From a65d4bacc73f07743a1dacacfc25fae128576fa9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 28 Jul 2018 12:07:14 +0200 Subject: [PATCH] 4.14-stable patches added patches: acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch alsa-fm801-add-error-handling-for-snd_ctl_add.patch alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch arm64-defconfig-enable-rockchip-io-domain-driver.patch arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch ath-add-regulatory-mapping-for-apl13_world.patch ath-add-regulatory-mapping-for-apl2_fcca.patch ath-add-regulatory-mapping-for-bahamas.patch ath-add-regulatory-mapping-for-bermuda.patch ath-add-regulatory-mapping-for-etsi8_world.patch ath-add-regulatory-mapping-for-fcc3_etsic.patch ath-add-regulatory-mapping-for-serbia.patch ath-add-regulatory-mapping-for-tanzania.patch ath-add-regulatory-mapping-for-uganda.patch audit-allow-not-equal-op-for-audit-by-executable.patch backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch bluetooth-btusb-add-id-for-liteon-04ca-301a.patch bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch bpf-fix-references-to-free_bpf_prog_info-in-comments.patch bpf-powerpc64-pad-function-address-loads-with-nops.patch brcmfmac-add-support-for-bcm43364-wireless-chipset.patch btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch ceph-fix-alignment-of-rasize.patch crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch delayacct-use-raw_spinlocks.patch disable-loading-f2fs-module-on-page_size-4kb.patch dma-iommu-fix-compilation-when-config_iommu_dma.patch drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch drm-add-dp-psr2-sink-enable-bit.patch drm-amdgpu-remove-vram-from-shared-bo-domains.patch drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch drm-radeon-fix-mode_valid-s-return-type.patch drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch edac-altera-fix-arm64-build-warning.patch f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch f2fs-fix-deadlock-in-shutdown-ioctl.patch f2fs-fix-error-path-of-move_data_page.patch f2fs-fix-race-in-between-gc-and-atomic-open.patch f2fs-fix-to-detect-failure-of-dquot_initialize.patch f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch fscrypt-use-unbound-workqueue-for-decryption.patch hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch hid-i2c-hid-check-if-device-is-there-before-really-probing.patch hv_netvsc-fix-network-namespace-issues-with-vf-support.patch hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch i40e-free-the-skb-after-clearing-the-bitlock.patch igb-fix-queue-selection-on-mac-filters-on-i210.patch ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch infiniband-fix-a-possible-use-after-free-bug.patch ipconfig-correctly-initialise-ic_nameservers.patch irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch kcov-ensure-irq-code-sees-a-valid-area.patch kernel-hung_task.c-show-all-hung-tasks-before-panic.patch libata-fix-command-retry-decision.patch lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch md-raid1-add-error-handling-of-read-error-from-failfast-device.patch media-atomisp-compat32-fix-__user-annotations.patch media-atomisp-ov2680-don-t-declare-unused-vars.patch media-media-device-fix-ioctl-function-types.patch media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch media-saa7164-fix-driver-name-in-debug-output.patch media-si470x-fix-__be16-annotations.patch media-siano-get-rid-of-__le32-__le16-cast-warnings.patch media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch memory-tegra-apply-interrupts-mask-per-soc.patch memory-tegra-do-not-handle-spurious-interrupts.patch mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch microblaze-fix-simpleimage-format-generation.patch mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch mm-slub.c-add-__printf-verification-to-slab_err.patch mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch mwifiex-correct-histogram-data-with-appropriate-index.patch mwifiex-handle-race-during-mwifiex_usb_disconnect.patch net-dsa-qca8k-add-support-for-qca8334-switch.patch net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch net-hns3-fix-the-missing-client-list-node-initialization.patch net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch net-phy-phylink-release-link-gpio.patch netfilter-ipset-forbid-family-for-hash-mac-sets.patch netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch nvme-lightnvm-add-granby-support.patch nvme-pci-fix-aer-reset-handling.patch nvme-rdma-stop-admin-queue-before-freeing-it.patch nvmem-properly-handle-returned-value-nvmem_reg_read.patch pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch perf-fix-invalid-bit-in-diagnostic-entry.patch perf-tools-fix-pmu-events-parsing-rule.patch perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch pinctrl-at91-pio4-add-missing-of_node_put.patch pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch powerpc-32-add-a-missing-include-header.patch powerpc-64s-add-barrier_nospec.patch powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch powerpc-add-__printf-verification-to-prom_printf.patch powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch powerpc-eeh-fix-use-after-release-of-eeh-driver.patch powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch powerpc-powermac-mark-variable-x-as-unused.patch printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch rdma-mad-convert-bug_ons-to-error-flows.patch regulator-don-t-return-or-expect-errno-from-of_map_mode.patch regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch rsi-fix-invalid-vdd-warning-in-mmc.patch rsi-fix-nommu_map_sg-overflow-kernel-panic.patch rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch rtc-tps6586x-fix-possible-race-condition.patch rtc-tps65910-fix-possible-race-condition.patch rtc-vr41xx-fix-possible-race-condition.patch s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch scsi-3w-9xxx-fix-a-missing-check-bug.patch scsi-3w-xxxx-fix-a-missing-check-bug.patch scsi-cxlflash-avoid-clobbering-context-control-register-value.patch scsi-cxlflash-synchronize-reset-and-remove-ops.patch scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch scsi-megaraid-silence-a-static-checker-bug.patch scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch scsi-ufs-fix-exception-event-handling.patch scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch selftests-intel_pstate-improve-test-minor-fixes.patch selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch skip-layoutreturn-if-layout-is-invalid.patch soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch staging-lustre-llite-correct-removexattr-detection.patch staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch stop_machine-use-raw-spinlocks.patch thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch vfio-mdev-check-globally-for-duplicate-devices.patch vfio-platform-fix-reset-module-leak-in-error-path.patch vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch watchdog-da9063-fix-updating-timeout-value.patch wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch --- ...e-for-bay-trail-pwm-if-pmic-hrv-is-2.patch | 67 ++++ ...1-add-error-handling-for-snd_ctl_add.patch | 35 ++ ...mit-error-messages-about-page-errors.patch | 49 +++ ...1-add-error-handling-for-snd_ctl_add.patch | 49 +++ ...ailure-when-a-local-macro-is-defined.patch | 51 +++ ...ng-messages-in-urb-complete-callback.patch | 32 ++ ...ssing-interrupt-affinity-to-pmu-node.patch | 50 +++ ...ssing-interrupt-affinity-to-pmu-node.patch | 52 +++ ...x-complain-about-irq_type_none-usage.patch | 69 ++++ ...ster-before-arming-exclusive-monitor.patch | 37 ++ ...fig-enable-rockchip-io-domain-driver.patch | 44 +++ ...ommon-use-audio-graph-card-for-sound.patch | 90 +++++ ...-fix-be-dai-not-hw_free-and-shutdown.patch | 47 +++ ...ng-parameter-when-parsing-hw_configs.patch | 100 +++++ ...sync-inversion-in-set_link_hw_format.patch | 89 +++++ ...d-regulatory-mapping-for-apl13_world.patch | 47 +++ ...add-regulatory-mapping-for-apl2_fcca.patch | 47 +++ ...h-add-regulatory-mapping-for-bahamas.patch | 50 +++ ...h-add-regulatory-mapping-for-bermuda.patch | 50 +++ ...d-regulatory-mapping-for-etsi8_world.patch | 47 +++ ...dd-regulatory-mapping-for-fcc3_etsic.patch | 47 +++ ...th-add-regulatory-mapping-for-serbia.patch | 50 +++ ...-add-regulatory-mapping-for-tanzania.patch | 50 +++ ...th-add-regulatory-mapping-for-uganda.patch | 50 +++ ...not-equal-op-for-audit-by-executable.patch | 47 +++ ...-use-gpiof_-with-gpiod_get_direction.patch | 44 +++ ...ve-wrong-lock-in-bfq_requests_merged.patch | 46 +++ ...dd-a-new-realtek-8723de-id-2ff8-b011.patch | 62 +++ ...th-btusb-add-id-for-liteon-04ca-301a.patch | 39 ++ ...-sleep-inside-atomic-section-warning.patch | 40 ++ ...peeds-in-bnxt_update_link-on-pf-only.patch | 34 ++ ...t-naming-about-emit_a32_lsr_-r64-i64.patch | 77 ++++ ...es-to-free_bpf_prog_info-in-comments.patch | 42 ++ ...pad-function-address-loads-with-nops.patch | 82 ++++ ...upport-for-bcm43364-wireless-chipset.patch | 51 +++ ...c_log-before-log_commit_wait-wakeups.patch | 97 +++++ ...ata-pages-in-btrfs_finish_ordered_io.patch | 89 +++++ ...bug_on-in-btrfs_truncate_inode_items.patch | 37 ++ ...no-cache-if-inode-item-removal-fails.patch | 66 ++++ ...hen-hit-the-last-leaf-of-extent-tree.patch | 110 ++++++ queue-4.14/ceph-fix-alignment-of-rasize.patch | 35 ++ ...-don-t-leak-pointers-to-authenc-keys.patch | 32 ++ ...-don-t-leak-pointers-to-authenc-keys.patch | 32 ++ queue-4.14/delayacct-use-raw_spinlocks.patch | 101 +++++ ...loading-f2fs-module-on-page_size-4kb.patch | 62 +++ ...ix-compilation-when-config_iommu_dma.patch | 48 +++ ...ccn-don-t-log-to-dmesg-in-event_init.patch | 114 ++++++ .../drm-add-dp-psr2-sink-enable-bit.patch | 31 ++ ...u-remove-vram-from-shared-bo-domains.patch | 41 ++ ...case-when-setting-old-crtc-for-plane.patch | 41 ++ ...-only-for-drm_atomic_helper_shutdown.patch | 174 +++++++++ ...-by-one-typo-when-dump-payload-table.patch | 65 +++ ..._intel_lvds_mode_valid-s-return-type.patch | 47 +++ ...d-quirk-for-glk-nuc-hdmi-port-issues.patch | 140 ------- ...4-poll-for-runlist-update-completion.patch | 39 ++ ...-radeon-fix-mode_valid-s-return-type.patch | 70 ++++ ...-setting-clock-divider-for-omap-l138.patch | 41 ++ ...wmac-new-compatible-name-for-axg-soc.patch | 32 ++ ...son-add-support-for-the-meson8m2-soc.patch | 39 ++ ...l-when-getting-i219-clock-attributes.patch | 75 ++++ .../edac-altera-fix-arm64-build-warning.patch | 45 +++ ...ailure-caused-by-eagain-in-writepage.patch | 38 ++ .../f2fs-fix-deadlock-in-shutdown-ioctl.patch | 55 +++ ...2fs-fix-error-path-of-move_data_page.patch | 41 ++ ...x-race-in-between-gc-and-atomic-open.patch | 54 +++ ...o-detect-failure-of-dquot_initialize.patch | 33 ++ ...-t-trigger-writeback-during-recovery.patch | 46 +++ ...iteback-during-revoking-atomic-write.patch | 32 ++ ...xt-and-interrupt-context-kill_fasync.patch | 118 ++++++ ...use-unbound-workqueue-for-decryption.patch | 59 +++ ...pdate-to-map-button-for-ptt-products.patch | 43 ++ ...evice-is-there-before-really-probing.patch | 43 ++ ...ork-namespace-issues-with-vf-support.patch | 131 +++++++ ...ks_per_usec-in-udbg_init_opal_common.patch | 46 +++ ...e-the-skb-after-clearing-the-bitlock.patch | 55 +++ ...eue-selection-on-mac-filters-on-i210.patch | 52 +++ ...ware-signatures-pre-allocated-buffer.patch | 35 ++ ...nd-fix-a-possible-use-after-free-bug.patch | 55 +++ ...-correctly-initialise-ic_nameservers.patch | 86 ++++ ...ip-ls-scfg-msi-map-msis-in-the-iommu.patch | 44 +++ ...pcie-fix-race-in-rx-buffer-allocator.patch | 34 ++ ...ress-changes-through-ixgbevf_set_mac.patch | 34 ++ ...ov-ensure-irq-code-sees-a-valid-area.patch | 77 ++++ ...k.c-show-all-hung-tasks-before-panic.patch | 118 ++++++ .../libata-fix-command-retry-decision.patch | 49 +++ ...rn-in-case-of-corrupted-write-buffer.patch | 39 ++ ...-mddev-pers-in-remove_and_add_spares.patch | 72 ++++ ...g-of-read-error-from-failfast-device.patch | 38 ++ ...misp-compat32-fix-__user-annotations.patch | 228 +++++++++++ ...isp-ov2680-don-t-declare-unused-vars.patch | 53 +++ ...edia-device-fix-ioctl-function-types.patch | 85 ++++ ...isp-fix-unbalanced-dma_iommu_mapping.patch | 57 +++ ...sable_unprepare-on-error-in-jpu_open.patch | 43 ++ ...7164-fix-driver-name-in-debug-output.patch | 39 ++ .../media-si470x-fix-__be16-annotations.patch | 58 +++ ...t-rid-of-__le32-__le16-cast-warnings.patch | 108 +++++ ...-timeout-checking-in-smiapp_read_nvm.patch | 58 +++ ...-fix-incorrect-vb2_mem_ops-gfp-flags.patch | 36 ++ ...on-t-call-memop-finish-when-queueing.patch | 42 ++ ...-tegra-apply-interrupts-mask-per-soc.patch | 161 ++++++++ ...ra-do-not-handle-spurious-interrupts.patch | 37 ++ ...l-early-if-we-cannot-identify-the-ec.patch | 41 ++ ...ze-fix-simpleimage-format-generation.patch | 47 +++ ..._switchdev-fix-port_vlan-refcounting.patch | 62 +++ ...swap-entries-from-unprivileged-users.patch | 93 +++++ ...dd-__printf-verification-to-slab_err.patch | 40 ++ ...y-handling-of-debugobjects-in-vunmap.patch | 64 +++ ...-update-actual-clock-for-mmc-debugfs.patch | 57 +++ ...e-kmalloc_array-instead-of-stack-vla.patch | 65 +++ ...ver-to-read-all-onfi-parameter-pages.patch | 57 +++ ...istogram-data-with-appropriate-index.patch | 39 ++ ...e-race-during-mwifiex_usb_disconnect.patch | 47 +++ ...qca8k-add-support-for-qca8334-switch.patch | 31 ++ ...-sel-check-bus_find_device-ret-value.patch | 51 +++ ...sing-client-list-node-initialization.patch | 34 ++ ...-the-valid-bd-info-in-the-descriptor.patch | 45 +++ ...ut-of-bounds-access-in-hclge_map_tqp.patch | 40 ++ .../net-phy-phylink-release-link-gpio.patch | 33 ++ ...pset-forbid-family-for-hash-mac-sets.patch | 48 +++ ...tries-with-timeout-1-instead-of-zero.patch | 45 +++ ...-msg_type-before-nft_trans_set-trans.patch | 142 +++++++ ...r-free-in-nfsd4_decode_getdeviceinfo.patch | 108 +++++ ...behaviour-on-nfs4err_seq_false_retry.patch | 47 +++ .../nvme-lightnvm-add-granby-support.patch | 32 ++ .../nvme-pci-fix-aer-reset-handling.patch | 40 ++ ...a-stop-admin-queue-before-freeing-it.patch | 68 ++++ ...handle-returned-value-nvmem_reg_read.patch | 53 +++ ...vm_pci_alloc_host_bridge-memory-leak.patch | 39 ++ ...-of-native-hotplug-only-if-supported.patch | 41 ++ ...e-of-device-while-driver-is-attached.patch | 47 +++ ...-fix-invalid-bit-in-diagnostic-entry.patch | 39 ++ ...rf-tools-fix-pmu-events-parsing-rule.patch | 82 ++++ ...ct-fixed-counter-index-check-for-nhm.patch | 41 ++ ...-counter-index-check-in-generic-code.patch | 41 ++ ...rl-at91-pio4-add-missing-of_node_put.patch | 55 +++ ...keup-make-s2idle_lock-a-raw_spinlock.patch | 76 ++++ ...il-we-ve-processed-layoutget-on-open.patch | 40 ++ ...erpc-32-add-a-missing-include-header.patch | 32 ++ .../powerpc-64s-add-barrier_nospec.patch | 53 +++ ...er-store-ordering-to-slb-shadow-area.patch | 47 +++ ...id-register-expression-in-head_8xx.s.patch | 36 ++ ...__printf-verification-to-prom_printf.patch | 369 ++++++++++++++++++ ...ns-static-add-missing-header-include.patch | 57 +++ ...-fix-use-after-release-of-eeh-driver.patch | 70 ++++ ...rrupts-from-being-handled-by-starlet.patch | 56 +++ ...gn-inside-string-functions-for-ppc32.patch | 87 +++++ ...ing-prototype-for-note_bootable_part.patch | 33 ++ ...c-powermac-mark-variable-x-as-unused.patch | 43 ++ ...heck-from-printk_safe_flush_on_panic.patch | 46 +++ ...a-mad-convert-bug_ons-to-error-flows.patch | 47 +++ ...urn-or-expect-errno-from-of_map_mode.patch | 109 ++++++ ...nable-for-pfuze100_swb_regulator_ops.patch | 33 ++ .../rsi-fix-invalid-vdd-warning-in-mmc.patch | 76 ++++ ...x-nommu_map_sg-overflow-kernel-panic.patch | 209 ++++++++++ ...-fails-when-alarms-are-not-supported.patch | 39 ++ ...tps6586x-fix-possible-race-condition.patch | 77 ++++ ...tps65910-fix-possible-race-condition.patch | 51 +++ ...c-vr41xx-fix-possible-race-condition.patch | 72 ++++ ...ntry-sizes-to-sampling-trailer-entry.patch | 41 ++ ...scsi-3w-9xxx-fix-a-missing-check-bug.patch | 48 +++ ...scsi-3w-xxxx-fix-a-missing-check-bug.patch | 47 +++ ...ering-context-control-register-value.patch | 63 +++ ...ash-synchronize-reset-and-remove-ops.patch | 54 +++ ...-as-an-constrained-command-for-v3-hw.patch | 61 +++ ...egaraid-silence-a-static-checker-bug.patch | 33 ++ ...t-by-1-sec-for-non-raid-fastpath-ios.patch | 39 ++ ...unloading-flag-when-removing-a-vport.patch | 70 ++++ ...oad-tp9-string-with-the-exact-models.patch | 46 +++ ...csi-ufs-fix-exception-event-handling.patch | 51 +++ ...x-possible-unclocked-register-access.patch | 70 ++++ ...held-when-tracing-a-recovery-trigger.patch | 75 ++++ ...ntel_pstate-improve-test-minor-fixes.patch | 91 +++++ ...selftest-skip-code-for-skipped-tests.patch | 43 ++ ...selftest-skip-code-for-skipped-tests.patch | 74 ++++ ...ler-barfs-for-16-byte-earlycon-names.patch | 50 +++ queue-4.14/series | 199 +++++++++- ...ip-layoutreturn-if-layout-is-invalid.patch | 56 +++ ...-pass-static-memory-as-platform-data.patch | 78 ++++ ..._runtime_put_noidle-after-failed-get.patch | 31 ++ ...-error-handling-in-meson_spicc_probe.patch | 44 +++ ...rmdr1.syncac-to-match-sitmdr1.syncac.patch | 49 +++ ...resource-when-ldlm_lock_create-fails.patch | 44 +++ ...-llite-correct-removexattr-detection.patch | 40 ++ ...iblnd-fix-fastreg-map-unmap-for-mlx5.patch | 80 ++++ ...blnd-fix-race-at-kiblnd_connect_peer.patch | 63 +++ ...sing-semaphore-release-in-error-case.patch | 32 ++ .../stop_machine-use-raw-spinlocks.patch | 109 ++++++ ...ting-rising_threshold-for-exynos5433.patch | 30 ++ ...device-only-if-it-s-cpu-local-device.patch | 40 ++ ...in-tty_insert_flip_string_fixed_flag.patch | 96 +++++ ...tate-at-resume-for-powered-off-ports.patch | 39 ++ ...locate-idev-by-nports-found-in-sysfs.patch | 120 ++++++ ...ix-memory-udev-context-and-udev-leak.patch | 48 +++ ...check-globally-for-duplicate-devices.patch | 284 ++++++++++++++ ...-fix-reset-module-leak-in-error-path.patch | 54 +++ ...-task-tracking-for-qemu-vcpu-hotplug.patch | 241 ++++++++++++ ...og-da9063-fix-updating-timeout-value.patch | 58 +++ ...-platform-device-data-before-suspend.patch | 39 ++ ...update-update_lock-a-raw-lock-for-rt.patch | 50 +++ ...ber-of-slots-in-xennet_get_responses.patch | 55 +++ 200 files changed, 12464 insertions(+), 141 deletions(-) create mode 100644 queue-4.14/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch create mode 100644 queue-4.14/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch create mode 100644 queue-4.14/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch create mode 100644 queue-4.14/alsa-fm801-add-error-handling-for-snd_ctl_add.patch create mode 100644 queue-4.14/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch create mode 100644 queue-4.14/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch create mode 100644 queue-4.14/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch create mode 100644 queue-4.14/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch create mode 100644 queue-4.14/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch create mode 100644 queue-4.14/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch create mode 100644 queue-4.14/arm64-defconfig-enable-rockchip-io-domain-driver.patch create mode 100644 queue-4.14/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch create mode 100644 queue-4.14/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch create mode 100644 queue-4.14/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch create mode 100644 queue-4.14/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-apl13_world.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-apl2_fcca.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-bahamas.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-bermuda.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-etsi8_world.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-fcc3_etsic.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-serbia.