queue-5.3/iavf-initialize-itrn-registers-with-correct-values.patch new file mode 100644 index 00000000000..62568fc2da1 --- /dev/null +++ b/queue-5.3/iavf-initialize-itrn-registers-with-correct-values.patch @@ -0,0 +1,60 @@ +From 41e4c922e3d0597c173acacfb0428a38ad3d71aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 04:22:14 -0800 +Subject: iavf: initialize ITRN registers with correct values + +From: Nicholas Nunley + +[ Upstream commit 4eda4e0096842764d725bcfd77471a419832b074 ] + +Since commit 92418fb14750 ("i40e/i40evf: Use usec value instead of reg +value for ITR defines") the driver tracks the interrupt throttling +intervals in single usec units, although the actual ITRN registers are +programmed in 2 usec units. Most register programming flows in the driver +correctly handle the conversion, although it is currently not applied when +the registers are initialized to their default values. Most of the time +this doesn't present a problem since the default values are usually +immediately overwritten through the standard adaptive throttling mechanism, +or updated manually by the user, but if adaptive throttling is disabled and +the interval values are left alone then the incorrect value will persist. + +Since the intended default interval of 50 usecs (vs. 100 usecs as +programmed) performs better for most traffic workloads, this can lead to +performance regressions. + +This patch adds the correct conversion when writing the initial values to +the ITRN registers. + +Signed-off-by: Nicholas Nunley +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 9d2b50964a08f..fa857b60ba2b6 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -336,7 +336,7 @@ iavf_map_vector_to_rxq(struct iavf_adapter *adapter, int v_idx, int r_idx) + q_vector->rx.target_itr = ITR_TO_REG(rx_ring->itr_setting); + q_vector->ring_mask |= BIT(r_idx); + wr32(hw, IAVF_VFINT_ITRN1(IAVF_RX_ITR, q_vector->reg_idx), +- q_vector->rx.current_itr); ++ q_vector->rx.current_itr >> 1); + q_vector->rx.current_itr = q_vector->rx.target_itr; + } + +@@ -362,7 +362,7 @@ iavf_map_vector_to_txq(struct iavf_adapter *adapter, int v_idx, int t_idx) + q_vector->tx.target_itr = ITR_TO_REG(tx_ring->itr_setting); + q_vector->num_ringpairs++; + wr32(hw, IAVF_VFINT_ITRN1(IAVF_TX_ITR, q_vector->reg_idx), +- q_vector->tx.target_itr); ++ q_vector->tx.target_itr >> 1); + q_vector->tx.current_itr = q_vector->tx.target_itr; + } + +-- +2.20.1 + diff --git a/queue-5.3/ice-fix-potential-infinite-loop-because-loop-counter.patch b/queue-5.3/ice-fix-potential-infinite-loop-because-loop-counter.patch new file mode 100644 index 00000000000..0f891f24be3 --- /dev/null +++ b/queue-5.3/ice-fix-potential-infinite-loop-because-loop-counter.patch @@ -0,0 +1,41 @@ +From 864ca0bf8c04953e746abdb8ac20b5c1efbbd45b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 14:00:17 +0000 +Subject: ice: fix potential infinite loop because loop counter being too small + +From: Colin Ian King + +[ Upstream commit 615457a226f042bffc3a1532afb244cab37460d4 ] + +Currently the for-loop counter i is a u8 however it is being checked +against a maximum value hw->num_tx_sched_layers which is a u16. Hence +there is a potential wrap-around of counter i back to zero if +hw->num_tx_sched_layers is greater than 255. Fix this by making i +a u16. + +Addresses-Coverity: ("Infinite loop") +Fixes: b36c598c999c ("ice: Updates to Tx scheduler code") +Signed-off-by: Colin Ian King +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_sched.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_sched.c b/drivers/net/ethernet/intel/ice/ice_sched.c +index 2a232504379d2..602b0fd84c29e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_sched.c ++++ b/drivers/net/ethernet/intel/ice/ice_sched.c +@@ -1052,7 +1052,7 @@ enum ice_status ice_sched_query_res_alloc(struct ice_hw *hw) + struct ice_aqc_query_txsched_res_resp *buf; + enum ice_status status = 0; + __le16 max_sibl; +- u8 i; ++ u16 i; + + if (hw->layer_info) + return status; +-- +2.20.1 + diff --git a/queue-5.3/idr-fix-idr_alloc_u32-on-32-bit-systems.patch b/queue-5.3/idr-fix-idr_alloc_u32-on-32-bit-systems.patch new file mode 100644 index 00000000000..47db1ef8f79 --- /dev/null +++ b/queue-5.3/idr-fix-idr_alloc_u32-on-32-bit-systems.patch @@ -0,0 +1,35 @@ +From ed76b3ddc86a7b51937d4271f93fba9d6d9c4953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2019 00:25:08 -0400 +Subject: idr: Fix idr_alloc_u32 on 32-bit systems + +From: Matthew Wilcox (Oracle) + +[ Upstream commit b7e9728f3d7fc5c5c8508d99f1675212af5cfd49 ] + +Attempting to allocate an entry at 0xffffffff when one is already +present would succeed in allocating one at 2^32, which would confuse +everything. Return -ENOSPC in this case, as expected. + +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + lib/radix-tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index 18c1dfbb17654..c8fa1d2745302 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -1529,7 +1529,7 @@ void __rcu **idr_get_free(struct radix_tree_root *root, + offset = radix_tree_find_next_bit(node, IDR_FREE, + offset + 1); + start = next_index(start, node, offset); +- if (start > max) ++ if (start > max || start == 0) + return ERR_PTR(-ENOSPC); + while (offset == RADIX_TREE_MAP_SIZE) { + offset = node->offset + 1; +-- +2.20.1 + diff --git a/queue-5.3/idr-fix-idr_get_next_ul-race-with-idr_remove.patch b/queue-5.3/idr-fix-idr_get_next_ul-race-with-idr_remove.patch new file mode 100644 index 00000000000..19497c61718 --- /dev/null +++ b/queue-5.3/idr-fix-idr_get_next_ul-race-with-idr_remove.patch @@ -0,0 +1,97 @@ +From 3ca3ea6a462284fa1204e48ca0016c1efc95ffa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 21:36:39 -0400 +Subject: idr: Fix idr_get_next_ul race with idr_remove + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 5a74ac4c4a97bd8b7dba054304d598e2a882fea6 ] + +Commit 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove") +neglected to fix idr_get_next_ul(). As far as I can tell, nobody's +actually using this interface under the RCU read lock, but fix it now +before anybody decides to use it. + +Fixes: 5c089fd0c734 ("idr: Fix idr_get_next race with idr_remove") +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + lib/idr.c | 31 +++++++++++-------------------- + 1 file changed, 11 insertions(+), 20 deletions(-) + +diff --git a/lib/idr.c b/lib/idr.c +index 66a3748924828..c2cf2c52bbde5 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -215,7 +215,7 @@ int idr_for_each(const struct idr *idr, + EXPORT_SYMBOL(idr_for_each); + + /** +- * idr_get_next() - Find next populated entry. ++ * idr_get_next_ul() - Find next populated entry. + * @idr: IDR handle. + * @nextid: Pointer to an ID. + * +@@ -224,7 +224,7 @@ EXPORT_SYMBOL(idr_for_each); + * to the ID of the found value. To use in a loop, the value pointed to by + * nextid must be incremented by the user. + */ +-void *idr_get_next(struct idr *idr, int *nextid) ++void *idr_get_next_ul(struct idr *idr, unsigned long *nextid) + { + struct radix_tree_iter iter; + void __rcu **slot; +@@ -245,18 +245,14 @@ void *idr_get_next(struct idr *idr, int *nextid) + } + if (!slot) + return NULL; +- id = iter.index + base; +- +- if (WARN_ON_ONCE(id > INT_MAX)) +- return NULL; + +- *nextid = id; ++ *nextid = iter.index + base; + return entry; + } +-EXPORT_SYMBOL(idr_get_next); ++EXPORT_SYMBOL(idr_get_next_ul); + + /** +- * idr_get_next_ul() - Find next populated entry. ++ * idr_get_next() - Find next populated entry. + * @idr: IDR handle. + * @nextid: Pointer to an ID. + * +@@ -265,22 +261,17 @@ EXPORT_SYMBOL(idr_get_next); + * to the ID of the found value. To use in a loop, the value pointed to by + * nextid must be incremented by the user. + */ +-void *idr_get_next_ul(struct idr *idr, unsigned long *nextid) ++void *idr_get_next(struct idr *idr, int *nextid) + { +- struct radix_tree_iter iter; +- void __rcu **slot; +- unsigned long base = idr->idr_base; + unsigned long id = *nextid; ++ void *entry = idr_get_next_ul(idr, &id); + +- id = (id < base) ? 0 : id - base; +- slot = radix_tree_iter_find(&idr->idr_rt, &iter, id); +- if (!slot) ++ if (WARN_ON_ONCE(id > INT_MAX)) + return NULL; +- +- *nextid = iter.index + base; +- return rcu_dereference_raw(*slot); ++ *nextid = id; ++ return entry; + } +-EXPORT_SYMBOL(idr_get_next_ul); ++EXPORT_SYMBOL(idr_get_next); + + /** + * idr_replace() - replace pointer for given ID. +-- +2.20.1 + diff --git a/queue-5.3/idr-fix-integer-overflow-in-idr_for_each_entry.patch b/queue-5.3/idr-fix-integer-overflow-in-idr_for_each_entry.patch new file mode 100644 index 00000000000..8184ff19262 --- /dev/null +++ b/queue-5.3/idr-fix-integer-overflow-in-idr_for_each_entry.patch @@ -0,0 +1,38 @@ +From dd38d03703a7066bcf9c18c61e88d192b1f48bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Nov 2019 06:36:43 -0500 +Subject: idr: Fix integer overflow in idr_for_each_entry + +From: Matthew Wilcox (Oracle) + +[ Upstream commit f6341c5af4e6e15041be39976d16deca789555fa ] + +If there is an entry at INT_MAX then idr_for_each_entry() will increment +id after handling it. This is undefined behaviour, and is caught by +UBSAN. Adding 1U to id forces the operation to be carried out as an +unsigned addition which (when assigned to id) will result in INT_MIN. +Since there is never an entry stored at INT_MIN, idr_get_next() will +return NULL, ending the loop as expected. + +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + include/linux/idr.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/idr.h b/include/linux/idr.h +index 4ec8986e5dfb6..ac6e946b6767b 100644 +--- a/include/linux/idr.h ++++ b/include/linux/idr.h +@@ -185,7 +185,7 @@ static inline void idr_preload_end(void) + * is convenient for a "not found" value. + */ + #define idr_for_each_entry(idr, entry, id) \ +- for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; ++id) ++ for (id = 0; ((entry) = idr_get_next(idr, &(id))) != NULL; id += 1U) + + /** + * idr_for_each_entry_ul() - Iterate over an IDR's elements of a given type. +-- +2.20.1 + diff --git a/queue-5.3/mac80211-fix-ieee80211_txq_setup_flows-failure-path.patch b/queue-5.3/mac80211-fix-ieee80211_txq_setup_flows-failure-path.patch new file mode 100644 index 00000000000..32f759c225a --- /dev/null +++ b/queue-5.3/mac80211-fix-ieee80211_txq_setup_flows-failure-path.patch @@ -0,0 +1,42 @@ +From c8d4bc435beb2e8bba2eb07f6666a773b052f02b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 15:41:11 +0100 +Subject: mac80211: fix ieee80211_txq_setup_flows() failure path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Johannes Berg + +[ Upstream commit 6dd47d9754ff0589715054b11294771f2c9a16ac ] + +If ieee80211_txq_setup_flows() fails, we don't clean up LED +state properly, leading to crashes later on, fix that. + +Fixes: dc8b274f0952 ("mac80211: Move up init of TXQs") +Signed-off-by: Johannes Berg +Acked-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20191105154110.1ccf7112ba5d.I0ba865792446d051867b33153be65ce6b063d98c@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 4c2702f128f3a..868705ed5cbbb 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -1297,8 +1297,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + ieee80211_remove_interfaces(local); + fail_rate: + rtnl_unlock(); +- ieee80211_led_exit(local); + fail_flows: ++ ieee80211_led_exit(local); + destroy_workqueue(local->workqueue); + fail_workqueue: + wiphy_unregister(local->hw.wiphy); +-- +2.20.1 + diff --git a/queue-5.3/mac80211-fix-station-inactive_time-shortly-after-boo.patch b/queue-5.3/mac80211-fix-station-inactive_time-shortly-after-boo.patch new file mode 100644 index 00000000000..4c94835051e --- /dev/null +++ b/queue-5.3/mac80211-fix-station-inactive_time-shortly-after-boo.patch @@ -0,0 +1,47 @@ +From 10725b2e29c587d010817ed9004a407dbc7faff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 06:12:43 -0600 +Subject: mac80211: fix station inactive_time shortly after boot + +From: Ahmed Zaki + +[ Upstream commit 285531f9e6774e3be71da6673d475ff1a088d675 ] + +In the first 5 minutes after boot (time of INITIAL_JIFFIES), +ieee80211_sta_last_active() returns zero if last_ack is zero. This +leads to "inactive time" showing jiffies_to_msecs(jiffies). + + # iw wlan0 station get fc:ec:da:64:a6:dd + Station fc:ec:da:64:a6:dd (on wlan0) + inactive time: 4294894049 ms + . + . + connected time: 70 seconds + +Fix by returning last_rx if last_ack == 0. + +Signed-off-by: Ahmed Zaki +Link: https://lore.kernel.org/r/20191031121243.27694-1-anzaki@gmail.