From: Greg Kroah-Hartman Date: Sat, 10 Nov 2018 19:16:09 +0000 (-0800) Subject: 4.19-stable patches X-Git-Tag: v4.19.2~71 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fbe9384b84788a61f74954d555a50ec77c4fd2ce;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch acpi-pptt-handle-architecturally-unknown-cache-types.patch acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch asoc-amd-fix-capture-unstable-in-beginning-for-some-runs.patch ataflop-fix-error-handling-during-setup.patch ath10k-fix-tx-status-flag-setting-for-management-frames.patch ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch bcache-populate-writeback_rate_minimum-attribute.patch block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch bluetooth-hci_qca-remove-hdev-dereference-in-qca_close.patch bpf-verifier-fix-verifier-instability.patch brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch cgroup-netclassid-add-a-preemption-point-to-write_classid.patch cifs-fix-a-credits-leak-for-compund-commands.patch coresight-etb10-fix-handling-of-perf-mode.patch cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch cpupower-fix-amd-family-0x17-msr_pstate-size.patch cpupower-fix-coredump-on-vmware.patch crypto-caam-fix-implicit-casts-in-endianness-helpers.patch dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch efi-x86-call-efi_parse_options-from-efi_main.patch ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch f2fs-avoid-sleeping-under-spin_lock.patch f2fs-clear-pageerror-on-the-read-path.patch f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch f2fs-fix-to-flush-all-dirty-inodes-recovered-in-readonly-fs.patch f2fs-fix-to-recover-inode-s-crtime-during-por.patch f2fs-fix-to-recover-inode-s-i_flags-during-por.patch f2fs-report-error-if-quota-off-error-during-umount.patch failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch firmware-coreboot-unmap-ioregion-after-device-population.patch gpio-brcmstb-allow-0-width-gpio-banks.patch hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch ib-ipoib-clear-ipcb-before-icmp_send.patch ib-ipoib-use-dev_port-to-expose-network-interface-port-numbers.patch ib-mlx5-allow-transition-of-dci-qp-to-reset.patch ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch ice-update-fw-version-check-logic.patch irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch iwlwifi-pcie-avoid-empty-free-rb-queue.patch ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch ixgbevf-vf2vf-tcp-rss.patch kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch libertas_tf-prevent-underflow-in-process_cmdrequest.patch lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch lightnvm-pblk-fix-race-on-sysfs-line-state.patch lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch locking-lockdep-fix-debug_locks-off-performance-problem.patch md-fix-invalid-stored-role-for-a-disk.patch md-fix-memleak-for-mempool.patch md-memory-leak-when-flush-bio-size-is-zero.patch mfd-menelaus-fix-possible-race-condition-and-leak.patch mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch mt76x2u-run-device-cleanup-routine-if-resume-fails.patch mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch net-hns3-check-hdev-state-when-getting-link-status.patch net-hns3-fix-ets-validate-issue.patch net-hns3-fix-for-packet-buffer-setting-bug.patch net-hns3-fix-for-vf-vlan-delete-failed-problem.patch net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch net-hns3-preserve-vlan-0-in-hardware-table.patch net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch net-loopback-clear-skb-tstamp-before-netif_rx.patch net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch net-socionext-reset-tx-queue-in-ndo_stop.patch net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch nvme-call-nvme_complete_rq-when-nvmf_check_ready-fails-for-mpath-i-o.patch nvmem-check-the-return-value-of-nvmem_add_cells.patch nvmet-rdma-use-a-private-workqueue-for-delete.patch of-add-missing-exports-of-node-name-compare-functions.patch pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch pci-cadence-correct-probe-behaviour-when-failing-to-get-phy.patch pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch perf-strbuf-match-va_-add-copy-with-va_end.patch perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch perf-tools-cleanup-trace-event-info-tdata-leak.patch perf-tools-free-printk-string-in-parse_ftrace_printk.patch perf-tools-free-temporary-sys-string-in-read_event_files.patch pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch rdma-cm-respect-returned-status-of-cm_init_av_by_path.patch rdma-core-do-not-expose-unsupported-counters.patch rsi-fix-memory-alignment-issue-in-arm32-platforms.patch s390-sthyi-fix-machine-name-validity-indication.patch scsi-esp_scsi-track-residual-for-pio-transfers.patch scsi-lpfc-correct-race-with-abort-on-completion-path.patch scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch scsi-megaraid_sas-fix-a-missing-check-bug.patch scsi-qla2xxx-fix-recursive-mailbox-timeout.patch scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch sdhci-acpi-add-free_slot-callback.patch signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch smack-ptrace-capability-use-fixes.patch spi-gpio-no-miso-does-not-imply-no-rx.patch spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch swim-fix-cleanup-on-setup-error.patch thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch thermal-rcar_thermal-prevent-doing-work-after-unbind.patch tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch uio-ensure-class-is-registered-before-devices.patch usb-chipidea-prevent-unbalanced-irq-disable.patch usb-dwc2-fix-a-race-with-external-vbus-supply.patch usb-dwc2-fix-call-to-vbus-supply-exit-routine-call-it-unlocked.patch usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch vmci-resource-wildcard-match-fixed.patch wil6210-fix-rx-buffers-release-and-unmap.patch wlcore-fix-bug-with-clear-completion-on-timeout.patch x86-boot-fix-efi-stub-alignment.patch x86-intel_rdt-show-missing-resctrl-mount-options.patch x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch --- diff --git a/queue-4.19/acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch b/queue-4.19/acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch new file mode 100644 index 00000000000..88d93183887 --- /dev/null +++ b/queue-4.19/acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Hans de Goede +Date: Mon, 27 Aug 2018 09:45:44 +0200 +Subject: ACPI / LPSS: Add alternative ACPI HIDs for Cherry Trail DMA controllers + +From: Hans de Goede + +[ Upstream commit 240714061c58e6b1abfb3322398a7634151c06cb ] + +Bay and Cherry Trail DSTDs represent a different set of devices depending +on which OS the device think it is booting. One set of decices for Windows +and another set of devices for Android which targets the Android-x86 Linux +kernel fork (which e.g. used to have its own display driver instead of +using the i915 driver). + +Which set of devices we are actually going to get is out of our control, +this is controlled by the ACPI OSID variable, which gets either set through +an EFI setup option, or sometimes is autodetected. So we need to support +both. + +This commit adds support for the 80862286 and 808622C0 ACPI HIDs which we +get for the first resp. second DMA controller on Cherry Trail devices when +OSID is set to Android. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_lpss.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -327,9 +327,11 @@ static const struct acpi_device_id acpi_ + { "INT33FC", }, + + /* Braswell LPSS devices */ ++ { "80862286", LPSS_ADDR(lpss_dma_desc) }, + { "80862288", LPSS_ADDR(bsw_pwm_dev_desc) }, + { "8086228A", LPSS_ADDR(bsw_uart_dev_desc) }, + { "8086228E", LPSS_ADDR(bsw_spi_dev_desc) }, ++ { "808622C0", LPSS_ADDR(lpss_dma_desc) }, + { "808622C1", LPSS_ADDR(bsw_i2c_dev_desc) }, + + /* Broadwell LPSS devices */ diff --git a/queue-4.19/acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch b/queue-4.19/acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch new file mode 100644 index 00000000000..cee80cd3d37 --- /dev/null +++ b/queue-4.19/acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Rajneesh Bhardwaj +Date: Fri, 28 Sep 2018 14:24:02 +0530 +Subject: ACPI / PM: LPIT: Register sysfs attributes based on FADT + +From: Rajneesh Bhardwaj + +[ Upstream commit 1cdda9486f5103fb133f88e662e48c504adbb779 ] + +ACPI Low Power S0 Idle capabilities are announced via FADT table and can +be used to inform the kernel about the presence of one or more Low Power +Idle (LPI) entries as descried in LPIT table. LPIT table can exist +independently even if the FADT S0 Idle flag is not set and thus it could +confuse user since the following cpuidle attributes are created. + +/sys/devices/system/cpu/cpuidle/low_power_idle_cpu_residency_us +/sys/devices/system/cpu/cpuidle/low_power_idle_system_residency_us + +Presence or absence of above attributes could mean that the given +platform supports S0ix state or not. + +This change allows to create the above cpuidle attributes only if +FADT table supports Low Power S0 Idle. + +Signed-off-by: Rajneesh Bhardwaj +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_lpit.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/acpi/acpi_lpit.c ++++ b/drivers/acpi/acpi_lpit.c +@@ -117,11 +117,17 @@ static void lpit_update_residency(struct + if (!info->iomem_addr) + return; + ++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0)) ++ return; ++ + /* Silently fail, if cpuidle attribute group is not present */ + sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj, + &dev_attr_low_power_idle_system_residency_us.attr, + "cpuidle"); + } else if (info->gaddr.space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) { ++ if (!(acpi_gbl_FADT.flags & ACPI_FADT_LOW_POWER_S0)) ++ return; ++ + /* Silently fail, if cpuidle attribute group is not present */ + sysfs_add_file_to_group(&cpu_subsys.dev_root->kobj, + &dev_attr_low_power_idle_cpu_residency_us.attr, diff --git a/queue-4.19/acpi-pptt-handle-architecturally-unknown-cache-types.patch b/queue-4.19/acpi-pptt-handle-architecturally-unknown-cache-types.patch new file mode 100644 index 00000000000..3a433f6a2ba --- /dev/null +++ b/queue-4.19/acpi-pptt-handle-architecturally-unknown-cache-types.patch @@ -0,0 +1,92 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jeffrey Hugo +Date: Thu, 4 Oct 2018 09:20:06 -0600 +Subject: ACPI/PPTT: Handle architecturally unknown cache types + +From: Jeffrey Hugo + +[ Upstream commit 59bbff3775c0951300f7b41345a54b999438f8d0 ] + +The type of a cache might not be specified by architectural mechanisms (ie +system registers), but its type might be specified in the PPTT. In this +case, we should populate the type of the cache, rather than leave it +undefined. + +This fixes the issue where the cacheinfo driver will not populate sysfs +for such caches, resulting in the information missing from utilities like +lstopo and lscpu, thus degrading the user experience. + +Fixes: 2bd00bcd73e5 (ACPI/PPTT: Add Processor Properties Topology Table parsing) +Reported-by: Vijaya Kumar K +Signed-off-by: Jeffrey Hugo +Reviewed-by: Sudeep Holla +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/pptt.c | 33 +++++++++++++-------------------- + 1 file changed, 13 insertions(+), 20 deletions(-) + +--- a/drivers/acpi/pptt.c ++++ b/drivers/acpi/pptt.c +@@ -338,9 +338,6 @@ static struct acpi_pptt_cache *acpi_find + return found; + } + +-/* total number of attributes checked by the properties code */ +-#define PPTT_CHECKED_ATTRIBUTES 4 +- + /** + * update_cache_properties() - Update cacheinfo for the given processor + * @this_leaf: Kernel cache info structure being updated +@@ -357,25 +354,15 @@ static void update_cache_properties(stru + struct acpi_pptt_cache *found_cache, + struct acpi_pptt_processor *cpu_node) + { +- int valid_flags = 0; +- + this_leaf->fw_token = cpu_node; +- if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) { ++ if (found_cache->flags & ACPI_PPTT_SIZE_PROPERTY_VALID) + this_leaf->size = found_cache->size; +- valid_flags++; +- } +- if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) { ++ if (found_cache->flags & ACPI_PPTT_LINE_SIZE_VALID) + this_leaf->coherency_line_size = found_cache->line_size; +- valid_flags++; +- } +- if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) { ++ if (found_cache->flags & ACPI_PPTT_NUMBER_OF_SETS_VALID) + this_leaf->number_of_sets = found_cache->number_of_sets; +- valid_flags++; +- } +- if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) { ++ if (found_cache->flags & ACPI_PPTT_ASSOCIATIVITY_VALID) + this_leaf->ways_of_associativity = found_cache->associativity; +- valid_flags++; +- } + if (found_cache->flags & ACPI_PPTT_WRITE_POLICY_VALID) { + switch (found_cache->attributes & ACPI_PPTT_MASK_WRITE_POLICY) { + case ACPI_PPTT_CACHE_POLICY_WT: +@@ -402,11 +389,17 @@ static void update_cache_properties(stru + } + } + /* +- * If the above flags are valid, and the cache type is NOCACHE +- * update the cache type as well. ++ * If cache type is NOCACHE, then the cache hasn't been specified ++ * via other mechanisms. Update the type if a cache type has been ++ * provided. ++ * ++ * Note, we assume such caches are unified based on conventional system ++ * design and known examples. Significant work is required elsewhere to ++ * fully support data/instruction only type caches which are only ++ * specified in PPTT. + */ + if (this_leaf->type == CACHE_TYPE_NOCACHE && +- valid_flags == PPTT_CHECKED_ATTRIBUTES) ++ found_cache->flags & ACPI_PPTT_CACHE_TYPE_VALID) + this_leaf->type = CACHE_TYPE_UNIFIED; + } + diff --git a/queue-4.19/acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch b/queue-4.19/acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch new file mode 100644 index 00000000000..ddfcc249b5d --- /dev/null +++ b/queue-4.19/acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Dou Liyang +Date: Fri, 24 Aug 2018 10:51:26 +0800 +Subject: ACPI / processor: Fix the return value of acpi_processor_ids_walk() + +From: Dou Liyang + +[ Upstream commit d0381bf4f80c571dde1244fe5b85dc35e8b3f546 ] + +ACPI driver should make sure all the processor IDs in their ACPI Namespace +are unique. the driver performs a depth-first walk of the namespace tree +and calls the acpi_processor_ids_walk() to check the duplicate IDs. + +But, the acpi_processor_ids_walk() mistakes the return value. If a +processor is checked, it returns true which causes the walk break +immediately, and other processors will never be checked. + +Repace the value with AE_OK which is the standard acpi_status value. +And don't abort the namespace walk even on error. + +Fixes: 8c8cb30f49b8 (acpi/processor: Implement DEVICE operator for processor enumeration) +Signed-off-by: Dou Liyang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_processor.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/acpi/acpi_processor.c ++++ b/drivers/acpi/acpi_processor.c +@@ -643,7 +643,7 @@ static acpi_status __init acpi_processor + + status = acpi_get_type(handle, &acpi_type); + if (ACPI_FAILURE(status)) +- return false; ++ return status; + + switch (acpi_type) { + case ACPI_TYPE_PROCESSOR: +@@ -663,11 +663,12 @@ static acpi_status __init acpi_processor + } + + processor_validated_ids_update(uid); +- return true; ++ return AE_OK; + + err: ++ /* Exit on error, but don't abort the namespace walk */ + acpi_handle_info(handle, "Invalid processor object\n"); +- return false; ++ return AE_OK; + + } + diff --git a/queue-4.19/alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch b/queue-4.19/alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch new file mode 100644 index 00000000000..9f2356cdd48 --- /dev/null +++ b/queue-4.19/alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch @@ -0,0 +1,78 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Takashi Iwai +Date: Sat, 11 Aug 2018 23:33:34 +0200 +Subject: ALSA: hda: Check the non-cached stream buffers more explicitly + +From: Takashi Iwai + +[ Upstream commit 78c9be61c3a5cd9e2439fd27a5ffad73a81958c7 ] + +Introduce a new flag, uc_buffer, to indicate that the controller +requires the non-cached pages for stream buffers, either as a +chip-specific requirement or specified via snoop=0 option. +This improves the code-readability. + +Also, this patch fixes the incorrect behavior for C-Media chip where +the stream buffers were never handled as non-cached due to the check +of driver_type even if you pass snoop=0 option. + +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_controller.h | 1 + + sound/pci/hda/hda_intel.c | 11 ++++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -160,6 +160,7 @@ struct azx { + unsigned int msi:1; + unsigned int probing:1; /* codec probing phase */ + unsigned int snoop:1; ++ unsigned int uc_buffer:1; /* non-cached pages for stream buffers */ + unsigned int align_buffer_size:1; + unsigned int region_requested:1; + unsigned int disabled:1; /* disabled by vga_switcheroo */ +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -412,7 +412,7 @@ static void __mark_pages_wc(struct azx * + #ifdef CONFIG_SND_DMA_SGBUF + if (dmab->dev.type == SNDRV_DMA_TYPE_DEV_SG) { + struct snd_sg_buf *sgbuf = dmab->private_data; +- if (chip->driver_type == AZX_DRIVER_CMEDIA) ++ if (!chip->uc_buffer) + return; /* deal with only CORB/RIRB buffers */ + if (on) + set_pages_array_wc(sgbuf->page_table, sgbuf->pages); +@@ -1678,6 +1678,7 @@ static void azx_check_snoop_available(st + dev_info(chip->card->dev, "Force to %s mode by module option\n", + snoop ? "snoop" : "non-snoop"); + chip->snoop = snoop; ++ chip->uc_buffer = !snoop; + return; + } + +@@ -1698,8 +1699,12 @@ static void azx_check_snoop_available(st + snoop = false; + + chip->snoop = snoop; +- if (!snoop) ++ if (!snoop) { + dev_info(chip->card->dev, "Force to non-snoop mode\n"); ++ /* C-Media requires non-cached pages only for CORB/RIRB */ ++ if (chip->driver_type != AZX_DRIVER_CMEDIA) ++ chip->uc_buffer = true; ++ } + } + + static void azx_probe_work(struct work_struct *work) +@@ -2138,7 +2143,7 @@ static void pcm_mmap_prepare(struct snd_ + #ifdef CONFIG_X86 + struct azx_pcm *apcm = snd_pcm_substream_chip(substream); + struct azx *chip = apcm->chip; +- if (!azx_snoop(chip) && chip->driver_type != AZX_DRIVER_CMEDIA) ++ if (chip->uc_buffer) + area->vm_page_prot = pgprot_writecombine(area->vm_page_prot); + #endif + } diff --git a/queue-4.19/arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch b/queue-4.19/arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch new file mode 100644 index 00000000000..194adf7cf0a --- /dev/null +++ b/queue-4.19/arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch @@ -0,0 +1,49 @@ +From f5e758b8358f6c27e8a351ddf0b441a64cdabb94 Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Wed, 5 Sep 2018 12:02:15 +0200 +Subject: ARM: dts: exynos: Disable pull control for MAX8997 interrupts on Origen + +From: Marek Szyprowski + +commit f5e758b8358f6c27e8a351ddf0b441a64cdabb94 upstream. + +PMIC_IRQB and PMIC_KEYINB lines on Exynos4210-based Origen board have +external pull-up resistors, so disable any pull control for those lines +in respective pin controller node. This fixes support for MAX8997 +interrupts and enables operation of wakeup from MAX8997 RTC alarm. + +Signed-off-by: Marek Szyprowski +Fixes: 17419726aaa1 ("ARM: dts: add max8997 device node for exynos4210-origen board") +Cc: +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/exynos4210-origen.dts | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/arch/arm/boot/dts/exynos4210-origen.dts ++++ b/arch/arm/boot/dts/exynos4210-origen.dts +@@ -151,6 +151,8 @@ + reg = <0x66>; + interrupt-parent = <&gpx0>; + interrupts = <4 IRQ_TYPE_NONE>, <3 IRQ_TYPE_NONE>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&max8997_irq>; + + max8997,pmic-buck1-dvs-voltage = <1350000>; + max8997,pmic-buck2-dvs-voltage = <1100000>; +@@ -288,6 +290,13 @@ + }; + }; + ++&pinctrl_1 { ++ max8997_irq: max8997-irq { ++ samsung,pins = "gpx0-3", "gpx0-4"; ++ samsung,pin-pud = ; ++ }; ++}; ++ + &sdhci_0 { + bus-width = <4>; + pinctrl-0 = <&sd0_clk &sd0_cmd &sd0_bus4 &sd0_cd>; diff --git a/queue-4.19/arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch b/queue-4.19/arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch new file mode 100644 index 00000000000..76535e31db3 --- /dev/null +++ b/queue-4.19/arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch @@ -0,0 +1,71 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Suzuki K Poulose +Date: Tue, 9 Oct 2018 14:47:05 +0100 +Subject: arm64: cpufeature: ctr: Fix cpu capability check for late CPUs + +From: Suzuki K Poulose + +[ Upstream commit 8ab66cbe63aeaf9e5970fb4aaef1c660fca59321 ] + +The matches() routine for a capability must honor the "scope" +passed to it and return the proper results. +i.e, when passed with SCOPE_LOCAL_CPU, it should check the +status of the capability on the current CPU. This is used by +verify_local_cpu_capabilities() on a late secondary CPU to make +sure that it's compliant with the established system features. +However, ARM64_HAS_CACHE_{IDC/DIC} always checks the system wide +registers and this could mean that a late secondary CPU could return +"true" (since the CPU hasn't updated the system wide registers yet) +and thus lead the system in an inconsistent state, where +the system assumes it has IDC/DIC feature, while the new CPU +doesn't. + +Fixes: commit 6ae4b6e0578886eb36 ("arm64: Add support for new control bits CTR_EL0.DIC and CTR_EL0.IDC") +Cc: Philip Elcan +Cc: Shanker Donthineni +Cc: Mark Rutland +Cc: Will Deacon +Signed-off-by: Suzuki K Poulose +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/cpufeature.c | 22 ++++++++++++++++++---- + 1 file changed, 18 insertions(+), 4 deletions(-) + +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -848,15 +848,29 @@ static bool has_no_fpsimd(const struct a + } + + static bool has_cache_idc(const struct arm64_cpu_capabilities *entry, +- int __unused) ++ int scope) + { +- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_IDC_SHIFT); ++ u64 ctr; ++ ++ if (scope == SCOPE_SYSTEM) ++ ctr = arm64_ftr_reg_ctrel0.sys_val; ++ else ++ ctr = read_cpuid_cachetype(); ++ ++ return ctr & BIT(CTR_IDC_SHIFT); + } + + static bool has_cache_dic(const struct arm64_cpu_capabilities *entry, +- int __unused) ++ int scope) + { +- return read_sanitised_ftr_reg(SYS_CTR_EL0) & BIT(CTR_DIC_SHIFT); ++ u64 ctr; ++ ++ if (scope == SCOPE_SYSTEM) ++ ctr = arm64_ftr_reg_ctrel0.sys_val; ++ else ++ ctr = read_cpuid_cachetype(); ++ ++ return ctr & BIT(CTR_DIC_SHIFT); + } + + #ifdef CONFIG_UNMAP_KERNEL_AT_EL0 diff --git a/queue-4.19/arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch b/queue-4.19/arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch new file mode 100644 index 00000000000..7c834c02b1e --- /dev/null +++ b/queue-4.19/arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch @@ -0,0 +1,60 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Will Deacon +Date: Tue, 7 Aug 2018 13:43:06 +0100 +Subject: arm64: entry: Allow handling of undefined instructions from EL1 + +From: Will Deacon + +[ Upstream commit 0bf0f444b2c49241b2b39aa3cf210d7c95ef6c34 ] + +Rather than panic() when taking an undefined instruction exception from +EL1, allow a hook to be registered in case we want to emulate the +instruction, like we will for the SSBS PSTATE manipulation instructions. + +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/entry.S | 2 +- + arch/arm64/kernel/traps.c | 11 +++++++---- + 2 files changed, 8 insertions(+), 5 deletions(-) + +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -589,7 +589,7 @@ el1_undef: + inherit_daif pstate=x23, tmp=x2 + mov x0, sp + bl do_undefinstr +- ASM_BUG() ++ kernel_exit 1 + el1_dbg: + /* + * Debug exception handling +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -310,10 +310,12 @@ static int call_undef_hook(struct pt_reg + int (*fn)(struct pt_regs *regs, u32 instr) = NULL; + void __user *pc = (void __user *)instruction_pointer(regs); + +- if (!user_mode(regs)) +- return 1; +- +- if (compat_thumb_mode(regs)) { ++ if (!user_mode(regs)) { ++ __le32 instr_le; ++ if (probe_kernel_address((__force __le32 *)pc, instr_le)) ++ goto exit; ++ instr = le32_to_cpu(instr_le); ++ } else if (compat_thumb_mode(regs)) { + /* 16-bit Thumb instruction */ + __le16 instr_le; + if (get_user(instr_le, (__le16 __user *)pc)) +@@ -407,6 +409,7 @@ asmlinkage void __exception do_undefinst + return; + + force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc); ++ BUG_ON(!user_mode(regs)); + } + + void cpu_enable_cache_maint_trap(const struct arm64_cpu_capabilities *__unused) diff --git a/queue-4.19/asoc-amd-fix-capture-unstable-in-beginning-for-some-runs.patch b/queue-4.19/asoc-amd-fix-capture-unstable-in-beginning-for-some-runs.patch new file mode 100644 index 00000000000..332f5b9247b --- /dev/null +++ b/queue-4.19/asoc-amd-fix-capture-unstable-in-beginning-for-some-runs.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Akshu Agrawal +Date: Tue, 18 Sep 2018 12:53:13 +0530 +Subject: ASoC: AMD: Fix capture unstable in beginning for some runs + +From: Akshu Agrawal + +[ Upstream commit c50535ed6a10fcae1b64ae83c0f6b1eeb5535afc ] + +alsa_conformance_test -C hw:0,4 -p 1024 --debug +would sometime show: +TIME_DIFF(s) HW_LEVEL READ RATE +0.000095970 1024 1024 10670001.041992 +0.042609555 1024 2048 24032.168372 +0.021330364 1024 3072 48006.681930 +0.021339559 1024 4096 47985.996337 +The issue is that in dma pointer function we can have stale value +of the register for current descriptor of channel. +The register retains the number of the last descriptor that +was transferred. + +Fix ensures that we report position, 0, till the one period worth of +data is transferred. After one period of data, in handler of period +completion interrupt we update the config and correct value of descriptor +starts reflecting. + +Signed-off-by: Akshu Agrawal +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/amd/acp-pcm-dma.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/sound/soc/amd/acp-pcm-dma.c ++++ b/sound/soc/amd/acp-pcm-dma.c +@@ -1036,16 +1036,22 @@ static snd_pcm_uframes_t acp_dma_pointer + + if (substream->stream == SNDRV_PCM_STREAM_CAPTURE) { + period_bytes = frames_to_bytes(runtime, runtime->period_size); +- dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr); +- if (dscr == rtd->dma_dscr_idx_1) +- pos = period_bytes; +- else +- pos = 0; + bytescount = acp_get_byte_count(rtd); +- if (bytescount > rtd->bytescount) ++ if (bytescount >= rtd->bytescount) + bytescount -= rtd->bytescount; +- delay = do_div(bytescount, period_bytes); +- runtime->delay = bytes_to_frames(runtime, delay); ++ if (bytescount < period_bytes) { ++ pos = 0; ++ } else { ++ dscr = acp_reg_read(rtd->acp_mmio, rtd->dma_curr_dscr); ++ if (dscr == rtd->dma_dscr_idx_1) ++ pos = period_bytes; ++ else ++ pos = 0; ++ } ++ if (bytescount > 0) { ++ delay = do_div(bytescount, period_bytes); ++ runtime->delay = bytes_to_frames(runtime, delay); ++ } + } else { + buffersize = frames_to_bytes(runtime, runtime->buffer_size); + bytescount = acp_get_byte_count(rtd); diff --git a/queue-4.19/ataflop-fix-error-handling-during-setup.patch b/queue-4.19/ataflop-fix-error-handling-during-setup.patch new file mode 100644 index 00000000000..81d1d78335e --- /dev/null +++ b/queue-4.19/ataflop-fix-error-handling-during-setup.patch @@ -0,0 +1,73 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Omar Sandoval +Date: Thu, 11 Oct 2018 12:20:49 -0700 +Subject: ataflop: fix error handling during setup + +From: Omar Sandoval + +[ Upstream commit 71327f547ee3a46ec5c39fdbbd268401b2578d0e ] + +Move queue allocation next to disk allocation to fix a couple of issues: + +- If add_disk() hasn't been called, we should clear disk->queue before + calling put_disk(). +- If we fail to allocate a request queue, we still need to put all of + the disks, not just the ones that we allocated queues for. + +Signed-off-by: Omar Sandoval +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/ataflop.c | 25 +++++++++++++++---------- + 1 file changed, 15 insertions(+), 10 deletions(-) + +--- a/drivers/block/ataflop.c ++++ b/drivers/block/ataflop.c +@@ -1935,6 +1935,11 @@ static int __init atari_floppy_init (voi + unit[i].disk = alloc_disk(1); + if (!unit[i].disk) + goto Enomem; ++ ++ unit[i].disk->queue = blk_init_queue(do_fd_request, ++ &ataflop_lock); ++ if (!unit[i].disk->queue) ++ goto Enomem; + } + + if (UseTrackbuffer < 0) +@@ -1966,10 +1971,6 @@ static int __init atari_floppy_init (voi + sprintf(unit[i].disk->disk_name, "fd%d", i); + unit[i].disk->fops = &floppy_fops; + unit[i].disk->private_data = &unit[i]; +- unit[i].disk->queue = blk_init_queue(do_fd_request, +- &ataflop_lock); +- if (!unit[i].disk->queue) +- goto Enomem; + set_capacity(unit[i].disk, MAX_DISK_SIZE * 2); + add_disk(unit[i].disk); + } +@@ -1984,13 +1985,17 @@ static int __init atari_floppy_init (voi + + return 0; + Enomem: +- while (i--) { +- struct request_queue *q = unit[i].disk->queue; ++ do { ++ struct gendisk *disk = unit[i].disk; + +- put_disk(unit[i].disk); +- if (q) +- blk_cleanup_queue(q); +- } ++ if (disk) { ++ if (disk->queue) { ++ blk_cleanup_queue(disk->queue); ++ disk->queue = NULL; ++ } ++ put_disk(unit[i].disk); ++ } ++ } while (i--); + + unregister_blkdev(FLOPPY_MAJOR, "fd"); + return -ENOMEM; diff --git a/queue-4.19/ath10k-fix-tx-status-flag-setting-for-management-frames.patch b/queue-4.19/ath10k-fix-tx-status-flag-setting-for-management-frames.patch new file mode 100644 index 00000000000..090987530f6 --- /dev/null +++ b/queue-4.19/ath10k-fix-tx-status-flag-setting-for-management-frames.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Rakesh Pillai +Date: Thu, 6 Sep 2018 18:57:27 +0530 +Subject: ath10k: fix tx status flag setting for management frames + +From: Rakesh Pillai + +[ Upstream commit 058a7eab9d9ee12f57282eb0b606668dada70d7a ] + +The tx_status for management frames is being filled +incorrectly in the flags of skb_cb. This incorrect +flag setting causes the upper layers to consider that +the particular frame was not transmitted properly, +leading to improper behavior. + +Set the IEEE80211_TX_STAT_ACK flag in the info flags +of skb_cb, to indicate the successful transmission of +the management frame. + +Tested HW: WCN3990 +Tested FW: WLAN.HL.2.0-01188-QCAHLSWMTPLZ-1 + +Fixes: dc405152bb64d4ae01c9ac669de25b2d1fb6fc2d +Signed-off-by: Rakesh Pillai +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -2336,7 +2336,12 @@ static int wmi_process_mgmt_tx_comp(stru + dma_unmap_single(ar->dev, pkt_addr->paddr, + msdu->len, DMA_FROM_DEVICE); + info = IEEE80211_SKB_CB(msdu); +- info->flags |= status; ++ ++ if (status) ++ info->flags &= ~IEEE80211_TX_STAT_ACK; ++ else ++ info->flags |= IEEE80211_TX_STAT_ACK; ++ + ieee80211_tx_status_irqsafe(ar->hw, msdu); + + ret = 0; diff --git a/queue-4.19/ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch b/queue-4.19/ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch new file mode 100644 index 00000000000..ce6aef0f88e --- /dev/null +++ b/queue-4.19/ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Martin Willi +Date: Wed, 22 Aug 2018 09:39:52 +0200 +Subject: ath10k: schedule hardware restart if WMI command times out + +From: Martin Willi + +[ Upstream commit a9911937e7d332761e8c4fcbc7ba0426bdc3956f ] + +When running in AP mode, ath10k sometimes suffers from TX credit +starvation. The issue is hard to reproduce and shows up once in a +few days, but has been repeatedly seen with QCA9882 and a large +range of firmwares, including 10.2.4.70.67. + +Once the module is in this state, TX credits are never replenished, +which results in "SWBA overrun" errors, as no beacons can be sent. +Even worse, WMI commands run in a timeout while holding the conf +mutex for three seconds each, making any further operations slow +and the whole system unresponsive. + +The firmware/driver never recovers from that state automatically, +and triggering TX flush or warm restarts won't work over WMI. So +issue a hardware restart if a WMI command times out due to missing +TX credits. This implies a connectivity outage of about 1.4s in AP +mode, but brings back the interface and the whole system to a usable +state. WMI command timeouts have not been seen in absent of this +specific issue, so taking such drastic actions seems legitimate. + +Signed-off-by: Martin Willi +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -1869,6 +1869,12 @@ int ath10k_wmi_cmd_send(struct ath10k *a + if (ret) + dev_kfree_skb_any(skb); + ++ if (ret == -EAGAIN) { ++ ath10k_warn(ar, "wmi command %d timeout, restarting hardware\n", ++ cmd_id); ++ queue_work(ar->workqueue, &ar->restart_work); ++ } ++ + return ret; + } + diff --git a/queue-4.19/bcache-populate-writeback_rate_minimum-attribute.patch b/queue-4.19/bcache-populate-writeback_rate_minimum-attribute.patch new file mode 100644 index 00000000000..0ddd43d1783 --- /dev/null +++ b/queue-4.19/bcache-populate-writeback_rate_minimum-attribute.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Ben Peddell +Date: Mon, 8 Oct 2018 20:41:13 +0800 +Subject: bcache: Populate writeback_rate_minimum attribute + +From: Ben Peddell + +[ Upstream commit 7567c2a2ad9e80a2ce977eef535e64b61899633e ] + +Forgot to include the maintainers with my first email. + +Somewhere between Michael Lyle's original +"bcache: PI controller for writeback rate V2" patch dated 07 Sep 2017 +and 1d316e6 bcache: implement PI controller for writeback rate, +the mapping of the writeback_rate_minimum attribute was dropped. + +Re-add the missing sysfs writeback_rate_minimum attribute mapping to +"allow the user to specify a minimum rate at which dirty blocks are +retired." + +Fixes: 1d316e6 ("bcache: implement PI controller for writeback rate") +Signed-off-by: Ben Peddell +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/sysfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -285,6 +285,7 @@ STORE(__cached_dev) + 1, WRITEBACK_RATE_UPDATE_SECS_MAX); + d_strtoul(writeback_rate_i_term_inverse); + d_strtoul_nonzero(writeback_rate_p_term_inverse); ++ d_strtoul_nonzero(writeback_rate_minimum); + + sysfs_strtoul_clamp(io_error_limit, dc->error_limit, 0, INT_MAX); + +@@ -412,6 +413,7 @@ static struct attribute *bch_cached_dev_ + &sysfs_writeback_rate_update_seconds, + &sysfs_writeback_rate_i_term_inverse, + &sysfs_writeback_rate_p_term_inverse, ++ &sysfs_writeback_rate_minimum, + &sysfs_writeback_rate_debug, + &sysfs_errors, + &sysfs_io_error_limit, diff --git a/queue-4.19/block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch b/queue-4.19/block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch new file mode 100644 index 00000000000..05521b9d400 --- /dev/null +++ b/queue-4.19/block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch @@ -0,0 +1,71 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Paolo Valente +Date: Fri, 14 Sep 2018 16:23:07 +0200 +Subject: block, bfq: correctly charge and reset entity service in all cases + +From: Paolo Valente + +[ Upstream commit cbeb869a3d1110450186b738199963c5e68c2a71 ] + +BFQ schedules entities (which represent either per-process queues or +groups of queues) as a function of their timestamps. In particular, as +a function of their (virtual) finish times. The finish time of an +entity is computed as a function of the budget assigned to the entity, +assuming, tentatively, that the entity, once in service, will receive +an amount of service equal to its budget. Then, when the entity is +expired because it finishes to be served, this finish time is updated +as a function of the actual service received by the entity. This +allows the entity to be correctly charged with only the service +received, and then to be correctly re-scheduled. + +Yet an entity may receive service also while not being the entity in +service (in the scheduling environment of its parent entity), for +several reasons. If the entity remains with no backlog while receiving +this 'unofficial' service, then it is expired. Also on such an +expiration, the finish time of the entity should be updated to account +for only the service actually received by the entity. Unfortunately, +such an update is not performed for an entity expiring without being +the entity in service. + +In a similar vein, the service counter of the entity in service is +reset when the entity is expired, to be ready to be used for next +service cycle. This reset too should be performed also in case an +entity is expired because it remains empty after receiving service +while not being the entity in service. But in this case the reset is +not performed. + +This commit performs the above update of the finish time and reset of +the service received, also for an entity expiring while not being the +entity in service. + +Signed-off-by: Paolo Valente +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/bfq-wf2q.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/block/bfq-wf2q.c ++++ b/block/bfq-wf2q.c +@@ -1181,10 +1181,17 @@ bool __bfq_deactivate_entity(struct bfq_ + st = bfq_entity_service_tree(entity); + is_in_service = entity == sd->in_service_entity; + +- if (is_in_service) { +- bfq_calc_finish(entity, entity->service); ++ bfq_calc_finish(entity, entity->service); ++ ++ if (is_in_service) + sd->in_service_entity = NULL; +- } ++ else ++ /* ++ * Non in-service entity: nobody will take care of ++ * resetting its service counter on expiration. Do it ++ * now. ++ */ ++ entity->service = 0; + + if (entity->tree == &st->active) + bfq_active_extract(st, entity); diff --git a/queue-4.19/bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch b/queue-4.19/bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch new file mode 100644 index 00000000000..11595c03e9b --- /dev/null +++ b/queue-4.19/bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch @@ -0,0 +1,61 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Christian Hewitt +Date: Tue, 4 Sep 2018 21:50:57 +0400 +Subject: Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth + +From: Christian Hewitt + +[ Upstream commit a357ea098c9605f60d92a66a9073f56ce25726da ] + +This patch adds the device ID for the AMPAK AP6335 combo module used +in the 1st generation WeTek Hub Android/LibreELEC HTPC box. The WiFI +chip identifies itself as BCM4339, while Bluetooth identifies itself +as BCM4335 (rev C0): + +``` +[ 4.864248] Bluetooth: hci0: BCM: chip id 86 +[ 4.866388] Bluetooth: hci0: BCM: features 0x2f +[ 4.889317] Bluetooth: hci0: BCM4335C0 +[ 4.889332] Bluetooth: hci0: BCM4335C0 (003.001.009) build 0000 +[ 9.778383] Bluetooth: hci0: BCM4335C0 (003.001.009) build 0268 +``` + +Output from hciconfig: + +``` +hci0: Type: Primary Bus: UART + BD Address: 43:39:00:00:1F:AC ACL MTU: 1021:8 SCO MTU: 64:1 + UP RUNNING + RX bytes:7567 acl:234 sco:0 events:386 errors:0 + TX bytes:53844 acl:77 sco:0 commands:304 errors:0 + Features: 0xbf 0xfe 0xcf 0xfe 0xdb 0xff 0x7b 0x87 + Packet type: DM1 DM3 DM5 DH1 DH3 DH5 HV1 HV2 HV3 + Link policy: RSWITCH SNIFF + Link mode: SLAVE ACCEPT + Name: 'HUB' + Class: 0x0c0000 + Service Classes: Rendering, Capturing + Device Class: Miscellaneous, + HCI Version: 4.0 (0x6) Revision: 0x10c + LMP Version: 4.0 (0x6) Subversion: 0x6109 + Manufacturer: Broadcom Corporation (15) +``` + +Signed-off-by: Christian Hewitt +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btbcm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/btbcm.c ++++ b/drivers/bluetooth/btbcm.c +@@ -324,6 +324,7 @@ static const struct bcm_subver_table bcm + { 0x4103, "BCM4330B1" }, /* 002.001.003 */ + { 0x410e, "BCM43341B0" }, /* 002.001.014 */ + { 0x4406, "BCM4324B3" }, /* 002.004.006 */ ++ { 0x6109, "BCM4335C0" }, /* 003.001.009 */ + { 0x610c, "BCM4354" }, /* 003.001.012 */ + { 0x2122, "BCM4343A0" }, /* 001.001.034 */ + { 0x2209, "BCM43430A1" }, /* 001.002.009 */ diff --git a/queue-4.19/bluetooth-hci_qca-remove-hdev-dereference-in-qca_close.patch b/queue-4.19/bluetooth-hci_qca-remove-hdev-dereference-in-qca_close.patch new file mode 100644 index 00000000000..745e0dc32ce --- /dev/null +++ b/queue-4.19/bluetooth-hci_qca-remove-hdev-dereference-in-qca_close.patch @@ -0,0 +1,99 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Balakrishna Godavarthi +Date: Wed, 22 Aug 2018 17:50:05 +0530 +Subject: Bluetooth: hci_qca: Remove hdev dereference in qca_close(). + +From: Balakrishna Godavarthi + +[ Upstream commit c2d7827338618a9e73a3f892ca63d9082bb7a94d ] + +When flag KASAN is set, we are seeing an following crash while removing +hci_uart module. + +[ 50.589909] Unable to handle kernel paging request at virtual address 6b6b6b6b6b6b73 +[ 50.597902] Mem abort info: +[ 50.600846] Exception class = DABT (current EL), IL = 32 bits +[ 50.606959] SET = 0, FnV = 0 +[ 50.610142] EA = 0, S1PTW = 0 +[ 50.613396] Data abort info: +[ 50.616401] ISV = 0, ISS = 0x00000004 +[ 50.620373] CM = 0, WnR = 0 +[ 50.623466] [006b6b6b6b6b6b73] address between user and kernel address ranges +[ 50.630818] Internal error: Oops: 96000004 [#1] PREEMPT SMP + +[ 50.671670] PC is at qca_power_shutdown+0x28/0x100 [hci_uart] +[ 50.677593] LR is at qca_close+0x74/0xb0 [hci_uart] +[ 50.775689] Process rmmod (pid: 2144, stack limit = 0xffffff801ba90000) +[ 50.782493] Call trace: + +[ 50.872150] [] qca_power_shutdown+0x28/0x100 [hci_uart] +[ 50.879138] [] qca_close+0x74/0xb0 [hci_uart] +[ 50.885238] [] hci_uart_unregister_device+0x44/0x50 [hci_uart] +[ 50.892846] [] qca_serdev_remove+0x50/0x5c [hci_uart] +[ 50.899654] [] serdev_drv_remove+0x28/0x38 +[ 50.905489] [] device_release_driver_internal+0x140/0x1e4 +[ 50.912653] [] driver_detach+0x78/0x84 +[ 50.918121] [] bus_remove_driver+0x80/0xa8 +[ 50.923942] [] driver_unregister+0x4c/0x58 +[ 50.929768] [] qca_deinit+0x24/0x598 [hci_uart] +[ 50.936045] [] hci_uart_exit+0x10/0x48 [hci_uart] +[ 50.942495] [] SyS_delete_module+0x17c/0x224 + +This crash is due to dereference of hdev, after freeing it. + +Signed-off-by: Balakrishna Godavarthi +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/hci_qca.