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-tanzania.patch create mode 100644 queue-4.14/ath-add-regulatory-mapping-for-uganda.patch create mode 100644 queue-4.14/audit-allow-not-equal-op-for-audit-by-executable.patch create mode 100644 queue-4.14/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch create mode 100644 queue-4.14/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch create mode 100644 queue-4.14/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch create mode 100644 queue-4.14/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch create mode 100644 queue-4.14/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch create mode 100644 queue-4.14/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch create mode 100644 queue-4.14/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch create mode 100644 queue-4.14/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch create mode 100644 queue-4.14/bpf-powerpc64-pad-function-address-loads-with-nops.patch create mode 100644 queue-4.14/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch create mode 100644 queue-4.14/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch create mode 100644 queue-4.14/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch create mode 100644 queue-4.14/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch create mode 100644 queue-4.14/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch create mode 100644 queue-4.14/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch create mode 100644 queue-4.14/ceph-fix-alignment-of-rasize.patch create mode 100644 queue-4.14/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch create mode 100644 queue-4.14/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch create mode 100644 queue-4.14/delayacct-use-raw_spinlocks.patch create mode 100644 queue-4.14/disable-loading-f2fs-module-on-page_size-4kb.patch create mode 100644 queue-4.14/dma-iommu-fix-compilation-when-config_iommu_dma.patch create mode 100644 queue-4.14/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch create mode 100644 queue-4.14/drm-add-dp-psr2-sink-enable-bit.patch create mode 100644 queue-4.14/drm-amdgpu-remove-vram-from-shared-bo-domains.patch create mode 100644 queue-4.14/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch create mode 100644 queue-4.14/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch create mode 100644 queue-4.14/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch create mode 100644 queue-4.14/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch delete mode 100644 queue-4.14/drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch create mode 100644 queue-4.14/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch create mode 100644 queue-4.14/drm-radeon-fix-mode_valid-s-return-type.patch create mode 100644 queue-4.14/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch create mode 100644 queue-4.14/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch create mode 100644 queue-4.14/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch create mode 100644 queue-4.14/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch create mode 100644 queue-4.14/edac-altera-fix-arm64-build-warning.patch create mode 100644 queue-4.14/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch create mode 100644 queue-4.14/f2fs-fix-deadlock-in-shutdown-ioctl.patch create mode 100644 queue-4.14/f2fs-fix-error-path-of-move_data_page.patch create mode 100644 queue-4.14/f2fs-fix-race-in-between-gc-and-atomic-open.patch create mode 100644 queue-4.14/f2fs-fix-to-detect-failure-of-dquot_initialize.patch create mode 100644 queue-4.14/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch create mode 100644 queue-4.14/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch create mode 100644 queue-4.14/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch create mode 100644 queue-4.14/fscrypt-use-unbound-workqueue-for-decryption.patch create mode 100644 queue-4.14/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch create mode 100644 queue-4.14/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch create mode 100644 queue-4.14/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch create mode 100644 queue-4.14/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch create mode 100644 queue-4.14/i40e-free-the-skb-after-clearing-the-bitlock.patch create mode 100644 queue-4.14/igb-fix-queue-selection-on-mac-filters-on-i210.patch create mode 100644 queue-4.14/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch create mode 100644 queue-4.14/infiniband-fix-a-possible-use-after-free-bug.patch create mode 100644 queue-4.14/ipconfig-correctly-initialise-ic_nameservers.patch create mode 100644 queue-4.14/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch create mode 100644 queue-4.14/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch create mode 100644 queue-4.14/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch create mode 100644 queue-4.14/kcov-ensure-irq-code-sees-a-valid-area.patch create mode 100644 queue-4.14/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch create mode 100644 queue-4.14/libata-fix-command-retry-decision.patch create mode 100644 queue-4.14/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch create mode 100644 queue-4.14/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch create mode 100644 queue-4.14/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch create mode 100644 queue-4.14/media-atomisp-compat32-fix-__user-annotations.patch create mode 100644 queue-4.14/media-atomisp-ov2680-don-t-declare-unused-vars.patch create mode 100644 queue-4.14/media-media-device-fix-ioctl-function-types.patch create mode 100644 queue-4.14/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch create mode 100644 queue-4.14/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch create mode 100644 queue-4.14/media-saa7164-fix-driver-name-in-debug-output.patch create mode 100644 queue-4.14/media-si470x-fix-__be16-annotations.patch create mode 100644 queue-4.14/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch create mode 100644 queue-4.14/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch create mode 100644 queue-4.14/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch create mode 100644 queue-4.14/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch create mode 100644 queue-4.14/memory-tegra-apply-interrupts-mask-per-soc.patch create mode 100644 queue-4.14/memory-tegra-do-not-handle-spurious-interrupts.patch create mode 100644 queue-4.14/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch create mode 100644 queue-4.14/microblaze-fix-simpleimage-format-generation.patch create mode 100644 queue-4.14/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch create mode 100644 queue-4.14/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch create mode 100644 queue-4.14/mm-slub.c-add-__printf-verification-to-slab_err.patch create mode 100644 queue-4.14/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch create mode 100644 queue-4.14/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch create mode 100644 queue-4.14/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch create mode 100644 queue-4.14/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch create mode 100644 queue-4.14/mwifiex-correct-histogram-data-with-appropriate-index.patch create mode 100644 queue-4.14/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch create mode 100644 queue-4.14/net-dsa-qca8k-add-support-for-qca8334-switch.patch create mode 100644 queue-4.14/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch create mode 100644 queue-4.14/net-hns3-fix-the-missing-client-list-node-initialization.patch create mode 100644 queue-4.14/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch create mode 100644 queue-4.14/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch create mode 100644 queue-4.14/net-phy-phylink-release-link-gpio.patch create mode 100644 queue-4.14/netfilter-ipset-forbid-family-for-hash-mac-sets.patch create mode 100644 queue-4.14/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch create mode 100644 queue-4.14/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch create mode 100644 queue-4.14/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch create mode 100644 queue-4.14/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch create mode 100644 queue-4.14/nvme-lightnvm-add-granby-support.patch create mode 100644 queue-4.14/nvme-pci-fix-aer-reset-handling.patch create mode 100644 queue-4.14/nvme-rdma-stop-admin-queue-before-freeing-it.patch create mode 100644 queue-4.14/nvmem-properly-handle-returned-value-nvmem_reg_read.patch create mode 100644 queue-4.14/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch create mode 100644 queue-4.14/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch create mode 100644 queue-4.14/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch create mode 100644 queue-4.14/perf-fix-invalid-bit-in-diagnostic-entry.patch create mode 100644 queue-4.14/perf-tools-fix-pmu-events-parsing-rule.patch create mode 100644 queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch create mode 100644 queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch create mode 100644 queue-4.14/pinctrl-at91-pio4-add-missing-of_node_put.patch create mode 100644 queue-4.14/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch create mode 100644 queue-4.14/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch create mode 100644 queue-4.14/powerpc-32-add-a-missing-include-header.patch create mode 100644 queue-4.14/powerpc-64s-add-barrier_nospec.patch create mode 100644 queue-4.14/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch create mode 100644 queue-4.14/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch create mode 100644 queue-4.14/powerpc-add-__printf-verification-to-prom_printf.patch create mode 100644 queue-4.14/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch create mode 100644 queue-4.14/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch create mode 100644 queue-4.14/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch create mode 100644 queue-4.14/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch create mode 100644 queue-4.14/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch create mode 100644 queue-4.14/powerpc-powermac-mark-variable-x-as-unused.patch create mode 100644 queue-4.14/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch create mode 100644 queue-4.14/rdma-mad-convert-bug_ons-to-error-flows.patch create mode 100644 queue-4.14/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch create mode 100644 queue-4.14/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch create mode 100644 queue-4.14/rsi-fix-invalid-vdd-warning-in-mmc.patch create mode 100644 queue-4.14/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch create mode 100644 queue-4.14/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch create mode 100644 queue-4.14/rtc-tps6586x-fix-possible-race-condition.patch create mode 100644 queue-4.14/rtc-tps65910-fix-possible-race-condition.patch create mode 100644 queue-4.14/rtc-vr41xx-fix-possible-race-condition.patch create mode 100644 queue-4.14/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch create mode 100644 queue-4.14/scsi-3w-9xxx-fix-a-missing-check-bug.patch create mode 100644 queue-4.14/scsi-3w-xxxx-fix-a-missing-check-bug.patch create mode 100644 queue-4.14/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch create mode 100644 queue-4.14/scsi-cxlflash-synchronize-reset-and-remove-ops.patch create mode 100644 queue-4.14/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch create mode 100644 queue-4.14/scsi-megaraid-silence-a-static-checker-bug.patch create mode 100644 queue-4.14/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch create mode 100644 queue-4.14/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch create mode 100644 queue-4.14/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch create mode 100644 queue-4.14/scsi-ufs-fix-exception-event-handling.patch create mode 100644 queue-4.14/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch create mode 100644 queue-4.14/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch create mode 100644 queue-4.14/selftests-intel_pstate-improve-test-minor-fixes.patch create mode 100644 queue-4.14/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.14/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.14/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch create mode 100644 queue-4.14/skip-layoutreturn-if-layout-is-invalid.patch create mode 100644 queue-4.14/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch create mode 100644 queue-4.14/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch create mode 100644 queue-4.14/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch create mode 100644 queue-4.14/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch create mode 100644 queue-4.14/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch create mode 100644 queue-4.14/staging-lustre-llite-correct-removexattr-detection.patch create mode 100644 queue-4.14/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch create mode 100644 queue-4.14/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch create mode 100644 queue-4.14/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch create mode 100644 queue-4.14/stop_machine-use-raw-spinlocks.patch create mode 100644 queue-4.14/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch create mode 100644 queue-4.14/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch create mode 100644 queue-4.14/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch create mode 100644 queue-4.14/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch create mode 100644 queue-4.14/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch create mode 100644 queue-4.14/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch create mode 100644 queue-4.14/vfio-mdev-check-globally-for-duplicate-devices.patch create mode 100644 queue-4.14/vfio-platform-fix-reset-module-leak-in-error-path.patch create mode 100644 queue-4.14/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch create mode 100644 queue-4.14/watchdog-da9063-fix-updating-timeout-value.patch create mode 100644 queue-4.14/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch create mode 100644 queue-4.14/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch create mode 100644 queue-4.14/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch diff --git a/queue-4.14/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch b/queue-4.14/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch new file mode 100644 index 00000000000..8dcc1df17a6 --- /dev/null +++ b/queue-4.14/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Hans de Goede +Date: Fri, 13 Apr 2018 14:54:17 +0200 +Subject: ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 + +From: Hans de Goede + +[ Upstream commit c975e472ec12392a0c34de1350e634310f8a1dea ] + +The Point of View mobii wintab p800w Bay Trail tablet comes with a Crystal +Cove PMIC, yet uses the LPSS PWM for backlight control, rather then the +Crystal Cove's PWM, so we need to call pwm_add_table() to add a +pwm_backlight mapping for the LPSS pwm despite there being an INT33FD +ACPI device present. + +On all Bay Trail devices the _HRV object of the INT33FD ACPI device +will normally return 2, to indicate the Bay Trail variant of the CRC +PMIC is present, except on this tablet where _HRV is 0xffff. I guess this +is a hack to make the windows Crystal Cove PWM driver not bind. + +Out of the 44 DSTDs with an INT33FD device in there which I have (from +different model devices) only the pov mobii wintab p800w uses 0xffff for +the HRV. + +The byt_pwm_setup code calls acpi_dev_present to check for the presence +of a INT33FD ACPI device which indicates that a CRC PMIC is present and +if the INT33FD ACPI device is present then byt_pwm_setup will not add +a pwm_backlight mapping for the LPSS pwm, so that the CRC PWM will get +used instead. + +acpi_dev_present has a hrv parameter, this commit make us pass 2 instead +of -1, so that things still match on normal tablets, but on this special +case with its _HRV of 0xffff, the check will now fail so that the +pwm_backlight mapping for the LPSS pwm gets added fixing backlight +brightness control on this device. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_lpss.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -69,6 +69,10 @@ ACPI_MODULE_NAME("acpi_lpss"); + #define LPSS_SAVE_CTX BIT(4) + #define LPSS_NO_D3_DELAY BIT(5) + ++/* Crystal Cove PMIC shares same ACPI ID between different platforms */ ++#define BYT_CRC_HRV 2 ++#define CHT_CRC_HRV 3 ++ + struct lpss_private_data; + + struct lpss_device_desc { +@@ -162,7 +166,7 @@ static void byt_pwm_setup(struct lpss_pr + if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1")) + return; + +- if (!acpi_dev_present("INT33FD", NULL, -1)) ++ if (!acpi_dev_present("INT33FD", NULL, BYT_CRC_HRV)) + pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup)); + } + diff --git a/queue-4.14/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch b/queue-4.14/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch new file mode 100644 index 00000000000..83e697c5bba --- /dev/null +++ b/queue-4.14/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Zhouyang Jia +Date: Mon, 11 Jun 2018 16:18:40 +0800 +Subject: ALSA: emu10k1: add error handling for snd_ctl_add + +From: Zhouyang Jia + +[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ] + +When snd_ctl_add fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling snd_ctl_add. + +Signed-off-by: Zhouyang Jia +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/emu10k1/emupcm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -1850,7 +1850,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10 + if (!kctl) + return -ENOMEM; + kctl->id.device = device; +- snd_ctl_add(emu->card, kctl); ++ err = snd_ctl_add(emu->card, kctl); ++ if (err < 0) ++ return err; + + snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024); + diff --git a/queue-4.14/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch b/queue-4.14/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch new file mode 100644 index 00000000000..4dfe395d9c2 --- /dev/null +++ b/queue-4.14/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Takashi Iwai +Date: Thu, 17 May 2018 20:02:23 +0200 +Subject: ALSA: emu10k1: Rate-limit error messages about page errors + +From: Takashi Iwai + +[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ] + +The error messages at sanity checks of memory pages tend to repeat too +many times once when it hits, and without the rate limit, it may flood +and become unreadable. Replace such messages with the *_ratelimited() +variant. + +Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/emu10k1/memory.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -237,13 +237,13 @@ __found_pages: + static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr) + { + if (addr & ~emu->dma_mask) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "max memory size is 0x%lx (addr = 0x%lx)!!\n", + emu->dma_mask, (unsigned long)addr); + return 0; + } + if (addr & (EMUPAGESIZE-1)) { +- dev_err(emu->card->dev, "page is not aligned\n"); ++ dev_err_ratelimited(emu->card->dev, "page is not aligned\n"); + return 0; + } + return 1; +@@ -334,7 +334,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10 + else + addr = snd_pcm_sgbuf_get_addr(substream, ofs); + if (! is_valid_page(emu, addr)) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "emu: failure page = %d\n", idx); + mutex_unlock(&hdr->block_mutex); + return NULL; diff --git a/queue-4.14/alsa-fm801-add-error-handling-for-snd_ctl_add.patch b/queue-4.14/alsa-fm801-add-error-handling-for-snd_ctl_add.patch new file mode 100644 index 00000000000..f1ceaa795a1 --- /dev/null +++ b/queue-4.14/alsa-fm801-add-error-handling-for-snd_ctl_add.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Zhouyang Jia +Date: Mon, 11 Jun 2018 16:04:06 +0800 +Subject: ALSA: fm801: add error handling for snd_ctl_add + +From: Zhouyang Jia + +[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ] + +When snd_ctl_add fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling snd_ctl_add. + +Signed-off-by: Zhouyang Jia +Acked-by: Andy Shevchenko +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/fm801.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/sound/pci/fm801.c ++++ b/sound/pci/fm801.c +@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801 + if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0) + return err; + } +- for (i = 0; i < FM801_CONTROLS; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ for (i = 0; i < FM801_CONTROLS; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ if (err < 0) ++ return err; ++ } + if (chip->multichannel) { +- for (i = 0; i < FM801_CONTROLS_MULTI; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ for (i = 0; i < FM801_CONTROLS_MULTI; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ if (err < 0) ++ return err; ++ } + } + return 0; + } diff --git a/queue-4.14/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch b/queue-4.14/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch new file mode 100644 index 00000000000..6f41c06878e --- /dev/null +++ b/queue-4.14/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Takashi Sakamoto +Date: Wed, 2 May 2018 22:48:16 +0900 +Subject: ALSA: hda/ca0132: fix build failure when a local macro is defined + +From: Takashi Sakamoto + +[ Upstream commit 8e142e9e628975b0dddd05cf1b095331dff6e2de ] + +DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but +tlv.h is not included. This causes build failure when local macro is +defined by comment-out. + +This commit fixes the bug. At the same time, the alias macro is replaced +with a destination macro added at a commit 46e860f76804 ("ALSA: rename +TLV-related macros so that they're friendly to user applications") + +Reported-by: Connor McAdams +Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_ca0132.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -38,6 +38,10 @@ + /* Enable this to see controls for tuning purpose. */ + /*#define ENABLE_TUNING_CONTROLS*/ + ++#ifdef ENABLE_TUNING_CONTROLS ++#include ++#endif ++ + #define FLOAT_ZERO 0x00000000 + #define FLOAT_ONE 0x3f800000 + #define FLOAT_TWO 0x40000000 +@@ -3067,8 +3071,8 @@ static int equalizer_ctl_put(struct snd_ + return 1; + } + +-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); +-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0); + + static int add_tuning_control(struct hda_codec *codec, + hda_nid_t pnid, hda_nid_t nid, diff --git a/queue-4.14/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch b/queue-4.14/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch new file mode 100644 index 00000000000..f905a09702c --- /dev/null +++ b/queue-4.14/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Takashi Iwai +Date: Wed, 16 May 2018 20:07:18 +0200 +Subject: ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback + +From: Takashi Iwai + +[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ] + +retire_capture_urb() may print warning messages when the given URB +doesn't align, and this may flood the system log easily. +Put the rate limit to the message for avoiding it. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct sn + if (bytes % (runtime->sample_bits >> 3) != 0) { + int oldbytes = bytes; + bytes = frames * stride; +- dev_warn(&subs->dev->dev, ++ dev_warn_ratelimited(&subs->dev->dev, + "Corrected urb data len. %d->%d\n", + oldbytes, bytes); + } diff --git a/queue-4.14/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch b/queue-4.14/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch new file mode 100644 index 00000000000..9a7f1c51310 --- /dev/null +++ b/queue-4.14/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Geert Uytterhoeven +Date: Mon, 7 May 2018 15:40:05 +0200 +Subject: ARM: dts: emev2: Add missing interrupt-affinity to PMU node + +From: Geert Uytterhoeven + +[ Upstream commit 7207b94754b6f503b278b5b200faaf662ffa1da8 ] + +The PMU node references two interrupts, but lacks the interrupt-affinity +property, which is required in that case: + + hw perfevents: no interrupt-affinity property for /pmu, guessing. + +Add the missing property to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/emev2.