From 3f45fd6556caac64a83e4515be2f41a53b9706a2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 28 Nov 2018 11:13:05 -0500 Subject: [PATCH] patches for 4.19 Signed-off-by: Sasha Levin --- ...dd-proc_vtable-and-proc_table-macros.patch | 109 +++++++++ ...per-processor-check_bugs-method-call.patch | 49 ++++ ...ake-lookup_processor_type-non-__init.patch | 44 ++++ ...er-cpu-vtables-to-work-around-big.li.patch | 210 ++++++++++++++++ ...oprio-in-__bio_clone_fast-and-bounce.patch | 50 ++++ ...d-return-value-check-for-voltage-sca.patch | 40 +++ ...ectly-take-reqsize-of-wrapped-skciph.patch | 43 ++++ ...rm-amdgpu-fix-bug-with-ih-ring-setup.patch | 39 +++ ...eferred-unmap-of-early-memmap-mappin.patch | 81 ++++++ ...e-condition-in-__floppy_read_block_0.patch | 79 ++++++ ...strscpy-with-destination-buffer-size.patch | 126 ++++++++++ ...ve-and-undef-trace_include_path-file.patch | 143 +++++++++++ ...g-check-zone_movable-in-has_unmovabl.patch | 67 +++++ ...lloc-check-for-max-order-in-hot-path.patch | 135 ++++++++++ ...-an-oops-during-delegation-callbacks.patch | 73 ++++++ ...ncore-add-more-imc-pci-ids-for-kabyl.patch | 173 +++++++++++++ ...meson-fix-gxbb-ao-pull-register-bits.patch | 35 +++ ...-meson-fix-gxl-ao-pull-register-bits.patch | 35 +++ ...son-fix-meson8-ao-pull-register-bits.patch | 35 +++ ...on-fix-meson8b-ao-pull-register-bits.patch | 35 +++ ...nctrl-meson-fix-pinconf-bias-disable.patch | 39 +++ ...he-io-workarounds-code-to-work-with-.patch | 120 +++++++++ ...press-vphn-is-not-supported-messages.patch | 36 +++ ...lence-some-module-warnings-on-32-bit.patch | 96 ++++++++ ...iscv-add-missing-vdso_install-target.patch | 33 +++ ...export-alarm-rtc_ops-when-we-do-not-.patch | 95 +++++++ ...a-kmemleak-caused-in-pcf2127_i2c_gat.patch | 55 +++++ ...pu_util_wake-for-execl-type-workload.patch | 215 ++++++++++++++++ ...move-set-but-not-used-variable-dq_li.patch | 85 +++++++ .../scsi-lpfc-fix-remoteport-access.patch | 43 ++++ queue-4.19/series | 34 +++ ...gus-get-put-in-generic_key_to_expire.patch | 35 +++ ...-seek_data-sek_hole-return-enxio-wit.patch | 54 ++++ ...dimm-fix-the-array-size-for-dimm-dev.patch | 86 +++++++ .../z3fold-fix-possible-reclaim-races.patch | 231 ++++++++++++++++++ 35 files changed, 2858 insertions(+) create mode 100644 queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch create mode 100644 queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch create mode 100644 queue-4.19/arm-make-lookup_processor_type-non-__init.patch create mode 100644 queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch create mode 100644 queue-4.19/block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch create mode 100644 queue-4.19/cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch create mode 100644 queue-4.19/crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch create mode 100644 queue-4.19/drm-amdgpu-fix-bug-with-ih-ring-setup.patch create mode 100644 queue-4.19/efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch create mode 100644 queue-4.19/floppy-fix-race-condition-in-__floppy_read_block_0.patch create mode 100644 queue-4.19/kdb-use-strscpy-with-destination-buffer-size.patch create mode 100644 queue-4.19/kvm-ppc-move-and-undef-trace_include_path-file.patch create mode 100644 queue-4.19/mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch create mode 100644 queue-4.19/mm-page_alloc-check-for-max-order-in-hot-path.patch create mode 100644 queue-4.19/nfsv4-fix-an-oops-during-delegation-callbacks.patch create mode 100644 queue-4.19/perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch create mode 100644 queue-4.19/pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch create mode 100644 queue-4.19/pinctrl-meson-fix-gxl-ao-pull-register-bits.patch create mode 100644 queue-4.19/pinctrl-meson-fix-meson8-ao-pull-register-bits.patch create mode 100644 queue-4.19/pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch create mode 100644 queue-4.19/pinctrl-meson-fix-pinconf-bias-disable.patch create mode 100644 queue-4.19/powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch create mode 100644 queue-4.19/powerpc-numa-suppress-vphn-is-not-supported-messages.patch create mode 100644 queue-4.19/risc-v-silence-some-module-warnings-on-32-bit.patch create mode 100644 queue-4.19/riscv-add-missing-vdso_install-target.patch create mode 100644 queue-4.19/rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch create mode 100644 queue-4.19/rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch create mode 100644 queue-4.19/sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch create mode 100644 queue-4.19/scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch create mode 100644 queue-4.19/scsi-lpfc-fix-remoteport-access.patch create mode 100644 queue-4.19/sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch create mode 100644 queue-4.19/tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch create mode 100644 queue-4.19/tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch create mode 100644 queue-4.19/z3fold-fix-possible-reclaim-races.patch diff --git a/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch b/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch new file mode 100644 index 00000000000..6bd69fc2c5b --- /dev/null +++ b/queue-4.19/arm-add-proc_vtable-and-proc_table-macros.patch @@ -0,0 +1,109 @@ +From f722f03e6fdb4b398ac743a1709789ef046a10ce Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 19 Jul 2018 12:17:38 +0100 +Subject: ARM: add PROC_VTABLE and PROC_TABLE macros + +[ Upstream commit e209950fdd065d2cc46e6338e47e52841b830cba ] + +Allow the way we access members of the processor vtable to be changed +at compile time. We will need to move to per-CPU vtables to fix the +Spectre variant 2 issues on big.Little systems. + +However, we have a couple of calls that do not need the vtable +treatment, and indeed cause a kernel warning due to the (later) use +of smp_processor_id(), so also introduce the PROC_TABLE macro for +these which always use CPU 0's function pointers. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++----------- + arch/arm/kernel/setup.c | 4 +--- + 2 files changed, 27 insertions(+), 16 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index 30c499146320..c259cc49c641 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -23,7 +23,7 @@ struct mm_struct; + /* + * Don't change this structure - ASM code relies on it. + */ +-extern struct processor { ++struct processor { + /* MISC + * get data abort address/flags + */ +@@ -79,9 +79,13 @@ extern struct processor { + unsigned int suspend_size; + void (*do_suspend)(void *); + void (*do_resume)(void *); +-} processor; ++}; + + #ifndef MULTI_CPU ++static inline void init_proc_vtable(const struct processor *p) ++{ ++} ++ + extern void cpu_proc_init(void); + extern void cpu_proc_fin(void); + extern int cpu_do_idle(void); +@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn)); + extern void cpu_do_suspend(void *); + extern void cpu_do_resume(void *); + #else +-#define cpu_proc_init processor._proc_init +-#define cpu_check_bugs processor.check_bugs +-#define cpu_proc_fin processor._proc_fin +-#define cpu_reset processor.reset +-#define cpu_do_idle processor._do_idle +-#define cpu_dcache_clean_area processor.dcache_clean_area +-#define cpu_set_pte_ext processor.set_pte_ext +-#define cpu_do_switch_mm processor.switch_mm + +-/* These three are private to arch/arm/kernel/suspend.c */ +-#define cpu_do_suspend processor.do_suspend +-#define cpu_do_resume processor.do_resume ++extern struct processor processor; ++#define PROC_VTABLE(f) processor.f ++#define PROC_TABLE(f) processor.f ++static inline void init_proc_vtable(const struct processor *p) ++{ ++ processor = *p; ++} ++ ++#define cpu_proc_init PROC_VTABLE(_proc_init) ++#define cpu_check_bugs PROC_VTABLE(check_bugs) ++#define cpu_proc_fin PROC_VTABLE(_proc_fin) ++#define cpu_reset PROC_VTABLE(reset) ++#define cpu_do_idle PROC_VTABLE(_do_idle) ++#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area) ++#define cpu_set_pte_ext PROC_TABLE(set_pte_ext) ++#define cpu_do_switch_mm PROC_VTABLE(switch_mm) ++ ++/* These two are private to arch/arm/kernel/suspend.c */ ++#define cpu_do_suspend PROC_VTABLE(do_suspend) ++#define cpu_do_resume PROC_VTABLE(do_resume) + #endif + + extern void cpu_resume(void); +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index 4c249cb261f3..6b9d191da868 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -686,9 +686,7 @@ static void __init setup_processor(void) + cpu_name = list->cpu_name; + __cpu_architecture = __get_cpu_architecture(); + +-#ifdef MULTI_CPU +- processor = *list->proc; +-#endif ++ init_proc_vtable(list->proc); + #ifdef MULTI_TLB + cpu_tlb = *list->tlb; + #endif +-- +2.17.1 + diff --git a/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch b/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch new file mode 100644 index 00000000000..5435a60400c --- /dev/null +++ b/queue-4.19/arm-clean-up-per-processor-check_bugs-method-call.patch @@ -0,0 +1,49 @@ +From 126a8c99f7943e0e70c191c97b233a112e6f77a9 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 19 Jul 2018 12:43:03 +0100 +Subject: ARM: clean up per-processor check_bugs method call + +[ Upstream commit 945aceb1db8885d3a35790cf2e810f681db52756 ] + +Call the per-processor type check_bugs() method in the same way as we +do other per-processor functions - move the "processor." detail into +proc-fns.h. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 1 + + arch/arm/kernel/bugs.c | 4 ++-- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index e25f4392e1b2..30c499146320 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *); + extern void cpu_do_resume(void *); + #else + #define cpu_proc_init processor._proc_init ++#define cpu_check_bugs processor.check_bugs + #define cpu_proc_fin processor._proc_fin + #define cpu_reset processor.reset + #define cpu_do_idle processor._do_idle +diff --git a/arch/arm/kernel/bugs.c b/arch/arm/kernel/bugs.c +index 7be511310191..d41d3598e5e5 100644 +--- a/arch/arm/kernel/bugs.c ++++ b/arch/arm/kernel/bugs.c +@@ -6,8 +6,8 @@ + void check_other_bugs(void) + { + #ifdef MULTI_CPU +- if (processor.check_bugs) +- processor.check_bugs(); ++ if (cpu_check_bugs) ++ cpu_check_bugs(); + #endif + } + +-- +2.17.1 + diff --git a/queue-4.19/arm-make-lookup_processor_type-non-__init.patch b/queue-4.19/arm-make-lookup_processor_type-non-__init.patch new file mode 100644 index 00000000000..f48fbd54122 --- /dev/null +++ b/queue-4.19/arm-make-lookup_processor_type-non-__init.patch @@ -0,0 +1,44 @@ +From 709a9d4f708170faf204bf59c0a1af26762cef78 Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 19 Jul 2018 11:42:36 +0100 +Subject: ARM: make lookup_processor_type() non-__init + +[ Upstream commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc ] + +Move lookup_processor_type() out of the __init section so it is callable +from (eg) the secondary startup code during hotplug. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/head-common.S | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/kernel/head-common.S b/arch/arm/kernel/head-common.S +index 6e0375e7db05..997b02302c31 100644 +--- a/arch/arm/kernel/head-common.S ++++ b/arch/arm/kernel/head-common.S +@@ -145,6 +145,9 @@ __mmap_switched_data: + #endif + .size __mmap_switched_data, . - __mmap_switched_data + ++ __FINIT ++ .text ++ + /* + * This provides a C-API version of __lookup_processor_type + */ +@@ -156,9 +159,6 @@ ENTRY(lookup_processor_type) + ldmfd sp!, {r4 - r6, r9, pc} + ENDPROC(lookup_processor_type) + +- __FINIT +- .text +- + /* + * Read processor ID register (CP#15, CR0), and look up in the linker-built + * supported processor list. Note that we can't use the absolute addresses +-- +2.17.1 + diff --git a/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch b/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch new file mode 100644 index 00000000000..29d3d683372 --- /dev/null +++ b/queue-4.19/arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch @@ -0,0 +1,210 @@ +From bf59fa8ce6a739b0d5c6e75bd7925785de232a9f Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Thu, 19 Jul 2018 12:21:31 +0100 +Subject: ARM: spectre-v2: per-CPU vtables to work around big.Little systems + +[ Upstream commit 383fb3ee8024d596f488d2dbaf45e572897acbdb ] + +In big.Little systems, some CPUs require the Spectre workarounds in +paths such as the context switch, but other CPUs do not. In order +to handle these differences, we need per-CPU vtables. + +We are unable to use the kernel's per-CPU variables to support this +as per-CPU is not initialised at times when we need access to the +vtables, so we have to use an array indexed by logical CPU number. + +We use an array-of-pointers to avoid having function pointers in +the kernel's read/write .data section. + +Reviewed-by: Julien Thierry +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++ + arch/arm/kernel/setup.c | 5 +++++ + arch/arm/kernel/smp.c | 31 +++++++++++++++++++++++++++++++ + arch/arm/mm/proc-v7-bugs.c | 17 ++--------------- + 4 files changed, 61 insertions(+), 15 deletions(-) + +diff --git