From 42e84b2645da2cce31e0e4aee90525d080eff5de Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 12 Feb 2020 20:09:38 -0800 Subject: [PATCH] 5.5-stable patches added patches: arc-add-missing-multicast-filter-number-to-gmac-node.patch arm-dts-am43xx-add-support-for-clkout1-clock.patch arm-dts-at91-reenable-uart-tx-pull-ups.patch arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch arm64-dts-udpu-fix-broken-ethernet.patch bpf-improve-bucket_log-calculation-logic.patch bpf-sockhash-synchronize_rcu-before-free-ing-map.patch bpf-sockmap-check-update-requirements-after-locking.patch bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch bpftool-don-t-crash-on-missing-xlated-program-instructions.patch mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch netdevsim-disable-devlink-reload-when-resources-are-being-used.patch netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch netdevsim-fix-using-uninitialized-resources.patch netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch rtc-cmos-stop-using-shared-irq.patch rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch tools-power-acpi-fix-compilation-error.patch watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch --- ...multicast-filter-number-to-gmac-node.patch | 32 +++ ...am43xx-add-support-for-clkout1-clock.patch | 97 ++++++++ ...m-dts-at91-reenable-uart-tx-pull-ups.patch | 224 +++++++++++++++++ ...5d3-define-clock-rate-range-for-tcb1.patch | 35 +++ ...3-fix-maximum-peripheral-clock-rates.patch | 173 +++++++++++++ ...frequency-for-the-gpu-s-182.1mhz-opp.patch | 38 +++ ...l-frequency-for-the-gpu-s-364mhz-opp.patch | 38 +++ ...arfog-gt-8k-fix-switch-cpu-port-node.patch | 35 +++ ...ts-qcom-msm8998-fix-tcsr-syscon-size.patch | 34 +++ ...sm8998-mtp-add-alias-for-blsp1_uart3.patch | 38 +++ ...ove-clkout-lr-synchronous-from-sound.patch | 35 +++ .../arm64-dts-udpu-fix-broken-ethernet.patch | 50 ++++ ...improve-bucket_log-calculation-logic.patch | 65 +++++ ...-synchronize_rcu-before-free-ing-map.patch | 48 ++++ ...ck-update-requirements-after-locking.patch | 80 ++++++ ...-while-holding-rcu-lock-on-tear-down.patch | 141 +++++++++++ ...-missing-xlated-program-instructions.patch | 40 +++ ...reference-in-loongson3_platform_init.patch | 38 +++ ...ax_nss-in-mt7615_eeprom_parse_hw_cap.patch | 34 +++ ...reload-when-resources-are-being-used.patch | 174 +++++++++++++ ...anic-in-nsim_dev_take_snapshot_write.patch | 129 ++++++++++ ...im-fix-using-uninitialized-resources.patch | 235 ++++++++++++++++++ ...gfp_nowarn-to-avoid-memalloc-warning.patch | 89 +++++++ ...el_mid_powerbtn-take-a-copy-of-ddata.patch | 40 +++ ...bus_desc.provider_name-in-some-paths.patch | 44 ++++ ...as-functions-hcall-multi-tce-for-ddw.patch | 155 ++++++++++++ ...able-use-after-free-refcount-warning.patch | 62 +++++ ...-verification-call-in-mark_rodata_ro.patch | 32 +++ ...-ppc_check_wx-with-strict_kernel_rwx.patch | 33 +++ ...t-use-dma_iommu_ops-on-secure-guests.patch | 57 +++++ .../rtc-cmos-stop-using-shared-irq.patch | 79 ++++++ ...l-if-the-time-is-known-to-be-invalid.patch | 35 +++ ...on-of-regmap-support-when-not-needed.patch | 70 ++++++ ...drop-free_irq-of-devm_-allocated-irq.patch | 43 ++++ ...sockmap-sockhash-with-a-socket-in-it.patch | 106 ++++++++ queue-5.5/series | 38 +++ ...e_only-for-active-only-power-domains.patch | 46 ++++ ...ols-power-acpi-fix-compilation-error.patch | 50 ++++ ...atform_get_irq_optional-for-bark-irq.patch | 43 ++++ 39 files changed, 2835 insertions(+) create mode 100644 queue-5.5/arc-add-missing-multicast-filter-number-to-gmac-node.patch create mode 100644 queue-5.5/arm-dts-am43xx-add-support-for-clkout1-clock.patch create mode 100644 queue-5.5/arm-dts-at91-reenable-uart-tx-pull-ups.patch create mode 100644 queue-5.5/arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch create mode 100644 queue-5.5/arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch create mode 100644 queue-5.5/arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch create mode 100644 queue-5.5/arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch create mode 100644 queue-5.5/arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch create mode 100644 queue-5.5/arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch create mode 100644 queue-5.5/arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch create mode 100644 queue-5.5/arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch create mode 100644 queue-5.5/arm64-dts-udpu-fix-broken-ethernet.patch create mode 100644 queue-5.5/bpf-improve-bucket_log-calculation-logic.patch create mode 100644 queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch create mode 100644 queue-5.5/bpf-sockmap-check-update-requirements-after-locking.patch create mode 100644 queue-5.5/bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch create mode 100644 queue-5.5/bpftool-don-t-crash-on-missing-xlated-program-instructions.patch create mode 100644 queue-5.5/mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch create mode 100644 queue-5.5/mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch create mode 100644 queue-5.5/netdevsim-disable-devlink-reload-when-resources-are-being-used.patch create mode 100644 queue-5.5/netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch create mode 100644 queue-5.5/netdevsim-fix-using-uninitialized-resources.patch create mode 100644 queue-5.5/netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch create mode 100644 queue-5.5/platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch create mode 100644 queue-5.5/powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch create mode 100644 queue-5.5/powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch create mode 100644 queue-5.5/powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch create mode 100644 queue-5.5/powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch create mode 100644 queue-5.5/powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch create mode 100644 queue-5.5/revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch create mode 100644 queue-5.5/rtc-cmos-stop-using-shared-irq.patch create mode 100644 queue-5.5/rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch create mode 100644 queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch create mode 100644 queue-5.5/rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch create mode 100644 queue-5.5/selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch create mode 100644 queue-5.5/soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch create mode 100644 queue-5.5/tools-power-acpi-fix-compilation-error.patch create mode 100644 queue-5.5/watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch diff --git a/queue-5.5/arc-add-missing-multicast-filter-number-to-gmac-node.patch b/queue-5.5/arc-add-missing-multicast-filter-number-to-gmac-node.patch new file mode 100644 index 00000000000..0b2f6308e57 --- /dev/null +++ b/queue-5.5/arc-add-missing-multicast-filter-number-to-gmac-node.patch @@ -0,0 +1,32 @@ +From 7980dff398f86a618f502378fa27cf7e77449afa Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Tue, 14 Jan 2020 17:09:24 +0100 +Subject: ARC: [plat-axs10x]: Add missing multicast filter number to GMAC node + +From: Jose Abreu + +commit 7980dff398f86a618f502378fa27cf7e77449afa upstream. + +Add a missing property to GMAC node so that multicast filtering works +correctly. + +Fixes: 556cc1c5f528 ("ARC: [axs101] Add support for AXS101 SDP (software development platform)") +Acked-by: Alexey Brodkin +Signed-off-by: Jose Abreu +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/boot/dts/axs10x_mb.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arc/boot/dts/axs10x_mb.dtsi ++++ b/arch/arc/boot/dts/axs10x_mb.dtsi +@@ -78,6 +78,7 @@ + interrupt-names = "macirq"; + phy-mode = "rgmii"; + snps,pbl = < 32 >; ++ snps,multicast-filter-bins = <256>; + clocks = <&apbclk>; + clock-names = "stmmaceth"; + max-speed = <100>; diff --git a/queue-5.5/arm-dts-am43xx-add-support-for-clkout1-clock.patch b/queue-5.5/arm-dts-am43xx-add-support-for-clkout1-clock.patch new file mode 100644 index 00000000000..a976cda3fd6 --- /dev/null +++ b/queue-5.5/arm-dts-am43xx-add-support-for-clkout1-clock.patch @@ -0,0 +1,97 @@ +From 01053dadb79d63b65f7b353e68b4b6ccf4effedb Mon Sep 17 00:00:00 2001 +From: Tero Kristo +Date: Wed, 11 Dec 2019 08:07:18 -0600 +Subject: ARM: dts: am43xx: add support for clkout1 clock + +From: Tero Kristo + +commit 01053dadb79d63b65f7b353e68b4b6ccf4effedb upstream. + +clkout1 clock node and its generation tree was missing. Add this based +on the data on TRM and PRCM functional spec. + +commit 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes") effectively +reverted this commit 8010f13a40d3 ("ARM: dts: am43xx: add support for +clkout1 clock") which is needed for the ov2659 camera sensor clock +definition hence it is being re-applied here. + +Note that because of the current dts node name dependency for mapping to +clock domain, we must still use "clkout1-*ck" naming instead of generic +"clock@" naming for the node. And because of this, it's probably best to +apply the dts node addition together along with the other clock changes. + +Fixes: 664ae1ab2536 ("ARM: dts: am43xx: add clkctrl nodes") +Signed-off-by: Tero Kristo +Tested-by: Benoit Parrot +Acked-by: Tony Lindgren +Signed-off-by: Benoit Parrot +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/am43xx-clocks.dtsi | 54 +++++++++++++++++++++++++++++++++++ + 1 file changed, 54 insertions(+) + +--- a/arch/arm/boot/dts/am43xx-clocks.dtsi ++++ b/arch/arm/boot/dts/am43xx-clocks.dtsi +@@ -704,6 +704,60 @@ + ti,bit-shift = <8>; + reg = <0x2a48>; + }; ++ ++ clkout1_osc_div_ck: clkout1-osc-div-ck { ++ #clock-cells = <0>; ++ compatible = "ti,divider-clock"; ++ clocks = <&sys_clkin_ck>; ++ ti,bit-shift = <20>; ++ ti,max-div = <4>; ++ reg = <0x4100>; ++ }; ++ ++ clkout1_src2_mux_ck: clkout1-src2-mux-ck { ++ #clock-cells = <0>; ++ compatible = "ti,mux-clock"; ++ clocks = <&clk_rc32k_ck>, <&sysclk_div>, <&dpll_ddr_m2_ck>, ++ <&dpll_per_m2_ck>, <&dpll_disp_m2_ck>, ++ <&dpll_mpu_m2_ck>; ++ reg = <0x4100>; ++ }; ++ ++ clkout1_src2_pre_div_ck: clkout1-src2-pre-div-ck { ++ #clock-cells = <0>; ++ compatible = "ti,divider-clock"; ++ clocks = <&clkout1_src2_mux_ck>; ++ ti,bit-shift = <4>; ++ ti,max-div = <8>; ++ reg = <0x4100>; ++ }; ++ ++ clkout1_src2_post_div_ck: clkout1-src2-post-div-ck { ++ #clock-cells = <0>; ++ compatible = "ti,divider-clock"; ++ clocks = <&clkout1_src2_pre_div_ck>; ++ ti,bit-shift = <8>; ++ ti,max-div = <32>; ++ ti,index-power-of-two; ++ reg = <0x4100>; ++ }; ++ ++ clkout1_mux_ck: clkout1-mux-ck { ++ #clock-cells = <0>; ++ compatible = "ti,mux-clock"; ++ clocks = <&clkout1_osc_div_ck>, <&clk_rc32k_ck>, ++ <&clkout1_src2_post_div_ck>, <&dpll_extdev_m2_ck>; ++ ti,bit-shift = <16>; ++ reg = <0x4100>; ++ }; ++ ++ clkout1_ck: clkout1-ck { ++ #clock-cells = <0>; ++ compatible = "ti,gate-clock"; ++ clocks = <&clkout1_mux_ck>; ++ ti,bit-shift = <23>; ++ reg = <0x4100>; ++ }; + }; + + &prcm { diff --git a/queue-5.5/arm-dts-at91-reenable-uart-tx-pull-ups.patch b/queue-5.5/arm-dts-at91-reenable-uart-tx-pull-ups.patch new file mode 100644 index 00000000000..812613d6408 --- /dev/null +++ b/queue-5.5/arm-dts-at91-reenable-uart-tx-pull-ups.patch @@ -0,0 +1,224 @@ +From 9d39d86cd4af2b17b970d63307daad71f563d207 Mon Sep 17 00:00:00 2001 +From: Ingo van Lil +Date: Tue, 3 Dec 2019 15:21:47 +0100 +Subject: ARM: dts: at91: Reenable UART TX pull-ups + +From: Ingo van Lil + +commit 9d39d86cd4af2b17b970d63307daad71f563d207 upstream. + +Pull-ups for SAM9 UART/USART TX lines were disabled in a previous +commit. However, several chips in the SAM9 family require pull-ups to +prevent the TX lines from falling (and causing an endless break +condition) when the transceiver is disabled. + +From the SAM9G20 datasheet, 32.5.1: "To prevent the TXD line from +falling when the USART is disabled, the use of an internal pull up +is mandatory.". This commit reenables the pull-ups for all chips having +that sentence in their datasheets. + +Fixes: 5e04822f7db5 ("ARM: dts: at91: fixes uart pinctrl, set pullup on rx, clear pullup on tx") +Signed-off-by: Ingo van Lil +Cc: Peter Rosin +Link: https://lore.kernel.org/r/20191203142147.875227-1-inguin@gmx.de +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/at91sam9260.dtsi | 12 ++++++------ + arch/arm/boot/dts/at91sam9261.dtsi | 6 +++--- + arch/arm/boot/dts/at91sam9263.dtsi | 6 +++--- + arch/arm/boot/dts/at91sam9g45.dtsi | 8 ++++---- + arch/arm/boot/dts/at91sam9rl.dtsi | 8 ++++---- + 5 files changed, 20 insertions(+), 20 deletions(-) + +--- a/arch/arm/boot/dts/at91sam9260.dtsi ++++ b/arch/arm/boot/dts/at91sam9260.dtsi +@@ -187,7 +187,7 @@ + usart0 { + pinctrl_usart0: usart0-0 { + atmel,pins = +- ; + }; + +@@ -221,7 +221,7 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- ; + }; + +@@ -239,7 +239,7 @@ + usart2 { + pinctrl_usart2: usart2-0 { + atmel,pins = +- ; + }; + +@@ -257,7 +257,7 @@ + usart3 { + pinctrl_usart3: usart3-0 { + atmel,pins = +- ; + }; + +@@ -275,7 +275,7 @@ + uart0 { + pinctrl_uart0: uart0-0 { + atmel,pins = +- ; + }; + }; +@@ -283,7 +283,7 @@ + uart1 { + pinctrl_uart1: uart1-0 { + atmel,pins = +- ; + }; + }; +--- a/arch/arm/boot/dts/at91sam9261.dtsi ++++ b/arch/arm/boot/dts/at91sam9261.dtsi +@@ -329,7 +329,7 @@ + usart0 { + pinctrl_usart0: usart0-0 { + atmel,pins = +- , ++ , + ; + }; + +@@ -347,7 +347,7 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- , ++ , + ; + }; + +@@ -365,7 +365,7 @@ + usart2 { + pinctrl_usart2: usart2-0 { + atmel,pins = +- , ++ , + ; + }; + +--- a/arch/arm/boot/dts/at91sam9263.dtsi ++++ b/arch/arm/boot/dts/at91sam9263.dtsi +@@ -183,7 +183,7 @@ + usart0 { + pinctrl_usart0: usart0-0 { + atmel,pins = +- ; + }; + +@@ -201,7 +201,7 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- ; + }; + +@@ -219,7 +219,7 @@ + usart2 { + pinctrl_usart2: usart2-0 { + atmel,pins = +- ; + }; + +--- a/arch/arm/boot/dts/at91sam9g45.dtsi ++++ b/arch/arm/boot/dts/at91sam9g45.dtsi +@@ -556,7 +556,7 @@ + usart0 { + pinctrl_usart0: usart0-0 { + atmel,pins = +- ; + }; + +@@ -574,7 +574,7 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- ; + }; + +@@ -592,7 +592,7 @@ + usart2 { + pinctrl_usart2: usart2-0 { + atmel,pins = +- ; + }; + +@@ -610,7 +610,7 @@ + usart3 { + pinctrl_usart3: usart3-0 { + atmel,pins = +- ; + }; + +--- a/arch/arm/boot/dts/at91sam9rl.dtsi ++++ b/arch/arm/boot/dts/at91sam9rl.dtsi +@@ -682,7 +682,7 @@ + usart0 { + pinctrl_usart0: usart0-0 { + atmel,pins = +- , ++ , + ; + }; + +@@ -721,7 +721,7 @@ + usart1 { + pinctrl_usart1: usart1-0 { + atmel,pins = +- , ++ , + ; + }; + +@@ -744,7 +744,7 @@ + usart2 { + pinctrl_usart2: usart2-0 { + atmel,pins = +- , ++ , + ; + }; + +@@ -767,7 +767,7 @@ + usart3 { + pinctrl_usart3: usart3-0 { + atmel,pins = +- , ++ , + ; + }; + diff --git a/queue-5.5/arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch b/queue-5.5/arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch new file mode 100644 index 00000000000..2726a707c1c --- /dev/null +++ b/queue-5.5/arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch @@ -0,0 +1,35 @@ +From a7e0f3fc01df4b1b7077df777c37feae8c9e8b6d Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Fri, 10 Jan 2020 18:20:07 +0100 +Subject: ARM: dts: at91: sama5d3: define clock rate range for tcb1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +commit a7e0f3fc01df4b1b7077df777c37feae8c9e8b6d upstream. + +The clock rate range for the TCB1 clock is missing. define it in the device +tree. + +Reported-by: Karl Rudbæk Olsen +Fixes: d2e8190b7916 ("ARM: at91/dt: define sama5d3 clocks") +Link: https://lore.kernel.org/r/20200110172007.1253659-2-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sama5d3_tcb1.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/boot/dts/sama5d3_tcb1.dtsi ++++ b/arch/arm/boot/dts/sama5d3_tcb1.dtsi +@@ -22,6 +22,7 @@ + tcb1_clk: tcb1_clk { + #clock-cells = <0>; + reg = <27>; ++ atmel,clk-output-range = <0 166000000>; + }; + }; + }; diff --git a/queue-5.5/arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch b/queue-5.5/arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch new file mode 100644 index 00000000000..b7db0871924 --- /dev/null +++ b/queue-5.5/arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch @@ -0,0 +1,173 @@ +From ee0aa926ddb0bd8ba59e33e3803b3b5804e3f5da Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Fri, 10 Jan 2020 18:20:06 +0100 +Subject: ARM: dts: at91: sama5d3: fix maximum peripheral clock rates +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alexandre Belloni + +commit ee0aa926ddb0bd8ba59e33e3803b3b5804e3f5da upstream. + +Currently the maximum rate for peripheral clock is calculated based on a +typical 133MHz MCK. The maximum frequency is defined in the datasheet as a +ratio to MCK. Some sama5d3 platforms are using a 166MHz MCK. Update the +device trees to match the maximum rate based on 166MHz. + +Reported-by: Karl Rudbæk Olsen +Fixes: d2e8190b7916 ("ARM: at91/dt: define sama5d3 clocks") +Link: https://lore.kernel.org/r/20200110172007.1253659-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sama5d3.dtsi | 28 ++++++++++++++-------------- + arch/arm/boot/dts/sama5d3_can.dtsi | 4 ++-- + arch/arm/boot/dts/sama5d3_uart.dtsi | 4 ++-- + 3 files changed, 18 insertions(+), 18 deletions(-) + +--- a/arch/arm/boot/dts/sama5d3.dtsi ++++ b/arch/arm/boot/dts/sama5d3.dtsi +@@ -1188,49 +1188,49 @@ + usart0_clk: usart0_clk { + #clock-cells = <0>; + reg = <12>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + usart1_clk: usart1_clk { + #clock-cells = <0>; + reg = <13>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + usart2_clk: usart2_clk { + #clock-cells = <0>; + reg = <14>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + usart3_clk: usart3_clk { + #clock-cells = <0>; + reg = <15>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + uart0_clk: uart0_clk { + #clock-cells = <0>; + reg = <16>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + twi0_clk: twi0_clk { + reg = <18>; + #clock-cells = <0>; +- atmel,clk-output-range = <0 16625000>; ++ atmel,clk-output-range = <0 41500000>; + }; + + twi1_clk: twi1_clk { + #clock-cells = <0>; + reg = <19>; +- atmel,clk-output-range = <0 16625000>; ++ atmel,clk-output-range = <0 41500000>; + }; + + twi2_clk: twi2_clk { + #clock-cells = <0>; + reg = <20>; +- atmel,clk-output-range = <0 16625000>; ++ atmel,clk-output-range = <0 41500000>; + }; + + mci0_clk: mci0_clk { +@@ -1246,19 +1246,19 @@ + spi0_clk: spi0_clk { + #clock-cells = <0>; + reg = <24>; +- atmel,clk-output-range = <0 133000000>; ++ atmel,clk-output-range = <0 166000000>; + }; + + spi1_clk: spi1_clk { + #clock-cells = <0>; + reg = <25>; +- atmel,clk-output-range = <0 133000000>; ++ atmel,clk-output-range = <0 166000000>; + }; + + tcb0_clk: tcb0_clk { + #clock-cells = <0>; + reg = <26>; +- atmel,clk-output-range = <0 133000000>; ++ atmel,clk-output-range = <0 166000000>; + }; + + pwm_clk: pwm_clk { +@@ -1269,7 +1269,7 @@ + adc_clk: adc_clk { + #clock-cells = <0>; + reg = <29>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + dma0_clk: dma0_clk { +@@ -1300,13 +1300,13 @@ + ssc0_clk: ssc0_clk { + #clock-cells = <0>; + reg = <38>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + ssc1_clk: ssc1_clk { + #clock-cells = <0>; + reg = <39>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + sha_clk: sha_clk { +--- a/arch/arm/boot/dts/sama5d3_can.dtsi ++++ b/arch/arm/boot/dts/sama5d3_can.dtsi +@@ -36,13 +36,13 @@ + can0_clk: can0_clk { + #clock-cells = <0>; + reg = <40>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + can1_clk: can1_clk { + #clock-cells = <0>; + reg = <41>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + }; + }; +--- a/arch/arm/boot/dts/sama5d3_uart.dtsi ++++ b/arch/arm/boot/dts/sama5d3_uart.dtsi +@@ -41,13 +41,13 @@ + uart0_clk: uart0_clk { + #clock-cells = <0>; + reg = <16>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + + uart1_clk: uart1_clk { + #clock-cells = <0>; + reg = <17>; +- atmel,clk-output-range = <0 66000000>; ++ atmel,clk-output-range = <0 83000000>; + }; + }; + }; diff --git a/queue-5.5/arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch b/queue-5.5/arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch new file mode 100644 index 00000000000..64bea70b62c --- /dev/null +++ b/queue-5.5/arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch @@ -0,0 +1,38 @@ +From fe634a7a9a57fb736e39fb71aa9adc6448a90f94 Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Wed, 25 Dec 2019 02:06:06 +0100 +Subject: ARM: dts: meson8: use the actual frequency for the GPU's 182.1MHz OPP + +From: Martin Blumenstingl + +commit fe634a7a9a57fb736e39fb71aa9adc6448a90f94 upstream. + +The clock setup on Meson8 cannot achieve a Mali frequency of exactly +182.15MHz. The vendor driver uses "FCLK_DIV7 / 2" for this frequency, +which translates to 2550MHz / 7 / 2 = 182142857Hz. +Update the GPU operating point to that specific frequency to not confuse +myself when comparing the frequency from the .dts with the actual clock +rate on the system. + +Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/meson8.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -129,8 +129,8 @@ + gpu_opp_table: gpu-opp-table { + compatible = "operating-points-v2"; + +- opp-182150000 { +- opp-hz = /bits/ 64 <182150000>; ++ opp-182142857 { ++ opp-hz = /bits/ 64 <182142857>; + opp-microvolt = <1150000>; + }; + opp-318750000 { diff --git a/queue-5.5/arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch b/queue-5.5/arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch new file mode 100644 index 00000000000..dc4f743dec1 --- /dev/null +++ b/queue-5.5/arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch @@ -0,0 +1,38 @@ +From c3dd3315ab58b2cfa1916df55b0d0f9fbd94266f Mon Sep 17 00:00:00 2001 +From: Martin Blumenstingl +Date: Wed, 25 Dec 2019 02:06:07 +0100 +Subject: ARM: dts: meson8b: use the actual frequency for the GPU's 364MHz OPP + +From: Martin Blumenstingl + +commit c3dd3315ab58b2cfa1916df55b0d0f9fbd94266f upstream. + +The clock setup on Meson8 cannot achieve a Mali frequency of exactly +182.15MHz. The vendor driver uses "FCLK_DIV7 / 1" for this frequency, +which translates to 2550MHz / 7 / 1 = 364285714Hz. +Update the GPU operating point to that specific frequency to not confuse +myself when comparing the frequency from the .dts with the actual clock +rate on the system. + +Fixes: c3ea80b6138cae ("ARM: dts: meson8b: add the Mali-450 MP2 GPU") +Signed-off-by: Martin Blumenstingl +Signed-off-by: Kevin Hilman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/meson8b.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/meson8b.dtsi ++++ b/arch/arm/boot/dts/meson8b.dtsi +@@ -125,8 +125,8 @@ + opp-hz = /bits/ 64 <255000000>; + opp-microvolt = <1100000>; + }; +- opp-364300000 { +- opp-hz = /bits/ 64 <364300000>; ++ opp-364285714 { ++ opp-hz = /bits/ 64 <364285714>; + opp-microvolt = <1100000>; + }; + opp-425000000 { diff --git a/queue-5.5/arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch b/queue-5.5/arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch new file mode 100644 index 00000000000..2163ab944ed --- /dev/null +++ b/queue-5.5/arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch @@ -0,0 +1,35 @@ +From 62bba54d99407aedfe9b0a02e72e23c06e2b0116 Mon Sep 17 00:00:00 2001 +From: Baruch Siach +Date: Thu, 19 Dec 2019 12:28:45 +0200 +Subject: arm64: dts: marvell: clearfog-gt-8k: fix switch cpu port node + +From: Baruch Siach + +commit 62bba54d99407aedfe9b0a02e72e23c06e2b0116 upstream. + +Explicitly set the switch cpu (upstream) port phy-mode and managed +properties. This fixes the Marvell 88E6141 switch serdes configuration +with the recently enabled phylink layer. + +Fixes: a6120833272c ("arm64: dts: add support for SolidRun Clearfog GT 8K") +Reported-by: Denis Odintsov +Signed-off-by: Baruch Siach +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts ++++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts +@@ -408,6 +408,8 @@ + reg = <5>; + label = "cpu"; + ethernet = <&cp1_eth2>; ++ phy-mode = "2500base-x"; ++ managed = "in-band-status"; + }; + }; + diff --git a/queue-5.5/arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch b/queue-5.5/arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch new file mode 100644 index 00000000000..86fcf4a2752 --- /dev/null +++ b/queue-5.5/arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch @@ -0,0 +1,34 @@ +From 05caa5bf9cab9983dd7a50428c46b7e617ba20d6 Mon Sep 17 00:00:00 2001 +From: Jeffrey Hugo +Date: Wed, 6 Nov 2019 20:59:48 -0800 +Subject: arm64: dts: qcom: msm8998: Fix tcsr syscon size + +From: Jeffrey Hugo + +commit 05caa5bf9cab9983dd7a50428c46b7e617ba20d6 upstream. + +The tcsr syscon region is really 0x40000 in size. We need access to the +full region so that we can access the axi resets when managing the +modem subsystem. + +Fixes: c7833949564e ("arm64: dts: qcom: msm8998: Add smem related nodes") +Signed-off-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/20191107045948.4341-1-jeffrey.l.hugo@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -987,7 +987,7 @@ + + tcsr_mutex_regs: syscon@1f40000 { + compatible = "syscon"; +- reg = <0x01f40000 0x20000>; ++ reg = <0x01f40000 0x40000>; + }; + + tlmm: pinctrl@3400000 { diff --git a/queue-5.5/arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch b/queue-5.5/arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch new file mode 100644 index 00000000000..4fa3cae3f4c --- /dev/null +++ b/queue-5.5/arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch @@ -0,0 +1,38 @@ +From c9ec155b5962233aff3df65210bd6a4788dee21c Mon Sep 17 00:00:00 2001 +From: Bjorn Andersson +Date: Mon, 18 Nov 2019 17:18:23 -0800 +Subject: arm64: dts: qcom: msm8998-mtp: Add alias for blsp1_uart3 + +From: Bjorn Andersson + +commit c9ec155b5962233aff3df65210bd6a4788dee21c upstream. + +The msm_serial driver has a predefined set of uart ports defined, which +is allocated either by reading aliases or if no match is found a simple +counter, starting at index 0. But there's no logic in place to prevent +these two allocation mechanism from colliding. As a result either none +or all of the active msm_serial instances must be listed as aliases. + +Define blsp1_uart3 as "serial1" to mitigate this problem. + +Fixes: 4cffb9f2c700 ("arm64: dts: qcom: msm8998-mtp: Enable bluetooth") +Signed-off-by: Bjorn Andersson +Reviewed-by: Jeffrey Hugo +Link: https://lore.kernel.org/r/20191119011823.379100-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998-mtp.dtsi +@@ -9,6 +9,7 @@ + / { + aliases { + serial0 = &blsp2_uart1; ++ serial1 = &blsp1_uart3; + }; + + chosen { diff --git a/queue-5.5/arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch b/queue-5.5/arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch new file mode 100644 index 00000000000..573197c5216 --- /dev/null +++ b/queue-5.5/arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch @@ -0,0 +1,35 @@ +From bf2b74ce9b33a2edd6ba1930ce60a71830790910 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Mon, 16 Dec 2019 11:08:22 +0900 +Subject: arm64: dts: renesas: r8a77990: ebisu: Remove clkout-lr-synchronous from sound + +From: Kuninori Morimoto + +commit