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/emev2.dtsi ++++ b/arch/arm/boot/dts/emev2.dtsi +@@ -31,13 +31,13 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; + clock-frequency = <533000000>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -57,6 +57,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + clocks@e0110000 { diff --git a/queue-4.14/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch b/queue-4.14/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch new file mode 100644 index 00000000000..887d3b59b93 --- /dev/null +++ b/queue-4.14/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Geert Uytterhoeven +Date: Mon, 7 May 2018 15:40:04 +0200 +Subject: ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node + +From: Geert Uytterhoeven + +[ Upstream commit 57a66497e1b7486609250a482f05935eae5035e9 ] + +The PMU node references two interrupts, but lacks the interrupt-affinity +property, which is required in that case: + + hw perfevents: no interrupt-affinity property for /pmu, guessing. + +Add the missing property to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/sh73a0.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/sh73a0.dtsi ++++ b/arch/arm/boot/dts/sh73a0.dtsi +@@ -22,7 +22,7 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; +@@ -30,7 +30,7 @@ + power-domains = <&pd_a2sl>; + next-level-cache = <&L2>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -89,6 +89,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + cmt1: timer@e6138000 { diff --git a/queue-4.14/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch b/queue-4.14/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch new file mode 100644 index 00000000000..90dbb1aa7bc --- /dev/null +++ b/queue-4.14/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Patrice Chotard +Date: Fri, 20 Apr 2018 17:41:31 +0200 +Subject: ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage + +From: Patrice Chotard + +[ Upstream commit e95b8e718f9bd2386a29639dd21c633b4951dc21 ] + +Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE") +kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't +be used. + +Use IRQ_TYPE_LEVEL_HIGH instead. + +Signed-off-by: Patrice Chotard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/stih407-pinctrl.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/stih407-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stih407-pinctrl.dtsi +@@ -52,7 +52,7 @@ + st,syscfg = <&syscfg_sbc>; + reg = <0x0961f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09610000 0x6000>; + +@@ -376,7 +376,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0920f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09200000 0x10000>; + +@@ -936,7 +936,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0921f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09210000 0x10000>; + +@@ -969,7 +969,7 @@ + st,syscfg = <&syscfg_rear>; + reg = <0x0922f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09220000 0x6000>; + +@@ -1164,7 +1164,7 @@ + st,syscfg = <&syscfg_flash>; + reg = <0x0923f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09230000 0x3000>; + diff --git a/queue-4.14/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch b/queue-4.14/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch new file mode 100644 index 00000000000..f82d6072e84 --- /dev/null +++ b/queue-4.14/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Will Deacon +Date: Mon, 30 Apr 2018 13:56:32 +0100 +Subject: arm64: cmpwait: Clear event register before arming exclusive monitor + +From: Will Deacon + +[ Upstream commit 1cfc63b5ae60fe7e01773f38132f98d8b13a99a0 ] + +When waiting for a cacheline to change state in cmpwait, we may immediately +wake-up the first time around the outer loop if the event register was +already set (for example, because of the event stream). + +Avoid these spurious wakeups by explicitly clearing the event register +before loading the cacheline and setting the exclusive monitor. + +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cmpxchg.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/cmpxchg.h ++++ b/arch/arm64/include/asm/cmpxchg.h +@@ -229,7 +229,9 @@ static inline void __cmpwait_case_##name + unsigned long tmp; \ + \ + asm volatile( \ +- " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ ++ " sevl\n" \ ++ " wfe\n" \ ++ " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ + " eor %" #w "[tmp], %" #w "[tmp], %" #w "[val]\n" \ + " cbnz %" #w "[tmp], 1f\n" \ + " wfe\n" \ diff --git a/queue-4.14/arm64-defconfig-enable-rockchip-io-domain-driver.patch b/queue-4.14/arm64-defconfig-enable-rockchip-io-domain-driver.patch new file mode 100644 index 00000000000..f6e32baccc3 --- /dev/null +++ b/queue-4.14/arm64-defconfig-enable-rockchip-io-domain-driver.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Enric Balletbo i Serra +Date: Mon, 16 Apr 2018 11:39:57 -0300 +Subject: arm64: defconfig: Enable Rockchip io-domain driver + +From: Enric Balletbo i Serra + +[ Upstream commit 7c8b77f81552c2b0e5d9c560da70bc4149ce66a5 ] + +Heiko Stübner justified pretty well the change in commit e330eb86ba0b +("ARM: multi_v7_defconfig: enable Rockchip io-domain driver"). This +change is also needed for arm64 rockchip boards, so, do the same for arm64. + +The io-domain driver is necessary to notify the soc about voltages +changes happening on supplying regulators. Probably the most important +user right now is the mmc tuning code, where the soc needs to get +notified when the voltage is dropped to the 1.8V point. + +As this option is necessary to successfully tune UHS cards etc, it +should get built in. Otherwise, tuning will fail with, + + dwmmc_rockchip fe320000.dwmmc: All phases bad! + mmc0: tuning execution failed: -5 + +Signed-off-by: Enric Balletbo i Serra +Acked-by: Robin Murphy +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/configs/defconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -302,6 +302,8 @@ CONFIG_GPIO_XGENE_SB=y + CONFIG_GPIO_PCA953X=y + CONFIG_GPIO_PCA953X_IRQ=y + CONFIG_GPIO_MAX77620=y ++CONFIG_POWER_AVS=y ++CONFIG_ROCKCHIP_IODOMAIN=y + CONFIG_POWER_RESET_MSM=y + CONFIG_POWER_RESET_XGENE=y + CONFIG_POWER_RESET_SYSCON=y diff --git a/queue-4.14/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch b/queue-4.14/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch new file mode 100644 index 00000000000..f51c9c3feef --- /dev/null +++ b/queue-4.14/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch @@ -0,0 +1,90 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kuninori Morimoto +Date: Mon, 23 Apr 2018 01:40:16 +0000 +Subject: arm64: dts: renesas: salvator-common: use audio-graph-card for Sound + +From: Kuninori Morimoto + +[ Upstream commit 06a574c7ef69bd0bd26ed08e35967acb76622ab3 ] + +Current Sound is using simple-audio-card which can't support HDMI. +To use HDMI sound, we need to use audio-graph-card. +But, one note is that r8a7795 has 2 HDMI ports, but r8a7796 has 1. +Because of this mismatch, supporting HDMI on salvator-common is +impossible. +Thus, this patch exchange sound card to audio-graph-card and keep +supporting ak4613 as 1st sound node. +r8a7795/r8a7796 salvator-x{s} need to add HDMI sound individually. + +Signed-off-by: Kuninori Morimoto +Tested-by: Nguyen Viet Dung +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/salvator-common.dtsi | 38 +++++++++++++---------- + 1 file changed, 22 insertions(+), 16 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -93,20 +93,12 @@ + regulator-always-on; + }; + +- rsnd_ak4613: sound { +- compatible = "simple-audio-card"; ++ sound_card: sound { ++ compatible = "audio-graph-card"; + +- simple-audio-card,format = "left_j"; +- simple-audio-card,bitclock-master = <&sndcpu>; +- simple-audio-card,frame-master = <&sndcpu>; ++ label = "rcar-sound"; + +- sndcpu: simple-audio-card,cpu { +- sound-dai = <&rcar_sound>; +- }; +- +- sndcodec: simple-audio-card,codec { +- sound-dai = <&ak4613>; +- }; ++ dais = <&rsnd_port0>; + }; + + vbus0_usb2: regulator-vbus0-usb2 { +@@ -320,6 +312,12 @@ + asahi-kasei,out4-single-end; + asahi-kasei,out5-single-end; + asahi-kasei,out6-single-end; ++ ++ port { ++ ak4613_endpoint: endpoint { ++ remote-endpoint = <&rsnd_endpoint0>; ++ }; ++ }; + }; + + cs2000: clk_multiplier@4f { +@@ -538,10 +536,18 @@ + <&audio_clk_c>, + <&cpg CPG_CORE CPG_AUDIO_CLK_I>; + +- rcar_sound,dai { +- dai0 { +- playback = <&ssi0 &src0 &dvc0>; +- capture = <&ssi1 &src1 &dvc1>; ++ ports { ++ rsnd_port0: port@0 { ++ rsnd_endpoint0: endpoint { ++ remote-endpoint = <&ak4613_endpoint>; ++ ++ dai-format = "left_j"; ++ bitclock-master = <&rsnd_endpoint0>; ++ frame-master = <&rsnd_endpoint0>; ++ ++ playback = <&ssi0 &src0 &dvc0>; ++ capture = <&ssi1 &src1 &dvc1>; ++ }; + }; + }; + }; diff --git a/queue-4.14/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch b/queue-4.14/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch new file mode 100644 index 00000000000..f9207ec1daf --- /dev/null +++ b/queue-4.14/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kai Chieh Chuang +Date: Mon, 28 May 2018 10:18:18 +0800 +Subject: ASoC: dpcm: fix BE dai not hw_free and shutdown + +From: Kai Chieh Chuang + +[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ] + +In case, one BE is used by two FE1/FE2 +FE1--->BE--> + | +FE2----] +when FE1/FE2 call dpcm_be_dai_hw_free() together +the BE users will be 2 (> 1), hence cannot be hw_free +the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP + +later FE1/FE2 call dpcm_be_dai_shutdown(), +will be skip due to wrong state. +leaving the BE not being hw_free and shutdown. + +The BE dai will be hw_free later when calling +dpcm_be_dai_shutdown() if still in invalid state. + +Signed-off-by: KaiChieh Chuang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-pcm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1779,8 +1779,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_ + continue; + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) +- continue; ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) { ++ soc_pcm_hw_free(be_substream); ++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE; ++ } + + dev_dbg(be->dev, "ASoC: close BE %s\n", + be->dai_link->name); diff --git a/queue-4.14/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch b/queue-4.14/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch new file mode 100644 index 00000000000..9f49309db95 --- /dev/null +++ b/queue-4.14/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch @@ -0,0 +1,100 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kirill Marinushkin +Date: Wed, 4 Apr 2018 06:19:38 +0200 +Subject: ASoC: topology: Add missing clock gating parameter when parsing hw_configs + +From: Kirill Marinushkin + +[ Upstream commit 933e1c4a667103c4d10ebdc9505a0a6abd8c3fbd ] + +Clock gating parameter is a part of `dai_fmt`. It is supported by +`alsa-lib` when creating a topology binary file, but ignored by kernel +when loading this topology file. + +After applying this commit, the clock gating parameter is not ignored any +more. This solution is backwards compatible. The existing behaviour is +not broken, because by default the parameter value is 0 and is ignored. + +snd_soc_tplg_hw_config.clock_gated = 0 => no effect +snd_soc_tplg_hw_config.clock_gated = 1 => SND_SOC_DAIFMT_GATED +snd_soc_tplg_hw_config.clock_gated = 2 => SND_SOC_DAIFMT_CONT + +For example, the following config, based on +alsa-lib/src/conf/topology/broadwell/broadwell.conf, is now supported: + +~~~~ +SectionHWConfig."CodecHWConfig" { + id "1" + format "I2S" # physical audio format. + pm_gate_clocks "true" # clock can be gated +} + +SectionLink."Codec" { + + # used for binding to the physical link + id "0" + + hw_configs [ + "CodecHWConfig" + ] + + default_hw_conf_id "1" +} +~~~~ + +Signed-off-by: Kirill Marinushkin +Reviewed-by: Pierre-Louis Bossart +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: Mark Brown +Cc: Pan Xiuli +Cc: Liam Girdwood +Cc: linux-kernel@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/sound/asoc.h | 7 ++++++- + sound/soc/soc-topology.c | 7 +++++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/include/uapi/sound/asoc.h ++++ b/include/uapi/sound/asoc.h +@@ -139,6 +139,11 @@ + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS (1 << 1) + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + ++/* DAI clock gating */ ++#define SND_SOC_TPLG_DAI_CLK_GATE_UNDEFINED 0 ++#define SND_SOC_TPLG_DAI_CLK_GATE_GATED 1 ++#define SND_SOC_TPLG_DAI_CLK_GATE_CONT 2 ++ + /* DAI physical PCM data formats. + * Add new formats to the end of the list. + */ +@@ -324,7 +329,7 @@ struct snd_soc_tplg_hw_config { + __le32 size; /* in bytes of this structure */ + __le32 id; /* unique ID - - used to match */ + __le32 fmt; /* SND_SOC_DAI_FORMAT_ format value */ +- __u8 clock_gated; /* 1 if clock can be gated to save power */ ++ __u8 clock_gated; /* SND_SOC_TPLG_DAI_CLK_GATE_ value */ + __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */ + __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */ + __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */ +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1997,6 +1997,13 @@ static void set_link_hw_format(struct sn + + link->dai_fmt = hw_config->fmt & SND_SOC_DAIFMT_FORMAT_MASK; + ++ /* clock gating */ ++ if (hw_config->clock_gated == SND_SOC_TPLG_DAI_CLK_GATE_GATED) ++ link->dai_fmt |= SND_SOC_DAIFMT_GATED; ++ else if (hw_config->clock_gated == ++ SND_SOC_TPLG_DAI_CLK_GATE_CONT) ++ link->dai_fmt |= SND_SOC_DAIFMT_CONT; ++ + /* clock signal polarity */ + invert_bclk = hw_config->invert_bclk; + invert_fsync = hw_config->invert_fsync; diff --git a/queue-4.14/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch b/queue-4.14/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch new file mode 100644 index 00000000000..68139d8a251 --- /dev/null +++ b/queue-4.14/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch @@ -0,0 +1,89 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kirill Marinushkin +Date: Wed, 4 Apr 2018 06:19:37 +0200 +Subject: ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format() + +From: Kirill Marinushkin + +[ Upstream commit a941e2fab3207cb0d57dc4ec47b1b12c8ea78b84 ] + +The values of bclk and fsync are inverted WRT the codec. But the existing +solution already works for Broadwell, see the alsa-lib config: + +`alsa-lib/src/conf/topology/broadwell/broadwell.conf` + +This commit provides the backwards-compatible solution to fix this misuse. + +Signed-off-by: Kirill Marinushkin +Reviewed-by: Pierre-Louis Bossart +Tested-by: Pan Xiuli +Tested-by: Pierre-Louis Bossart +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: Mark Brown +Cc: Liam Girdwood +Cc: linux-kernel@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/sound/asoc.h | 16 ++++++++++++++-- + sound/soc/soc-topology.c | 12 +++++++----- + 2 files changed, 21 insertions(+), 7 deletions(-) + +--- a/include/uapi/sound/asoc.h ++++ b/include/uapi/sound/asoc.h +@@ -160,6 +160,18 @@ + #define SND_SOC_TPLG_LNK_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + #define SND_SOC_TPLG_LNK_FLGBIT_VOICE_WAKEUP (1 << 3) + ++/* DAI topology BCLK parameter ++ * For the backwards capability, by default codec is bclk master ++ */ ++#define SND_SOC_TPLG_BCLK_CM 0 /* codec is bclk master */ ++#define SND_SOC_TPLG_BCLK_CS 1 /* codec is bclk slave */ ++ ++/* DAI topology FSYNC parameter ++ * For the backwards capability, by default codec is fsync master ++ */ ++#define SND_SOC_TPLG_FSYNC_CM 0 /* codec is fsync master */ ++#define SND_SOC_TPLG_FSYNC_CS 1 /* codec is fsync slave */ ++ + /* + * Block Header. + * This header precedes all object and object arrays below. +@@ -315,8 +327,8 @@ struct snd_soc_tplg_hw_config { + __u8 clock_gated; /* 1 if clock can be gated to save power */ + __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */ + __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */ +- __u8 bclk_master; /* 1 for master of BCLK, 0 for slave */ +- __u8 fsync_master; /* 1 for master of FSYNC, 0 for slave */ ++ __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */ ++ __u8 fsync_master; /* SND_SOC_TPLG_FSYNC_ value */ + __u8 mclk_direction; /* 0 for input, 1 for output */ + __le16 reserved; /* for 32bit alignment */ + __le32 mclk_rate; /* MCLK or SYSCLK freqency in Hz */ +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2010,13 +2010,15 @@ static void set_link_hw_format(struct sn + link->dai_fmt |= SND_SOC_DAIFMT_IB_IF; + + /* clock masters */ +- bclk_master = hw_config->bclk_master; +- fsync_master = hw_config->fsync_master; +- if (!bclk_master && !fsync_master) ++ bclk_master = (hw_config->bclk_master == ++ SND_SOC_TPLG_BCLK_CM); ++ fsync_master = (hw_config->fsync_master == ++ SND_SOC_TPLG_FSYNC_CM); ++ if (bclk_master && fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM; +- else if (bclk_master && !fsync_master) +- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; + else if (!bclk_master && fsync_master) ++ link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; ++ else if (bclk_master && !fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFS; + else + link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS; diff --git a/queue-4.14/ath-add-regulatory-mapping-for-apl13_world.patch b/queue-4.14/ath-add-regulatory-mapping-for-apl13_world.patch new file mode 100644 index 00000000000..7998a67caa2 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-apl13_world.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:14 +0300 +Subject: ath: Add regulatory mapping for APL13_WORLD + +From: Sven Eckelmann + +[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -69,6 +69,7 @@ enum EnumRd { + APL1_ETSIC = 0x55, + APL2_ETSIC = 0x56, + APL5_WORLD = 0x58, ++ APL13_WORLD = 0x5A, + APL6_WORLD = 0x5B, + APL7_FCCA = 0x5C, + APL8_WORLD = 0x5D, +@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo + {APL3_WORLD, CTL_FCC, CTL_ETSI}, + {APL4_WORLD, CTL_FCC, CTL_ETSI}, + {APL5_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL13_WORLD, CTL_ETSI, CTL_ETSI}, + {APL6_WORLD, CTL_ETSI, CTL_ETSI}, + {APL8_WORLD, CTL_ETSI, CTL_ETSI}, + {APL9_WORLD, CTL_ETSI, CTL_ETSI}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-apl2_fcca.patch b/queue-4.14/ath-add-regulatory-mapping-for-apl2_fcca.patch new file mode 100644 index 00000000000..9ab6a6c73ea --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-apl2_fcca.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:05 +0300 +Subject: ath: Add regulatory mapping for APL2_FCCA + +From: Sven Eckelmann + +[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: FCC +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -61,6 +61,7 @@ enum EnumRd { + MKK1_MKKA1 = 0x4A, + MKK1_MKKA2 = 0x4B, + MKK1_MKKC = 0x4C, ++ APL2_FCCA = 0x4D, + + APL3_FCCA = 0x50, + APL1_WORLD = 0x52, +@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo + {FCC1_FCCA, CTL_FCC, CTL_FCC}, + {APL1_WORLD, CTL_FCC, CTL_ETSI}, + {APL2_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL2_FCCA, CTL_FCC, CTL_FCC}, + {APL3_WORLD, CTL_FCC, CTL_ETSI}, + {APL4_WORLD, CTL_FCC, CTL_ETSI}, + {APL5_WORLD, CTL_FCC, CTL_ETSI}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-bahamas.patch b/queue-4.14/ath-add-regulatory-mapping-for-bahamas.patch new file mode 100644 index 00000000000..a657f4efcd0 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-bahamas.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:09:53 +0300 +Subject: ath: Add regulatory mapping for Bahamas + +From: Sven Eckelmann + +[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -68,6 +68,7 @@ enum CountryCode { + CTRY_AUSTRALIA = 36, + CTRY_AUSTRIA = 40, + CTRY_AZERBAIJAN = 31, ++ CTRY_BAHAMAS = 44, + CTRY_BAHRAIN = 48, + CTRY_BANGLADESH = 50, + CTRY_BARBADOS = 52, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al + {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"}, + {CTRY_AUSTRIA, ETSI1_WORLD, "AT"}, + {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"}, ++ {CTRY_BAHAMAS, FCC3_WORLD, "BS"}, + {CTRY_BAHRAIN, APL6_WORLD, "BH"}, + {CTRY_BANGLADESH, NULL1_WORLD, "BD"}, + {CTRY_BARBADOS, FCC2_WORLD, "BB"}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-bermuda.patch b/queue-4.14/ath-add-regulatory-mapping-for-bermuda.patch new file mode 100644 index 00000000000..e8e847a3005 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-bermuda.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:09:59 +0300 +Subject: ath: Add regulatory mapping for Bermuda + +From: Sven Eckelmann + +[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: FCC +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -74,6 +74,7 @@ enum CountryCode { + CTRY_BELARUS = 112, + CTRY_BELGIUM = 56, + CTRY_BELIZE = 84, ++ CTRY_BERMUDA = 60, + CTRY_BOLIVIA = 68, + CTRY_BOSNIA_HERZ = 70, + CTRY_BRAZIL = 76, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al + {CTRY_BELGIUM, ETSI1_WORLD, "BE"}, + {CTRY_BELGIUM2, ETSI4_WORLD, "BL"}, + {CTRY_BELIZE, APL1_ETSIC, "BZ"}, ++ {CTRY_BERMUDA, FCC3_FCCA, "BM"}, + {CTRY_BOLIVIA, APL1_ETSIC, "BO"}, + {CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"}, + {CTRY_BRAZIL, FCC3_WORLD, "BR"}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-etsi8_world.patch b/queue-4.14/ath-add-regulatory-mapping-for-etsi8_world.patch new file mode 100644 index 00000000000..2290fbe3866 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-etsi8_world.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:18 +0300 +Subject: ath: Add regulatory mapping for ETSI8_WORLD + +From: Sven Eckelmann + +[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -45,6 +45,7 @@ enum EnumRd { + ETSI4_ETSIC = 0x38, + ETSI5_WORLD = 0x39, + ETSI6_WORLD = 0x34, ++ ETSI8_WORLD = 0x3D, + ETSI_RESERVED = 0x33, + + MKK1_MKKA = 0x40, +@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo + {ETSI4_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI5_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI6_WORLD, CTL_ETSI, CTL_ETSI}, ++ {ETSI8_WORLD, CTL_ETSI, CTL_ETSI}, + + /* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */ + {ETSI3_ETSIA, CTL_ETSI, CTL_ETSI}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-fcc3_etsic.patch b/queue-4.14/ath-add-regulatory-mapping-for-fcc3_etsic.patch new file mode 100644 index 00000000000..1c809f48512 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-fcc3_etsic.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:30 +0300 +Subject: ath: Add regulatory mapping for FCC3_ETSIC + +From: Sven Eckelmann + +[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -35,6 +35,7 @@ enum EnumRd { + FRANCE_RES = 0x31, + FCC3_FCCA = 0x3A, + FCC3_WORLD = 0x3B, ++ FCC3_ETSIC = 0x3F, + + ETSI1_WORLD = 0x37, + ETSI3_ETSIA = 0x32, +@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo + {FCC2_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC3_FCCA, CTL_FCC, CTL_FCC}, + {FCC3_WORLD, CTL_FCC, CTL_ETSI}, ++ {FCC3_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC4_FCCA, CTL_FCC, CTL_FCC}, + {FCC5_FCCA, CTL_FCC, CTL_FCC}, + {FCC6_FCCA, CTL_FCC, CTL_FCC}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-serbia.patch b/queue-4.14/ath-add-regulatory-mapping-for-serbia.patch new file mode 100644 index 00000000000..4100506c724 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-serbia.