From: Sasha Levin Date: Mon, 26 Aug 2019 02:40:23 +0000 (-0400) Subject: fixes for 5.2 X-Git-Tag: v4.14.141~43 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f3df57e1128d6aabe3d144da870b20529786807d;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 5.2 Signed-off-by: Sasha Levin --- diff --git a/queue-5.2/asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch b/queue-5.2/asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch new file mode 100644 index 00000000000..d98fa9f68ef --- /dev/null +++ b/queue-5.2/asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch @@ -0,0 +1,43 @@ +From 48e54cd0417880b610e30ed303cde09c56b74adb Mon Sep 17 00:00:00 2001 +From: Vijendar Mukunda +Date: Fri, 2 Aug 2019 19:21:23 +0530 +Subject: ASoC: amd: acp3x: use dma_ops of parent device for acp3x dma driver + +[ Upstream commit 88639051017fb61a414b636dd0fc490da2b62b64 ] + +AMD platform device acp3x_rv_i2s created by parent PCI device +driver. Pass struct device of the parent to +snd_pcm_lib_preallocate_pages() so dma_alloc_coherent() can use +correct dma_ops. Otherwise, it will use default dma_ops which +is nommu_dma_ops on x86_64 even when IOMMU is enabled and +set to non passthrough mode. + +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/1564753899-17124-1-git-send-email-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/raven/acp3x-pcm-dma.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c +index 9775bda2a4ca3..d8aa6ab3f68bc 100644 +--- a/sound/soc/amd/raven/acp3x-pcm-dma.c ++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c +@@ -367,9 +367,11 @@ static snd_pcm_uframes_t acp3x_dma_pointer(struct snd_pcm_substream *substream) + + static int acp3x_dma_new(struct snd_soc_pcm_runtime *rtd) + { ++ struct snd_soc_component *component = snd_soc_rtdcom_lookup(rtd, ++ DRV_NAME); ++ struct device *parent = component->dev->parent; + snd_pcm_lib_preallocate_pages_for_all(rtd->pcm, SNDRV_DMA_TYPE_DEV, +- rtd->pcm->card->dev, +- MIN_BUFFER, MAX_BUFFER); ++ parent, MIN_BUFFER, MAX_BUFFER); + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.2/asoc-audio-graph-card-add-missing-const-at-graph_get.patch b/queue-5.2/asoc-audio-graph-card-add-missing-const-at-graph_get.patch new file mode 100644 index 00000000000..55fdfd3f872 --- /dev/null +++ b/queue-5.2/asoc-audio-graph-card-add-missing-const-at-graph_get.patch @@ -0,0 +1,44 @@ +From 1f3aada3fe075634d99094dfc047328161ebf785 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Thu, 11 Jul 2019 13:10:45 +0900 +Subject: ASoC: audio-graph-card: add missing const at graph_get_dai_id() + +[ Upstream commit ec3042ad39d4e2ddbc3a3344f90bb10d8feb53bc ] + +commit c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in +graph_get_dai_id()") fixups use-after-free issue, +but, it need to use "const" for reg. This patch adds it. + +We will have below without this patch + +LINUX/sound/soc/generic/audio-graph-card.c: In function 'graph_get_dai_id': +LINUX/sound/soc/generic/audio-graph-card.c:87:7: warning: assignment discards\ + 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] + reg = of_get_property(node, "reg", NULL); + +Fixes: c152f8491a8d9 ("ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id()") +Signed-off-by: Kuninori Morimoto +Acked-by: Wen Yang +Link: https://lore.kernel.org/r/87sgrd43ja.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/audio-graph-card.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index a681ea443fc16..6398741ebd0ef 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -63,7 +63,7 @@ static int graph_get_dai_id(struct device_node *ep) + struct device_node *endpoint; + struct of_endpoint info; + int i, id; +- u32 *reg; ++ const u32 *reg; + int ret; + + /* use driver specified DAI ID if exist */ +-- +2.20.1 + diff --git a/queue-5.2/asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch b/queue-5.2/asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch new file mode 100644 index 00000000000..0cf244ea672 --- /dev/null +++ b/queue-5.2/asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch @@ -0,0 +1,47 @@ +From bd0a9f03b7cd9871fa81810fd4a7e980c0a009a2 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 10 Jul 2019 15:25:09 +0800 +Subject: ASoC: audio-graph-card: fix an use-after-free in graph_get_dai_id() + +[ Upstream commit c152f8491a8d9a4b25afd65a86eb5e55e2a8c380 ] + +After calling of_node_put() on the node variable, it is still being +used, which may result in use-after-free. +Fix this issue by calling of_node_put() after the last usage. + +Fixes: a0c426fe1433 ("ASoC: simple-card-utils: check "reg" property on asoc_simple_card_get_dai_id()") +Link: https://lore.kernel.org/r/1562743509-30496-5-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Wen Yang +Acked-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/audio-graph-card.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index d5188a179378f..a681ea443fc16 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -63,6 +63,7 @@ static int graph_get_dai_id(struct device_node *ep) + struct device_node *endpoint; + struct of_endpoint info; + int i, id; ++ u32 *reg; + int ret; + + /* use driver specified DAI ID if exist */ +@@ -83,8 +84,9 @@ static int graph_get_dai_id(struct device_node *ep) + return info.id; + + node = of_get_parent(ep); ++ reg = of_get_property(node, "reg", NULL); + of_node_put(node); +- if (of_get_property(node, "reg", NULL)) ++ if (reg) + return info.port; + } + node = of_graph_get_port_parent(ep); +-- +2.20.1 + diff --git a/queue-5.2/asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch b/queue-5.2/asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch new file mode 100644 index 00000000000..8a54a2f03ee --- /dev/null +++ b/queue-5.2/asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch @@ -0,0 +1,109 @@ +From 1b8def342f410e60183a74b2a6256508db09cd41 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 10 Jul 2019 15:25:08 +0800 +Subject: ASoC: audio-graph-card: fix use-after-free in + graph_dai_link_of_dpcm() + +[ Upstream commit aa2e362cb6b3f5ca88093ada01e1a0ace8a517b2 ] + +After calling of_node_put() on the ports, port, and node variables, +they are still being used, which may result in use-after-free. +Fix this issue by calling of_node_put() after the last usage. + +Fixes: dd98fbc558a0 ("ASoC: audio-graph-card: cleanup DAI link loop method - step1") +Link: https://lore.kernel.org/r/1562743509-30496-4-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Wen Yang +Acked-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/audio-graph-card.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/sound/soc/generic/audio-graph-card.c b/sound/soc/generic/audio-graph-card.c +index 70ed28d97d497..d5188a179378f 100644 +--- a/sound/soc/generic/audio-graph-card.c ++++ b/sound/soc/generic/audio-graph-card.c +@@ -222,10 +222,6 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + dev_dbg(dev, "link_of DPCM (%pOF)\n", ep); + +- of_node_put(ports); +- of_node_put(port); +- of_node_put(node); +- + if (li->cpu) { + int is_single_links = 0; + +@@ -243,17 +239,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_cpu(ep, dai_link, &is_single_links); + if (ret) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_clk_cpu(dev, ep, dai_link, dai); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_set_dailink_name(dev, dai_link, + "fe.%s", + dai_link->cpu_dai_name); + if (ret < 0) +- return ret; ++ goto out_put_node; + + /* card->num_links includes Codec */ + asoc_simple_canonicalize_cpu(dai_link, is_single_links); +@@ -277,17 +273,17 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_codec(ep, dai_link); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_clk_codec(dev, ep, dai_link, dai); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_set_dailink_name(dev, dai_link, + "be.%s", + codecs->dai_name); + if (ret < 0) +- return ret; ++ goto out_put_node; + + /* check "prefix" from top node */ + snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node, +@@ -307,19 +303,23 @@ static int graph_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_tdm(ep, dai); + if (ret) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_daifmt(dev, cpu_ep, codec_ep, + NULL, &dai_link->dai_fmt); + if (ret < 0) +- return ret; ++ goto out_put_node; + + dai_link->dpcm_playback = 1; + dai_link->dpcm_capture = 1; + dai_link->ops = &graph_ops; + dai_link->init = asoc_simple_dai_init; + +- return 0; ++out_put_node: ++ of_node_put(ports); ++ of_node_put(port); ++ of_node_put(node); ++ return ret; + } + + static int graph_dai_link_of(struct asoc_simple_priv *priv, +-- +2.20.1 + diff --git a/queue-5.2/asoc-dapm-fix-a-memory-leak-bug.patch b/queue-5.2/asoc-dapm-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..791717b52c3 --- /dev/null +++ b/queue-5.2/asoc-dapm-fix-a-memory-leak-bug.patch @@ -0,0 +1,41 @@ +From e6ff0657812277c1799bbe4de29f756f9c4e5470 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Mon, 22 Jul 2019 08:57:44 -0500 +Subject: ASoC: dapm: fix a memory leak bug + +[ Upstream commit 45004d66f2a28d78f543fb2ffbc133e31dc2d162 ] + +In snd_soc_dapm_new_control_unlocked(), a kernel buffer is allocated in +dapm_cnew_widget() to hold the new dapm widget. Then, different actions are +taken according to the id of the widget, i.e., 'w->id'. If any failure +occurs during this process, snd_soc_dapm_new_control_unlocked() should be +terminated by going to the 'request_failed' label. However, the allocated +kernel buffer is not freed on this code path, leading to a memory leak bug. + +To fix the above issue, free the buffer before returning from +snd_soc_dapm_new_control_unlocked() through the 'request_failed' label. + +Signed-off-by: Wenwen Wang +Link: https://lore.kernel.org/r/1563803864-2809-1-git-send-email-wang6495@umn.edu +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 835ce1ff188d9..f40adb604c25b 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3705,6 +3705,8 @@ request_failed: + dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n", + w->name, ret); + ++ kfree_const(w->sname); ++ kfree(w); + return ERR_PTR(ret); + } + +-- +2.20.1 + diff --git a/queue-5.2/asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch b/queue-5.2/asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch new file mode 100644 index 00000000000..756ff57c615 --- /dev/null +++ b/queue-5.2/asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch @@ -0,0 +1,76 @@ +From 9406ac2faa7762af4933c3b9ad5d52cb3041182d Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Thu, 18 Jul 2019 09:43:33 +0100 +Subject: ASoC: dapm: Fix handling of custom_stop_condition on DAPM graph walks + +[ Upstream commit 8dd26dff00c0636b1d8621acaeef3f6f3a39dd77 ] + +DPCM uses snd_soc_dapm_dai_get_connected_widgets to build a +list of the widgets connected to a specific front end DAI so it +can search through this list for available back end DAIs. The +custom_stop_condition was added to is_connected_ep to facilitate this +list not containing more widgets than is necessary. Doing so both +speeds up the DPCM handling as less widgets need to be searched and +avoids issues with CODEC to CODEC links as these would be confused +with back end DAIs if they appeared in the list of available widgets. + +custom_stop_condition was implemented by aborting the graph walk +when the condition is triggered, however there is an issue with this +approach. Whilst walking the graph is_connected_ep should update the +endpoints cache on each widget, if the walk is aborted the number +of attached end points is unknown for that sub-graph. When the stop +condition triggered, the original patch ignored the triggering widget +and returned zero connected end points; a later patch updated this +to set the triggering widget's cache to 1 and return that. Both of +these approaches result in inaccurate values being stored in various +end point caches as the values propagate back through the graph, +which can result in later issues with widgets powering/not powering +unexpectedly. + +As the original goal was to reduce the size of the widget list passed +to the DPCM code, the simplest solution is to limit the functionality +of the custom_stop_condition to the widget list. This means the rest +of the graph will still be processed resulting in correct end point +caches, but only widgets up to the stop condition will be added to the +returned widget list. + +Fixes: 6742064aef7f ("ASoC: dapm: support user-defined stop condition in dai_get_connected_widgets") +Fixes: 5fdd022c2026 ("ASoC: dpcm: play nice with CODEC<->CODEC links") +Fixes: 09464974eaa8 ("ASoC: dapm: Fix to return correct path list in is_connected_ep.") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20190718084333.15598-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index c91df5a9c8406..835ce1ff188d9 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -1156,8 +1156,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget, + list_add_tail(&widget->work_list, list); + + if (custom_stop_condition && custom_stop_condition(widget, dir)) { +- widget->endpoints[dir] = 1; +- return widget->endpoints[dir]; ++ list = NULL; ++ custom_stop_condition = NULL; + } + + if ((widget->is_ep & SND_SOC_DAPM_DIR_TO_EP(dir)) && widget->connected) { +@@ -1194,8 +1194,8 @@ static __always_inline int is_connected_ep(struct snd_soc_dapm_widget *widget, + * + * Optionally, can be supplied with a function acting as a stopping condition. + * This function takes the dapm widget currently being examined and the walk +- * direction as an arguments, it should return true if the walk should be +- * stopped and false otherwise. ++ * direction as an arguments, it should return true if widgets from that point ++ * in the graph onwards should not be added to the widget list. + */ + static int is_connected_output_ep(struct snd_soc_dapm_widget *widget, + struct list_head *list, +-- +2.20.1 + diff --git a/queue-5.2/asoc-fail-card-instantiation-if-dai-format-setup-fai.patch b/queue-5.2/asoc-fail-card-instantiation-if-dai-format-setup-fai.patch new file mode 100644 index 00000000000..08a852ba591 --- /dev/null +++ b/queue-5.2/asoc-fail-card-instantiation-if-dai-format-setup-fai.patch @@ -0,0 +1,40 @@ +From e449c08033911ac8709ab75eec8f898b6d6b20de Mon Sep 17 00:00:00 2001 +From: Ricard Wanderlof +Date: Wed, 24 Jul 2019 11:38:44 +0200 +Subject: ASoC: Fail card instantiation if DAI format setup fails + +[ Upstream commit 40aa5383e393d72f6aa3943a4e7b1aae25a1e43b ] + +If the DAI format setup fails, there is no valid communication format +between CPU and CODEC, so fail card instantiation, rather than continue +with a card that will most likely not function properly. + +Signed-off-by: Ricard Wanderlof +Link: https://lore.kernel.org/r/alpine.DEB.2.20.1907241132350.6338@lnxricardw1.se.axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 6aeba0d66ec50..dd0f43a1c5e14 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -1605,8 +1605,11 @@ static int soc_probe_link_dais(struct snd_soc_card *card, + } + } + +- if (dai_link->dai_fmt) +- snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt); ++ if (dai_link->dai_fmt) { ++ ret = snd_soc_runtime_set_dai_fmt(rtd, dai_link->dai_fmt); ++ if (ret) ++ return ret; ++ } + + ret = soc_post_component_init(rtd, dai_link->name); + if (ret) +-- +2.20.1 + diff --git a/queue-5.2/asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch b/queue-5.2/asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch new file mode 100644 index 00000000000..ff590f188a7 --- /dev/null +++ b/queue-5.2/asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch @@ -0,0 +1,42 @@ +From d07db774f10fb8bfd479cb65ca951d1536d41659 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Fri, 12 Jul 2019 13:27:08 +0200 +Subject: ASoC: Intel: bytcht_es8316: Add quirk for Irbis NB41 netbook + +[ Upstream commit aa2ba991c4206d5b778dcaa7b4997396e79f8e90 ] + +The Irbis NB41 netbook has its internal mic on IN2, inverted jack-detect +and stereo speakers, add a quirk for this. + +Cc: russianneuromancer@ya.ru +Reported-and-tested-by: russianneuromancer@ya.ru +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20190712112708.25327-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcht_es8316.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcht_es8316.c b/sound/soc/intel/boards/bytcht_es8316.c +index 2fe1ce8791235..c360ebc3ccc7f 100644 +--- a/sound/soc/intel/boards/bytcht_es8316.c ++++ b/sound/soc/intel/boards/bytcht_es8316.c +@@ -436,6 +436,14 @@ static const struct acpi_gpio_mapping byt_cht_es8316_gpios[] = { + + /* Please keep this list alphabetically sorted */ + static const struct dmi_system_id byt_cht_es8316_quirk_table[] = { ++ { /* Irbis NB41 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "IRBIS"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "NB41"), ++ }, ++ .driver_data = (void *)(BYT_CHT_ES8316_INTMIC_IN2_MAP ++ | BYT_CHT_ES8316_JD_INVERTED), ++ }, + { /* Teclast X98 Plus II */ + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TECLAST"), +-- +2.20.1 + diff --git a/queue-5.2/asoc-rockchip-fix-mono-capture.patch b/queue-5.2/asoc-rockchip-fix-mono-capture.patch new file mode 100644 index 00000000000..07d87ca69fa --- /dev/null +++ b/queue-5.2/asoc-rockchip-fix-mono-capture.patch @@ -0,0 +1,66 @@ +From 9810f34ff37eed6df409dfe3d42357d1424d8890 Mon Sep 17 00:00:00 2001 +From: Cheng-Yi Chiang +Date: Fri, 26 Jul 2019 12:42:02 +0800 +Subject: ASoC: rockchip: Fix mono capture + +[ Upstream commit 789e162a6255325325bd321ab0cd51dc7e285054 ] + +This reverts commit db51707b9c9aeedd310ebce60f15d5bb006567e0. +Revert "ASoC: rockchip: i2s: Support mono capture" + +Previous discussion in + +https://patchwork.kernel.org/patch/10147153/ + +explains the issue of the patch. +While device is configured as 1-ch, hardware is still +generating a 2-ch stream. +When user space reads the data and assumes it is a 1-ch stream, +the rate will be slower by 2x. + +Revert the change so 1-ch is not supported. +User space can selectively take one channel data out of two channel +if 1-ch is preferred. +Currently, both channels record identical data. + +Signed-off-by: Cheng-Yi Chiang +Link: https://lore.kernel.org/r/20190726044202.26866-1-cychiang@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_i2s.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c +index 0a34d0eb8dba9..88ebaf6e1880a 100644 +--- a/sound/soc/rockchip/rockchip_i2s.c ++++ b/sound/soc/rockchip/rockchip_i2s.c +@@ -326,7 +326,6 @@ static int rockchip_i2s_hw_params(struct snd_pcm_substream *substream, + val |= I2S_CHN_4; + break; + case 2: +- case 1: + val |= I2S_CHN_2; + break; + default: +@@ -459,7 +458,7 @@ static struct snd_soc_dai_driver rockchip_i2s_dai = { + }, + .capture = { + .stream_name = "Capture", +- .channels_min = 1, ++ .channels_min = 2, + .channels_max = 2, + .rates = SNDRV_PCM_RATE_8000_192000, + .formats = (SNDRV_PCM_FMTBIT_S8 | +@@ -659,7 +658,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev) + } + + if (!of_property_read_u32(node, "rockchip,capture-channels", &val)) { +- if (val >= 1 && val <= 8) ++ if (val >= 2 && val <= 8) + soc_dai->capture.channels_max = val; + } + +-- +2.20.1 + diff --git a/queue-5.2/asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch b/queue-5.2/asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch new file mode 100644 index 00000000000..0b232dca20f --- /dev/null +++ b/queue-5.2/asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch @@ -0,0 +1,66 @@ +From 25ef5246b4c7ae4fcf65a92a061d599e34998ed3 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Sat, 13 Jul 2019 11:46:15 +0800 +Subject: ASoC: samsung: odroid: fix a double-free issue for cpu_dai + +[ Upstream commit 2abee12c0ab1924a69993d2c063a39a952e7d836 ] + +The cpu_dai variable is still being used after the of_node_put() call, +which may result in double-free: + + of_node_put(cpu_dai); ---> released here + + ret = devm_snd_soc_register_card(dev, card); + if (ret < 0) { +... + goto err_put_clk_i2s; --> jump to err_put_clk_i2s +... + +err_put_clk_i2s: + clk_put(priv->clk_i2s_bus); +err_put_sclk: + clk_put(priv->sclk_i2s); +err_put_cpu_dai: + of_node_put(cpu_dai); --> double-free here + +Fixes: d832d2b246c5 ("ASoC: samsung: odroid: Fix of_node refcount unbalance") +Signed-off-by: Wen Yang +Cc: Krzysztof Kozlowski +Cc: Sangbeom Kim +Cc: Sylwester Nawrocki +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Cc: linux-kernel@vger.kernel.org +Link: https://lore.kernel.org/r/1562989575-33785-3-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/odroid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c +index 95c35e3ff3303..d606e48fe551a 100644 +--- a/sound/soc/samsung/odroid.c ++++ b/sound/soc/samsung/odroid.c +@@ -299,7 +299,6 @@ static int odroid_audio_probe(struct platform_device *pdev) + ret = PTR_ERR(priv->clk_i2s_bus); + goto err_put_sclk; + } +- of_node_put(cpu_dai); + + ret = devm_snd_soc_register_card(dev, card); + if (ret < 0) { +@@ -307,6 +306,7 @@ static int odroid_audio_probe(struct platform_device *pdev) + goto err_put_clk_i2s; + } + ++ of_node_put(cpu_dai); + of_node_put(codec); + return 0; + +-- +2.20.1 + diff --git a/queue-5.2/asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch b/queue-5.2/asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch new file mode 100644 index 00000000000..76fd076c053 --- /dev/null +++ b/queue-5.2/asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch @@ -0,0 +1,63 @@ +From 11573275bf379e4ff719713deb151790de4e818f Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Sat, 13 Jul 2019 11:46:14 +0800 +Subject: ASoC: samsung: odroid: fix an use-after-free issue for codec + +[ Upstream commit 9b6d104a6b150bd4d3e5b039340e1f6b20c2e3c1 ] + +The codec variable is still being used after the of_node_put() call, +which may result in use-after-free. + +Fixes: bc3cf17b575a ("ASoC: samsung: odroid: Add support for secondary CPU DAI") +Signed-off-by: Wen Yang +Cc: Krzysztof Kozlowski +Cc: Sangbeom Kim +Cc: Sylwester Nawrocki +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Cc: linux-kernel@vger.kernel.org +Link: https://lore.kernel.org/r/1562989575-33785-2-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/samsung/odroid.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c +index e688169ff12ab..95c35e3ff3303 100644 +--- a/sound/soc/samsung/odroid.c ++++ b/sound/soc/samsung/odroid.c +@@ -275,9 +275,8 @@ static int odroid_audio_probe(struct platform_device *pdev) + } + + of_node_put(cpu); +- of_node_put(codec); + if (ret < 0) +- return ret; ++ goto err_put_node; + + ret = snd_soc_of_get_dai_link_codecs(dev, codec, codec_link); + if (ret < 0) +@@ -308,6 +307,7 @@ static int odroid_audio_probe(struct platform_device *pdev) + goto err_put_clk_i2s; + } + ++ of_node_put(codec); + return 0; + + err_put_clk_i2s: +@@ -317,6 +317,8 @@ err_put_sclk: + err_put_cpu_dai: + of_node_put(cpu_dai); + snd_soc_of_put_dai_link_codecs(codec_link); ++err_put_node: ++ of_node_put(codec); + return ret; + } + +-- +2.20.1 + diff --git a/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch b/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch new file mode 100644 index 00000000000..05e78f5ae9f --- /dev/null +++ b/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch @@ -0,0 +1,103 @@ +From d5fda0296ffa92f381dbb26713a9bce6fe1fde05 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 10 Jul 2019 15:25:06 +0800 +Subject: ASoC: simple-card: fix an use-after-free in simple_dai_link_of_dpcm() + +[ Upstream commit 724808ad556c15e9473418d082f8aae81dd267f6 ] + +The node variable is still being used after the of_node_put() call, +which may result in use-after-free. + +Fixes: cfc652a73331 ("ASoC: simple-card: tidyup prefix for snd_soc_codec_conf") +Link: https://lore.kernel.org/r/1562743509-30496-2-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Wen Yang +Acked-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 9b568f578bcd2..544064fdc780c 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -138,8 +138,6 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + li->link++; + +- of_node_put(node); +- + /* For single DAI link & old style of DT node */ + if (is_top) + prefix = PREFIX; +@@ -161,17 +159,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_cpu(np, dai_link, &is_single_links); + if (ret) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_clk_cpu(dev, np, dai_link, dai); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_set_dailink_name(dev, dai_link, + "fe.%s", + dai_link->cpu_dai_name); + if (ret < 0) +- return ret; ++ goto out_put_node; + + asoc_simple_canonicalize_cpu(dai_link, is_single_links); + } else { +@@ -194,17 +192,17 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_codec(np, dai_link); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_clk_codec(dev, np, dai_link, dai); + if (ret < 0) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_set_dailink_name(dev, dai_link, + "be.%s", + codecs->dai_name); + if (ret < 0) +- return ret; ++ goto out_put_node; + + /* check "prefix" from top node */ + snd_soc_of_parse_node_prefix(top, cconf, codecs->of_node, +@@ -222,19 +220,21 @@ static int simple_dai_link_of_dpcm(struct asoc_simple_priv *priv, + + ret = asoc_simple_parse_tdm(np, dai); + if (ret) +- return ret; ++ goto out_put_node; + + ret = asoc_simple_parse_daifmt(dev, node, codec, + prefix, &dai_link->dai_fmt); + if (ret < 0) +- return ret; ++ goto out_put_node; + + dai_link->dpcm_playback = 1; + dai_link->dpcm_capture = 1; + dai_link->ops = &simple_ops; + dai_link->init = asoc_simple_dai_init; + +- return 0; ++out_put_node: ++ of_node_put(node); ++ return ret; + } + + static int simple_dai_link_of(struct asoc_simple_priv *priv, +-- +2.20.1 + diff --git a/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_for.patch b/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_for.patch new file mode 100644 index 00000000000..a09ea4584a5 --- /dev/null +++ b/queue-5.2/asoc-simple-card-fix-an-use-after-free-in-simple_for.patch @@ -0,0 +1,50 @@ +From a4cdd3628b0ea2344cea0d556953e98a94cad8c9 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Wed, 10 Jul 2019 15:25:07 +0800 +Subject: ASoC: simple-card: fix an use-after-free in simple_for_each_link() + +[ Upstream commit 27862d5a3325bc531ec15e3c607e44aa0fd57f6f ] + +The codec variable is still being used after the of_node_put() call, +which may result in use-after-free. + +Fixes: d947cdfd4be2 ("ASoC: simple-card: cleanup DAI link loop method - step1") +Link: https://lore.kernel.org/r/1562743509-30496-3-git-send-email-wen.yang99@zte.com.cn +Signed-off-by: Wen Yang +Acked-by: Kuninori Morimoto +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 544064fdc780c..2712a2b201024 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -378,8 +378,6 @@ static int simple_for_each_link(struct asoc_simple_priv *priv, + goto error; + } + +- of_node_put(codec); +- + /* get convert-xxx property */ + memset(&adata, 0, sizeof(adata)); + for_each_child_of_node(node, np) +@@ -401,11 +399,13 @@ static int simple_for_each_link(struct asoc_simple_priv *priv, + ret = func_noml(priv, np, codec, li, is_top); + + if (ret < 0) { ++ of_node_put(codec); + of_node_put(np); + goto error; + } + } + ++ of_node_put(codec); + node = of_get_next_child(top, node); + } while (!is_top && node); + +-- +2.20.1 + diff --git a/queue-5.2/asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch b/queue-5.2/asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch new file mode 100644 index 00000000000..ac6487f8eea --- /dev/null +++ b/queue-5.2/asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch @@ -0,0 +1,37 @@ +From 0608aa7f4935a8283c240294ca6396f8c6eb6153 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Wed, 10 Jul 2019 16:59:55 +0900 +Subject: ASoC: simple_card_utils.h: care NULL dai at asoc_simple_debug_dai() + +[ Upstream commit 52db6685932e326ed607644ab7ebdae8c194adda ] + +props->xxx_dai might be NULL when DPCM. +This patch cares it for debug. + +Fixes: commit 0580dde59438 ("ASoC: simple-card-utils: add asoc_simple_debug_info()") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87o922gw4u.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/simple_card_utils.h | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/include/sound/simple_card_utils.h b/include/sound/simple_card_utils.h +index 3429888347e7c..b3609e4c46e0f 100644 +--- a/include/sound/simple_card_utils.h ++++ b/include/sound/simple_card_utils.h +@@ -149,6 +149,10 @@ inline void asoc_simple_debug_dai(struct asoc_simple_priv *priv, + { + struct device *dev = simple_priv_to_dev(priv); + ++ /* dai might be NULL */ ++ if (!dai) ++ return; ++ + if (dai->name) + dev_dbg(dev, "%s dai name = %s\n", + name, dai->name); +-- +2.20.1 + diff --git a/queue-5.2/asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch b/queue-5.2/asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch new file mode 100644 index 00000000000..6f682e9506b --- /dev/null +++ b/queue-5.2/asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch @@ -0,0 +1,160 @@ +From 9276a74cdcf3404b96d5bd35ba52c93661e9be73 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Sun, 21 Jul 2019 23:23:08 +0900 +Subject: ASoC: SOF: use __u32 instead of uint32_t in uapi headers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 62ec3d13601bd626ca7a0edef6d45dbb753d94e8 ] + +When CONFIG_UAPI_HEADER_TEST=y, exported headers are compile-tested to +make sure they can be included from user-space. + +Currently, header.h and fw.h are excluded from the test coverage. +To make them join the compile-test, we need to fix the build errors +attached below. + +For a case like this, we decided to use __u{8,16,32,64} variable types +in this discussion: + + https://lkml.org/lkml/2019/6/5/18 + +Build log: + + CC usr/include/sound/sof/header.h.s + CC usr/include/sound/sof/fw.h.s +In file included from :32:0: +./usr/include/sound/sof/header.h:19:2: error: unknown type name ‘uint32_t’ + uint32_t magic; /**< 'S', 'O', 'F', '\0' */ + ^~~~~~~~ +./usr/include/sound/sof/header.h:20:2: error: unknown type name ‘uint32_t’ + uint32_t type; /**< component specific type */ + ^~~~~~~~ +./usr/include/sound/sof/header.h:21:2: error: unknown type name ‘uint32_t’ + uint32_t size; /**< size in bytes of data excl. this struct */ + ^~~~~~~~ +./usr/include/sound/sof/header.h:22:2: error: unknown type name ‘uint32_t’ + uint32_t abi; /**< SOF ABI version */ + ^~~~~~~~ +./usr/include/sound/sof/header.h:23:2: error: unknown type name ‘uint32_t’ + uint32_t reserved[4]; /**< reserved for future use */ + ^~~~~~~~ +./usr/include/sound/sof/header.h:24:2: error: unknown type name ‘uint32_t’ + uint32_t data[0]; /**< Component data - opaque to core */ + ^~~~~~~~ +In file included from :32:0: +./usr/include/sound/sof/fw.h:49:2: error: unknown type name ‘uint32_t’ + uint32_t size; /* bytes minus this header */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:50:2: error: unknown type name ‘uint32_t’ + uint32_t offset; /* offset from base */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:64:2: error: unknown type name ‘uint32_t’ + uint32_t size; /* bytes minus this header */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:65:2: error: unknown type name ‘uint32_t’ + uint32_t num_blocks; /* number of blocks */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:73:2: error: unknown type name ‘uint32_t’ + uint32_t file_size; /* size of file minus this header */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:74:2: error: unknown type name ‘uint32_t’ + uint32_t num_modules; /* number of modules */ + ^~~~~~~~ +./usr/include/sound/sof/fw.h:75:2: error: unknown type name ‘uint32_t’ + uint32_t abi; /* version of header format */ + ^~~~~~~~ + +Signed-off-by: Masahiro Yamada +Link: https://lore.kernel.org/r/20190721142308.30306-1-yamada.masahiro@socionext.