bf2b74ce9b33a2edd6ba1930ce60a71830790910 upstream. + +rcar_sound doesn't support clkout-lr-synchronous in upstream. +It was supported under out-of-tree rcar_sound. +upstream rcar_sound is supporting + - clkout-lr-synchronous + + clkout-lr-asynchronous + +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87mubt3tux.wl-kuninori.morimoto.gx@renesas.com +Fixes: 56629fcba94c698d ("arm64: dts: renesas: ebisu: Enable Audio") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77990-ebisu.dts +@@ -636,7 +636,6 @@ + /* audio_clkout0/1/2/3 */ + #clock-cells = <1>; + clock-frequency = <12288000 11289600>; +- clkout-lr-synchronous; + + status = "okay"; + diff --git a/queue-5.5/arm64-dts-udpu-fix-broken-ethernet.patch b/queue-5.5/arm64-dts-udpu-fix-broken-ethernet.patch new file mode 100644 index 00000000000..a4af29bdb9b --- /dev/null +++ b/queue-5.5/arm64-dts-udpu-fix-broken-ethernet.patch @@ -0,0 +1,50 @@ +From 1eebac0240580b531954b02c05068051df41142a Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Sat, 16 Nov 2019 11:06:56 +0000 +Subject: arm64: dts: uDPU: fix broken ethernet + +From: Russell King + +commit 1eebac0240580b531954b02c05068051df41142a upstream. + +The uDPU uses both ethernet controllers, which ties up COMPHY 0 for +eth1 and COMPHY 1 for eth0, with no USB3 comphy. The addition of +COMPHY support made the kernel override the setup by the boot loader +breaking this platform by assuming that COMPHY 0 was always used for +USB3. Delete the USB3 COMPHY definition at platform level, and add +phy specifications for the ethernet channels. + +Fixes: bd3d25b07342 ("arm64: dts: marvell: armada-37xx: link USB hosts with their PHYs") +Signed-off-by: Russell King +Signed-off-by: Gregory CLEMENT +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-uDPU.dts +@@ -143,6 +143,7 @@ + phy-mode = "sgmii"; + status = "okay"; + managed = "in-band-status"; ++ phys = <&comphy1 0>; + sfp = <&sfp_eth0>; + }; + +@@ -150,11 +151,14 @@ + phy-mode = "sgmii"; + status = "okay"; + managed = "in-band-status"; ++ phys = <&comphy0 1>; + sfp = <&sfp_eth1>; + }; + + &usb3 { + status = "okay"; ++ phys = <&usb2_utmi_otg_phy>; ++ phy-names = "usb2-utmi-otg-phy"; + }; + + &uart0 { diff --git a/queue-5.5/bpf-improve-bucket_log-calculation-logic.patch b/queue-5.5/bpf-improve-bucket_log-calculation-logic.patch new file mode 100644 index 00000000000..075f645c109 --- /dev/null +++ b/queue-5.5/bpf-improve-bucket_log-calculation-logic.patch @@ -0,0 +1,65 @@ +From 88d6f130e5632bbf419a2e184ec7adcbe241260b Mon Sep 17 00:00:00 2001 +From: Martin KaFai Lau +Date: Fri, 7 Feb 2020 00:18:10 -0800 +Subject: bpf: Improve bucket_log calculation logic + +From: Martin KaFai Lau + +commit 88d6f130e5632bbf419a2e184ec7adcbe241260b upstream. + +It was reported that the max_t, ilog2, and roundup_pow_of_two macros have +exponential effects on the number of states in the sparse checker. + +This patch breaks them up by calculating the "nbuckets" first so that the +"bucket_log" only needs to take ilog2(). + +In addition, Linus mentioned: + + Patch looks good, but I'd like to point out that it's not just sparse. + + You can see it with a simple + + make net/core/bpf_sk_storage.i + grep 'smap->bucket_log = ' net/core/bpf_sk_storage.i | wc + + and see the end result: + + 1 365071 2686974 + + That's one line (the assignment line) that is 2,686,974 characters in + length. + + Now, sparse does happen to react particularly badly to that (I didn't + look to why, but I suspect it's just that evaluating all the types + that don't actually ever end up getting used ends up being much more + expensive than it should be), but I bet it's not good for gcc either. + +Fixes: 6ac99e8f23d4 ("bpf: Introduce bpf sk local storage") +Reported-by: Randy Dunlap +Reported-by: Luc Van Oostenryck +Suggested-by: Linus Torvalds +Signed-off-by: Martin KaFai Lau +Signed-off-by: Daniel Borkmann +Reviewed-by: Luc Van Oostenryck +Link: https://lore.kernel.org/bpf/20200207081810.3918919-1-kafai@fb.com +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/bpf_sk_storage.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/core/bpf_sk_storage.c ++++ b/net/core/bpf_sk_storage.c +@@ -643,9 +643,10 @@ static struct bpf_map *bpf_sk_storage_ma + return ERR_PTR(-ENOMEM); + bpf_map_init_from_attr(&smap->map, attr); + ++ nbuckets = roundup_pow_of_two(num_possible_cpus()); + /* Use at least 2 buckets, select_bucket() is undefined behavior with 1 bucket */ +- smap->bucket_log = max_t(u32, 1, ilog2(roundup_pow_of_two(num_possible_cpus()))); +- nbuckets = 1U << smap->bucket_log; ++ nbuckets = max_t(u32, 2, nbuckets); ++ smap->bucket_log = ilog2(nbuckets); + cost = sizeof(*smap->buckets) * nbuckets + sizeof(*smap); + + ret = bpf_map_charge_init(&smap->map.memory, cost); diff --git a/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch b/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch new file mode 100644 index 00000000000..85ab18d7f31 --- /dev/null +++ b/queue-5.5/bpf-sockhash-synchronize_rcu-before-free-ing-map.patch @@ -0,0 +1,48 @@ +From 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 Mon Sep 17 00:00:00 2001 +From: Jakub Sitnicki +Date: Thu, 6 Feb 2020 12:16:51 +0100 +Subject: bpf, sockhash: Synchronize_rcu before free'ing map + +From: Jakub Sitnicki + +commit 0b2dc83906cf1e694e48003eae5df8fa63f76fd9 upstream. + +We need to have a synchronize_rcu before free'ing the sockhash because any +outstanding psock references will have a pointer to the map and when they +use it, this could trigger a use after free. + +This is a sister fix for sockhash, following commit 2bb90e5cc90e ("bpf: +sockmap, synchronize_rcu before free'ing map") which addressed sockmap, +which comes from a manual audit. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Jakub Sitnicki +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20200206111652.694507-3-jakub@cloudflare.com +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/sock_map.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -250,6 +250,7 @@ static void sock_map_free(struct bpf_map + } + raw_spin_unlock_bh(&stab->lock); + ++ /* wait for psock readers accessing its map link */ + synchronize_rcu(); + + bpf_map_area_free(stab->sks); +@@ -873,6 +874,9 @@ static void sock_hash_free(struct bpf_ma + raw_spin_unlock_bh(&bucket->lock); + } + ++ /* wait for psock readers accessing its map link */ ++ synchronize_rcu(); ++ + bpf_map_area_free(htab->buckets); + kfree(htab); + } diff --git a/queue-5.5/bpf-sockmap-check-update-requirements-after-locking.patch b/queue-5.5/bpf-sockmap-check-update-requirements-after-locking.patch new file mode 100644 index 00000000000..c152c7813bc --- /dev/null +++ b/queue-5.5/bpf-sockmap-check-update-requirements-after-locking.patch @@ -0,0 +1,80 @@ +From 85b8ac01a421791d66c3a458a7f83cfd173fe3fa Mon Sep 17 00:00:00 2001 +From: Lorenz Bauer +Date: Fri, 7 Feb 2020 10:37:12 +0000 +Subject: bpf, sockmap: Check update requirements after locking + +From: Lorenz Bauer + +commit 85b8ac01a421791d66c3a458a7f83cfd173fe3fa upstream. + +It's currently possible to insert sockets in unexpected states into +a sockmap, due to a TOCTTOU when updating the map from a syscall. +sock_map_update_elem checks that sk->sk_state == TCP_ESTABLISHED, +locks the socket and then calls sock_map_update_common. At this +point, the socket may have transitioned into another state, and +the earlier assumptions don't hold anymore. Crucially, it's +conceivable (though very unlikely) that a socket has become unhashed. +This breaks the sockmap's assumption that it will get a callback +via sk->sk_prot->unhash. + +Fix this by checking the (fixed) sk_type and sk_protocol without the +lock, followed by a locked check of sk_state. + +Unfortunately it's not possible to push the check down into +sock_(map|hash)_update_common, since BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB +run before the socket has transitioned from TCP_SYN_RECV into +TCP_ESTABLISHED. + +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Lorenz Bauer +Signed-off-by: Daniel Borkmann +Reviewed-by: Jakub Sitnicki +Link: https://lore.kernel.org/bpf/20200207103713.28175-1-lmb@cloudflare.com +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/sock_map.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -417,14 +417,16 @@ static int sock_map_update_elem(struct b + ret = -EINVAL; + goto out; + } +- if (!sock_map_sk_is_suitable(sk) || +- sk->sk_state != TCP_ESTABLISHED) { ++ if (!sock_map_sk_is_suitable(sk)) { + ret = -EOPNOTSUPP; + goto out; + } + + sock_map_sk_acquire(sk); +- ret = sock_map_update_common(map, idx, sk, flags); ++ if (sk->sk_state != TCP_ESTABLISHED) ++ ret = -EOPNOTSUPP; ++ else ++ ret = sock_map_update_common(map, idx, sk, flags); + sock_map_sk_release(sk); + out: + fput(sock->file); +@@ -740,14 +742,16 @@ static int sock_hash_update_elem(struct + ret = -EINVAL; + goto out; + } +- if (!sock_map_sk_is_suitable(sk) || +- sk->sk_state != TCP_ESTABLISHED) { ++ if (!sock_map_sk_is_suitable(sk)) { + ret = -EOPNOTSUPP; + goto out; + } + + sock_map_sk_acquire(sk); +- ret = sock_hash_update_common(map, key, sk, flags); ++ if (sk->sk_state != TCP_ESTABLISHED) ++ ret = -EOPNOTSUPP; ++ else ++ ret = sock_hash_update_common(map, key, sk, flags); + sock_map_sk_release(sk); + out: + fput(sock->file); diff --git a/queue-5.5/bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch b/queue-5.5/bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch new file mode 100644 index 00000000000..dda6fd73463 --- /dev/null +++ b/queue-5.5/bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch @@ -0,0 +1,141 @@ +From db6a5018b6e008c1d69c6628cdaa9541b8e70940 Mon Sep 17 00:00:00 2001 +From: Jakub Sitnicki +Date: Thu, 6 Feb 2020 12:16:50 +0100 +Subject: bpf, sockmap: Don't sleep while holding RCU lock on tear-down + +From: Jakub Sitnicki + +commit db6a5018b6e008c1d69c6628cdaa9541b8e70940 upstream. + +rcu_read_lock is needed to protect access to psock inside sock_map_unref +when tearing down the map. However, we can't afford to sleep in lock_sock +while in RCU read-side critical section. Grab the RCU lock only after we +have locked the socket. + +This fixes RCU warnings triggerable on a VM with 1 vCPU when free'ing a +sockmap/sockhash that contains at least one socket: + +| ============================= +| WARNING: suspicious RCU usage +| 5.5.0-04005-g8fc91b972b73 #450 Not tainted +| ----------------------------- +| include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section! +| +| other info that might help us debug this: +| +| +| rcu_scheduler_active = 2, debug_locks = 1 +| 4 locks held by kworker/0:1/62: +| #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0 +| #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0 +| #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_map_free+0x5/0x170 +| #3: ffff8881368c5df8 (&stab->lock){+...}, at: sock_map_free+0x64/0x170 +| +| stack backtrace: +| CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73 #450 +| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 +| Workqueue: events bpf_map_free_deferred +| Call Trace: +| dump_stack+0x71/0xa0 +| ___might_sleep+0x105/0x190 +| lock_sock_nested+0x28/0x90 +| sock_map_free+0x95/0x170 +| bpf_map_free_deferred+0x58/0x80 +| process_one_work+0x260/0x5e0 +| worker_thread+0x4d/0x3e0 +| kthread+0x108/0x140 +| ? process_one_work+0x5e0/0x5e0 +| ? kthread_park+0x90/0x90 +| ret_from_fork+0x3a/0x50 + +| ============================= +| WARNING: suspicious RCU usage +| 5.5.0-04005-g8fc91b972b73-dirty #452 Not tainted +| ----------------------------- +| include/linux/rcupdate.h:272 Illegal context switch in RCU read-side critical section! +| +| other info that might help us debug this: +| +| +| rcu_scheduler_active = 2, debug_locks = 1 +| 4 locks held by kworker/0:1/62: +| #0: ffff88813b019748 ((wq_completion)events){+.+.}, at: process_one_work+0x1d7/0x5e0 +| #1: ffffc900000abe50 ((work_completion)(&map->work)){+.+.}, at: process_one_work+0x1d7/0x5e0 +| #2: ffffffff82065d20 (rcu_read_lock){....}, at: sock_hash_free+0x5/0x1d0 +| #3: ffff888139966e00 (&htab->buckets[i].lock){+...}, at: sock_hash_free+0x92/0x1d0 +| +| stack backtrace: +| CPU: 0 PID: 62 Comm: kworker/0:1 Not tainted 5.5.0-04005-g8fc91b972b73-dirty #452 +| Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 +| Workqueue: events bpf_map_free_deferred +| Call Trace: +| dump_stack+0x71/0xa0 +| ___might_sleep+0x105/0x190 +| lock_sock_nested+0x28/0x90 +| sock_hash_free+0xec/0x1d0 +| bpf_map_free_deferred+0x58/0x80 +| process_one_work+0x260/0x5e0 +| worker_thread+0x4d/0x3e0 +| kthread+0x108/0x140 +| ? process_one_work+0x5e0/0x5e0 +| ? kthread_park+0x90/0x90 +| ret_from_fork+0x3a/0x50 + +Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") +Signed-off-by: Jakub Sitnicki +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20200206111652.694507-2-jakub@cloudflare.com +Signed-off-by: Greg Kroah-Hartman + +--- + net/core/sock_map.