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:43 +0300 +Subject: ath: Add regulatory mapping for Serbia + +From: Sven Eckelmann + +[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -159,6 +159,7 @@ enum CountryCode { + CTRY_ROMANIA = 642, + CTRY_RUSSIA = 643, + CTRY_SAUDI_ARABIA = 682, ++ CTRY_SERBIA = 688, + CTRY_SERBIA_MONTENEGRO = 891, + CTRY_SINGAPORE = 702, + CTRY_SLOVAKIA = 703, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al + {CTRY_ROMANIA, NULL1_WORLD, "RO"}, + {CTRY_RUSSIA, NULL1_WORLD, "RU"}, + {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"}, ++ {CTRY_SERBIA, ETSI1_WORLD, "RS"}, + {CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"}, + {CTRY_SINGAPORE, APL6_WORLD, "SG"}, + {CTRY_SLOVAKIA, ETSI1_WORLD, "SK"}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-tanzania.patch b/queue-4.14/ath-add-regulatory-mapping-for-tanzania.patch new file mode 100644 index 00000000000..8e4d7b73159 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-tanzania.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:48 +0300 +Subject: ath: Add regulatory mapping for Tanzania + +From: Sven Eckelmann + +[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -170,6 +170,7 @@ enum CountryCode { + CTRY_SWITZERLAND = 756, + CTRY_SYRIA = 760, + CTRY_TAIWAN = 158, ++ CTRY_TANZANIA = 834, + CTRY_THAILAND = 764, + CTRY_TRINIDAD_Y_TOBAGO = 780, + CTRY_TUNISIA = 788, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al + {CTRY_SWITZERLAND, ETSI1_WORLD, "CH"}, + {CTRY_SYRIA, NULL1_WORLD, "SY"}, + {CTRY_TAIWAN, APL3_FCCA, "TW"}, ++ {CTRY_TANZANIA, APL1_WORLD, "TZ"}, + {CTRY_THAILAND, FCC3_WORLD, "TH"}, + {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"}, + {CTRY_TUNISIA, ETSI3_WORLD, "TN"}, diff --git a/queue-4.14/ath-add-regulatory-mapping-for-uganda.patch b/queue-4.14/ath-add-regulatory-mapping-for-uganda.patch new file mode 100644 index 00000000000..483e7549727 --- /dev/null +++ b/queue-4.14/ath-add-regulatory-mapping-for-uganda.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:54 +0300 +Subject: ath: Add regulatory mapping for Uganda + +From: Sven Eckelmann + +[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -175,6 +175,7 @@ enum CountryCode { + CTRY_TUNISIA = 788, + CTRY_TURKEY = 792, + CTRY_UAE = 784, ++ CTRY_UGANDA = 800, + CTRY_UKRAINE = 804, + CTRY_UNITED_KINGDOM = 826, + CTRY_UNITED_STATES = 840, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al + {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"}, + {CTRY_TUNISIA, ETSI3_WORLD, "TN"}, + {CTRY_TURKEY, ETSI3_WORLD, "TR"}, ++ {CTRY_UGANDA, FCC3_WORLD, "UG"}, + {CTRY_UKRAINE, NULL1_WORLD, "UA"}, + {CTRY_UAE, NULL1_WORLD, "AE"}, + {CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"}, diff --git a/queue-4.14/audit-allow-not-equal-op-for-audit-by-executable.patch b/queue-4.14/audit-allow-not-equal-op-for-audit-by-executable.patch new file mode 100644 index 00000000000..558a688b6f6 --- /dev/null +++ b/queue-4.14/audit-allow-not-equal-op-for-audit-by-executable.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Ondrej Mosnáček" +Date: Mon, 9 Apr 2018 10:00:06 +0200 +Subject: audit: allow not equal op for audit by executable + +From: "Ondrej Mosnáček" + +[ Upstream commit 23bcc480dac204c7dbdf49d96b2c918ed98223c2 ] + +Current implementation of auditing by executable name only implements +the 'equal' operator. This patch extends it to also support the 'not +equal' operator. + +See: https://github.com/linux-audit/audit-kernel/issues/53 + +Signed-off-by: Ondrej Mosnacek +Reviewed-by: Richard Guy Briggs +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/auditfilter.c | 2 +- + kernel/auditsc.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/auditfilter.c ++++ b/kernel/auditfilter.c +@@ -407,7 +407,7 @@ static int audit_field_valid(struct audi + return -EINVAL; + break; + case AUDIT_EXE: +- if (f->op != Audit_equal) ++ if (f->op != Audit_not_equal && f->op != Audit_equal) + return -EINVAL; + if (entry->rule.listnr != AUDIT_FILTER_EXIT) + return -EINVAL; +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -471,6 +471,8 @@ static int audit_filter_rules(struct tas + break; + case AUDIT_EXE: + result = audit_exe_compare(tsk, rule->exe); ++ if (f->op == Audit_not_equal) ++ result = !result; + break; + case AUDIT_UID: + result = audit_uid_comparator(cred->uid, f->op, f->uid); diff --git a/queue-4.14/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch b/queue-4.14/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch new file mode 100644 index 00000000000..229c8ce5350 --- /dev/null +++ b/queue-4.14/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wolfram Sang +Date: Sun, 14 Jan 2018 22:07:10 +0100 +Subject: backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction + +From: Wolfram Sang + +[ Upstream commit bb084c0f61d659f0e6d371b096e0e57998f191d6 ] + +The documentation was wrong, gpiod_get_direction() returns 0/1 instead +of the GPIOF_* flags. The docs were fixed with commit 94fc73094abe47 +("gpio: correct docs about return value of gpiod_get_direction"). Now, +fix this user (until a better, system-wide solution is in place). + +Signed-off-by: Wolfram Sang +Acked-by: Daniel Thompson +Reviewed-by: Simon Horman +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/backlight/pwm_bl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -301,14 +301,14 @@ static int pwm_backlight_probe(struct pl + + /* + * If the GPIO is not known to be already configured as output, that +- * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL, +- * change the direction to output and set the GPIO as active. ++ * is, if gpiod_get_direction returns either 1 or -EINVAL, change the ++ * direction to output and set the GPIO as active. + * Do not force the GPIO to active when it was already output as it + * could cause backlight flickering or we would enable the backlight too + * early. Leave the decision of the initial backlight state for later. + */ + if (pb->enable_gpio && +- gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT) ++ gpiod_get_direction(pb->enable_gpio) != 0) + gpiod_direction_output(pb->enable_gpio, 1); + + pb->power_supply = devm_regulator_get(&pdev->dev, "power"); diff --git a/queue-4.14/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch b/queue-4.14/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch new file mode 100644 index 00000000000..547ec4bad0e --- /dev/null +++ b/queue-4.14/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Filippo Muzzini +Date: Thu, 31 May 2018 15:23:11 +0200 +Subject: block, bfq: remove wrong lock in bfq_requests_merged + +From: Filippo Muzzini + +[ Upstream commit a12bffebc0c9d6a5851f062aaea3aa7c4adc6042 ] + +In bfq_requests_merged(), there is a deadlock because the lock on +bfqq->bfqd->lock is held by the calling function, but the code of +this function tries to grab the lock again. + +This deadlock is currently hidden by another bug (fixed by next commit +for this source file), which causes the body of bfq_requests_merged() +to be never executed. + +This commit removes the deadlock by removing the lock/unlock pair. + +Signed-off-by: Filippo Muzzini +Signed-off-by: Paolo Valente +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/bfq-iosched.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -1678,7 +1678,6 @@ static void bfq_requests_merged(struct r + + if (!RB_EMPTY_NODE(&rq->rb_node)) + goto end; +- spin_lock_irq(&bfqq->bfqd->lock); + + /* + * If next and rq belong to the same bfq_queue and next is older +@@ -1702,7 +1701,6 @@ static void bfq_requests_merged(struct r + + bfq_remove_request(q, next); + +- spin_unlock_irq(&bfqq->bfqd->lock); + end: + bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); + } diff --git a/queue-4.14/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch b/queue-4.14/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch new file mode 100644 index 00000000000..ac6ffa0e07b --- /dev/null +++ b/queue-4.14/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jian-Hong Pan +Date: Mon, 21 May 2018 18:09:20 +0800 +Subject: Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 + +From: Jian-Hong Pan + +[ Upstream commit 66d9975c5a7c40aa7e4bb0ec0b0c37ba1f190923 ] + +Without this patch we cannot turn on the Bluethooth adapter on ASUS +E406MA. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2ff8 ProdID=b011 Rev= 2.00 +S: Manufacturer=Realtek +S: Product=802.11n WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -373,6 +373,9 @@ static const struct usb_device_id blackl + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, + ++ /* Additional Realtek 8723DE Bluetooth devices */ ++ { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, ++ + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, diff --git a/queue-4.14/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch b/queue-4.14/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch new file mode 100644 index 00000000000..8e9bdc65171 --- /dev/null +++ b/queue-4.14/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Vic Wei +Date: Mon, 23 Apr 2018 15:17:07 -0700 +Subject: Bluetooth: btusb: add ID for LiteOn 04ca:301a + +From: Vic Wei + +[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ] + +Contains a QCA6174A chipset, with USB BT. Let's support loading +firmware on it. + +>From usb-devices: +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04ca ProdID=301a Rev= 0.01 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Signed-off-by: Vic Wei +Signed-off-by: Matthias Kaehlcke +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -279,6 +279,7 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, ++ { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME }, + + /* Broadcom BCM2035 */ + { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, diff --git a/queue-4.14/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch b/queue-4.14/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch new file mode 100644 index 00000000000..fb269e34886 --- /dev/null +++ b/queue-4.14/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Thierry Escande +Date: Tue, 29 May 2018 18:37:16 +0200 +Subject: Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning + +From: Thierry Escande + +[ Upstream commit 9960521c44a5d828f29636ceac0600603ecbddbf ] + +This patch fixes the following warning during boot: + + do not call blocking ops when !TASK_RUNNING; state=1 set at + [<(ptrval)>] qca_setup+0x194/0x750 [hci_uart] + WARNING: CPU: 2 PID: 1878 at kernel/sched/core.c:6135 + __might_sleep+0x7c/0x88 + +In qca_set_baudrate(), the current task state is set to +TASK_UNINTERRUPTIBLE before going to sleep for 300ms. It was then +restored to TASK_INTERRUPTIBLE. This patch sets the current task state +back to TASK_RUNNING instead. + +Signed-off-by: Thierry Escande +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/hci_qca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -881,7 +881,7 @@ static int qca_set_baudrate(struct hci_d + */ + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS)); +- set_current_state(TASK_INTERRUPTIBLE); ++ set_current_state(TASK_RUNNING); + + return 0; + } diff --git a/queue-4.14/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch b/queue-4.14/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch new file mode 100644 index 00000000000..d8f9d916d67 --- /dev/null +++ b/queue-4.14/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Michael Chan +Date: Tue, 8 May 2018 03:18:39 -0400 +Subject: bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only. + +From: Michael Chan + +[ Upstream commit dac0490718bd17df5e3995ffca14255e5f9ed22d ] + +Only non-NPAR PFs need to actively check and manage unsupported link +speeds. NPAR functions and VFs do not control the link speed and +should skip the unsupported speed detection logic, to avoid warning +messages from firmware rejecting the unsupported firmware calls. + +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5927,6 +5927,9 @@ static int bnxt_update_link(struct bnxt + } + mutex_unlock(&bp->hwrm_cmd_lock); + ++ if (!BNXT_SINGLE_PF(bp)) ++ return 0; ++ + diff = link_info->support_auto_speeds ^ link_info->advertising; + if ((link_info->support_auto_speeds | diff) != + link_info->support_auto_speeds) { diff --git a/queue-4.14/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch b/queue-4.14/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch new file mode 100644 index 00000000000..310d2c309cc --- /dev/null +++ b/queue-4.14/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wang YanQing +Date: Fri, 11 May 2018 10:52:17 +0800 +Subject: bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64} + +From: Wang YanQing + +[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ] + +The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*, +the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but +the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*. + +For consistence reason, let's rename emit_a32_lsr_* to +emit_a32_rsh_*. + +This patch also corrects a wrong comment. + +Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") +Signed-off-by: Wang YanQing +Cc: Shubham Bansal +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux@armlinux.org.uk +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/net/bpf_jit_32.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -718,7 +718,7 @@ static inline void emit_a32_arsh_r64(con + } + + /* dst = dst >> src */ +-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk, ++static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk, + bool sstk, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -734,7 +734,7 @@ static inline void emit_a32_lsr_r64(cons + emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx); + } + +- /* Do LSH operation */ ++ /* Do RSH operation */ + emit(ARM_RSB_I(ARM_IP, rt, 32), ctx); + emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx); + emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx); +@@ -784,7 +784,7 @@ static inline void emit_a32_lsh_i64(cons + } + + /* dst = dst >> val */ +-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk, ++static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk, + const u32 val, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -1340,7 +1340,7 @@ static int build_insn(const struct bpf_i + case BPF_ALU64 | BPF_RSH | BPF_K: + if (unlikely(imm > 63)) + return -EINVAL; +- emit_a32_lsr_i64(dst, dstk, imm, ctx); ++ emit_a32_rsh_i64(dst, dstk, imm, ctx); + break; + /* dst = dst << src */ + case BPF_ALU64 | BPF_LSH | BPF_X: +@@ -1348,7 +1348,7 @@ static int build_insn(const struct bpf_i + break; + /* dst = dst >> src */ + case BPF_ALU64 | BPF_RSH | BPF_X: +- emit_a32_lsr_r64(dst, src, dstk, sstk, ctx); ++ emit_a32_rsh_r64(dst, src, dstk, sstk, ctx); + break; + /* dst = dst >> src (signed) */ + case BPF_ALU64 | BPF_ARSH | BPF_X: diff --git a/queue-4.14/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch b/queue-4.14/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch new file mode 100644 index 00000000000..8ea88d52ebf --- /dev/null +++ b/queue-4.14/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jakub Kicinski +Date: Thu, 3 May 2018 18:37:17 -0700 +Subject: bpf: fix references to free_bpf_prog_info() in comments + +From: Jakub Kicinski + +[ Upstream commit ab7f5bf0928be2f148d000a6eaa6c0a36e74750e ] + +Comments in the verifier refer to free_bpf_prog_info() which +seems to have never existed in tree. Replace it with +free_used_maps(). + +Signed-off-by: Jakub Kicinski +Reviewed-by: Quentin Monnet +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4110,7 +4110,7 @@ static int replace_map_fd_with_map_ptr(s + /* hold the map. If the program is rejected by verifier, + * the map will be released by release_maps() or it + * will be used by the valid program until it's unloaded +- * and all maps are released in free_bpf_prog_info() ++ * and all maps are released in free_used_maps() + */ + map = bpf_map_inc(map, false); + if (IS_ERR(map)) { +@@ -4623,7 +4623,7 @@ free_log_buf: + vfree(log_buf); + if (!env->prog->aux->used_maps) + /* if we didn't copy map pointers into bpf_prog_info, release +- * them now. Otherwise free_bpf_prog_info() will release them. ++ * them now. Otherwise free_used_maps() will release them. + */ + release_maps(env); + *prog = env->prog; diff --git a/queue-4.14/bpf-powerpc64-pad-function-address-loads-with-nops.patch b/queue-4.14/bpf-powerpc64-pad-function-address-loads-with-nops.patch new file mode 100644 index 00000000000..538ace0608c --- /dev/null +++ b/queue-4.14/bpf-powerpc64-pad-function-address-loads-with-nops.patch @@ -0,0 +1,82 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sandipan Das +Date: Thu, 24 May 2018 12:26:46 +0530 +Subject: bpf: powerpc64: pad function address loads with NOPs + +From: Sandipan Das + +[ Upstream commit 4ea69b2fd623dee2bbc77d3b6b7d8c0924e2026a ] + +For multi-function programs, loading the address of a callee +function to a register requires emitting instructions whose +count varies from one to five depending on the nature of the +address. + +Since we come to know of the callee's address only before the +extra pass, the number of instructions required to load this +address may vary from what was previously generated. This can +make the JITed image grow or shrink. + +To avoid this, we should generate a constant five-instruction +when loading function addresses by padding the optimized load +sequence with NOPs. + +Signed-off-by: Sandipan Das +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/net/bpf_jit_comp64.c | 34 +++++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -203,25 +203,37 @@ static void bpf_jit_build_epilogue(u32 * + + static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func) + { ++ unsigned int i, ctx_idx = ctx->idx; ++ ++ /* Load function address into r12 */ ++ PPC_LI64(12, func); ++ ++ /* For bpf-to-bpf function calls, the callee's address is unknown ++ * until the last extra pass. As seen above, we use PPC_LI64() to ++ * load the callee's address, but this may optimize the number of ++ * instructions required based on the nature of the address. ++ * ++ * Since we don't want the number of instructions emitted to change, ++ * we pad the optimized PPC_LI64() call with NOPs to guarantee that ++ * we always have a five-instruction sequence, which is the maximum ++ * that PPC_LI64() can emit. ++ */ ++ for (i = ctx->idx - ctx_idx; i < 5; i++) ++ PPC_NOP(); ++ + #ifdef PPC64_ELF_ABI_v1 +- /* func points to the function descriptor */ +- PPC_LI64(b2p[TMP_REG_2], func); +- /* Load actual entry point from function descriptor */ +- PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0); +- /* ... and move it to LR */ +- PPC_MTLR(b2p[TMP_REG_1]); + /* + * Load TOC from function descriptor at offset 8. + * We can clobber r2 since we get called through a + * function pointer (so caller will save/restore r2) + * and since we don't use a TOC ourself. + */ +- PPC_BPF_LL(2, b2p[TMP_REG_2], 8); +-#else +- /* We can clobber r12 */ +- PPC_FUNC_ADDR(12, func); +- PPC_MTLR(12); ++ PPC_BPF_LL(2, 12, 8); ++ /* Load actual entry point from function descriptor */ ++ PPC_BPF_LL(12, 12, 0); + #endif ++ ++ PPC_MTLR(12); + PPC_BLRL(); + } + diff --git a/queue-4.14/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch b/queue-4.14/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch new file mode 100644 index 00000000000..fa4ededa18a --- /dev/null +++ b/queue-4.14/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sean Lanigan +Date: Fri, 4 May 2018 16:48:23 +1000 +Subject: brcmfmac: Add support for bcm43364 wireless chipset + +From: Sean Lanigan + +[ Upstream commit 9c4a121e82634aa000a702c98cd6f05b27d6e186 ] + +Add support for the BCM43364 chipset via an SDIO interface, as used in +e.g. the Murata 1FX module. + +The BCM43364 uses the same firmware as the BCM43430 (which is already +included), the only difference is the omission of Bluetooth. + +However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS +of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't +load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place +triggers the brcmfmac driver to load, and then correctly use the +firmware file 'brcmfmac43430-sdio.bin'. + +Signed-off-by: Sean Lanigan +Acked-by: Ulf Hansson +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 + + include/linux/mmc/sdio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -1098,6 +1098,7 @@ static const struct sdio_device_id brcmf + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430), +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -35,6 +35,7 @@ + #define SDIO_DEVICE_ID_BROADCOM_4335_4339 0x4335 + #define SDIO_DEVICE_ID_BROADCOM_4339 0x4339 + #define SDIO_DEVICE_ID_BROADCOM_43362 0xa962 ++#define SDIO_DEVICE_ID_BROADCOM_43364 0xa9a4 + #define SDIO_DEVICE_ID_BROADCOM_43430 0xa9a6 + #define SDIO_DEVICE_ID_BROADCOM_4345 0x4345 + #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf diff --git a/queue-4.14/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch b/queue-4.14/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch new file mode 100644 index 00000000000..748e27b62a6 --- /dev/null +++ b/queue-4.14/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch @@ -0,0 +1,97 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: David Sterba +Date: Tue, 24 Apr 2018 14:53:56 +0200 +Subject: btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups + +From: David Sterba + +[ Upstream commit 3d3a2e610ea5e7c6d4f9481ecce5d8e2d8317843 ] + +Currently the code assumes that there's an implied barrier by the +sequence of code preceding the wakeup, namely the mutex unlock. + +As Nikolay pointed out: + +I think this is wrong (not your code) but the original assumption that +the RELEASE semantics provided by mutex_unlock is sufficient. +According to memory-barriers.txt: + +Section 'LOCK ACQUISITION FUNCTIONS' states: + + (2) RELEASE operation implication: + + Memory operations issued before the RELEASE will be completed before the + RELEASE operation has completed. + + Memory operations issued after the RELEASE *may* be completed before the + RELEASE operation has completed. + +(I've bolded the may portion) + +The example given there: + +As an example, consider the following: + + *A = a; + *B = b; + ACQUIRE + *C = c; + *D = d; + RELEASE + *E = e; + *F = f; + +The following sequence of events is acceptable: + + ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE + +So if we assume that *C is modifying the flag which the waitqueue is checking, +and *E is the actual wakeup, then those accesses can be re-ordered... + +IMHO this code should be considered broken... +Signed-off-by: Greg Kroah-Hartman +--- + +To be on the safe side, add the barriers. The synchronization logic +around log using the mutexes and several other threads does not make it +easy to reason for/against the barrier. + +CC: Nikolay Borisov +Link: https://lkml.kernel.org/r/6ee068d8-1a69-3728-00d1-d86293d43c9f@suse.com +Reviewed-by: Nikolay Borisov +Signed-off-by: David Sterba + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/tree-log.