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 5fb368cc26338..0030b13c2f501 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2455,7 +2455,8 @@ unsigned long ieee80211_sta_last_active(struct sta_info *sta) + { + struct ieee80211_sta_rx_stats *stats = sta_get_last_rx_stats(sta); + +- if (time_after(stats->last_rx, sta->status_stats.last_ack)) ++ if (!sta->status_stats.last_ack || ++ time_after(stats->last_rx, sta->status_stats.last_ack)) + return stats->last_rx; + return sta->status_stats.last_ack; + } +-- +2.20.1 + diff --git a/queue-5.3/mm-gup_benchmark-fix-map_hugetlb-case.patch b/queue-5.3/mm-gup_benchmark-fix-map_hugetlb-case.patch new file mode 100644 index 00000000000..a14b6bb8e4c --- /dev/null +++ b/queue-5.3/mm-gup_benchmark-fix-map_hugetlb-case.patch @@ -0,0 +1,70 @@ +From d492791454af65051a43446eaf80c9f0875c9f20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 21:16:24 -0800 +Subject: mm/gup_benchmark: fix MAP_HUGETLB case +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: John Hubbard + +[ Upstream commit 64801d19eba156170340c76f70ade743defcb8ce ] + +The MAP_HUGETLB ("-H" option) of gup_benchmark fails: + + $ sudo ./gup_benchmark -H + mmap: Invalid argument + +This is because gup_benchmark.c is passing in a file descriptor to +mmap(), but the fd came from opening up the /dev/zero file. This +confuses the mmap syscall implementation, which thinks that, if the +caller did not specify MAP_ANONYMOUS, then the file must be a huge page +file. So it attempts to verify that the file really is a huge page +file, as you can see here: + +ksys_mmap_pgoff() +{ + if (!(flags & MAP_ANONYMOUS)) { + retval = -EINVAL; + if (unlikely(flags & MAP_HUGETLB && !is_file_hugepages(file))) + goto out_fput; /* THIS IS WHERE WE END UP */ + + else if (flags & MAP_HUGETLB) { + ...proceed normally, /dev/zero is ok here... + +...and of course is_file_hugepages() returns "false" for the /dev/zero +file. + +The problem is that the user space program, gup_benchmark.c, really just +wants anonymous memory here. The simplest way to get that is to pass +MAP_ANONYMOUS whenever MAP_HUGETLB is specified, so that's what this +patch does. + +Link: http://lkml.kernel.org/r/20191021212435.398153-2-jhubbard@nvidia.com +Signed-off-by: John Hubbard +Reviewed-by: Andrew Morton +Reviewed-by: Jérôme Glisse +Cc: Keith Busch +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/gup_benchmark.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c +index c0534e298b512..8e9929ce64cdb 100644 +--- a/tools/testing/selftests/vm/gup_benchmark.c ++++ b/tools/testing/selftests/vm/gup_benchmark.c +@@ -71,7 +71,7 @@ int main(int argc, char **argv) + flags |= MAP_SHARED; + break; + case 'H': +- flags |= MAP_HUGETLB; ++ flags |= (MAP_HUGETLB | MAP_ANONYMOUS); + break; + default: + return -1; +-- +2.20.1 + diff --git a/queue-5.3/net-bcmgenet-reapply-manual-settings-to-the-phy.patch b/queue-5.3/net-bcmgenet-reapply-manual-settings-to-the-phy.patch new file mode 100644 index 00000000000..d51840b5877 --- /dev/null +++ b/queue-5.3/net-bcmgenet-reapply-manual-settings-to-the-phy.patch @@ -0,0 +1,58 @@ +From 7869ff3a0317a5af8802e5f96e2c6a6f4adb8fea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 11:07:26 -0800 +Subject: net: bcmgenet: reapply manual settings to the PHY + +From: Doug Berger + +[ Upstream commit 0686bd9d5e6863f60e4bb1e78e6fe7bb217a0890 ] + +The phy_init_hw() function may reset the PHY to a configuration +that does not match manual network settings stored in the phydev +structure. If the phy state machine is polled rather than event +driven this can create a timing hazard where the phy state machine +might alter the settings stored in the phydev structure from the +value read from the BMCR. + +This commit follows invocations of phy_init_hw() by the bcmgenet +driver with invocations of the genphy_config_aneg() function to +ensure that the BMCR is written to match the settings held in the +phydev structure. This prevents the risk of manual settings being +accidentally altered. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 4c90923d7a1c8..2f0011465af0c 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -2617,8 +2617,10 @@ static void bcmgenet_irq_task(struct work_struct *work) + spin_unlock_irq(&priv->lock); + + if (status & UMAC_IRQ_PHY_DET_R && +- priv->dev->phydev->autoneg != AUTONEG_ENABLE) ++ priv->dev->phydev->autoneg != AUTONEG_ENABLE) { + phy_init_hw(priv->dev->phydev); ++ genphy_config_aneg(priv->dev->phydev); ++ } + + /* Link UP/DOWN event */ + if (status & UMAC_IRQ_LINK_EVENT) +@@ -3641,6 +3643,7 @@ static int bcmgenet_resume(struct device *d) + phy_init_hw(dev->phydev); + + /* Speed settings must be restored */ ++ genphy_config_aneg(dev->phydev); + bcmgenet_mii_config(priv->dev, false); + + bcmgenet_set_hw_addr(priv, dev->dev_addr); +-- +2.20.1 + diff --git a/queue-5.3/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch b/queue-5.3/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch new file mode 100644 index 00000000000..8370b9a7bf3 --- /dev/null +++ b/queue-5.3/net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch @@ -0,0 +1,130 @@ +From 022e7bdba663f3ebb34a8a1d23265d9fa482003d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 11:07:24 -0800 +Subject: net: bcmgenet: use RGMII loopback for MAC reset + +From: Doug Berger + +[ Upstream commit 3a55402c93877d291b0a612d25edb03d1b4b93ac ] + +As noted in commit 28c2d1a7a0bf ("net: bcmgenet: enable loopback +during UniMAC sw_reset") the UniMAC must be clocked while sw_reset +is asserted for its state machines to reset cleanly. + +The transmit and receive clocks used by the UniMAC are derived from +the signals used on its PHY interface. The bcmgenet MAC can be +configured to work with different PHY interfaces including MII, +GMII, RGMII, and Reverse MII on internal and external interfaces. +Unfortunately for the UniMAC, when configured for MII the Tx clock +is always driven from the PHY which places it outside of the direct +control of the MAC. + +The earlier commit enabled a local loopback mode within the UniMAC +so that the receive clock would be derived from the transmit clock +which addressed the observed issue with an external GPHY disabling +it's Rx clock. However, when a Tx clock is not available this +loopback is insufficient. + +This commit implements a workaround that leverages the fact that +the MAC can reliably generate all of its necessary clocking by +enterring the external GPHY RGMII interface mode with the UniMAC in +local loopback during the sw_reset interval. Unfortunately, this +has the undesirable side efect of the RGMII GTXCLK signal being +driven during the same window. + +In most configurations this is a benign side effect as the signal +is either not routed to a pin or is already expected to drive the +pin. The one exception is when an external MII PHY is expected to +drive the same pin with its TX_CLK output creating output driver +contention. + +This commit exploits the IEEE 802.3 clause 22 standard defined +isolate mode to force an external MII PHY to present a high +impedance on its TX_CLK output during the window to prevent any +contention at the pin. + +The MII interface is used internally with the 40nm internal EPHY +which agressively disables its clocks for power savings leading to +incomplete resets of the UniMAC and many instabilities observed +over the years. The workaround of this commit is expected to put +an end to those problems. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Doug Berger +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/broadcom/genet/bcmgenet.c | 2 -- + drivers/net/ethernet/broadcom/genet/bcmmii.c | 33 +++++++++++++++++++ + 2 files changed, 33 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 06e2581b28eaf..4c90923d7a1c8 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1996,8 +1996,6 @@ static void reset_umac(struct bcmgenet_priv *priv) + + /* issue soft reset with (rg)mii loopback to ensure a stable rxclk */ + bcmgenet_umac_writel(priv, CMD_SW_RESET | CMD_LCL_LOOP_EN, UMAC_CMD); +- udelay(2); +- bcmgenet_umac_writel(priv, 0, UMAC_CMD); + } + + static void bcmgenet_intr_disable(struct bcmgenet_priv *priv) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index e7c291bf4ed17..dbe18cdf6c1b8 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -181,8 +181,38 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + const char *phy_name = NULL; + u32 id_mode_dis = 0; + u32 port_ctrl; ++ int bmcr = -1; ++ int ret; + u32 reg; + ++ /* MAC clocking workaround during reset of umac state machines */ ++ reg = bcmgenet_umac_readl(priv, UMAC_CMD); ++ if (reg & CMD_SW_RESET) { ++ /* An MII PHY must be isolated to prevent TXC contention */ ++ if (priv->phy_interface == PHY_INTERFACE_MODE_MII) { ++ ret = phy_read(phydev, MII_BMCR); ++ if (ret >= 0) { ++ bmcr = ret; ++ ret = phy_write(phydev, MII_BMCR, ++ bmcr | BMCR_ISOLATE); ++ } ++ if (ret) { ++ netdev_err(dev, "failed to isolate PHY\n"); ++ return ret; ++ } ++ } ++ /* Switch MAC clocking to RGMII generated clock */ ++ bcmgenet_sys_writel(priv, PORT_MODE_EXT_GPHY, SYS_PORT_CTRL); ++ /* Ensure 5 clks with Rx disabled ++ * followed by 5 clks with Reset asserted ++ */ ++ udelay(4); ++ reg &= ~(CMD_SW_RESET | CMD_LCL_LOOP_EN); ++ bcmgenet_umac_writel(priv, reg, UMAC_CMD); ++ /* Ensure 5 more clocks before Rx is enabled */ ++ udelay(2); ++ } ++ + priv->ext_phy = !priv->internal_phy && + (priv->phy_interface != PHY_INTERFACE_MODE_MOCA); + +@@ -214,6 +244,9 @@ int bcmgenet_mii_config(struct net_device *dev, bool init) + phy_set_max_speed(phydev, SPEED_100); + bcmgenet_sys_writel(priv, + PORT_MODE_EXT_EPHY, SYS_PORT_CTRL); ++ /* Restore the MII PHY after isolation */ ++ if (bmcr >= 0) ++ phy_write(phydev, MII_BMCR, bmcr); + break; + + case PHY_INTERFACE_MODE_REVMII: +-- +2.20.1 + diff --git a/queue-5.3/net-fec-add-missed-clk_disable_unprepare-in-remove.patch b/queue-5.3/net-fec-add-missed-clk_disable_unprepare-in-remove.patch new file mode 100644 index 00000000000..e0f266877fc --- /dev/null +++ b/queue-5.3/net-fec-add-missed-clk_disable_unprepare-in-remove.patch @@ -0,0 +1,35 @@ +From b22ae6ddf4bb6d95107c73180d9ba188eecea5e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 23:50:00 +0800 +Subject: net: fec: add missed clk_disable_unprepare in remove + +From: Chuhong Yuan + +[ Upstream commit c43eab3eddb4c6742ac20138659a9b701822b274 ] + +This driver forgets to disable and unprepare clks when remove. +Add calls to clk_disable_unprepare to fix it. + +Signed-off-by: Chuhong Yuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index e5610a4da5390..9cb1d6ab19d5b 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3589,6 +3589,8 @@ fec_drv_remove(struct platform_device *pdev) + regulator_disable(fep->reg_phy); + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ clk_disable_unprepare(fep->clk_ahb); ++ clk_disable_unprepare(fep->clk_ipg); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +-- +2.20.1 + diff --git a/queue-5.3/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch b/queue-5.3/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch new file mode 100644 index 00000000000..27ca28a9e63 --- /dev/null +++ b/queue-5.3/net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch @@ -0,0 +1,54 @@ +From 614c890c99ef5334a004c1b41c6c6c54620e2179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 16:57:50 +0100 +Subject: net/fq_impl: Switch to kvmalloc() for memory allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 71e67c3bd127cfe7863f54e4b087eba1cc8f9a7a ] + +The FQ implementation used by mac80211 allocates memory using kmalloc(), +which can fail; and Johannes reported that this actually happens in +practice. + +To avoid this, switch the allocation to kvmalloc() instead; this also +brings fq_impl in line with all the FQ qdiscs. + +Fixes: 557fc4a09803 ("fq: add fair queuing framework") +Reported-by: Johannes Berg +Signed-off-by: Toke Høiland-Jørgensen +Link: https://lore.kernel.org/r/20191105155750.547379-1-toke@redhat.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/fq_impl.