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -167,7 +167,7 @@ struct qca_serdev { + }; + + static int qca_power_setup(struct hci_uart *hu, bool on); +-static void qca_power_shutdown(struct hci_dev *hdev); ++static void qca_power_shutdown(struct hci_uart *hu); + + static void __serial_clock_on(struct tty_struct *tty) + { +@@ -609,7 +609,7 @@ static int qca_close(struct hci_uart *hu + if (hu->serdev) { + qcadev = serdev_device_get_drvdata(hu->serdev); + if (qcadev->btsoc_type == QCA_WCN3990) +- qca_power_shutdown(hu->hdev); ++ qca_power_shutdown(hu); + else + gpiod_set_value_cansleep(qcadev->bt_en, 0); + +@@ -1232,12 +1232,15 @@ static const struct qca_vreg_data qca_so + .num_vregs = 4, + }; + +-static void qca_power_shutdown(struct hci_dev *hdev) ++static void qca_power_shutdown(struct hci_uart *hu) + { +- struct hci_uart *hu = hci_get_drvdata(hdev); ++ struct serdev_device *serdev = hu->serdev; ++ unsigned char cmd = QCA_WCN3990_POWEROFF_PULSE; + + host_set_baudrate(hu, 2400); +- qca_send_power_pulse(hdev, QCA_WCN3990_POWEROFF_PULSE); ++ hci_uart_set_flow_control(hu, true); ++ serdev_device_write_buf(serdev, &cmd, sizeof(cmd)); ++ hci_uart_set_flow_control(hu, false); + qca_power_setup(hu, false); + } + +@@ -1413,7 +1416,7 @@ static void qca_serdev_remove(struct ser + struct qca_serdev *qcadev = serdev_device_get_drvdata(serdev); + + if (qcadev->btsoc_type == QCA_WCN3990) +- qca_power_shutdown(qcadev->serdev_hu.hdev); ++ qca_power_shutdown(&qcadev->serdev_hu); + else + clk_disable_unprepare(qcadev->susclk); + diff --git a/queue-4.19/bpf-verifier-fix-verifier-instability.patch b/queue-4.19/bpf-verifier-fix-verifier-instability.patch new file mode 100644 index 00000000000..df307a910f9 --- /dev/null +++ b/queue-4.19/bpf-verifier-fix-verifier-instability.patch @@ -0,0 +1,85 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Alexei Starovoitov +Date: Tue, 4 Sep 2018 19:13:44 -0700 +Subject: bpf/verifier: fix verifier instability + +From: Alexei Starovoitov + +[ Upstream commit a9c676bc8fc58d00eea9836fb14ee43c0346416a ] + +Edward Cree says: +In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access() +has supplied a reg_type, the other members of the register state are set +appropriately. Previously reg.range was set to 0, but as it is in a +union with reg.map_ptr, which is larger, upper bytes of the latter were +left in place. This then caused the memcmp() in regsafe() to fail, +preventing some branches from being pruned (and occasionally causing the +same program to take a varying number of processed insns on repeated +verifier runs). + +Fix the instability by clearing bpf_reg_state in __mark_reg_[un]known() + +Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") +Debugged-by: Edward Cree +Acked-by: Edward Cree +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -553,7 +553,9 @@ static void __mark_reg_not_init(struct b + */ + static void __mark_reg_known(struct bpf_reg_state *reg, u64 imm) + { +- reg->id = 0; ++ /* Clear id, off, and union(map_ptr, range) */ ++ memset(((u8 *)reg) + sizeof(reg->type), 0, ++ offsetof(struct bpf_reg_state, var_off) - sizeof(reg->type)); + reg->var_off = tnum_const(imm); + reg->smin_value = (s64)imm; + reg->smax_value = (s64)imm; +@@ -572,7 +574,6 @@ static void __mark_reg_known_zero(struct + static void __mark_reg_const_zero(struct bpf_reg_state *reg) + { + __mark_reg_known(reg, 0); +- reg->off = 0; + reg->type = SCALAR_VALUE; + } + +@@ -683,9 +684,12 @@ static void __mark_reg_unbounded(struct + /* Mark a register as having a completely unknown (scalar) value. */ + static void __mark_reg_unknown(struct bpf_reg_state *reg) + { ++ /* ++ * Clear type, id, off, and union(map_ptr, range) and ++ * padding between 'type' and union ++ */ ++ memset(reg, 0, offsetof(struct bpf_reg_state, var_off)); + reg->type = SCALAR_VALUE; +- reg->id = 0; +- reg->off = 0; + reg->var_off = tnum_unknown; + reg->frameno = 0; + __mark_reg_unbounded(reg); +@@ -1727,9 +1731,6 @@ static int check_mem_access(struct bpf_v + else + mark_reg_known_zero(env, regs, + value_regno); +- regs[value_regno].id = 0; +- regs[value_regno].off = 0; +- regs[value_regno].range = 0; + regs[value_regno].type = reg_type; + } + +@@ -2580,7 +2581,6 @@ static int check_helper_call(struct bpf_ + regs[BPF_REG_0].type = PTR_TO_MAP_VALUE_OR_NULL; + /* There is no offset yet applied, variable or fixed */ + mark_reg_known_zero(env, regs, BPF_REG_0); +- regs[BPF_REG_0].off = 0; + /* remember map_ptr, so that check_map_access() + * can check 'value_size' boundary of memory access + * to map element returned from bpf_map_lookup_elem() diff --git a/queue-4.19/brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch b/queue-4.19/brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch new file mode 100644 index 00000000000..f6ef75de597 --- /dev/null +++ b/queue-4.19/brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch @@ -0,0 +1,125 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Arend van Spriel +Date: Wed, 5 Sep 2018 09:48:58 +0200 +Subject: brcmfmac: fix for proper support of 160MHz bandwidth + +From: Arend van Spriel + +[ Upstream commit 330994e8e8ec5d0b269a5265e6032b37e29aa336 ] + +Decoding of firmware channel information was not complete for 160MHz +support. This resulted in the following warning: + + WARNING: CPU: 2 PID: 2222 at .../broadcom/brcm80211/brcmutil/d11.c:196 + brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil] + Modules linked in: brcmfmac(O) brcmutil(O) sha256_generic cfg80211 ... + CPU: 2 PID: 2222 Comm: kworker/2:0 Tainted: G O + 4.17.0-wt-testing-x64-00002-gf1bed50 #1 + Hardware name: Dell Inc. Latitude E6410/07XJP9, BIOS A07 02/15/2011 + Workqueue: events request_firmware_work_func + RIP: 0010:brcmu_d11ac_decchspec+0x2e/0x100 [brcmutil] + RSP: 0018:ffffc90000047bd0 EFLAGS: 00010206 + RAX: 000000000000e832 RBX: ffff8801146fe910 RCX: ffff8801146fd3c0 + RDX: 0000000000002800 RSI: 0000000000000070 RDI: ffffc90000047c30 + RBP: ffffc90000047bd0 R08: 0000000000000000 R09: ffffffffa0798c80 + R10: ffff88012bca55e0 R11: ffff880110a4ea00 R12: ffff8801146f8000 + R13: ffffc90000047c30 R14: ffff8801146fe930 R15: ffff8801138e02e0 + FS: 0000000000000000(0000) GS:ffff88012bc80000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f18ce8b8070 CR3: 000000000200a003 CR4: 00000000000206e0 + Call Trace: + brcmf_setup_wiphybands+0x212/0x780 [brcmfmac] + brcmf_cfg80211_attach+0xae2/0x11a0 [brcmfmac] + brcmf_attach+0x1fc/0x4b0 [brcmfmac] + ? __kmalloc+0x13c/0x1c0 + brcmf_pcie_setup+0x99b/0xe00 [brcmfmac] + brcmf_fw_request_done+0x16a/0x1f0 [brcmfmac] + request_firmware_work_func+0x36/0x60 + process_one_work+0x146/0x350 + worker_thread+0x4a/0x3b0 + kthread+0x102/0x140 + ? process_one_work+0x350/0x350 + ? kthread_bind+0x20/0x20 + ret_from_fork+0x35/0x40 + Code: 66 90 0f b7 07 55 48 89 e5 89 c2 88 47 02 88 47 03 66 81 e2 00 38 + 66 81 fa 00 18 74 6e 66 81 fa 00 20 74 39 66 81 fa 00 10 74 14 <0f> + 0b 66 25 00 c0 74 20 66 3d 00 c0 75 20 c6 47 04 01 5d c3 66 + ---[ end trace 550c46682415b26d ]--- + brcmfmac: brcmf_construct_chaninfo: Ignoring unexpected firmware channel 50 + +This patch adds the missing stuff to properly handle this. + +Reviewed-by: Hante Meuleman +Reviewed-by: Pieter-Paul Giesberts +Reviewed-by: Franky Lin +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 34 ++++++++++- + drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h | 2 + 2 files changed, 35 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c +@@ -77,6 +77,8 @@ static u16 d11ac_bw(enum brcmu_chan_bw b + return BRCMU_CHSPEC_D11AC_BW_40; + case BRCMU_CHAN_BW_80: + return BRCMU_CHSPEC_D11AC_BW_80; ++ case BRCMU_CHAN_BW_160: ++ return BRCMU_CHSPEC_D11AC_BW_160; + default: + WARN_ON(1); + } +@@ -190,8 +192,38 @@ static void brcmu_d11ac_decchspec(struct + break; + } + break; +- case BRCMU_CHSPEC_D11AC_BW_8080: + case BRCMU_CHSPEC_D11AC_BW_160: ++ switch (ch->sb) { ++ case BRCMU_CHAN_SB_LLL: ++ ch->control_ch_num -= CH_70MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_LLU: ++ ch->control_ch_num -= CH_50MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_LUL: ++ ch->control_ch_num -= CH_30MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_LUU: ++ ch->control_ch_num -= CH_10MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_ULL: ++ ch->control_ch_num += CH_10MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_ULU: ++ ch->control_ch_num += CH_30MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_UUL: ++ ch->control_ch_num += CH_50MHZ_APART; ++ break; ++ case BRCMU_CHAN_SB_UUU: ++ ch->control_ch_num += CH_70MHZ_APART; ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ break; ++ } ++ break; ++ case BRCMU_CHSPEC_D11AC_BW_8080: + default: + WARN_ON_ONCE(1); + break; +--- a/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h ++++ b/drivers/net/wireless/broadcom/brcm80211/include/brcmu_wifi.h +@@ -29,6 +29,8 @@ + #define CH_UPPER_SB 0x01 + #define CH_LOWER_SB 0x02 + #define CH_EWA_VALID 0x04 ++#define CH_70MHZ_APART 14 ++#define CH_50MHZ_APART 10 + #define CH_30MHZ_APART 6 + #define CH_20MHZ_APART 4 + #define CH_10MHZ_APART 2 diff --git a/queue-4.19/cgroup-netclassid-add-a-preemption-point-to-write_classid.patch b/queue-4.19/cgroup-netclassid-add-a-preemption-point-to-write_classid.patch new file mode 100644 index 00000000000..594ab15693b --- /dev/null +++ b/queue-4.19/cgroup-netclassid-add-a-preemption-point-to-write_classid.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Michal Hocko +Date: Thu, 18 Oct 2018 10:56:17 +0200 +Subject: cgroup, netclassid: add a preemption point to write_classid + +From: Michal Hocko + +[ Upstream commit a90e90b7d55e789c71d85b946ffb5c1ab2f137ca ] + +We have seen a customer complaining about soft lockups on !PREEMPT +kernel config with 4.4 based kernel + +[1072141.435366] NMI watchdog: BUG: soft lockup - CPU#21 stuck for 22s! [systemd:1] +[1072141.444090] Modules linked in: mpt3sas raid_class binfmt_misc af_packet 8021q garp mrp stp llc xfs libcrc32c bonding iscsi_ibft iscsi_boot_sysfs msr ext4 crc16 jbd2 mbcache cdc_ether usbnet mii joydev hid_generic usbhid intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ipmi_ssif mgag200 i2c_algo_bit ttm ipmi_devintf drbg ixgbe drm_kms_helper vxlan ansi_cprng ip6_udp_tunnel drm aesni_intel udp_tunnel aes_x86_64 iTCO_wdt syscopyarea ptp xhci_pci lrw iTCO_vendor_support pps_core gf128mul ehci_pci glue_helper sysfillrect mdio pcspkr sb_edac ablk_helper cryptd ehci_hcd sysimgblt xhci_hcd fb_sys_fops edac_core mei_me lpc_ich ses usbcore enclosure dca mfd_core ipmi_si mei i2c_i801 scsi_transport_sas usb_common ipmi_msghandler shpchp fjes wmi processor button acpi_pad btrfs xor raid6_pq sd_mod crc32c_intel megaraid_sas sg dm_multipath dm_mod scsi_dh_rdac scsi_dh_emc scsi_dh_alua scsi_mod md_mod autofs4 +[1072141.444146] Supported: Yes +[1072141.444149] CPU: 21 PID: 1 Comm: systemd Not tainted 4.4.121-92.80-default #1 +[1072141.444150] Hardware name: LENOVO Lenovo System x3650 M5 -[5462P4U]- -[5462P4U]-/01GR451, BIOS -[TCE136H-2.70]- 06/13/2018 +[1072141.444151] task: ffff880191bd0040 ti: ffff880191bd4000 task.ti: ffff880191bd4000 +[1072141.444153] RIP: 0010:[] [] update_classid_sock+0x29/0x40 +[1072141.444157] RSP: 0018:ffff880191bd7d58 EFLAGS: 00000286 +[1072141.444158] RAX: ffff883b177cb7c0 RBX: 0000000000000000 RCX: 0000000000000000 +[1072141.444159] RDX: 00000000000009c7 RSI: ffff880191bd7d5c RDI: ffff8822e29bb200 +[1072141.444160] RBP: ffff883a72230980 R08: 0000000000000101 R09: 0000000000000000 +[1072141.444161] R10: 0000000000000008 R11: f000000000000000 R12: ffffffff815229d0 +[1072141.444162] R13: 0000000000000000 R14: ffff881fd0a47ac0 R15: ffff880191bd7f28 +[1072141.444163] FS: 00007f3e2f1eb8c0(0000) GS:ffff882000340000(0000) knlGS:0000000000000000 +[1072141.444164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[1072141.444165] CR2: 00007f3e2f200000 CR3: 0000001ffea4e000 CR4: 00000000001606f0 +[1072141.444166] Stack: +[1072141.444166] ffffffa800000246 00000000000009c7 ffffffff8121d583 ffff8818312a05c0 +[1072141.444168] ffff8818312a1100 ffff880197c3b280 ffff881861422858 ffffffffffffffea +[1072141.444170] ffffffff81522b1c ffffffff81d0ca20 ffff8817fa17b950 ffff883fdd8121e0 +[1072141.444171] Call Trace: +[1072141.444179] [] iterate_fd+0x53/0x80 +[1072141.444182] [] write_classid+0x4c/0x80 +[1072141.444187] [] cgroup_file_write+0x9b/0x100 +[1072141.444193] [] kernfs_fop_write+0x11b/0x150 +[1072141.444198] [] __vfs_write+0x26/0x100 +[1072141.444201] [] vfs_write+0x9d/0x190 +[1072141.444203] [] SyS_write+0x42/0xa0 +[1072141.444207] [] entry_SYSCALL_64_fastpath+0x1e/0xca +[1072141.445490] DWARF2 unwinder stuck at entry_SYSCALL_64_fastpath+0x1e/0xca + +If a cgroup has many tasks with many open file descriptors then we would +end up in a large loop without any rescheduling point throught the +operation. Add cond_resched once per task. + +Signed-off-by: Michal Hocko +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/core/netclassid_cgroup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/net/core/netclassid_cgroup.c ++++ b/net/core/netclassid_cgroup.c +@@ -106,6 +106,7 @@ static int write_classid(struct cgroup_s + iterate_fd(p->files, 0, update_classid_sock, + (void *)(unsigned long)cs->classid); + task_unlock(p); ++ cond_resched(); + } + css_task_iter_end(&it); + diff --git a/queue-4.19/cifs-fix-a-credits-leak-for-compund-commands.patch b/queue-4.19/cifs-fix-a-credits-leak-for-compund-commands.patch new file mode 100644 index 00000000000..ab80c3d3abf --- /dev/null +++ b/queue-4.19/cifs-fix-a-credits-leak-for-compund-commands.patch @@ -0,0 +1,125 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Ronnie Sahlberg +Date: Wed, 10 Oct 2018 15:29:06 +1000 +Subject: cifs: fix a credits leak for compund commands + +From: Ronnie Sahlberg + +[ Upstream commit cb5c2e63948451d38c977685fffc06e23beb4517 ] + +When processing the mids for compounds we would only add credits based on +the last successful mid in the compound which would leak credits and +eventually triggering a re-connect. + +Fix this by splitting the mid processing part into two loops instead of one +where the first loop just waits for all mids and then counts how many +credits we were granted for the whole compound. + +Signed-off-by: Ronnie Sahlberg +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/transport.c | 57 +++++++++++++++++++++++++++++++++------------------- + 1 file changed, 37 insertions(+), 20 deletions(-) + +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -786,7 +786,7 @@ compound_send_recv(const unsigned int xi + int i, j, rc = 0; + int timeout, optype; + struct mid_q_entry *midQ[MAX_COMPOUND]; +- unsigned int credits = 1; ++ unsigned int credits = 0; + char *buf; + + timeout = flags & CIFS_TIMEOUT_MASK; +@@ -851,17 +851,20 @@ compound_send_recv(const unsigned int xi + + mutex_unlock(&ses->server->srv_mutex); + +- for (i = 0; i < num_rqst; i++) { +- if (rc < 0) +- goto out; ++ if (rc < 0) ++ goto out; + +- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) +- smb311_update_preauth_hash(ses, rqst[i].rq_iov, +- rqst[i].rq_nvec); ++ /* ++ * Compounding is never used during session establish. ++ */ ++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) ++ smb311_update_preauth_hash(ses, rqst[0].rq_iov, ++ rqst[0].rq_nvec); + +- if (timeout == CIFS_ASYNC_OP) +- goto out; ++ if (timeout == CIFS_ASYNC_OP) ++ goto out; + ++ for (i = 0; i < num_rqst; i++) { + rc = wait_for_response(ses->server, midQ[i]); + if (rc != 0) { + cifs_dbg(FYI, "Cancelling wait for mid %llu\n", +@@ -877,10 +880,21 @@ compound_send_recv(const unsigned int xi + } + spin_unlock(&GlobalMid_Lock); + } ++ } ++ ++ for (i = 0; i < num_rqst; i++) ++ if (midQ[i]->resp_buf) ++ credits += ses->server->ops->get_credits(midQ[i]); ++ if (!credits) ++ credits = 1; ++ ++ for (i = 0; i < num_rqst; i++) { ++ if (rc < 0) ++ goto out; + + rc = cifs_sync_mid_result(midQ[i], ses->server); + if (rc != 0) { +- add_credits(ses->server, 1, optype); ++ add_credits(ses->server, credits, optype); + return rc; + } + +@@ -901,23 +915,26 @@ compound_send_recv(const unsigned int xi + else + resp_buf_type[i] = CIFS_SMALL_BUFFER; + +- if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) { +- struct kvec iov = { +- .iov_base = resp_iov[i].iov_base, +- .iov_len = resp_iov[i].iov_len +- }; +- smb311_update_preauth_hash(ses, &iov, 1); +- } +- +- credits = ses->server->ops->get_credits(midQ[i]); +- + rc = ses->server->ops->check_receive(midQ[i], ses->server, + flags & CIFS_LOG_ERROR); + + /* mark it so buf will not be freed by cifs_delete_mid */ + if ((flags & CIFS_NO_RESP) == 0) + midQ[i]->resp_buf = NULL; ++ ++ } ++ ++ /* ++ * Compounding is never used during session establish. ++ */ ++ if ((ses->status == CifsNew) || (optype & CIFS_NEG_OP)) { ++ struct kvec iov = { ++ .iov_base = resp_iov[0].iov_base, ++ .iov_len = resp_iov[0].iov_len ++ }; ++ smb311_update_preauth_hash(ses, &iov, 1); + } ++ + out: + /* + * This will dequeue all mids. After this it is important that the diff --git a/queue-4.19/coresight-etb10-fix-handling-of-perf-mode.patch b/queue-4.19/coresight-etb10-fix-handling-of-perf-mode.patch new file mode 100644 index 00000000000..bdb679a782a --- /dev/null +++ b/queue-4.19/coresight-etb10-fix-handling-of-perf-mode.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Suzuki K Poulose +Date: Thu, 20 Sep 2018 13:17:46 -0600 +Subject: coresight: etb10: Fix handling of perf mode + +From: Suzuki K Poulose + +[ Upstream commit 987d1e8dcd370d96029a3d76a0031b043c4a69ae ] + +If the ETB is already enabled in sysfs mode, the ETB reports +success even if a perf mode is requested. Fix this by checking +the requested mode. + +Cc: Mathieu Poirier +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight-etb10.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -147,6 +147,10 @@ static int etb_enable(struct coresight_d + if (val == CS_MODE_PERF) + return -EBUSY; + ++ /* Don't let perf disturb sysFS sessions */ ++ if (val == CS_MODE_SYSFS && mode == CS_MODE_PERF) ++ return -EBUSY; ++ + /* Nothing to do, the tracer is already enabled. */ + if (val == CS_MODE_SYSFS) + goto out; diff --git a/queue-4.19/cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch b/queue-4.19/cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch new file mode 100644 index 00000000000..bb49c6d1ea4 --- /dev/null +++ b/queue-4.19/cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch @@ -0,0 +1,111 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Viresh Kumar +Date: Wed, 3 Oct 2018 15:35:21 +0530 +Subject: cpufreq: dt: Try freeing static OPPs only if we have added them + +From: Viresh Kumar + +[ Upstream commit 51c99dd2c06b234575661fa1e0a1dea6c3ef566f ] + +We can not call dev_pm_opp_of_cpumask_remove_table() freely anymore +since the latest OPP core updates as that uses reference counting to +free resources. There are cases where no static OPPs are added (using +DT) for a platform and trying to remove the OPP table may end up +decrementing refcount which is already zero and hence generating +warnings. + +Lets track if we were able to add static OPPs or not and then only +remove the table based on that. Some reshuffling of code is also done to +do that. + +Reported-by: Niklas Cassel +Tested-by: Niklas Cassel +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cpufreq-dt.c | 34 +++++++++++++++++++--------------- + 1 file changed, 19 insertions(+), 15 deletions(-) + +--- a/drivers/cpufreq/cpufreq-dt.c ++++ b/drivers/cpufreq/cpufreq-dt.c +@@ -32,6 +32,7 @@ struct private_data { + struct device *cpu_dev; + struct thermal_cooling_device *cdev; + const char *reg_name; ++ bool have_static_opps; + }; + + static struct freq_attr *cpufreq_dt_attr[] = { +@@ -204,6 +205,15 @@ static int cpufreq_init(struct cpufreq_p + } + } + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) { ++ ret = -ENOMEM; ++ goto out_put_regulator; ++ } ++ ++ priv->reg_name = name; ++ priv->opp_table = opp_table; ++ + /* + * Initialize OPP tables for all policy->cpus. They will be shared by + * all CPUs which have marked their CPUs shared with OPP bindings. +@@ -214,7 +224,8 @@ static int cpufreq_init(struct cpufreq_p + * + * OPPs might be populated at runtime, don't check for error here + */ +- dev_pm_opp_of_cpumask_add_table(policy->cpus); ++ if (!dev_pm_opp_of_cpumask_add_table(policy->cpus)) ++ priv->have_static_opps = true; + + /* + * But we need OPP table to function so if it is not there let's +@@ -240,19 +251,10 @@ static int cpufreq_init(struct cpufreq_p + __func__, ret); + } + +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) { +- ret = -ENOMEM; +- goto out_free_opp; +- } +- +- priv->reg_name = name; +- priv->opp_table = opp_table; +- + ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table); + if (ret) { + dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret); +- goto out_free_priv; ++ goto out_free_opp; + } + + priv->cpu_dev = cpu_dev; +@@ -282,10 +284,11 @@ static int cpufreq_init(struct cpufreq_p + + out_free_cpufreq_table: + dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table); +-out_free_priv: +- kfree(priv); + out_free_opp: +- dev_pm_opp_of_cpumask_remove_table(policy->cpus); ++ if (priv->have_static_opps) ++ dev_pm_opp_of_cpumask_remove_table(policy->cpus); ++ kfree(priv); ++out_put_regulator: + if (name) + dev_pm_opp_put_regulators(opp_table); + out_put_clk: +@@ -300,7 +303,8 @@ static int cpufreq_exit(struct cpufreq_p + + cpufreq_cooling_unregister(priv->cdev); + dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &policy->freq_table); +- dev_pm_opp_of_cpumask_remove_table(policy->related_cpus); ++ if (priv->have_static_opps) ++ dev_pm_opp_of_cpumask_remove_table(policy->related_cpus); + if (priv->reg_name) + dev_pm_opp_put_regulators(priv->opp_table); + diff --git a/queue-4.19/cpupower-fix-amd-family-0x17-msr_pstate-size.patch b/queue-4.19/cpupower-fix-amd-family-0x17-msr_pstate-size.patch new file mode 100644 index 00000000000..80116558d65 --- /dev/null +++ b/queue-4.19/cpupower-fix-amd-family-0x17-msr_pstate-size.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Prarit Bhargava +Date: Mon, 8 Oct 2018 11:06:18 -0400 +Subject: cpupower: Fix AMD Family 0x17 msr_pstate size + +From: Prarit Bhargava + +[ Upstream commit 8c22e2f695920ebd94f9a53bcf2a65eb36d4dba1 ] + +The msr_pstate data is only 63 bits long and should be 64 bits. + +Add in the missing bit from res1 for AMD Family 0x17. + +Reference: https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0Fh.pdf, page 138. + +Signed-off-by: Prarit Bhargava +Cc: Shuah Khan +Cc: Stafford Horne +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/power/cpupower/utils/helpers/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/power/cpupower/utils/helpers/amd.c ++++ b/tools/power/cpupower/utils/helpers/amd.c +@@ -33,7 +33,7 @@ union msr_pstate { + unsigned vid:8; + unsigned iddval:8; + unsigned idddiv:2; +- unsigned res1:30; ++ unsigned res1:31; + unsigned en:1; + } fam17h_bits; + unsigned long long val; diff --git a/queue-4.19/cpupower-fix-coredump-on-vmware.patch b/queue-4.19/cpupower-fix-coredump-on-vmware.patch new file mode 100644 index 00000000000..484478f814e --- /dev/null +++ b/queue-4.19/cpupower-fix-coredump-on-vmware.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Prarit Bhargava +Date: Mon, 8 Oct 2018 11:06:19 -0400 +Subject: cpupower: Fix coredump on VMWare + +From: Prarit Bhargava + +[ Upstream commit f69ffc5d3db8f1f03fd6d1df5930f9a1fbd787b6 ] + +cpupower crashes on VMWare guests. The guests have the AMD PStateDef MSR +(0xC0010064 + state number) set to zero. As a result fid and did are zero +and the crash occurs because of a divide by zero (cof = fid/did). This +can be prevented by checking the enable bit in the PStateDef MSR before +calculating cof. By doing this the value of pstate[i] remains zero and +the value can be tested before displaying the active Pstates. + +Check the enable bit in the PstateDef register for all supported families +and only print out enabled Pstates. + +Signed-off-by: Prarit Bhargava +Cc: Shuah Khan +Cc: Stafford Horne +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/power/cpupower/utils/cpufreq-info.c | 2 ++ + tools/power/cpupower/utils/helpers/amd.c | 5 +++++ + 2 files changed, 7 insertions(+) + +--- a/tools/power/cpupower/utils/cpufreq-info.c ++++ b/tools/power/cpupower/utils/cpufreq-info.c +@@ -200,6 +200,8 @@ static int get_boost_mode(unsigned int c + printf(_(" Boost States: %d\n"), b_states); + printf(_(" Total States: %d\n"), pstate_no); + for (i = 0; i < pstate_no; i++) { ++ if (!pstates[i]) ++ continue; + if (i < b_states) + printf(_(" Pstate-Pb%d: %luMHz (boost state)" + "\n"), i, pstates[i]); +--- a/tools/power/cpupower/utils/helpers/amd.c ++++ b/tools/power/cpupower/utils/helpers/amd.c +@@ -119,6 +119,11 @@ int decode_pstates(unsigned int cpu, uns + } + if (read_msr(cpu, MSR_AMD_PSTATE + i, &pstate.val)) + return -1; ++ if ((cpu_family == 0x17) && (!pstate.fam17h_bits.en)) ++ continue; ++ else if (!pstate.bits.en) ++ continue; ++ + pstates[i] = get_cof(cpu_family, pstate); + } + *no = i; diff --git a/queue-4.19/crypto-caam-fix-implicit-casts-in-endianness-helpers.patch b/queue-4.19/crypto-caam-fix-implicit-casts-in-endianness-helpers.patch new file mode 100644 index 00000000000..b067724826f --- /dev/null +++ b/queue-4.19/crypto-caam-fix-implicit-casts-in-endianness-helpers.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: "Horia Geantă" +Date: Wed, 12 Sep 2018 11:59:30 +0300 +Subject: crypto: caam - fix implicit casts in endianness helpers + +From: "Horia Geantă" + +[ Upstream commit aae733a3f46f5ef338fbdde26e14cbb205a23de0 ] + +Fix the following sparse endianness warnings: + +drivers/crypto/caam/regs.h:95:1: sparse: incorrect type in return expression (different base types) @@ expected unsigned int @@ got restricted __le32unsigned int @@ +drivers/crypto/caam/regs.h:95:1: expected unsigned int +drivers/crypto/caam/regs.h:95:1: got restricted __le32 [usertype] +drivers/crypto/caam/regs.h:95:1: sparse: incorrect type in return expression (different base types) @@ expected unsigned int @@ got restricted __be32unsigned int @@ +drivers/crypto/caam/regs.h:95:1: expected unsigned int +drivers/crypto/caam/regs.h:95:1: got restricted __be32 [usertype] + +drivers/crypto/caam/regs.h:92:1: sparse: cast to restricted __le32 +drivers/crypto/caam/regs.h:92:1: sparse: cast to restricted __be32 + +Fixes: 261ea058f016 ("crypto: caam - handle core endianness != caam endianness") +Reported-by: kbuild test robot +Signed-off-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/caam/regs.h | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/drivers/crypto/caam/regs.h ++++ b/drivers/crypto/caam/regs.h +@@ -70,22 +70,22 @@ + extern bool caam_little_end; + extern bool caam_imx; + +-#define caam_to_cpu(len) \ +-static inline u##len caam##len ## _to_cpu(u##len val) \ +-{ \ +- if (caam_little_end) \ +- return le##len ## _to_cpu(val); \ +- else \ +- return be##len ## _to_cpu(val); \ ++#define caam_to_cpu(len) \ ++static inline u##len caam##len ## _to_cpu(u##len val) \ ++{ \ ++ if (caam_little_end) \ ++ return le##len ## _to_cpu((__force __le##len)val); \ ++ else \ ++ return be##len ## _to_cpu((__force __be##len)val); \ + } + +-#define cpu_to_caam(len) \ +-static inline u##len cpu_to_caam##len(u##len val) \ +-{ \ +- if (caam_little_end) \ +- return cpu_to_le##len(val); \ +- else \ +- return cpu_to_be##len(val); \ ++#define cpu_to_caam(len) \ ++static inline u##len cpu_to_caam##len(u##len val) \ ++{ \ ++ if (caam_little_end) \ ++ return (__force u##len)cpu_to_le##len(val); \ ++ else \ ++ return (__force u##len)cpu_to_be##len(val); \ + } + + caam_to_cpu(16) diff --git a/queue-4.19/dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch b/queue-4.19/dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch new file mode 100644 index 00000000000..b16a73c9777 --- /dev/null +++ b/queue-4.19/dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Paul Cercueil +Date: Wed, 29 Aug 2018 23:32:44 +0200 +Subject: dmaengine: dma-jz4780: Return error if not probed from DT + +From: Paul Cercueil + +[ Upstream commit 54f919a04cf221bc1601d1193682d4379dacacbd ] + +The driver calls clk_get() with the clock name set to NULL, which means +that the driver could only work when probed from devicetree. From now +on, we explicitly require the driver to be probed from devicetree. + +Signed-off-by: Paul Cercueil +Tested-by: Mathieu Malaterre +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/dma-jz4780.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/dma/dma-jz4780.c ++++ b/drivers/dma/dma-jz4780.c +@@ -761,6 +761,11 @@ static int jz4780_dma_probe(struct platf + struct resource *res; + int i, ret; + ++ if (!dev->of_node) { ++ dev_err(dev, "This driver must be probed from devicetree\n"); ++ return -EINVAL; ++ } ++ + jzdma = devm_kzalloc(dev, sizeof(*jzdma), GFP_KERNEL); + if (!jzdma) + return -ENOMEM; diff --git a/queue-4.19/driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch b/queue-4.19/driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch new file mode 100644 index 00000000000..b5a5990ee0e --- /dev/null +++ b/queue-4.19/driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch @@ -0,0 +1,87 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Waiman Long +Date: Fri, 14 Sep 2018 14:53:32 -0400 +Subject: driver/dma/ioat: Call del_timer_sync() without holding prep_lock + +From: Waiman Long + +[ Upstream commit cfb03be6c7e8a1591285849c361d67b09f5149f7 ] + +The following lockdep splat was observed: + +[ 1222.241750] ====================================================== +[ 1222.271301] WARNING: possible circular locking dependency detected +[ 1222.301060] 4.16.0-10.el8+5.x86_64+debug #1 Not tainted +[ 1222.326659] ------------------------------------------------------ +[ 1222.356565] systemd-shutdow/1 is trying to acquire lock: +[ 1222.382660] ((&ioat_chan->timer)){+.-.}, at: [<00000000f71e1a28>] del_timer_sync+0x5/0xf0 +[ 1222.422928] +[ 1222.422928] but task is already holding lock: +[ 1222.451743] (&(&ioat_chan->prep_lock)->rlock){+.-.}, at: [<000000008ea98b12>] ioat_shutdown+0x86/0x100 [ioatdma] + : +[ 1223.524987] Chain exists of: +[ 1223.524987] (&ioat_chan->timer) --> &(&ioat_chan->cleanup_lock)->rlock --> &(&ioat_chan->prep_lock)->rlock +[ 1223.524987] +[ 1223.594082] Possible unsafe locking scenario: +[ 1223.594082] +[ 1223.622630] CPU0 CPU1 +[ 1223.645080] ---- ---- +[ 1223.667404] lock(&(&ioat_chan->prep_lock)->rlock); +[ 1223.691535] lock(&(&ioat_chan->cleanup_lock)->rlock); +[ 1223.728657] lock(&(&ioat_chan->prep_lock)->rlock); +[ 1223.765122] lock((&ioat_chan->timer)); +[ 1223.784095] +[ 1223.784095] *** DEADLOCK *** +[ 1223.784095] +[ 1223.813492] 4 locks held by systemd-shutdow/1: +[ 1223.834677] #0: (reboot_mutex){+.+.}, at: [<0000000056d33456>] SYSC_reboot+0x10f/0x300 +[ 1223.873310] #1: (&dev->mutex){....}, at: [<00000000258dfdd7>] device_shutdown+0x1c8/0x660 +[ 1223.913604] #2: (&dev->mutex){....}, at: [<0000000068331147>] device_shutdown+0x1d6/0x660 +[ 1223.954000] #3: (&(&ioat_chan->prep_lock)->rlock){+.-.}, at: [<000000008ea98b12>] ioat_shutdown+0x86/0x100 [ioatdma] + +In the ioat_shutdown() function: + + spin_lock_bh(&ioat_chan->prep_lock); + set_bit(IOAT_CHAN_DOWN, &ioat_chan->state); + del_timer_sync(&ioat_chan->timer); + spin_unlock_bh(&ioat_chan->prep_lock); + +According to the synchronization rule for the del_timer_sync() function, +the caller must not hold locks which would prevent completion of the +timer's handler. + +The timer structure has its own lock that manages its synchronization. +Setting the IOAT_CHAN_DOWN bit should prevent other CPUs from +trying to use that device anyway, there is probably no need to call +del_timer_sync() while holding the prep_lock. So the del_timer_sync() +call is now moved outside of the prep_lock critical section to prevent +the circular lock dependency. + +Signed-off-by: Waiman Long +Reviewed-by: Dave Jiang +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma/ioat/init.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -1205,8 +1205,15 @@ static void ioat_shutdown(struct pci_dev + + spin_lock_bh(&ioat_chan->prep_lock); + set_bit(IOAT_CHAN_DOWN, &ioat_chan->state); +- del_timer_sync(&ioat_chan->timer); + spin_unlock_bh(&ioat_chan->prep_lock); ++ /* ++ * Synchronization rule for del_timer_sync(): ++ * - The caller must not hold locks which would prevent ++ * completion of the timer's handler. ++ * So prep_lock cannot be held before calling it. ++ */ ++ del_timer_sync(&ioat_chan->timer); ++ + /* this should quiesce then reset */ + ioat_reset_hw(ioat_chan); + } diff --git a/queue-4.19/drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch b/queue-4.19/drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch new file mode 100644 index 00000000000..0d4840c0def --- /dev/null +++ b/queue-4.19/drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Dexuan Cui +Date: Sun, 23 Sep 2018 21:10:44 +0000 +Subject: Drivers: hv: vmbus: Use cpumask_var_t for on-stack cpu mask + +From: Dexuan Cui + +[ Upstream commit 25355252607ca288f329ee033f387764883393f6 ] + +A cpumask structure on the stack can cause a warning with +CONFIG_NR_CPUS=8192 (e.g. Ubuntu 16.04 and 18.04 use this): + +drivers/hv//channel_mgmt.c: In function ‘init_vp_index’: +drivers/hv//channel_mgmt.c:702:1: warning: the frame size of 1032 bytes + is larger than 1024 bytes [-Wframe-larger-than=] + +Nowadays it looks most distros enable CONFIG_CPUMASK_OFFSTACK=y, and +hence we can work around the warning by using cpumask_var_t. + +Signed-off-by: Dexuan Cui +Cc: K. Y. Srinivasan +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hv/channel_mgmt.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -606,16 +606,18 @@ static void init_vp_index(struct vmbus_c + bool perf_chn = vmbus_devs[dev_type].perf_device; + struct vmbus_channel *primary = channel->primary_channel; + int next_node; +- struct cpumask available_mask; ++ cpumask_var_t available_mask; + struct cpumask *alloced_mask; + + if ((vmbus_proto_version == VERSION_WS2008) || +- (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) { ++ (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) || ++ !alloc_cpumask_var(&available_mask, GFP_KERNEL)) { + /* + * Prior to win8, all channel interrupts are + * delivered on cpu 0. + * Also if the channel is not a performance critical + * channel, bind it to cpu 0. ++ * In case alloc_cpumask_var() fails, bind it to cpu 0. + */ + channel->numa_node = 0; + channel->target_cpu = 0; +@@ -653,7 +655,7 @@ static void init_vp_index(struct vmbus_c + cpumask_clear(alloced_mask); + } + +- cpumask_xor(&available_mask, alloced_mask, ++ cpumask_xor(available_mask, alloced_mask, + cpumask_of_node(primary->numa_node)); + + cur_cpu = -1; +@@ -671,10 +673,10 @@ static void init_vp_index(struct vmbus_c + } + + while (true) { +- cur_cpu = cpumask_next(cur_cpu, &available_mask); ++ cur_cpu = cpumask_next(cur_cpu, available_mask); + if (cur_cpu >= nr_cpu_ids) { + cur_cpu = -1; +- cpumask_copy(&available_mask, ++ cpumask_copy(available_mask, + cpumask_of_node(primary->numa_node)); + continue; + } +@@ -704,6 +706,8 @@ static void init_vp_index(struct vmbus_c + + channel->target_cpu = cur_cpu; + channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu); ++ ++ free_cpumask_var(available_mask); + } + + static void vmbus_wait_for_unload(void) diff --git a/queue-4.19/efi-x86-call-efi_parse_options-from-efi_main.patch b/queue-4.19/efi-x86-call-efi_parse_options-from-efi_main.patch new file mode 100644 index 00000000000..6a3ae38dca7 --- /dev/null +++ b/queue-4.19/efi-x86-call-efi_parse_options-from-efi_main.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Hans de Goede +Date: Wed, 12 Sep 2018 20:32:05 +0200 +Subject: efi/x86: Call efi_parse_options() from efi_main() + +From: Hans de Goede + +[ Upstream commit c33ce984435bb6142792802d75513a71e55d1969 ] + +Before this commit we were only calling efi_parse_options() from +make_boot_params(), but make_boot_params() only gets called if the +kernel gets booted directly as an EFI executable. So when booted through +e.g. grub we ended up not parsing the commandline in the boot code. + +This makes the drivers/firmware/efi/libstub code ignore the "quiet" +commandline argument resulting in the following message being printed: +"EFI stub: UEFI Secure Boot is enabled." + +Despite the quiet request. This commits adds an extra call to +efi_parse_options() to efi_main() to make sure that the options are +always processed. This fixes quiet not working. + +This also fixes the libstub code ignoring nokaslr and efi=nochunk. + +Reported-by: Peter Robinson +Signed-off-by: Hans de Goede +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/compressed/eboot.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -738,6 +738,7 @@ efi_main(struct efi_config *c, struct bo + struct desc_struct *desc; + void *handle; + efi_system_table_t *_table; ++ unsigned long cmdline_paddr; + + efi_early = c; + +@@ -756,6 +757,15 @@ efi_main(struct efi_config *c, struct bo + setup_boot_services32(efi_early); + + /* ++ * make_boot_params() may have been called before efi_main(), in which ++ * case this is the second time we parse the cmdline. This is ok, ++ * parsing the cmdline multiple times does not have side-effects. ++ */ ++ cmdline_paddr = ((u64)hdr->cmd_line_ptr | ++ ((u64)boot_params->ext_cmd_line_ptr << 32)); ++ efi_parse_options((char *)cmdline_paddr); ++ ++ /* + * If the boot loader gave us a value for secure_boot then we use that, + * otherwise we ask the BIOS. + */ diff --git a/queue-4.19/ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch b/queue-4.19/ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch new file mode 100644 index 00000000000..d634ef10a08 --- /dev/null +++ b/queue-4.19/ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Theodore Ts'o +Date: Tue, 2 Oct 2018 01:34:44 -0400 +Subject: ext4: fix argument checking in EXT4_IOC_MOVE_EXT + +From: Theodore Ts'o + +[ Upstream commit f18b2b83a727a3db208308057d2c7945f368e625 ] + +If the starting block number of either the source or destination file +exceeds the EOF, EXT4_IOC_MOVE_EXT should return EINVAL. + +Also fixed the helper function mext_check_coverage() so that if the +logical block is beyond EOF, make it return immediately, instead of +looping until the block number wraps all the away around. This takes +long enough that if there are multiple threads trying to do pound on +an the same inode doing non-sensical things, it can end up triggering +the kernel's soft lockup detector. + +Reported-by: syzbot+c61979f6f2cba5cb3c06@syzkaller.appspotmail.com +Signed-off-by: Theodore Ts'o +Cc: stable@kernel.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/move_extent.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -516,9 +516,13 @@ mext_check_arguments(struct inode *orig_ + orig_inode->i_ino, donor_inode->i_ino); + return -EINVAL; + } +- if (orig_eof < orig_start + *len - 1) ++ if (orig_eof <= orig_start) ++ *len = 0; ++ else if (orig_eof < orig_start + *len - 1) + *len = orig_eof - orig_start; +- if (donor_eof < donor_start + *len - 1) ++ if (donor_eof <= donor_start) ++ *len = 0; ++ else if (donor_eof < donor_start + *len - 1) + *len = donor_eof - donor_start; + if (!*len) { + ext4_debug("ext4 move extent: len should not be 0 " diff --git a/queue-4.19/f2fs-avoid-sleeping-under-spin_lock.patch b/queue-4.19/f2fs-avoid-sleeping-under-spin_lock.patch new file mode 100644 index 00000000000..2488ae62e7b --- /dev/null +++ b/queue-4.19/f2fs-avoid-sleeping-under-spin_lock.patch @@ -0,0 +1,245 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Zhikang Zhang +Date: Mon, 10 Sep 2018 16:18:25 +0800 +Subject: f2fs: avoid sleeping under spin_lock + +From: Zhikang Zhang + +[ Upstream commit b430f7263673eab1dc40e662ae3441a9619d16b8 ] + +In the call trace below, we might sleep in function dput(). + +So in order to avoid sleeping under spin_lock, we remove f2fs_mark_inode_dirty_sync +from __try_update_largest_extent && __drop_largest_extent. + +BUG: sleeping function called from invalid context at fs/dcache.c:796 +Call trace: + dump_backtrace+0x0/0x3f4 + show_stack+0x24/0x30 + dump_stack+0xe0/0x138 + ___might_sleep+0x2a8/0x2c8 + __might_sleep+0x78/0x10c + dput+0x7c/0x750 + block_dump___mark_inode_dirty+0x120/0x17c + __mark_inode_dirty+0x344/0x11f0 + f2fs_mark_inode_dirty_sync+0x40/0x50 + __insert_extent_tree+0x2e0/0x2f4 + f2fs_update_extent_tree_range+0xcf4/0xde8 + f2fs_update_extent_cache+0x114/0x12c + f2fs_update_data_blkaddr+0x40/0x50 + write_data_page+0x150/0x314 + do_write_data_page+0x648/0x2318 + __write_data_page+0xdb4/0x1640 + f2fs_write_cache_pages+0x768/0xafc + __f2fs_write_data_pages+0x590/0x1218 + f2fs_write_data_pages+0x64/0x74 + do_writepages+0x74/0xe4 + __writeback_single_inode+0xdc/0x15f0 + writeback_sb_inodes+0x574/0xc98 + __writeback_inodes_wb+0x190/0x204 + wb_writeback+0x730/0xf14 + wb_check_old_data_flush+0x1bc/0x1c8 + wb_workfn+0x554/0xf74 + process_one_work+0x440/0x118c + worker_thread+0xac/0x974 + kthread+0x1a0/0x1c8 + ret_from_fork+0x10/0x1c + +Signed-off-by: Zhikang Zhang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/extent_cache.c | 51 ++++++++++++++++++++++++++++++------------------- + fs/f2fs/f2fs.h | 7 +++--- + 2 files changed, 36 insertions(+), 22 deletions(-) + +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -308,14 +308,13 @@ static unsigned int __free_extent_tree(s + return count - atomic_read(&et->node_cnt); + } + +-static void __drop_largest_extent(struct inode *inode, ++static void __drop_largest_extent(struct extent_tree *et, + pgoff_t fofs, unsigned int len) + { +- struct extent_info *largest = &F2FS_I(inode)->extent_tree->largest; +- +- if (fofs < largest->fofs + largest->len && fofs + len > largest->fofs) { +- largest->len = 0; +- f2fs_mark_inode_dirty_sync(inode, true); ++ if (fofs < et->largest.fofs + et->largest.len && ++ fofs + len > et->largest.fofs) { ++ et->largest.len = 0; ++ et->largest_updated = true; + } + } + +@@ -416,12 +415,11 @@ out: + return ret; + } + +-static struct extent_node *__try_merge_extent_node(struct inode *inode, ++static struct extent_node *__try_merge_extent_node(struct f2fs_sb_info *sbi, + struct extent_tree *et, struct extent_info *ei, + struct extent_node *prev_ex, + struct extent_node *next_ex) + { +- struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_node *en = NULL; + + if (prev_ex && __is_back_mergeable(ei, &prev_ex->ei)) { +@@ -443,7 +441,7 @@ static struct extent_node *__try_merge_e + if (!en) + return NULL; + +- __try_update_largest_extent(inode, et, en); ++ __try_update_largest_extent(et, en); + + spin_lock(&sbi->extent_lock); + if (!list_empty(&en->list)) { +@@ -454,12 +452,11 @@ static struct extent_node *__try_merge_e + return en; + } + +-static struct extent_node *__insert_extent_tree(struct inode *inode, ++static struct extent_node *__insert_extent_tree(struct f2fs_sb_info *sbi, + struct extent_tree *et, struct extent_info *ei, + struct rb_node **insert_p, + struct rb_node *insert_parent) + { +- struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct rb_node **p; + struct rb_node *parent = NULL; + struct extent_node *en = NULL; +@@ -476,7 +473,7 @@ do_insert: + if (!en) + return NULL; + +- __try_update_largest_extent(inode, et, en); ++ __try_update_largest_extent(et, en); + + /* update in global extent list */ + spin_lock(&sbi->extent_lock); +@@ -497,6 +494,7 @@ static void f2fs_update_extent_tree_rang + struct rb_node **insert_p = NULL, *insert_parent = NULL; + unsigned int end = fofs + len; + unsigned int pos = (unsigned int)fofs; ++ bool updated = false; + + if (!et) + return; +@@ -517,7 +515,7 @@ static void f2fs_update_extent_tree_rang + * drop largest extent before lookup, in case it's already + * been shrunk from extent tree + */ +- __drop_largest_extent(inode, fofs, len); ++ __drop_largest_extent(et, fofs, len); + + /* 1. lookup first extent node in range [fofs, fofs + len - 1] */ + en = (struct extent_node *)f2fs_lookup_rb_tree_ret(&et->root, +@@ -550,7 +548,7 @@ static void f2fs_update_extent_tree_rang + set_extent_info(&ei, end, + end - dei.fofs + dei.blk, + org_end - end); +- en1 = __insert_extent_tree(inode, et, &ei, ++ en1 = __insert_extent_tree(sbi, et, &ei, + NULL, NULL); + next_en = en1; + } else { +@@ -570,7 +568,7 @@ static void f2fs_update_extent_tree_rang + } + + if (parts) +- __try_update_largest_extent(inode, et, en); ++ __try_update_largest_extent(et, en); + else + __release_extent_node(sbi, et, en); + +@@ -590,15 +588,16 @@ static void f2fs_update_extent_tree_rang + if (blkaddr) { + + set_extent_info(&ei, fofs, blkaddr, len); +- if (!__try_merge_extent_node(inode, et, &ei, prev_en, next_en)) +- __insert_extent_tree(inode, et, &ei, ++ if (!