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -234,7 +234,6 @@ static void sock_map_free(struct bpf_map + int i; + + synchronize_rcu(); +- rcu_read_lock(); + raw_spin_lock_bh(&stab->lock); + for (i = 0; i < stab->map.max_entries; i++) { + struct sock **psk = &stab->sks[i]; +@@ -243,12 +242,13 @@ static void sock_map_free(struct bpf_map + sk = xchg(psk, NULL); + if (sk) { + lock_sock(sk); ++ rcu_read_lock(); + sock_map_unref(sk, psk); ++ rcu_read_unlock(); + release_sock(sk); + } + } + raw_spin_unlock_bh(&stab->lock); +- rcu_read_unlock(); + + synchronize_rcu(); + +@@ -859,19 +859,19 @@ static void sock_hash_free(struct bpf_ma + int i; + + synchronize_rcu(); +- rcu_read_lock(); + for (i = 0; i < htab->buckets_num; i++) { + bucket = sock_hash_select_bucket(htab, i); + raw_spin_lock_bh(&bucket->lock); + hlist_for_each_entry_safe(elem, node, &bucket->head, node) { + hlist_del_rcu(&elem->node); + lock_sock(elem->sk); ++ rcu_read_lock(); + sock_map_unref(elem->sk, elem); ++ rcu_read_unlock(); + release_sock(elem->sk); + } + raw_spin_unlock_bh(&bucket->lock); + } +- rcu_read_unlock(); + + bpf_map_area_free(htab->buckets); + kfree(htab); diff --git a/queue-5.5/bpftool-don-t-crash-on-missing-xlated-program-instructions.patch b/queue-5.5/bpftool-don-t-crash-on-missing-xlated-program-instructions.patch new file mode 100644 index 00000000000..9a5c4b613cb --- /dev/null +++ b/queue-5.5/bpftool-don-t-crash-on-missing-xlated-program-instructions.patch @@ -0,0 +1,40 @@ +From d95f1e8b462c4372ac409886070bb8719d8a4d3a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= +Date: Thu, 6 Feb 2020 11:29:06 +0100 +Subject: bpftool: Don't crash on missing xlated program instructions +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +commit d95f1e8b462c4372ac409886070bb8719d8a4d3a upstream. + +Turns out the xlated program instructions can also be missing if +kptr_restrict sysctl is set. This means that the previous fix to check the +jited_prog_insns pointer was insufficient; add another check of the +xlated_prog_insns pointer as well. + +Fixes: 5b79bcdf0362 ("bpftool: Don't crash on missing jited insns or ksyms") +Fixes: cae73f233923 ("bpftool: use bpf_program__get_prog_info_linear() in prog.c:do_dump()") +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Daniel Borkmann +Reviewed-by: Quentin Monnet +Link: https://lore.kernel.org/bpf/20200206102906.112551-1-toke@redhat.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/bpf/bpftool/prog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -500,7 +500,7 @@ static int do_dump(int argc, char **argv + buf = (unsigned char *)(info->jited_prog_insns); + member_len = info->jited_prog_len; + } else { /* DUMP_XLATED */ +- if (info->xlated_prog_len == 0) { ++ if (info->xlated_prog_len == 0 || !info->xlated_prog_insns) { + p_err("error retrieving insn dump: kernel.kptr_restrict set?"); + goto err_free; + } diff --git a/queue-5.5/mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch b/queue-5.5/mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch new file mode 100644 index 00000000000..b9f17c0832f --- /dev/null +++ b/queue-5.5/mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch @@ -0,0 +1,38 @@ +From 72d052e28d1d2363f9107be63ef3a3afdea6143c Mon Sep 17 00:00:00 2001 +From: Tiezhu Yang +Date: Fri, 10 Jan 2020 09:30:42 +0800 +Subject: MIPS: Loongson: Fix potential NULL dereference in loongson3_platform_init() + +From: Tiezhu Yang + +commit 72d052e28d1d2363f9107be63ef3a3afdea6143c upstream. + +If kzalloc fails, it should return -ENOMEM, otherwise may trigger a NULL +pointer dereference. + +Fixes: 3adeb2566b9b ("MIPS: Loongson: Improve LEFI firmware interface") +Signed-off-by: Tiezhu Yang +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: Huacai Chen +Cc: Jiaxun Yang +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/loongson64/platform.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/mips/loongson64/platform.c ++++ b/arch/mips/loongson64/platform.c +@@ -27,6 +27,9 @@ static int __init loongson3_platform_ini + continue; + + pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL); ++ if (!pdev) ++ return -ENOMEM; ++ + pdev->name = loongson_sysconf.sensors[i].name; + pdev->id = loongson_sysconf.sensors[i].id; + pdev->dev.platform_data = &loongson_sysconf.sensors[i]; diff --git a/queue-5.5/mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch b/queue-5.5/mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch new file mode 100644 index 00000000000..7706504c036 --- /dev/null +++ b/queue-5.5/mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch @@ -0,0 +1,34 @@ +From d08f3010f4a32eec3c8aa771f03a1b342a1472fa Mon Sep 17 00:00:00 2001 +From: Lorenzo Bianconi +Date: Fri, 7 Feb 2020 11:29:51 +0100 +Subject: mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap + +From: Lorenzo Bianconi + +commit d08f3010f4a32eec3c8aa771f03a1b342a1472fa upstream. + +Fix u8 cast reading max_nss from MT_TOP_STRAP_STA register in +mt7615_eeprom_parse_hw_cap routine + +Fixes: acf5457fd99db ("mt76: mt7615: read {tx,rx} mask from eeprom") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/eeprom.c +@@ -92,8 +92,9 @@ static int mt7615_check_eeprom(struct mt + + static void mt7615_eeprom_parse_hw_cap(struct mt7615_dev *dev) + { +- u8 val, *eeprom = dev->mt76.eeprom.data; ++ u8 *eeprom = dev->mt76.eeprom.data; + u8 tx_mask, rx_mask, max_nss; ++ u32 val; + + val = FIELD_GET(MT_EE_NIC_WIFI_CONF_BAND_SEL, + eeprom[MT_EE_WIFI_CONF]); diff --git a/queue-5.5/netdevsim-disable-devlink-reload-when-resources-are-being-used.patch b/queue-5.5/netdevsim-disable-devlink-reload-when-resources-are-being-used.patch new file mode 100644 index 00000000000..c43323a0755 --- /dev/null +++ b/queue-5.5/netdevsim-disable-devlink-reload-when-resources-are-being-used.patch @@ -0,0 +1,174 @@ +From 6ab63366e1ec4ec1900f253aa64727b4b5f4ee73 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sat, 1 Feb 2020 16:43:04 +0000 +Subject: netdevsim: disable devlink reload when resources are being used + +From: Taehee Yoo + +commit 6ab63366e1ec4ec1900f253aa64727b4b5f4ee73 upstream. + +devlink reload destroys resources and allocates resources again. +So, when devices and ports resources are being used, devlink reload +function should not be executed. In order to avoid this race, a new +lock is added and new_port() and del_port() call devlink_reload_disable() +and devlink_reload_enable(). + +Thread0 Thread1 +{new/del}_port() {new/del}_port() +devlink_reload_disable() + devlink_reload_disable() +devlink_reload_enable() + //here + devlink_reload_enable() + +Before Thread1's devlink_reload_enable(), the devlink is already allowed +to execute reload because Thread0 allows it. devlink reload disable/enable +variable type is bool. So the above case would exist. +So, disable/enable should be executed atomically. +In order to do that, a new lock is used. + +Test commands: + modprobe netdevsim + echo 1 > /sys/bus/netdevsim/new_device + while : + do + echo 1 > /sys/devices/netdevsim1/new_port & + echo 1 > /sys/devices/netdevsim1/del_port & + devlink dev reload netdevsim/netdevsim1 & + done + +Splat looks like: +[ 23.342145][ T932] DEBUG_LOCKS_WARN_ON(mutex_is_locked(lock)) +[ 23.342159][ T932] WARNING: CPU: 0 PID: 932 at kernel/locking/mutex-debug.c:103 mutex_destroy+0xc7/0xf0 +[ 23.344182][ T932] Modules linked in: netdevsim openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_dx +[ 23.346485][ T932] CPU: 0 PID: 932 Comm: devlink Not tainted 5.5.0+ #322 +[ 23.347696][ T932] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 23.348893][ T932] RIP: 0010:mutex_destroy+0xc7/0xf0 +[ 23.349505][ T932] Code: e0 07 83 c0 03 38 d0 7c 04 84 d2 75 2e 8b 05 00 ac b0 02 85 c0 75 8b 48 c7 c6 00 5e 07 96 40 +[ 23.351887][ T932] RSP: 0018:ffff88806208f810 EFLAGS: 00010286 +[ 23.353963][ T932] RAX: dffffc0000000008 RBX: ffff888067f6f2c0 RCX: ffffffff942c4bd4 +[ 23.355222][ T932] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff96dac5b4 +[ 23.356169][ T932] RBP: ffff888067f6f000 R08: fffffbfff2d235a5 R09: fffffbfff2d235a5 +[ 23.357160][ T932] R10: 0000000000000001 R11: fffffbfff2d235a4 R12: ffff888067f6f208 +[ 23.358288][ T932] R13: ffff88806208fa70 R14: ffff888067f6f000 R15: ffff888069ce3800 +[ 23.359307][ T932] FS: 00007fe2a3876740(0000) GS:ffff88806c000000(0000) knlGS:0000000000000000 +[ 23.360473][ T932] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 23.361319][ T932] CR2: 00005561357aa000 CR3: 000000005227a006 CR4: 00000000000606f0 +[ 23.362323][ T932] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 23.363417][ T932] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 23.364414][ T932] Call Trace: +[ 23.364828][ T932] nsim_dev_reload_destroy+0x77/0xb0 [netdevsim] +[ 23.365655][ T932] nsim_dev_reload_down+0x84/0xb0 [netdevsim] +[ 23.366433][ T932] devlink_reload+0xb1/0x350 +[ 23.367010][ T932] genl_rcv_msg+0x580/0xe90 + +[ ...] + +[ 23.531729][ T1305] kernel BUG at lib/list_debug.c:53! +[ 23.532523][ T1305] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI +[ 23.533467][ T1305] CPU: 2 PID: 1305 Comm: bash Tainted: G W 5.5.0+ #322 +[ 23.534962][ T1305] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 23.536503][ T1305] RIP: 0010:__list_del_entry_valid+0xe6/0x150 +[ 23.538346][ T1305] Code: 89 ea 48 c7 c7 00 73 1e 96 e8 df f7 4c ff 0f 0b 48 c7 c7 60 73 1e 96 e8 d1 f7 4c ff 0f 0b 44 +[ 23.541068][ T1305] RSP: 0018:ffff888047c27b58 EFLAGS: 00010282 +[ 23.542001][ T1305] RAX: 0000000000000054 RBX: ffff888067f6f318 RCX: 0000000000000000 +[ 23.543051][ T1305] RDX: 0000000000000054 RSI: 0000000000000008 RDI: ffffed1008f84f61 +[ 23.544072][ T1305] RBP: ffff88804aa0fca0 R08: ffffed100d940539 R09: ffffed100d940539 +[ 23.545085][ T1305] R10: 0000000000000001 R11: ffffed100d940538 R12: ffff888047c27cb0 +[ 23.546422][ T1305] R13: ffff88806208b840 R14: ffffffff981976c0 R15: ffff888067f6f2c0 +[ 23.547406][ T1305] FS: 00007f76c0431740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 +[ 23.548527][ T1305] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 23.549389][ T1305] CR2: 00007f5048f1a2f8 CR3: 000000004b310006 CR4: 00000000000606e0 +[ 23.550636][ T1305] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 23.551578][ T1305] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 23.552597][ T1305] Call Trace: +[ 23.553004][ T1305] mutex_remove_waiter+0x101/0x520 +[ 23.553646][ T1305] __mutex_lock+0xac7/0x14b0 +[ 23.554218][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] +[ 23.554908][ T1305] ? mutex_lock_io_nested+0x1380/0x1380 +[ 23.555570][ T1305] ? _parse_integer+0xf0/0xf0 +[ 23.556043][ T1305] ? kstrtouint+0x86/0x110 +[ 23.556504][ T1305] ? nsim_dev_port_del+0x4e/0x140 [netdevsim] +[ 23.557133][ T1305] nsim_dev_port_del+0x4e/0x140 [netdevsim] +[ 23.558024][ T1305] del_port_store+0xcc/0xf0 [netdevsim] +[ ... ] + +Fixes: 75ba029f3c07 ("netdevsim: implement proper devlink reload") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netdevsim/bus.c | 19 +++++++++++++++++++ + drivers/net/netdevsim/netdevsim.h | 2 ++ + 2 files changed, 21 insertions(+) + +--- a/drivers/net/netdevsim/bus.c ++++ b/drivers/net/netdevsim/bus.c +@@ -97,6 +97,8 @@ new_port_store(struct device *dev, struc + const char *buf, size_t count) + { + struct nsim_bus_dev *nsim_bus_dev = to_nsim_bus_dev(dev); ++ struct nsim_dev *nsim_dev = dev_get_drvdata(dev); ++ struct devlink *devlink; + unsigned int port_index; + int ret; + +@@ -106,7 +108,14 @@ new_port_store(struct device *dev, struc + ret = kstrtouint(buf, 0, &port_index); + if (ret) + return ret; ++ ++ devlink = priv_to_devlink(nsim_dev); ++ ++ mutex_lock(&nsim_bus_dev->nsim_bus_reload_lock); ++ devlink_reload_disable(devlink); + ret = nsim_dev_port_add(nsim_bus_dev, port_index); ++ devlink_reload_enable(devlink); ++ mutex_unlock(&nsim_bus_dev->nsim_bus_reload_lock); + return ret ? ret : count; + } + +@@ -117,6 +126,8 @@ del_port_store(struct device *dev, struc + const char *buf, size_t count) + { + struct nsim_bus_dev *nsim_bus_dev = to_nsim_bus_dev(dev); ++ struct nsim_dev *nsim_dev = dev_get_drvdata(dev); ++ struct devlink *devlink; + unsigned int port_index; + int ret; + +@@ -126,7 +137,14 @@ del_port_store(struct device *dev, struc + ret = kstrtouint(buf, 0, &port_index); + if (ret) + return ret; ++ ++ devlink = priv_to_devlink(nsim_dev); ++ ++ mutex_lock(&nsim_bus_dev->nsim_bus_reload_lock); ++ devlink_reload_disable(devlink); + ret = nsim_dev_port_del(nsim_bus_dev, port_index); ++ devlink_reload_enable(devlink); ++ mutex_unlock(&nsim_bus_dev->nsim_bus_reload_lock); + return ret ? ret : count; + } + +@@ -311,6 +329,7 @@ nsim_bus_dev_new(unsigned int id, unsign + nsim_bus_dev->dev.type = &nsim_bus_dev_type; + nsim_bus_dev->port_count = port_count; + nsim_bus_dev->initial_net = current->nsproxy->net_ns; ++ mutex_init(&nsim_bus_dev->nsim_bus_reload_lock); + /* Disallow using nsim_bus_dev */ + smp_store_release(&nsim_bus_dev->init, false); + +--- a/drivers/net/netdevsim/netdevsim.h ++++ b/drivers/net/netdevsim/netdevsim.h +@@ -240,6 +240,8 @@ struct nsim_bus_dev { + */ + unsigned int num_vfs; + struct nsim_vf_config *vfconfigs; ++ /* Lock for devlink->reload_enabled in netdevsim module */ ++ struct mutex nsim_bus_reload_lock; + bool init; + }; + diff --git a/queue-5.5/netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch b/queue-5.5/netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch new file mode 100644 index 00000000000..2e89747c8c4 --- /dev/null +++ b/queue-5.5/netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch @@ -0,0 +1,129 @@ +From 8526ad9646b17c59b6d430d8baa8f152a14fe177 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sat, 1 Feb 2020 16:43:13 +0000 +Subject: netdevsim: fix panic in nsim_dev_take_snapshot_write() + +From: Taehee Yoo + +commit 8526ad9646b17c59b6d430d8baa8f152a14fe177 upstream. + +nsim_dev_take_snapshot_write() uses nsim_dev and nsim_dev->dummy_region. +So, during this function, these data shouldn't be removed. +But there is no protecting stuff in this function. + +There are two similar cases. +1. reload case +reload could be called during nsim_dev_take_snapshot_write(). +When reload is being executed, nsim_dev_reload_down() is called and it +calls nsim_dev_reload_destroy(). nsim_dev_reload_destroy() calls +devlink_region_destroy() to destroy nsim_dev->dummy_region. +So, during nsim_dev_take_snapshot_write(), nsim_dev->dummy_region() +would