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/uapi/sound/sof/fw.h | 16 +++++++++------- + include/uapi/sound/sof/header.h | 14 ++++++++------ + 2 files changed, 17 insertions(+), 13 deletions(-) + +diff --git a/include/uapi/sound/sof/fw.h b/include/uapi/sound/sof/fw.h +index 1afca973eb097..e9f697467a861 100644 +--- a/include/uapi/sound/sof/fw.h ++++ b/include/uapi/sound/sof/fw.h +@@ -13,6 +13,8 @@ + #ifndef __INCLUDE_UAPI_SOF_FW_H__ + #define __INCLUDE_UAPI_SOF_FW_H__ + ++#include ++ + #define SND_SOF_FW_SIG_SIZE 4 + #define SND_SOF_FW_ABI 1 + #define SND_SOF_FW_SIG "Reef" +@@ -46,8 +48,8 @@ enum snd_sof_fw_blk_type { + + struct snd_sof_blk_hdr { + enum snd_sof_fw_blk_type type; +- uint32_t size; /* bytes minus this header */ +- uint32_t offset; /* offset from base */ ++ __u32 size; /* bytes minus this header */ ++ __u32 offset; /* offset from base */ + } __packed; + + /* +@@ -61,8 +63,8 @@ enum snd_sof_fw_mod_type { + + struct snd_sof_mod_hdr { + enum snd_sof_fw_mod_type type; +- uint32_t size; /* bytes minus this header */ +- uint32_t num_blocks; /* number of blocks */ ++ __u32 size; /* bytes minus this header */ ++ __u32 num_blocks; /* number of blocks */ + } __packed; + + /* +@@ -70,9 +72,9 @@ struct snd_sof_mod_hdr { + */ + struct snd_sof_fw_header { + unsigned char sig[SND_SOF_FW_SIG_SIZE]; /* "Reef" */ +- uint32_t file_size; /* size of file minus this header */ +- uint32_t num_modules; /* number of modules */ +- uint32_t abi; /* version of header format */ ++ __u32 file_size; /* size of file minus this header */ ++ __u32 num_modules; /* number of modules */ ++ __u32 abi; /* version of header format */ + } __packed; + + #endif +diff --git a/include/uapi/sound/sof/header.h b/include/uapi/sound/sof/header.h +index 7868990b0d6f3..5f4518e7a9723 100644 +--- a/include/uapi/sound/sof/header.h ++++ b/include/uapi/sound/sof/header.h +@@ -9,6 +9,8 @@ + #ifndef __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__ + #define __INCLUDE_UAPI_SOUND_SOF_USER_HEADER_H__ + ++#include ++ + /* + * Header for all non IPC ABI data. + * +@@ -16,12 +18,12 @@ + * Used by any bespoke component data structures or binary blobs. + */ + struct sof_abi_hdr { +- uint32_t magic; /**< 'S', 'O', 'F', '\0' */ +- uint32_t type; /**< component specific type */ +- uint32_t size; /**< size in bytes of data excl. this struct */ +- uint32_t abi; /**< SOF ABI version */ +- uint32_t reserved[4]; /**< reserved for future use */ +- uint32_t data[0]; /**< Component data - opaque to core */ ++ __u32 magic; /**< 'S', 'O', 'F', '\0' */ ++ __u32 type; /**< component specific type */ ++ __u32 size; /**< size in bytes of data excl. this struct */ ++ __u32 abi; /**< SOF ABI version */ ++ __u32 reserved[4]; /**< reserved for future use */ ++ __u32 data[0]; /**< Component data - opaque to core */ + } __packed; + + #endif +-- +2.20.1 + diff --git a/queue-5.2/asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch b/queue-5.2/asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch new file mode 100644 index 00000000000..cb855be49a0 --- /dev/null +++ b/queue-5.2/asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch @@ -0,0 +1,112 @@ +From 200d6795c6e86d543b2ff0bb67dbe7568ca6bfe4 Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Fri, 26 Jul 2019 09:42:43 +0300 +Subject: ASoC: ti: davinci-mcasp: Correct slot_width posed constraint + +[ Upstream commit 1e112c35e3c96db7c8ca6ddaa96574f00c06e7db ] + +The slot_width is a property for the bus while the constraint for +SNDRV_PCM_HW_PARAM_SAMPLE_BITS is for the in memory format. + +Applying slot_width constraint to sample_bits works most of the time, but +it will blacklist valid formats in some cases. + +With slot_width 24 we can support S24_3LE and S24_LE formats as they both +look the same on the bus, but a a 24 constraint on sample_bits would not +allow S24_LE as it is stored in 32bits in memory. + +Implement a simple hw_rule function to allow all formats which require less +or equal number of bits on the bus as slot_width (if configured). + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20190726064244.3762-2-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/davinci-mcasp.c | 43 ++++++++++++++++++++++++++++-------- + 1 file changed, 34 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c +index dc01bbca0ff69..56009d1472084 100644 +--- a/sound/soc/ti/davinci-mcasp.c ++++ b/sound/soc/ti/davinci-mcasp.c +@@ -1254,6 +1254,28 @@ static int davinci_mcasp_trigger(struct snd_pcm_substream *substream, + return ret; + } + ++static int davinci_mcasp_hw_rule_slot_width(struct snd_pcm_hw_params *params, ++ struct snd_pcm_hw_rule *rule) ++{ ++ struct davinci_mcasp_ruledata *rd = rule->private; ++ struct snd_mask *fmt = hw_param_mask(params, SNDRV_PCM_HW_PARAM_FORMAT); ++ struct snd_mask nfmt; ++ int i, slot_width; ++ ++ snd_mask_none(&nfmt); ++ slot_width = rd->mcasp->slot_width; ++ ++ for (i = 0; i <= SNDRV_PCM_FORMAT_LAST; i++) { ++ if (snd_mask_test(fmt, i)) { ++ if (snd_pcm_format_width(i) <= slot_width) { ++ snd_mask_set(&nfmt, i); ++ } ++ } ++ } ++ ++ return snd_mask_refine(fmt, &nfmt); ++} ++ + static const unsigned int davinci_mcasp_dai_rates[] = { + 8000, 11025, 16000, 22050, 32000, 44100, 48000, 64000, + 88200, 96000, 176400, 192000, +@@ -1361,7 +1383,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + struct davinci_mcasp_ruledata *ruledata = + &mcasp->ruledata[substream->stream]; + u32 max_channels = 0; +- int i, dir; ++ int i, dir, ret; + int tdm_slots = mcasp->tdm_slots; + + /* Do not allow more then one stream per direction */ +@@ -1390,6 +1412,7 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + max_channels++; + } + ruledata->serializers = max_channels; ++ ruledata->mcasp = mcasp; + max_channels *= tdm_slots; + /* + * If the already active stream has less channels than the calculated +@@ -1415,20 +1438,22 @@ static int davinci_mcasp_startup(struct snd_pcm_substream *substream, + 0, SNDRV_PCM_HW_PARAM_CHANNELS, + &mcasp->chconstr[substream->stream]); + +- if (mcasp->slot_width) +- snd_pcm_hw_constraint_minmax(substream->runtime, +- SNDRV_PCM_HW_PARAM_SAMPLE_BITS, +- 8, mcasp->slot_width); ++ if (mcasp->slot_width) { ++ /* Only allow formats require <= slot_width bits on the bus */ ++ ret = snd_pcm_hw_rule_add(substream->runtime, 0, ++ SNDRV_PCM_HW_PARAM_FORMAT, ++ davinci_mcasp_hw_rule_slot_width, ++ ruledata, ++ SNDRV_PCM_HW_PARAM_FORMAT, -1); ++ if (ret) ++ return ret; ++ } + + /* + * If we rely on implicit BCLK divider setting we should + * set constraints based on what we can provide. + */ + if (mcasp->bclk_master && mcasp->bclk_div == 0 && mcasp->sysclk_freq) { +- int ret; +- +- ruledata->mcasp = mcasp; +- + ret = snd_pcm_hw_rule_add(substream->runtime, 0, + SNDRV_PCM_HW_PARAM_RATE, + davinci_mcasp_hw_rule_rate, +-- +2.20.1 + diff --git a/queue-5.2/asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch b/queue-5.2/asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch new file mode 100644 index 00000000000..71d95742f08 --- /dev/null +++ b/queue-5.2/asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch @@ -0,0 +1,51 @@ +From 71beec0944314bbcb8643aa3c4ddd0f090ae08ba Mon Sep 17 00:00:00 2001 +From: Peter Ujfalusi +Date: Thu, 25 Jul 2019 11:34:23 +0300 +Subject: ASoC: ti: davinci-mcasp: Fix clk PDIR handling for i2s master mode + +[ Upstream commit 34a2a80ff30b5d2330abfa8980c7f0cc15a8158a ] + +When running McASP as master capture alone will not record any audio unless +a parallel playback stream is running. As soon as the playback stops the +captured data is going to be silent again. + +In McASP master mode we need to set the PDIR for the clock pins and fix +the mcasp_set_axr_pdir() to skip the bits in the PDIR registers above +AMUTE. + +This went unnoticed as most of the boards uses McASP as slave and neither +of these issues are visible (audible) in those setups. + +Fixes: ca3d9433349e ("ASoC: davinci-mcasp: Update PDIR (pin direction) register handling") +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20190725083423.7321-1-peter.ujfalusi@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/davinci-mcasp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/ti/davinci-mcasp.c b/sound/soc/ti/davinci-mcasp.c +index 5e8e31743a28d..dc01bbca0ff69 100644 +--- a/sound/soc/ti/davinci-mcasp.c ++++ b/sound/soc/ti/davinci-mcasp.c +@@ -194,7 +194,7 @@ static inline void mcasp_set_axr_pdir(struct davinci_mcasp *mcasp, bool enable) + { + u32 bit; + +- for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AFSR) { ++ for_each_set_bit(bit, &mcasp->pdir, PIN_BIT_AMUTE) { + if (enable) + mcasp_set_bits(mcasp, DAVINCI_MCASP_PDIR_REG, BIT(bit)); + else +@@ -222,6 +222,7 @@ static void mcasp_start_rx(struct davinci_mcasp *mcasp) + if (mcasp_is_synchronous(mcasp)) { + mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXHCLKRST); + mcasp_set_ctl_reg(mcasp, DAVINCI_MCASP_GBLCTLX_REG, TXCLKRST); ++ mcasp_set_clk_pdir(mcasp, true); + } + + /* Activate serializer(s) */ +-- +2.20.1 + diff --git a/queue-5.2/ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch b/queue-5.2/ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch new file mode 100644 index 00000000000..8155de52c91 --- /dev/null +++ b/queue-5.2/ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch @@ -0,0 +1,40 @@ +From c1be329ee47e0dbe7ad78ef6ab8d5189572ea635 Mon Sep 17 00:00:00 2001 +From: "Gustavo A. R. Silva" +Date: Tue, 6 Aug 2019 03:08:08 -0500 +Subject: ata: rb532_cf: Fix unused variable warning in rb532_pata_driver_probe +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit db341a049ec7e87053c91008cb452d0bfa6dde72 ] + +Fix the following warning (Building: rb532_defconfig mips): + +drivers/ata/pata_rb532_cf.c: In function ‘rb532_pata_driver_remove’: +drivers/ata/pata_rb532_cf.c:161:24: warning: unused variable ‘info’ [-Wunused-variable] + struct rb532_cf_info *info = ah->private_data; + ^~~~ + +Fixes: cd56f35e52d9 ("ata: rb532_cf: Convert to use GPIO descriptors") +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_rb532_cf.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c +index 7c37f2ff09e41..deae466395de1 100644 +--- a/drivers/ata/pata_rb532_cf.c ++++ b/drivers/ata/pata_rb532_cf.c +@@ -158,7 +158,6 @@ static int rb532_pata_driver_probe(struct platform_device *pdev) + static int rb532_pata_driver_remove(struct platform_device *pdev) + { + struct ata_host *ah = platform_get_drvdata(pdev); +- struct rb532_cf_info *info = ah->private_data; + + ata_host_detach(ah); + +-- +2.20.1 + diff --git a/queue-5.2/block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch b/queue-5.2/block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch new file mode 100644 index 00000000000..0c369ab9ce9 --- /dev/null +++ b/queue-5.2/block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch @@ -0,0 +1,108 @@ +From f623d92208414572a25f0239a0b55464818540fc Mon Sep 17 00:00:00 2001 +From: He Zhe +Date: Thu, 8 Aug 2019 11:09:54 +0800 +Subject: block: aoe: Fix kernel crash due to atomic sleep when exiting + +[ Upstream commit 430380b4637aec646996b4aef67ad417593923b2 ] + +Since commit 3582dd291788 ("aoe: convert aoeblk to blk-mq"), aoedev_downdev +has had the possibility of sleeping and causing the following crash. + +BUG: scheduling while atomic: rmmod/2242/0x00000003 +Modules linked in: aoe +Preemption disabled at: +[] flush+0x95/0x4a0 [aoe] +CPU: 7 PID: 2242 Comm: rmmod Tainted: G I 5.2.3 #1 +Hardware name: Intel Corporation S5520HC/S5520HC, BIOS S5500.86B.01.10.0025.030220091519 03/02/2009 +Call Trace: + dump_stack+0x4f/0x6a + ? flush+0x95/0x4a0 [aoe] + __schedule_bug.cold+0x44/0x54 + __schedule+0x44f/0x680 + schedule+0x44/0xd0 + blk_mq_freeze_queue_wait+0x46/0xb0 + ? wait_woken+0x80/0x80 + blk_mq_freeze_queue+0x1b/0x20 + aoedev_downdev+0x111/0x160 [aoe] + flush+0xff/0x4a0 [aoe] + aoedev_exit+0x23/0x30 [aoe] + aoe_exit+0x35/0x948 [aoe] + __se_sys_delete_module+0x183/0x210 + __x64_sys_delete_module+0x16/0x20 + do_syscall_64+0x4d/0x130 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x7f24e0043b07 +Code: 73 01 c3 48 8b 0d 89 73 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f +1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff +ff 73 01 c3 48 8b 0d 59 73 0b 00 f7 d8 64 89 01 48 +RSP: 002b:00007ffe18f7f1e8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 +RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f24e0043b07 +RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000555c3ecf87c8 +RBP: 00007ffe18f7f1f0 R08: 0000000000000000 R09: 0000000000000000 +R10: 00007f24e00b4ac0 R11: 0000000000000206 R12: 00007ffe18f7f238 +R13: 00007ffe18f7f410 R14: 00007ffe18f80e73 R15: 0000555c3ecf8760 + +This patch, handling in the same way of pass two, unlocks the locks and +restart pass one after aoedev_downdev is done. + +Fixes: 3582dd291788 ("aoe: convert aoeblk to blk-mq") +Signed-off-by: He Zhe +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/aoe/aoedev.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c +index 5b49f1b33ebec..e2ea2356da061 100644 +--- a/drivers/block/aoe/aoedev.c ++++ b/drivers/block/aoe/aoedev.c +@@ -323,10 +323,14 @@ flush(const char __user *str, size_t cnt, int exiting) + } + + flush_scheduled_work(); +- /* pass one: without sleeping, do aoedev_downdev */ ++ /* pass one: do aoedev_downdev, which might sleep */ ++restart1: + spin_lock_irqsave(&devlist_lock, flags); + for (d = devlist; d; d = d->next) { + spin_lock(&d->lock); ++ if (d->flags & DEVFL_TKILL) ++ goto cont; ++ + if (exiting) { + /* unconditionally take each device down */ + } else if (specified) { +@@ -338,8 +342,11 @@ flush(const char __user *str, size_t cnt, int exiting) + || d->ref) + goto cont; + ++ spin_unlock(&d->lock); ++ spin_unlock_irqrestore(&devlist_lock, flags); + aoedev_downdev(d); + d->flags |= DEVFL_TKILL; ++ goto restart1; + cont: + spin_unlock(&d->lock); + } +@@ -348,7 +355,7 @@ cont: + /* pass two: call freedev, which might sleep, + * for aoedevs marked with DEVFL_TKILL + */ +-restart: ++restart2: + spin_lock_irqsave(&devlist_lock, flags); + for (d = devlist; d; d = d->next) { + spin_lock(&d->lock); +@@ -357,7 +364,7 @@ restart: + spin_unlock(&d->lock); + spin_unlock_irqrestore(&devlist_lock, flags); + freedev(d); +- goto restart; ++ goto restart2; + } + spin_unlock(&d->lock); + } +-- +2.20.1 + diff --git a/queue-5.2/block-bfq-handle-null-return-value-by-bfq_init_rq.patch b/queue-5.2/block-bfq-handle-null-return-value-by-bfq_init_rq.patch new file mode 100644 index 00000000000..8e3d672921f --- /dev/null +++ b/queue-5.2/block-bfq-handle-null-return-value-by-bfq_init_rq.patch @@ -0,0 +1,76 @@ +From f9b8018d89423512903474e4e95c3fd4dd924ba6 Mon Sep 17 00:00:00 2001 +From: Paolo Valente +Date: Wed, 7 Aug 2019 19:21:11 +0200 +Subject: block, bfq: handle NULL return value by bfq_init_rq() + +[ Upstream commit fd03177c33b287c6541f4048f1d67b7b45a1abc9 ] + +As reported in [1], the call bfq_init_rq(rq) may return NULL in case +of OOM (in particular, if rq->elv.icq is NULL because memory +allocation failed in failed in ioc_create_icq()). + +This commit handles this circumstance. + +[1] https://lkml.org/lkml/2019/7/22/824 + +Cc: Hsin-Yi Wang +Cc: Nicolas Boichat +Cc: Doug Anderson +Reported-by: Guenter Roeck +Reported-by: Hsin-Yi Wang +Reviewed-by: Guenter Roeck +Signed-off-by: Paolo Valente +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 404e776aa36d0..b528710364e9e 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2085,9 +2085,14 @@ static void bfq_request_merged(struct request_queue *q, struct request *req, + blk_rq_pos(container_of(rb_prev(&req->rb_node), + struct request, rb_node))) { + struct bfq_queue *bfqq = bfq_init_rq(req); +- struct bfq_data *bfqd = bfqq->bfqd; ++ struct bfq_data *bfqd; + struct request *prev, *next_rq; + ++ if (!bfqq) ++ return; ++ ++ bfqd = bfqq->bfqd; ++ + /* Reposition request in its sort_list */ + elv_rb_del(&bfqq->sort_list, req); + elv_rb_add(&bfqq->sort_list, req); +@@ -2134,6 +2139,9 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, + struct bfq_queue *bfqq = bfq_init_rq(rq), + *next_bfqq = bfq_init_rq(next); + ++ if (!bfqq) ++ return; ++ + /* + * If next and rq belong to the same bfq_queue and next is older + * than rq, then reposition rq in the fifo (by substituting next +@@ -5061,12 +5069,12 @@ static void bfq_insert_request(struct blk_mq_hw_ctx *hctx, struct request *rq, + + spin_lock_irq(&bfqd->lock); + bfqq = bfq_init_rq(rq); +- if (at_head || blk_rq_is_passthrough(rq)) { ++ if (!bfqq || at_head || blk_rq_is_passthrough(rq)) { + if (at_head) + list_add(&rq->queuelist, &bfqd->dispatch); + else + list_add_tail(&rq->queuelist, &bfqd->dispatch); +- } else { /* bfqq is assumed to be non null here */ ++ } else { + idle_timer_disabled = __bfq_insert_request(bfqd, rq); + /* + * Update bfqq, because, if a queue merge has occurred +-- +2.20.1 + diff --git a/queue-5.2/bonding-force-slave-speed-check-after-link-state-rec.patch b/queue-5.2/bonding-force-slave-speed-check-after-link-state-rec.patch new file mode 100644 index 00000000000..19162201c23 --- /dev/null +++ b/queue-5.2/bonding-force-slave-speed-check-after-link-state-rec.patch @@ -0,0 +1,73 @@ +From f85edccd4e4a99d83df8e461d69754f57fb9a6a8 Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Tue, 16 Jul 2019 17:25:10 -0500 +Subject: bonding: Force slave speed check after link state recovery for + 802.3ad + +[ Upstream commit 12185dfe44360f814ac4ead9d22ad2af7511b2e9 ] + +The following scenario was encountered during testing of logical +partition mobility on pseries partitions with bonded ibmvnic +adapters in LACP mode. + +1. Driver receives a signal that the device has been + swapped, and it needs to reset to initialize the new + device. + +2. Driver reports loss of carrier and begins initialization. + +3. Bonding driver receives NETDEV_CHANGE notifier and checks + the slave's current speed and duplex settings. Because these + are unknown at the time, the bond sets its link state to + BOND_LINK_FAIL and handles the speed update, clearing + AD_PORT_LACP_ENABLE. + +4. Driver finishes recovery and reports that the carrier is on. + +5. Bond receives a new notification and checks the speed again. + The speeds are valid but miimon has not altered the link + state yet. AD_PORT_LACP_ENABLE remains off. + +Because the slave's link state is still BOND_LINK_FAIL, +no further port checks are made when it recovers. Though +the slave devices are operational and have valid speed +and duplex settings, the bond will not send LACPDU's. The +simplest fix I can see is to force another speed check +in bond_miimon_commit. This way the bond will update +AD_PORT_LACP_ENABLE if needed when transitioning from +BOND_LINK_FAIL to BOND_LINK_UP. + +CC: Jarod Wilson +CC: Jay Vosburgh +CC: Veaceslav Falico +CC: Andy Gospodarek +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index f183cadd14e3d..e8f48f3cdf948 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2205,6 +2205,15 @@ static void bond_miimon_commit(struct bonding *bond) + bond_for_each_slave(bond, slave, iter) { + switch (slave->new_link) { + case BOND_LINK_NOCHANGE: ++ /* For 802.3ad mode, check current slave speed and ++ * duplex again in case its port was disabled after ++ * invalid speed/duplex reporting but recovered before ++ * link monitoring could make a decision on the actual ++ * link status ++ */ ++ if (BOND_MODE(bond) == BOND_MODE_8023AD && ++ slave->link == BOND_LINK_UP) ++ bond_3ad_adapter_speed_duplex_changed(slave); + continue; + + case BOND_LINK_UP: +-- +2.20.1 + diff --git a/queue-5.2/bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch b/queue-5.2/bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch new file mode 100644 index 00000000000..0aa18375001 --- /dev/null +++ b/queue-5.2/bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch @@ -0,0 +1,45 @@ +From 15e16ce4c6363fbb2b11a7aeeb3fa83c2fff1c38 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Fri, 19 Jul 2019 10:29:21 -0700 +Subject: bpf: sockmap, only create entry if ulp is not already enabled + +[ Upstream commit 0e858739c2d2eedeeac1d35bfa0ec3cc2a7190d8 ] + +Sockmap does not currently support adding sockets after TLS has been +enabled. There never was a real use case for this so it was never +added. But, we lost the test for ULP at some point so add it here +and fail the socket insert if TLS is enabled. Future work could +make sockmap support this use case but fixup the bug here. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index bbc91597d8364..8a4a45e7c29df 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -339,6 +339,7 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx, + struct sock *sk, u64 flags) + { + struct bpf_stab *stab = container_of(map, struct bpf_stab, map); ++ struct inet_connection_sock *icsk = inet_csk(sk); + struct sk_psock_link *link; + struct sk_psock *psock; + struct sock *osk; +@@ -349,6 +350,8 @@ static int sock_map_update_common(struct bpf_map *map, u32 idx, + return -EINVAL; + if (unlikely(idx >= map->max_entries)) + return -E2BIG; ++ if (unlikely(icsk->icsk_ulp_data)) ++ return -EINVAL; + + link = sk_psock_init_link(); + if (!link) +-- +2.20.1 + diff --git a/queue-5.2/bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch b/queue-5.2/bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch new file mode 100644 index 00000000000..5d9c472db46 --- /dev/null +++ b/queue-5.2/bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch @@ -0,0 +1,74 @@ +From 85609ec10a99c99e36a1a07b0bf17e9c3312c451 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Fri, 19 Jul 2019 10:29:19 -0700 +Subject: bpf: sockmap, sock_map_delete needs to use xchg + +[ Upstream commit 45a4521dcbd92e71c9e53031b40e34211d3b4feb ] + +__sock_map_delete() may be called from a tcp event such as unhash or +close from the following trace, + + tcp_bpf_close() + tcp_bpf_remove() + sk_psock_unlink() + sock_map_delete_from_link() + __sock_map_delete() + +In this case the sock lock is held but this only protects against +duplicate removals on the TCP side. If the map is free'd then we have +this trace, + + sock_map_free + xchg() <- replaces map entry + sock_map_unref() + sk_psock_put() + sock_map_del_link() + +The __sock_map_delete() call however uses a read, test, null over the +map entry which can result in both paths trying to free the map +entry. + +To fix use xchg in TCP paths as well so we avoid having two references +to the same map entry. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index be6092ac69f8a..1d40e040320d2 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -281,16 +281,20 @@ static int __sock_map_delete(struct bpf_stab *stab, struct sock *sk_test, + struct sock **psk) + { + struct sock *sk; ++ int err = 0; + + raw_spin_lock_bh(&stab->lock); + sk = *psk; + if (!sk_test || sk_test == sk) +- *psk = NULL; ++ sk = xchg(psk, NULL); ++ ++ if (likely(sk)) ++ sock_map_unref(sk, psk); ++ else ++ err = -EINVAL; ++ + raw_spin_unlock_bh(&stab->lock); +- if (unlikely(!sk)) +- return -EINVAL; +- sock_map_unref(sk, psk); +- return 0; ++ return err; + } + + static void sock_map_delete_from_link(struct bpf_map *map, struct sock *sk, +-- +2.20.1 + diff --git a/queue-5.2/bpf-sockmap-synchronize_rcu-before-free-ing-map.patch b/queue-5.2/bpf-sockmap-synchronize_rcu-before-free-ing-map.patch new file mode 100644 index 00000000000..85e0ceaa124 --- /dev/null +++ b/queue-5.2/bpf-sockmap-synchronize_rcu-before-free-ing-map.patch @@ -0,0 +1,35 @@ +From 06c56cd261236b355336fd222a801db8dcbacce5 Mon Sep 17 00:00:00 2001 +From: John Fastabend +Date: Fri, 19 Jul 2019 10:29:20 -0700 +Subject: bpf: sockmap, synchronize_rcu before free'ing map + +[ Upstream commit 2bb90e5cc90e1d09f631aeab041a9cf913a5bbe5 ] + +We need to have a synchronize_rcu before free'ing the sockmap because +any outstanding psock references will have a pointer to the map and +when they use this could trigger a use after free. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + net/core/sock_map.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index 1d40e040320d2..bbc91597d8364 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -252,6 +252,8 @@ static void sock_map_free(struct bpf_map *map) + raw_spin_unlock_bh(&stab->lock); + rcu_read_unlock(); + ++ synchronize_rcu(); ++ + bpf_map_area_free(stab->sks); + kfree(stab); + } +-- +2.20.1 + diff --git a/queue-5.2/can-dev-call-netif_carrier_off-in-register_candev.patch b/queue-5.2/can-dev-call-netif_carrier_off-in-register_candev.patch new file mode 100644 index 00000000000..1c0fb605e1e --- /dev/null +++ b/queue-5.2/can-dev-call-netif_carrier_off-in-register_candev.patch @@ -0,0 +1,38 @@ +From 9c4e64c50d72bfbcf936e60f035c92a1495cbd32 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Mon, 24 Jun 2019 08:34:13 +0000 +Subject: can: dev: call netif_carrier_off() in register_candev() + +[ Upstream commit c63845609c4700488e5eacd6ab4d06d5d420e5ef ] + +CONFIG_CAN_LEDS is deprecated. When trying to use the generic netdev +trigger as suggested, there's a small inconsistency with the link +property: The LED is on initially, stays on when the device is brought +up, and then turns off (as expected) when the device is brought down. + +Make sure the LED always reflects the state of the CAN device. + +Signed-off-by: Rasmus Villemoes +Acked-by: Willem de Bruijn +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index b6b93a2d93a59..483d270664cc8 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -1249,6 +1249,8 @@ int register_candev(struct net_device *dev) + return -EINVAL; + + dev->rtnl_link_ops = &can_link_ops; ++ netif_carrier_off(dev); ++ + return register_netdev(dev); + } + EXPORT_SYMBOL_GPL(register_candev); +-- +2.20.1 + diff --git a/queue-5.2/can-gw-fix-error-path-of-cgw_module_init.patch b/queue-5.2/can-gw-fix-error-path-of-cgw_module_init.patch new file mode 100644 index 00000000000..9a75ca8bfae --- /dev/null +++ b/queue-5.2/can-gw-fix-error-path-of-cgw_module_init.patch @@ -0,0 +1,92 @@ +From a8e20bc3e292c4f40432a9848917d4dbdb430a4e Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Sat, 18 May 2019 17:35:43 +0800 +Subject: can: gw: Fix error path of cgw_module_init + +[ Upstream commit b7a14297f102b6e2ce6f16feffebbb9bde1e9b55 ] + +This patch add error path for cgw_module_init to avoid possible crash if +some error occurs. + +Fixes: c1aabdf379bc ("can-gw: add netlink based CAN routing") +Signed-off-by: YueHaibing +Acked-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/gw.c | 48 +++++++++++++++++++++++++++++++++--------------- + 1 file changed, 33 insertions(+), 15 deletions(-) + +diff --git a/net/can/gw.c b/net/can/gw.c +index 5275ddf580bc7..72711053ebe66 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -1046,32 +1046,50 @@ static __init int cgw_module_init(void) + pr_info("can: netlink gateway (rev " CAN_GW_VERSION ") max_hops=%d\n", + max_hops); + +- register_pernet_subsys(&cangw_pernet_ops); ++ ret = register_pernet_subsys(&cangw_pernet_ops); ++ if (ret) ++ return ret; ++ ++ ret = -ENOMEM; + cgw_cache = kmem_cache_create("can_gw", sizeof(struct cgw_job), + 0, 0, NULL); +- + if (!cgw_cache) +- return -ENOMEM; ++ goto out_cache_create; + + /* set notifier */ + notifier.notifier_call = cgw_notifier; +- register_netdevice_notifier(¬ifier); ++ ret = register_netdevice_notifier(¬ifier); ++ if (ret) ++ goto out_register_notifier; + + ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_GETROUTE, + NULL, cgw_dump_jobs, 0); +- if (ret) { +- unregister_netdevice_notifier(¬ifier); +- kmem_cache_destroy(cgw_cache); +- return -ENOBUFS; +- } +- +- /* Only the first call to rtnl_register_module can fail */ +- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE, +- cgw_create_job, NULL, 0); +- rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE, +- cgw_remove_job, NULL, 0); ++ if (ret) ++ goto out_rtnl_register1; ++ ++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_NEWROUTE, ++ cgw_create_job, NULL, 0); ++ if (ret) ++ goto out_rtnl_register2; ++ ret = rtnl_register_module(THIS_MODULE, PF_CAN, RTM_DELROUTE, ++ cgw_remove_job, NULL, 0); ++ if (ret) ++ goto out_rtnl_register3; + + return 0; ++ ++out_rtnl_register3: ++ rtnl_unregister(PF_CAN, RTM_NEWROUTE); ++out_rtnl_register2: ++ rtnl_unregister(PF_CAN, RTM_GETROUTE); ++out_rtnl_register1: ++ unregister_netdevice_notifier(¬ifier); ++out_register_notifier: ++ kmem_cache_destroy(cgw_cache); ++out_cache_create: ++ unregister_pernet_subsys(&cangw_pernet_ops); ++ ++ return ret; + } + + static __exit void cgw_module_exit(void) +-- +2.20.1 + diff --git a/queue-5.2/can-mcp251x-add-error-check-when-wq-alloc-failed.patch b/queue-5.2/can-mcp251x-add-error-check-when-wq-alloc-failed.patch new file mode 100644 index 00000000000..b235be6f710 --- /dev/null +++ b/queue-5.2/can-mcp251x-add-error-check-when-wq-alloc-failed.patch @@ -0,0 +1,105 @@ +From d1654555d9b482c511dbe266a04cff4044b7e74c Mon Sep 17 00:00:00 2001 +From: Weitao Hou +Date: Tue, 25 Jun 2019 20:50:48 +0800 +Subject: can: mcp251x: add error check when wq alloc failed + +[ Upstream commit 375f755899b8fc21196197e02aab26257df26e85 ] + +add error check when workqueue alloc failed, and remove redundant code +to make it clear. + +Fixes: e0000163e30e ("can: Driver for the Microchip MCP251x SPI CAN controllers") +Signed-off-by: Weitao Hou +Acked-by: Willem de Bruijn +Tested-by: Sean Nyekjaer +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251x.c | 49 ++++++++++++++++------------------- + 1 file changed, 22 insertions(+), 27 deletions(-) + +diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c +index 44e99e3d71348..2aec934fab0cd 100644 +--- a/drivers/net/can/spi/mcp251x.c ++++ b/drivers/net/can/spi/mcp251x.c +@@ -664,17 +664,6 @@ static int mcp251x_power_enable(struct regulator *reg, int enable) + return regulator_disable(reg); + } + +-static void mcp251x_open_clean(struct net_device *net) +-{ +- struct mcp251x_priv *priv = netdev_priv(net); +- struct spi_device *spi = priv->spi; +- +- free_irq(spi->irq, priv); +- mcp251x_hw_sleep(spi); +- mcp251x_power_enable(priv->transceiver, 0); +- close_candev(net); +-} +- + static int mcp251x_stop(struct net_device *net) + { + struct mcp251x_priv *priv = netdev_priv(net); +@@ -940,37 +929,43 @@ static int mcp251x_open(struct net_device *net) + flags | IRQF_ONESHOT, DEVICE_NAME, priv); + if (ret) { + dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq); +- mcp251x_power_enable(priv->transceiver, 0); +- close_candev(net); +- goto open_unlock; ++ goto out_close; + } + + priv->wq = alloc_workqueue("mcp251x_wq", WQ_FREEZABLE | WQ_MEM_RECLAIM, + 0); ++ if (!priv->wq) { ++ ret = -ENOMEM; ++ goto out_clean; ++ } + INIT_WORK(&priv->tx_work, mcp251x_tx_work_handler); + INIT_WORK(&priv->restart_work, mcp251x_restart_work_handler); + + ret = mcp251x_hw_reset(spi); +- if (ret) { +- mcp251x_open_clean(net); +- goto open_unlock; +- } ++ if (ret) ++ goto out_free_wq; + ret = mcp251x_setup(net, spi); +- if (ret) { +- mcp251x_open_clean(net); +- goto open_unlock; +- } ++ if (ret) ++ goto out_free_wq; + ret = mcp251x_set_normal_mode(spi); +- if (ret) { +- mcp251x_open_clean(net); +- goto open_unlock; +- } ++ if (ret) ++ goto out_free_wq; + + can_led_event(net, CAN_LED_EVENT_OPEN); + + netif_wake_queue(net); ++ mutex_unlock(&priv->mcp_lock); + +-open_unlock: ++ return 0; ++ ++out_free_wq: ++ destroy_workqueue(priv->wq); ++out_clean: ++ free_irq(spi->irq, priv); ++ mcp251x_hw_sleep(spi); ++out_close: ++ mcp251x_power_enable(priv->transceiver, 0); ++ close_candev(net); + mutex_unlock(&priv->mcp_lock); + return ret; + } +-- +2.20.1 + diff --git a/queue-5.2/can-peak_usb-force-the-string-buffer-null-terminated.patch b/queue-5.2/can-peak_usb-force-the-string-buffer-null-terminated.patch new file mode 100644 index 00000000000..e5fc0737d0a --- /dev/null +++ b/queue-5.2/can-peak_usb-force-the-string-buffer-null-terminated.patch @@ -0,0 +1,38 @@ +From 25804a71462bf127027592599e7e0e279b0eac67 Mon Sep 17 00:00:00 2001 +From: Wang Xiayang +Date: Wed, 31 Jul 2019 15:25:59 +0800 +Subject: can: peak_usb: force the string buffer NULL-terminated + +[ Upstream commit e787f19373b8a5fa24087800ed78314fd17b984a ] + +strncpy() does not ensure NULL-termination when the input string size +equals to the destination buffer size IFNAMSIZ. The output string is +passed to dev_info() which relies on the NULL-termination. + +Use strlcpy() instead. + +This issue is identified by a Coccinelle script. + +Signed-off-by: Wang Xiayang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/usb/peak_usb/pcan_usb_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +index 22b9c8e6d040a..65dce642b86b5 100644 +--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c ++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c +@@ -855,7 +855,7 @@ static void peak_usb_disconnect(struct usb_interface *intf) + + dev_prev_siblings = dev->prev_siblings; + dev->state &= ~PCAN_USB_STATE_CONNECTED; +- strncpy(name, netdev->name, IFNAMSIZ); ++ strlcpy(name, netdev->name, IFNAMSIZ); + + unregister_netdev(netdev); + +-- +2.20.1 + diff --git a/queue-5.2/can-sja1000-force-the-string-buffer-null-terminated.patch b/queue-5.2/can-sja1000-force-the-string-buffer-null-terminated.patch new file mode 100644 index 00000000000..6ff393fdd89 --- /dev/null +++ b/queue-5.2/can-sja1000-force-the-string-buffer-null-terminated.patch @@ -0,0 +1,38 @@ +From b5fc64020ebb9cffa1b11c6425771a3de3e35142 Mon Sep 17 00:00:00 2001 +From: Wang Xiayang +Date: Wed, 31 Jul 2019 15:31:14 +0800 +Subject: can: sja1000: force the string buffer NULL-terminated + +[ Upstream commit cd28aa2e056cd1ea79fc5f24eed0ce868c6cab5c ] + +strncpy() does not ensure NULL-termination when the input string size +equals to the destination buffer size IFNAMSIZ. The output string +'name' is passed to dev_info which relies on NULL-termination. + +Use strlcpy() instead. + +This issue is identified by a Coccinelle script. + +Signed-off-by: Wang Xiayang +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/sja1000/peak_pcmcia.