From 9d599b989577880c84277e063501d06f0e82d221 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 27 Feb 2019 20:02:07 -0500 Subject: [PATCH] patches for 4.19 Signed-off-by: Sasha Levin --- ...revent-potential-divide-by-zero-bugs.patch | 45 +++ ...return-value-to-avoid-build-warnings.patch | 74 +++++ ...ow_regs-lockdep-avoid-page-allocator.patch | 141 +++++++++ ...-snprintf-to-scnprintf-for-possible-.patch | 83 ++++++ ...change-snprintf-to-scnprintf-for-pos.patch | 117 ++++++++ ...ll-broadwell-fix-setting-for-.dynami.patch | 50 ++++ ...-fix-pll-source-register-definitions.patch | 55 ++++ ...l-in-function-rt274_i2c_probe-could-.patch | 39 +++ ...80211-extend-range-deviation-for-dmg.patch | 43 +++ ...k-sysfs-fix-invalid-json-in-clk_dump.patch | 33 +++ ...a-dfll-fix-a-potential-oop-in-remove.patch | 38 +++ ...ock-configuration-without-upstream-c.patch | 49 +++ ...-allow-direct-writes-to-empty-inodes.patch | 56 ++++ ...int340x_thermal-fix-sysfs-race-condi.patch | 113 +++++++ ...d-powerplay-od-setting-fix-on-vega10.patch | 61 ++++ ...m-msm-fix-a6xx-support-for-opp-level.patch | 49 +++ ...unblock-writer-if-reader-closes-file.patch | 45 +++ ...m-sun4i-hdmi-fix-usage-of-tmds-clock.patch | 50 ++++ .../futex-fix-possible-missed-wakeup.patch | 61 ++++ ...re-the-initial-affinity-is-not-empty.patch | 40 +++ ...sc-fix-ethtool-change-hash-key-error.patch | 81 +++++ ...hash-key-value-reset-after-other-ops.patch | 133 +++++++++ ...or-assignments-of-struct-netvsc_devi.patch | 278 ++++++++++++++++++ ...rocess-frames-after-calling-napi_res.patch | 43 +++ ...ic-v3-mbi-fix-uninitialized-mbi_lock.patch | 34 +++ ...vents-pending-from-svm_complete_inte.patch | 47 +++ ...fix-region-overlap-check-in-kvm_util.patch | 58 ++++ ...ing-rwsem-fix-possible-missed-wakeup.patch | 63 ++++ ...attribute-aligned-2-to-struct-action.patch | 62 ++++ ...nitiate-tdls-connection-if-station-i.patch | 57 ++++ ...ix-miscounting-of-ttl-dropped-frames.patch | 44 +++ ...tse-fix-connect_local_phy-error-path.patch | 37 +++ ...ac_header_xmit-true-for-arphrd_rawip.patch | 36 +++ ...8772_bind-return-error-when-hw_reset.patch | 63 ++++ ...rop-optimization-for-static-ana-grou.patch | 43 +++ .../nvme-rdma-fix-timeout-handler.patch | 75 +++++ ...x-the-main-reset-name-to-match-the-d.patch | 43 +++ ...th79-usb-fix-the-power-on-error-path.patch | 34 +++ ...ed-wait-fix-rcuwait_wake_up-ordering.patch | 65 ++++ ...ake_q-fix-wakeup-ordering-for-wake_q.patch | 94 ++++++ ...x-null-pointer-dereference-in-csio_v.patch | 41 +++ ...void-hang-use-after-free-when-destro.patch | 105 +++++++ ...avoid-hang-use-after-free-when-destr.patch | 74 +++++ ...ockup-chardev-check-asprintf-for-err.patch | 56 ++++ ...ctest-add-alarm-test-on-minute-bound.patch | 133 +++++++++ ...elftests-rtc-rtctest-fix-alarm-tests.patch | 50 ++++ ...eccomp-use-ldlibs-instead-of-ldflags.patch | 126 ++++++++ ..._benchmark.c-match-gup-struct-to-ker.patch | 36 +++ ...t-fix-maximum-acceptable-baud-rate-w.patch | 34 +++ queue-4.19/series | 60 ++++ ...licate-nvmem-partition-types-in-efx_.patch | 98 ++++++ ...ion-support-cpu-access-during-dma_bu.patch | 51 ++++ ...s-fix-build-error-with-clang-when-in.patch | 68 +++++ ...vm-fix-avic-incomplete-ipi-emulation.patch | 58 ++++ ...x_thermal-fix-a-null-vs-is_err-check.patch | 34 +++ ...geni_serial-allow-mctrl-when-flow-co.patch | 46 +++ ...fix-the-uninitialized-link_state-whe.patch | 57 ++++ ...t-synchronize_irq-dwc-irq-in-suspend.patch | 38 +++ ...tial-null-dereference-on-allocation-.patch | 37 +++ ...onize-sync-2-against-cgroup-writebac.patch | 168 +++++++++++ ...-mm-mem_encrypt-fix-erroneous-sizeof.patch | 48 +++ 61 files changed, 4050 insertions(+) create mode 100644 queue-4.19/alsa-compress-prevent-potential-divide-by-zero-bugs.patch create mode 100644 queue-4.19/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch create mode 100644 queue-4.19/arc-show_regs-lockdep-avoid-page-allocator.patch create mode 100644 queue-4.19/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch create mode 100644 queue-4.19/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch create mode 100644 queue-4.19/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch create mode 100644 queue-4.19/asoc-rt5682-fix-pll-source-register-definitions.patch create mode 100644 queue-4.19/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch create mode 100644 queue-4.19/cfg80211-extend-range-deviation-for-dmg.patch create mode 100644 queue-4.19/clk-sysfs-fix-invalid-json-in-clk_dump.patch create mode 100644 queue-4.19/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch create mode 100644 queue-4.19/clk-vc5-abort-clock-configuration-without-upstream-c.patch create mode 100644 queue-4.19/direct-io-allow-direct-writes-to-empty-inodes.patch create mode 100644 queue-4.19/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch create mode 100644 queue-4.19/drm-amd-powerplay-od-setting-fix-on-vega10.patch create mode 100644 queue-4.19/drm-msm-fix-a6xx-support-for-opp-level.patch create mode 100644 queue-4.19/drm-msm-unblock-writer-if-reader-closes-file.patch create mode 100644 queue-4.19/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch create mode 100644 queue-4.19/futex-fix-possible-missed-wakeup.patch create mode 100644 queue-4.19/genirq-make-sure-the-initial-affinity-is-not-empty.patch create mode 100644 queue-4.19/hv_netvsc-fix-ethtool-change-hash-key-error.patch create mode 100644 queue-4.19/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch create mode 100644 queue-4.19/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch create mode 100644 queue-4.19/ibmveth-do-not-process-frames-after-calling-napi_res.patch create mode 100644 queue-4.19/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch create mode 100644 queue-4.19/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch create mode 100644 queue-4.19/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch create mode 100644 queue-4.19/locking-rwsem-fix-possible-missed-wakeup.patch create mode 100644 queue-4.19/mac80211-add-attribute-aligned-2-to-struct-action.patch create mode 100644 queue-4.19/mac80211-don-t-initiate-tdls-connection-if-station-i.patch create mode 100644 queue-4.19/mac80211-fix-miscounting-of-ttl-dropped-frames.patch create mode 100644 queue-4.19/net-altera_tse-fix-connect_local_phy-error-path.patch create mode 100644 queue-4.19/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch create mode 100644 queue-4.19/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch create mode 100644 queue-4.19/nvme-multipath-drop-optimization-for-static-ana-grou.patch create mode 100644 queue-4.19/nvme-rdma-fix-timeout-handler.patch create mode 100644 queue-4.19/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch create mode 100644 queue-4.19/phy-ath79-usb-fix-the-power-on-error-path.patch create mode 100644 queue-4.19/sched-wait-fix-rcuwait_wake_up-ordering.patch create mode 100644 queue-4.19/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch create mode 100644 queue-4.19/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch create mode 100644 queue-4.19/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch create mode 100644 queue-4.19/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch create mode 100644 queue-4.19/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch create mode 100644 queue-4.19/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch create mode 100644 queue-4.19/selftests-rtc-rtctest-fix-alarm-tests.patch create mode 100644 queue-4.19/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch create mode 100644 queue-4.19/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch create mode 100644 queue-4.19/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch create mode 100644 queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch create mode 100644 queue-4.19/staging-android-ion-support-cpu-access-during-dma_bu.patch create mode 100644 queue-4.19/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch create mode 100644 queue-4.19/svm-fix-avic-incomplete-ipi-emulation.patch create mode 100644 queue-4.19/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch create mode 100644 queue-4.19/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch create mode 100644 queue-4.19/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch create mode 100644 queue-4.19/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch create mode 100644 queue-4.19/usb-gadget-potential-null-dereference-on-allocation-.patch create mode 100644 queue-4.19/writeback-synchronize-sync-2-against-cgroup-writebac.patch create mode 100644 queue-4.19/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch diff --git a/queue-4.19/alsa-compress-prevent-potential-divide-by-zero-bugs.patch b/queue-4.19/alsa-compress-prevent-potential-divide-by-zero-bugs.patch new file mode 100644 index 00000000000..0b800bd08b1 --- /dev/null +++ b/queue-4.19/alsa-compress-prevent-potential-divide-by-zero-bugs.patch @@ -0,0 +1,45 @@ +From ebbd43fc6d159f2ba7ee78a9dc79a5265e5c19c0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 21 Dec 2018 12:06:58 +0300 +Subject: ALSA: compress: prevent potential divide by zero bugs + +[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ] + +The problem is seen in the q6asm_dai_compr_set_params() function: + + ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys, + (prtd->pcm_size / prtd->periods), + ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + prtd->periods); + +In this code prtd->pcm_size is the buffer_size and prtd->periods comes +from params->buffer.fragments. If we allow the number of fragments to +be zero then it results in a divide by zero bug. One possible fix would +be to use prtd->pcm_count directly instead of using the division to +re-calculate it. But I decided that it doesn't really make sense to +allow zero fragments. + +Signed-off-by: Dan Carpenter +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/core/compress_offload.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 26b5e245b0747..8b78ddffa509a 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -529,7 +529,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) + { + /* first let's check the buffer parameter's */ + if (params->buffer.fragment_size == 0 || +- params->buffer.fragments > INT_MAX / params->buffer.fragment_size) ++ params->buffer.fragments > INT_MAX / params->buffer.fragment_size || ++ params->buffer.fragments == 0) + return -EINVAL; + + /* now codec parameters */ +-- +2.19.1 + diff --git a/queue-4.19/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch b/queue-4.19/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch new file mode 100644 index 00000000000..6f0115fa4ee --- /dev/null +++ b/queue-4.19/arc-fix-__ffs-return-value-to-avoid-build-warnings.patch @@ -0,0 +1,74 @@ +From c44d24c0be4f67a8c0c1d1184e37518f8b5c8687 Mon Sep 17 00:00:00 2001 +From: Eugeniy Paltsev +Date: Thu, 13 Dec 2018 18:42:57 +0300 +Subject: ARC: fix __ffs return value to avoid build warnings + +[ Upstream commit 4e868f8419cb4cb558c5d428e7ab5629cef864c7 ] + +| CC mm/nobootmem.o +|In file included from ./include/asm-generic/bug.h:18:0, +| from ./arch/arc/include/asm/bug.h:32, +| from ./include/linux/bug.h:5, +| from ./include/linux/mmdebug.h:5, +| from ./include/linux/gfp.h:5, +| from ./include/linux/slab.h:15, +| from mm/nobootmem.c:14: +|mm/nobootmem.c: In function '__free_pages_memory': +|./include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast +| (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) +| ^ +|./include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck' +| (__typecheck(x, y) && __no_side_effects(x, y)) +| ^~~~~~~~~~~ +|./include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp' +| __builtin_choose_expr(__safe_cmp(x, y), \ +| ^~~~~~~~~~ +|./include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp' +| #define min(x, y) __careful_cmp(x, y, <) +| ^~~~~~~~~~~~~ +|mm/nobootmem.c:104:11: note: in expansion of macro 'min' +| order = min(MAX_ORDER - 1UL, __ffs(start)); + +Change __ffs return value from 'int' to 'unsigned long' as it +is done in other implementations (like asm-generic, x86, etc...) +to avoid build-time warnings in places where type is strictly +checked. + +As __ffs may return values in [0-31] interval changing return +type to unsigned is valid. + +Signed-off-by: Eugeniy Paltsev +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/bitops.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h +index 8da87feec59aa..99e6d8948f4ac 100644 +--- a/arch/arc/include/asm/bitops.h ++++ b/arch/arc/include/asm/bitops.h +@@ -340,7 +340,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long word) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long word) + { + if (!word) + return word; +@@ -400,9 +400,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x) + /* + * __ffs: Similar to ffs, but zero based (0-31) + */ +-static inline __attribute__ ((const)) int __ffs(unsigned long x) ++static inline __attribute__ ((const)) unsigned long __ffs(unsigned long x) + { +- int n; ++ unsigned long n; + + asm volatile( + " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */ +-- +2.19.1 + diff --git a/queue-4.19/arc-show_regs-lockdep-avoid-page-allocator.patch b/queue-4.19/arc-show_regs-lockdep-avoid-page-allocator.patch new file mode 100644 index 00000000000..5fe17d738d9 --- /dev/null +++ b/queue-4.19/arc-show_regs-lockdep-avoid-page-allocator.patch @@ -0,0 +1,141 @@ +From d0ed1d56a7baae524817e40dc91170b711004bb4 Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Mon, 17 Dec 2018 14:11:19 -0800 +Subject: ARC: show_regs: lockdep: avoid page allocator... + +[ Upstream commit ab6c03676cb190156603cf4c5ecf97aa406c9c53 ] + +and use smaller/on-stack buffer instead + +The motivation for this change was lockdep splat like below. + +| potentially unexpected fatal signal 11. +| BUG: sleeping function called from invalid context at ../mm/page_alloc.c:4317 +| in_atomic(): 1, irqs_disabled(): 0, pid: 57, name: segv +| no locks held by segv/57. +| Preemption disabled at: +| [<8182f17e>] get_signal+0x4a6/0x7c4 +| CPU: 0 PID: 57 Comm: segv Not tainted 4.17.0+ #23 +| +| Stack Trace: +| arc_unwind_core.constprop.1+0xd0/0xf4 +| __might_sleep+0x1f6/0x234 +| __get_free_pages+0x174/0xca0 +| show_regs+0x22/0x330 +| get_signal+0x4ac/0x7c4 # print_fatal_signals() -> preempt_disable() +| do_signal+0x30/0x224 +| resume_user_mode_begin+0x90/0xd8 + +So signal handling core calls show_regs() with preemption disabled but +an ensuing GFP_KERNEL page allocator call is flagged by lockdep. + +We could have switched to GFP_NOWAIT, but turns out that is not enough +anways and eliding page allocator call leads to less code and +instruction traces to sift thru when debugging pesky crashes. + +FWIW, this patch doesn't cure the lockdep splat (which next patch does). + +Reviewed-by: William Kucharski +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/troubleshoot.c | 26 ++++++++++++-------------- + 1 file changed, 12 insertions(+), 14 deletions(-) + +diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c +index e8d9fb4523462..5c6663321e873 100644 +--- a/arch/arc/kernel/troubleshoot.c ++++ b/arch/arc/kernel/troubleshoot.c +@@ -18,6 +18,8 @@ + #include + #include + ++#define ARC_PATH_MAX 256 ++ + /* + * Common routine to print scratch regs (r0-r12) or callee regs (r13-r25) + * -Prints 3 regs per line and a CR. +@@ -58,11 +60,12 @@ static void show_callee_regs(struct callee_regs *cregs) + print_reg_file(&(cregs->r13), 13); + } + +-static void print_task_path_n_nm(struct task_struct *tsk, char *buf) ++static void print_task_path_n_nm(struct task_struct *tsk) + { + char *path_nm = NULL; + struct mm_struct *mm; + struct file *exe_file; ++ char buf[ARC_PATH_MAX]; + + mm = get_task_mm(tsk); + if (!mm) +@@ -72,7 +75,7 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf) + mmput(mm); + + if (exe_file) { +- path_nm = file_path(exe_file, buf, 255); ++ path_nm = file_path(exe_file, buf, ARC_PATH_MAX-1); + fput(exe_file); + } + +@@ -80,10 +83,9 @@ static void print_task_path_n_nm(struct task_struct *tsk, char *buf) + pr_info("Path: %s\n", !IS_ERR(path_nm) ? path_nm : "?"); + } + +-static void show_faulting_vma(unsigned long address, char *buf) ++static void show_faulting_vma(unsigned long address) + { + struct vm_area_struct *vma; +- char *nm = buf; + struct mm_struct *active_mm = current->active_mm; + + /* can't use print_vma_addr() yet as it doesn't check for +@@ -96,8 +98,11 @@ static void show_faulting_vma(unsigned long address, char *buf) + * if the container VMA is not found + */ + if (vma && (vma->vm_start <= address)) { ++ char buf[ARC_PATH_MAX]; ++ char *nm = "?"; ++ + if (vma->vm_file) { +- nm = file_path(vma->vm_file, buf, PAGE_SIZE - 1); ++ nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1); + if (IS_ERR(nm)) + nm = "?"; + } +@@ -173,13 +178,8 @@ void show_regs(struct pt_regs *regs) + { + struct task_struct *tsk = current; + struct callee_regs *cregs; +- char *buf; + +- buf = (char *)__get_free_page(GFP_KERNEL); +- if (!buf) +- return; +- +- print_task_path_n_nm(tsk, buf); ++ print_task_path_n_nm(tsk); + show_regs_print_info(KERN_INFO); + + show_ecr_verbose(regs); +@@ -189,7 +189,7 @@ void show_regs(struct pt_regs *regs) + (void *)regs->blink, (void *)regs->ret); + + if (user_mode(regs)) +- show_faulting_vma(regs->ret, buf); /* faulting code, not data */ ++ show_faulting_vma(regs->ret); /* faulting code, not data */ + + pr_info("[STAT32]: 0x%08lx", regs->status32); + +@@ -221,8 +221,6 @@ void show_regs(struct pt_regs *regs) + cregs = (struct callee_regs *)current->thread.callee_reg; + if (cregs) + show_callee_regs(cregs); +- +- free_page((unsigned long)buf); + } + + void show_kernel_fault_diag(const char *str, struct pt_regs *regs, +-- +2.19.1 + diff --git a/queue-4.19/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch b/queue-4.19/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch new file mode 100644 index 00000000000..f0dff417fbc --- /dev/null +++ b/queue-4.19/asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch @@ -0,0 +1,83 @@ +From f3beb7b50f5a00fd391c2346b70a63d450156306 Mon Sep 17 00:00:00 2001 +From: Silvio Cesare +Date: Sat, 12 Jan 2019 16:28:43 +0100 +Subject: ASoC: dapm: change snprintf to scnprintf for possible overflow + +[ Upstream commit e581e151e965bf1f2815dd94620b638fec4d0a7e ] + +Change snprintf to scnprintf. There are generally two cases where using +snprintf causes problems. + +1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) +In this case, if snprintf would have written more characters than what the +buffer size (SIZE) is, then size will end up larger than SIZE. In later +uses of snprintf, SIZE - size will result in a negative number, leading +to problems. Note that size might already be too large by using +size = snprintf before the code reaches a case of size += snprintf. + +2) If size is ultimately used as a length parameter for a copy back to user +space, then it will potentially allow for a buffer overflow and information +disclosure when size is greater than