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3041,8 +3041,11 @@ out_wake_log_root: + mutex_unlock(&log_root_tree->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&log_root_tree->log_commit_wait[index2])) + wake_up(&log_root_tree->log_commit_wait[index2]); + out: +@@ -3053,8 +3056,11 @@ out: + mutex_unlock(&root->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&root->log_commit_wait[index1])) + wake_up(&root->log_commit_wait[index1]); + return ret; diff --git a/queue-4.14/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch b/queue-4.14/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch new file mode 100644 index 00000000000..b563208eaf4 --- /dev/null +++ b/queue-4.14/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch @@ -0,0 +1,89 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Ethan Lien +Date: Mon, 28 May 2018 13:48:20 +0800 +Subject: btrfs: balance dirty metadata pages in btrfs_finish_ordered_io + +From: Ethan Lien + +[ Upstream commit e73e81b6d0114d4a303205a952ab2e87c44bd279 ] + +[Problem description and how we fix it] +We should balance dirty metadata pages at the end of +btrfs_finish_ordered_io, since a small, unmergeable random write can +potentially produce dirty metadata which is multiple times larger than +the data itself. For example, a small, unmergeable 4KiB write may +produce: + + 16KiB dirty leaf (and possibly 16KiB dirty node) in subvolume tree + 16KiB dirty leaf (and possibly 16KiB dirty node) in checksum tree + 16KiB dirty leaf (and possibly 16KiB dirty node) in extent tree + +Although we do call balance dirty pages in write side, but in the +buffered write path, most metadata are dirtied only after we reach the +dirty background limit (which by far only counts dirty data pages) and +wakeup the flusher thread. If there are many small, unmergeable random +writes spread in a large btree, we'll find a burst of dirty pages +exceeds the dirty_bytes limit after we wakeup the flusher thread - which +is not what we expect. In our machine, it caused out-of-memory problem +since a page cannot be dropped if it is marked dirty. + +Someone may worry about we may sleep in btrfs_btree_balance_dirty_nodelay, +but since we do btrfs_finish_ordered_io in a separate worker, it will not +stop the flusher consuming dirty pages. Also, we use different worker for +metadata writeback endio, sleep in btrfs_finish_ordered_io help us throttle +the size of dirty metadata pages. + +[Reproduce steps] +To reproduce the problem, we need to do 4KiB write randomly spread in a +large btree. In our 2GiB RAM machine: + +1) Create 4 subvolumes. +2) Run fio on each subvolume: + + [global] + direct=0 + rw=randwrite + ioengine=libaio + bs=4k + iodepth=16 + numjobs=1 + group_reporting + size=128G + runtime=1800 + norandommap + time_based + randrepeat=0 + +3) Take snapshot on each subvolume and repeat fio on existing files. +4) Repeat step (3) until we get large btrees. + In our case, by observing btrfs_root_item->bytes_used, we have 2GiB of + metadata in each subvolume tree and 12GiB of metadata in extent tree. +5) Stop all fio, take snapshot again, and wait until all delayed work is + completed. +6) Start all fio. Few seconds later we hit OOM when the flusher starts + to work. + +It can be reproduced even when using nocow write. + +Signed-off-by: Ethan Lien +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3162,6 +3162,9 @@ out: + /* once for the tree */ + btrfs_put_ordered_extent(ordered_extent); + ++ /* Try to release some metadata so we don't get an OOM but don't wait */ ++ btrfs_btree_balance_dirty_nodelay(fs_info); ++ + return ret; + } + diff --git a/queue-4.14/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch b/queue-4.14/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch new file mode 100644 index 00000000000..8adaa389288 --- /dev/null +++ b/queue-4.14/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Omar Sandoval +Date: Fri, 11 May 2018 13:13:31 -0700 +Subject: Btrfs: don't BUG_ON() in btrfs_truncate_inode_items() + +From: Omar Sandoval + +[ Upstream commit 0552210997badb6a60740a26ff9d976a416510f0 ] + +btrfs_free_extent() can fail because of ENOMEM. There's no reason to +panic here, we can just abort the transaction. + +Fixes: f4b9aa8d3b87 ("btrfs_truncate") +Reviewed-by: Nikolay Borisov +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4740,7 +4740,10 @@ delete: + extent_num_bytes, 0, + btrfs_header_owner(leaf), + ino, extent_offset); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + if (btrfs_should_throttle_delayed_refs(trans, fs_info)) + btrfs_async_run_delayed_refs(fs_info, + trans->delayed_ref_updates * 2, diff --git a/queue-4.14/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch b/queue-4.14/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch new file mode 100644 index 00000000000..a6dd66e1e86 --- /dev/null +++ b/queue-4.14/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Omar Sandoval +Date: Fri, 11 May 2018 13:13:35 -0700 +Subject: Btrfs: don't return ino to ino cache if inode item removal fails + +From: Omar Sandoval + +[ Upstream commit c08db7d8d295a4f3a10faaca376de011afff7950 ] + +In btrfs_evict_inode(), if btrfs_truncate_inode_items() fails, the inode +item will still be in the tree but we still return the ino to the ino +cache. That will blow up later when someone tries to allocate that ino, +so don't return it to the cache. + +Fixes: 581bb050941b ("Btrfs: Cache free inode numbers in memory") +Reviewed-by: Josef Bacik +Signed-off-by: Omar Sandoval +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5499,13 +5499,18 @@ void btrfs_evict_inode(struct inode *ino + trans->block_rsv = rsv; + + ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0); +- if (ret != -ENOSPC && ret != -EAGAIN) ++ if (ret) { ++ trans->block_rsv = &fs_info->trans_block_rsv; ++ btrfs_end_transaction(trans); ++ btrfs_btree_balance_dirty(fs_info); ++ if (ret != -ENOSPC && ret != -EAGAIN) { ++ btrfs_orphan_del(NULL, BTRFS_I(inode)); ++ btrfs_free_block_rsv(fs_info, rsv); ++ goto no_delete; ++ } ++ } else { + break; +- +- trans->block_rsv = &fs_info->trans_block_rsv; +- btrfs_end_transaction(trans); +- trans = NULL; +- btrfs_btree_balance_dirty(fs_info); ++ } + } + + btrfs_free_block_rsv(fs_info, rsv); +@@ -5514,12 +5519,8 @@ void btrfs_evict_inode(struct inode *ino + * Errors here aren't a big deal, it just means we leave orphan items + * in the tree. They will be cleaned up on the next mount. + */ +- if (ret == 0) { +- trans->block_rsv = root->orphan_block_rsv; +- btrfs_orphan_del(trans, BTRFS_I(inode)); +- } else { +- btrfs_orphan_del(NULL, BTRFS_I(inode)); +- } ++ trans->block_rsv = root->orphan_block_rsv; ++ btrfs_orphan_del(trans, BTRFS_I(inode)); + + trans->block_rsv = &fs_info->trans_block_rsv; + if (!(root == fs_info->tree_root || diff --git a/queue-4.14/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch b/queue-4.14/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch new file mode 100644 index 00000000000..fc00ad44909 --- /dev/null +++ b/queue-4.14/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch @@ -0,0 +1,110 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Qu Wenruo +Date: Mon, 14 May 2018 09:38:13 +0800 +Subject: btrfs: qgroup: Finish rescan when hit the last leaf of extent tree + +From: Qu Wenruo + +[ Upstream commit ff3d27a048d926b3920ccdb75d98788c567cae0d ] + +Under the following case, qgroup rescan can double account cowed tree +blocks: + +In this case, extent tree only has one tree block. + +- +| transid=5 last committed=4 +| btrfs_qgroup_rescan_worker() +| |- btrfs_start_transaction() +| | transid = 5 +| |- qgroup_rescan_leaf() +| |- btrfs_search_slot_for_read() on extent tree +| Get the only extent tree block from commit root (transid = 4). +| Scan it, set qgroup_rescan_progress to the last +| EXTENT/META_ITEM + 1 +| now qgroup_rescan_progress = A + 1. +| +| fs tree get CoWed, new tree block is at A + 16K +| transid 5 get committed +- +| transid=6 last committed=5 +| btrfs_qgroup_rescan_worker() +| btrfs_qgroup_rescan_worker() +| |- btrfs_start_transaction() +| | transid = 5 +| |- qgroup_rescan_leaf() +| |- btrfs_search_slot_for_read() on extent tree +| Get the only extent tree block from commit root (transid = 5). +| scan it using qgroup_rescan_progress (A + 1). +| found new tree block beyong A, and it's fs tree block, +| account it to increase qgroup numbers. +- + +In above case, tree block A, and tree block A + 16K get accounted twice, +while qgroup rescan should stop when it already reach the last leaf, +other than continue using its qgroup_rescan_progress. + +Such case could happen by just looping btrfs/017 and with some +possibility it can hit such double qgroup accounting problem. + +Fix it by checking the path to determine if we should finish qgroup +rescan, other than relying on next loop to exit. + +Reported-by: Nikolay Borisov +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/qgroup.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2500,6 +2500,21 @@ out: + } + + /* ++ * Check if the leaf is the last leaf. Which means all node pointers ++ * are at their last position. ++ */ ++static bool is_last_leaf(struct btrfs_path *path) ++{ ++ int i; ++ ++ for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) { ++ if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1) ++ return false; ++ } ++ return true; ++} ++ ++/* + * returns < 0 on error, 0 when more leafs are to be scanned. + * returns 1 when done. + */ +@@ -2512,6 +2527,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info + struct ulist *roots = NULL; + struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem); + u64 num_bytes; ++ bool done; + int slot; + int ret; + +@@ -2540,6 +2556,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info + mutex_unlock(&fs_info->qgroup_rescan_lock); + return ret; + } ++ done = is_last_leaf(path); + + btrfs_item_key_to_cpu(path->nodes[0], &found, + btrfs_header_nritems(path->nodes[0]) - 1); +@@ -2586,6 +2603,8 @@ out: + } + btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem); + ++ if (done && !ret) ++ ret = 1; + return ret; + } + diff --git a/queue-4.14/ceph-fix-alignment-of-rasize.patch b/queue-4.14/ceph-fix-alignment-of-rasize.patch new file mode 100644 index 00000000000..52b2ec9ebe8 --- /dev/null +++ b/queue-4.14/ceph-fix-alignment-of-rasize.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chengguang Xu +Date: Wed, 30 May 2018 10:13:11 +0800 +Subject: ceph: fix alignment of rasize + +From: Chengguang Xu + +[ Upstream commit c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7 ] + +On currently logic: +when I specify rasize=0~1 then it will be 4096. +when I specify rasize=2~4097 then it will be 8192. + +Make it the same as rsize & wsize. + +Signed-off-by: Chengguang Xu +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -254,7 +254,7 @@ static int parse_fsopt_token(char *c, vo + case Opt_rasize: + if (intval < 0) + return -EINVAL; +- fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE); ++ fsopt->rasize = ALIGN(intval, PAGE_SIZE); + break; + case Opt_caps_wanted_delay_min: + if (intval < 1) diff --git a/queue-4.14/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch b/queue-4.14/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch new file mode 100644 index 00000000000..604e66c8653 --- /dev/null +++ b/queue-4.14/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Tudor-Dan Ambarus +Date: Tue, 3 Apr 2018 09:39:00 +0300 +Subject: crypto: authenc - don't leak pointers to authenc keys + +From: Tudor-Dan Ambarus + +[ Upstream commit ad2fdcdf75d169e7a5aec6c7cb421c0bec8ec711 ] + +In crypto_authenc_setkey we save pointers to the authenc keys in +a local variable of type struct crypto_authenc_keys and we don't +zeroize it after use. Fix this and don't leak pointers to the +authenc keys. + +Signed-off-by: Tudor Ambarus +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/authenc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -108,6 +108,7 @@ static int crypto_authenc_setkey(struct + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: diff --git a/queue-4.14/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch b/queue-4.14/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch new file mode 100644 index 00000000000..7a2923d5f1a --- /dev/null +++ b/queue-4.14/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Tudor-Dan Ambarus +Date: Tue, 3 Apr 2018 09:39:01 +0300 +Subject: crypto: authencesn - don't leak pointers to authenc keys + +From: Tudor-Dan Ambarus + +[ Upstream commit 31545df391d58a3bb60e29b1192644a6f2b5a8dd ] + +In crypto_authenc_esn_setkey we save pointers to the authenc keys +in a local variable of type struct crypto_authenc_keys and we don't +zeroize it after use. Fix this and don't leak pointers to the +authenc keys. + +Signed-off-by: Tudor Ambarus +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/authencesn.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/crypto/authencesn.c ++++ b/crypto/authencesn.c +@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(str + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: diff --git a/queue-4.14/delayacct-use-raw_spinlocks.patch b/queue-4.14/delayacct-use-raw_spinlocks.patch new file mode 100644 index 00000000000..c9351f02c51 --- /dev/null +++ b/queue-4.14/delayacct-use-raw_spinlocks.patch @@ -0,0 +1,101 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sebastian Andrzej Siewior +Date: Mon, 23 Apr 2018 18:10:23 +0200 +Subject: delayacct: Use raw_spinlocks + +From: Sebastian Andrzej Siewior + +[ Upstream commit 02acc80d19edb0d5684c997b2004ad19f9f5236e ] + +try_to_wake_up() might invoke delayacct_blkio_end() while holding the +pi_lock (which is a raw_spinlock_t). delayacct_blkio_end() acquires +task_delay_info.lock which is a spinlock_t. This causes a might sleep splat +on -RT where non raw spinlocks are converted to 'sleeping' spinlocks. + +task_delay_info.lock is only held for a short amount of time so it's not a +problem latency wise to make convert it to a raw spinlock. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Cc: Balbir Singh +Link: https://lkml.kernel.org/r/20180423161024.6710-1-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/delayacct.h | 2 +- + kernel/delayacct.c | 17 +++++++++-------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/include/linux/delayacct.h ++++ b/include/linux/delayacct.h +@@ -29,7 +29,7 @@ + + #ifdef CONFIG_TASK_DELAY_ACCT + struct task_delay_info { +- spinlock_t lock; ++ raw_spinlock_t lock; + unsigned int flags; /* Private per-task flags */ + + /* For each stat XXX, add following, aligned appropriately +--- a/kernel/delayacct.c ++++ b/kernel/delayacct.c +@@ -44,23 +44,24 @@ void __delayacct_tsk_init(struct task_st + { + tsk->delays = kmem_cache_zalloc(delayacct_cache, GFP_KERNEL); + if (tsk->delays) +- spin_lock_init(&tsk->delays->lock); ++ raw_spin_lock_init(&tsk->delays->lock); + } + + /* + * Finish delay accounting for a statistic using its timestamps (@start), + * accumalator (@total) and @count + */ +-static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count) ++static void delayacct_end(raw_spinlock_t *lock, u64 *start, u64 *total, ++ u32 *count) + { + s64 ns = ktime_get_ns() - *start; + unsigned long flags; + + if (ns > 0) { +- spin_lock_irqsave(lock, flags); ++ raw_spin_lock_irqsave(lock, flags); + *total += ns; + (*count)++; +- spin_unlock_irqrestore(lock, flags); ++ raw_spin_unlock_irqrestore(lock, flags); + } + } + +@@ -127,7 +128,7 @@ int __delayacct_add_tsk(struct taskstats + + /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */ + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + tmp = d->blkio_delay_total + tsk->delays->blkio_delay; + d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp; + tmp = d->swapin_delay_total + tsk->delays->swapin_delay; +@@ -137,7 +138,7 @@ int __delayacct_add_tsk(struct taskstats + d->blkio_count += tsk->delays->blkio_count; + d->swapin_count += tsk->delays->swapin_count; + d->freepages_count += tsk->delays->freepages_count; +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + + return 0; + } +@@ -147,10 +148,10 @@ __u64 __delayacct_blkio_ticks(struct tas + __u64 ret; + unsigned long flags; + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + ret = nsec_to_clock_t(tsk->delays->blkio_delay + + tsk->delays->swapin_delay); +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + return ret; + } + diff --git a/queue-4.14/disable-loading-f2fs-module-on-page_size-4kb.patch b/queue-4.14/disable-loading-f2fs-module-on-page_size-4kb.patch new file mode 100644 index 00000000000..54649e0e35b --- /dev/null +++ b/queue-4.14/disable-loading-f2fs-module-on-page_size-4kb.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Anatoly Pugachev +Date: Mon, 28 May 2018 02:06:37 +0300 +Subject: disable loading f2fs module on PAGE_SIZE > 4KB + +From: Anatoly Pugachev + +[ Upstream commit 4071e67cffcc5c2a007116a02437471351f550eb ] + +The following patch disables loading of f2fs module on architectures +which have PAGE_SIZE > 4096 , since it is impossible to mount f2fs on +such architectures , log messages are: + +mount: /mnt: wrong fs type, bad option, bad superblock on +/dev/vdiskb1, missing codepage or helper program, or other error. +/dev/vdiskb1: F2FS filesystem, +UUID=1d8b9ca4-2389-4910-af3b-10998969f09c, volume name "" + +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS +filesystem in 1th superblock +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS +filesystem in 2th superblock +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB + +which was introduced by git commit 5c9b469295fb6b10d98923eab5e79c4edb80ed20 + +tested on git kernel 4.17.0-rc6-00309-gec30dcf7f425 + +with patch applied: + +modprobe: ERROR: could not insert 'f2fs': Invalid argument +May 28 01:40:28 v215 kernel: F2FS not supported on PAGE_SIZE(8192) != 4096 + +Signed-off-by: Anatoly Pugachev +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2663,6 +2663,12 @@ static int __init init_f2fs_fs(void) + { + int err; + ++ if (PAGE_SIZE != F2FS_BLKSIZE) { ++ printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n", ++ PAGE_SIZE, F2FS_BLKSIZE); ++ return -EINVAL; ++ } ++ + f2fs_build_trace_ios(); + + err = init_inodecache(); diff --git a/queue-4.14/dma-iommu-fix-compilation-when-config_iommu_dma.patch b/queue-4.14/dma-iommu-fix-compilation-when-config_iommu_dma.patch new file mode 100644 index 00000000000..6fa726f8543 --- /dev/null +++ b/queue-4.14/dma-iommu-fix-compilation-when-config_iommu_dma.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Marc Zyngier +Date: Tue, 8 May 2018 13:14:33 +0100 +Subject: dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA + +From: Marc Zyngier + +[ Upstream commit 8a22a3e1e768c309b718f99bd86f9f25a453e0dc ] + +Inclusion of include/dma-iommu.h when CONFIG_IOMMU_DMA is not selected +results in the following splat: + +In file included from drivers/irqchip/irq-gic-v3-mbi.c:20:0: +./include/linux/dma-iommu.h:95:69: error: unknown type name ‘dma_addr_t’ + static inline int iommu_get_msi_cookie(struct iommu_domain *domain, dma_addr_t base) + ^~~~~~~~~~ +./include/linux/dma-iommu.h:108:74: warning: ‘struct list_head’ declared inside parameter list will not be visible outside of this definition or declaration + static inline void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list) + ^~~~~~~~~ +scripts/Makefile.build:312: recipe for target 'drivers/irqchip/irq-gic-v3-mbi.o' failed + +Fix it by including linux/types.h. + +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Cc: Rob Herring +Cc: Jason Cooper +Cc: Ard Biesheuvel +Cc: Srinivas Kandagatla +Cc: Thomas Petazzoni +Cc: Miquel Raynal +Link: https://lkml.kernel.org/r/20180508121438.11301-5-marc.zyngier@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/dma-iommu.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/dma-iommu.h ++++ b/include/linux/dma-iommu.h +@@ -17,6 +17,7 @@ + #define __DMA_IOMMU_H + + #ifdef __KERNEL__ ++#include + #include + + #ifdef CONFIG_IOMMU_DMA diff --git a/queue-4.14/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch b/queue-4.14/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch new file mode 100644 index 00000000000..cd8bc111009 --- /dev/null +++ b/queue-4.14/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch @@ -0,0 +1,114 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mark Rutland +Date: Mon, 21 May 2018 18:19:49 +0100 +Subject: drivers/perf: arm-ccn: don't log to dmesg in event_init + +From: Mark Rutland + +[ Upstream commit 1898eb61fbc9703efee886d3abec27a388cf28c3 ] + +The ARM CCN PMU driver uses dev_warn() to complain about parameters in +the user-provided perf_event_attr. This means that under normal +operation (e.g. a single invocation of the perf tool), a number of +messages warnings may be logged to dmesg. + +Tools may issue multiple syscalls to probe for feature support, and +multiple applications (from multiple users) can attempt to open events +simultaneously, so this is not very helpful, even if a user happens to +have access to dmesg. Worse, this can push important information out of +the dmesg ring buffer, and can significantly slow down syscall fuzzers, +vastly increasing the time it takes to find critical bugs. + +Demote the dev_warn() instances to dev_dbg(), as is the case for all +other PMU drivers under drivers/perf/. Users who wish to debug PMU event +initialisation can enable dynamic debug to receive these messages. + +Signed-off-by: Mark Rutland +Cc: Pawel Moll +Cc: Will Deacon +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bus/arm-ccn.