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/fq_impl.h b/include/net/fq_impl.h +index 107c0d700ed6f..38a9a3d1222b7 100644 +--- a/include/net/fq_impl.h ++++ b/include/net/fq_impl.h +@@ -313,7 +313,7 @@ static int fq_init(struct fq *fq, int flows_cnt) + fq->limit = 8192; + fq->memory_limit = 16 << 20; /* 16 MBytes */ + +- fq->flows = kcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL); ++ fq->flows = kvcalloc(fq->flows_cnt, sizeof(fq->flows[0]), GFP_KERNEL); + if (!fq->flows) + return -ENOMEM; + +@@ -331,7 +331,7 @@ static void fq_reset(struct fq *fq, + for (i = 0; i < fq->flows_cnt; i++) + fq_flow_reset(fq, &fq->flows[i], free_func); + +- kfree(fq->flows); ++ kvfree(fq->flows); + fq->flows = NULL; + } + +-- +2.20.1 + diff --git a/queue-5.3/net-mlx5e-fix-eswitch-debug-print-of-max-fdb-flow.patch b/queue-5.3/net-mlx5e-fix-eswitch-debug-print-of-max-fdb-flow.patch new file mode 100644 index 00000000000..879b6803ed4 --- /dev/null +++ b/queue-5.3/net-mlx5e-fix-eswitch-debug-print-of-max-fdb-flow.patch @@ -0,0 +1,36 @@ +From 2337db17bfbff724a516b93ea93b4b2670583c53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Oct 2019 19:13:58 +0200 +Subject: net/mlx5e: Fix eswitch debug print of max fdb flow + +From: Roi Dayan + +[ Upstream commit f382b0df6946d48fae80a2201ccff43b41382099 ] + +The value is already the calculation so remove the log prefix. + +Fixes: e52c28024008 ("net/mlx5: E-Switch, Add chains and priorities") +Signed-off-by: Roi Dayan +Reviewed-by: Eli Britstein +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index 35945cdd0a618..3ac6104e9924c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -1085,7 +1085,7 @@ static int esw_create_offloads_fdb_tables(struct mlx5_eswitch *esw, int nvports) + MLX5_CAP_GEN(dev, max_flow_counter_15_0); + fdb_max = 1 << MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size); + +- esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(2^%d))\n", ++ esw_debug(dev, "Create offloads FDB table, min (max esw size(2^%d), max counters(%d), groups(%d), max flow table size(%d))\n", + MLX5_CAP_ESW_FLOWTABLE_FDB(dev, log_max_ft_size), + max_flow_counter, ESW_OFFLOADS_NUM_GROUPS, + fdb_max); +-- +2.20.1 + diff --git a/queue-5.3/net-mlx5e-use-correct-enum-to-determine-uplink-port.patch b/queue-5.3/net-mlx5e-use-correct-enum-to-determine-uplink-port.patch new file mode 100644 index 00000000000..91f6f906680 --- /dev/null +++ b/queue-5.3/net-mlx5e-use-correct-enum-to-determine-uplink-port.patch @@ -0,0 +1,50 @@ +From 6496d630bc588d303459a6e3431cf0efa72b85ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 11:44:24 +0200 +Subject: net/mlx5e: Use correct enum to determine uplink port + +From: Dmytro Linkin + +[ Upstream commit 950d3af70ea89cf7ac51d734a634174013631192 ] + +For vlan push action, if eswitch flow source capability is enabled, flow +source value compared with MLX5_VPORT_UPLINK enum, to determine uplink +port. This lead to syndrome in dmesg if try to add vlan push action. +For example: + $ tc filter add dev vxlan0 ingress protocol ip prio 1 flower \ + enc_dst_port 4789 \ + action tunnel_key unset pipe \ + action vlan push id 20 pipe \ + action mirred egress redirect dev ens1f0_0 + $ dmesg + ... + [ 2456.883693] mlx5_core 0000:82:00.0: mlx5_cmd_check:756:(pid 5273): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0xa9c090) +Use the correct enum value MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK. + +Fixes: bb204dcf39fe ("net/mlx5e: Determine source port properly for vlan push action") +Signed-off-by: Dmytro Linkin +Reviewed-by: Vlad Buslov +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +index 7879e1746297c..366bda1bb1c32 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c +@@ -183,7 +183,8 @@ static bool mlx5_eswitch_offload_is_uplink_port(const struct mlx5_eswitch *esw, + u32 port_mask, port_value; + + if (MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source)) +- return spec->flow_context.flow_source == MLX5_VPORT_UPLINK; ++ return spec->flow_context.flow_source == ++ MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK; + + port_mask = MLX5_GET(fte_match_param, spec->match_criteria, + misc_parameters.source_port); +-- +2.20.1 + diff --git a/queue-5.3/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch b/queue-5.3/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch new file mode 100644 index 00000000000..d4ec408decc --- /dev/null +++ b/queue-5.3/net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch @@ -0,0 +1,39 @@ +From a3d9579f8f9770f73fd3f2e6341dfb8676ff8998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 00:01:40 +0200 +Subject: net: mscc: ocelot: fix __ocelot_rmw_ix prototype + +From: Vladimir Oltean + +[ Upstream commit 17fdd7638cb687cd7f15a48545f25d738f0101e0 ] + +The "read-modify-write register index" function is declared with a +confusing prototype: the "mask" and "reg" arguments are swapped. + +Fortunately, this does not affect callers so far. Both arguments are +u32, and the wrapper macros (ocelot_rmw_ix etc) have the arguments in +the correct order (the one from ocelot_io.c). + +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot.h b/drivers/net/ethernet/mscc/ocelot.h +index f7eeb4806897d..aa372aba66c8c 100644 +--- a/drivers/net/ethernet/mscc/ocelot.h ++++ b/drivers/net/ethernet/mscc/ocelot.h +@@ -479,7 +479,7 @@ void __ocelot_write_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 offset); + #define ocelot_write_rix(ocelot, val, reg, ri) __ocelot_write_ix(ocelot, val, reg, reg##_RSZ * (ri)) + #define ocelot_write(ocelot, val, reg) __ocelot_write_ix(ocelot, val, reg, 0) + +-void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 reg, u32 mask, ++void __ocelot_rmw_ix(struct ocelot *ocelot, u32 val, u32 mask, u32 reg, + u32 offset); + #define ocelot_rmw_ix(ocelot, val, m, reg, gi, ri) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi) + reg##_RSZ * (ri)) + #define ocelot_rmw_gix(ocelot, val, m, reg, gi) __ocelot_rmw_ix(ocelot, val, m, reg, reg##_GSZ * (gi)) +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-gmac4-bitrev32-returns-u32.patch b/queue-5.3/net-stmmac-gmac4-bitrev32-returns-u32.patch new file mode 100644 index 00000000000..0e4fe3270c7 --- /dev/null +++ b/queue-5.3/net-stmmac-gmac4-bitrev32-returns-u32.patch @@ -0,0 +1,35 @@ +From edfa3cd1fdafaa30b6ff4343c67abe29410c2dac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 16:02:55 +0100 +Subject: net: stmmac: gmac4: bitrev32 returns u32 + +From: Jose Abreu + +[ Upstream commit 4d7c47e34fab0d25790bb6e85b85e26fdf0090d5 ] + +The bitrev32 function returns an u32 var, not an int. Fix it. + +Fixes: 477286b53f55 ("stmmac: add GMAC4 core support") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 9c73fb759b575..ff830bb5fcaf7 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -438,7 +438,7 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + * bits used depends on the hardware configuration + * selected at core configuration time. + */ +- int bit_nr = bitrev32(~crc32_le(~0, ha->addr, ++ u32 bit_nr = bitrev32(~crc32_le(~0, ha->addr, + ETH_ALEN)) >> (32 - mcbitslog2); + /* The most significant bit determines the register to + * use (H/L) while the other 5 bits determine the bit +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-xgmac-bitrev32-returns-u32.patch b/queue-5.3/net-stmmac-xgmac-bitrev32-returns-u32.patch new file mode 100644 index 00000000000..a58acb21354 --- /dev/null +++ b/queue-5.3/net-stmmac-xgmac-bitrev32-returns-u32.patch @@ -0,0 +1,35 @@ +From 26fb6db31900bc2ff016893036c0f3cb8f0de491 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 16:02:56 +0100 +Subject: net: stmmac: xgmac: bitrev32 returns u32 + +From: Jose Abreu + +[ Upstream commit 3d00e45d498fd5347cea653ef494c56731b651e0 ] + +The bitrev32 function returns an u32 var, not an int. Fix it. + +Fixes: 0efedbf11f07 ("net: stmmac: xgmac: Fix XGMAC selftests") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 46d74f407aab6..91d7dec2540a1 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -361,7 +361,7 @@ static void dwxgmac2_set_filter(struct mac_device_info *hw, + value |= XGMAC_FILTER_HMC; + + netdev_for_each_mc_addr(ha, dev) { +- int nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >> ++ u32 nr = (bitrev32(~crc32_le(~0, ha->addr, 6)) >> + (32 - mcbitslog2)); + mc_filter[nr >> 5] |= (1 << (nr & 0x1F)); + } +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-xgmac-disable-flow-control-when-1-or-more.patch b/queue-5.3/net-stmmac-xgmac-disable-flow-control-when-1-or-more.patch new file mode 100644 index 00000000000..13ff1b32afc --- /dev/null +++ b/queue-5.3/net-stmmac-xgmac-disable-flow-control-when-1-or-more.patch @@ -0,0 +1,44 @@ +From b66499ef18299e2fea92c4fba403759040916541 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 16:03:01 +0100 +Subject: net: stmmac: xgmac: Disable Flow Control when 1 or more queues are in + AV + +From: Jose Abreu + +[ Upstream commit 132f2f20c9866325d12c155aca06d260f358d3cb ] + +When in AVB mode we need to disable flow control to prevent MAC from +pausing in TX side. + +Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +index a4f236e3593e7..28dc3b33606e1 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_dma.c +@@ -441,6 +441,7 @@ static void dwxgmac2_enable_tso(void __iomem *ioaddr, bool en, u32 chan) + static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode) + { + u32 value = readl(ioaddr + XGMAC_MTL_TXQ_OPMODE(channel)); ++ u32 flow = readl(ioaddr + XGMAC_RX_FLOW_CTRL); + + value &= ~XGMAC_TXQEN; + if (qmode != MTL_QUEUE_AVB) { +@@ -448,6 +449,7 @@ static void dwxgmac2_qmode(void __iomem *ioaddr, u32 channel, u8 qmode) + writel(0, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(channel)); + } else { + value |= 0x1 << XGMAC_TXQEN_SHIFT; ++ writel(flow & (~XGMAC_RFE), ioaddr + XGMAC_RX_FLOW_CTRL); + } + + writel(value, ioaddr + XGMAC_MTL_TXQ_OPMODE(channel)); +-- +2.20.1 + diff --git a/queue-5.3/net-stmmac-xgmac-fix-tsa-selection.patch b/queue-5.3/net-stmmac-xgmac-fix-tsa-selection.patch new file mode 100644 index 00000000000..544e04221a7 --- /dev/null +++ b/queue-5.3/net-stmmac-xgmac-fix-tsa-selection.patch @@ -0,0 +1,36 @@ +From 8b6ce55923fc6ffc4410cd10e3a786aeca39b954 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2019 16:02:59 +0100 +Subject: net: stmmac: xgmac: Fix TSA selection + +From: Jose Abreu + +[ Upstream commit 97add93fbcfa566735d6a4b96684110d356ebd35 ] + +When we change between Transmission Scheduling Algorithms, we need to +clear previous values so that the new chosen algorithm is correctly +selected. + +Fixes: ec6ea8e3eee9 ("net: stmmac: Add CBS support in XGMAC2") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 91d7dec2540a1..341c7a70fc71a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -196,6 +196,7 @@ static void dwxgmac2_config_cbs(struct mac_device_info *hw, + writel(low_credit, ioaddr + XGMAC_MTL_TCx_LOCREDIT(queue)); + + value = readl(ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue)); ++ value &= ~XGMAC_TSA; + value |= XGMAC_CC | XGMAC_CBS; + writel(value, ioaddr + XGMAC_MTL_TCx_ETS_CONTROL(queue)); + } +-- +2.20.1 + diff --git a/queue-5.3/netfilter-ipset-fix-nla_policies-to-fully-support-nl.patch b/queue-5.3/netfilter-ipset-fix-nla_policies-to-fully-support-nl.patch new file mode 100644 index 00000000000..b3dda94970f --- /dev/null +++ b/queue-5.3/netfilter-ipset-fix-nla_policies-to-fully-support-nl.patch @@ -0,0 +1,164 @@ +From d9a168b8fb2684607156ebed6f49b375626c02f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 17:13:18 +0100 +Subject: netfilter: ipset: Fix nla_policies to fully support + NL_VALIDATE_STRICT + +From: Jozsef Kadlecsik + +[ Upstream commit 1289975643f4cdecb071dc641059a47679fd170f ] + +Since v5.2 (commit "netlink: re-add parse/validate functions in strict +mode") NL_VALIDATE_STRICT is enabled. Fix the ipset nla_policies which did +not support strict mode and convert from deprecated parsings to verified ones. + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_core.c | 41 ++++++++++++++++-------- + net/netfilter/ipset/ip_set_hash_net.c | 1 + + net/netfilter/ipset/ip_set_hash_netnet.c | 1 + + 3 files changed, 30 insertions(+), 13 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index e7288eab75126..d73d1828216a6 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -296,7 +296,8 @@ ip_set_get_ipaddr4(struct nlattr *nla, __be32 *ipaddr) + + if (unlikely(!flag_nested(nla))) + return -IPSET_ERR_PROTOCOL; +- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL)) ++ if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ++ ipaddr_policy, NULL)) + return -IPSET_ERR_PROTOCOL; + if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV4))) + return -IPSET_ERR_PROTOCOL; +@@ -314,7 +315,8 @@ ip_set_get_ipaddr6(struct nlattr *nla, union nf_inet_addr *ipaddr) + if (unlikely(!flag_nested(nla))) + return -IPSET_ERR_PROTOCOL; + +- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_IPADDR_MAX, nla, ipaddr_policy, NULL)) ++ if (nla_parse_nested(tb, IPSET_ATTR_IPADDR_MAX, nla, ++ ipaddr_policy, NULL)) + return -IPSET_ERR_PROTOCOL; + if (unlikely(!ip_set_attr_netorder(tb, IPSET_ATTR_IPADDR_IPV6))) + return -IPSET_ERR_PROTOCOL; +@@ -934,7 +936,8 @@ static int ip_set_create(struct net *net, struct sock *ctnl, + + /* Without holding any locks, create private part. */ + if (attr[IPSET_ATTR_DATA] && +- nla_parse_nested_deprecated(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], set->type->create_policy, NULL)) { ++ nla_parse_nested(tb, IPSET_ATTR_CREATE_MAX, attr[IPSET_ATTR_DATA], ++ set->type->create_policy, NULL)) { + ret = -IPSET_ERR_PROTOCOL; + goto put_out; + } +@@ -1281,6 +1284,14 @@ dump_attrs(struct nlmsghdr *nlh) + } + } + ++static const struct nla_policy ++ip_set_dump_policy[IPSET_ATTR_CMD_MAX + 1] = { ++ [IPSET_ATTR_PROTOCOL] = { .type = NLA_U8 }, ++ [IPSET_ATTR_SETNAME] = { .type = NLA_NUL_STRING, ++ .len = IPSET_MAXNAMELEN - 1 }, ++ [IPSET_ATTR_FLAGS] = { .type = NLA_U32 }, ++}; ++ + static int + dump_init(struct netlink_callback *cb, struct ip_set_net *inst) + { +@@ -1292,9 +1303,9 @@ dump_init(struct netlink_callback *cb, struct ip_set_net *inst) + ip_set_id_t index; + int ret; + +- ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, attr, +- nlh->nlmsg_len - min_len, +- ip_set_setname_policy, NULL); ++ ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, attr, ++ nlh->nlmsg_len - min_len, ++ ip_set_dump_policy, NULL); + if (ret) + return ret; + +@@ -1543,9 +1554,9 @@ call_ad(struct sock *ctnl, struct sk_buff *skb, struct ip_set *set, + memcpy(&errmsg->msg, nlh, nlh->nlmsg_len); + cmdattr = (void *)&errmsg->msg + min_len; + +- ret = nla_parse_deprecated(cda, IPSET_ATTR_CMD_MAX, cmdattr, +- nlh->nlmsg_len - min_len, +- ip_set_adt_policy, NULL); ++ ret = nla_parse(cda, IPSET_ATTR_CMD_MAX, cmdattr, ++ nlh->nlmsg_len - min_len, ip_set_adt_policy, ++ NULL); + + if (ret) { + nlmsg_free(skb2); +@@ -1596,7 +1607,9 @@ static int ip_set_ad(struct net *net, struct sock *ctnl, + + use_lineno = !!attr[IPSET_ATTR_LINENO]; + if (attr[IPSET_ATTR_DATA]) { +- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL)) ++ if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, ++ attr[IPSET_ATTR_DATA], ++ set->type->adt_policy, NULL)) + return -IPSET_ERR_PROTOCOL; + ret = call_ad(ctnl, skb, set, tb, adt, flags, + use_lineno); +@@ -1606,7 +1619,8 @@ static int ip_set_ad(struct net *net, struct sock *ctnl, + nla_for_each_nested(nla, attr[IPSET_ATTR_ADT], nla_rem) { + if (nla_type(nla) != IPSET_ATTR_DATA || + !flag_nested(nla) || +- nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, nla, set->type->adt_policy, NULL)) ++ nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, nla, ++ set->type->adt_policy, NULL)) + return -IPSET_ERR_PROTOCOL; + ret = call_ad(ctnl, skb, set, tb, adt, + flags, use_lineno); +@@ -1655,7 +1669,8 @@ static int ip_set_utest(struct net *net, struct sock *ctnl, struct sk_buff *skb, + if (!set) + return -ENOENT; + +- if (nla_parse_nested_deprecated(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], set->type->adt_policy, NULL)) ++ if (nla_parse_nested(tb, IPSET_ATTR_ADT_MAX, attr[IPSET_ATTR_DATA], ++ set->type->adt_policy, NULL)) + return -IPSET_ERR_PROTOCOL; + + rcu_read_lock_bh(); +@@ -1961,7 +1976,7 @@ static const struct nfnl_callback ip_set_netlink_subsys_cb[IPSET_MSG_MAX] = { + [IPSET_CMD_LIST] = { + .call = ip_set_dump, + .attr_count = IPSET_ATTR_CMD_MAX, +- .policy = ip_set_setname_policy, ++ .policy = ip_set_dump_policy, + }, + [IPSET_CMD_SAVE] = { + .call = ip_set_dump, +diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c +index c259cbc3ef453..3d932de0ad295 100644 +--- a/net/netfilter/ipset/ip_set_hash_net.c ++++ b/net/netfilter/ipset/ip_set_hash_net.c +@@ -368,6 +368,7 @@ static struct ip_set_type hash_net_type __read_mostly = { + [IPSET_ATTR_IP_TO] = { .type = NLA_NESTED }, + [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, + [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, ++ [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, + [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, + [IPSET_ATTR_BYTES] = { .type = NLA_U64 }, + [IPSET_ATTR_PACKETS] = { .type = NLA_U64 }, +diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c +index a3ae69bfee668..4398322fad592 100644 +--- a/net/netfilter/ipset/ip_set_hash_netnet.c ++++ b/net/netfilter/ipset/ip_set_hash_netnet.c +@@ -476,6 +476,7 @@ static struct ip_set_type hash_netnet_type __read_mostly = { + [IPSET_ATTR_CIDR] = { .type = NLA_U8 }, + [IPSET_ATTR_CIDR2] = { .type = NLA_U8 }, + [IPSET_ATTR_TIMEOUT] = { .type = NLA_U32 }, ++ [IPSET_ATTR_LINENO] = { .type = NLA_U32 }, + [IPSET_ATTR_CADT_FLAGS] = { .type = NLA_U32 }, + [IPSET_ATTR_BYTES] = { .type = NLA_U64 }, + [IPSET_ATTR_PACKETS] = { .type = NLA_U64 }, +-- +2.20.1 + diff --git a/queue-5.3/netfilter-nf_tables-bogus-eopnotsupp-on-basechain-up.patch b/queue-5.3/netfilter-nf_tables-bogus-eopnotsupp-on-basechain-up.patch new file mode 100644 index 00000000000..cb5a5ae5064 --- /dev/null +++ b/queue-5.3/netfilter-nf_tables-bogus-eopnotsupp-on-basechain-up.patch @@ -0,0 +1,35 @@ +From 4c0e436e8fb9502ddf94907ed86008430e03dfec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 14:52:41 +0100 +Subject: netfilter: nf_tables: bogus EOPNOTSUPP on basechain update + +From: Pablo Neira Ayuso + +[ Upstream commit 1ed012f6fd83e7ee7efd22e2c32f23efff015b30 ] + +Userspace never includes the NFT_BASE_CHAIN flag, this flag is inferred +from the NFTA_CHAIN_HOOK atribute. The chain update path does not allow +to update flags at this stage, the existing sanity check bogusly hits +EOPNOTSUPP in the basechain case if the offload flag is set on. + +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 3b81323fa0171..5dbc6bfb532cd 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -1922,6 +1922,7 @@ static int nf_tables_newchain(struct net *net, struct sock *nlsk, + if (nlh->nlmsg_flags & NLM_F_REPLACE) + return -EOPNOTSUPP; + ++ flags |= chain->flags & NFT_BASE_CHAIN; + return nf_tables_updchain(&ctx, genmask, policy, flags); + } + +-- +2.20.1 + diff --git a/queue-5.3/netfilter-nf_tables_offload-skip-ebusy-on-chain-upda.patch b/queue-5.3/netfilter-nf_tables_offload-skip-ebusy-on-chain-upda.patch new file mode 100644 index 00000000000..01f58c945ab --- /dev/null +++ b/queue-5.3/netfilter-nf_tables_offload-skip-ebusy-on-chain-upda.patch @@ -0,0 +1,36 @@ +From 6716ec16992741e49556d85f4d25bcff4fb1a356 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Nov 2019 14:52:42 +0100 +Subject: netfilter: nf_tables_offload: skip EBUSY on chain update + +From: Pablo Neira Ayuso + +[ Upstream commit 88c749840dff58e7a40e18bf9bdace15f27ef259 ] + +Do not try to bind a chain again if it exists, otherwise the driver +returns EBUSY. + +Fixes: c9626a2cbdb2 ("netfilter: nf_tables: add hardware offload support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index c0d18c1d77ac0..04fbab60e8080 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -241,7 +241,8 @@ int nft_flow_rule_offload_commit(struct net *net) + + switch (trans->msg_type) { + case NFT_MSG_NEWCHAIN: +- if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD)) ++ if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) || ++ nft_trans_chain_update(trans)) + continue; + + err = nft_flow_offload_chain(trans, FLOW_BLOCK_BIND); +-- +2.20.1 + diff --git a/queue-5.3/nvme-multipath-fix-crash-in-nvme_mpath_clear_ctrl_pa.patch b/queue-5.3/nvme-multipath-fix-crash-in-nvme_mpath_clear_ctrl_pa.patch new file mode 100644 index 00000000000..e2a5a92bafd --- /dev/null +++ b/queue-5.3/nvme-multipath-fix-crash-in-nvme_mpath_clear_ctrl_pa.patch @@ -0,0 +1,81 @@ +From 663618e4b986a4a7f90ece42bb8121bd8d5d3f17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 17:27:55 -0700 +Subject: nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths + +From: Anton Eidelman + +[ Upstream commit 763303a83a095a88c3a8a0d1abf97165db2e8bf5 ] + +nvme_mpath_clear_ctrl_paths() iterates through +the ctrl->namespaces list while holding ctrl->scan_lock. +This does not seem to be the correct way of protecting +from concurrent list modification. + +Specifically, nvme_scan_work() sorts ctrl->namespaces +AFTER unlocking scan_lock. + +This may result in the following (rare) crash in ctrl disconnect +during scan_work: + + BUG: kernel NULL pointer dereference, address: 0000000000000050 + Oops: 0000 [#1] SMP PTI + CPU: 0 PID: 3995 Comm: nvme 5.3.5-050305-generic + RIP: 0010:nvme_mpath_clear_current_path+0xe/0x90 [nvme_core] + ... + Call Trace: + nvme_mpath_clear_ctrl_paths+0x3c/0x70 [nvme_core] + nvme_remove_namespaces+0x35/0xe0 [nvme_core] + nvme_do_delete_ctrl+0x47/0x90 [nvme_core] + nvme_sysfs_delete+0x49/0x60 [nvme_core] + dev_attr_store+0x17/0x30 + sysfs_kf_write+0x3e/0x50 + kernfs_fop_write+0x11e/0x1a0 + __vfs_write+0x1b/0x40 + vfs_write+0xb9/0x1a0 + ksys_write+0x67/0xe0 + __x64_sys_write+0x1a/0x20 + do_syscall_64+0x5a/0x130 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f8d02bfb154 + +Fix: +After taking scan_lock in nvme_mpath_clear_ctrl_paths() +down_read(&ctrl->namespaces_rwsem) as well to make list traversal safe. +This will not cause deadlocks because taking scan_lock never happens +while holding the namespaces_rwsem. +Moreover, scan work downs namespaces_rwsem in the same order. + +Alternative: sort ctrl->namespaces in nvme_scan_work() +while still holding the scan_lock. +This would leave nvme_mpath_clear_ctrl_paths() without correct protection +against ctrl->namespaces modification by anyone other than scan_work. + +Reviewed-by: Sagi Grimberg +Reviewed-by: Christoph Hellwig +Signed-off-by: Anton Eidelman +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index d320684d25b20..a5c809c85f6d2 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -158,9 +158,11 @@ void nvme_mpath_clear_ctrl_paths(struct nvme_ctrl *ctrl) + struct nvme_ns *ns; + + mutex_lock(&ctrl->scan_lock); ++ down_read(&ctrl->namespaces_rwsem); + list_for_each_entry(ns, &ctrl->namespaces, list) + if (nvme_mpath_clear_current_path(ns)) + kblockd_schedule_work(&ns->head->requeue_work); ++ up_read(&ctrl->namespaces_rwsem); + mutex_unlock(&ctrl->scan_lock); + } + +-- +2.20.1 + diff --git a/queue-5.3/nvme-rdma-fix-a-segmentation-fault-during-module-unl.patch b/queue-5.3/nvme-rdma-fix-a-segmentation-fault-during-module-unl.patch new file mode 100644 index 00000000000..b37b9cf7136 --- /dev/null +++ b/queue-5.3/nvme-rdma-fix-a-segmentation-fault-during-module-unl.patch @@ -0,0 +1,47 @@ +From a075377a902f0eba1f0856e7f816968490b25957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 16:42:27 +0200 +Subject: nvme-rdma: fix a segmentation fault during module unload + +From: Max Gurtovoy + +[ Upstream commit 9ad9e8d6ca29c1446d81c6518ae634a2141dfd22 ] + +In case there are controllers that are not associated with any RDMA +device (e.g. during unsuccessful reconnection) and the user will unload +the module, these controllers will not be freed and will access already +freed memory. The same logic appears in other fabric drivers as well. + +Fixes: 87fd125344d6 ("nvme-rdma: remove redundant reference between ib_device and tagset") +Reviewed-by: Sagi Grimberg +Signed-off-by: Max Gurtovoy +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 842ef876724f7..439e66769f250 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -2118,8 +2118,16 @@ err_unreg_client: + + static void __exit nvme_rdma_cleanup_module(void) + { ++ struct nvme_rdma_ctrl *ctrl; ++ + nvmf_unregister_transport(&nvme_rdma_transport); + ib_unregister_client(&nvme_rdma_ib_client); ++ ++ mutex_lock(&nvme_rdma_ctrl_mutex); ++ list_for_each_entry(ctrl, &nvme_rdma_ctrl_list, list) ++ nvme_delete_ctrl(&ctrl->ctrl); ++ mutex_unlock(&nvme_rdma_ctrl_mutex); ++ flush_workqueue(nvme_delete_wq); + } + + module_init(nvme_rdma_init_module); +-- +2.20.1 + diff --git a/queue-5.3/perf-scripting-engines-iterate-on-tep-event-arrays-d.patch b/queue-5.3/perf-scripting-engines-iterate-on-tep-event-arrays-d.patch new file mode 100644 index 00000000000..5066d9b80e9 --- /dev/null +++ b/queue-5.3/perf-scripting-engines-iterate-on-tep-event-arrays-d.patch @@ -0,0 +1,109 @@ +From ac02cfc5ca7c156418e49f9b397712030acc20cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 17:05:22 -0400 +Subject: perf scripting engines: Iterate on tep event arrays directly + +From: Steven Rostedt (VMware) + +[ Upstream commit 443b0636ea7386d01dc460b4a4264e125f710b53 ] + +Instead of calling a useless (and broken) helper function to get the +next event of a tep event array, just get the array directly and iterate +over it. + +Note, the broken part was from trace_find_next_event() which after this +will no longer be used, and can be removed. + +Committer notes: + +This fixes a segfault when generating python scripts from perf.data +files with multiple tracepoint events, i.e. the following use case is +fixed by this patch: + + # perf record -e sched:* sleep 1 + [ perf record: Woken up 31 times to write data ] + [ perf record: Captured and wrote 0.031 MB perf.data (9 samples) ] + # perf script -g python + Segmentation fault (core dumped) + # + +Reported-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (VMware) +Tested-by: Arnaldo Carvalho de Melo +Cc: Andrew Morton +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Tzvetomir Stoyanov +Cc: linux-trace-devel@vger.kernel.org +Link: http://lkml.kernel.org/r/20191017153733.630cd5eb@gandalf.local.home +Link: http://lore.kernel.org/lkml/20191017210636.061448713@goodmis.