SIZE. When the size is used to index +the buffer directly, we can have memory corruption. This also means when +size = snprintf... is used, it may also cause problems since size may become +large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel +configuration. + +The solution to these issues is to use scnprintf which returns the number of +characters actually written to the buffer, so the size variable will never +exceed SIZE. + +Signed-off-by: Silvio Cesare +Cc: Liam Girdwood +Cc: Mark Brown +Cc: Dan Carpenter +Cc: Kees Cook +Cc: Will Deacon +Cc: Greg KH +Signed-off-by: Willy Tarreau +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 461d951917c05..6537069452226 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2028,19 +2028,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + out = is_connected_output_ep(w, NULL, NULL); + } + +- ret = snprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", ++ ret = scnprintf(buf, PAGE_SIZE, "%s: %s%s in %d out %d", + w->name, w->power ? "On" : "Off", + w->force ? " (forced)" : "", in, out); + + if (w->reg >= 0) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " - R%d(0x%x) mask 0x%x", + w->reg, w->reg, w->mask << w->shift); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (w->sname) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, " stream %s %s\n", + w->sname, + w->active ? "active" : "inactive"); + +@@ -2053,7 +2053,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file, + if (!p->connect) + continue; + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + " %s \"%s\" \"%s\"\n", + (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", + p->name ? p->name : "static", +-- +2.19.1 + diff --git a/queue-4.19/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch b/queue-4.19/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch new file mode 100644 index 00000000000..c77a345e5b4 --- /dev/null +++ b/queue-4.19/asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch @@ -0,0 +1,117 @@ +From 8055b2042a8f26acaf6fa975093ab4e63c9f8179 Mon Sep 17 00:00:00 2001 +From: Silvio Cesare +Date: Tue, 15 Jan 2019 04:27:27 +0100 +Subject: ASoC: imx-audmux: change snprintf to scnprintf for possible overflow + +[ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ] + +Change snprintf to scnprintf. There are generally two cases where using +snprintf causes problems. + +1) Uses of size += snprintf(buf, SIZE - size, fmt, ...) +In this case, if snprintf would have written more characters than what the +buffer size (SIZE) is, then size will end up larger than SIZE. In later +uses of snprintf, SIZE - size will result in a negative number, leading +to problems. Note that size might already be too large by using +size = snprintf before the code reaches a case of size += snprintf. + +2) If size is ultimately used as a length parameter for a copy back to user +space, then it will potentially allow for a buffer overflow and information +disclosure when size is greater than SIZE. When the size is used to index +the buffer directly, we can have memory corruption. This also means when +size = snprintf... is used, it may also cause problems since size may become +large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel +configuration. + +The solution to these issues is to use scnprintf which returns the number of +characters actually written to the buffer, so the size variable will never +exceed SIZE. + +Signed-off-by: Silvio Cesare +Cc: Timur Tabi +Cc: Nicolin Chen +Cc: Mark Brown +Cc: Xiubo Li +Cc: Fabio Estevam +Cc: Dan Carpenter +Cc: Kees Cook +Cc: Will Deacon +Cc: Greg KH +Signed-off-by: Willy Tarreau +Acked-by: Nicolin Chen +Reviewed-by: Kees Cook +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/fsl/imx-audmux.c b/sound/soc/fsl/imx-audmux.c +index 392d5eef356d3..99e07b01a2ce9 100644 +--- a/sound/soc/fsl/imx-audmux.c ++++ b/sound/soc/fsl/imx-audmux.c +@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf, + if (!buf) + return -ENOMEM; + +- ret = snprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", ++ ret = scnprintf(buf, PAGE_SIZE, "PDCR: %08x\nPTCR: %08x\n", + pdcr, ptcr); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS output from %s, ", + audmux_port_string((ptcr >> 27) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_TCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk output from %s", + audmux_port_string((ptcr >> 22) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "TxClk input"); + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, "\n"); ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, "\n"); + + if (ptcr & IMX_AUDMUX_V2_PTCR_SYN) { +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "Port is symmetric"); + } else { + if (ptcr & IMX_AUDMUX_V2_PTCR_RFSDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS output from %s, ", + audmux_port_string((ptcr >> 17) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxFS input, "); + + if (ptcr & IMX_AUDMUX_V2_PTCR_RCLKDIR) +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk output from %s", + audmux_port_string((ptcr >> 12) & 0x7)); + else +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "RxClk input"); + } + +- ret += snprintf(buf + ret, PAGE_SIZE - ret, ++ ret += scnprintf(buf + ret, PAGE_SIZE - ret, + "\nData received from %s\n", + audmux_port_string((pdcr >> 13) & 0x7)); + +-- +2.19.1 + diff --git a/queue-4.19/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch b/queue-4.19/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch new file mode 100644 index 00000000000..e8848722752 --- /dev/null +++ b/queue-4.19/asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch @@ -0,0 +1,50 @@ +From f06fe5a29bcdba910c667394d052d0d95820fe4a Mon Sep 17 00:00:00 2001 +From: Rander Wang +Date: Tue, 18 Dec 2018 16:24:54 +0800 +Subject: ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field + +[ Upstream commit 906a9abc5de73c383af518f5a806f4be2993a0c7 ] + +For some reason this field was set to zero when all other drivers use +.dynamic = 1 for front-ends. This change was tested on Dell XPS13 and +has no impact with the existing legacy driver. The SOF driver also works +with this change which enables it to override the fixed topology. + +Signed-off-by: Rander Wang +Acked-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/broadwell.c | 2 +- + sound/soc/intel/boards/haswell.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/intel/boards/broadwell.c b/sound/soc/intel/boards/broadwell.c +index 7b0ee67b4fc8b..78ec97b53f50e 100644 +--- a/sound/soc/intel/boards/broadwell.c ++++ b/sound/soc/intel/boards/broadwell.c +@@ -192,7 +192,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +diff --git a/sound/soc/intel/boards/haswell.c b/sound/soc/intel/boards/haswell.c +index eab1f439dd3f1..a4022983a7ce0 100644 +--- a/sound/soc/intel/boards/haswell.c ++++ b/sound/soc/intel/boards/haswell.c +@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { + .stream_name = "Loopback", + .cpu_dai_name = "Loopback Pin", + .platform_name = "haswell-pcm-audio", +- .dynamic = 0, ++ .dynamic = 1, + .codec_name = "snd-soc-dummy", + .codec_dai_name = "snd-soc-dummy-dai", + .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST}, +-- +2.19.1 + diff --git a/queue-4.19/asoc-rt5682-fix-pll-source-register-definitions.patch b/queue-4.19/asoc-rt5682-fix-pll-source-register-definitions.patch new file mode 100644 index 00000000000..c46eb863159 --- /dev/null +++ b/queue-4.19/asoc-rt5682-fix-pll-source-register-definitions.patch @@ -0,0 +1,55 @@ +From 6b892c85b53a5884bd362ba3ef06cbe5363240b0 Mon Sep 17 00:00:00 2001 +From: Shuming Fan +Date: Tue, 15 Jan 2019 11:27:39 +0800 +Subject: ASoC: rt5682: Fix PLL source register definitions + +[ Upstream commit ee7ea2a9a318a89d21b156dc75e54d53904bdbe5 ] + +Fix typo which causes headphone no sound while using BCLK +as PLL source. + +Signed-off-by: Shuming Fan +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682.h | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +diff --git a/sound/soc/codecs/rt5682.h b/sound/soc/codecs/rt5682.h +index 8068140ebe3f1..cdd659f4df93d 100644 +--- a/sound/soc/codecs/rt5682.h ++++ b/sound/soc/codecs/rt5682.h +@@ -849,18 +849,18 @@ + #define RT5682_SCLK_SRC_PLL2 (0x2 << 13) + #define RT5682_SCLK_SRC_SDW (0x3 << 13) + #define RT5682_SCLK_SRC_RCCLK (0x4 << 13) +-#define RT5682_PLL1_SRC_MASK (0x3 << 10) +-#define RT5682_PLL1_SRC_SFT 10 +-#define RT5682_PLL1_SRC_MCLK (0x0 << 10) +-#define RT5682_PLL1_SRC_BCLK1 (0x1 << 10) +-#define RT5682_PLL1_SRC_SDW (0x2 << 10) +-#define RT5682_PLL1_SRC_RC (0x3 << 10) +-#define RT5682_PLL2_SRC_MASK (0x3 << 8) +-#define RT5682_PLL2_SRC_SFT 8 +-#define RT5682_PLL2_SRC_MCLK (0x0 << 8) +-#define RT5682_PLL2_SRC_BCLK1 (0x1 << 8) +-#define RT5682_PLL2_SRC_SDW (0x2 << 8) +-#define RT5682_PLL2_SRC_RC (0x3 << 8) ++#define RT5682_PLL2_SRC_MASK (0x3 << 10) ++#define RT5682_PLL2_SRC_SFT 10 ++#define RT5682_PLL2_SRC_MCLK (0x0 << 10) ++#define RT5682_PLL2_SRC_BCLK1 (0x1 << 10) ++#define RT5682_PLL2_SRC_SDW (0x2 << 10) ++#define RT5682_PLL2_SRC_RC (0x3 << 10) ++#define RT5682_PLL1_SRC_MASK (0x3 << 8) ++#define RT5682_PLL1_SRC_SFT 8 ++#define RT5682_PLL1_SRC_MCLK (0x0 << 8) ++#define RT5682_PLL1_SRC_BCLK1 (0x1 << 8) ++#define RT5682_PLL1_SRC_SDW (0x2 << 8) ++#define RT5682_PLL1_SRC_RC (0x3 << 8) + + + +-- +2.19.1 + diff --git a/queue-4.19/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch b/queue-4.19/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch new file mode 100644 index 00000000000..f413b3a1c1f --- /dev/null +++ b/queue-4.19/asoc-variable-val-in-function-rt274_i2c_probe-could-.patch @@ -0,0 +1,39 @@ +From cf412fdc2e59b2cd48e079d7e7084aec4e065d06 Mon Sep 17 00:00:00 2001 +From: Yizhuo +Date: Thu, 3 Jan 2019 13:59:12 -0800 +Subject: ASoC: Variable "val" in function rt274_i2c_probe() could be + uninitialized + +[ Upstream commit 8c3590de0a378c2449fc1aec127cc693632458e4 ] + +Inside function rt274_i2c_probe(), if regmap_read() function +returns -EINVAL, then local variable "val" leaves uninitialized +but used in if statement. This is potentially unsafe. + +Signed-off-by: Yizhuo +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt274.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt274.c b/sound/soc/codecs/rt274.c +index d88e673410835..18a931c25ca58 100644 +--- a/sound/soc/codecs/rt274.c ++++ b/sound/soc/codecs/rt274.c +@@ -1126,8 +1126,11 @@ static int rt274_i2c_probe(struct i2c_client *i2c, + return ret; + } + +- regmap_read(rt274->regmap, ++ ret = regmap_read(rt274->regmap, + RT274_GET_PARAM(AC_NODE_ROOT, AC_PAR_VENDOR_ID), &val); ++ if (ret) ++ return ret; ++ + if (val != RT274_VENDOR_ID) { + dev_err(&i2c->dev, + "Device with ID register %#x is not rt274\n", val); +-- +2.19.1 + diff --git a/queue-4.19/cfg80211-extend-range-deviation-for-dmg.patch b/queue-4.19/cfg80211-extend-range-deviation-for-dmg.patch new file mode 100644 index 00000000000..654c3fd1b8a --- /dev/null +++ b/queue-4.19/cfg80211-extend-range-deviation-for-dmg.patch @@ -0,0 +1,43 @@ +From 3bd2c68e7d747a6bd74983373655182167e93f04 Mon Sep 17 00:00:00 2001 +From: Chaitanya Tata +Date: Sat, 19 Jan 2019 03:17:47 +0530 +Subject: cfg80211: extend range deviation for DMG + +[ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ] + +Recently, DMG frequency bands have been extended till 71GHz, so extend +the range check till 20GHz (45-71GHZ), else some channels will be marked +as disabled. + +Signed-off-by: Chaitanya Tata +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 24cfa2776f50b..8002ace7c9f65 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -1249,7 +1249,7 @@ static bool is_valid_rd(const struct ieee80211_regdomain *rd) + * definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), + * however it is safe for now to assume that a frequency rule should not be + * part of a frequency's band if the start freq or end freq are off by more +- * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the ++ * than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the + * 60 GHz band. + * This resolution can be lowered and should be considered as we add + * regulatory rule support for other "bands". +@@ -1264,7 +1264,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range, + * with the Channel starting frequency above 45 GHz. + */ + u32 limit = freq_khz > 45 * ONE_GHZ_IN_KHZ ? +- 10 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; ++ 20 * ONE_GHZ_IN_KHZ : 2 * ONE_GHZ_IN_KHZ; + if (abs(freq_khz - freq_range->start_freq_khz) <= limit) + return true; + if (abs(freq_khz - freq_range->end_freq_khz) <= limit) +-- +2.19.1 + diff --git a/queue-4.19/clk-sysfs-fix-invalid-json-in-clk_dump.patch b/queue-4.19/clk-sysfs-fix-invalid-json-in-clk_dump.patch new file mode 100644 index 00000000000..0bddf6f8aeb --- /dev/null +++ b/queue-4.19/clk-sysfs-fix-invalid-json-in-clk_dump.patch @@ -0,0 +1,33 @@ +From 280830c705c70eb6d7a2a8a07f3a1f0d01d9a69e Mon Sep 17 00:00:00 2001 +From: Lubomir Rintel +Date: Fri, 4 Jan 2019 23:05:49 +0100 +Subject: clk: sysfs: fix invalid JSON in clk_dump + +[ Upstream commit c6e909972ef87aa2a479269f46b84126f99ec6db ] + +Add a missing comma so that the output is valid JSON format again. + +Fixes: 9fba738a53dd ("clk: add duty cycle support") +Signed-off-by: Lubomir Rintel +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index d31055ae6ec6f..5413ffaf02e23 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2687,7 +2687,7 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + seq_printf(s, "\"protect_count\": %d,", c->protect_count); + seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c)); + seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c)); +- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c)); ++ seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c)); + seq_printf(s, "\"duty_cycle\": %u", + clk_core_get_scaled_duty_cycle(c, 100000)); + } +-- +2.19.1 + diff --git a/queue-4.19/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch b/queue-4.19/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch new file mode 100644 index 00000000000..d6453f11336 --- /dev/null +++ b/queue-4.19/clk-tegra-dfll-fix-a-potential-oop-in-remove.patch @@ -0,0 +1,38 @@ +From 45f15183376af02dc904c09240eb0833372f8556 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 18 Dec 2018 11:22:41 +0300 +Subject: clk: tegra: dfll: Fix a potential Oop in remove() + +[ Upstream commit d39eca547f3ec67140a5d765a426eb157b978a59 ] + +If tegra_dfll_unregister() fails then "soc" is an error pointer. We +should just return instead of dereferencing it. + +Fixes: 1752c9ee23fb ("clk: tegra: dfll: Fix drvdata overwriting issue") +Signed-off-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra124-dfll-fcpu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +index 269d3595758be..edc31bb56674a 100644 +--- a/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c ++++ b/drivers/clk/tegra/clk-tegra124-dfll-fcpu.c +@@ -133,9 +133,11 @@ static int tegra124_dfll_fcpu_remove(struct platform_device *pdev) + struct tegra_dfll_soc_data *soc; + + soc = tegra_dfll_unregister(pdev); +- if (IS_ERR(soc)) ++ if (IS_ERR(soc)) { + dev_err(&pdev->dev, "failed to unregister DFLL: %ld\n", + PTR_ERR(soc)); ++ return PTR_ERR(soc); ++ } + + tegra_cvb_remove_opp_table(soc->dev, soc->cvb, soc->max_freq); + +-- +2.19.1 + diff --git a/queue-4.19/clk-vc5-abort-clock-configuration-without-upstream-c.patch b/queue-4.19/clk-vc5-abort-clock-configuration-without-upstream-c.patch new file mode 100644 index 00000000000..7ee7d553c49 --- /dev/null +++ b/queue-4.19/clk-vc5-abort-clock-configuration-without-upstream-c.patch @@ -0,0 +1,49 @@ +From 4525e4a86e635c961578cab4cea24f460e0baa25 Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Sat, 15 Dec 2018 01:55:19 +0100 +Subject: clk: vc5: Abort clock configuration without upstream clock + +[ Upstream commit 2137a109a5e39c2bdccfffe65230ed3fadbaac0e ] + +In case the upstream clock are not set, which can happen in case the +VC5 has no valid upstream clock, the $src variable is used uninited +by regmap_update_bits(). Check for this condition and return -EINVAL +in such case. + +Note that in case the VC5 has no valid upstream clock, the VC5 can +not operate correctly. That is a hardware property of the VC5. The +internal oscilator present in some VC5 models is also considered +upstream clock. + +Signed-off-by: Marek Vasut +Cc: Alexey Firago +Cc: Laurent Pinchart +Cc: Stephen Boyd +Cc: linux-renesas-soc@vger.kernel.org +[sboyd@kernel.org: Added comment about probe preventing this from +happening in the first place] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index decffb3826ece..a738af893532f 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -262,8 +262,10 @@ static int vc5_mux_set_parent(struct clk_hw *hw, u8 index) + + if (vc5->clk_mux_ins == VC5_MUX_IN_XIN) + src = VC5_PRIM_SRC_SHDN_EN_XTAL; +- if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) ++ else if (vc5->clk_mux_ins == VC5_MUX_IN_CLKIN) + src = VC5_PRIM_SRC_SHDN_EN_CLKIN; ++ else /* Invalid; should have been caught by vc5_probe() */ ++ return -EINVAL; + } + + return regmap_update_bits(vc5->regmap, VC5_PRIM_SRC_SHDN, mask, src); +-- +2.19.1 + diff --git a/queue-4.19/direct-io-allow-direct-writes-to-empty-inodes.patch b/queue-4.19/direct-io-allow-direct-writes-to-empty-inodes.patch new file mode 100644 index 00000000000..0beb1e93d91 --- /dev/null +++ b/queue-4.19/direct-io-allow-direct-writes-to-empty-inodes.patch @@ -0,0 +1,56 @@ +From 253b063ba2466c0462b86a1568e30ada11b1bcfd Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ernesto=20A=2E=20Fern=C3=A1ndez?= + +Date: Mon, 8 Oct 2018 20:58:23 -0300 +Subject: direct-io: allow direct writes to empty inodes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 8b9433eb4de3c26a9226c981c283f9f4896ae030 ] + +On a DIO_SKIP_HOLES filesystem, the ->get_block() method is currently +not allowed to create blocks for an empty inode. This confusion comes +from trying to bit shift a negative number, so check the size of the +inode first. + +The problem is most visible for hfsplus, because the fallback to +buffered I/O doesn't happen and the write fails with EIO. This is in +part the fault of the module, because it gives a wrong return value on +->get_block(); that will be fixed in a separate patch. + +Reviewed-by: Jeff Moyer +Reviewed-by: Jan Kara +Signed-off-by: Ernesto A. Fernández +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/direct-io.