__try_merge_extent_node(sbi, et, &ei, prev_en, next_en)) ++ __insert_extent_tree(sbi, et, &ei, + insert_p, insert_parent); + + /* give up extent_cache, if split and small updates happen */ + if (dei.len >= 1 && + prev.len < F2FS_MIN_EXTENT_LEN && + et->largest.len < F2FS_MIN_EXTENT_LEN) { +- __drop_largest_extent(inode, 0, UINT_MAX); ++ et->largest.len = 0; ++ et->largest_updated = true; + set_inode_flag(inode, FI_NO_EXTENT); + } + } +@@ -606,7 +605,15 @@ static void f2fs_update_extent_tree_rang + if (is_inode_flag_set(inode, FI_NO_EXTENT)) + __free_extent_tree(sbi, et); + ++ if (et->largest_updated) { ++ et->largest_updated = false; ++ updated = true; ++ } ++ + write_unlock(&et->lock); ++ ++ if (updated) ++ f2fs_mark_inode_dirty_sync(inode, true); + } + + unsigned int f2fs_shrink_extent_tree(struct f2fs_sb_info *sbi, int nr_shrink) +@@ -705,6 +712,7 @@ void f2fs_drop_extent_tree(struct inode + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et = F2FS_I(inode)->extent_tree; ++ bool updated = false; + + if (!f2fs_may_extent_tree(inode)) + return; +@@ -713,8 +721,13 @@ void f2fs_drop_extent_tree(struct inode + + write_lock(&et->lock); + __free_extent_tree(sbi, et); +- __drop_largest_extent(inode, 0, UINT_MAX); ++ if (et->largest.len) { ++ et->largest.len = 0; ++ updated = true; ++ } + write_unlock(&et->lock); ++ if (updated) ++ f2fs_mark_inode_dirty_sync(inode, true); + } + + void f2fs_destroy_extent_tree(struct inode *inode) +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -572,6 +572,7 @@ struct extent_tree { + struct list_head list; /* to be used by sbi->zombie_list */ + rwlock_t lock; /* protect extent info rb-tree */ + atomic_t node_cnt; /* # of extent node in rb-tree*/ ++ bool largest_updated; /* largest extent updated */ + }; + + /* +@@ -754,12 +755,12 @@ static inline bool __is_front_mergeable( + } + + extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync); +-static inline void __try_update_largest_extent(struct inode *inode, +- struct extent_tree *et, struct extent_node *en) ++static inline void __try_update_largest_extent(struct extent_tree *et, ++ struct extent_node *en) + { + if (en->ei.len > et->largest.len) { + et->largest = en->ei; +- f2fs_mark_inode_dirty_sync(inode, true); ++ et->largest_updated = true; + } + } + diff --git a/queue-4.19/f2fs-clear-pageerror-on-the-read-path.patch b/queue-4.19/f2fs-clear-pageerror-on-the-read-path.patch new file mode 100644 index 00000000000..d0589213439 --- /dev/null +++ b/queue-4.19/f2fs-clear-pageerror-on-the-read-path.patch @@ -0,0 +1,60 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Jaegeuk Kim +Date: Tue, 25 Sep 2018 13:54:33 -0700 +Subject: f2fs: clear PageError on the read path + +From: Jaegeuk Kim + +[ Upstream commit fb7d70db305a1446864227abf711b756568f8242 ] + +When running fault injection test, I hit somewhat wrong behavior in f2fs_gc -> +gc_data_segment(): + +0. fault injection generated some PageError'ed pages + +1. gc_data_segment + -> f2fs_get_read_data_page(REQ_RAHEAD) + +2. move_data_page + -> f2fs_get_lock_data_page() + -> f2f_get_read_data_page() + -> f2fs_submit_page_read() + -> submit_bio(READ) + -> return EIO due to PageError + -> fail to move data + +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -80,7 +80,8 @@ static void __read_end_io(struct bio *bi + /* PG_error was set if any post_read step failed */ + if (bio->bi_status || PageError(page)) { + ClearPageUptodate(page); +- SetPageError(page); ++ /* will re-read again later */ ++ ClearPageError(page); + } else { + SetPageUptodate(page); + } +@@ -590,6 +591,7 @@ static int f2fs_submit_page_read(struct + bio_put(bio); + return -EFAULT; + } ++ ClearPageError(page); + __submit_bio(F2FS_I_SB(inode), bio, DATA); + return 0; + } +@@ -1565,6 +1567,7 @@ submit_and_realloc: + if (bio_add_page(bio, page, blocksize, 0) < blocksize) + goto submit_and_realloc; + ++ ClearPageError(page); + last_block_in_bio = block_nr; + goto next_page; + set_error_page: diff --git a/queue-4.19/f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch b/queue-4.19/f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch new file mode 100644 index 00000000000..2bcf3736961 --- /dev/null +++ b/queue-4.19/f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Chao Yu +Date: Mon, 22 Oct 2018 23:24:28 +0800 +Subject: f2fs: fix to account IO correctly for cgroup writeback + +From: Chao Yu + +[ Upstream commit 78efac537de33faab9a4302cc05a70bb4a8b3b63 ] + +Now, we have supported cgroup writeback, it depends on correctly IO +account of specified filesystem. + +But in commit d1b3e72d5490 ("f2fs: submit bio of in-place-update pages"), +we split write paths from f2fs_submit_page_mbio() to two: +- f2fs_submit_page_bio() for IPU path +- f2fs_submit_page_bio() for OPU path + +But still we account write IO only in f2fs_submit_page_mbio(), result in +incorrect IO account, fix it by adding missing IO account in IPU path. + +Fixes: d1b3e72d5490 ("f2fs: submit bio of in-place-update pages") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -456,6 +456,10 @@ int f2fs_submit_page_bio(struct f2fs_io_ + bio_put(bio); + return -EFAULT; + } ++ ++ if (fio->io_wbc && !is_read_io(fio->op)) ++ wbc_account_io(fio->io_wbc, page, PAGE_SIZE); ++ + bio_set_op_attrs(bio, fio->op, fio->op_flags); + + __submit_bio(fio->sbi, bio, fio->type); diff --git a/queue-4.19/f2fs-fix-to-flush-all-dirty-inodes-recovered-in-readonly-fs.patch b/queue-4.19/f2fs-fix-to-flush-all-dirty-inodes-recovered-in-readonly-fs.patch new file mode 100644 index 00000000000..2bf7ad1c213 --- /dev/null +++ b/queue-4.19/f2fs-fix-to-flush-all-dirty-inodes-recovered-in-readonly-fs.patch @@ -0,0 +1,143 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Chao Yu +Date: Wed, 22 Aug 2018 17:11:05 +0800 +Subject: f2fs: fix to flush all dirty inodes recovered in readonly fs + +From: Chao Yu + +[ Upstream commit 1378752b9921e60749eaf18ec6c47b33f9001abb ] + +generic/417 reported as blow: + +------------[ cut here ]------------ +kernel BUG at /home/yuchao/git/devf2fs/inode.c:695! +invalid opcode: 0000 [#1] PREEMPT SMP +CPU: 1 PID: 21697 Comm: umount Tainted: G W O 4.18.0-rc2+ #39 +Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +EIP: f2fs_evict_inode+0x556/0x580 [f2fs] +Call Trace: + ? _raw_spin_unlock+0x2c/0x50 + evict+0xa8/0x170 + dispose_list+0x34/0x40 + evict_inodes+0x118/0x120 + generic_shutdown_super+0x41/0x100 + ? rcu_read_lock_sched_held+0x97/0xa0 + kill_block_super+0x22/0x50 + kill_f2fs_super+0x6f/0x80 [f2fs] + deactivate_locked_super+0x3d/0x70 + deactivate_super+0x40/0x60 + cleanup_mnt+0x39/0x70 + __cleanup_mnt+0x10/0x20 + task_work_run+0x81/0xa0 + exit_to_usermode_loop+0x59/0xa7 + do_fast_syscall_32+0x1f5/0x22c + entry_SYSENTER_32+0x53/0x86 +EIP: f2fs_evict_inode+0x556/0x580 [f2fs] + +It can simply reproduced with scripts: + +Enable quota feature during mkfs. + +Testcase1: +1. mkfs.f2fs /dev/zram0 +2. mount -t f2fs /dev/zram0 /mnt/f2fs +3. xfs_io -f /mnt/f2fs/file -c "pwrite 0 4k" -c "fsync" +4. godown /mnt/f2fs +5. umount /mnt/f2fs +6. mount -t f2fs -o ro /dev/zram0 /mnt/f2fs +7. umount /mnt/f2fs + +Testcase2: +1. mkfs.f2fs /dev/zram0 +2. mount -t f2fs /dev/zram0 /mnt/f2fs +3. touch /mnt/f2fs/file +4. create process[pid = x] do: + a) open /mnt/f2fs/file; + b) unlink /mnt/f2fs/file +5. godown -f /mnt/f2fs +6. kill process[pid = x] +7. umount /mnt/f2fs +8. mount -t f2fs -o ro /dev/zram0 /mnt/f2fs +9. umount /mnt/f2fs + +The reason is: during recovery, i_{c,m}time of inode will be updated, then +the inode can be set dirty w/o being tracked in sbi->inode_list[DIRTY_META] +global list, so later write_checkpoint will not flush such dirty inode into +node page. + +Once umount is called, sync_filesystem() in generic_shutdown_super() will +skip syncng dirty inodes due to sb_rdonly check, leaving dirty inodes +there. + +To solve this issue, during umount, add remove SB_RDONLY flag in +sb->s_flags, to make sure sync_filesystem() will not be skipped. + +Signed-off-by: Chao Yu + +Signed-off-by: Jaegeuk Kim + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/checkpoint.c | 2 ++ + fs/f2fs/f2fs.h | 1 + + fs/f2fs/recovery.c | 14 +++++++++----- + fs/f2fs/super.c | 3 +++ + 4 files changed, 15 insertions(+), 5 deletions(-) + +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -696,6 +696,8 @@ int f2fs_recover_orphan_inodes(struct f2 + /* clear Orphan Flag */ + clear_ckpt_flags(sbi, CP_ORPHAN_PRESENT_FLAG); + out: ++ set_sbi_flag(sbi, SBI_IS_RECOVERED); ++ + #ifdef CONFIG_QUOTA + /* Turn quotas off */ + if (quota_enabled) +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1089,6 +1089,7 @@ enum { + SBI_NEED_SB_WRITE, /* need to recover superblock */ + SBI_NEED_CP, /* need to checkpoint */ + SBI_IS_SHUTDOWN, /* shutdown by ioctl */ ++ SBI_IS_RECOVERED, /* recovered orphan/data */ + }; + + enum { +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -698,11 +698,15 @@ skip: + /* let's drop all the directory inodes for clean checkpoint */ + destroy_fsync_dnodes(&dir_list); + +- if (!err && need_writecp) { +- struct cp_control cpc = { +- .reason = CP_RECOVERY, +- }; +- err = f2fs_write_checkpoint(sbi, &cpc); ++ if (need_writecp) { ++ set_sbi_flag(sbi, SBI_IS_RECOVERED); ++ ++ if (!err) { ++ struct cp_control cpc = { ++ .reason = CP_RECOVERY, ++ }; ++ err = f2fs_write_checkpoint(sbi, &cpc); ++ } + } + + kmem_cache_destroy(fsync_entry_slab); +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3188,6 +3188,9 @@ static void kill_f2fs_super(struct super + }; + f2fs_write_checkpoint(sbi, &cpc); + } ++ ++ if (is_sbi_flag_set(sbi, SBI_IS_RECOVERED) && f2fs_readonly(sb)) ++ sb->s_flags &= ~SB_RDONLY; + } + kill_block_super(sb); + } diff --git a/queue-4.19/f2fs-fix-to-recover-inode-s-crtime-during-por.patch b/queue-4.19/f2fs-fix-to-recover-inode-s-crtime-during-por.patch new file mode 100644 index 00000000000..4f9f1b2f53d --- /dev/null +++ b/queue-4.19/f2fs-fix-to-recover-inode-s-crtime-during-por.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Chao Yu +Date: Tue, 25 Sep 2018 15:36:01 +0800 +Subject: f2fs: fix to recover inode's crtime during POR + +From: Chao Yu + +[ Upstream commit 5cd1f387a13b5188b4edb4c834310302a85a6ea2 ] + +Testcase to reproduce this bug: +1. mkfs.f2fs -O extra_attr -O inode_crtime /dev/sdd +2. mount -t f2fs /dev/sdd /mnt/f2fs +3. touch /mnt/f2fs/file +4. xfs_io -f /mnt/f2fs/file -c "fsync" +5. godown /mnt/f2fs +6. umount /mnt/f2fs +7. mount -t f2fs /dev/sdd /mnt/f2fs +8. xfs_io -f /mnt/f2fs/file -c "statx -r" + +stat.btime.tv_sec = 0 +stat.btime.tv_nsec = 0 + +This patch fixes to recover inode creation time fields during +mount. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/node.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -2560,6 +2560,13 @@ retry: + F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize), + i_projid)) + dst->i_projid = src->i_projid; ++ ++ if (f2fs_sb_has_inode_crtime(sbi->sb) && ++ F2FS_FITS_IN_INODE(src, le16_to_cpu(src->i_extra_isize), ++ i_crtime_nsec)) { ++ dst->i_crtime = src->i_crtime; ++ dst->i_crtime_nsec = src->i_crtime_nsec; ++ } + } + + new_ni = old_ni; diff --git a/queue-4.19/f2fs-fix-to-recover-inode-s-i_flags-during-por.patch b/queue-4.19/f2fs-fix-to-recover-inode-s-i_flags-during-por.patch new file mode 100644 index 00000000000..2a862067a1c --- /dev/null +++ b/queue-4.19/f2fs-fix-to-recover-inode-s-i_flags-during-por.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Chao Yu +Date: Tue, 25 Sep 2018 15:35:59 +0800 +Subject: f2fs: fix to recover inode's i_flags during POR + +From: Chao Yu + +[ Upstream commit 19c73a691ccf6fb2f12d4e9cf9830023966cec88 ] + +Testcase to reproduce this bug: +1. mkfs.f2fs /dev/sdd +2. mount -t f2fs /dev/sdd /mnt/f2fs +3. touch /mnt/f2fs/file +4. sync +5. chattr +A /mnt/f2fs/file +6. xfs_io -f /mnt/f2fs/file -c "fsync" +7. godown /mnt/f2fs +8. umount /mnt/f2fs +9. mount -t f2fs /dev/sdd /mnt/f2fs +10. lsattr /mnt/f2fs/file + +-----------------N- /mnt/f2fs/file + +But actually, we expect the corrct result is: + +-------A---------N- /mnt/f2fs/file + +The reason is we didn't recover inode.i_flags field during mount, +fix it. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/recovery.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/f2fs/recovery.c ++++ b/fs/f2fs/recovery.c +@@ -221,6 +221,7 @@ static void recover_inode(struct inode * + inode->i_mtime.tv_nsec = le32_to_cpu(raw->i_mtime_nsec); + + F2FS_I(inode)->i_advise = raw->i_advise; ++ F2FS_I(inode)->i_flags = le32_to_cpu(raw->i_flags); + + recover_inline_flags(inode, raw); + diff --git a/queue-4.19/f2fs-report-error-if-quota-off-error-during-umount.patch b/queue-4.19/f2fs-report-error-if-quota-off-error-during-umount.patch new file mode 100644 index 00000000000..e8a3ab2e89f --- /dev/null +++ b/queue-4.19/f2fs-report-error-if-quota-off-error-during-umount.patch @@ -0,0 +1,83 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Yunlei He +Date: Tue, 26 Jun 2018 13:12:43 +0800 +Subject: f2fs: report error if quota off error during umount + +From: Yunlei He + +[ Upstream commit cda9cc595f0bb6ffa51a4efc4b6533dfa4039b4c ] + +Now, we depend on fsck to ensure quota file data is ok, +so we scan whole partition if checkpoint without umount +flag. It's same for quota off error case, which may make +quota file data inconsistent. + +generic/019 reports below error: + + __quota_error: 1160 callbacks suppressed + Quota error (device zram1): write_blk: dquota write failed + Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota + Quota error (device zram1): write_blk: dquota write failed + Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota + Quota error (device zram1): write_blk: dquota write failed + Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota + Quota error (device zram1): write_blk: dquota write failed + Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota + Quota error (device zram1): write_blk: dquota write failed + Quota error (device zram1): qtree_write_dquot: Error -28 occurred while creating quota + VFS: Busy inodes after unmount of zram1. Self-destruct in 5 seconds. Have a nice day... + +If we failed in below path due to fail to write dquot block, we will miss +to release quota inode, fix it. + +- f2fs_put_super + - f2fs_quota_off_umount + - f2fs_quota_off + - f2fs_quota_sync <-- failed + - dquot_quota_off <-- missed to call + +Signed-off-by: Yunlei He +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/super.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1852,7 +1852,9 @@ static int f2fs_quota_off(struct super_b + if (!inode || !igrab(inode)) + return dquot_quota_off(sb, type); + +- f2fs_quota_sync(sb, type); ++ err = f2fs_quota_sync(sb, type); ++ if (err) ++ goto out_put; + + err = dquot_quota_off(sb, type); + if (err || f2fs_sb_has_quota_ino(sb)) +@@ -1871,9 +1873,20 @@ out_put: + void f2fs_quota_off_umount(struct super_block *sb) + { + int type; ++ int err; + +- for (type = 0; type < MAXQUOTAS; type++) +- f2fs_quota_off(sb, type); ++ for (type = 0; type < MAXQUOTAS; type++) { ++ err = f2fs_quota_off(sb, type); ++ if (err) { ++ int ret = dquot_quota_off(sb, type); ++ ++ f2fs_msg(sb, KERN_ERR, ++ "Fail to turn off disk quota " ++ "(type: %d, err: %d, ret:%d), Please " ++ "run fsck to fix it.", type, err, ret); ++ set_sbi_flag(F2FS_SB(sb), SBI_NEED_FSCK); ++ } ++ } + } + + static int f2fs_get_projid(struct inode *inode, kprojid_t *projid) diff --git a/queue-4.19/failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch b/queue-4.19/failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch new file mode 100644 index 00000000000..2dd8bee1126 --- /dev/null +++ b/queue-4.19/failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: YueHaibing +Date: Tue, 4 Sep 2018 02:56:26 +0000 +Subject: failover: Add missing check to validate 'slave_dev' in net_failover_slave_unregister + +From: YueHaibing + +[ Upstream commit 9e7e6cabf371cc008cb2244a04c012b516753693 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/net/net_failover.c: In function 'net_failover_slave_unregister': +drivers/net/net_failover.c:598:35: warning: + variable 'primary_dev' set but not used [-Wunused-but-set-variable] + +There should check the validity of 'slave_dev'. + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") + +Signed-off-by: YueHaibing +Acked-by: Sridhar Samudrala +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/net_failover.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -603,6 +603,9 @@ static int net_failover_slave_unregister + primary_dev = rtnl_dereference(nfo_info->primary_dev); + standby_dev = rtnl_dereference(nfo_info->standby_dev); + ++ if (WARN_ON_ONCE(slave_dev != primary_dev && slave_dev != standby_dev)) ++ return -ENODEV; ++ + vlan_vids_del_by_dev(slave_dev, failover_dev); + dev_uc_unsync(slave_dev, failover_dev); + dev_mc_unsync(slave_dev, failover_dev); diff --git a/queue-4.19/firmware-coreboot-unmap-ioregion-after-device-population.patch b/queue-4.19/firmware-coreboot-unmap-ioregion-after-device-population.patch new file mode 100644 index 00000000000..c023f1cc3dc --- /dev/null +++ b/queue-4.19/firmware-coreboot-unmap-ioregion-after-device-population.patch @@ -0,0 +1,60 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Stephen Boyd +Date: Wed, 15 Aug 2018 13:37:04 -0700 +Subject: firmware: coreboot: Unmap ioregion after device population + +From: Stephen Boyd + +[ Upstream commit 20edec388277b62ddfddb8b2b376a937a2cd6d1b ] + +Both callers of coreboot_table_init() ioremap the pointer that comes in +but they don't unmap the memory on failure. Both of them also fail probe +immediately with the return value of coreboot_table_init(), leaking a +mapping when it fails. The mapping isn't necessary at all after devices +are populated either, so we can just drop the mapping here when we exit +the function. Let's do that to simplify the code a bit and plug the leak. + +Cc: Wei-Ning Huang +Cc: Julius Werner +Cc: Brian Norris +Cc: Samuel Holland +Fixes: 570d30c2823f ("firmware: coreboot: Expose the coreboot table as a bus") +Signed-off-by: Stephen Boyd +Reviewed-by: Julius Werner +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/firmware/google/coreboot_table.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/firmware/google/coreboot_table.c ++++ b/drivers/firmware/google/coreboot_table.c +@@ -110,7 +110,8 @@ int coreboot_table_init(struct device *d + + if (strncmp(header.signature, "LBIO", sizeof(header.signature))) { + pr_warn("coreboot_table: coreboot table missing or corrupt!\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto out; + } + + ptr_entry = (void *)ptr_header + header.header_bytes; +@@ -137,7 +138,8 @@ int coreboot_table_init(struct device *d + + ptr_entry += entry.size; + } +- ++out: ++ iounmap(ptr); + return ret; + } + EXPORT_SYMBOL(coreboot_table_init); +@@ -146,7 +148,6 @@ int coreboot_table_exit(void) + { + if (ptr_header) { + bus_unregister(&coreboot_bus_type); +- iounmap(ptr_header); + ptr_header = NULL; + } + diff --git a/queue-4.19/gpio-brcmstb-allow-0-width-gpio-banks.patch b/queue-4.19/gpio-brcmstb-allow-0-width-gpio-banks.patch new file mode 100644 index 00000000000..d1b6adc125a --- /dev/null +++ b/queue-4.19/gpio-brcmstb-allow-0-width-gpio-banks.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Justin Chen +Date: Fri, 17 Aug 2018 16:47:39 -0700 +Subject: gpio: brcmstb: allow 0 width GPIO banks + +From: Justin Chen + +[ Upstream commit bfba223dcc4548632d8f3bfd15690a86d4c68504 ] + +Sometimes we have empty banks within the GPIO block. This commit allows +proper handling of 0 width GPIO banks. We handle 0 width GPIO banks by +incrementing the bank and number of GPIOs, but not initializing them. +This will mean a call into the non-existent GPIOs will return an error. + +Also remove "GPIO registered" dev print. This information is misleading +since the incremented banks and gpio_base do not reflect the actual GPIOs +that get initialized. We leave this information out since it is already +printed with dev_dbg. + +Signed-off-by: Justin Chen +Acked-by: Florian Fainelli +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-brcmstb.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/drivers/gpio/gpio-brcmstb.c ++++ b/drivers/gpio/gpio-brcmstb.c +@@ -664,6 +664,18 @@ static int brcmstb_gpio_probe(struct pla + struct brcmstb_gpio_bank *bank; + struct gpio_chip *gc; + ++ /* ++ * If bank_width is 0, then there is an empty bank in the ++ * register block. Special handling for this case. ++ */ ++ if (bank_width == 0) { ++ dev_dbg(dev, "Width 0 found: Empty bank @ %d\n", ++ num_banks); ++ num_banks++; ++ gpio_base += MAX_GPIO_PER_BANK; ++ continue; ++ } ++ + bank = devm_kzalloc(dev, sizeof(*bank), GFP_KERNEL); + if (!bank) { + err = -ENOMEM; +@@ -740,9 +752,6 @@ static int brcmstb_gpio_probe(struct pla + goto fail; + } + +- dev_info(dev, "Registered %d banks (GPIO(s): %d-%d)\n", +- num_banks, priv->gpio_base, gpio_base - 1); +- + if (priv->parent_wake_irq && need_wakeup_event) + pm_wakeup_event(dev, 0); + diff --git a/queue-4.19/hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch b/queue-4.19/hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch new file mode 100644 index 00000000000..c4e888dc632 --- /dev/null +++ b/queue-4.19/hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Haiyang Zhang +Date: Mon, 15 Oct 2018 19:06:15 +0000 +Subject: hv_netvsc: fix vf serial matching with pci slot info + +From: Haiyang Zhang + +[ Upstream commit 005479556197f80139771960dda0dfdcd2d2aad5 ] + +The VF device's serial number is saved as a string in PCI slot's +kobj name, not the slot->number. This patch corrects the netvsc +driver, so the VF device can be successfully paired with synthetic +NIC. + +Fixes: 00d7ddba1143 ("hv_netvsc: pair VF based on serial number") +Reported-by: Vitaly Kuznetsov +Signed-off-by: Haiyang Zhang +Reviewed-by: Stephen Hemminger +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hyperv/netvsc_drv.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -2022,14 +2022,15 @@ static void netvsc_vf_setup(struct work_ + rtnl_unlock(); + } + +-/* Find netvsc by VMBus serial number. +- * The PCI hyperv controller records the serial number as the slot. ++/* Find netvsc by VF serial number. ++ * The PCI hyperv controller records the serial number as the slot kobj name. + */ + static struct net_device *get_netvsc_byslot(const struct net_device *vf_netdev) + { + struct device *parent = vf_netdev->dev.parent; + struct net_device_context *ndev_ctx; + struct pci_dev *pdev; ++ u32 serial; + + if (!parent || !dev_is_pci(parent)) + return NULL; /* not a PCI device */ +@@ -2040,16 +2041,22 @@ static struct net_device *get_netvsc_bys + return NULL; + } + ++ if (kstrtou32(pci_slot_name(pdev->slot), 10, &serial)) { ++ netdev_notice(vf_netdev, "Invalid vf serial:%s\n", ++ pci_slot_name(pdev->slot)); ++ return NULL; ++ } ++ + list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { + if (!ndev_ctx->vf_alloc) + continue; + +- if (ndev_ctx->vf_serial == pdev->slot->number) ++ if (ndev_ctx->vf_serial == serial) + return hv_get_drvdata(ndev_ctx->device_ctx); + } + + netdev_notice(vf_netdev, +- "no netdev found for slot %u\n", pdev->slot->number); ++ "no netdev found for vf serial:%u\n", serial); + return NULL; + } + diff --git a/queue-4.19/hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch b/queue-4.19/hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch new file mode 100644 index 00000000000..db38fb4ea49 --- /dev/null +++ b/queue-4.19/hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Thierry Reding +Date: Fri, 21 Sep 2018 12:10:48 +0200 +Subject: hwmon: (pwm-fan) Set fan speed to 0 on suspend + +From: Thierry Reding + +[ Upstream commit 95dcd64bc5a27080beaa344edfe5bdcca3d2e7dc ] + +Technically this is not required because disabling the PWM should be +enough. However, when support for atomic operations was implemented in +the PWM subsystem, only actual changes to the PWM channel are applied +during pwm_config(), which means that during after resume from suspend +the old settings won't be applied. + +One possible solution is for the PWM driver to implement its own PM +operations such that settings from before suspend get applied on resume. +This has the disadvantage of completely ignoring any particular ordering +requirements that PWM user drivers might have, so it is best to leave it +up to the user drivers to apply the settings that they want at the +appropriate time. + +Another way to solve this would be to read back the current state of the +PWM at the time of resume. That way, in case the configuration was lost +during suspend, applying the old settings in PWM user drivers would +actually get them applied because they differ from the current settings. +However, not all PWM drivers support reading the hardware state, and not +all hardware may support it. + +The best workaround at this point seems to be to let PWM user drivers +tell the PWM subsystem that the PWM is turned off by, in addition to +disabling it, also setting the duty cycle to 0. This causes the resume +operation to apply a configuration that is different from the current +configuration, resulting in the proper state from before suspend getting +restored. + +Signed-off-by: Thierry Reding +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/pwm-fan.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/hwmon/pwm-fan.c ++++ b/drivers/hwmon/pwm-fan.c +@@ -290,9 +290,19 @@ static int pwm_fan_remove(struct platfor + static int pwm_fan_suspend(struct device *dev) + { + struct pwm_fan_ctx *ctx = dev_get_drvdata(dev); ++ struct pwm_args args; ++ int ret; ++ ++ pwm_get_args(ctx->pwm, &args); ++ ++ if (ctx->pwm_value) { ++ ret = pwm_config(ctx->pwm, 0, args.period); ++ if (ret < 0) ++ return ret; + +- if (ctx->pwm_value) + pwm_disable(ctx->pwm); ++ } ++ + return 0; + } + diff --git a/queue-4.19/ib-ipoib-clear-ipcb-before-icmp_send.patch b/queue-4.19/ib-ipoib-clear-ipcb-before-icmp_send.patch new file mode 100644 index 00000000000..e33a6632afd --- /dev/null +++ b/queue-4.19/ib-ipoib-clear-ipcb-before-icmp_send.patch @@ -0,0 +1,103 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Denis Drozdov +Date: Thu, 11 Oct 2018 22:33:57 +0300 +Subject: IB/ipoib: Clear IPCB before icmp_send + +From: Denis Drozdov + +[ Upstream commit 4d6e4d12da2c308f8f976d3955c45ee62539ac98 ] + +IPCB should be cleared before icmp_send, since it may contain data from +previous layers and the data could be misinterpreted as ip header options, +which later caused the ihl to be set to an invalid value and resulted in +the following stack corruption: + +[ 1083.031512] ib0: packet len 57824 (> 2048) too long to send, dropping +[ 1083.031843] ib0: packet len 37904 (> 2048) too long to send, dropping +[ 1083.032004] ib0: packet len 4040 (> 2048) too long to send, dropping +[ 1083.032253] ib0: packet len 63800 (> 2048) too long to send, dropping +[ 1083.032481] ib0: packet len 23960 (> 2048) too long to send, dropping +[ 1083.033149] ib0: packet len 63800 (> 2048) too long to send, dropping +[ 1083.033439] ib0: packet len 63800 (> 2048) too long to send, dropping +[ 1083.033700] ib0: packet len 63800 (> 2048) too long to send, dropping +[ 1083.034124] ib0: packet len 63800 (> 2048) too long to send, dropping +[ 1083.034387] ================================================================== +[ 1083.034602] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xf08/0x1310 +[ 1083.034798] Write of size 4 at addr ffff880353457c5f by task kworker/u16:0/7 +[ 1083.034990] +[ 1083.035104] CPU: 7 PID: 7 Comm: kworker/u16:0 Tainted: G O 4.19.0-rc5+ #1 +[ 1083.035316] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu2 04/01/2014 +[ 1083.035573] Workqueue: ipoib_wq ipoib_cm_skb_reap [ib_ipoib] +[ 1083.035750] Call Trace: +[ 1083.035888] dump_stack+0x9a/0xeb +[ 1083.036031] print_address_description+0xe3/0x2e0 +[ 1083.036213] kasan_report+0x18a/0x2e0 +[ 1083.036356] ? __ip_options_echo+0xf08/0x1310 +[ 1083.036522] __ip_options_echo+0xf08/0x1310 +[ 1083.036688] icmp_send+0x7b9/0x1cd0 +[ 1083.036843] ? icmp_route_lookup.constprop.9+0x1070/0x1070 +[ 1083.037018] ? netif_schedule_queue+0x5/0x200 +[ 1083.037180] ? debug_show_all_locks+0x310/0x310 +[ 1083.037341] ? rcu_dynticks_curr_cpu_in_eqs+0x85/0x120 +[ 1083.037519] ? debug_locks_off+0x11/0x80 +[ 1083.037673] ? debug_check_no_obj_freed+0x207/0x4c6 +[ 1083.037841] ? check_flags.part.27+0x450/0x450 +[ 1083.037995] ? debug_check_no_obj_freed+0xc3/0x4c6 +[ 1083.038169] ? debug_locks_off+0x11/0x80 +[ 1083.038318] ? skb_dequeue+0x10e/0x1a0 +[ 1083.038476] ? ipoib_cm_skb_reap+0x2b5/0x650 [ib_ipoib] +[ 1083.038642] ? netif_schedule_queue+0xa8/0x200 +[ 1083.038820] ? ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib] +[ 1083.038996] ipoib_cm_skb_reap+0x544/0x650 [ib_ipoib] +[ 1083.039174] process_one_work+0x912/0x1830 +[ 1083.039336] ? wq_pool_ids_show+0x310/0x310 +[ 1083.039491] ? lock_acquire+0x145/0x3a0 +[ 1083.042312] worker_thread+0x87/0xbb0 +[ 1083.045099] ? process_one_work+0x1830/0x1830 +[ 1083.047865] kthread+0x322/0x3e0 +[ 1083.050624] ? kthread_create_worker_on_cpu+0xc0/0xc0 +[ 1083.053354] ret_from_fork+0x3a/0x50 + +For instance __ip_options_echo is failing to proceed with invalid srr and +optlen passed from another layer via IPCB + +[ 762.139568] IPv4: __ip_options_echo rr=0 ts=0 srr=43 cipso=0 +[ 762.139720] IPv4: ip_options_build: IPCB 00000000f3cd969e opt 000000002ccb3533 +[ 762.139838] IPv4: __ip_options_echo in srr: optlen 197 soffset 84 +[ 762.139852] IPv4: ip_options_build srr=0 is_frag=0 rr_needaddr=0 ts_needaddr=0 ts_needtime=0 rr=0 ts=0 +[ 762.140269] ================================================================== +[ 762.140713] IPv4: __ip_options_echo rr=0 ts=0 srr=0 cipso=0 +[ 762.141078] BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0x12ec/0x1680 +[ 762.141087] Write of size 4 at addr ffff880353457c7f by task kworker/u16:0/7 + +Signed-off-by: Denis Drozdov +Reviewed-by: Erez Shitrit +Reviewed-by: Feras Daoud +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1438,11 +1438,15 @@ static void ipoib_cm_skb_reap(struct wor + spin_unlock_irqrestore(&priv->lock, flags); + netif_tx_unlock_bh(dev); + +- if (skb->protocol == htons(ETH_P_IP)) ++ if (skb->protocol == htons(ETH_P_IP)) { ++ memset(IPCB(skb), 0, sizeof(*IPCB(skb))); + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu)); ++ } + #if IS_ENABLED(CONFIG_IPV6) +- else if (skb->protocol == htons(ETH_P_IPV6)) ++ else if (skb->protocol == htons(ETH_P_IPV6)) { ++ memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ } + #endif + dev_kfree_skb_any(skb); + diff --git a/queue-4.19/ib-ipoib-use-dev_port-to-expose-network-interface-port-numbers.patch b/queue-4.19/ib-ipoib-use-dev_port-to-expose-network-interface-port-numbers.patch new file mode 100644 index 00000000000..88ba42c131c --- /dev/null +++ b/queue-4.19/ib-ipoib-use-dev_port-to-expose-network-interface-port-numbers.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Arseny Maslennikov +Date: Thu, 6 Sep 2018 17:51:11 +0300 +Subject: IB/ipoib: Use dev_port to expose network interface port numbers + +From: Arseny Maslennikov + +[ Upstream commit 9b8b2a323008aedd39a8debb861b825707f01420 ] + +Some InfiniBand network devices have multiple ports on the same PCI +function. This initializes the `dev_port' sysfs field of those +network interfaces with their port number. + +Prior to this the kernel erroneously used the `dev_id' sysfs +field of those network interfaces to convey the port number to userspace. + +The use of `dev_id' was considered correct until Linux 3.15, +when another field, `dev_port', was defined for this particular +purpose and `dev_id' was reserved for distinguishing stacked ifaces +(e.g: VLANs) with the same hardware address as their parent device. + +Similar fixes to net/mlx4_en and many other drivers, which started +exporting this information through `dev_id' before 3.15, were accepted +into the kernel 4 years ago. +See 76a066f2a2a0 (`net/mlx4_en: Expose port number through sysfs'). + +Signed-off-by: Arseny Maslennikov +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1880,6 +1880,8 @@ static int ipoib_parent_init(struct net_ + sizeof(union ib_gid)); + + SET_NETDEV_DEV(priv->dev, priv->ca->dev.parent); ++ priv->dev->dev_port = priv->port - 1; ++ /* Let's set this one too for backwards compatibility. */ + priv->dev->dev_id = priv->port - 1; + + return 0; diff --git a/queue-4.19/ib-mlx5-allow-transition-of-dci-qp-to-reset.patch b/queue-4.19/ib-mlx5-allow-transition-of-dci-qp-to-reset.patch new file mode 100644 index 00000000000..676a1bab189 --- /dev/null +++ b/queue-4.19/ib-mlx5-allow-transition-of-dci-qp-to-reset.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Moni Shoua +Date: Wed, 12 Sep 2018 09:33:55 +0300 +Subject: IB/mlx5: Allow transition of DCI QP to reset + +From: Moni Shoua + +[ Upstream commit 99ed748e878a99c6c7b87bbec063eefd9e47cb42 ] + +The transition is allowed from any state and the atrribute mask must be +IB_QP_STATE. + +Fixes: c32a4f296e1d ("IB/mlx5: Add support for DC Initiator QP") +Signed-off-by: Moni Shoua +Reviewed-by: Artemy Kovalyov +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/qp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -3243,7 +3243,9 @@ static bool modify_dci_qp_is_ok(enum ib_ + int req = IB_QP_STATE; + int opt = 0; + +- if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) { ++ if (new_state == IB_QPS_RESET) { ++ return is_valid_mask(attr_mask, req, opt); ++ } else if (cur_state == IB_QPS_RESET && new_state == IB_QPS_INIT) { + req |= IB_QP_PKEY_INDEX | IB_QP_PORT; + return is_valid_mask(attr_mask, req, opt); + } else if (cur_state == IB_QPS_INIT && new_state == IB_QPS_INIT) { diff --git a/queue-4.19/ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch b/queue-4.19/ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch new file mode 100644 index 00000000000..18ce2ee7d8a --- /dev/null +++ b/queue-4.19/ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch @@ -0,0 +1,109 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Vijay Immanuel +Date: Tue, 12 Jun 2018 18:20:49 -0700 +Subject: IB/rxe: fix for duplicate request processing and ack psns + +From: Vijay Immanuel + +[ Upstream commit b97db58557f4aa6d9903f8e1deea6b3d1ed0ba43 ] + +Don't reset the resp opcode for a replayed read response. +The resp opcode could be in the middle of a write or send +sequence, when the duplicate read request was received. +An example sequence is as follows: +- Receive read request for 12KB PSN 20. Transmit read response + first, middle and last with PSNs 20,21,22. +- Receive write first PSN 23. + At this point the resp psn is 24 and resp opcode is write first. +- The sender notices that PSN 20 is dropped and retransmits. + Receive read request for 12KB PSN 20. Transmit read response + first, middle and last with PSNs 20,21,22. The resp opcode is + set to -1, the resp psn remains 24. +- Receive write first PSN 23. This is processed by duplicate_request(). + The resp opcode remains -1 and resp psn remains 24. +- Receive write middle PSN 24. check_op_seq() reports a missing + first error since the resp opcode is -1. + +When sending an ack for a duplicate send or write request, +use the psn of the previous ack sent. Do not use the psn +of a read response for the ack. +An example sequence is as follows: +- Receive write PSN 30. Transmit ACK for PSN 30. +- Receive read request 4KB PSN 31. Transmit read response with + PSN 31. The resp psn is now 32. +- The sender notices that PSN 30 is dropped and retransmits. + Receive write PSN 30. duplicate_request() sends an ACK with + PSN 31. That is incorrect since PSN 31 was a read request. + +Signed-off-by: Vijay Immanuel +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rxe/rxe_resp.c | 8 ++++++-- + drivers/infiniband/sw/rxe/rxe_verbs.h | 2 ++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -682,6 +682,7 @@ static enum resp_states read_reply(struc + rxe_advance_resp_resource(qp); + + res->type = RXE_READ_MASK; ++ res->replay = 0; + + res->read.va = qp->resp.va; + res->read.va_org = qp->resp.va; +@@ -752,7 +753,8 @@ static enum resp_states read_reply(struc + state = RESPST_DONE; + } else { + qp->resp.res = NULL; +- qp->resp.opcode = -1; ++ if (!res->replay) ++ qp->resp.opcode = -1; + if (psn_compare(res->cur_psn, qp->resp.psn) >= 0) + qp->resp.psn = res->cur_psn; + state = RESPST_CLEANUP; +@@ -814,6 +816,7 @@ static enum resp_states execute(struct r + + /* next expected psn, read handles this separately */ + qp->resp.psn = (pkt->psn + 1) & BTH_PSN_MASK; ++ qp->resp.ack_psn = qp->resp.psn; + + qp->resp.opcode = pkt->opcode; + qp->resp.status = IB_WC_SUCCESS; +@@ -1065,7 +1068,7 @@ static enum resp_states duplicate_reques + struct rxe_pkt_info *pkt) + { + enum resp_states rc; +- u32 prev_psn = (qp->resp.psn - 1) & BTH_PSN_MASK; ++ u32 prev_psn = (qp->resp.ack_psn - 1) & BTH_PSN_MASK; + + if (pkt->mask & RXE_SEND_MASK || + pkt->mask & RXE_WRITE_MASK) { +@@ -1108,6 +1111,7 @@ static enum resp_states duplicate_reques + res->state = (pkt->psn == res->first_psn) ? + rdatm_res_state_new : + rdatm_res_state_replay; ++ res->replay = 1; + + /* Reset the resource, except length. */ + res->read.va_org = iova; +--- a/drivers/infiniband/sw/rxe/rxe_verbs.h ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.h +@@ -171,6 +171,7 @@ enum rdatm_res_state { + + struct resp_res { + int type; ++ int replay; + u32 first_psn; + u32 last_psn; + u32 cur_psn; +@@ -195,6 +196,7 @@ struct rxe_resp_info { + enum rxe_qp_state state; + u32 msn; + u32 psn; ++ u32 ack_psn; + int opcode; + int drop_msg; + int goto_error; diff --git a/queue-4.19/ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch b/queue-4.19/ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch new file mode 100644 index 00000000000..25a6589f04c --- /dev/null +++ b/queue-4.19/ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Bruce Allan +Date: Wed, 19 Sep 2018 17:23:11 -0700 +Subject: ice: fix changing of ring descriptor size (ethtool -G) + +From: Bruce Allan + +[ Upstream commit f934bb9b8b6136edd261b2dc2c9ad4dbc39ffc66 ] + +rx_mini_pending was set to an incorrect value. This was causing EINVAL to +always be returned to 'ethtool -G'. The driver does not support mini or +jumbo rings so the respective settings should be zero. + +Also, change the valid range of the number of descriptors in the rings to +make the code simpler and easier for users to understand (this removes the +valid settings of 8 and 16). Add a system log message indicating when the +number is rounded-up from what the user specifies with the 'ethtool -G' +command (i.e. when it is not a multiple of 32), and update the log message +when a user-provided value is out of range to also indicate the stride. + +Signed-off-by: Bruce Allan +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice.h | 4 ++-- + drivers/net/ethernet/intel/ice/ice_ethtool.c | 17 ++++++++++++++--- + 2 files changed, 16 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice.h ++++ b/drivers/net/ethernet/intel/ice/ice.h +@@ -39,9 +39,9 @@ + extern const char ice_drv_ver[]; + #define ICE_BAR0 0 + #define ICE_DFLT_NUM_DESC 128 +-#define ICE_MIN_NUM_DESC 8 +-#define ICE_MAX_NUM_DESC 8160 + #define ICE_REQ_DESC_MULTIPLE 32 ++#define ICE_MIN_NUM_DESC ICE_REQ_DESC_MULTIPLE ++#define ICE_MAX_NUM_DESC 8160 + #define ICE_DFLT_TRAFFIC_CLASS BIT(0) + #define ICE_INT_NAME_STR_LEN (IFNAMSIZ + 16) + #define ICE_ETHTOOL_FWVER_LEN 32 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c +@@ -478,9 +478,11 @@ ice_get_ringparam(struct net_device *net + ring->tx_max_pending = ICE_MAX_NUM_DESC; + ring->rx_pending = vsi->rx_rings[0]->count; + ring->tx_pending = vsi->tx_rings[0]->count; +- ring->rx_mini_pending = ICE_MIN_NUM_DESC; ++ ++ /* Rx mini and jumbo rings are not supported */ + ring->rx_mini_max_pending = 0; + ring->rx_jumbo_max_pending = 0; ++ ring->rx_mini_pending = 0; + ring->rx_jumbo_pending = 0; + } + +@@ -498,14 +500,23 @@ ice_set_ringparam(struct net_device *net + ring->tx_pending < ICE_MIN_NUM_DESC || + ring->rx_pending > ICE_MAX_NUM_DESC || + ring->rx_pending < ICE_MIN_NUM_DESC) { +- netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d]\n", ++ netdev_err(netdev, "Descriptors requested (Tx: %d / Rx: %d) out of range [%d-%d] (increment %d)\n", + ring->tx_pending, ring->rx_pending, +- ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC); ++ ICE_MIN_NUM_DESC, ICE_MAX_NUM_DESC, ++ ICE_REQ_DESC_MULTIPLE); + return -EINVAL; + } + + new_tx_cnt = ALIGN(ring->tx_pending, ICE_REQ_DESC_MULTIPLE); ++ if (new_tx_cnt != ring->tx_pending) ++ netdev_info(netdev, ++ "Requested Tx descriptor count rounded up to %d\n", ++ new_tx_cnt); + new_rx_cnt = ALIGN(ring->rx_pending, ICE_REQ_DESC_MULTIPLE); ++ if (new_rx_cnt != ring->rx_pending) ++ netdev_info(netdev, ++ "Requested Rx descriptor count rounded up to %d\n", ++ new_rx_cnt); + + /* if nothing to do return success */ + if (new_tx_cnt == vsi->tx_rings[0]->count && diff --git a/queue-4.19/ice-update-fw-version-check-logic.patch b/queue-4.19/ice-update-fw-version-check-logic.patch new file mode 100644 index 00000000000..e1bfd1cb6e0 --- /dev/null +++ b/queue-4.19/ice-update-fw-version-check-logic.patch @@ -0,0 +1,115 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jacob Keller +Date: Wed, 19 Sep 2018 17:23:07 -0700 +Subject: ice: update fw version check logic + +From: Jacob Keller + +[ Upstream commit 396fbf9cab5dc07f8f87773062a8d35f54b40a05 ] + +We have MAX_FW_API_VER_BRANCH, MAX_FW_API_VER_MAJOR, and +MAX_FW_API_VER_MINOR that we use in ice_controlq.h to test when a +firmware version is newer than expected. This is currently tested by +comparing each field separately. Thus, we compare the branch field +against the MAX_FW_API_VER_BRANCH, and so forth. + +This means that currently, if we suppose that the max firmware version +is defined as 0.2.1, i.e. + +Then firmware 0.1.3 will fail to load. This is because the minor version +3 is greater than the max minor version 1. + +This is not intuitive, because of the notion that increasing the major +firmware version to 2 should mean any firmware version with a major +version is less than 2 should be considered older than 2... + +In order to allow both 0.2.1 and 0.1.3 to load, you would have to define +the "max" firmware version as 0.2.3.. It is possible that such +a firmware version doesn't even exist yet! + +Fix this by replacing the current logic with an updated check that +behaves as follows: + +First, we check the major version. If it is greater than the expected +version, then we prevent driver load. Additionally, a warning message is +logged to indicate to the system administrator that they need to update +their driver. This is now the only case where the driver will refuse to +load. + +Second, if the major version is less than the expected version, we log +an information message indicating the NVM should be updated. + +Third, if the major version is exact, we'll then check the minor +version. If the minor version is more than two versions less than +expected, we log an information message indicating the NVM should be +updated. If it is more than two versions greater than the expected +version, we log an information message that the driver should be +updated. + +To support this, the ice_aq_ver_check function needs its signature +updated to pass the HW structure. Since we now pass this structure, +there is no need to pass the firmware API versions separately. + +Signed-off-by: Jacob Keller +Signed-off-by: Anirudh Venkataramanan +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ice/ice_controlq.c | 30 ++++++++++++++++---------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/intel/ice/ice_controlq.c ++++ b/drivers/net/ethernet/intel/ice/ice_controlq.c +@@ -518,22 +518,31 @@ shutdown_sq_out: + + /** + * ice_aq_ver_check - Check the reported AQ API version. +- * @fw_branch: The "branch" of FW, typically describes the device type +- * @fw_major: The major version of the FW API +- * @fw_minor: The minor version increment of the FW API ++ * @hw: pointer to the hardware structure + * + * Checks if the driver should load on a given AQ API version. + * + * Return: 'true' iff the driver should attempt to load. 