a/arch/arm/include/asm/proc-fns.h b/arch/arm/include/asm/proc-fns.h +index c259cc49c641..e1b6f280ab08 100644 +--- a/arch/arm/include/asm/proc-fns.h ++++ b/arch/arm/include/asm/proc-fns.h +@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *); + #else + + extern struct processor processor; ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++#include ++/* ++ * This can't be a per-cpu variable because we need to access it before ++ * per-cpu has been initialised. We have a couple of functions that are ++ * called in a pre-emptible context, and so can't use smp_processor_id() ++ * there, hence PROC_TABLE(). We insist in init_proc_vtable() that the ++ * function pointers for these are identical across all CPUs. ++ */ ++extern struct processor *cpu_vtable[]; ++#define PROC_VTABLE(f) cpu_vtable[smp_processor_id()]->f ++#define PROC_TABLE(f) cpu_vtable[0]->f ++static inline void init_proc_vtable(const struct processor *p) ++{ ++ unsigned int cpu = smp_processor_id(); ++ *cpu_vtable[cpu] = *p; ++ WARN_ON_ONCE(cpu_vtable[cpu]->dcache_clean_area != ++ cpu_vtable[0]->dcache_clean_area); ++ WARN_ON_ONCE(cpu_vtable[cpu]->set_pte_ext != ++ cpu_vtable[0]->set_pte_ext); ++} ++#else + #define PROC_VTABLE(f) processor.f + #define PROC_TABLE(f) processor.f + static inline void init_proc_vtable(const struct processor *p) + { + processor = *p; + } ++#endif + + #define cpu_proc_init PROC_VTABLE(_proc_init) + #define cpu_check_bugs PROC_VTABLE(check_bugs) +diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c +index 6b9d191da868..830d7b4ecb84 100644 +--- a/arch/arm/kernel/setup.c ++++ b/arch/arm/kernel/setup.c +@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2); + + #ifdef MULTI_CPU + struct processor processor __ro_after_init; ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++struct processor *cpu_vtable[NR_CPUS] = { ++ [0] = &processor, ++}; ++#endif + #endif + #ifdef MULTI_TLB + struct cpu_tlb_fns cpu_tlb __ro_after_init; +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 0978282d5fc2..12a6172263c0 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd) + #endif + } + ++#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) ++static int secondary_biglittle_prepare(unsigned int cpu) ++{ ++ if (!cpu_vtable[cpu]) ++ cpu_vtable[cpu] = kzalloc(sizeof(*cpu_vtable[cpu]), GFP_KERNEL); ++ ++ return cpu_vtable[cpu] ? 0 : -ENOMEM; ++} ++ ++static void secondary_biglittle_init(void) ++{ ++ init_proc_vtable(lookup_processor(read_cpuid_id())->proc); ++} ++#else ++static int secondary_biglittle_prepare(unsigned int cpu) ++{ ++ return 0; ++} ++ ++static void secondary_biglittle_init(void) ++{ ++} ++#endif ++ + int __cpu_up(unsigned int cpu, struct task_struct *idle) + { + int ret; +@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle) + if (!smp_ops.smp_boot_secondary) + return -ENOSYS; + ++ ret = secondary_biglittle_prepare(cpu); ++ if (ret) ++ return ret; ++ + /* + * We need to tell the secondary core where to find + * its stack and the page tables. +@@ -359,6 +388,8 @@ asmlinkage void secondary_start_kernel(void) + struct mm_struct *mm = &init_mm; + unsigned int cpu; + ++ secondary_biglittle_init(); ++ + /* + * The identity mapping is uncached (strongly ordered), so + * switch away from it before attempting any exclusive accesses. +diff --git a/arch/arm/mm/proc-v7-bugs.c b/arch/arm/mm/proc-v7-bugs.c +index 5544b82a2e7a..9a07916af8dd 100644 +--- a/arch/arm/mm/proc-v7-bugs.c ++++ b/arch/arm/mm/proc-v7-bugs.c +@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void) + case ARM_CPU_PART_CORTEX_A17: + case ARM_CPU_PART_CORTEX_A73: + case ARM_CPU_PART_CORTEX_A75: +- if (processor.switch_mm != cpu_v7_bpiall_switch_mm) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + harden_branch_predictor_bpiall; + spectre_v2_method = "BPIALL"; +@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void) + + case ARM_CPU_PART_CORTEX_A15: + case ARM_CPU_PART_BRAHMA_B15: +- if (processor.switch_mm != cpu_v7_iciallu_switch_mm) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + harden_branch_predictor_iciallu; + spectre_v2_method = "ICIALLU"; +@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void) + ARM_SMCCC_ARCH_WORKAROUND_1, &res); + if ((int)res.a0 != 0) + break; +- if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + call_hvc_arch_workaround_1; +- processor.switch_mm = cpu_v7_hvc_switch_mm; ++ cpu_do_switch_mm = cpu_v7_hvc_switch_mm; + spectre_v2_method = "hypervisor"; + break; + +@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void) + ARM_SMCCC_ARCH_WORKAROUND_1, &res); + if ((int)res.a0 != 0) + break; +- if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu) +- goto bl_error; + per_cpu(harden_branch_predictor_fn, cpu) = + call_smc_arch_workaround_1; +- processor.switch_mm = cpu_v7_smc_switch_mm; ++ cpu_do_switch_mm = cpu_v7_smc_switch_mm; + spectre_v2_method = "firmware"; + break; + +@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void) + if (spectre_v2_method) + pr_info("CPU%u: Spectre v2: using %s workaround\n", + smp_processor_id(), spectre_v2_method); +- return; +- +-bl_error: +- pr_err("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n", +- cpu); + } + #else + static void cpu_v7_spectre_init(void) +-- +2.17.1 + diff --git a/queue-4.19/block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch b/queue-4.19/block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch new file mode 100644 index 00000000000..f84bd2342bc --- /dev/null +++ b/queue-4.19/block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch @@ -0,0 +1,50 @@ +From 8bf5f2faf0b5f3cfbcc74b7032b82498977319d7 Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Mon, 12 Nov 2018 10:35:25 -0700 +Subject: block: copy ioprio in __bio_clone_fast() and bounce + +[ Upstream commit ca474b73896bf6e0c1eb8787eb217b0f80221610 ] + +We need to copy the io priority, too; otherwise the clone will run +with a different priority than the original one. + +Fixes: 43b62ce3ff0a ("block: move bio io prio to a new field") +Signed-off-by: Hannes Reinecke +Signed-off-by: Jean Delvare + +Fixed up subject, and ordered stores. + +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 1 + + block/bounce.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/block/bio.c b/block/bio.c +index 41173710430c..c4ef8aa46452 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -605,6 +605,7 @@ void __bio_clone_fast(struct bio *bio, struct bio *bio_src) + if (bio_flagged(bio_src, BIO_THROTTLED)) + bio_set_flag(bio, BIO_THROTTLED); + bio->bi_opf = bio_src->bi_opf; ++ bio->bi_ioprio = bio_src->bi_ioprio; + bio->bi_write_hint = bio_src->bi_write_hint; + bio->bi_iter = bio_src->bi_iter; + bio->bi_io_vec = bio_src->bi_io_vec; +diff --git a/block/bounce.c b/block/bounce.c +index 418677dcec60..abb50e7e5fab 100644 +--- a/block/bounce.c ++++ b/block/bounce.c +@@ -248,6 +248,7 @@ static struct bio *bounce_clone_bio(struct bio *bio_src, gfp_t gfp_mask, + return NULL; + bio->bi_disk = bio_src->bi_disk; + bio->bi_opf = bio_src->bi_opf; ++ bio->bi_ioprio = bio_src->bi_ioprio; + bio->bi_write_hint = bio_src->bi_write_hint; + bio->bi_iter.bi_sector = bio_src->bi_iter.bi_sector; + bio->bi_iter.bi_size = bio_src->bi_iter.bi_size; +-- +2.17.1 + diff --git a/queue-4.19/cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch b/queue-4.19/cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch new file mode 100644 index 00000000000..fd3c5afa3a1 --- /dev/null +++ b/queue-4.19/cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch @@ -0,0 +1,40 @@ +From a82084937d7f776e75dea34dff8e0f05563a364c Mon Sep 17 00:00:00 2001 +From: Anson Huang +Date: Mon, 5 Nov 2018 00:59:28 +0000 +Subject: cpufreq: imx6q: add return value check for voltage scale + +[ Upstream commit 6ef28a04d1ccf718eee069b72132ce4aa1e52ab9 ] + +Add return value check for voltage scale when ARM clock +rate change fail. + +Signed-off-by: Anson Huang +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/imx6q-cpufreq.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c +index b2ff423ad7f8..f4880a4f865b 100644 +--- a/drivers/cpufreq/imx6q-cpufreq.c ++++ b/drivers/cpufreq/imx6q-cpufreq.c +@@ -159,8 +159,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index) + /* Ensure the arm clock divider is what we expect */ + ret = clk_set_rate(clks[ARM].clk, new_freq * 1000); + if (ret) { ++ int ret1; ++ + dev_err(cpu_dev, "failed to set clock rate: %d\n", ret); +- regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ ret1 = regulator_set_voltage_tol(arm_reg, volt_old, 0); ++ if (ret1) ++ dev_warn(cpu_dev, ++ "failed to restore vddarm voltage: %d\n", ret1); + return ret; + } + +-- +2.17.1 + diff --git a/queue-4.19/crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch b/queue-4.19/crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch new file mode 100644 index 00000000000..081d9840d6d --- /dev/null +++ b/queue-4.19/crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch @@ -0,0 +1,43 @@ +From 8f2af66b3e2cab4458001003a4ea74898c7ed08e Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 8 Nov 2018 23:55:16 +0100 +Subject: crypto: simd - correctly take reqsize of wrapped skcipher into + account + +[ Upstream commit 508a1c4df085a547187eed346f1bfe5e381797f1 ] + +The simd wrapper's skcipher request context structure consists +of a single subrequest whose size is taken from the subordinate +skcipher. However, in simd_skcipher_init(), the reqsize that is +retrieved is not from the subordinate skcipher but from the +cryptd request structure, whose size is completely unrelated to +the actual wrapped skcipher. + +Reported-by: Qian Cai +Signed-off-by: Ard Biesheuvel +Tested-by: Qian Cai +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/simd.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/crypto/simd.c b/crypto/simd.c +index ea7240be3001..78e8d037ae2b 100644 +--- a/crypto/simd.c ++++ b/crypto/simd.c +@@ -124,8 +124,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm) + + ctx->cryptd_tfm = cryptd_tfm; + +- reqsize = sizeof(struct skcipher_request); +- reqsize += crypto_skcipher_reqsize(&cryptd_tfm->base); ++ reqsize = crypto_skcipher_reqsize(cryptd_skcipher_child(cryptd_tfm)); ++ reqsize = max(reqsize, crypto_skcipher_reqsize(&cryptd_tfm->base)); ++ reqsize += sizeof(struct skcipher_request); + + crypto_skcipher_set_reqsize(tfm, reqsize); + +-- +2.17.1 + diff --git a/queue-4.19/drm-amdgpu-fix-bug-with-ih-ring-setup.patch b/queue-4.19/drm-amdgpu-fix-bug-with-ih-ring-setup.patch new file mode 100644 index 00000000000..148e869ed84 --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-bug-with-ih-ring-setup.patch @@ -0,0 +1,39 @@ +From 0ce5ed41d523e009cb79ac8a18c319bea76c21b5 Mon Sep 17 00:00:00 2001 +From: Philip Yang +Date: Mon, 12 Nov 2018 14:00:45 -0500 +Subject: drm/amdgpu: fix bug with IH ring setup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit c837243ff4017f493c7d6f4ab57278d812a86859 ] + +The bug limits the IH ring wptr address to 40bit. When the system memory +is bigger than 1TB, the bus address is more than 40bit, this causes the +interrupt cannot be handled and cleared correctly. + +Reviewed-by: Christian König +Signed-off-by: Philip Yang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vega10_ih.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c +index 5ae5ed2e62d6..21bc12e02311 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vega10_ih.c ++++ b/drivers/gpu/drm/amd/amdgpu/vega10_ih.c +@@ -129,7 +129,7 @@ static int vega10_ih_irq_init(struct amdgpu_device *adev) + else + wptr_off = adev->wb.gpu_addr + (adev->irq.ih.wptr_offs * 4); + WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_LO, lower_32_bits(wptr_off)); +- WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFF); ++ WREG32_SOC15(OSSSYS, 0, mmIH_RB_WPTR_ADDR_HI, upper_32_bits(wptr_off) & 0xFFFF); + + /* set rptr, wptr to 0 */ + WREG32_SOC15(OSSSYS, 0, mmIH_RB_RPTR, 0); +-- +2.17.1 + diff --git a/queue-4.19/efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch b/queue-4.19/efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch new file mode 100644 index 00000000000..acb58c31629 --- /dev/null +++ b/queue-4.19/efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch @@ -0,0 +1,81 @@ +From c5561008cdaa8d379d3e26264697c39638ba275d Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Wed, 14 Nov 2018 09:55:41 -0800 +Subject: efi/arm: Revert deferred unmap of early memmap mapping + +[ Upstream commit 33412b8673135b18ea42beb7f5117ed0091798b6 ] + +Commit: + + 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory map longer for BGRT") + +deferred the unmap of the early mapping of the UEFI memory map to +accommodate the ACPI BGRT code, which looks up the memory type that +backs the BGRT table to validate it against the requirements of the UEFI spec. + +Unfortunately, this causes problems on ARM, which does not permit +early mappings to persist after paging_init() is called, resulting +in a WARN() splat. Since we don't support the BGRT table on ARM anway, +let's revert ARM to the old behaviour, which is to take down the +early mapping at the end of efi_init(). + +Signed-off-by: Ard Biesheuvel +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-efi@vger.kernel.org +Fixes: 3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory ...") +Link: http://lkml.kernel.org/r/20181114175544.12860-3-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/arm-init.c | 4 ++++ + drivers/firmware/efi/arm-runtime.c | 2 +- + drivers/firmware/efi/memmap.c | 3 +++ + 3 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c +index 388a929baf95..1a6a77df8a5e 100644 +--- a/drivers/firmware/efi/arm-init.c ++++ b/drivers/firmware/efi/arm-init.c +@@ -265,6 +265,10 @@ void __init efi_init(void) + (params.mmap & ~PAGE_MASK))); + + init_screen_info(); ++ ++ /* ARM does not permit early mappings to persist across paging_init() */ ++ if (IS_ENABLED(CONFIG_ARM)) ++ efi_memmap_unmap(); + } + + static int __init register_gop_device(void) +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 922cfb813109..a00934d263c5 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -110,7 +110,7 @@ static int __init arm_enable_runtime_services(void) + { + u64 mapsize; + +- if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) { ++ if (!efi_enabled(EFI_BOOT)) { + pr_info("EFI services will not be available.