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/direct-io.c b/fs/direct-io.c +index 1991460360930..1abb7634b2d58 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -679,6 +679,7 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + unsigned long fs_count; /* Number of filesystem-sized blocks */ + int create; + unsigned int i_blkbits = sdio->blkbits + sdio->blkfactor; ++ loff_t i_size; + + /* + * If there was a memory error and we've overwritten all the +@@ -708,8 +709,8 @@ static int get_more_blocks(struct dio *dio, struct dio_submit *sdio, + */ + create = dio->op == REQ_OP_WRITE; + if (dio->flags & DIO_SKIP_HOLES) { +- if (fs_startblk <= ((i_size_read(dio->inode) - 1) >> +- i_blkbits)) ++ i_size = i_size_read(dio->inode); ++ if (i_size && fs_startblk <= (i_size - 1) >> i_blkbits) + create = 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch b/queue-4.19/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch new file mode 100644 index 00000000000..13f804db2bc --- /dev/null +++ b/queue-4.19/drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch @@ -0,0 +1,113 @@ +From b5692589c110eb0789b90fd890e02d01fef85a15 Mon Sep 17 00:00:00 2001 +From: Aaron Hill +Date: Mon, 24 Dec 2018 14:23:36 -0500 +Subject: drivers: thermal: int340x_thermal: Fix sysfs race condition + +[ Upstream commit 129699bb8c7572106b5bbb2407c2daee4727ccad ] + +Changes since V1: +* Use dev_info instead of printk +* Use dev_warn instead of BUG_ON + +Previously, sysfs_create_group was called before all initialization had +fully run - specifically, before pci_set_drvdata was called. Since the +sysctl group is visible to userspace as soon as sysfs_create_group +returns, a small window of time existed during which a process could read +from an uninitialized/partially-initialized device. + +This commit moves the creation of the sysctl group to after all +initialized is completed. This ensures that it's impossible for +userspace to read from a sysctl file before initialization has fully +completed. + +To catch any future regressions, I've added a check to ensure +that proc_thermal_emum_mode is never PROC_THERMAL_NONE when a process +tries to read from a sysctl file. Previously, the aforementioned race +condition could result in the 'else' branch +running while PROC_THERMAL_NONE was set, +leading to a null pointer deference. + +Signed-off-by: Aaron Hill +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + .../processor_thermal_device.c | 28 ++++++++++--------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index 8e0f665cf06f8..8e1cf4d789be1 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -84,7 +84,12 @@ static ssize_t power_limit_##index##_##suffix##_show(struct device *dev, \ + struct pci_dev *pci_dev; \ + struct platform_device *pdev; \ + struct proc_thermal_device *proc_dev; \ +-\ ++ \ ++ if (proc_thermal_emum_mode == PROC_THERMAL_NONE) { \ ++ dev_warn(dev, "Attempted to get power limit before device was initialized!\n"); \ ++ return 0; \ ++ } \ ++ \ + if (proc_thermal_emum_mode == PROC_THERMAL_PLATFORM_DEV) { \ + pdev = to_platform_device(dev); \ + proc_dev = platform_get_drvdata(pdev); \ +@@ -298,11 +303,6 @@ static int proc_thermal_add(struct device *dev, + *priv = proc_priv; + + ret = proc_thermal_read_ppcc(proc_priv); +- if (!ret) { +- ret = sysfs_create_group(&dev->kobj, +- &power_limit_attribute_group); +- +- } + if (ret) + return ret; + +@@ -316,8 +316,7 @@ static int proc_thermal_add(struct device *dev, + + proc_priv->int340x_zone = int340x_thermal_zone_add(adev, ops); + if (IS_ERR(proc_priv->int340x_zone)) { +- ret = PTR_ERR(proc_priv->int340x_zone); +- goto remove_group; ++ return PTR_ERR(proc_priv->int340x_zone); + } else + ret = 0; + +@@ -331,9 +330,6 @@ static int proc_thermal_add(struct device *dev, + + remove_zone: + int340x_thermal_zone_remove(proc_priv->int340x_zone); +-remove_group: +- sysfs_remove_group(&proc_priv->dev->kobj, +- &power_limit_attribute_group); + + return ret; + } +@@ -364,7 +360,10 @@ static int int3401_add(struct platform_device *pdev) + platform_set_drvdata(pdev, proc_priv); + proc_thermal_emum_mode = PROC_THERMAL_PLATFORM_DEV; + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PLATFORM_DEV\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static int int3401_remove(struct platform_device *pdev) +@@ -441,7 +440,10 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, "No auxiliary DTSs enabled\n"); + } + +- return 0; ++ dev_info(&pdev->dev, "Creating sysfs group for PROC_THERMAL_PCI\n"); ++ ++ return sysfs_create_group(&pdev->dev.kobj, ++ &power_limit_attribute_group); + } + + static void proc_thermal_pci_remove(struct pci_dev *pdev) +-- +2.19.1 + diff --git a/queue-4.19/drm-amd-powerplay-od-setting-fix-on-vega10.patch b/queue-4.19/drm-amd-powerplay-od-setting-fix-on-vega10.patch new file mode 100644 index 00000000000..35ec8d29456 --- /dev/null +++ b/queue-4.19/drm-amd-powerplay-od-setting-fix-on-vega10.patch @@ -0,0 +1,61 @@ +From f48cf7cee75a6e4dfea87a7ed879e7e82d37a7ea Mon Sep 17 00:00:00 2001 +From: Kenneth Feng +Date: Fri, 18 Jan 2019 18:08:19 +0800 +Subject: drm/amd/powerplay: OD setting fix on Vega10 + +[ Upstream commit 6d87dc97eb3341de3f7b1efa3156cb0e014f4a96 ] + +gfxclk for OD setting is limited to 1980M for non-acg +ASICs of Vega10 + +Signed-off-by: Kenneth Feng +Reviewed-by: Evan Quan +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../powerplay/hwmgr/vega10_processpptables.c | 22 ++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +index 16b1a9cf6cf08..743d3c983082d 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_processpptables.c +@@ -32,6 +32,7 @@ + #include "vega10_pptable.h" + + #define NUM_DSPCLK_LEVELS 8 ++#define VEGA10_ENGINECLOCK_HARDMAX 198000 + + static void set_hw_cap(struct pp_hwmgr *hwmgr, bool enable, + enum phm_platform_caps cap) +@@ -258,7 +259,26 @@ static int init_over_drive_limits( + struct pp_hwmgr *hwmgr, + const ATOM_Vega10_POWERPLAYTABLE *powerplay_table) + { +- hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ const ATOM_Vega10_GFXCLK_Dependency_Table *gfxclk_dep_table = ++ (const ATOM_Vega10_GFXCLK_Dependency_Table *) ++ (((unsigned long) powerplay_table) + ++ le16_to_cpu(powerplay_table->usGfxclkDependencyTableOffset)); ++ bool is_acg_enabled = false; ++ ATOM_Vega10_GFXCLK_Dependency_Record_V2 *patom_record_v2; ++ ++ if (gfxclk_dep_table->ucRevId == 1) { ++ patom_record_v2 = ++ (ATOM_Vega10_GFXCLK_Dependency_Record_V2 *)gfxclk_dep_table->entries; ++ is_acg_enabled = ++ (bool)patom_record_v2[gfxclk_dep_table->ucNumEntries-1].ucACGEnable; ++ } ++ ++ if (powerplay_table->ulMaxODEngineClock > VEGA10_ENGINECLOCK_HARDMAX && ++ !is_acg_enabled) ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = ++ VEGA10_ENGINECLOCK_HARDMAX; ++ else ++ hwmgr->platform_descriptor.overdriveLimit.engineClock = + le32_to_cpu(powerplay_table->ulMaxODEngineClock); + hwmgr->platform_descriptor.overdriveLimit.memoryClock = + le32_to_cpu(powerplay_table->ulMaxODMemoryClock); +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-fix-a6xx-support-for-opp-level.patch b/queue-4.19/drm-msm-fix-a6xx-support-for-opp-level.patch new file mode 100644 index 00000000000..c257f51ae4c --- /dev/null +++ b/queue-4.19/drm-msm-fix-a6xx-support-for-opp-level.patch @@ -0,0 +1,49 @@ +From b4e1f95910a20a1adc33bf64be778d34b9ac3d53 Mon Sep 17 00:00:00 2001 +From: Douglas Anderson +Date: Wed, 16 Jan 2019 10:46:21 -0800 +Subject: drm/msm: Fix A6XX support for opp-level + +[ Upstream commit a3c5e2cd79753121f49a8662c1e0a60ddb5486ca ] + +The bindings for Qualcomm opp levels changed after being Acked but +before landing. Thus the code in the GPU driver that was relying on +the old bindings is now broken. + +Let's change the code to match the new bindings by adjusting the old +string 'qcom,level' to the new string 'opp-level'. See the patch +("dt-bindings: opp: Introduce opp-level bindings"). + +NOTE: we will do additional cleanup to totally remove the string from +the code and use the new dev_pm_opp_get_level() but we'll do it in a +future patch. This will facilitate getting the important code fix in +sooner without having to deal with cross-maintainer dependencies. + +This patch needs to land before the patch ("arm64: dts: sdm845: Add +gpu and gmu device nodes") since if a tree contains the device tree +patch but not this one you'll get a crash at bootup. + +Fixes: 4b565ca5a2cb ("drm/msm: Add A6XX device support") +Signed-off-by: Douglas Anderson +Reviewed-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +index bbb8126ec5c57..9acb9dfaf57e6 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c +@@ -896,7 +896,7 @@ static u32 a6xx_gmu_get_arc_level(struct device *dev, unsigned long freq) + np = dev_pm_opp_get_of_node(opp); + + if (np) { +- of_property_read_u32(np, "qcom,level", &val); ++ of_property_read_u32(np, "opp-level", &val); + of_node_put(np); + } + +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-unblock-writer-if-reader-closes-file.patch b/queue-4.19/drm-msm-unblock-writer-if-reader-closes-file.patch new file mode 100644 index 00000000000..f5e056ceb59 --- /dev/null +++ b/queue-4.19/drm-msm-unblock-writer-if-reader-closes-file.patch @@ -0,0 +1,45 @@ +From 56ca32e1c249721fe882121bfd8ede30003c7ba8 Mon Sep 17 00:00:00 2001 +From: "Kristian H. Kristensen" +Date: Wed, 19 Dec 2018 08:57:41 -0800 +Subject: drm/msm: Unblock writer if reader closes file + +[ Upstream commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd ] + +Prevents deadlock when fifo is full and reader closes file. + +Signed-off-by: Kristian H. Kristensen +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_rd.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c +index f7a0edea4705b..d4cc5ceb22d01 100644 +--- a/drivers/gpu/drm/msm/msm_rd.c ++++ b/drivers/gpu/drm/msm/msm_rd.c +@@ -115,7 +115,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz) + char *fptr = &fifo->buf[fifo->head]; + int n; + +- wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0); ++ wait_event(rd->fifo_event, circ_space(&rd->fifo) > 0 || !rd->open); ++ if (!rd->open) ++ return; + + /* Note that smp_load_acquire() is not strictly required + * as CIRC_SPACE_TO_END() does not access the tail more +@@ -213,7 +215,10 @@ static int rd_open(struct inode *inode, struct file *file) + static int rd_release(struct inode *inode, struct file *file) + { + struct msm_rd_state *rd = inode->i_private; ++ + rd->open = false; ++ wake_up_all(&rd->fifo_event); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch b/queue-4.19/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch new file mode 100644 index 00000000000..19695adbfeb --- /dev/null +++ b/queue-4.19/drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch @@ -0,0 +1,50 @@ +From 00432e7b98effba57b0e66aa87ab5d05b2bdf8e8 Mon Sep 17 00:00:00 2001 +From: Priit Laes +Date: Tue, 22 Jan 2019 09:32:32 +0200 +Subject: drm/sun4i: hdmi: Fix usage of TMDS clock + +[ Upstream commit 5e1bc251cebc84b41b8eb5d2434e54d939a85430 ] + +Although TMDS clock is required for HDMI to properly function, +nobody called clk_prepare_enable(). This fixes reference counting +issues and makes sure clock is running when it needs to be running. + +Due to TDMS clock being parent clock for DDC clock, TDMS clock +was turned on/off for each EDID probe, causing spurious failures +for certain HDMI/DVI screens. + +Fixes: 9c5681011a0c ("drm/sun4i: Add HDMI support") +Signed-off-by: Priit Laes +[Maxime: Moved the TMDS clock enable earlier] +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20190122073232.7240-1-plaes@plaes.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +index 061d2e0d9011e..416da53767018 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c ++++ b/drivers/gpu/drm/sun4i/sun4i_hdmi_enc.c +@@ -92,6 +92,8 @@ static void sun4i_hdmi_disable(struct drm_encoder *encoder) + val = readl(hdmi->base + SUN4I_HDMI_VID_CTRL_REG); + val &= ~SUN4I_HDMI_VID_CTRL_ENABLE; + writel(val, hdmi->base + SUN4I_HDMI_VID_CTRL_REG); ++ ++ clk_disable_unprepare(hdmi->tmds_clk); + } + + static void sun4i_hdmi_enable(struct drm_encoder *encoder) +@@ -102,6 +104,8 @@ static void sun4i_hdmi_enable(struct drm_encoder *encoder) + + DRM_DEBUG_DRIVER("Enabling the HDMI Output\n"); + ++ clk_prepare_enable(hdmi->tmds_clk); ++ + sun4i_hdmi_setup_avi_infoframes(hdmi, mode); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(0, SUN4I_HDMI_PKT_AVI); + val |= SUN4I_HDMI_PKT_CTRL_TYPE(1, SUN4I_HDMI_PKT_END); +-- +2.19.1 + diff --git a/queue-4.19/futex-fix-possible-missed-wakeup.patch b/queue-4.19/futex-fix-possible-missed-wakeup.patch new file mode 100644 index 00000000000..cf18c6ced6e --- /dev/null +++ b/queue-4.19/futex-fix-possible-missed-wakeup.patch @@ -0,0 +1,61 @@ +From 2b4630941aa7ce7ef65a605b705879365dfb6947 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Thu, 29 Nov 2018 14:44:49 +0100 +Subject: futex: Fix (possible) missed wakeup + +[ Upstream commit b061c38bef43406df8e73c5be06cbfacad5ee6ad ] + +We must not rely on wake_q_add() to delay the wakeup; in particular +commit: + + 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") + +moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which +could result in futex_wait() waking before observing ->lock_ptr == +NULL and going back to sleep again. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 1d0dcb3ad9d3 ("futex: Implement lockless wakeups") +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/futex.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/kernel/futex.c b/kernel/futex.c +index d7c465fd687c6..c5fca746edc46 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1444,11 +1444,7 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + if (WARN(q->pi_state || q->rt_waiter, "refusing to wake PI futex\n")) + return; + +- /* +- * Queue the task for later wakeup for after we've released +- * the hb->lock. wake_q_add() grabs reference to p. +- */ +- wake_q_add(wake_q, p); ++ get_task_struct(p); + __unqueue_futex(q); + /* + * The waiting task can free the futex_q as soon as q->lock_ptr = NULL +@@ -1458,6 +1454,13 @@ static void mark_wake_futex(struct wake_q_head *wake_q, struct futex_q *q) + * plist_del in __unqueue_futex(). + */ + smp_store_release(&q->lock_ptr, NULL); ++ ++ /* ++ * Queue the task for later wakeup for after we've released ++ * the hb->lock. wake_q_add() grabs reference to p. ++ */ ++ wake_q_add(wake_q, p); ++ put_task_struct(p); + } + + /* +-- +2.19.1 + diff --git a/queue-4.19/genirq-make-sure-the-initial-affinity-is-not-empty.patch b/queue-4.19/genirq-make-sure-the-initial-affinity-is-not-empty.patch new file mode 100644 index 00000000000..e91d1c3a4ed --- /dev/null +++ b/queue-4.19/genirq-make-sure-the-initial-affinity-is-not-empty.patch @@ -0,0 +1,40 @@ +From de58b982935bab5d8e976f27cb5e17aa63555e70 Mon Sep 17 00:00:00 2001 +From: Srinivas Ramana +Date: Thu, 20 Dec 2018 19:05:57 +0530 +Subject: genirq: Make sure the initial affinity is not empty + +[ Upstream commit bddda606ec76550dd63592e32a6e87e7d32583f7 ] + +If all CPUs in the irq_default_affinity mask are offline when an interrupt +is initialized then irq_setup_affinity() can set an empty affinity mask for +a newly allocated interrupt. + +Fix this by falling back to cpu_online_mask in case the resulting affinity +mask is zero. + +Signed-off-by: Srinivas Ramana +Signed-off-by: Thomas Gleixner +Cc: linux-arm-msm@vger.kernel.org +Link: https://lkml.kernel.org/r/1545312957-8504-1-git-send-email-sramana@codeaurora.org +Signed-off-by: Sasha Levin +--- + kernel/irq/manage.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index 9dbdccab3b6a3..5c0ba5ca59308 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -393,6 +393,9 @@ int irq_setup_affinity(struct irq_desc *desc) + } + + cpumask_and(&mask, cpu_online_mask, set); ++ if (cpumask_empty(&mask)) ++ cpumask_copy(&mask, cpu_online_mask); ++ + if (node != NUMA_NO_NODE) { + const struct cpumask *nodemask = cpumask_of_node(node); + +-- +2.19.1 + diff --git a/queue-4.19/hv_netvsc-fix-ethtool-change-hash-key-error.patch b/queue-4.19/hv_netvsc-fix-ethtool-change-hash-key-error.patch new file mode 100644 index 00000000000..904594a18fd --- /dev/null +++ b/queue-4.19/hv_netvsc-fix-ethtool-change-hash-key-error.patch @@ -0,0 +1,81 @@ +From def5bc3f60ba0cdd38011fd638d29a3744311532 Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:42 +0000 +Subject: hv_netvsc: Fix ethtool change hash key error + +[ Upstream commit b4a10c750424e01b5e37372fef0a574ebf7b56c3 ] + +Hyper-V hosts require us to disable RSS before changing RSS key, +otherwise the changing request will fail. This patch fixes the +coding error. + +Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") +Reported-by: Wei Hu +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/rndis_filter.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 2a5209f23f296..0b05f7ebeb01e 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -715,8 +715,8 @@ rndis_filter_set_offload_params(struct net_device *ndev, + return ret; + } + +-int rndis_filter_set_rss_param(struct rndis_device *rdev, +- const u8 *rss_key) ++static int rndis_set_rss_param_msg(struct rndis_device *rdev, ++ const u8 *rss_key, u16 flag) + { + struct net_device *ndev = rdev->ndev; + struct rndis_request *request; +@@ -745,7 +745,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + rssp->hdr.type = NDIS_OBJECT_TYPE_RSS_PARAMETERS; + rssp->hdr.rev = NDIS_RECEIVE_SCALE_PARAMETERS_REVISION_2; + rssp->hdr.size = sizeof(struct ndis_recv_scale_param); +- rssp->flag = 0; ++ rssp->flag = flag; + rssp->hashinfo = NDIS_HASH_FUNC_TOEPLITZ | NDIS_HASH_IPV4 | + NDIS_HASH_TCP_IPV4 | NDIS_HASH_IPV6 | + NDIS_HASH_TCP_IPV6; +@@ -770,9 +770,12 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + + wait_for_completion(&request->wait_event); + set_complete = &request->response_msg.msg.set_complete; +- if (set_complete->status == RNDIS_STATUS_SUCCESS) +- memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); +- else { ++ if (set_complete->status == RNDIS_STATUS_SUCCESS) { ++ if (!(flag & NDIS_RSS_PARAM_FLAG_DISABLE_RSS) && ++ !