'false' otherwise. + */ +-static bool ice_aq_ver_check(u8 fw_branch, u8 fw_major, u8 fw_minor) ++static bool ice_aq_ver_check(struct ice_hw *hw) + { +- if (fw_branch != EXP_FW_API_VER_BRANCH) +- return false; +- if (fw_major != EXP_FW_API_VER_MAJOR) +- return false; +- if (fw_minor != EXP_FW_API_VER_MINOR) ++ if (hw->api_maj_ver > EXP_FW_API_VER_MAJOR) { ++ /* Major API version is newer than expected, don't load */ ++ dev_warn(ice_hw_to_dev(hw), ++ "The driver for the device stopped because the NVM image is newer than expected. You must install the most recent version of the network driver.\n"); + return false; ++ } else if (hw->api_maj_ver == EXP_FW_API_VER_MAJOR) { ++ if (hw->api_min_ver > (EXP_FW_API_VER_MINOR + 2)) ++ dev_info(ice_hw_to_dev(hw), ++ "The driver for the device detected a newer version of the NVM image than expected. Please install the most recent version of the network driver.\n"); ++ else if ((hw->api_min_ver + 2) < EXP_FW_API_VER_MINOR) ++ dev_info(ice_hw_to_dev(hw), ++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n"); ++ } else { ++ /* Major API version is older than expected, log a warning */ ++ dev_info(ice_hw_to_dev(hw), ++ "The driver for the device detected an older version of the NVM image than expected. Please update the NVM image.\n"); ++ } + return true; + } + +@@ -588,8 +597,7 @@ static enum ice_status ice_init_check_ad + if (status) + goto init_ctrlq_free_rq; + +- if (!ice_aq_ver_check(hw->api_branch, hw->api_maj_ver, +- hw->api_min_ver)) { ++ if (!ice_aq_ver_check(hw)) { + status = ICE_ERR_FW_API_VER; + goto init_ctrlq_free_rq; + } diff --git a/queue-4.19/irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch b/queue-4.19/irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch new file mode 100644 index 00000000000..71c4f4662ba --- /dev/null +++ b/queue-4.19/irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Lina Iyer +Date: Thu, 27 Sep 2018 11:18:10 -0600 +Subject: irqchip/pdc: Setup all edge interrupts as rising edge at GIC + +From: Lina Iyer + +[ Upstream commit 7bae48b22c8d38c5cd50f52b6e15d134e2bb3935 ] + +The PDC irqchp can convert a falling edge or level low interrupt to a +rising edge or level high interrupt at the GIC. We just need to setup +the GIC correctly. Set up the interrupt type for the IRQ_TYPE_EDGE_BOTH +as IRQ_TYPE_EDGE_RISING at the GIC. + +Fixes: f55c73aef890 ("irqchip/pdc: Add PDC interrupt controller for QCOM SoCs") +Reported-by: Evan Green +Reviewed-by: Evan Green +Signed-off-by: Lina Iyer +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/qcom-pdc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/irqchip/qcom-pdc.c ++++ b/drivers/irqchip/qcom-pdc.c +@@ -124,6 +124,7 @@ static int qcom_pdc_gic_set_type(struct + break; + case IRQ_TYPE_EDGE_BOTH: + pdc_type = PDC_EDGE_DUAL; ++ type = IRQ_TYPE_EDGE_RISING; + break; + case IRQ_TYPE_LEVEL_HIGH: + pdc_type = PDC_LEVEL_HIGH; diff --git a/queue-4.19/iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch b/queue-4.19/iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch new file mode 100644 index 00000000000..03fd494a31b --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Luca Coelho +Date: Mon, 11 Jun 2018 11:15:17 +0300 +Subject: iwlwifi: mvm: check for n_profiles validity in EWRD ACPI + +From: Luca Coelho + +[ Upstream commit 2e1976bb75263fbad918e82184b16a23bd721546 ] + +When reading the profiles from the EWRD table in ACPI, we loop over +the data and set it into our internal table. We use the number of +profiles specified in ACPI without checking its validity, so if the +ACPI table is corrupted and the number is larger than our array size, +we will try to make an out-of-bounds access. + +Fix this by making sure the value specified in the ACPI table is +valid. + +Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table") +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -704,8 +704,12 @@ static int iwl_mvm_sar_get_ewrd_table(st + enabled = !!(wifi_pkg->package.elements[1].integer.value); + n_profiles = wifi_pkg->package.elements[2].integer.value; + +- /* in case of BIOS bug */ +- if (n_profiles <= 0) { ++ /* ++ * Check the validity of n_profiles. The EWRD profiles start ++ * from index 1, so the maximum value allowed here is ++ * ACPI_SAR_PROFILES_NUM - 1. ++ */ ++ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) { + ret = -EINVAL; + goto out_free; + } diff --git a/queue-4.19/iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch b/queue-4.19/iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch new file mode 100644 index 00000000000..64d6e81ffce --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch @@ -0,0 +1,116 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Emmanuel Grumbach +Date: Wed, 13 Jun 2018 11:49:20 +0300 +Subject: iwlwifi: mvm: clear HW_RESTART_REQUESTED when stopping the interface + +From: Emmanuel Grumbach + +[ Upstream commit 155f7e0441cd121b1e673d465a35e99f4b9b2f0b ] + +Fix a bug that happens in the following scenario: +1) suspend without WoWLAN +2) mac80211 calls drv_stop because of the suspend +3) __iwl_mvm_mac_stop deallocates the aux station +4) during drv_stop the firmware crashes +5) iwlmvm: + * sets IWL_MVM_STATUS_HW_RESTART_REQUESTED + * asks mac80211 to kick the restart flow +6) mac80211 puts the restart worker into a freezable + queue which means that the worker will not run for now + since the workqueue is already frozen +7) ... +8) resume +9) mac80211 runs ieee80211_reconfig as part of the resume +10) mac80211 detects that a restart flow has been requested + and that we are now resuming from suspend and cancels + the restart worker +11) mac80211 calls drv_start() +12) __iwl_mvm_mac_start checks that IWL_MVM_STATUS_HW_RESTART_REQUESTED + clears it, sets IWL_MVM_STATUS_IN_HW_RESTART and calls + iwl_mvm_restart_cleanup() +13) iwl_fw_error_dump gets called and accesses the device + to get debug data +14) iwl_mvm_up adds the aux station +15) iwl_mvm_add_aux_sta() allocates an internal station for + the aux station +16) iwl_mvm_allocate_int_sta() tests IWL_MVM_STATUS_IN_HW_RESTART + and doesn't really allocate a station ID for the aux + station +17) a new queue is added for the aux station + +Note that steps from 5 to 9 aren't really part of the +problem but were described for the sake of completeness. + +Once the iwl_mvm_mac_stop() is called, the device is not +accessible, meaning that step 12) can't succeed and we'll +see the following: + +drivers/net/wireless/intel/iwlwifi/pcie/trans.c:2122 iwl_trans_pcie_grab_nic_access+0xc0/0x1d6 [iwlwifi]() +Timeout waiting for hardware access (CSR_GP_CNTRL 0x080403d8) +Call Trace: +[] iwl_trans_pcie_grab_nic_access+0xc0/0x1d6 [iwlwifi] +[] iwl_trans_pcie_dump_regs+0x3fd/0x3fd [iwlwifi] +[] iwl_fw_error_dump+0x4f5/0xe8b [iwlwifi] +[] __iwl_mvm_mac_start+0x5a/0x21a [iwlmvm] +[] iwl_mvm_mac_start+0xd4/0x103 [iwlmvm] +[] drv_start+0xa1/0xc5 [iwl7000_mac80211] +[] ieee80211_reconfig+0x145/0xf50 [mac80211] +[] ieee80211_resume+0x62/0x66 [mac80211] +[] wiphy_resume+0xa9/0xc6 [cfg80211] + +The station id of the aux station is set to 0xff in step 3 +and because we don't really allocate a new station id for +the auxliary station (as explained in 16), we end up sending +a command to the firmware asking to connect the queue +to station id 0xff. This makes the firmware crash with the +following information: + +0x00002093 | ADVANCED_SYSASSERT +0x000002F0 | trm_hw_status0 +0x00000000 | trm_hw_status1 +0x00000B38 | branchlink2 +0x0001978C | interruptlink1 +0x00000000 | interruptlink2 +0xFF080501 | data1 +0xDEADBEEF | data2 +0xDEADBEEF | data3 +Firmware error during reconfiguration - reprobe! +FW error in SYNC CMD SCD_QUEUE_CFG + +Fix this by clearing IWL_MVM_STATUS_HW_RESTART_REQUESTED +in iwl_mvm_mac_stop(). We won't be able to collect debug +data anyway and when we will brought up again, we will +have a clean state from the firmware perspective. +Since we won't have IWL_MVM_STATUS_IN_HW_RESTART set in +step 12) we won't get to the 2093 ASSERT either. + +Fixes: bf8b286f86fc ("iwlwifi: mvm: defer setting IWL_MVM_STATUS_IN_HW_RESTART") +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -1233,12 +1233,15 @@ void __iwl_mvm_mac_stop(struct iwl_mvm * + iwl_mvm_del_aux_sta(mvm); + + /* +- * Clear IN_HW_RESTART flag when stopping the hw (as restart_complete() +- * won't be called in this case). ++ * Clear IN_HW_RESTART and HW_RESTART_REQUESTED flag when stopping the ++ * hw (as restart_complete() won't be called in this case) and mac80211 ++ * won't execute the restart. + * But make sure to cleanup interfaces that have gone down before/during + * HW restart was requested. + */ +- if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) ++ if (test_and_clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) || ++ test_and_clear_bit(IWL_MVM_STATUS_HW_RESTART_REQUESTED, ++ &mvm->status)) + ieee80211_iterate_interfaces(mvm->hw, 0, + iwl_mvm_cleanup_iterator, mvm); + diff --git a/queue-4.19/iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch b/queue-4.19/iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch new file mode 100644 index 00000000000..461bdc4f54f --- /dev/null +++ b/queue-4.19/iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sara Sharon +Date: Tue, 1 May 2018 14:54:22 +0300 +Subject: iwlwifi: mvm: fix BAR seq ctrl reporting + +From: Sara Sharon + +[ Upstream commit 941ab4eb66c10bc5c7234e83a7a858b2806ed151 ] + +There is a bug in FW where the sequence control may be +incorrect, and the driver overrides it with the value +of the ieee80211 header. + +However, in BAR there is no sequence control in the header, +which result with arbitrary sequence. + +This access to an unknown location is bad and it makes the +logs very confusing - so fix it. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -1405,6 +1405,7 @@ static void iwl_mvm_rx_tx_cmd_single(str + while (!skb_queue_empty(&skbs)) { + struct sk_buff *skb = __skb_dequeue(&skbs); + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); ++ struct ieee80211_hdr *hdr = (void *)skb->data; + bool flushed = false; + + skb_freed++; +@@ -1449,11 +1450,11 @@ static void iwl_mvm_rx_tx_cmd_single(str + info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK; + info->flags &= ~IEEE80211_TX_CTL_AMPDU; + +- /* W/A FW bug: seq_ctl is wrong when the status isn't success */ +- if (status != TX_STATUS_SUCCESS) { +- struct ieee80211_hdr *hdr = (void *)skb->data; ++ /* W/A FW bug: seq_ctl is wrong upon failure / BAR frame */ ++ if (ieee80211_is_back_req(hdr->frame_control)) ++ seq_ctl = 0; ++ else if (status != TX_STATUS_SUCCESS) + seq_ctl = le16_to_cpu(hdr->seq_ctrl); +- } + + if (unlikely(!seq_ctl)) { + struct ieee80211_hdr *hdr = (void *)skb->data; diff --git a/queue-4.19/iwlwifi-pcie-avoid-empty-free-rb-queue.patch b/queue-4.19/iwlwifi-pcie-avoid-empty-free-rb-queue.patch new file mode 100644 index 00000000000..c1943d1293d --- /dev/null +++ b/queue-4.19/iwlwifi-pcie-avoid-empty-free-rb-queue.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Shaul Triebitz +Date: Wed, 6 Jun 2018 17:20:58 +0300 +Subject: iwlwifi: pcie: avoid empty free RB queue + +From: Shaul Triebitz + +[ Upstream commit 868a1e863f95183f00809363fefba6d4f5bcd116 ] + +If all free RB queues are empty, the driver will never restock the +free RB queue. That's because the restocking happens in the Rx flow, +and if the free queue is empty there will be no Rx. + +Although there's a background worker (a.k.a. allocator) allocating +memory for RBs so that the Rx handler can restock them, the worker may +run only after the free queue has become empty (and then it is too +late for restocking as explained above). + +There is a solution for that called 'emergency': If the number of used +RB's reaches half the amount of all RB's, the Rx handler will not wait +for the allocator but immediately allocate memory for the used RB's +and restock the free queue. + +But, since the used RB's is per queue, it may happen that the used +RB's are spread between the queues such that the emergency check will +fail for each of the queues +(and still run out of RBs, causing the above symptom). + +To fix it, move to emergency mode if the sum of *all* used RBs (for +all Rx queues) reaches half the amount of all RB's + +Signed-off-by: Shaul Triebitz +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 32 +++++++++++++++++---------- + 1 file changed, 21 insertions(+), 11 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -1144,6 +1144,14 @@ void iwl_pcie_rx_free(struct iwl_trans * + kfree(trans_pcie->rxq); + } + ++static void iwl_pcie_rx_move_to_allocator(struct iwl_rxq *rxq, ++ struct iwl_rb_allocator *rba) ++{ ++ spin_lock(&rba->lock); ++ list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty); ++ spin_unlock(&rba->lock); ++} ++ + /* + * iwl_pcie_rx_reuse_rbd - Recycle used RBDs + * +@@ -1175,9 +1183,7 @@ static void iwl_pcie_rx_reuse_rbd(struct + if ((rxq->used_count % RX_CLAIM_REQ_ALLOC) == RX_POST_REQ_ALLOC) { + /* Move the 2 RBDs to the allocator ownership. + Allocator has another 6 from pool for the request completion*/ +- spin_lock(&rba->lock); +- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty); +- spin_unlock(&rba->lock); ++ iwl_pcie_rx_move_to_allocator(rxq, rba); + + atomic_inc(&rba->req_pending); + queue_work(rba->alloc_wq, &rba->rx_alloc); +@@ -1396,10 +1402,18 @@ restart: + IWL_DEBUG_RX(trans, "Q %d: HW = SW = %d\n", rxq->id, r); + + while (i != r) { ++ struct iwl_rb_allocator *rba = &trans_pcie->rba; + struct iwl_rx_mem_buffer *rxb; +- +- if (unlikely(rxq->used_count == rxq->queue_size / 2)) ++ /* number of RBDs still waiting for page allocation */ ++ u32 rb_pending_alloc = ++ atomic_read(&trans_pcie->rba.req_pending) * ++ RX_CLAIM_REQ_ALLOC; ++ ++ if (unlikely(rb_pending_alloc >= rxq->queue_size / 2 && ++ !emergency)) { ++ iwl_pcie_rx_move_to_allocator(rxq, rba); + emergency = true; ++ } + + rxb = iwl_pcie_get_rxb(trans, rxq, i); + if (!rxb) +@@ -1421,17 +1435,13 @@ restart: + iwl_pcie_rx_allocator_get(trans, rxq); + + if (rxq->used_count % RX_CLAIM_REQ_ALLOC == 0 && !emergency) { +- struct iwl_rb_allocator *rba = &trans_pcie->rba; +- + /* Add the remaining empty RBDs for allocator use */ +- spin_lock(&rba->lock); +- list_splice_tail_init(&rxq->rx_used, &rba->rbd_empty); +- spin_unlock(&rba->lock); ++ iwl_pcie_rx_move_to_allocator(rxq, rba); + } else if (emergency) { + count++; + if (count == 8) { + count = 0; +- if (rxq->used_count < rxq->queue_size / 3) ++ if (rb_pending_alloc < rxq->queue_size / 3) + emergency = false; + + rxq->read = i; diff --git a/queue-4.19/ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch b/queue-4.19/ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch new file mode 100644 index 00000000000..740f07e7dde --- /dev/null +++ b/queue-4.19/ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Shannon Nelson +Date: Wed, 22 Aug 2018 16:47:14 -0700 +Subject: ixgbe: disallow IPsec Tx offload when in SR-IOV mode + +From: Shannon Nelson + +[ Upstream commit 47b6f50077e68bcd544f657526dad4bfdce7e87d ] + +There seems to be a problem in the x540's internal switch wherein if SR-IOV +mode is enabled and an offloaded IPsec packet is sent to a local VF, +the packet is silently dropped. This might never be a problem as it is +somewhat a corner case, but if someone happens to be using IPsec offload +from the PF to a VF that just happens to get migrated to the local box, +communication will mysteriously fail. + +Not good. + +A simple way to protect from this is to simply not allow any IPsec offloads +for outgoing packets when num_vfs != 0. This doesn't help any offloads that +were created before SR-IOV was enabled, but we'll get to that later. + +Signed-off-by: Shannon Nelson +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ipsec.c +@@ -676,6 +676,9 @@ static int ixgbe_ipsec_add_sa(struct xfr + } else { + struct tx_sa tsa; + ++ if (adapter->num_vfs) ++ return -EOPNOTSUPP; ++ + /* find the first unused index */ + ret = ixgbe_ipsec_find_empty_idx(ipsec, false); + if (ret < 0) { diff --git a/queue-4.19/ixgbevf-vf2vf-tcp-rss.patch b/queue-4.19/ixgbevf-vf2vf-tcp-rss.patch new file mode 100644 index 00000000000..1eb51f1425b --- /dev/null +++ b/queue-4.19/ixgbevf-vf2vf-tcp-rss.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sebastian Basierski +Date: Thu, 9 Aug 2018 11:45:40 +0200 +Subject: ixgbevf: VF2VF TCP RSS + +From: Sebastian Basierski + +[ Upstream commit 7fb94bd58dd6650a0158e68d414e185077d8b57a ] + +While VF2VF with RSS communication, RSS Type were wrongly recognized +and RSS hash was not calculated as it should be. Packets was +distributed on various queues by accident. +This commit fixes that behaviour and causes proper RSS Type recognition. + +Signed-off-by: Sebastian Basierski +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -3849,6 +3849,10 @@ static void ixgbevf_tx_csum(struct ixgbe + skb_checksum_help(skb); + goto no_csum; + } ++ ++ if (first->protocol == htons(ETH_P_IP)) ++ type_tucmd |= IXGBE_ADVTXD_TUCMD_IPV4; ++ + /* update TX checksum flag */ + first->tx_flags |= IXGBE_TX_FLAGS_CSUM; + vlan_macip_lens = skb_checksum_start_offset(skb) - diff --git a/queue-4.19/kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch b/queue-4.19/kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch new file mode 100644 index 00000000000..a2d094568d3 --- /dev/null +++ b/queue-4.19/kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch @@ -0,0 +1,91 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Masami Hiramatsu +Date: Tue, 11 Sep 2018 19:20:40 +0900 +Subject: kprobes: Return error if we fail to reuse kprobe instead of BUG_ON() + +From: Masami Hiramatsu + +[ Upstream commit 819319fc93461c07b9cdb3064f154bd8cfd48172 ] + +Make reuse_unused_kprobe() to return error code if +it fails to reuse unused kprobe for optprobe instead +of calling BUG_ON(). + +Signed-off-by: Masami Hiramatsu +Cc: Anil S Keshavamurthy +Cc: David S . Miller +Cc: Linus Torvalds +Cc: Naveen N . Rao +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/153666124040.21306.14150398706331307654.stgit@devbox +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/kprobes.c | 27 ++++++++++++++++++++------- + 1 file changed, 20 insertions(+), 7 deletions(-) + +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -700,9 +700,10 @@ static void unoptimize_kprobe(struct kpr + } + + /* Cancel unoptimizing for reusing */ +-static void reuse_unused_kprobe(struct kprobe *ap) ++static int reuse_unused_kprobe(struct kprobe *ap) + { + struct optimized_kprobe *op; ++ int ret; + + BUG_ON(!kprobe_unused(ap)); + /* +@@ -714,8 +715,12 @@ static void reuse_unused_kprobe(struct k + /* Enable the probe again */ + ap->flags &= ~KPROBE_FLAG_DISABLED; + /* Optimize it again (remove from op->list) */ +- BUG_ON(!kprobe_optready(ap)); ++ ret = kprobe_optready(ap); ++ if (ret) ++ return ret; ++ + optimize_kprobe(ap); ++ return 0; + } + + /* Remove optimized instructions */ +@@ -940,11 +945,16 @@ static void __disarm_kprobe(struct kprob + #define kprobe_disarmed(p) kprobe_disabled(p) + #define wait_for_kprobe_optimizer() do {} while (0) + +-/* There should be no unused kprobes can be reused without optimization */ +-static void reuse_unused_kprobe(struct kprobe *ap) ++static int reuse_unused_kprobe(struct kprobe *ap) + { ++ /* ++ * If the optimized kprobe is NOT supported, the aggr kprobe is ++ * released at the same time that the last aggregated kprobe is ++ * unregistered. ++ * Thus there should be no chance to reuse unused kprobe. ++ */ + printk(KERN_ERR "Error: There should be no unused kprobe here.\n"); +- BUG_ON(kprobe_unused(ap)); ++ return -EINVAL; + } + + static void free_aggr_kprobe(struct kprobe *p) +@@ -1318,9 +1328,12 @@ static int register_aggr_kprobe(struct k + goto out; + } + init_aggr_kprobe(ap, orig_p); +- } else if (kprobe_unused(ap)) ++ } else if (kprobe_unused(ap)) { + /* This probe is going to die. Rescue it */ +- reuse_unused_kprobe(ap); ++ ret = reuse_unused_kprobe(ap); ++ if (ret) ++ goto out; ++ } + + if (kprobe_gone(ap)) { + /* diff --git a/queue-4.19/kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch b/queue-4.19/kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch new file mode 100644 index 00000000000..09676b7c5a7 --- /dev/null +++ b/queue-4.19/kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch @@ -0,0 +1,64 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jim Mattson +Date: Fri, 21 Sep 2018 10:36:17 -0700 +Subject: KVM: nVMX: Clear reserved bits of #DB exit qualification + +From: Jim Mattson + +[ Upstream commit cfb634fe3052aefc4e1360fa322018c9a0b49755 ] + +According to volume 3 of the SDM, bits 63:15 and 12:4 of the exit +qualification field for debug exceptions are reserved (cleared to +0). However, the SDM is incorrect about bit 16 (corresponding to +DR6.RTM). This bit should be set if a debug exception (#DB) or a +breakpoint exception (#BP) occurred inside an RTM region while +advanced debugging of RTM transactional regions was enabled. Note that +this is the opposite of DR6.RTM, which "indicates (when clear) that a +debug exception (#DB) or breakpoint exception (#BP) occurred inside an +RTM region while advanced debugging of RTM transactional regions was +enabled." + +There is still an issue with stale DR6 bits potentially being +misreported for the current debug exception. DR6 should not have been +modified before vectoring the #DB exception, and the "new DR6 bits" +should be available somewhere, but it was and they aren't. + +Fixes: b96fb439774e1 ("KVM: nVMX: fixes to nested virt interrupt injection") +Signed-off-by: Jim Mattson +Reviewed-by: Sean Christopherson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/kvm_host.h | 1 + + arch/x86/kvm/vmx.c | 7 +++++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -177,6 +177,7 @@ enum { + + #define DR6_BD (1 << 13) + #define DR6_BS (1 << 14) ++#define DR6_BT (1 << 15) + #define DR6_RTM (1 << 16) + #define DR6_FIXED_1 0xfffe0ff0 + #define DR6_INIT 0xffff0ff0 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3294,10 +3294,13 @@ static int nested_vmx_check_exception(st + } + } else { + if (vmcs12->exception_bitmap & (1u << nr)) { +- if (nr == DB_VECTOR) ++ if (nr == DB_VECTOR) { + *exit_qual = vcpu->arch.dr6; +- else ++ *exit_qual &= ~(DR6_FIXED_1 | DR6_BT); ++ *exit_qual ^= DR6_RTM; ++ } else { + *exit_qual = 0; ++ } + return 1; + } + } diff --git a/queue-4.19/libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch b/queue-4.19/libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch new file mode 100644 index 00000000000..92b7c5c3c5e --- /dev/null +++ b/queue-4.19/libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Diego Viola +Date: Fri, 26 Oct 2018 10:45:16 -0300 +Subject: libata: Apply NOLPM quirk for SAMSUNG MZ7TD256HAFV-000L9 + +From: Diego Viola + +[ Upstream commit a435ab4f80f983c53b4ca4f8c12b3ddd3ca17670 ] + +med_power_with_dipm causes my T450 to freeze with a SAMSUNG +MZ7TD256HAFV-000L9 SSD (firmware DXT02L5Q). + +Switching the LPM to max_performance fixes this issue. + +Acked-by: Hans de Goede +Signed-off-by: Diego Viola +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4553,6 +4553,7 @@ static const struct ata_blacklist_entry + /* These specific Samsung models/firmware-revs do not handle LPM well */ + { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM, }, + { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM, }, ++ { "SAMSUNG MZ7TD256HAFV-000L9", "DXT02L5Q", ATA_HORKAGE_NOLPM, }, + + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | diff --git a/queue-4.19/libertas_tf-prevent-underflow-in-process_cmdrequest.patch b/queue-4.19/libertas_tf-prevent-underflow-in-process_cmdrequest.patch new file mode 100644 index 00000000000..6b8905963ea --- /dev/null +++ b/queue-4.19/libertas_tf-prevent-underflow-in-process_cmdrequest.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Dan Carpenter +Date: Tue, 14 Aug 2018 12:07:48 +0300 +Subject: libertas_tf: prevent underflow in process_cmdrequest() + +From: Dan Carpenter + +[ Upstream commit 3348ef6a6a126706d6a73ed40c18d8033df72783 ] + +If recvlength is less than MESSAGE_HEADER_LEN (4) we would end up +corrupting memory. + +Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/libertas_tf/if_usb.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c ++++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c +@@ -605,9 +605,10 @@ static inline void process_cmdrequest(in + { + unsigned long flags; + +- if (recvlength > LBS_CMD_BUFFER_SIZE) { ++ if (recvlength < MESSAGE_HEADER_LEN || ++ recvlength > LBS_CMD_BUFFER_SIZE) { + lbtf_deb_usbd(&cardp->udev->dev, +- "The receive buffer is too large\n"); ++ "The receive buffer is invalid: %d\n", recvlength); + kfree_skb(skb); + return; + } diff --git a/queue-4.19/lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch b/queue-4.19/lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch new file mode 100644 index 00000000000..42002d30e81 --- /dev/null +++ b/queue-4.19/lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: "Javier González" +Date: Tue, 9 Oct 2018 13:11:35 +0200 +Subject: lightnvm: pblk: fix race condition on metadata I/O + +From: "Javier González" + +[ Upstream commit d8adaa3b86324c6186d0adf74bc256bdacfffdb6 ] + +In pblk, when a new line is allocated, metadata for the previously +written line is scheduled. This is done through a fixed memory region +that is shared through time and contexts across different lines and +therefore protected by a lock. Unfortunately, this lock is not properly +covering all the metadata used for sharing this memory regions, +resulting in a race condition. + +This patch fixes this race condition by protecting this metadata +properly. + +Fixes: dd2a43437337 ("lightnvm: pblk: sched. metadata on write thread") +Signed-off-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-write.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/lightnvm/pblk-write.c ++++ b/drivers/lightnvm/pblk-write.c +@@ -417,12 +417,11 @@ int pblk_submit_meta_io(struct pblk *pbl + rqd->ppa_list[i] = addr_to_gen_ppa(pblk, paddr, id); + } + ++ spin_lock(&l_mg->close_lock); + emeta->mem += rq_len; +- if (emeta->mem >= lm->emeta_len[0]) { +- spin_lock(&l_mg->close_lock); ++ if (emeta->mem >= lm->emeta_len[0]) + list_del(&meta_line->list); +- spin_unlock(&l_mg->close_lock); +- } ++ spin_unlock(&l_mg->close_lock); + + pblk_down_page(pblk, rqd->ppa_list, rqd->nr_ppas); + +@@ -491,14 +490,15 @@ static struct pblk_line *pblk_should_sub + struct pblk_line *meta_line; + + spin_lock(&l_mg->close_lock); +-retry: + if (list_empty(&l_mg->emeta_list)) { + spin_unlock(&l_mg->close_lock); + return NULL; + } + meta_line = list_first_entry(&l_mg->emeta_list, struct pblk_line, list); +- if (meta_line->emeta->mem >= lm->emeta_len[0]) +- goto retry; ++ if (meta_line->emeta->mem >= lm->emeta_len[0]) { ++ spin_unlock(&l_mg->close_lock); ++ return NULL; ++ } + spin_unlock(&l_mg->close_lock); + + if (!pblk_valid_meta_ppa(pblk, meta_line, data_rqd)) diff --git a/queue-4.19/lightnvm-pblk-fix-race-on-sysfs-line-state.patch b/queue-4.19/lightnvm-pblk-fix-race-on-sysfs-line-state.patch new file mode 100644 index 00000000000..655da8a3de6 --- /dev/null +++ b/queue-4.19/lightnvm-pblk-fix-race-on-sysfs-line-state.patch @@ -0,0 +1,64 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: "Javier González" +Date: Tue, 9 Oct 2018 13:12:07 +0200 +Subject: lightnvm: pblk: fix race on sysfs line state + +From: "Javier González" + +[ Upstream commit 44cdbdc657b23f75736eca3e88b781f009104363 ] + +pblk exposes a sysfs interface that represents its internal state. Part +of this state is the map bitmap for the current open line, which should +be protected by the line lock to avoid a race when freeing the line +metadata. Currently, it is not. + +This patch makes sure that the line state is consistent and NULL +bitmap pointers are not dereferenced. + +Signed-off-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-core.c | 5 +++-- + drivers/lightnvm/pblk-sysfs.c | 8 +++++++- + 2 files changed, 10 insertions(+), 3 deletions(-) + +--- a/drivers/lightnvm/pblk-core.c ++++ b/drivers/lightnvm/pblk-core.c +@@ -1539,13 +1539,14 @@ struct pblk_line *pblk_line_replace_data + struct pblk_line *cur, *new = NULL; + unsigned int left_seblks; + +- cur = l_mg->data_line; + new = l_mg->data_next; + if (!new) + goto out; +- l_mg->data_line = new; + + spin_lock(&l_mg->free_lock); ++ cur = l_mg->data_line; ++ l_mg->data_line = new; ++ + pblk_line_setup_metadata(new, l_mg, &pblk->lm); + spin_unlock(&l_mg->free_lock); + +--- a/drivers/lightnvm/pblk-sysfs.c ++++ b/drivers/lightnvm/pblk-sysfs.c +@@ -262,8 +262,14 @@ static ssize_t pblk_sysfs_lines(struct p + sec_in_line = l_mg->data_line->sec_in_line; + meta_weight = bitmap_weight(&l_mg->meta_bitmap, + PBLK_DATA_LINES); +- map_weight = bitmap_weight(l_mg->data_line->map_bitmap, ++ ++ spin_lock(&l_mg->data_line->lock); ++ if (l_mg->data_line->map_bitmap) ++ map_weight = bitmap_weight(l_mg->data_line->map_bitmap, + lm->sec_per_line); ++ else ++ map_weight = 0; ++ spin_unlock(&l_mg->data_line->lock); + } + spin_unlock(&l_mg->free_lock); + diff --git a/queue-4.19/lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch b/queue-4.19/lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch new file mode 100644 index 00000000000..aaf44dbbef0 --- /dev/null +++ b/queue-4.19/lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch @@ -0,0 +1,80 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jia-Ju Bai +Date: Tue, 9 Oct 2018 13:12:00 +0200 +Subject: lightnvm: pblk: fix two sleep-in-atomic-context bugs + +From: Jia-Ju Bai + +[ Upstream commit 7325b4bbe5952e3e939f15de812f2ee0c0d33ca9 ] + +The driver may sleep with holding a spinlock. + +The function call paths (from bottom to top) in Linux-4.16 are: + +[FUNC] nvm_dev_dma_alloc(GFP_KERNEL) +drivers/lightnvm/pblk-core.c, 754: + nvm_dev_dma_alloc in pblk_line_submit_smeta_io +drivers/lightnvm/pblk-core.c, 1048: + pblk_line_submit_smeta_io in pblk_line_init_bb +drivers/lightnvm/pblk-core.c, 1434: + pblk_line_init_bb in pblk_line_replace_data +drivers/lightnvm/pblk-recovery.c, 980: + pblk_line_replace_data in pblk_recov_l2p +drivers/lightnvm/pblk-recovery.c, 976: + spin_lock in pblk_recov_l2p + +[FUNC] bio_map_kern(GFP_KERNEL) +drivers/lightnvm/pblk-core.c, 762: + bio_map_kern in pblk_line_submit_smeta_io +drivers/lightnvm/pblk-core.c, 1048: + pblk_line_submit_smeta_io in pblk_line_init_bb +drivers/lightnvm/pblk-core.c, 1434: + pblk_line_init_bb in pblk_line_replace_data +drivers/lightnvm/pblk-recovery.c, 980: + pblk_line_replace_data in pblk_recov_l2p +drivers/lightnvm/pblk-recovery.c, 976: + spin_lock in pblk_recov_l2p + +To fix these bugs, the call to pblk_line_replace_data() +is moved out of the spinlock protection. + +These bugs are found by my static analysis tool DSAC. + +Signed-off-by: Jia-Ju Bai +Reviewed-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-recovery.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/lightnvm/pblk-recovery.c ++++ b/drivers/lightnvm/pblk-recovery.c +@@ -956,12 +956,14 @@ next: + } + } + +- spin_lock(&l_mg->free_lock); + if (!open_lines) { ++ spin_lock(&l_mg->free_lock); + WARN_ON_ONCE(!test_and_clear_bit(meta_line, + &l_mg->meta_bitmap)); ++ spin_unlock(&l_mg->free_lock); + pblk_line_replace_data(pblk); + } else { ++ spin_lock(&l_mg->free_lock); + /* Allocate next line for preparation */ + l_mg->data_next = pblk_line_get(pblk); + if (l_mg->data_next) { +@@ -969,8 +971,8 @@ next: + l_mg->data_next->type = PBLK_LINETYPE_DATA; + is_next = 1; + } ++ spin_unlock(&l_mg->free_lock); + } +- spin_unlock(&l_mg->free_lock); + + if (is_next) + pblk_line_erase(pblk, l_mg->data_next); diff --git a/queue-4.19/locking-lockdep-fix-debug_locks-off-performance-problem.patch b/queue-4.19/locking-lockdep-fix-debug_locks-off-performance-problem.patch new file mode 100644 index 00000000000..e99a3d20c7b --- /dev/null +++ b/queue-4.19/locking-lockdep-fix-debug_locks-off-performance-problem.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Waiman Long +Date: Thu, 18 Oct 2018 21:45:17 -0400 +Subject: locking/lockdep: Fix debug_locks off performance problem + +From: Waiman Long + +[ Upstream commit 9506a7425b094d2f1d9c877ed5a78f416669269b ] + +It was found that when debug_locks was turned off because of a problem +found by the lockdep code, the system performance could drop quite +significantly when the lock_stat code was also configured into the +kernel. For instance, parallel kernel build time on a 4-socket x86-64 +server nearly doubled. + +Further analysis into the cause of the slowdown traced back to the +frequent call to debug_locks_off() from the __lock_acquired() function +probably due to some inconsistent lockdep states with debug_locks +off. The debug_locks_off() function did an unconditional atomic xchg +to write a 0 value into debug_locks which had already been set to 0. +This led to severe cacheline contention in the cacheline that held +debug_locks. As debug_locks is being referenced in quite a few different +places in the kernel, this greatly slow down the system performance. + +To prevent that trashing of debug_locks cacheline, lock_acquired() +and lock_contended() now checks the state of debug_locks before +proceeding. The debug_locks_off() function is also modified to check +debug_locks before calling __debug_locks_off(). + +Signed-off-by: Waiman Long +Cc: Andrew Morton +Cc: Linus Torvalds +Cc: Paul E. McKenney +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Will Deacon +Link: http://lkml.kernel.org/r/1539913518-15598-1-git-send-email-longman@redhat.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 4 ++-- + lib/debug_locks.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -4122,7 +4122,7 @@ void lock_contended(struct lockdep_map * + { + unsigned long flags; + +- if (unlikely(!lock_stat)) ++ if (unlikely(!lock_stat || !debug_locks)) + return; + + if (unlikely(current->lockdep_recursion)) +@@ -4142,7 +4142,7 @@ void lock_acquired(struct lockdep_map *l + { + unsigned long flags; + +- if (unlikely(!lock_stat)) ++ if (unlikely(!lock_stat || !debug_locks)) + return; + + if (unlikely(current->lockdep_recursion)) +--- a/lib/debug_locks.c ++++ b/lib/debug_locks.c +@@ -37,7 +37,7 @@ EXPORT_SYMBOL_GPL(debug_locks_silent); + */ + int debug_locks_off(void) + { +- if (__debug_locks_off()) { ++ if (debug_locks && __debug_locks_off()) { + if (!debug_locks_silent) { + console_verbose(); + return 1; diff --git a/queue-4.19/md-fix-invalid-stored-role-for-a-disk.patch b/queue-4.19/md-fix-invalid-stored-role-for-a-disk.patch new file mode 100644 index 00000000000..073b4d6cb6b --- /dev/null +++ b/queue-4.19/md-fix-invalid-stored-role-for-a-disk.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Shaohua Li +Date: Mon, 1 Oct 2018 18:36:36 -0700 +Subject: MD: fix invalid stored role for a disk + +From: Shaohua Li + +[ Upstream commit d595567dc4f0c1d90685ec1e2e296e2cad2643ac ] + +If we change the number of array's device after device is removed from array, +then add the device back to array, we can see that device is added as active +role instead of spare which we expected. + +Please see the below link for details: +https://marc.info/?l=linux-raid&m=153736982015076&w=2 + +This is caused by that we prefer to use device's previous role which is +recorded by saved_raid_disk, but we should respect the new number of +conf->raid_disks since it could be changed after device is removed. + +Reported-by: Gioh Kim +Tested-by: Gioh Kim +Acked-by: Guoqing Jiang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -1776,6 +1776,10 @@ static int super_1_validate(struct mddev + } else + set_bit(In_sync, &rdev->flags); + rdev->raid_disk = role; ++ if (role >= mddev->raid_disks) { ++ rdev->saved_raid_disk = -1; ++ rdev->raid_disk = -1; ++ } + break; + } + if (sb->devflags & WriteMostly1) diff --git a/queue-4.19/md-fix-memleak-for-mempool.patch b/queue-4.19/md-fix-memleak-for-mempool.patch new file mode 100644 index 00000000000..be45e4cc10a --- /dev/null +++ b/queue-4.19/md-fix-memleak-for-mempool.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jack Wang +Date: Fri, 19 Oct 2018 16:21:31 +0200 +Subject: md: fix memleak for mempool + +From: Jack Wang + +[ Upstream commit 6aaa58c994277647f8b05ffef3b9b225a2d08f36 ] + +I noticed kmemleak report memory leak when run create/stop +md in a loop, backtrace: +[<000000001ca975e7>] mempool_create_node+0x86/0xd0 +[<0000000095576bcd>] md_run+0x1057/0x1410 [md_mod] +[<000000007b45c5fc>] do_md_run+0x15/0x130 [md_mod] +[<000000001ede9ec0>] md_ioctl+0x1f49/0x25d0 [md_mod] +[<000000004142cacf>] blkdev_ioctl+0x680/0xd00 + +The root cause is we alloc mddev->flush_pool and +mddev->flush_bio_pool in md_run, but from do_md_stop +will not call into md_stop but __md_stop, move the +mempool_destroy to __md_stop fixes the problem for me. + +The bug was introduced in 5a409b4f56d5, the fixes should go to +4.18+ + +Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") +Signed-off-by: Jack Wang +Reviewed-by: Xiao Ni +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5906,14 +5906,6 @@ static void __md_stop(struct mddev *mdde + mddev->to_remove = &md_redundancy_group; + module_put(pers->owner); + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); +-} +- +-void md_stop(struct mddev *mddev) +-{ +- /* stop the array and free an attached data structures. +- * This is called from dm-raid +- */ +- __md_stop(mddev); + if (mddev->flush_bio_pool) { + mempool_destroy(mddev->flush_bio_pool); + mddev->flush_bio_pool = NULL; +@@ -5922,6 +5914,14 @@ void md_stop(struct mddev *mddev) + mempool_destroy(mddev->flush_pool); + mddev->flush_pool = NULL; + } ++} ++ ++void md_stop(struct mddev *mddev) ++{ ++ /* stop the array and free an attached data structures. ++ * This is called from dm-raid ++ */ ++ __md_stop(mddev); + bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->sync_set); + } diff --git a/queue-4.19/md-memory-leak-when-flush-bio-size-is-zero.patch b/queue-4.19/md-memory-leak-when-flush-bio-size-is-zero.patch new file mode 100644 index 00000000000..2ea3fab1c38 --- /dev/null +++ b/queue-4.19/md-memory-leak-when-flush-bio-size-is-zero.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Xiao Ni +Date: Sat, 20 Oct 2018 08:09:25 +0800 +Subject: MD: Memory leak when flush bio size is zero + +From: Xiao Ni + +[ Upstream commit af9b926de9c5986ab009e64917de87c9758bab10 ] + +flush_pool is leaked when flush bio size is zero + +Fixes: 5a409b4f56d5 ("MD: fix lock contention for flush bios") +Signed-off-by: David Jeffery +Signed-off-by: Xiao Ni +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -452,10 +452,11 @@ static void md_end_flush(struct bio *fbi + rdev_dec_pending(rdev, mddev); + + if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) ++ if (bio->bi_iter.bi_size == 0) { + /* an empty barrier - all done */ + bio_endio(bio); +- else { ++ mempool_free(fi, mddev->flush_pool); ++ } else { + INIT_WORK(&fi->flush_work, submit_flushes); + queue_work(md_wq, &fi->flush_work); + } +@@ -509,10 +510,11 @@ void md_flush_request(struct mddev *mdde + rcu_read_unlock(); + + if (atomic_dec_and_test(&fi->flush_pending)) { +- if (bio->bi_iter.bi_size == 0) ++ if (bio->bi_iter.bi_size == 0) { + /* an empty barrier - all done */ + bio_endio(bio); +- else { ++ mempool_free(fi, mddev->flush_pool); ++ } else { + INIT_WORK(&fi->flush_work, submit_flushes); + queue_work(md_wq, &fi->flush_work); + } diff --git a/queue-4.19/mfd-menelaus-fix-possible-race-condition-and-leak.patch b/queue-4.19/mfd-menelaus-fix-possible-race-condition-and-leak.patch new file mode 100644 index 00000000000..9bfa1837f9e --- /dev/null +++ b/queue-4.19/mfd-menelaus-fix-possible-race-condition-and-leak.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Alexandre Belloni +Date: Sun, 9 Sep 2018 22:48:58 +0200 +Subject: mfd: menelaus: Fix possible race condition and leak + +From: Alexandre Belloni + +[ Upstream commit 9612f8f503804d2fd2f63aa6ba1e58bba4612d96 ] + +The IRQ work is added before the struct rtc is allocated and registered, +but this struct is used in the IRQ handler. This may lead to a NULL pointer +dereference. + +Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc +before calling menelaus_add_irq_work. + +Also, this solves a possible leak as the RTC is never released. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/menelaus.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/mfd/menelaus.c ++++ b/drivers/mfd/menelaus.c +@@ -1094,6 +1094,7 @@ static void menelaus_rtc_alarm_work(stru + static inline void menelaus_rtc_init(struct menelaus_chip *m) + { + int alarm = (m->client->irq > 0); ++ int err; + + /* assume 32KDETEN pin is pulled high */ + if (!(menelaus_read_reg(MENELAUS_OSC_CTRL) & 0x80)) { +@@ -1101,6 +1102,12 @@ static inline void menelaus_rtc_init(str + return; + } + ++ m->rtc = devm_rtc_allocate_device(&m->client->dev); ++ if (IS_ERR(m->rtc)) ++ return; ++ ++ m->rtc->ops = &menelaus_rtc_ops; ++ + /* support RTC alarm; it can issue wakeups */ + if (alarm) { + if (menelaus_add_irq_work(MENELAUS_RTCALM_IRQ, +@@ -1125,10 +1132,8 @@ static inline void menelaus_rtc_init(str + menelaus_write_reg(MENELAUS_RTC_CTRL, m->rtc_control); + } + +- m->rtc = rtc_device_register(DRIVER_NAME, +- &m->client->dev, +- &menelaus_rtc_ops, THIS_MODULE); +- if (IS_ERR(m->rtc)) { ++ err = rtc_register_device(m->rtc); ++ if (err) { + if (alarm) { + menelaus_remove_irq_work(MENELAUS_RTCALM_IRQ); + device_init_wakeup(&m->client->dev, 0); diff --git a/queue-4.19/mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch b/queue-4.19/mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch new file mode 100644 index 00000000000..f8880827c26 --- /dev/null +++ b/queue-4.19/mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Yu Zhao +Date: Sun, 23 Sep 2018 14:39:24 -0600 +Subject: mmc: sdhci-pci-o2micro: Add quirk for O2 Micro dev 0x8620 rev 0x01 + +From: Yu Zhao + +[ Upstream commit 5169894982bb67486d93cc1e10151712bb86bcb6 ] + +This device reports SDHCI_CLOCK_INT_STABLE even though it's not +ready to take SDHCI_CLOCK_CARD_EN. The symptom is that reading +SDHCI_CLOCK_CONTROL after enabling the clock shows absence of the +bit from the register (e.g. expecting 0x0000fa07 = 0x0000fa03 | +SDHCI_CLOCK_CARD_EN but only observed the first operand). + +mmc1: Timeout waiting for hardware cmd interrupt. +mmc1: sdhci: ============ SDHCI REGISTER DUMP =========== +mmc1: sdhci: Sys addr: 0x00000000 | Version: 0x00000603 +mmc1: sdhci: Blk size: 0x00000000 | Blk cnt: 0x00000000 +mmc1: sdhci: Argument: 0x00000000 | Trn mode: 0x00000000 +mmc1: sdhci: Present: 0x01ff0001 | Host ctl: 0x00000001 +mmc1: sdhci: Power: 0x0000000f | Blk gap: 0x00000000 +mmc1: sdhci: Wake-up: 0x00000000 | Clock: 0x0000fa03 +mmc1: sdhci: Timeout: 0x00000000 | Int stat: 0x00000000 +mmc1: sdhci: Int enab: 0x00ff0083 | Sig enab: 0x00ff0083 +mmc1: sdhci: AC12 err: 0x00000000 | Slot int: 0x00000000 +mmc1: sdhci: Caps: 0x25fcc8bf | Caps_1: 0x00002077 +mmc1: sdhci: Cmd: 0x00000000 | Max curr: 0x005800c8 +mmc1: sdhci: Resp[0]: 0x00000000 | Resp[1]: 0x00000000 +mmc1: sdhci: Resp[2]: 0x00000000 | Resp[3]: 0x00000000 +mmc1: sdhci: Host ctl2: 0x00000008 +mmc1: sdhci: ADMA Err: 0x00000000 | ADMA Ptr: 0x00000000 +mmc1: sdhci: ============================================ + +The problem happens during wakeup from S3. Adding a delay quirk +after power up reliably fixes the problem. + +Signed-off-by: Yu Zhao +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-pci-o2micro.