\n"); + return 0; + } +diff --git a/drivers/firmware/efi/memmap.c b/drivers/firmware/efi/memmap.c +index 5fc70520e04c..1907db2b38d8 100644 +--- a/drivers/firmware/efi/memmap.c ++++ b/drivers/firmware/efi/memmap.c +@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data) + + void __init efi_memmap_unmap(void) + { ++ if (!efi_enabled(EFI_MEMMAP)) ++ return; ++ + if (!efi.memmap.late) { + unsigned long size; + +-- +2.17.1 + diff --git a/queue-4.19/floppy-fix-race-condition-in-__floppy_read_block_0.patch b/queue-4.19/floppy-fix-race-condition-in-__floppy_read_block_0.patch new file mode 100644 index 00000000000..f9f2e636717 --- /dev/null +++ b/queue-4.19/floppy-fix-race-condition-in-__floppy_read_block_0.patch @@ -0,0 +1,79 @@ +From ff5edcf876adc920666faf569ee293ed9499a704 Mon Sep 17 00:00:00 2001 +From: Jens Axboe +Date: Fri, 9 Nov 2018 15:58:40 -0700 +Subject: floppy: fix race condition in __floppy_read_block_0() + +[ Upstream commit de7b75d82f70c5469675b99ad632983c50b6f7e7 ] + +LKP recently reported a hang at bootup in the floppy code: + +[ 245.678853] INFO: task mount:580 blocked for more than 120 seconds. +[ 245.679906] Tainted: G T 4.19.0-rc6-00172-ga9f38e1 #1 +[ 245.680959] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +[ 245.682181] mount D 6372 580 1 0x00000004 +[ 245.683023] Call Trace: +[ 245.683425] __schedule+0x2df/0x570 +[ 245.683975] schedule+0x2d/0x80 +[ 245.684476] schedule_timeout+0x19d/0x330 +[ 245.685090] ? wait_for_common+0xa5/0x170 +[ 245.685735] wait_for_common+0xac/0x170 +[ 245.686339] ? do_sched_yield+0x90/0x90 +[ 245.686935] wait_for_completion+0x12/0x20 +[ 245.687571] __floppy_read_block_0+0xfb/0x150 +[ 245.688244] ? floppy_resume+0x40/0x40 +[ 245.688844] floppy_revalidate+0x20f/0x240 +[ 245.689486] check_disk_change+0x43/0x60 +[ 245.690087] floppy_open+0x1ea/0x360 +[ 245.690653] __blkdev_get+0xb4/0x4d0 +[ 245.691212] ? blkdev_get+0x1db/0x370 +[ 245.691777] blkdev_get+0x1f3/0x370 +[ 245.692351] ? path_put+0x15/0x20 +[ 245.692871] ? lookup_bdev+0x4b/0x90 +[ 245.693539] blkdev_get_by_path+0x3d/0x80 +[ 245.694165] mount_bdev+0x2a/0x190 +[ 245.694695] squashfs_mount+0x10/0x20 +[ 245.695271] ? squashfs_alloc_inode+0x30/0x30 +[ 245.695960] mount_fs+0xf/0x90 +[ 245.696451] vfs_kern_mount+0x43/0x130 +[ 245.697036] do_mount+0x187/0xc40 +[ 245.697563] ? memdup_user+0x28/0x50 +[ 245.698124] ksys_mount+0x60/0xc0 +[ 245.698639] sys_mount+0x19/0x20 +[ 245.699167] do_int80_syscall_32+0x61/0x130 +[ 245.699813] entry_INT80_32+0xc7/0xc7 + +showing that we never complete that read request. The reason is that +the completion setup is racy - it initializes the completion event +AFTER submitting the IO, which means that the IO could complete +before/during the init. If it does, we are passing garbage to +complete() and we may sleep forever waiting for the event to +occur. + +Fixes: 7b7b68bba5ef ("floppy: bail out in open() if drive is not responding to block0 read") +Reviewed-by: Omar Sandoval +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/floppy.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index f2b6f4da1034..fdabd0b74492 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -4151,10 +4151,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive) + bio.bi_end_io = floppy_rb0_cb; + bio_set_op_attrs(&bio, REQ_OP_READ, 0); + ++ init_completion(&cbdata.complete); ++ + submit_bio(&bio); + process_fd_request(); + +- init_completion(&cbdata.complete); + wait_for_completion(&cbdata.complete); + + __free_page(page); +-- +2.17.1 + diff --git a/queue-4.19/kdb-use-strscpy-with-destination-buffer-size.patch b/queue-4.19/kdb-use-strscpy-with-destination-buffer-size.patch new file mode 100644 index 00000000000..58b537730e1 --- /dev/null +++ b/queue-4.19/kdb-use-strscpy-with-destination-buffer-size.patch @@ -0,0 +1,126 @@ +From 8479c0c750d1510eff812f06f9915b6d806d2db5 Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Thu, 20 Sep 2018 08:59:14 -0400 +Subject: kdb: Use strscpy with destination buffer size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit c2b94c72d93d0929f48157eef128c4f9d2e603ce ] + +gcc 8.1.0 warns with: + +kernel/debug/kdb/kdb_support.c: In function ‘kallsyms_symbol_next’: +kernel/debug/kdb/kdb_support.c:239:4: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=] + strncpy(prefix_name, name, strlen(name)+1); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +kernel/debug/kdb/kdb_support.c:239:31: note: length computed here + +Use strscpy() with the destination buffer size, and use ellipses when +displaying truncated symbols. + +v2: Use strscpy() + +Signed-off-by: Prarit Bhargava +Cc: Jonathan Toppins +Cc: Jason Wessel +Cc: Daniel Thompson +Cc: kgdb-bugreport@lists.sourceforge.net +Reviewed-by: Daniel Thompson +Signed-off-by: Daniel Thompson +Signed-off-by: Sasha Levin +--- + kernel/debug/kdb/kdb_io.c | 15 +++++++++------ + kernel/debug/kdb/kdb_private.h | 2 +- + kernel/debug/kdb/kdb_support.c | 10 +++++----- + 3 files changed, 15 insertions(+), 12 deletions(-) + +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index ed5d34925ad0..6a4b41484afe 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize) + int count; + int i; + int diag, dtab_count; +- int key; ++ int key, buf_size, ret; + + + diag = kdbgetintenv("DTABCOUNT", &dtab_count); +@@ -336,9 +336,8 @@ poll_again: + else + p_tmp = tmpbuffer; + len = strlen(p_tmp); +- count = kallsyms_symbol_complete(p_tmp, +- sizeof(tmpbuffer) - +- (p_tmp - tmpbuffer)); ++ buf_size = sizeof(tmpbuffer) - (p_tmp - tmpbuffer); ++ count = kallsyms_symbol_complete(p_tmp, buf_size); + if (tab == 2 && count > 0) { + kdb_printf("\n%d symbols are found.", count); + if (count > dtab_count) { +@@ -350,9 +349,13 @@ poll_again: + } + kdb_printf("\n"); + for (i = 0; i < count; i++) { +- if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) ++ ret = kallsyms_symbol_next(p_tmp, i, buf_size); ++ if (WARN_ON(!ret)) + break; +- kdb_printf("%s ", p_tmp); ++ if (ret != -E2BIG) ++ kdb_printf("%s ", p_tmp); ++ else ++ kdb_printf("%s... ", p_tmp); + *(p_tmp + len) = '\0'; + } + if (i >= dtab_count) +diff --git a/kernel/debug/kdb/kdb_private.h b/kernel/debug/kdb/kdb_private.h +index 1e5a502ba4a7..2118d8258b7c 100644 +--- a/kernel/debug/kdb/kdb_private.h ++++ b/kernel/debug/kdb/kdb_private.h +@@ -83,7 +83,7 @@ typedef struct __ksymtab { + unsigned long sym_start; + unsigned long sym_end; + } kdb_symtab_t; +-extern int kallsyms_symbol_next(char *prefix_name, int flag); ++extern int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size); + extern int kallsyms_symbol_complete(char *prefix_name, int max_len); + + /* Exported Symbols for kernel loadable modules to use. */ +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 987eb73284d2..b14b0925c184 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len) + * Parameters: + * prefix_name prefix of a symbol name to lookup + * flag 0 means search from the head, 1 means continue search. ++ * buf_size maximum length that can be written to prefix_name ++ * buffer + * Returns: + * 1 if a symbol matches the given prefix. + * 0 if no string found + */ +-int kallsyms_symbol_next(char *prefix_name, int flag) ++int kallsyms_symbol_next(char *prefix_name, int flag, int buf_size) + { + int prefix_len = strlen(prefix_name); + static loff_t pos; +@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag) + pos = 0; + + while ((name = kdb_walk_kallsyms(&pos))) { +- if (strncmp(name, prefix_name, prefix_len) == 0) { +- strncpy(prefix_name, name, strlen(name)+1); +- return 1; +- } ++ if (!strncmp(name, prefix_name, prefix_len)) ++ return strscpy(prefix_name, name, buf_size); + } + return 0; + } +-- +2.17.1 + diff --git a/queue-4.19/kvm-ppc-move-and-undef-trace_include_path-file.patch b/queue-4.19/kvm-ppc-move-and-undef-trace_include_path-file.patch new file mode 100644 index 00000000000..c7d1b07ed71 --- /dev/null +++ b/queue-4.19/kvm-ppc-move-and-undef-trace_include_path-file.patch @@ -0,0 +1,143 @@ +From aad771f93ee8517c71b189b9fb1ea90fa8fe816c Mon Sep 17 00:00:00 2001 +From: Scott Wood +Date: Tue, 6 Nov 2018 19:49:34 -0600 +Subject: KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE + +[ Upstream commit 28c5bcf74fa07c25d5bd118d1271920f51ce2a98 ] + +TRACE_INCLUDE_PATH and TRACE_INCLUDE_FILE are used by +, so like that #include, they should +be outside #ifdef protection. + +They also need to be #undefed before defining, in case multiple trace +headers are included by the same C file. This became the case on +book3e after commit cf4a6085151a ("powerpc/mm: Add missing tracepoint for +tlbie"), leading to the following build error: + + CC arch/powerpc/kvm/powerpc.o +In file included from arch/powerpc/kvm/powerpc.c:51:0: +arch/powerpc/kvm/trace.h:9:0: error: "TRACE_INCLUDE_PATH" redefined +[-Werror] + #define TRACE_INCLUDE_PATH . + ^ +In file included from arch/powerpc/kvm/../mm/mmu_decl.h:25:0, + from arch/powerpc/kvm/powerpc.c:48: +./arch/powerpc/include/asm/trace.h:224:0: note: this is the location of +the previous definition + #define TRACE_INCLUDE_PATH asm + ^ +cc1: all warnings being treated as errors + +Reported-by: Christian Zigotzky +Signed-off-by: Scott Wood +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/trace.h | 8 ++++++-- + arch/powerpc/kvm/trace_booke.h | 9 +++++++-- + arch/powerpc/kvm/trace_hv.h | 9 +++++++-- + arch/powerpc/kvm/trace_pr.h | 9 +++++++-- + 4 files changed, 27 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/kvm/trace.h b/arch/powerpc/kvm/trace.h +index 491b0f715d6b..ea1d7c808319 100644 +--- a/arch/powerpc/kvm/trace.h ++++ b/arch/powerpc/kvm/trace.h +@@ -6,8 +6,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace + + /* + * Tracepoint for guest mode entry. +@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace ++ + #include +diff --git a/arch/powerpc/kvm/trace_booke.h b/arch/powerpc/kvm/trace_booke.h +index ac640e81fdc5..3837842986aa 100644 +--- a/arch/powerpc/kvm/trace_booke.h ++++ b/arch/powerpc/kvm/trace_booke.h +@@ -6,8 +6,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_booke +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_booke + + #define kvm_trace_symbol_exit \ + {0, "CRITICAL"}, \ +@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio, + #endif + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_booke ++ + #include +diff --git a/arch/powerpc/kvm/trace_hv.h b/arch/powerpc/kvm/trace_hv.h +index bcfe8a987f6a..8a1e3b0047f1 100644 +--- a/arch/powerpc/kvm/trace_hv.h ++++ b/arch/powerpc/kvm/trace_hv.h +@@ -9,8 +9,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_hv +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_hv + + #define kvm_trace_symbol_hcall \ + {H_REMOVE, "H_REMOVE"}, \ +@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit, + #endif /* _TRACE_KVM_HV_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_hv ++ + #include +diff --git a/arch/powerpc/kvm/trace_pr.h b/arch/powerpc/kvm/trace_pr.h +index 2f9a8829552b..46a46d328fbf 100644 +--- a/arch/powerpc/kvm/trace_pr.h ++++ b/arch/powerpc/kvm/trace_pr.h +@@ -8,8 +8,6 @@ + + #undef TRACE_SYSTEM + #define TRACE_SYSTEM kvm_pr +-#define TRACE_INCLUDE_PATH . +-#define TRACE_INCLUDE_FILE trace_pr + + TRACE_EVENT(kvm_book3s_reenter, + TP_PROTO(int r, struct kvm_vcpu *vcpu), +@@ -257,4 +255,11 @@ TRACE_EVENT(kvm_exit, + #endif /* _TRACE_KVM_H */ + + /* This part must be outside protection */ ++ ++#undef TRACE_INCLUDE_PATH ++#undef TRACE_INCLUDE_FILE ++ ++#define TRACE_INCLUDE_PATH . ++#define TRACE_INCLUDE_FILE trace_pr ++ + #include +-- +2.17.1 + diff --git a/queue-4.19/mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch b/queue-4.19/mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch new file mode 100644 index 00000000000..d6922a1639e --- /dev/null +++ b/queue-4.19/mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch @@ -0,0 +1,67 @@ +From a4e3783ae28220adcfd1f119c4431bbc732da6e5 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Fri, 16 Nov 2018 15:08:15 -0800 +Subject: mm, memory_hotplug: check zone_movable