(flag & NDIS_RSS_PARAM_FLAG_HASH_KEY_UNCHANGED)) ++ memcpy(rdev->rss_key, rss_key, NETVSC_HASH_KEYLEN); ++ ++ } else { + netdev_err(ndev, "Fail to set RSS parameters:0x%x\n", + set_complete->status); + ret = -EINVAL; +@@ -783,6 +786,16 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + return ret; + } + ++int rndis_filter_set_rss_param(struct rndis_device *rdev, ++ const u8 *rss_key) ++{ ++ /* Disable RSS before change */ ++ rndis_set_rss_param_msg(rdev, rss_key, ++ NDIS_RSS_PARAM_FLAG_DISABLE_RSS); ++ ++ return rndis_set_rss_param_msg(rdev, rss_key, 0); ++} ++ + static int rndis_filter_query_device_link_status(struct rndis_device *dev, + struct netvsc_device *net_device) + { +-- +2.19.1 + diff --git a/queue-4.19/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch b/queue-4.19/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch new file mode 100644 index 00000000000..f169d139bfc --- /dev/null +++ b/queue-4.19/hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch @@ -0,0 +1,133 @@ +From c96df1c2a74fb65b59d5597019f9d3e19bc5f7ac Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:44 +0000 +Subject: hv_netvsc: Fix hash key value reset after other ops + +[ Upstream commit 17d91256898402daf4425cc541ac9cbf64574d9a ] + +Changing mtu, channels, or buffer sizes ops call to netvsc_attach(), +rndis_set_subchannel(), which always reset the hash key to default +value. That will override hash key changed previously. This patch +fixes the problem by save the hash key, then restore it when we re- +add the netvsc device. + +Fixes: ff4a44199012 ("netvsc: allow get/set of RSS indirection table") +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/hyperv_net.h | 10 +++++++--- + drivers/net/hyperv/netvsc.c | 2 +- + drivers/net/hyperv/netvsc_drv.c | 5 ++++- + drivers/net/hyperv/rndis_filter.c | 9 +++++++-- + 4 files changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index a32ded5b4f416..42d284669b03a 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -144,6 +144,8 @@ struct hv_netvsc_packet { + u32 total_data_buflen; + }; + ++#define NETVSC_HASH_KEYLEN 40 ++ + struct netvsc_device_info { + unsigned char mac_adr[ETH_ALEN]; + u32 num_chn; +@@ -151,6 +153,8 @@ struct netvsc_device_info { + u32 recv_sections; + u32 send_section_size; + u32 recv_section_size; ++ ++ u8 rss_key[NETVSC_HASH_KEYLEN]; + }; + + enum rndis_device_state { +@@ -160,8 +164,6 @@ enum rndis_device_state { + RNDIS_DEV_DATAINITIALIZED, + }; + +-#define NETVSC_HASH_KEYLEN 40 +- + struct rndis_device { + struct net_device *ndev; + +@@ -210,7 +212,9 @@ int netvsc_recv_callback(struct net_device *net, + void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev); ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info); + int rndis_filter_open(struct netvsc_device *nvdev); + int rndis_filter_close(struct netvsc_device *nvdev); + struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index fe01e141c8f87..1a942feab9548 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -84,7 +84,7 @@ static void netvsc_subchan_work(struct work_struct *w) + + rdev = nvdev->extension; + if (rdev) { +- ret = rndis_set_subchannel(rdev->ndev, nvdev); ++ ret = rndis_set_subchannel(rdev->ndev, nvdev, NULL); + if (ret == 0) { + netif_device_attach(rdev->ndev); + } else { +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index bece935567c14..c9e2a986ccb72 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -875,6 +875,9 @@ static struct netvsc_device_info *netvsc_devinfo_get + dev_info->send_section_size = nvdev->send_section_size; + dev_info->recv_sections = nvdev->recv_section_cnt; + dev_info->recv_section_size = nvdev->recv_section_size; ++ ++ memcpy(dev_info->rss_key, nvdev->extension->rss_key, ++ NETVSC_HASH_KEYLEN); + } else { + dev_info->num_chn = VRSS_CHANNEL_DEFAULT; + dev_info->send_sections = NETVSC_DEFAULT_TX; +@@ -937,7 +940,7 @@ static int netvsc_attach(struct net_device *ndev, + return PTR_ERR(nvdev); + + if (nvdev->num_chn > 1) { +- ret = rndis_set_subchannel(ndev, nvdev); ++ ret = rndis_set_subchannel(ndev, nvdev, dev_info); + + /* if unavailable, just proceed with one queue */ + if (ret) { +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 0b05f7ebeb01e..53c6039bffb67 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1075,7 +1075,9 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) + * This breaks overlap of processing the host message for the + * new primary channel with the initialization of sub-channels. + */ +-int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) ++int rndis_set_subchannel(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ struct netvsc_device_info *dev_info) + { + struct nvsp_message *init_packet = &nvdev->channel_init_pkt; + struct net_device_context *ndev_ctx = netdev_priv(ndev); +@@ -1116,7 +1118,10 @@ int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) + atomic_read(&nvdev->open_chn) == nvdev->num_chn); + + /* ignore failues from setting rss parameters, still have channels */ +- rndis_filter_set_rss_param(rdev, netvsc_hash_key); ++ if (dev_info) ++ rndis_filter_set_rss_param(rdev, dev_info->rss_key); ++ else ++ rndis_filter_set_rss_param(rdev, netvsc_hash_key); + + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); +-- +2.19.1 + diff --git a/queue-4.19/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch b/queue-4.19/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch new file mode 100644 index 00000000000..6ad3630ec27 --- /dev/null +++ b/queue-4.19/hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch @@ -0,0 +1,278 @@ +From 6e780175fc320cdbef7a9a199b7735f63c17f035 Mon Sep 17 00:00:00 2001 +From: Haiyang Zhang +Date: Tue, 15 Jan 2019 00:51:43 +0000 +Subject: hv_netvsc: Refactor assignments of struct netvsc_device_info + +[ Upstream commit 7c9f335a3ff20557a92584199f3d35c7e992bbe5 ] + +These assignments occur in multiple places. The patch refactor them +to a function for simplicity. It also puts the struct to heap area +for future expension. + +Signed-off-by: Haiyang Zhang +Reviewed-by: Michael Kelley +[sl: fix up subject line] +Signed-off-by: Sasha Levin +--- + drivers/net/hyperv/netvsc_drv.c | 134 ++++++++++++++++++++------------ + 1 file changed, 85 insertions(+), 49 deletions(-) + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 1c37a821895b7..bece935567c14 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -856,6 +856,36 @@ static void netvsc_get_channels(struct net_device *net, + } + } + ++/* Alloc struct netvsc_device_info, and initialize it from either existing ++ * struct netvsc_device, or from default values. ++ */ ++static struct netvsc_device_info *netvsc_devinfo_get ++ (struct netvsc_device *nvdev) ++{ ++ struct netvsc_device_info *dev_info; ++ ++ dev_info = kzalloc(sizeof(*dev_info), GFP_ATOMIC); ++ ++ if (!dev_info) ++ return NULL; ++ ++ if (nvdev) { ++ dev_info->num_chn = nvdev->num_chn; ++ dev_info->send_sections = nvdev->send_section_cnt; ++ dev_info->send_section_size = nvdev->send_section_size; ++ dev_info->recv_sections = nvdev->recv_section_cnt; ++ dev_info->recv_section_size = nvdev->recv_section_size; ++ } else { ++ dev_info->num_chn = VRSS_CHANNEL_DEFAULT; ++ dev_info->send_sections = NETVSC_DEFAULT_TX; ++ dev_info->send_section_size = NETVSC_SEND_SECTION_SIZE; ++ dev_info->recv_sections = NETVSC_DEFAULT_RX; ++ dev_info->recv_section_size = NETVSC_RECV_SECTION_SIZE; ++ } ++ ++ return dev_info; ++} ++ + static int netvsc_detach(struct net_device *ndev, + struct netvsc_device *nvdev) + { +@@ -941,7 +971,7 @@ static int netvsc_set_channels(struct net_device *net, + struct net_device_context *net_device_ctx = netdev_priv(net); + struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); + unsigned int orig, count = channels->combined_count; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret; + + /* We do not support separate count for rx, tx, or other */ +@@ -960,24 +990,26 @@ static int netvsc_set_channels(struct net_device *net, + + orig = nvdev->num_chn; + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = count; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->num_chn = count; + + ret = netvsc_detach(net, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(net, &device_info); ++ ret = netvsc_attach(net, device_info); + if (ret) { +- device_info.num_chn = orig; +- if (netvsc_attach(net, &device_info)) ++ device_info->num_chn = orig; ++ if (netvsc_attach(net, device_info)) + netdev_err(net, "restoring channel setting failed\n"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1044,48 +1076,45 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); + int orig_mtu = ndev->mtu; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + int ret = 0; + + if (!nvdev || nvdev->destroy) + return -ENODEV; + ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ + /* Change MTU of underlying VF netdev first. */ + if (vf_netdev) { + ret = dev_set_mtu(vf_netdev, mtu); + if (ret) +- return ret; ++ goto out; + } + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = nvdev->send_section_cnt; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = nvdev->recv_section_cnt; +- device_info.recv_section_size = nvdev->recv_section_size; +- + ret = netvsc_detach(ndev, nvdev); + if (ret) + goto rollback_vf; + + ndev->mtu = mtu; + +- ret = netvsc_attach(ndev, &device_info); +- if (ret) +- goto rollback; +- +- return 0; ++ ret = netvsc_attach(ndev, device_info); ++ if (!ret) ++ goto out; + +-rollback: + /* Attempt rollback to original MTU */ + ndev->mtu = orig_mtu; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring mtu failed\n"); + rollback_vf: + if (vf_netdev) + dev_set_mtu(vf_netdev, orig_mtu); + ++out: ++ kfree(device_info); + return ret; + } + +@@ -1690,7 +1719,7 @@ static int netvsc_set_ringparam(struct net_device *ndev, + { + struct net_device_context *ndevctx = netdev_priv(ndev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info; + struct ethtool_ringparam orig; + u32 new_tx, new_rx; + int ret = 0; +@@ -1710,26 +1739,29 @@ static int netvsc_set_ringparam(struct net_device *ndev, + new_rx == orig.rx_pending) + return 0; /* no change */ + +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = nvdev->num_chn; +- device_info.send_sections = new_tx; +- device_info.send_section_size = nvdev->send_section_size; +- device_info.recv_sections = new_rx; +- device_info.recv_section_size = nvdev->recv_section_size; ++ device_info = netvsc_devinfo_get(nvdev); ++ ++ if (!device_info) ++ return -ENOMEM; ++ ++ device_info->send_sections = new_tx; ++ device_info->recv_sections = new_rx; + + ret = netvsc_detach(ndev, nvdev); + if (ret) +- return ret; ++ goto out; + +- ret = netvsc_attach(ndev, &device_info); ++ ret = netvsc_attach(ndev, device_info); + if (ret) { +- device_info.send_sections = orig.tx_pending; +- device_info.recv_sections = orig.rx_pending; ++ device_info->send_sections = orig.tx_pending; ++ device_info->recv_sections = orig.rx_pending; + +- if (netvsc_attach(ndev, &device_info)) ++ if (netvsc_attach(ndev, device_info)) + netdev_err(ndev, "restoring ringparam failed"); + } + ++out: ++ kfree(device_info); + return ret; + } + +@@ -2158,7 +2190,7 @@ static int netvsc_probe(struct hv_device *dev, + { + struct net_device *net = NULL; + struct net_device_context *net_device_ctx; +- struct netvsc_device_info device_info; ++ struct netvsc_device_info *device_info = NULL; + struct netvsc_device *nvdev; + int ret = -ENOMEM; + +@@ -2205,21 +2237,21 @@ static int netvsc_probe(struct hv_device *dev, + netif_set_real_num_rx_queues(net, 1); + + /* Notify the netvsc driver of the new device */ +- memset(&device_info, 0, sizeof(device_info)); +- device_info.num_chn = VRSS_CHANNEL_DEFAULT; +- device_info.send_sections = NETVSC_DEFAULT_TX; +- device_info.send_section_size = NETVSC_SEND_SECTION_SIZE; +- device_info.recv_sections = NETVSC_DEFAULT_RX; +- device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE; +- +- nvdev = rndis_filter_device_add(dev, &device_info); ++ device_info = netvsc_devinfo_get(NULL); ++ ++ if (!device_info) { ++ ret = -ENOMEM; ++ goto devinfo_failed; ++ } ++ ++ nvdev = rndis_filter_device_add(dev, device_info); + if (IS_ERR(nvdev)) { + ret = PTR_ERR(nvdev); + netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); + goto rndis_failed; + } + +- memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); ++ memcpy(net->dev_addr, device_info->mac_adr, ETH_ALEN); + + /* We must get rtnl lock before scheduling nvdev->subchan_work, + * otherwise netvsc_subchan_work() can get rtnl lock first and wait +@@ -2257,12 +2289,16 @@ static int netvsc_probe(struct hv_device *dev, + + list_add(&net_device_ctx->list, &netvsc_dev_list); + rtnl_unlock(); ++ ++ kfree(device_info); + return 0; + + register_failed: + rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: ++ kfree(device_info); ++devinfo_failed: + free_percpu(net_device_ctx->vf_stats); + no_stats: + hv_set_drvdata(dev, NULL); +-- +2.19.1 + diff --git a/queue-4.19/ibmveth-do-not-process-frames-after-calling-napi_res.patch b/queue-4.19/ibmveth-do-not-process-frames-after-calling-napi_res.patch new file mode 100644 index 00000000000..7bafdf18be0 --- /dev/null +++ b/queue-4.19/ibmveth-do-not-process-frames-after-calling-napi_res.patch @@ -0,0 +1,43 @@ +From c45dd362107e028d609bf03eb4d64d180eba7d1a Mon Sep 17 00:00:00 2001 +From: Thomas Falcon +Date: Thu, 24 Jan 2019 11:17:01 -0600 +Subject: ibmveth: Do not process frames after calling napi_reschedule + +[ Upstream commit e95d22c69b2c130ccce257b84daf283fd82d611e ] + +The IBM virtual ethernet driver's polling function continues +to process frames after rescheduling NAPI, resulting in a warning +if it exhausted its budget. Do not restart polling after calling +napi_reschedule. Instead let frames be processed in the following +instance. + +Signed-off-by: Thomas Falcon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmveth.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index 91f48c0780734..f70cb4d3c6846 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1314,7 +1314,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + unsigned long lpar_rc; + u16 mss = 0; + +-restart_poll: + while (frames_processed < budget) { + if (!ibmveth_rxq_pending_buffer(adapter)) + break; +@@ -1402,7 +1401,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) + napi_reschedule(napi)) { + lpar_rc = h_vio_signal(adapter->vdev->unit_address, + VIO_IRQ_DISABLE); +- goto restart_poll; + } + } + +-- +2.19.1 + diff --git a/queue-4.19/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch b/queue-4.19/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch new file mode 100644 index 00000000000..840dce376e8 --- /dev/null +++ b/queue-4.19/irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch @@ -0,0 +1,34 @@ +From a4a622bf94eab9692f998cfa224a06122e84918c Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Fri, 26 Oct 2018 15:51:17 +0800 +Subject: irqchip/gic-v3-mbi: Fix uninitialized mbi_lock + +[ Upstream commit c530bb8a726a37811e9fb5d68cd6b5408173b545 ] + +The mbi_lock mutex is left uninitialized, so let's use DEFINE_MUTEX +to initialize it statically. + +Fixes: 505287525c24d ("irqchip/gic-v3: Add support for Message Based Interrupts as an MSI controller") +Signed-off-by: Yang Yingliang +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-gic-v3-mbi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/irqchip/irq-gic-v3-mbi.c b/drivers/irqchip/irq-gic-v3-mbi.c +index ad70e7c416e30..fbfa7ff6deb16 100644 +--- a/drivers/irqchip/irq-gic-v3-mbi.c ++++ b/drivers/irqchip/irq-gic-v3-mbi.c +@@ -24,7 +24,7 @@ struct mbi_range { + unsigned long *bm; + }; + +-static struct mutex mbi_lock; ++static DEFINE_MUTEX(mbi_lock); + static phys_addr_t mbi_phys_base; + static struct mbi_range *mbi_ranges; + static unsigned int mbi_range_nr; +-- +2.19.1 + diff --git a/queue-4.19/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch b/queue-4.19/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch new file mode 100644 index 00000000000..cf54d742f5c --- /dev/null +++ b/queue-4.19/kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch @@ -0,0 +1,47 @@ +From 162ec9e45830ea70786fba3a24b6c3afe94669ab Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Mon, 7 Jan 2019 19:44:51 +0100 +Subject: KVM: nSVM: clear events pending from svm_complete_interrupts() when + exiting to L1 + +[ Upstream commit 619ad846fc3452adaf71ca246c5aa711e2055398 ] + +kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being +delivered to the host (L1) when it's running nested. The problem seems to +be: svm_complete_interrupts() raises 'nmi_injected' flag but later we +decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI +injection upon entry so it got delivered to L1 instead of L2. + +It seems that VMX code solves the same issue in prepare_vmcs12(), this was +introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework +event injection and recovery"). + +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 8241fd27de19c..b475419620121 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -3399,6 +3399,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm) + kvm_mmu_reset_context(&svm->vcpu); + kvm_mmu_load(&svm->vcpu); + ++ /* ++ * Drop what we picked up for L2 via svm_complete_interrupts() so it ++ * doesn't end up in L1. ++ */ ++ svm->vcpu.arch.nmi_injected = false; ++ kvm_clear_exception_queue(&svm->vcpu); ++ kvm_clear_interrupt_queue(&svm->vcpu); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch b/queue-4.19/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch new file mode 100644 index 00000000000..6ace48250fa --- /dev/null +++ b/queue-4.19/kvm-selftests-fix-region-overlap-check-in-kvm_util.patch @@ -0,0 +1,58 @@ +From 2ee52999f528b076ed1294602c572cbce6ef5e9d Mon Sep 17 00:00:00 2001 +From: Ben Gardon +Date: Wed, 16 Jan 2019 09:41:15 -0800 +Subject: kvm: selftests: Fix region overlap check in kvm_util + +[ Upstream commit 94a980c39c8e3f8abaff5d3b5bbcd4ccf1c02c4f ] + +Fix a call to userspace_mem_region_find to conform to its spec of +taking an inclusive, inclusive range. It was previously being called +with an inclusive, exclusive range. Also remove a redundant region bounds +check in vm_userspace_mem_region_add. Region overlap checking is already +performed by the call to userspace_mem_region_find. + +Tested: Compiled tools/testing/selftests/kvm with -static + Ran all resulting test binaries on an Intel Haswell test machine + All tests passed + +Signed-off-by: Ben Gardon +Reviewed-by: Jim Mattson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/lib/kvm_util.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c +index 6fd8c089cafcd..fb5d2d1e0c048 100644 +--- a/tools/testing/selftests/kvm/lib/kvm_util.c ++++ b/tools/testing/selftests/kvm/lib/kvm_util.c +@@ -590,7 +590,7 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + * already exist. + */ + region = (struct userspace_mem_region *) userspace_mem_region_find( +- vm, guest_paddr, guest_paddr + npages * vm->page_size); ++ vm, guest_paddr, (guest_paddr + npages * vm->page_size) - 1); + if (region != NULL) + TEST_ASSERT(false, "overlapping userspace_mem_region already " + "exists\n" +@@ -606,15 +606,10 @@ void vm_userspace_mem_region_add(struct kvm_vm *vm, + region = region->next) { + if (region->region.slot == slot) + break; +- if ((guest_paddr <= (region->region.guest_phys_addr +- + region->region.memory_size)) +- && ((guest_paddr + npages * vm->page_size) +- >= region->region.guest_phys_addr)) +- break; + } + if (region != NULL) + TEST_ASSERT(false, "A mem region with the requested slot " +- "or overlapping physical memory range already exists.\n" ++ "already exists.\n" + " requested slot: %u paddr: 0x%lx npages: 0x%lx\n" + " existing slot: %u paddr: 0x%lx size: 0x%lx", + slot, guest_paddr, npages, +-- +2.19.1 + diff --git a/queue-4.19/locking-rwsem-fix-possible-missed-wakeup.patch b/queue-4.19/locking-rwsem-fix-possible-missed-wakeup.patch new file mode 100644 index 00000000000..7910d5a136d --- /dev/null +++ b/queue-4.19/locking-rwsem-fix-possible-missed-wakeup.patch @@ -0,0 +1,63 @@ +From 70eb3bda42f7139c735a2840ac73c90efb556a9d Mon Sep 17 00:00:00 2001 +From: Xie Yongji +Date: Thu, 29 Nov 2018 20:50:30 +0800 +Subject: locking/rwsem: Fix (possible) missed wakeup + +[ Upstream commit e158488be27b157802753a59b336142dc0eb0380 ] + +Because wake_q_add() can imply an immediate wakeup (cmpxchg failure +case), we must not rely on the wakeup being delayed. However, commit: + + e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") + +relies on exactly that behaviour in that the wakeup must not happen +until after we clear waiter->task. + +[ peterz: Added changelog. ] + +Signed-off-by: Xie Yongji +Signed-off-by: Zhang Yu +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: e38513905eea ("locking/rwsem: Rework zeroing reader waiter->task") +Link: https://lkml.kernel.org/r/1543495830-2644-1-git-send-email-xieyongji@baidu.