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct + ccn = pmu_to_arm_ccn(event->pmu); + + if (hw->sample_period) { +- dev_warn(ccn->dev, "Sampling not supported!\n"); ++ dev_dbg(ccn->dev, "Sampling not supported!\n"); + return -EOPNOTSUPP; + } + +@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct + event->attr.exclude_kernel || event->attr.exclude_hv || + event->attr.exclude_idle || event->attr.exclude_host || + event->attr.exclude_guest) { +- dev_warn(ccn->dev, "Can't exclude execution levels!\n"); ++ dev_dbg(ccn->dev, "Can't exclude execution levels!\n"); + return -EINVAL; + } + + if (event->cpu < 0) { +- dev_warn(ccn->dev, "Can't provide per-task data!\n"); ++ dev_dbg(ccn->dev, "Can't provide per-task data!\n"); + return -EOPNOTSUPP; + } + /* +@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct + switch (type) { + case CCN_TYPE_MN: + if (node_xp != ccn->mn_id) { +- dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp); + return -EINVAL; + } + break; + case CCN_TYPE_XP: + if (node_xp >= ccn->num_xps) { +- dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp); + return -EINVAL; + } + break; +@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct + break; + default: + if (node_xp >= ccn->num_nodes) { +- dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp); + return -EINVAL; + } + if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) { +- dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n", ++ dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n", + type, node_xp); + return -EINVAL; + } +@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct + if (event_id != e->event) + continue; + if (e->num_ports && port >= e->num_ports) { +- dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n", + port, node_xp); + return -EINVAL; + } + if (e->num_vcs && vc >= e->num_vcs) { +- dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n", + vc, node_xp); + return -EINVAL; + } + valid = 1; + } + if (!valid) { +- dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", + event_id, node_xp); + return -EINVAL; + } diff --git a/queue-4.14/drm-add-dp-psr2-sink-enable-bit.patch b/queue-4.14/drm-add-dp-psr2-sink-enable-bit.patch new file mode 100644 index 00000000000..1f4a202970c --- /dev/null +++ b/queue-4.14/drm-add-dp-psr2-sink-enable-bit.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "José Roberto de Souza" +Date: Wed, 28 Mar 2018 15:30:37 -0700 +Subject: drm: Add DP PSR2 sink enable bit + +From: "José Roberto de Souza" + +[ Upstream commit 4f212e40468650e220c1770876c7f25b8e0c1ff5 ] + +To comply with eDP1.4a this bit should be set when enabling PSR2. + +Signed-off-by: José Roberto de Souza +Reviewed-by: Rodrigo Vivi +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20180328223046.16125-1-jose.souza@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/drm/drm_dp_helper.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/drm_dp_helper.h ++++ b/include/drm/drm_dp_helper.h +@@ -453,6 +453,7 @@ + # define DP_PSR_FRAME_CAPTURE (1 << 3) + # define DP_PSR_SELECTIVE_UPDATE (1 << 4) + # define DP_PSR_IRQ_HPD_WITH_CRC_ERRORS (1 << 5) ++# define DP_PSR_ENABLE_PSR2 (1 << 6) /* eDP 1.4a */ + + #define DP_ADAPTER_CTRL 0x1a0 + # define DP_ADAPTER_CTRL_FORCE_LOAD_SENSE (1 << 0) diff --git a/queue-4.14/drm-amdgpu-remove-vram-from-shared-bo-domains.patch b/queue-4.14/drm-amdgpu-remove-vram-from-shared-bo-domains.patch new file mode 100644 index 00000000000..c7174127026 --- /dev/null +++ b/queue-4.14/drm-amdgpu-remove-vram-from-shared-bo-domains.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Samuel Li +Date: Wed, 18 Apr 2018 16:26:18 -0400 +Subject: drm/amdgpu: Remove VRAM from shared bo domains. + +From: Samuel Li + +[ Upstream commit 9b3f217faf48603c91d4ca44a18e6ff74c3c1c0c ] + +This fixes an issue introduced by change "allow framebuffer in GART +memory as well" which could lead to a shared buffer ending up +pinned in vram. Use GTT if it is included in the domain, otherwise +return an error. + +Signed-off-by: Samuel Li +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -683,8 +683,12 @@ int amdgpu_bo_pin_restricted(struct amdg + return -EINVAL; + + /* A shared bo cannot be migrated to VRAM */ +- if (bo->prime_shared_count && (domain == AMDGPU_GEM_DOMAIN_VRAM)) +- return -EINVAL; ++ if (bo->prime_shared_count) { ++ if (domain & AMDGPU_GEM_DOMAIN_GTT) ++ domain = AMDGPU_GEM_DOMAIN_GTT; ++ else ++ return -EINVAL; ++ } + + if (bo->pin_count) { + uint32_t mem_type = bo->tbo.mem.mem_type; diff --git a/queue-4.14/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch b/queue-4.14/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch new file mode 100644 index 00000000000..42189875487 --- /dev/null +++ b/queue-4.14/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Satendra Singh Thakur +Date: Thu, 3 May 2018 11:19:32 +0530 +Subject: drm/atomic: Handling the case when setting old crtc for plane + +From: Satendra Singh Thakur + +[ Upstream commit fc2a69f3903dfd97cd47f593e642b47918c949df ] + +In the func drm_atomic_set_crtc_for_plane, with the current code, +if crtc of the plane_state and crtc passed as argument to the func +are same, entire func will executed in vein. +It will get state of crtc and clear and set the bits in plane_mask. +All these steps are not required for same old crtc. +Ideally, we should do nothing in this case, this patch handles the same, +and causes the program to return without doing anything in such scenario. + +Signed-off-by: Satendra Singh Thakur +Cc: Madhur Verma +Cc: Hemanshu Srivastava +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/1525326572-25854-1-git-send-email-satendra.t@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1355,7 +1355,9 @@ drm_atomic_set_crtc_for_plane(struct drm + { + struct drm_plane *plane = plane_state->plane; + struct drm_crtc_state *crtc_state; +- ++ /* Nothing to do for same crtc*/ ++ if (plane_state->crtc == crtc) ++ return 0; + if (plane_state->crtc) { + crtc_state = drm_atomic_get_crtc_state(plane_state->state, + plane_state->crtc); diff --git a/queue-4.14/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch b/queue-4.14/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch new file mode 100644 index 00000000000..496394fe168 --- /dev/null +++ b/queue-4.14/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch @@ -0,0 +1,174 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Ville Syrjälä" +Date: Thu, 22 Mar 2018 17:22:51 +0200 +Subject: drm/atomic-helper: Drop plane->fb references only for drm_atomic_helper_shutdown() + +From: "Ville Syrjälä" + +[ Upstream commit 5e9cfeba6abb7e1a3f240bd24eb29178f0b83716 ] + +drm_atomic_helper_shutdown() needs to release the reference held by +plane->fb. Since commit 49d70aeaeca8 ("drm/atomic-helper: Fix leak in +disable_all") we're doing that by calling drm_atomic_clean_old_fb() in +drm_atomic_helper_disable_all(). This also leaves plane->fb == NULL +afterwards. However, since drm_atomic_helper_disable_all() is also +used by the i915 gpu reset code +drm_atomic_helper_commit_duplicated_state() then has to undo the +damage and put the correct plane->fb pointers back in (and also +adjust the ref counts to match again as well). + +That approach doesn't work so well for load detection as nothing +sets up the plane->old_fb pointers for us. This causes us to +leak an extra reference for each plane->fb when +drm_atomic_helper_commit_duplicated_state() calls +drm_atomic_clean_old_fb() after load detection. + +To fix this let's call drm_atomic_clean_old_fb() only for +drm_atomic_helper_shutdown() as that's the only time we need to +actually drop the plane->fb references. In all the other cases +(load detection, gpu reset) we want to leave plane->fb alone. + +v2: Don't inflict the clean_old_fbs bool to drivers (Daniel) +v3: Squash in the revert and rewrite the commit msg (Daniel) + +Cc: martin.peres@free.fr +Cc: chris@chris-wilson.co.uk +Cc: Dave Airlie +Cc: Maarten Lankhorst +Cc: Daniel Vetter +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20180322152313.6561-3-ville.syrjala@linux.intel.com +Reviewed-by: Maarten Lankhorst #pre-squash +Reviewed-by: Daniel Vetter +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic_helper.c | 78 ++++++++++++++++++------------------ + 1 file changed, 39 insertions(+), 39 deletions(-) + +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -2683,31 +2683,9 @@ commit: + return 0; + } + +-/** +- * drm_atomic_helper_disable_all - disable all currently active outputs +- * @dev: DRM device +- * @ctx: lock acquisition context +- * +- * Loops through all connectors, finding those that aren't turned off and then +- * turns them off by setting their DPMS mode to OFF and deactivating the CRTC +- * that they are connected to. +- * +- * This is used for example in suspend/resume to disable all currently active +- * functions when suspending. If you just want to shut down everything at e.g. +- * driver unload, look at drm_atomic_helper_shutdown(). +- * +- * Note that if callers haven't already acquired all modeset locks this might +- * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). +- * +- * Returns: +- * 0 on success or a negative error code on failure. +- * +- * See also: +- * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and +- * drm_atomic_helper_shutdown(). +- */ +-int drm_atomic_helper_disable_all(struct drm_device *dev, +- struct drm_modeset_acquire_ctx *ctx) ++static int __drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx, ++ bool clean_old_fbs) + { + struct drm_atomic_state *state; + struct drm_connector_state *conn_state; +@@ -2759,8 +2737,11 @@ int drm_atomic_helper_disable_all(struct + goto free; + + drm_atomic_set_fb_for_plane(plane_state, NULL); +- plane_mask |= BIT(drm_plane_index(plane)); +- plane->old_fb = plane->fb; ++ ++ if (clean_old_fbs) { ++ plane->old_fb = plane->fb; ++ plane_mask |= BIT(drm_plane_index(plane)); ++ } + } + + ret = drm_atomic_commit(state); +@@ -2771,6 +2752,34 @@ free: + return ret; + } + ++/** ++ * drm_atomic_helper_disable_all - disable all currently active outputs ++ * @dev: DRM device ++ * @ctx: lock acquisition context ++ * ++ * Loops through all connectors, finding those that aren't turned off and then ++ * turns them off by setting their DPMS mode to OFF and deactivating the CRTC ++ * that they are connected to. ++ * ++ * This is used for example in suspend/resume to disable all currently active ++ * functions when suspending. If you just want to shut down everything at e.g. ++ * driver unload, look at drm_atomic_helper_shutdown(). ++ * ++ * Note that if callers haven't already acquired all modeset locks this might ++ * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). ++ * ++ * Returns: ++ * 0 on success or a negative error code on failure. ++ * ++ * See also: ++ * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and ++ * drm_atomic_helper_shutdown(). ++ */ ++int drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx) ++{ ++ return __drm_atomic_helper_disable_all(dev, ctx, false); ++} + EXPORT_SYMBOL(drm_atomic_helper_disable_all); + + /** +@@ -2793,7 +2802,7 @@ void drm_atomic_helper_shutdown(struct d + while (1) { + ret = drm_modeset_lock_all_ctx(dev, &ctx); + if (!ret) +- ret = drm_atomic_helper_disable_all(dev, &ctx); ++ ret = __drm_atomic_helper_disable_all(dev, &ctx, true); + + if (ret != -EDEADLK) + break; +@@ -2897,16 +2906,11 @@ int drm_atomic_helper_commit_duplicated_ + struct drm_connector_state *new_conn_state; + struct drm_crtc *crtc; + struct drm_crtc_state *new_crtc_state; +- unsigned plane_mask = 0; +- struct drm_device *dev = state->dev; +- int ret; + + state->acquire_ctx = ctx; + +- for_each_new_plane_in_state(state, plane, new_plane_state, i) { +- plane_mask |= BIT(drm_plane_index(plane)); ++ for_each_new_plane_in_state(state, plane, new_plane_state, i) + state->planes[i].old_state = plane->state; +- } + + for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) + state->crtcs[i].old_state = crtc->state; +@@ -2914,11 +2918,7 @@ int drm_atomic_helper_commit_duplicated_ + for_each_new_connector_in_state(state, connector, new_conn_state, i) + state->connectors[i].old_state = connector->state; + +- ret = drm_atomic_commit(state); +- if (plane_mask) +- drm_atomic_clean_old_fb(dev, plane_mask, ret); +- +- return ret; ++ return drm_atomic_commit(state); + } + EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state); + diff --git a/queue-4.14/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch b/queue-4.14/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch new file mode 100644 index 00000000000..3caec6e4318 --- /dev/null +++ b/queue-4.14/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Andy Shevchenko +Date: Mon, 19 Mar 2018 16:19:32 +0200 +Subject: drm/dp/mst: Fix off-by-one typo when dump payload table + +From: Andy Shevchenko + +[ Upstream commit 7056a2bccc3b5afc51f9b35b30a46f0d9219968d ] + +It seems there is a classical off-by-one typo from the beginning +when commit + + ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") + +introduced a new helper. + +Fix a typo by introducing a macro constant. + +Cc: Dave Airlie +Signed-off-by: Andy Shevchenko +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180319141932.37290-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2862,12 +2862,14 @@ static void drm_dp_mst_dump_mstb(struct + } + } + ++#define DP_PAYLOAD_TABLE_SIZE 64 ++ + static bool dump_dp_payload_table(struct drm_dp_mst_topology_mgr *mgr, + char *buf) + { + int i; + +- for (i = 0; i < 64; i += 16) { ++ for (i = 0; i < DP_PAYLOAD_TABLE_SIZE; i += 16) { + if (drm_dp_dpcd_read(mgr->aux, + DP_PAYLOAD_TABLE_UPDATE_STATUS + i, + &buf[i], 16) != 16) +@@ -2936,7 +2938,7 @@ void drm_dp_mst_dump_topology(struct seq + + mutex_lock(&mgr->lock); + if (mgr->mst_primary) { +- u8 buf[64]; ++ u8 buf[DP_PAYLOAD_TABLE_SIZE]; + int ret; + + ret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, buf, DP_RECEIVER_CAP_SIZE); +@@ -2954,8 +2956,7 @@ void drm_dp_mst_dump_topology(struct seq + seq_printf(m, " revision: hw: %x.%x sw: %x.%x\n", + buf[0x9] >> 4, buf[0x9] & 0xf, buf[0xa], buf[0xb]); + if (dump_dp_payload_table(mgr, buf)) +- seq_printf(m, "payload table: %*ph\n", 63, buf); +- ++ seq_printf(m, "payload table: %*ph\n", DP_PAYLOAD_TABLE_SIZE, buf); + } + + mutex_unlock(&mgr->lock); diff --git a/queue-4.14/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch b/queue-4.14/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch new file mode 100644 index 00000000000..f4811fdfe48 --- /dev/null +++ b/queue-4.14/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Luc Van Oostenryck +Date: Tue, 24 Apr 2018 15:14:57 +0200 +Subject: drm/gma500: fix psb_intel_lvds_mode_valid()'s return type + +From: Luc Van Oostenryck + +[ Upstream commit 2ea009095c6e7396915a1d0dd480c41f02985f79 ] + +The method struct drm_connector_helper_funcs::mode_valid is defined +as returning an 'enum drm_mode_status' but the driver implementation +for this method, psb_intel_lvds_mode_valid(), uses an 'int' for it. + +Fix this by using 'enum drm_mode_status' for psb_intel_lvds_mode_valid(). + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20180424131458.2060-1-luc.vanoostenryck@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/psb_intel_drv.h | 2 +- + drivers/gpu/drm/gma500/psb_intel_lvds.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/psb_intel_drv.h ++++ b/drivers/gpu/drm/gma500/psb_intel_drv.h +@@ -255,7 +255,7 @@ extern int intelfb_remove(struct drm_dev + extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder, + const struct drm_display_mode *mode, + struct drm_display_mode *adjusted_mode); +-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode); + extern int psb_intel_lvds_set_property(struct drm_connector *connector, + struct drm_property *property, +--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c ++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c +@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struc + } + } + +-int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_psb_private *dev_priv = connector->dev->dev_private; diff --git a/queue-4.14/drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch b/queue-4.14/drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch deleted file mode 100644 index b7a3f0c5626..00000000000 --- a/queue-4.14/drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 0ca9488193e61ec5f31a631d8147f74525629e8a Mon Sep 17 00:00:00 2001 -From: Clint Taylor -Date: Tue, 10 Jul 2018 13:02:05 -0700 -Subject: drm/i915/glk: Add Quirk for GLK NUC HDMI port issues. - -From: Clint Taylor - -commit 0ca9488193e61ec5f31a631d8147f74525629e8a upstream. - -On GLK NUC platforms the HDMI retiming buffer needs additional disabled -time to correctly sync to a faster incoming signal. - -When measured on a scope the highspeed lines of the HDMI clock turn off - for ~400uS during a normal resolution change. The HDMI retimer on the - GLK NUC appears to require at least a full frame of quiet time before a -new faster clock can be correctly sync'd. Wait 100ms due to msleep -inaccuracies while waiting for a completed frame. Add a quirk to the -driver for GLK boards that use ITE66317 HDMI retimers. - -V2: Add more devices to the quirk list -V3: Delay increased to 100ms, check to confirm crtc type is HDMI. -V4: crtc type check extended to include _DDI and whitespace fixes -v5: Fix white spaces, remove the macro for delay. Revert the crtc type - check introduced in v4. - -Cc: Imre Deak -Cc: # v4.14+ -Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105887 -Signed-off-by: Clint Taylor -Tested-by: Daniel Scheller -Signed-off-by: Radhakrishna Sripada -Signed-off-by: Imre Deak -Reviewed-by: Imre Deak -Link: https://patchwork.freedesktop.org/patch/msgid/20180710200205.1478-1-radhakrishna.sripada@intel.com -(cherry picked from commit 90c3e2198777aaa355b6994a31a79c636c8d4306) -Signed-off-by: Rodrigo Vivi -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/gpu/drm/i915/i915_drv.h | 1 + - drivers/gpu/drm/i915/intel_ddi.c | 13 +++++++++++-- - drivers/gpu/drm/i915/intel_display.c | 21 ++++++++++++++++++++- - drivers/gpu/drm/i915/intel_drv.h | 3 +-- - 4 files changed, 33 insertions(+), 5 deletions(-) - ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -1183,6 +1183,7 @@ enum intel_sbi_destination { - #define QUIRK_BACKLIGHT_PRESENT (1<<3) - #define QUIRK_PIN_SWIZZLED_PAGES (1<<5) - #define QUIRK_INCREASE_T12_DELAY (1<<6) -+#define QUIRK_INCREASE_DDI_DISABLED_TIME (1<<7) - - struct intel_fbdev; - struct intel_fbc_work; ---- a/drivers/gpu/drm/i915/intel_ddi.c -+++ b/drivers/gpu/drm/i915/intel_ddi.c -@@ -1522,15 +1522,24 @@ void intel_ddi_enable_transcoder_func(co - I915_WRITE(TRANS_DDI_FUNC_CTL(cpu_transcoder), temp); - } - --void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv, -- enum transcoder cpu_transcoder) -+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state) - { -+ struct intel_crtc *crtc = to_intel_crtc(crtc_state->base.crtc); -+ struct drm_i915_private *dev_priv = to_i915(crtc->base.dev); -+ enum transcoder cpu_transcoder = crtc_state->cpu_transcoder; - i915_reg_t reg = TRANS_DDI_FUNC_CTL(cpu_transcoder); - uint32_t val = I915_READ(reg); - - val &= ~(TRANS_DDI_FUNC_ENABLE | TRANS_DDI_PORT_MASK | TRANS_DDI_DP_VC_PAYLOAD_ALLOC); - val |= TRANS_DDI_PORT_NONE; - I915_WRITE(reg, val); -+ -+ if (dev_priv->quirks & QUIRK_INCREASE_DDI_DISABLED_TIME && -+ intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI)) { -+ DRM_DEBUG_KMS("Quirk Increase DDI disabled time\n"); -+ /* Quirk time at 100ms for reliable operation */ -+ msleep(100); -+ } - } - - bool intel_ddi_connector_get_hw_state(struct intel_connector *intel_connector) ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -5653,7 +5653,7 @@ static void haswell_crtc_disable(struct - intel_ddi_set_vc_payload_alloc(intel_crtc->config, false); - - if (!transcoder_is_dsi(cpu_transcoder)) -- intel_ddi_disable_transcoder_func(dev_priv, cpu_transcoder); -+ intel_ddi_disable_transcoder_func(old_crtc_state); - - if (INTEL_GEN(dev_priv) >= 9) - skylake_scaler_disable(intel_crtc); -@@ -14286,6 +14286,18 @@ static void quirk_increase_t12_delay(str - DRM_INFO("Applying T12 delay quirk\n"); - } - -+/* -+ * GeminiLake NUC HDMI outputs require additional off time -+ * this allows the onboard retimer to correctly sync to signal -+ */ -+static void quirk_increase_ddi_disabled_time(struct drm_device *dev) -+{ -+ struct drm_i915_private *dev_priv = to_i915(dev); -+ -+ dev_priv->quirks |= QUIRK_INCREASE_DDI_DISABLED_TIME; -+ DRM_INFO("Applying Increase DDI Disabled quirk\n"); -+} -+ - struct intel_quirk { - int device; - int subsystem_vendor; -@@ -14372,6 +14384,13 @@ static struct intel_quirk intel_quirks[] - - /* Toshiba Satellite P50-C-18C */ - { 0x191B, 0x1179, 0xF840, quirk_increase_t12_delay }, -+ -+ /* GeminiLake NUC */ -+ { 0x3185, 0x8086, 0x2072, quirk_increase_ddi_disabled_time }, -+ { 0x3184, 0x8086, 0x2072, quirk_increase_ddi_disabled_time }, -+ /* ASRock ITX*/ -+ { 0x3185, 0x1849, 0x2212, quirk_increase_ddi_disabled_time }, -+ { 0x3184, 0x1849, 0x2212, quirk_increase_ddi_disabled_time }, - }; - - static void intel_init_quirks(struct drm_device *dev) ---- a/drivers/gpu/drm/i915/intel_drv.h -+++ b/drivers/gpu/drm/i915/intel_drv.h -@@ -1254,8 +1254,7 @@ void intel_ddi_init(struct drm_i915_priv - enum port intel_ddi_get_encoder_port(struct intel_encoder *intel_encoder); - bool intel_ddi_get_hw_state(struct intel_encoder *encoder, enum pipe *pipe); - void intel_ddi_enable_transcoder_func(const struct intel_crtc_state *crtc_state); --void intel_ddi_disable_transcoder_func(struct drm_i915_private *dev_priv, -- enum transcoder cpu_transcoder); -+void intel_ddi_disable_transcoder_func(const struct intel_crtc_state *crtc_state); - void intel_ddi_enable_pipe_clock(const struct intel_crtc_state *crtc_state); - void intel_ddi_disable_pipe_clock(const struct intel_crtc_state *crtc_state); - struct intel_encoder * diff --git a/queue-4.14/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch b/queue-4.14/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch new file mode 100644 index 00000000000..b683f68f5d2 --- /dev/null +++ b/queue-4.14/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Ben Skeggs +Date: Tue, 8 May 2018 20:39:46 +1000 +Subject: drm/nouveau/fifo/gk104-: poll for runlist update completion + +From: Ben Skeggs + +[ Upstream commit 4f2fc25c0f8bcc8db1b8a7b21e88c3d7f35c5acb ] + +Newer HW doesn't appear to send this event, which will cause long delays +in runlist updates if they don't complete immediately. + +RM doesn't use these events anywhere, and an NVGPU commit message notes +that polling is the preferred method even on HW that supports the event. + +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c +@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_f + (target << 28)); + nvkm_wr32(device, 0x002274, (runl << 20) | nr); + +- if (wait_event_timeout(fifo->runlist[runl].wait, +- !