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/can/sja1000/peak_pcmcia.c b/drivers/net/can/sja1000/peak_pcmcia.c +index 185c7f7d38a4a..5e0d5e8101c86 100644 +--- a/drivers/net/can/sja1000/peak_pcmcia.c ++++ b/drivers/net/can/sja1000/peak_pcmcia.c +@@ -479,7 +479,7 @@ static void pcan_free_channels(struct pcan_pccard *card) + if (!netdev) + continue; + +- strncpy(name, netdev->name, IFNAMSIZ); ++ strlcpy(name, netdev->name, IFNAMSIZ); + + unregister_sja1000dev(netdev); + +-- +2.20.1 + diff --git a/queue-5.2/drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch b/queue-5.2/drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch new file mode 100644 index 00000000000..850f03fe177 --- /dev/null +++ b/queue-5.2/drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch @@ -0,0 +1,89 @@ +From ff2f9731211bd8929031d6dbd858b594facf393e Mon Sep 17 00:00:00 2001 +From: Likun Gao +Date: Fri, 2 Aug 2019 15:18:57 +0800 +Subject: drm/amdgpu: pin the csb buffer on hw init for gfx v8 + +[ Upstream commit 72cda9bb5e219aea0f2f62f56ae05198c59022a7 ] + +Without this pin, the csb buffer will be filled with inconsistent +data after S3 resume. And that will causes gfx hang on gfxoff +exit since this csb will be executed then. + +Signed-off-by: Likun Gao +Tested-by: Paul Gover +Reviewed-by: Feifei Xu +Reviewed-by: Xiaojie Yuan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 40 +++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 02955e6e9dd9e..c21ef99cc590f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -1317,6 +1317,39 @@ static int gfx_v8_0_rlc_init(struct amdgpu_device *adev) + return 0; + } + ++static int gfx_v8_0_csb_vram_pin(struct amdgpu_device *adev) ++{ ++ int r; ++ ++ r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, false); ++ if (unlikely(r != 0)) ++ return r; ++ ++ r = amdgpu_bo_pin(adev->gfx.rlc.clear_state_obj, ++ AMDGPU_GEM_DOMAIN_VRAM); ++ if (!r) ++ adev->gfx.rlc.clear_state_gpu_addr = ++ amdgpu_bo_gpu_offset(adev->gfx.rlc.clear_state_obj); ++ ++ amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj); ++ ++ return r; ++} ++ ++static void gfx_v8_0_csb_vram_unpin(struct amdgpu_device *adev) ++{ ++ int r; ++ ++ if (!adev->gfx.rlc.clear_state_obj) ++ return; ++ ++ r = amdgpu_bo_reserve(adev->gfx.rlc.clear_state_obj, true); ++ if (likely(r == 0)) { ++ amdgpu_bo_unpin(adev->gfx.rlc.clear_state_obj); ++ amdgpu_bo_unreserve(adev->gfx.rlc.clear_state_obj); ++ } ++} ++ + static void gfx_v8_0_mec_fini(struct amdgpu_device *adev) + { + amdgpu_bo_free_kernel(&adev->gfx.mec.hpd_eop_obj, NULL, NULL); +@@ -4777,6 +4810,10 @@ static int gfx_v8_0_hw_init(void *handle) + gfx_v8_0_init_golden_registers(adev); + gfx_v8_0_constants_init(adev); + ++ r = gfx_v8_0_csb_vram_pin(adev); ++ if (r) ++ return r; ++ + r = adev->gfx.rlc.funcs->resume(adev); + if (r) + return r; +@@ -4893,6 +4930,9 @@ static int gfx_v8_0_hw_fini(void *handle) + else + pr_err("rlc is busy, skip halt rlc\n"); + amdgpu_gfx_rlc_exit_safe_mode(adev); ++ ++ gfx_v8_0_csb_vram_unpin(adev); ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.2/drm-rockchip-suspend-dp-late.patch b/queue-5.2/drm-rockchip-suspend-dp-late.patch new file mode 100644 index 00000000000..fb1e11b1ee9 --- /dev/null +++ b/queue-5.2/drm-rockchip-suspend-dp-late.patch @@ -0,0 +1,44 @@ +From e04bdc62bc4d8f3cdb79c749ef393add11e2607c Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Fri, 2 Aug 2019 11:46:16 -0700 +Subject: drm/rockchip: Suspend DP late + +[ Upstream commit f7ccbed656f78212593ca965d9a8f34bf24e0aab ] + +In commit fe64ba5c6323 ("drm/rockchip: Resume DP early") we moved +resume to be early but left suspend at its normal time. This seems +like it could be OK, but casues problems if a suspend gets interrupted +partway through. The OS only balances matching suspend/resume levels. +...so if suspend was called then resume will be called. If suspend +late was called then resume early will be called. ...but if suspend +was called resume early might not get called. This leads to an +unbalance in the clock enables / disables. + +Lets take the simple fix and just move suspend to be late to match. +This makes the PM core take proper care in keeping things balanced. + +Fixes: fe64ba5c6323 ("drm/rockchip: Resume DP early") +Signed-off-by: Douglas Anderson +Signed-off-by: Sean Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20190802184616.44822-1-dianders@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +index 95e5c517a15f7..9aae3d8e99ef4 100644 +--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c ++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +@@ -432,7 +432,7 @@ static int rockchip_dp_resume(struct device *dev) + + static const struct dev_pm_ops rockchip_dp_pm_ops = { + #ifdef CONFIG_PM_SLEEP +- .suspend = rockchip_dp_suspend, ++ .suspend_late = rockchip_dp_suspend, + .resume_early = rockchip_dp_resume, + #endif + }; +-- +2.20.1 + diff --git a/queue-5.2/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch b/queue-5.2/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch new file mode 100644 index 00000000000..8d668cb4cbd --- /dev/null +++ b/queue-5.2/drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch @@ -0,0 +1,41 @@ +From 7fee11c1331e99a66ad596e53715d0844206209c Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 24 Jun 2019 09:39:59 -0700 +Subject: drm/vmwgfx: fix memory leak when too many retries have occurred + +[ Upstream commit 6b7c3b86f0b63134b2ab56508921a0853ffa687a ] + +Currently when too many retries have occurred there is a memory +leak on the allocation for reply on the error return path. Fix +this by kfree'ing reply before returning. + +Addresses-Coverity: ("Resource leak") +Fixes: a9cd9c044aa9 ("drm/vmwgfx: Add a check to handle host message failure") +Signed-off-by: Colin Ian King +Reviewed-by: Deepak Rawat +Signed-off-by: Deepak Rawat +Signed-off-by: Thomas Hellstrom +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +index e4e09d47c5c0e..59e9d05ab928b 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c +@@ -389,8 +389,10 @@ static int vmw_recv_msg(struct rpc_channel *channel, void **msg, + break; + } + +- if (retries == RETRIES) ++ if (retries == RETRIES) { ++ kfree(reply); + return -EINVAL; ++ } + + *msg_len = reply_len; + *msg = reply; +-- +2.20.1 + diff --git a/queue-5.2/dt-bindings-riscv-fix-the-schema-compatible-string-f.patch b/queue-5.2/dt-bindings-riscv-fix-the-schema-compatible-string-f.patch new file mode 100644 index 00000000000..4c44cd41501 --- /dev/null +++ b/queue-5.2/dt-bindings-riscv-fix-the-schema-compatible-string-f.patch @@ -0,0 +1,41 @@ +From 39ae76039307b5b5d6f0956dd62571065e946894 Mon Sep 17 00:00:00 2001 +From: Paul Walmsley +Date: Thu, 8 Aug 2019 15:36:44 -0700 +Subject: dt-bindings: riscv: fix the schema compatible string for the HiFive + Unleashed board + +[ Upstream commit b390e0bfd2996f1215231395f4e25a4c011eeaf9 ] + +The YAML binding document for SiFive boards has an incorrect +compatible string for the HiFive Unleashed board. Change it to match +the name of the board on the SiFive web site: + + https://www.sifive.com/boards/hifive-unleashed + +which also matches the contents of the board DT data file: + + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/riscv/boot/dts/sifive/hifive-unleashed-a00.dts#n13 + +Signed-off-by: Paul Walmsley +Acked-by: Rob Herring +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/riscv/sifive.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/riscv/sifive.yaml b/Documentation/devicetree/bindings/riscv/sifive.yaml +index 9d17dc2f3f843..3ab532713dc12 100644 +--- a/Documentation/devicetree/bindings/riscv/sifive.yaml ++++ b/Documentation/devicetree/bindings/riscv/sifive.yaml +@@ -19,7 +19,7 @@ properties: + compatible: + items: + - enum: +- - sifive,freedom-unleashed-a00 ++ - sifive,hifive-unleashed-a00 + - const: sifive,fu540-c000 + - const: sifive,fu540 + ... +-- +2.20.1 + diff --git a/queue-5.2/enetc-fix-build-error-without-phylib.patch b/queue-5.2/enetc-fix-build-error-without-phylib.patch new file mode 100644 index 00000000000..1eb02eea78a --- /dev/null +++ b/queue-5.2/enetc-fix-build-error-without-phylib.patch @@ -0,0 +1,46 @@ +From 12026ca257a553c262ca91d91f83856490900b80 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Tue, 30 Jul 2019 22:29:59 +0800 +Subject: enetc: Fix build error without PHYLIB + +[ Upstream commit 5f4e4203add2b860d2345312509a160f8292063b ] + +If PHYLIB is not set, build enetc will fails: + +drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open': +enetc.c: undefined reference to `phy_disconnect' +enetc.c: undefined reference to `phy_start' +drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close': +enetc.c: undefined reference to `phy_stop' +enetc.c: undefined reference to `phy_disconnect' +drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_get_link_ksettings' +drivers/net/ethernet/freescale/enetc/enetc_ethtool.o: undefined reference to `phy_ethtool_set_link_ksettings' +drivers/net/ethernet/freescale/enetc/enetc_mdio.o: In function `enetc_mdio_probe': +enetc_mdio.c: undefined reference to `mdiobus_alloc_size' +enetc_mdio.c: undefined reference to `mdiobus_free' + +Reported-by: Hulk Robot +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: YueHaibing +Acked-by: Claudiu Manoil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig +index 8429f5c1d8106..8ac109e73a7bb 100644 +--- a/drivers/net/ethernet/freescale/enetc/Kconfig ++++ b/drivers/net/ethernet/freescale/enetc/Kconfig +@@ -2,6 +2,7 @@ + config FSL_ENETC + tristate "ENETC PF driver" + depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST) ++ select PHYLIB + help + This driver supports NXP ENETC gigabit ethernet controller PCIe + physical function (PF) devices, managing ENETC Ports at a privileged +-- +2.20.1 + diff --git a/queue-5.2/enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch b/queue-5.2/enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch new file mode 100644 index 00000000000..6dd61b8e1d3 --- /dev/null +++ b/queue-5.2/enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch @@ -0,0 +1,43 @@ +From 0a71df88d38c11583f753d448be98698ab6a15f5 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 1 Aug 2019 09:24:19 +0800 +Subject: enetc: Select PHYLIB while CONFIG_FSL_ENETC_VF is set + +[ Upstream commit 2802d2cf24b1ca7ea4c54dde266ded6a16020eb5 ] + +Like FSL_ENETC, when CONFIG_FSL_ENETC_VF is set, +we should select PHYLIB, otherwise building still fails: + +drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_open': +enetc.c:(.text+0x2744): undefined reference to `phy_start' +enetc.c:(.text+0x282c): undefined reference to `phy_disconnect' +drivers/net/ethernet/freescale/enetc/enetc.o: In function `enetc_close': +enetc.c:(.text+0x28f8): undefined reference to `phy_stop' +enetc.c:(.text+0x2904): undefined reference to `phy_disconnect' +drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x3f8): undefined reference to `phy_ethtool_get_link_ksettings' +drivers/net/ethernet/freescale/enetc/enetc_ethtool.o:(.rodata+0x400): undefined reference to `phy_ethtool_set_link_ksettings' + +Reported-by: Hulk Robot +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/freescale/enetc/Kconfig b/drivers/net/ethernet/freescale/enetc/Kconfig +index 8ac109e73a7bb..a268e74b1834e 100644 +--- a/drivers/net/ethernet/freescale/enetc/Kconfig ++++ b/drivers/net/ethernet/freescale/enetc/Kconfig +@@ -13,6 +13,7 @@ config FSL_ENETC + config FSL_ENETC_VF + tristate "ENETC VF driver" + depends on PCI && PCI_MSI && (ARCH_LAYERSCAPE || COMPILE_TEST) ++ select PHYLIB + help + This driver supports NXP ENETC gigabit ethernet controller PCIe + virtual function (VF) devices enabled by the ENETC PF driver. +-- +2.20.1 + diff --git a/queue-5.2/habanalabs-fix-f-w-download-in-be-architecture.patch b/queue-5.2/habanalabs-fix-f-w-download-in-be-architecture.patch new file mode 100644 index 00000000000..a017265fd72 --- /dev/null +++ b/queue-5.2/habanalabs-fix-f-w-download-in-be-architecture.patch @@ -0,0 +1,66 @@ +From 473c88cc057964e83f71c1826b9f1095a09e7013 Mon Sep 17 00:00:00 2001 +From: Ben Segal +Date: Tue, 23 Jul 2019 11:22:42 +0300 +Subject: habanalabs: fix F/W download in BE architecture + +[ Upstream commit 75035fe22b808a520e1d712ebe913684ba406e01 ] + +writeX macros might perform byte-swapping in BE architectures. As our F/W +is in LE format, we need to make sure no byte-swapping will occur. + +There is a standard kernel function (called memcpy_toio) for copying data +to I/O area which is used in a lot of drivers to download F/W to PCIe +adapters. That function also makes sure the data is copied "as-is", +without byte-swapping. + +This patch use that function to copy the F/W to the GOYA ASIC instead of +writeX macros. + +Signed-off-by: Ben Segal +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/firmware_if.c | 19 ++----------------- + 1 file changed, 2 insertions(+), 17 deletions(-) + +diff --git a/drivers/misc/habanalabs/firmware_if.c b/drivers/misc/habanalabs/firmware_if.c +index eda5d7fcb79f2..fe9e57a81b6fd 100644 +--- a/drivers/misc/habanalabs/firmware_if.c ++++ b/drivers/misc/habanalabs/firmware_if.c +@@ -24,7 +24,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name, + { + const struct firmware *fw; + const u64 *fw_data; +- size_t fw_size, i; ++ size_t fw_size; + int rc; + + rc = request_firmware(&fw, fw_name, hdev->dev); +@@ -45,22 +45,7 @@ int hl_fw_push_fw_to_device(struct hl_device *hdev, const char *fw_name, + + fw_data = (const u64 *) fw->data; + +- if ((fw->size % 8) != 0) +- fw_size -= 8; +- +- for (i = 0 ; i < fw_size ; i += 8, fw_data++, dst += 8) { +- if (!(i & (0x80000 - 1))) { +- dev_dbg(hdev->dev, +- "copied so far %zu out of %zu for %s firmware", +- i, fw_size, fw_name); +- usleep_range(20, 100); +- } +- +- writeq(*fw_data, dst); +- } +- +- if ((fw->size % 8) != 0) +- writel(*(const u32 *) fw_data, dst); ++ memcpy_toio(dst, fw_data, fw_size); + + out: + release_firmware(fw); +-- +2.20.1 + diff --git a/queue-5.2/hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch b/queue-5.2/hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch new file mode 100644 index 00000000000..e4642649a95 --- /dev/null +++ b/queue-5.2/hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch @@ -0,0 +1,65 @@ +From e8e14df27893185806b07c4c57fda57496f5c0d7 Mon Sep 17 00:00:00 2001 +From: Ilya Trukhanov +Date: Tue, 2 Jul 2019 13:37:16 +0300 +Subject: HID: Add 044f:b320 ThrustMaster, Inc. 2 in 1 DT + +[ Upstream commit 65f11c72780fa9d598df88def045ccb6a885cf80 ] + +Enable force feedback for the Thrustmaster Dual Trigger 2 in 1 Rumble Force +gamepad. Compared to other Thrustmaster devices, left and right rumble +motors here are swapped. + +Signed-off-by: Ilya Trukhanov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-tmff.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/hid/hid-tmff.c b/drivers/hid/hid-tmff.c +index e12f2588ddebb..bdfc5ff3b2c5c 100644 +--- a/drivers/hid/hid-tmff.c ++++ b/drivers/hid/hid-tmff.c +@@ -22,6 +22,8 @@ + + #include "hid-ids.h" + ++#define THRUSTMASTER_DEVICE_ID_2_IN_1_DT 0xb320 ++ + static const signed short ff_rumble[] = { + FF_RUMBLE, + -1 +@@ -76,6 +78,7 @@ static int tmff_play(struct input_dev *dev, void *data, + struct hid_field *ff_field = tmff->ff_field; + int x, y; + int left, right; /* Rumbling */ ++ int motor_swap; + + switch (effect->type) { + case FF_CONSTANT: +@@ -100,6 +103,13 @@ static int tmff_play(struct input_dev *dev, void *data, + ff_field->logical_minimum, + ff_field->logical_maximum); + ++ /* 2-in-1 strong motor is left */ ++ if (hid->product == THRUSTMASTER_DEVICE_ID_2_IN_1_DT) { ++ motor_swap = left; ++ left = right; ++ right = motor_swap; ++ } ++ + dbg_hid("(left,right)=(%08x, %08x)\n", left, right); + ff_field->value[0] = left; + ff_field->value[1] = right; +@@ -226,6 +236,8 @@ static const struct hid_device_id tm_devices[] = { + .driver_data = (unsigned long)ff_rumble }, + { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb304), /* FireStorm Dual Power 2 (and 3) */ + .driver_data = (unsigned long)ff_rumble }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, THRUSTMASTER_DEVICE_ID_2_IN_1_DT), /* Dual Trigger 2-in-1 */ ++ .driver_data = (unsigned long)ff_rumble }, + { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb323), /* Dual Trigger 3-in-1 (PC Mode) */ + .driver_data = (unsigned long)ff_rumble }, + { HID_USB_DEVICE(USB_VENDOR_ID_THRUSTMASTER, 0xb324), /* Dual Trigger 3-in-1 (PS3 Mode) */ +-- +2.20.1 + diff --git a/queue-5.2/hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch b/queue-5.2/hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch new file mode 100644 index 00000000000..c56fc26f47f --- /dev/null +++ b/queue-5.2/hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch @@ -0,0 +1,98 @@ +From 4ccfe178c96f309aeaecc7e225395581c88097a8 Mon Sep 17 00:00:00 2001 +From: Nicolas Saenz Julienne +Date: Tue, 11 Jun 2019 14:13:20 +0200 +Subject: HID: input: fix a4tech horizontal wheel custom usage + +[ Upstream commit 1c703b53e5bfb5c2205c30f0fb157ce271fd42fb ] + +Some a4tech mice use the 'GenericDesktop.00b8' usage to inform whether +the previous wheel report was horizontal or vertical. Before +c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") this +usage was being mapped to 'Relative.Misc'. After the patch it's simply +ignored (usage->type == 0 & usage->code == 0). Which ultimately makes +hid-a4tech ignore the WHEEL/HWHEEL selection event, as it has no +usage->type. + +We shouldn't rely on a mapping for that usage as it's nonstandard and +doesn't really map to an input event. So we bypass the mapping and make +sure the custom event handling properly handles both reports. + +Fixes: c01908a14bf73 ("HID: input: add mapping for "Toggle Display" key") +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-a4tech.c | 30 +++++++++++++++++++++++++++--- + 1 file changed, 27 insertions(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-a4tech.c b/drivers/hid/hid-a4tech.c +index 98bf694626f71..3a8c4a5971f70 100644 +--- a/drivers/hid/hid-a4tech.c ++++ b/drivers/hid/hid-a4tech.c +@@ -23,12 +23,36 @@ + #define A4_2WHEEL_MOUSE_HACK_7 0x01 + #define A4_2WHEEL_MOUSE_HACK_B8 0x02 + ++#define A4_WHEEL_ORIENTATION (HID_UP_GENDESK | 0x000000b8) ++ + struct a4tech_sc { + unsigned long quirks; + unsigned int hw_wheel; + __s32 delayed_value; + }; + ++static int a4_input_mapping(struct hid_device *hdev, struct hid_input *hi, ++ struct hid_field *field, struct hid_usage *usage, ++ unsigned long **bit, int *max) ++{ ++ struct a4tech_sc *a4 = hid_get_drvdata(hdev); ++ ++ if (a4->quirks & A4_2WHEEL_MOUSE_HACK_B8 && ++ usage->hid == A4_WHEEL_ORIENTATION) { ++ /* ++ * We do not want to have this usage mapped to anything as it's ++ * nonstandard and doesn't really behave like an HID report. ++ * It's only selecting the orientation (vertical/horizontal) of ++ * the previous mouse wheel report. The input_events will be ++ * generated once both reports are recorded in a4_event(). ++ */ ++ return -1; ++ } ++ ++ return 0; ++ ++} ++ + static int a4_input_mapped(struct hid_device *hdev, struct hid_input *hi, + struct hid_field *field, struct hid_usage *usage, + unsigned long **bit, int *max) +@@ -52,8 +76,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field, + struct a4tech_sc *a4 = hid_get_drvdata(hdev); + struct input_dev *input; + +- if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput || +- !usage->type) ++ if (!(hdev->claimed & HID_CLAIMED_INPUT) || !field->hidinput) + return 0; + + input = field->hidinput->input; +@@ -64,7 +87,7 @@ static int a4_event(struct hid_device *hdev, struct hid_field *field, + return 1; + } + +- if (usage->hid == 0x000100b8) { ++ if (usage->hid == A4_WHEEL_ORIENTATION) { + input_event(input, EV_REL, value ? REL_HWHEEL : + REL_WHEEL, a4->delayed_value); + input_event(input, EV_REL, value ? REL_HWHEEL_HI_RES : +@@ -131,6 +154,7 @@ MODULE_DEVICE_TABLE(hid, a4_devices); + static struct hid_driver a4_driver = { + .name = "a4tech", + .id_table = a4_devices, ++ .input_mapping = a4_input_mapping, + .input_mapped = a4_input_mapped, + .event = a4_event, + .probe = a4_probe, +-- +2.20.1 + diff --git a/queue-5.2/hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch b/queue-5.2/hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch new file mode 100644 index 00000000000..9fd2d9cafc5 --- /dev/null +++ b/queue-5.2/hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch @@ -0,0 +1,73 @@ +From d5e3327d9e922e0ae1907dcb86b29c90b802bcd1 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Filipe=20La=C3=ADns?= +Date: Tue, 16 Jul 2019 08:37:26 +0100 +Subject: HID: logitech-hidpp: add USB PID for a few more supported mice +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 27fc32fd9417968a459d43d9a7c50fd423d53eb9 ] + +Add more device IDs to logitech-hidpp driver. + +Signed-off-by: Filipe Laíns +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-logitech-hidpp.c | 32 +++++++++++++++++++++++++++++++- + 1 file changed, 31 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c +index cf05816a601f5..34e2b3f9d540d 100644 +--- a/drivers/hid/hid-logitech-hidpp.c ++++ b/drivers/hid/hid-logitech-hidpp.c +@@ -3749,15 +3749,45 @@ static const struct hid_device_id hidpp_devices[] = { + + { L27MHZ_DEVICE(HID_ANY_ID) }, + +- { /* Logitech G403 Gaming Mouse over USB */ ++ { /* Logitech G203/Prodigy Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC084) }, ++ { /* Logitech G302 Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07F) }, ++ { /* Logitech G303 Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC080) }, ++ { /* Logitech G400 Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07E) }, ++ { /* Logitech G403 Wireless Gaming Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC082) }, ++ { /* Logitech G403 Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC083) }, ++ { /* Logitech G403 Hero Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08F) }, ++ { /* Logitech G502 Proteus Core Gaming Mouse */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07D) }, ++ { /* Logitech G502 Proteus Spectrum Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC332) }, ++ { /* Logitech G502 Hero Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC08B) }, + { /* Logitech G700 Gaming Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC06B) }, ++ { /* Logitech G700s Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC07C) }, ++ { /* Logitech G703 Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC087) }, ++ { /* Logitech G703 Hero Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC090) }, + { /* Logitech G900 Gaming Mouse over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC081) }, ++ { /* Logitech G903 Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC086) }, ++ { /* Logitech G903 Hero Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC091) }, + { /* Logitech G920 Wheel over USB */ + HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_G920_WHEEL), + .driver_data = HIDPP_QUIRK_CLASS_G920 | HIDPP_QUIRK_FORCE_OUTPUT_REPORTS}, ++ { /* Logitech G Pro Gaming Mouse over USB */ ++ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, 0xC088) }, + + { /* MX5000 keyboard over Bluetooth */ + HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH, 0xb305), +-- +2.20.1 + diff --git a/queue-5.2/hid-quirks-set-the-increment_usage_on_duplicate-quir.patch b/queue-5.2/hid-quirks-set-the-increment_usage_on_duplicate-quir.patch new file mode 100644 index 00000000000..eaa6cfdef5f --- /dev/null +++ b/queue-5.2/hid-quirks-set-the-increment_usage_on_duplicate-quir.patch @@ -0,0 +1,53 @@ +From 22003e35948b90f8ea20694557b962f8932d13b6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Istv=C3=A1n=20V=C3=A1radi?= +Date: Wed, 24 Jul 2019 20:09:18 +0200 +Subject: HID: quirks: Set the INCREMENT_USAGE_ON_DUPLICATE quirk on Saitek X52 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 7bc74853fd61432ec59f812a40425bf6d8c986a4 ] + +The Saitek X52 joystick has a pair of axes that are originally +(by the Windows driver) used as mouse pointer controls. The corresponding +usage->hid values are 0x50024 and 0x50026. Thus they are handled +as unknown axes and both get mapped to ABS_MISC. The quirk makes +the second axis to be mapped to ABS_MISC1 and thus made available +separately. + +[jkosina@suse.cz: squashed two patches into one] +Signed-off-by: István Váradi +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 34a812025b948..76aa474e92c15 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -990,6 +990,7 @@ + #define USB_DEVICE_ID_SAITEK_RAT7 0x0cd7 + #define USB_DEVICE_ID_SAITEK_RAT9 0x0cfa + #define USB_DEVICE_ID_SAITEK_MMO7 0x0cd0 ++#define USB_DEVICE_ID_SAITEK_X52 0x075c + + #define USB_VENDOR_ID_SAMSUNG 0x0419 + #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 5b669f7d653fa..4fe2c3ab76f9c 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -141,6 +141,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPAD), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_RETROUSB, USB_DEVICE_ID_RETROUSB_SNES_RETROPORT), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_RUMBLEPAD), HID_QUIRK_BADPAD }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SAITEK, USB_DEVICE_ID_SAITEK_X52), HID_QUIRK_INCREMENT_USAGE_ON_DUPLICATE }, + { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB), HID_QUIRK_NOGET }, +-- +2.20.1 + diff --git a/queue-5.2/isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch b/queue-5.2/isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch new file mode 100644 index 00000000000..bb4d5828a06 --- /dev/null +++ b/queue-5.2/isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch @@ -0,0 +1,86 @@ +From e22a8dfeac241a46448dbdf7be0827e946951cf8 Mon Sep 17 00:00:00 2001 +From: Juliana Rodrigueiro +Date: Wed, 31 Jul 2019 15:17:23 +0200 +Subject: isdn: hfcsusb: Fix mISDN driver crash caused by transfer buffer on + the stack + +[ Upstream commit d8a1de3d5bb881507602bc02e004904828f88711 ] + +Since linux 4.9 it is not possible to use buffers on the stack for DMA transfers. + +During usb probe the driver crashes with "transfer buffer is on stack" message. + +This fix k-allocates a buffer to be used on "read_reg_atomic", which is a macro +that calls "usb_control_msg" under the hood. + +Kernel 4.19 backtrace: + +usb_hcd_submit_urb+0x3e5/0x900 +? sched_clock+0x9/0x10 +? log_store+0x203/0x270 +? get_random_u32+0x6f/0x90 +? cache_alloc_refill+0x784/0x8a0 +usb_submit_urb+0x3b4/0x550 +usb_start_wait_urb+0x4e/0xd0 +usb_control_msg+0xb8/0x120 +hfcsusb_probe+0x6bc/0xb40 [hfcsusb] +usb_probe_interface+0xc2/0x260 +really_probe+0x176/0x280 +driver_probe_device+0x49/0x130 +__driver_attach+0xa9/0xb0 +? driver_probe_device+0x130/0x130 +bus_for_each_dev+0x5a/0x90 +driver_attach+0x14/0x20 +? driver_probe_device+0x130/0x130 +bus_add_driver+0x157/0x1e0 +driver_register+0x51/0xe0 +usb_register_driver+0x5d/0x120 +? 0xf81ed000 +hfcsusb_drv_init+0x17/0x1000 [hfcsusb] +do_one_initcall+0x44/0x190 +? free_unref_page_commit+0x6a/0xd0 +do_init_module+0x46/0x1c0 +load_module+0x1dc1/0x2400 +sys_init_module+0xed/0x120 +do_fast_syscall_32+0x7a/0x200 +entry_SYSENTER_32+0x6b/0xbe + +Signed-off-by: Juliana Rodrigueiro +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c +index 8fb7c5dea07fc..008a74a1ed444 100644 +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -1693,13 +1693,23 @@ hfcsusb_stop_endpoint(struct hfcsusb *hw, int channel) + static int + setup_hfcsusb(struct hfcsusb *hw) + { ++ void *dmabuf = kmalloc(sizeof(u_char), GFP_KERNEL); + u_char b; ++ int ret; + + if (debug & DBG_HFC_CALL_TRACE) + printk(KERN_DEBUG "%s: %s\n", hw->name, __func__); + ++ if (!dmabuf) ++ return -ENOMEM; ++ ++ ret = read_reg_atomic(hw, HFCUSB_CHIP_ID, dmabuf); ++ ++ memcpy(&b, dmabuf, sizeof(u_char)); ++ kfree(dmabuf); ++ + /* check the chip id */ +- if (read_reg_atomic(hw, HFCUSB_CHIP_ID, &b) != 1) { ++ if (ret != 1) { + printk(KERN_DEBUG "%s: %s: cannot read chip id\n", + hw->name, __func__); + return 1; +-- +2.20.1 + diff --git a/queue-5.2/isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch b/queue-5.2/isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch new file mode 100644 index 00000000000..b8f81be90e3 --- /dev/null +++ b/queue-5.2/isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch @@ -0,0 +1,49 @@ +From 7721254524a05a20eaf1525d58c7d9d9f9fadf60 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Fri, 26 Jul 2019 16:27:36 +0800 +Subject: isdn: mISDN: hfcsusb: Fix possible null-pointer dereferences in + start_isoc_chain() + +[ Upstream commit a0d57a552b836206ad7705a1060e6e1ce5a38203 ] + +In start_isoc_chain(), usb_alloc_urb() on line 1392 may fail +and return NULL. At this time, fifo->iso[i].urb is assigned to NULL. + +Then, fifo->iso[i].urb is used at some places, such as: +LINE 1405: fill_isoc_urb(fifo->iso[i].urb, ...) + urb->number_of_packets = num_packets; + urb->transfer_flags = URB_ISO_ASAP; + urb->actual_length = 0; + urb->interval = interval; +LINE 1416: fifo->iso[i].urb->... +LINE 1419: fifo->iso[i].urb->... + +Thus, possible null-pointer dereferences may occur. + +To fix these bugs, "continue" is added to avoid using fifo->iso[i].urb +when it is NULL. + +These bugs are found by a static analysis tool STCheck written by us. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/hfcsusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/isdn/hardware/mISDN/hfcsusb.c b/drivers/isdn/hardware/mISDN/hfcsusb.c +index 0e224232f7464..8fb7c5dea07fc 100644 +--- a/drivers/isdn/hardware/mISDN/hfcsusb.c ++++ b/drivers/isdn/hardware/mISDN/hfcsusb.c +@@ -1394,6 +1394,7 @@ start_isoc_chain(struct usb_fifo *fifo, int num_packets_per_urb, + printk(KERN_DEBUG + "%s: %s: alloc urb for fifo %i failed", + hw->name, __func__, fifo->fifonum); ++ continue; + } + fifo->iso[i].owner_fifo = (struct usb_fifo *) fifo; + fifo->iso[i].indx = i; +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch b/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch new file mode 100644 index 00000000000..89be53c4aa2 --- /dev/null +++ b/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch @@ -0,0 +1,36 @@ +From 8ee9cbe6076124d7cfc8a295dbaf8c4e0ec9b7fb Mon Sep 17 00:00:00 2001 +From: Shahar S Matityahu +Date: Thu, 13 Jun 2019 15:11:24 +0300 +Subject: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef + +[ Upstream commit abcbef5977df1fb61026ba429964cd6b9a085699 ] + +The driver should call iwl_dbg_tlv_free even if debugfs is not defined +since ini mode does not depend on debugfs ifdef. + +Signed-off-by: Shahar S Matityahu +Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file") +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +index efd4bf04d0162..fa81ad67539f3 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +@@ -1649,8 +1649,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans) + err_fw: + #ifdef CONFIG_IWLWIFI_DEBUGFS + debugfs_remove_recursive(drv->dbgfs_drv); +- iwl_fw_dbg_free(drv->trans); + #endif ++ iwl_fw_dbg_free(drv->trans); + kfree(drv); + err: + return ERR_PTR(ret); +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch b/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch new file mode 100644 index 00000000000..7b2798e4bdd --- /dev/null +++ b/queue-5.2/iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch @@ -0,0 +1,35 @@ +From d9877451a721bef735937109e869e2fe3c60dc7a Mon Sep 17 00:00:00 2001 +From: Shahar S Matityahu +Date: Thu, 13 Jun 2019 15:08:24 +0300 +Subject: iwlwifi: dbg_ini: move iwl_dbg_tlv_load_bin out of debug override + ifdef + +[ Upstream commit 072b30642f90b01d139131ec7bf763778a3a3f41 ] + +ini debug mode should work even if debug override is not defined. + +Signed-off-by: Shahar S Matityahu +Fixes: 68f6f492c4fa ("iwlwifi: trans: support loading ini TLVs from external file") +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +index fba242284507b..efd4bf04d0162 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +@@ -1627,6 +1627,8 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans) + init_completion(&drv->request_firmware_complete); + INIT_LIST_HEAD(&drv->list); + ++ iwl_load_fw_dbg_tlv(drv->trans->dev, drv->trans); ++ + #ifdef CONFIG_IWLWIFI_DEBUGFS + /* Create the device debugfs entries. */ + drv->dbgfs_drv = debugfs_create_dir(dev_name(trans->dev), +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-fix-locking-in-delayed-gtk-setting.patch b/queue-5.2/iwlwifi-fix-locking-in-delayed-gtk-setting.patch new file mode 100644 index 00000000000..fbfc41b5a0b --- /dev/null +++ b/queue-5.2/iwlwifi-fix-locking-in-delayed-gtk-setting.patch @@ -0,0 +1,101 @@ +From 9985c25c7ec42947b1aa8d3314a4c88847280441 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Thu, 27 Jun 2019 09:44:50 +0200 +Subject: iwlwifi: fix locking in delayed GTK setting + +[ Upstream commit 6569e7d36773956298ec1d5f4e6a2487913d2752 ] + +This code clearly never could have worked, since it locks +while already locked. Add an unlocked __iwl_mvm_mac_set_key() +variant that doesn't do locking to fix that. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 39 ++++++++++++------- + 1 file changed, 26 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 964c7baabede3..edffae3741e00 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -207,11 +207,11 @@ static const struct cfg80211_pmsr_capabilities iwl_mvm_pmsr_capa = { + }, + }; + +-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw, +- enum set_key_cmd cmd, +- struct ieee80211_vif *vif, +- struct ieee80211_sta *sta, +- struct ieee80211_key_conf *key); ++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ++ enum set_key_cmd cmd, ++ struct ieee80211_vif *vif, ++ struct ieee80211_sta *sta, ++ struct ieee80211_key_conf *key); + + void iwl_mvm_ref(struct iwl_mvm *mvm, enum iwl_mvm_ref_type ref_type) + { +@@ -2725,7 +2725,7 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw, + + mvmvif->ap_early_keys[i] = NULL; + +- ret = iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key); ++ ret = __iwl_mvm_mac_set_key(hw, SET_KEY, vif, NULL, key); + if (ret) + goto out_quota_failed; + } +@@ -3493,11 +3493,11 @@ static int iwl_mvm_mac_sched_scan_stop(struct ieee80211_hw *hw, + return ret; + } + +-static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw, +- enum set_key_cmd cmd, +- struct ieee80211_vif *vif, +- struct ieee80211_sta *sta, +- struct ieee80211_key_conf *key) ++static int __iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ++ enum set_key_cmd cmd, ++ struct ieee80211_vif *vif, ++ struct ieee80211_sta *sta, ++ struct ieee80211_key_conf *key) + { + struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); + struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); +@@ -3552,8 +3552,6 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw, + return -EOPNOTSUPP; + } + +- mutex_lock(&mvm->mutex); +- + switch (cmd) { + case SET_KEY: + if ((vif->type == NL80211_IFTYPE_ADHOC || +@@ -3699,7 +3697,22 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw, + ret = -EINVAL; + } + ++ return ret; ++} ++ ++static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw, ++ enum set_key_cmd cmd, ++ struct ieee80211_vif *vif, ++ struct ieee80211_sta *sta, ++ struct ieee80211_key_conf *key) ++{ ++ struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); ++ int ret; ++ ++ mutex_lock(&mvm->mutex); ++ ret = __iwl_mvm_mac_set_key(hw, cmd, vif, sta, key); + mutex_unlock(&mvm->mutex); ++ + return ret; + } + +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch b/queue-5.2/iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch new file mode 100644 index 00000000000..7a6d6f55d8c --- /dev/null +++ b/queue-5.2/iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch @@ -0,0 +1,181 @@ +From cd492659772467f8f879d9e7b59422127777dd60 Mon Sep 17 00:00:00 2001 +From: Mordechay Goodstein +Date: Thu, 13 Jun 2019 16:34:07 +0300 +Subject: iwlwifi: mvm: avoid races in rate init and rate perform + +[ Upstream commit 0f8084cdc1f9d4a6693ef4168167febb0918c6f6 ] + +Rate perform uses the lq_sta table to calculate the next rate to scale +while rate init resets the same table, + +Rate perform is done in soft irq context in parallel to rate init +that can be called in case we are doing changes like AP changes BW +or moving state for auth to assoc. + +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 42 ++++++++++++++++++-- + drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 7 +++- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 6 +++ + drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 1 + + 4 files changed, 51 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +index 63fdb4e68e9d7..836541caa3167 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -1197,6 +1197,27 @@ static u8 rs_get_tid(struct ieee80211_hdr *hdr) + return tid; + } + ++void iwl_mvm_rs_init_wk(struct work_struct *wk) ++{ ++ struct iwl_mvm_sta *mvmsta = container_of(wk, struct iwl_mvm_sta, ++ rs_init_wk); ++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(mvmsta->vif); ++ struct ieee80211_sta *sta; ++ ++ rcu_read_lock(); ++ ++ sta = rcu_dereference(mvmvif->mvm->fw_id_to_mac_id[mvmsta->sta_id]); ++ if (WARN_ON_ONCE(IS_ERR_OR_NULL(sta))) { ++ rcu_read_unlock(); ++ return; ++ } ++ ++ iwl_mvm_rs_rate_init(mvmvif->mvm, sta, mvmvif->phy_ctxt->channel->band, ++ true); ++ ++ rcu_read_unlock(); ++} ++ + void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + int tid, struct ieee80211_tx_info *info, bool ndp) + { +@@ -1269,7 +1290,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + (unsigned long)(lq_sta->last_tx + + (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) { + IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n"); +- iwl_mvm_rs_rate_init(mvm, sta, info->band, true); ++ schedule_work(&mvmsta->rs_init_wk); + return; + } + lq_sta->last_tx = jiffies; +@@ -1442,16 +1463,24 @@ static void rs_drv_mac80211_tx_status(void *mvm_r, + struct iwl_op_mode *op_mode = mvm_r; + struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode); + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); ++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + +- if (!iwl_mvm_sta_from_mac80211(sta)->vif) ++ if (!mvmsta->vif) + return; + + if (!ieee80211_is_data(hdr->frame_control) || + info->flags & IEEE80211_TX_CTL_NO_ACK) + return; + ++ /* If it's locked we are in middle of init flow ++ * just wait for next tx status to update the lq_sta data ++ */ ++ if (!mutex_trylock(&mvmsta->lq_sta.rs_drv.mutex)) ++ return; ++ + iwl_mvm_rs_tx_status(mvm, sta, rs_get_tid(hdr), info, + ieee80211_is_qos_nullfunc(hdr->frame_control)); ++ mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex); + } + + /* +@@ -4136,10 +4165,15 @@ static const struct rate_control_ops rs_mvm_ops_drv = { + void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + enum nl80211_band band, bool update) + { +- if (iwl_mvm_has_tlc_offload(mvm)) ++ if (iwl_mvm_has_tlc_offload(mvm)) { + rs_fw_rate_init(mvm, sta, band, update); +- else ++ } else { ++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); ++ ++ mutex_lock(&mvmsta->lq_sta.rs_drv.mutex); + rs_drv_rate_init(mvm, sta, band, update); ++ mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex); ++ } + } + + int iwl_mvm_rate_control_register(void) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h +index f7eb60dbaf202..086f47e2a4f0c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h +@@ -4,7 +4,7 @@ + * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH + * Copyright(c) 2017 Intel Deutschland GmbH +- * Copyright(c) 2018 Intel Corporation ++ * Copyright(c) 2018 - 2019 Intel Corporation + * + * Contact Information: + * Intel Linux Wireless +@@ -376,6 +376,9 @@ struct iwl_lq_sta { + /* tx power reduce for this sta */ + int tpc_reduce; + ++ /* avoid races of reinit and update table from rx_tx */ ++ struct mutex mutex; ++ + /* persistent fields - initialized only once - keep last! */ + struct lq_sta_pers { + #ifdef CONFIG_MAC80211_DEBUGFS +@@ -440,6 +443,8 @@ struct iwl_mvm_sta; + int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta, + bool enable); + ++void iwl_mvm_rs_init_wk(struct work_struct *wk); ++ + #ifdef CONFIG_IWLWIFI_DEBUGFS + void iwl_mvm_reset_frame_stats(struct iwl_mvm *mvm); + #endif +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index f545a737a92df..ac9bc65c4d156 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1684,6 +1684,10 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm, + */ + if (iwl_mvm_has_tlc_offload(mvm)) + iwl_mvm_rs_add_sta(mvm, mvm_sta); ++ else ++ mutex_init(&mvm_sta->lq_sta.rs_drv.mutex); ++ ++ INIT_WORK(&mvm_sta->rs_init_wk, iwl_mvm_rs_init_wk); + + iwl_mvm_toggle_tx_ant(mvm, &mvm_sta->tx_ant); + +@@ -1846,6 +1850,8 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm, + if (ret) + return ret; + ++ cancel_work_sync(&mvm_sta->rs_init_wk); ++ + /* flush its queues here since we are freeing mvm_sta */ + ret = iwl_mvm_flush_sta(mvm, mvm_sta, false, 0); + if (ret) +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +index b4d4071b865db..6e93c30492b78 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +@@ -421,6 +421,7 @@ struct iwl_mvm_sta { + struct iwl_lq_sta_rs_fw rs_fw; + struct iwl_lq_sta rs_drv; + } lq_sta; ++ struct work_struct rs_init_wk; + struct ieee80211_vif *vif; + struct iwl_mvm_key_pn __rcu *ptk_pn[4]; + struct iwl_mvm_rxq_dup_data *dup_data; +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch b/queue-5.2/iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch new file mode 100644 index 00000000000..f9febdc8632 --- /dev/null +++ b/queue-5.2/iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch @@ -0,0 +1,56 @@ +From 75ee07c11d49de416b5adb936f2b739907dca4ec Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 12 Jun 2019 11:09:58 +0200 +Subject: iwlwifi: mvm: disable TX-AMSDU on older NICs + +[ Upstream commit cfb21b11b891b08b79be07be57c40a85bb926668 ] + +On older NICs, we occasionally see issues with A-MSDU support, +where the commands in the FIFO get confused and then we see an +assert EDC because the next command in the FIFO isn't TX. + +We've tried to isolate this issue and understand where it comes +from, but haven't found any errors in building the A-MSDU in +software. + +At least for now, disable A-MSDU support on older hardware so +that users can use it again without fearing the assert. + +This fixes https://bugzilla.kernel.org/show_bug.cgi?id=203315. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index edffae3741e00..a6183281ee1e1 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -474,7 +474,19 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm) + ieee80211_hw_set(hw, SUPPORTS_VHT_EXT_NSS_BW); + ieee80211_hw_set(hw, BUFF_MMPDU_TXQ); + ieee80211_hw_set(hw, STA_MMPDU_TXQ); +- ieee80211_hw_set(hw, TX_AMSDU); ++ /* ++ * On older devices, enabling TX A-MSDU occasionally leads to ++ * something getting messed up, the command read from the FIFO ++ * gets out of sync and isn't a TX command, so that we have an ++ * assert EDC. ++ * ++ * It's not clear where the bug is, but since we didn't used to ++ * support A-MSDU until moving the mac80211 iTXQs, just leave it ++ * for older devices. We also don't see this issue on any newer ++ * devices. ++ */ ++ if (mvm->cfg->device_family >= IWL_DEVICE_FAMILY_9000) ++ ieee80211_hw_set(hw, TX_AMSDU); + ieee80211_hw_set(hw, TX_FRAG_LIST); + + if (iwl_mvm_has_tlc_offload(mvm)) { +-- +2.20.1 + diff --git a/queue-5.2/iwlwifi-mvm-send-lq-command-always-async.patch b/queue-5.2/iwlwifi-mvm-send-lq-command-always-async.patch new file mode 100644 index 00000000000..ab06953a806 --- /dev/null +++ b/queue-5.2/iwlwifi-mvm-send-lq-command-always-async.patch @@ -0,0 +1,176 @@ +From dfdb243340a18a989564fb07037488e6d55cfc47 Mon Sep 17 00:00:00 2001 +From: Gregory Greenman +Date: Sun, 30 Jun 2019 09:18:15 +0300 +Subject: iwlwifi: mvm: send LQ command always ASYNC + +[ Upstream commit cd4d6b0bcd51580efda9ae54ab7b2d630b4147dc ] + +The only place where the command was sent as SYNC is during +init and this is not really critical. This change is required +for replacing RS mutex with a spinlock (in the subsequent patch), +since SYNC comamnd requres sleeping and thus the flow cannot +be done when holding a spinlock. + +Signed-off-by: Gregory Greenman +Signed-off-by: Luca Coelho +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mvm.h | 2 +- + drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 23 ++++++++++--------- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 +- + .../net/wireless/intel/iwlwifi/mvm/utils.c | 4 ++-- + 4 files changed, 16 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index ed8fc9a9204ca..0c11a219e3477 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -1807,7 +1807,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + #endif /* CONFIG_IWLWIFI_DEBUGFS */ + + /* rate scaling */ +-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync); ++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq); + void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg); + int rs_pretty_print_rate(char *buf, int bufsz, const u32 rate); + void rs_update_last_rssi(struct iwl_mvm *mvm, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +index 836541caa3167..01b032f18bc8b 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -1326,7 +1326,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + IWL_DEBUG_RATE(mvm, + "Too many rates mismatch. Send sync LQ. rs_state %d\n", + lq_sta->rs_state); +- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false); ++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq); + } + /* Regardless, ignore this status info for outdated rate */ + return; +@@ -1388,7 +1388,8 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + if (info->status.ampdu_ack_len == 0) + info->status.ampdu_len = 1; + +- rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl, tx_resp_rate.index, ++ rs_collect_tlc_data(mvm, mvmsta, tid, curr_tbl, ++ tx_resp_rate.index, + info->status.ampdu_len, + info->status.ampdu_ack_len); + +@@ -1823,7 +1824,7 @@ static void rs_update_rate_tbl(struct iwl_mvm *mvm, + struct iwl_scale_tbl_info *tbl) + { + rs_fill_lq_cmd(mvm, sta, lq_sta, &tbl->rate); +- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false); ++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq); + } + + static bool rs_tweak_rate_tbl(struct iwl_mvm *mvm, +@@ -2925,7 +2926,7 @@ void rs_update_last_rssi(struct iwl_mvm *mvm, + static void rs_initialize_lq(struct iwl_mvm *mvm, + struct ieee80211_sta *sta, + struct iwl_lq_sta *lq_sta, +- enum nl80211_band band, bool update) ++ enum nl80211_band band) + { + struct iwl_scale_tbl_info *tbl; + struct rs_rate *rate; +@@ -2955,7 +2956,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm, + rs_set_expected_tpt_table(lq_sta, tbl); + rs_fill_lq_cmd(mvm, sta, lq_sta, rate); + /* TODO restore station should remember the lq cmd */ +- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, !update); ++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq); + } + + static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta, +@@ -3208,7 +3209,7 @@ void iwl_mvm_update_frame_stats(struct iwl_mvm *mvm, u32 rate, bool agg) + * Called after adding a new station to initialize rate scaling + */ + static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, +- enum nl80211_band band, bool update) ++ enum nl80211_band band) + { + int i, j; + struct ieee80211_hw *hw = mvm->hw; +@@ -3288,7 +3289,7 @@ static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + #ifdef CONFIG_IWLWIFI_DEBUGFS + iwl_mvm_reset_frame_stats(mvm); + #endif +- rs_initialize_lq(mvm, sta, lq_sta, band, update); ++ rs_initialize_lq(mvm, sta, lq_sta, band); + } + + static void rs_drv_rate_update(void *mvm_r, +@@ -3602,7 +3603,7 @@ static void rs_set_lq_ss_params(struct iwl_mvm *mvm, + + bfersta_ss_params &= ~LQ_SS_BFER_ALLOWED; + bfersta_lq_cmd->ss_params = cpu_to_le32(bfersta_ss_params); +- iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd, false); ++ iwl_mvm_send_lq_cmd(mvm, bfersta_lq_cmd); + + ss_params |= LQ_SS_BFER_ALLOWED; + IWL_DEBUG_RATE(mvm, +@@ -3768,7 +3769,7 @@ static void rs_program_fix_rate(struct iwl_mvm *mvm, + + if (lq_sta->pers.dbg_fixed_rate) { + rs_fill_lq_cmd(mvm, NULL, lq_sta, NULL); +- iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq, false); ++ iwl_mvm_send_lq_cmd(lq_sta->pers.drv, &lq_sta->lq); + } + } + +@@ -4171,7 +4172,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, + struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + + mutex_lock(&mvmsta->lq_sta.rs_drv.mutex); +- rs_drv_rate_init(mvm, sta, band, update); ++ rs_drv_rate_init(mvm, sta, band); + mutex_unlock(&mvmsta->lq_sta.rs_drv.mutex); + } + } +@@ -4203,7 +4204,7 @@ static int rs_drv_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta, + lq->flags &= ~LQ_FLAG_USE_RTS_MSK; + } + +- return iwl_mvm_send_lq_cmd(mvm, lq, false); ++ return iwl_mvm_send_lq_cmd(mvm, lq); + } + + /** +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index ac9bc65c4d156..22715cdb83171 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -2978,7 +2978,7 @@ out: + IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n", + sta->addr, tid); + +- return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq, false); ++ return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.rs_drv.lq); + } + + static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +index cc56ab88fb439..a71277de2e0eb 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -641,12 +641,12 @@ int iwl_mvm_reconfig_scd(struct iwl_mvm *mvm, int queue, int fifo, int sta_id, + * this case to clear the state indicating that station creation is in + * progress. + */ +-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool sync) ++int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq) + { + struct iwl_host_cmd cmd = { + .id = LQ_CMD, + .len = { sizeof(struct iwl_lq_cmd), }, +- .flags = sync ? 0 : CMD_ASYNC, ++ .flags = CMD_ASYNC, + .data = { lq, }, + }; + +-- +2.20.1 + diff --git a/queue-5.2/kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch b/queue-5.2/kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch new file mode 100644 index 00000000000..65b6c5d2620 --- /dev/null +++ b/queue-5.2/kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch @@ -0,0 +1,83 @@ +From 26dd451b7a89fc33e1fc40d99d38558fd8a07aa0 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 5 Aug 2019 10:34:51 +0100 +Subject: KVM: arm: Don't write junk to CP15 registers on reset + +[ Upstream commit c69509c70aa45a8c4954c88c629a64acf4ee4a36 ] + +At the moment, the way we reset CP15 registers is mildly insane: +We write junk to them, call the reset functions, and then check that +we have something else in them. + +The "fun" thing is that this can happen while the guest is running +(PSCI, for example). If anything in KVM has to evaluate the state +of a CP15 register while junk is in there, bad thing may happen. + +Let's stop doing that. Instead, we track that we have called a +reset function for that register, and assume that the reset +function has done something. + +In the end, the very need of this reset check is pretty dubious, +as it doesn't check everything (a lot of the CP15 reg leave outside +of the cp15_regs[] array). It may well be axed in the near future. + +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + arch/arm/kvm/coproc.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/kvm/coproc.c b/arch/arm/kvm/coproc.c +index d2806bcff8bbb..07745ee022a12 100644 +--- a/arch/arm/kvm/coproc.c ++++ b/arch/arm/kvm/coproc.c +@@ -651,13 +651,22 @@ int kvm_handle_cp14_64(struct kvm_vcpu *vcpu, struct kvm_run *run) + } + + static void reset_coproc_regs(struct kvm_vcpu *vcpu, +- const struct coproc_reg *table, size_t num) ++ const struct coproc_reg *table, size_t num, ++ unsigned long *bmap) + { + unsigned long i; + + for (i = 0; i < num; i++) +- if (table[i].reset) ++ if (table[i].reset) { ++ int reg = table[i].reg; ++ + table[i].reset(vcpu, &table[i]); ++ if (reg > 0 && reg < NR_CP15_REGS) { ++ set_bit(reg, bmap); ++ if (table[i].is_64bit) ++ set_bit(reg + 1, bmap); ++ } ++ } + } + + static struct coproc_params decode_32bit_hsr(struct kvm_vcpu *vcpu) +@@ -1432,17 +1441,15 @@ void kvm_reset_coprocs(struct kvm_vcpu *vcpu) + { + size_t num; + const struct coproc_reg *table; +- +- /* Catch someone adding a register without putting in reset entry. */ +- memset(vcpu->arch.ctxt.cp15, 0x42, sizeof(vcpu->arch.ctxt.cp15)); ++ DECLARE_BITMAP(bmap, NR_CP15_REGS) = { 0, }; + + /* Generic chip reset first (so target could override). */ +- reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs)); ++ reset_coproc_regs(vcpu, cp15_regs, ARRAY_SIZE(cp15_regs), bmap); + + table = get_target_table(vcpu->arch.target, &num); +- reset_coproc_regs(vcpu, table, num); ++ reset_coproc_regs(vcpu, table, num, bmap); + + for (num = 1; num < NR_CP15_REGS; num++) +- WARN(vcpu_cp15(vcpu, num) == 0x42424242, ++ WARN(!test_bit(num, bmap), + "Didn't reset vcpu_cp15(vcpu, %zi)", num); + } +-- +2.20.1 + diff --git a/queue-5.2/kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch b/queue-5.2/kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch new file mode 100644 index 00000000000..679dc27d88d --- /dev/null +++ b/queue-5.2/kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch @@ -0,0 +1,119 @@ +From a9dca1d28f52236f401c54ff146f21a0183fefbf Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Mon, 5 Aug 2019 10:34:51 +0100 +Subject: KVM: arm64: Don't write junk to sysregs on reset + +[ Upstream commit 03fdfb2690099c19160a3f2c5b77db60b3afeded ] + +At the moment, the way we reset system registers is mildly insane: +We write junk to them, call the reset functions, and then check that +we have something else in them. + +The "fun" thing is that this can happen while the guest is running +(PSCI, for example). If anything in KVM has to evaluate the state +of a system register while junk is in there, bad thing may happen. + +Let's stop doing that. Instead, we track that we have called a +reset function for that register, and assume that the reset +function has done something. This requires fixing a couple of +sysreg refinition in the trap table. + +In the end, the very need of this reset check is pretty dubious, +as it doesn't check everything (a lot of the sysregs leave outside of +the sys_regs[] array). It may well be axed in the near future. + +Tested-by: Zenghui Yu +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/sys_regs.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c +index ce933f2960496..5b7085ca213df 100644 +--- a/arch/arm64/kvm/sys_regs.c ++++ b/arch/arm64/kvm/sys_regs.c +@@ -632,7 +632,7 @@ static void reset_pmcr(struct kvm_vcpu *vcpu, const struct sys_reg_desc *r) + */ + val = ((pmcr & ~ARMV8_PMU_PMCR_MASK) + | (ARMV8_PMU_PMCR_MASK & 0xdecafbad)) & (~ARMV8_PMU_PMCR_E); +- __vcpu_sys_reg(vcpu, PMCR_EL0) = val; ++ __vcpu_sys_reg(vcpu, r->reg) = val; + } + + static bool check_pmu_access_disabled(struct kvm_vcpu *vcpu, u64 flags) +@@ -981,13 +981,13 @@ static bool access_pmuserenr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, + /* Silly macro to expand the DBG{BCR,BVR,WVR,WCR}n_EL1 registers in one go */ + #define DBG_BCR_BVR_WCR_WVR_EL1(n) \ + { SYS_DESC(SYS_DBGBVRn_EL1(n)), \ +- trap_bvr, reset_bvr, n, 0, get_bvr, set_bvr }, \ ++ trap_bvr, reset_bvr, 0, 0, get_bvr, set_bvr }, \ + { SYS_DESC(SYS_DBGBCRn_EL1(n)), \ +- trap_bcr, reset_bcr, n, 0, get_bcr, set_bcr }, \ ++ trap_bcr, reset_bcr, 0, 0, get_bcr, set_bcr }, \ + { SYS_DESC(SYS_DBGWVRn_EL1(n)), \ +- trap_wvr, reset_wvr, n, 0, get_wvr, set_wvr }, \ ++ trap_wvr, reset_wvr, 0, 0, get_wvr, set_wvr }, \ + { SYS_DESC(SYS_DBGWCRn_EL1(n)), \ +- trap_wcr, reset_wcr, n, 0, get_wcr, set_wcr } ++ trap_wcr, reset_wcr, 0, 0, get_wcr, set_wcr } + + /* Macro to expand the PMEVCNTRn_EL0 register */ + #define PMU_PMEVCNTR_EL0(n) \ +@@ -1540,7 +1540,7 @@ static const struct sys_reg_desc sys_reg_descs[] = { + { SYS_DESC(SYS_CSSELR_EL1), access_csselr, reset_unknown, CSSELR_EL1 }, + { SYS_DESC(SYS_CTR_EL0), access_ctr }, + +- { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, }, ++ { SYS_DESC(SYS_PMCR_EL0), access_pmcr, reset_pmcr, PMCR_EL0 }, + { SYS_DESC(SYS_PMCNTENSET_EL0), access_pmcnten, reset_unknown, PMCNTENSET_EL0 }, + { SYS_DESC(SYS_PMCNTENCLR_EL0), access_pmcnten, NULL, PMCNTENSET_EL0 }, + { SYS_DESC(SYS_PMOVSCLR_EL0), access_pmovs, NULL, PMOVSSET_EL0 }, +@@ -2254,13 +2254,19 @@ static int emulate_sys_reg(struct kvm_vcpu *vcpu, + } + + static void reset_sys_reg_descs(struct kvm_vcpu *vcpu, +- const struct sys_reg_desc *table, size_t num) ++ const struct sys_reg_desc *table, size_t num, ++ unsigned long *bmap) + { + unsigned long i; + + for (i = 0; i < num; i++) +- if (table[i].reset) ++ if (table[i].reset) { ++ int reg = table[i].reg; ++ + table[i].reset(vcpu, &table[i]); ++ if (reg > 0 && reg < NR_SYS_REGS) ++ set_bit(reg, bmap); ++ } + } + + /** +@@ -2774,18 +2780,16 @@ void kvm_reset_sys_regs(struct kvm_vcpu *vcpu) + { + size_t num; + const struct sys_reg_desc *table; +- +- /* Catch someone adding a register without putting in reset entry. */ +- memset(&vcpu->arch.ctxt.sys_regs, 0x42, sizeof(vcpu->arch.ctxt.sys_regs)); ++ DECLARE_BITMAP(bmap, NR_SYS_REGS) = { 0, }; + + /* Generic chip reset first (so target could override). */ +- reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs)); ++ reset_sys_reg_descs(vcpu, sys_reg_descs, ARRAY_SIZE(sys_reg_descs), bmap); + + table = get_target_table(vcpu->arch.target, true, &num); +- reset_sys_reg_descs(vcpu, table, num); ++ reset_sys_reg_descs(vcpu, table, num, bmap); + + for (num = 1; num < NR_SYS_REGS; num++) { +- if (WARN(__vcpu_sys_reg(vcpu, num) == 0x4242424242424242, ++ if (WARN(!test_bit(num, bmap), + "Didn't reset __vcpu_sys_reg(%zi)\n", num)) + break; + } +-- +2.20.1 + diff --git a/queue-5.2/libata-add-sg-safety-checks-in-sff-pio-transfers.patch b/queue-5.2/libata-add-sg-safety-checks-in-sff-pio-transfers.patch new file mode 100644 index 00000000000..881c561ed6a --- /dev/null +++ b/queue-5.2/libata-add-sg-safety-checks-in-sff-pio-transfers.patch @@ -0,0 +1,46 @@ +From ce5ec16cb4e0f19ff736d7e596f80a4b06492800 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Wed, 7 Aug 2019 12:23:57 -0600 +Subject: libata: add SG safety checks in SFF pio transfers + +[ Upstream commit 752ead44491e8c91e14d7079625c5916b30921c5 ] + +Abort processing of a command if we run out of mapped data in the +SG list. This should never happen, but a previous bug caused it to +be possible. Play it safe and attempt to abort nicely if we don't +have more SG segments left. + +Reviewed-by: Kees Cook +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-sff.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 10aa278821427..4f115adb4ee83 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -658,6 +658,10 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) + unsigned int offset; + unsigned char *buf; + ++ if (!qc->cursg) { ++ qc->curbytes = qc->nbytes; ++ return; ++ } + if (qc->curbytes == qc->nbytes - qc->sect_size) + ap->hsm_task_state = HSM_ST_LAST; + +@@ -683,6 +687,8 @@ static void ata_pio_sector(struct ata_queued_cmd *qc) + + if (qc->cursg_ofs == qc->cursg->length) { + qc->cursg = sg_next(qc->cursg); ++ if (!qc->cursg) ++ ap->hsm_task_state = HSM_ST_LAST; + qc->cursg_ofs = 0; + } + } +-- +2.20.1 + diff --git a/queue-5.2/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch b/queue-5.2/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch new file mode 100644 index 00000000000..b84a281552d --- /dev/null +++ b/queue-5.2/libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch @@ -0,0 +1,82 @@ +From 919fe54872d74180ee32fdfd6a5b9c6aee93fe1f Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Wed, 7 Aug 2019 12:20:52 -0600 +Subject: libata: have ata_scsi_rw_xlat() fail invalid passthrough requests + +[ Upstream commit 2d7271501720038381d45fb3dcbe4831228fc8cc ] + +For passthrough requests, libata-scsi takes what the user passes in +as gospel. This can be problematic if the user fills in the CDB +incorrectly. One example of that is in request sizes. For read/write +commands, the CDB contains fields describing the transfer length of +the request. These should match with the SG_IO header fields, but +libata-scsi currently does no validation of that. + +Check that the number of blocks in the CDB for passthrough requests +matches what was mapped into the request. If the CDB asks for more +data then the validated SG_IO header fields, error it. + +Reported-by: Krishna Ram Prakash R +Reviewed-by: Kees Cook +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-scsi.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 391ac0503dc07..76d0f9de767bc 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -1786,6 +1786,21 @@ nothing_to_do: + return 1; + } + ++static bool ata_check_nblocks(struct scsi_cmnd *scmd, u32 n_blocks) ++{ ++ struct request *rq = scmd->request; ++ u32 req_blocks; ++ ++ if (!blk_rq_is_passthrough(rq)) ++ return true; ++ ++ req_blocks = blk_rq_bytes(rq) / scmd->device->sector_size; ++ if (n_blocks > req_blocks) ++ return false; ++ ++ return true; ++} ++ + /** + * ata_scsi_rw_xlat - Translate SCSI r/w command into an ATA one + * @qc: Storage for translated ATA taskfile +@@ -1830,6 +1845,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) + scsi_10_lba_len(cdb, &block, &n_block); + if (cdb[1] & (1 << 3)) + tf_flags |= ATA_TFLAG_FUA; ++ if (!ata_check_nblocks(scmd, n_block)) ++ goto invalid_fld; + break; + case READ_6: + case WRITE_6: +@@ -1844,6 +1861,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) + */ + if (!n_block) + n_block = 256; ++ if (!ata_check_nblocks(scmd, n_block)) ++ goto invalid_fld; + break; + case READ_16: + case WRITE_16: +@@ -1854,6 +1873,8 @@ static unsigned int ata_scsi_rw_xlat(struct ata_queued_cmd *qc) + scsi_16_lba_len(cdb, &block, &n_block); + if (cdb[1] & (1 << 3)) + tf_flags |= ATA_TFLAG_FUA; ++ if (!ata_check_nblocks(scmd, n_block)) ++ goto invalid_fld; + break; + default: + DPRINTK("no-byte command\n"); +-- +2.20.1 + diff --git a/queue-5.2/libbpf-fix-using-uninitialized-ioctl-results.patch b/queue-5.2/libbpf-fix-using-uninitialized-ioctl-results.patch new file mode 100644 index 00000000000..977b0f3b5e3 --- /dev/null +++ b/queue-5.2/libbpf-fix-using-uninitialized-ioctl-results.patch @@ -0,0 +1,78 @@ +From 5444bf9713f3f1806ad6ab12f639f2beca3b972b Mon Sep 17 00:00:00 2001 +From: Ilya Maximets +Date: Tue, 23 Jul 2019 15:08:10 +0300 +Subject: libbpf: fix using uninitialized ioctl results + +[ Upstream commit decb705e01a5d325c9876b9674043cde4b54f0db ] + +'channels.max_combined' initialized only on ioctl success and +errno is only valid on ioctl failure. + +The code doesn't produce any runtime issues, but makes memory +sanitizers angry: + + Conditional jump or move depends on uninitialised value(s) + at 0x55C056F: xsk_get_max_queues (xsk.c:336) + by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354) + by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447) + by 0x55C0E57: xsk_socket__create (xsk.c:601) + Uninitialised value was created by a stack allocation + at 0x55C04CD: xsk_get_max_queues (xsk.c:318) + +Additionally fixed warning on uninitialized bytes in ioctl arguments: + + Syscall param ioctl(SIOCETHTOOL) points to uninitialised byte(s) + at 0x648D45B: ioctl (in /usr/lib64/libc-2.28.so) + by 0x55C0546: xsk_get_max_queues (xsk.c:330) + by 0x55C05B2: xsk_create_bpf_maps (xsk.c:354) + by 0x55C089F: xsk_setup_xdp_prog (xsk.c:447) + by 0x55C0E57: xsk_socket__create (xsk.c:601) + Address 0x1ffefff378 is on thread 1's stack + in frame #1, created by xsk_get_max_queues (xsk.c:318) + Uninitialised value was created by a stack allocation + at 0x55C04CD: xsk_get_max_queues (xsk.c:318) + +CC: Magnus Karlsson +Fixes: 1cad07884239 ("libbpf: add support for using AF_XDP sockets") +Signed-off-by: Ilya Maximets +Acked-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/xsk.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index ca272c5b67f47..8e03b65830da0 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -327,15 +327,14 @@ static int xsk_load_xdp_prog(struct xsk_socket *xsk) + + static int xsk_get_max_queues(struct xsk_socket *xsk) + { +- struct ethtool_channels channels; +- struct ifreq ifr; ++ struct ethtool_channels channels = { .cmd = ETHTOOL_GCHANNELS }; ++ struct ifreq ifr = {}; + int fd, err, ret; + + fd = socket(AF_INET, SOCK_DGRAM, 0); + if (fd < 0) + return -errno; + +- channels.cmd = ETHTOOL_GCHANNELS; + ifr.ifr_data = (void *)&channels; + strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1); + ifr.ifr_name[IFNAMSIZ - 1] = '\0'; +@@ -345,7 +344,7 @@ static int xsk_get_max_queues(struct xsk_socket *xsk) + goto out; + } + +- if (channels.max_combined == 0 || errno == EOPNOTSUPP) ++ if (err || channels.max_combined == 0) + /* If the device says it has no channels, then all traffic + * is sent to a single stream, so max queues = 1. + */ +-- +2.20.1 + diff --git a/queue-5.2/libbpf-sanitize-var-to-conservative-1-byte-int.patch b/queue-5.2/libbpf-sanitize-var-to-conservative-1-byte-int.patch new file mode 100644 index 00000000000..0bde0a2badd --- /dev/null +++ b/queue-5.2/libbpf-sanitize-var-to-conservative-1-byte-int.patch @@ -0,0 +1,42 @@ +From 284fa0e31c1eba7f1393c8f7eb8fef474f4843da Mon Sep 17 00:00:00 2001 +From: Andrii Nakryiko +Date: Fri, 19 Jul 2019 12:46:03 -0700 +Subject: libbpf: sanitize VAR to conservative 1-byte INT + +[ Upstream commit 1d4126c4e1190d2f7d3f388552f9bd17ae0c64fc ] + +If VAR in non-sanitized BTF was size less than 4, converting such VAR +into an INT with size=4 will cause BTF validation failure due to +violationg of STRUCT (into which DATASEC was converted) member size. +Fix by conservatively using size=1. + +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 3865a5d272514..77e14d9954796 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -1044,8 +1044,13 @@ static void bpf_object__sanitize_btf(struct bpf_object *obj) + if (!has_datasec && kind == BTF_KIND_VAR) { + /* replace VAR with INT */ + t->info = BTF_INFO_ENC(BTF_KIND_INT, 0, 0); +- t->size = sizeof(int); +- *(int *)(t+1) = BTF_INT_ENC(0, 0, 32); ++ /* ++ * using size = 1 is the safest choice, 4 will be too ++ * big and cause kernel BTF validation failure if ++ * original variable took less than 4 bytes ++ */ ++ t->size = 1; ++ *(int *)(t+1) = BTF_INT_ENC(0, 0, 8); + } else if (!has_datasec && kind == BTF_KIND_DATASEC) { + /* replace DATASEC with STRUCT */ + struct btf_var_secinfo *v = (void *)(t + 1); +-- +2.20.1 + diff --git a/queue-5.2/libbpf-silence-gcc8-warning-about-string-truncation.patch b/queue-5.2/libbpf-silence-gcc8-warning-about-string-truncation.patch new file mode 100644 index 00000000000..de58bd4abec --- /dev/null +++ b/queue-5.2/libbpf-silence-gcc8-warning-about-string-truncation.patch @@ -0,0 +1,56 @@ +From a1431c0a4e3400e08cff8fb830495fc1ddcdc21d Mon Sep 17 00:00:00 2001 +From: Andrii Nakryiko +Date: Wed, 24 Jul 2019 14:47:53 -0700 +Subject: libbpf: silence GCC8 warning about string truncation + +[ Upstream commit cb8ffde5694ae5fffb456eae932aac442aa3a207 ] + +Despite a proper NULL-termination after strncpy(..., ..., IFNAMSIZ - 1), +GCC8 still complains about *expected* string truncation: + + xsk.c:330:2: error: 'strncpy' output may be truncated copying 15 bytes + from a string of length 15 [-Werror=stringop-truncation] + strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1); + +This patch gets rid of the issue altogether by using memcpy instead. +There is no performance regression, as strncpy will still copy and fill +all of the bytes anyway. + +v1->v2: +- rebase against bpf tree. + +Cc: Magnus Karlsson +Signed-off-by: Andrii Nakryiko +Acked-by: Magnus Karlsson +Acked-by: Song Liu +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/xsk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index 8e03b65830da0..fa948c5445ecf 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -336,7 +336,7 @@ static int xsk_get_max_queues(struct xsk_socket *xsk) + return -errno; + + ifr.ifr_data = (void *)&channels; +- strncpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1); ++ memcpy(ifr.ifr_name, xsk->ifname, IFNAMSIZ - 1); + ifr.ifr_name[IFNAMSIZ - 1] = '\0'; + err = ioctl(fd, SIOCETHTOOL, &ifr); + if (err && errno != EOPNOTSUPP) { +@@ -561,7 +561,7 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname, + err = -errno; + goto out_socket; + } +- strncpy(xsk->ifname, ifname, IFNAMSIZ - 1); ++ memcpy(xsk->ifname, ifname, IFNAMSIZ - 1); + xsk->ifname[IFNAMSIZ - 1] = '\0'; + + err = xsk_set_xdp_socket_config(&xsk->config, usr_config); +-- +2.20.1 + diff --git a/queue-5.2/mac80211_hwsim-fix-possible-null-pointer-dereference.patch b/queue-5.2/mac80211_hwsim-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..f3b6b3498bd --- /dev/null +++ b/queue-5.2/mac80211_hwsim-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,51 @@ +From 7c45aee975a7c24b29a7f4335b225853b1259186 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Mon, 29 Jul 2019 16:23:32 +0800 +Subject: mac80211_hwsim: Fix possible null-pointer dereferences in + hwsim_dump_radio_nl() + +[ Upstream commit b55f3b841099e641bdb2701d361a4c304e2dbd6f ] + +In hwsim_dump_radio_nl(), when genlmsg_put() on line 3617 fails, hdr is +assigned to NULL. Then hdr is used on lines 3622 and 3623: + genl_dump_check_consistent(cb, hdr); + genlmsg_end(skb, hdr); + +Thus, possible null-pointer dereferences may occur. + +To fix these bugs, hdr is used here when it is not NULL. + +This bug is found by a static analysis tool STCheck written by us. + +Signed-off-by: Jia-Ju Bai +Link: https://lore.kernel.org/r/20190729082332.28895-1-baijiaju1990@gmail.com +[put braces on all branches] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mac80211_hwsim.