in has_unmovable_pages + +[ Upstream commit 9d7899999c62c1a81129b76d2a6ecbc4655e1597 ] + +Page state checks are racy. Under a heavy memory workload (e.g. stress +-m 200 -t 2h) it is quite easy to hit a race window when the page is +allocated but its state is not fully populated yet. A debugging patch to +dump the struct page state shows + + has_unmovable_pages: pfn:0x10dfec00, found:0x1, count:0x0 + page:ffffea0437fb0000 count:1 mapcount:1 mapping:ffff880e05239841 index:0x7f26e5000 compound_mapcount: 1 + flags: 0x5fffffc0090034(uptodate|lru|active|head|swapbacked) + +Note that the state has been checked for both PageLRU and PageSwapBacked +already. Closing this race completely would require some sort of retry +logic. This can be tricky and error prone (think of potential endless +or long taking loops). + +Workaround this problem for movable zones at least. Such a zone should +only contain movable pages. Commit 15c30bc09085 ("mm, memory_hotplug: +make has_unmovable_pages more robust") has told us that this is not +strictly true though. Bootmem pages should be marked reserved though so +we can move the original check after the PageReserved check. Pages from +other zones are still prone to races but we even do not pretend that +memory hotremove works for those so pre-mature failure doesn't hurt that +much. + +Link: http://lkml.kernel.org/r/20181106095524.14629-1-mhocko@kernel.org +Fixes: 15c30bc09085 ("mm, memory_hotplug: make has_unmovable_pages more robust") +Signed-off-by: Michal Hocko +Reported-by: Baoquan He +Tested-by: Baoquan He +Acked-by: Baoquan He +Reviewed-by: Oscar Salvador +Acked-by: Balbir Singh +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index e2ef1c17942f..3a4065312938 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7690,6 +7690,14 @@ bool has_unmovable_pages(struct zone *zone, struct page *page, int count, + if (PageReserved(page)) + goto unmovable; + ++ /* ++ * If the zone is movable and we have ruled out all reserved ++ * pages then it should be reasonably safe to assume the rest ++ * is movable. ++ */ ++ if (zone_idx(zone) == ZONE_MOVABLE) ++ continue; ++ + /* + * Hugepages are not in LRU lists, but they're movable. + * We need not scan over tail pages bacause we don't +-- +2.17.1 + diff --git a/queue-4.19/mm-page_alloc-check-for-max-order-in-hot-path.patch b/queue-4.19/mm-page_alloc-check-for-max-order-in-hot-path.patch new file mode 100644 index 00000000000..77f21553d37 --- /dev/null +++ b/queue-4.19/mm-page_alloc-check-for-max-order-in-hot-path.patch @@ -0,0 +1,135 @@ +From 7c690849dbc08f67c661fc417bec5a178ba869e8 Mon Sep 17 00:00:00 2001 +From: Michal Hocko +Date: Fri, 16 Nov 2018 15:08:53 -0800 +Subject: mm, page_alloc: check for max order in hot path + +[ Upstream commit c63ae43ba53bc432b414fd73dd5f4b01fcb1ab43 ] + +Konstantin has noticed that kvmalloc might trigger the following +warning: + + WARNING: CPU: 0 PID: 6676 at mm/vmstat.c:986 __fragmentation_index+0x54/0x60 + [...] + Call Trace: + fragmentation_index+0x76/0x90 + compaction_suitable+0x4f/0xf0 + shrink_node+0x295/0x310 + node_reclaim+0x205/0x250 + get_page_from_freelist+0x649/0xad0 + __alloc_pages_nodemask+0x12a/0x2a0 + kmalloc_large_node+0x47/0x90 + __kmalloc_node+0x22b/0x2e0 + kvmalloc_node+0x3e/0x70 + xt_alloc_table_info+0x3a/0x80 [x_tables] + do_ip6t_set_ctl+0xcd/0x1c0 [ip6_tables] + nf_setsockopt+0x44/0x60 + SyS_setsockopt+0x6f/0xc0 + do_syscall_64+0x67/0x120 + entry_SYSCALL_64_after_hwframe+0x3d/0xa2 + +the problem is that we only check for an out of bound order in the slow +path and the node reclaim might happen from the fast path already. This +is fixable by making sure that kvmalloc doesn't ever use kmalloc for +requests that are larger than KMALLOC_MAX_SIZE but this also shows that +the code is rather fragile. A recent UBSAN report just underlines that +by the following report + + UBSAN: Undefined behaviour in mm/page_alloc.c:3117:19 + shift exponent 51 is too large for 32-bit type 'int' + CPU: 0 PID: 6520 Comm: syz-executor1 Not tainted 4.19.0-rc2 #1 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 + Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xd2/0x148 lib/dump_stack.c:113 + ubsan_epilogue+0x12/0x94 lib/ubsan.c:159 + __ubsan_handle_shift_out_of_bounds+0x2b6/0x30b lib/ubsan.c:425 + __zone_watermark_ok+0x2c7/0x400 mm/page_alloc.c:3117 + zone_watermark_fast mm/page_alloc.c:3216 [inline] + get_page_from_freelist+0xc49/0x44c0 mm/page_alloc.c:3300 + __alloc_pages_nodemask+0x21e/0x640 mm/page_alloc.c:4370 + alloc_pages_current+0xcc/0x210 mm/mempolicy.c:2093 + alloc_pages include/linux/gfp.h:509 [inline] + __get_free_pages+0x12/0x60 mm/page_alloc.c:4414 + dma_mem_alloc+0x36/0x50 arch/x86/include/asm/floppy.h:156 + raw_cmd_copyin drivers/block/floppy.c:3159 [inline] + raw_cmd_ioctl drivers/block/floppy.c:3206 [inline] + fd_locked_ioctl+0xa00/0x2c10 drivers/block/floppy.c:3544 + fd_ioctl+0x40/0x60 drivers/block/floppy.c:3571 + __blkdev_driver_ioctl block/ioctl.c:303 [inline] + blkdev_ioctl+0xb3c/0x1a30 block/ioctl.c:601 + block_ioctl+0x105/0x150 fs/block_dev.c:1883 + vfs_ioctl fs/ioctl.c:46 [inline] + do_vfs_ioctl+0x1c0/0x1150 fs/ioctl.c:687 + ksys_ioctl+0x9e/0xb0 fs/ioctl.c:702 + __do_sys_ioctl fs/ioctl.c:709 [inline] + __se_sys_ioctl fs/ioctl.c:707 [inline] + __x64_sys_ioctl+0x7e/0xc0 fs/ioctl.c:707 + do_syscall_64+0xc4/0x510 arch/x86/entry/common.c:290 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Note that this is not a kvmalloc path. It is just that the fast path +really depends on having sanitzed order as well. Therefore move the +order check to the fast path. + +Link: http://lkml.kernel.org/r/20181113094305.GM15120@dhcp22.suse.cz +Signed-off-by: Michal Hocko +Reported-by: Konstantin Khlebnikov +Reported-by: Kyungtae Kim +Acked-by: Vlastimil Babka +Cc: Balbir Singh +Cc: Mel Gorman +Cc: Pavel Tatashin +Cc: Oscar Salvador +Cc: Mike Rapoport +Cc: Aaron Lu +Cc: Joonsoo Kim +Cc: Byoungyoung Lee +Cc: "Dae R. Jeong" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 20 +++++++++----------- + 1 file changed, 9 insertions(+), 11 deletions(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 3a4065312938..b721631d78ab 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -4055,17 +4055,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, + unsigned int cpuset_mems_cookie; + int reserve_flags; + +- /* +- * In the slowpath, we sanity check order to avoid ever trying to +- * reclaim >= MAX_ORDER areas which will never succeed. Callers may +- * be using allocators in order of preference for an area that is +- * too large. +- */ +- if (order >= MAX_ORDER) { +- WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); +- return NULL; +- } +- + /* + * We also sanity check to catch abuse of atomic reserves being used by + * callers that are not in atomic context. +@@ -4359,6 +4348,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid, + gfp_t alloc_mask; /* The gfp_t that was actually used for allocation */ + struct alloc_context ac = { }; + ++ /* ++ * There are several places where we assume that the order value is sane ++ * so bail out early if the request is out of bound. ++ */ ++ if (unlikely(order >= MAX_ORDER)) { ++ WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); ++ return NULL; ++ } ++ + gfp_mask &= gfp_allowed_mask; + alloc_mask = gfp_mask; + if (!prepare_alloc_pages(gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags)) +-- +2.17.1 + diff --git a/queue-4.19/nfsv4-fix-an-oops-during-delegation-callbacks.patch b/queue-4.19/nfsv4-fix-an-oops-during-delegation-callbacks.patch new file mode 100644 index 00000000000..40bfb1d6953 --- /dev/null +++ b/queue-4.19/nfsv4-fix-an-oops-during-delegation-callbacks.patch @@ -0,0 +1,73 @@ +From 3e0b1b48f185860c3e59efae9ca88172eb3f8812 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 13 Nov 2018 16:37:54 -0500 +Subject: NFSv4: Fix an Oops during delegation callbacks + +[ Upstream commit e39d8a186ed002854196668cb7562ffdfbc6d379 ] + +If the server sends a CB_GETATTR or a CB_RECALL while the filesystem is +being unmounted, then we can Oops when releasing the inode in +nfs4_callback_getattr() and nfs4_callback_recall(). + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_proc.c | 4 ++-- + fs/nfs/delegation.c | 11 +++++++++-- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index fa515d5ea5ba..7b861bbc0b43 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -66,7 +66,7 @@ __be32 nfs4_callback_getattr(void *argp, void *resp, + out_iput: + rcu_read_unlock(); + trace_nfs4_cb_getattr(cps->clp, &args->fh, inode, -ntohl(res->status)); +- iput(inode); ++ nfs_iput_and_deactive(inode); + out: + dprintk("%s: exit with status = %d\n", __func__, ntohl(res->status)); + return res->status; +@@ -108,7 +108,7 @@ __be32 nfs4_callback_recall(void *argp, void *resp, + } + trace_nfs4_cb_recall(cps->clp, &args->fh, inode, + &args->stateid, -ntohl(res)); +- iput(inode); ++ nfs_iput_and_deactive(inode); + out: + dprintk("%s: exit with status = %d\n", __func__, ntohl(res)); + return res; +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index f033f3a69a3b..75fe92eaa681 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -849,16 +849,23 @@ nfs_delegation_find_inode_server(struct nfs_server *server, + const struct nfs_fh *fhandle) + { + struct nfs_delegation *delegation; +- struct inode *res = NULL; ++ struct inode *freeme, *res = NULL; + + list_for_each_entry_rcu(delegation, &server->delegations, super_list) { + spin_lock(&delegation->lock); + if (delegation->inode != NULL && + nfs_compare_fh(fhandle, &NFS_I(delegation->inode)->fh) == 0) { +- res = igrab(delegation->inode); ++ freeme = igrab(delegation->inode); ++ if (freeme && nfs_sb_active(freeme->i_sb)) ++ res = freeme; + spin_unlock(&delegation->lock); + if (res != NULL) + return res; ++ if (freeme) { ++ rcu_read_unlock(); ++ iput(freeme); ++ rcu_read_lock(); ++ } + return ERR_PTR(-EAGAIN); + } + spin_unlock(&delegation->lock); +-- +2.17.1 + diff --git a/queue-4.19/perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch b/queue-4.19/perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch new file mode 100644 index 00000000000..3c66863291a --- /dev/null +++ b/queue-4.19/perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch @@ -0,0 +1,173 @@ +From cf08b3eee3db7ae91f9e954dbc3c96efd428a838 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Fri, 19 Oct 2018 10:04:18 -0700 +Subject: perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and + CoffeeLake CPUs + +[ Upstream commit c10a8de0d32e95b0b8c7c17b6dc09baea5a5a899 ] + +KabyLake and CoffeeLake CPUs have the same client uncore events as SkyLake. + +Add the PCI IDs for the KabyLake Y, U, S processor lines and CoffeeLake U, +H, S processor lines. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Link: http://lkml.kernel.org/r/20181019170419.378-1-kan.liang@linux.intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snb.c | 115 ++++++++++++++++++++++++++++- + 1 file changed, 114 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index 8527c3e1038b..bfa25814fe5f 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -15,6 +15,25 @@ + #define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910 + #define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f + #define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f ++#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c ++#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904 ++#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914 ++#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f ++#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f ++#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc ++#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0 ++#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10 ++#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4 ++#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f ++#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f ++#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2 ++#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30 ++#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18 ++#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6 ++#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31 ++#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33 ++#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca ++#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32 + + /* SNB event control */ + #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff +@@ -569,7 +588,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = { + PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, +- ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_UQ_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SD_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_SQ_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4U_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4H_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6H_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, ++ { /* IMC */ ++ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC), ++ .