(nvkm_rd32(device, 0x002284 + (runl * 0x08)) +- & 0x00100000), +- msecs_to_jiffies(2000)) == 0) ++ if (nvkm_msec(device, 2000, ++ if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000)) ++ break; ++ ) < 0) + nvkm_error(subdev, "runlist %d update timeout\n", runl); + unlock: + mutex_unlock(&subdev->mutex); diff --git a/queue-4.14/drm-radeon-fix-mode_valid-s-return-type.patch b/queue-4.14/drm-radeon-fix-mode_valid-s-return-type.patch new file mode 100644 index 00000000000..1b94982cef8 --- /dev/null +++ b/queue-4.14/drm-radeon-fix-mode_valid-s-return-type.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Luc Van Oostenryck +Date: Tue, 24 Apr 2018 15:15:13 +0200 +Subject: drm/radeon: fix mode_valid's return type + +From: Luc Van Oostenryck + +[ Upstream commit 7a47f20eb1fb8fa8d7a8fe3a4fd8c721f04c2174 ] + +The method struct drm_connector_helper_funcs::mode_valid is defined +as returning an 'enum drm_mode_status' but the driver implementation +for this method uses an 'int' for it. + +Fix this by using 'enum drm_mode_status' in the driver too. + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -853,7 +853,7 @@ static int radeon_lvds_get_modes(struct + return ret; + } + +-static int radeon_lvds_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_encoder *encoder = radeon_best_single_encoder(connector); +@@ -1013,7 +1013,7 @@ static int radeon_vga_get_modes(struct d + return ret; + } + +-static int radeon_vga_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1157,7 +1157,7 @@ static int radeon_tv_get_modes(struct dr + return 1; + } + +-static int radeon_tv_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + if ((mode->hdisplay > 1024) || (mode->vdisplay > 768)) +@@ -1499,7 +1499,7 @@ static void radeon_dvi_force(struct drm_ + radeon_connector->use_digital = true; + } + +-static int radeon_dvi_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1801,7 +1801,7 @@ out: + return ret; + } + +-static int radeon_dp_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; diff --git a/queue-4.14/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch b/queue-4.14/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch new file mode 100644 index 00000000000..cfdbbb9b56e --- /dev/null +++ b/queue-4.14/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: David Lechner +Date: Wed, 14 Mar 2018 17:58:45 -0500 +Subject: drm/tilcdc: Fix setting clock divider for omap-l138 + +From: David Lechner + +[ Upstream commit a88ad3ded15daa0389106779c60b8a5e76d4b20a ] + +This fixes setting the clock divider on the TI OMAP-L138 LCDK board. + +The clock drivers for OMAP-L138 are being covernted to the common clock +framework. When this happens, clk_set_rate() will no longer return an +error. However, on this SoC, the clock rate cannot actually be changed +because the clock has to maintain a fixed ratio to the ARM clock. So +after attempting to set the clock rate, we need to check to see if the +new rate is actually close enough. If not, then follow the previous +error path to adjust the divider in LCDC IP block to compensate for not +being able to change the parent clock rate. + +Tested working on a TI OMAP-L138 LCDK board. + +Signed-off-by: David Lechner +Signed-off-by: Jyri Sarha +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +@@ -246,7 +246,7 @@ static void tilcdc_crtc_set_clk(struct d + + ret = clk_set_rate(priv->clk, req_rate * clkdiv); + clk_rate = clk_get_rate(priv->clk); +- if (ret < 0) { ++ if (ret < 0 || tilcdc_pclk_diff(req_rate, clk_rate) > 5) { + /* + * If we fail to set the clock rate (some architectures don't + * use the common clock framework yet and may not implement diff --git a/queue-4.14/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch b/queue-4.14/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch new file mode 100644 index 00000000000..00c6d328e9b --- /dev/null +++ b/queue-4.14/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Yixun Lan +Date: Sat, 28 Apr 2018 10:21:10 +0000 +Subject: dt-bindings: net: meson-dwmac: new compatible name for AXG SoC + +From: Yixun Lan + +[ Upstream commit 7e5d05e18ba1ed491c6f836edee7f0b90f3167bc ] + +We need to introduce a new compatible name for the Meson-AXG SoC +in order to support the RMII 100M ethernet PHY, since the PRG_ETH0 +register of the dwmac glue layer is changed from previous old SoC. + +Signed-off-by: Yixun Lan +Reviewed-by: Rob Herring +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/net/meson-dwmac.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt ++++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt +@@ -10,6 +10,7 @@ Required properties on all platforms: + - "amlogic,meson6-dwmac" + - "amlogic,meson8b-dwmac" + - "amlogic,meson-gxbb-dwmac" ++ - "amlogic,meson-axg-dwmac" + Additionally "snps,dwmac" and any applicable more + detailed version number described in net/stmmac.txt + should be used. diff --git a/queue-4.14/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch b/queue-4.14/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch new file mode 100644 index 00000000000..e91e70a1361 --- /dev/null +++ b/queue-4.14/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Martin Blumenstingl +Date: Sun, 22 Apr 2018 12:53:28 +0200 +Subject: dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC + +From: Martin Blumenstingl + +[ Upstream commit 03d9fbc39730b3e6b2e7047dc85f0f70de8fb97d ] + +The Meson8m2 SoC is a variant of Meson8 with some updates from Meson8b +(such as the Gigabit capable DesignWare MAC). +It is mostly pin compatible with Meson8, only 10 (existing) CBUS pins +get an additional function (four of these are Ethernet RXD2, RXD3, TXD2 +and TXD3 which are required when the board uses an RGMII PHY). +The AOBUS pins seem to be identical on Meson8 and Meson8m2. + +Signed-off-by: Martin Blumenstingl +Reviewed-by: Rob Herring +Reviewed-by: Kevin Hilman +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt +@@ -3,8 +3,10 @@ + Required properties for the root node: + - compatible: one of "amlogic,meson8-cbus-pinctrl" + "amlogic,meson8b-cbus-pinctrl" ++ "amlogic,meson8m2-cbus-pinctrl" + "amlogic,meson8-aobus-pinctrl" + "amlogic,meson8b-aobus-pinctrl" ++ "amlogic,meson8m2-aobus-pinctrl" + "amlogic,meson-gxbb-periphs-pinctrl" + "amlogic,meson-gxbb-aobus-pinctrl" + "amlogic,meson-gxl-periphs-pinctrl" diff --git a/queue-4.14/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch b/queue-4.14/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch new file mode 100644 index 00000000000..a8bfc2e28fa --- /dev/null +++ b/queue-4.14/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Benjamin Poirier +Date: Thu, 10 May 2018 16:28:35 +0900 +Subject: e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes + +From: Benjamin Poirier + +[ Upstream commit fff200caf6f9179dd9a7fc67acd659e614c3f72f ] + +There have been multiple reports of crashes that look like +kernel: RIP: 0010:[] timecounter_read+0xf/0x50 +[...] +kernel: Call Trace: +kernel: [] e1000e_phc_gettime+0x2f/0x60 [e1000e] +kernel: [] e1000e_systim_overflow_work+0x1d/0x80 [e1000e] +kernel: [] process_one_work+0x155/0x440 +kernel: [] worker_thread+0x116/0x4b0 +kernel: [] kthread+0xd2/0xf0 +kernel: [] ret_from_fork+0x3f/0x70 + +These can be traced back to the fact that e1000e_systim_reset() skips the +timecounter_init() call if e1000e_get_base_timinca() returns -EINVAL, which +leads to a null deref in timecounter_read(). + +Commit 83129b37ef35 ("e1000e: fix systim issues", v4.2-rc1) reworked +e1000e_get_base_timinca() in such a way that it can return -EINVAL for +e1000_pch_spt if the SYSCFI bit is not set in TSYNCRXCTL. + +Some experimentation has shown that on I219 (e1000_pch_spt, "MAC: 12") +adapters, the E1000_TSYNCRXCTL_SYSCFI flag is unstable; TSYNCRXCTL reads +sometimes don't have the SYSCFI bit set. Retrying the read shortly after +finds the bit to be set. This was observed at boot (probe) but also link up +and link down. + +Moreover, the phc (PTP Hardware Clock) seems to operate normally even after +reads where SYSCFI=0. Therefore, remove this register read and +unconditionally set the clock parameters. + +Reported-by: Achim Mildenberger +Message-Id: <20180425065243.g5mqewg5irkwgwgv@f2> +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1075876 +Fixes: 83129b37ef35 ("e1000e: fix systim issues") +Signed-off-by: Benjamin Poirier +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3558,15 +3558,12 @@ s32 e1000e_get_base_timinca(struct e1000 + } + break; + case e1000_pch_spt: +- if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { +- /* Stable 24MHz frequency */ +- incperiod = INCPERIOD_24MHZ; +- incvalue = INCVALUE_24MHZ; +- shift = INCVALUE_SHIFT_24MHZ; +- adapter->cc.shift = shift; +- break; +- } +- return -EINVAL; ++ /* Stable 24MHz frequency */ ++ incperiod = INCPERIOD_24MHZ; ++ incvalue = INCVALUE_24MHZ; ++ shift = INCVALUE_SHIFT_24MHZ; ++ adapter->cc.shift = shift; ++ break; + case e1000_pch_cnp: + if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { + /* Stable 24MHz frequency */ diff --git a/queue-4.14/edac-altera-fix-arm64-build-warning.patch b/queue-4.14/edac-altera-fix-arm64-build-warning.patch new file mode 100644 index 00000000000..2fa5236bf95 --- /dev/null +++ b/queue-4.14/edac-altera-fix-arm64-build-warning.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Thor Thayer +Date: Mon, 14 May 2018 12:04:01 -0500 +Subject: EDAC, altera: Fix ARM64 build warning + +From: Thor Thayer + +[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ] + +The kbuild test robot reported the following warning: + + drivers/edac/altera_edac.c: In function 'ocram_free_mem': + drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer + of different size [-Wpointer-to-int-cast] + gen_pool_free((struct gen_pool *)other, (u32)p, size); + ^ + +After adding support for ARM64 architectures, the unsigned long +parameter is 64 bits and causes a build warning on 64-bit configs. Fix +by casting to the correct size (unsigned long) instead of u32. + +Reported-by: kbuild test robot +Signed-off-by: Thor Thayer +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-edac +Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support") +Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer@linux.intel.com +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size + + static void ocram_free_mem(void *p, size_t size, void *other) + { +- gen_pool_free((struct gen_pool *)other, (u32)p, size); ++ gen_pool_free((struct gen_pool *)other, (unsigned long)p, size); + } + + static const struct edac_device_prv_data ocramecc_data = { diff --git a/queue-4.14/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch b/queue-4.14/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch new file mode 100644 index 00000000000..b94daed1e9a --- /dev/null +++ b/queue-4.14/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jaegeuk Kim +Date: Thu, 3 May 2018 23:26:02 -0700 +Subject: f2fs: avoid fsync() failure caused by EAGAIN in writepage() + +From: Jaegeuk Kim + +[ Upstream commit 5b19d284f5195a925dd015a6397bfce184097378 ] + +pageout() in MM traslates EAGAIN, so calls handle_write_error() + -> mapping_set_error() -> set_bit(AS_EIO, ...). + file_write_and_wait_range() will see EIO error, which is critical + to return value of fsync() followed by atomic_write failure to user. + +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1601,7 +1601,13 @@ out: + + redirty_out: + redirty_page_for_writepage(wbc, page); +- if (!err) ++ /* ++ * pageout() in MM traslates EAGAIN, so calls handle_write_error() ++ * -> mapping_set_error() -> set_bit(AS_EIO, ...). ++ * file_write_and_wait_range() will see EIO error, which is critical ++ * to return value of fsync() followed by atomic_write failure to user. ++ */ ++ if (!err || wbc->for_reclaim) + return AOP_WRITEPAGE_ACTIVATE; + unlock_page(page); + return err; diff --git a/queue-4.14/f2fs-fix-deadlock-in-shutdown-ioctl.patch b/queue-4.14/f2fs-fix-deadlock-in-shutdown-ioctl.patch new file mode 100644 index 00000000000..40af3e0c6ec --- /dev/null +++ b/queue-4.14/f2fs-fix-deadlock-in-shutdown-ioctl.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sahitya Tummala +Date: Fri, 18 May 2018 11:51:52 +0530 +Subject: f2fs: Fix deadlock in shutdown ioctl + +From: Sahitya Tummala + +[ Upstream commit 60b2b4ee2bc01dd052f99fa9d65da2232102ef8e ] + +f2fs_ioc_shutdown() ioctl gets stuck in the below path +when issued with F2FS_GOING_DOWN_FULLSYNC option. + +__switch_to+0x90/0xc4 +percpu_down_write+0x8c/0xc0 +freeze_super+0xec/0x1e4 +freeze_bdev+0xc4/0xcc +f2fs_ioctl+0xc0c/0x1ce0 +f2fs_compat_ioctl+0x98/0x1f0 + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1808,9 +1808,11 @@ static int f2fs_ioc_shutdown(struct file + if (get_user(in, (__u32 __user *)arg)) + return -EFAULT; + +- ret = mnt_want_write_file(filp); +- if (ret) +- return ret; ++ if (in != F2FS_GOING_DOWN_FULLSYNC) { ++ ret = mnt_want_write_file(filp); ++ if (ret) ++ return ret; ++ } + + switch (in) { + case F2FS_GOING_DOWN_FULLSYNC: +@@ -1838,7 +1840,8 @@ static int f2fs_ioc_shutdown(struct file + } + f2fs_update_time(sbi, REQ_TIME); + out: +- mnt_drop_write_file(filp); ++ if (in != F2FS_GOING_DOWN_FULLSYNC) ++ mnt_drop_write_file(filp); + return ret; + } + diff --git a/queue-4.14/f2fs-fix-error-path-of-move_data_page.patch b/queue-4.14/f2fs-fix-error-path-of-move_data_page.patch new file mode 100644 index 00000000000..40b42176fa9 --- /dev/null +++ b/queue-4.14/f2fs-fix-error-path-of-move_data_page.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chao Yu +Date: Mon, 28 May 2018 16:59:27 +0800 +Subject: f2fs: fix error path of move_data_page + +From: Chao Yu + +[ Upstream commit 14a28559f43ac7c0b98dd1b0e73ec9ec8ab4fc45 ] + +This patch fixes error path of move_data_page: +- clear cold data flag if it fails to write page. +- redirty page for non-ENOMEM case. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/gc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -768,9 +768,14 @@ retry: + set_cold_data(page); + + err = do_write_data_page(&fio); +- if (err == -ENOMEM && is_dirty) { +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; ++ if (err) { ++ clear_cold_data(page); ++ if (err == -ENOMEM) { ++ congestion_wait(BLK_RW_ASYNC, HZ/50); ++ goto retry; ++ } ++ if (is_dirty) ++ set_page_dirty(page); + } + } + out: diff --git a/queue-4.14/f2fs-fix-race-in-between-gc-and-atomic-open.patch b/queue-4.14/f2fs-fix-race-in-between-gc-and-atomic-open.patch new file mode 100644 index 00000000000..635f4a25c74 --- /dev/null +++ b/queue-4.14/f2fs-fix-race-in-between-gc-and-atomic-open.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chao Yu +Date: Tue, 17 Apr 2018 17:51:28 +0800 +Subject: f2fs: fix race in between GC and atomic open + +From: Chao Yu + +[ Upstream commit 27319ba4044c0c67d62ae39e53c0118c89f0a029 ] + +Thread GC thread +- f2fs_ioc_start_atomic_write + - get_dirty_pages + - filemap_write_and_wait_range + - f2fs_gc + - do_garbage_collect + - gc_data_segment + - move_data_page + - f2fs_is_atomic_file + - set_page_dirty + - set_inode_flag(, FI_ATOMIC_FILE) + +Dirty data page can still be generated by GC in race condition as +above call stack. + +This patch adds fi->dio_rwsem[WRITE] in f2fs_ioc_start_atomic_write +to avoid such race. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1630,6 +1630,8 @@ static int f2fs_ioc_start_atomic_write(s + + inode_lock(inode); + ++ down_write(&F2FS_I(inode)->dio_rwsem[WRITE]); ++ + if (f2fs_is_atomic_file(inode)) + goto out; + +@@ -1659,6 +1661,7 @@ inc_stat: + stat_inc_atomic_write(inode); + stat_update_max_atomic_write(inode); + out: ++ up_write(&F2FS_I(inode)->dio_rwsem[WRITE]); + inode_unlock(inode); + mnt_drop_write_file(filp); + return ret; diff --git a/queue-4.14/f2fs-fix-to-detect-failure-of-dquot_initialize.patch b/queue-4.14/f2fs-fix-to-detect-failure-of-dquot_initialize.patch new file mode 100644 index 00000000000..779e16e7dd7 --- /dev/null +++ b/queue-4.14/f2fs-fix-to-detect-failure-of-dquot_initialize.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chao Yu +Date: Sat, 21 Apr 2018 17:53:52 +0800 +Subject: f2fs: fix to detect failure of dquot_initialize + +From: Chao Yu + +[ Upstream commit c22aecd75919511abea872b201751e0be1add898 ] + +dquot_initialize() can fail due to any exception inside quota subsystem, +f2fs needs to be aware of it, and return correct return value to caller. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2493,7 +2493,9 @@ static int f2fs_ioc_setproject(struct fi + } + f2fs_put_page(ipage, 1); + +- dquot_initialize(inode); ++ err = dquot_initialize(inode); ++ if (err) ++ goto out_unlock; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); + if (!IS_ERR(transfer_to[PRJQUOTA])) { diff --git a/queue-4.14/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch b/queue-4.14/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch new file mode 100644 index 00000000000..b953a7acdf5 --- /dev/null +++ b/queue-4.14/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chao Yu +Date: Sat, 26 May 2018 18:03:34 +0800 +Subject: f2fs: fix to don't trigger writeback during recovery + +From: Chao Yu + +[ Upstream commit 64c74a7ab505ea40d1b3e5d02735ecab08ae1b14 ] + +- f2fs_fill_super + - recover_fsync_data + - recover_data + - del_fsync_inode + - iput + - iput_final + - write_inode_now + - f2fs_write_inode + - f2fs_balance_fs + - f2fs_balance_fs_bg + - sync_dirty_inodes + +With data_flush mount option, during recovery, in order to avoid entering +above writeback flow, let's detect recovery status and do skip in +f2fs_balance_fs_bg. + +Signed-off-by: Chao Yu +Signed-off-by: Yunlei He +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/segment.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -435,6 +435,9 @@ void f2fs_balance_fs(struct f2fs_sb_info + + void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi) + { ++ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING))) ++ return; ++ + /* try to shrink extent cache when there is no enough memory */ + if (!available_free_memory(sbi, EXTENT_CACHE)) + f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER); diff --git a/queue-4.14/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch b/queue-4.14/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch new file mode 100644 index 00000000000..ed456274db3 --- /dev/null +++ b/queue-4.14/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chao Yu +Date: Mon, 23 Apr 2018 10:36:13 +0800 +Subject: f2fs: fix to wait page writeback during revoking atomic write + +From: Chao Yu + +[ Upstream commit e5e5732d8120654159254c16834bc8663d8be124 ] + +After revoking atomic write, related LBA can be reused by others, so we +need to wait page writeback before reusing the LBA, in order to avoid +interference between old atomic written in-flight IO and new IO. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -225,6 +225,8 @@ static int __revoke_inmem_pages(struct i + + lock_page(page); + ++ f2fs_wait_on_page_writeback(page, DATA, true); ++ + if (recover) { + struct dnode_of_data dn; + struct node_info ni; diff --git a/queue-4.14/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch b/queue-4.14/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch new file mode 100644 index 00000000000..f306a491f0d --- /dev/null +++ b/queue-4.14/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch @@ -0,0 +1,118 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kirill Tkhai +Date: Thu, 5 Apr 2018 14:58:06 +0300 +Subject: fasync: Fix deadlock between task-context and interrupt-context kill_fasync() + +From: Kirill Tkhai + +[ Upstream commit 7a107c0f55a3b4c6f84a4323df5610360bde1684 ] + +I observed the following deadlock between them: + +[task 1] [task 2] [task 3] +kill_fasync() mm_update_next_owner() copy_process() + spin_lock_irqsave(&fa->fa_lock) read_lock(&tasklist_lock) write_lock_irq(&tasklist_lock) + send_sigio() ... + read_lock(&fown->lock) kill_fasync() ... + read_lock(&tasklist_lock) spin_lock_irqsave(&fa->fa_lock) ... + +Task 1 can't acquire read locked tasklist_lock, since there is +already task 3 expressed its wish to take the lock exclusive. +Task 2 holds the read locked lock, but it can't take the spin lock. + +Also, there is possible another deadlock (which I haven't observed): + +[task 1] [task 2] +f_getown() kill_fasync() + read_lock(&f_own->lock) spin_lock_irqsave(&fa->fa_lock,) + send_sigio() write_lock_irq(&f_own->lock) + kill_fasync() read_lock(&fown->lock) + spin_lock_irqsave(&fa->fa_lock,) + +Actually, we do not need exclusive fa->fa_lock in kill_fasync_rcu(), +as it guarantees fa->fa_file->f_owner integrity only. It may seem, +that it used to give a task a small possibility to receive two sequential +signals, if there are two parallel kill_fasync() callers, and task +handles the first signal fastly, but the behaviour won't become +different, since there is exclusive sighand lock in do_send_sig_info(). + +The patch converts fa_lock into rwlock_t, and this fixes two above +deadlocks, as rwlock is allowed to be taken from interrupt handler +by qrwlock design. + +Signed-off-by: Kirill Tkhai +Signed-off-by: Jeff Layton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/fcntl.c | 15 +++++++-------- + include/linux/fs.h | 2 +- + 2 files changed, 8 insertions(+), 9 deletions(-) + +--- a/fs/fcntl.c ++++ b/fs/fcntl.c +@@ -864,9 +864,9 @@ int fasync_remove_entry(struct file *fil + if (fa->fa_file != filp) + continue; + +- spin_lock_irq(&fa->fa_lock); ++ write_lock_irq(&fa->fa_lock); + fa->fa_file = NULL; +- spin_unlock_irq(&fa->fa_lock); ++ write_unlock_irq(&fa->fa_lock); + + *fp = fa->fa_next; + call_rcu(&fa->fa_rcu, fasync_free_rcu); +@@ -911,13 +911,13 @@ struct fasync_struct *fasync_insert_entr + if (fa->fa_file != filp) + continue; + +- spin_lock_irq(&fa->fa_lock); ++ write_lock_irq(&fa->fa_lock); + fa->fa_fd = fd; +- spin_unlock_irq(&fa->fa_lock); ++ write_unlock_irq(&fa->fa_lock); + goto out; + } + +- spin_lock_init(&new->fa_lock); ++ rwlock_init(&new->fa_lock); + new->magic = FASYNC_MAGIC; + new->fa_file = filp; + new->fa_fd = fd; +@@ -980,14 +980,13 @@ static void kill_fasync_rcu(struct fasyn + { + while (fa) { + struct fown_struct *fown; +- unsigned long flags; + + if (fa->magic != FASYNC_MAGIC) { + printk(KERN_ERR "kill_fasync: bad magic number in " + "fasync_struct!