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 1c699a9fa8661..faec05ab42754 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3615,10 +3615,12 @@ static int hwsim_dump_radio_nl(struct sk_buff *skb, + hdr = genlmsg_put(skb, NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, &hwsim_genl_family, + NLM_F_MULTI, HWSIM_CMD_GET_RADIO); +- if (!hdr) ++ if (hdr) { ++ genl_dump_check_consistent(cb, hdr); ++ genlmsg_end(skb, hdr); ++ } else { + res = -EMSGSIZE; +- genl_dump_check_consistent(cb, hdr); +- genlmsg_end(skb, hdr); ++ } + } + + done: +-- +2.20.1 + diff --git a/queue-5.2/mips-fix-cacheinfo.patch b/queue-5.2/mips-fix-cacheinfo.patch new file mode 100644 index 00000000000..95b2eacad52 --- /dev/null +++ b/queue-5.2/mips-fix-cacheinfo.patch @@ -0,0 +1,47 @@ +From 6c368a73a12a871934f63561bb93ef70c21ae3d1 Mon Sep 17 00:00:00 2001 +From: Vladimir Kondratiev +Date: Tue, 16 Jul 2019 10:36:56 +0300 +Subject: mips: fix cacheinfo + +[ Upstream commit b8bea8a5e5d942e62203416ab41edecaed4fda02 ] + +Because CONFIG_OF defined for MIPS, cacheinfo attempts to fill information +from DT, ignoring data filled by architecture routine. This leads to error +reported + + cacheinfo: Unable to detect cache hierarchy for CPU 0 + +Way to fix this provided in +commit fac51482577d ("drivers: base: cacheinfo: fix x86 with + CONFIG_OF enabled") + +Utilize same mechanism to report that cacheinfo set by architecture +specific function + +Signed-off-by: Vladimir Kondratiev +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/cacheinfo.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/kernel/cacheinfo.c b/arch/mips/kernel/cacheinfo.c +index e0dd66881da68..f777e44653d57 100644 +--- a/arch/mips/kernel/cacheinfo.c ++++ b/arch/mips/kernel/cacheinfo.c +@@ -69,6 +69,8 @@ static int __populate_cache_leaves(unsigned int cpu) + if (c->tcache.waysize) + populate_cache(tcache, this_leaf, 3, CACHE_TYPE_UNIFIED); + ++ this_cpu_ci->cpu_map_populated = true; ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.2/mips-kernel-only-use-i8253-clocksource-with-periodic.patch b/queue-5.2/mips-kernel-only-use-i8253-clocksource-with-periodic.patch new file mode 100644 index 00000000000..889786af92e --- /dev/null +++ b/queue-5.2/mips-kernel-only-use-i8253-clocksource-with-periodic.patch @@ -0,0 +1,38 @@ +From 0634671bc65b48e88b7f999c7e6227610aafeee4 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Mon, 13 May 2019 13:47:25 +0200 +Subject: MIPS: kernel: only use i8253 clocksource with periodic clockevent + +[ Upstream commit a07e3324538a989b7cdbf2c679be6a7f9df2544f ] + +i8253 clocksource needs a free running timer. This could only +be used, if i8253 clockevent is set up as periodic. + +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/i8253.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c +index 5f209f111e59e..df7ddd246eaac 100644 +--- a/arch/mips/kernel/i8253.c ++++ b/arch/mips/kernel/i8253.c +@@ -32,7 +32,8 @@ void __init setup_pit_timer(void) + + static int __init init_pit_clocksource(void) + { +- if (num_possible_cpus() > 1) /* PIT does not scale! */ ++ if (num_possible_cpus() > 1 || /* PIT does not scale! */ ++ !clockevent_state_periodic(&i8253_clockevent)) + return 0; + + return clocksource_i8253_init(); +-- +2.20.1 + diff --git a/queue-5.2/net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch b/queue-5.2/net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch new file mode 100644 index 00000000000..a59b99e396c --- /dev/null +++ b/queue-5.2/net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch @@ -0,0 +1,44 @@ +From 33ed00df46d0a7a07080724e22c12c088407772c Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Tue, 6 Aug 2019 10:55:12 +0200 +Subject: net: cxgb3_main: Fix a resource leak in a error path in 'init_one()' + +[ Upstream commit debea2cd3193ac868289e8893c3a719c265b0612 ] + +A call to 'kfree_skb()' is missing in the error handling path of +'init_one()'. +This is already present in 'remove_one()' but is missing here. + +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +index 1e82b9efe4471..58f89f6a040fe 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +@@ -3269,7 +3269,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (!adapter->regs) { + dev_err(&pdev->dev, "cannot map device registers\n"); + err = -ENOMEM; +- goto out_free_adapter; ++ goto out_free_adapter_nofail; + } + + adapter->pdev = pdev; +@@ -3397,6 +3397,9 @@ out_free_dev: + if (adapter->port[i]) + free_netdev(adapter->port[i]); + ++out_free_adapter_nofail: ++ kfree_skb(adapter->nofail_skb); ++ + out_free_adapter: + kfree(adapter); + +-- +2.20.1 + diff --git a/queue-5.2/net-ethernet-qlogic-qed-force-the-string-buffer-null.patch b/queue-5.2/net-ethernet-qlogic-qed-force-the-string-buffer-null.patch new file mode 100644 index 00000000000..9a8207e8b6e --- /dev/null +++ b/queue-5.2/net-ethernet-qlogic-qed-force-the-string-buffer-null.patch @@ -0,0 +1,40 @@ +From f68e2364f52733a0669ff4af2c16a76ebfef1b31 Mon Sep 17 00:00:00 2001 +From: Wang Xiayang +Date: Wed, 31 Jul 2019 16:15:42 +0800 +Subject: net/ethernet/qlogic/qed: force the string buffer NULL-terminated + +[ Upstream commit 3690c8c9a8edff0db077a38783112d8fe12a7dd2 ] + +strncpy() does not ensure NULL-termination when the input string +size equals to the destination buffer size 30. +The output string is passed to qed_int_deassertion_aeu_bit() +which calls DP_INFO() and relies NULL-termination. + +Use strlcpy instead. The other conditional branch above strncpy() +needs no fix as snprintf() ensures NULL-termination. + +This issue is identified by a Coccinelle script. + +Signed-off-by: Wang Xiayang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_int.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index fdfedbc8e4311..70a771cd87889 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -1093,7 +1093,7 @@ static int qed_int_deassertion(struct qed_hwfn *p_hwfn, + snprintf(bit_name, 30, + p_aeu->bit_name, num); + else +- strncpy(bit_name, ++ strlcpy(bit_name, + p_aeu->bit_name, 30); + + /* We now need to pass bitmask in its +-- +2.20.1 + diff --git a/queue-5.2/net-hisilicon-fix-dma_map_single-failed-on-arm64.patch b/queue-5.2/net-hisilicon-fix-dma_map_single-failed-on-arm64.patch new file mode 100644 index 00000000000..8eda0cbff94 --- /dev/null +++ b/queue-5.2/net-hisilicon-fix-dma_map_single-failed-on-arm64.patch @@ -0,0 +1,107 @@ +From cd6d7d3385e2a917043e5a3de1ea1037ef094999 Mon Sep 17 00:00:00 2001 +From: Jiangfeng Xiao +Date: Sat, 3 Aug 2019 20:31:41 +0800 +Subject: net: hisilicon: Fix dma_map_single failed on arm64 + +[ Upstream commit 96a50c0d907ac8f5c3d6b051031a19eb8a2b53e3 ] + +On the arm64 platform, executing "ifconfig eth0 up" will fail, +returning "ifconfig: SIOCSIFFLAGS: Input/output error." + +ndev->dev is not initialized, dma_map_single->get_dma_ops-> +dummy_dma_ops->__dummy_map_page will return DMA_ERROR_CODE +directly, so when we use dma_map_single, the first parameter +is to use the device of platform_device. + +Signed-off-by: Jiangfeng Xiao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hip04_eth.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index ee6da8d66cd31..51cf6b0db904b 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -153,6 +153,7 @@ struct hip04_priv { + unsigned int reg_inten; + + struct napi_struct napi; ++ struct device *dev; + struct net_device *ndev; + + struct tx_desc *tx_desc; +@@ -383,7 +384,7 @@ static int hip04_tx_reclaim(struct net_device *ndev, bool force) + } + + if (priv->tx_phys[tx_tail]) { +- dma_unmap_single(&ndev->dev, priv->tx_phys[tx_tail], ++ dma_unmap_single(priv->dev, priv->tx_phys[tx_tail], + priv->tx_skb[tx_tail]->len, + DMA_TO_DEVICE); + priv->tx_phys[tx_tail] = 0; +@@ -434,8 +435,8 @@ hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) + return NETDEV_TX_BUSY; + } + +- phys = dma_map_single(&ndev->dev, skb->data, skb->len, DMA_TO_DEVICE); +- if (dma_mapping_error(&ndev->dev, phys)) { ++ phys = dma_map_single(priv->dev, skb->data, skb->len, DMA_TO_DEVICE); ++ if (dma_mapping_error(priv->dev, phys)) { + dev_kfree_skb(skb); + return NETDEV_TX_OK; + } +@@ -505,7 +506,7 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) + goto refill; + } + +- dma_unmap_single(&ndev->dev, priv->rx_phys[priv->rx_head], ++ dma_unmap_single(priv->dev, priv->rx_phys[priv->rx_head], + RX_BUF_SIZE, DMA_FROM_DEVICE); + priv->rx_phys[priv->rx_head] = 0; + +@@ -534,9 +535,9 @@ refill: + buf = netdev_alloc_frag(priv->rx_buf_size); + if (!buf) + goto done; +- phys = dma_map_single(&ndev->dev, buf, ++ phys = dma_map_single(priv->dev, buf, + RX_BUF_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, phys)) ++ if (dma_mapping_error(priv->dev, phys)) + goto done; + priv->rx_buf[priv->rx_head] = buf; + priv->rx_phys[priv->rx_head] = phys; +@@ -639,9 +640,9 @@ static int hip04_mac_open(struct net_device *ndev) + for (i = 0; i < RX_DESC_NUM; i++) { + dma_addr_t phys; + +- phys = dma_map_single(&ndev->dev, priv->rx_buf[i], ++ phys = dma_map_single(priv->dev, priv->rx_buf[i], + RX_BUF_SIZE, DMA_FROM_DEVICE); +- if (dma_mapping_error(&ndev->dev, phys)) ++ if (dma_mapping_error(priv->dev, phys)) + return -EIO; + + priv->rx_phys[i] = phys; +@@ -675,7 +676,7 @@ static int hip04_mac_stop(struct net_device *ndev) + + for (i = 0; i < RX_DESC_NUM; i++) { + if (priv->rx_phys[i]) { +- dma_unmap_single(&ndev->dev, priv->rx_phys[i], ++ dma_unmap_single(priv->dev, priv->rx_phys[i], + RX_BUF_SIZE, DMA_FROM_DEVICE); + priv->rx_phys[i] = 0; + } +@@ -819,6 +820,7 @@ static int hip04_mac_probe(struct platform_device *pdev) + return -ENOMEM; + + priv = netdev_priv(ndev); ++ priv->dev = d; + priv->ndev = ndev; + platform_set_drvdata(pdev, ndev); + SET_NETDEV_DEV(ndev, &pdev->dev); +-- +2.20.1 + diff --git a/queue-5.2/net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch b/queue-5.2/net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch new file mode 100644 index 00000000000..19d4bf55d86 --- /dev/null +++ b/queue-5.2/net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch @@ -0,0 +1,41 @@ +From e170233988ab7a4d28ec54153b2b460cbbe032c1 Mon Sep 17 00:00:00 2001 +From: Jiangfeng Xiao +Date: Sat, 3 Aug 2019 20:31:40 +0800 +Subject: net: hisilicon: fix hip04-xmit never return TX_BUSY + +[ Upstream commit f2243b82785942be519016067ee6c55a063bbfe2 ] + +TX_DESC_NUM is 256, in tx_count, the maximum value of +mod(TX_DESC_NUM - 1) is 254, the variable "count" in +the hip04_mac_start_xmit function is never equal to +(TX_DESC_NUM - 1), so hip04_mac_start_xmit never +return NETDEV_TX_BUSY. + +tx_count is modified to mod(TX_DESC_NUM) so that +the maximum value of tx_count can reach +(TX_DESC_NUM - 1), then hip04_mac_start_xmit can reurn +NETDEV_TX_BUSY. + +Signed-off-by: Jiangfeng Xiao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hip04_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index 5abe88dfe6abf..ee6da8d66cd31 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -181,7 +181,7 @@ struct hip04_priv { + + static inline unsigned int tx_count(unsigned int head, unsigned int tail) + { +- return (head - tail) % (TX_DESC_NUM - 1); ++ return (head - tail) % TX_DESC_NUM; + } + + static void hip04_config_port(struct net_device *ndev, u32 speed, u32 duplex) +-- +2.20.1 + diff --git a/queue-5.2/net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch b/queue-5.2/net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch new file mode 100644 index 00000000000..6cd10cfd66b --- /dev/null +++ b/queue-5.2/net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch @@ -0,0 +1,94 @@ +From e7061399a67f328951ca013b704e1c1a8a7ae518 Mon Sep 17 00:00:00 2001 +From: Jiangfeng Xiao +Date: Sat, 3 Aug 2019 20:31:39 +0800 +Subject: net: hisilicon: make hip04_tx_reclaim non-reentrant + +[ Upstream commit 1a2c070ae805910a853b4a14818481ed2e17c727 ] + +If hip04_tx_reclaim is interrupted while it is running +and then __napi_schedule continues to execute +hip04_rx_poll->hip04_tx_reclaim, reentrancy occurs +and oops is generated. So you need to mask the interrupt +during the hip04_tx_reclaim run. + +The kernel oops exception stack is as follows: + +Unable to handle kernel NULL pointer dereference +at virtual address 00000050 +pgd = c0003000 +[00000050] *pgd=80000000a04003, *pmd=00000000 +Internal error: Oops: 206 [#1] SMP ARM +Modules linked in: hip04_eth mtdblock mtd_blkdevs mtd +ohci_platform ehci_platform ohci_hcd ehci_hcd +vfat fat sd_mod usb_storage scsi_mod usbcore usb_common +CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 4.4.185 #1 +Hardware name: Hisilicon A15 +task: c0a250e0 task.stack: c0a00000 +PC is at hip04_tx_reclaim+0xe0/0x17c [hip04_eth] +LR is at hip04_tx_reclaim+0x30/0x17c [hip04_eth] +pc : [] lr : [] psr: 600e0313 +sp : c0a01d88 ip : 00000000 fp : c0601f9c +r10: 00000000 r9 : c3482380 r8 : 00000001 +r7 : 00000000 r6 : 000000e1 r5 : c3482000 r4 : 0000000c +r3 : f2209800 r2 : 00000000 r1 : 00000000 r0 : 00000000 +Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment kernel +Control: 32c5387d Table: 03d28c80 DAC: 55555555 +Process swapper/0 (pid: 0, stack limit = 0xc0a00190) +Stack: (0xc0a01d88 to 0xc0a02000) +[] (hip04_tx_reclaim [hip04_eth]) from [] + (hip04_rx_poll+0x88/0x368 [hip04_eth]) +[] (hip04_rx_poll [hip04_eth]) from [] (net_rx_action+0x114/0x34c) +[] (net_rx_action) from [] (__do_softirq+0x218/0x318) +[] (__do_softirq) from [] (irq_exit+0x88/0xac) +[] (irq_exit) from [] (msa_irq_exit+0x11c/0x1d4) +[] (msa_irq_exit) from [] (__handle_domain_irq+0x110/0x148) +[] (__handle_domain_irq) from [] (gic_handle_irq+0xd4/0x118) +[] (gic_handle_irq) from [] (__irq_svc+0x40/0x58) +Exception stack(0xc0a01f30 to 0xc0a01f78) +1f20: c0ae8b40 00000000 00000000 00000000 +1f40: 00000002 ffffe000 c0601f9c 00000000 ffffffff c0a2257c c0a22440 c0831a38 +1f60: c0a01ec4 c0a01f80 c0203714 c0203718 600e0213 ffffffff +[] (__irq_svc) from [] (arch_cpu_idle+0x20/0x3c) +[] (arch_cpu_idle) from [] (cpu_startup_entry+0x244/0x29c) +[] (cpu_startup_entry) from [] (rest_init+0xc8/0x10c) +[] (rest_init) from [] (start_kernel+0x468/0x514) +Code: a40599e5 016086e2 018088e2 7660efe6 (503090e5) +---[ end trace 1db21d6d09c49d74 ]--- +Kernel panic - not syncing: Fatal exception in interrupt +CPU3: stopping +CPU: 3 PID: 0 Comm: swapper/3 Tainted: G D O 4.4.185 #1 + +Signed-off-by: Jiangfeng Xiao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hip04_eth.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c +index e1f2978506fd3..5abe88dfe6abf 100644 +--- a/drivers/net/ethernet/hisilicon/hip04_eth.c ++++ b/drivers/net/ethernet/hisilicon/hip04_eth.c +@@ -494,6 +494,9 @@ static int hip04_rx_poll(struct napi_struct *napi, int budget) + u16 len; + u32 err; + ++ /* clean up tx descriptors */ ++ tx_remaining = hip04_tx_reclaim(ndev, false); ++ + while (cnt && !last) { + buf = priv->rx_buf[priv->rx_head]; + skb = build_skb(buf, priv->rx_buf_size); +@@ -554,8 +557,7 @@ refill: + } + napi_complete_done(napi, rx); + done: +- /* clean up tx descriptors and start a new timer if necessary */ +- tx_remaining = hip04_tx_reclaim(ndev, false); ++ /* start a new timer if necessary */ + if (rx < budget && tx_remaining) + hip04_start_tx_timer(priv); + +-- +2.20.1 + diff --git a/queue-5.2/net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch b/queue-5.2/net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch new file mode 100644 index 00000000000..219d03609bd --- /dev/null +++ b/queue-5.2/net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch @@ -0,0 +1,39 @@ +From 1ad609398c77e7135b4da0a1016036de75fe8b17 Mon Sep 17 00:00:00 2001 +From: Maxime Chevallier +Date: Fri, 19 Jul 2019 16:38:48 +0200 +Subject: net: mvpp2: Don't check for 3 consecutive Idle frames for 10G links + +[ Upstream commit bba18318e7d1d5c8b0bbafd65010a0cee3c65608 ] + +PPv2's XLGMAC can wait for 3 idle frames before triggering a link up +event. This can cause the link to be stuck low when there's traffic on +the interface, so disable this feature. + +Fixes: 4bb043262878 ("net: mvpp2: phylink support") +Signed-off-by: Maxime Chevallier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 50ed1bdb632db..885529701de90 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4580,9 +4580,9 @@ static void mvpp2_xlg_config(struct mvpp2_port *port, unsigned int mode, + else + ctrl0 &= ~MVPP22_XLG_CTRL0_RX_FLOW_CTRL_EN; + +- ctrl4 &= ~MVPP22_XLG_CTRL4_MACMODSELECT_GMAC; +- ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC | +- MVPP22_XLG_CTRL4_EN_IDLE_CHECK; ++ ctrl4 &= ~(MVPP22_XLG_CTRL4_MACMODSELECT_GMAC | ++ MVPP22_XLG_CTRL4_EN_IDLE_CHECK); ++ ctrl4 |= MVPP22_XLG_CTRL4_FWD_FC | MVPP22_XLG_CTRL4_FWD_PFC; + + if (old_ctrl0 != ctrl0) + writel(ctrl0, port->base + MVPP22_XLG_CTRL0_REG); +-- +2.20.1 + diff --git a/queue-5.2/net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch b/queue-5.2/net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch new file mode 100644 index 00000000000..830f617cf9b --- /dev/null +++ b/queue-5.2/net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch @@ -0,0 +1,48 @@ +From f7000d6b6b0f7a40e5097121d0f6176160cbc28e Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Tue, 30 Jul 2019 16:08:13 +0800 +Subject: net: phy: phy_led_triggers: Fix a possible null-pointer dereference + in phy_led_trigger_change_speed() + +[ Upstream commit 271da132e29b5341c31eca6ba6a72ea1302ebac8 ] + +In phy_led_trigger_change_speed(), there is an if statement on line 48 +to check whether phy->last_triggered is NULL: + if (!phy->last_triggered) + +When phy->last_triggered is NULL, it is used on line 52: + led_trigger_event(&phy->last_triggered->trigger, LED_OFF); + +Thus, a possible null-pointer dereference may occur. + +To fix this bug, led_trigger_event(&phy->last_triggered->trigger, +LED_OFF) is called when phy->last_triggered is not NULL. + +This bug is found by a static analysis tool STCheck written by +the OSLAB group in Tsinghua University. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phy_led_triggers.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/phy_led_triggers.c b/drivers/net/phy/phy_led_triggers.c +index b86a4b2116f81..59a94e07e7c55 100644 +--- a/drivers/net/phy/phy_led_triggers.c ++++ b/drivers/net/phy/phy_led_triggers.c +@@ -48,8 +48,9 @@ void phy_led_trigger_change_speed(struct phy_device *phy) + if (!phy->last_triggered) + led_trigger_event(&phy->led_link_trigger->trigger, + LED_FULL); ++ else ++ led_trigger_event(&phy->last_triggered->trigger, LED_OFF); + +- led_trigger_event(&phy->last_triggered->trigger, LED_OFF); + led_trigger_event(&plt->trigger, LED_FULL); + phy->last_triggered = plt; + } +-- +2.20.1 + diff --git a/queue-5.2/net-stmmac-fix-issues-when-number-of-queues-4.patch b/queue-5.2/net-stmmac-fix-issues-when-number-of-queues-4.patch new file mode 100644 index 00000000000..e858435558f --- /dev/null +++ b/queue-5.2/net-stmmac-fix-issues-when-number-of-queues-4.patch @@ -0,0 +1,67 @@ +From ffb8375755a6c0dba01b36c4efeb12da8d2dd301 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Tue, 6 Aug 2019 15:16:17 +0200 +Subject: net: stmmac: Fix issues when number of Queues >= 4 + +[ Upstream commit e8df7e8c233a18d2704e37ecff47583b494789d3 ] + +When queues >= 4 we use different registers but we were not subtracting +the offset of 4. Fix this. + +Found out by Coverity. + +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 4 ++++ + drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c | 4 ++++ + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index e3850938cf2f3..d7bf0ad954b8c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -85,6 +85,8 @@ static void dwmac4_rx_queue_priority(struct mac_device_info *hw, + u32 value; + + base_register = (queue < 4) ? GMAC_RXQ_CTRL2 : GMAC_RXQ_CTRL3; ++ if (queue >= 4) ++ queue -= 4; + + value = readl(ioaddr + base_register); + +@@ -102,6 +104,8 @@ static void dwmac4_tx_queue_priority(struct mac_device_info *hw, + u32 value; + + base_register = (queue < 4) ? GMAC_TXQ_PRTY_MAP0 : GMAC_TXQ_PRTY_MAP1; ++ if (queue >= 4) ++ queue -= 4; + + value = readl(ioaddr + base_register); + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +index 64b8cb88ea45d..d4bd99770f5d1 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwxgmac2_core.c +@@ -106,6 +106,8 @@ static void dwxgmac2_rx_queue_prio(struct mac_device_info *hw, u32 prio, + u32 value, reg; + + reg = (queue < 4) ? XGMAC_RXQ_CTRL2 : XGMAC_RXQ_CTRL3; ++ if (queue >= 4) ++ queue -= 4; + + value = readl(ioaddr + reg); + value &= ~XGMAC_PSRQ(queue); +@@ -169,6 +171,8 @@ static void dwxgmac2_map_mtl_to_dma(struct mac_device_info *hw, u32 queue, + u32 value, reg; + + reg = (queue < 4) ? XGMAC_MTL_RXQ_DMA_MAP0 : XGMAC_MTL_RXQ_DMA_MAP1; ++ if (queue >= 4) ++ queue -= 4; + + value = readl(ioaddr + reg); + value &= ~XGMAC_QxMDMACH(queue); +-- +2.20.1 + diff --git a/queue-5.2/net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch b/queue-5.2/net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch new file mode 100644 index 00000000000..fa93897c783 --- /dev/null +++ b/queue-5.2/net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch @@ -0,0 +1,49 @@ +From 46f3957b42fffea07e6a8cff4e1fa98285e834cf Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Sat, 27 Jul 2019 21:21:37 +0200 +Subject: net: stmmac: manage errors returned by of_get_mac_address() + +[ Upstream commit 195b2919ccd7ffcaf6b6bbcb39444a53ab8308c7 ] + +Commit d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") +added support for reading the MAC address from an nvmem-cell. This +required changing the logic to return an error pointer upon failure. + +If stmmac is loaded before the nvmem provider driver then +of_get_mac_address() return an error pointer with -EPROBE_DEFER. + +Propagate this error so the stmmac driver will be probed again after the +nvmem provider driver is loaded. +Default to a random generated MAC address in case of any other error, +instead of using the error pointer as MAC address. + +Fixes: d01f449c008a ("of_net: add NVMEM support to of_get_mac_address") +Signed-off-by: Martin Blumenstingl +Reviewed-by: Neil Armstrong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 0f0f4b31eb7ec..9b5218a8c15bc 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -385,6 +385,13 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + return ERR_PTR(-ENOMEM); + + *mac = of_get_mac_address(np); ++ if (IS_ERR(*mac)) { ++ if (PTR_ERR(*mac) == -EPROBE_DEFER) ++ return ERR_CAST(*mac); ++ ++ *mac = NULL; ++ } ++ + plat->interface = of_get_phy_mode(np); + + /* Get max speed of operation from device tree */ +-- +2.20.1 + diff --git a/queue-5.2/net-stmmac-tc-do-not-return-a-fragment-entry.patch b/queue-5.2/net-stmmac-tc-do-not-return-a-fragment-entry.patch new file mode 100644 index 00000000000..81b88f712be --- /dev/null +++ b/queue-5.2/net-stmmac-tc-do-not-return-a-fragment-entry.patch @@ -0,0 +1,33 @@ +From 4733a786a21c112c3d64a2ba5960b759afc54986 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Tue, 6 Aug 2019 15:16:18 +0200 +Subject: net: stmmac: tc: Do not return a fragment entry + +[ Upstream commit 4a6a1385a4db5f42258a40fcd497cbfd22075968 ] + +Do not try to return a fragment entry from TC list. Otherwise we may not +clean properly allocated entries. + +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +index 58ea18af9813a..37c0bc699cd9c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c +@@ -37,7 +37,7 @@ static struct stmmac_tc_entry *tc_find_entry(struct stmmac_priv *priv, + entry = &priv->tc_entries[i]; + if (!entry->in_use && !first && free) + first = entry; +- if (entry->handle == loc && !free) ++ if ((entry->handle == loc) && !free && !entry->is_frag) + dup = entry; + } + +-- +2.20.1 + diff --git a/queue-5.2/net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch b/queue-5.2/net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch new file mode 100644 index 00000000000..fc67413e070 --- /dev/null +++ b/queue-5.2/net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch @@ -0,0 +1,32 @@ +From 8723a38312b4b9c4725e3cf3756e5f21d4794830 Mon Sep 17 00:00:00 2001 +From: Bob Ham +Date: Wed, 24 Jul 2019 07:52:27 -0700 +Subject: net: usb: qmi_wwan: Add the BroadMobi BM818 card + +[ Upstream commit 9a07406b00cdc6ec689dc142540739575c717f3c ] + +The BroadMobi BM818 M.2 card uses the QMI protocol + +Signed-off-by: Bob Ham +Signed-off-by: Angus Ainslie (Purism) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/qmi_wwan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 8b4ad10cf9402..26c5207466afc 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1294,6 +1294,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ + {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ + {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ ++ {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +-- +2.20.1 + diff --git a/queue-5.2/netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch b/queue-5.2/netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch new file mode 100644 index 00000000000..37494b54129 --- /dev/null +++ b/queue-5.2/netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch @@ -0,0 +1,44 @@ +From 4fe5ff76b72ef4c3e8d36bbcc44b1b79c5f9c994 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Sat, 20 Jul 2019 07:22:45 -0500 +Subject: netfilter: ebtables: fix a memory leak bug in compat + +[ Upstream commit 15a78ba1844a8e052c1226f930133de4cef4e7ad ] + +In compat_do_replace(), a temporary buffer is allocated through vmalloc() +to hold entries copied from the user space. The buffer address is firstly +saved to 'newinfo->entries', and later on assigned to 'entries_tmp'. Then +the entries in this temporary buffer is copied to the internal kernel +structure through compat_copy_entries(). If this copy process fails, +compat_do_replace() should be terminated. However, the allocated temporary +buffer is not freed on this path, leading to a memory leak. + +To fix the bug, free the buffer before returning from compat_do_replace(). + +Signed-off-by: Wenwen Wang +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebtables.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 1fa9ac483173d..c8177a89f52c3 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2267,8 +2267,10 @@ static int compat_do_replace(struct net *net, void __user *user, + state.buf_kern_len = size64; + + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); +- if (WARN_ON(ret < 0)) ++ if (WARN_ON(ret < 0)) { ++ vfree(entries_tmp); + goto out_unlock; ++ } + + vfree(entries_tmp); + tmp.entries_size = size64; +-- +2.20.1 + diff --git a/queue-5.2/netfilter-ipset-actually-allow-destination-mac-addre.patch b/queue-5.2/netfilter-ipset-actually-allow-destination-mac-addre.patch new file mode 100644 index 00000000000..4e29d1fcecc --- /dev/null +++ b/queue-5.2/netfilter-ipset-actually-allow-destination-mac-addre.patch @@ -0,0 +1,43 @@ +From c4dfbb7a6a791165fcdae05ba04a303f79af0eaa Mon Sep 17 00:00:00 2001 +From: Stefano Brivio +Date: Mon, 24 Jun 2019 15:20:11 +0200 +Subject: netfilter: ipset: Actually allow destination MAC address for + hash:ip,mac sets too + +[ Upstream commit b89d15480d0cacacae1a0fe0b3da01b529f2914f ] + +In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address +for mac and ipmac sets"), ipset.git commit 1543514c46a7, I removed the +KADT check that prevents matching on destination MAC addresses for +hash:mac sets, but forgot to remove the same check for hash:ip,mac set. + +Drop this check: functionality is now commented in man pages and there's +no reason to restrict to source MAC address matching anymore. + +Reported-by: Chen Yi +Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets") +Signed-off-by: Stefano Brivio +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_hash_ipmac.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c +index faf59b6a998fe..eb14434083203 100644 +--- a/net/netfilter/ipset/ip_set_hash_ipmac.c ++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c +@@ -89,10 +89,6 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, + struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } }; + struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); + +- /* MAC can be src only */ +- if (!(opt->flags & IPSET_DIM_TWO_SRC)) +- return 0; +- + if (skb_mac_header(skb) < skb->head || + (skb_mac_header(skb) + ETH_HLEN) > skb->data) + return -EINVAL; +-- +2.20.1 + diff --git a/queue-5.2/netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch b/queue-5.2/netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch new file mode 100644 index 00000000000..82bc3373b03 --- /dev/null +++ b/queue-5.2/netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch @@ -0,0 +1,87 @@ +From 6d6cc8e81f5f4ddbed29926db69d0f3f18543f0c Mon Sep 17 00:00:00 2001 +From: Stefano Brivio +Date: Mon, 24 Jun 2019 15:20:12 +0200 +Subject: netfilter: ipset: Copy the right MAC address in bitmap:ip,mac and + hash:ip,mac sets + +[ Upstream commit 1b4a75108d5bc153daf965d334e77e8e94534f96 ] + +In commit 8cc4ccf58379 ("ipset: Allow matching on destination MAC address +for mac and ipmac sets"), ipset.git commit 1543514c46a7, I added to the +KADT functions for sets matching on MAC addreses the copy of source or +destination MAC address depending on the configured match. + +This was done correctly for hash:mac, but for hash:ip,mac and +bitmap:ip,mac, copying and pasting the same code block presents an +obvious problem: in these two set types, the MAC address is the second +dimension, not the first one, and we are actually selecting the MAC +address depending on whether the first dimension (IP address) specifies +source or destination. + +Fix this by checking for the IPSET_DIM_TWO_SRC flag in option flags. + +This way, mixing source and destination matches for the two dimensions +of ip,mac set types works as expected. With this setup: + + ip netns add A + ip link add veth1 type veth peer name veth2 netns A + ip addr add 192.0.2.1/24 dev veth1 + ip -net A addr add 192.0.2.2/24 dev veth2 + ip link set veth1 up + ip -net A link set veth2 up + + dst=$(ip netns exec A cat /sys/class/net/veth2/address) + + ip netns exec A ipset create test_bitmap bitmap:ip,mac range 192.0.0.0/16 + ip netns exec A ipset add test_bitmap 192.0.2.1,${dst} + ip netns exec A iptables -A INPUT -m set ! --match-set test_bitmap src,dst -j DROP + + ip netns exec A ipset create test_hash hash:ip,mac + ip netns exec A ipset add test_hash 192.0.2.1,${dst} + ip netns exec A iptables -A INPUT -m set ! --match-set test_hash src,dst -j DROP + +ipset correctly matches a test packet: + + # ping -c1 192.0.2.2 >/dev/null + # echo $? + 0 + +Reported-by: Chen Yi +Fixes: 8cc4ccf58379 ("ipset: Allow matching on destination MAC address for mac and ipmac sets") +Signed-off-by: Stefano Brivio +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_bitmap_ipmac.c | 2 +- + net/netfilter/ipset/ip_set_hash_ipmac.