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), ++ }, + { /* end: all zeroes */ }, + }; + +@@ -618,6 +712,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = { + IMC_DEV(SKL_HQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core H Quad Core */ + IMC_DEV(SKL_SD_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Dual Core */ + IMC_DEV(SKL_SQ_IMC, &skl_uncore_pci_driver), /* 6th Gen Core S Quad Core */ ++ IMC_DEV(KBL_Y_IMC, &skl_uncore_pci_driver), /* 7th Gen Core Y */ ++ IMC_DEV(KBL_U_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U */ ++ IMC_DEV(KBL_UQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core U Quad Core */ ++ IMC_DEV(KBL_SD_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Dual Core */ ++ IMC_DEV(KBL_SQ_IMC, &skl_uncore_pci_driver), /* 7th Gen Core S Quad Core */ ++ IMC_DEV(CFL_2U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 2 Cores */ ++ IMC_DEV(CFL_4U_IMC, &skl_uncore_pci_driver), /* 8th Gen Core U 4 Cores */ ++ IMC_DEV(CFL_4H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 4 Cores */ ++ IMC_DEV(CFL_6H_IMC, &skl_uncore_pci_driver), /* 8th Gen Core H 6 Cores */ ++ IMC_DEV(CFL_2S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 2 Cores Desktop */ ++ IMC_DEV(CFL_4S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Desktop */ ++ IMC_DEV(CFL_6S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Desktop */ ++ IMC_DEV(CFL_8S_D_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Desktop */ ++ IMC_DEV(CFL_4S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Work Station */ ++ IMC_DEV(CFL_6S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Work Station */ ++ IMC_DEV(CFL_8S_W_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Work Station */ ++ IMC_DEV(CFL_4S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 4 Cores Server */ ++ IMC_DEV(CFL_6S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 6 Cores Server */ ++ IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */ + { /* end marker */ } + }; + +-- +2.17.1 + diff --git a/queue-4.19/pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch b/queue-4.19/pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch new file mode 100644 index 00000000000..4e7519eda80 --- /dev/null +++ b/queue-4.19/pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch @@ -0,0 +1,35 @@ +From 0d3f380ceb14700e51af3aca5780c01117144f59 Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Mon, 29 Oct 2018 16:13:37 +0100 +Subject: pinctrl: meson: fix gxbb ao pull register bits + +[ Upstream commit 4bc51e1e350cd4707ce6e551a93eae26d40b9889 ] + +AO pull register definition is inverted between pull (up/down) and +pull enable. Fixing this allows to properly apply bias setting +through pinconf + +Fixes: 468c234f9ed7 ("pinctrl: amlogic: Add support for Amlogic Meson GXBB SoC") +Signed-off-by: Jerome Brunet +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxbb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c +index 4ceb06f8a33c..4edeb4cae72a 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxbb.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxbb.c +@@ -830,7 +830,7 @@ static struct meson_bank meson_gxbb_periphs_banks[] = { + + static struct meson_bank meson_gxbb_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIOAO_13, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson_gxbb_periphs_pinctrl_data = { +-- +2.17.1 + diff --git a/queue-4.19/pinctrl-meson-fix-gxl-ao-pull-register-bits.patch b/queue-4.19/pinctrl-meson-fix-gxl-ao-pull-register-bits.patch new file mode 100644 index 00000000000..069451df7be --- /dev/null +++ b/queue-4.19/pinctrl-meson-fix-gxl-ao-pull-register-bits.patch @@ -0,0 +1,35 @@ +From 311a0341a029608687587b31028e4da1ec392ff7 Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Mon, 29 Oct 2018 16:13:38 +0100 +Subject: pinctrl: meson: fix gxl ao pull register bits + +[ Upstream commit ed3a2b74f3eb34c84c8377353f4730f05acdfd05 ] + +AO pull register definition is inverted between pull (up/down) and +pull enable. Fixing this allows to properly apply bias setting +through pinconf + +Fixes: 0f15f500ff2c ("pinctrl: meson: Add GXL pinctrl definitions") +Signed-off-by: Jerome Brunet +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson-gxl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 7dae1d7bf6b0..158f618f1695 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -807,7 +807,7 @@ static struct meson_bank meson_gxl_periphs_banks[] = { + + static struct meson_bank meson_gxl_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIOAO_9, 0, 9, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson_gxl_periphs_pinctrl_data = { +-- +2.17.1 + diff --git a/queue-4.19/pinctrl-meson-fix-meson8-ao-pull-register-bits.patch b/queue-4.19/pinctrl-meson-fix-meson8-ao-pull-register-bits.patch new file mode 100644 index 00000000000..b790a003a98 --- /dev/null +++ b/queue-4.19/pinctrl-meson-fix-meson8-ao-pull-register-bits.patch @@ -0,0 +1,35 @@ +From 3c16a6e0ef482af058fa2bebe31b8cda78eeea5b Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Mon, 29 Oct 2018 16:13:39 +0100 +Subject: pinctrl: meson: fix meson8 ao pull register bits + +[ Upstream commit e91b162d2868672d06010f34aa83d408db13d3c6 ] + +AO pull register definition is inverted between pull (up/down) and +pull enable. Fixing this allows to properly apply bias setting +through pinconf + +Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") +Signed-off-by: Jerome Brunet +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson8.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8.c b/drivers/pinctrl/meson/pinctrl-meson8.c +index c6d79315218f..86466173114d 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8.c +@@ -1053,7 +1053,7 @@ static struct meson_bank meson8_cbus_banks[] = { + + static struct meson_bank meson8_aobus_banks[] = { + /* name first last irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson8_cbus_pinctrl_data = { +-- +2.17.1 + diff --git a/queue-4.19/pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch b/queue-4.19/pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch new file mode 100644 index 00000000000..e338f994244 --- /dev/null +++ b/queue-4.19/pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch @@ -0,0 +1,35 @@ +From 9dec29e6a7fde47789822f64c7ba8a49face098a Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Mon, 29 Oct 2018 16:13:40 +0100 +Subject: pinctrl: meson: fix meson8b ao pull register bits + +[ Upstream commit a1705f02704cd8a24d434bfd0141ee8142ad277a ] + +AO pull register definition is inverted between pull (up/down) and +pull enable. Fixing this allows to properly apply bias setting +through pinconf + +Fixes: 0fefcb6876d0 ("pinctrl: Add support for Meson8b") +Signed-off-by: Jerome Brunet +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c +index bb2a30964fc6..647ad15d5c3c 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson8b.c ++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c +@@ -906,7 +906,7 @@ static struct meson_bank meson8b_cbus_banks[] = { + + static struct meson_bank meson8b_aobus_banks[] = { + /* name first lastc irq pullen pull dir out in */ +- BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 0, 0, 16, 0, 0, 0, 16, 1, 0), ++ BANK("AO", GPIOAO_0, GPIO_TEST_N, 0, 13, 0, 16, 0, 0, 0, 0, 0, 16, 1, 0), + }; + + static struct meson_pinctrl_data meson8b_cbus_pinctrl_data = { +-- +2.17.1 + diff --git a/queue-4.19/pinctrl-meson-fix-pinconf-bias-disable.patch b/queue-4.19/pinctrl-meson-fix-pinconf-bias-disable.patch new file mode 100644 index 00000000000..e9fbe74fcbd --- /dev/null +++ b/queue-4.19/pinctrl-meson-fix-pinconf-bias-disable.patch @@ -0,0 +1,39 @@ +From a5b7d5d91677a44a16f2f318342fedb04ae5253c Mon Sep 17 00:00:00 2001 +From: Jerome Brunet +Date: Tue, 23 Oct 2018 18:03:19 +0200 +Subject: pinctrl: meson: fix pinconf bias disable + +[ Upstream commit e39f9dd8206ad66992ac0e6218ef1ba746f2cce9 ] + +If a bias is enabled on a pin of an Amlogic SoC, calling .pin_config_set() +with PIN_CONFIG_BIAS_DISABLE will not disable the bias. Instead it will +force a pull-down bias on the pin. + +Instead of the pull type register bank, the driver should access the pull +enable register bank. + +Fixes: 6ac730951104 ("pinctrl: add driver for Amlogic Meson SoCs") +Signed-off-by: Jerome Brunet +Acked-by: Neil Armstrong +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/meson/pinctrl-meson.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/meson/pinctrl-meson.c b/drivers/pinctrl/meson/pinctrl-meson.c +index 29a458da78db..4f3ab18636a3 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson.c ++++ b/drivers/pinctrl/meson/pinctrl-meson.c +@@ -192,7 +192,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin, + dev_dbg(pc->dev, "pin %u: disable bias\n", pin); + + meson_calc_reg_and_bit(bank, pin, REG_PULL, ®, &bit); +- ret = regmap_update_bits(pc->reg_pull, reg, ++ ret = regmap_update_bits(pc->reg_pullen, reg, + BIT(bit), 0); + if (ret) + return ret; +-- +2.17.1 + diff --git a/queue-4.19/powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch b/queue-4.19/powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch new file mode 100644 index 00000000000..cddb4ac16d9 --- /dev/null +++ b/queue-4.19/powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch @@ -0,0 +1,120 @@ +From c2aa734d8c80fb2ef291f879764ad53973612d34 Mon Sep 17 00:00:00 2001 +From: Michael Ellerman +Date: Tue, 6 Nov 2018 23:37:58 +1100 +Subject: powerpc/io: Fix the IO workarounds code to work with Radix + +[ Upstream commit 43c6494fa1499912c8177e71450c0279041152a6 ] + +Back in 2006 Ben added some workarounds for a misbehaviour in the +Spider IO bridge used on early Cell machines, see commit +014da7ff47b5 ("[POWERPC] Cell "Spider" MMIO workarounds"). Later these +were made to be generic, ie. not tied specifically to Spider. + +The code stashes a token in the high bits (59-48) of virtual addresses +used for IO (eg. returned from ioremap()). This works fine when using +the Hash MMU, but when we're using the Radix MMU the bits used for the +token overlap with some of the bits of the virtual address. + +This is because the maximum virtual address is larger with Radix, up +to c00fffffffffffff, and in fact we use that high part of the address +range for ioremap(), see RADIX_KERN_IO_START. + +As it happens the bits that are used overlap with the bits that +differentiate an IO address vs a linear map address. If the resulting +address lies outside the linear mapping we will crash (see below), if +not we just corrupt memory. + + virtio-pci 0000:00:00.0: Using 64-bit direct DMA at offset 800000000000000 + Unable to handle kernel paging request for data at address 0xc000000080000014 + ... + CFAR: c000000000626b98 DAR: c000000080000014 DSISR: 42000000 IRQMASK: 0 + GPR00: c0000000006c54fc c00000003e523378 c0000000016de600 0000000000000000 + GPR04: c00c000080000014 0000000000000007 0fffffff000affff 0000000000000030 + ^^^^ + ... + NIP [c000000000626c5c] .iowrite8+0xec/0x100 + LR [c0000000006c992c] .vp_reset+0x2c/0x90 + Call Trace: + .pci_bus_read_config_dword+0xc4/0x120 (unreliable) + .register_virtio_device+0x13c/0x1c0 + .virtio_pci_probe+0x148/0x1f0 + .local_pci_probe+0x68/0x140 + .pci_device_probe+0x164/0x220 + .really_probe+0x274/0x3b0 + .driver_probe_device+0x80/0x170 + .__driver_attach+0x14c/0x150 + .bus_for_each_dev+0xb8/0x130 + .driver_attach+0x34/0x50 + .bus_add_driver+0x178/0x2f0 + .driver_register+0x90/0x1a0 + .