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/scripting-engines/trace-event-perl.c | 8 ++++++-- + tools/perf/util/scripting-engines/trace-event-python.c | 9 +++++++-- + 2 files changed, 13 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c +index 61aa7f3df915b..6a0dcaee3f3ee 100644 +--- a/tools/perf/util/scripting-engines/trace-event-perl.c ++++ b/tools/perf/util/scripting-engines/trace-event-perl.c +@@ -539,10 +539,11 @@ static int perl_stop_script(void) + + static int perl_generate_script(struct tep_handle *pevent, const char *outfile) + { ++ int i, not_first, count, nr_events; ++ struct tep_event **all_events; + struct tep_event *event = NULL; + struct tep_format_field *f; + char fname[PATH_MAX]; +- int not_first, count; + FILE *ofp; + + sprintf(fname, "%s.pl", outfile); +@@ -603,8 +604,11 @@ sub print_backtrace\n\ + }\n\n\ + "); + ++ nr_events = tep_get_events_count(pevent); ++ all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID); + +- while ((event = trace_find_next_event(pevent, event))) { ++ for (i = 0; all_events && i < nr_events; i++) { ++ event = all_events[i]; + fprintf(ofp, "sub %s::%s\n{\n", event->system, event->name); + fprintf(ofp, "\tmy ("); + +diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c +index 25dc1d765553b..df5ebb6af9fc8 100644 +--- a/tools/perf/util/scripting-engines/trace-event-python.c ++++ b/tools/perf/util/scripting-engines/trace-event-python.c +@@ -1687,10 +1687,11 @@ static int python_stop_script(void) + + static int python_generate_script(struct tep_handle *pevent, const char *outfile) + { ++ int i, not_first, count, nr_events; ++ struct tep_event **all_events; + struct tep_event *event = NULL; + struct tep_format_field *f; + char fname[PATH_MAX]; +- int not_first, count; + FILE *ofp; + + sprintf(fname, "%s.py", outfile); +@@ -1735,7 +1736,11 @@ static int python_generate_script(struct tep_handle *pevent, const char *outfile + fprintf(ofp, "def trace_end():\n"); + fprintf(ofp, "\tprint(\"in trace_end\")\n\n"); + +- while ((event = trace_find_next_event(pevent, event))) { ++ nr_events = tep_get_events_count(pevent); ++ all_events = tep_list_events(pevent, TEP_EVENT_SORT_ID); ++ ++ for (i = 0; all_events && i < nr_events; i++) { ++ event = all_events[i]; + fprintf(ofp, "def %s__%s(", event->system, event->name); + fprintf(ofp, "event_name, "); + fprintf(ofp, "context, "); +-- +2.20.1 + diff --git a/queue-5.3/pinctrl-cherryview-allocate-irq-chip-dynamic.patch b/queue-5.3/pinctrl-cherryview-allocate-irq-chip-dynamic.patch new file mode 100644 index 00000000000..e69c1c8feed --- /dev/null +++ b/queue-5.3/pinctrl-cherryview-allocate-irq-chip-dynamic.patch @@ -0,0 +1,96 @@ +From 137b4f5c1b5276036de0832d3eb75d97ed3e2d56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 16:34:41 +0300 +Subject: pinctrl: cherryview: Allocate IRQ chip dynamic + +From: Andy Shevchenko + +[ Upstream commit 67d33aecd030226f0a577eb683aaa6853ecf8f91 ] + +Keeping the IRQ chip definition static shares it with multiple instances +of the GPIO chip in the system. This is bad and now we get this warning +from GPIO library: + +"detected irqchip that is shared with multiple gpiochips: please fix the driver." + +Hence, move the IRQ chip definition from being driver static into the struct +intel_pinctrl. So a unique IRQ chip is used for each GPIO chip instance. + +This patch is heavily based on the attachment to the bug by Christoph Marz. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=202543 +Fixes: 6e08d6bbebeb ("pinctrl: Add Intel Cherryview/Braswell pin controller support") +Depends-on: 83b9dc11312f ("pinctrl: cherryview: Associate IRQ descriptors to irqdomain") +Signed-off-by: Andy Shevchenko +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-cherryview.c | 24 +++++++++++----------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c +index 17a248b723b9b..8dfaf8e8c3a09 100644 +--- a/drivers/pinctrl/intel/pinctrl-cherryview.c ++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c +@@ -147,6 +147,7 @@ struct chv_pin_context { + * @pctldesc: Pin controller description + * @pctldev: Pointer to the pin controller device + * @chip: GPIO chip in this pin controller ++ * @irqchip: IRQ chip in this pin controller + * @regs: MMIO registers + * @intr_lines: Stores mapping between 16 HW interrupt wires and GPIO + * offset (in GPIO number space) +@@ -162,6 +163,7 @@ struct chv_pinctrl { + struct pinctrl_desc pctldesc; + struct pinctrl_dev *pctldev; + struct gpio_chip chip; ++ struct irq_chip irqchip; + void __iomem *regs; + unsigned intr_lines[16]; + const struct chv_community *community; +@@ -1466,16 +1468,6 @@ static int chv_gpio_irq_type(struct irq_data *d, unsigned int type) + return 0; + } + +-static struct irq_chip chv_gpio_irqchip = { +- .name = "chv-gpio", +- .irq_startup = chv_gpio_irq_startup, +- .irq_ack = chv_gpio_irq_ack, +- .irq_mask = chv_gpio_irq_mask, +- .irq_unmask = chv_gpio_irq_unmask, +- .irq_set_type = chv_gpio_irq_type, +- .flags = IRQCHIP_SKIP_SET_WAKE, +-}; +- + static void chv_gpio_irq_handler(struct irq_desc *desc) + { + struct gpio_chip *gc = irq_desc_get_handler_data(desc); +@@ -1615,7 +1607,15 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq) + } + } + +- ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0, ++ pctrl->irqchip.name = "chv-gpio"; ++ pctrl->irqchip.irq_startup = chv_gpio_irq_startup; ++ pctrl->irqchip.irq_ack = chv_gpio_irq_ack; ++ pctrl->irqchip.irq_mask = chv_gpio_irq_mask; ++ pctrl->irqchip.irq_unmask = chv_gpio_irq_unmask; ++ pctrl->irqchip.irq_set_type = chv_gpio_irq_type; ++ pctrl->irqchip.flags = IRQCHIP_SKIP_SET_WAKE; ++ ++ ret = gpiochip_irqchip_add(chip, &pctrl->irqchip, 0, + handle_bad_irq, IRQ_TYPE_NONE); + if (ret) { + dev_err(pctrl->dev, "failed to add IRQ chip\n"); +@@ -1632,7 +1632,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq) + } + } + +- gpiochip_set_chained_irqchip(chip, &chv_gpio_irqchip, irq, ++ gpiochip_set_chained_irqchip(chip, &pctrl->irqchip, irq, + chv_gpio_irq_handler); + return 0; + } +-- +2.20.1 + diff --git a/queue-5.3/powerpc-bpf-fix-tail-call-implementation.patch b/queue-5.3/powerpc-bpf-fix-tail-call-implementation.patch new file mode 100644 index 00000000000..b16446b632e --- /dev/null +++ b/queue-5.3/powerpc-bpf-fix-tail-call-implementation.patch @@ -0,0 +1,78 @@ +From 0e38d1a074410d28ea603a40ac3d8e9a515ce80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 31 Oct 2019 20:34:44 -0700 +Subject: powerpc/bpf: Fix tail call implementation + +From: Eric Dumazet + +[ Upstream commit 7de086909365cd60a5619a45af3f4152516fd75c ] + +We have seen many crashes on powerpc hosts while loading bpf programs. + +The problem here is that bpf_int_jit_compile() does a first pass +to compute the program length. + +Then it allocates memory to store the generated program and +calls bpf_jit_build_body() a second time (and a third time +later) + +What I have observed is that the second bpf_jit_build_body() +could end up using few more words than expected. + +If bpf_jit_binary_alloc() put the space for the program +at the end of the allocated page, we then write on +a non mapped memory. + +It appears that bpf_jit_emit_tail_call() calls +bpf_jit_emit_common_epilogue() while ctx->seen might not +be stable. + +Only after the second pass we can be sure ctx->seen wont be changed. + +Trying to avoid a second pass seems quite complex and probably +not worth it. + +Fixes: ce0761419faef ("powerpc/bpf: Implement support for tail calls") +Signed-off-by: Eric Dumazet +Signed-off-by: Daniel Borkmann +Cc: Naveen N. Rao +Cc: Sandipan Das +Cc: Benjamin Herrenschmidt +Cc: Paul Mackerras +Cc: Michael Ellerman +Cc: Martin KaFai Lau +Cc: Song Liu +Cc: Yonghong Song +Link: https://lore.kernel.org/bpf/20191101033444.143741-1-edumazet@google.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/net/bpf_jit_comp64.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index 02a59946a78af..be3517ef0574d 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -1141,6 +1141,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) + goto out_addrs; + } + ++ /* ++ * If we have seen a tail call, we need a second pass. ++ * This is because bpf_jit_emit_common_epilogue() is called ++ * from bpf_jit_emit_tail_call() with a not yet stable ctx->seen. ++ */ ++ if (cgctx.seen & SEEN_TAILCALL) { ++ cgctx.idx = 0; ++ if (bpf_jit_build_body(fp, 0, &cgctx, addrs, false)) { ++ fp = org_fp; ++ goto out_addrs; ++ } ++ } ++ + /* + * Pretend to build prologue, given the features we've seen. This will + * update ctgtx.idx as it pretends to output instructions, then we can +-- +2.20.1 + diff --git a/queue-5.3/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch b/queue-5.3/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch new file mode 100644 index 00000000000..a996b143230 --- /dev/null +++ b/queue-5.3/pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch @@ -0,0 +1,40 @@ +From 50cf1f85b01bcd96da2bf4aa685fa3d10cba1940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2019 21:22:18 +0200 +Subject: pwm: bcm-iproc: Prevent unloading the driver module while in use +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 24906a41eecb73d51974ade0847c21e429beec60 ] + +The owner member of struct pwm_ops must be set to THIS_MODULE to +increase the reference count of the module such that the module cannot +be removed while its code is in use. + +Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller") +Signed-off-by: Uwe Kleine-König +Reviewed-by: Florian Fainelli +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-bcm-iproc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index d961a8207b1cb..31b01035d0ab3 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -187,6 +187,7 @@ static int iproc_pwmc_apply(struct pwm_chip *chip, struct pwm_device *pwm, + static const struct pwm_ops iproc_pwm_ops = { + .apply = iproc_pwmc_apply, + .get_state = iproc_pwmc_get_state, ++ .owner = THIS_MODULE, + }; + + static int iproc_pwmc_probe(struct platform_device *pdev) +-- +2.20.1 + diff --git a/queue-5.3/reset-fix-memory-leak-in-reset_control_array_put.patch b/queue-5.3/reset-fix-memory-leak-in-reset_control_array_put.patch new file mode 100644 index 00000000000..ce471d12e51 --- /dev/null +++ b/queue-5.3/reset-fix-memory-leak-in-reset_control_array_put.patch @@ -0,0 +1,55 @@ +From 57d2b264a1a3b351e73ec2aeb479bf393874bb54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 14:06:23 +0530 +Subject: reset: Fix memory leak in reset_control_array_put() + +From: Kishon Vijay Abraham I + +[ Upstream commit 532f9cd6ee994ed10403e856ca27501428048597 ] + +Memory allocated for 'struct reset_control_array' in +of_reset_control_array_get() is never freed in +reset_control_array_put() resulting in kmemleak showing +the following backtrace. + + backtrace: + [<00000000c5f17595>] __kmalloc+0x1b0/0x2b0 + [<00000000bd499e13>] of_reset_control_array_get+0xa4/0x180 + [<000000004cc02754>] 0xffff800008c669e4 + [<0000000050a83b24>] platform_drv_probe+0x50/0xa0 + [<00000000d3a0b0bc>] really_probe+0x108/0x348 + [<000000005aa458ac>] driver_probe_device+0x58/0x100 + [<000000008853626c>] device_driver_attach+0x6c/0x90 + [<0000000085308d19>] __driver_attach+0x84/0xc8 + [<00000000080d35f2>] bus_for_each_dev+0x74/0xc8 + [<00000000dd7f015b>] driver_attach+0x20/0x28 + [<00000000923ba6e6>] bus_add_driver+0x148/0x1f0 + [<0000000061473b66>] driver_register+0x60/0x110 + [<00000000c5bec167>] __platform_driver_register+0x40/0x48 + [<000000007c764b4f>] 0xffff800008c6c020 + [<0000000047ec2e8c>] do_one_initcall+0x5c/0x1b0 + [<0000000093d4b50d>] do_init_module+0x54/0x1d0 + +Fixes: 17c82e206d2a ("reset: Add APIs to manage array of resets") +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 213ff40dda110..36b1ff69b1e2a 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -748,6 +748,7 @@ static void reset_control_array_put(struct reset_control_array *resets) + for (i = 0; i < resets->num_rstcs; i++) + __reset_control_put_internal(resets->rstc[i]); + mutex_unlock(&reset_list_mutex); ++ kfree(resets); + } + + /** +-- +2.20.1 + diff --git a/queue-5.3/reset-fix-reset_control_ops-kerneldoc-comment.patch b/queue-5.3/reset-fix-reset_control_ops-kerneldoc-comment.patch new file mode 100644 index 00000000000..640ee6ad562 --- /dev/null +++ b/queue-5.3/reset-fix-reset_control_ops-kerneldoc-comment.patch @@ -0,0 +1,35 @@ +From 6235cf6ddf236a21608ed8027aa2857a9ea21470 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Oct 2019 20:57:06 -0700 +Subject: reset: fix reset_control_ops kerneldoc comment + +From: Randy Dunlap + +[ Upstream commit f430c7ed8bc22992ed528b518da465b060b9223f ] + +Add a missing short description to the reset_control_ops documentation. + +Signed-off-by: Randy Dunlap +[p.zabel@pengutronix.de: rebased and updated commit message] +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + include/linux/reset-controller.