be removed. +At this point, snapshot_write() would access freed pointer. +In order to fix this case, take_snapshot file will be removed before +devlink_region_destroy(). +The take_snapshot file will be re-created by ->reload_up(). + +2. del_device_store case +del_device_store() also could call nsim_dev_reload_destroy() +during nsim_dev_take_snapshot_write(). If so, panic would occur. +This problem is actually the same problem with the first case. +So, this problem will be fixed by the first case's solution. + +Test commands: + modprobe netdevsim + while : + do + echo 1 > /sys/bus/netdevsim/new_device & + echo 1 > /sys/bus/netdevsim/del_device & + devlink dev reload netdevsim/netdevsim1 & + echo 1 > /sys/kernel/debug/netdevsim/netdevsim1/take_snapshot & + done + +Splat looks like: +[ 45.564513][ T975] general protection fault, probably for non-canonical address 0xdffffc000000003a: 0000 [#1] SMP DEI +[ 45.566131][ T975] KASAN: null-ptr-deref in range [0x00000000000001d0-0x00000000000001d7] +[ 45.566135][ T975] CPU: 1 PID: 975 Comm: bash Not tainted 5.5.0+ #322 +[ 45.569020][ T975] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 45.569026][ T975] RIP: 0010:__mutex_lock+0x10a/0x14b0 +[ 45.570518][ T975] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f +[ 45.570522][ T975] RSP: 0018:ffff888046ccfbf0 EFLAGS: 00010206 +[ 45.572305][ T975] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 45.572308][ T975] RDX: 000000000000003a RSI: ffffffffac926440 RDI: 00000000000001d0 +[ 45.576843][ T975] RBP: ffff888046ccfd70 R08: ffffffffab610645 R09: 0000000000000000 +[ 45.576847][ T975] R10: ffff888046ccfd90 R11: ffffed100d6360ad R12: 0000000000000000 +[ 45.578471][ T975] R13: dffffc0000000000 R14: ffffffffae1976c0 R15: 0000000000000168 +[ 45.578475][ T975] FS: 00007f614d6e7740(0000) GS:ffff88806c400000(0000) knlGS:0000000000000000 +[ 45.581492][ T975] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 45.582942][ T975] CR2: 00005618677d1cf0 CR3: 000000005fb9c002 CR4: 00000000000606e0 +[ 45.584543][ T975] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 45.586633][ T975] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 45.589889][ T975] Call Trace: +[ 45.591445][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 +[ 45.601250][ T975] ? mutex_lock_io_nested+0x1380/0x1380 +[ 45.602817][ T975] ? mutex_lock_io_nested+0x1380/0x1380 +[ 45.603875][ T975] ? mark_held_locks+0xa5/0xe0 +[ 45.604769][ T975] ? _raw_spin_unlock_irqrestore+0x2d/0x50 +[ 45.606147][ T975] ? __mutex_unlock_slowpath+0xd0/0x670 +[ 45.607723][ T975] ? crng_backtrack_protect+0x80/0x80 +[ 45.613530][ T975] ? wait_for_completion+0x390/0x390 +[ 45.615152][ T975] ? devlink_region_snapshot_create+0x55/0x4a0 +[ 45.616834][ T975] devlink_region_snapshot_create+0x55/0x4a0 +[ ... ] + +Fixes: 4418f862d675 ("netdevsim: implement support for devlink region and snapshots") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netdevsim/dev.c | 13 +++++++++++-- + drivers/net/netdevsim/netdevsim.h | 1 + + 2 files changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/net/netdevsim/dev.c ++++ b/drivers/net/netdevsim/dev.c +@@ -88,8 +88,11 @@ static int nsim_dev_debugfs_init(struct + &nsim_dev->max_macs); + debugfs_create_bool("test1", 0600, nsim_dev->ddir, + &nsim_dev->test1); +- debugfs_create_file("take_snapshot", 0200, nsim_dev->ddir, nsim_dev, +- &nsim_dev_take_snapshot_fops); ++ nsim_dev->take_snapshot = debugfs_create_file("take_snapshot", ++ 0200, ++ nsim_dev->ddir, ++ nsim_dev, ++ &nsim_dev_take_snapshot_fops); + debugfs_create_bool("dont_allow_reload", 0600, nsim_dev->ddir, + &nsim_dev->dont_allow_reload); + debugfs_create_bool("fail_reload", 0600, nsim_dev->ddir, +@@ -740,6 +743,11 @@ static int nsim_dev_reload_create(struct + if (err) + goto err_health_exit; + ++ nsim_dev->take_snapshot = debugfs_create_file("take_snapshot", ++ 0200, ++ nsim_dev->ddir, ++ nsim_dev, ++ &nsim_dev_take_snapshot_fops); + return 0; + + err_health_exit: +@@ -853,6 +861,7 @@ static void nsim_dev_reload_destroy(stru + + if (devlink_is_reload_failed(devlink)) + return; ++ debugfs_remove(nsim_dev->take_snapshot); + nsim_dev_port_del_all(nsim_dev); + nsim_dev_health_exit(nsim_dev); + nsim_dev_traps_exit(devlink); +--- a/drivers/net/netdevsim/netdevsim.h ++++ b/drivers/net/netdevsim/netdevsim.h +@@ -160,6 +160,7 @@ struct nsim_dev { + struct nsim_trap_data *trap_data; + struct dentry *ddir; + struct dentry *ports_ddir; ++ struct dentry *take_snapshot; + struct bpf_offload_dev *bpf_dev; + bool bpf_bind_accept; + u32 bpf_bind_verifier_delay; diff --git a/queue-5.5/netdevsim-fix-using-uninitialized-resources.patch b/queue-5.5/netdevsim-fix-using-uninitialized-resources.patch new file mode 100644 index 00000000000..75a35257bb5 --- /dev/null +++ b/queue-5.5/netdevsim-fix-using-uninitialized-resources.patch @@ -0,0 +1,235 @@ +From f5cd21605ecd249e5fc715411df22cc1bc877b32 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sat, 1 Feb 2020 16:42:54 +0000 +Subject: netdevsim: fix using uninitialized resources + +From: Taehee Yoo + +commit f5cd21605ecd249e5fc715411df22cc1bc877b32 upstream. + +When module is being initialized, __init() calls bus_register() and +driver_register(). +These functions internally create various resources and sysfs files. +The sysfs files are used for basic operations(add/del device). +/sys/bus/netdevsim/new_device +/sys/bus/netdevsim/del_device + +These sysfs files use netdevsim resources, they are mostly allocated +and initialized in ->probe() function, which is nsim_dev_probe(). +But, sysfs files could be executed before ->probe() is finished. +So, accessing uninitialized data would occur. + +Another problem is very similar. +/sys/bus/netdevsim/new_device internally creates sysfs files. +/sys/devices/netdevsim/new_port +/sys/devices/netdevsim/del_port + +These sysfs files also use netdevsim resources, they are mostly allocated +and initialized in creating device routine, which is nsim_bus_dev_new(). +But they also could be executed before nsim_bus_dev_new() is finished. +So, accessing uninitialized data would occur. + +To fix these problems, this patch adds flags, which means whether the +operation is finished or not. +The flag variable 'nsim_bus_enable' means whether netdevsim bus was +initialized or not. +This is protected by nsim_bus_dev_list_lock. +The flag variable 'nsim_bus_dev->init' means whether nsim_bus_dev was +initialized or not. +This could be used in {new/del}_port_store() with no lock. + +Test commands: + #SHELL1 + modprobe netdevsim + while : + do + echo "1 1" > /sys/bus/netdevsim/new_device + echo "1 1" > /sys/bus/netdevsim/del_device + done + + #SHELL2 + while : + do + echo 1 > /sys/devices/netdevsim1/new_port + echo 1 > /sys/devices/netdevsim1/del_port + done + +Splat looks like: +[ 47.508954][ T1008] general protection fault, probably for non-canonical address 0xdffffc0000000021: 0000 I +[ 47.510793][ T1008] KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] +[ 47.511963][ T1008] CPU: 2 PID: 1008 Comm: bash Not tainted 5.5.0+ #322 +[ 47.512823][ T1008] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 47.514041][ T1008] RIP: 0010:__mutex_lock+0x10a/0x14b0 +[ 47.514699][ T1008] Code: 08 84 d2 0f 85 7f 12 00 00 44 8b 0d 10 23 65 02 45 85 c9 75 29 49 8d 7f 68 48 b8 00 00 00 0f +[ 47.517163][ T1008] RSP: 0018:ffff888059b4fbb0 EFLAGS: 00010206 +[ 47.517802][ T1008] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 47.518941][ T1008] RDX: 0000000000000021 RSI: ffffffff85926440 RDI: 0000000000000108 +[ 47.519732][ T1008] RBP: ffff888059b4fd30 R08: ffffffffc073fad0 R09: 0000000000000000 +[ 47.520729][ T1008] R10: ffff888059b4fd50 R11: ffff88804bb38040 R12: 0000000000000000 +[ 47.521702][ T1008] R13: dffffc0000000000 R14: ffffffff871976c0 R15: 00000000000000a0 +[ 47.522760][ T1008] FS: 00007fd4be05a740(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000 +[ 47.523877][ T1008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 47.524627][ T1008] CR2: 0000561c82b69cf0 CR3: 0000000065dd6004 CR4: 00000000000606e0 +[ 47.527662][ T1008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 47.528604][ T1008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 47.529531][ T1008] Call Trace: +[ 47.529874][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] +[ 47.530470][ T1008] ? mutex_lock_io_nested+0x1380/0x1380 +[ 47.531018][ T1008] ? _kstrtoull+0x76/0x160 +[ 47.531449][ T1008] ? _parse_integer+0xf0/0xf0 +[ 47.531874][ T1008] ? kernfs_fop_write+0x1cf/0x410 +[ 47.532330][ T1008] ? sysfs_file_ops+0x160/0x160 +[ 47.532773][ T1008] ? kstrtouint+0x86/0x110 +[ 47.533168][ T1008] ? nsim_dev_port_add+0x50/0x150 [netdevsim] +[ 47.533721][ T1008] nsim_dev_port_add+0x50/0x150 [netdevsim] +[ 47.534336][ T1008] ? sysfs_file_ops+0x160/0x160 +[ 47.534858][ T1008] new_port_store+0x99/0xb0 [netdevsim] +[ 47.535439][ T1008] ? del_port_store+0xb0/0xb0 [netdevsim] +[ 47.536035][ T1008] ? sysfs_file_ops+0x112/0x160 +[ 47.536544][ T1008] ? sysfs_kf_write+0x3b/0x180 +[ 47.537029][ T1008] kernfs_fop_write+0x276/0x410 +[ 47.537548][ T1008] ? __sb_start_write+0x215/0x2e0 +[ 47.538110][ T1008] vfs_write+0x197/0x4a0 +[ ... ] + +Fixes: f9d9db47d3ba ("netdevsim: add bus attributes to add new and delete devices") +Fixes: 794b2c05ca1c ("netdevsim: extend device attrs to support port addition and deletion") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netdevsim/bus.c | 43 +++++++++++++++++++++++++++++++++++--- + drivers/net/netdevsim/netdevsim.h | 1 + 2 files changed, 41 insertions(+), 3 deletions(-) + +--- a/drivers/net/netdevsim/bus.c ++++ b/drivers/net/netdevsim/bus.c +@@ -17,6 +17,7 @@ + static DEFINE_IDA(nsim_bus_dev_ids); + static LIST_HEAD(nsim_bus_dev_list); + static DEFINE_MUTEX(nsim_bus_dev_list_lock); ++static bool nsim_bus_enable; + + static struct nsim_bus_dev *to_nsim_bus_dev(struct device *dev) + { +@@ -99,6 +100,9 @@ new_port_store(struct device *dev, struc + unsigned int port_index; + int ret; + ++ /* Prevent to use nsim_bus_dev before initialization. */ ++ if (!smp_load_acquire(&nsim_bus_dev->init)) ++ return -EBUSY; + ret = kstrtouint(buf, 0, &port_index); + if (ret) + return ret; +@@ -116,6 +120,9 @@ del_port_store(struct device *dev, struc + unsigned int port_index; + int ret; + ++ /* Prevent to use nsim_bus_dev before initialization. */ ++ if (!smp_load_acquire(&nsim_bus_dev->init)) ++ return -EBUSY; + ret = kstrtouint(buf, 0, &port_index); + if (ret) + return ret; +@@ -179,15 +186,30 @@ new_device_store(struct bus_type *bus, c + pr_err("Format for adding new device is \"id port_count\" (uint uint).\n"); + return -EINVAL; + } +- nsim_bus_dev = nsim_bus_dev_new(id, port_count); +- if (IS_ERR(nsim_bus_dev)) +- return PTR_ERR(nsim_bus_dev); + + mutex_lock(&nsim_bus_dev_list_lock); ++ /* Prevent to use resource before initialization. */ ++ if (!smp_load_acquire(&nsim_bus_enable)) { ++ err = -EBUSY; ++ goto err; ++ } ++ ++ nsim_bus_dev = nsim_bus_dev_new(id, port_count); ++ if (IS_ERR(nsim_bus_dev)) { ++ err = PTR_ERR(nsim_bus_dev); ++ goto err; ++ } ++ ++ /* Allow using nsim_bus_dev */ ++ smp_store_release(&nsim_bus_dev->init, true); ++ + list_add_tail(&nsim_bus_dev->list, &nsim_bus_dev_list); + mutex_unlock(&nsim_bus_dev_list_lock); + + return count; ++err: ++ mutex_unlock(&nsim_bus_dev_list_lock); ++ return err; + } + static BUS_ATTR_WO(new_device); + +@@ -215,6 +237,11 @@ del_device_store(struct bus_type *bus, c + + err = -ENOENT; + mutex_lock(&nsim_bus_dev_list_lock); ++ /* Prevent to use resource before initialization. */ ++ if (!smp_load_acquire(&nsim_bus_enable)) { ++ mutex_unlock(&nsim_bus_dev_list_lock); ++ return -EBUSY; ++ } + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) { + if (nsim_bus_dev->dev.id != id) + continue; +@@ -284,6 +311,8 @@ nsim_bus_dev_new(unsigned int id, unsign + nsim_bus_dev->dev.type = &nsim_bus_dev_type; + nsim_bus_dev->port_count = port_count; + nsim_bus_dev->initial_net = current->nsproxy->net_ns; ++ /* Disallow using nsim_bus_dev */ ++ smp_store_release(&nsim_bus_dev->init, false); + + err = device_register(&nsim_bus_dev->dev); + if (err) +@@ -299,6 +328,8 @@ err_nsim_bus_dev_free: + + static void nsim_bus_dev_del(struct nsim_bus_dev *nsim_bus_dev) + { ++ /* Disallow using nsim_bus_dev */ ++ smp_store_release(&nsim_bus_dev->init, false); + device_unregister(&nsim_bus_dev->dev); + ida_free(&nsim_bus_dev_ids, nsim_bus_dev->dev.id); + kfree(nsim_bus_dev); +@@ -320,6 +351,8 @@ int nsim_bus_init(void) + err = driver_register(&nsim_driver); + if (err) + goto err_bus_unregister; ++ /* Allow using resources */ ++ smp_store_release(&nsim_bus_enable, true); + return 0; + + err_bus_unregister: +@@ -331,12 +364,16 @@ void nsim_bus_exit(void) + { + struct nsim_bus_dev *nsim_bus_dev, *tmp; + ++ /* Disallow using resources */ ++ smp_store_release(&nsim_bus_enable, false); ++ + mutex_lock(&nsim_bus_dev_list_lock); + list_for_each_entry_safe(nsim_bus_dev, tmp, &nsim_bus_dev_list, list) { + list_del(&nsim_bus_dev->list); + nsim_bus_dev_del(nsim_bus_dev); + } + mutex_unlock(&nsim_bus_dev_list_lock); ++ + driver_unregister(&nsim_driver); + bus_unregister(&nsim_bus); + } +--- a/drivers/net/netdevsim/netdevsim.h ++++ b/drivers/net/netdevsim/netdevsim.h +@@ -240,6 +240,7 @@ struct nsim_bus_dev { + */ + unsigned int num_vfs; + struct nsim_vf_config *vfconfigs; ++ bool init; + }; + + int nsim_bus_init(void); diff --git a/queue-5.5/netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch b/queue-5.5/netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch new file mode 100644 index 00000000000..7363d9fdec2 --- /dev/null +++ b/queue-5.5/netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch @@ -0,0 +1,89 @@ +From 83cf4213bafc4e3c747f0a25ad22cfbf55af7e84 Mon Sep 17 00:00:00 2001 +From: Taehee Yoo +Date: Sat, 1 Feb 2020 16:43:39 +0000 +Subject: netdevsim: use __GFP_NOWARN to avoid memalloc warning + +From: Taehee Yoo + +commit 83cf4213bafc4e3c747f0a25ad22cfbf55af7e84 upstream. + +vfnum buffer size and binary_len buffer size is received by user-space. +So, this buffer size could be too large. If so, kmalloc will internally +print a warning message. +This warning message is actually not necessary for the netdevsim module. +So, this patch adds __GFP_NOWARN. + +Test commands: + modprobe netdevsim + echo 1 > /sys/bus/netdevsim/new_device + echo 1000000000 > /sys/devices/netdevsim1/sriov_numvfs + +Splat looks like: +[ 357.847266][ T1000] WARNING: CPU: 0 PID: 1000 at mm/page_alloc.c:4738 __alloc_pages_nodemask+0x2f3/0x740 +[ 357.850273][ T1000] Modules linked in: netdevsim veth openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrx +[ 357.852989][ T1000] CPU: 0 PID: 1000 Comm: bash Tainted: G B 5.5.0-rc5+ #270 +[ 357.854334][ T1000] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +[ 357.855703][ T1000] RIP: 0010:__alloc_pages_nodemask+0x2f3/0x740 +[ 357.856669][ T1000] Code: 64 fe ff ff 65 48 8b 04 25 c0 0f 02 00 48 05 f0 12 00 00 41 be 01 00 00 00 49 89 47 0 +[ 357.860272][ T1000] RSP: 0018:ffff8880b7f47bd8 EFLAGS: 00010246 +[ 357.861009][ T1000] RAX: ffffed1016fe8f80 RBX: 1ffff11016fe8fae RCX: 0000000000000000 +[ 357.861843][ T1000] RDX: 0000000000000000 RSI: 0000000000000017 RDI: 0000000000000000 +[ 357.862661][ T1000] RBP: 0000000000040dc0 R08: 1ffff11016fe8f67 R09: dffffc0000000000 +[ 357.863509][ T1000] R10: ffff8880b7f47d68 R11: fffffbfff2798180 R12: 1ffff11016fe8f80 +[ 357.864355][ T1000] R13: 0000000000000017 R14: 0000000000000017 R15: ffff8880c2038d68 +[ 357.865178][ T1000] FS: 00007fd9a5b8c740(0000) GS:ffff8880d9c00000(0000) knlGS:0000000000000000 +[ 357.866248][ T1000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 357.867531][ T1000] CR2: 000055ce01ba8100 CR3: 00000000b7dbe005 CR4: 00000000000606f0 +[ 357.868972][ T1000] Call Trace: +[ 357.869423][ T1000] ? lock_contended+0xcd0/0xcd0 +[ 357.870001][ T1000] ? __alloc_pages_slowpath+0x21d0/0x21d0 +[ 357.870673][ T1000] ? _kstrtoull+0x76/0x160 +[ 357.871148][ T1000] ? alloc_pages_current+0xc1/0x1a0 +[ 357.871704][ T1000] kmalloc_order+0x22/0x80 +[ 357.872184][ T1000] kmalloc_order_trace+0x1d/0x140 +[ 357.872733][ T1000] __kmalloc+0x302/0x3a0 +[ 357.873204][ T1000] nsim_bus_dev_numvfs_store+0x1ab/0x260 [netdevsim] +[ 357.873919][ T1000] ? kernfs_get_active+0x12c/0x180 +[ 357.874459][ T1000] ? new_device_store+0x450/0x450 [netdevsim] +[ 357.875111][ T1000] ? kernfs_get_parent+0x70/0x70 +[ 357.875632][ T1000] ? sysfs_file_ops+0x160/0x160 +[ 357.876152][ T1000] kernfs_fop_write+0x276/0x410 +[ 357.876680][ T1000] ? __sb_start_write+0x1ba/0x2e0 +[ 357.877225][ T1000] vfs_write+0x197/0x4a0 +[ 357.877671][ T1000] ksys_write+0x141/0x1d0 +[ ... ] + +Reviewed-by: Jakub Kicinski +Fixes: 79579220566c ("netdevsim: add SR-IOV functionality") +Fixes: 82c93a87bf8b ("netdevsim: implement couple of testing devlink health reporters") +Signed-off-by: Taehee Yoo +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/netdevsim/bus.c | 2 +- + drivers/net/netdevsim/health.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/netdevsim/bus.c ++++ b/drivers/net/netdevsim/bus.c +@@ -29,7 +29,7 @@ static int nsim_bus_dev_vfs_enable(struc + { + nsim_bus_dev->vfconfigs = kcalloc(num_vfs, + sizeof(struct nsim_vf_config), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (!nsim_bus_dev->vfconfigs) + return -ENOMEM; + nsim_bus_dev->num_vfs = num_vfs; +--- a/drivers/net/netdevsim/health.c ++++ b/drivers/net/netdevsim/health.c +@@ -82,7 +82,7 @@ static int nsim_dev_dummy_fmsg_put(struc + if (err) + return err; + +- binary = kmalloc(binary_len, GFP_KERNEL); ++ binary = kmalloc(binary_len, GFP_KERNEL | __GFP_NOWARN); + if (!binary) + return -ENOMEM; + get_random_bytes(binary, binary_len); diff --git a/queue-5.5/platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch b/queue-5.5/platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch new file mode 100644 index 00000000000..af7fa45c074 --- /dev/null +++ b/queue-5.5/platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch @@ -0,0 +1,40 @@ +From 5e0c94d3aeeecc68c573033f08d9678fecf253bd Mon Sep 17 00:00:00 2001 +From: Mika Westerberg +Date: Wed, 22 Jan 2020 19:05:20 +0300 +Subject: platform/x86: intel_mid_powerbtn: Take a copy of ddata + +From: Mika Westerberg + +commit 5e0c94d3aeeecc68c573033f08d9678fecf253bd upstream. + +The driver gets driver_data from memory that is marked as const (which +is probably put to read-only memory) and it then modifies it. This +likely causes some sort of fault to happen. + +Fix this by taking a copy of the structure. + +Fixes: c94a8ff14de3 ("platform/x86: intel_mid_powerbtn: make mid_pb_ddata const") +Signed-off-by: Mika Westerberg +Reviewed-by: Andy Shevchenko +Signed-off-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/platform/x86/intel_mid_powerbtn.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/platform/x86/intel_mid_powerbtn.c ++++ b/drivers/platform/x86/intel_mid_powerbtn.c +@@ -146,9 +146,10 @@ static int mid_pb_probe(struct platform_ + + input_set_capability(input, EV_KEY, KEY_POWER); + +- ddata = (struct mid_pb_ddata *)id->driver_data; ++ ddata = devm_kmemdup(&pdev->dev, (void *)id->driver_data, ++ sizeof(*ddata), GFP_KERNEL); + if (!ddata) +- return -ENODATA; ++ return -ENOMEM; + + ddata->dev = &pdev->dev; + ddata->irq = irq; diff --git a/queue-5.5/powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch b/queue-5.5/powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch new file mode 100644 index 00000000000..90cea75bbe0 --- /dev/null +++ b/queue-5.5/powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch @@ -0,0 +1,44 @@ +From 5649607a8d0b0e019a4db14aab3de1e16c3a2b4f Mon Sep 17 00:00:00 2001 +From: Vaibhav Jain +Date: Wed, 22 Jan 2020 21:21:40 +0530 +Subject: powerpc/papr_scm: Fix leaking 'bus_desc.provider_name' in some paths + +From: Vaibhav Jain + +commit 5649607a8d0b0e019a4db14aab3de1e16c3a2b4f upstream. + +String 'bus_desc.provider_name' allocated inside +papr_scm_nvdimm_init() will leaks in case call to +nvdimm_bus_register() fails or when papr_scm_remove() is called. + +This minor patch ensures that 'bus_desc.provider_name' is freed in +error path for nvdimm_bus_register() as well as in papr_scm_remove(). + +Fixes: b5beae5e224f ("powerpc/pseries: Add driver for PAPR SCM regions") +Signed-off-by: Vaibhav Jain +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200122155140.120429-1-vaibhav@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/pseries/papr_scm.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -322,6 +322,7 @@ static int papr_scm_nvdimm_init(struct p + p->bus = nvdimm_bus_register(NULL, &p->bus_desc); + if (!p->bus) { + dev_err(dev, "Error creating nvdimm bus %pOF\n", p->dn); ++ kfree(p->bus_desc.provider_name); + return -ENXIO; + } + +@@ -477,6 +478,7 @@ static int papr_scm_remove(struct platfo + + nvdimm_bus_unregister(p->bus); + drc_pmem_unbind(p); ++ kfree(p->bus_desc.provider_name); + kfree(p); + + return 0; diff --git a/queue-5.5/powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch b/queue-5.5/powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch new file mode 100644 index 00000000000..27161862a8c --- /dev/null +++ b/queue-5.5/powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch @@ -0,0 +1,155 @@ +From 7559d3d295f3365ea7ac0c0274c05e633fe4f594 Mon Sep 17 00:00:00 2001 +From: Alexey Kardashevskiy +Date: Mon, 16 Dec 2019 15:19:22 +1100 +Subject: powerpc/pseries: Allow not having ibm, hypertas-functions::hcall-multi-tce for DDW + +From: Alexey Kardashevskiy + +commit 7559d3d295f3365ea7ac0c0274c05e633fe4f594 upstream. + +By default a pseries guest supports a H_PUT_TCE hypercall which maps +a single IOMMU page in a DMA window. Additionally the hypervisor may +support H_PUT_TCE_INDIRECT/H_STUFF_TCE which update multiple TCEs at once; +this is advertised via the device tree /rtas/ibm,hypertas-functions +property which Linux converts to FW_FEATURE_MULTITCE. + +FW_FEATURE_MULTITCE is checked when dma_iommu_ops is used; however +the code managing the huge DMA window (DDW) ignores it and calls +H_PUT_TCE_INDIRECT even if it is explicitly disabled via +the "multitce=off" kernel command line parameter. + +This adds FW_FEATURE_MULTITCE checking to the DDW code path. + +This changes tce_build_pSeriesLP to take liobn and page size as +the huge window does not have iommu_table descriptor which usually +the place to store these numbers. + +Fixes: 4e8b0cf46b25 ("powerpc/pseries: Add support for dynamic dma windows") +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: Thiago Jung Bauermann +Tested-by: Thiago Jung Bauermann +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191216041924.42318-3-aik@ozlabs.ru +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/pseries/iommu.c | 43 ++++++++++++++++++++++----------- + 1 file changed, 29 insertions(+), 14 deletions(-) + +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -132,10 +132,10 @@ static unsigned long tce_get_pseries(str + return be64_to_cpu(*tcep); + } + +-static void tce_free_pSeriesLP(struct iommu_table*, long, long); ++static void tce_free_pSeriesLP(unsigned long liobn, long, long); + static void tce_freemulti_pSeriesLP(struct iommu_table*, long, long); + +-static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, ++static int tce_build_pSeriesLP(unsigned long liobn, long tcenum, long tceshift, + long npages, unsigned long uaddr, + enum dma_data_direction direction, + unsigned long attrs) +@@ -146,25 +146,25 @@ static int tce_build_pSeriesLP(struct io + int ret = 0; + long tcenum_start = tcenum, npages_start = npages; + +- rpn = __pa(uaddr) >> TCE_SHIFT; ++ rpn = __pa(uaddr) >> tceshift; + proto_tce = TCE_PCI_READ; + if (direction != DMA_TO_DEVICE) + proto_tce |= TCE_PCI_WRITE; + + while (npages--) { +- tce = proto_tce | (rpn & TCE_RPN_MASK) << TCE_RPN_SHIFT; +- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, tce); ++ tce = proto_tce | (rpn & TCE_RPN_MASK) << tceshift; ++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << tceshift, tce); + + if (unlikely(rc == H_NOT_ENOUGH_RESOURCES)) { + ret = (int)rc; +- tce_free_pSeriesLP(tbl, tcenum_start, ++ tce_free_pSeriesLP(liobn, tcenum_start, + (npages_start - (npages + 1))); + break; + } + + if (rc && printk_ratelimit()) { + printk("tce_build_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc); +- printk("\tindex = 0x%llx\n", (u64)tbl->it_index); ++ printk("\tindex = 0x%llx\n", (u64)liobn); + printk("\ttcenum = 0x%llx\n", (u64)tcenum); + printk("\ttce val = 0x%llx\n", tce ); + dump_stack(); +@@ -193,7 +193,8 @@ static int tce_buildmulti_pSeriesLP(stru + unsigned long flags; + + if ((npages == 1) || !firmware_has_feature(FW_FEATURE_MULTITCE)) { +- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, ++ return tce_build_pSeriesLP(tbl->it_index, tcenum, ++ tbl->it_page_shift, npages, uaddr, + direction, attrs); + } + +@@ -209,8 +210,9 @@ static int tce_buildmulti_pSeriesLP(stru + /* If allocation fails, fall back to the loop implementation */ + if (!tcep) { + local_irq_restore(flags); +- return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, +- direction, attrs); ++ return tce_build_pSeriesLP(tbl->it_index, tcenum, ++ tbl->it_page_shift, ++ npages, uaddr, direction, attrs); + } + __this_cpu_write(tce_page, tcep); + } +@@ -261,16 +263,16 @@ static int tce_buildmulti_pSeriesLP(stru + return ret; + } + +-static void tce_free_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages) ++static void tce_free_pSeriesLP(unsigned long liobn, long tcenum, long npages) + { + u64 rc; + + while (npages--) { +- rc = plpar_tce_put((u64)tbl->it_index, (u64)tcenum << 12, 0); ++ rc = plpar_tce_put((u64)liobn, (u64)tcenum << 12, 0); + + if (rc && printk_ratelimit()) { + printk("tce_free_pSeriesLP: plpar_tce_put failed. rc=%lld\n", rc); +- printk("\tindex = 0x%llx\n", (u64)tbl->it_index); ++ printk("\tindex = 0x%llx\n", (u64)liobn); + printk("\ttcenum = 0x%llx\n", (u64)tcenum); + dump_stack(); + } +@@ -285,7 +287,7 @@ static void tce_freemulti_pSeriesLP(stru + u64 rc; + + if (!firmware_has_feature(FW_FEATURE_MULTITCE)) +- return tce_free_pSeriesLP(tbl, tcenum, npages); ++ return tce_free_pSeriesLP(tbl->it_index, tcenum, npages); + + rc = plpar_tce_stuff((u64)tbl->it_index, (u64)tcenum << 12, 0, npages); + +@@ -400,6 +402,19 @@ static int tce_setrange_multi_pSeriesLP( + u64 rc = 0; + long l, limit; + ++ if (!firmware_has_feature(FW_FEATURE_MULTITCE)) { ++ unsigned long tceshift = be32_to_cpu(maprange->tce_shift); ++ unsigned long dmastart = (start_pfn << PAGE_SHIFT) + ++ be64_to_cpu(maprange->dma_base); ++ unsigned long tcenum = dmastart >> tceshift; ++ unsigned long npages = num_pfn << PAGE_SHIFT >> tceshift; ++ void *uaddr = __va(start_pfn << PAGE_SHIFT); ++ ++ return tce_build_pSeriesLP(be32_to_cpu(maprange->liobn), ++ tcenum, tceshift, npages, (unsigned long) uaddr, ++ DMA_BIDIRECTIONAL, 0); ++ } ++ + local_irq_disable(); /* to protect tcep and the page behind it */ + tcep = __this_cpu_read(tce_page); + diff --git a/queue-5.5/powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch b/queue-5.5/powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch new file mode 100644 index 00000000000..1e7552ff38b --- /dev/null +++ b/queue-5.5/powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch @@ -0,0 +1,62 @@ +From aff8c8242bc638ba57247ae1ec5f272ac3ed3b92 