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +index b73c37b3a791f..cfe7b556775f1 100644 +--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c ++++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c +@@ -227,7 +227,7 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, + + e.id = ip_to_id(map, ip); + +- if (opt->flags & IPSET_DIM_ONE_SRC) ++ if (opt->flags & IPSET_DIM_TWO_SRC) + ether_addr_copy(e.ether, eth_hdr(skb)->h_source); + else + ether_addr_copy(e.ether, eth_hdr(skb)->h_dest); +diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c +index eb14434083203..24d8f4df4230c 100644 +--- a/net/netfilter/ipset/ip_set_hash_ipmac.c ++++ b/net/netfilter/ipset/ip_set_hash_ipmac.c +@@ -93,7 +93,7 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, + (skb_mac_header(skb) + ETH_HLEN) > skb->data) + return -EINVAL; + +- if (opt->flags & IPSET_DIM_ONE_SRC) ++ if (opt->flags & IPSET_DIM_TWO_SRC) + ether_addr_copy(e.ether, eth_hdr(skb)->h_source); + else + ether_addr_copy(e.ether, eth_hdr(skb)->h_dest); +-- +2.20.1 + diff --git a/queue-5.2/netfilter-ipset-fix-rename-concurrency-with-listing.patch b/queue-5.2/netfilter-ipset-fix-rename-concurrency-with-listing.patch new file mode 100644 index 00000000000..b944325371a --- /dev/null +++ b/queue-5.2/netfilter-ipset-fix-rename-concurrency-with-listing.patch @@ -0,0 +1,38 @@ +From 2ebe878f04c8a15ccf3995c841bb0456708f6b63 Mon Sep 17 00:00:00 2001 +From: Jozsef Kadlecsik +Date: Tue, 23 Jul 2019 10:25:55 +0200 +Subject: netfilter: ipset: Fix rename concurrency with listing + +[ Upstream commit 6c1f7e2c1b96ab9b09ac97c4df2bd9dc327206f6 ] + +Shijie Luo reported that when stress-testing ipset with multiple concurrent +create, rename, flush, list, destroy commands, it can result + +ipset : Broken LIST kernel message: missing DATA part! + +error messages and broken list results. The problem was the rename operation +was not properly handled with respect of listing. The patch fixes the issue. + +Reported-by: Shijie Luo +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +--- + net/netfilter/ipset/ip_set_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index 16afa0df4004d..e103c875383a5 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -1161,7 +1161,7 @@ static int ip_set_rename(struct net *net, struct sock *ctnl, + return -ENOENT; + + write_lock_bh(&ip_set_ref_lock); +- if (set->ref != 0) { ++ if (set->ref != 0 || set->ref_netlink != 0) { + ret = -IPSET_ERR_REFERENCED; + goto out; + } +-- +2.20.1 + diff --git a/queue-5.2/nfs-fix-regression-whereby-fscache-errors-are-appear.patch b/queue-5.2/nfs-fix-regression-whereby-fscache-errors-are-appear.patch new file mode 100644 index 00000000000..a501ddc2d1b --- /dev/null +++ b/queue-5.2/nfs-fix-regression-whereby-fscache-errors-are-appear.patch @@ -0,0 +1,86 @@ +From 1c07b194a3f7fdfa340b9bc5b89770c2648dd216 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 3 Aug 2019 13:39:24 -0400 +Subject: NFS: Fix regression whereby fscache errors are appearing on 'nofsc' + mounts + +[ Upstream commit dea1bb35c5f35e0577cfc61f79261d80b8715221 ] + +People are reporing seeing fscache errors being reported concerning +duplicate cookies even in cases where they are not setting up fscache +at all. The rule needs to be that if fscache is not enabled, then it +should have no side effects at all. + +To ensure this is the case, we disable fscache completely on all superblocks +for which the 'fsc' mount option was not set. In order to avoid issues +with '-oremount', we also disable the ability to turn fscache on via +remount. + +Fixes: f1fe29b4a02d ("NFS: Use i_writecount to control whether...") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=200145 +Signed-off-by: Trond Myklebust +Cc: Steve Dickson +Cc: David Howells +Signed-off-by: Sasha Levin +--- + fs/nfs/fscache.c | 7 ++++++- + fs/nfs/fscache.h | 2 +- + fs/nfs/super.c | 1 + + 3 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/fscache.c b/fs/nfs/fscache.c +index 53507aa96b0b6..3800ab6f08fa8 100644 +--- a/fs/nfs/fscache.c ++++ b/fs/nfs/fscache.c +@@ -114,6 +114,10 @@ void nfs_fscache_get_super_cookie(struct super_block *sb, const char *uniq, int + struct rb_node **p, *parent; + int diff; + ++ nfss->fscache_key = NULL; ++ nfss->fscache = NULL; ++ if (!(nfss->options & NFS_OPTION_FSCACHE)) ++ return; + if (!uniq) { + uniq = ""; + ulen = 1; +@@ -226,10 +230,11 @@ void nfs_fscache_release_super_cookie(struct super_block *sb) + void nfs_fscache_init_inode(struct inode *inode) + { + struct nfs_fscache_inode_auxdata auxdata; ++ struct nfs_server *nfss = NFS_SERVER(inode); + struct nfs_inode *nfsi = NFS_I(inode); + + nfsi->fscache = NULL; +- if (!S_ISREG(inode->i_mode)) ++ if (!(nfss->fscache && S_ISREG(inode->i_mode))) + return; + + memset(&auxdata, 0, sizeof(auxdata)); +diff --git a/fs/nfs/fscache.h b/fs/nfs/fscache.h +index 25a75e40d91d9..ad041cfbf9ec0 100644 +--- a/fs/nfs/fscache.h ++++ b/fs/nfs/fscache.h +@@ -182,7 +182,7 @@ static inline void nfs_fscache_wait_on_invalidate(struct inode *inode) + */ + static inline const char *nfs_server_fscache_state(struct nfs_server *server) + { +- if (server->fscache && (server->options & NFS_OPTION_FSCACHE)) ++ if (server->fscache) + return "yes"; + return "no "; + } +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index f88ddac2dcdf3..4d375b517eda8 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2239,6 +2239,7 @@ nfs_compare_remount_data(struct nfs_server *nfss, + data->acdirmin != nfss->acdirmin / HZ || + data->acdirmax != nfss->acdirmax / HZ || + data->timeo != (10U * nfss->client->cl_timeout->to_initval / HZ) || ++ (data->options & NFS_OPTION_FSCACHE) != (nfss->options & NFS_OPTION_FSCACHE) || + data->nfs_server.port != nfss->port || + data->nfs_server.addrlen != nfss->nfs_client->cl_addrlen || + !rpc_cmp_addr((struct sockaddr *)&data->nfs_server.address, +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-ensure-state-recovery-handles-etimedout-correc.patch b/queue-5.2/nfsv4-ensure-state-recovery-handles-etimedout-correc.patch new file mode 100644 index 00000000000..1f2adef3936 --- /dev/null +++ b/queue-5.2/nfsv4-ensure-state-recovery-handles-etimedout-correc.patch @@ -0,0 +1,91 @@ +From 4f3720990a9ede2cb813d0b19dd5b5d34ea91f76 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 7 Aug 2019 07:31:27 -0400 +Subject: NFSv4: Ensure state recovery handles ETIMEDOUT correctly + +[ Upstream commit 67e7b52d44e3d539dfbfcd866c3d3d69da23a909 ] + +Ensure that the state recovery code handles ETIMEDOUT correctly, +and also that we set RPC_TASK_TIMEOUT when recovering open state. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 ++ + fs/nfs/nfs4state.c | 7 +++++-- + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 74e1732a4bd01..2023011c7a8fe 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2150,6 +2150,7 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct + case -ENOENT: + case -EAGAIN: + case -ESTALE: ++ case -ETIMEDOUT: + break; + case -NFS4ERR_BADSESSION: + case -NFS4ERR_BADSLOT: +@@ -2470,6 +2471,7 @@ static int nfs4_run_open_task(struct nfs4_opendata *data, + if (!ctx) { + nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 1); + data->is_recover = true; ++ task_setup_data.flags |= RPC_TASK_TIMEOUT; + } else { + nfs4_init_sequence(&o_arg->seq_args, &o_res->seq_res, 1, 0); + pnfs_lgopen_prepare(data, ctx); +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 261de26d897f7..0e69cd846afb5 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1528,6 +1528,7 @@ restart: + switch (status) { + case 0: + break; ++ case -ETIMEDOUT: + case -ESTALE: + case -NFS4ERR_ADMIN_REVOKED: + case -NFS4ERR_STALE_STATEID: +@@ -1681,11 +1682,13 @@ restart: + case -NFS4ERR_EXPIRED: + case -NFS4ERR_NO_GRACE: + nfs4_state_mark_reclaim_nograce(sp->so_server->nfs_client, state); ++ /* Fall through */ + case -NFS4ERR_STALE_CLIENTID: + case -NFS4ERR_BADSESSION: + case -NFS4ERR_BADSLOT: + case -NFS4ERR_BAD_HIGH_SLOT: + case -NFS4ERR_CONN_NOT_BOUND_TO_SESSION: ++ case -ETIMEDOUT: + goto out_err; + } + nfs4_put_open_state(state); +@@ -1970,7 +1973,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status) + return -EPERM; + case -EACCES: + case -NFS4ERR_DELAY: +- case -ETIMEDOUT: + case -EAGAIN: + ssleep(1); + break; +@@ -2599,7 +2601,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + } + + /* Now recover expired state... */ +- if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) { ++ if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) { + section = "reclaim nograce"; + status = nfs4_do_reclaim(clp, + clp->cl_mvops->nograce_recovery_ops); +@@ -2607,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + continue; + if (status < 0) + goto out_error; ++ clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state); + } + + nfs4_end_drain_session(clp); +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch b/queue-5.2/nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch new file mode 100644 index 00000000000..a12206feb87 --- /dev/null +++ b/queue-5.2/nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch @@ -0,0 +1,34 @@ +From fe07427f4c9b9b5ffed9663f78e8e011db94a0ef Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 19 Jul 2019 13:48:44 -0400 +Subject: NFSv4: Fix a credential refcount leak in + nfs41_check_delegation_stateid + +[ Upstream commit 8c39a39e28b86a4021d9be314ce01019bafa5fdc ] + +It is unsafe to dereference delegation outside the rcu lock, and in +any case, the refcount is guaranteed held if cred is non-zero. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 63edda145d1b8..420f2350c2781 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2752,8 +2752,7 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state) + if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) + nfs_finish_clear_delegation_stateid(state, &stateid); + +- if (delegation->cred) +- put_cred(cred); ++ put_cred(cred); + } + + /** +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch b/queue-5.2/nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch new file mode 100644 index 00000000000..0188777a4fe --- /dev/null +++ b/queue-5.2/nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch @@ -0,0 +1,142 @@ +From 8f6e029060201bfb475b1d541bc0c35fb7335463 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 3 Aug 2019 10:11:27 -0400 +Subject: NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() + +[ Upstream commit c77e22834ae9a11891cb613bd9a551be1b94f2bc ] + +John Hubbard reports seeing the following stack trace: + +nfs4_do_reclaim + rcu_read_lock /* we are now in_atomic() and must not sleep */ + nfs4_purge_state_owners + nfs4_free_state_owner + nfs4_destroy_seqid_counter + rpc_destroy_wait_queue + cancel_delayed_work_sync + __cancel_work_timer + __flush_work + start_flush_work + might_sleep: + (kernel/workqueue.c:2975: BUG) + +The solution is to separate out the freeing of the state owners +from nfs4_purge_state_owners(), and perform that outside the atomic +context. + +Reported-by: John Hubbard +Fixes: 0aaaf5c424c7f ("NFS: Cache state owners after files are closed") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4_fs.h | 3 ++- + fs/nfs/nfs4client.c | 5 ++++- + fs/nfs/nfs4state.c | 27 ++++++++++++++++++++++----- + 3 files changed, 28 insertions(+), 7 deletions(-) + +diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h +index 8a38a254f5162..235919156eddd 100644 +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -465,7 +465,8 @@ static inline void nfs4_schedule_session_recovery(struct nfs4_session *session, + + extern struct nfs4_state_owner *nfs4_get_state_owner(struct nfs_server *, const struct cred *, gfp_t); + extern void nfs4_put_state_owner(struct nfs4_state_owner *); +-extern void nfs4_purge_state_owners(struct nfs_server *); ++extern void nfs4_purge_state_owners(struct nfs_server *, struct list_head *); ++extern void nfs4_free_state_owners(struct list_head *head); + extern struct nfs4_state * nfs4_get_open_state(struct inode *, struct nfs4_state_owner *); + extern void nfs4_put_open_state(struct nfs4_state *); + extern void nfs4_close_state(struct nfs4_state *, fmode_t); +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 81b9b6d7927ac..208a236dc2350 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -758,9 +758,12 @@ out: + + static void nfs4_destroy_server(struct nfs_server *server) + { ++ LIST_HEAD(freeme); ++ + nfs_server_return_all_delegations(server); + unset_pnfs_layoutdriver(server); +- nfs4_purge_state_owners(server); ++ nfs4_purge_state_owners(server, &freeme); ++ nfs4_free_state_owners(&freeme); + } + + /* +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 556ec916846f0..261de26d897f7 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -624,24 +624,39 @@ void nfs4_put_state_owner(struct nfs4_state_owner *sp) + /** + * nfs4_purge_state_owners - Release all cached state owners + * @server: nfs_server with cached state owners to release ++ * @head: resulting list of state owners + * + * Called at umount time. Remaining state owners will be on + * the LRU with ref count of zero. ++ * Note that the state owners are not freed, but are added ++ * to the list @head, which can later be used as an argument ++ * to nfs4_free_state_owners. + */ +-void nfs4_purge_state_owners(struct nfs_server *server) ++void nfs4_purge_state_owners(struct nfs_server *server, struct list_head *head) + { + struct nfs_client *clp = server->nfs_client; + struct nfs4_state_owner *sp, *tmp; +- LIST_HEAD(doomed); + + spin_lock(&clp->cl_lock); + list_for_each_entry_safe(sp, tmp, &server->state_owners_lru, so_lru) { +- list_move(&sp->so_lru, &doomed); ++ list_move(&sp->so_lru, head); + nfs4_remove_state_owner_locked(sp); + } + spin_unlock(&clp->cl_lock); ++} + +- list_for_each_entry_safe(sp, tmp, &doomed, so_lru) { ++/** ++ * nfs4_purge_state_owners - Release all cached state owners ++ * @head: resulting list of state owners ++ * ++ * Frees a list of state owners that was generated by ++ * nfs4_purge_state_owners ++ */ ++void nfs4_free_state_owners(struct list_head *head) ++{ ++ struct nfs4_state_owner *sp, *tmp; ++ ++ list_for_each_entry_safe(sp, tmp, head, so_lru) { + list_del(&sp->so_lru); + nfs4_free_state_owner(sp); + } +@@ -1864,12 +1879,13 @@ static int nfs4_do_reclaim(struct nfs_client *clp, const struct nfs4_state_recov + struct nfs4_state_owner *sp; + struct nfs_server *server; + struct rb_node *pos; ++ LIST_HEAD(freeme); + int status = 0; + + restart: + rcu_read_lock(); + list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { +- nfs4_purge_state_owners(server); ++ nfs4_purge_state_owners(server, &freeme); + spin_lock(&clp->cl_lock); + for (pos = rb_first(&server->state_owners); + pos != NULL; +@@ -1898,6 +1914,7 @@ restart: + spin_unlock(&clp->cl_lock); + } + rcu_read_unlock(); ++ nfs4_free_state_owners(&freeme); + return 0; + } + +-- +2.20.1 + diff --git a/queue-5.2/nfsv4-when-recovering-state-fails-with-eagain-retry-.patch b/queue-5.2/nfsv4-when-recovering-state-fails-with-eagain-retry-.patch new file mode 100644 index 00000000000..83dd12a29a0 --- /dev/null +++ b/queue-5.2/nfsv4-when-recovering-state-fails-with-eagain-retry-.patch @@ -0,0 +1,60 @@ +From 8731eb0d22eeed2eab7b137888f1d7d40b74c0bc Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 22 Jul 2019 09:54:29 +0100 +Subject: NFSv4: When recovering state fails with EAGAIN, retry the same + recovery + +[ Upstream commit c34fae003c79570b6c930b425fea3f0b7b1e7056 ] + +If the server returns with EAGAIN when we're trying to recover from +a server reboot, we currently delay for 1 second, but then mark the +stateid as needing recovery after the grace period has expired. + +Instead, we should just retry the same recovery process immediately +after the 1 second delay. Break out of the loop after 10 retries. + +Fixes: 35a61606a612 ("NFS: Reduce indentation of the switch statement...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4state.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index e2e3c4f04d3e0..556ec916846f0 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1606,6 +1606,7 @@ static int __nfs4_reclaim_open_state(struct nfs4_state_owner *sp, struct nfs4_st + static int nfs4_reclaim_open_state(struct nfs4_state_owner *sp, const struct nfs4_state_recovery_ops *ops) + { + struct nfs4_state *state; ++ unsigned int loop = 0; + int status = 0; + + /* Note: we rely on the sp->so_states list being ordered +@@ -1632,8 +1633,10 @@ restart: + + switch (status) { + default: +- if (status >= 0) ++ if (status >= 0) { ++ loop = 0; + break; ++ } + printk(KERN_ERR "NFS: %s: unhandled error %d\n", __func__, status); + /* Fall through */ + case -ENOENT: +@@ -1647,6 +1650,10 @@ restart: + break; + case -EAGAIN: + ssleep(1); ++ if (loop++ < 10) { ++ set_bit(ops->state_flag_bit, &state->flags); ++ break; ++ } + /* Fall through */ + case -NFS4ERR_ADMIN_REVOKED: + case -NFS4ERR_STALE_STATEID: +-- +2.20.1 + diff --git a/queue-5.2/nfsv4.1-fix-open-stateid-recovery.patch b/queue-5.2/nfsv4.1-fix-open-stateid-recovery.patch new file mode 100644 index 00000000000..fdc9f9f4636 --- /dev/null +++ b/queue-5.2/nfsv4.1-fix-open-stateid-recovery.patch @@ -0,0 +1,172 @@ +From 8a210359ebe2f5ccc88a11f5a253355b95bf969d Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 22 Jul 2019 18:32:59 +0100 +Subject: NFSv4.1: Fix open stateid recovery + +[ Upstream commit 27a30cf64a5cbe2105e4ff9613246b32d584766a ] + +The logic for checking in nfs41_check_open_stateid() whether the state +is supported by a delegation is inverted. In addition, it makes more +sense to perform that check before we check for expired locks. + +Fixes: 8a64c4ef106d1 ("NFSv4.1: Even if the stateid is OK,...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 65 +++++++++++++++++++++++++++-------------------- + 1 file changed, 38 insertions(+), 27 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 420f2350c2781..74e1732a4bd01 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1654,6 +1654,14 @@ static void nfs_state_set_open_stateid(struct nfs4_state *state, + write_sequnlock(&state->seqlock); + } + ++static void nfs_state_clear_open_state_flags(struct nfs4_state *state) ++{ ++ clear_bit(NFS_O_RDWR_STATE, &state->flags); ++ clear_bit(NFS_O_WRONLY_STATE, &state->flags); ++ clear_bit(NFS_O_RDONLY_STATE, &state->flags); ++ clear_bit(NFS_OPEN_STATE, &state->flags); ++} ++ + static void nfs_state_set_delegation(struct nfs4_state *state, + const nfs4_stateid *deleg_stateid, + fmode_t fmode) +@@ -2049,13 +2057,7 @@ static int nfs4_open_recover(struct nfs4_opendata *opendata, struct nfs4_state * + { + int ret; + +- /* Don't trigger recovery in nfs_test_and_clear_all_open_stateid */ +- clear_bit(NFS_O_RDWR_STATE, &state->flags); +- clear_bit(NFS_O_WRONLY_STATE, &state->flags); +- clear_bit(NFS_O_RDONLY_STATE, &state->flags); + /* memory barrier prior to reading state->n_* */ +- clear_bit(NFS_DELEGATED_STATE, &state->flags); +- clear_bit(NFS_OPEN_STATE, &state->flags); + smp_rmb(); + ret = nfs4_open_recover_helper(opendata, FMODE_READ|FMODE_WRITE); + if (ret != 0) +@@ -2131,6 +2133,8 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta + ctx = nfs4_state_find_open_context(state); + if (IS_ERR(ctx)) + return -EAGAIN; ++ clear_bit(NFS_DELEGATED_STATE, &state->flags); ++ nfs_state_clear_open_state_flags(state); + ret = nfs4_do_open_reclaim(ctx, state); + put_nfs_open_context(ctx); + return ret; +@@ -2672,6 +2676,7 @@ static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st + { + /* NFSv4.0 doesn't allow for delegation recovery on open expire */ + nfs40_clear_delegation_stateid(state); ++ nfs_state_clear_open_state_flags(state); + return nfs4_open_expired(sp, state); + } + +@@ -2714,13 +2719,13 @@ out_free: + return -NFS4ERR_EXPIRED; + } + +-static void nfs41_check_delegation_stateid(struct nfs4_state *state) ++static int nfs41_check_delegation_stateid(struct nfs4_state *state) + { + struct nfs_server *server = NFS_SERVER(state->inode); + nfs4_stateid stateid; + struct nfs_delegation *delegation; + const struct cred *cred = NULL; +- int status; ++ int status, ret = NFS_OK; + + /* Get the delegation credential for use by test/free_stateid */ + rcu_read_lock(); +@@ -2728,20 +2733,15 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state) + if (delegation == NULL) { + rcu_read_unlock(); + nfs_state_clear_delegation(state); +- return; ++ return NFS_OK; + } + + nfs4_stateid_copy(&stateid, &delegation->stateid); +- if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) { +- rcu_read_unlock(); +- nfs_state_clear_delegation(state); +- return; +- } + + if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, + &delegation->flags)) { + rcu_read_unlock(); +- return; ++ return NFS_OK; + } + + if (delegation->cred) +@@ -2751,8 +2751,24 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state) + trace_nfs4_test_delegation_stateid(state, NULL, status); + if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) + nfs_finish_clear_delegation_stateid(state, &stateid); ++ else ++ ret = status; + + put_cred(cred); ++ return ret; ++} ++ ++static void nfs41_delegation_recover_stateid(struct nfs4_state *state) ++{ ++ nfs4_stateid tmp; ++ ++ if (test_bit(NFS_DELEGATED_STATE, &state->flags) && ++ nfs4_copy_delegation_stateid(state->inode, state->state, ++ &tmp, NULL) && ++ nfs4_stateid_match_other(&state->stateid, &tmp)) ++ nfs_state_set_delegation(state, &tmp, state->state); ++ else ++ nfs_state_clear_delegation(state); + } + + /** +@@ -2822,21 +2838,12 @@ static int nfs41_check_open_stateid(struct nfs4_state *state) + const struct cred *cred = state->owner->so_cred; + int status; + +- if (test_bit(NFS_OPEN_STATE, &state->flags) == 0) { +- if (test_bit(NFS_DELEGATED_STATE, &state->flags) == 0) { +- if (nfs4_have_delegation(state->inode, state->state)) +- return NFS_OK; +- return -NFS4ERR_OPENMODE; +- } ++ if (test_bit(NFS_OPEN_STATE, &state->flags) == 0) + return -NFS4ERR_BAD_STATEID; +- } + status = nfs41_test_and_free_expired_stateid(server, stateid, cred); + trace_nfs4_test_open_stateid(state, NULL, status); + if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) { +- clear_bit(NFS_O_RDONLY_STATE, &state->flags); +- clear_bit(NFS_O_WRONLY_STATE, &state->flags); +- clear_bit(NFS_O_RDWR_STATE, &state->flags); +- clear_bit(NFS_OPEN_STATE, &state->flags); ++ nfs_state_clear_open_state_flags(state); + stateid->type = NFS4_INVALID_STATEID_TYPE; + return status; + } +@@ -2849,7 +2856,11 @@ static int nfs41_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *st + { + int status; + +- nfs41_check_delegation_stateid(state); ++ status = nfs41_check_delegation_stateid(state); ++ if (status != NFS_OK) ++ return status; ++ nfs41_delegation_recover_stateid(state); ++ + status = nfs41_check_expired_locks(state); + if (status != NFS_OK) + return status; +-- +2.20.1 + diff --git a/queue-5.2/nfsv4.1-only-reap-expired-delegations.patch b/queue-5.2/nfsv4.1-only-reap-expired-delegations.patch new file mode 100644 index 00000000000..695d7286bf1 --- /dev/null +++ b/queue-5.2/nfsv4.1-only-reap-expired-delegations.patch @@ -0,0 +1,68 @@ +From 83bc740a79a35ed5d9da162a1b53f787ad2dd355 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 26 Jul 2019 14:40:53 +0100 +Subject: NFSv4.1: Only reap expired delegations + +[ Upstream commit ad11408970df79d5f481aa9964e91f183133424c ] + +Fix nfs_reap_expired_delegations() to ensure that we only reap delegations +that are actually expired, rather than triggering on random errors. + +Fixes: 45870d6909d5a ("NFSv4.1: Test delegation stateids when server...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/delegation.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 0af854cce8ffa..071b90a45933a 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -1046,6 +1046,22 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp) + nfs4_schedule_state_manager(clp); + } + ++static void ++nfs_delegation_test_free_expired(struct inode *inode, ++ nfs4_stateid *stateid, ++ const struct cred *cred) ++{ ++ struct nfs_server *server = NFS_SERVER(inode); ++ const struct nfs4_minor_version_ops *ops = server->nfs_client->cl_mvops; ++ int status; ++ ++ if (!cred) ++ return; ++ status = ops->test_and_free_expired(server, stateid, cred); ++ if (status == -NFS4ERR_EXPIRED || status == -NFS4ERR_BAD_STATEID) ++ nfs_remove_bad_delegation(inode, stateid); ++} ++ + /** + * nfs_reap_expired_delegations - reap expired delegations + * @clp: nfs_client to process +@@ -1057,7 +1073,6 @@ void nfs_test_expired_all_delegations(struct nfs_client *clp) + */ + void nfs_reap_expired_delegations(struct nfs_client *clp) + { +- const struct nfs4_minor_version_ops *ops = clp->cl_mvops; + struct nfs_delegation *delegation; + struct nfs_server *server; + struct inode *inode; +@@ -1088,11 +1103,7 @@ restart: + nfs4_stateid_copy(&stateid, &delegation->stateid); + clear_bit(NFS_DELEGATION_TEST_EXPIRED, &delegation->flags); + rcu_read_unlock(); +- if (cred != NULL && +- ops->test_and_free_expired(server, &stateid, cred) < 0) { +- nfs_revoke_delegation(inode, &stateid); +- nfs_inode_find_state_and_recover(inode, &stateid); +- } ++ nfs_delegation_test_free_expired(inode, &stateid, cred); + put_cred(cred); + if (nfs4_server_rebooted(clp)) { + nfs_inode_mark_test_expired_delegation(server,inode); +-- +2.20.1 + diff --git a/queue-5.2/nl-mac-80211-fix-interface-combinations-on-crypto-co.patch b/queue-5.2/nl-mac-80211-fix-interface-combinations-on-crypto-co.patch new file mode 100644 index 00000000000..7e3a88f7790 --- /dev/null +++ b/queue-5.2/nl-mac-80211-fix-interface-combinations-on-crypto-co.patch @@ -0,0 +1,178 @@ +From eae8058f0e0dff7500187b253d4545826c80c9e6 Mon Sep 17 00:00:00 2001 +From: Manikanta Pubbisetty +Date: Mon, 22 Jul 2019 12:44:50 +0530 +Subject: {nl,mac}80211: fix interface combinations on crypto controlled + devices + +[ Upstream commit e6f4051123fd33901e9655a675b22aefcdc5d277 ] + +Commit 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on +crypto controlled devices") has introduced a change which allows +4addr operation on crypto controlled devices (ex: ath10k). This +change has inadvertently impacted the interface combinations logic +on such devices. + +General rule is that software interfaces like AP/VLAN should not be +listed under supported interface combinations and should not be +considered during validation of these combinations; because of the +aforementioned change, AP/VLAN interfaces(if present) will be checked +against interfaces supported by the device and blocks valid interface +combinations. + +Consider a case where an AP and AP/VLAN are up and running; when a +second AP device is brought up on the same physical device, this AP +will be checked against the AP/VLAN interface (which will not be +part of supported interface combinations of the device) and blocks +second AP to come up. + +Add a new API cfg80211_iftype_allowed() to fix the problem, this +API works for all devices with/without SW crypto control. + +Signed-off-by: Manikanta Pubbisetty +Fixes: 33d915d9e8ce ("{nl,mac}80211: allow 4addr AP operation on crypto controlled devices") +Link: https://lore.kernel.org/r/1563779690-9716-1-git-send-email-mpubbise@codeaurora.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + include/net/cfg80211.h | 15 +++++++++++++++ + net/mac80211/util.c | 7 +++---- + net/wireless/core.c | 6 ++---- + net/wireless/nl80211.c | 4 +--- + net/wireless/util.c | 27 +++++++++++++++++++++++++-- + 5 files changed, 46 insertions(+), 13 deletions(-) + +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index 8fb5be3ca0ca8..8b13bd05befac 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -7254,6 +7254,21 @@ void cfg80211_pmsr_complete(struct wireless_dev *wdev, + struct cfg80211_pmsr_request *req, + gfp_t gfp); + ++/** ++ * cfg80211_iftype_allowed - check whether the interface can be allowed ++ * @wiphy: the wiphy ++ * @iftype: interface type ++ * @is_4addr: use_4addr flag, must be '0' when check_swif is '1' ++ * @check_swif: check iftype against software interfaces ++ * ++ * Check whether the interface is allowed to operate; additionally, this API ++ * can be used to check iftype against the software interfaces when ++ * check_swif is '1'. ++ */ ++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype, ++ bool is_4addr, u8 check_swif); ++ ++ + /* Logging, debugging and troubleshooting/diagnostic helpers. */ + + /* wiphy_printk helpers, similar to dev_printk */ +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 1b224fa27367f..ad1e58184c4e4 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -3796,9 +3796,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata, + } + + /* Always allow software iftypes */ +- if (local->hw.wiphy->software_iftypes & BIT(iftype) || +- (iftype == NL80211_IFTYPE_AP_VLAN && +- local->hw.wiphy->flags & WIPHY_FLAG_4ADDR_AP)) { ++ if (cfg80211_iftype_allowed(local->hw.wiphy, iftype, 0, 1)) { + if (radar_detect) + return -EINVAL; + return 0; +@@ -3833,7 +3831,8 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata, + + if (sdata_iter == sdata || + !ieee80211_sdata_running(sdata_iter) || +- local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype)) ++ cfg80211_iftype_allowed(local->hw.wiphy, ++ wdev_iter->iftype, 0, 1)) + continue; + + params.iftype_num[wdev_iter->iftype]++; +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 53ad3dbb76fe5..ed24a0b071c33 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1397,10 +1397,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, + } + break; + case NETDEV_PRE_UP: +- if (!(wdev->wiphy->interface_modes & BIT(wdev->iftype)) && +- !(wdev->iftype == NL80211_IFTYPE_AP_VLAN && +- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP && +- wdev->use_4addr)) ++ if (!cfg80211_iftype_allowed(wdev->wiphy, wdev->iftype, ++ wdev->use_4addr, 0)) + return notifier_from_errno(-EOPNOTSUPP); + + if (rfkill_blocked(rdev->rfkill)) +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 520d437aa8d15..88a1de9def115 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3481,9 +3481,7 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) + return err; + } + +- if (!(rdev->wiphy.interface_modes & (1 << type)) && +- !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr && +- rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)) ++ if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0)) + return -EOPNOTSUPP; + + err = nl80211_parse_mon_options(rdev, type, info, ¶ms); +diff --git a/net/wireless/util.c b/net/wireless/util.c +index 1c39d6a2e8501..d0e35b7b9e350 100644 +--- a/net/wireless/util.c ++++ b/net/wireless/util.c +@@ -1697,7 +1697,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy, + for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) { + num_interfaces += params->iftype_num[iftype]; + if (params->iftype_num[iftype] > 0 && +- !(wiphy->software_iftypes & BIT(iftype))) ++ !cfg80211_iftype_allowed(wiphy, iftype, 0, 1)) + used_iftypes |= BIT(iftype); + } + +@@ -1719,7 +1719,7 @@ int cfg80211_iter_combinations(struct wiphy *wiphy, + return -ENOMEM; + + for (iftype = 0; iftype < NUM_NL80211_IFTYPES; iftype++) { +- if (wiphy->software_iftypes & BIT(iftype)) ++ if (cfg80211_iftype_allowed(wiphy, iftype, 0, 1)) + continue; + for (j = 0; j < c->n_limits; j++) { + all_iftypes |= limits[j].types; +@@ -2072,3 +2072,26 @@ int ieee80211_get_vht_max_nss(struct ieee80211_vht_cap *cap, + return max_vht_nss; + } + EXPORT_SYMBOL(ieee80211_get_vht_max_nss); ++ ++bool cfg80211_iftype_allowed(struct wiphy *wiphy, enum nl80211_iftype iftype, ++ bool is_4addr, u8 check_swif) ++ ++{ ++ bool is_vlan = iftype == NL80211_IFTYPE_AP_VLAN; ++ ++ switch (check_swif) { ++ case 0: ++ if (is_vlan && is_4addr) ++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP; ++ return wiphy->interface_modes & BIT(iftype); ++ case 1: ++ if (!(wiphy->software_iftypes & BIT(iftype)) && is_vlan) ++ return wiphy->flags & WIPHY_FLAG_4ADDR_AP; ++ return wiphy->software_iftypes & BIT(iftype); ++ default: ++ break; ++ } ++ ++ return false; ++} ++EXPORT_SYMBOL(cfg80211_iftype_allowed); +-- +2.20.1 + diff --git a/queue-5.2/nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch b/queue-5.2/nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch new file mode 100644 index 00000000000..d6d72d60386 --- /dev/null +++ b/queue-5.2/nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch @@ -0,0 +1,54 @@ +From 6995baeac1cf1565b26b31343fd749516620251d Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Sun, 28 Jul 2019 18:42:55 +0200 +Subject: nvmem: Use the same permissions for eeprom as for nvmem + +[ Upstream commit e70d8b287301eb6d7c7761c6171c56af62110ea3 ] + +The compatibility "eeprom" attribute is currently root-only no +matter what the configuration says. The "nvmem" attribute does +respect the setting of the root_only configuration bit, so do the +same for "eeprom". + +Signed-off-by: Jean Delvare +Fixes: b6c217ab9be6 ("nvmem: Add backwards compatibility support for older EEPROM drivers.") +Reviewed-by: Bartosz Golaszewski +Cc: Andrew Lunn +Cc: Srinivas Kandagatla +Cc: Arnd Bergmann +Link: https://lore.kernel.org/r/20190728184255.563332e6@endymion +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/nvmem-sysfs.