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/reset-controller.h b/include/linux/reset-controller.h +index 9326d671b6e6c..8675ec64987bb 100644 +--- a/include/linux/reset-controller.h ++++ b/include/linux/reset-controller.h +@@ -7,7 +7,7 @@ + struct reset_controller_dev; + + /** +- * struct reset_control_ops ++ * struct reset_control_ops - reset controller driver callbacks + * + * @reset: for self-deasserting resets, does all necessary + * things to reset the device +-- +2.20.1 + diff --git a/queue-5.3/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch b/queue-5.3/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch new file mode 100644 index 00000000000..6fec53133ae --- /dev/null +++ b/queue-5.3/samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch @@ -0,0 +1,47 @@ +From f22c05c7196211dc3fbb48b258b7cfb5d725ea39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 13:33:07 +0200 +Subject: samples/bpf: fix build by setting HAVE_ATTR_TEST to zero +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 04ec044b7d30800296824783df7d9728d16d7567 ] + +To remove that test_attr__{enabled/open} are used by perf-sys.h, we +set HAVE_ATTR_TEST to zero. + +Signed-off-by: Björn Töpel +Tested-by: KP Singh +Acked-by: Song Liu +Cc: Adrian Hunter +Cc: Alexei Starovoitov +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Daniel Borkmann +Link: http://lore.kernel.org/bpf/20191001113307.27796-3-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + samples/bpf/Makefile | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile +index 1d9be26b4edd7..42b571cde1778 100644 +--- a/samples/bpf/Makefile ++++ b/samples/bpf/Makefile +@@ -176,6 +176,7 @@ KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/bpf/ + KBUILD_HOSTCFLAGS += -I$(srctree)/tools/testing/selftests/bpf/ + KBUILD_HOSTCFLAGS += -I$(srctree)/tools/lib/ -I$(srctree)/tools/include + KBUILD_HOSTCFLAGS += -I$(srctree)/tools/perf ++KBUILD_HOSTCFLAGS += -DHAVE_ATTR_TEST=0 + + HOSTCFLAGS_bpf_load.o += -I$(objtree)/usr/include -Wno-unused-variable + +-- +2.20.1 + diff --git a/queue-5.3/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch b/queue-5.3/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch new file mode 100644 index 00000000000..7752e207540 --- /dev/null +++ b/queue-5.3/scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch @@ -0,0 +1,59 @@ +From 406ed3e3d140daf5dfe1eaf1ef6af3e53c540aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Nov 2019 21:17:06 -0800 +Subject: scripts/gdb: fix debugging modules compiled with hot/cold + partitioning + +From: Ilya Leoshkevich + +[ Upstream commit 8731acc5068eb3f422a45c760d32198175c756f8 ] + +gcc's -freorder-blocks-and-partition option makes it group frequently +and infrequently used code in .text.hot and .text.unlikely sections +respectively. At least when building modules on s390, this option is +used by default. + +gdb assumes that all code is located in .text section, and that .text +section is located at module load address. With such modules this is no +longer the case: there is code in .text.hot and .text.unlikely, and +either of them might precede .text. + +Fix by explicitly telling gdb the addresses of code sections. + +It might be tempting to do this for all sections, not only the ones in +the white list. Unfortunately, gdb appears to have an issue, when +telling it about e.g. loadable .note.gnu.build-id section causes it to +think that non-loadable .note.Linux section is loaded at address 0, +which in turn causes NULL pointers to be resolved to bogus symbols. So +keep using the white list approach for the time being. + +Link: http://lkml.kernel.org/r/20191028152734.13065-1-iii@linux.ibm.com +Signed-off-by: Ilya Leoshkevich +Reviewed-by: Jan Kiszka +Cc: Kieran Bingham +Cc: Heiko Carstens +Cc: Vasily Gorbik +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/symbols.py | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/scripts/gdb/linux/symbols.py b/scripts/gdb/linux/symbols.py +index 2f5b95f09fa03..3c29504302896 100644 +--- a/scripts/gdb/linux/symbols.py ++++ b/scripts/gdb/linux/symbols.py +@@ -99,7 +99,8 @@ lx-symbols command.""" + attrs[n]['name'].string(): attrs[n]['address'] + for n in range(int(sect_attrs['nsections']))} + args = [] +- for section_name in [".data", ".data..read_mostly", ".rodata", ".bss"]: ++ for section_name in [".data", ".data..read_mostly", ".rodata", ".bss", ++ ".text", ".text.hot", ".text.unlikely"]: + address = section_name_to_address.get(section_name) + if address: + args.append(" -s {name} {addr}".format( +-- +2.20.1 + diff --git a/queue-5.3/series b/queue-5.3/series index 701544c872e..e141d43549f 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -1,3 +1,96 @@ io_uring-async-workers-should-inherit-the-user-creds.patch net-separate-out-the-msghdr-copy-from-___sys_-send-r.patch net-disallow-ancillary-data-for-__sys_-send-recv-msg.patch +xarray-fix-xas_next-with-a-single-entry-at-0.patch +clk-meson-gxbb-let-sar_adc_clk_div-set-the-parent-cl.patch +clk-at91-sam9x60-fix-programmable-clock.patch +thunderbolt-read-dp-in-adapter-first-two-dwords-in-o.patch +thunderbolt-fix-lockdep-circular-locking-depedency-w.patch +clocksource-drivers-mediatek-fix-error-handling.patch +soundwire-intel-fix-intel_register_dai-pdi-offsets-a.patch +asoc-msm8916-wcd-analog-fix-rx1-selection-in-rdac2-m.patch +asoc-compress-fix-unsigned-integer-overflow-check.patch +reset-fix-memory-leak-in-reset_control_array_put.patch +clk-samsung-exynos5433-fix-error-paths.patch +clk-samsung-exynos542x-move-g3d-subsystem-clocks-to-.patch +asoc-kirkwood-fix-external-clock-probe-defer.patch +asoc-kirkwood-fix-device-remove-ordering.patch +arm64-dts-ls1028a-fix-a-compatible-issue.patch +clk-samsung-exynos5420-preserve-pll-configuration-du.patch +pinctrl-cherryview-allocate-irq-chip-dynamic.patch +arm-dts-imx6qdl-sabreauto-fix-storm-of-accelerometer.patch +soc-imx-gpc-fix-initialiser-format.patch +reset-fix-reset_control_ops-kerneldoc-comment.patch +arm64-dts-imx8mm-fix-compatible-string-for-sdma.patch +asoc-sof-ipc-fix-memory-leak-in-sof_set_get_large_ct.patch +asoc-ti-sdma-pcm-add-back-the-flags-parameter-for-no.patch +asoc-rockchip-rockchip_max98090-enable-shdn-to-fix-h.patch +clk-at91-avoid-sleeping-early.patch +clk-sunxi-fix-operator-precedence-in-sunxi_divs_clk_.patch +clk-sunxi-ng-a80-fix-the-zero-ing-of-bits-16-and-18.patch +arm-dts-sun8i-a83t-tbs-a711-fix-wifi-resume-from-sus.patch +bpf-allow-narrow-loads-of-bpf_sysctl-fields-with-off.patch +samples-bpf-fix-build-by-setting-have_attr_test-to-z.patch +bpf-change-size-to-u64-for-bpf_map_-area_alloc-charg.patch +powerpc-bpf-fix-tail-call-implementation.patch +idr-fix-idr_get_next_ul-race-with-idr_remove.patch +idr-fix-integer-overflow-in-idr_for_each_entry.patch +idr-fix-idr_alloc_u32-on-32-bit-systems.patch +x86-resctrl-prevent-null-pointer-dereference-when-re.patch +arm64-dts-zii-ultra-fix-arm-regulator-gpio-handle.patch +fbdev-c2p-fix-link-failure-on-non-inlining.patch +asoc-hdac_hda-fix-race-in-device-removal.patch +clk-ti-dra7-atl-clock-remove-ti_clk_add_alias-call.patch +clk-ti-clkctrl-fix-failed-to-enable-error-with-doubl.patch +net-fec-add-missed-clk_disable_unprepare-in-remove.patch +netfilter-ipset-fix-nla_policies-to-fully-support-nl.patch +bridge-ebtables-don-t-crash-when-using-dnat-target-i.patch +netfilter-nf_tables-bogus-eopnotsupp-on-basechain-up.patch +netfilter-nf_tables_offload-skip-ebusy-on-chain-upda.patch +stacktrace-don-t-skip-first-entry-on-noncurrent-task.patch +can-peak_usb-report-bus-recovery-as-well.patch +can-c_can-d_can-c_can_chip_config-perform-a-sofware-.patch +can-rx-offload-can_rx_offload_queue_tail-fix-error-h.patch +can-rx-offload-can_rx_offload_offload_one-do-not-inc.patch +can-rx-offload-can_rx_offload_offload_one-increment-.patch +can-rx-offload-can_rx_offload_offload_one-use-err_pt.patch +can-rx-offload-can_rx_offload_irq_offload_timestamp-.patch +can-rx-offload-can_rx_offload_irq_offload_fifo-conti.patch +can-flexcan-increase-error-counters-if-skb-enqueuein.patch +x86-tsc-respect-tsc-command-line-paraemeter-for-cloc.patch +perf-scripting-engines-iterate-on-tep-event-arrays-d.patch +can-mcp251x-mcp251x_restart_work_handler-fix-potenti.patch +nvme-rdma-fix-a-segmentation-fault-during-module-unl.patch +nvme-multipath-fix-crash-in-nvme_mpath_clear_ctrl_pa.patch +watchdog-pm8916_wdt-fix-pretimeout-registration-flow.patch +watchdog-meson-fix-the-wrong-value-of-left-time.patch +watchdog-imx_sc_wdt-pretimeout-should-follow-scu-fir.patch +watchdog-bd70528-add-module_alias-to-allow-module-au.patch +asoc-stm32-sai-add-restriction-on-mmap-support.patch +alsa-hda-hdmi-add-tigerlake-support.patch +arm-dts-stm32-fix-can-ram-mapping-on-stm32mp157c.patch +asoc-sof-topology-fix-bytes-control-size-checks.patch +mm-gup_benchmark-fix-map_hugetlb-case.patch +scripts-gdb-fix-debugging-modules-compiled-with-hot-.patch +net-bcmgenet-use-rgmii-loopback-for-mac-reset.patch +net-bcmgenet-reapply-manual-settings-to-the-phy.patch +drm-amdgpu-dont-schedule-jobs-while-in-reset.patch +net-mlx5e-fix-eswitch-debug-print-of-max-fdb-flow.patch +net-mlx5e-use-correct-enum-to-determine-uplink-port.patch +net-mscc-ocelot-fix-__ocelot_rmw_ix-prototype.patch +drm-amd-swsmu-fix-smu-workload-bit-map-error.patch +drm-amdgpu-register-gpu-instance-before-fan-boost-fe.patch +drm-amdgpu-add-warning-for-grbm-1-cycle-delay-issue-.patch +net-stmmac-gmac4-bitrev32-returns-u32.patch +net-stmmac-xgmac-bitrev32-returns-u32.patch +net-stmmac-xgmac-fix-tsa-selection.patch +net-stmmac-xgmac-disable-flow-control-when-1-or-more.patch +ceph-return-einval-if-given-fsc-mount-option-on-kern.patch +mac80211-fix-ieee80211_txq_setup_flows-failure-path.patch +net-fq_impl-switch-to-kvmalloc-for-memory-allocation.patch +mac80211-fix-station-inactive_time-shortly-after-boo.patch +block-drbd-remove-a-stray-unlock-in-__drbd_send_prot.patch +pwm-bcm-iproc-prevent-unloading-the-driver-module-wh.patch +ice-fix-potential-infinite-loop-because-loop-counter.patch +iavf-initialize-itrn-registers-with-correct-values.patch +i40e-fix-for-ethtool-m-issue-on-x722-nic.patch diff --git a/queue-5.3/soc-imx-gpc-fix-initialiser-format.patch b/queue-5.3/soc-imx-gpc-fix-initialiser-format.patch new file mode 100644 index 00000000000..ee293b2f99f --- /dev/null +++ b/queue-5.3/soc-imx-gpc-fix-initialiser-format.patch @@ -0,0 +1,67 @@ +From 7518a65f69026c217e4ed999182105052cb8c172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2019 15:09:09 +0100 +Subject: soc: imx: gpc: fix initialiser format + +From: Ben Dooks + +[ Upstream commit 96ed1044fa98ea9e164fc1e679cad61575bf4f32 ] + +Make the initialiers in imx_gpc_domains C99 format to fix the +following sparse warnings: + +drivers/soc/imx/gpc.c:252:30: warning: obsolete array initializer, use C99 syntax +drivers/soc/imx/gpc.c:258:29: warning: obsolete array initializer, use C99 syntax +drivers/soc/imx/gpc.c:269:34: warning: obsolete array initializer, use C99 syntax +drivers/soc/imx/gpc.c:278:30: warning: obsolete array initializer, use C99 syntax + +Signed-off-by: Ben Dooks +Reviewed-by: Lucas Stach +Fixes: b0682d485f12 ("soc: imx: gpc: use GPC_PGC_DOMAIN_* indexes") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/gpc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c +index d9231bd3c691a..98b9d9a902ae3 100644 +--- a/drivers/soc/imx/gpc.c ++++ b/drivers/soc/imx/gpc.c +@@ -249,13 +249,13 @@ static struct genpd_power_state imx6_pm_domain_pu_state = { + }; + + static struct imx_pm_domain imx_gpc_domains[] = { +- [GPC_PGC_DOMAIN_ARM] { ++ [GPC_PGC_DOMAIN_ARM] = { + .base = { + .name = "ARM", + .flags = GENPD_FLAG_ALWAYS_ON, + }, + }, +- [GPC_PGC_DOMAIN_PU] { ++ [GPC_PGC_DOMAIN_PU] = { + .base = { + .name = "PU", + .power_off = imx6_pm_domain_power_off, +@@ -266,7 +266,7 @@ static struct imx_pm_domain imx_gpc_domains[] = { + .reg_offs = 0x260, + .cntr_pdn_bit = 0, + }, +- [GPC_PGC_DOMAIN_DISPLAY] { ++ [GPC_PGC_DOMAIN_DISPLAY] = { + .base = { + .name = "DISPLAY", + .power_off = imx6_pm_domain_power_off, +@@ -275,7 +275,7 @@ static struct imx_pm_domain imx_gpc_domains[] = { + .reg_offs = 0x240, + .cntr_pdn_bit = 4, + }, +- [GPC_PGC_DOMAIN_PCI] { ++ [GPC_PGC_DOMAIN_PCI] = { + .base = { + .name = "PCI", + .power_off = imx6_pm_domain_power_off, +-- +2.20.1 + diff --git a/queue-5.3/soundwire-intel-fix-intel_register_dai-pdi-offsets-a.patch b/queue-5.3/soundwire-intel-fix-intel_register_dai-pdi-offsets-a.patch new file mode 100644 index 00000000000..cd8606052d6 --- /dev/null +++ b/queue-5.3/soundwire-intel-fix-intel_register_dai-pdi-offsets-a.patch @@ -0,0 +1,53 @@ +From c4cbf6519e27fe96e8ed2e8789ff3cf6a42288ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2019 14:23:43 -0500 +Subject: soundwire: intel: fix intel_register_dai PDI offsets and numbers + +From: Bard Liao + +[ Upstream commit cf9249626f72878b6d205a4965093cba5cce98df ] + +There are two issues, likely copy/paste: + +1. Use cdns->pcm.num_in instead of stream_num_in for consistency with +the rest of the code. This was not detected earlier since platforms did +not have input-only PDIs. + +2. use the correct offset for bi-dir PDM, based on IN and OUT +PDIs. Again this was not detected since PDM was not supported earlier. + +Reported-by: Ranjani Sridharan +Signed-off-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20190916192348.467-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/intel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c +index ec25a71d08873..db9c138adb1ff 100644 +--- a/drivers/soundwire/intel.c ++++ b/drivers/soundwire/intel.c +@@ -765,7 +765,7 @@ static int intel_register_dai(struct sdw_intel *sdw) + /* Create PCM DAIs */ + stream = &cdns->pcm; + +- ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, stream->num_in, ++ ret = intel_create_dai(cdns, dais, INTEL_PDI_IN, cdns->pcm.num_in, + off, stream->num_ch_in, true); + if (ret) + return ret; +@@ -796,7 +796,7 @@ static int intel_register_dai(struct sdw_intel *sdw) + if (ret) + return ret; + +- off += cdns->pdm.num_bd; ++ off += cdns->pdm.num_out; + ret = intel_create_dai(cdns, dais, INTEL_PDI_BD, cdns->pdm.num_bd, + off, stream->num_ch_bd, false); + if (ret) +-- +2.20.1 + diff --git a/queue-5.3/stacktrace-don-t-skip-first-entry-on-noncurrent-task.patch b/queue-5.3/stacktrace-don-t-skip-first-entry-on-noncurrent-task.patch new file mode 100644 index 00000000000..598f5218da3 --- /dev/null +++ b/queue-5.3/stacktrace-don-t-skip-first-entry-on-noncurrent-task.patch @@ -0,0 +1,57 @@ +From 4dad81d2d3579335d4633731b6d3d7ad02f79a5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Oct 2019 08:25:45 +0100 +Subject: stacktrace: Don't skip first entry on noncurrent tasks + +From: Jiri Slaby + +[ Upstream commit b0c51f158455e31d5024100cf3580fcd88214b0e ] + +When doing cat /proc//stack, the output is missing the first entry. +When the current code walks the stack starting in stack_trace_save_tsk, +it skips all scheduler functions (that's OK) plus one more function. But +this one function should be skipped only for the 'current' task as it is +stack_trace_save_tsk proper. + +The original code (before the common infrastructure) skipped one +function only for the 'current' task -- see save_stack_trace_tsk before +3599fe12a125. So do so also in the new infrastructure now. + +Fixes: 214d8ca6ee85 ("stacktrace: Provide common infrastructure") +Signed-off-by: Jiri Slaby +Signed-off-by: Thomas Gleixner +Tested-by: Michal Suchanek +Acked-by: Josh Poimboeuf +Link: https://lkml.kernel.org/r/20191030072545.19462-1-jslaby@suse.cz +Signed-off-by: Sasha Levin +--- + kernel/stacktrace.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/stacktrace.c b/kernel/stacktrace.c +index f5440abb75329..9bbfbdb96ae51 100644 +--- a/kernel/stacktrace.c ++++ b/kernel/stacktrace.c +@@ -141,7 +141,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *tsk, unsigned long *store, + struct stacktrace_cookie c = { + .store = store, + .size = size, +- .skip = skipnr + 1, ++ /* skip this function if they are tracing us */ ++ .skip = skipnr + !!(current == tsk), + }; + + if (!try_get_task_stack(tsk)) +@@ -298,7 +299,8 @@ unsigned int stack_trace_save_tsk(struct task_struct *task, + struct stack_trace trace = { + .entries = store, + .max_entries = size, +- .skip = skipnr + 1, ++ /* skip this function if they are tracing us */ ++ .skip = skipnr + !!(current == task), + }; + + save_stack_trace_tsk(task, &trace); +-- +2.20.1 + diff --git a/queue-5.3/thunderbolt-fix-lockdep-circular-locking-depedency-w.patch b/queue-5.3/thunderbolt-fix-lockdep-circular-locking-depedency-w.patch new file mode 100644 index 00000000000..e19e6f21ab0 --- /dev/null +++ b/queue-5.3/thunderbolt-fix-lockdep-circular-locking-depedency-w.patch @@ -0,0 +1,133 @@ +From 68a7049bcc641c6a732d13688b6aa1bd590ee4eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2019 15:28:58 +0300 +Subject: thunderbolt: Fix lockdep circular locking depedency warning + +From: Mika Westerberg + +[ Upstream commit 6f6709734274aef75058356e029d5e8f86d0d53b ] + +When lockdep is enabled, plugging Thunderbolt dock on Dominik's laptop +triggers following splat: + + ====================================================== + WARNING: possible circular locking dependency detected + 5.3.0-rc6+ #1 Tainted: G T + ------------------------------------------------------ + pool-/usr/lib/b/1258 is trying to acquire lock: + 000000005ab0ad43 (pci_rescan_remove_lock){+.+.}, at: authorized_store+0xe8/0x210 + + but task is already holding lock: + 00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (&tb->lock){+.+.}: + __mutex_lock+0xac/0x9a0 + tb_domain_add+0x2d/0x130 + nhi_probe+0x1dd/0x330 + pci_device_probe+0xd2/0x150 + really_probe+0xee/0x280 + driver_probe_device+0x50/0xc0 + bus_for_each_drv+0x84/0xd0 + __device_attach+0xe4/0x150 + pci_bus_add_device+0x4e/0x70 + pci_bus_add_devices+0x2e/0x66 + pci_bus_add_devices+0x59/0x66 + pci_bus_add_devices+0x59/0x66 + enable_slot+0x344/0x450 + acpiphp_check_bridge.part.0+0x119/0x150 + acpiphp_hotplug_notify+0xaa/0x140 + acpi_device_hotplug+0xa2/0x3f0 + acpi_hotplug_work_fn+0x1a/0x30 + process_one_work+0x234/0x580 + worker_thread+0x50/0x3b0 + kthread+0x10a/0x140 + ret_from_fork+0x3a/0x50 + + -> #0 (pci_rescan_remove_lock){+.+.}: + __lock_acquire+0xe54/0x1ac0 + lock_acquire+0xb8/0x1b0 + __mutex_lock+0xac/0x9a0 + authorized_store+0xe8/0x210 + kernfs_fop_write+0x125/0x1b0 + vfs_write+0xc2/0x1d0 + ksys_write+0x6c/0xf0 + do_syscall_64+0x50/0x180 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + + other info that might help us debug this: + Possible unsafe locking scenario: + CPU0 CPU1 + ---- ---- + lock(&tb->lock); + lock(pci_rescan_remove_lock); + lock(&tb->lock); + lock(pci_rescan_remove_lock); + + *** DEADLOCK *** + 5 locks held by pool-/usr/lib/b/1258: + #0: 000000003df1a1ad (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x4d/0x60 + #1: 0000000095a40b02 (sb_writers#6){.+.+}, at: vfs_write+0x185/0x1d0 + #2: 0000000017a7d714 (&of->mutex){+.+.}, at: kernfs_fop_write+0xf2/0x1b0 + #3: 000000004f262981 (kn->count#208){.+.+}, at: kernfs_fop_write+0xfa/0x1b0 + #4: 00000000bfb796b5 (&tb->lock){+.+.}, at: authorized_store+0x7c/0x210 + + stack backtrace: + CPU: 0 PID: 1258 Comm: pool-/usr/lib/b Tainted: G T 5.3.0-rc6+ #1 + +On an system using ACPI hotplug the host router gets hotplugged first and then +the firmware starts sending notifications about connected devices so the above +scenario should not happen in reality. However, after taking a second +look at commit a03e828915c0 ("thunderbolt: Serialize PCIe tunnel +creation with PCI rescan") that introduced the locking, I don't think it +is actually correct. It may have cured the symptom but probably the real +root cause was somewhere closer to PCI stack and possibly is already +fixed with recent kernels. I also tried to reproduce the original issue +with the commit reverted but could not. + +So to keep lockdep happy and the code bit less complex drop calls to +pci_lock_rescan_remove()/pci_unlock_rescan_remove() in +tb_switch_set_authorized() effectively reverting a03e828915c0. + +Link: https://lkml.org/lkml/2019/8/30/513 +Fixes: a03e828915c0 ("thunderbolt: Serialize PCIe tunnel creation with PCI rescan") +Reported-by: Dominik Brodowski +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/switch.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 00daf5a7f46a5..28395c3dcfed5 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -1025,13 +1025,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val) + if (sw->authorized) + goto unlock; + +- /* +- * Make sure there is no PCIe rescan ongoing when a new PCIe +- * tunnel is created. Otherwise the PCIe rescan code might find +- * the new tunnel too early. +- */ +- pci_lock_rescan_remove(); +- + switch (val) { + /* Approve switch */ + case 1: +@@ -1051,8 +1044,6 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val) + break; + } + +- pci_unlock_rescan_remove(); +- + if (!ret) { + sw->authorized = val; + /* Notify status change to the userspace */ +-- +2.20.1 + diff --git a/queue-5.3/thunderbolt-read-dp-in-adapter-first-two-dwords-in-o.patch b/queue-5.3/thunderbolt-read-dp-in-adapter-first-two-dwords-in-o.patch new file mode 100644 index 00000000000..97346e5ff1f --- /dev/null +++ b/queue-5.3/thunderbolt-read-dp-in-adapter-first-two-dwords-in-o.patch @@ -0,0 +1,95 @@ +From c81e5bd708e346df613651370758444d36016ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Sep 2019 14:55:23 +0300 +Subject: thunderbolt: Read DP IN adapter first two dwords in one go + +From: Mika Westerberg + +[ Upstream commit fd5c46b754d4799afda8dcdd6851e0390aa4961a ] + +When we discover existing DP tunnels the code checks whether DP IN +adapter port is enabled by calling tb_dp_port_is_enabled() before it +continues the discovery process. On Light Ridge (gen 1) controller +reading only the first dword of the DP IN config space causes subsequent +access to the same DP IN port path config space to fail or return +invalid data as can be seen in the below splat: + + thunderbolt 0000:07:00.0: CFG_ERROR(0:d): Invalid config space or offset + Call Trace: + tb_cfg_read+0xb9/0xd0 + __tb_path_deactivate_hop+0x98/0x210 + tb_path_activate+0x228/0x7d0 + tb_tunnel_restart+0x95/0x200 + tb_handle_hotplug+0x30e/0x630 + process_one_work+0x1b4/0x340 + worker_thread+0x44/0x3d0 + kthread+0xeb/0x120 + ? process_one_work+0x340/0x340 + ? kthread_park+0xa0/0xa0 + ret_from_fork+0x1f/0x30 + +If both DP In adapter config dwords are read in one go the issue does +not reproduce. This is likely firmware bug but we can work it around by +always reading the two dwords in one go. There should be no harm for +other controllers either so can do it unconditionally. + +Link: https://lkml.org/lkml/2019/8/28/160 +Reported-by: Brad Campbell +Tested-by: Brad Campbell +Signed-off-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/thunderbolt/switch.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 5668a44e0653b..00daf5a7f46a5 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -887,12 +887,13 @@ int tb_dp_port_set_hops(struct tb_port *port, unsigned int video, + */ + bool tb_dp_port_is_enabled(struct tb_port *port) + { +- u32 data; ++ u32 data[2]; + +- if (tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1)) ++ if (tb_port_read(port, data, TB_CFG_PORT, port->cap_adap, ++ ARRAY_SIZE(data))) + return false; + +- return !!(data & (TB_DP_VIDEO_EN | TB_DP_AUX_EN)); ++ return !!(data[0] & (TB_DP_VIDEO_EN | TB_DP_AUX_EN)); + } + + /** +@@ -905,19 +906,21 @@ bool tb_dp_port_is_enabled(struct tb_port *port) + */ + int tb_dp_port_enable(struct tb_port *port, bool enable) + { +- u32 data; ++ u32 data[2]; + int ret; + +- ret = tb_port_read(port, &data, TB_CFG_PORT, port->cap_adap, 1); ++ ret = tb_port_read(port, data, TB_CFG_PORT, port->cap_adap, ++ ARRAY_SIZE(data)); + if (ret) + return ret; + + if (enable) +- data |= TB_DP_VIDEO_EN | TB_DP_AUX_EN; ++ data[0] |= TB_DP_VIDEO_EN | TB_DP_AUX_EN; + else +- data &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN); ++ data[0] &= ~(TB_DP_VIDEO_EN | TB_DP_AUX_EN); + +- return tb_port_write(port, &data, TB_CFG_PORT, port->cap_adap, 1); ++ return tb_port_write(port, data, TB_CFG_PORT, port->cap_adap, ++ ARRAY_SIZE(data)); + } + + /* switch utility functions */ +-- +2.20.1 + diff --git a/queue-5.3/watchdog-bd70528-add-module_alias-to-allow-module-au.patch b/queue-5.3/watchdog-bd70528-add-module_alias-to-allow-module-au.patch new file mode 100644 index 00000000000..817ea28f472 --- /dev/null +++ b/queue-5.3/watchdog-bd70528-add-module_alias-to-allow-module-au.patch @@ -0,0 +1,35 @@ +From 75640551116dab85272284bae50c578f2e4155cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2019 15:41:59 +0300 +Subject: watchdog: bd70528: Add MODULE_ALIAS to allow module auto loading + +From: Matti Vaittinen + +[ Upstream commit 81363f248aecd2b5f10547af268a4dfaf8963489 ] + +The bd70528 watchdog driver is probed by MFD driver. Add MODULE_ALIAS +in order to allow udev to load the module when MFD sub-device cell for +watchdog is added. + +Fixes: bbc88a0ec9f37 ("watchdog: bd70528: Initial support for ROHM BD70528 watchdog block") +Signed-off-by: Matti Vaittinen +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/bd70528_wdt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/bd70528_wdt.c b/drivers/watchdog/bd70528_wdt.c +index b0152fef4fc7e..bc60e036627af 100644 +--- a/drivers/watchdog/bd70528_wdt.c ++++ b/drivers/watchdog/bd70528_wdt.c +@@ -288,3 +288,4 @@ module_platform_driver(bd70528_wdt); + MODULE_AUTHOR("Matti Vaittinen "); + MODULE_DESCRIPTION("BD70528 watchdog driver"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS("platform:bd70528-wdt"); +-- +2.20.1 + diff --git a/queue-5.3/watchdog-imx_sc_wdt-pretimeout-should-follow-scu-fir.patch b/queue-5.3/watchdog-imx_sc_wdt-pretimeout-should-follow-scu-fir.patch new file mode 100644 index 00000000000..2e826789f42 --- /dev/null +++ b/queue-5.3/watchdog-imx_sc_wdt-pretimeout-should-follow-scu-fir.patch @@ -0,0 +1,46 @@ +From 106ed3e7bf15108651711e733c5ab17ce65b3aaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2019 15:37:47 +0800 +Subject: watchdog: imx_sc_wdt: Pretimeout should follow SCU firmware format + +From: Anson Huang + +[ Upstream commit 2c50a6b825b3463a7600d6e6acadba73211c3d2c ] + +SCU firmware calculates pretimeout based on current time stamp +instead of watchdog timeout stamp, need to convert the pretimeout +to SCU firmware's timeout value. + +Fixes: 15f7d7fc5542 ("watchdog: imx_sc: Add pretimeout support") +Signed-off-by: Anson Huang +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx_sc_wdt.