Mon Sep 17 00:00:00 2001 +From: Tyrel Datwyler +Date: Mon, 20 Jan 2020 14:10:02 -0800 +Subject: powerpc/pseries/vio: Fix iommu_table use-after-free refcount warning + +From: Tyrel Datwyler + +commit aff8c8242bc638ba57247ae1ec5f272ac3ed3b92 upstream. + +Commit e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to +iommu_table") missed an iommu_table allocation in the pseries vio code. +The iommu_table is allocated with kzalloc and as a result the associated +kref gets a value of zero. This has the side effect that during a DLPAR +remove of the associated virtual IOA the iommu_tce_table_put() triggers +a use-after-free underflow warning. + +Call Trace: +[c0000002879e39f0] [c00000000071ecb4] refcount_warn_saturate+0x184/0x190 +(unreliable) +[c0000002879e3a50] [c0000000000500ac] iommu_tce_table_put+0x9c/0xb0 +[c0000002879e3a70] [c0000000000f54e4] vio_dev_release+0x34/0x70 +[c0000002879e3aa0] [c00000000087cfa4] device_release+0x54/0xf0 +[c0000002879e3b10] [c000000000d64c84] kobject_cleanup+0xa4/0x240 +[c0000002879e3b90] [c00000000087d358] put_device+0x28/0x40 +[c0000002879e3bb0] [c0000000007a328c] dlpar_remove_slot+0x15c/0x250 +[c0000002879e3c50] [c0000000007a348c] remove_slot_store+0xac/0xf0 +[c0000002879e3cd0] [c000000000d64220] kobj_attr_store+0x30/0x60 +[c0000002879e3cf0] [c0000000004ff13c] sysfs_kf_write+0x6c/0xa0 +[c0000002879e3d10] [c0000000004fde4c] kernfs_fop_write+0x18c/0x260 +[c0000002879e3d60] [c000000000410f3c] __vfs_write+0x3c/0x70 +[c0000002879e3d80] [c000000000415408] vfs_write+0xc8/0x250 +[c0000002879e3dd0] [c0000000004157dc] ksys_write+0x7c/0x120 +[c0000002879e3e20] [c00000000000b278] system_call+0x5c/0x68 + +Further, since the refcount was always zero the iommu_tce_table_put() +fails to call the iommu_table release function resulting in a leak. + +Fix this issue be initilizing the iommu_table kref immediately after +allocation. + +Fixes: e5afdf9dd515 ("powerpc/vfio_spapr_tce: Add reference counting to iommu_table") +Signed-off-by: Tyrel Datwyler +Reviewed-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1579558202-26052-1-git-send-email-tyreld@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/pseries/vio.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/powerpc/platforms/pseries/vio.c ++++ b/arch/powerpc/platforms/pseries/vio.c +@@ -1176,6 +1176,8 @@ static struct iommu_table *vio_build_iom + if (tbl == NULL) + return NULL; + ++ kref_init(&tbl->it_kref); ++ + of_parse_dma_window(dev->dev.of_node, dma_window, + &tbl->it_index, &offset, &size); + diff --git a/queue-5.5/powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch b/queue-5.5/powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch new file mode 100644 index 00000000000..361bbafaa7b --- /dev/null +++ b/queue-5.5/powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch @@ -0,0 +1,32 @@ +From e26ad936dd89d79f66c2b567f700e0c2a7103070 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Tue, 14 Jan 2020 08:13:08 +0000 +Subject: powerpc/ptdump: Fix W+X verification call in mark_rodata_ro() + +From: Christophe Leroy + +commit e26ad936dd89d79f66c2b567f700e0c2a7103070 upstream. + +ptdump_check_wx() also have to be called when pages are mapped +by blocks. + +Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/37517da8310f4457f28921a4edb88fb21d27b62a.1578989531.git.christophe.leroy@c-s.fr +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/mm/pgtable_32.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/mm/pgtable_32.c ++++ b/arch/powerpc/mm/pgtable_32.c +@@ -218,6 +218,7 @@ void mark_rodata_ro(void) + + if (v_block_mapped((unsigned long)_sinittext)) { + mmu_mark_rodata_ro(); ++ ptdump_check_wx(); + return; + } + diff --git a/queue-5.5/powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch b/queue-5.5/powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch new file mode 100644 index 00000000000..4a4cb5b615e --- /dev/null +++ b/queue-5.5/powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch @@ -0,0 +1,33 @@ +From f509247b08f2dcf7754d9ed85ad69a7972aa132b Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Tue, 14 Jan 2020 08:13:10 +0000 +Subject: powerpc/ptdump: Only enable PPC_CHECK_WX with STRICT_KERNEL_RWX + +From: Christophe Leroy + +commit f509247b08f2dcf7754d9ed85ad69a7972aa132b upstream. + +ptdump_check_wx() is called from mark_rodata_ro() which only exists +when CONFIG_STRICT_KERNEL_RWX is selected. + +Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/922d4939c735c6b52b4137838bcc066fffd4fc33.1578989545.git.christophe.leroy@c-s.fr +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/Kconfig.debug | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/Kconfig.debug ++++ b/arch/powerpc/Kconfig.debug +@@ -371,7 +371,7 @@ config PPC_PTDUMP + + config PPC_DEBUG_WX + bool "Warn on W+X mappings at boot" +- depends on PPC_PTDUMP ++ depends on PPC_PTDUMP && STRICT_KERNEL_RWX + help + Generate a warning if any W+X mappings are found at boot. + diff --git a/queue-5.5/revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch b/queue-5.5/revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch new file mode 100644 index 00000000000..47b1aab6e28 --- /dev/null +++ b/queue-5.5/revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch @@ -0,0 +1,57 @@ +From d862b44133b7a1d7de25288e09eabf4df415e971 Mon Sep 17 00:00:00 2001 +From: Ram Pai +Date: Mon, 16 Dec 2019 15:19:21 +1100 +Subject: Revert "powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests" + +From: Ram Pai + +commit d862b44133b7a1d7de25288e09eabf4df415e971 upstream. + +This reverts commit edea902c1c1efb855f77e041f9daf1abe7a9768a. + +At the time the change allowed direct DMA ops for secure VMs; however +since then we switched on using SWIOTLB backed with IOMMU (direct mapping) +and to make this work, we need dma_iommu_ops which handles all cases +including TCE mapping I/O pages in the presence of an IOMMU. + +Fixes: edea902c1c1e ("powerpc/pseries/iommu: Don't use dma_iommu_ops on secure guests") +Signed-off-by: Ram Pai +[aik: added "revert" and "fixes:"] +Signed-off-by: Alexey Kardashevskiy +Reviewed-by: Thiago Jung Bauermann +Tested-by: Thiago Jung Bauermann +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20191216041924.42318-2-aik@ozlabs.ru +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/platforms/pseries/iommu.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +--- a/arch/powerpc/platforms/pseries/iommu.c ++++ b/arch/powerpc/platforms/pseries/iommu.c +@@ -36,7 +36,6 @@ + #include + #include + #include +-#include + + #include "pseries.h" + +@@ -1320,15 +1319,7 @@ void iommu_init_early_pSeries(void) + of_reconfig_notifier_register(&iommu_reconfig_nb); + register_memory_notifier(&iommu_mem_nb); + +- /* +- * Secure guest memory is inacessible to devices so regular DMA isn't +- * possible. +- * +- * In that case keep devices' dma_map_ops as NULL so that the generic +- * DMA code path will use SWIOTLB to bounce buffers for DMA. +- */ +- if (!is_secure_guest()) +- set_pci_dma_ops(&dma_iommu_ops); ++ set_pci_dma_ops(&dma_iommu_ops); + } + + static int __init disable_multitce(char *str) diff --git a/queue-5.5/rtc-cmos-stop-using-shared-irq.patch b/queue-5.5/rtc-cmos-stop-using-shared-irq.patch new file mode 100644 index 00000000000..68e1cdff7b7 --- /dev/null +++ b/queue-5.5/rtc-cmos-stop-using-shared-irq.patch @@ -0,0 +1,79 @@ +From b6da197a2e9670df6f07e6698629e9ce95ab614e Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Thu, 23 Jan 2020 15:14:35 +0200 +Subject: rtc: cmos: Stop using shared IRQ + +From: Andy Shevchenko + +commit b6da197a2e9670df6f07e6698629e9ce95ab614e upstream. + +As reported by Guilherme G. Piccoli: + +---8<---8<---8<--- + +The rtc-cmos interrupt setting was changed in the commit 079062b28fb4 +("rtc: cmos: prevent kernel warning on IRQ flags mismatch") in order +to allow shared interrupts; according to that commit's description, +some machine got kernel warnings due to the interrupt line being shared +between rtc-cmos and other hardware, and rtc-cmos didn't allow IRQ sharing +that time. + +After the aforementioned commit though it was observed a huge increase +in lost HPET interrupts in some systems, observed through the following +kernel message: + +[...] hpet1: lost 35 rtc interrupts + +After investigation, it was narrowed down to the shared interrupts +usage when having the kernel option "irqpoll" enabled. In this case, +all IRQ handlers are called for non-timer interrupts, if such handlers +are setup in shared IRQ lines. The rtc-cmos IRQ handler could be set to +hpet_rtc_interrupt(), which will produce the kernel "lost interrupts" +message after doing work - lots of readl/writel to HPET registers, which +are known to be slow. + +Although "irqpoll" is not a default kernel option, it's used in some contexts, +one being the kdump kernel (which is an already "impaired" kernel usually +running with 1 CPU available), so the performance burden could be considerable. +Also, the same issue would happen (in a shorter extent though) when using +"irqfixup" kernel option. + +In a quick experiment, a virtual machine with uptime of 2 minutes produced +>300 calls to hpet_rtc_interrupt() when "irqpoll" was set, whereas without +sharing interrupts this number reduced to 1 interrupt. Machines with more +hardware than a VM should generate even more unnecessary HPET interrupts +in this scenario. + +---8<---8<---8<--- + +After looking into the rtc-cmos driver history and DSDT table from +the Microsoft Surface 3, we may notice that Hans de Goede submitted +a correct fix (see dependency below). Thus, we simply revert +the culprit commit. + +Fixes: 079062b28fb4 ("rtc: cmos: prevent kernel warning on IRQ flags mismatch") +Depends-on: a1e23a42f1bd ("rtc: cmos: Do not assume irq 8 for rtc when there are no legacy irqs") +Reported-by: Guilherme G. Piccoli +Cc: Hans de Goede +Signed-off-by: Andy Shevchenko +Tested-by: Guilherme G. Piccoli +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20200123131437.28157-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-cmos.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-cmos.c ++++ b/drivers/rtc/rtc-cmos.c +@@ -850,7 +850,7 @@ cmos_do_probe(struct device *dev, struct + rtc_cmos_int_handler = cmos_interrupt; + + retval = request_irq(rtc_irq, rtc_cmos_int_handler, +- IRQF_SHARED, dev_name(&cmos_rtc.rtc->dev), ++ 0, dev_name(&cmos_rtc.rtc->dev), + cmos_rtc.rtc); + if (retval < 0) { + dev_dbg(dev, "IRQ %d is already in use\n", rtc_irq); diff --git a/queue-5.5/rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch b/queue-5.5/rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch new file mode 100644 index 00000000000..75d6be7cc97 --- /dev/null +++ b/queue-5.5/rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch @@ -0,0 +1,35 @@ +From f236a2a2ebabad0848ad0995af7ad1dc7029e895 Mon Sep 17 00:00:00 2001 +From: Paul Kocialkowski +Date: Thu, 12 Dec 2019 16:31:10 +0100 +Subject: rtc: hym8563: Return -EINVAL if the time is known to be invalid + +From: Paul Kocialkowski + +commit f236a2a2ebabad0848ad0995af7ad1dc7029e895 upstream. + +The current code returns -EPERM when the voltage loss bit is set. +Since the bit indicates that the time value is not valid, return +-EINVAL instead, which is the appropriate error code for this +situation. + +Fixes: dcaf03849352 ("rtc: add hym8563 rtc-driver") +Signed-off-by: Paul Kocialkowski +Link: https://lore.kernel.org/r/20191212153111.966923-1-paul.kocialkowski@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-hym8563.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/rtc/rtc-hym8563.c ++++ b/drivers/rtc/rtc-hym8563.c +@@ -97,7 +97,7 @@ static int hym8563_rtc_read_time(struct + + if (!hym8563->valid) { + dev_warn(&client->dev, "no valid clock/calendar values available\n"); +- return -EPERM; ++ return -EINVAL; + } + + ret = i2c_smbus_read_i2c_block_data(client, HYM8563_SEC, 7, buf); diff --git a/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch b/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch new file mode 100644 index 00000000000..e0819e08fe2 --- /dev/null +++ b/queue-5.5/rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch @@ -0,0 +1,70 @@ +From 34719de919af07682861cb0fa2bcf64da33ecf44 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Sun, 12 Jan 2020 18:13:49 +0100 +Subject: rtc: i2c/spi: Avoid inclusion of REGMAP support when not needed + +From: Geert Uytterhoeven + +commit 34719de919af07682861cb0fa2bcf64da33ecf44 upstream. + +Merely enabling I2C and RTC selects REGMAP_I2C and REGMAP_SPI, even when +no driver needs it. While the former can be moduler, the latter cannot, +and thus becomes built-in. + +Fix this by moving the select statements for REGMAP_I2C and REGMAP_SPI +from the RTC_I2C_AND_SPI helper to the individual drivers that depend on +it. + +Note that the comment for RTC_I2C_AND_SPI refers to SND_SOC_I2C_AND_SPI +for more information, but the latter does not select REGMAP_{I2C,SPI} +itself, and defers that to the individual drivers, too. + +Fixes: 080481f54ef62121 ("rtc: merge ds3232 and ds3234") +Signed-off-by: Geert Uytterhoeven +Reported-by: kbuild test robot +Reported-by: kbuild test robot +Link: https://lore.kernel.org/r/20200112171349.22268-1-geert@linux-m68k.