__pci_register_driver+0x6c/0x90 + .virtio_pci_driver_init+0x2c/0x40 + .do_one_initcall+0x64/0x280 + .kernel_init_freeable+0x36c/0x474 + .kernel_init+0x24/0x160 + .ret_from_kernel_thread+0x58/0x7c + +This hasn't been a problem because CONFIG_PPC_IO_WORKAROUNDS which +enables this code is usually not enabled. It is only enabled when it's +selected by PPC_CELL_NATIVE which is only selected by +PPC_IBM_CELL_BLADE and that in turn depends on BIG_ENDIAN. So in order +to hit the bug you need to build a big endian kernel, with IBM Cell +Blade support enabled, as well as Radix MMU support, and then boot +that on Power9 using Radix MMU. + +Still we can fix the bug, so let's do that. We simply use fewer bits +for the token, taking the union of the restrictions on the address +from both Hash and Radix, we end up with 8 bits we can use for the +token. The only user of the token is iowa_mem_find_bus() which only +supports 8 token values, so 8 bits is plenty for that. + +Fixes: 566ca99af026 ("powerpc/mm/radix: Add dummy radix_enabled()") +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/io.h | 20 +++++++------------- + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index e0331e754568..b855f56489ac 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -285,19 +285,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src, + * their hooks, a bitfield is reserved for use by the platform near the + * top of MMIO addresses (not PIO, those have to cope the hard way). + * +- * This bit field is 12 bits and is at the top of the IO virtual +- * addresses PCI_IO_INDIRECT_TOKEN_MASK. ++ * The highest address in the kernel virtual space are: + * +- * The kernel virtual space is thus: ++ * d0003fffffffffff # with Hash MMU ++ * c00fffffffffffff # with Radix MMU + * +- * 0xD000000000000000 : vmalloc +- * 0xD000080000000000 : PCI PHB IO space +- * 0xD000080080000000 : ioremap +- * 0xD0000fffffffffff : end of ioremap region +- * +- * Since the top 4 bits are reserved as the region ID, we use thus +- * the next 12 bits and keep 4 bits available for the future if the +- * virtual address space is ever to be extended. ++ * The top 4 bits are reserved as the region ID on hash, leaving us 8 bits ++ * that can be used for the field. + * + * The direct IO mapping operations will then mask off those bits + * before doing the actual access, though that only happen when +@@ -309,8 +303,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src, + */ + + #ifdef CONFIG_PPC_INDIRECT_MMIO +-#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul +-#define PCI_IO_IND_TOKEN_SHIFT 48 ++#define PCI_IO_IND_TOKEN_SHIFT 52 ++#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT) + #define PCI_FIX_ADDR(addr) \ + ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK)) + #define PCI_GET_ADDR_TOKEN(addr) \ +-- +2.17.1 + diff --git a/queue-4.19/powerpc-numa-suppress-vphn-is-not-supported-messages.patch b/queue-4.19/powerpc-numa-suppress-vphn-is-not-supported-messages.patch new file mode 100644 index 00000000000..f35dbeb81dc --- /dev/null +++ b/queue-4.19/powerpc-numa-suppress-vphn-is-not-supported-messages.patch @@ -0,0 +1,36 @@ +From 55911bde8830bc8dcc065054f2f0773f59d1fda4 Mon Sep 17 00:00:00 2001 +From: Satheesh Rajendran +Date: Thu, 8 Nov 2018 10:47:56 +0530 +Subject: powerpc/numa: Suppress "VPHN is not supported" messages + +[ Upstream commit 437ccdc8ce629470babdda1a7086e2f477048cbd ] + +When VPHN function is not supported and during cpu hotplug event, +kernel prints message 'VPHN function not supported. Disabling +polling...'. Currently it prints on every hotplug event, it floods +dmesg when a KVM guest tries to hotplug huge number of vcpus, let's +just print once and suppress further kernel prints. + +Signed-off-by: Satheesh Rajendran +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/numa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index 055b211b7126..5500e4edabc6 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -1179,7 +1179,7 @@ static long vphn_get_associativity(unsigned long cpu, + + switch (rc) { + case H_FUNCTION: +- printk(KERN_INFO ++ printk_once(KERN_INFO + "VPHN is not supported. Disabling polling...\n"); + stop_topology_update(); + break; +-- +2.17.1 + diff --git a/queue-4.19/risc-v-silence-some-module-warnings-on-32-bit.patch b/queue-4.19/risc-v-silence-some-module-warnings-on-32-bit.patch new file mode 100644 index 00000000000..ded1dc3688a --- /dev/null +++ b/queue-4.19/risc-v-silence-some-module-warnings-on-32-bit.patch @@ -0,0 +1,96 @@ +From d567f84a52f4052ca584ba91ea5e2c045a017618 Mon Sep 17 00:00:00 2001 +From: Olof Johansson +Date: Tue, 30 Oct 2018 23:47:09 -0700 +Subject: RISC-V: Silence some module warnings on 32-bit + +[ Upstream commit ef3a61406618291c46da168ff91acaa28d85944c ] + +Fixes: + +arch/riscv/kernel/module.c: In function 'apply_r_riscv_32_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:23:27: note: format string is defined here +arch/riscv/kernel/module.c: In function 'apply_r_riscv_pcrel_hi20_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:104:23: note: format string is defined here +arch/riscv/kernel/module.c: In function 'apply_r_riscv_hi20_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:146:23: note: format string is defined here +arch/riscv/kernel/module.c: In function 'apply_r_riscv_got_hi20_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:190:60: note: format string is defined here +arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_plt_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:214:24: note: format string is defined here +arch/riscv/kernel/module.c: In function 'apply_r_riscv_call_rela': +./include/linux/kern_levels.h:5:18: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 3 has type 'Elf32_Addr' {aka 'unsigned int'} [-Wformat=] +arch/riscv/kernel/module.c:236:23: note: format string is defined here + +Signed-off-by: Olof Johansson +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/module.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c +index 3303ed2cd419..7dd308129b40 100644 +--- a/arch/riscv/kernel/module.c ++++ b/arch/riscv/kernel/module.c +@@ -21,7 +21,7 @@ static int apply_r_riscv_32_rela(struct module *me, u32 *location, Elf_Addr v) + { + if (v != (u32)v) { + pr_err("%s: value %016llx out of range for 32-bit field\n", +- me->name, v); ++ me->name, (long long)v); + return -EINVAL; + } + *location = v; +@@ -102,7 +102,7 @@ static int apply_r_riscv_pcrel_hi20_rela(struct module *me, u32 *location, + if (offset != (s32)offset) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -144,7 +144,7 @@ static int apply_r_riscv_hi20_rela(struct module *me, u32 *location, + if (IS_ENABLED(CMODEL_MEDLOW)) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -188,7 +188,7 @@ static int apply_r_riscv_got_hi20_rela(struct module *me, u32 *location, + } else { + pr_err( + "%s: can not generate the GOT entry for symbol = %016llx from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +@@ -212,7 +212,7 @@ static int apply_r_riscv_call_plt_rela(struct module *me, u32 *location, + } else { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + } +@@ -234,7 +234,7 @@ static int apply_r_riscv_call_rela(struct module *me, u32 *location, + if (offset != fill_v) { + pr_err( + "%s: target %016llx can not be addressed by the 32-bit offset from PC = %p\n", +- me->name, v, location); ++ me->name, (long long)v, location); + return -EINVAL; + } + +-- +2.17.1 + diff --git a/queue-4.19/riscv-add-missing-vdso_install-target.patch b/queue-4.19/riscv-add-missing-vdso_install-target.patch new file mode 100644 index 00000000000..ed5f836acbb --- /dev/null +++ b/queue-4.19/riscv-add-missing-vdso_install-target.patch @@ -0,0 +1,33 @@ +From 40afd3845aba4da5197c54232dcabd6d6c2820a2 Mon Sep 17 00:00:00 2001 +From: David Abdurachmanov +Date: Mon, 5 Nov 2018 15:35:37 +0100 +Subject: riscv: add missing vdso_install target + +[ Upstream commit f157d411a9eb170d2ee6b766da7a381962017cc9 ] + +Building kernel 4.20 for Fedora as RPM fails, because riscv is missing +vdso_install target in arch/riscv/Makefile. + +Signed-off-by: David Abdurachmanov +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/Makefile | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/riscv/Makefile b/arch/riscv/Makefile +index 61ec42405ec9..110be14e6122 100644 +--- a/arch/riscv/Makefile ++++ b/arch/riscv/Makefile +@@ -82,4 +82,8 @@ core-y += arch/riscv/kernel/ arch/riscv/mm/ + + libs-y += arch/riscv/lib/ + ++PHONY += vdso_install ++vdso_install: ++ $(Q)$(MAKE) $(build)=arch/riscv/kernel/vdso $@ ++ + all: vmlinux +-- +2.17.1 + diff --git a/queue-4.19/rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch b/queue-4.19/rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch new file mode 100644 index 00000000000..462caa5dc12 --- /dev/null +++ b/queue-4.19/rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch @@ -0,0 +1,95 @@ +From 2bd4fd39e350f316c5ec5e5d7bd8655864a268d4 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Tue, 4 Sep 2018 16:51:29 +0200 +Subject: rtc: cmos: Do not export alarm rtc_ops when we do not support alarms + +[ Upstream commit fbb974ba693bbfb4e24a62181ef16d4e45febc37 ] + +When there is no IRQ configured for the RTC, the rtc-cmos code does not +support alarms, all alarm rtc_ops fail with -EIO / -EINVAL. + +The rtc-core expects a rtc driver which does not support rtc alarms to +not have alarm ops at all. Otherwise the wakealarm sysfs attr will read +as empty rather then returning an error, making it impossible for +userspace to find out beforehand if alarms are supported. + +A system without an IRQ for the RTC before this patch: +[root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm +[root@localhost ~]# + +After this patch: +[root@localhost ~]# cat /sys/class/rtc/rtc0/wakealarm +cat: /sys/class/rtc/rtc0/wakealarm: No such file or directory +[root@localhost ~]# + +This fixes gnome-session + systemd trying to use suspend-then-hibernate, +which causes systemd to abort the suspend when writing the RTC alarm fails. + +BugLink: https://github.com/systemd/systemd/issues/9988 +Signed-off-by: Hans de Goede +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-cmos.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c +index df0c5776d49b..a5a19ff10535 100644 +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -257,6 +257,7 @@ static int cmos_read_alarm(struct device *dev, struct rtc_wkalrm *t) + struct cmos_rtc *cmos = dev_get_drvdata(dev); + unsigned char rtc_control; + ++ /* This not only a rtc_op, but also called directly */ + if (!is_valid_irq(cmos->irq)) + return -EIO; + +@@ -452,6 +453,7 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t) + unsigned char mon, mday, hrs, min, sec, rtc_control; + int ret; + ++ /* This not only a rtc_op, but also called directly */ + if (!is_valid_irq(cmos->irq)) + return -EIO; + +@@ -516,9 +518,6 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled) + struct cmos_rtc *cmos = dev_get_drvdata(dev); + unsigned long flags; + +- if (!is_valid_irq(cmos->irq)) +- return -EINVAL; +- + spin_lock_irqsave(&rtc_lock, flags); + + if (enabled) +@@ -579,6 +578,12 @@ static const struct rtc_class_ops cmos_rtc_ops = { + .alarm_irq_enable = cmos_alarm_irq_enable, + }; + ++static const struct rtc_class_ops cmos_rtc_ops_no_alarm = { ++ .read_time = cmos_read_time, ++ .set_time = cmos_set_time, ++ .proc = cmos_procfs, ++}; ++ + /*----------------------------------------------------------------*/ + + /* +@@ -855,9 +860,12 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq) + dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq); + goto cleanup1; + } ++ ++ cmos_rtc.rtc->ops = &cmos_rtc_ops; ++ } else { ++ cmos_rtc.rtc->ops = &cmos_rtc_ops_no_alarm; + } + +- cmos_rtc.rtc->ops = &cmos_rtc_ops; + cmos_rtc.rtc->nvram_old_abi = true; + retval = rtc_register_device(cmos_rtc.rtc); + if (retval) +-- +2.17.1 + diff --git a/queue-4.19/rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch b/queue-4.19/rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch new file mode 100644 index 00000000000..14856e65a5e --- /dev/null +++ b/queue-4.19/rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch @@ -0,0 +1,55 @@ +From 60abe9bac1b2907be22d82a241d514cad8a2a1bd Mon Sep 17 00:00:00 2001 +From: Xulin Sun +Date: Tue, 6 Nov 2018 16:42:19 +0800 +Subject: rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write + +[ Upstream commit 9bde0afb7a906f1dabdba37162551565740b862d ] + +pcf2127_i2c_gather_write() allocates memory as local variable +for i2c_master_send(), after finishing the master transfer, +the allocated memory should be freed. The kmemleak is reported: + +unreferenced object 0xffff80231e7dba80 (size 64): + comm "hwclock", pid 27762, jiffies 4296880075 (age 356.944s) + hex dump (first 32 bytes): + 03 00 12 03 19 02 11 13 00 80 98 18 00 00 ff ff ................ + 00 50 00 00 00 00 00 00 02 00 00 00 00 00 00 00 .P.............. + backtrace: + [] create_object+0xf8/0x278 + [] kmemleak_alloc+0x74/0xa0 + [] __kmalloc+0x1ac/0x348 + [] pcf2127_i2c_gather_write+0x54/0xf8 + [] _regmap_raw_write+0x464/0x850 + [] regmap_bulk_write+0x1a4/0x348 + [] pcf2127_rtc_set_time+0xac/0xe8 + [] rtc_set_time+0x80/0x138 + [] rtc_dev_ioctl+0x398/0x610 + [] do_vfs_ioctl+0xb0/0x848 + [] SyS_ioctl+0x8c/0xa8 + [] el0_svc_naked+0x34/0x38 + [] 0xffffffffffffffff + +Signed-off-by: Xulin Sun +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 9f99a0966550..7cb786d76e3c 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -303,6 +303,9 @@ static int pcf2127_i2c_gather_write(void *context, + memcpy(buf + 1, val, val_size); + + ret = i2c_master_send(client, buf, val_size + 1); ++ ++ kfree(buf); ++ + if (ret != val_size + 1) + return ret < 0 ? ret : -EIO; + +-- +2.17.1 + diff --git a/queue-4.19/sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch b/queue-4.19/sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch new file mode 100644 index 00000000000..53609f63f39 --- /dev/null +++ b/queue-4.19/sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch @@ -0,0 +1,215 @@ +From da74bbe9ff7a29044de3c843f0c4424390e8ff40 Mon Sep 17 00:00:00 2001 +From: Patrick Bellasi +Date: Mon, 5 Nov 2018 14:53:58 +0000 +Subject: sched/fair: Fix cpu_util_wake() for 'execl' type workloads + +[ Upstream commit c469933e772132aad040bd6a2adc8edf9ad6f825 ] + +A ~10% regression has been reported for UnixBench's execl throughput +test by Aaron Lu and Ye Xiaolong: + + https://lkml.org/lkml/2018/10/30/765 + +That test is pretty simple, it does a "recursive" execve() syscall on the +same binary. Starting from the syscall, this sequence is possible: + + do_execve() + do_execveat_common() + __do_execve_file() + sched_exec() + select_task_rq_fair() <==| Task already enqueued + find_idlest_cpu() + find_idlest_group() + capacity_spare_wake() <==| Functions not called from + cpu_util_wake() | the wakeup path + +which means we can end