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/mmc/host/sdhci-pci-o2micro.c ++++ b/drivers/mmc/host/sdhci-pci-o2micro.c +@@ -490,6 +490,9 @@ int sdhci_pci_o2_probe(struct sdhci_pci_ + pci_write_config_byte(chip->pdev, O2_SD_LOCK_WP, scratch); + break; + case PCI_DEVICE_ID_O2_SEABIRD0: ++ if (chip->pdev->revision == 0x01) ++ chip->quirks |= SDHCI_QUIRK_DELAY_AFTER_POWER; ++ /* fall through */ + case PCI_DEVICE_ID_O2_SEABIRD1: + /* UnLock WP */ + ret = pci_read_config_byte(chip->pdev, diff --git a/queue-4.19/mt76x2u-run-device-cleanup-routine-if-resume-fails.patch b/queue-4.19/mt76x2u-run-device-cleanup-routine-if-resume-fails.patch new file mode 100644 index 00000000000..e4df20fcc61 --- /dev/null +++ b/queue-4.19/mt76x2u-run-device-cleanup-routine-if-resume-fails.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Lorenzo Bianconi +Date: Fri, 24 Aug 2018 10:17:49 +0200 +Subject: mt76x2u: run device cleanup routine if resume fails + +From: Lorenzo Bianconi + +[ Upstream commit 9b2fd48d36e25b9be9ddb8be8cc1eb263a1d1843 ] + +Cleanup {tx,rx} and mcu queues if resume operation fails + +Fixes: ee676cd5017c ("mt76: add driver code for MT76x2u based devices") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt76x2_usb.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_usb.c +@@ -107,16 +107,24 @@ static int __maybe_unused mt76x2u_resume + mt76u_mcu_complete_urb, + &usb->mcu.cmpl); + if (err < 0) +- return err; ++ goto err; + + err = mt76u_submit_rx_buffers(&dev->mt76); + if (err < 0) +- return err; ++ goto err; + + tasklet_enable(&usb->rx_tasklet); + tasklet_enable(&usb->tx_tasklet); + +- return mt76x2u_init_hardware(dev); ++ err = mt76x2u_init_hardware(dev); ++ if (err < 0) ++ goto err; ++ ++ return 0; ++ ++err: ++ mt76x2u_cleanup(dev); ++ return err; + } + + MODULE_DEVICE_TABLE(usb, mt76x2u_device_table); diff --git a/queue-4.19/mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch b/queue-4.19/mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch new file mode 100644 index 00000000000..7ad6f77f4a1 --- /dev/null +++ b/queue-4.19/mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: "Gustavo A. R. Silva" +Date: Tue, 18 Sep 2018 08:55:55 -0500 +Subject: mtd: rawnand: atmel: Fix potential NULL pointer dereference + +From: "Gustavo A. R. Silva" + +[ Upstream commit fbed20280d912449cfb40c382cb55e3d11502587 ] + +There is a potential execution path in which function +of_find_compatible_node() returns NULL. In such a case, +we end up having a NULL pointer dereference when accessing +pointer *nfc_np* in function of_clk_get(). + +So, we better don't take any chances and fix this by null +checking pointer *nfc_np* before calling of_clk_get(). + +Addresses-Coverity-ID: 1473052 ("Dereference null return value") +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Boris Brezillon +Acked-by: Tudor Ambarus +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -2063,6 +2063,10 @@ atmel_hsmc_nand_controller_legacy_init(s + nand_np = dev->of_node; + nfc_np = of_find_compatible_node(dev->of_node, NULL, + "atmel,sama5d3-nfc"); ++ if (!nfc_np) { ++ dev_err(dev, "Could not find device node for sama5d3-nfc\n"); ++ return -ENODEV; ++ } + + nc->clk = of_clk_get(nfc_np, 0); + if (IS_ERR(nc->clk)) { diff --git a/queue-4.19/mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch b/queue-4.19/mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch new file mode 100644 index 00000000000..515334508a9 --- /dev/null +++ b/queue-4.19/mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch @@ -0,0 +1,87 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Masahiro Yamada +Date: Fri, 28 Sep 2018 13:16:01 +0900 +Subject: mtd: rawnand: denali: set SPARE_AREA_SKIP_BYTES register to 8 if unset + +From: Masahiro Yamada + +[ Upstream commit 0d55c668b218a1db68b5044bce4de74e1bd0f0c8 ] + +NAND devices need additional data area (OOB) for error correction, +but it is also used for Bad Block Marker (BBM). In many cases, the +first byte in OOB is used for BBM, but the location actually depends +on chip vendors. The NAND controller should preserve the precious +BBM to keep track of bad blocks. + +In Denali IP, the SPARE_AREA_SKIP_BYTES register is used to specify +the number of bytes to skip from the start of OOB. The ECC engine +will automatically skip the specified number of bytes when it gets +access to OOB area. + +The same value for SPARE_AREA_SKIP_BYTES should be used between +firmware and the operating system if you intend to use the NAND +device across the control hand-off. + +In fact, the current denali.c code expects firmware to have already +set the SPARE_AREA_SKIP_BYTES register, then reads the value out. + +If no firmware (or bootloader) has initialized the controller, the +register value is zero, which is the default after power-on-reset. +In other words, the Linux driver cannot initialize the controller +by itself. + +Some possible solutions are: + + [1] Add a DT property to specify the skipped bytes in OOB + [2] Associate the preferred value with compatible + [3] Hard-code the default value in the driver + +My first attempt was [1], but in the review process, [3] was suggested +as a counter-implementation. +(https://lore.kernel.org/patchwork/patch/983055/) + +The default value 8 was chosen to match to the boot ROM of the UniPhier +platform. The preferred value may vary by platform. If so, please +trade up to a different solution. + +Signed-off-by: Masahiro Yamada +Reviewed-by: Boris Brezillon +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/denali.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +--- a/drivers/mtd/nand/raw/denali.c ++++ b/drivers/mtd/nand/raw/denali.c +@@ -28,6 +28,7 @@ + MODULE_LICENSE("GPL"); + + #define DENALI_NAND_NAME "denali-nand" ++#define DENALI_DEFAULT_OOB_SKIP_BYTES 8 + + /* for Indexed Addressing */ + #define DENALI_INDEXED_CTRL 0x00 +@@ -1105,12 +1106,17 @@ static void denali_hw_init(struct denali + denali->revision = swab16(ioread32(denali->reg + REVISION)); + + /* +- * tell driver how many bit controller will skip before +- * writing ECC code in OOB, this register may be already +- * set by firmware. So we read this value out. +- * if this value is 0, just let it be. ++ * Set how many bytes should be skipped before writing data in OOB. ++ * If a non-zero value has already been set (by firmware or something), ++ * just use it. Otherwise, set the driver default. + */ + denali->oob_skip_bytes = ioread32(denali->reg + SPARE_AREA_SKIP_BYTES); ++ if (!denali->oob_skip_bytes) { ++ denali->oob_skip_bytes = DENALI_DEFAULT_OOB_SKIP_BYTES; ++ iowrite32(denali->oob_skip_bytes, ++ denali->reg + SPARE_AREA_SKIP_BYTES); ++ } ++ + denali_detect_max_banks(denali); + iowrite32(0x0F, denali->reg + RB_PIN_ENABLED); + iowrite32(CHIP_EN_DONT_CARE__FLAG, denali->reg + CHIP_ENABLE_DONT_CARE); diff --git a/queue-4.19/net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch b/queue-4.19/net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch new file mode 100644 index 00000000000..0db4c736787 --- /dev/null +++ b/queue-4.19/net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Andrew Lunn +Date: Sun, 2 Sep 2018 18:13:14 +0200 +Subject: net: dsa: mv88e6xxx: Fix writing to a PHY page. + +From: Andrew Lunn + +[ Upstream commit c309b158090d788e96ee597444965cb79b040484 ] + +After changing to the needed page, actually write the value to the +register! + +Fixes: 09cb7dfd3f14 ("net: dsa: mv88e6xxx: describe PHY page and SerDes") +Signed-off-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mv88e6xxx/phy.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/dsa/mv88e6xxx/phy.c ++++ b/drivers/net/dsa/mv88e6xxx/phy.c +@@ -110,6 +110,9 @@ int mv88e6xxx_phy_page_write(struct mv88 + err = mv88e6xxx_phy_page_get(chip, phy, page); + if (!err) { + err = mv88e6xxx_phy_write(chip, phy, MV88E6XXX_PHY_PAGE, page); ++ if (!err) ++ err = mv88e6xxx_phy_write(chip, phy, reg, val); ++ + mv88e6xxx_phy_page_put(chip, phy); + } + diff --git a/queue-4.19/net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch b/queue-4.19/net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch new file mode 100644 index 00000000000..15610c26f13 --- /dev/null +++ b/queue-4.19/net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Ivan Khoronzhuk +Date: Mon, 22 Oct 2018 21:51:36 +0300 +Subject: net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode + +From: Ivan Khoronzhuk + +[ Upstream commit 9737cc99dd14b5b8b9d267618a6061feade8ea68 ] + +After flushing all mcast entries from the table, the ones contained in +mc list of ndev are not restored when promisc mode is toggled off, +because they are considered as synched with ALE, thus, in order to +restore them after promisc mode - reset syncing info. This fix +touches only switch mode devices, including single port boards +like Beagle Bone. + +Fixes: commit 5da1948969bc +("net: ethernet: ti: cpsw: fix lost of mcast packets while rx_mode update") + +Signed-off-by: Ivan Khoronzhuk +Reviewed-by: Grygorii Strashko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -642,6 +642,7 @@ static void cpsw_set_promiscious(struct + + /* Clear all mcast from ALE */ + cpsw_ale_flush_multicast(ale, ALE_ALL_PORTS, -1); ++ __dev_mc_unsync(ndev, NULL); + + /* Flood All Unicast Packets to Host port */ + cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1); diff --git a/queue-4.19/net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch b/queue-4.19/net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch new file mode 100644 index 00000000000..94580351074 --- /dev/null +++ b/queue-4.19/net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jian Shen +Date: Fri, 21 Sep 2018 16:41:43 +0100 +Subject: net: hns3: Add nic state check before calling netif_tx_wake_queue + +From: Jian Shen + +[ Upstream commit 7a8101109dd37837f587cd56f3111d4fc17a07f5 ] + +When nic down, it firstly calls netif_tx_stop_all_queues(), then calls +napi_disable(). But napi_disable() will wait current napi_poll finish, +it may call netif_tx_wake_queue(). This patch fixes it by add nic state +checking. + +Fixes: 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC") +Signed-off-by: Jian Shen +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1915,6 +1915,7 @@ static int is_valid_clean_head(struct hn + bool hns3_clean_tx_ring(struct hns3_enet_ring *ring, int budget) + { + struct net_device *netdev = ring->tqp->handle->kinfo.netdev; ++ struct hns3_nic_priv *priv = netdev_priv(netdev); + struct netdev_queue *dev_queue; + int bytes, pkts; + int head; +@@ -1961,7 +1962,8 @@ bool hns3_clean_tx_ring(struct hns3_enet + * sees the new next_to_clean. + */ + smp_mb(); +- if (netif_tx_queue_stopped(dev_queue)) { ++ if (netif_tx_queue_stopped(dev_queue) && ++ !test_bit(HNS3_NIC_STATE_DOWN, &priv->state)) { + netif_tx_wake_queue(dev_queue); + ring->stats.restart_queue++; + } diff --git a/queue-4.19/net-hns3-check-hdev-state-when-getting-link-status.patch b/queue-4.19/net-hns3-check-hdev-state-when-getting-link-status.patch new file mode 100644 index 00000000000..ebc866dad5c --- /dev/null +++ b/queue-4.19/net-hns3-check-hdev-state-when-getting-link-status.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Peng Li +Date: Wed, 19 Sep 2018 18:29:53 +0100 +Subject: net: hns3: Check hdev state when getting link status + +From: Peng Li + +[ Upstream commit 582d37bbb613b8ad86bf82845d3a74a02a5a0fa1 ] + +By default, HW link status is up. If hclge_update_link_status is called +before net up, driver will print "link up". It is not suitable. hdev +state check is needed when getting link status. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Fuyun Liang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++ + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +++ + 2 files changed, 6 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2362,6 +2362,9 @@ static int hclge_get_mac_phy_link(struct + int mac_state; + int link_stat; + ++ if (test_bit(HCLGE_STATE_DOWN, &hdev->state)) ++ return 0; ++ + mac_state = hclge_get_mac_link_status(hdev); + + if (hdev->hw.mac.phydev) { +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -299,6 +299,9 @@ void hclgevf_update_link_status(struct h + + client = handle->client; + ++ link_state = ++ test_bit(HCLGEVF_STATE_DOWN, &hdev->state) ? 0 : link_state; ++ + if (link_state != hdev->hw.mac.link) { + client->ops->link_status_change(handle, !!link_state); + hdev->hw.mac.link = link_state; diff --git a/queue-4.19/net-hns3-fix-ets-validate-issue.patch b/queue-4.19/net-hns3-fix-ets-validate-issue.patch new file mode 100644 index 00000000000..583111eb864 --- /dev/null +++ b/queue-4.19/net-hns3-fix-ets-validate-issue.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Jian Shen +Date: Fri, 21 Sep 2018 16:41:37 +0100 +Subject: net: hns3: Fix ets validate issue + +From: Jian Shen + +[ Upstream commit adefc0a2ff465f4ac4a88450fe69d336c8b074c5 ] + +There is a defect in hclge_ets_validate(). If each member of tc_tsa is +not IEEE_8021QAZ_TSA_ETS, the variable total_ets_bw won't be updated. +In this case, the check for value of total_ets_bw will fail. This patch +fixes it by checking total_ets_bw only after it has been updated. + +Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature") +Signed-off-by: Jian Shen +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -73,6 +73,7 @@ static int hclge_ieee_getets(struct hnae + static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, + u8 *tc, bool *changed) + { ++ bool has_ets_tc = false; + u32 total_ets_bw = 0; + u8 max_tc = 0; + u8 i; +@@ -100,13 +101,14 @@ static int hclge_ets_validate(struct hcl + *changed = true; + + total_ets_bw += ets->tc_tx_bw[i]; +- break; ++ has_ets_tc = true; ++ break; + default: + return -EINVAL; + } + } + +- if (total_ets_bw != BW_PERCENT) ++ if (has_ets_tc && total_ets_bw != BW_PERCENT) + return -EINVAL; + + *tc = max_tc + 1; diff --git a/queue-4.19/net-hns3-fix-for-packet-buffer-setting-bug.patch b/queue-4.19/net-hns3-fix-for-packet-buffer-setting-bug.patch new file mode 100644 index 00000000000..0e2b8f8c918 --- /dev/null +++ b/queue-4.19/net-hns3-fix-for-packet-buffer-setting-bug.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Yunsheng Lin +Date: Wed, 26 Sep 2018 19:28:36 +0100 +Subject: net: hns3: Fix for packet buffer setting bug + +From: Yunsheng Lin + +[ Upstream commit 996ff91840eb6f288826e472685abde78bac20ea ] + +The hardware expects a unit of 128 bytes when setting +packet buffer. When calculating the packet buffer size, +hclge_rx_buffer_calc does not round up the size as a unit +of 128 byte, which may casue packet lost problem when stress +testing. + +This patch fixes it by rounding up packet size when calculating. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -1657,11 +1657,13 @@ static int hclge_tx_buffer_calc(struct h + static int hclge_rx_buffer_calc(struct hclge_dev *hdev, + struct hclge_pkt_buf_alloc *buf_alloc) + { +- u32 rx_all = hdev->pkt_buf_size; ++#define HCLGE_BUF_SIZE_UNIT 128 ++ u32 rx_all = hdev->pkt_buf_size, aligned_mps; + int no_pfc_priv_num, pfc_priv_num; + struct hclge_priv_buf *priv; + int i; + ++ aligned_mps = round_up(hdev->mps, HCLGE_BUF_SIZE_UNIT); + rx_all -= hclge_get_tx_buff_alloced(buf_alloc); + + /* When DCB is not supported, rx private +@@ -1680,13 +1682,13 @@ static int hclge_rx_buffer_calc(struct h + if (hdev->hw_tc_map & BIT(i)) { + priv->enable = 1; + if (hdev->tm_info.hw_pfc_map & BIT(i)) { +- priv->wl.low = hdev->mps; +- priv->wl.high = priv->wl.low + hdev->mps; ++ priv->wl.low = aligned_mps; ++ priv->wl.high = priv->wl.low + aligned_mps; + priv->buf_size = priv->wl.high + + HCLGE_DEFAULT_DV; + } else { + priv->wl.low = 0; +- priv->wl.high = 2 * hdev->mps; ++ priv->wl.high = 2 * aligned_mps; + priv->buf_size = priv->wl.high; + } + } else { +@@ -1718,11 +1720,11 @@ static int hclge_rx_buffer_calc(struct h + + if (hdev->tm_info.hw_pfc_map & BIT(i)) { + priv->wl.low = 128; +- priv->wl.high = priv->wl.low + hdev->mps; ++ priv->wl.high = priv->wl.low + aligned_mps; + priv->buf_size = priv->wl.high + HCLGE_DEFAULT_DV; + } else { + priv->wl.low = 0; +- priv->wl.high = hdev->mps; ++ priv->wl.high = aligned_mps; + priv->buf_size = priv->wl.high; + } + } diff --git a/queue-4.19/net-hns3-fix-for-vf-vlan-delete-failed-problem.patch b/queue-4.19/net-hns3-fix-for-vf-vlan-delete-failed-problem.patch new file mode 100644 index 00000000000..07ed592ef8f --- /dev/null +++ b/queue-4.19/net-hns3-fix-for-vf-vlan-delete-failed-problem.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Yunsheng Lin +Date: Mon, 3 Sep 2018 11:21:46 +0100 +Subject: net: hns3: Fix for vf vlan delete failed problem + +From: Yunsheng Lin + +[ Upstream commit 41dafea2af781d8e3ab8626d236b52e4172905a3 ] + +There are only 128 entries in vf vlan table, if user has added +more than 128 vlan, fw will ignore it and disable the vf vlan +table. So when user deletes the vlan entry that has not been +set to vf vlan table, fw will return not found result and driver +treat that as error, which will cause vlan delete failed problem. + +This patch fixes it by returning ok when fw returns not found +result. + +Fixes: 6c251711b37f ("net: hns3: Disable vf vlan filter when vf vlan table is full") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4693,9 +4693,17 @@ static int hclge_set_vf_vlan_common(stru + "Add vf vlan filter fail, ret =%d.\n", + req0->resp_code); + } else { ++#define HCLGE_VF_VLAN_DEL_NO_FOUND 1 + if (!req0->resp_code) + return 0; + ++ if (req0->resp_code == HCLGE_VF_VLAN_DEL_NO_FOUND) { ++ dev_warn(&hdev->pdev->dev, ++ "vlan %d filter is not in vf vlan table\n", ++ vlan); ++ return 0; ++ } ++ + dev_err(&hdev->pdev->dev, + "Kill vf vlan filter fail, ret =%d.\n", + req0->resp_code); diff --git a/queue-4.19/net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch b/queue-4.19/net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch new file mode 100644 index 00000000000..1fe61e56419 --- /dev/null +++ b/queue-4.19/net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Yunsheng Lin +Date: Mon, 3 Sep 2018 11:21:51 +0100 +Subject: net: hns3: Fix ping exited problem when doing lp selftest + +From: Yunsheng Lin + +[ Upstream commit 3f8601f0f5716c4e63a9f215bbc581df42859d61 ] + +When ping is runnig and user executes the loopback selftest, the +ping cmd will stop and exit. + +This patch fixes it by using the hns3_nic_net_open/stop to offline +the netdev when doing loopback selftest. + +Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +@@ -309,7 +309,7 @@ static void hns3_self_test(struct net_de + h->flags & HNAE3_SUPPORT_SERDES_LOOPBACK; + + if (if_running) +- dev_close(ndev); ++ ndev->netdev_ops->ndo_stop(ndev); + + #if IS_ENABLED(CONFIG_VLAN_8021Q) + /* Disable the vlan filter for selftest does not support it */ +@@ -347,7 +347,7 @@ static void hns3_self_test(struct net_de + #endif + + if (if_running) +- dev_open(ndev); ++ ndev->netdev_ops->ndo_open(ndev); + } + + static int hns3_get_sset_count(struct net_device *netdev, int stringset) diff --git a/queue-4.19/net-hns3-preserve-vlan-0-in-hardware-table.patch b/queue-4.19/net-hns3-preserve-vlan-0-in-hardware-table.patch new file mode 100644 index 00000000000..9f794bc35b6 --- /dev/null +++ b/queue-4.19/net-hns3-preserve-vlan-0-in-hardware-table.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Yunsheng Lin +Date: Mon, 3 Sep 2018 11:21:52 +0100 +Subject: net: hns3: Preserve vlan 0 in hardware table + +From: Yunsheng Lin + +[ Upstream commit daaa8521760ee4d4e65f309c4c37b3a1e58c9d4e ] + +When netdev is down, the stack will delete the vlan from +hardware including vlan0, which will cause problem when +doing loopback selftest when netdev is down. + +This patch fixes it by always preserving vlan 0 in hardware, +because vlan 0 is defalut vlan, which should always be in +hardware. + +Fixes: c39c4d98dc65 ("net: hns3: Add mac loopback selftest support in hns3 driver") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4739,6 +4739,9 @@ static int hclge_set_vlan_filter_hw(stru + u16 vport_idx, vport_num = 0; + int ret; + ++ if (is_kill && !vlan_id) ++ return 0; ++ + ret = hclge_set_vf_vlan_common(hdev, vport_id, is_kill, vlan_id, + 0, proto); + if (ret) { diff --git a/queue-4.19/net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch b/queue-4.19/net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch new file mode 100644 index 00000000000..55efb9b217d --- /dev/null +++ b/queue-4.19/net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Fuyun Liang +Date: Wed, 19 Sep 2018 18:29:52 +0100 +Subject: net: hns3: Set STATE_DOWN bit of hdev state when stopping net + +From: Fuyun Liang + +[ Upstream commit 2f7e489611bc685b8e00aba436032a8aac6cac57 ] + +We clear STATE_DOWN bit of hdev state when starting net, but do not set +it again when stopping net. It causes that the net is down, but hdev state +is still up. STATE_DOWN bit of hdev state should be set when stopping net. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Fuyun Liang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 2 ++ + 2 files changed, 4 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3814,6 +3814,8 @@ static void hclge_ae_stop(struct hnae3_h + struct hclge_dev *hdev = vport->back; + int i; + ++ set_bit(HCLGE_STATE_DOWN, &hdev->state); ++ + del_timer_sync(&hdev->service_timer); + cancel_work_sync(&hdev->service_task); + clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state); +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1451,6 +1451,8 @@ static void hclgevf_ae_stop(struct hnae3 + struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle); + int i, queue_id; + ++ set_bit(HCLGEVF_STATE_DOWN, &hdev->state); ++ + for (i = 0; i < hdev->num_tqps; i++) { + /* Ring disable */ + queue_id = hclgevf_get_queue_id(handle->kinfo.tqp[i]); diff --git a/queue-4.19/net-loopback-clear-skb-tstamp-before-netif_rx.patch b/queue-4.19/net-loopback-clear-skb-tstamp-before-netif_rx.patch new file mode 100644 index 00000000000..01fa980c254 --- /dev/null +++ b/queue-4.19/net-loopback-clear-skb-tstamp-before-netif_rx.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Eric Dumazet +Date: Fri, 19 Oct 2018 19:11:26 -0700 +Subject: net: loopback: clear skb->tstamp before netif_rx() + +From: Eric Dumazet + +[ Upstream commit 4c16128b6271e70c8743178e90cccee147858503 ] + +At least UDP / TCP stacks can now cook skbs with a tstamp using +MONOTONIC base (or arbitrary values with SCM_TXTIME) + +Since loopback driver does not call (directly or indirectly) +skb_scrub_packet(), we need to clear skb->tstamp so that +net_timestamp_check() can eventually resample the time, +using ktime_get_real(). + +Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") +Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") +Signed-off-by: Eric Dumazet +Cc: Willem de Bruijn +Cc: Soheil Hassas Yeganeh +Acked-by: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/loopback.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/loopback.c ++++ b/drivers/net/loopback.c +@@ -75,6 +75,10 @@ static netdev_tx_t loopback_xmit(struct + int len; + + skb_tx_timestamp(skb); ++ ++ /* do not fool net_timestamp_check() with various clock bases */ ++ skb->tstamp = 0; ++ + skb_orphan(skb); + + /* Before queueing this packet to netif_rx(), diff --git a/queue-4.19/net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch b/queue-4.19/net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch new file mode 100644 index 00000000000..4c37035862e --- /dev/null +++ b/queue-4.19/net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Antoine Tenart +Date: Wed, 19 Sep 2018 11:39:31 +0200 +Subject: net: phy: phylink: ensure the carrier is off when starting phylink + +From: Antoine Tenart + +[ Upstream commit aeeb2e8fdefdd5d257a1446351c70cb3df540199 ] + +Phylink made an assumption about the carrier state being down when +calling phylink_start(). If this assumption isn't satisfied, the +internal phylink state could misbehave and a net device could end up not +being functional. + +This patch fixes this by explicitly calling netif_carrier_off() in +phylink_start(). + +Signed-off-by: Antoine Tenart +Acked-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phylink.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -907,6 +907,9 @@ void phylink_start(struct phylink *pl) + phylink_an_mode_str(pl->link_an_mode), + phy_modes(pl->link_config.interface)); + ++ /* Always set the carrier off */ ++ netif_carrier_off(pl->netdev); ++ + /* Apply the link configuration to the MAC when starting. This allows + * a fixed-link to start with the correct parameters, and also + * ensures that we set the appropriate advertisement for Serdes links. diff --git a/queue-4.19/net-socionext-reset-tx-queue-in-ndo_stop.patch b/queue-4.19/net-socionext-reset-tx-queue-in-ndo_stop.patch new file mode 100644 index 00000000000..33f048c596e --- /dev/null +++ b/queue-4.19/net-socionext-reset-tx-queue-in-ndo_stop.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Masahisa Kojima +Date: Tue, 23 Oct 2018 20:24:28 +0900 +Subject: net: socionext: Reset tx queue in ndo_stop + +From: Masahisa Kojima + +[ Upstream commit 8d5b0bf611ec5b7618d5b772dddc93b8afa78cb8 ] + +We observed that packets and bytes count are not reset +when user performs interface down. Eventually, tx queue is +exhausted and packets will not be sent out. +To avoid this problem, resets tx queue in ndo_stop. + +Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") +Signed-off-by: Masahisa Kojima +Signed-off-by: Yoshitoyo Osaki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/socionext/netsec.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -940,6 +940,9 @@ static void netsec_uninit_pkt_dring(stru + dring->head = 0; + dring->tail = 0; + dring->pkt_cnt = 0; ++ ++ if (id == NETSEC_RING_TX) ++ netdev_reset_queue(priv->ndev); + } + + static void netsec_free_dring(struct netsec_priv *priv, int id) diff --git a/queue-4.19/net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch b/queue-4.19/net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch new file mode 100644 index 00000000000..13a215ead02 --- /dev/null +++ b/queue-4.19/net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Johan Hovold +Date: Mon, 27 Aug 2018 10:21:51 +0200 +Subject: net: stmmac: dwmac-sun8i: fix OF child-node lookup + +From: Johan Hovold + +[ Upstream commit ac63043d8cb5503c7e0fe110f947eacf2663804e ] + +Use the new of_get_compatible_child() helper to lookup the mdio-internal +child node instead of using of_find_compatible_node(), which searches +the entire tree from a given start node and thus can return an unrelated +(i.e. non-child) node. + +This also addresses a potential use-after-free (e.g. after probe +deferral) as the tree-wide helper drops a reference to its first +argument (i.e. the mdio-mux node). Fortunately, this was inadvertently +balanced by a failure to drop the mdio-mux reference after lookup. + +While at it, also fix the related mdio-internal- and phy-node reference +leaks. + +Fixes: 634db83b8265 ("net: stmmac: dwmac-sun8i: Handle integrated/external MDIOs") +Tested-by: Corentin Labbe +Cc: Andrew Lunn +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Cc: Jose Abreu +Cc: David S. Miller +Signed-off-by: Johan Hovold +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +@@ -714,8 +714,9 @@ static int get_ephy_nodes(struct stmmac_ + return -ENODEV; + } + +- mdio_internal = of_find_compatible_node(mdio_mux, NULL, ++ mdio_internal = of_get_compatible_child(mdio_mux, + "allwinner,sun8i-h3-mdio-internal"); ++ of_node_put(mdio_mux); + if (!mdio_internal) { + dev_err(priv->device, "Cannot get internal_mdio node\n"); + return -ENODEV; +@@ -729,13 +730,20 @@ static int get_ephy_nodes(struct stmmac_ + gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL); + if (IS_ERR(gmac->rst_ephy)) { + ret = PTR_ERR(gmac->rst_ephy); +- if (ret == -EPROBE_DEFER) ++ if (ret == -EPROBE_DEFER) { ++ of_node_put(iphynode); ++ of_node_put(mdio_internal); + return ret; ++ } + continue; + } + dev_info(priv->device, "Found internal PHY node\n"); ++ of_node_put(iphynode); ++ of_node_put(mdio_internal); + return 0; + } ++ ++ of_node_put(mdio_internal); + return -ENODEV; + } + diff --git a/queue-4.19/netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch b/queue-4.19/netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch new file mode 100644 index 00000000000..239516e94e5 --- /dev/null +++ b/queue-4.19/netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Paolo Abeni +Date: Tue, 16 Oct 2018 16:52:05 +0200 +Subject: netfilter: xt_nat: fix DNAT target for shifted portmap ranges + +From: Paolo Abeni + +[ Upstream commit cb20f2d2c0507d60d94ef896991e95708f051dd1 ] + +The commit 2eb0f624b709 ("netfilter: add NAT support for shifted +portmap ranges") did not set the checkentry/destroy callbacks for +the newly added DNAT target. As a result, rulesets using only +such nat targets are not effective, as the relevant conntrack hooks +are not enabled. +The above affect also nft_compat rulesets. +Fix the issue adding the missing initializers. + +Fixes: 2eb0f624b709 ("netfilter: add NAT support for shifted portmap ranges") +Signed-off-by: Paolo Abeni +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/xt_nat.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netfilter/xt_nat.c ++++ b/net/netfilter/xt_nat.c +@@ -216,6 +216,8 @@ static struct xt_target xt_nat_target_re + { + .name = "DNAT", + .revision = 2, ++ .checkentry = xt_nat_checkentry, ++ .destroy = xt_nat_destroy, + .target = xt_dnat_target_v2, + .targetsize = sizeof(struct nf_nat_range2), + .table = "nat", diff --git a/queue-4.19/nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch b/queue-4.19/nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch new file mode 100644 index 00000000000..9013f0fcf3e --- /dev/null +++ b/queue-4.19/nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Ryan C Goodfellow +Date: Fri, 12 Oct 2018 11:09:01 -0700 +Subject: nfp: devlink port split support for 1x100G CXP NIC + +From: Ryan C Goodfellow + +[ Upstream commit 5948185b97fa1f83d7855e638a72982a1073ebf5 ] + +This commit makes it possible to use devlink to split the 100G CXP +Netronome into two 40G interfaces. Currently when you ask for 2 +interfaces, the math in src/nfp_devlink.c:nfp_devlink_port_split +calculates that you want 5 lanes per port because for some reason +eth_port.port_lanes=10 (shouldn't this be 12 for CXP?). What we really +want when asking for 2 breakout interfaces is 4 lanes per port. This +commit makes that happen by calculating based on 8 lanes if 10 are +present. + +Signed-off-by: Ryan C Goodfellow +Reviewed-by: Jakub Kicinski +Reviewed-by: Greg Weeks +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/netronome/nfp/nfp_devlink.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/netronome/nfp/nfp_devlink.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_devlink.c +@@ -96,6 +96,7 @@ nfp_devlink_port_split(struct devlink *d + { + struct nfp_pf *pf = devlink_priv(devlink); + struct nfp_eth_table_port eth_port; ++ unsigned int lanes; + int ret; + + if (count < 2) +@@ -114,8 +115,12 @@ nfp_devlink_port_split(struct devlink *d + goto out; + } + +- ret = nfp_devlink_set_lanes(pf, eth_port.index, +- eth_port.port_lanes / count); ++ /* Special case the 100G CXP -> 2x40G split */ ++ lanes = eth_port.port_lanes / count; ++ if (eth_port.lanes == 10 && count == 2) ++ lanes = 8 / count; ++ ++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes); + out: + mutex_unlock(&pf->lock); + +@@ -128,6 +133,7 @@ nfp_devlink_port_unsplit(struct devlink + { + struct nfp_pf *pf = devlink_priv(devlink); + struct nfp_eth_table_port eth_port; ++ unsigned int lanes; + int ret; + + mutex_lock(&pf->lock); +@@ -143,7 +149,12 @@ nfp_devlink_port_unsplit(struct devlink + goto out; + } + +- ret = nfp_devlink_set_lanes(pf, eth_port.index, eth_port.port_lanes); ++ /* Special case the 100G CXP -> 2x40G unsplit */ ++ lanes = eth_port.port_lanes; ++ if (eth_port.port_lanes == 8) ++ lanes = 10; ++ ++ ret = nfp_devlink_set_lanes(pf, eth_port.index, lanes); + out: + mutex_unlock(&pf->lock); + diff --git a/queue-4.19/nvme-call-nvme_complete_rq-when-nvmf_check_ready-fails-for-mpath-i-o.patch b/queue-4.19/nvme-call-nvme_complete_rq-when-nvmf_check_ready-fails-for-mpath-i-o.patch new file mode 100644 index 00000000000..9f0addb36aa --- /dev/null +++ b/queue-4.19/nvme-call-nvme_complete_rq-when-nvmf_check_ready-fails-for-mpath-i-o.patch @@ -0,0 +1,95 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: James Smart +Date: Thu, 27 Sep 2018 16:58:54 -0700 +Subject: nvme: call nvme_complete_rq when nvmf_check_ready fails for mpath I/O + +From: James Smart + +[ Upstream commit 783f4a4408e1251d17f333ad56abac24dde988b9 ] + +When an io is rejected by nvmf_check_ready() due to validation of the +controller state, the nvmf_fail_nonready_command() will normally return +BLK_STS_RESOURCE to requeue and retry. However, if the controller is +dying or the I/O is marked for NVMe multipath, the I/O is failed so that +the controller can terminate or so that the io can be issued on a +different path. Unfortunately, as this reject point is before the +transport has accepted the command, blk-mq ends up completing the I/O +and never calls nvme_complete_rq(), which is where multipath may preserve +or re-route the I/O. The end result is, the device user ends up seeing an +EIO error. + +Example: single path connectivity, controller is under load, and a reset +is induced. An I/O is received: + + a) while the reset state has been set but the queues have yet to be + stopped; or + b) after queues are started (at end of reset) but before the reconnect + has completed. + +The I/O finishes with an EIO status. + +This patch makes the following changes: + + - Adds the HOST_PATH_ERROR pathing status from TP4028 + - Modifies the reject point such that it appears to queue successfully, + but actually completes the io with the new pathing status and calls + nvme_complete_rq(). + - nvme_complete_rq() recognizes the new status, avoids resetting the + controller (likely was already done in order to get this new status), + and calls the multipather to clear the current path that errored. + This allows the next command (retry or new command) to select a new + path if there is one. + +Signed-off-by: James Smart +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/fabrics.c | 7 +++++-- + drivers/nvme/host/multipath.c | 7 +++++++ + include/linux/nvme.h | 1 + + 3 files changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -552,8 +552,11 @@ blk_status_t nvmf_fail_nonready_command( + ctrl->state != NVME_CTRL_DEAD && + !blk_noretry_request(rq) && !(rq->cmd_flags & REQ_NVME_MPATH)) + return BLK_STS_RESOURCE; +- nvme_req(rq)->status = NVME_SC_ABORT_REQ; +- return BLK_STS_IOERR; ++ ++ nvme_req(rq)->status = NVME_SC_HOST_PATH_ERROR; ++ blk_mq_start_request(rq); ++ nvme_complete_rq(rq); ++ return BLK_STS_OK; + } + EXPORT_SYMBOL_GPL(nvmf_fail_nonready_command); + +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -77,6 +77,13 @@ void nvme_failover_req(struct request *r + queue_work(nvme_wq, &ns->ctrl->ana_work); + } + break; ++ case NVME_SC_HOST_PATH_ERROR: ++ /* ++ * Temporary transport disruption in talking to the controller. ++ * Try to send on a new path. ++ */ ++ nvme_mpath_clear_current_path(ns); ++ break; + default: + /* + * Reset the controller for any non-ANA error as we don't know +--- a/include/linux/nvme.h ++++ b/include/linux/nvme.h +@@ -1241,6 +1241,7 @@ enum { + NVME_SC_ANA_PERSISTENT_LOSS = 0x301, + NVME_SC_ANA_INACCESSIBLE = 0x302, + NVME_SC_ANA_TRANSITION = 0x303, ++ NVME_SC_HOST_PATH_ERROR = 0x370, + + NVME_SC_DNR = 0x4000, + }; diff --git a/queue-4.19/nvmem-check-the-return-value-of-nvmem_add_cells.patch b/queue-4.19/nvmem-check-the-return-value-of-nvmem_add_cells.patch new file mode 100644 index 00000000000..9f0a54b4b6f --- /dev/null +++ b/queue-4.19/nvmem-check-the-return-value-of-nvmem_add_cells.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Bartosz Golaszewski +Date: Fri, 21 Sep 2018 06:40:07 -0700 +Subject: nvmem: check the return value of nvmem_add_cells() + +From: Bartosz Golaszewski + +[ Upstream commit fa72d847d68d7833b77a4bef944cf2c5baf56f49 ] + +This function can fail so check its return value in nvmem_register() +and act accordingly. + +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -516,11 +516,17 @@ struct nvmem_device *nvmem_register(cons + goto err_device_del; + } + +- if (config->cells) +- nvmem_add_cells(nvmem, config->cells, config->ncells); ++ if (config->cells) { ++ rval = nvmem_add_cells(nvmem, config->cells, config->ncells); ++ if (rval) ++ goto err_teardown_compat; ++ } + + return nvmem; + ++err_teardown_compat: ++ if (config->compat) ++ device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom); + err_device_del: + device_del(&nvmem->dev); + err_put_device: diff --git a/queue-4.19/nvmet-rdma-use-a-private-workqueue-for-delete.patch b/queue-4.19/nvmet-rdma-use-a-private-workqueue-for-delete.patch new file mode 100644 index 00000000000..4f930652ff4 --- /dev/null +++ b/queue-4.19/nvmet-rdma-use-a-private-workqueue-for-delete.patch @@ -0,0 +1,158 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sagi Grimberg +Date: Thu, 27 Sep 2018 11:00:31 -0700 +Subject: nvmet-rdma: use a private workqueue for delete + +From: Sagi Grimberg + +[ Upstream commit 2acf70ade79d26b97611a8df52eb22aa33814cd4 ] + +Queue deletion is done asynchronous when the last reference on the queue +is dropped. Thus, in order to make sure we don't over allocate under a +connect/disconnect storm, we let queue deletion complete before making +forward progress. + +However, given that we flush the system_wq from rdma_cm context which +runs from a workqueue context, we can have a circular locking complaint +[1]. Fix that by using a private workqueue for queue deletion. + +[1]: +====================================================== +WARNING: possible circular locking dependency detected +4.19.0-rc4-dbg+ #3 Not tainted +------------------------------------------------------ +kworker/5:0/39 is trying to acquire lock: +00000000a10b6db9 (&id_priv->handler_mutex){+.+.}, at: rdma_destroy_id+0x6f/0x440 [rdma_cm] + +but task is already holding lock: +00000000331b4e2c ((work_completion)(&queue->release_work)){+.+.}, at: process_one_work+0x3ed/0xa20 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #3 ((work_completion)(&queue->release_work)){+.+.}: + process_one_work+0x474/0xa20 + worker_thread+0x63/0x5a0 + kthread+0x1cf/0x1f0 + ret_from_fork+0x24/0x30 + +-> #2 ((wq_completion)"events"){+.+.}: + flush_workqueue+0xf3/0x970 + nvmet_rdma_cm_handler+0x133d/0x1734 [nvmet_rdma] + cma_ib_req_handler+0x72f/0xf90 [rdma_cm] + cm_process_work+0x2e/0x110 [ib_cm] + cm_req_handler+0x135b/0x1c30 [ib_cm] + cm_work_handler+0x2b7/0x38cd [ib_cm] + process_one_work+0x4ae/0xa20 +nvmet_rdma:nvmet_rdma_cm_handler: nvmet_rdma: disconnected (10): status 0 id 0000000040357082 + worker_thread+0x63/0x5a0 + kthread+0x1cf/0x1f0 + ret_from_fork+0x24/0x30 +nvme nvme0: Reconnecting in 10 seconds... + +-> #1 (&id_priv->handler_mutex/1){+.+.}: + __mutex_lock+0xfe/0xbe0 + mutex_lock_nested+0x1b/0x20 + cma_ib_req_handler+0x6aa/0xf90 [rdma_cm] + cm_process_work+0x2e/0x110 [ib_cm] + cm_req_handler+0x135b/0x1c30 [ib_cm] + cm_work_handler+0x2b7/0x38cd [ib_cm] + process_one_work+0x4ae/0xa20 + worker_thread+0x63/0x5a0 + kthread+0x1cf/0x1f0 + ret_from_fork+0x24/0x30 + +-> #0 (&id_priv->handler_mutex){+.+.}: + lock_acquire+0xc5/0x200 + __mutex_lock+0xfe/0xbe0 + mutex_lock_nested+0x1b/0x20 + rdma_destroy_id+0x6f/0x440 [rdma_cm] + nvmet_rdma_release_queue_work+0x8e/0x1b0 [nvmet_rdma] + process_one_work+0x4ae/0xa20 + worker_thread+0x63/0x5a0 + kthread+0x1cf/0x1f0 + ret_from_fork+0x24/0x30 + +Fixes: 777dc82395de ("nvmet-rdma: occasionally flush ongoing controller teardown") +Reported-by: Bart Van Assche +Signed-off-by: Sagi Grimberg +Tested-by: Bart Van Assche + +Signed-off-by: Christoph Hellwig + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/target/rdma.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -122,6 +122,7 @@ struct nvmet_rdma_device { + int inline_page_count; + }; + ++struct workqueue_struct *nvmet_rdma_delete_wq; + static bool nvmet_rdma_use_srq; + module_param_named(use_srq, nvmet_rdma_use_srq, bool, 0444); + MODULE_PARM_DESC(use_srq, "Use shared receive queue."); +@@ -1267,12 +1268,12 @@ static int nvmet_rdma_queue_connect(stru + + if (queue->host_qid == 0) { + /* Let inflight controller teardown complete */ +- flush_scheduled_work(); ++ flush_workqueue(nvmet_rdma_delete_wq); + } + + ret = nvmet_rdma_cm_accept(cm_id, queue, &event->param.conn); + if (ret) { +- schedule_work(&queue->release_work); ++ queue_work(nvmet_rdma_delete_wq, &queue->release_work); + /* Destroying rdma_cm id is not needed here */ + return 0; + } +@@ -1337,7 +1338,7 @@ static void __nvmet_rdma_queue_disconnec + + if (disconnect) { + rdma_disconnect(queue->cm_id); +- schedule_work(&queue->release_work); ++ queue_work(nvmet_rdma_delete_wq, &queue->release_work); + } + } + +@@ -1367,7 +1368,7 @@ static void nvmet_rdma_queue_connect_fai + mutex_unlock(&nvmet_rdma_queue_mutex); + + pr_err("failed to connect queue %d\n", queue->idx); +- schedule_work(&queue->release_work); ++ queue_work(nvmet_rdma_delete_wq, &queue->release_work); + } + + /** +@@ -1649,8 +1650,17 @@ static int __init nvmet_rdma_init(void) + if (ret) + goto err_ib_client; + ++ nvmet_rdma_delete_wq = alloc_workqueue("nvmet-rdma-delete-wq", ++ WQ_UNBOUND | WQ_MEM_RECLAIM | WQ_SYSFS, 0); ++ if (!nvmet_rdma_delete_wq) { ++ ret = -ENOMEM; ++ goto err_unreg_transport; ++ } ++ + return 0; + ++err_unreg_transport: ++ nvmet_unregister_transport(&nvmet_rdma_ops); + err_ib_client: + ib_unregister_client(&nvmet_rdma_ib_client); + return ret; +@@ -1658,6 +1668,7 @@ err_ib_client: + + static void __exit nvmet_rdma_exit(void) + { ++ destroy_workqueue(nvmet_rdma_delete_wq); + nvmet_unregister_transport(&nvmet_rdma_ops); + ib_unregister_client(&nvmet_rdma_ib_client); + WARN_ON_ONCE(!list_empty(&nvmet_rdma_queue_list)); diff --git a/queue-4.19/of-add-missing-exports-of-node-name-compare-functions.patch b/queue-4.19/of-add-missing-exports-of-node-name-compare-functions.patch new file mode 100644 index 00000000000..feb9a15fe42 --- /dev/null +++ b/queue-4.19/of-add-missing-exports-of-node-name-compare-functions.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Rob Herring +Date: Mon, 22 Oct 2018 09:03:54 -0500 +Subject: of: Add missing exports of node name compare functions + +From: Rob Herring + +[ Upstream commit 173ee3962959a1985a109f81539a403b5cd07ae7 ] + +Commit f42b0e18f2e5 ("of: add node name compare helper functions") +failed to add the module exports to of_node_name_eq() and +of_node_name_prefix(). Add them now. + +Fixes: f42b0e18f2e5 ("of: add node name compare helper functions") +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/of/base.