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/locking/rwsem-xadd.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index 3064c50e181e1..ef909357b84e1 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -198,15 +198,22 @@ static void __rwsem_mark_wake(struct rw_semaphore *sem, + woken++; + tsk = waiter->task; + +- wake_q_add(wake_q, tsk); ++ get_task_struct(tsk); + list_del(&waiter->list); + /* +- * Ensure that the last operation is setting the reader ++ * Ensure calling get_task_struct() before setting the reader + * waiter to nil such that rwsem_down_read_failed() cannot + * race with do_exit() by always holding a reference count + * to the task to wakeup. + */ + smp_store_release(&waiter->task, NULL); ++ /* ++ * Ensure issuing the wakeup (either by us or someone else) ++ * after setting the reader waiter to nil. ++ */ ++ wake_q_add(wake_q, tsk); ++ /* wake_q_add() already take the task ref */ ++ put_task_struct(tsk); + } + + adjustment = woken * RWSEM_ACTIVE_READ_BIAS - adjustment; +-- +2.19.1 + diff --git a/queue-4.19/mac80211-add-attribute-aligned-2-to-struct-action.patch b/queue-4.19/mac80211-add-attribute-aligned-2-to-struct-action.patch new file mode 100644 index 00000000000..12b0bdf4da9 --- /dev/null +++ b/queue-4.19/mac80211-add-attribute-aligned-2-to-struct-action.patch @@ -0,0 +1,62 @@ +From 171fb7eeb69ea01acb7e7954e9b0017307f1d9db Mon Sep 17 00:00:00 2001 +From: Mathieu Malaterre +Date: Thu, 24 Jan 2019 19:19:57 +0100 +Subject: mac80211: Add attribute aligned(2) to struct 'action' + +[ Upstream commit 7c53eb5d87bc21464da4268c3c0c47457b6d9c9b ] + +During refactor in commit 9e478066eae4 ("mac80211: fix MU-MIMO +follow-MAC mode") a new struct 'action' was declared with packed +attribute as: + + struct { + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; + } __packed action; + +But since struct 'ieee80211_hdr_3addr' is declared with an aligned +keyword as: + + struct ieee80211_hdr { + __le16 frame_control; + __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; + __le16 seq_ctrl; + u8 addr4[ETH_ALEN]; + } __packed __aligned(2); + +Solve the ambiguity of placing aligned structure in a packed one by +adding the aligned(2) attribute to struct 'action'. + +This removes the following warning (W=1): + + net/mac80211/rx.c:234:2: warning: alignment 1 of 'struct ' is less than 2 [-Wpacked-not-aligned] + +Cc: Johannes Berg +Suggested-by: Johannes Berg +Signed-off-by: Mathieu Malaterre +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index d7a05a9944421..e946ee4f335bd 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -221,7 +221,7 @@ static void ieee80211_handle_mu_mimo_mon(struct ieee80211_sub_if_data *sdata, + struct ieee80211_hdr_3addr hdr; + u8 category; + u8 action_code; +- } __packed action; ++ } __packed __aligned(2) action; + + if (!sdata) + return; +-- +2.19.1 + diff --git a/queue-4.19/mac80211-don-t-initiate-tdls-connection-if-station-i.patch b/queue-4.19/mac80211-don-t-initiate-tdls-connection-if-station-i.patch new file mode 100644 index 00000000000..e9da3f69503 --- /dev/null +++ b/queue-4.19/mac80211-don-t-initiate-tdls-connection-if-station-i.patch @@ -0,0 +1,57 @@ +From b5b9d81745870106fc8cd416b6d76b9d7ced04f7 Mon Sep 17 00:00:00 2001 +From: Balaji Pothunoori +Date: Mon, 21 Jan 2019 12:30:43 +0530 +Subject: mac80211: don't initiate TDLS connection if station is not associated + to AP + +[ Upstream commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce ] + +Following call trace is observed while adding TDLS peer entry in driver +during TDLS setup. + +Call Trace: +[] dump_stack+0x47/0x61 +[] __warn+0xe2/0x100 +[] ? sta_apply_parameters+0x49f/0x550 [mac80211] +[] warn_slowpath_null+0x25/0x30 +[] sta_apply_parameters+0x49f/0x550 [mac80211] +[] ? sta_info_alloc+0x1c2/0x450 [mac80211] +[] ieee80211_add_station+0xe3/0x160 [mac80211] +[] nl80211_new_station+0x273/0x420 +[] genl_rcv_msg+0x219/0x3c0 +[] ? genl_rcv+0x30/0x30 +[] netlink_rcv_skb+0x8e/0xb0 +[] genl_rcv+0x1c/0x30 +[] netlink_unicast+0x13a/0x1d0 +[] netlink_sendmsg+0x2d8/0x390 +[] sock_sendmsg+0x2d/0x40 +[] ___sys_sendmsg+0x1d9/0x1e0 + +Fixing this by allowing TDLS setup request only when we have completed +association. + +Signed-off-by: Balaji Pothunoori +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index c2abe9db1ea24..40c5102234679 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -1478,6 +1478,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, + if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) + sta->sta.tdls = true; + ++ if (sta->sta.tdls && sdata->vif.type == NL80211_IFTYPE_STATION && ++ !sdata->u.mgd.associated) ++ return -EINVAL; ++ + err = sta_apply_parameters(local, sta, params); + if (err) { + sta_info_free(local, sta); +-- +2.19.1 + diff --git a/queue-4.19/mac80211-fix-miscounting-of-ttl-dropped-frames.patch b/queue-4.19/mac80211-fix-miscounting-of-ttl-dropped-frames.patch new file mode 100644 index 00000000000..37449bf658a --- /dev/null +++ b/queue-4.19/mac80211-fix-miscounting-of-ttl-dropped-frames.patch @@ -0,0 +1,44 @@ +From e3443fa00c63e1e712376dfb49c4b78394575e1d Mon Sep 17 00:00:00 2001 +From: Bob Copeland +Date: Thu, 17 Jan 2019 16:32:42 -0500 +Subject: mac80211: fix miscounting of ttl-dropped frames + +[ Upstream commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c ] + +In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl' +counter when we decrement the ttl to zero. For unicast frames +destined for other hosts, we stop processing the frame at that point. + +For multicast frames, we do not rebroadcast it in this case, but we +do pass the frame up the stack to process it on this STA. That +doesn't match the usual definition of "dropped," so don't count +those as such. + +With this change, something like `ping6 -i0.2 ff02::1%mesh0` from a +peer in a ttl=1 network no longer increments the counter rapidly. + +Signed-off-by: Bob Copeland +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 828348b2a504d..d7a05a9944421 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2678,7 +2678,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + skb_set_queue_mapping(skb, q); + + if (!--mesh_hdr->ttl) { +- IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl); ++ if (!is_multicast_ether_addr(hdr->addr1)) ++ IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, ++ dropped_frames_ttl); + goto out; + } + +-- +2.19.1 + diff --git a/queue-4.19/net-altera_tse-fix-connect_local_phy-error-path.patch b/queue-4.19/net-altera_tse-fix-connect_local_phy-error-path.patch new file mode 100644 index 00000000000..c3d41fcea0b --- /dev/null +++ b/queue-4.19/net-altera_tse-fix-connect_local_phy-error-path.patch @@ -0,0 +1,37 @@ +From 513c243e677dfa2508b760cad593f97afe9db04b Mon Sep 17 00:00:00 2001 +From: Atsushi Nemoto +Date: Mon, 21 Jan 2019 17:26:41 +0900 +Subject: net: altera_tse: fix connect_local_phy error path + +[ Upstream commit 17b42a20d7ca59377788c6a2409e77569570cc10 ] + +The connect_local_phy should return NULL (not negative errno) on +error, since its caller expects it. + +Signed-off-by: Atsushi Nemoto +Acked-by: Thor Thayer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/altera/altera_tse_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/altera/altera_tse_main.c b/drivers/net/ethernet/altera/altera_tse_main.c +index baca8f704a459..c3c1195021a2b 100644 +--- a/drivers/net/ethernet/altera/altera_tse_main.c ++++ b/drivers/net/ethernet/altera/altera_tse_main.c +@@ -714,8 +714,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) + + phydev = phy_connect(dev, phy_id_fmt, &altera_tse_adjust_link, + priv->phy_iface); +- if (IS_ERR(phydev)) ++ if (IS_ERR(phydev)) { + netdev_err(dev, "Could not attach to PHY\n"); ++ phydev = NULL; ++ } + + } else { + int ret; +-- +2.19.1 + diff --git a/queue-4.19/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch b/queue-4.19/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch new file mode 100644 index 00000000000..35378cc7fd3 --- /dev/null +++ b/queue-4.19/net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch @@ -0,0 +1,36 @@ +From 5693d459c561a0e618d5580fa16fa0772c531c77 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Maciej=20=C5=BBenczykowski?= +Date: Thu, 24 Jan 2019 03:07:02 -0800 +Subject: net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3b707c3008cad04604c1f50e39f456621821c414 ] + +__bpf_redirect() and act_mirred checks this boolean +to determine whether to prefix an ethernet header. + +Signed-off-by: Maciej Żenczykowski +Acked-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/if_arp.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/if_arp.h b/include/linux/if_arp.h +index 6756fea18b69f..e44746de95cdf 100644 +--- a/include/linux/if_arp.h ++++ b/include/linux/if_arp.h +@@ -54,6 +54,7 @@ static inline bool dev_is_mac_header_xmit(const struct net_device *dev) + case ARPHRD_IPGRE: + case ARPHRD_VOID: + case ARPHRD_NONE: ++ case ARPHRD_RAWIP: + return false; + default: + return true; +-- +2.19.1 + diff --git a/queue-4.19/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch b/queue-4.19/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch new file mode 100644 index 00000000000..1498e5f4001 --- /dev/null +++ b/queue-4.19/net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch @@ -0,0 +1,63 @@ +From d232a83aad0d3964142933c6b861a4882cffa9c1 Mon Sep 17 00:00:00 2001 +From: Zhang Run +Date: Thu, 24 Jan 2019 13:48:49 +0800 +Subject: net: usb: asix: ax88772_bind return error when hw_reset fail + +[ Upstream commit 6eea3527e68acc22483f4763c8682f223eb90029 ] + +The ax88772_bind() should return error code immediately when the PHY +was not reset properly through ax88772a_hw_reset(). +Otherwise, The asix_get_phyid() will block when get the PHY +Identifier from the PHYSID1 MII registers through asix_mdio_read() +due to the PHY isn't ready. Furthermore, it will produce a lot of +error message cause system crash.As follows: +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to send + software reset: ffffffb9 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable + software MII access +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write + reg index 0x0000: -71 +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to enable + software MII access +asix 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read + reg index 0x0000: -71 +... + +Signed-off-by: Zhang Run +Reviewed-by: Yang Wei +Tested-by: Marcel Ziswiler +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix_devices.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index b654f05b2ccd0..3d93993e74da0 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -739,8 +739,13 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + asix_read_cmd(dev, AX_CMD_STATMNGSTS_REG, 0, 0, 1, &chipcode, 0); + chipcode &= AX_CHIPCODE_MASK; + +- (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : +- ax88772a_hw_reset(dev, 0); ++ ret = (chipcode == AX_AX88772_CHIPCODE) ? ax88772_hw_reset(dev, 0) : ++ ax88772a_hw_reset(dev, 0); ++ ++ if (ret < 0) { ++ netdev_dbg(dev->net, "Failed to reset AX88772: %d\n", ret); ++ return ret; ++ } + + /* Read PHYID register *AFTER* the PHY was reset properly */ + phyid = asix_get_phyid(dev); +-- +2.19.1 + diff --git a/queue-4.19/nvme-multipath-drop-optimization-for-static-ana-grou.patch b/queue-4.19/nvme-multipath-drop-optimization-for-static-ana-grou.patch new file mode 100644 index 00000000000..c72308dd175 --- /dev/null +++ b/queue-4.19/nvme-multipath-drop-optimization-for-static-ana-grou.patch @@ -0,0 +1,43 @@ +From 2ab10acbfdaa0eea29b3d9cb87cbc963591dc51a Mon Sep 17 00:00:00 2001 +From: Hannes Reinecke +Date: Wed, 9 Jan 2019 09:45:15 +0100 +Subject: nvme-multipath: drop optimization for static ANA group IDs + +[ Upstream commit 78a61cd42a64f3587862b372a79e1d6aaf131fd7 ] + +Bit 6 in the ANACAP field is used to indicate that the ANA group ID +doesn't change while the namespace is attached to the controller. +There is an optimisation in the code to only allocate space +for the ANA group header, as the namespace list won't change and +hence would not need to be refreshed. +However, this optimisation was never carried over to the actual +workflow, which always assumes that the buffer is large enough +to hold the ANA header _and_ the namespace list. +So drop this optimisation and always allocate enough space. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Hannes Reinecke +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 815509dbed846..da8f5ad30c719 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -531,8 +531,7 @@ int nvme_mpath_init(struct nvme_ctrl *ctrl, struct nvme_id_ctrl *id) + timer_setup(&ctrl->anatt_timer, nvme_anatt_timeout, 0); + ctrl->ana_log_size = sizeof(struct nvme_ana_rsp_hdr) + + ctrl->nanagrpid * sizeof(struct nvme_ana_group_desc); +- if (!(ctrl->anacap & (1 << 6))) +- ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); ++ ctrl->ana_log_size += ctrl->max_namespaces * sizeof(__le32); + + if (ctrl->ana_log_size > ctrl->max_hw_sectors << SECTOR_SHIFT) { + dev_err(ctrl->device, +-- +2.19.1 + diff --git a/queue-4.19/nvme-rdma-fix-timeout-handler.patch b/queue-4.19/nvme-rdma-fix-timeout-handler.patch new file mode 100644 index 00000000000..83c140a1dfb --- /dev/null +++ b/queue-4.19/nvme-rdma-fix-timeout-handler.patch @@ -0,0 +1,75 @@ +From 99afadd4cd85e1c005fd0089e6aa035895aa4b1b Mon Sep 17 00:00:00 2001 +From: Sagi Grimberg +Date: Tue, 8 Jan 2019 00:53:22 -0800 +Subject: nvme-rdma: fix timeout handler + +[ Upstream commit 4c174e6366746ae8d49f9cc409f728eebb7a9ac9 ] + +Currently, we have several problems with the timeout +handler: +1. If we timeout on the controller establishment flow, we will hang +because we don't execute the error recovery (and we shouldn't because +the create_ctrl flow needs to fail and cleanup on its own) +2. We might also hang if we get a disconnet on a queue while the +controller is already deleting. This racy flow can cause the controller +disable/shutdown admin command to hang. + +We cannot complete a timed out request from the timeout handler without +mutual exclusion from the teardown flow (e.g. nvme_rdma_error_recovery_work). +So we serialize it in the timeout handler and teardown io and admin +queues to guarantee that no one races with us from completing the +request. + +Reported-by: Jaesoo Lee +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index b6a28de682e85..0939a4e178fb9 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1672,18 +1672,28 @@ static enum blk_eh_timer_return + nvme_rdma_timeout(struct request *rq, bool reserved) + { + struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq); ++ struct nvme_rdma_queue *queue = req->queue; ++ struct nvme_rdma_ctrl *ctrl = queue->ctrl; + +- dev_warn(req->queue->ctrl->ctrl.device, +- "I/O %d QID %d timeout, reset controller\n", +- rq->tag, nvme_rdma_queue_idx(req->queue)); ++ dev_warn(ctrl->ctrl.device, "I/O %d QID %d timeout\n", ++ rq->tag, nvme_rdma_queue_idx(queue)); + +- /* queue error recovery */ +- nvme_rdma_error_recovery(req->queue->ctrl); ++ if (ctrl->ctrl.state != NVME_CTRL_LIVE) { ++ /* ++ * Teardown immediately if controller times out while starting ++ * or we are already started error recovery. all outstanding ++ * requests are completed on shutdown, so we return BLK_EH_DONE. ++ */ ++ flush_work(&ctrl->err_work); ++ nvme_rdma_teardown_io_queues(ctrl, false); ++ nvme_rdma_teardown_admin_queue(ctrl, false); ++ return BLK_EH_DONE; ++ } + +- /* fail with DNR on cmd timeout */ +- nvme_req(rq)->status = NVME_SC_ABORT_REQ | NVME_SC_DNR; ++ dev_warn(ctrl->ctrl.device, "starting error recovery\n"); ++ nvme_rdma_error_recovery(ctrl); + +- return BLK_EH_DONE; ++ return BLK_EH_RESET_TIMER; + } + + static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx, +-- +2.19.1 + diff --git a/queue-4.19/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch b/queue-4.19/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch new file mode 100644 index 00000000000..2ff1725649e --- /dev/null +++ b/queue-4.19/phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch @@ -0,0 +1,43 @@ +From df2bd256f1b74260e3ade5f5abd6b7f732b7a8c2 Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:44:54 +0100 +Subject: phy: ath79-usb: Fix the main reset name to match the DT binding + +[ Upstream commit 827cb0323928952c0db9515aba9d534fb1285b3f ] + +I submitted this driver several times before it got accepted. The +first series hasn't been accepted but the DTS binding did made it. +I then made a second series that added generic reset support to the +PHY core, this in turn required a change to the DT binding. This +second series seemed to have been ignored, so I did a third one +without the change to the PHY core and the DT binding update, and this +last attempt finally made it. + +But two months later the DT binding update from the second series has +been integrated too. So now the driver doesn't match the binding and +the only DTS using it. This patch fix the driver to match the new +binding. + +Signed-off-by: Alban Bedel +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c +index f7d64f3910b4d..09a77e556eceb 100644 +--- a/drivers/phy/qualcomm/phy-ath79-usb.c ++++ b/drivers/phy/qualcomm/phy-ath79-usb.c +@@ -69,7 +69,7 @@ static int ath79_usb_phy_probe(struct platform_device *pdev) + if (!priv) + return -ENOMEM; + +- priv->reset = devm_reset_control_get(&pdev->dev, "usb-phy"); ++ priv->reset = devm_reset_control_get(&pdev->dev, "phy"); + if (IS_ERR(priv->reset)) + return PTR_ERR(priv->reset); + +-- +2.19.1 + diff --git a/queue-4.19/phy-ath79-usb-fix-the-power-on-error-path.patch b/queue-4.19/phy-ath79-usb-fix-the-power-on-error-path.patch new file mode 100644 index 00000000000..66ee881b417 --- /dev/null +++ b/queue-4.19/phy-ath79-usb-fix-the-power-on-error-path.patch @@ -0,0 +1,34 @@ +From fe8115da330ee9aa5de8354fbb07ad7a1050301f Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:44:53 +0100 +Subject: phy: ath79-usb: Fix the power on error path + +[ Upstream commit 009808154c69c48d5b41fc8cf5ad5ab5704efd8f ] + +In the power on function the error path doesn't return the suspend +override to its proper state. It should should deassert this reset +line to enable the suspend override. + +Signed-off-by: Alban Bedel +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-ath79-usb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-ath79-usb.c b/drivers/phy/qualcomm/phy-ath79-usb.c +index 6fd6e07ab345f..f7d64f3910b4d 100644 +--- a/drivers/phy/qualcomm/phy-ath79-usb.c ++++ b/drivers/phy/qualcomm/phy-ath79-usb.c +@@ -31,7 +31,7 @@ static int ath79_usb_phy_power_on(struct phy *phy) + + err = reset_control_deassert(priv->reset); + if (err && priv->no_suspend_override) +- reset_control_assert(priv->no_suspend_override); ++ reset_control_deassert(priv->no_suspend_override); + + return err; + } +-- +2.19.1 + diff --git a/queue-4.19/sched-wait-fix-rcuwait_wake_up-ordering.patch b/queue-4.19/sched-wait-fix-rcuwait_wake_up-ordering.patch new file mode 100644 index 00000000000..15e433cf0c3 --- /dev/null +++ b/queue-4.19/sched-wait-fix-rcuwait_wake_up-ordering.patch @@ -0,0 +1,65 @@ +From c3a8139eedce52a4f008f76708c4334efc6a482a Mon Sep 17 00:00:00 2001 +From: Prateek Sood +Date: Fri, 30 Nov 2018 20:40:56 +0530 +Subject: sched/wait: Fix rcuwait_wake_up() ordering + +[ Upstream commit 6dc080eeb2ba01973bfff0d79844d7a59e12542e ] + +For some peculiar reason rcuwait_wake_up() has the right barrier in +the comment, but not in the code. + +This mistake has been observed to cause a deadlock in the following +situation: + + P1 P2 + + percpu_up_read() percpu_down_write() + rcu_sync_is_idle() // false + rcu_sync_enter() + ... + __percpu_up_read() + +[S] ,- __this_cpu_dec(*sem->read_count) + | smp_rmb(); +[L] | task = rcu_dereference(w->task) // NULL + | + | [S] w->task = current + | smp_mb(); + | [L] readers_active_check() // fail + `-> + +Where the smp_rmb() (obviously) fails to constrain the store. + +[ peterz: Added changelog. ] + +Signed-off-by: Prateek Sood +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andrea Parri +Acked-by: Davidlohr Bueso +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Fixes: 8f95c90ceb54 ("sched/wait, RCU: Introduce rcuwait machinery") +Link: https://lkml.kernel.org/r/1543590656-7157-1-git-send-email-prsood@codeaurora.