up calling cpu_util_wake() not only from the +"wakeup path", as its name would suggest. Indeed, the task doing an +execve() syscall is already enqueued on the CPU we want to get the +cpu_util_wake() for. + +The estimated utilization for a CPU computed in cpu_util_wake() was +written under the assumption that function can be called only from the +wakeup path. If instead the task is already enqueued, we end up with a +utilization which does not remove the current task's contribution from +the estimated utilization of the CPU. +This will wrongly assume a reduced spare capacity on the current CPU and +increase the chances to migrate the task on execve. + +The regression is tracked down to: + + commit d519329f72a6 ("sched/fair: Update util_est only on util_avg updates") + +because in that patch we turn on by default the UTIL_EST sched feature. +However, the real issue is introduced by: + + commit f9be3e5961c5 ("sched/fair: Use util_est in LB and WU paths") + +Let's fix this by ensuring to always discount the task estimated +utilization from the CPU's estimated utilization when the task is also +the current one. The same benchmark of the bug report, executed on a +dual socket 40 CPUs Intel(R) Xeon(R) CPU E5-2690 v2 @ 3.00GHz machine, +reports these "Execl Throughput" figures (higher the better): + + mainline : 48136.5 lps + mainline+fix : 55376.5 lps + +which correspond to a 15% speedup. + +Moreover, since {cpu_util,capacity_spare}_wake() are not really only +used from the wakeup path, let's remove this ambiguity by using a better +matching name: {cpu_util,capacity_spare}_without(). + +Since we are at that, let's also improve the existing documentation. + +Reported-by: Aaron Lu +Reported-by: Ye Xiaolong +Tested-by: Aaron Lu +Signed-off-by: Patrick Bellasi +Signed-off-by: Peter Zijlstra (Intel) +Cc: Dietmar Eggemann +Cc: Juri Lelli +Cc: Linus Torvalds +Cc: Morten Rasmussen +Cc: Peter Zijlstra +Cc: Quentin Perret +Cc: Steve Muckle +Cc: Suren Baghdasaryan +Cc: Thomas Gleixner +Cc: Todd Kjos +Cc: Vincent Guittot +Fixes: f9be3e5961c5 (sched/fair: Use util_est in LB and WU paths) +Link: https://lore.kernel.org/lkml/20181025093100.GB13236@e110439-lin/ +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 62 +++++++++++++++++++++++++++++++++++---------- + 1 file changed, 48 insertions(+), 14 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 908c9cdae2f0..1162552dc3cc 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5672,11 +5672,11 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, + return target; + } + +-static unsigned long cpu_util_wake(int cpu, struct task_struct *p); ++static unsigned long cpu_util_without(int cpu, struct task_struct *p); + +-static unsigned long capacity_spare_wake(int cpu, struct task_struct *p) ++static unsigned long capacity_spare_without(int cpu, struct task_struct *p) + { +- return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0); ++ return max_t(long, capacity_of(cpu) - cpu_util_without(cpu, p), 0); + } + + /* +@@ -5736,7 +5736,7 @@ find_idlest_group(struct sched_domain *sd, struct task_struct *p, + + avg_load += cfs_rq_load_avg(&cpu_rq(i)->cfs); + +- spare_cap = capacity_spare_wake(i, p); ++ spare_cap = capacity_spare_without(i, p); + + if (spare_cap > max_spare_cap) + max_spare_cap = spare_cap; +@@ -5887,8 +5887,8 @@ static inline int find_idlest_cpu(struct sched_domain *sd, struct task_struct *p + return prev_cpu; + + /* +- * We need task's util for capacity_spare_wake, sync it up to prev_cpu's +- * last_update_time. ++ * We need task's util for capacity_spare_without, sync it up to ++ * prev_cpu's last_update_time. + */ + if (!(sd_flag & SD_BALANCE_FORK)) + sync_entity_load_avg(&p->se); +@@ -6214,10 +6214,19 @@ static inline unsigned long cpu_util(int cpu) + } + + /* +- * cpu_util_wake: Compute CPU utilization with any contributions from +- * the waking task p removed. ++ * cpu_util_without: compute cpu utilization without any contributions from *p ++ * @cpu: the CPU which utilization is requested ++ * @p: the task which utilization should be discounted ++ * ++ * The utilization of a CPU is defined by the utilization of tasks currently ++ * enqueued on that CPU as well as tasks which are currently sleeping after an ++ * execution on that CPU. ++ * ++ * This method returns the utilization of the specified CPU by discounting the ++ * utilization of the specified task, whenever the task is currently ++ * contributing to the CPU utilization. + */ +-static unsigned long cpu_util_wake(int cpu, struct task_struct *p) ++static unsigned long cpu_util_without(int cpu, struct task_struct *p) + { + struct cfs_rq *cfs_rq; + unsigned int util; +@@ -6229,7 +6238,7 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + cfs_rq = &cpu_rq(cpu)->cfs; + util = READ_ONCE(cfs_rq->avg.util_avg); + +- /* Discount task's blocked util from CPU's util */ ++ /* Discount task's util from CPU's util */ + util -= min_t(unsigned int, util, task_util(p)); + + /* +@@ -6238,14 +6247,14 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + * a) if *p is the only task sleeping on this CPU, then: + * cpu_util (== task_util) > util_est (== 0) + * and thus we return: +- * cpu_util_wake = (cpu_util - task_util) = 0 ++ * cpu_util_without = (cpu_util - task_util) = 0 + * + * b) if other tasks are SLEEPING on this CPU, which is now exiting + * IDLE, then: + * cpu_util >= task_util + * cpu_util > util_est (== 0) + * and thus we discount *p's blocked utilization to return: +- * cpu_util_wake = (cpu_util - task_util) >= 0 ++ * cpu_util_without = (cpu_util - task_util) >= 0 + * + * c) if other tasks are RUNNABLE on that CPU and + * util_est > cpu_util +@@ -6258,8 +6267,33 @@ static unsigned long cpu_util_wake(int cpu, struct task_struct *p) + * covered by the following code when estimated utilization is + * enabled. + */ +- if (sched_feat(UTIL_EST)) +- util = max(util, READ_ONCE(cfs_rq->avg.util_est.enqueued)); ++ if (sched_feat(UTIL_EST)) { ++ unsigned int estimated = ++ READ_ONCE(cfs_rq->avg.util_est.enqueued); ++ ++ /* ++ * Despite the following checks we still have a small window ++ * for a possible race, when an execl's select_task_rq_fair() ++ * races with LB's detach_task(): ++ * ++ * detach_task() ++ * p->on_rq = TASK_ON_RQ_MIGRATING; ++ * ---------------------------------- A ++ * deactivate_task() \ ++ * dequeue_task() + RaceTime ++ * util_est_dequeue() / ++ * ---------------------------------- B ++ * ++ * The additional check on "current == p" it's required to ++ * properly fix the execl regression and it helps in further ++ * reducing the chances for the above race. ++ */ ++ if (unlikely(task_on_rq_queued(p) || current == p)) { ++ estimated -= min_t(unsigned int, estimated, ++ (_task_util_est(p) | UTIL_AVG_UNCHANGED)); ++ } ++ util = max(util, estimated); ++ } + + /* + * Utilization (estimated) can exceed the CPU capacity, thus let's +-- +2.17.1 + diff --git a/queue-4.19/scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch b/queue-4.19/scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch new file mode 100644 index 00000000000..4b498e95959 --- /dev/null +++ b/queue-4.19/scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch @@ -0,0 +1,85 @@ +From 3194c0ea9509594caa400f9e7b39cb2f80c9ed03 Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 26 Oct 2018 15:07:31 +0800 +Subject: scsi: hisi_sas: Remove set but not used variable 'dq_list' + +[ Upstream commit e34ff8edcae89922d187425ab0b82e6a039aa371 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/scsi/hisi_sas/hisi_sas_v1_hw.c: In function 'start_delivery_v1_hw': +drivers/scsi/hisi_sas/hisi_sas_v1_hw.c:907:20: warning: + variable 'dq_list' set but not used [-Wunused-but-set-variable] + +drivers/scsi/hisi_sas/hisi_sas_v2_hw.c: In function 'start_delivery_v2_hw': +drivers/scsi/hisi_sas/hisi_sas_v2_hw.c:1671:20: warning: + variable 'dq_list' set but not used [-Wunused-but-set-variable] + +drivers/scsi/hisi_sas/hisi_sas_v3_hw.c: In function 'start_delivery_v3_hw': +drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:889:20: warning: + variable 'dq_list' set but not used [-Wunused-but-set-variable] + +It never used since introduction in commit +fa222db0b036 ("scsi: hisi_sas: Don't lock DQ for complete task sending") + +Signed-off-by: YueHaibing +Acked-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 -- + drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 -- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 -- + 3 files changed, 6 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index 8f60f0e04599..410eccf0bc5e 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -904,11 +904,9 @@ static void start_delivery_v1_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +index 9c5c5a601332..1c4ea58da1ae 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c +@@ -1666,11 +1666,9 @@ static void start_delivery_v2_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 08b503e274b8..687ff61bba9f 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -883,11 +883,9 @@ static void start_delivery_v3_hw(struct hisi_sas_dq *dq) + { + struct hisi_hba *hisi_hba = dq->hisi_hba; + struct hisi_sas_slot *s, *s1, *s2 = NULL; +- struct list_head *dq_list; + int dlvry_queue = dq->id; + int wp; + +- dq_list = &dq->list; + list_for_each_entry_safe(s, s1, &dq->list, delivery) { + if (!s->ready) + break; +-- +2.17.1 + diff --git a/queue-4.19/scsi-lpfc-fix-remoteport-access.patch b/queue-4.19/scsi-lpfc-fix-remoteport-access.patch new file mode 100644 index 00000000000..3f436318b26 --- /dev/null +++ b/queue-4.19/scsi-lpfc-fix-remoteport-access.patch @@ -0,0 +1,43 @@ +From 085915fb7ced72142d018d5ed0897324377dc448 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Fri, 2 Nov 2018 16:35:48 +0100 +Subject: scsi: lpfc: fix remoteport access + +[ Upstream commit f8d294324598ec85bea2779512e48c94cbe4d7c6 ] + +The addition of a spinlock in lpfc_debugfs_nodelist_data() introduced +a bug that lets us not skip NULL pointers correctly, as noticed by +gcc-8: + +drivers/scsi/lpfc/lpfc_debugfs.c: In function 'lpfc_debugfs_nodelist_data.constprop': +drivers/scsi/lpfc/lpfc_debugfs.c:728:13: error: 'nrport' may be used uninitialized in this function [-Werror=maybe-uninitialized] + if (nrport->port_role & FC_PORT_ROLE_NVME_INITIATOR) + +This changes the logic back to what it was, while keeping the added +spinlock. + +Fixes: 9e210178267b ("scsi: lpfc: Synchronize access to remoteport via rport") +Signed-off-by: Arnd Bergmann +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c +index aec5b10a8c85..ca6c3982548d 100644 +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -700,6 +700,8 @@ lpfc_debugfs_nodelist_data(struct lpfc_vport *vport, char *buf, int size) + rport = lpfc_ndlp_get_nrport(ndlp); + if (rport) + nrport = rport->remoteport; ++ else ++ nrport = NULL; + spin_unlock(&phba->hbalock); + if (!nrport) + continue; +-- +2.17.1 + diff --git a/queue-4.19/series b/queue-4.19/series index a6475a182e1..b5ab24861f5 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -62,3 +62,37 @@ acpica-aml-interpreter-add-region-addresses-in-global-list-during-initialization ib-hfi1-eliminate-races-in-the-sdma-send-error-path.patch fsnotify-generalize-handling-of-extra-event-flags.patch fanotify-fix-handling-of-events-on-child-sub-directory.patch +pinctrl-meson-fix-pinconf-bias-disable.patch +pinctrl-meson-fix-gxbb-ao-pull-register-bits.patch +pinctrl-meson-fix-gxl-ao-pull-register-bits.patch +pinctrl-meson-fix-meson8-ao-pull-register-bits.patch +pinctrl-meson-fix-meson8b-ao-pull-register-bits.patch +tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch +scsi-lpfc-fix-remoteport-access.patch +scsi-hisi_sas-remove-set-but-not-used-variable-dq_li.patch +kvm-ppc-move-and-undef-trace_include_path-file.patch +cpufreq-imx6q-add-return-value-check-for-voltage-sca.patch +rtc-cmos-do-not-export-alarm-rtc_ops-when-we-do-not-.patch +rtc-pcf2127-fix-a-kmemleak-caused-in-pcf2127_i2c_gat.patch +crypto-simd-correctly-take-reqsize-of-wrapped-skciph.patch +floppy-fix-race-condition-in-__floppy_read_block_0.patch +powerpc-io-fix-the-io-workarounds-code-to-work-with-.patch +sched-fair-fix-cpu_util_wake-for-execl-type-workload.patch +perf-x86-intel-uncore-add-more-imc-pci-ids-for-kabyl.patch +arm-make-lookup_processor_type-non-__init.patch +arm-clean-up-per-processor-check_bugs-method-call.patch +arm-add-proc_vtable-and-proc_table-macros.patch +arm-spectre-v2-per-cpu-vtables-to-work-around-big.li.patch +block-copy-ioprio-in-__bio_clone_fast-and-bounce.patch +sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch +riscv-add-missing-vdso_install-target.patch +risc-v-silence-some-module-warnings-on-32-bit.patch +drm-amdgpu-fix-bug-with-ih-ring-setup.patch +kdb-use-strscpy-with-destination-buffer-size.patch +nfsv4-fix-an-oops-during-delegation-callbacks.patch +powerpc-numa-suppress-vphn-is-not-supported-messages.patch +efi-arm-revert-deferred-unmap-of-early-memmap-mappin.patch +z3fold-fix-possible-reclaim-races.patch +mm-memory_hotplug-check-zone_movable-in-has_unmovabl.patch +tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch +mm-page_alloc-check-for-max-order-in-hot-path.patch diff --git a/queue-4.19/sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch b/queue-4.19/sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch new file mode 100644 index 00000000000..cd394f4ed73 --- /dev/null +++ b/queue-4.19/sunrpc-fix-a-bogus-get-put-in-generic_key_to_expire.patch @@ -0,0 +1,35 @@ +From de5279d17f67ec3e1239b07a2d619fd6c71f3acb Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Mon, 12 Nov 2018 16:06:51 -0500 +Subject: SUNRPC: Fix a bogus get/put in generic_key_to_expire() + +[ Upstream commit e3d5e573a54dabdc0f9f3cb039d799323372b251 ] + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_generic.