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/of/base.c ++++ b/drivers/of/base.c +@@ -67,6 +67,7 @@ bool of_node_name_eq(const struct device + + return (strlen(name) == len) && (strncmp(node_name, name, len) == 0); + } ++EXPORT_SYMBOL(of_node_name_eq); + + bool of_node_name_prefix(const struct device_node *np, const char *prefix) + { +@@ -75,6 +76,7 @@ bool of_node_name_prefix(const struct de + + return strncmp(kbasename(np->full_name), prefix, strlen(prefix)) == 0; + } ++EXPORT_SYMBOL(of_node_name_prefix); + + int of_n_addr_cells(struct device_node *np) + { diff --git a/queue-4.19/pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch b/queue-4.19/pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch new file mode 100644 index 00000000000..49ee0ad8a13 --- /dev/null +++ b/queue-4.19/pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch @@ -0,0 +1,74 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Mika Westerberg +Date: Thu, 27 Sep 2018 16:54:13 -0500 +Subject: PCI / ACPI: Enable wake automatically for power managed bridges + +From: Mika Westerberg + +[ Upstream commit 6299cf9ec3985cac70bede8a855b5087b81a6640 ] + +We enable power management automatically for bridges where +pci_bridge_d3_possible() returns true. However, these bridges may have +ACPI methods such as _DSW that need to be called before D3 entry. For +example in Lenovo Thinkpad X1 Carbon 6th _DSW method is used to prepare +D3cold for the PCIe root port hosting Thunderbolt chain. Because wake is +not enabled _DSW method is never called and the port does not enter +D3cold properly consuming more power than necessary. + +Users can work this around by writing "enabled" to "wakeup" sysfs file +under the device in question but that is not something an ordinary user +is expected to do. + +Since we already automatically enable power management for PCIe ports +with ->bridge_d3 set extend that to enable wake for them as well, +assuming the port has any ACPI wakeup related objects implemented in the +namespace (adev->wakeup.flags.valid is true). This ensures the necessary +ACPI methods get called at appropriate times and allows the root port in +Thinkpad X1 Carbon 6th to go into D3cold. + +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-acpi.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -762,19 +762,33 @@ static void pci_acpi_setup(struct device + return; + + device_set_wakeup_capable(dev, true); ++ /* ++ * For bridges that can do D3 we enable wake automatically (as ++ * we do for the power management itself in that case). The ++ * reason is that the bridge may have additional methods such as ++ * _DSW that need to be called. ++ */ ++ if (pci_dev->bridge_d3) ++ device_wakeup_enable(dev); ++ + acpi_pci_wakeup(pci_dev, false); + } + + static void pci_acpi_cleanup(struct device *dev) + { + struct acpi_device *adev = ACPI_COMPANION(dev); ++ struct pci_dev *pci_dev = to_pci_dev(dev); + + if (!adev) + return; + + pci_acpi_remove_pm_notifier(adev); +- if (adev->wakeup.flags.valid) ++ if (adev->wakeup.flags.valid) { ++ if (pci_dev->bridge_d3) ++ device_wakeup_disable(dev); ++ + device_set_wakeup_capable(dev, false); ++ } + } + + static bool pci_acpi_bus_match(struct device *dev) diff --git a/queue-4.19/pci-cadence-correct-probe-behaviour-when-failing-to-get-phy.patch b/queue-4.19/pci-cadence-correct-probe-behaviour-when-failing-to-get-phy.patch new file mode 100644 index 00000000000..d1c71a59314 --- /dev/null +++ b/queue-4.19/pci-cadence-correct-probe-behaviour-when-failing-to-get-phy.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Alan Douglas +Date: Fri, 28 Sep 2018 11:51:18 +0100 +Subject: PCI: cadence: Correct probe behaviour when failing to get PHY + +From: Alan Douglas + +[ Upstream commit aa77e55d48124d0d78456eabf872fffb5decdbe1 ] + +Test the correct value to see whether the PHY get failed. + +Use devm_phy_get() instead of devm_phy_optional_get(), since it is +only called if phy name is given in devicetree and so should exist. +If failure when getting or linking PHY, put any PHYs which were +already got and unlink them. + +Fixes: dfb80534692ddc5b ("PCI: cadence: Add generic PHY support to host and EP drivers") +Reported-by: Colin King +Signed-off-by: Alan Douglas +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-cadence.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/pci/controller/pcie-cadence.c ++++ b/drivers/pci/controller/pcie-cadence.c +@@ -190,14 +190,16 @@ int cdns_pcie_init_phy(struct device *de + + for (i = 0; i < phy_count; i++) { + of_property_read_string_index(np, "phy-names", i, &name); +- phy[i] = devm_phy_optional_get(dev, name); +- if (IS_ERR(phy)) +- return PTR_ERR(phy); +- ++ phy[i] = devm_phy_get(dev, name); ++ if (IS_ERR(phy[i])) { ++ ret = PTR_ERR(phy[i]); ++ goto err_phy; ++ } + link[i] = device_link_add(dev, &phy[i]->dev, DL_FLAG_STATELESS); + if (!link[i]) { ++ devm_phy_put(dev, phy[i]); + ret = -EINVAL; +- goto err_link; ++ goto err_phy; + } + } + +@@ -207,13 +209,15 @@ int cdns_pcie_init_phy(struct device *de + + ret = cdns_pcie_enable_phy(pcie); + if (ret) +- goto err_link; ++ goto err_phy; + + return 0; + +-err_link: +- while (--i >= 0) ++err_phy: ++ while (--i >= 0) { + device_link_del(link[i]); ++ devm_phy_put(dev, phy[i]); ++ } + + return ret; + } diff --git a/queue-4.19/pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch b/queue-4.19/pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch new file mode 100644 index 00000000000..d1bd6863703 --- /dev/null +++ b/queue-4.19/pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Alan Douglas +Date: Thu, 11 Oct 2018 17:15:43 +0100 +Subject: PCI: cadence: Use AXI region 0 to signal interrupts from EP + +From: Alan Douglas + +[ Upstream commit 0652d4b6b56f73c81abbdbc7e26f772cb2dfe370 ] + +The IRQ physical address is allocated from region 0, rather than +the highest region. Update the driver to reserve this region in +the bitmap and to use region 0 for all types of interrupt. + +This corrects a problem which prevents the interrupt being +signalled correctly if using the first address in the AXI region, +since an offset of zero will always be mapped to region 0. + +Fixes: 37dddf14f1ae ("PCI: cadence: Add EndPoint Controller driver for Cadence PCIe controller") +Signed-off-by: Alan Douglas +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-cadence-ep.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/pci/controller/pcie-cadence-ep.c ++++ b/drivers/pci/controller/pcie-cadence-ep.c +@@ -258,7 +258,6 @@ static void cdns_pcie_ep_assert_intx(str + u8 intx, bool is_asserted) + { + struct cdns_pcie *pcie = &ep->pcie; +- u32 r = ep->max_regions - 1; + u32 offset; + u16 status; + u8 msg_code; +@@ -268,8 +267,8 @@ static void cdns_pcie_ep_assert_intx(str + /* Set the outbound region if needed. */ + if (unlikely(ep->irq_pci_addr != CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY || + ep->irq_pci_fn != fn)) { +- /* Last region was reserved for IRQ writes. */ +- cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, r, ++ /* First region was reserved for IRQ writes. */ ++ cdns_pcie_set_outbound_region_for_normal_msg(pcie, fn, 0, + ep->irq_phys_addr); + ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_LEGACY; + ep->irq_pci_fn = fn; +@@ -347,8 +346,8 @@ static int cdns_pcie_ep_send_msi_irq(str + /* Set the outbound region if needed. */ + if (unlikely(ep->irq_pci_addr != (pci_addr & ~pci_addr_mask) || + ep->irq_pci_fn != fn)) { +- /* Last region was reserved for IRQ writes. */ +- cdns_pcie_set_outbound_region(pcie, fn, ep->max_regions - 1, ++ /* First region was reserved for IRQ writes. */ ++ cdns_pcie_set_outbound_region(pcie, fn, 0, + false, + ep->irq_phys_addr, + pci_addr & ~pci_addr_mask, +@@ -517,6 +516,8 @@ static int cdns_pcie_ep_probe(struct pla + goto free_epc_mem; + } + ep->irq_pci_addr = CDNS_PCIE_EP_IRQ_PCI_ADDR_NONE; ++ /* Reserve region 0 for IRQs */ ++ set_bit(0, &ep->ob_region_map); + + return 0; + diff --git a/queue-4.19/pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch b/queue-4.19/pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch new file mode 100644 index 00000000000..9e9d6898d84 --- /dev/null +++ b/queue-4.19/pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Vignesh R +Date: Tue, 25 Sep 2018 14:00:24 +0530 +Subject: PCI: dwc: pci-dra7xx: Enable errata i870 for both EP and RC mode + +From: Vignesh R + +[ Upstream commit 726d75a6d243bf6730da3216f3592503f6f0f588 ] + +Errata i870 is applicable in both EP and RC mode. Therefore rename +function dra7xx_pcie_ep_unaligned_memaccess(), that implements errata +workaround, to dra7xx_pcie_unaligned_memaccess() and call it for both RC +and EP. Make sure driver probe does not fail in case the workaround is not +applied for RC mode in order to maintain DT backward compatibility. + +Reported-by: Chris Welch +Signed-off-by: Vignesh R +[lorenzo.pieralisi@arm.com: reworded the log] +Signed-off-by: Lorenzo Pieralisi +Acked-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/dwc/pci-dra7xx.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/pci/controller/dwc/pci-dra7xx.c ++++ b/drivers/pci/controller/dwc/pci-dra7xx.c +@@ -542,7 +542,7 @@ static const struct of_device_id of_dra7 + }; + + /* +- * dra7xx_pcie_ep_unaligned_memaccess: workaround for AM572x/AM571x Errata i870 ++ * dra7xx_pcie_unaligned_memaccess: workaround for AM572x/AM571x Errata i870 + * @dra7xx: the dra7xx device where the workaround should be applied + * + * Access to the PCIe slave port that are not 32-bit aligned will result +@@ -552,7 +552,7 @@ static const struct of_device_id of_dra7 + * + * To avoid this issue set PCIE_SS1_AXI2OCP_LEGACY_MODE_ENABLE to 1. + */ +-static int dra7xx_pcie_ep_unaligned_memaccess(struct device *dev) ++static int dra7xx_pcie_unaligned_memaccess(struct device *dev) + { + int ret; + struct device_node *np = dev->of_node; +@@ -704,6 +704,11 @@ static int __init dra7xx_pcie_probe(stru + + dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE, + DEVICE_TYPE_RC); ++ ++ ret = dra7xx_pcie_unaligned_memaccess(dev); ++ if (ret) ++ dev_err(dev, "WA for Errata i870 not applied\n"); ++ + ret = dra7xx_add_pcie_port(dra7xx, pdev); + if (ret < 0) + goto err_gpio; +@@ -717,7 +722,7 @@ static int __init dra7xx_pcie_probe(stru + dra7xx_pcie_writel(dra7xx, PCIECTRL_TI_CONF_DEVICE_TYPE, + DEVICE_TYPE_EP); + +- ret = dra7xx_pcie_ep_unaligned_memaccess(dev); ++ ret = dra7xx_pcie_unaligned_memaccess(dev); + if (ret) + goto err_gpio; + diff --git a/queue-4.19/pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch b/queue-4.19/pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch new file mode 100644 index 00000000000..01a1b3e57b7 --- /dev/null +++ b/queue-4.19/pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch @@ -0,0 +1,68 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Honghui Zhang +Date: Mon, 15 Oct 2018 16:08:52 +0800 +Subject: PCI: mediatek: Fix mtk_pcie_find_port() endpoint/port matching logic + +From: Honghui Zhang + +[ Upstream commit 074d6f32689ce05a084b6fa3db38445745bf11cc ] + +The Mediatek's host controller has two slots, each with its own control +registers. The host driver needs to identify what slot is connected to +what port in order to access the device's configuration space. + +Current code retrieving slot connected to a given endpoint device. + +Assuming each slot is connected to one endpoint device as below: + + host bridge + bus 0 --> __________|_______ + | | + | | + slot 0 slot 1 + bus 1 -->| bus 2 --> | + | | + EP 0 EP 1 + +During PCI enumeration, system software will scan all the PCI devices on +every bus starting from devfn 0. Using PCI_SLOT(devfn) for matching an +endpoint to its slot is erroneous in that the devfn does not contain the +hierarchical bus numbering in it. In order to match an endpoint with its +slot (and related port), the PCI tree must be walked up to the root bus +(where the root ports are situated) and then the PCI_SLOT(devfn) +matching logic can be correctly applied for matching. + +This patch fixes the mtk_pcie_find_port() slot matching logic by adding +appropriate PCI tree walking code to retrieve the slot/port a given +endpoint is connected to. + +Signed-off-by: Honghui Zhang +[lorenzo.pieralisi@arm.com: rewrote the commit log] +Signed-off-by: Lorenzo Pieralisi +Acked-by: Ryder Lee +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pcie-mediatek.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/pci/controller/pcie-mediatek.c ++++ b/drivers/pci/controller/pcie-mediatek.c +@@ -337,6 +337,17 @@ static struct mtk_pcie_port *mtk_pcie_fi + { + struct mtk_pcie *pcie = bus->sysdata; + struct mtk_pcie_port *port; ++ struct pci_dev *dev = NULL; ++ ++ /* ++ * Walk the bus hierarchy to get the devfn value ++ * of the port in the root bus. ++ */ ++ while (bus && bus->number) { ++ dev = bus->self; ++ bus = dev->bus; ++ devfn = dev->devfn; ++ } + + list_for_each_entry(port, &pcie->ports, list) + if (port->slot == PCI_SLOT(devfn)) diff --git a/queue-4.19/pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch b/queue-4.19/pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch new file mode 100644 index 00000000000..9097b3ba8b0 --- /dev/null +++ b/queue-4.19/pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch @@ -0,0 +1,95 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Tonghao Zhang +Date: Mon, 24 Sep 2018 07:00:41 -0700 +Subject: PCI/MSI: Warn and return error if driver enables MSI/MSI-X twice + +From: Tonghao Zhang + +[ Upstream commit 4c1ef72e9b71a19fb405ebfcd37c0a5e16fa44ca ] + +It is a serious driver defect to enable MSI or MSI-X more than once. Doing +so may panic the kernel as in the stack trace below: + + Call Trace: + sysfs_add_one+0xa5/0xd0 + create_dir+0x7c/0xe0 + sysfs_create_subdir+0x1c/0x20 + internal_create_group+0x6d/0x290 + sysfs_create_groups+0x4a/0xa0 + populate_msi_sysfs+0x1cd/0x210 + pci_enable_msix+0x31c/0x3e0 + igbuio_pci_open+0x72/0x300 [igb_uio] + uio_open+0xcc/0x120 [uio] + chrdev_open+0xa1/0x1e0 + [...] + do_sys_open+0xf3/0x1f0 + SyS_open+0x1e/0x20 + system_call_fastpath+0x16/0x1b + ---[ end trace 11042e2848880209 ]--- + Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffffa056b4fa + +We want to keep the WARN_ON() and stack trace so the driver can be fixed, +but we can avoid the kernel panic by returning an error. We may still get +warnings like this: + + Call Trace: + pci_enable_msix+0x3c9/0x3e0 + igbuio_pci_open+0x72/0x300 [igb_uio] + uio_open+0xcc/0x120 [uio] + chrdev_open+0xa1/0x1e0 + [...] + do_sys_open+0xf3/0x1f0 + SyS_open+0x1e/0x20 + system_call_fastpath+0x16/0x1b + ------------[ cut here ]------------ + WARNING: at fs/sysfs/dir.c:526 sysfs_add_one+0xa5/0xd0() + sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/0000:01:00.1/msi_irqs' + +Signed-off-by: Tonghao Zhang +[bhelgaas: changelog, fix patch whitespace, remove !!] +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/msi.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -958,7 +958,6 @@ static int __pci_enable_msix(struct pci_ + } + } + } +- WARN_ON(!!dev->msix_enabled); + + /* Check whether driver already requested for MSI irq */ + if (dev->msi_enabled) { +@@ -1028,8 +1027,6 @@ static int __pci_enable_msi_range(struct + if (!pci_msi_supported(dev, minvec)) + return -EINVAL; + +- WARN_ON(!!dev->msi_enabled); +- + /* Check whether driver already requested MSI-X irqs */ + if (dev->msix_enabled) { + pci_info(dev, "can't enable MSI (MSI-X already enabled)\n"); +@@ -1039,6 +1036,9 @@ static int __pci_enable_msi_range(struct + if (maxvec < minvec) + return -ERANGE; + ++ if (WARN_ON_ONCE(dev->msi_enabled)) ++ return -EINVAL; ++ + nvec = pci_msi_vec_count(dev); + if (nvec < 0) + return nvec; +@@ -1087,6 +1087,9 @@ static int __pci_enable_msix_range(struc + if (maxvec < minvec) + return -ERANGE; + ++ if (WARN_ON_ONCE(dev->msix_enabled)) ++ return -EINVAL; ++ + for (;;) { + if (affd) { + nvec = irq_calc_affinity_vectors(minvec, nvec, affd); diff --git a/queue-4.19/perf-strbuf-match-va_-add-copy-with-va_end.patch b/queue-4.19/perf-strbuf-match-va_-add-copy-with-va_end.patch new file mode 100644 index 00000000000..cb86dcf7cf6 --- /dev/null +++ b/queue-4.19/perf-strbuf-match-va_-add-copy-with-va_end.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sanskriti Sharma +Date: Tue, 2 Oct 2018 10:29:10 -0400 +Subject: perf strbuf: Match va_{add,copy} with va_end + +From: Sanskriti Sharma + +[ Upstream commit ce49d8436cffa9b7a6a5f110879d53e89dbc6746 ] + +Ensure that all code paths in strbuf_addv() call va_end() on the +ap_saved copy that was made. + +Fixes the following coverity complaint: + + Error: VARARGS (CWE-237): [#def683] + tools/perf/util/strbuf.c:106: missing_va_end: va_end was not called + for "ap_saved". + +Signed-off-by: Sanskriti Sharma +Reviewed-by: Jiri Olsa +Cc: Joe Lawrence +Link: http://lkml.kernel.org/r/1538490554-8161-2-git-send-email-sansharm@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/strbuf.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/strbuf.c ++++ b/tools/perf/util/strbuf.c +@@ -98,19 +98,25 @@ static int strbuf_addv(struct strbuf *sb + + va_copy(ap_saved, ap); + len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap); +- if (len < 0) ++ if (len < 0) { ++ va_end(ap_saved); + return len; ++ } + if (len > strbuf_avail(sb)) { + ret = strbuf_grow(sb, len); +- if (ret) ++ if (ret) { ++ va_end(ap_saved); + return ret; ++ } + len = vsnprintf(sb->buf + sb->len, sb->alloc - sb->len, fmt, ap_saved); + va_end(ap_saved); + if (len > strbuf_avail(sb)) { + pr_debug("this should not happen, your vsnprintf is broken"); ++ va_end(ap_saved); + return -EINVAL; + } + } ++ va_end(ap_saved); + return strbuf_setlen(sb, sb->len + len); + } + diff --git a/queue-4.19/perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch b/queue-4.19/perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch new file mode 100644 index 00000000000..721104f9df6 --- /dev/null +++ b/queue-4.19/perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch @@ -0,0 +1,61 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Arnaldo Carvalho de Melo +Date: Wed, 5 Sep 2018 10:47:56 -0300 +Subject: perf tests: Fix record+probe_libc_inet_pton.sh without ping's debuginfo + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 1632936480a53d85ef3012cd9f290e247251cbb9 ] + +When we don't have the iputils-debuginfo package installed, i.e. when we +don't have the DWARF information needed to resolve ping's samples, we +end up failing this 'perf test' entry: + + # perf test ping + 62: probe libc's inet_pton & backtrace it with ping : Ok + # rpm -e iputils-debuginfo + # perf test ping + 62: probe libc's inet_pton & backtrace it with ping : FAILED! + # + +Fix it to accept "[unknown]" where the symbol + offset, when resolved, +is expected. + +I think this will fail in the other arches as well, but since I can't +test now, I'm leaving s390x and ppc cases as-is. + +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Hendrik Brueckner +Cc: Jiri Olsa +Cc: Kim Phillips +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Naveen N. Rao +Cc: Peter Zijlstra +Cc: Ravi Bangoria +Cc: Sandipan Das +Cc: Sukadev Bhattiprolu +Cc: Thomas Richter +Cc: Wang Nan +Fixes: 7903a7086723 ("perf script: Show symbol offsets by default") +Link: https://lkml.kernel.org/n/tip-hnizqwqrs03vcq1b74yao0f6@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/tests/shell/record+probe_libc_inet_pton.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/tests/shell/record+probe_libc_inet_pton.sh ++++ b/tools/perf/tests/shell/record+probe_libc_inet_pton.sh +@@ -48,7 +48,7 @@ trace_libc_inet_pton_backtrace() { + *) + eventattr='max-stack=3' + echo "getaddrinfo\+0x[[:xdigit:]]+[[:space:]]\($libc\)$" >> $expected +- echo ".*\+0x[[:xdigit:]]+[[:space:]]\(.*/bin/ping.*\)$" >> $expected ++ echo ".*(\+0x[[:xdigit:]]+|\[unknown\])[[:space:]]\(.*/bin/ping.*\)$" >> $expected + ;; + esac + diff --git a/queue-4.19/perf-tools-cleanup-trace-event-info-tdata-leak.patch b/queue-4.19/perf-tools-cleanup-trace-event-info-tdata-leak.patch new file mode 100644 index 00000000000..d7f18ea517c --- /dev/null +++ b/queue-4.19/perf-tools-cleanup-trace-event-info-tdata-leak.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sanskriti Sharma +Date: Tue, 2 Oct 2018 10:29:11 -0400 +Subject: perf tools: Cleanup trace-event-info 'tdata' leak + +From: Sanskriti Sharma + +[ Upstream commit faedbf3fd19f2511a39397f76359e4cc6ee93072 ] + +Free tracing_data structure in tracing_data_get() error paths. + +Fixes the following coverity complaint: + + Error: RESOURCE_LEAK (CWE-772): + leaked_storage: Variable "tdata" going out of scope leaks the storage + +Signed-off-by: Sanskriti Sharma +Reviewed-by: Jiri Olsa +Cc: Joe Lawrence +Link: http://lkml.kernel.org/r/1538490554-8161-3-git-send-email-sansharm@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/trace-event-info.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/tools/perf/util/trace-event-info.c ++++ b/tools/perf/util/trace-event-info.c +@@ -531,12 +531,14 @@ struct tracing_data *tracing_data_get(st + "/tmp/perf-XXXXXX"); + if (!mkstemp(tdata->temp_file)) { + pr_debug("Can't make temp file"); ++ free(tdata); + return NULL; + } + + temp_fd = open(tdata->temp_file, O_RDWR); + if (temp_fd < 0) { + pr_debug("Can't read '%s'", tdata->temp_file); ++ free(tdata); + return NULL; + } + diff --git a/queue-4.19/perf-tools-free-printk-string-in-parse_ftrace_printk.patch b/queue-4.19/perf-tools-free-printk-string-in-parse_ftrace_printk.patch new file mode 100644 index 00000000000..5a0c7c6ab66 --- /dev/null +++ b/queue-4.19/perf-tools-free-printk-string-in-parse_ftrace_printk.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sanskriti Sharma +Date: Tue, 2 Oct 2018 10:29:12 -0400 +Subject: perf tools: Free 'printk' string in parse_ftrace_printk() + +From: Sanskriti Sharma + +[ Upstream commit 9c8a182e5a73e01afd11742a2ab887bf338fdafd ] + +parse_ftrace_printk() tokenizes and parses a line, calling strdup() each +iteration. Add code to free this temporary format string duplicate. + +Fixes the following coverity complaints: + + Error: RESOURCE_LEAK (CWE-772): + tools/perf/util/trace-event-parse.c:158: overwrite_var: Overwriting + "printk" in "printk = strdup(fmt + 1)" leaks the storage that "printk" + points to. + + tools/perf/util/trace-event-parse.c:162: leaked_storage: Variable + "printk" going out of scope leaks the storage it points to. + +Signed-off-by: Sanskriti Sharma +Reviewed-by: Jiri Olsa +Cc: Joe Lawrence +Link: http://lkml.kernel.org/r/1538490554-8161-4-git-send-email-sansharm@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/trace-event-parse.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/perf/util/trace-event-parse.c ++++ b/tools/perf/util/trace-event-parse.c +@@ -158,6 +158,7 @@ void parse_ftrace_printk(struct tep_hand + printk = strdup(fmt+1); + line = strtok_r(NULL, "\n", &next); + tep_register_print_string(pevent, printk, addr); ++ free(printk); + } + } + diff --git a/queue-4.19/perf-tools-free-temporary-sys-string-in-read_event_files.patch b/queue-4.19/perf-tools-free-temporary-sys-string-in-read_event_files.patch new file mode 100644 index 00000000000..8c7f212f28d --- /dev/null +++ b/queue-4.19/perf-tools-free-temporary-sys-string-in-read_event_files.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Sanskriti Sharma +Date: Tue, 2 Oct 2018 10:29:14 -0400 +Subject: perf tools: Free temporary 'sys' string in read_event_files() + +From: Sanskriti Sharma + +[ Upstream commit 1e44224fb0528b4c0cc176bde2bb31e9127eb14b ] + +For each system in a given pevent, read_event_files() reads in a +temporary 'sys' string. Be sure to free this string before moving onto +to the next system and/or leaving read_event_files(). + +Fixes the following coverity complaints: + + Error: RESOURCE_LEAK (CWE-772): + + tools/perf/util/trace-event-read.c:343: overwrite_var: Overwriting + "sys" in "sys = read_string()" leaks the storage that "sys" points to. + + tools/perf/util/trace-event-read.c:353: leaked_storage: Variable "sys" + going out of scope leaks the storage it points to. + +Signed-off-by: Sanskriti Sharma +Reviewed-by: Jiri Olsa +Cc: Joe Lawrence +Link: http://lkml.kernel.org/r/1538490554-8161-6-git-send-email-sansharm@redhat.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/trace-event-read.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/trace-event-read.c ++++ b/tools/perf/util/trace-event-read.c +@@ -349,9 +349,12 @@ static int read_event_files(struct tep_h + for (x=0; x < count; x++) { + size = read8(pevent); + ret = read_event_file(pevent, sys, size); +- if (ret) ++ if (ret) { ++ free(sys); + return ret; ++ } + } ++ free(sys); + } + return 0; + } diff --git a/queue-4.19/pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch b/queue-4.19/pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch new file mode 100644 index 00000000000..e3ceeae1b17 --- /dev/null +++ b/queue-4.19/pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Stephen Boyd +Date: Thu, 30 Aug 2018 17:58:52 -0700 +Subject: pinctrl: qcom: spmi-mpp: Fix drive strength setting + +From: Stephen Boyd + +[ Upstream commit 89c68b102f13f123aaef22b292526d6b92501334 ] + +It looks like we parse the drive strength setting here, but never +actually write it into the hardware to update it. Parse the setting and +then write it at the end of the pinconf setting function so that it +actually sticks in the hardware. + +Fixes: 0e948042c420 ("pinctrl: qcom: spmi-mpp: Implement support for sink mode") +Cc: Doug Anderson +Signed-off-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +@@ -457,7 +457,7 @@ static int pmic_mpp_config_set(struct pi + pad->dtest = arg; + break; + case PIN_CONFIG_DRIVE_STRENGTH: +- arg = pad->drive_strength; ++ pad->drive_strength = arg; + break; + case PMIC_MPP_CONF_AMUX_ROUTE: + if (arg >= PMIC_MPP_AMUX_ROUTE_ABUS4) +@@ -504,6 +504,10 @@ static int pmic_mpp_config_set(struct pi + if (ret < 0) + return ret; + ++ ret = pmic_mpp_write(state, pad, PMIC_MPP_REG_SINK_CTL, pad->drive_strength); ++ if (ret < 0) ++ return ret; ++ + val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT; + + return pmic_mpp_write(state, pad, PMIC_MPP_REG_EN_CTL, val); diff --git a/queue-4.19/pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch b/queue-4.19/pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch new file mode 100644 index 00000000000..1c03ed52baa --- /dev/null +++ b/queue-4.19/pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: YueHaibing +Date: Thu, 20 Sep 2018 01:58:18 +0000 +Subject: pinctrl: qcom: spmi-mpp: Fix err handling of pmic_mpp_set_mux + +From: YueHaibing + +[ Upstream commit 69f8455f6cc78fa6cdf80d0105d7a748106271dc ] + +'ret' should be returned while pmic_mpp_write_mode_ctl fails. + +Fixes: 0e948042c420 ("pinctrl: qcom: spmi-mpp: Implement support for sink mode") +Signed-off-by: YueHaibing +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +@@ -319,6 +319,8 @@ static int pmic_mpp_set_mux(struct pinct + pad->function = function; + + ret = pmic_mpp_write_mode_ctl(state, pad); ++ if (ret < 0) ++ return ret; + + val = pad->is_enabled << PMIC_MPP_REG_MASTER_EN_SHIFT; + diff --git a/queue-4.19/pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch b/queue-4.19/pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch new file mode 100644 index 00000000000..5282915e6ae --- /dev/null +++ b/queue-4.19/pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch @@ -0,0 +1,91 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Douglas Anderson +Date: Thu, 30 Aug 2018 08:23:39 -0700 +Subject: pinctrl: spmi-mpp: Fix pmic_mpp_config_get() to be compliant + +From: Douglas Anderson + +[ Upstream commit 0d5b476f8f57fcb06c45fe27681ac47254f63fd2 ] + +If you look at "pinconf-groups" in debugfs for ssbi-mpp you'll notice +it looks like nonsense. + +The problem is fairly well described in commit 1cf86bc21257 ("pinctrl: +qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant") and +commit 05e0c828955c ("pinctrl: msm: Fix msm_config_group_get() to be +compliant"), but it was pointed out that ssbi-mpp has the same +problem. Let's fix it there too. + +NOTE: in case it's helpful to someone reading this, the way to tell +whether to do the -EINVAL or not is to look at the PCONFDUMP for a +given attribute. If the last element (has_arg) is false then you need +to do the -EINVAL trick. + +ALSO NOTE: it seems unlikely that the values returned when we try to +get PIN_CONFIG_BIAS_PULL_UP will actually be printed since "has_arg" +is false for that one, but I guess it's still fine to return different +values so I kept doing that. It seems like another driver (ssbi-gpio) +uses a custom attribute (PM8XXX_QCOM_PULL_UP_STRENGTH) for something +similar so maybe a future change should do that here too. + +Fixes: cfb24f6ebd38 ("pinctrl: Qualcomm SPMI PMIC MPP pin controller driver") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-spmi-mpp.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-mpp.c +@@ -345,13 +345,12 @@ static int pmic_mpp_config_get(struct pi + + switch (param) { + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup == PMIC_MPP_PULL_UP_OPEN; ++ if (pad->pullup != PMIC_MPP_PULL_UP_OPEN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: + switch (pad->pullup) { +- case PMIC_MPP_PULL_UP_OPEN: +- arg = 0; +- break; + case PMIC_MPP_PULL_UP_0P6KOHM: + arg = 600; + break; +@@ -366,13 +365,17 @@ static int pmic_mpp_config_get(struct pi + } + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +@@ -384,7 +387,9 @@ static int pmic_mpp_config_get(struct pi + arg = pad->amux_input; + break; + case PMIC_MPP_CONF_PAIRED: +- arg = pad->paired; ++ if (!pad->paired) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_STRENGTH: + arg = pad->drive_strength; diff --git a/queue-4.19/pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch b/queue-4.19/pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch new file mode 100644 index 00000000000..3b9d34e6c86 --- /dev/null +++ b/queue-4.19/pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Douglas Anderson +Date: Thu, 30 Aug 2018 08:23:38 -0700 +Subject: pinctrl: ssbi-gpio: Fix pm8xxx_pin_config_get() to be compliant + +From: Douglas Anderson + +[ Upstream commit b432414b996d32a1bd9afe2bd595bd5729c1477f ] + +If you look at "pinconf-groups" in debugfs for ssbi-gpio you'll notice +it looks like nonsense. + +The problem is fairly well described in commit 1cf86bc21257 ("pinctrl: +qcom: spmi-gpio: Fix pmic_gpio_config_get() to be compliant") and +commit 05e0c828955c ("pinctrl: msm: Fix msm_config_group_get() to be +compliant"), but it was pointed out that ssbi-gpio has the same +problem. Let's fix it there too. + +Fixes: b4c45fe974bc ("pinctrl: qcom: ssbi: Family A gpio & mpp drivers") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -260,22 +260,32 @@ static int pm8xxx_pin_config_get(struct + + switch (param) { + case PIN_CONFIG_BIAS_DISABLE: +- arg = pin->bias == PM8XXX_GPIO_BIAS_NP; ++ if (pin->bias != PM8XXX_GPIO_BIAS_NP) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pin->bias == PM8XXX_GPIO_BIAS_PD; ++ if (pin->bias != PM8XXX_GPIO_BIAS_PD) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pin->bias <= PM8XXX_GPIO_BIAS_PU_1P5_30; ++ if (pin->bias > PM8XXX_GPIO_BIAS_PU_1P5_30) ++ return -EINVAL; ++ arg = 1; + break; + case PM8XXX_QCOM_PULL_UP_STRENGTH: + arg = pin->pull_up_strength; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = pin->disable; ++ if (!pin->disable) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pin->mode == PM8XXX_GPIO_MODE_INPUT; ++ if (pin->mode != PM8XXX_GPIO_MODE_INPUT) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + if (pin->mode & PM8XXX_GPIO_MODE_OUTPUT) +@@ -290,10 +300,14 @@ static int pm8xxx_pin_config_get(struct + arg = pin->output_strength; + break; + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = !pin->open_drain; ++ if (pin->open_drain) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pin->open_drain; ++ if (!pin->open_drain) ++ return -EINVAL; ++ arg = 1; + break; + default: + return -EINVAL; diff --git a/queue-4.19/pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch b/queue-4.19/pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch new file mode 100644 index 00000000000..f90c4892334 --- /dev/null +++ b/queue-4.19/pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: YueHaibing +Date: Fri, 21 Sep 2018 09:59:41 +0800 +Subject: pinctrl: sunxi: fix 'pctrl->functions' allocation in sunxi_pinctrl_build_state + +From: YueHaibing + +[ Upstream commit a4925311a5443126ecc90671a1604ea7b0f5b32e ] + +fixes following Smatch static check warning: + + ./drivers/pinctrl/sunxi/pinctrl-sunxi.c:1112 sunxi_pinctrl_build_state() + warn: passing devm_ allocated variable to kfree. 'pctrl->functions' + +As we will be calling krealloc() on pointer 'pctrl->functions', which means +kfree() will be called in there, devm_kzalloc() shouldn't be used with +the allocation in the first place. Fix the warning by calling kcalloc() +and managing the free procedure in error path on our own. + +Fixes: 0e37f88d9ad8 ("ARM: sunxi: Add pinctrl driver for Allwinner SoCs") +Signed-off-by: YueHaibing +Acked-by: Maxime Ripard +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c ++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c +@@ -1079,10 +1079,9 @@ static int sunxi_pinctrl_build_state(str + * We suppose that we won't have any more functions than pins, + * we'll reallocate that later anyway + */ +- pctl->functions = devm_kcalloc(&pdev->dev, +- pctl->ngroups, +- sizeof(*pctl->functions), +- GFP_KERNEL); ++ pctl->functions = kcalloc(pctl->ngroups, ++ sizeof(*pctl->functions), ++ GFP_KERNEL); + if (!pctl->functions) + return -ENOMEM; + +@@ -1133,8 +1132,10 @@ static int sunxi_pinctrl_build_state(str + + func_item = sunxi_pinctrl_find_function_by_name(pctl, + func->name); +- if (!func_item) ++ if (!func_item) { ++ kfree(pctl->functions); + return -EINVAL; ++ } + + if (!func_item->groups) { + func_item->groups = +@@ -1142,8 +1143,10 @@ static int sunxi_pinctrl_build_state(str + func_item->ngroups, + sizeof(*func_item->groups), + GFP_KERNEL); +- if (!func_item->groups) ++ if (!func_item->groups) { ++ kfree(pctl->functions); + return -ENOMEM; ++ } + } + + func_grp = func_item->groups; diff --git a/queue-4.19/rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch b/queue-4.19/rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch new file mode 100644 index 00000000000..db1b74261a5 --- /dev/null +++ b/queue-4.19/rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Selvin Xavier +Date: Mon, 8 Oct 2018 03:27:56 -0700 +Subject: RDMA/bnxt_re: Avoid accessing nq->bar_reg_iomem in failure case + +From: Selvin Xavier + +[ Upstream commit ed51efd2ce44091a858ad829f666727e7c95695e ] + +In the failure path, nq->bar_reg_iomem gets accessed without +initializing. Avoid this by calling the bnxt_qplib_nq_stop_irq only if the +initialization is complete. + +Reported-by: Dan Carpenter +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Fixes: 6e04b1035689 ("RDMA/bnxt_re: Fix broken RoCE driver due to recent L2 driver changes") +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -360,7 +360,8 @@ void bnxt_qplib_disable_nq(struct bnxt_q + } + + /* Make sure the HW is stopped! */ +- bnxt_qplib_nq_stop_irq(nq, true); ++ if (nq->requested) ++ bnxt_qplib_nq_stop_irq(nq, true); + + if (nq->bar_reg_iomem) + iounmap(nq->bar_reg_iomem); diff --git a/queue-4.19/rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch b/queue-4.19/rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch new file mode 100644 index 00000000000..b15caac99f7 --- /dev/null +++ b/queue-4.19/rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch @@ -0,0 +1,90 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Selvin Xavier +Date: Mon, 8 Oct 2018 03:27:53 -0700 +Subject: RDMA/bnxt_re: Fix recursive lock warning in debug kernel + +From: Selvin Xavier + +[ Upstream commit d455f29f6d76a5f94881ca1289aaa1e90617ff5d ] + +Fix possible recursive lock warning. Its a false warning as the locks are +part of two differnt HW Queue data structure - cmdq and creq. Debug kernel +is throwing the following warning and stack trace. + +[ 783.914967] ============================================ +[ 783.914970] WARNING: possible recursive locking detected +[ 783.914973] 4.19.0-rc2+ #33 Not tainted +[ 783.914976] -------------------------------------------- +[ 783.914979] swapper/2/0 is trying to acquire lock: +[ 783.914982] 000000002aa3949d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] +[ 783.914999] +but task is already holding lock: +[ 783.915002] 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re] +[ 783.915013] +other info that might help us debug this: +[ 783.915016] Possible unsafe locking scenario: + +[ 783.915019] CPU0 +[ 783.915021] ---- +[ 783.915034] lock(&(&hwq->lock)->rlock); +[ 783.915035] lock(&(&hwq->lock)->rlock); +[ 783.915037] + *** DEADLOCK *** + +[ 783.915038] May be due to missing lock nesting notation + +[ 783.915039] 1 lock held by swapper/2/0: +[ 783.915040] #0: 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re] +[ 783.915044] +stack backtrace: +[ 783.915046] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.0-rc2+ #33 +[ 783.915047] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014 +[ 783.915048] Call Trace: +[ 783.915049] +[ 783.915054] dump_stack+0x90/0xe3 +[ 783.915058] __lock_acquire+0x106c/0x1080 +[ 783.915061] ? sched_clock+0x5/0x10 +[ 783.915063] lock_acquire+0xbd/0x1a0 +[ 783.915065] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] +[ 783.915069] _raw_spin_lock_irqsave+0x4a/0x90 +[ 783.915071] ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] +[ 783.915073] bnxt_qplib_service_creq+0x232/0x350 [bnxt_re] +[ 783.915078] tasklet_action_common.isra.17+0x197/0x1b0 +[ 783.915081] __do_softirq+0xcb/0x3a6 +[ 783.915084] irq_exit+0xe9/0x100 +[ 783.915085] do_IRQ+0x6a/0x120 +[ 783.915087] common_interrupt+0xf/0xf +[ 783.915088] + +Use nested notation for the spin_lock to avoid this warning. + +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -309,8 +309,17 @@ static int bnxt_qplib_process_qp_event(s + rcfw->aeq_handler(rcfw, qp_event, qp); + break; + default: +- /* Command Response */ +- spin_lock_irqsave(&cmdq->lock, flags); ++ /* ++ * Command Response ++ * cmdq->lock needs to be acquired to synchronie ++ * the command send and completion reaping. This function ++ * is always called with creq->lock held. Using ++ * the nested variant of spin_lock. ++ * ++ */ ++ ++ spin_lock_irqsave_nested(&cmdq->lock, flags, ++ SINGLE_DEPTH_NESTING); + cookie = le16_to_cpu(qp_event->cookie); + mcookie = qp_event->cookie; + blocked = cookie & RCFW_CMD_IS_BLOCKING; diff --git a/queue-4.19/rdma-cm-respect-returned-status-of-cm_init_av_by_path.patch b/queue-4.19/rdma-cm-respect-returned-status-of-cm_init_av_by_path.patch new file mode 100644 index 00000000000..9b2744e1ab0 --- /dev/null +++ b/queue-4.19/rdma-cm-respect-returned-status-of-cm_init_av_by_path.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Leon Romanovsky +Date: Thu, 11 Oct 2018 22:36:10 +0300 +Subject: RDMA/cm: Respect returned status of cm_init_av_by_path + +From: Leon Romanovsky + +[ Upstream commit e54b6a3bcd1ec972b25a164bdf495d9e7120b107 ] + +Add missing check for failure of cm_init_av_by_path + +Fixes: e1444b5a163e ("IB/cm: Fix automatic path migration support") +Reported-by: Slava Shwartsman +Reviewed-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/cm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -3292,8 +3292,11 @@ static int cm_lap_handler(struct cm_work + if (ret) + goto unlock; + +- cm_init_av_by_path(param->alternate_path, NULL, &cm_id_priv->alt_av, +- cm_id_priv); ++ ret = cm_init_av_by_path(param->alternate_path, NULL, ++ &cm_id_priv->alt_av, cm_id_priv); ++ if (ret) ++ goto unlock; ++ + cm_id_priv->id.lap_state = IB_CM_LAP_RCVD; + cm_id_priv->tid = lap_msg->hdr.tid; + ret = atomic_inc_and_test(&cm_id_priv->work_count); diff --git a/queue-4.19/rdma-core-do-not-expose-unsupported-counters.patch b/queue-4.19/rdma-core-do-not-expose-unsupported-counters.patch new file mode 100644 index 00000000000..7916f9a86ea --- /dev/null +++ b/queue-4.19/rdma-core-do-not-expose-unsupported-counters.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Parav Pandit +Date: Sun, 7 Oct 2018 12:12:40 +0300 +Subject: RDMA/core: Do not expose unsupported counters + +From: Parav Pandit + +[ Upstream commit 0f6ef65d1c6ec8deb5d0f11f86631ec4cfe8f22e ] + +If the provider driver (such as rdma_rxe) doesn't support pma counters, +avoid exposing its directory similar to optional hw_counters directory. +If core fails to read the PMA counter, return an error so that user can +retry later if needed. + +Fixes: 35c4cbb17811 ("IB/core: Create get_perf_mad function in sysfs.c") +Reported-by: Holger Hoffstätte +Tested-by: Holger Hoffstätte +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/sysfs.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +--- a/drivers/infiniband/core/sysfs.c ++++ b/drivers/infiniband/core/sysfs.c +@@ -512,7 +512,7 @@ static ssize_t show_pma_counter(struct i + ret = get_perf_mad(p->ibdev, p->port_num, tab_attr->attr_id, &data, + 40 + offset / 8, sizeof(data)); + if (ret < 0) +- return sprintf(buf, "N/A (no PMA)\n"); ++ return ret; + + switch (width) { + case 4: +@@ -1057,10 +1057,12 @@ static int add_port(struct ib_device *de + goto err_put; + } + +- p->pma_table = get_counter_table(device, port_num); +- ret = sysfs_create_group(&p->kobj, p->pma_table); +- if (ret) +- goto err_put_gid_attrs; ++ if (device->process_mad) { ++ p->pma_table = get_counter_table(device, port_num); ++ ret = sysfs_create_group(&p->kobj, p->pma_table); ++ if (ret) ++ goto err_put_gid_attrs; ++ } + + p->gid_group.name = "gids"; + p->gid_group.attrs = alloc_group_attrs(show_port_gid, attr.gid_tbl_len); +@@ -1173,7 +1175,8 @@ err_free_gid: + p->gid_group.attrs = NULL; + + err_remove_pma: +- sysfs_remove_group(&p->kobj, p->pma_table); ++ if (p->pma_table) ++ sysfs_remove_group(&p->kobj, p->pma_table); + + err_put_gid_attrs: + kobject_put(&p->gid_attr_group->kobj); +@@ -1285,7 +1288,9 @@ static void free_port_list_attributes(st + kfree(port->hw_stats); + free_hsag(&port->kobj, port->hw_stats_ag); + } +- sysfs_remove_group(p, port->pma_table); ++ ++ if (port->pma_table) ++ sysfs_remove_group(p, port->pma_table); + sysfs_remove_group(p, &port->pkey_group); + sysfs_remove_group(p, &port->gid_group); + sysfs_remove_group(&port->gid_attr_group->kobj, diff --git a/queue-4.19/rsi-fix-memory-alignment-issue-in-arm32-platforms.patch b/queue-4.19/rsi-fix-memory-alignment-issue-in-arm32-platforms.patch new file mode 100644 index 00000000000..90f0219e259 --- /dev/null +++ b/queue-4.19/rsi-fix-memory-alignment-issue-in-arm32-platforms.patch @@ -0,0 +1,100 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Siva Rebbagondla +Date: Mon, 27 Aug 2018 17:05:14 +0530 +Subject: rsi: fix memory alignment issue in ARM32 platforms + +From: Siva Rebbagondla + +[ Upstream commit baa8caf4ab7af2d9e84b566b99fe919a4e9e7562 ] + +During testing in ARM32 platforms, observed below kernel panic, as driver +accessing data beyond the allocated memory while submitting URB to USB. + +Fix: Resolved this by specifying correct length by considering 64 bit +alignment. so that, USB bus driver will access only allocated memory. + +Unit-test: Tested and confirm that driver bring up and scanning, +connection and data transfer works fine with this fix. + +...skipping... +[ 25.389450] Unable to handle kernel paging request at virtual + address 5aa11422 +[ 25.403078] Internal error: Oops: 5 [#1] SMP ARM +[ 25.407703] Modules linked in: rsi_usb +[ 25.411473] CPU: 1 PID: 317 Comm: RX-Thread Not tainted 4.18.0-rc7 #1 +[ 25.419221] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) +[ 25.425764] PC is at skb_release_data+0x90/0x168 +[ 25.430393] LR is at skb_release_all+0x28/0x2c +[ 25.434842] pc : [<807435b0>] lr : [<80742ba0>] psr: 200e0013 5aa1141e +[ 25.464633] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 25.477524] Process RX-Thread (pid: 317, stack limit = 0x(ptrval)) +[ 25.483709] Stack: (0xedf69ed8 to 0xedf6a000) +[ 25.569907] Backtrace: +[ 25.572368] [<80743520>] (skb_release_data) from [<80742ba0>] + (skb_release_all+0x28/0x2c) +[ 25.580555] r9:7f00258c r8:00000001 r7:ee355000 r6:eddab0d0 + r5:eddab000 r4:eddbb840 +[ 25.588308] [<80742b78>] (skb_release_all) from [<807432cc>] + (consume_skb+0x30/0x50) +[ 25.596055] r5:eddab000 r4:eddbb840 +[ 25.599648] [<8074329c>] (consume_skb) from [<7f00117c>] + (rsi_usb_rx_thread+0x64/0x12c [rsi_usb]) +[ 25.608524] r5:eddab000 r4:eddbb840 +[ 25.612116] [<7f001118>] (rsi_usb_rx_thread [rsi_usb]) from + [<80142750>] (kthread+0x11c/0x15c) +[ 25.620735] r10:ee9ff9e0 r9:edcde3b8 r8:ee355000 r7:edf68000 + r6:edd3a780 r5:00000000 +[ 25.628567] r4:edcde380 +[ 25.631110] [<80142634>] (kthread) from [<801010e8>] + (ret_from_fork+0x14/0x2c) +[ 25.638336] Exception stack(0xedf69fb0 to 0xedf69ff8) +[ 25.682929] ---[ end trace 8236a5496f5b5d3b ]--- + +Signed-off-by: Siva Rebbagondla +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_usb.