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/exit.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/exit.c b/kernel/exit.c +index 55b4fa6d01ebd..d607e23fd0c3e 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -307,7 +307,7 @@ void rcuwait_wake_up(struct rcuwait *w) + * MB (A) MB (B) + * [L] cond [L] tsk + */ +- smp_rmb(); /* (B) */ ++ smp_mb(); /* (B) */ + + /* + * Avoid using task_rcu_dereference() magic as long as we are careful, +-- +2.19.1 + diff --git a/queue-4.19/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch b/queue-4.19/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch new file mode 100644 index 00000000000..37b46c5c36a --- /dev/null +++ b/queue-4.19/sched-wake_q-fix-wakeup-ordering-for-wake_q.patch @@ -0,0 +1,94 @@ +From b62099029e96c7743cec11dfa391ff1f0c87980a Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 17 Dec 2018 10:14:53 +0100 +Subject: sched/wake_q: Fix wakeup ordering for wake_q + +[ Upstream commit 4c4e3731564c8945ac5ac90fc2a1e1f21cb79c92 ] + +Notable cmpxchg() does not provide ordering when it fails, however +wake_q_add() requires ordering in this specific case too. Without this +it would be possible for the concurrent wakeup to not observe our +prior state. + +Andrea Parri provided: + + C wake_up_q-wake_q_add + + { + int next = 0; + int y = 0; + } + + P0(int *next, int *y) + { + int r0; + + /* in wake_up_q() */ + + WRITE_ONCE(*next, 1); /* node->next = NULL */ + smp_mb(); /* implied by wake_up_process() */ + r0 = READ_ONCE(*y); + } + + P1(int *next, int *y) + { + int r1; + + /* in wake_q_add() */ + + WRITE_ONCE(*y, 1); /* wake_cond = true */ + smp_mb__before_atomic(); + r1 = cmpxchg_relaxed(next, 1, 2); + } + + exists (0:r0=0 /\ 1:r1=0) + + This "exists" clause cannot be satisfied according to the LKMM: + + Test wake_up_q-wake_q_add Allowed + States 3 + 0:r0=0; 1:r1=1; + 0:r0=1; 1:r1=0; + 0:r0=1; 1:r1=1; + No + Witnesses + Positive: 0 Negative: 3 + Condition exists (0:r0=0 /\ 1:r1=0) + Observation wake_up_q-wake_q_add Never 0 3 + +Reported-by: Yongji Xie +Signed-off-by: Peter Zijlstra (Intel) +Cc: Davidlohr Bueso +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Waiman Long +Cc: Will Deacon +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 13ddfa46d741f..152a0b0c91bb6 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -405,10 +405,11 @@ void wake_q_add(struct wake_q_head *head, struct task_struct *task) + * its already queued (either by us or someone else) and will get the + * wakeup due to that. + * +- * This cmpxchg() executes a full barrier, which pairs with the full +- * barrier executed by the wakeup in wake_up_q(). ++ * In order to ensure that a pending wakeup will observe our pending ++ * state, even in the failed case, an explicit smp_mb() must be used. + */ +- if (cmpxchg(&node->next, NULL, WAKE_Q_TAIL)) ++ smp_mb__before_atomic(); ++ if (cmpxchg_relaxed(&node->next, NULL, WAKE_Q_TAIL)) + return; + + get_task_struct(task); +-- +2.19.1 + diff --git a/queue-4.19/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch b/queue-4.19/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch new file mode 100644 index 00000000000..4890caeabae --- /dev/null +++ b/queue-4.19/scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch @@ -0,0 +1,41 @@ +From 1f6d308a085add0d178a5a45a06614dfcd0bc3e8 Mon Sep 17 00:00:00 2001 +From: Varun Prakash +Date: Sat, 12 Jan 2019 22:14:30 +0530 +Subject: scsi: csiostor: fix NULL pointer dereference in + csio_vport_set_state() + +[ Upstream commit fe35a40e675473eb65f2f5462b82770f324b5689 ] + +Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to +avoid a NULL pointer dereference in csio_vport_set_state(). + +ln->fc_vport is dereferenced in csio_vport_set_state(). + +Signed-off-by: Varun Prakash +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/csiostor/csio_attr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/csiostor/csio_attr.c b/drivers/scsi/csiostor/csio_attr.c +index 8a004036e3d72..9bd2bd8dc2be2 100644 +--- a/drivers/scsi/csiostor/csio_attr.c ++++ b/drivers/scsi/csiostor/csio_attr.c +@@ -594,12 +594,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) + } + + fc_vport_set_state(fc_vport, FC_VPORT_INITIALIZING); ++ ln->fc_vport = fc_vport; + + if (csio_fcoe_alloc_vnp(hw, ln)) + goto error; + + *(struct csio_lnode **)fc_vport->dd_data = ln; +- ln->fc_vport = fc_vport; + if (!fc_vport->node_name) + fc_vport->node_name = wwn_to_u64(csio_ln_wwnn(ln)); + if (!fc_vport->port_name) +-- +2.19.1 + diff --git a/queue-4.19/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch b/queue-4.19/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch new file mode 100644 index 00000000000..c6fbeb6a21e --- /dev/null +++ b/queue-4.19/scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch @@ -0,0 +1,105 @@ +From 5cc980619ed51084ec0f0576e0f4df80ec01b55e Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Thu, 17 Jan 2019 11:14:44 -0500 +Subject: scsi: lpfc: nvme: avoid hang / use-after-free when destroying + localport + +[ Upstream commit 7961cba6f7d8215fa632df3d220e5154bb825249 ] + +We cannot wait on a completion object in the lpfc_nvme_lport structure in +the _destroy_localport() code path because the NVMe/fc transport will free +that structure immediately after the .localport_delete() callback. This +results in a use-after-free, and a hang if slub_debug=FZPU is enabled. + +Fix this by putting the completion on the stack. + +Signed-off-by: Ewan D. Milne +Acked-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvme.c | 16 +++++++++------- + drivers/scsi/lpfc/lpfc_nvme.h | 2 +- + 2 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c +index 918ae18ef8a82..ca62117a2d131 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.c ++++ b/drivers/scsi/lpfc/lpfc_nvme.c +@@ -297,7 +297,8 @@ lpfc_nvme_localport_delete(struct nvme_fc_local_port *localport) + lport); + + /* release any threads waiting for the unreg to complete */ +- complete(&lport->lport_unreg_done); ++ if (lport->vport->localport) ++ complete(lport->lport_unreg_cmp); + } + + /* lpfc_nvme_remoteport_delete +@@ -2556,7 +2557,8 @@ lpfc_nvme_create_localport(struct lpfc_vport *vport) + */ + void + lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, +- struct lpfc_nvme_lport *lport) ++ struct lpfc_nvme_lport *lport, ++ struct completion *lport_unreg_cmp) + { + #if (IS_ENABLED(CONFIG_NVME_FC)) + u32 wait_tmo; +@@ -2568,8 +2570,7 @@ lpfc_nvme_lport_unreg_wait(struct lpfc_vport *vport, + */ + wait_tmo = msecs_to_jiffies(LPFC_NVME_WAIT_TMO * 1000); + while (true) { +- ret = wait_for_completion_timeout(&lport->lport_unreg_done, +- wait_tmo); ++ ret = wait_for_completion_timeout(lport_unreg_cmp, wait_tmo); + if (unlikely(!ret)) { + lpfc_printf_vlog(vport, KERN_ERR, LOG_NVME_IOERR, + "6176 Lport %p Localport %p wait " +@@ -2603,12 +2604,12 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + struct lpfc_nvme_lport *lport; + struct lpfc_nvme_ctrl_stat *cstat; + int ret; ++ DECLARE_COMPLETION_ONSTACK(lport_unreg_cmp); + + if (vport->nvmei_support == 0) + return; + + localport = vport->localport; +- vport->localport = NULL; + lport = (struct lpfc_nvme_lport *)localport->private; + cstat = lport->cstat; + +@@ -2619,13 +2620,14 @@ lpfc_nvme_destroy_localport(struct lpfc_vport *vport) + /* lport's rport list is clear. Unregister + * lport and release resources. + */ +- init_completion(&lport->lport_unreg_done); ++ lport->lport_unreg_cmp = &lport_unreg_cmp; + ret = nvme_fc_unregister_localport(localport); + + /* Wait for completion. This either blocks + * indefinitely or succeeds + */ +- lpfc_nvme_lport_unreg_wait(vport, lport); ++ lpfc_nvme_lport_unreg_wait(vport, lport, &lport_unreg_cmp); ++ vport->localport = NULL; + kfree(cstat); + + /* Regardless of the unregister upcall response, clear +diff --git a/drivers/scsi/lpfc/lpfc_nvme.h b/drivers/scsi/lpfc/lpfc_nvme.h +index cfd4719be25c3..b234d02989942 100644 +--- a/drivers/scsi/lpfc/lpfc_nvme.h ++++ b/drivers/scsi/lpfc/lpfc_nvme.h +@@ -50,7 +50,7 @@ struct lpfc_nvme_ctrl_stat { + /* Declare nvme-based local and remote port definitions. */ + struct lpfc_nvme_lport { + struct lpfc_vport *vport; +- struct completion lport_unreg_done; ++ struct completion *lport_unreg_cmp; + /* Add stats counters here */ + struct lpfc_nvme_ctrl_stat *cstat; + atomic_t fc4NvmeLsRequests; +-- +2.19.1 + diff --git a/queue-4.19/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch b/queue-4.19/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch new file mode 100644 index 00000000000..d62cd3d4f97 --- /dev/null +++ b/queue-4.19/scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch @@ -0,0 +1,74 @@ +From 496b70b3518711aa80eaafa8a2fcf186d7f4e897 Mon Sep 17 00:00:00 2001 +From: "Ewan D. Milne" +Date: Thu, 17 Jan 2019 11:14:45 -0500 +Subject: scsi: lpfc: nvmet: avoid hang / use-after-free when destroying + targetport + +[ Upstream commit c41f59884be5cca293ed61f3d64637dbba3a6381 ] + +We cannot wait on a completion object in the lpfc_nvme_targetport structure +in the _destroy_targetport() code path because the NVMe/fc transport will +free that structure immediately after the .targetport_delete() callback. +This results in a use-after-free, and a hang if slub_debug=FZPU is enabled. + +Fix this by putting the completion on the stack. + +Signed-off-by: Ewan D. Milne +Acked-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvmet.c | 8 +++++--- + drivers/scsi/lpfc/lpfc_nvmet.h | 2 +- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index b766afe10d3d7..e2575c8ec93e8 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1003,7 +1003,8 @@ lpfc_nvmet_targetport_delete(struct nvmet_fc_target_port *targetport) + struct lpfc_nvmet_tgtport *tport = targetport->private; + + /* release any threads waiting for the unreg to complete */ +- complete(&tport->tport_unreg_done); ++ if (tport->phba->targetport) ++ complete(tport->tport_unreg_cmp); + } + + static void +@@ -1700,6 +1701,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + struct lpfc_nvmet_tgtport *tgtp; + struct lpfc_queue *wq; + uint32_t qidx; ++ DECLARE_COMPLETION_ONSTACK(tport_unreg_cmp); + + if (phba->nvmet_support == 0) + return; +@@ -1709,9 +1711,9 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + wq = phba->sli4_hba.nvme_wq[qidx]; + lpfc_nvmet_wqfull_flush(phba, wq, NULL); + } +- init_completion(&tgtp->tport_unreg_done); ++ tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- wait_for_completion_timeout(&tgtp->tport_unreg_done, 5); ++ wait_for_completion_timeout(&tport_unreg_cmp, 5); + lpfc_nvmet_cleanup_io_context(phba); + } + phba->targetport = NULL; +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.h b/drivers/scsi/lpfc/lpfc_nvmet.h +index 1aaff63f1f419..0ec1082ce7ef6 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.h ++++ b/drivers/scsi/lpfc/lpfc_nvmet.h +@@ -34,7 +34,7 @@ + /* Used for NVME Target */ + struct lpfc_nvmet_tgtport { + struct lpfc_hba *phba; +- struct completion tport_unreg_done; ++ struct completion *tport_unreg_cmp; + + /* Stats counters - lpfc_nvmet_unsol_ls_buffer */ + atomic_t rcv_ls_req_in; +-- +2.19.1 + diff --git a/queue-4.19/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch b/queue-4.19/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch new file mode 100644 index 00000000000..7d64829a118 --- /dev/null +++ b/queue-4.19/selftests-gpio-mockup-chardev-check-asprintf-for-err.patch @@ -0,0 +1,56 @@ +From bb7b0b44666c0bd9d92ba745288132f96f62195e Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Mon, 14 Jan 2019 14:51:33 +0100 +Subject: selftests: gpio-mockup-chardev: Check asprintf() for error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 508cacd7da6659ae7b7bdd0a335f675422277758 ] + +With gcc 7.3.0: + + gpio-mockup-chardev.c: In function ‘get_debugfs’: + gpio-mockup-chardev.c:62:3: warning: ignoring return value of ‘asprintf’, declared with attribute warn_unused_result [-Wunused-result] + asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Handle asprintf() failures to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/gpio/gpio-mockup-chardev.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/gpio/gpio-mockup-chardev.c b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +index f8d468f54e986..aaa1e9f083c37 100644 +--- a/tools/testing/selftests/gpio/gpio-mockup-chardev.c ++++ b/tools/testing/selftests/gpio/gpio-mockup-chardev.c +@@ -37,7 +37,7 @@ static int get_debugfs(char **path) + struct libmnt_table *tb; + struct libmnt_iter *itr = NULL; + struct libmnt_fs *fs; +- int found = 0; ++ int found = 0, ret; + + cxt = mnt_new_context(); + if (!cxt) +@@ -58,8 +58,11 @@ static int get_debugfs(char **path) + break; + } + } +- if (found) +- asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (found) { ++ ret = asprintf(path, "%s/gpio", mnt_fs_get_target(fs)); ++ if (ret < 0) ++ err(EXIT_FAILURE, "failed to format string"); ++ } + + mnt_free_iter(itr); + mnt_free_context(cxt); +-- +2.19.1 + diff --git a/queue-4.19/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch b/queue-4.19/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch new file mode 100644 index 00000000000..42092fa8d4c --- /dev/null +++ b/queue-4.19/selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch @@ -0,0 +1,133 @@ +From 055d48b13dcfe96062d5e85c1e5983e99a19e249 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Tue, 18 Dec 2018 22:34:21 +0100 +Subject: selftests: rtc: rtctest: add alarm test on minute boundary + +[ Upstream commit 7b3027728f4d4f6763f4d7e771acfc9424cdd0e6 ] + +Unfortunately, some RTC don't have a second resolution for alarm so also +test for alarm on a minute boundary. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/rtc/rtctest.c | 102 ++++++++++++++++++++++++++ + 1 file changed, 102 insertions(+) + +diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c +index dea4e3d6d9e18..b2065536d4075 100644 +--- a/tools/testing/selftests/rtc/rtctest.c ++++ b/tools/testing/selftests/rtc/rtctest.c +@@ -211,6 +211,108 @@ TEST_F(rtc, alarm_wkalm_set) { + ASSERT_EQ(new, secs); + } + ++TEST_F(rtc, alarm_alm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ unsigned long data; ++ struct rtc_time tm; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&tm) + 60 - tm.tm_sec; ++ gmtime_r(&secs, (struct tm *)&tm); ++ ++ rc = ioctl(self->fd, RTC_ALM_SET, &tm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_ALM_READ, &tm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d:%02d:%02d.", ++ tm.tm_hour, tm.tm_min, tm.tm_sec); ++ ++ /* Enable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_ON, 0); ++ ASSERT_NE(-1, rc); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); ++ ++ /* Disable alarm interrupts */ ++ rc = ioctl(self->fd, RTC_AIE_OFF, 0); ++ ASSERT_NE(-1, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ TH_LOG("data: %lx", data); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ ++TEST_F(rtc, alarm_wkalm_set_minute) { ++ struct timeval tv = { .tv_sec = 62 }; ++ struct rtc_wkalrm alarm = { 0 }; ++ struct rtc_time tm; ++ unsigned long data; ++ fd_set readfds; ++ time_t secs, new; ++ int rc; ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &alarm.time); ++ ASSERT_NE(-1, rc); ++ ++ secs = timegm((struct tm *)&alarm.time) + 60 - alarm.time.tm_sec; ++ gmtime_r(&secs, (struct tm *)&alarm.time); ++ ++ alarm.enabled = 1; ++ ++ rc = ioctl(self->fd, RTC_WKALM_SET, &alarm); ++ if (rc == -1) { ++ ASSERT_EQ(EINVAL, errno); ++ TH_LOG("skip alarms are not supported."); ++ return; ++ } ++ ++ rc = ioctl(self->fd, RTC_WKALM_RD, &alarm); ++ ASSERT_NE(-1, rc); ++ ++ TH_LOG("Alarm time now set to %02d/%02d/%02d %02d:%02d:%02d.", ++ alarm.time.tm_mday, alarm.time.tm_mon + 1, ++ alarm.time.tm_year + 1900, alarm.time.tm_hour, ++ alarm.time.tm_min, alarm.time.tm_sec); ++ ++ FD_ZERO(&readfds); ++ FD_SET(self->fd, &readfds); ++ ++ rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); ++ ASSERT_NE(-1, rc); ++ ASSERT_NE(0, rc); ++ ++ rc = read(self->fd, &data, sizeof(unsigned long)); ++ ASSERT_NE(-1, rc); ++ ++ rc = ioctl(self->fd, RTC_RD_TIME, &tm); ++ ASSERT_NE(-1, rc); ++ ++ new = timegm((struct tm *)&tm); ++ ASSERT_EQ(new, secs); ++} ++ + static void __attribute__((constructor)) + __constructor_order_last(void) + { +-- +2.19.1 + diff --git a/queue-4.19/selftests-rtc-rtctest-fix-alarm-tests.patch b/queue-4.19/selftests-rtc-rtctest-fix-alarm-tests.patch new file mode 100644 index 00000000000..368ba7d80fa --- /dev/null +++ b/queue-4.19/selftests-rtc-rtctest-fix-alarm-tests.patch @@ -0,0 +1,50 @@ +From 5d8b45fe80007bc67579dc921a24e2f32ba83fe7 Mon Sep 17 00:00:00 2001 +From: Alexandre Belloni +Date: Tue, 18 Dec 2018 22:34:20 +0100 +Subject: selftests: rtc: rtctest: fix alarm tests + +[ Upstream commit fdac94489c4d247088b3885875b39b3e1eb621ef ] + +Return values for select are not checked properly and timeouts may not be +detected. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/rtc/rtctest.