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c +index f1df9837f1ac..1ac08dcbf85d 100644 +--- a/net/sunrpc/auth_generic.c ++++ b/net/sunrpc/auth_generic.c +@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred) + { + struct auth_cred *acred = &container_of(cred, struct generic_cred, + gc_base)->acred; +- bool ret; +- +- get_rpccred(cred); +- ret = test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); +- put_rpccred(cred); +- +- return ret; ++ return test_bit(RPC_CRED_KEY_EXPIRE_SOON, &acred->ac_flags); + } + + static const struct rpc_credops generic_credops = { +-- +2.17.1 + diff --git a/queue-4.19/tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch b/queue-4.19/tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch new file mode 100644 index 00000000000..87e64ffcef1 --- /dev/null +++ b/queue-4.19/tmpfs-make-lseek-seek_data-sek_hole-return-enxio-wit.patch @@ -0,0 +1,54 @@ +From e5eac91bd7bafadf9c68353986b7448eb974c3fe Mon Sep 17 00:00:00 2001 +From: Yufen Yu +Date: Fri, 16 Nov 2018 15:08:39 -0800 +Subject: tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative + offset + +[ Upstream commit 1a413646931cb14442065cfc17561e50f5b5bb44 ] + +Other filesystems such as ext4, f2fs and ubifs all return ENXIO when +lseek (SEEK_DATA or SEEK_HOLE) requests a negative offset. + +man 2 lseek says + +: EINVAL whence is not valid. Or: the resulting file offset would be +: negative, or beyond the end of a seekable device. +: +: ENXIO whence is SEEK_DATA or SEEK_HOLE, and the file offset is beyond +: the end of the file. + +Make tmpfs return ENXIO under these circumstances as well. After this, +tmpfs also passes xfstests's generic/448. + +[akpm@linux-foundation.org: rewrite changelog] +Link: http://lkml.kernel.org/r/1540434176-14349-1-git-send-email-yuyufen@huawei.com +Signed-off-by: Yufen Yu +Reviewed-by: Andrew Morton +Cc: Al Viro +Cc: Hugh Dickins +Cc: William Kucharski +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/shmem.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/mm/shmem.c b/mm/shmem.c +index 446942677cd4..38d228a30fdc 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2610,9 +2610,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence) + inode_lock(inode); + /* We're holding i_mutex so we can access i_size directly */ + +- if (offset < 0) +- offset = -EINVAL; +- else if (offset >= inode->i_size) ++ if (offset < 0 || offset >= inode->i_size) + offset = -ENXIO; + else { + start = offset >> PAGE_SHIFT; +-- +2.17.1 + diff --git a/queue-4.19/tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch b/queue-4.19/tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch new file mode 100644 index 00000000000..00b57ec3224 --- /dev/null +++ b/queue-4.19/tools-testing-nvdimm-fix-the-array-size-for-dimm-dev.patch @@ -0,0 +1,86 @@ +From 74e230a03ae7a8870fded254f079f5987dbfc854 Mon Sep 17 00:00:00 2001 +From: Masayoshi Mizuma +Date: Tue, 30 Oct 2018 21:50:25 -0400 +Subject: tools/testing/nvdimm: Fix the array size for dimm devices. + +[ Upstream commit af31b04b67f4fd7f639fd465a507c154c46fc9fb ] + +KASAN reports following global out of bounds access while +nfit_test is being loaded. The out of bound access happens +the following reference to dimm_fail_cmd_flags[dimm]. 'dimm' is +over than the index value, NUM_DCR (==5). + + static int override_return_code(int dimm, unsigned int func, int rc) + { + if ((1 << func) & dimm_fail_cmd_flags[dimm]) { + +dimm_fail_cmd_flags[] definition: + static unsigned long dimm_fail_cmd_flags[NUM_DCR]; + +'dimm' is the return value of get_dimm(), and get_dimm() returns +the index of handle[] array. The handle[] has 7 index. Let's use +ARRAY_SIZE(handle) as the array size. + +KASAN report: + +================================================================== +BUG: KASAN: global-out-of-bounds in nfit_test_ctl+0x47bb/0x55b0 [nfit_test] +Read of size 8 at addr ffffffffc10cbbe8 by task kworker/u41:0/8 +... +Call Trace: + dump_stack+0xea/0x1b0 + ? dump_stack_print_info.cold.0+0x1b/0x1b + ? kmsg_dump_rewind_nolock+0xd9/0xd9 + print_address_description+0x65/0x22e + ? nfit_test_ctl+0x47bb/0x55b0 [nfit_test] + kasan_report.cold.6+0x92/0x1a6 + nfit_test_ctl+0x47bb/0x55b0 [nfit_test] +... +The buggy address belongs to the variable: + dimm_fail_cmd_flags+0x28/0xffffffffffffa440 [nfit_test] +================================================================== + +Fixes: 39611e83a28c ("tools/testing/nvdimm: Make DSM failure code injection...") +Signed-off-by: Masayoshi Mizuma +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + tools/testing/nvdimm/test/nfit.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c +index cffc2c5a778d..ec50d2a95076 100644 +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -139,8 +139,8 @@ static u32 handle[] = { + [6] = NFIT_DIMM_HANDLE(1, 0, 0, 0, 1), + }; + +-static unsigned long dimm_fail_cmd_flags[NUM_DCR]; +-static int dimm_fail_cmd_code[NUM_DCR]; ++static unsigned long dimm_fail_cmd_flags[ARRAY_SIZE(handle)]; ++static int dimm_fail_cmd_code[ARRAY_SIZE(handle)]; + + static const struct nd_intel_smart smart_def = { + .flags = ND_INTEL_SMART_HEALTH_VALID +@@ -203,7 +203,7 @@ struct nfit_test { + unsigned long deadline; + spinlock_t lock; + } ars_state; +- struct device *dimm_dev[NUM_DCR]; ++ struct device *dimm_dev[ARRAY_SIZE(handle)]; + struct nd_intel_smart *smart; + struct nd_intel_smart_threshold *smart_threshold; + struct badrange badrange; +@@ -2678,7 +2678,7 @@ static int nfit_test_probe(struct platform_device *pdev) + u32 nfit_handle = __to_nfit_memdev(nfit_mem)->device_handle; + int i; + +- for (i = 0; i < NUM_DCR; i++) ++ for (i = 0; i < ARRAY_SIZE(handle); i++) + if (nfit_handle == handle[i]) + dev_set_drvdata(nfit_test->dimm_dev[i], + nfit_mem); +-- +2.17.1 + diff --git a/queue-4.19/z3fold-fix-possible-reclaim-races.patch b/queue-4.19/z3fold-fix-possible-reclaim-races.patch new file mode 100644 index 00000000000..863ff2a7297 --- /dev/null +++ b/queue-4.19/z3fold-fix-possible-reclaim-races.patch @@ -0,0 +1,231 @@ +From bd5921dcc7ed51eecedc363277bff006dcee255d Mon Sep 17 00:00:00 2001 +From: Vitaly Wool +Date: Fri, 16 Nov 2018 15:07:56 -0800 +Subject: z3fold: fix possible reclaim races + +[ Upstream commit ca0246bb97c23da9d267c2107c07fb77e38205c9 ] + +Reclaim and free can race on an object which is basically fine but in +order for reclaim to be able to map "freed" object we need to encode +object length in the handle. handle_to_chunks() is then introduced to +extract object length from a handle and use it during mapping. + +Moreover, to avoid racing on a z3fold "headless" page release, we should +not try to free that page in z3fold_free() if the reclaim bit is set. +Also, in the unlikely case of trying to reclaim a page being freed, we +should not proceed with that page. + +While at it, fix the page accounting in reclaim function. + +This patch supersedes "[PATCH] z3fold: fix reclaim lock-ups". + +Link: http://lkml.kernel.org/r/20181105162225.74e8837d03583a9b707cf559@gmail.com +Signed-off-by: Vitaly Wool +Signed-off-by: Jongseok Kim +Reported-by-by: Jongseok Kim +Reviewed-by: Snild Dolkow +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/z3fold.c | 101 ++++++++++++++++++++++++++++++++-------------------- + 1 file changed, 62 insertions(+), 39 deletions(-) + +diff --git a/mm/z3fold.c b/mm/z3fold.c +index 4b366d181f35..aee9b0b8d907 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -99,6 +99,7 @@ struct z3fold_header { + #define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT) + + #define BUDDY_MASK (0x3) ++#define BUDDY_SHIFT 2 + + /** + * struct z3fold_pool - stores metadata for each z3fold pool +@@ -145,7 +146,7 @@ enum z3fold_page_flags { + MIDDLE_CHUNK_MAPPED, + NEEDS_COMPACTING, + PAGE_STALE, +- UNDER_RECLAIM ++ PAGE_CLAIMED, /* by either reclaim or free */ + }; + + /***************** +@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page, + clear_bit(MIDDLE_CHUNK_MAPPED, &page->private); + clear_bit(NEEDS_COMPACTING, &page->private); + clear_bit(PAGE_STALE, &page->private); +- clear_bit(UNDER_RECLAIM, &page->private); ++ clear_bit(PAGE_CLAIMED, &page->private); + + spin_lock_init(&zhdr->page_lock); + kref_init(&zhdr->refcount); +@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud) + unsigned long handle; + + handle = (unsigned long)zhdr; +- if (bud != HEADLESS) +- handle += (bud + zhdr->first_num) & BUDDY_MASK; ++ if (bud != HEADLESS) { ++ handle |= (bud + zhdr->first_num) & BUDDY_MASK; ++ if (bud == LAST) ++ handle |= (zhdr->last_chunks << BUDDY_SHIFT); ++ } + return handle; + } + +@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle) + return (struct z3fold_header *)(handle & PAGE_MASK); + } + ++/* only for LAST bud, returns zero otherwise */ ++static unsigned short handle_to_chunks(unsigned long handle) ++{ ++ return (handle & ~PAGE_MASK) >> BUDDY_SHIFT; ++} ++ + /* + * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle + * but that doesn't matter. because the masking will result in the +@@ -720,37 +730,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) + page = virt_to_page(zhdr); + + if (test_bit(PAGE_HEADLESS, &page->private)) { +- /* HEADLESS page stored */ +- bud = HEADLESS; +- } else { +- z3fold_page_lock(zhdr); +- bud = handle_to_buddy(handle); +- +- switch (bud) { +- case FIRST: +- zhdr->first_chunks = 0; +- break; +- case MIDDLE: +- zhdr->middle_chunks = 0; +- zhdr->start_middle = 0; +- break; +- case LAST: +- zhdr->last_chunks = 0; +- break; +- default: +- pr_err("%s: unknown bud %d\n", __func__, bud); +- WARN_ON(1); +- z3fold_page_unlock(zhdr); +- return; ++ /* if a headless page is under reclaim, just leave. ++ * NB: we use test_and_set_bit for a reason: if the bit ++ * has not been set before, we release this page ++ * immediately so we don't care about its value any more. ++ */ ++ if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) { ++ spin_lock(&pool->lock); ++ list_del(&page->lru); ++ spin_unlock(&pool->lock); ++ free_z3fold_page(page); ++ atomic64_dec(&pool->pages_nr); + } ++ return; + } + +- if (bud == HEADLESS) { +- spin_lock(&pool->lock); +- list_del(&page->lru); +- spin_unlock(&pool->lock); +- free_z3fold_page(page); +- atomic64_dec(&pool->pages_nr); ++ /* Non-headless case */ ++ z3fold_page_lock(zhdr); ++ bud = handle_to_buddy(handle); ++ ++ switch (bud) { ++ case FIRST: ++ zhdr->first_chunks = 0; ++ break; ++ case MIDDLE: ++ zhdr->middle_chunks = 0; ++ break; ++ case LAST: ++ zhdr->last_chunks = 0; ++ break; ++ default: ++ pr_err("%s: unknown bud %d\n", __func__, bud); ++ WARN_ON(1); ++ z3fold_page_unlock(zhdr); + return; + } + +@@ -758,7 +770,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) + atomic64_dec(&pool->pages_nr); + return; + } +- if (test_bit(UNDER_RECLAIM, &page->private)) { ++ if (test_bit(PAGE_CLAIMED, &page->private)) { + z3fold_page_unlock(zhdr); + return; + } +@@ -836,20 +848,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + } + list_for_each_prev(pos, &pool->lru) { + page = list_entry(pos, struct page, lru); ++ ++ /* this bit could have been set by free, in which case ++ * we pass over to the next page in the pool. ++ */ ++ if (test_and_set_bit(PAGE_CLAIMED, &page->private)) ++ continue; ++ ++ zhdr = page_address(page); + if (test_bit(PAGE_HEADLESS, &page->private)) +- /* candidate found */ + break; + +- zhdr = page_address(page); +- if (!z3fold_page_trylock(zhdr)) ++ if (!z3fold_page_trylock(zhdr)) { ++ zhdr = NULL; + continue; /* can't evict at this point */ ++ } + kref_get(&zhdr->refcount); + list_del_init(&zhdr->buddy); + zhdr->cpu = -1; +- set_bit(UNDER_RECLAIM, &page->private); + break; + } + ++ if (!zhdr) ++ break; ++ + list_del_init(&page->lru); + spin_unlock(&pool->lock); + +@@ -898,6 +920,7 @@ next: + if (test_bit(PAGE_HEADLESS, &page->private)) { + if (ret == 0) { + free_z3fold_page(page); ++ atomic64_dec(&pool->pages_nr); + return 0; + } + spin_lock(&pool->lock); +@@ -905,7 +928,7 @@ next: + spin_unlock(&pool->lock); + } else { + z3fold_page_lock(zhdr); +- clear_bit(UNDER_RECLAIM, &page->private); ++ clear_bit(PAGE_CLAIMED, &page->private); + if (kref_put(&zhdr->refcount, + release_z3fold_page_locked)) { + atomic64_dec(&pool->pages_nr); +@@ -964,7 +987,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle) + set_bit(MIDDLE_CHUNK_MAPPED, &page->private); + break; + case LAST: +- addr += PAGE_SIZE - (zhdr->last_chunks << CHUNK_SHIFT); ++ addr += PAGE_SIZE - (handle_to_chunks(handle) << CHUNK_SHIFT); + break; + default: + pr_err("unknown buddy id %d\n", buddy); +-- +2.17.1 + -- 2.47.3