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct u + if (urb->status) + goto out; + +- if (urb->actual_length <= 0) { +- rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__); ++ if (urb->actual_length <= 0 || ++ urb->actual_length > rx_cb->rx_skb->len) { ++ rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n", ++ __func__, urb->actual_length); + goto out; + } + if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) { + rsi_dbg(INFO_ZONE, "Max RX packets reached\n"); + goto out; + } +- skb_put(rx_cb->rx_skb, urb->actual_length); ++ skb_trim(rx_cb->rx_skb, urb->actual_length); + skb_queue_tail(&dev->rx_q, rx_cb->rx_skb); + + rsi_set_event(&dev->rx_thread.event); +@@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_ + if (!skb) + return -ENOMEM; + skb_reserve(skb, MAX_DWORD_ALIGN_BYTES); ++ skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES); + dword_align_bytes = (unsigned long)skb->data & 0x3f; + if (dword_align_bytes > 0) + skb_push(skb, dword_align_bytes); +@@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_ + usb_rcvbulkpipe(dev->usbdev, + dev->bulkin_endpoint_addr[ep_num - 1]), + urb->transfer_buffer, +- RSI_MAX_RX_USB_PKT_SIZE, ++ skb->len, + rsi_rx_done_handler, + rx_cb); + diff --git a/queue-4.19/s390-sthyi-fix-machine-name-validity-indication.patch b/queue-4.19/s390-sthyi-fix-machine-name-validity-indication.patch new file mode 100644 index 00000000000..fa9ba5bfb2a --- /dev/null +++ b/queue-4.19/s390-sthyi-fix-machine-name-validity-indication.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Janosch Frank +Date: Tue, 2 Oct 2018 10:57:52 +0200 +Subject: s390/sthyi: Fix machine name validity indication + +From: Janosch Frank + +[ Upstream commit b5130dc2224d1881f24224c0590c6d97f2168d6a ] + +When running as a level 3 guest with no host provided sthyi support +sclp_ocf_cpc_name_copy() will only return zeroes. Zeroes are not a +valid group name, so let's not indicate that the group name field is +valid. + +Also the group name is not dependent on stsi, let's not return based +on stsi before setting it. + +Fixes: 95ca2cb57985 ("KVM: s390: Add sthyi emulation") +Signed-off-by: Janosch Frank +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/sthyi.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/arch/s390/kernel/sthyi.c ++++ b/arch/s390/kernel/sthyi.c +@@ -183,17 +183,19 @@ static void fill_hdr(struct sthyi_sctns + static void fill_stsi_mac(struct sthyi_sctns *sctns, + struct sysinfo_1_1_1 *sysinfo) + { ++ sclp_ocf_cpc_name_copy(sctns->mac.infmname); ++ if (*(u64 *)sctns->mac.infmname != 0) ++ sctns->mac.infmval1 |= MAC_NAME_VLD; ++ + if (stsi(sysinfo, 1, 1, 1)) + return; + +- sclp_ocf_cpc_name_copy(sctns->mac.infmname); +- + memcpy(sctns->mac.infmtype, sysinfo->type, sizeof(sctns->mac.infmtype)); + memcpy(sctns->mac.infmmanu, sysinfo->manufacturer, sizeof(sctns->mac.infmmanu)); + memcpy(sctns->mac.infmpman, sysinfo->plant, sizeof(sctns->mac.infmpman)); + memcpy(sctns->mac.infmseq, sysinfo->sequence, sizeof(sctns->mac.infmseq)); + +- sctns->mac.infmval1 |= MAC_ID_VLD | MAC_NAME_VLD; ++ sctns->mac.infmval1 |= MAC_ID_VLD; + } + + static void fill_stsi_par(struct sthyi_sctns *sctns, diff --git a/queue-4.19/scsi-esp_scsi-track-residual-for-pio-transfers.patch b/queue-4.19/scsi-esp_scsi-track-residual-for-pio-transfers.patch new file mode 100644 index 00000000000..ced8cba6236 --- /dev/null +++ b/queue-4.19/scsi-esp_scsi-track-residual-for-pio-transfers.patch @@ -0,0 +1,68 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Finn Thain +Date: Tue, 16 Oct 2018 16:31:25 +1100 +Subject: scsi: esp_scsi: Track residual for PIO transfers + +From: Finn Thain + +[ Upstream commit fd47d919d0c336e7c22862b51ee94927ffea227a ] + +If a target disconnects during a PIO data transfer the command may fail +when the target reconnects: + +scsi host1: DMA length is zero! +scsi host1: cur adr[04380000] len[00000000] + +The scsi bus is then reset. This happens because the residual reached +zero before the transfer was completed. + +The usual residual calculation relies on the Transfer Count registers. +That works for DMA transfers but not for PIO transfers. Fix the problem +by storing the PIO transfer residual and using that to correctly +calculate bytes_sent. + +Fixes: 6fe07aaffbf0 ("[SCSI] m68k: new mac_esp scsi driver") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Tested-by: Michael Schmitz +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/esp_scsi.c | 1 + + drivers/scsi/esp_scsi.h | 2 ++ + drivers/scsi/mac_esp.c | 2 ++ + 3 files changed, 5 insertions(+) + +--- a/drivers/scsi/esp_scsi.c ++++ b/drivers/scsi/esp_scsi.c +@@ -1338,6 +1338,7 @@ static int esp_data_bytes_sent(struct es + + bytes_sent = esp->data_dma_len; + bytes_sent -= ecount; ++ bytes_sent -= esp->send_cmd_residual; + + /* + * The am53c974 has a DMA 'pecularity'. The doc states: +--- a/drivers/scsi/esp_scsi.h ++++ b/drivers/scsi/esp_scsi.h +@@ -540,6 +540,8 @@ struct esp { + + void *dma; + int dmarev; ++ ++ u32 send_cmd_residual; + }; + + /* A front-end driver for the ESP chip should do the following in +--- a/drivers/scsi/mac_esp.c ++++ b/drivers/scsi/mac_esp.c +@@ -427,6 +427,8 @@ static void mac_esp_send_pio_cmd(struct + scsi_esp_cmd(esp, ESP_CMD_TI); + } + } ++ ++ esp->send_cmd_residual = esp_count; + } + + static int mac_esp_irq_pending(struct esp *esp) diff --git a/queue-4.19/scsi-lpfc-correct-race-with-abort-on-completion-path.patch b/queue-4.19/scsi-lpfc-correct-race-with-abort-on-completion-path.patch new file mode 100644 index 00000000000..8831da84ae0 --- /dev/null +++ b/queue-4.19/scsi-lpfc-correct-race-with-abort-on-completion-path.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: James Smart +Date: Mon, 10 Sep 2018 10:30:44 -0700 +Subject: scsi: lpfc: Correct race with abort on completion path + +From: James Smart + +[ Upstream commit ca7fb76e091f889cfda1287c07a9358f73832b39 ] + +On io completion, the driver is taking an adapter wide lock and nulling the +scsi command back pointer. The nulling of the back pointer is to signify the +io was completed and the scsi_done() routine was called. However, the routine +makes no check to see if the abort routine had done the same thing and +possibly nulled the pointer. Thus it may doubly-complete the io. + +Make the following mods: + +- Check to make sure forward progress (call scsi_done()) only happens if the + command pointer was non-null. + +- As the taking of the lock, which is adapter wide, is very costly on a system + under load, null the pointer using an xchg operation rather than under lock. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_scsi.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_scsi.c ++++ b/drivers/scsi/lpfc/lpfc_scsi.c +@@ -4158,9 +4158,17 @@ lpfc_scsi_cmd_iocb_cmpl(struct lpfc_hba + } + lpfc_scsi_unprep_dma_buf(phba, lpfc_cmd); + +- spin_lock_irqsave(&phba->hbalock, flags); +- lpfc_cmd->pCmd = NULL; +- spin_unlock_irqrestore(&phba->hbalock, flags); ++ /* If pCmd was set to NULL from abort path, do not call scsi_done */ ++ if (xchg(&lpfc_cmd->pCmd, NULL) == NULL) { ++ lpfc_printf_vlog(vport, KERN_INFO, LOG_FCP, ++ "0711 FCP cmd already NULL, sid: 0x%06x, " ++ "did: 0x%06x, oxid: 0x%04x\n", ++ vport->fc_myDID, ++ (pnode) ? pnode->nlp_DID : 0, ++ phba->sli_rev == LPFC_SLI_REV4 ? ++ lpfc_cmd->cur_iocbq.sli4_xritag : 0xffff); ++ return; ++ } + + /* The sdev is not guaranteed to be valid post scsi_done upcall. */ + cmd->scsi_done(cmd); diff --git a/queue-4.19/scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch b/queue-4.19/scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch new file mode 100644 index 00000000000..15156c813b4 --- /dev/null +++ b/queue-4.19/scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch @@ -0,0 +1,60 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: James Smart +Date: Mon, 10 Sep 2018 10:30:45 -0700 +Subject: scsi: lpfc: Correct soft lockup when running mds diagnostics + +From: James Smart + +[ Upstream commit 0ef01a2d95fd62bb4f536e7ce4d5e8e74b97a244 ] + +When running an mds diagnostic that passes frames with the switch, soft +lockups are detected. The driver is in a CQE processing loop and has +sufficient amount of traffic that it never exits the ring processing routine, +thus the "lockup". + +Cap the number of elements in the work processing routine to 64 elements. This +ensures that the cpu will be given up and the handler reschedule to process +additional items. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_sli.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -3797,6 +3797,7 @@ lpfc_sli_handle_slow_ring_event_s4(struc + struct hbq_dmabuf *dmabuf; + struct lpfc_cq_event *cq_event; + unsigned long iflag; ++ int count = 0; + + spin_lock_irqsave(&phba->hbalock, iflag); + phba->hba_flag &= ~HBA_SP_QUEUE_EVT; +@@ -3818,16 +3819,22 @@ lpfc_sli_handle_slow_ring_event_s4(struc + if (irspiocbq) + lpfc_sli_sp_handle_rspiocb(phba, pring, + irspiocbq); ++ count++; + break; + case CQE_CODE_RECEIVE: + case CQE_CODE_RECEIVE_V1: + dmabuf = container_of(cq_event, struct hbq_dmabuf, + cq_event); + lpfc_sli4_handle_received_buffer(phba, dmabuf); ++ count++; + break; + default: + break; + } ++ ++ /* Limit the number of events to 64 to avoid soft lockups */ ++ if (count == 64) ++ break; + } + } + diff --git a/queue-4.19/scsi-megaraid_sas-fix-a-missing-check-bug.patch b/queue-4.19/scsi-megaraid_sas-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..602a99a8e0a --- /dev/null +++ b/queue-4.19/scsi-megaraid_sas-fix-a-missing-check-bug.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Wenwen Wang +Date: Sat, 6 Oct 2018 13:34:21 -0500 +Subject: scsi: megaraid_sas: fix a missing-check bug + +From: Wenwen Wang + +[ Upstream commit 47db7873136a9c57c45390a53b57019cf73c8259 ] + +In megasas_mgmt_compat_ioctl_fw(), to handle the structure +compat_megasas_iocpacket 'cioc', a user-space structure megasas_iocpacket +'ioc' is allocated before megasas_mgmt_ioctl_fw() is invoked to handle +the packet. Since the two data structures have different fields, the data +is copied from 'cioc' to 'ioc' field by field. In the copy process, +'sense_ptr' is prepared if the field 'sense_len' is not null, because it +will be used in megasas_mgmt_ioctl_fw(). To prepare 'sense_ptr', the +user-space data 'ioc->sense_off' and 'cioc->sense_off' are copied and +saved to kernel-space variables 'local_sense_off' and 'user_sense_off' +respectively. Given that 'ioc->sense_off' is also copied from +'cioc->sense_off', 'local_sense_off' and 'user_sense_off' should have the +same value. However, 'cioc' is in the user space and a malicious user can +race to change the value of 'cioc->sense_off' after it is copied to +'ioc->sense_off' but before it is copied to 'user_sense_off'. By doing +so, the attacker can inject different values into 'local_sense_off' and +'user_sense_off'. This can cause undefined behavior in the following +execution, because the two variables are supposed to be same. + +This patch enforces a check on the two kernel variables 'local_sense_off' +and 'user_sense_off' to make sure they are the same after the copy. In +case they are not, an error code EINVAL will be returned. + +Signed-off-by: Wenwen Wang +Acked-by: Sumit Saxena +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -7523,6 +7523,9 @@ static int megasas_mgmt_compat_ioctl_fw( + get_user(user_sense_off, &cioc->sense_off)) + return -EFAULT; + ++ if (local_sense_off != user_sense_off) ++ return -EINVAL; ++ + if (local_sense_len) { + void __user **sense_ioc_ptr = + (void __user **)((u8 *)((unsigned long)&ioc->frame.raw) + local_sense_off); diff --git a/queue-4.19/scsi-qla2xxx-fix-recursive-mailbox-timeout.patch b/queue-4.19/scsi-qla2xxx-fix-recursive-mailbox-timeout.patch new file mode 100644 index 00000000000..cde5d2ae000 --- /dev/null +++ b/queue-4.19/scsi-qla2xxx-fix-recursive-mailbox-timeout.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Quinn Tran +Date: Wed, 26 Sep 2018 22:05:16 -0700 +Subject: scsi: qla2xxx: Fix recursive mailbox timeout + +From: Quinn Tran + +[ Upstream commit 710bc78f829d014eca95ed7ccc4052bc064b1320 ] + +This patch prevents user space mailbox request from doing chip reset if the +mailbox timed out. The chip reset is only reserved for the DPC thread to +ensure all mailbox requests are flushed properly. The DPC thread is +responsible for the flushing all MBs and chip reset. + +Fixes: b2000805a975 ("scsi: qla2xxx: Flush mailbox commands on chip reset") +Cc: +Signed-off-by: Quinn Tran +Reviewed-by: Ewan D. Milne +Signed-off-by: Himanshu Madhani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -493,7 +493,7 @@ qla2x00_mailbox_command(scsi_qla_host_t + set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); + qla2xxx_wake_dpc(vha); + } +- } else if (!abort_active) { ++ } else if (current == ha->dpc_thread) { + /* call abort directly since we are in the DPC thread */ + ql_dbg(ql_dbg_mbx, vha, 0x101d, + "Timeout, calling abort_isp.\n"); diff --git a/queue-4.19/scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch b/queue-4.19/scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch new file mode 100644 index 00000000000..0808e9c91e7 --- /dev/null +++ b/queue-4.19/scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Evan Green +Date: Fri, 5 Oct 2018 10:27:32 -0700 +Subject: scsi: ufs: Schedule clk gating work on correct queue + +From: Evan Green + +[ Upstream commit f4bb7704699beee9edfbee875daa9089c86cf724 ] + +With commit 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate +workqueue"), clock gating work was moved to a separate work queue with +WQ_MEM_RECLAIM set, since clock gating could occur from a memory reclaim +context. Unfortunately, clk_gating.gate_work was left queued via +schedule_delayed_work, which is a system workqueue that does not have +WQ_MEM_RECLAIM set. Because ufshcd_ungate_work attempts to cancel +gate_work, the following warning appears: + +[ 14.174170] workqueue: WQ_MEM_RECLAIM ufs_clk_gating_0:ufshcd_ungate_work is flushing !WQ_MEM_RECLAIM events:ufshcd_gate_work +[ 14.174179] WARNING: CPU: 4 PID: 173 at kernel/workqueue.c:2440 check_flush_dependency+0x110/0x118 +[ 14.205725] CPU: 4 PID: 173 Comm: kworker/u16:3 Not tainted 4.14.68 #1 +[ 14.212437] Hardware name: Google Cheza (rev1) (DT) +[ 14.217459] Workqueue: ufs_clk_gating_0 ufshcd_ungate_work +[ 14.223107] task: ffffffc0f6a40080 task.stack: ffffff800a490000 +[ 14.229195] PC is at check_flush_dependency+0x110/0x118 +[ 14.234569] LR is at check_flush_dependency+0x110/0x118 +[ 14.239944] pc : [] lr : [] pstate: 60c001c9 +[ 14.333050] Call trace: +[ 14.427767] [] check_flush_dependency+0x110/0x118 +[ 14.434219] [] start_flush_work+0xac/0x1fc +[ 14.440046] [] flush_work+0x40/0x94 +[ 14.445246] [] __cancel_work_timer+0x11c/0x1b8 +[ 14.451433] [] cancel_delayed_work_sync+0x20/0x30 +[ 14.457886] [] ufshcd_ungate_work+0x24/0xd0 +[ 14.463800] [] process_one_work+0x32c/0x690 +[ 14.469713] [] worker_thread+0x218/0x338 +[ 14.475361] [] kthread+0x120/0x130 +[ 14.480470] [] ret_from_fork+0x10/0x18 + +The simple solution is to put the gate_work on the same WQ_MEM_RECLAIM +work queue as the ungate_work. + +Fixes: 10e5e37581fc ("scsi: ufs: Add clock ungating to a separate workqueue") +Signed-off-by: Evan Green +Reviewed-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1691,8 +1691,9 @@ static void __ufshcd_release(struct ufs_ + + hba->clk_gating.state = REQ_CLKS_OFF; + trace_ufshcd_clk_gating(dev_name(hba->dev), hba->clk_gating.state); +- schedule_delayed_work(&hba->clk_gating.gate_work, +- msecs_to_jiffies(hba->clk_gating.delay_ms)); ++ queue_delayed_work(hba->clk_gating.clk_gating_workq, ++ &hba->clk_gating.gate_work, ++ msecs_to_jiffies(hba->clk_gating.delay_ms)); + } + + void ufshcd_release(struct ufs_hba *hba) diff --git a/queue-4.19/sdhci-acpi-add-free_slot-callback.patch b/queue-4.19/sdhci-acpi-add-free_slot-callback.patch new file mode 100644 index 00000000000..94ca883c61a --- /dev/null +++ b/queue-4.19/sdhci-acpi-add-free_slot-callback.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Wang Dongsheng +Date: Thu, 16 Aug 2018 12:48:42 +0800 +Subject: sdhci: acpi: add free_slot callback + +From: Wang Dongsheng + +[ Upstream commit c7eabbee3de99347105faa7fd925a500ccf43baf ] + +The device specific resource can be free in free_slot after +removing host controller. + +Signed-off-by: Wang Dongsheng +Acked-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-acpi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/mmc/host/sdhci-acpi.c ++++ b/drivers/mmc/host/sdhci-acpi.c +@@ -76,6 +76,7 @@ struct sdhci_acpi_slot { + size_t priv_size; + int (*probe_slot)(struct platform_device *, const char *, const char *); + int (*remove_slot)(struct platform_device *); ++ int (*free_slot)(struct platform_device *pdev); + int (*setup_host)(struct platform_device *pdev); + }; + +@@ -756,6 +757,9 @@ static int sdhci_acpi_probe(struct platf + err_cleanup: + sdhci_cleanup_host(c->host); + err_free: ++ if (c->slot && c->slot->free_slot) ++ c->slot->free_slot(pdev); ++ + sdhci_free_host(c->host); + return err; + } +@@ -777,6 +781,10 @@ static int sdhci_acpi_remove(struct plat + + dead = (sdhci_readl(c->host, SDHCI_INT_STATUS) == ~0); + sdhci_remove_host(c->host, dead); ++ ++ if (c->slot && c->slot->free_slot) ++ c->slot->free_slot(pdev); ++ + sdhci_free_host(c->host); + + return 0; diff --git a/queue-4.19/series b/queue-4.19/series index 7eb20908bff..3c5f1bad99b 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -44,3 +44,149 @@ x86-corruption-check-fix-panic-in-memory_corruption_check-when-boot-option-witho x86-kvm-nvmx-allow-bare-vmxon-state-migration.patch x86-mm-pat-disable-preemption-around-__flush_tlb_all.patch x86-numa_emulation-fix-uniform-split-numa-emulation.patch +arm-dts-exynos-disable-pull-control-for-max8997-interrupts-on-origen.patch +net-socionext-reset-tx-queue-in-ndo_stop.patch +net-ethernet-ti-cpsw-unsync-mcast-entries-while-switch-promisc-mode.patch +net-loopback-clear-skb-tstamp-before-netif_rx.patch +locking-lockdep-fix-debug_locks-off-performance-problem.patch +netfilter-xt_nat-fix-dnat-target-for-shifted-portmap-ranges.patch +ataflop-fix-error-handling-during-setup.patch +swim-fix-cleanup-on-setup-error.patch +arm64-cpufeature-ctr-fix-cpu-capability-check-for-late-cpus.patch +hv_netvsc-fix-vf-serial-matching-with-pci-slot-info.patch +nfp-devlink-port-split-support-for-1x100g-cxp-nic.patch +tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch +s390-sthyi-fix-machine-name-validity-indication.patch +hwmon-pwm-fan-set-fan-speed-to-0-on-suspend.patch +lightnvm-pblk-fix-race-on-sysfs-line-state.patch +lightnvm-pblk-fix-two-sleep-in-atomic-context-bugs.patch +lightnvm-pblk-fix-race-condition-on-metadata-i-o.patch +spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch +perf-tools-free-temporary-sys-string-in-read_event_files.patch +perf-tools-cleanup-trace-event-info-tdata-leak.patch +perf-tools-free-printk-string-in-parse_ftrace_printk.patch +perf-strbuf-match-va_-add-copy-with-va_end.patch +cpupower-fix-coredump-on-vmware.patch +bcache-populate-writeback_rate_minimum-attribute.patch +mmc-sdhci-pci-o2micro-add-quirk-for-o2-micro-dev-0x8620-rev-0x01.patch +sdhci-acpi-add-free_slot-callback.patch +mtd-rawnand-denali-set-spare_area_skip_bytes-register-to-8-if-unset.patch +iwlwifi-pcie-avoid-empty-free-rb-queue.patch +iwlwifi-mvm-clear-hw_restart_requested-when-stopping-the-interface.patch +iwlwifi-mvm-check-for-n_profiles-validity-in-ewrd-acpi.patch +x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch +wlcore-fix-bug-with-clear-completion-on-timeout.patch +nvmet-rdma-use-a-private-workqueue-for-delete.patch +acpi-pptt-handle-architecturally-unknown-cache-types.patch +acpi-pm-lpit-register-sysfs-attributes-based-on-fadt.patch +acpi-processor-fix-the-return-value-of-acpi_processor_ids_walk.patch +cpufreq-dt-try-freeing-static-opps-only-if-we-have-added-them.patch +x86-intel_rdt-show-missing-resctrl-mount-options.patch +mtd-rawnand-atmel-fix-potential-null-pointer-dereference.patch +nvme-call-nvme_complete_rq-when-nvmf_check_ready-fails-for-mpath-i-o.patch +ath10k-fix-tx-status-flag-setting-for-management-frames.patch +signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch +ice-fix-changing-of-ring-descriptor-size-ethtool-g.patch +ice-update-fw-version-check-logic.patch +net-hns3-fix-for-packet-buffer-setting-bug.patch +bluetooth-btbcm-add-entry-for-bcm4335c0-uart-bluetooth.patch +bluetooth-hci_qca-remove-hdev-dereference-in-qca_close.patch +efi-x86-call-efi_parse_options-from-efi_main.patch +x86-boot-fix-efi-stub-alignment.patch +net-hns3-add-nic-state-check-before-calling-netif_tx_wake_queue.patch +net-hns3-fix-ets-validate-issue.patch +pinctrl-sunxi-fix-pctrl-functions-allocation-in-sunxi_pinctrl_build_state.patch +pinctrl-qcom-spmi-mpp-fix-err-handling-of-pmic_mpp_set_mux.patch +brcmfmac-fix-for-proper-support-of-160mhz-bandwidth.patch +net-hns3-check-hdev-state-when-getting-link-status.patch +net-hns3-set-state_down-bit-of-hdev-state-when-stopping-net.patch +net-phy-phylink-ensure-the-carrier-is-off-when-starting-phylink.patch +block-bfq-correctly-charge-and-reset-entity-service-in-all-cases.patch +arm64-entry-allow-handling-of-undefined-instructions-from-el1.patch +kprobes-return-error-if-we-fail-to-reuse-kprobe-instead-of-bug_on.patch +spi-gpio-no-miso-does-not-imply-no-rx.patch +acpi-lpss-add-alternative-acpi-hids-for-cherry-trail-dma-controllers.patch +pinctrl-qcom-spmi-mpp-fix-drive-strength-setting.patch +bpf-verifier-fix-verifier-instability.patch +failover-add-missing-check-to-validate-slave_dev-in-net_failover_slave_unregister.patch +perf-tests-fix-record-probe_libc_inet_pton.sh-without-ping-s-debuginfo.patch +pinctrl-spmi-mpp-fix-pmic_mpp_config_get-to-be-compliant.patch +pinctrl-ssbi-gpio-fix-pm8xxx_pin_config_get-to-be-compliant.patch +net-hns3-preserve-vlan-0-in-hardware-table.patch +net-hns3-fix-ping-exited-problem-when-doing-lp-selftest.patch +net-hns3-fix-for-vf-vlan-delete-failed-problem.patch +net-dsa-mv88e6xxx-fix-writing-to-a-phy-page.patch +mt76x2u-run-device-cleanup-routine-if-resume-fails.patch +rsi-fix-memory-alignment-issue-in-arm32-platforms.patch +libertas_tf-prevent-underflow-in-process_cmdrequest.patch +iwlwifi-mvm-fix-bar-seq-ctrl-reporting.patch +gpio-brcmstb-allow-0-width-gpio-banks.patch +ixgbe-disallow-ipsec-tx-offload-when-in-sr-iov-mode.patch +ixgbevf-vf2vf-tcp-rss.patch +wil6210-fix-rx-buffers-release-and-unmap.patch +ath10k-schedule-hardware-restart-if-wmi-command-times-out.patch +libata-apply-nolpm-quirk-for-samsung-mz7td256hafv-000l9.patch +thermal-rcar_thermal-prevent-doing-work-after-unbind.patch +thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch +cifs-fix-a-credits-leak-for-compund-commands.patch +cgroup-netclassid-add-a-preemption-point-to-write_classid.patch +net-stmmac-dwmac-sun8i-fix-of-child-node-lookup.patch +f2fs-fix-to-account-io-correctly-for-cgroup-writeback.patch +md-memory-leak-when-flush-bio-size-is-zero.patch +md-fix-memleak-for-mempool.patch +of-add-missing-exports-of-node-name-compare-functions.patch +scsi-esp_scsi-track-residual-for-pio-transfers.patch +scsi-ufs-schedule-clk-gating-work-on-correct-queue.patch +uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch +kvm-nvmx-clear-reserved-bits-of-db-exit-qualification.patch +scsi-megaraid_sas-fix-a-missing-check-bug.patch +rdma-core-do-not-expose-unsupported-counters.patch +rdma-cm-respect-returned-status-of-cm_init_av_by_path.patch +ib-ipoib-clear-ipcb-before-icmp_send.patch +rdma-bnxt_re-avoid-accessing-nq-bar_reg_iomem-in-failure-case.patch +rdma-bnxt_re-fix-recursive-lock-warning-in-debug-kernel.patch +usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch +pci-mediatek-fix-mtk_pcie_find_port-endpoint-port-matching-logic.patch +pci-cadence-use-axi-region-0-to-signal-interrupts-from-ep.patch +usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch +tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch +f2fs-clear-pageerror-on-the-read-path.patch +drivers-hv-vmbus-use-cpumask_var_t-for-on-stack-cpu-mask.patch +vmci-resource-wildcard-match-fixed.patch +pci-acpi-enable-wake-automatically-for-power-managed-bridges.patch +xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch +irqchip-pdc-setup-all-edge-interrupts-as-rising-edge-at-gic.patch +usb-dwc2-fix-call-to-vbus-supply-exit-routine-call-it-unlocked.patch +usb-dwc2-fix-a-race-with-external-vbus-supply.patch +usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch +ext4-fix-argument-checking-in-ext4_ioc_move_ext.patch +md-fix-invalid-stored-role-for-a-disk.patch +pci-cadence-correct-probe-behaviour-when-failing-to-get-phy.patch +nvmem-check-the-return-value-of-nvmem_add_cells.patch +xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch +scsi-qla2xxx-fix-recursive-mailbox-timeout.patch +f2fs-fix-to-recover-inode-s-crtime-during-por.patch +f2fs-fix-to-recover-inode-s-i_flags-during-por.patch +pci-msi-warn-and-return-error-if-driver-enables-msi-msi-x-twice.patch +coresight-etb10-fix-handling-of-perf-mode.patch +pci-dwc-pci-dra7xx-enable-errata-i870-for-both-ep-and-rc-mode.patch +crypto-caam-fix-implicit-casts-in-endianness-helpers.patch +usb-chipidea-prevent-unbalanced-irq-disable.patch +smack-ptrace-capability-use-fixes.patch +driver-dma-ioat-call-del_timer_sync-without-holding-prep_lock.patch +asoc-amd-fix-capture-unstable-in-beginning-for-some-runs.patch +firmware-coreboot-unmap-ioregion-after-device-population.patch +ib-ipoib-use-dev_port-to-expose-network-interface-port-numbers.patch +ib-mlx5-allow-transition-of-dci-qp-to-reset.patch +uio-ensure-class-is-registered-before-devices.patch +scsi-lpfc-correct-soft-lockup-when-running-mds-diagnostics.patch +scsi-lpfc-correct-race-with-abort-on-completion-path.patch +f2fs-avoid-sleeping-under-spin_lock.patch +f2fs-report-error-if-quota-off-error-during-umount.patch +signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch +f2fs-fix-to-flush-all-dirty-inodes-recovered-in-readonly-fs.patch +mfd-menelaus-fix-possible-race-condition-and-leak.patch +dmaengine-dma-jz4780-return-error-if-not-probed-from-dt.patch +ib-rxe-fix-for-duplicate-request-processing-and-ack-psns.patch +alsa-hda-check-the-non-cached-stream-buffers-more-explicitly.patch +cpupower-fix-amd-family-0x17-msr_pstate-size.patch diff --git a/queue-4.19/signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch b/queue-4.19/signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch new file mode 100644 index 00000000000..cc8af67bda9 --- /dev/null +++ b/queue-4.19/signal-always-deliver-the-kernel-s-sigkill-and-sigstop-to-a-pid-namespace-init.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: "Eric W. Biederman" +Date: Mon, 3 Sep 2018 20:02:46 +0200 +Subject: signal: Always deliver the kernel's SIGKILL and SIGSTOP to a pid namespace init + +From: "Eric W. Biederman" + +[ Upstream commit 3597dfe01d12f570bc739da67f857fd222a3ea66 ] + +Instead of playing whack-a-mole and changing SEND_SIG_PRIV to +SEND_SIG_FORCED throughout the kernel to ensure a pid namespace init +gets signals sent by the kernel, stop allowing a pid namespace init to +ignore SIGKILL or SIGSTOP sent by the kernel. A pid namespace init is +only supposed to be able to ignore signals sent from itself and +children with SIG_DFL. + +Fixes: 921cf9f63089 ("signals: protect cinit from unblocked SIG_DFL signals") +Reviewed-by: Thomas Gleixner +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/signal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1035,7 +1035,7 @@ static int __send_signal(int sig, struct + + result = TRACE_SIGNAL_IGNORED; + if (!prepare_signal(sig, t, +- from_ancestor_ns || (info == SEND_SIG_FORCED))) ++ from_ancestor_ns || (info == SEND_SIG_PRIV) || (info == SEND_SIG_FORCED))) + goto ret; + + pending = (type != PIDTYPE_PID) ? &t->signal->shared_pending : &t->pending; diff --git a/queue-4.19/signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch b/queue-4.19/signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch new file mode 100644 index 00000000000..40ea45f460b --- /dev/null +++ b/queue-4.19/signal-introduce-compat_sigminstksz-for-use-in-compat_sys_sigaltstack.patch @@ -0,0 +1,103 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Will Deacon +Date: Wed, 5 Sep 2018 15:34:42 +0100 +Subject: signal: Introduce COMPAT_SIGMINSTKSZ for use in compat_sys_sigaltstack + +From: Will Deacon + +[ Upstream commit 22839869f21ab3850fbbac9b425ccc4c0023926f ] + +The sigaltstack(2) system call fails with -ENOMEM if the new alternative +signal stack is found to be smaller than SIGMINSTKSZ. On architectures +such as arm64, where the native value for SIGMINSTKSZ is larger than +the compat value, this can result in an unexpected error being reported +to a compat task. See, for example: + + https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904385 + +This patch fixes the problem by extending do_sigaltstack to take the +minimum signal stack size as an additional parameter, allowing the +native and compat system call entry code to pass in their respective +values. COMPAT_SIGMINSTKSZ is just defined as SIGMINSTKSZ if it has not +been defined by the architecture. + +Cc: Arnd Bergmann +Cc: Dominik Brodowski +Cc: "Eric W. Biederman" +Cc: Andrew Morton +Cc: Al Viro +Cc: Oleg Nesterov +Reported-by: Steve McIntyre +Tested-by: Steve McIntyre <93sam@debian.org> +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/compat.h | 3 +++ + kernel/signal.c | 14 +++++++++----- + 2 files changed, 12 insertions(+), 5 deletions(-) + +--- a/include/linux/compat.h ++++ b/include/linux/compat.h +@@ -103,6 +103,9 @@ typedef struct compat_sigaltstack { + compat_size_t ss_size; + } compat_stack_t; + #endif ++#ifndef COMPAT_MINSIGSTKSZ ++#define COMPAT_MINSIGSTKSZ MINSIGSTKSZ ++#endif + + #define compat_jiffies_to_clock_t(x) \ + (((unsigned long)(x) * COMPAT_USER_HZ) / HZ) +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -3460,7 +3460,8 @@ int do_sigaction(int sig, struct k_sigac + } + + static int +-do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp) ++do_sigaltstack (const stack_t *ss, stack_t *oss, unsigned long sp, ++ size_t min_ss_size) + { + struct task_struct *t = current; + +@@ -3490,7 +3491,7 @@ do_sigaltstack (const stack_t *ss, stack + ss_size = 0; + ss_sp = NULL; + } else { +- if (unlikely(ss_size < MINSIGSTKSZ)) ++ if (unlikely(ss_size < min_ss_size)) + return -ENOMEM; + } + +@@ -3508,7 +3509,8 @@ SYSCALL_DEFINE2(sigaltstack,const stack_ + if (uss && copy_from_user(&new, uss, sizeof(stack_t))) + return -EFAULT; + err = do_sigaltstack(uss ? &new : NULL, uoss ? &old : NULL, +- current_user_stack_pointer()); ++ current_user_stack_pointer(), ++ MINSIGSTKSZ); + if (!err && uoss && copy_to_user(uoss, &old, sizeof(stack_t))) + err = -EFAULT; + return err; +@@ -3519,7 +3521,8 @@ int restore_altstack(const stack_t __use + stack_t new; + if (copy_from_user(&new, uss, sizeof(stack_t))) + return -EFAULT; +- (void)do_sigaltstack(&new, NULL, current_user_stack_pointer()); ++ (void)do_sigaltstack(&new, NULL, current_user_stack_pointer(), ++ MINSIGSTKSZ); + /* squash all but EFAULT for now */ + return 0; + } +@@ -3553,7 +3556,8 @@ static int do_compat_sigaltstack(const c + uss.ss_size = uss32.ss_size; + } + ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, +- compat_user_stack_pointer()); ++ compat_user_stack_pointer(), ++ COMPAT_MINSIGSTKSZ); + if (ret >= 0 && uoss_ptr) { + compat_stack_t old; + memset(&old, 0, sizeof(old)); diff --git a/queue-4.19/smack-ptrace-capability-use-fixes.patch b/queue-4.19/smack-ptrace-capability-use-fixes.patch new file mode 100644 index 00000000000..9eedc96480d --- /dev/null +++ b/queue-4.19/smack-ptrace-capability-use-fixes.patch @@ -0,0 +1,74 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Casey Schaufler +Date: Tue, 18 Sep 2018 16:09:16 -0700 +Subject: Smack: ptrace capability use fixes + +From: Casey Schaufler + +[ Upstream commit dcb569cf6ac99ca899b8109c128b6ae52477a015 ] + +This fixes a pair of problems in the Smack ptrace checks +related to checking capabilities. In both cases, as reported +by Lukasz Pawelczyk, the raw capability calls are used rather +than the Smack wrapper that check addition restrictions. +In one case, as reported by Jann Horn, the wrong task is being +checked for capabilities. + +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/smack/smack_lsm.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -421,6 +421,7 @@ static int smk_ptrace_rule_check(struct + struct smk_audit_info ad, *saip = NULL; + struct task_smack *tsp; + struct smack_known *tracer_known; ++ const struct cred *tracercred; + + if ((mode & PTRACE_MODE_NOAUDIT) == 0) { + smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); +@@ -429,7 +430,8 @@ static int smk_ptrace_rule_check(struct + } + + rcu_read_lock(); +- tsp = __task_cred(tracer)->security; ++ tracercred = __task_cred(tracer); ++ tsp = tracercred->security; + tracer_known = smk_of_task(tsp); + + if ((mode & PTRACE_MODE_ATTACH) && +@@ -439,7 +441,7 @@ static int smk_ptrace_rule_check(struct + rc = 0; + else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) + rc = -EACCES; +- else if (capable(CAP_SYS_PTRACE)) ++ else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred)) + rc = 0; + else + rc = -EACCES; +@@ -1841,6 +1843,7 @@ static int smack_file_send_sigiotask(str + { + struct smack_known *skp; + struct smack_known *tkp = smk_of_task(tsk->cred->security); ++ const struct cred *tcred; + struct file *file; + int rc; + struct smk_audit_info ad; +@@ -1854,8 +1857,12 @@ static int smack_file_send_sigiotask(str + skp = file->f_security; + rc = smk_access(skp, tkp, MAY_DELIVER, NULL); + rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc); +- if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) ++ ++ rcu_read_lock(); ++ tcred = __task_cred(tsk); ++ if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred)) + rc = 0; ++ rcu_read_unlock(); + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); + smk_ad_setfield_u_tsk(&ad, tsk); diff --git a/queue-4.19/spi-gpio-no-miso-does-not-imply-no-rx.patch b/queue-4.19/spi-gpio-no-miso-does-not-imply-no-rx.patch new file mode 100644 index 00000000000..a3fb5982db3 --- /dev/null +++ b/queue-4.19/spi-gpio-no-miso-does-not-imply-no-rx.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Linus Walleij +Date: Mon, 10 Sep 2018 00:28:05 +0200 +Subject: spi: gpio: No MISO does not imply no RX + +From: Linus Walleij + +[ Upstream commit abf5feef3ff0cefade0c76be53b59e55fdd46093 ] + +There is a logical problem in spi-gpio with host just +assigning a MOSI line and no MISO: this is interpreted +as the host cannot do RX and the host is flagged with +SPI_MASTER_NO_RX. + +This is wrong: since GPIO lines can switch direction, +in 3WIRE operation the host will simply reverse the +direction of the GPIO line and start reading from it, +there is even code for doing this in the driver, but +it went unnoticed because it was tested by using a +master with 4 wires but a device using just 3 wires. + +Remove the offending flag. + +Cc: Andrzej Hajda +Cc: Lorenzo Bianconi +Signed-off-by: Linus Walleij +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-gpio.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/spi/spi-gpio.c ++++ b/drivers/spi/spi-gpio.c +@@ -295,9 +295,11 @@ static int spi_gpio_request(struct devic + spi_gpio->miso = devm_gpiod_get_optional(dev, "miso", GPIOD_IN); + if (IS_ERR(spi_gpio->miso)) + return PTR_ERR(spi_gpio->miso); +- if (!spi_gpio->miso) +- /* HW configuration without MISO pin */ +- *mflags |= SPI_MASTER_NO_RX; ++ /* ++ * No setting SPI_MASTER_NO_RX here - if there is only a MOSI ++ * pin connected the host can still do RX by changing the ++ * direction of the line. ++ */ + + spi_gpio->sck = devm_gpiod_get(dev, "sck", GPIOD_OUT_LOW); + if (IS_ERR(spi_gpio->sck)) +@@ -423,7 +425,7 @@ static int spi_gpio_probe(struct platfor + spi_gpio->bitbang.chipselect = spi_gpio_chipselect; + spi_gpio->bitbang.set_line_direction = spi_gpio_set_direction; + +- if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) { ++ if ((master_flags & SPI_MASTER_NO_TX) == 0) { + spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0; + spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1; + spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2; diff --git a/queue-4.19/spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch b/queue-4.19/spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch new file mode 100644 index 00000000000..49ac79de95c --- /dev/null +++ b/queue-4.19/spi-spi-ep93xx-use-dma_data_direction-for-ep93xx_spi_dma_-finish-prepare.patch @@ -0,0 +1,160 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Nathan Chancellor +Date: Mon, 8 Oct 2018 11:08:47 -0700 +Subject: spi: spi-ep93xx: Use dma_data_direction for ep93xx_spi_dma_{finish,prepare} + +From: Nathan Chancellor + +[ Upstream commit a1108c7b2efb892350ba6a0e932dfd45622f4e2b ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/spi/spi-ep93xx.c:342:62: warning: implicit conversion from +enumeration type 'enum dma_transfer_direction' to different enumeration +type 'enum dma_data_direction' [-Wenum-conversion] + nents = dma_map_sg(chan->device->dev, sgt->sgl, sgt->nents, dir); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ +./include/linux/dma-mapping.h:428:58: note: expanded from macro +'dma_map_sg' +#define dma_map_sg(d, s, n, r) dma_map_sg_attrs(d, s, n, r, 0) + ~~~~~~~~~~~~~~~~ ^ +drivers/spi/spi-ep93xx.c:348:57: warning: implicit conversion from +enumeration type 'enum dma_transfer_direction' to different enumeration +type 'enum dma_data_direction' [-Wenum-conversion] + dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ +./include/linux/dma-mapping.h:429:62: note: expanded from macro +'dma_unmap_sg' +#define dma_unmap_sg(d, s, n, r) dma_unmap_sg_attrs(d, s, n, r, 0) + ~~~~~~~~~~~~~~~~~~ ^ +drivers/spi/spi-ep93xx.c:377:56: warning: implicit conversion from +enumeration type 'enum dma_transfer_direction' to different enumeration +type 'enum dma_data_direction' [-Wenum-conversion] + dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir); + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~ +./include/linux/dma-mapping.h:429:62: note: expanded from macro +'dma_unmap_sg' +#define dma_unmap_sg(d, s, n, r) dma_unmap_sg_attrs(d, s, n, r, 0) + ~~~~~~~~~~~~~~~~~~ ^ +3 warnings generated. + +dma_{,un}map_sg expect an enum of type dma_data_direction but this +driver uses dma_transfer_direction for everything. Convert the driver to +use dma_data_direction for these two functions. + +There are two places that strictly require an enum of type +dma_transfer_direction: the direction member in struct dma_slave_config +and the direction parameter in dmaengine_prep_slave_sg. To avoid using +an explicit cast, add a simple function, ep93xx_dma_data_to_trans_dir, +to safely map between the two types because they are not 1 to 1 in +meaning. + +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Reviewed-by: Mika Westerberg +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-ep93xx.c | 36 +++++++++++++++++++++++++----------- + 1 file changed, 25 insertions(+), 11 deletions(-) + +--- a/drivers/spi/spi-ep93xx.c ++++ b/drivers/spi/spi-ep93xx.c +@@ -246,6 +246,19 @@ static int ep93xx_spi_read_write(struct + return -EINPROGRESS; + } + ++static enum dma_transfer_direction ++ep93xx_dma_data_to_trans_dir(enum dma_data_direction dir) ++{ ++ switch (dir) { ++ case DMA_TO_DEVICE: ++ return DMA_MEM_TO_DEV; ++ case DMA_FROM_DEVICE: ++ return DMA_DEV_TO_MEM; ++ default: ++ return DMA_TRANS_NONE; ++ } ++} ++ + /** + * ep93xx_spi_dma_prepare() - prepares a DMA transfer + * @master: SPI master +@@ -257,7 +270,7 @@ static int ep93xx_spi_read_write(struct + */ + static struct dma_async_tx_descriptor * + ep93xx_spi_dma_prepare(struct spi_master *master, +- enum dma_transfer_direction dir) ++ enum dma_data_direction dir) + { + struct ep93xx_spi *espi = spi_master_get_devdata(master); + struct spi_transfer *xfer = master->cur_msg->state; +@@ -277,9 +290,9 @@ ep93xx_spi_dma_prepare(struct spi_master + buswidth = DMA_SLAVE_BUSWIDTH_1_BYTE; + + memset(&conf, 0, sizeof(conf)); +- conf.direction = dir; ++ conf.direction = ep93xx_dma_data_to_trans_dir(dir); + +- if (dir == DMA_DEV_TO_MEM) { ++ if (dir == DMA_FROM_DEVICE) { + chan = espi->dma_rx; + buf = xfer->rx_buf; + sgt = &espi->rx_sgt; +@@ -343,7 +356,8 @@ ep93xx_spi_dma_prepare(struct spi_master + if (!nents) + return ERR_PTR(-ENOMEM); + +- txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, dir, DMA_CTRL_ACK); ++ txd = dmaengine_prep_slave_sg(chan, sgt->sgl, nents, conf.direction, ++ DMA_CTRL_ACK); + if (!txd) { + dma_unmap_sg(chan->device->dev, sgt->sgl, sgt->nents, dir); + return ERR_PTR(-ENOMEM); +@@ -360,13 +374,13 @@ ep93xx_spi_dma_prepare(struct spi_master + * unmapped. + */ + static void ep93xx_spi_dma_finish(struct spi_master *master, +- enum dma_transfer_direction dir) ++ enum dma_data_direction dir) + { + struct ep93xx_spi *espi = spi_master_get_devdata(master); + struct dma_chan *chan; + struct sg_table *sgt; + +- if (dir == DMA_DEV_TO_MEM) { ++ if (dir == DMA_FROM_DEVICE) { + chan = espi->dma_rx; + sgt = &espi->rx_sgt; + } else { +@@ -381,8 +395,8 @@ static void ep93xx_spi_dma_callback(void + { + struct spi_master *master = callback_param; + +- ep93xx_spi_dma_finish(master, DMA_MEM_TO_DEV); +- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM); ++ ep93xx_spi_dma_finish(master, DMA_TO_DEVICE); ++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE); + + spi_finalize_current_transfer(master); + } +@@ -392,15 +406,15 @@ static int ep93xx_spi_dma_transfer(struc + struct ep93xx_spi *espi = spi_master_get_devdata(master); + struct dma_async_tx_descriptor *rxd, *txd; + +- rxd = ep93xx_spi_dma_prepare(master, DMA_DEV_TO_MEM); ++ rxd = ep93xx_spi_dma_prepare(master, DMA_FROM_DEVICE); + if (IS_ERR(rxd)) { + dev_err(&master->dev, "DMA RX failed: %ld\n", PTR_ERR(rxd)); + return PTR_ERR(rxd); + } + +- txd = ep93xx_spi_dma_prepare(master, DMA_MEM_TO_DEV); ++ txd = ep93xx_spi_dma_prepare(master, DMA_TO_DEVICE); + if (IS_ERR(txd)) { +- ep93xx_spi_dma_finish(master, DMA_DEV_TO_MEM); ++ ep93xx_spi_dma_finish(master, DMA_FROM_DEVICE); + dev_err(&master->dev, "DMA TX failed: %ld\n", PTR_ERR(txd)); + return PTR_ERR(txd); + } diff --git a/queue-4.19/swim-fix-cleanup-on-setup-error.patch b/queue-4.19/swim-fix-cleanup-on-setup-error.patch new file mode 100644 index 00000000000..c0160d1ce5f --- /dev/null +++ b/queue-4.19/swim-fix-cleanup-on-setup-error.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Omar Sandoval +Date: Thu, 11 Oct 2018 12:20:41 -0700 +Subject: swim: fix cleanup on setup error + +From: Omar Sandoval + +[ Upstream commit 1448a2a5360ae06f25e2edc61ae070dff5c0beb4 ] + +If we fail to allocate the request queue for a disk, we still need to +free that disk, not just the previous ones. Additionally, we need to +cleanup the previous request queues. + +Signed-off-by: Omar Sandoval +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/block/swim.