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/tools/testing/selftests/rtc/rtctest.c b/tools/testing/selftests/rtc/rtctest.c +index e20b017e70731..dea4e3d6d9e18 100644 +--- a/tools/testing/selftests/rtc/rtctest.c ++++ b/tools/testing/selftests/rtc/rtctest.c +@@ -145,15 +145,12 @@ TEST_F(rtc, alarm_alm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); + + /* Disable alarm interrupts */ + rc = ioctl(self->fd, RTC_AIE_OFF, 0); + ASSERT_NE(-1, rc); + +- if (rc == 0) +- return; +- + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); + TH_LOG("data: %lx", data); +@@ -202,7 +199,7 @@ TEST_F(rtc, alarm_wkalm_set) { + + rc = select(self->fd + 1, &readfds, NULL, NULL, &tv); + ASSERT_NE(-1, rc); +- EXPECT_NE(0, rc); ++ ASSERT_NE(0, rc); + + rc = read(self->fd, &data, sizeof(unsigned long)); + ASSERT_NE(-1, rc); +-- +2.19.1 + diff --git a/queue-4.19/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch b/queue-4.19/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch new file mode 100644 index 00000000000..391f53a8d49 --- /dev/null +++ b/queue-4.19/selftests-seccomp-use-ldlibs-instead-of-ldflags.patch @@ -0,0 +1,126 @@ +From 169977f82b210d3dbb2d24bc9718db5726a8087f Mon Sep 17 00:00:00 2001 +From: Fathi Boudra +Date: Wed, 16 Jan 2019 11:43:19 -0600 +Subject: selftests: seccomp: use LDLIBS instead of LDFLAGS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 5bbc73a841d7f0bbe025a342146dde462a796a5a ] + +seccomp_bpf fails to build due to undefined reference errors: + + aarch64-linaro-linux-gcc --sysroot=/build/tmp-rpb-glibc/sysroots/hikey + -O2 -pipe -g -feliminate-unused-debug-types -Wl,-no-as-needed -Wall + -Wl,-O1 -Wl,--hash-style=gnu -Wl,--as-needed -lpthread seccomp_bpf.c -o + /build/tmp-rpb-glibc/work/hikey-linaro-linux/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf + /tmp/ccrlR3MW.o: In function `tsync_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1920: undefined reference to `sem_post' + /tmp/ccrlR3MW.o: In function `TSYNC_setup': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1863: undefined reference to `sem_init' + /tmp/ccrlR3MW.o: In function `TSYNC_teardown': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1904: undefined reference to `sem_destroy' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1897: undefined reference to `pthread_kill' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1898: undefined reference to `pthread_cancel' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1899: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_siblings_fail_prctl': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1978: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1990: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1992: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_ancestor': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2016: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2032: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2034: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_sibling_want_nnp': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2046: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2058: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2060: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_no_filter': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2073: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2098: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2100: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_with_one_divergence': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2125: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2143: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2145: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + /tmp/ccrlR3MW.o: In function `TSYNC_two_siblings_not_under_filter': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2169: undefined reference to `sem_wait' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2202: undefined reference to `pthread_join' + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:2227: undefined reference to `pthread_join' + /tmp/ccrlR3MW.o: In function `tsync_start_sibling': + /usr/src/debug/kselftests/4.12-r0/linux-4.12-rc7/tools/testing/selftests/seccomp/seccomp_bpf.c:1941: undefined reference to `pthread_create' + +It's GNU Make and linker specific. + +The default Makefile rule looks like: + +$(CC) $(CFLAGS) $(LDFLAGS) $@ $^ $(LDLIBS) + +When linking is done by gcc itself, no issue, but when it needs to be passed +to proper ld, only LDLIBS follows and then ld cannot know what libs to link +with. + +More detail: +https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html + +LDFLAGS +Extra flags to give to compilers when they are supposed to invoke the linker, +‘ld’, such as -L. Libraries (-lfoo) should be added to the LDLIBS variable +instead. + +LDLIBS +Library flags or names given to compilers when they are supposed to invoke the +linker, ‘ld’. LOADLIBES is a deprecated (but still supported) alternative to +LDLIBS. Non-library linker flags, such as -L, should go in the LDFLAGS +variable. + +https://lkml.org/lkml/2010/2/10/362 + +tools/perf: libraries must come after objects + +Link order matters, use LDLIBS instead of LDFLAGS to properly link against +libpthread. + +Signed-off-by: Fathi Boudra +Acked-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/seccomp/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/seccomp/Makefile b/tools/testing/selftests/seccomp/Makefile +index fce7f4ce06925..1760b3e397306 100644 +--- a/tools/testing/selftests/seccomp/Makefile ++++ b/tools/testing/selftests/seccomp/Makefile +@@ -9,7 +9,7 @@ BINARIES := seccomp_bpf seccomp_benchmark + CFLAGS += -Wl,-no-as-needed -Wall + + seccomp_bpf: seccomp_bpf.c ../kselftest_harness.h +- $(CC) $(CFLAGS) $(LDFLAGS) -lpthread $< -o $@ ++ $(CC) $(CFLAGS) $(LDFLAGS) $< -lpthread -o $@ + + TEST_PROGS += $(BINARIES) + EXTRA_CLEAN := $(BINARIES) +-- +2.19.1 + diff --git a/queue-4.19/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch b/queue-4.19/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch new file mode 100644 index 00000000000..819ce12274e --- /dev/null +++ b/queue-4.19/selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch @@ -0,0 +1,36 @@ +From 759def61a47b1fded2a019a2980c3ad8c51f8f8d Mon Sep 17 00:00:00 2001 +From: Alison Schofield +Date: Fri, 7 Dec 2018 18:06:45 -0800 +Subject: selftests/vm/gup_benchmark.c: match gup struct to kernel + +[ Upstream commit 91cd63d320f84dcbf21d4327f31f7e1f85adebd0 ] + +An expansion field was added to the kernel copy of this structure for +future use. See mm/gup_benchmark.c. + +Add the same expansion field here, so that the IOCTL command decodes +correctly. Otherwise, it fails with EINVAL. + +Signed-off-by: Alison Schofield +Acked-by: Kirill A. Shutemov +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/gup_benchmark.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/vm/gup_benchmark.c b/tools/testing/selftests/vm/gup_benchmark.c +index 36df55132036f..9601bc24454d9 100644 +--- a/tools/testing/selftests/vm/gup_benchmark.c ++++ b/tools/testing/selftests/vm/gup_benchmark.c +@@ -22,6 +22,7 @@ struct gup_benchmark { + __u64 size; + __u32 nr_pages_per_call; + __u32 flags; ++ __u64 expansion[10]; /* For future use */ + }; + + int main(int argc, char **argv) +-- +2.19.1 + diff --git a/queue-4.19/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch b/queue-4.19/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch new file mode 100644 index 00000000000..f7e24b7906f --- /dev/null +++ b/queue-4.19/serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch @@ -0,0 +1,34 @@ +From e5ac3f26a0065a5f683b3e9a91c2df47a6ddffe7 Mon Sep 17 00:00:00 2001 +From: Tomonori Sakita +Date: Mon, 21 Jan 2019 17:34:16 +0900 +Subject: serial: fsl_lpuart: fix maximum acceptable baud rate with + over-sampling + +[ Upstream commit 815d835b7ba46685c316b000013367dacb2b461b ] + +Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4. + +Signed-off-by: Tomonori Sakita +Signed-off-by: Atsushi Nemoto +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 7d030c2e42ffd..50b6746a8b5d7 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1695,7 +1695,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, + } + + /* ask the core to calculate the divisor */ +- baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 16); ++ baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4); + + spin_lock_irqsave(&sport->port.lock, flags); + +-- +2.19.1 + diff --git a/queue-4.19/series b/queue-4.19/series index bd273a6cd13..f505fd1b55d 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -3,3 +3,63 @@ irq-matrix-spread-managed-interrupts-on-allocation.patch genirq-matrix-improve-target-cpu-selection-for-manag.patch mac80211-change-default-tx_sk_pacing_shift-to-7.patch scsi-libsas-fix-rphy-phy_identifier-for-phys-with-end-devices-attached.patch +drm-msm-unblock-writer-if-reader-closes-file.patch +asoc-intel-haswell-broadwell-fix-setting-for-.dynami.patch +alsa-compress-prevent-potential-divide-by-zero-bugs.patch +asoc-variable-val-in-function-rt274_i2c_probe-could-.patch +clk-tegra-dfll-fix-a-potential-oop-in-remove.patch +clk-sysfs-fix-invalid-json-in-clk_dump.patch +clk-vc5-abort-clock-configuration-without-upstream-c.patch +thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch +usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch +usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch +usb-gadget-potential-null-dereference-on-allocation-.patch +selftests-rtc-rtctest-fix-alarm-tests.patch +selftests-rtc-rtctest-add-alarm-test-on-minute-bound.patch +genirq-make-sure-the-initial-affinity-is-not-empty.patch +x86-mm-mem_encrypt-fix-erroneous-sizeof.patch +asoc-rt5682-fix-pll-source-register-definitions.patch +asoc-dapm-change-snprintf-to-scnprintf-for-possible-.patch +asoc-imx-audmux-change-snprintf-to-scnprintf-for-pos.patch +selftests-vm-gup_benchmark.c-match-gup-struct-to-ker.patch +phy-ath79-usb-fix-the-power-on-error-path.patch +phy-ath79-usb-fix-the-main-reset-name-to-match-the-d.patch +selftests-seccomp-use-ldlibs-instead-of-ldflags.patch +selftests-gpio-mockup-chardev-check-asprintf-for-err.patch +irqchip-gic-v3-mbi-fix-uninitialized-mbi_lock.patch +arc-fix-__ffs-return-value-to-avoid-build-warnings.patch +arc-show_regs-lockdep-avoid-page-allocator.patch +drivers-thermal-int340x_thermal-fix-sysfs-race-condi.patch +staging-rtl8723bs-fix-build-error-with-clang-when-in.patch +mac80211-fix-miscounting-of-ttl-dropped-frames.patch +sched-wait-fix-rcuwait_wake_up-ordering.patch +sched-wake_q-fix-wakeup-ordering-for-wake_q.patch +futex-fix-possible-missed-wakeup.patch +locking-rwsem-fix-possible-missed-wakeup.patch +drm-amd-powerplay-od-setting-fix-on-vega10.patch +tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch +serial-fsl_lpuart-fix-maximum-acceptable-baud-rate-w.patch +drm-sun4i-hdmi-fix-usage-of-tmds-clock.patch +staging-android-ion-support-cpu-access-during-dma_bu.patch +direct-io-allow-direct-writes-to-empty-inodes.patch +writeback-synchronize-sync-2-against-cgroup-writebac.patch +scsi-lpfc-nvme-avoid-hang-use-after-free-when-destro.patch +scsi-lpfc-nvmet-avoid-hang-use-after-free-when-destr.patch +scsi-csiostor-fix-null-pointer-dereference-in-csio_v.patch +net-altera_tse-fix-connect_local_phy-error-path.patch +hv_netvsc-fix-ethtool-change-hash-key-error.patch +hv_netvsc-refactor-assignments-of-struct-netvsc_devi.patch +hv_netvsc-fix-hash-key-value-reset-after-other-ops.patch +sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch +nvme-rdma-fix-timeout-handler.patch +nvme-multipath-drop-optimization-for-static-ana-grou.patch +drm-msm-fix-a6xx-support-for-opp-level.patch +net-usb-asix-ax88772_bind-return-error-when-hw_reset.patch +net-dev_is_mac_header_xmit-true-for-arphrd_rawip.patch +ibmveth-do-not-process-frames-after-calling-napi_res.patch +mac80211-don-t-initiate-tdls-connection-if-station-i.patch +mac80211-add-attribute-aligned-2-to-struct-action.patch +cfg80211-extend-range-deviation-for-dmg.patch +svm-fix-avic-incomplete-ipi-emulation.patch +kvm-nsvm-clear-events-pending-from-svm_complete_inte.patch +kvm-selftests-fix-region-overlap-check-in-kvm_util.patch diff --git a/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch b/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch new file mode 100644 index 00000000000..cd5d19fb627 --- /dev/null +++ b/queue-4.19/sfc-suppress-duplicate-nvmem-partition-types-in-efx_.patch @@ -0,0 +1,98 @@ +From 43065648286549fee83fdc0ab9f1132ad8427864 Mon Sep 17 00:00:00 2001 +From: Edward Cree +Date: Tue, 22 Jan 2019 19:02:17 +0000 +Subject: sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe + +[ Upstream commit 3366463513f544c12c6b88c13da4462ee9e7a1a1 ] + +Use a bitmap to keep track of which partition types we've already seen; + for duplicates, return -EEXIST from efx_ef10_mtd_probe_partition() and + thus skip adding that partition. +Duplicate partitions occur because of the A/B backup scheme used by newer + sfc NICs. Prior to this patch they cause sysfs_warn_dup errors because + they have the same name, causing us not to expose any MTDs at all. + +Signed-off-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 29 +++++++++++++++++++++-------- + 1 file changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index 7eeac3d6cfe89..a497aace7e4f4 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -6042,22 +6042,25 @@ static const struct efx_ef10_nvram_type_info efx_ef10_nvram_types[] = { + { NVRAM_PARTITION_TYPE_LICENSE, 0, 0, "sfc_license" }, + { NVRAM_PARTITION_TYPE_PHY_MIN, 0xff, 0, "sfc_phy_fw" }, + }; ++#define EF10_NVRAM_PARTITION_COUNT ARRAY_SIZE(efx_ef10_nvram_types) + + static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + struct efx_mcdi_mtd_partition *part, +- unsigned int type) ++ unsigned int type, ++ unsigned long *found) + { + MCDI_DECLARE_BUF(inbuf, MC_CMD_NVRAM_METADATA_IN_LEN); + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_METADATA_OUT_LENMAX); + const struct efx_ef10_nvram_type_info *info; + size_t size, erase_size, outlen; ++ int type_idx = 0; + bool protected; + int rc; + +- for (info = efx_ef10_nvram_types; ; info++) { +- if (info == +- efx_ef10_nvram_types + ARRAY_SIZE(efx_ef10_nvram_types)) ++ for (type_idx = 0; ; type_idx++) { ++ if (type_idx == EF10_NVRAM_PARTITION_COUNT) + return -ENODEV; ++ info = efx_ef10_nvram_types + type_idx; + if ((type & ~info->type_mask) == info->type) + break; + } +@@ -6070,6 +6073,13 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + if (protected) + return -ENODEV; /* hide it */ + ++ /* If we've already exposed a partition of this type, hide this ++ * duplicate. All operations on MTDs are keyed by the type anyway, ++ * so we can't act on the duplicate. ++ */ ++ if (__test_and_set_bit(type_idx, found)) ++ return -EEXIST; ++ + part->nvram_type = type; + + MCDI_SET_DWORD(inbuf, NVRAM_METADATA_IN_TYPE, type); +@@ -6098,6 +6108,7 @@ static int efx_ef10_mtd_probe_partition(struct efx_nic *efx, + static int efx_ef10_mtd_probe(struct efx_nic *efx) + { + MCDI_DECLARE_BUF(outbuf, MC_CMD_NVRAM_PARTITIONS_OUT_LENMAX); ++ DECLARE_BITMAP(found, EF10_NVRAM_PARTITION_COUNT); + struct efx_mcdi_mtd_partition *parts; + size_t outlen, n_parts_total, i, n_parts; + unsigned int type; +@@ -6126,11 +6137,13 @@ static int efx_ef10_mtd_probe(struct efx_nic *efx) + for (i = 0; i < n_parts_total; i++) { + type = MCDI_ARRAY_DWORD(outbuf, NVRAM_PARTITIONS_OUT_TYPE_ID, + i); +- rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type); +- if (rc == 0) +- n_parts++; +- else if (rc != -ENODEV) ++ rc = efx_ef10_mtd_probe_partition(efx, &parts[n_parts], type, ++ found); ++ if (rc == -EEXIST || rc == -ENODEV) ++ continue; ++ if (rc) + goto fail; ++ n_parts++; + } + + rc = efx_mtd_add(efx, &parts[0].common, n_parts, sizeof(*parts)); +-- +2.19.1 + diff --git a/queue-4.19/staging-android-ion-support-cpu-access-during-dma_bu.patch b/queue-4.19/staging-android-ion-support-cpu-access-during-dma_bu.patch new file mode 100644 index 00000000000..1918edae25a --- /dev/null +++ b/queue-4.19/staging-android-ion-support-cpu-access-during-dma_bu.patch @@ -0,0 +1,51 @@ +From 37f2a8dcabb2951e0ca5730956bc9db28394f42c Mon Sep 17 00:00:00 2001 +From: Liam Mark +Date: Fri, 18 Jan 2019 10:37:44 -0800 +Subject: staging: android: ion: Support cpu access during dma_buf_detach + +[ Upstream commit 31eb79db420a3f94c4c45a8c0a05cd30e333f981 ] + +Often userspace doesn't know when the kernel will be calling dma_buf_detach +on the buffer. +If userpace starts its CPU access at the same time as the sg list is being +freed it could end up accessing the sg list after it has been freed. + +Thread A Thread B +- DMA_BUF_IOCTL_SYNC IOCT + - ion_dma_buf_begin_cpu_access + - list_for_each_entry + - ion_dma_buf_detatch + - free_duped_table + - dma_sync_sg_for_cpu + +Fix this by getting the ion_buffer lock before freeing the sg table memory. + +Fixes: 2a55e7b5e544 ("staging: android: ion: Call dma_map_sg for syncing and mapping") +Signed-off-by: Liam Mark +Acked-by: Laura Abbott +Acked-by: Andrew F. Davis +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/android/ion/ion.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index 99073325b0c00..45c7f829e3872 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -237,10 +237,10 @@ static void ion_dma_buf_detatch(struct dma_buf *dmabuf, + struct ion_dma_buf_attachment *a = attachment->priv; + struct ion_buffer *buffer = dmabuf->priv; + +- free_duped_table(a->table); + mutex_lock(&buffer->lock); + list_del(&a->list); + mutex_unlock(&buffer->lock); ++ free_duped_table(a->table); + + kfree(a); + } +-- +2.19.1 + diff --git a/queue-4.19/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch b/queue-4.19/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch new file mode 100644 index 00000000000..1841b1cead3 --- /dev/null +++ b/queue-4.19/staging-rtl8723bs-fix-build-error-with-clang-when-in.patch @@ -0,0 +1,68 @@ +From f980a4552c4677cacf7a1aeb5ead6941c2a82718 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 16 Jan 2019 06:20:11 -0700 +Subject: staging: rtl8723bs: Fix build error with Clang when inlining is + disabled + +[ Upstream commit 97715058b70da1262fd07798c8b2e3e894f759dd ] + +When CONFIG_NO_AUTO_INLINE was present in linux-next (which added +'-fno-inline-functions' to KBUILD_CFLAGS), an allyesconfig build with +Clang failed at the modpost stage: + +ERROR: "is_broadcast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! +ERROR: "is_zero_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! +ERROR: "is_multicast_mac_addr" [drivers/staging/rtl8723bs/r8723bs.ko] undefined! + +These functions were marked as extern inline, meaning that if inlining +doesn't happen, the function will be undefined, as it is above. + +This happens to work with GCC because the '-fno-inline-functions' option +respects the __inline attribute so all instances of these functions are +inlined as expected and the definition doesn't actually matter. However, +with Clang and '-fno-inline-functions', a function has to be marked with +the __always_inline attribute to be considered for inlining, which none +of these functions are. Clang tries to find the symbol definition +elsewhere as it was told and fails, which trickles down to modpost. + +To make sure that this code compiles regardless of compiler and make the +intention of the code clearer, use 'static' to ensure these functions +are always defined, regardless of inlining. Additionally, silence a +checkpatch warning by switching from '__inline' to 'inline'. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/include/ieee80211.