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvmem/nvmem-sysfs.c b/drivers/nvmem/nvmem-sysfs.c +index 6f303b91f6e70..9e0c429cd08a2 100644 +--- a/drivers/nvmem/nvmem-sysfs.c ++++ b/drivers/nvmem/nvmem-sysfs.c +@@ -224,10 +224,17 @@ int nvmem_sysfs_setup_compat(struct nvmem_device *nvmem, + if (!config->base_dev) + return -EINVAL; + +- if (nvmem->read_only) +- nvmem->eeprom = bin_attr_ro_root_nvmem; +- else +- nvmem->eeprom = bin_attr_rw_root_nvmem; ++ if (nvmem->read_only) { ++ if (config->root_only) ++ nvmem->eeprom = bin_attr_ro_root_nvmem; ++ else ++ nvmem->eeprom = bin_attr_ro_nvmem; ++ } else { ++ if (config->root_only) ++ nvmem->eeprom = bin_attr_rw_root_nvmem; ++ else ++ nvmem->eeprom = bin_attr_rw_nvmem; ++ } + nvmem->eeprom.attr.name = "eeprom"; + nvmem->eeprom.size = nvmem->size; + #ifdef CONFIG_DEBUG_LOCK_ALLOC +-- +2.20.1 + diff --git a/queue-5.2/perf-bench-numa-fix-cpu0-binding.patch b/queue-5.2/perf-bench-numa-fix-cpu0-binding.patch new file mode 100644 index 00000000000..e4239eb6354 --- /dev/null +++ b/queue-5.2/perf-bench-numa-fix-cpu0-binding.patch @@ -0,0 +1,57 @@ +From 481b766d4040970a778463e267ff4d0708154878 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Thu, 1 Aug 2019 16:26:42 +0200 +Subject: perf bench numa: Fix cpu0 binding + +[ Upstream commit 6bbfe4e602691b90ac866712bd4c43c51e546a60 ] + +Michael reported an issue with perf bench numa failing with binding to +cpu0 with '-0' option. + + # perf bench numa mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd + # Running 'numa/mem' benchmark: + + # Running main, "perf bench numa numa-mem -p 3 -t 1 -P 512 -s 100 -zZcm0 --thp 1 -M 1 -ddd" + binding to node 0, mask: 0000000000000001 => -1 + perf: bench/numa.c:356: bind_to_memnode: Assertion `!(ret)' failed. + Aborted (core dumped) + +This happens when the cpu0 is not part of node0, which is the benchmark +assumption and we can see that's not the case for some powerpc servers. + +Using correct node for cpu0 binding. + +Reported-by: Michael Petlan +Signed-off-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Satheesh Rajendran +Link: http://lkml.kernel.org/r/20190801142642.28004-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/numa.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c +index a7784554a80de..23c27ca48abf3 100644 +--- a/tools/perf/bench/numa.c ++++ b/tools/perf/bench/numa.c +@@ -379,8 +379,10 @@ static u8 *alloc_data(ssize_t bytes0, int map_flags, + + /* Allocate and initialize all memory on CPU#0: */ + if (init_cpu0) { +- orig_mask = bind_to_node(0); +- bind_to_memnode(0); ++ int node = numa_node_of_cpu(0); ++ ++ orig_mask = bind_to_node(node); ++ bind_to_memnode(node); + } + + bytes = bytes0 + HPSIZE; +-- +2.20.1 + diff --git a/queue-5.2/perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch b/queue-5.2/perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch new file mode 100644 index 00000000000..a6f94465033 --- /dev/null +++ b/queue-5.2/perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch @@ -0,0 +1,48 @@ +From faf4f2698bb91a50367383312e287a74b4442e09 Mon Sep 17 00:00:00 2001 +From: He Zhe +Date: Fri, 2 Aug 2019 16:29:52 +0800 +Subject: perf cpumap: Fix writing to illegal memory in handling cpumap mask + +[ Upstream commit 5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed ] + +cpu_map__snprint_mask() would write to illegal memory pointed by +zalloc(0) when there is only one cpu. + +This patch fixes the calculation and adds sanity check against the input +parameters. + +Signed-off-by: He Zhe +Cc: Alexander Shishkin +Cc: Alexey Budankov +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()") +Link: http://lkml.kernel.org/r/1564734592-15624-2-git-send-email-zhe.he@windriver.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/cpumap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c +index 0b599229bc7e9..0aba5b39c21ef 100644 +--- a/tools/perf/util/cpumap.c ++++ b/tools/perf/util/cpumap.c +@@ -701,7 +701,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size) + unsigned char *bitmap; + int last_cpu = cpu_map__cpu(map, map->nr - 1); + +- bitmap = zalloc((last_cpu + 7) / 8); ++ if (buf == NULL) ++ return 0; ++ ++ bitmap = zalloc(last_cpu / 8 + 1); + if (bitmap == NULL) { + buf[0] = '\0'; + return 0; +-- +2.20.1 + diff --git a/queue-5.2/perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch b/queue-5.2/perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch new file mode 100644 index 00000000000..533f95fc05c --- /dev/null +++ b/queue-5.2/perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch @@ -0,0 +1,52 @@ +From af6f9676c1db8e59ac84999f4816f47d867aceed Mon Sep 17 00:00:00 2001 +From: He Zhe +Date: Fri, 2 Aug 2019 16:29:51 +0800 +Subject: perf ftrace: Fix failure to set cpumask when only one cpu is present + +[ Upstream commit cf30ae726c011e0372fd4c2d588466c8b50a8907 ] + +The buffer containing the string used to set cpumask is overwritten at +the end of the string later in cpu_map__snprint_mask due to not enough +memory space, when there is only one cpu. + +And thus causes the following failure: + + $ perf ftrace ls + failed to reset ftrace + $ + +This patch fixes the calculation of the cpumask string size. + +Signed-off-by: He Zhe +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Alexey Budankov +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Fixes: dc23103278c5 ("perf ftrace: Add support for -a and -C option") +Link: http://lkml.kernel.org/r/1564734592-15624-1-git-send-email-zhe.he@windriver.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-ftrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c +index 9c228c55e1fb7..22386ab350504 100644 +--- a/tools/perf/builtin-ftrace.c ++++ b/tools/perf/builtin-ftrace.c +@@ -173,7 +173,7 @@ static int set_tracing_cpumask(struct cpu_map *cpumap) + int last_cpu; + + last_cpu = cpu_map__cpu(cpumap, cpumap->nr - 1); +- mask_size = (last_cpu + 3) / 4 + 1; ++ mask_size = last_cpu / 4 + 2; /* one more byte for EOS */ + mask_size += last_cpu / 32; /* ',' is needed for every 32th cpus */ + + cpumask = malloc(mask_size); +-- +2.20.1 + diff --git a/queue-5.2/perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch b/queue-5.2/perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch new file mode 100644 index 00000000000..3aa4d9d9968 --- /dev/null +++ b/queue-5.2/perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch @@ -0,0 +1,64 @@ +From 3a917799af722635e93cd2503ef743bf629b333b Mon Sep 17 00:00:00 2001 +From: Jin Yao +Date: Mon, 29 Jul 2019 15:27:55 +0800 +Subject: perf pmu-events: Fix missing "cpu_clk_unhalted.core" event + +[ Upstream commit 8e6e5bea2e34c61291d00cb3f47560341aa84bc3 ] + +The events defined in pmu-events JSON are parsed and added into perf +tool. For fixed counters, we handle the encodings between JSON and perf +by using a static array fixed[]. + +But the fixed[] has missed an important event "cpu_clk_unhalted.core". + +For example, on the Tremont platform, + + [root@localhost ~]# perf stat -e cpu_clk_unhalted.core -a + event syntax error: 'cpu_clk_unhalted.core' + \___ parser error + +With this patch, the event cpu_clk_unhalted.core can be parsed. + + [root@localhost perf]# ./perf stat -e cpu_clk_unhalted.core -a -vvv + ------------------------------------------------------------ + perf_event_attr: + type 4 + size 112 + config 0x3c + sample_type IDENTIFIER + read_format TOTAL_TIME_ENABLED|TOTAL_TIME_RUNNING + disabled 1 + inherit 1 + exclude_guest 1 + ------------------------------------------------------------ +... + +Signed-off-by: Jin Yao +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20190729072755.2166-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/jevents.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index 58f77fd0f59fe..ed5423d8a95fd 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -450,6 +450,7 @@ static struct fixed { + { "inst_retired.any_p", "event=0xc0" }, + { "cpu_clk_unhalted.ref", "event=0x0,umask=0x03" }, + { "cpu_clk_unhalted.thread", "event=0x3c" }, ++ { "cpu_clk_unhalted.core", "event=0x3c" }, + { "cpu_clk_unhalted.thread_any", "event=0x3c,any=1" }, + { NULL, NULL}, + }; +-- +2.20.1 + diff --git a/queue-5.2/qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch b/queue-5.2/qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch new file mode 100644 index 00000000000..b0902fab475 --- /dev/null +++ b/queue-5.2/qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch @@ -0,0 +1,33 @@ +From 063e6c3f2dd647cd52e4b69d0ea3dadc72681e92 Mon Sep 17 00:00:00 2001 +From: Michal Kalderon +Date: Thu, 25 Jul 2019 13:59:55 +0300 +Subject: qed: RDMA - Fix the hw_ver returned in device attributes + +[ Upstream commit 81af04b432fdfabcdbd2c06be2ee647e3ca41a22 ] + +The hw_ver field was initialized to zero. Return the chip revision. +This is relevant for rdma driver. + +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_rdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index 13802b825d65a..909422d939033 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -442,7 +442,7 @@ static void qed_rdma_init_devinfo(struct qed_hwfn *p_hwfn, + /* Vendor specific information */ + dev->vendor_id = cdev->vendor_id; + dev->vendor_part_id = cdev->device_id; +- dev->hw_ver = 0; ++ dev->hw_ver = cdev->chip_rev; + dev->fw_ver = (FW_MAJOR_VERSION << 24) | (FW_MINOR_VERSION << 16) | + (FW_REVISION_VERSION << 8) | (FW_ENGINEERING_VERSION); + +-- +2.20.1 + diff --git a/queue-5.2/regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch b/queue-5.2/regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch new file mode 100644 index 00000000000..06cde17d367 --- /dev/null +++ b/queue-5.2/regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch @@ -0,0 +1,50 @@ +From f320f7073ea95461f1116fe5c2ded94b61d8d5f7 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Sat, 13 Jul 2019 11:07:17 +0200 +Subject: regulator: axp20x: fix DCDC5 and DCDC6 for AXP803 + +[ Upstream commit 8f46e22b5ac692b48d04bb722547ca17b66dda02 ] + +Refactoring of axp20x driver introduced a bug in AXP803's DCDC6 +regulator definition. AXP803_DCDC6_1120mV_STEPS was obtained by +subtracting 0x47 and 0x33. This should be 0x14 (hex) and not 14 +(dec). + +Refactoring also carried over a bug in DCDC5 regulator definition. +Number of possible voltages must be for 1 bigger than maximum valid +voltage index, because 0 is also valid and it means lowest voltage. + +Fixes: 1dbe0ccb0631 ("regulator: axp20x-regulator: add support for AXP803") +Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks") +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20190713090717.347-3-jernej.skrabec@siol.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/axp20x-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c +index c951568994a11..989506bd90b19 100644 +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -174,14 +174,14 @@ + #define AXP803_DCDC5_1140mV_STEPS 35 + #define AXP803_DCDC5_1140mV_END \ + (AXP803_DCDC5_1140mV_START + AXP803_DCDC5_1140mV_STEPS) +-#define AXP803_DCDC5_NUM_VOLTAGES 68 ++#define AXP803_DCDC5_NUM_VOLTAGES 69 + + #define AXP803_DCDC6_600mV_START 0x00 + #define AXP803_DCDC6_600mV_STEPS 50 + #define AXP803_DCDC6_600mV_END \ + (AXP803_DCDC6_600mV_START + AXP803_DCDC6_600mV_STEPS) + #define AXP803_DCDC6_1120mV_START 0x33 +-#define AXP803_DCDC6_1120mV_STEPS 14 ++#define AXP803_DCDC6_1120mV_STEPS 20 + #define AXP803_DCDC6_1120mV_END \ + (AXP803_DCDC6_1120mV_START + AXP803_DCDC6_1120mV_STEPS) + #define AXP803_DCDC6_NUM_VOLTAGES 72 +-- +2.20.1 + diff --git a/queue-5.2/regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch b/queue-5.2/regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch new file mode 100644 index 00000000000..c221c43524c --- /dev/null +++ b/queue-5.2/regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch @@ -0,0 +1,54 @@ +From f0db4e4e1ca44220092571251afee776a736bc4f Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Sat, 13 Jul 2019 11:07:16 +0200 +Subject: regulator: axp20x: fix DCDCA and DCDCD for AXP806 + +[ Upstream commit 1ef55fed9219963359a7b3bc7edca8517c6e45ac ] + +Refactoring of the driver introduced bugs in AXP806's DCDCA and DCDCD +regulator definitions. + +In DCDCA case, AXP806_DCDCA_1120mV_STEPS was obtained by subtracting +0x47 and 0x33. This should be 0x14 (hex) and not 14 (dec). + +In DCDCD case, axp806_dcdcd_ranges[] contains two ranges with same +start and end macros, which is clearly wrong. Second range starts at +1.6V so it should use AXP806_DCDCD_1600mV_[START|END] macros. They are +already defined but unused. + +Fixes: db4a555f7c4c ("regulator: axp20x: use defines for masks") +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20190713090717.347-2-jernej.skrabec@siol.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/axp20x-regulator.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/regulator/axp20x-regulator.c b/drivers/regulator/axp20x-regulator.c +index 152053361862d..c951568994a11 100644 +--- a/drivers/regulator/axp20x-regulator.c ++++ b/drivers/regulator/axp20x-regulator.c +@@ -240,7 +240,7 @@ + #define AXP806_DCDCA_600mV_END \ + (AXP806_DCDCA_600mV_START + AXP806_DCDCA_600mV_STEPS) + #define AXP806_DCDCA_1120mV_START 0x33 +-#define AXP806_DCDCA_1120mV_STEPS 14 ++#define AXP806_DCDCA_1120mV_STEPS 20 + #define AXP806_DCDCA_1120mV_END \ + (AXP806_DCDCA_1120mV_START + AXP806_DCDCA_1120mV_STEPS) + #define AXP806_DCDCA_NUM_VOLTAGES 72 +@@ -774,8 +774,8 @@ static const struct regulator_linear_range axp806_dcdcd_ranges[] = { + AXP806_DCDCD_600mV_END, + 20000), + REGULATOR_LINEAR_RANGE(1600000, +- AXP806_DCDCD_600mV_START, +- AXP806_DCDCD_600mV_END, ++ AXP806_DCDCD_1600mV_START, ++ AXP806_DCDCD_1600mV_END, + 100000), + }; + +-- +2.20.1 + diff --git a/queue-5.2/rxrpc-fix-potential-deadlock.patch b/queue-5.2/rxrpc-fix-potential-deadlock.patch new file mode 100644 index 00000000000..754a9d58d13 --- /dev/null +++ b/queue-5.2/rxrpc-fix-potential-deadlock.patch @@ -0,0 +1,106 @@ +From a0168f1b41af143741932507f3b5c598130a1cba Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 30 Jul 2019 14:42:50 +0100 +Subject: rxrpc: Fix potential deadlock + +[ Upstream commit 60034d3d146b11922ab1db613bce062dddc0327a ] + +There is a potential deadlock in rxrpc_peer_keepalive_dispatch() whereby +rxrpc_put_peer() is called with the peer_hash_lock held, but if it reduces +the peer's refcount to 0, rxrpc_put_peer() calls __rxrpc_put_peer() - which +the tries to take the already held lock. + +Fix this by providing a version of rxrpc_put_peer() that can be called in +situations where the lock is already held. + +The bug may produce the following lockdep report: + +============================================ +WARNING: possible recursive locking detected +5.2.0-next-20190718 #41 Not tainted +-------------------------------------------- +kworker/0:3/21678 is trying to acquire lock: +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh +/./include/linux/spinlock.h:343 [inline] +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: +__rxrpc_put_peer /net/rxrpc/peer_object.c:415 [inline] +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: +rxrpc_put_peer+0x2d3/0x6a0 /net/rxrpc/peer_object.c:435 + +but task is already holding lock: +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: spin_lock_bh +/./include/linux/spinlock.h:343 [inline] +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: +rxrpc_peer_keepalive_dispatch /net/rxrpc/peer_event.c:378 [inline] +00000000aa5eecdf (&(&rxnet->peer_hash_lock)->rlock){+.-.}, at: +rxrpc_peer_keepalive_worker+0x6b3/0xd02 /net/rxrpc/peer_event.c:430 + +Fixes: 330bdcfadcee ("rxrpc: Fix the keepalive generator [ver #2]") +Reported-by: syzbot+72af434e4b3417318f84@syzkaller.appspotmail.com +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Reviewed-by: Jeffrey Altman +Signed-off-by: Sasha Levin +--- + net/rxrpc/ar-internal.h | 1 + + net/rxrpc/peer_event.c | 2 +- + net/rxrpc/peer_object.c | 18 ++++++++++++++++++ + 3 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h +index 80335b4ee4fd6..822f45386e311 100644 +--- a/net/rxrpc/ar-internal.h ++++ b/net/rxrpc/ar-internal.h +@@ -1061,6 +1061,7 @@ void rxrpc_destroy_all_peers(struct rxrpc_net *); + struct rxrpc_peer *rxrpc_get_peer(struct rxrpc_peer *); + struct rxrpc_peer *rxrpc_get_peer_maybe(struct rxrpc_peer *); + void rxrpc_put_peer(struct rxrpc_peer *); ++void rxrpc_put_peer_locked(struct rxrpc_peer *); + + /* + * proc.c +diff --git a/net/rxrpc/peer_event.c b/net/rxrpc/peer_event.c +index 9f2f45c09e583..7666ec72d37e5 100644 +--- a/net/rxrpc/peer_event.c ++++ b/net/rxrpc/peer_event.c +@@ -378,7 +378,7 @@ static void rxrpc_peer_keepalive_dispatch(struct rxrpc_net *rxnet, + spin_lock_bh(&rxnet->peer_hash_lock); + list_add_tail(&peer->keepalive_link, + &rxnet->peer_keepalive[slot & mask]); +- rxrpc_put_peer(peer); ++ rxrpc_put_peer_locked(peer); + } + + spin_unlock_bh(&rxnet->peer_hash_lock); +diff --git a/net/rxrpc/peer_object.c b/net/rxrpc/peer_object.c +index 9d3ce81cf8ae8..9c3ac96f71cbf 100644 +--- a/net/rxrpc/peer_object.c ++++ b/net/rxrpc/peer_object.c +@@ -436,6 +436,24 @@ void rxrpc_put_peer(struct rxrpc_peer *peer) + } + } + ++/* ++ * Drop a ref on a peer record where the caller already holds the ++ * peer_hash_lock. ++ */ ++void rxrpc_put_peer_locked(struct rxrpc_peer *peer) ++{ ++ const void *here = __builtin_return_address(0); ++ int n; ++ ++ n = atomic_dec_return(&peer->usage); ++ trace_rxrpc_peer(peer, rxrpc_peer_put, n, here); ++ if (n == 0) { ++ hash_del_rcu(&peer->hash_link); ++ list_del_init(&peer->keepalive_link); ++ kfree_rcu(peer, rcu); ++ } ++} ++ + /* + * Make sure all peer records have been discarded. + */ +-- +2.20.1 + diff --git a/queue-5.2/rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch b/queue-5.2/rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch new file mode 100644 index 00000000000..42052efd025 --- /dev/null +++ b/queue-5.2/rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch @@ -0,0 +1,47 @@ +From f46c5cfc8605a5ec1e3fe359ebf7e3dd6934b95d Mon Sep 17 00:00:00 2001 +From: David Howells +Date: Tue, 30 Jul 2019 14:42:50 +0100 +Subject: rxrpc: Fix the lack of notification when sendmsg() fails on a DATA + packet + +[ Upstream commit c69565ee6681e151e2bb80502930a16e04b553d1 ] + +Fix the fact that a notification isn't sent to the recvmsg side to indicate +a call failed when sendmsg() fails to transmit a DATA packet with the error +ENETUNREACH, EHOSTUNREACH or ECONNREFUSED. + +Without this notification, the afs client just sits there waiting for the +call to complete in some manner (which it's not now going to do), which +also pins the rxrpc call in place. + +This can be seen if the client has a scope-level IPv6 address, but not a +global-level IPv6 address, and we try and transmit an operation to a +server's IPv6 address. + +Looking in /proc/net/rxrpc/calls shows completed calls just sat there with +an abort code of RX_USER_ABORT and an error code of -ENETUNREACH. + +Fixes: c54e43d752c7 ("rxrpc: Fix missing start of call timeout") +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Reviewed-by: Jeffrey Altman +Signed-off-by: Sasha Levin +--- + net/rxrpc/sendmsg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index 5d3f33ce6d410..bae14438f8691 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -226,6 +226,7 @@ static int rxrpc_queue_packet(struct rxrpc_sock *rx, struct rxrpc_call *call, + rxrpc_set_call_completion(call, + RXRPC_CALL_LOCAL_ERROR, + 0, ret); ++ rxrpc_notify_socket(call); + goto out; + } + _debug("need instant resend %d", ret); +-- +2.20.1 + diff --git a/queue-5.2/s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch b/queue-5.2/s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch new file mode 100644 index 00000000000..05362cebec9 --- /dev/null +++ b/queue-5.2/s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch @@ -0,0 +1,67 @@ +From 5aed462929318b6eed1f2e30b2112077ef8ff418 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Fri, 26 Jul 2019 08:23:20 +0200 +Subject: s390/mm: fix dump_pagetables top level page table walking + +[ Upstream commit 8024b5a9fc2bed9a00f0bdba60b443fa3cc4bb5d ] + +Since commit d1874a0c2805 ("s390/mm: make the pxd_offset functions more +robust") behaviour of p4d_offset, pud_offset and pmd_offset has been +changed so that they cannot be used to iterate through top level page +table, because the index for the top level page table is now calculated +in pgd_offset. To avoid dumping the very first region/segment top level +table entry 2048 times simply iterate entry pointer like it is already +done in other page walking cases. + +Fixes: d1874a0c2805 ("s390/mm: make the pxd_offset functions more robust") +Reported-by: Ilya Leoshkevich +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/mm/dump_pagetables.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c +index 3b93ba0b5d8d6..5d67b81c704a4 100644 +--- a/arch/s390/mm/dump_pagetables.c ++++ b/arch/s390/mm/dump_pagetables.c +@@ -161,9 +161,9 @@ static void walk_pmd_level(struct seq_file *m, struct pg_state *st, + } + #endif + +- for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++) { ++ pmd = pmd_offset(pud, addr); ++ for (i = 0; i < PTRS_PER_PMD && addr < max_addr; i++, pmd++) { + st->current_address = addr; +- pmd = pmd_offset(pud, addr); + if (!pmd_none(*pmd)) { + if (pmd_large(*pmd)) { + prot = pmd_val(*pmd) & +@@ -192,9 +192,9 @@ static void walk_pud_level(struct seq_file *m, struct pg_state *st, + } + #endif + +- for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++) { ++ pud = pud_offset(p4d, addr); ++ for (i = 0; i < PTRS_PER_PUD && addr < max_addr; i++, pud++) { + st->current_address = addr; +- pud = pud_offset(p4d, addr); + if (!pud_none(*pud)) + if (pud_large(*pud)) { + prot = pud_val(*pud) & +@@ -222,9 +222,9 @@ static void walk_p4d_level(struct seq_file *m, struct pg_state *st, + } + #endif + +- for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++) { ++ p4d = p4d_offset(pgd, addr); ++ for (i = 0; i < PTRS_PER_P4D && addr < max_addr; i++, p4d++) { + st->current_address = addr; +- p4d = p4d_offset(pgd, addr); + if (!p4d_none(*p4d)) + walk_pud_level(m, st, p4d, addr); + else +-- +2.20.1 + diff --git a/queue-5.2/s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch b/queue-5.2/s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch new file mode 100644 index 00000000000..140927b438f --- /dev/null +++ b/queue-5.2/s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch @@ -0,0 +1,81 @@ +From f824bc07b31b58eab49e0ceffe2309a6671f5470 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Fri, 2 Aug 2019 13:27:22 +0200 +Subject: s390/protvirt: avoid memory sharing for diag 308 set/store + +[ Upstream commit a287a49e672d9762bb85de117b477bdf3ef20bd5 ] + +This reverts commit db9492cef45e ("s390/protvirt: add memory sharing for +diag 308 set/store") which due to ultravisor implementation change is +not needed after all. + +Fixes: db9492cef45e ("s390/protvirt: add memory sharing for diag 308 set/store") +Reviewed-by: Janosch Frank +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/ipl_parm.c | 2 -- + arch/s390/kernel/ipl.c | 9 --------- + 2 files changed, 11 deletions(-) + +diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c +index 3c49bde8aa5e3..b8aa6a9f937b2 100644 +--- a/arch/s390/boot/ipl_parm.c ++++ b/arch/s390/boot/ipl_parm.c +@@ -48,9 +48,7 @@ void store_ipl_parmblock(void) + { + int rc; + +- uv_set_shared(__pa(&ipl_block)); + rc = __diag308(DIAG308_STORE, &ipl_block); +- uv_remove_shared(__pa(&ipl_block)); + if (rc == DIAG308_RC_OK && + ipl_block.hdr.version <= IPL_MAX_SUPPORTED_VERSION) + ipl_block_valid = 1; +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 2c0a515428d61..6837affc19e81 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -31,7 +31,6 @@ + #include + #include + #include +-#include + #include "entry.h" + + #define IPL_PARM_BLOCK_VERSION 0 +@@ -892,21 +891,15 @@ static void __reipl_run(void *unused) + { + switch (reipl_type) { + case IPL_TYPE_CCW: +- uv_set_shared(__pa(reipl_block_ccw)); + diag308(DIAG308_SET, reipl_block_ccw); +- uv_remove_shared(__pa(reipl_block_ccw)); + diag308(DIAG308_LOAD_CLEAR, NULL); + break; + case IPL_TYPE_FCP: +- uv_set_shared(__pa(reipl_block_fcp)); + diag308(DIAG308_SET, reipl_block_fcp); +- uv_remove_shared(__pa(reipl_block_fcp)); + diag308(DIAG308_LOAD_CLEAR, NULL); + break; + case IPL_TYPE_NSS: +- uv_set_shared(__pa(reipl_block_nss)); + diag308(DIAG308_SET, reipl_block_nss); +- uv_remove_shared(__pa(reipl_block_nss)); + diag308(DIAG308_LOAD_CLEAR, NULL); + break; + case IPL_TYPE_UNKNOWN: +@@ -1176,9 +1169,7 @@ static struct kset *dump_kset; + + static void diag308_dump(void *dump_block) + { +- uv_set_shared(__pa(dump_block)); + diag308(DIAG308_SET, dump_block); +- uv_remove_shared(__pa(dump_block)); + while (1) { + if (diag308(DIAG308_LOAD_NORMAL_DUMP, NULL) != 0x302) + break; +-- +2.20.1 + diff --git a/queue-5.2/s390-put-_stext-and-_etext-into-.text-section.patch b/queue-5.2/s390-put-_stext-and-_etext-into-.text-section.patch new file mode 100644 index 00000000000..a9b13e47848 --- /dev/null +++ b/queue-5.2/s390-put-_stext-and-_etext-into-.text-section.patch @@ -0,0 +1,57 @@ +From 7250890a516010c209b7ab4197b6fbb31e0bf4b9 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Mon, 5 Aug 2019 14:25:16 +0200 +Subject: s390: put _stext and _etext into .text section + +[ Upstream commit 24350fdadbdec780406a1ef988e6cd3875e374a8 ] + +Perf relies on _etext and _stext symbols being one of 't', 'T', 'v' or +'V'. Put them into .text section to guarantee that. + +Also moves padding to page boundary inside .text which has an effect that +.text section is now padded with nops rather than 0's, which apparently +has been the initial intention for specifying 0x0700 fill expression. + +Reported-by: Thomas Richter +Tested-by: Thomas Richter +Suggested-by: Andreas Krebbel +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vmlinux.lds.S | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 49d55327de0bc..7e0eb40209177 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -32,10 +32,9 @@ PHDRS { + SECTIONS + { + . = 0x100000; +- _stext = .; /* Start of text section */ + .text : { +- /* Text and read-only data */ +- _text = .; ++ _stext = .; /* Start of text section */ ++ _text = .; /* Text and read-only data */ + HEAD_TEXT + TEXT_TEXT + SCHED_TEXT +@@ -47,11 +46,10 @@ SECTIONS + *(.text.*_indirect_*) + *(.fixup) + *(.gnu.warning) ++ . = ALIGN(PAGE_SIZE); ++ _etext = .; /* End of text section */ + } :text = 0x0700 + +- . = ALIGN(PAGE_SIZE); +- _etext = .; /* End of text section */ +- + NOTES :text :note + + .dummy : { *(.dummy) } :data +-- +2.20.1 + diff --git a/queue-5.2/sched-deadline-fix-double-accounting-of-rq-running-b.patch b/queue-5.2/sched-deadline-fix-double-accounting-of-rq-running-b.patch new file mode 100644 index 00000000000..91b664fd869 --- /dev/null +++ b/queue-5.2/sched-deadline-fix-double-accounting-of-rq-running-b.patch @@ -0,0 +1,70 @@ +From d10c168b81e34fd55b66bc794e0b795a3c300514 Mon Sep 17 00:00:00 2001 +From: Dietmar Eggemann +Date: Fri, 2 Aug 2019 15:59:43 +0100 +Subject: sched/deadline: Fix double accounting of rq/running bw in push & pull + +[ Upstream commit f4904815f97a934258445a8f763f6b6c48f007e7 ] + +{push,pull}_dl_task() always calls {de,}activate_task() with .flags=0 +which sets p->on_rq=TASK_ON_RQ_MIGRATING. + +{push,pull}_dl_task()->{de,}activate_task()->{de,en}queue_task()-> +{de,en}queue_task_dl() calls {sub,add}_{running,rq}_bw() since +p->on_rq==TASK_ON_RQ_MIGRATING. +So {sub,add}_{running,rq}_bw() in {push,pull}_dl_task() is +double-accounting for that task. + +Fix it by removing rq/running bw accounting in [push/pull]_dl_task(). + +Fixes: 7dd778841164 ("sched/core: Unify p->on_rq updates") +Signed-off-by: Dietmar Eggemann +Signed-off-by: Peter Zijlstra (Intel) +Cc: Valentin Schneider +Cc: Ingo Molnar +Cc: Luca Abeni +Cc: Daniel Bristot de Oliveira +Cc: Juri Lelli +Cc: Qais Yousef +Link: https://lkml.kernel.org/r/20190802145945.18702-2-dietmar.eggemann@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 43901fa3f2693..1c66480afda81 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2088,17 +2088,13 @@ retry: + } + + deactivate_task(rq, next_task, 0); +- sub_running_bw(&next_task->dl, &rq->dl); +- sub_rq_bw(&next_task->dl, &rq->dl); + set_task_cpu(next_task, later_rq->cpu); +- add_rq_bw(&next_task->dl, &later_rq->dl); + + /* + * Update the later_rq clock here, because the clock is used + * by the cpufreq_update_util() inside __add_running_bw(). + */ + update_rq_clock(later_rq); +- add_running_bw(&next_task->dl, &later_rq->dl); + activate_task(later_rq, next_task, ENQUEUE_NOCLOCK); + ret = 1; + +@@ -2186,11 +2182,7 @@ static void pull_dl_task(struct rq *this_rq) + resched = true; + + deactivate_task(src_rq, p, 0); +- sub_running_bw(&p->dl, &src_rq->dl); +- sub_rq_bw(&p->dl, &src_rq->dl); + set_task_cpu(p, this_cpu); +- add_rq_bw(&p->dl, &this_rq->dl); +- add_running_bw(&p->dl, &this_rq->dl); + activate_task(this_rq, p, 0); + dmin = p->dl.deadline; + +-- +2.20.1 + diff --git a/queue-5.2/sched-psi-do-not-require-setsched-permission-from-th.patch b/queue-5.2/sched-psi-do-not-require-setsched-permission-from-th.patch new file mode 100644 index 00000000000..31217992c6a --- /dev/null +++ b/queue-5.2/sched-psi-do-not-require-setsched-permission-from-th.patch @@ -0,0 +1,49 @@ +From 9006f6b85279584b2b329480ab43d308d172d826 Mon Sep 17 00:00:00 2001 +From: Suren Baghdasaryan +Date: Mon, 29 Jul 2019 18:33:10 -0700 +Subject: sched/psi: Do not require setsched permission from the trigger + creator + +[ Upstream commit 04e048cf09d7b5fc995817cdc5ae1acd4482429c ] + +When a process creates a new trigger by writing into /proc/pressure/* +files, permissions to write such a file should be used to determine whether +the process is allowed to do so or not. Current implementation would also +require such a process to have setsched capability. Setting of psi trigger +thread's scheduling policy is an implementation detail and should not be +exposed to the user level. Remove the permission check by using _nocheck +version of the function. + +Suggested-by: Nick Kralevich +Signed-off-by: Suren Baghdasaryan +Signed-off-by: Peter Zijlstra (Intel) +Cc: lizefan@huawei.com +Cc: mingo@redhat.com +Cc: akpm@linux-foundation.org +Cc: kernel-team@android.com +Cc: dennisszhou@gmail.com +Cc: dennis@kernel.org +Cc: hannes@cmpxchg.org +Cc: axboe@kernel.dk +Link: https://lkml.kernel.org/r/20190730013310.162367-1-surenb@google.com +Signed-off-by: Sasha Levin +--- + kernel/sched/psi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 7fe2c5fd26b54..23fbbcc414d5d 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -1061,7 +1061,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, + mutex_unlock(&group->trigger_lock); + return ERR_CAST(kworker); + } +- sched_setscheduler(kworker->task, SCHED_FIFO, ¶m); ++ sched_setscheduler_nocheck(kworker->task, SCHED_FIFO, ¶m); + kthread_init_delayed_work(&group->poll_work, + psi_poll_work); + rcu_assign_pointer(group->poll_kworker, kworker); +-- +2.20.1 + diff --git a/queue-5.2/sched-psi-reduce-psimon-fifo-priority.patch b/queue-5.2/sched-psi-reduce-psimon-fifo-priority.patch new file mode 100644 index 00000000000..8bc1f394311 --- /dev/null +++ b/queue-5.2/sched-psi-reduce-psimon-fifo-priority.patch @@ -0,0 +1,42 @@ +From 7010bed51b704bc7885709251437f1658a1d41b1 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 1 Aug 2019 12:41:31 +0200 +Subject: sched/psi: Reduce psimon FIFO priority + +[ Upstream commit 14f5c7b46a41a595fc61db37f55721714729e59e ] + +PSI defaults to a FIFO-99 thread, reduce this to FIFO-1. + +FIFO-99 is the very highest priority available to SCHED_FIFO and +it not a suitable default; it would indicate the psi work is the +most important work on the machine. + +Since Real-Time tasks will have pre-allocated memory and locked it in +place, Real-Time tasks do not care about PSI. All it needs is to be +above OTHER. + +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Johannes Weiner +Tested-by: Suren Baghdasaryan +Cc: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + kernel/sched/psi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index 7acc632c3b82b..7fe2c5fd26b54 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -1051,7 +1051,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, + + if (!rcu_access_pointer(group->poll_kworker)) { + struct sched_param param = { +- .sched_priority = MAX_RT_PRIO - 1, ++ .sched_priority = 1, + }; + struct kthread_worker *kworker; + +-- +2.20.1 + diff --git a/queue-5.2/selftests-bpf-add-another-gso_segs-access.patch b/queue-5.2/selftests-bpf-add-another-gso_segs-access.patch new file mode 100644 index 00000000000..363fbd434bd --- /dev/null +++ b/queue-5.2/selftests-bpf-add-another-gso_segs-access.patch @@ -0,0 +1,43 @@ +From 25cdd35e7b901f4b295aa430c47f1b2abcc717b4 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Tue, 23 Jul 2019 03:15:38 -0700 +Subject: selftests/bpf: add another gso_segs access + +[ Upstream commit be69483bf4f3abaaca5d5ba460dbb50239463552 ] + +Use BPF_REG_1 for source and destination of gso_segs read, +to exercise "bpf: fix access to skb_shared_info->gso_segs" fix. + +Signed-off-by: Eric Dumazet +Suggested-by: Stanislav Fomichev +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/verifier/ctx_skb.