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -887,8 +887,17 @@ static int swim_floppy_init(struct swim_ + + exit_put_disks: + unregister_blkdev(FLOPPY_MAJOR, "fd"); +- while (drive--) +- put_disk(swd->unit[drive].disk); ++ do { ++ struct gendisk *disk = swd->unit[drive].disk; ++ ++ if (disk) { ++ if (disk->queue) { ++ blk_cleanup_queue(disk->queue); ++ disk->queue = NULL; ++ } ++ put_disk(disk); ++ } ++ } while (drive--); + return err; + } + diff --git a/queue-4.19/thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch b/queue-4.19/thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch new file mode 100644 index 00000000000..82ac0cc173c --- /dev/null +++ b/queue-4.19/thermal-da9062-61-prevent-hardware-access-during-system-suspend.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Geert Uytterhoeven +Date: Fri, 12 Oct 2018 09:20:17 +0200 +Subject: thermal: da9062/61: Prevent hardware access during system suspend + +From: Geert Uytterhoeven + +[ Upstream commit 760eea43f8c6d48684f1f34b8a02fddc1456e849 ] + +The workqueue used for monitoring the hardware may run while the device +is already suspended. Fix this by using the freezable system workqueue +instead, cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from +happening during system suspend"). + +Fixes: 608567aac3206ae8 ("thermal: da9062/61: Thermal junction temperature monitoring driver") +Signed-off-by: Geert Uytterhoeven +Acked-by: Steve Twiss +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/da9062-thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/thermal/da9062-thermal.c ++++ b/drivers/thermal/da9062-thermal.c +@@ -106,7 +106,7 @@ static void da9062_thermal_poll_on(struc + THERMAL_EVENT_UNSPECIFIED); + + delay = msecs_to_jiffies(thermal->zone->passive_delay); +- schedule_delayed_work(&thermal->work, delay); ++ queue_delayed_work(system_freezable_wq, &thermal->work, delay); + return; + } + +@@ -125,7 +125,7 @@ static irqreturn_t da9062_thermal_irq_ha + struct da9062_thermal *thermal = data; + + disable_irq_nosync(thermal->irq); +- schedule_delayed_work(&thermal->work, 0); ++ queue_delayed_work(system_freezable_wq, &thermal->work, 0); + + return IRQ_HANDLED; + } diff --git a/queue-4.19/thermal-rcar_thermal-prevent-doing-work-after-unbind.patch b/queue-4.19/thermal-rcar_thermal-prevent-doing-work-after-unbind.patch new file mode 100644 index 00000000000..89b3157a77c --- /dev/null +++ b/queue-4.19/thermal-rcar_thermal-prevent-doing-work-after-unbind.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Geert Uytterhoeven +Date: Fri, 12 Oct 2018 09:20:16 +0200 +Subject: thermal: rcar_thermal: Prevent doing work after unbind + +From: Geert Uytterhoeven + +[ Upstream commit 697ee786f15d7b65c7f3045d45fe3a05d28e0911 ] + +When testing bind/unbind on r8a7791/koelsch: + + WARNING: CPU: 1 PID: 697 at lib/debugobjects.c:329 debug_print_object+0x8c/0xb4 + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x10 + +This happens if the workqueue runs after the device has been unbound. +Fix this by cancelling any queued work during remove. + +Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/rcar_thermal.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/thermal/rcar_thermal.c ++++ b/drivers/thermal/rcar_thermal.c +@@ -453,6 +453,7 @@ static int rcar_thermal_remove(struct pl + + rcar_thermal_for_each_priv(priv, common) { + rcar_thermal_irq_disable(priv); ++ cancel_delayed_work_sync(&priv->work); + if (priv->chip->use_of_thermal) + thermal_remove_hwmon_sysfs(priv->zone); + else diff --git a/queue-4.19/tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch b/queue-4.19/tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch new file mode 100644 index 00000000000..636667e4850 --- /dev/null +++ b/queue-4.19/tpm-suppress-transmit-cmd-error-logs-when-tpm-1.2-is-disabled-deactivated.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Javier Martinez Canillas +Date: Thu, 30 Aug 2018 16:40:05 +0200 +Subject: tpm: suppress transmit cmd error logs when TPM 1.2 is disabled/deactivated + +From: Javier Martinez Canillas + +[ Upstream commit 0d6d0d62d9505a9816716aa484ebd0b04c795063 ] + +For TPM 1.2 chips the system setup utility allows to set the TPM device in +one of the following states: + + * Active: Security chip is functional + * Inactive: Security chip is visible, but is not functional + * Disabled: Security chip is hidden and is not functional + +When choosing the "Inactive" state, the TPM 1.2 device is enumerated and +registered, but sending TPM commands fail with either TPM_DEACTIVATED or +TPM_DISABLED depending if the firmware deactivated or disabled the TPM. + +Since these TPM 1.2 error codes don't have special treatment, inactivating +the TPM leads to a very noisy kernel log buffer that shows messages like +the following: + + tpm_tis 00:05: 1.2 TPM (device-id 0x0, rev-id 78) + tpm tpm0: A TPM error (6) occurred attempting to read a pcr value + tpm tpm0: TPM is disabled/deactivated (0x6) + tpm tpm0: A TPM error (6) occurred attempting get random + tpm tpm0: A TPM error (6) occurred attempting to read a pcr value + ima: No TPM chip found, activating TPM-bypass! (rc=6) + tpm tpm0: A TPM error (6) occurred attempting get random + tpm tpm0: A TPM error (6) occurred attempting get random + tpm tpm0: A TPM error (6) occurred attempting get random + tpm tpm0: A TPM error (6) occurred attempting get random + +Let's just suppress error log messages for the TPM_{DEACTIVATED,DISABLED} +return codes, since this is expected when the TPM 1.2 is set to Inactive. + +In that case the kernel log is cleaner and less confusing for users, i.e: + + tpm_tis 00:05: 1.2 TPM (device-id 0x0, rev-id 78) + tpm tpm0: TPM is disabled/deactivated (0x6) + ima: No TPM chip found, activating TPM-bypass! (rc=6) + +Reported-by: Hans de Goede +Signed-off-by: Javier Martinez Canillas +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm-interface.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -663,7 +663,8 @@ ssize_t tpm_transmit_cmd(struct tpm_chip + return len; + + err = be32_to_cpu(header->return_code); +- if (err != 0 && desc) ++ if (err != 0 && err != TPM_ERR_DISABLED && err != TPM_ERR_DEACTIVATED ++ && desc) + dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err, + desc); + if (err) diff --git a/queue-4.19/tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch b/queue-4.19/tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch new file mode 100644 index 00000000000..5ae4f80d47c --- /dev/null +++ b/queue-4.19/tun-consistently-configure-generic-netdev-params-via-rtnetlink.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Serhey Popovych +Date: Tue, 9 Oct 2018 21:21:01 +0300 +Subject: tun: Consistently configure generic netdev params via rtnetlink + +From: Serhey Popovych + +[ Upstream commit df52eab23d703142c766ac00bdb8db19d71238d0 ] + +Configuring generic network device parameters on tun will fail in +presence of IFLA_INFO_KIND attribute in IFLA_LINKINFO nested attribute +since tun_validate() always return failure. + +This can be visualized with following ip-link(8) command sequences: + + # ip link set dev tun0 group 100 + # ip link set dev tun0 group 100 type tun + RTNETLINK answers: Invalid argument + +with contrast to dummy and veth drivers: + + # ip link set dev dummy0 group 100 + # ip link set dev dummy0 type dummy + + # ip link set dev veth0 group 100 + # ip link set dev veth0 group 100 type veth + +Fix by returning zero in tun_validate() when @data is NULL that is +always in case since rtnl_link_ops->maxtype is zero in tun driver. + +Fixes: f019a7a594d9 ("tun: Implement ip link del tunXXX") +Signed-off-by: Serhey Popovych +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/tun.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -2264,6 +2264,8 @@ static void tun_setup(struct net_device + static int tun_validate(struct nlattr *tb[], struct nlattr *data[], + struct netlink_ext_ack *extack) + { ++ if (!data) ++ return 0; + return -EINVAL; + } + diff --git a/queue-4.19/uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch b/queue-4.19/uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch new file mode 100644 index 00000000000..4ee3a180071 --- /dev/null +++ b/queue-4.19/uapi-ndctl-fix-g-unsupported-initialisation-in-headers.patch @@ -0,0 +1,113 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: David Howells +Date: Thu, 6 Sep 2018 10:19:24 +0100 +Subject: UAPI: ndctl: Fix g++-unsupported initialisation in headers + +From: David Howells + +[ Upstream commit 9607871f37dc3e717639694b8d0dc738f2a68efc ] + +The following code in the linux/ndctl header file: + + static inline const char *nvdimm_bus_cmd_name(unsigned cmd) + { + static const char * const names[] = { + [ND_CMD_ARS_CAP] = "ars_cap", + [ND_CMD_ARS_START] = "ars_start", + [ND_CMD_ARS_STATUS] = "ars_status", + [ND_CMD_CLEAR_ERROR] = "clear_error", + [ND_CMD_CALL] = "cmd_call", + }; + + if (cmd < ARRAY_SIZE(names) && names[cmd]) + return names[cmd]; + return "unknown"; + } + +is broken in a number of ways: + + (1) ARRAY_SIZE() is not generally defined. + + (2) g++ does not support "non-trivial" array initialisers fully yet. + + (3) Every file that calls this function will acquire a copy of names[]. + +The same goes for nvdimm_cmd_name(). + +Fix all three by converting to a switch statement where each case returns a +string. That way if cmd is a constant, the compiler can trivially reduce it +and, if not, the compiler can use a shared lookup table if it thinks that is +more efficient. + +A better way would be to remove these functions and their arrays from the +header entirely. + +Signed-off-by: David Howells +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/ndctl.h | 48 +++++++++++++++++++-------------------------- + 1 file changed, 21 insertions(+), 27 deletions(-) + +--- a/include/uapi/linux/ndctl.h ++++ b/include/uapi/linux/ndctl.h +@@ -128,37 +128,31 @@ enum { + + static inline const char *nvdimm_bus_cmd_name(unsigned cmd) + { +- static const char * const names[] = { +- [ND_CMD_ARS_CAP] = "ars_cap", +- [ND_CMD_ARS_START] = "ars_start", +- [ND_CMD_ARS_STATUS] = "ars_status", +- [ND_CMD_CLEAR_ERROR] = "clear_error", +- [ND_CMD_CALL] = "cmd_call", +- }; +- +- if (cmd < ARRAY_SIZE(names) && names[cmd]) +- return names[cmd]; +- return "unknown"; ++ switch (cmd) { ++ case ND_CMD_ARS_CAP: return "ars_cap"; ++ case ND_CMD_ARS_START: return "ars_start"; ++ case ND_CMD_ARS_STATUS: return "ars_status"; ++ case ND_CMD_CLEAR_ERROR: return "clear_error"; ++ case ND_CMD_CALL: return "cmd_call"; ++ default: return "unknown"; ++ } + } + + static inline const char *nvdimm_cmd_name(unsigned cmd) + { +- static const char * const names[] = { +- [ND_CMD_SMART] = "smart", +- [ND_CMD_SMART_THRESHOLD] = "smart_thresh", +- [ND_CMD_DIMM_FLAGS] = "flags", +- [ND_CMD_GET_CONFIG_SIZE] = "get_size", +- [ND_CMD_GET_CONFIG_DATA] = "get_data", +- [ND_CMD_SET_CONFIG_DATA] = "set_data", +- [ND_CMD_VENDOR_EFFECT_LOG_SIZE] = "effect_size", +- [ND_CMD_VENDOR_EFFECT_LOG] = "effect_log", +- [ND_CMD_VENDOR] = "vendor", +- [ND_CMD_CALL] = "cmd_call", +- }; +- +- if (cmd < ARRAY_SIZE(names) && names[cmd]) +- return names[cmd]; +- return "unknown"; ++ switch (cmd) { ++ case ND_CMD_SMART: return "smart"; ++ case ND_CMD_SMART_THRESHOLD: return "smart_thresh"; ++ case ND_CMD_DIMM_FLAGS: return "flags"; ++ case ND_CMD_GET_CONFIG_SIZE: return "get_size"; ++ case ND_CMD_GET_CONFIG_DATA: return "get_data"; ++ case ND_CMD_SET_CONFIG_DATA: return "set_data"; ++ case ND_CMD_VENDOR_EFFECT_LOG_SIZE: return "effect_size"; ++ case ND_CMD_VENDOR_EFFECT_LOG: return "effect_log"; ++ case ND_CMD_VENDOR: return "vendor"; ++ case ND_CMD_CALL: return "cmd_call"; ++ default: return "unknown"; ++ } + } + + #define ND_IOCTL 'N' diff --git a/queue-4.19/uio-ensure-class-is-registered-before-devices.patch b/queue-4.19/uio-ensure-class-is-registered-before-devices.patch new file mode 100644 index 00000000000..db22bc5f778 --- /dev/null +++ b/queue-4.19/uio-ensure-class-is-registered-before-devices.patch @@ -0,0 +1,85 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Alexandre Belloni +Date: Thu, 16 Aug 2018 09:39:41 +0200 +Subject: uio: ensure class is registered before devices + +From: Alexandre Belloni + +[ Upstream commit ae61cf5b9913027c6953a79ed3894da4f47061bd ] + +When both uio and the uio drivers are built in the kernel, it is possible +for a driver to register devices before the uio class is registered. + +This may result in a NULL pointer dereference later on in +get_device_parent() when accessing the class glue_dirs spinlock. + +The trace looks like that: + +Unable to handle kernel NULL pointer dereference at virtual address 00000140 +[...] +[] _raw_spin_lock+0x14/0x48 +[] device_add+0x154/0x6a0 +[] device_create_groups_vargs+0x120/0x128 +[] device_create+0x54/0x60 +[] __uio_register_device+0x120/0x4a8 +[] jaguar2_pci_probe+0x2d4/0x558 +[] local_pci_probe+0x3c/0xb8 +[] pci_device_probe+0x11c/0x180 +[] driver_probe_device+0x22c/0x2d8 +[] __driver_attach+0xbc/0xc0 +[] bus_for_each_dev+0x4c/0x98 +[] driver_attach+0x20/0x28 +[] bus_add_driver+0x1b8/0x228 +[] driver_register+0x60/0xf8 +[] __pci_register_driver+0x40/0x48 + +Return EPROBE_DEFER in that case so the driver can register the device +later. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/uio/uio.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/uio/uio.c ++++ b/drivers/uio/uio.c +@@ -274,6 +274,8 @@ static struct class uio_class = { + .dev_groups = uio_groups, + }; + ++bool uio_class_registered; ++ + /* + * device functions + */ +@@ -876,6 +878,9 @@ static int init_uio_class(void) + printk(KERN_ERR "class_register failed for uio\n"); + goto err_class_register; + } ++ ++ uio_class_registered = true; ++ + return 0; + + err_class_register: +@@ -886,6 +891,7 @@ exit: + + static void release_uio_class(void) + { ++ uio_class_registered = false; + class_unregister(&uio_class); + uio_major_cleanup(); + } +@@ -912,6 +918,9 @@ int __uio_register_device(struct module + struct uio_device *idev; + int ret = 0; + ++ if (!uio_class_registered) ++ return -EPROBE_DEFER; ++ + if (!parent || !info || !info->name || !info->version) + return -EINVAL; + diff --git a/queue-4.19/usb-chipidea-prevent-unbalanced-irq-disable.patch b/queue-4.19/usb-chipidea-prevent-unbalanced-irq-disable.patch new file mode 100644 index 00000000000..ae8249bf327 --- /dev/null +++ b/queue-4.19/usb-chipidea-prevent-unbalanced-irq-disable.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Loic Poulain +Date: Tue, 4 Sep 2018 17:18:57 +0200 +Subject: usb: chipidea: Prevent unbalanced IRQ disable + +From: Loic Poulain + +[ Upstream commit 8b97d73c4d72a2abf58f8e49062a7ee1e5f1334e ] + +The ChipIdea IRQ is disabled before scheduling the otg work and +re-enabled on otg work completion. However if the job is already +scheduled we have to undo the effect of disable_irq int order to +balance the IRQ disable-depth value. + +Fixes: be6b0c1bd0be ("usb: chipidea: using one inline function to cover queue work operations") +Signed-off-by: Loic Poulain +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/chipidea/otg.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/chipidea/otg.h ++++ b/drivers/usb/chipidea/otg.h +@@ -17,7 +17,8 @@ void ci_handle_vbus_change(struct ci_hdr + static inline void ci_otg_queue_work(struct ci_hdrc *ci) + { + disable_irq_nosync(ci->irq); +- queue_work(ci->wq, &ci->work); ++ if (queue_work(ci->wq, &ci->work) == false) ++ enable_irq(ci->irq); + } + + #endif /* __DRIVERS_USB_CHIPIDEA_OTG_H */ diff --git a/queue-4.19/usb-dwc2-fix-a-race-with-external-vbus-supply.patch b/queue-4.19/usb-dwc2-fix-a-race-with-external-vbus-supply.patch new file mode 100644 index 00000000000..42e92fdb01a --- /dev/null +++ b/queue-4.19/usb-dwc2-fix-a-race-with-external-vbus-supply.patch @@ -0,0 +1,61 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Fabrice Gasnier +Date: Wed, 5 Sep 2018 13:40:03 +0200 +Subject: usb: dwc2: fix a race with external vbus supply + +From: Fabrice Gasnier + +[ Upstream commit 41ee1ea21052583eaf5487dfa0d0c907c9667548 ] + +There's a race with root hub resume, when using external vbus supply. +Root hub gets resumed, but runtime pm autosuspend runs as external vbus +supply isn't enabled. So, host never exit from power down properly. +Initialize vbus external supply before, rater that after hub resume. + +Fixes: 531ef5ebea96 ("usb: dwc2: add support for host mode external +vbus supply") + +Tested-by: Artur Petrosyan +Acked-by: Minas Harutyunyan +Signed-off-by: Fabrice Gasnier +Signed-off-by: Amelie Delaunay +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -4393,6 +4393,7 @@ static int _dwc2_hcd_start(struct usb_hc + struct dwc2_hsotg *hsotg = dwc2_hcd_to_hsotg(hcd); + struct usb_bus *bus = hcd_to_bus(hcd); + unsigned long flags; ++ int ret; + + dev_dbg(hsotg->dev, "DWC OTG HCD START\n"); + +@@ -4408,6 +4409,13 @@ static int _dwc2_hcd_start(struct usb_hc + + dwc2_hcd_reinit(hsotg); + ++ /* enable external vbus supply before resuming root hub */ ++ spin_unlock_irqrestore(&hsotg->lock, flags); ++ ret = dwc2_vbus_supply_init(hsotg); ++ if (ret) ++ return ret; ++ spin_lock_irqsave(&hsotg->lock, flags); ++ + /* Initialize and connect root hub if one is not already attached */ + if (bus->root_hub) { + dev_dbg(hsotg->dev, "DWC OTG HCD Has Root Hub\n"); +@@ -4417,7 +4425,7 @@ static int _dwc2_hcd_start(struct usb_hc + + spin_unlock_irqrestore(&hsotg->lock, flags); + +- return dwc2_vbus_supply_init(hsotg); ++ return 0; + } + + /* diff --git a/queue-4.19/usb-dwc2-fix-call-to-vbus-supply-exit-routine-call-it-unlocked.patch b/queue-4.19/usb-dwc2-fix-call-to-vbus-supply-exit-routine-call-it-unlocked.patch new file mode 100644 index 00000000000..26fbec27d81 --- /dev/null +++ b/queue-4.19/usb-dwc2-fix-call-to-vbus-supply-exit-routine-call-it-unlocked.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Fabrice Gasnier +Date: Wed, 5 Sep 2018 13:40:04 +0200 +Subject: usb: dwc2: fix call to vbus supply exit routine, call it unlocked + +From: Fabrice Gasnier + +[ Upstream commit 5aa678c7fd5371769efde30763fb43a43a118cd0 ] + +dwc2_vbus_supply_exit() may call regulator_disable(). It shouldn't be +called with interrupts disabled as it might sleep. +This is seen with DEBUG_ATOMIC_SLEEP=y. + +Fixes: 531ef5ebea96 ("usb: dwc2: add support for host mode external +vbus supply") + +Tested-by: Artur Petrosyan +Acked-by: Minas Harutyunyan +Signed-off-by: Fabrice Gasnier +Signed-off-by: Amelie Delaunay +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/hcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -4482,7 +4482,9 @@ static int _dwc2_hcd_suspend(struct usb_ + hprt0 |= HPRT0_SUSP; + hprt0 &= ~HPRT0_PWR; + dwc2_writel(hsotg, hprt0, HPRT0); ++ spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_vbus_supply_exit(hsotg); ++ spin_lock_irqsave(&hsotg->lock, flags); + } + + /* Enter partial_power_down */ diff --git a/queue-4.19/usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch b/queue-4.19/usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch new file mode 100644 index 00000000000..9137e6cdfd4 --- /dev/null +++ b/queue-4.19/usb-gadget-udc-atmel-handle-at91sam9rl-pmc.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Alexandre Belloni +Date: Mon, 10 Sep 2018 22:12:49 +0200 +Subject: usb: gadget: udc: atmel: handle at91sam9rl PMC + +From: Alexandre Belloni + +[ Upstream commit bb80e4fa57eb75ebd64ae9be4155da6d12c1a997 ] + +The at91sam9rl PMC is not quite the same as the at91sam9g45 one and now has +its own compatible string. Add support for that. + +Fixes: 217bace8e548 ("ARM: dts: fix PMC compatible") +Acked-by: Cristian Birsan +Signed-off-by: Alexandre Belloni +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/gadget/udc/atmel_usba_udc.c ++++ b/drivers/usb/gadget/udc/atmel_usba_udc.c +@@ -2018,6 +2018,8 @@ static struct usba_ep * atmel_udc_of_ini + udc->errata = match->data; + udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9g45-pmc"); + if (IS_ERR(udc->pmc)) ++ udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9rl-pmc"); ++ if (IS_ERR(udc->pmc)) + udc->pmc = syscon_regmap_lookup_by_compatible("atmel,at91sam9x5-pmc"); + if (udc->errata && IS_ERR(udc->pmc)) + return ERR_CAST(udc->pmc); diff --git a/queue-4.19/usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch b/queue-4.19/usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch new file mode 100644 index 00000000000..72497e5abb0 --- /dev/null +++ b/queue-4.19/usb-host-ohci-at91-fix-request-of-irq-for-optional-gpio.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: "Tudor.Ambarus@microchip.com" +Date: Mon, 15 Oct 2018 09:00:54 +0000 +Subject: usb: host: ohci-at91: fix request of irq for optional gpio + +From: "Tudor.Ambarus@microchip.com" + +[ Upstream commit 325b9313ec3be56c8e2fe03f977fee19cec75820 ] + +atmel,oc-gpio is optional. Request its irq only when atmel,oc is set +in device tree. + +devm_gpiod_get_index_optional returns NULL if -ENOENT. Check its +return value for NULL before error, because it is more probable that +atmel,oc is not set. + +This fixes the following errors on boards where atmel,oc is not set in +device tree: +[ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ +[ 0.960000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ +[ 0.970000] at91_ohci 500000.ohci: failed to request gpio "overcurrent" IRQ + +Signed-off-by: Tudor Ambarus +Acked-by: Nicolas Ferre +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/ohci-at91.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/usb/host/ohci-at91.c ++++ b/drivers/usb/host/ohci-at91.c +@@ -551,6 +551,8 @@ static int ohci_hcd_at91_drv_probe(struc + pdata->overcurrent_pin[i] = + devm_gpiod_get_index_optional(&pdev->dev, "atmel,oc", + i, GPIOD_IN); ++ if (!pdata->overcurrent_pin[i]) ++ continue; + if (IS_ERR(pdata->overcurrent_pin[i])) { + err = PTR_ERR(pdata->overcurrent_pin[i]); + dev_err(&pdev->dev, "unable to claim gpio \"overcurrent\": %d\n", err); diff --git a/queue-4.19/usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch b/queue-4.19/usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch new file mode 100644 index 00000000000..372e7069692 --- /dev/null +++ b/queue-4.19/usb-typec-tcpm-report-back-negotiated-pps-voltage-and-current.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Adam Thomson +Date: Mon, 8 Oct 2018 13:53:59 +0100 +Subject: usb: typec: tcpm: Report back negotiated PPS voltage and current + +From: Adam Thomson + +[ Upstream commit 554fab6dbf20ee7298ed2d4e8398b85e6058abb7 ] + +Currently when requesting a specific voltage or current through +the psy interface, for PPS, when reading back from that interface +the values will always be the same as previously given, if the +request was successful. However PPS only allows for 20mV voltage +steps and 50mA current steps, and the psy class expects microvolt +and micro amp requests, so inbetween values can be provided through +this interface. Really when reading back the true values negotiated +should be given, and not the ones originally asked for. + +To report the actual values negotiated with the Source, the values +stored are now rounded down to the relevant step units prior to +building the PPS request, so that those values are later correctly +reported through the psy interface. In addition this improves the +adjustments made to meet the operating power requirements of the +platform, which previously could have been slightly out due to not +using valid PPS units of voltage and current. + +Signed-off-by: Adam Thomson +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/tcpm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/usb/typec/tcpm.c ++++ b/drivers/usb/typec/tcpm.c +@@ -4116,6 +4116,9 @@ static int tcpm_pps_set_op_curr(struct t + goto port_unlock; + } + ++ /* Round down operating current to align with PPS valid steps */ ++ op_curr = op_curr - (op_curr % RDO_PROG_CURR_MA_STEP); ++ + reinit_completion(&port->pps_complete); + port->pps_data.op_curr = op_curr; + port->pps_status = 0; +@@ -4169,6 +4172,9 @@ static int tcpm_pps_set_out_volt(struct + goto port_unlock; + } + ++ /* Round down output voltage to align with PPS valid steps */ ++ out_volt = out_volt - (out_volt % RDO_PROG_VOLT_MV_STEP); ++ + reinit_completion(&port->pps_complete); + port->pps_data.out_volt = out_volt; + port->pps_status = 0; diff --git a/queue-4.19/vmci-resource-wildcard-match-fixed.patch b/queue-4.19/vmci-resource-wildcard-match-fixed.patch new file mode 100644 index 00000000000..46c0cca1bb8 --- /dev/null +++ b/queue-4.19/vmci-resource-wildcard-match-fixed.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Jorgen Hansen +Date: Fri, 21 Sep 2018 00:31:05 -0700 +Subject: VMCI: Resource wildcard match fixed + +From: Jorgen Hansen + +[ Upstream commit 11924ba5e671d6caef1516923e2bd8c72929a3fe ] + +When adding a VMCI resource, the check for an existing entry +would ignore that the new entry could be a wildcard. This could +result in multiple resource entries that would match a given +handle. One disastrous outcome of this is that the +refcounting used to ensure that delayed callbacks for VMCI +datagrams have run before the datagram is destroyed can be +wrong, since the refcount could be increased on the duplicate +entry. This in turn leads to a use after free bug. This issue +was discovered by Hangbin Liu using KASAN and syzkaller. + +Fixes: bc63dedb7d46 ("VMCI: resource object implementation") +Reported-by: Hangbin Liu +Reviewed-by: Adit Ranadive +Reviewed-by: Vishnu Dasa +Signed-off-by: Jorgen Hansen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_driver.c | 2 +- + drivers/misc/vmw_vmci/vmci_resource.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/misc/vmw_vmci/vmci_driver.c ++++ b/drivers/misc/vmw_vmci/vmci_driver.c +@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit); + + MODULE_AUTHOR("VMware, Inc."); + MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface."); +-MODULE_VERSION("1.1.5.0-k"); ++MODULE_VERSION("1.1.6.0-k"); + MODULE_LICENSE("GPL v2"); +--- a/drivers/misc/vmw_vmci/vmci_resource.c ++++ b/drivers/misc/vmw_vmci/vmci_resource.c +@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resour + + if (r->type == type && + rid == handle.resource && +- (cid == handle.context || cid == VMCI_INVALID_ID)) { ++ (cid == handle.context || cid == VMCI_INVALID_ID || ++ handle.context == VMCI_INVALID_ID)) { + resource = r; + break; + } diff --git a/queue-4.19/wil6210-fix-rx-buffers-release-and-unmap.patch b/queue-4.19/wil6210-fix-rx-buffers-release-and-unmap.patch new file mode 100644 index 00000000000..387bcd42526 --- /dev/null +++ b/queue-4.19/wil6210-fix-rx-buffers-release-and-unmap.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Maya Erez +Date: Thu, 23 Aug 2018 14:47:11 +0300 +Subject: wil6210: fix RX buffers release and unmap + +From: Maya Erez + +[ Upstream commit 84f16fbb62384fb209cd35741d94eb00b5ca2746 ] + +RX SKBs are released in both wil6210 rmmod and RX handle. +As there is no lock to protect the buffers DMA unmap, +the SKB pointer in buff_arr is used to check if the buffer +memory was already released. +Setting wil->rx_buff_mgmt.buff_arr[buff_id].skb to NULL before the DMA +memory unmap will prevent duplicate unmapping of the same memory. +Move the buffer ID to the free list also in case the SKB is NULL. + +Signed-off-by: Maya Erez +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wil6210/txrx_edma.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c ++++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c +@@ -279,9 +279,6 @@ static void wil_move_all_rx_buff_to_free + u16 buff_id; + + *d = *_d; +- pa = wil_rx_desc_get_addr_edma(&d->dma); +- dmalen = le16_to_cpu(d->dma.length); +- dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE); + + /* Extract the SKB from the rx_buff management array */ + buff_id = __le16_to_cpu(d->mac.buff_id); +@@ -291,10 +288,15 @@ static void wil_move_all_rx_buff_to_free + } + skb = wil->rx_buff_mgmt.buff_arr[buff_id].skb; + wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL; +- if (unlikely(!skb)) ++ if (unlikely(!skb)) { + wil_err(wil, "No Rx skb at buff_id %d\n", buff_id); +- else ++ } else { ++ pa = wil_rx_desc_get_addr_edma(&d->dma); ++ dmalen = le16_to_cpu(d->dma.length); ++ dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE); ++ + kfree_skb(skb); ++ } + + /* Move the buffer from the active to the free list */ + list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list, +@@ -906,6 +908,9 @@ again: + wil->rx_buff_mgmt.buff_arr[buff_id].skb = NULL; + if (!skb) { + wil_err(wil, "No Rx skb at buff_id %d\n", buff_id); ++ /* Move the buffer from the active list to the free list */ ++ list_move(&wil->rx_buff_mgmt.buff_arr[buff_id].list, ++ &wil->rx_buff_mgmt.free); + goto again; + } + diff --git a/queue-4.19/wlcore-fix-bug-with-clear-completion-on-timeout.patch b/queue-4.19/wlcore-fix-bug-with-clear-completion-on-timeout.patch new file mode 100644 index 00000000000..3256e319296 --- /dev/null +++ b/queue-4.19/wlcore-fix-bug-with-clear-completion-on-timeout.patch @@ -0,0 +1,99 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Tony Lindgren +Date: Mon, 1 Oct 2018 14:38:05 -0700 +Subject: wlcore: Fix BUG with clear completion on timeout + +From: Tony Lindgren + +[ Upstream commit 4e651bad848955d88b29a568bfbfb4b831270e16 ] + +We do not currently clear wl->elp_compl on ELP timeout and we have bogus +lingering pointer that wlcore_irq then will try to access after recovery +is done: + +BUG: spinlock bad magic on CPU#1, irq/255-wl12xx/580 +... +(spin_dump) from [] (do_raw_spin_lock+0xc8/0x124) +(do_raw_spin_lock) from [] (_raw_spin_lock_irqsave+0x68/0x74) +(_raw_spin_lock_irqsave) from [] (complete+0x24/0x58) +(complete) from [] (wlcore_irq+0x48/0x17c [wlcore]) +(wlcore_irq [wlcore]) from [] (irq_thread_fn+0x2c/0x64) +(irq_thread_fn) from [] (irq_thread+0x148/0x290) +(irq_thread) from [] (kthread+0x160/0x17c) +(kthread) from [] (ret_from_fork+0x14/0x20) +... + +After that the system will hang. Let's fix this by adding a flag for +recovery and moving the recovery work call to to the error handling +section. + +And we want to set WL1271_FLAG_INTENDED_FW_RECOVERY and actually clear +it too in wl1271_recovery_work() and just downgrade the error to a +warning to prevent overly verbose output. + +Cc: Eyal Reizer +Signed-off-by: Tony Lindgren +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ti/wlcore/main.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/ti/wlcore/main.c ++++ b/drivers/net/wireless/ti/wlcore/main.c +@@ -957,6 +957,8 @@ static void wl1271_recovery_work(struct + BUG_ON(wl->conf.recovery.bug_on_recovery && + !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags)); + ++ clear_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags); ++ + if (wl->conf.recovery.no_recovery) { + wl1271_info("No recovery (chosen on module load). Fw will remain stuck."); + goto out_unlock; +@@ -6710,6 +6712,7 @@ static int __maybe_unused wlcore_runtime + int ret; + unsigned long start_time = jiffies; + bool pending = false; ++ bool recovery = false; + + /* Nothing to do if no ELP mode requested */ + if (!test_bit(WL1271_FLAG_IN_ELP, &wl->flags)) +@@ -6726,7 +6729,7 @@ static int __maybe_unused wlcore_runtime + + ret = wlcore_raw_write32(wl, HW_ACCESS_ELP_CTRL_REG, ELPCTRL_WAKE_UP); + if (ret < 0) { +- wl12xx_queue_recovery_work(wl); ++ recovery = true; + goto err; + } + +@@ -6734,11 +6737,12 @@ static int __maybe_unused wlcore_runtime + ret = wait_for_completion_timeout(&compl, + msecs_to_jiffies(WL1271_WAKEUP_TIMEOUT)); + if (ret == 0) { +- wl1271_error("ELP wakeup timeout!"); +- wl12xx_queue_recovery_work(wl); ++ wl1271_warning("ELP wakeup timeout!"); + + /* Return no error for runtime PM for recovery */ +- return 0; ++ ret = 0; ++ recovery = true; ++ goto err; + } + } + +@@ -6753,6 +6757,12 @@ err: + spin_lock_irqsave(&wl->wl_lock, flags); + wl->elp_compl = NULL; + spin_unlock_irqrestore(&wl->wl_lock, flags); ++ ++ if (recovery) { ++ set_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags); ++ wl12xx_queue_recovery_work(wl); ++ } ++ + return ret; + } + diff --git a/queue-4.19/x86-boot-fix-efi-stub-alignment.patch b/queue-4.19/x86-boot-fix-efi-stub-alignment.patch new file mode 100644 index 00000000000..18868be6f0f --- /dev/null +++ b/queue-4.19/x86-boot-fix-efi-stub-alignment.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Ben Hutchings +Date: Sun, 16 Sep 2018 16:22:47 +0100 +Subject: x86: boot: Fix EFI stub alignment + +From: Ben Hutchings + +[ Upstream commit 9c1442a9d039a1a3302fa93e9a11001c5f23b624 ] + +We currently align the end of the compressed image to a multiple of +16. However, the PE-COFF header included in the EFI stub says that +the file alignment is 32 bytes, and when adding an EFI signature to +the file it must first be padded to this alignment. + +sbsigntool commands warn about this: + + warning: file-aligned section .text extends beyond end of file + warning: checksum areas are greater than image size. Invalid section table? + +Worse, pesign -at least when creating a detached signature- uses the +hash of the unpadded file, resulting in an invalid signature if +padding is required. + +Avoid both these problems by increasing alignment to 32 bytes when +CONFIG_EFI_STUB is enabled. + +Signed-off-by: Ben Hutchings +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/boot/tools/build.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/boot/tools/build.c ++++ b/arch/x86/boot/tools/build.c +@@ -391,6 +391,13 @@ int main(int argc, char ** argv) + die("Unable to mmap '%s': %m", argv[2]); + /* Number of 16-byte paragraphs, including space for a 4-byte CRC */ + sys_size = (sz + 15 + 4) / 16; ++#ifdef CONFIG_EFI_STUB ++ /* ++ * COFF requires minimum 32-byte alignment of sections, and ++ * adding a signature is problematic without that alignment. ++ */ ++ sys_size = (sys_size + 1) & ~1; ++#endif + + /* Patch the setup code with the appropriate size parameters */ + buf[0x1f1] = setup_sectors-1; diff --git a/queue-4.19/x86-intel_rdt-show-missing-resctrl-mount-options.patch b/queue-4.19/x86-intel_rdt-show-missing-resctrl-mount-options.patch new file mode 100644 index 00000000000..1c5946d715b --- /dev/null +++ b/queue-4.19/x86-intel_rdt-show-missing-resctrl-mount-options.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Xiaochen Shen +Date: Wed, 12 Sep 2018 16:48:38 -0700 +Subject: x86/intel_rdt: Show missing resctrl mount options + +From: Xiaochen Shen + +[ Upstream commit 2cc81c6992248ea37d0241bc325977bab310bc3b ] + +In resctrl filesystem, mount options exist to enable L3/L2 CDP and MBA +Software Controller features if the platform supports them: + + mount -t resctrl resctrl [-o cdp[,cdpl2][,mba_MBps]] /sys/fs/resctrl + +But currently only "cdp" option is displayed in /proc/mounts. "cdpl2" and +"mba_MBps" options are not shown even when they are active. + +Before: + # mount -t resctrl resctrl -o cdp,mba_MBps /sys/fs/resctrl + # grep resctrl /proc/mounts + /sys/fs/resctrl /sys/fs/resctrl resctrl rw,relatime,cdp 0 0 + +After: + # mount -t resctrl resctrl -o cdp,mba_MBps /sys/fs/resctrl + # grep resctrl /proc/mounts + /sys/fs/resctrl /sys/fs/resctrl resctrl rw,relatime,cdp,mba_MBps 0 0 + +Signed-off-by: Xiaochen Shen +Signed-off-by: Fenghua Yu +Signed-off-by: Thomas Gleixner +Cc: "H Peter Anvin" +Cc: "Tony Luck" +Link: https://lkml.kernel.org/r/1536796118-60135-1-git-send-email-fenghua.yu@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c ++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +@@ -2805,6 +2805,13 @@ static int rdtgroup_show_options(struct + { + if (rdt_resources_all[RDT_RESOURCE_L3DATA].alloc_enabled) + seq_puts(seq, ",cdp"); ++ ++ if (rdt_resources_all[RDT_RESOURCE_L2DATA].alloc_enabled) ++ seq_puts(seq, ",cdpl2"); ++ ++ if (is_mba_sc(&rdt_resources_all[RDT_RESOURCE_MBA])) ++ seq_puts(seq, ",mba_MBps"); ++ + return 0; + } + diff --git a/queue-4.19/x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch b/queue-4.19/x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch new file mode 100644 index 00000000000..e7859d6f358 --- /dev/null +++ b/queue-4.19/x86-olpc-indicate-that-legacy-pc-xo-1-platform-should-not-register-rtc.patch @@ -0,0 +1,71 @@ +From foo@baz Sat Nov 10 10:51:03 PST 2018 +From: Lubomir Rintel +Date: Thu, 4 Oct 2018 18:08:08 +0200 +Subject: x86/olpc: Indicate that legacy PC XO-1 platform should not register RTC + +From: Lubomir Rintel + +[ Upstream commit d92116b800fb79a72ad26121f5011f6aa3ad94c2 ] + +On OLPC XO-1, the RTC is discovered via device tree from the arch +initcall. Don't let the PC platform register another one from its device +initcall, it's not going to work: + + sysfs: cannot create duplicate filename '/devices/platform/rtc_cmos' + CPU: 0 PID: 1 Comm: swapper Not tainted 4.19.0-rc6 #12 + Hardware name: OLPC XO/XO, BIOS OLPC Ver 1.00.01 06/11/2014 + Call Trace: + dump_stack+0x16/0x18 + sysfs_warn_dup+0x46/0x58 + sysfs_create_dir_ns+0x76/0x9b + kobject_add_internal+0xed/0x209 + ? __schedule+0x3fa/0x447 + kobject_add+0x5b/0x66 + device_add+0x298/0x535 + ? insert_resource_conflict+0x2a/0x3e + platform_device_add+0x14d/0x192 + ? io_delay_init+0x19/0x19 + platform_device_register+0x1c/0x1f + add_rtc_cmos+0x16/0x31 + do_one_initcall+0x78/0x14a + ? do_early_param+0x75/0x75 + kernel_init_freeable+0x152/0x1e0 + ? rest_init+0xa2/0xa2 + kernel_init+0x8/0xd5 + ret_from_fork+0x2e/0x38 + kobject_add_internal failed for rtc_cmos with -EEXIST, don't try to + register things with the same name in the same directory. + platform rtc_cmos: registered platform RTC device (no PNP device found) + +Signed-off-by: Lubomir Rintel +Signed-off-by: Borislav Petkov +Acked-by: Thomas Gleixner +CC: "H. Peter Anvin" +CC: Ingo Molnar +CC: x86-ml +Link: http://lkml.kernel.org/r/20181004160808.307738-1-lkundrak@v3.sk +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/platform/olpc/olpc-xo1-rtc.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/platform/olpc/olpc-xo1-rtc.c ++++ b/arch/x86/platform/olpc/olpc-xo1-rtc.c +@@ -16,6 +16,7 @@ + + #include + #include ++#include + + static void rtc_wake_on(struct device *dev) + { +@@ -75,6 +76,8 @@ static int __init xo1_rtc_init(void) + if (r) + return r; + ++ x86_platform.legacy.rtc = 0; ++ + device_init_wakeup(&xo1_rtc_device.dev, 1); + return 0; + } diff --git a/queue-4.19/xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch b/queue-4.19/xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch new file mode 100644 index 00000000000..3501b33c306 --- /dev/null +++ b/queue-4.19/xhci-avoid-usb-autosuspend-when-resuming-usb2-ports.patch @@ -0,0 +1,84 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Anshuman Gupta +Date: Thu, 20 Sep 2018 19:13:40 +0300 +Subject: xhci: Avoid USB autosuspend when resuming USB2 ports. + +From: Anshuman Gupta + +[ Upstream commit 330e2d61cdd58363eb5e66b2e72f76fe3c5492e0 ] + +When USB bus host controller root hub resumes from autosuspend, +it immediately tries to enter auto-suspend, but there can be a +scenario when root hub is resuming its usb2 ports, in that particular +case USB host controller auto suspend fails since it is busy +to resuming its usb2 ports. + +This makes multiple failed cycles of auto-suspend until all usb2 +ports of host controller root hub do not resume. + +This patch uses USB core framework usb_hcd_start_port_resume, +usb_hcd_end_port_resume API's in order to autoresume/autosuspend +root hub properly. + +Signed-off-by: Anshuman Gupta +Signed-off-by: Mathias Nyman +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/host/xhci-hub.c | 5 +++++ + drivers/usb/host/xhci-ring.c | 1 + + 2 files changed, 6 insertions(+) + +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -900,6 +900,7 @@ static u32 xhci_get_port_status(struct u + set_bit(wIndex, &bus_state->resuming_ports); + bus_state->resume_done[wIndex] = timeout; + mod_timer(&hcd->rh_timer, timeout); ++ usb_hcd_start_port_resume(&hcd->self, wIndex); + } + /* Has resume been signalled for USB_RESUME_TIME yet? */ + } else if (time_after_eq(jiffies, +@@ -940,6 +941,7 @@ static u32 xhci_get_port_status(struct u + clear_bit(wIndex, &bus_state->rexit_ports); + } + ++ usb_hcd_end_port_resume(&hcd->self, wIndex); + bus_state->port_c_suspend |= 1 << wIndex; + bus_state->suspended_ports &= ~(1 << wIndex); + } else { +@@ -962,6 +964,7 @@ static u32 xhci_get_port_status(struct u + (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) { + bus_state->resume_done[wIndex] = 0; + clear_bit(wIndex, &bus_state->resuming_ports); ++ usb_hcd_end_port_resume(&hcd->self, wIndex); + } + + +@@ -1337,6 +1340,7 @@ int xhci_hub_control(struct usb_hcd *hcd + goto error; + + set_bit(wIndex, &bus_state->resuming_ports); ++ usb_hcd_start_port_resume(&hcd->self, wIndex); + xhci_set_link_state(xhci, ports[wIndex], + XDEV_RESUME); + spin_unlock_irqrestore(&xhci->lock, flags); +@@ -1345,6 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd + xhci_set_link_state(xhci, ports[wIndex], + XDEV_U0); + clear_bit(wIndex, &bus_state->resuming_ports); ++ usb_hcd_end_port_resume(&hcd->self, wIndex); + } + bus_state->port_c_suspend |= 1 << wIndex; + +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1602,6 +1602,7 @@ static void handle_port_status(struct xh + set_bit(HCD_FLAG_POLL_RH, &hcd->flags); + mod_timer(&hcd->rh_timer, + bus_state->resume_done[hcd_portnum]); ++ usb_hcd_start_port_resume(&hcd->self, hcd_portnum); + bogus_port_status = true; + } + } diff --git a/queue-4.19/xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch b/queue-4.19/xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch new file mode 100644 index 00000000000..85b44bb8af9 --- /dev/null +++ b/queue-4.19/xprtrdma-reset-credit-grant-properly-after-a-disconnect.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Nov 10 10:51:04 PST 2018 +From: Chuck Lever +Date: Mon, 1 Oct 2018 14:25:14 -0400 +Subject: xprtrdma: Reset credit grant properly after a disconnect + +From: Chuck Lever + +[ Upstream commit ef739b2175dde9c05594f768cb78149f1ce2ac36 ] + +On a fresh connection, an RPC/RDMA client is supposed to send only +one RPC Call until it gets a credit grant in the first RPC Reply +from the server [RFC 8166, Section 3.3.3]. + +There is a bug in the Linux client's credit accounting mechanism +introduced by commit e7ce710a8802 ("xprtrdma: Avoid deadlock when +credit window is reset"). On connect, it simply dumps all pending +RPC Calls onto the new connection. + +Servers have been tolerant of this bad behavior. Currently no server +implementation ever changes its credit grant over reconnects, and +servers always repost enough Receives before connections are fully +established. + +To correct this issue, ensure that the client resets both the credit +grant _and_ the congestion window when handling a reconnect. + +Fixes: e7ce710a8802 ("xprtrdma: Avoid deadlock when credit ... ") +Signed-off-by: Chuck Lever +Cc: stable@kernel.org +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/sunrpc/xprtrdma/svc_rdma_backchannel.c | 1 + + net/sunrpc/xprtrdma/transport.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +--- a/net/sunrpc/xprtrdma/svc_rdma_backchannel.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_backchannel.c +@@ -248,6 +248,7 @@ static void + xprt_rdma_bc_close(struct rpc_xprt *xprt) + { + dprintk("svcrdma: %s: xprt %p\n", __func__, xprt); ++ xprt->cwnd = RPC_CWNDSHIFT; + } + + static void +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -468,6 +468,12 @@ xprt_rdma_close(struct rpc_xprt *xprt) + xprt->reestablish_timeout = 0; + xprt_disconnect_done(xprt); + rpcrdma_ep_disconnect(ep, ia); ++ ++ /* Prepare @xprt for the next connection by reinitializing ++ * its credit grant to one (see RFC 8166, Section 3.3.3). ++ */ ++ r_xprt->rx_buf.rb_credits = 1; ++ xprt->cwnd = RPC_CWNDSHIFT; + } + + /**