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/Kconfig | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/Kconfig ++++ b/drivers/rtc/Kconfig +@@ -848,14 +848,14 @@ config RTC_I2C_AND_SPI + default m if I2C=m + default y if I2C=y + default y if SPI_MASTER=y +- select REGMAP_I2C if I2C +- select REGMAP_SPI if SPI_MASTER + + comment "SPI and I2C RTC drivers" + + config RTC_DRV_DS3232 + tristate "Dallas/Maxim DS3232/DS3234" + depends on RTC_I2C_AND_SPI ++ select REGMAP_I2C if I2C ++ select REGMAP_SPI if SPI_MASTER + help + If you say yes here you get support for Dallas Semiconductor + DS3232 and DS3234 real-time clock chips. If an interrupt is associated +@@ -875,6 +875,8 @@ config RTC_DRV_DS3232_HWMON + config RTC_DRV_PCF2127 + tristate "NXP PCF2127" + depends on RTC_I2C_AND_SPI ++ select REGMAP_I2C if I2C ++ select REGMAP_SPI if SPI_MASTER + select WATCHDOG_CORE if WATCHDOG + help + If you say yes here you get support for the NXP PCF2127/29 RTC +@@ -891,6 +893,8 @@ config RTC_DRV_PCF2127 + config RTC_DRV_RV3029C2 + tristate "Micro Crystal RV3029/3049" + depends on RTC_I2C_AND_SPI ++ select REGMAP_I2C if I2C ++ select REGMAP_SPI if SPI_MASTER + help + If you say yes here you get support for the Micro Crystal + RV3029 and RV3049 RTC chips. diff --git a/queue-5.5/rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch b/queue-5.5/rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch new file mode 100644 index 00000000000..8073e7143de --- /dev/null +++ b/queue-5.5/rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch @@ -0,0 +1,43 @@ +From 751438bc0f10f75633144acd6ff145f7260706d5 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Wed, 13 Nov 2019 02:17:20 +0000 +Subject: rtc: mt6397: drop free_irq of devm_ allocated irq + +From: Wei Yongjun + +commit 751438bc0f10f75633144acd6ff145f7260706d5 upstream. + +The devm_request_threaded_irq function allocates irq that is +released when a driver detaches. Thus, there is no reason to +explicitly call free_irq in probe function. + +Fixes: 851b87148aa2 ("rtc: mt6397: improvements of rtc driver") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20191113021720.9527-1-weiyongjun1@huawei.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-mt6397.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +--- a/drivers/rtc/rtc-mt6397.c ++++ b/drivers/rtc/rtc-mt6397.c +@@ -297,15 +297,7 @@ static int mtk_rtc_probe(struct platform + + rtc->rtc_dev->ops = &mtk_rtc_ops; + +- ret = rtc_register_device(rtc->rtc_dev); +- if (ret) +- goto out_free_irq; +- +- return 0; +- +-out_free_irq: +- free_irq(rtc->irq, rtc); +- return ret; ++ return rtc_register_device(rtc->rtc_dev); + } + + #ifdef CONFIG_PM_SLEEP diff --git a/queue-5.5/selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch b/queue-5.5/selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch new file mode 100644 index 00000000000..928f5a0387e --- /dev/null +++ b/queue-5.5/selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch @@ -0,0 +1,106 @@ +From 5d3919a953c3c96c02fc7a337f8376cde43ae31f Mon Sep 17 00:00:00 2001 +From: Jakub Sitnicki +Date: Thu, 6 Feb 2020 12:16:52 +0100 +Subject: selftests/bpf: Test freeing sockmap/sockhash with a socket in it + +From: Jakub Sitnicki + +commit 5d3919a953c3c96c02fc7a337f8376cde43ae31f upstream. + +Commit 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear +down") introduced sleeping issues inside RCU critical sections and while +holding a spinlock on sockmap/sockhash tear-down. There has to be at least +one socket in the map for the problem to surface. + +This adds a test that triggers the warnings for broken locking rules. Not a +fix per se, but rather tooling to verify the accompanying fixes. Run on a +VM with 1 vCPU to reproduce the warnings. + +Fixes: 7e81a3530206 ("bpf: Sockmap, ensure sock lock held during tear down") +Signed-off-by: Jakub Sitnicki +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20200206111652.694507-4-jakub@cloudflare.com +Signed-off-by: Greg Kroah-Hartman + +--- + tools/testing/selftests/bpf/prog_tests/sockmap_basic.c | 74 +++++++++++++++++ + 1 file changed, 74 insertions(+) + +--- /dev/null ++++ b/tools/testing/selftests/bpf/prog_tests/sockmap_basic.c +@@ -0,0 +1,74 @@ ++// SPDX-License-Identifier: GPL-2.0 ++// Copyright (c) 2020 Cloudflare ++ ++#include "test_progs.h" ++ ++static int connected_socket_v4(void) ++{ ++ struct sockaddr_in addr = { ++ .sin_family = AF_INET, ++ .sin_port = htons(80), ++ .sin_addr = { inet_addr("127.0.0.1") }, ++ }; ++ socklen_t len = sizeof(addr); ++ int s, repair, err; ++ ++ s = socket(AF_INET, SOCK_STREAM, 0); ++ if (CHECK_FAIL(s == -1)) ++ goto error; ++ ++ repair = TCP_REPAIR_ON; ++ err = setsockopt(s, SOL_TCP, TCP_REPAIR, &repair, sizeof(repair)); ++ if (CHECK_FAIL(err)) ++ goto error; ++ ++ err = connect(s, (struct sockaddr *)&addr, len); ++ if (CHECK_FAIL(err)) ++ goto error; ++ ++ repair = TCP_REPAIR_OFF_NO_WP; ++ err = setsockopt(s, SOL_TCP, TCP_REPAIR, &repair, sizeof(repair)); ++ if (CHECK_FAIL(err)) ++ goto error; ++ ++ return s; ++error: ++ perror(__func__); ++ close(s); ++ return -1; ++} ++ ++/* Create a map, populate it with one socket, and free the map. */ ++static void test_sockmap_create_update_free(enum bpf_map_type map_type) ++{ ++ const int zero = 0; ++ int s, map, err; ++ ++ s = connected_socket_v4(); ++ if (CHECK_FAIL(s == -1)) ++ return; ++ ++ map = bpf_create_map(map_type, sizeof(int), sizeof(int), 1, 0); ++ if (CHECK_FAIL(map == -1)) { ++ perror("bpf_create_map"); ++ goto out; ++ } ++ ++ err = bpf_map_update_elem(map, &zero, &s, BPF_NOEXIST); ++ if (CHECK_FAIL(err)) { ++ perror("bpf_map_update"); ++ goto out; ++ } ++ ++out: ++ close(map); ++ close(s); ++} ++ ++void test_sockmap_basic(void) ++{ ++ if (test__start_subtest("sockmap create_update_free")) ++ test_sockmap_create_update_free(BPF_MAP_TYPE_SOCKMAP); ++ if (test__start_subtest("sockhash create_update_free")) ++ test_sockmap_create_update_free(BPF_MAP_TYPE_SOCKHASH); ++} diff --git a/queue-5.5/series b/queue-5.5/series index 95ba52c36f6..8bcc8b7d9d0 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -33,3 +33,41 @@ nfsv4-pnfs_roc-must-use-cred_fscmp-to-compare-creds.patch nfsv4-try-lease-recovery-on-nfs4err_expired.patch nfsv4.0-nfs4_do_fsinfo-should-not-do-implicit-lease-renewals.patch x86-boot-handle-malformed-srat-tables-during-early-a.patch +bpftool-don-t-crash-on-missing-xlated-program-instructions.patch +bpf-sockmap-don-t-sleep-while-holding-rcu-lock-on-tear-down.patch +bpf-sockhash-synchronize_rcu-before-free-ing-map.patch +selftests-bpf-test-freeing-sockmap-sockhash-with-a-socket-in-it.patch +bpf-improve-bucket_log-calculation-logic.patch +bpf-sockmap-check-update-requirements-after-locking.patch +mt76-mt7615-fix-max_nss-in-mt7615_eeprom_parse_hw_cap.patch +netdevsim-fix-using-uninitialized-resources.patch +netdevsim-disable-devlink-reload-when-resources-are-being-used.patch +netdevsim-fix-panic-in-nsim_dev_take_snapshot_write.patch +netdevsim-use-__gfp_nowarn-to-avoid-memalloc-warning.patch +rtc-mt6397-drop-free_irq-of-devm_-allocated-irq.patch +rtc-hym8563-return-einval-if-the-time-is-known-to-be-invalid.patch +rtc-i2c-spi-avoid-inclusion-of-regmap-support-when-not-needed.patch +rtc-cmos-stop-using-shared-irq.patch +watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch +mips-loongson-fix-potential-null-dereference-in-loongson3_platform_init.patch +arc-add-missing-multicast-filter-number-to-gmac-node.patch +platform-x86-intel_mid_powerbtn-take-a-copy-of-ddata.patch +arm64-dts-qcom-msm8998-fix-tcsr-syscon-size.patch +arm64-dts-udpu-fix-broken-ethernet.patch +arm64-dts-qcom-msm8998-mtp-add-alias-for-blsp1_uart3.patch +arm-dts-at91-reenable-uart-tx-pull-ups.patch +arm-dts-am43xx-add-support-for-clkout1-clock.patch +arm64-dts-renesas-r8a77990-ebisu-remove-clkout-lr-synchronous-from-sound.patch +arm64-dts-marvell-clearfog-gt-8k-fix-switch-cpu-port-node.patch +arm-dts-meson8-use-the-actual-frequency-for-the-gpu-s-182.1mhz-opp.patch +arm-dts-meson8b-use-the-actual-frequency-for-the-gpu-s-364mhz-opp.patch +arm-dts-at91-sama5d3-fix-maximum-peripheral-clock-rates.patch +arm-dts-at91-sama5d3-define-clock-rate-range-for-tcb1.patch +tools-power-acpi-fix-compilation-error.patch +soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch +revert-powerpc-pseries-iommu-don-t-use-dma_iommu_ops-on-secure-guests.patch +powerpc-ptdump-fix-w-x-verification-call-in-mark_rodata_ro.patch +powerpc-ptdump-only-enable-ppc_check_wx-with-strict_kernel_rwx.patch +powerpc-papr_scm-fix-leaking-bus_desc.provider_name-in-some-paths.patch +powerpc-pseries-vio-fix-iommu_table-use-after-free-refcount-warning.patch +powerpc-pseries-allow-not-having-ibm-hypertas-functions-hcall-multi-tce-for-ddw.patch diff --git a/queue-5.5/soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch b/queue-5.5/soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch new file mode 100644 index 00000000000..f71e850bdf2 --- /dev/null +++ b/queue-5.5/soc-qcom-rpmhpd-set-active_only-for-active-only-power-domains.patch @@ -0,0 +1,46 @@ +From 5d0d4d42bed0090d3139e7c5ca1587d76d48add6 Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Thu, 14 Feb 2019 09:36:33 -0800 +Subject: soc: qcom: rpmhpd: Set 'active_only' for active only power domains + +From: Douglas Anderson + +commit 5d0d4d42bed0090d3139e7c5ca1587d76d48add6 upstream. + +The 'active_only' attribute was accidentally never set to true for any +power domains meaning that all the code handling this attribute was +dead. + +NOTE that the RPM power domain code (as opposed to the RPMh one) gets +this right. + +Acked-by: Rajendra Nayak +Reviewed-by: Stephen Boyd +Fixes: 279b7e8a62cc ("soc: qcom: rpmhpd: Add RPMh power domain driver") +Signed-off-by: Douglas Anderson +Link: https://lore.kernel.org/r/20190214173633.211000-1-dianders@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/qcom/rpmhpd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/soc/qcom/rpmhpd.c ++++ b/drivers/soc/qcom/rpmhpd.c +@@ -93,6 +93,7 @@ static struct rpmhpd sdm845_mx = { + + static struct rpmhpd sdm845_mx_ao = { + .pd = { .name = "mx_ao", }, ++ .active_only = true, + .peer = &sdm845_mx, + .res_name = "mx.lvl", + }; +@@ -107,6 +108,7 @@ static struct rpmhpd sdm845_cx = { + + static struct rpmhpd sdm845_cx_ao = { + .pd = { .name = "cx_ao", }, ++ .active_only = true, + .peer = &sdm845_cx, + .parent = &sdm845_mx_ao.pd, + .res_name = "cx.lvl", diff --git a/queue-5.5/tools-power-acpi-fix-compilation-error.patch b/queue-5.5/tools-power-acpi-fix-compilation-error.patch new file mode 100644 index 00000000000..f608f878bf4 --- /dev/null +++ b/queue-5.5/tools-power-acpi-fix-compilation-error.patch @@ -0,0 +1,50 @@ +From 1985f8c7f9a42a651a9750d6fcadc74336d182df Mon Sep 17 00:00:00 2001 +From: Zhengyuan Liu +Date: Sat, 14 Dec 2019 00:27:12 +0800 +Subject: tools/power/acpi: fix compilation error + +From: Zhengyuan Liu + +commit 1985f8c7f9a42a651a9750d6fcadc74336d182df upstream. + +If we compile tools/acpi target in the top source directory, we'd get a +compilation error showing as bellow: + + # make tools/acpi + DESCEND power/acpi + DESCEND tools/acpidbg + CC tools/acpidbg/acpidbg.o + Assembler messages: + Fatal error: can't create /home/lzy/kernel-upstream/power/acpi/\ + tools/acpidbg/acpidbg.o: No such file or directory + ../../Makefile.rules:26: recipe for target '/home/lzy/kernel-upstream/\ + power/acpi/tools/acpidbg/acpidbg.o' failed + make[3]: *** [/home/lzy/kernel-upstream//power/acpi/tools/acpidbg/\ + acpidbg.o] Error 1 + Makefile:19: recipe for target 'acpidbg' failed + make[2]: *** [acpidbg] Error 2 + Makefile:54: recipe for target 'acpi' failed + make[1]: *** [acpi] Error 2 + Makefile:1607: recipe for target 'tools/acpi' failed + make: *** [tools/acpi] Error 2 + +Fixes: d5a4b1a540b8 ("tools/power/acpi: Remove direct kernel source include reference") +Signed-off-by: Zhengyuan Liu +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + tools/power/acpi/Makefile.config | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/power/acpi/Makefile.config ++++ b/tools/power/acpi/Makefile.config +@@ -15,7 +15,7 @@ include $(srctree)/../../scripts/Makefil + + OUTPUT=$(srctree)/ + ifeq ("$(origin O)", "command line") +- OUTPUT := $(O)/power/acpi/ ++ OUTPUT := $(O)/tools/power/acpi/ + endif + #$(info Determined 'OUTPUT' to be $(OUTPUT)) + diff --git a/queue-5.5/watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch b/queue-5.5/watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch new file mode 100644 index 00000000000..34985d44ae3 --- /dev/null +++ b/queue-5.5/watchdog-qcom-use-platform_get_irq_optional-for-bark-irq.patch @@ -0,0 +1,43 @@ +From e0b4f4e0cf7fa9d62628d4249c765ec18dffd143 Mon Sep 17 00:00:00 2001 +From: Sai Prakash Ranjan +Date: Fri, 13 Dec 2019 12:19:34 +0530 +Subject: watchdog: qcom: Use platform_get_irq_optional() for bark irq + +From: Sai Prakash Ranjan + +commit e0b4f4e0cf7fa9d62628d4249c765ec18dffd143 upstream. + +platform_get_irq() prints an error message when the interrupt +is not available. So on platforms where bark interrupt is +not specified, following error message is observed on SDM845. + +[ 2.975888] qcom_wdt 17980000.watchdog: IRQ index 0 not found + +This is also seen on SC7180, SM8150 SoCs as well. +Fix this by using platform_get_irq_optional() instead. + +Fixes: 36375491a4395654 ("watchdog: qcom: support pre-timeout when the bark irq is available") +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Bjorn Andersson +Reviewed-by: Guenter Roeck +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/20191213064934.4112-1-saiprakash.ranjan@codeaurora.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/qcom-wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/qcom-wdt.c ++++ b/drivers/watchdog/qcom-wdt.c +@@ -246,7 +246,7 @@ static int qcom_wdt_probe(struct platfor + } + + /* check if there is pretimeout support */ +- irq = platform_get_irq(pdev, 0); ++ irq = platform_get_irq_optional(pdev, 0); + if (irq > 0) { + ret = devm_request_irq(dev, irq, qcom_wdt_isr, + IRQF_TRIGGER_RISING, -- 2.47.3