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c +index 78eaaf75a263f..9545d1e07421a 100644 +--- a/drivers/watchdog/imx_sc_wdt.c ++++ b/drivers/watchdog/imx_sc_wdt.c +@@ -99,8 +99,14 @@ static int imx_sc_wdt_set_pretimeout(struct watchdog_device *wdog, + { + struct arm_smccc_res res; + ++ /* ++ * SCU firmware calculates pretimeout based on current time ++ * stamp instead of watchdog timeout stamp, need to convert ++ * the pretimeout to SCU firmware's timeout value. ++ */ + arm_smccc_smc(IMX_SIP_TIMER, IMX_SIP_TIMER_SET_PRETIME_WDOG, +- pretimeout * 1000, 0, 0, 0, 0, 0, &res); ++ (wdog->timeout - pretimeout) * 1000, 0, 0, 0, ++ 0, 0, &res); + if (res.a0) + return -EACCES; + +-- +2.20.1 + diff --git a/queue-5.3/watchdog-meson-fix-the-wrong-value-of-left-time.patch b/queue-5.3/watchdog-meson-fix-the-wrong-value-of-left-time.patch new file mode 100644 index 00000000000..586bb7ed483 --- /dev/null +++ b/queue-5.3/watchdog-meson-fix-the-wrong-value-of-left-time.patch @@ -0,0 +1,47 @@ +From f6e58b458b751422b5e9e32f1b2237f60837f8b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2019 18:53:49 +0800 +Subject: watchdog: meson: Fix the wrong value of left time + +From: Xingyu Chen + +[ Upstream commit 2c77734642d52448aca673e889b39f981110828b ] + +The left time value is wrong when we get it by sysfs. The left time value +should be equal to preset timeout value minus elapsed time value. According +to the Meson-GXB/GXL datasheets which can be found at [0], the timeout value +is saved to BIT[0-15] of the WATCHDOG_TCNT, and elapsed time value is saved +to BIT[16-31] of the WATCHDOG_TCNT. + +[0]: http://linux-meson.com + +Fixes: 683fa50f0e18 ("watchdog: Add Meson GXBB Watchdog Driver") +Signed-off-by: Xingyu Chen +Acked-by: Neil Armstrong +Reviewed-by: Kevin Hilman +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/meson_gxbb_wdt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/meson_gxbb_wdt.c b/drivers/watchdog/meson_gxbb_wdt.c +index d17c1a6ed7234..5a9ca10fbcfa0 100644 +--- a/drivers/watchdog/meson_gxbb_wdt.c ++++ b/drivers/watchdog/meson_gxbb_wdt.c +@@ -89,8 +89,8 @@ static unsigned int meson_gxbb_wdt_get_timeleft(struct watchdog_device *wdt_dev) + + reg = readl(data->reg_base + GXBB_WDT_TCNT_REG); + +- return ((reg >> GXBB_WDT_TCNT_CNT_SHIFT) - +- (reg & GXBB_WDT_TCNT_SETUP_MASK)) / 1000; ++ return ((reg & GXBB_WDT_TCNT_SETUP_MASK) - ++ (reg >> GXBB_WDT_TCNT_CNT_SHIFT)) / 1000; + } + + static const struct watchdog_ops meson_gxbb_wdt_ops = { +-- +2.20.1 + diff --git a/queue-5.3/watchdog-pm8916_wdt-fix-pretimeout-registration-flow.patch b/queue-5.3/watchdog-pm8916_wdt-fix-pretimeout-registration-flow.patch new file mode 100644 index 00000000000..77dd55872ad --- /dev/null +++ b/queue-5.3/watchdog-pm8916_wdt-fix-pretimeout-registration-flow.patch @@ -0,0 +1,61 @@ +From 424a33839da171668b496d8981a6e8150f867ebb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Sep 2019 22:30:53 +0200 +Subject: watchdog: pm8916_wdt: fix pretimeout registration flow + +From: Jorge Ramirez-Ortiz + +[ Upstream commit 1993f1d7ca3f315e0459c58c8e7038039a96dd85 ] + +When an IRQ is present in the dts, the probe function shall fail if +the interrupt can not be registered. + +The probe function shall also be retried if getting the irq is being +deferred. + +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Loic Poulain +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/pm8916_wdt.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/watchdog/pm8916_wdt.c b/drivers/watchdog/pm8916_wdt.c +index 2d3652004e39c..1213179f863c2 100644 +--- a/drivers/watchdog/pm8916_wdt.c ++++ b/drivers/watchdog/pm8916_wdt.c +@@ -163,9 +163,17 @@ static int pm8916_wdt_probe(struct platform_device *pdev) + + irq = platform_get_irq(pdev, 0); + if (irq > 0) { +- if (devm_request_irq(dev, irq, pm8916_wdt_isr, 0, "pm8916_wdt", +- wdt)) +- irq = 0; ++ err = devm_request_irq(dev, irq, pm8916_wdt_isr, 0, ++ "pm8916_wdt", wdt); ++ if (err) ++ return err; ++ ++ wdt->wdev.info = &pm8916_wdt_pt_ident; ++ } else { ++ if (irq == -EPROBE_DEFER) ++ return -EPROBE_DEFER; ++ ++ wdt->wdev.info = &pm8916_wdt_ident; + } + + /* Configure watchdog to hard-reset mode */ +@@ -177,7 +185,6 @@ static int pm8916_wdt_probe(struct platform_device *pdev) + return err; + } + +- wdt->wdev.info = (irq > 0) ? &pm8916_wdt_pt_ident : &pm8916_wdt_ident, + wdt->wdev.ops = &pm8916_wdt_ops, + wdt->wdev.parent = dev; + wdt->wdev.min_timeout = PM8916_WDT_MIN_TIMEOUT; +-- +2.20.1 + diff --git a/queue-5.3/x86-resctrl-prevent-null-pointer-dereference-when-re.patch b/queue-5.3/x86-resctrl-prevent-null-pointer-dereference-when-re.patch new file mode 100644 index 00000000000..d9856e573b5 --- /dev/null +++ b/queue-5.3/x86-resctrl-prevent-null-pointer-dereference-when-re.patch @@ -0,0 +1,59 @@ +From 520aa09cafbbc7432cd976e7d1bc03177c2825e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Oct 2019 13:25:02 +0800 +Subject: x86/resctrl: Prevent NULL pointer dereference when reading mondata + +From: Xiaochen Shen + +[ Upstream commit 26467b0f8407cbd628fa5b7bcfd156e772004155 ] + +When a mon group is being deleted, rdtgrp->flags is set to RDT_DELETED +in rdtgroup_rmdir_mon() firstly. The structure of rdtgrp will be freed +until rdtgrp->waitcount is dropped to 0 in rdtgroup_kn_unlock() later. + +During the window of deleting a mon group, if an application calls +rdtgroup_mondata_show() to read mondata under this mon group, +'rdtgrp' returned from rdtgroup_kn_lock_live() is a NULL pointer when +rdtgrp->flags is RDT_DELETED. And then 'rdtgrp' is passed in this path: +rdtgroup_mondata_show() --> mon_event_read() --> mon_event_count(). +Thus it results in NULL pointer dereference in mon_event_count(). + +Check 'rdtgrp' in rdtgroup_mondata_show(), and return -ENOENT +immediately when reading mondata during the window of deleting a mon +group. + +Fixes: d89b7379015f ("x86/intel_rdt/cqm: Add mon_data") +Signed-off-by: Xiaochen Shen +Signed-off-by: Borislav Petkov +Reviewed-by: Fenghua Yu +Reviewed-by: Tony Luck +Cc: "H. Peter Anvin" +Cc: Ingo Molnar +Cc: pei.p.jia@intel.com +Cc: Reinette Chatre +Cc: Thomas Gleixner +Cc: x86-ml +Link: https://lkml.kernel.org/r/1572326702-27577-1-git-send-email-xiaochen.shen@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c +index efbd54cc4e696..055c8613b5317 100644 +--- a/arch/x86/kernel/cpu/resctrl/ctrlmondata.c ++++ b/arch/x86/kernel/cpu/resctrl/ctrlmondata.c +@@ -522,6 +522,10 @@ int rdtgroup_mondata_show(struct seq_file *m, void *arg) + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); ++ if (!rdtgrp) { ++ ret = -ENOENT; ++ goto out; ++ } + + md.priv = of->kn->priv; + resid = md.u.rid; +-- +2.20.1 + diff --git a/queue-5.3/x86-tsc-respect-tsc-command-line-paraemeter-for-cloc.patch b/queue-5.3/x86-tsc-respect-tsc-command-line-paraemeter-for-cloc.patch new file mode 100644 index 00000000000..3cc465a06ca --- /dev/null +++ b/queue-5.3/x86-tsc-respect-tsc-command-line-paraemeter-for-cloc.patch @@ -0,0 +1,69 @@ +From ca863d68a153777a97553831b08a0cd9a14729f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Oct 2019 13:59:45 -0400 +Subject: x86/tsc: Respect tsc command line paraemeter for + clocksource_tsc_early + +From: Michael Zhivich + +[ Upstream commit 63ec58b44fcc05efd1542045abd7faf056ac27d9 ] + +The introduction of clocksource_tsc_early broke the functionality of +"tsc=reliable" and "tsc=nowatchdog" command line parameters, since +clocksource_tsc_early is unconditionally registered with +CLOCK_SOURCE_MUST_VERIFY and thus put on the watchdog list. + +This can cause the TSC to be declared unstable during boot: + + clocksource: timekeeping watchdog on CPU0: Marking clocksource + 'tsc-early' as unstable because the skew is too large: + clocksource: 'refined-jiffies' wd_now: fffb7018 wd_last: fffb6e9d + mask: ffffffff + clocksource: 'tsc-early' cs_now: 68a6a7070f6a0 cs_last: 68a69ab6f74d6 + mask: ffffffffffffffff + tsc: Marking TSC unstable due to clocksource watchdog + +The corresponding elapsed times are cs_nsec=1224152026 and wd_nsec=378942392, so +the watchdog differs from TSC by 0.84 seconds. + +This happens when HPET is not available and jiffies are used as the TSC +watchdog instead and the jiffies update is not happening due to lost timer +interrupts in periodic mode, which can happen e.g. with expensive debug +mechanisms enabled or under massive overload conditions in virtualized +environments. + +Before the introduction of the early TSC clocksource the command line +parameters "tsc=reliable" and "tsc=nowatchdog" could be used to work around +this issue. + +Restore the behaviour by disabling the watchdog if requested on the kernel +command line. + +[ tglx: Clarify changelog ] + +Fixes: aa83c45762a24 ("x86/tsc: Introduce early tsc clocksource") +Signed-off-by: Michael Zhivich +Signed-off-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/20191024175945.14338-1-mzhivich@akamai.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/tsc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index 57d87f79558f2..04dd3cc6c6edd 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -1505,6 +1505,9 @@ void __init tsc_init(void) + return; + } + ++ if (tsc_clocksource_reliable || no_tsc_watchdog) ++ clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY; ++ + clocksource_register_khz(&clocksource_tsc_early, tsc_khz); + detect_art(); + } +-- +2.20.1 + diff --git a/queue-5.3/xarray-fix-xas_next-with-a-single-entry-at-0.patch b/queue-5.3/xarray-fix-xas_next-with-a-single-entry-at-0.patch new file mode 100644 index 00000000000..969800bf917 --- /dev/null +++ b/queue-5.3/xarray-fix-xas_next-with-a-single-entry-at-0.patch @@ -0,0 +1,90 @@ +From 24ed96e22e327ea815d8bae08b49b419ac946c96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2019 17:03:29 -0400 +Subject: XArray: Fix xas_next() with a single entry at 0 + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 91abab83839aa2eba073e4a63c729832fdb27ea1 ] + +If there is only a single entry at 0, the first time we call xas_next(), +we return the entry. Unfortunately, all subsequent times we call +xas_next(), we also return the entry at 0 instead of noticing that the +xa_index is now greater than zero. This broke find_get_pages_contig(). + +Fixes: 64d3e9a9e0cc ("xarray: Step through an XArray") +Reported-by: Kent Overstreet +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + lib/test_xarray.c | 24 ++++++++++++++++++++++++ + lib/xarray.c | 4 ++++ + 2 files changed, 28 insertions(+) + +diff --git a/lib/test_xarray.c b/lib/test_xarray.c +index 9d631a7b6a705..7df4f7f395bf2 100644 +--- a/lib/test_xarray.c ++++ b/lib/test_xarray.c +@@ -1110,6 +1110,28 @@ static noinline void check_find_entry(struct xarray *xa) + XA_BUG_ON(xa, !xa_empty(xa)); + } + ++static noinline void check_move_tiny(struct xarray *xa) ++{ ++ XA_STATE(xas, xa, 0); ++ ++ XA_BUG_ON(xa, !xa_empty(xa)); ++ rcu_read_lock(); ++ XA_BUG_ON(xa, xas_next(&xas) != NULL); ++ XA_BUG_ON(xa, xas_next(&xas) != NULL); ++ rcu_read_unlock(); ++ xa_store_index(xa, 0, GFP_KERNEL); ++ rcu_read_lock(); ++ xas_set(&xas, 0); ++ XA_BUG_ON(xa, xas_next(&xas) != xa_mk_index(0)); ++ XA_BUG_ON(xa, xas_next(&xas) != NULL); ++ xas_set(&xas, 0); ++ XA_BUG_ON(xa, xas_prev(&xas) != xa_mk_index(0)); ++ XA_BUG_ON(xa, xas_prev(&xas) != NULL); ++ rcu_read_unlock(); ++ xa_erase_index(xa, 0); ++ XA_BUG_ON(xa, !xa_empty(xa)); ++} ++ + static noinline void check_move_small(struct xarray *xa, unsigned long idx) + { + XA_STATE(xas, xa, 0); +@@ -1217,6 +1239,8 @@ static noinline void check_move(struct xarray *xa) + + xa_destroy(xa); + ++ check_move_tiny(xa); ++ + for (i = 0; i < 16; i++) + check_move_small(xa, 1UL << i); + +diff --git a/lib/xarray.c b/lib/xarray.c +index 446b956c91888..1237c213f52bc 100644 +--- a/lib/xarray.c ++++ b/lib/xarray.c +@@ -994,6 +994,8 @@ void *__xas_prev(struct xa_state *xas) + + if (!xas_frozen(xas->xa_node)) + xas->xa_index--; ++ if (!xas->xa_node) ++ return set_bounds(xas); + if (xas_not_node(xas->xa_node)) + return xas_load(xas); + +@@ -1031,6 +1033,8 @@ void *__xas_next(struct xa_state *xas) + + if (!xas_frozen(xas->xa_node)) + xas->xa_index++; ++ if (!xas->xa_node) ++ return set_bounds(xas); + if (xas_not_node(xas->xa_node)) + return xas_load(xas); + +-- +2.20.1 +