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/tools/testing/selftests/bpf/verifier/ctx_skb.c b/tools/testing/selftests/bpf/verifier/ctx_skb.c +index b0fda2877119c..d438193804b21 100644 +--- a/tools/testing/selftests/bpf/verifier/ctx_skb.c ++++ b/tools/testing/selftests/bpf/verifier/ctx_skb.c +@@ -974,6 +974,17 @@ + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_CGROUP_SKB, + }, ++{ ++ "read gso_segs from CGROUP_SKB", ++ .insns = { ++ BPF_LDX_MEM(BPF_W, BPF_REG_1, BPF_REG_1, ++ offsetof(struct __sk_buff, gso_segs)), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ .result = ACCEPT, ++ .prog_type = BPF_PROG_TYPE_CGROUP_SKB, ++}, + { + "write gso_segs from CGROUP_SKB", + .insns = { +-- +2.20.1 + diff --git a/queue-5.2/selftests-bpf-fix-sendmsg6_prog-on-s390.patch b/queue-5.2/selftests-bpf-fix-sendmsg6_prog-on-s390.patch new file mode 100644 index 00000000000..6b445f5606f --- /dev/null +++ b/queue-5.2/selftests-bpf-fix-sendmsg6_prog-on-s390.patch @@ -0,0 +1,40 @@ +From 438f23acd354a6ee0120eccc235cf1f802fd02b9 Mon Sep 17 00:00:00 2001 +From: Ilya Leoshkevich +Date: Fri, 19 Jul 2019 11:06:11 +0200 +Subject: selftests/bpf: fix sendmsg6_prog on s390 + +[ Upstream commit c8eee4135a456bc031d67cadc454e76880d1afd8 ] + +"sendmsg6: rewrite IP & port (C)" fails on s390, because the code in +sendmsg_v6_prog() assumes that (ctx->user_ip6[0] & 0xFFFF) refers to +leading IPv6 address digits, which is not the case on big-endian +machines. + +Since checking bitwise operations doesn't seem to be the point of the +test, replace two short comparisons with a single int comparison. + +Signed-off-by: Ilya Leoshkevich +Acked-by: Andrey Ignatov +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/sendmsg6_prog.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c +index 5aeaa284fc474..a680628204108 100644 +--- a/tools/testing/selftests/bpf/progs/sendmsg6_prog.c ++++ b/tools/testing/selftests/bpf/progs/sendmsg6_prog.c +@@ -41,8 +41,7 @@ int sendmsg_v6_prog(struct bpf_sock_addr *ctx) + } + + /* Rewrite destination. */ +- if ((ctx->user_ip6[0] & 0xFFFF) == bpf_htons(0xFACE) && +- ctx->user_ip6[0] >> 16 == bpf_htons(0xB00C)) { ++ if (ctx->user_ip6[0] == bpf_htonl(0xFACEB00C)) { + ctx->user_ip6[0] = bpf_htonl(DST_REWRITE_IP6_0); + ctx->user_ip6[1] = bpf_htonl(DST_REWRITE_IP6_1); + ctx->user_ip6[2] = bpf_htonl(DST_REWRITE_IP6_2); +-- +2.20.1 + diff --git a/queue-5.2/selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch b/queue-5.2/selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch new file mode 100644 index 00000000000..88de7f293f3 --- /dev/null +++ b/queue-5.2/selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch @@ -0,0 +1,44 @@ +From 76612075407c692e4ad3e7ac2743bfe0832522fc Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Tue, 23 Jul 2019 11:19:25 +0300 +Subject: selftests: forwarding: gre_multipath: Enable IPv4 forwarding + +[ Upstream commit efa7b79f675da0efafe3f32ba0d6efe916cf4867 ] + +The test did not enable IPv4 forwarding during its setup phase, which +causes the test to fail on machines where IPv4 forwarding is disabled. + +Fixes: 54818c4c4b93 ("selftests: forwarding: Test multipath tunneling") +Signed-off-by: Ido Schimmel +Reported-by: Stephen Suryaputra +Tested-by: Stephen Suryaputra +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/forwarding/gre_multipath.sh | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh +index cca2baa03fb81..37d7297e1cf8a 100755 +--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh ++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh +@@ -187,12 +187,16 @@ setup_prepare() + sw1_create + sw2_create + h2_create ++ ++ forwarding_enable + } + + cleanup() + { + pre_cleanup + ++ forwarding_restore ++ + h2_destroy + sw2_destroy + sw1_destroy +-- +2.20.1 + diff --git a/queue-5.2/selftests-forwarding-gre_multipath-fix-flower-filter.patch b/queue-5.2/selftests-forwarding-gre_multipath-fix-flower-filter.patch new file mode 100644 index 00000000000..fb066c5b68d --- /dev/null +++ b/queue-5.2/selftests-forwarding-gre_multipath-fix-flower-filter.patch @@ -0,0 +1,91 @@ +From c2764d264428935e37bc299d68364318b4356446 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Tue, 23 Jul 2019 11:19:26 +0300 +Subject: selftests: forwarding: gre_multipath: Fix flower filters + +[ Upstream commit 1be79d89b7ae96e004911bd228ce8c2b5cc6415f ] + +The TC filters used in the test do not work with veth devices because the +outer Ethertype is 802.1Q and not IPv4. The test passes with mlxsw +netdevs since the hardware always looks at "The first Ethertype that +does not point to either: VLAN, CNTAG or configurable Ethertype". + +Fix this by matching on the VLAN ID instead, but on the ingress side. +The reason why this is not performed at egress is explained in the +commit cited below. + +Fixes: 541ad323db3a ("selftests: forwarding: gre_multipath: Update next-hop statistics match criteria") +Signed-off-by: Ido Schimmel +Reported-by: Stephen Suryaputra +Tested-by: Stephen Suryaputra +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../selftests/net/forwarding/gre_multipath.sh | 24 +++++++++---------- + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/tools/testing/selftests/net/forwarding/gre_multipath.sh b/tools/testing/selftests/net/forwarding/gre_multipath.sh +index 37d7297e1cf8a..a8d8e8b3dc819 100755 +--- a/tools/testing/selftests/net/forwarding/gre_multipath.sh ++++ b/tools/testing/selftests/net/forwarding/gre_multipath.sh +@@ -93,18 +93,10 @@ sw1_create() + ip route add vrf v$ol1 192.0.2.16/28 \ + nexthop dev g1a \ + nexthop dev g1b +- +- tc qdisc add dev $ul1 clsact +- tc filter add dev $ul1 egress pref 111 prot ipv4 \ +- flower dst_ip 192.0.2.66 action pass +- tc filter add dev $ul1 egress pref 222 prot ipv4 \ +- flower dst_ip 192.0.2.82 action pass + } + + sw1_destroy() + { +- tc qdisc del dev $ul1 clsact +- + ip route del vrf v$ol1 192.0.2.16/28 + + ip route del vrf v$ol1 192.0.2.82/32 via 192.0.2.146 +@@ -139,10 +131,18 @@ sw2_create() + ip route add vrf v$ol2 192.0.2.0/28 \ + nexthop dev g2a \ + nexthop dev g2b ++ ++ tc qdisc add dev $ul2 clsact ++ tc filter add dev $ul2 ingress pref 111 prot 802.1Q \ ++ flower vlan_id 111 action pass ++ tc filter add dev $ul2 ingress pref 222 prot 802.1Q \ ++ flower vlan_id 222 action pass + } + + sw2_destroy() + { ++ tc qdisc del dev $ul2 clsact ++ + ip route del vrf v$ol2 192.0.2.0/28 + + ip route del vrf v$ol2 192.0.2.81/32 via 192.0.2.145 +@@ -215,15 +215,15 @@ multipath4_test() + nexthop dev g1a weight $weight1 \ + nexthop dev g1b weight $weight2 + +- local t0_111=$(tc_rule_stats_get $ul1 111 egress) +- local t0_222=$(tc_rule_stats_get $ul1 222 egress) ++ local t0_111=$(tc_rule_stats_get $ul2 111 ingress) ++ local t0_222=$(tc_rule_stats_get $ul2 222 ingress) + + ip vrf exec v$h1 \ + $MZ $h1 -q -p 64 -A 192.0.2.1 -B 192.0.2.18 \ + -d 1msec -t udp "sp=1024,dp=0-32768" + +- local t1_111=$(tc_rule_stats_get $ul1 111 egress) +- local t1_222=$(tc_rule_stats_get $ul1 222 egress) ++ local t1_111=$(tc_rule_stats_get $ul2 111 ingress) ++ local t1_222=$(tc_rule_stats_get $ul2 222 ingress) + + local d111=$((t1_111 - t0_111)) + local d222=$((t1_222 - t0_222)) +-- +2.20.1 + diff --git a/queue-5.2/selftests-kvm-adding-config-fragments.patch b/queue-5.2/selftests-kvm-adding-config-fragments.patch new file mode 100644 index 00000000000..5c81f3c6f52 --- /dev/null +++ b/queue-5.2/selftests-kvm-adding-config-fragments.patch @@ -0,0 +1,30 @@ +From b1b864c83777dbb9ed4b21a8a332472c9b9b0854 Mon Sep 17 00:00:00 2001 +From: Naresh Kamboju +Date: Wed, 7 Aug 2019 13:58:14 +0000 +Subject: selftests: kvm: Adding config fragments + +[ Upstream commit c096397c78f766db972f923433031f2dec01cae0 ] + +selftests kvm test cases need pre-required kernel configs for the test +to get pass. + +Signed-off-by: Naresh Kamboju +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/config | 3 +++ + 1 file changed, 3 insertions(+) + create mode 100644 tools/testing/selftests/kvm/config + +diff --git a/tools/testing/selftests/kvm/config b/tools/testing/selftests/kvm/config +new file mode 100644 +index 0000000000000..63ed533f73d6e +--- /dev/null ++++ b/tools/testing/selftests/kvm/config +@@ -0,0 +1,3 @@ ++CONFIG_KVM=y ++CONFIG_KVM_INTEL=y ++CONFIG_KVM_AMD=y +-- +2.20.1 + diff --git a/queue-5.2/series b/queue-5.2/series new file mode 100644 index 00000000000..dbf958ae16b --- /dev/null +++ b/queue-5.2/series @@ -0,0 +1,110 @@ +asoc-simple_card_utils.h-care-null-dai-at-asoc_simpl.patch +asoc-simple-card-fix-an-use-after-free-in-simple_dai.patch +asoc-simple-card-fix-an-use-after-free-in-simple_for.patch +asoc-audio-graph-card-fix-use-after-free-in-graph_da.patch +asoc-audio-graph-card-fix-an-use-after-free-in-graph.patch +asoc-audio-graph-card-add-missing-const-at-graph_get.patch +regulator-axp20x-fix-dcdca-and-dcdcd-for-axp806.patch +regulator-axp20x-fix-dcdc5-and-dcdc6-for-axp803.patch +asoc-samsung-odroid-fix-an-use-after-free-issue-for-.patch +asoc-samsung-odroid-fix-a-double-free-issue-for-cpu_.patch +asoc-intel-bytcht_es8316-add-quirk-for-irbis-nb41-ne.patch +hid-logitech-hidpp-add-usb-pid-for-a-few-more-suppor.patch +hid-add-044f-b320-thrustmaster-inc.-2-in-1-dt.patch +mips-kernel-only-use-i8253-clocksource-with-periodic.patch +mips-fix-cacheinfo.patch +libbpf-sanitize-var-to-conservative-1-byte-int.patch +netfilter-ebtables-fix-a-memory-leak-bug-in-compat.patch +asoc-dapm-fix-handling-of-custom_stop_condition-on-d.patch +asoc-sof-use-__u32-instead-of-uint32_t-in-uapi-heade.patch +spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch +bpf-sockmap-sock_map_delete-needs-to-use-xchg.patch +bpf-sockmap-synchronize_rcu-before-free-ing-map.patch +bpf-sockmap-only-create-entry-if-ulp-is-not-already-.patch +selftests-bpf-fix-sendmsg6_prog-on-s390.patch +asoc-dapm-fix-a-memory-leak-bug.patch +bonding-force-slave-speed-check-after-link-state-rec.patch +net-mvpp2-don-t-check-for-3-consecutive-idle-frames-.patch +selftests-forwarding-gre_multipath-enable-ipv4-forwa.patch +selftests-forwarding-gre_multipath-fix-flower-filter.patch +selftests-bpf-add-another-gso_segs-access.patch +libbpf-fix-using-uninitialized-ioctl-results.patch +can-dev-call-netif_carrier_off-in-register_candev.patch +can-mcp251x-add-error-check-when-wq-alloc-failed.patch +can-gw-fix-error-path-of-cgw_module_init.patch +asoc-fail-card-instantiation-if-dai-format-setup-fai.patch +staging-fbtft-fix-gpio-handling.patch +libbpf-silence-gcc8-warning-about-string-truncation.patch +st21nfca_connectivity_event_received-null-check-the-.patch +st_nci_hci_connectivity_event_received-null-check-th.patch +nl-mac-80211-fix-interface-combinations-on-crypto-co.patch +asoc-ti-davinci-mcasp-fix-clk-pdir-handling-for-i2s-.patch +asoc-rockchip-fix-mono-capture.patch +asoc-ti-davinci-mcasp-correct-slot_width-posed-const.patch +net-usb-qmi_wwan-add-the-broadmobi-bm818-card.patch +qed-rdma-fix-the-hw_ver-returned-in-device-attribute.patch +isdn-misdn-hfcsusb-fix-possible-null-pointer-derefer.patch +habanalabs-fix-f-w-download-in-be-architecture.patch +mac80211_hwsim-fix-possible-null-pointer-dereference.patch +net-stmmac-manage-errors-returned-by-of_get_mac_addr.patch +netfilter-ipset-actually-allow-destination-mac-addre.patch +netfilter-ipset-copy-the-right-mac-address-in-bitmap.patch +netfilter-ipset-fix-rename-concurrency-with-listing.patch +rxrpc-fix-potential-deadlock.patch +rxrpc-fix-the-lack-of-notification-when-sendmsg-fail.patch +nvmem-use-the-same-permissions-for-eeprom-as-for-nvm.patch +iwlwifi-mvm-avoid-races-in-rate-init-and-rate-perfor.patch +iwlwifi-dbg_ini-move-iwl_dbg_tlv_load_bin-out-of-deb.patch +iwlwifi-dbg_ini-move-iwl_dbg_tlv_free-outside-of-deb.patch +iwlwifi-fix-locking-in-delayed-gtk-setting.patch +iwlwifi-mvm-send-lq-command-always-async.patch +enetc-fix-build-error-without-phylib.patch +isdn-hfcsusb-fix-misdn-driver-crash-caused-by-transf.patch +net-phy-phy_led_triggers-fix-a-possible-null-pointer.patch +perf-bench-numa-fix-cpu0-binding.patch +spi-pxa2xx-add-support-for-intel-tiger-lake.patch +can-sja1000-force-the-string-buffer-null-terminated.patch +can-peak_usb-force-the-string-buffer-null-terminated.patch +asoc-amd-acp3x-use-dma_ops-of-parent-device-for-acp3.patch +net-ethernet-qlogic-qed-force-the-string-buffer-null.patch +enetc-select-phylib-while-config_fsl_enetc_vf-is-set.patch +nfsv4-fix-a-credential-refcount-leak-in-nfs41_check_.patch +nfsv4-when-recovering-state-fails-with-eagain-retry-.patch +nfsv4.1-fix-open-stateid-recovery.patch +nfsv4.1-only-reap-expired-delegations.patch +nfsv4-fix-a-potential-sleep-while-atomic-in-nfs4_do_.patch +nfs-fix-regression-whereby-fscache-errors-are-appear.patch +hid-quirks-set-the-increment_usage_on_duplicate-quir.patch +hid-input-fix-a4tech-horizontal-wheel-custom-usage.patch +drm-rockchip-suspend-dp-late.patch +smb3-fix-potential-memory-leak-when-processing-compo.patch +smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch +sched-deadline-fix-double-accounting-of-rq-running-b.patch +sched-psi-reduce-psimon-fifo-priority.patch +sched-psi-do-not-require-setsched-permission-from-th.patch +s390-protvirt-avoid-memory-sharing-for-diag-308-set-.patch +s390-mm-fix-dump_pagetables-top-level-page-table-wal.patch +s390-put-_stext-and-_etext-into-.text-section.patch +ata-rb532_cf-fix-unused-variable-warning-in-rb532_pa.patch +net-cxgb3_main-fix-a-resource-leak-in-a-error-path-i.patch +net-stmmac-fix-issues-when-number-of-queues-4.patch +net-stmmac-tc-do-not-return-a-fragment-entry.patch +drm-amdgpu-pin-the-csb-buffer-on-hw-init-for-gfx-v8.patch +net-hisilicon-make-hip04_tx_reclaim-non-reentrant.patch +net-hisilicon-fix-hip04-xmit-never-return-tx_busy.patch +net-hisilicon-fix-dma_map_single-failed-on-arm64.patch +nfsv4-ensure-state-recovery-handles-etimedout-correc.patch +libata-have-ata_scsi_rw_xlat-fail-invalid-passthroug.patch +libata-add-sg-safety-checks-in-sff-pio-transfers.patch +x86-lib-cpu-address-missing-prototypes-warning.patch +drm-vmwgfx-fix-memory-leak-when-too-many-retries-hav.patch +block-aoe-fix-kernel-crash-due-to-atomic-sleep-when-.patch +block-bfq-handle-null-return-value-by-bfq_init_rq.patch +perf-ftrace-fix-failure-to-set-cpumask-when-only-one.patch +perf-cpumap-fix-writing-to-illegal-memory-in-handlin.patch +perf-pmu-events-fix-missing-cpu_clk_unhalted.core-ev.patch +dt-bindings-riscv-fix-the-schema-compatible-string-f.patch +kvm-arm64-don-t-write-junk-to-sysregs-on-reset.patch +kvm-arm-don-t-write-junk-to-cp15-registers-on-reset.patch +selftests-kvm-adding-config-fragments.patch +iwlwifi-mvm-disable-tx-amsdu-on-older-nics.patch diff --git a/queue-5.2/smb3-fix-potential-memory-leak-when-processing-compo.patch b/queue-5.2/smb3-fix-potential-memory-leak-when-processing-compo.patch new file mode 100644 index 00000000000..0e9a073867b --- /dev/null +++ b/queue-5.2/smb3-fix-potential-memory-leak-when-processing-compo.patch @@ -0,0 +1,87 @@ +From 28ec6454f9c6cad9bc9c1625e58cca39d74dab41 Mon Sep 17 00:00:00 2001 +From: Pavel Shilovsky +Date: Mon, 22 Jul 2019 11:38:22 -0700 +Subject: SMB3: Fix potential memory leak when processing compound chain + +[ Upstream commit 3edeb4a4146dc3b54d6fa71b7ee0585cb52ebfdf ] + +When a reconnect happens in the middle of processing a compound chain +the code leaks a buffer from the memory pool. Fix this by properly +checking for a return code and freeing buffers in case of error. + +Also maintain a buf variable to be equal to either smallbuf or bigbuf +depending on a response buffer size while parsing a chain and when +returning to the caller. + +Signed-off-by: Pavel Shilovsky +Reviewed-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 29 +++++++++++++++++------------ + 1 file changed, 17 insertions(+), 12 deletions(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 2ec37dc589a7b..ae10d6e297c3a 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -4015,7 +4015,6 @@ receive_encrypted_standard(struct TCP_Server_Info *server, + { + int ret, length; + char *buf = server->smallbuf; +- char *tmpbuf; + struct smb2_sync_hdr *shdr; + unsigned int pdu_length = server->pdu_size; + unsigned int buf_size; +@@ -4045,18 +4044,15 @@ receive_encrypted_standard(struct TCP_Server_Info *server, + return length; + + next_is_large = server->large_buf; +- one_more: ++one_more: + shdr = (struct smb2_sync_hdr *)buf; + if (shdr->NextCommand) { +- if (next_is_large) { +- tmpbuf = server->bigbuf; ++ if (next_is_large) + next_buffer = (char *)cifs_buf_get(); +- } else { +- tmpbuf = server->smallbuf; ++ else + next_buffer = (char *)cifs_small_buf_get(); +- } + memcpy(next_buffer, +- tmpbuf + le32_to_cpu(shdr->NextCommand), ++ buf + le32_to_cpu(shdr->NextCommand), + pdu_length - le32_to_cpu(shdr->NextCommand)); + } + +@@ -4085,12 +4081,21 @@ receive_encrypted_standard(struct TCP_Server_Info *server, + pdu_length -= le32_to_cpu(shdr->NextCommand); + server->large_buf = next_is_large; + if (next_is_large) +- server->bigbuf = next_buffer; ++ server->bigbuf = buf = next_buffer; + else +- server->smallbuf = next_buffer; +- +- buf += le32_to_cpu(shdr->NextCommand); ++ server->smallbuf = buf = next_buffer; + goto one_more; ++ } else if (ret != 0) { ++ /* ++ * ret != 0 here means that we didn't get to handle_mid() thus ++ * server->smallbuf and server->bigbuf are still valid. We need ++ * to free next_buffer because it is not going to be used ++ * anywhere. ++ */ ++ if (next_is_large) ++ free_rsp_buf(CIFS_LARGE_BUFFER, next_buffer); ++ else ++ free_rsp_buf(CIFS_SMALL_BUFFER, next_buffer); + } + + return ret; +-- +2.20.1 + diff --git a/queue-5.2/smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch b/queue-5.2/smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch new file mode 100644 index 00000000000..5b19559b637 --- /dev/null +++ b/queue-5.2/smb3-kernel-oops-mounting-a-encryptdata-share-with-c.patch @@ -0,0 +1,43 @@ +From 81579dab0752b9082b7324fafa8bf0b30275ae9d Mon Sep 17 00:00:00 2001 +From: Sebastien Tisserant +Date: Thu, 1 Aug 2019 12:06:08 -0500 +Subject: SMB3: Kernel oops mounting a encryptData share with + CONFIG_DEBUG_VIRTUAL + +[ Upstream commit ee9d66182392695535cc9fccfcb40c16f72de2a9 ] + +Fix kernel oops when mounting a encryptData CIFS share with +CONFIG_DEBUG_VIRTUAL + +Signed-off-by: Sebastien Tisserant +Reviewed-by: Pavel Shilovsky +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index ae10d6e297c3a..42de31d206169 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -3439,7 +3439,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, + static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf, + unsigned int buflen) + { +- sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf)); ++ void *addr; ++ /* ++ * VMAP_STACK (at least) puts stack into the vmalloc address space ++ */ ++ if (is_vmalloc_addr(buf)) ++ addr = vmalloc_to_page(buf); ++ else ++ addr = virt_to_page(buf); ++ sg_set_page(sg, addr, buflen, offset_in_page(buf)); + } + + /* Assumes the first rqst has a transform header as the first iov. +-- +2.20.1 + diff --git a/queue-5.2/spi-pxa2xx-add-support-for-intel-tiger-lake.patch b/queue-5.2/spi-pxa2xx-add-support-for-intel-tiger-lake.patch new file mode 100644 index 00000000000..5a92c02e8d3 --- /dev/null +++ b/queue-5.2/spi-pxa2xx-add-support-for-intel-tiger-lake.patch @@ -0,0 +1,41 @@ +From 25e7f39c84a1e0619044c540e3be9cbe4cfbd6dc Mon Sep 17 00:00:00 2001 +From: Jarkko Nikula +Date: Thu, 1 Aug 2019 16:49:01 +0300 +Subject: spi: pxa2xx: Add support for Intel Tiger Lake + +[ Upstream commit a4127952859a869cf3fc5a49547dbe2ffa2eac89 ] + +Intel Tiger Lake -LP LPSS SPI controller is otherwise similar than +Cannon Lake but has more controllers and up to two chip selects per +controller. + +Signed-off-by: Jarkko Nikula +Link: https://lore.kernel.org/r/20190801134901.12635-1-jarkko.nikula@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index c1af8887d9186..1f32c9e3ca65c 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1453,6 +1453,14 @@ static const struct pci_device_id pxa2xx_spi_pci_compound_match[] = { + { PCI_VDEVICE(INTEL, 0x02aa), LPSS_CNL_SSP }, + { PCI_VDEVICE(INTEL, 0x02ab), LPSS_CNL_SSP }, + { PCI_VDEVICE(INTEL, 0x02fb), LPSS_CNL_SSP }, ++ /* TGL-LP */ ++ { PCI_VDEVICE(INTEL, 0xa0aa), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0ab), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0de), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0df), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0fb), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0fd), LPSS_CNL_SSP }, ++ { PCI_VDEVICE(INTEL, 0xa0fe), LPSS_CNL_SSP }, + { }, + }; + +-- +2.20.1 + diff --git a/queue-5.2/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch b/queue-5.2/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch new file mode 100644 index 00000000000..2f1794174ee --- /dev/null +++ b/queue-5.2/spi-pxa2xx-balance-runtime-pm-enable-disable-on-erro.patch @@ -0,0 +1,49 @@ +From 82187707eb68d614596effb35da7d883c48676b5 Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Fri, 19 Jul 2019 14:27:13 +0200 +Subject: spi: pxa2xx: Balance runtime PM enable/disable on error + +[ Upstream commit 1274204542f683e1d8491ebe9cc86284d5a8ebcc ] + +Don't undo the PM initialization if we error out before we managed to +initialize it. The call to pm_runtime_disable() without being preceded +by pm_runtime_enable() would disturb the balance of the Force. + +In practice, this happens if we fail to allocate any of the GPIOS ("cs", +"ready") due to -EPROBE_DEFER because we're getting probled before the +GPIO driver. + +Signed-off-by: Lubomir Rintel +Link: https://lore.kernel.org/r/20190719122713.3444318-1-lkundrak@v3.sk +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-pxa2xx.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index af3f37ba82c83..c1af8887d9186 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1817,14 +1817,16 @@ static int pxa2xx_spi_probe(struct platform_device *pdev) + status = devm_spi_register_controller(&pdev->dev, controller); + if (status != 0) { + dev_err(&pdev->dev, "problem registering spi controller\n"); +- goto out_error_clock_enabled; ++ goto out_error_pm_runtime_enabled; + } + + return status; + +-out_error_clock_enabled: ++out_error_pm_runtime_enabled: + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); ++ ++out_error_clock_enabled: + clk_disable_unprepare(ssp->clk); + + out_error_dma_irq_alloc: +-- +2.20.1 + diff --git a/queue-5.2/st21nfca_connectivity_event_received-null-check-the-.patch b/queue-5.2/st21nfca_connectivity_event_received-null-check-the-.patch new file mode 100644 index 00000000000..4ebda44b487 --- /dev/null +++ b/queue-5.2/st21nfca_connectivity_event_received-null-check-the-.patch @@ -0,0 +1,32 @@ +From 36b3ab496ac2380c68c5134115e8a5891d06aa86 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Tue, 23 Jul 2019 17:04:30 -0500 +Subject: st21nfca_connectivity_event_received: null check the allocation + +[ Upstream commit 9891d06836e67324c9e9c4675ed90fc8b8110034 ] + +devm_kzalloc may fail and return null. So the null check is needed. + +Signed-off-by: Navid Emamdoost +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/st21nfca/se.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nfc/st21nfca/se.c b/drivers/nfc/st21nfca/se.c +index 06fc542fd1987..6586378cacb05 100644 +--- a/drivers/nfc/st21nfca/se.c ++++ b/drivers/nfc/st21nfca/se.c +@@ -317,6 +317,8 @@ int st21nfca_connectivity_event_received(struct nfc_hci_dev *hdev, u8 host, + + transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, + skb->len - 2, GFP_KERNEL); ++ if (!transaction) ++ return -ENOMEM; + + transaction->aid_len = skb->data[1]; + memcpy(transaction->aid, &skb->data[2], +-- +2.20.1 + diff --git a/queue-5.2/st_nci_hci_connectivity_event_received-null-check-th.patch b/queue-5.2/st_nci_hci_connectivity_event_received-null-check-th.patch new file mode 100644 index 00000000000..7da4dd9ff74 --- /dev/null +++ b/queue-5.2/st_nci_hci_connectivity_event_received-null-check-th.patch @@ -0,0 +1,32 @@ +From 493220b3e57ee6e9f2e08402b3b88a53820e3b60 Mon Sep 17 00:00:00 2001 +From: Navid Emamdoost +Date: Tue, 23 Jul 2019 17:11:51 -0500 +Subject: st_nci_hci_connectivity_event_received: null check the allocation + +[ Upstream commit 3008e06fdf0973770370f97d5f1fba3701d8281d ] + +devm_kzalloc may fail and return NULL. So the null check is needed. + +Signed-off-by: Navid Emamdoost +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/st-nci/se.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c +index c3e10b6ab3a4d..f25f1ec5f9e97 100644 +--- a/drivers/nfc/st-nci/se.c ++++ b/drivers/nfc/st-nci/se.c +@@ -333,6 +333,8 @@ static int st_nci_hci_connectivity_event_received(struct nci_dev *ndev, + + transaction = (struct nfc_evt_transaction *)devm_kzalloc(dev, + skb->len - 2, GFP_KERNEL); ++ if (!transaction) ++ return -ENOMEM; + + transaction->aid_len = skb->data[1]; + memcpy(transaction->aid, &skb->data[2], transaction->aid_len); +-- +2.20.1 + diff --git a/queue-5.2/staging-fbtft-fix-gpio-handling.patch b/queue-5.2/staging-fbtft-fix-gpio-handling.patch new file mode 100644 index 00000000000..1dbfbf6694d --- /dev/null +++ b/queue-5.2/staging-fbtft-fix-gpio-handling.patch @@ -0,0 +1,173 @@ +From a75b04d4f32b3bb31264ad8b308ce0a1940d4a34 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20Sebastian=20G=C3=B6tte?= +Date: Wed, 17 Jul 2019 23:41:37 +0900 +Subject: Staging: fbtft: Fix GPIO handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 92e3e884887c0d278042fbbb6f6c9b41d6addb71 ] + +Commit c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor +interface") breaks GPIO handling. In several places, checks to only set +a GPIO if it was configured ended up backwards. +I have tested this fix. The fixed driver works with a ili9486 +display connected to a raspberry pi via SPI. + +Fixes: c440eee1a7a1d ("Staging: fbtft: Switch to the gpio descriptor interface") +Tested-by: Jan Sebastian Götte +Reviewed-by: Nicolas Saenz Julienne +Signed-off-by: Jan Sebastian Götte +Link: https://lore.kernel.org/r/75ada52f-afa1-08bc-d0ce-966fc1110e70@jaseg.net +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fb_bd663474.c | 2 +- + drivers/staging/fbtft/fb_ili9163.c | 2 +- + drivers/staging/fbtft/fb_ili9325.c | 2 +- + drivers/staging/fbtft/fb_s6d1121.c | 2 +- + drivers/staging/fbtft/fb_ssd1289.c | 2 +- + drivers/staging/fbtft/fb_ssd1331.c | 4 ++-- + drivers/staging/fbtft/fb_upd161704.c | 2 +- + drivers/staging/fbtft/fbtft-bus.c | 2 +- + drivers/staging/fbtft/fbtft-core.c | 4 ++-- + 9 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/staging/fbtft/fb_bd663474.c b/drivers/staging/fbtft/fb_bd663474.c +index b6c6d66e4eb1b..e2c7646588f8c 100644 +--- a/drivers/staging/fbtft/fb_bd663474.c ++++ b/drivers/staging/fbtft/fb_bd663474.c +@@ -24,7 +24,7 @@ + + static int init_display(struct fbtft_par *par) + { +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + par->fbtftops.reset(par); +diff --git a/drivers/staging/fbtft/fb_ili9163.c b/drivers/staging/fbtft/fb_ili9163.c +index d609a2b67db9b..fd32376700e28 100644 +--- a/drivers/staging/fbtft/fb_ili9163.c ++++ b/drivers/staging/fbtft/fb_ili9163.c +@@ -77,7 +77,7 @@ static int init_display(struct fbtft_par *par) + { + par->fbtftops.reset(par); + +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + write_reg(par, MIPI_DCS_SOFT_RESET); /* software reset */ +diff --git a/drivers/staging/fbtft/fb_ili9325.c b/drivers/staging/fbtft/fb_ili9325.c +index b090e7ab6fdd6..85e54a10ed72c 100644 +--- a/drivers/staging/fbtft/fb_ili9325.c ++++ b/drivers/staging/fbtft/fb_ili9325.c +@@ -85,7 +85,7 @@ static int init_display(struct fbtft_par *par) + { + par->fbtftops.reset(par); + +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + bt &= 0x07; +diff --git a/drivers/staging/fbtft/fb_s6d1121.c b/drivers/staging/fbtft/fb_s6d1121.c +index b3d0701880fe3..5a129b1352cc8 100644 +--- a/drivers/staging/fbtft/fb_s6d1121.c ++++ b/drivers/staging/fbtft/fb_s6d1121.c +@@ -29,7 +29,7 @@ static int init_display(struct fbtft_par *par) + { + par->fbtftops.reset(par); + +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + /* Initialization sequence from Lib_UTFT */ +diff --git a/drivers/staging/fbtft/fb_ssd1289.c b/drivers/staging/fbtft/fb_ssd1289.c +index bbf75f795234b..88a5b6925901d 100644 +--- a/drivers/staging/fbtft/fb_ssd1289.c ++++ b/drivers/staging/fbtft/fb_ssd1289.c +@@ -28,7 +28,7 @@ static int init_display(struct fbtft_par *par) + { + par->fbtftops.reset(par); + +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + write_reg(par, 0x00, 0x0001); +diff --git a/drivers/staging/fbtft/fb_ssd1331.c b/drivers/staging/fbtft/fb_ssd1331.c +index 4cfe9f8535d0f..37622c9462aa7 100644 +--- a/drivers/staging/fbtft/fb_ssd1331.c ++++ b/drivers/staging/fbtft/fb_ssd1331.c +@@ -81,7 +81,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...) + va_start(args, len); + + *buf = (u8)va_arg(args, unsigned int); +- if (!par->gpio.dc) ++ if (par->gpio.dc) + gpiod_set_value(par->gpio.dc, 0); + ret = par->fbtftops.write(par, par->buf, sizeof(u8)); + if (ret < 0) { +@@ -104,7 +104,7 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...) + return; + } + } +- if (!par->gpio.dc) ++ if (par->gpio.dc) + gpiod_set_value(par->gpio.dc, 1); + va_end(args); + } +diff --git a/drivers/staging/fbtft/fb_upd161704.c b/drivers/staging/fbtft/fb_upd161704.c +index 564a38e344406..c77832ae5e5ba 100644 +--- a/drivers/staging/fbtft/fb_upd161704.c ++++ b/drivers/staging/fbtft/fb_upd161704.c +@@ -26,7 +26,7 @@ static int init_display(struct fbtft_par *par) + { + par->fbtftops.reset(par); + +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + /* Initialization sequence from Lib_UTFT */ +diff --git a/drivers/staging/fbtft/fbtft-bus.c b/drivers/staging/fbtft/fbtft-bus.c +index 2ea814d0dca5d..63c65dd67b175 100644 +--- a/drivers/staging/fbtft/fbtft-bus.c ++++ b/drivers/staging/fbtft/fbtft-bus.c +@@ -135,7 +135,7 @@ int fbtft_write_vmem16_bus8(struct fbtft_par *par, size_t offset, size_t len) + remain = len / 2; + vmem16 = (u16 *)(par->info->screen_buffer + offset); + +- if (!par->gpio.dc) ++ if (par->gpio.dc) + gpiod_set_value(par->gpio.dc, 1); + + /* non buffered write */ +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index bc750250ccd6c..5127de922f6a2 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -916,7 +916,7 @@ static int fbtft_init_display_dt(struct fbtft_par *par) + return -EINVAL; + + par->fbtftops.reset(par); +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + while (p) { +@@ -1007,7 +1007,7 @@ int fbtft_init_display(struct fbtft_par *par) + } + + par->fbtftops.reset(par); +- if (!par->gpio.cs) ++ if (par->gpio.cs) + gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ + + i = 0; +-- +2.20.1 + diff --git a/queue-5.2/x86-lib-cpu-address-missing-prototypes-warning.patch b/queue-5.2/x86-lib-cpu-address-missing-prototypes-warning.patch new file mode 100644 index 00000000000..63c7dffdbeb --- /dev/null +++ b/queue-5.2/x86-lib-cpu-address-missing-prototypes-warning.patch @@ -0,0 +1,45 @@ +From c810428da124e41b8e1943b90a51b4d2eb8435bd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Valdis=20Kl=C4=93tnieks?= +Date: Wed, 7 Aug 2019 23:27:17 -0400 +Subject: x86/lib/cpu: Address missing prototypes warning + +[ Upstream commit 04f5bda84b0712d6f172556a7e8dca9ded5e73b9 ] + +When building with W=1, warnings about missing prototypes are emitted: + + CC arch/x86/lib/cpu.o +arch/x86/lib/cpu.c:5:14: warning: no previous prototype for 'x86_family' [-Wmissing-prototypes] + 5 | unsigned int x86_family(unsigned int sig) + | ^~~~~~~~~~ +arch/x86/lib/cpu.c:18:14: warning: no previous prototype for 'x86_model' [-Wmissing-prototypes] + 18 | unsigned int x86_model(unsigned int sig) + | ^~~~~~~~~ +arch/x86/lib/cpu.c:33:14: warning: no previous prototype for 'x86_stepping' [-Wmissing-prototypes] + 33 | unsigned int x86_stepping(unsigned int sig) + | ^~~~~~~~~~~~ + +Add the proper include file so the prototypes are there. + +Signed-off-by: Valdis Kletnieks +Signed-off-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/42513.1565234837@turing-police +Signed-off-by: Sasha Levin +--- + arch/x86/lib/cpu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/x86/lib/cpu.c b/arch/x86/lib/cpu.c +index 04967cdce5d12..7ad68917a51e8 100644 +--- a/arch/x86/lib/cpu.c ++++ b/arch/x86/lib/cpu.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0-only + #include + #include ++#include + + unsigned int x86_family(unsigned int sig) + { +-- +2.20.1 +