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/include/ieee80211.h b/drivers/staging/rtl8723bs/include/ieee80211.h +index bcc8dfa8e6728..9efb4dcb9d3a8 100644 +--- a/drivers/staging/rtl8723bs/include/ieee80211.h ++++ b/drivers/staging/rtl8723bs/include/ieee80211.h +@@ -850,18 +850,18 @@ enum ieee80211_state { + #define IP_FMT "%pI4" + #define IP_ARG(x) (x) + +-extern __inline int is_multicast_mac_addr(const u8 *addr) ++static inline int is_multicast_mac_addr(const u8 *addr) + { + return ((addr[0] != 0xff) && (0x01 & addr[0])); + } + +-extern __inline int is_broadcast_mac_addr(const u8 *addr) ++static inline int is_broadcast_mac_addr(const u8 *addr) + { + return ((addr[0] == 0xff) && (addr[1] == 0xff) && (addr[2] == 0xff) && \ + (addr[3] == 0xff) && (addr[4] == 0xff) && (addr[5] == 0xff)); + } + +-extern __inline int is_zero_mac_addr(const u8 *addr) ++static inline int is_zero_mac_addr(const u8 *addr) + { + return ((addr[0] == 0x00) && (addr[1] == 0x00) && (addr[2] == 0x00) && \ + (addr[3] == 0x00) && (addr[4] == 0x00) && (addr[5] == 0x00)); +-- +2.19.1 + diff --git a/queue-4.19/svm-fix-avic-incomplete-ipi-emulation.patch b/queue-4.19/svm-fix-avic-incomplete-ipi-emulation.patch new file mode 100644 index 00000000000..ca56132fc8c --- /dev/null +++ b/queue-4.19/svm-fix-avic-incomplete-ipi-emulation.patch @@ -0,0 +1,58 @@ +From 75f50ccda30f28523643b88456814a55551a6642 Mon Sep 17 00:00:00 2001 +From: Suravee Suthikulpanit +Date: Tue, 22 Jan 2019 10:25:13 +0000 +Subject: svm: Fix AVIC incomplete IPI emulation + +[ Upstream commit bb218fbcfaaa3b115d4cd7a43c0ca164f3a96e57 ] + +In case of incomplete IPI with invalid interrupt type, the current +SVM driver does not properly emulate the IPI, and fails to boot +FreeBSD guests with multiple vcpus when enabling AVIC. + +Fix this by update APIC ICR high/low registers, which also +emulate sending the IPI. + +Signed-off-by: Suravee Suthikulpanit +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/svm.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index ee8f8d70b98a2..8241fd27de19c 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -4485,25 +4485,14 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm) + kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: { +- int i; +- struct kvm_vcpu *vcpu; +- struct kvm *kvm = svm->vcpu.kvm; + struct kvm_lapic *apic = svm->vcpu.arch.apic; + + /* +- * At this point, we expect that the AVIC HW has already +- * set the appropriate IRR bits on the valid target +- * vcpus. So, we just need to kick the appropriate vcpu. ++ * Update ICR high and low, then emulate sending IPI, ++ * which is handled when writing APIC_ICR. + */ +- kvm_for_each_vcpu(i, vcpu, kvm) { +- bool m = kvm_apic_match_dest(vcpu, apic, +- icrl & KVM_APIC_SHORT_MASK, +- GET_APIC_DEST_FIELD(icrh), +- icrl & KVM_APIC_DEST_MASK); +- +- if (m && !avic_vcpu_is_running(vcpu)) +- kvm_vcpu_wake_up(vcpu); +- } ++ kvm_lapic_reg_write(apic, APIC_ICR2, icrh); ++ kvm_lapic_reg_write(apic, APIC_ICR, icrl); + break; + } + case AVIC_IPI_FAILURE_INVALID_TARGET: +-- +2.19.1 + diff --git a/queue-4.19/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch b/queue-4.19/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch new file mode 100644 index 00000000000..038a3d0f0a8 --- /dev/null +++ b/queue-4.19/thermal-int340x_thermal-fix-a-null-vs-is_err-check.patch @@ -0,0 +1,34 @@ +From c22d7bca84c868a7b09fdc9b080c4b76088c6986 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 17 Dec 2018 10:02:42 +0300 +Subject: thermal: int340x_thermal: Fix a NULL vs IS_ERR() check + +[ Upstream commit 3fe931b31a4078395c1967f0495dcc9e5ec6b5e3 ] + +The intel_soc_dts_iosf_init() function doesn't return NULL, it returns +error pointers. + +Fixes: 4d0dd6c1576b ("Thermal/int340x/processor_thermal: Enable auxiliary DTS for Braswell") +Signed-off-by: Dan Carpenter +Signed-off-by: Zhang Rui +Signed-off-by: Sasha Levin +--- + drivers/thermal/int340x_thermal/processor_thermal_device.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/int340x_thermal/processor_thermal_device.c b/drivers/thermal/int340x_thermal/processor_thermal_device.c +index 284cf2c5a8fd9..8e0f665cf06f8 100644 +--- a/drivers/thermal/int340x_thermal/processor_thermal_device.c ++++ b/drivers/thermal/int340x_thermal/processor_thermal_device.c +@@ -423,7 +423,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, + proc_priv->soc_dts = intel_soc_dts_iosf_init( + INTEL_SOC_DTS_INTERRUPT_MSI, 2, 0); + +- if (proc_priv->soc_dts && pdev->irq) { ++ if (!IS_ERR(proc_priv->soc_dts) && pdev->irq) { + ret = pci_enable_msi(pdev); + if (!ret) { + ret = request_threaded_irq(pdev->irq, NULL, +-- +2.19.1 + diff --git a/queue-4.19/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch b/queue-4.19/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch new file mode 100644 index 00000000000..bd663980f8a --- /dev/null +++ b/queue-4.19/tty-serial-qcom_geni_serial-allow-mctrl-when-flow-co.patch @@ -0,0 +1,46 @@ +From 0a768f86438e18ab182b477c11f8e69e40092a31 Mon Sep 17 00:00:00 2001 +From: Matthias Kaehlcke +Date: Fri, 18 Jan 2019 16:23:05 -0800 +Subject: tty: serial: qcom_geni_serial: Allow mctrl when flow control is + disabled + +[ Upstream commit e8a6ca808c5ed1e2b43ab25f1f2cbd43a7574f73 ] + +The geni set/get_mctrl() functions currently do nothing unless +hardware flow control is enabled. Remove this arbitrary limitation. + +Suggested-by: Johan Hovold +Fixes: 8a8a66a1a18a ("tty: serial: qcom_geni_serial: Add support for flow control") +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/qcom_geni_serial.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c +index 1515074e18fb6..35d1f6fa0e3c3 100644 +--- a/drivers/tty/serial/qcom_geni_serial.c ++++ b/drivers/tty/serial/qcom_geni_serial.c +@@ -221,7 +221,7 @@ static unsigned int qcom_geni_serial_get_mctrl(struct uart_port *uport) + unsigned int mctrl = TIOCM_DSR | TIOCM_CAR; + u32 geni_ios; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) { ++ if (uart_console(uport)) { + mctrl |= TIOCM_CTS; + } else { + geni_ios = readl_relaxed(uport->membase + SE_GENI_IOS); +@@ -237,7 +237,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport, + { + u32 uart_manual_rfr = 0; + +- if (uart_console(uport) || !uart_cts_enabled(uport)) ++ if (uart_console(uport)) + return; + + if (!(mctrl & TIOCM_RTS)) +-- +2.19.1 + diff --git a/queue-4.19/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch b/queue-4.19/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch new file mode 100644 index 00000000000..e882d3f293a --- /dev/null +++ b/queue-4.19/usb-dwc3-gadget-fix-the-uninitialized-link_state-whe.patch @@ -0,0 +1,57 @@ +From 54750ed4b67023d6fc0618684e49463a809833c7 Mon Sep 17 00:00:00 2001 +From: Zeng Tao +Date: Wed, 26 Dec 2018 19:22:00 +0800 +Subject: usb: dwc3: gadget: Fix the uninitialized link_state when udc starts + +[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ] + +Currently the link_state is uninitialized and the default value is 0(U0) +before the first time we start the udc, and after we start the udc then + stop the udc, the link_state will be undefined. +We may have the following warnings if we start the udc again with +an undefined link_state: + +WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308 +dwc3 100e0000.hidwc3_0: wakeup failed --> -22 +[...] +Call Trace: +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0x84/0x98) +[] (dump_stack) from [] (__warn+0xe8/0x100) +[] (__warn) from [](warn_slowpath_fmt+0x38/0x48) +[] (warn_slowpath_fmt) from [](dwc3_send_gadget_ep_cmd+0x304/0x308) +[] (dwc3_send_gadget_ep_cmd) from [](dwc3_ep0_start_trans+0x48/0xf4) +[] (dwc3_ep0_start_trans) from [](dwc3_ep0_out_start+0x64/0x80) +[] (dwc3_ep0_out_start) from [](__dwc3_gadget_start+0x1e0/0x278) +[] (__dwc3_gadget_start) from [](dwc3_gadget_start+0x88/0x10c) +[] (dwc3_gadget_start) from [](udc_bind_to_driver+0x88/0xbc) +[] (udc_bind_to_driver) from [](usb_gadget_probe_driver+0xf8/0x140) +[] (usb_gadget_probe_driver) from [](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite]) +[] (gadget_dev_desc_UDC_store [libcomposite]) from[] (configfs_write_file+0xd4/0x160) +[] (configfs_write_file) from [] (__vfs_write+0x1c/0x114) +[] (__vfs_write) from [] (vfs_write+0xa4/0x168) +[] (vfs_write) from [] (SyS_write+0x3c/0x90) +[] (SyS_write) from [] (ret_fast_syscall+0x0/0x3c) + +Signed-off-by: Zeng Tao +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index f6cd7feeb1c4f..700fb626ad03b 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1864,6 +1864,7 @@ static int __dwc3_gadget_start(struct dwc3 *dwc) + + /* begin to receive SETUP packets */ + dwc->ep0state = EP0_SETUP_PHASE; ++ dwc->link_state = DWC3_LINK_STATE_SS_DIS; + dwc3_ep0_out_start(dwc); + + dwc3_gadget_enable_irq(dwc); +-- +2.19.1 + diff --git a/queue-4.19/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch b/queue-4.19/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch new file mode 100644 index 00000000000..d1cddad38c1 --- /dev/null +++ b/queue-4.19/usb-dwc3-gadget-synchronize_irq-dwc-irq-in-suspend.patch @@ -0,0 +1,38 @@ +From 3879a4ff1bcd8b45b90f152ba64a975c68ec61e4 Mon Sep 17 00:00:00 2001 +From: Bo He +Date: Mon, 14 Jan 2019 09:48:32 +0200 +Subject: usb: dwc3: gadget: synchronize_irq dwc irq in suspend + +[ Upstream commit 01c10880d24291a96a4ab0da773e3c5ce4d12da8 ] + +We see dwc3 endpoint stopped by unwanted irq during +suspend resume test, which is caused dwc3 ep can't be started +with error "No Resource". + +Here, add synchronize_irq before suspend to sync the +pending IRQ handlers complete. + +Signed-off-by: Bo He +Signed-off-by: Yu Wang +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/gadget.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 0db90f6f4aa81..f6cd7feeb1c4f 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -3274,6 +3274,8 @@ int dwc3_gadget_suspend(struct dwc3 *dwc) + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); + ++ synchronize_irq(dwc->irq_gadget); ++ + return 0; + } + +-- +2.19.1 + diff --git a/queue-4.19/usb-gadget-potential-null-dereference-on-allocation-.patch b/queue-4.19/usb-gadget-potential-null-dereference-on-allocation-.patch new file mode 100644 index 00000000000..0e2da38d5aa --- /dev/null +++ b/queue-4.19/usb-gadget-potential-null-dereference-on-allocation-.patch @@ -0,0 +1,37 @@ +From 26f579c740351076b0ec01bb9a3bd88816bb6d7b Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 21 Dec 2018 23:42:52 +0300 +Subject: usb: gadget: Potential NULL dereference on allocation error + +[ Upstream commit df28169e1538e4a8bcd8b779b043e5aa6524545c ] + +The source_sink_alloc_func() function is supposed to return error +pointers on error. The function is called from usb_get_function() which +doesn't check for NULL returns so it would result in an Oops. + +Of course, in the current kernel, small allocations always succeed so +this doesn't affect runtime. + +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_sourcesink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_sourcesink.c b/drivers/usb/gadget/function/f_sourcesink.c +index 9cdef108fb1b3..ed68a4860b7d8 100644 +--- a/drivers/usb/gadget/function/f_sourcesink.c ++++ b/drivers/usb/gadget/function/f_sourcesink.c +@@ -838,7 +838,7 @@ static struct usb_function *source_sink_alloc_func( + + ss = kzalloc(sizeof(*ss), GFP_KERNEL); + if (!ss) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + ss_opts = container_of(fi, struct f_ss_opts, func_inst); + +-- +2.19.1 + diff --git a/queue-4.19/writeback-synchronize-sync-2-against-cgroup-writebac.patch b/queue-4.19/writeback-synchronize-sync-2-against-cgroup-writebac.patch new file mode 100644 index 00000000000..b71cff2de87 --- /dev/null +++ b/queue-4.19/writeback-synchronize-sync-2-against-cgroup-writebac.patch @@ -0,0 +1,168 @@ +From d6f5487fcf8ee158d7c343010d20730a7d161d41 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Tue, 12 Dec 2017 08:38:30 -0800 +Subject: writeback: synchronize sync(2) against cgroup writeback membership + switches + +[ Upstream commit 7fc5854f8c6efae9e7624970ab49a1eac2faefb1 ] + +sync_inodes_sb() can race against cgwb (cgroup writeback) membership +switches and fail to writeback some inodes. For example, if an inode +switches to another wb while sync_inodes_sb() is in progress, the new +wb might not be visible to bdi_split_work_to_wbs() at all or the inode +might jump from a wb which hasn't issued writebacks yet to one which +already has. + +This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb +switch path against sync_inodes_sb() so that sync_inodes_sb() is +guaranteed to see all the target wbs and inodes can't jump wbs to +escape syncing. + +v2: Fixed misplaced rwsem init. Spotted by Jiufei. + +Signed-off-by: Tejun Heo +Reported-by: Jiufei Xue +Link: http://lkml.kernel.org/r/dc694ae2-f07f-61e1-7097-7c8411cee12d@gmail.com +Acked-by: Jan Kara +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/fs-writeback.c | 40 ++++++++++++++++++++++++++++++-- + include/linux/backing-dev-defs.h | 1 + + mm/backing-dev.c | 1 + + 3 files changed, 40 insertions(+), 2 deletions(-) + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 471d863958bc2..82ce6d4f7e314 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -331,11 +331,22 @@ struct inode_switch_wbs_context { + struct work_struct work; + }; + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ down_write(&bdi->wb_switch_rwsem); ++} ++ ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) ++{ ++ up_write(&bdi->wb_switch_rwsem); ++} ++ + static void inode_switch_wbs_work_fn(struct work_struct *work) + { + struct inode_switch_wbs_context *isw = + container_of(work, struct inode_switch_wbs_context, work); + struct inode *inode = isw->inode; ++ struct backing_dev_info *bdi = inode_to_bdi(inode); + struct address_space *mapping = inode->i_mapping; + struct bdi_writeback *old_wb = inode->i_wb; + struct bdi_writeback *new_wb = isw->new_wb; +@@ -343,6 +354,12 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + bool switched = false; + void **slot; + ++ /* ++ * If @inode switches cgwb membership while sync_inodes_sb() is ++ * being issued, sync_inodes_sb() might miss it. Synchronize. ++ */ ++ down_read(&bdi->wb_switch_rwsem); ++ + /* + * By the time control reaches here, RCU grace period has passed + * since I_WB_SWITCH assertion and all wb stat update transactions +@@ -435,6 +452,8 @@ static void inode_switch_wbs_work_fn(struct work_struct *work) + spin_unlock(&new_wb->list_lock); + spin_unlock(&old_wb->list_lock); + ++ up_read(&bdi->wb_switch_rwsem); ++ + if (switched) { + wb_wakeup(new_wb); + wb_put(old_wb); +@@ -475,9 +494,18 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + if (inode->i_state & I_WB_SWITCH) + return; + ++ /* ++ * Avoid starting new switches while sync_inodes_sb() is in ++ * progress. Otherwise, if the down_write protected issue path ++ * blocks heavily, we might end up starting a large number of ++ * switches which will block on the rwsem. ++ */ ++ if (!down_read_trylock(&bdi->wb_switch_rwsem)) ++ return; ++ + isw = kzalloc(sizeof(*isw), GFP_ATOMIC); + if (!isw) +- return; ++ goto out_unlock; + + /* find and pin the new wb */ + rcu_read_lock(); +@@ -511,12 +539,14 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id) + * Let's continue after I_WB_SWITCH is guaranteed to be visible. + */ + call_rcu(&isw->rcu_head, inode_switch_wbs_rcu_fn); +- return; ++ goto out_unlock; + + out_free: + if (isw->new_wb) + wb_put(isw->new_wb); + kfree(isw); ++out_unlock: ++ up_read(&bdi->wb_switch_rwsem); + } + + /** +@@ -894,6 +924,9 @@ fs_initcall(cgroup_writeback_init); + + #else /* CONFIG_CGROUP_WRITEBACK */ + ++static void bdi_down_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++static void bdi_up_write_wb_switch_rwsem(struct backing_dev_info *bdi) { } ++ + static struct bdi_writeback * + locked_inode_to_wb_and_lock_list(struct inode *inode) + __releases(&inode->i_lock) +@@ -2420,8 +2453,11 @@ void sync_inodes_sb(struct super_block *sb) + return; + WARN_ON(!rwsem_is_locked(&sb->s_umount)); + ++ /* protect against inode wb switch, see inode_switch_wbs_work_fn() */ ++ bdi_down_write_wb_switch_rwsem(bdi); + bdi_split_work_to_wbs(bdi, &work, false); + wb_wait_for_completion(bdi, &done); ++ bdi_up_write_wb_switch_rwsem(bdi); + + wait_sb_inodes(sb); + } +diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h +index c311571355981..07e02d6df5ad9 100644 +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -190,6 +190,7 @@ struct backing_dev_info { + struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ + struct rb_root cgwb_congested_tree; /* their congested states */ + struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */ ++ struct rw_semaphore wb_switch_rwsem; /* no cgwb switch while syncing */ + #else + struct bdi_writeback_congested *wb_congested; + #endif +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 8a8bb8796c6c4..72e6d0c55cfad 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -689,6 +689,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) + INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); + bdi->cgwb_congested_tree = RB_ROOT; + mutex_init(&bdi->cgwb_release_mutex); ++ init_rwsem(&bdi->wb_switch_rwsem); + + ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); + if (!ret) { +-- +2.19.1 + diff --git a/queue-4.19/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch b/queue-4.19/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch new file mode 100644 index 00000000000..f73acb673d7 --- /dev/null +++ b/queue-4.19/x86-mm-mem_encrypt-fix-erroneous-sizeof.patch @@ -0,0 +1,48 @@ +From 2e35d41d38bd3985b38a13775064947bb3e8deda Mon Sep 17 00:00:00 2001 +From: Peng Hao +Date: Sat, 29 Dec 2018 14:34:12 +0800 +Subject: x86/mm/mem_encrypt: Fix erroneous sizeof() + +[ Upstream commit bf7d28c53453ea904584960de55e33e03b9d93b1 ] + +Using sizeof(pointer) for determining the size of a memset() only works +when the size of the pointer and the size of type to which it points are +the same. For pte_t this is only true for 64bit and 32bit-NONPAE. On 32bit +PAE systems this is wrong as the pointer size is 4 byte but the PTE entry +is 8 bytes. It's actually not a real world issue as this code depends on +64bit, but it's wrong nevertheless. + +Use sizeof(*p) for correctness sake. + +Fixes: aad983913d77 ("x86/mm/encrypt: Simplify sme_populate_pgd() and sme_populate_pgd_large()") +Signed-off-by: Peng Hao +Signed-off-by: Thomas Gleixner +Cc: Kirill A. Shutemov +Cc: Tom Lendacky +Cc: dave.hansen@linux.intel.com +Cc: peterz@infradead.org +Cc: luto@kernel.org +Link: https://lkml.kernel.org/r/1546065252-97996-1-git-send-email-peng.hao2@zte.com.cn +Signed-off-by: Sasha Levin +--- + arch/x86/mm/mem_encrypt_identity.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/mem_encrypt_identity.c b/arch/x86/mm/mem_encrypt_identity.c +index 7ae36868aed25..c9faf34cbb62e 100644 +--- a/arch/x86/mm/mem_encrypt_identity.c ++++ b/arch/x86/mm/mem_encrypt_identity.c +@@ -157,8 +157,8 @@ static void __init sme_populate_pgd(struct sme_populate_pgd_data *ppd) + pmd = pmd_offset(pud, ppd->vaddr); + if (pmd_none(*pmd)) { + pte = ppd->pgtable_area; +- memset(pte, 0, sizeof(pte) * PTRS_PER_PTE); +- ppd->pgtable_area += sizeof(pte) * PTRS_PER_PTE; ++ memset(pte, 0, sizeof(*pte) * PTRS_PER_PTE); ++ ppd->pgtable_area += sizeof(*pte) * PTRS_PER_PTE; + set_pmd(pmd, __pmd(PMD_FLAGS | __pa(pte))); + } + +-- +2.19.1 + -- 2.39.5