\n"); + return; + } +- spin_lock_irqsave(&fa->fa_lock, flags); ++ read_lock(&fa->fa_lock); + if (fa->fa_file) { + fown = &fa->fa_file->f_owner; + /* Don't send SIGURG to processes which have not set a +@@ -996,7 +995,7 @@ static void kill_fasync_rcu(struct fasyn + if (!(sig == SIGURG && fown->signum == 0)) + send_sigio(fown, fa->fa_fd, band); + } +- spin_unlock_irqrestore(&fa->fa_lock, flags); ++ read_unlock(&fa->fa_lock); + fa = rcu_dereference(fa->fa_next); + } + } +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1245,7 +1245,7 @@ static inline int locks_lock_file_wait(s + } + + struct fasync_struct { +- spinlock_t fa_lock; ++ rwlock_t fa_lock; + int magic; + int fa_fd; + struct fasync_struct *fa_next; /* singly linked list */ diff --git a/queue-4.14/fscrypt-use-unbound-workqueue-for-decryption.patch b/queue-4.14/fscrypt-use-unbound-workqueue-for-decryption.patch new file mode 100644 index 00000000000..2d61cfc9721 --- /dev/null +++ b/queue-4.14/fscrypt-use-unbound-workqueue-for-decryption.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Eric Biggers +Date: Fri, 20 Apr 2018 16:30:02 -0700 +Subject: fscrypt: use unbound workqueue for decryption + +From: Eric Biggers + +[ Upstream commit 36dd26e0c8d42699eeba87431246c07c28075bae ] + +Improve fscrypt read performance by switching the decryption workqueue +from bound to unbound. With the bound workqueue, when multiple bios +completed on the same CPU, they were decrypted on that same CPU. But +with the unbound queue, they are now decrypted in parallel on any CPU. + +Although fscrypt read performance can be tough to measure due to the +many sources of variation, this change is most beneficial when +decryption is slow, e.g. on CPUs without AES instructions. For example, +I timed tarring up encrypted directories on f2fs. On x86 with AES-NI +instructions disabled, the unbound workqueue improved performance by +about 25-35%, using 1 to NUM_CPUs jobs with 4 or 8 CPUs available. But +with AES-NI enabled, performance was unchanged to within ~2%. + +I also did the same test on a quad-core ARM CPU using xts-speck128-neon +encryption. There performance was usually about 10% better with the +unbound workqueue, bringing it closer to the unencrypted speed. + +The unbound workqueue may be worse in some cases due to worse locality, +but I think it's still the better default. dm-crypt uses an unbound +workqueue by default too, so this change makes fscrypt match. + +Signed-off-by: Eric Biggers +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/crypto/crypto.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/crypto/crypto.c ++++ b/fs/crypto/crypto.c +@@ -446,8 +446,17 @@ fail: + */ + static int __init fscrypt_init(void) + { ++ /* ++ * Use an unbound workqueue to allow bios to be decrypted in parallel ++ * even when they happen to complete on the same CPU. This sacrifices ++ * locality, but it's worthwhile since decryption is CPU-intensive. ++ * ++ * Also use a high-priority workqueue to prioritize decryption work, ++ * which blocks reads from completing, over regular application tasks. ++ */ + fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue", +- WQ_HIGHPRI, 0); ++ WQ_UNBOUND | WQ_HIGHPRI, ++ num_online_cpus()); + if (!fscrypt_read_workqueue) + goto fail; + diff --git a/queue-4.14/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch b/queue-4.14/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch new file mode 100644 index 00000000000..b40ac891999 --- /dev/null +++ b/queue-4.14/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Terry Junge +Date: Mon, 30 Apr 2018 13:32:46 -0700 +Subject: HID: hid-plantronics: Re-resend Update to map button for PTT products + +From: Terry Junge + +[ Upstream commit 37e376df5f4993677c33968a0c19b0c5acbf1108 ] + +Add a mapping for Push-To-Talk joystick trigger button. + +Tested on ChromeBox/ChromeBook with various Plantronics devices. + +Signed-off-by: Terry Junge +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-plantronics.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -2,7 +2,7 @@ + * Plantronics USB HID Driver + * + * Copyright (c) 2014 JD Cole +- * Copyright (c) 2015 Terry Junge ++ * Copyright (c) 2015-2018 Terry Junge + */ + + /* +@@ -48,6 +48,10 @@ static int plantronics_input_mapping(str + unsigned short mapped_key; + unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); + ++ /* special case for PTT products */ ++ if (field->application == HID_GD_JOYSTICK) ++ goto defaulted; ++ + /* handle volume up/down mapping */ + /* non-standard types or multi-HID interfaces - plt_type is PID */ + if (!(plt_type & HID_USAGE_PAGE)) { diff --git a/queue-4.14/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch b/queue-4.14/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch new file mode 100644 index 00000000000..fe5f64cd929 --- /dev/null +++ b/queue-4.14/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Dmitry Torokhov +Date: Wed, 9 May 2018 12:12:15 -0700 +Subject: HID: i2c-hid: check if device is there before really probing + +From: Dmitry Torokhov + +[ Upstream commit b3a81b6c4fc6730ac49e20d789a93c0faabafc98 ] + +On many Chromebooks touch devices are multi-sourced; the components are +electrically compatible and one can be freely swapped for another without +changing the OS image or firmware. + +To avoid bunch of scary messages when device is not actually present in the +system let's try testing basic communication with it and if there is no +response terminate probe early with -ENXIO. + +Signed-off-by: Dmitry Torokhov +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/i2c-hid/i2c-hid.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -1036,6 +1036,14 @@ static int i2c_hid_probe(struct i2c_clie + pm_runtime_enable(&client->dev); + device_enable_async_suspend(&client->dev); + ++ /* Make sure there is something at this address */ ++ ret = i2c_smbus_read_byte(client); ++ if (ret < 0) { ++ dev_dbg(&client->dev, "nothing at this address: %d\n", ret); ++ ret = -ENXIO; ++ goto err_pm; ++ } ++ + ret = i2c_hid_fetch_hid_descriptor(ihid); + if (ret < 0) + goto err_pm; diff --git a/queue-4.14/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch b/queue-4.14/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch new file mode 100644 index 00000000000..6d4d8954dca --- /dev/null +++ b/queue-4.14/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch @@ -0,0 +1,131 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Stephen Hemminger +Date: Mon, 11 Jun 2018 12:44:55 -0700 +Subject: hv_netvsc: fix network namespace issues with VF support + +From: Stephen Hemminger + +[ Upstream commit 7bf7bb37f16a80465ee3bd7c6c966f96f5a075a6 ] + +When finding the parent netvsc device, the search needs to be across +all netvsc device instances (independent of network namespace). + +Find parent device of VF using upper_dev_get routine which +searches only adjacent list. + +Fixes: e8ff40d4bff1 ("hv_netvsc: improve VF device matching") +Signed-off-by: Stephen Hemminger + +netns aware byref +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hyperv/hyperv_net.h | 2 + + drivers/net/hyperv/netvsc_drv.c | 45 ++++++++++++++++++---------------------- + 2 files changed, 23 insertions(+), 24 deletions(-) + +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -724,6 +724,8 @@ struct net_device_context { + struct hv_device *device_ctx; + /* netvsc_device */ + struct netvsc_device __rcu *nvdev; ++ /* list of netvsc net_devices */ ++ struct list_head list; + /* reconfigure work */ + struct delayed_work dwork; + /* last reconfig time */ +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -66,6 +66,8 @@ static int debug = -1; + module_param(debug, int, S_IRUGO); + MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)"); + ++static LIST_HEAD(netvsc_dev_list); ++ + static void netvsc_change_rx_flags(struct net_device *net, int change) + { + struct net_device_context *ndev_ctx = netdev_priv(net); +@@ -1749,13 +1751,10 @@ out_unlock: + + static struct net_device *get_netvsc_bymac(const u8 *mac) + { +- struct net_device *dev; +- +- ASSERT_RTNL(); ++ struct net_device_context *ndev_ctx; + +- for_each_netdev(&init_net, dev) { +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ ++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { ++ struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx); + + if (ether_addr_equal(mac, dev->perm_addr)) + return dev; +@@ -1766,25 +1765,18 @@ static struct net_device *get_netvsc_bym + + static struct net_device *get_netvsc_byref(struct net_device *vf_netdev) + { ++ struct net_device_context *net_device_ctx; + struct net_device *dev; + +- ASSERT_RTNL(); +- +- for_each_netdev(&init_net, dev) { +- struct net_device_context *net_device_ctx; +- +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ +- +- net_device_ctx = netdev_priv(dev); +- if (!rtnl_dereference(net_device_ctx->nvdev)) +- continue; /* device is removed */ ++ dev = netdev_master_upper_dev_get(vf_netdev); ++ if (!dev || dev->netdev_ops != &device_ops) ++ return NULL; /* not a netvsc device */ ++ ++ net_device_ctx = netdev_priv(dev); ++ if (!rtnl_dereference(net_device_ctx->nvdev)) ++ return NULL; /* device is removed */ + +- if (rtnl_dereference(net_device_ctx->vf_netdev) == vf_netdev) +- return dev; /* a match */ +- } +- +- return NULL; ++ return dev; + } + + /* Called when VF is injecting data into network stack. +@@ -2065,15 +2057,19 @@ static int netvsc_probe(struct hv_device + else + net->max_mtu = ETH_DATA_LEN; + +- ret = register_netdev(net); ++ rtnl_lock(); ++ ret = register_netdevice(net); + if (ret != 0) { + pr_err("Unable to register netdev.\n"); + goto register_failed; + } + +- return ret; ++ list_add(&net_device_ctx->list, &netvsc_dev_list); ++ rtnl_unlock(); ++ return 0; + + register_failed: ++ rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: + free_percpu(net_device_ctx->vf_stats); +@@ -2119,6 +2115,7 @@ static int netvsc_remove(struct hv_devic + rndis_filter_device_remove(dev, nvdev); + + unregister_netdevice(net); ++ list_del(&ndev_ctx->list); + + rtnl_unlock(); + rcu_read_unlock(); diff --git a/queue-4.14/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch b/queue-4.14/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch new file mode 100644 index 00000000000..c4cafa0f6bd --- /dev/null +++ b/queue-4.14/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Stewart Smith +Date: Thu, 29 Mar 2018 17:02:46 +1100 +Subject: hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common() + +From: Stewart Smith + +[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ] + +time_init() will set up tb_ticks_per_usec based on reality. +time_init() is called *after* udbg_init_opal_common() during boot. + +from arch/powerpc/kernel/time.c: + unsigned long tb_ticks_per_usec = 100; /* sane default */ + +Currently, all powernv systems have a timebase frequency of 512mhz +(512000000/1000000 == 0x200) - although there's nothing written +down anywhere that I can find saying that we couldn't make that +different based on the requirements in the ISA. + +So, we've been (accidentally) thwacking the (currently) correct +(for powernv at least) value for tb_ticks_per_usec earlier than +we otherwise would have. + +The "sane default" seems to be adequate for our purposes between +udbg_init_opal_common() and time_init() being called, and if it isn't, +then we should probably be setting it somewhere that isn't hvc_opal.c! + +Signed-off-by: Stewart Smith +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/hvc/hvc_opal.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/tty/hvc/hvc_opal.c ++++ b/drivers/tty/hvc/hvc_opal.c +@@ -332,7 +332,6 @@ static void udbg_init_opal_common(void) + udbg_putc = udbg_opal_putc; + udbg_getc = udbg_opal_getc; + udbg_getc_poll = udbg_opal_getc_poll; +- tb_ticks_per_usec = 0x200; /* Make udelay not suck */ + } + + void __init hvc_opal_init_early(void) diff --git a/queue-4.14/i40e-free-the-skb-after-clearing-the-bitlock.patch b/queue-4.14/i40e-free-the-skb-after-clearing-the-bitlock.patch new file mode 100644 index 00000000000..f6a5df29522 --- /dev/null +++ b/queue-4.14/i40e-free-the-skb-after-clearing-the-bitlock.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jacob Keller +Date: Thu, 10 May 2018 05:59:48 -0700 +Subject: i40e: free the skb after clearing the bitlock + +From: Jacob Keller + +[ Upstream commit c79756cb5f084736b138da9319a02f7c72644548 ] + +In commit bbc4e7d273b5 ("i40e: fix race condition with PTP_TX_IN_PROGRESS +bits") we modified the code which handles Tx timestamps so that we would +clear the progress bit as soon as possible. + +A later commit 0bc0706b46cd ("i40e: check for Tx timestamp timeouts during +watchdog") introduced similar code for detecting and handling cleanup of +a blocked Tx timestamp. This code did not use the same pattern for cleaning +up the skb. + +Update this code to wait to free the skb until after the bit lock is +free, by first setting the ptp_tx_skb to NULL and clearing the lock. + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -337,6 +337,8 @@ void i40e_ptp_rx_hang(struct i40e_pf *pf + **/ + void i40e_ptp_tx_hang(struct i40e_pf *pf) + { ++ struct sk_buff *skb; ++ + if (!(pf->flags & I40E_FLAG_PTP) || !pf->ptp_tx) + return; + +@@ -349,9 +351,12 @@ void i40e_ptp_tx_hang(struct i40e_pf *pf + * within a second it is reasonable to assume that we never will. + */ + if (time_is_before_jiffies(pf->ptp_tx_start + HZ)) { +- dev_kfree_skb_any(pf->ptp_tx_skb); ++ skb = pf->ptp_tx_skb; + pf->ptp_tx_skb = NULL; + clear_bit_unlock(__I40E_PTP_TX_IN_PROGRESS, pf->state); ++ ++ /* Free the skb after we clear the bitlock */ ++ dev_kfree_skb_any(skb); + pf->tx_hwtstamp_timeouts++; + } + } diff --git a/queue-4.14/igb-fix-queue-selection-on-mac-filters-on-i210.patch b/queue-4.14/igb-fix-queue-selection-on-mac-filters-on-i210.patch new file mode 100644 index 00000000000..a11860a2764 --- /dev/null +++ b/queue-4.14/igb-fix-queue-selection-on-mac-filters-on-i210.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Vinicius Costa Gomes +Date: Tue, 10 Apr 2018 10:49:51 -0700 +Subject: igb: Fix queue selection on MAC filters on i210 + +From: Vinicius Costa Gomes + +[ Upstream commit 4dc93fcf0b95dc3fda4db917effae31fbb8ad2a8 ] + +On the RAH registers there are semantic differences on the meaning of +the "queue" parameter for traffic steering depending on the controller +model: there is the 82575 meaning, which "queue" means a RX Hardware +Queue, and the i350 meaning, where it is a reception pool. + +The previous behaviour was having no effect for i210 based controllers +because the QSEL bit of the RAH register wasn't being set. + +This patch separates the condition in discrete cases, so the different +handling is clearer. + +Fixes: 83c21335c876 ("igb: improve MAC filter handling") +Signed-off-by: Vinicius Costa Gomes +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igb/igb_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8376,12 +8376,17 @@ static void igb_rar_set_index(struct igb + if (is_valid_ether_addr(addr)) + rar_high |= E1000_RAH_AV; + +- if (hw->mac.type == e1000_82575) ++ switch (hw->mac.type) { ++ case e1000_82575: ++ case e1000_i210: + rar_high |= E1000_RAH_POOL_1 * + adapter->mac_table[index].queue; +- else ++ break; ++ default: + rar_high |= E1000_RAH_POOL_1 << + adapter->mac_table[index].queue; ++ break; ++ } + } + + wr32(E1000_RAL(index), rar_low); diff --git a/queue-4.14/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch b/queue-4.14/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch new file mode 100644 index 00000000000..eea1d329378 --- /dev/null +++ b/queue-4.14/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mimi Zohar +Date: Fri, 27 Apr 2018 14:31:40 -0400 +Subject: ima: based on policy verify firmware signatures (pre-allocated buffer) + +From: Mimi Zohar + +[ Upstream commit fd90bc559bfba743ae8de87ff23b92a5e4668062 ] + +Don't differentiate, for now, between kernel_read_file_id READING_FIRMWARE +and READING_FIRMWARE_PREALLOC_BUFFER enumerations. + +Fixes: a098ecd firmware: support loading into a pre-allocated buffer (since 4.8) +Signed-off-by: Mimi Zohar +Cc: Luis R. Rodriguez +Cc: David Howells +Cc: Kees Cook +Cc: Serge E. Hallyn +Cc: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/ima/ima_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -379,6 +379,7 @@ int ima_read_file(struct file *file, enu + + static int read_idmap[READING_MAX_ID] = { + [READING_FIRMWARE] = FIRMWARE_CHECK, ++ [READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK, + [READING_MODULE] = MODULE_CHECK, + [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK, + [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK, diff --git a/queue-4.14/infiniband-fix-a-possible-use-after-free-bug.patch b/queue-4.14/infiniband-fix-a-possible-use-after-free-bug.patch new file mode 100644 index 00000000000..ff832e2df34 --- /dev/null +++ b/queue-4.14/infiniband-fix-a-possible-use-after-free-bug.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Cong Wang +Date: Fri, 1 Jun 2018 11:31:44 -0700 +Subject: infiniband: fix a possible use-after-free bug + +From: Cong Wang + +[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ] + +ucma_process_join() will free the new allocated "mc" struct, +if there is any error after that, especially the copy_to_user(). + +But in parallel, ucma_leave_multicast() could find this "mc" +through idr_find() before ucma_process_join() frees it, since it +is already published. + +So "mc" could be used in ucma_leave_multicast() after it is been +allocated and freed in ucma_process_join(), since we don't refcnt +it. + +Fix this by separating "publish" from ID allocation, so that we +can get an ID first and publish it later after copy_to_user(). + +Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") +Reported-by: Noam Rathaus +Signed-off-by: Cong Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/ucma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc + return NULL; + + mutex_lock(&mut); +- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); ++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); + mutex_unlock(&mut); + if (mc->id < 0) + goto error; +@@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct + goto err3; + } + ++ mutex_lock(&mut); ++ idr_replace(&multicast_idr, mc, mc->id); ++ mutex_unlock(&mut); ++ + mutex_unlock(&file->mut); + ucma_put_ctx(ctx); + return 0; diff --git a/queue-4.14/ipconfig-correctly-initialise-ic_nameservers.patch b/queue-4.14/ipconfig-correctly-initialise-ic_nameservers.patch new file mode 100644 index 00000000000..0d19df397e6 --- /dev/null +++ b/queue-4.14/ipconfig-correctly-initialise-ic_nameservers.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chris Novakovic +Date: Tue, 24 Apr 2018 03:56:37 +0100 +Subject: ipconfig: Correctly initialise ic_nameservers + +From: Chris Novakovic + +[ Upstream commit 300eec7c0a2495f771709c7642aa15f7cc148b83 ] + +ic_nameservers, which stores the list of name servers discovered by +ipconfig, is initialised (i.e. has all of its elements set to NONE, or +0xffffffff) by ic_nameservers_predef() in the following scenarios: + + - before the "ip=" and "nfsaddrs=" kernel command line parameters are + parsed (in ip_auto_config_setup()); + - before autoconfiguring via DHCP or BOOTP (in ic_bootp_init()), in + order to clear any values that may have been set after parsing "ip=" + or "nfsaddrs=" and are no longer needed. + +This means that ic_nameservers_predef() is not called when neither "ip=" +nor "nfsaddrs=" is specified on the kernel command line. In this +scenario, every element in ic_nameservers remains set to 0x00000000, +which is indistinguishable from ANY and causes pnp_seq_show() to write +the following (bogus) information to /proc/net/pnp: + + #MANUAL + nameserver 0.0.0.0 + nameserver 0.0.0.0 + nameserver 0.0.0.0 + +This is potentially problematic for systems that blindly link +/etc/resolv.conf to /proc/net/pnp. + +Ensure that ic_nameservers is also initialised when neither "ip=" nor +"nfsaddrs=" are specified by calling ic_nameservers_predef() in +ip_auto_config(), but only when ip_auto_config_setup() was not called +earlier. This causes the following to be written to /proc/net/pnp, and +is consistent with what gets written when ipconfig is configured +manually but no name servers are specified on the kernel command line: + + #MANUAL + +Signed-off-by: Chris Novakovic +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ipconfig.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/net/ipv4/ipconfig.c ++++ b/net/ipv4/ipconfig.c +@@ -781,6 +781,11 @@ static void __init ic_bootp_init_ext(u8 + */ + static inline void __init ic_bootp_init(void) + { ++ /* Re-initialise all name servers to NONE, in case any were set via the ++ * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses ++ * specified there will already have been decoded but are no longer ++ * needed ++ */ + ic_nameservers_predef(); + + dev_add_pack(&bootp_packet_type); +@@ -1402,6 +1407,13 @@ static int __init ip_auto_config(void) + int err; + unsigned int i; + ++ /* Initialise all name servers to NONE (but only if the "ip=" or ++ * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise ++ * we'll overwrite the IP addresses specified there) ++ */ ++ if (ic_set_manually == 0) ++ ic_nameservers_predef(); ++ + #ifdef CONFIG_PROC_FS + proc_create("pnp", S_IRUGO, init_net.proc_net, &pnp_seq_fops); + #endif /* CONFIG_PROC_FS */ +@@ -1622,6 +1634,7 @@ static int __init ip_auto_config_setup(c + return 1; + } + ++ /* Initialise all name servers to NONE */ + ic_nameservers_predef(); + + /* Parse string for static IP assignment. */ diff --git a/queue-4.14/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch b/queue-4.14/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch new file mode 100644 index 00000000000..73b9ba0ce50 --- /dev/null +++ b/queue-4.14/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Laurentiu Tudor +Date: Tue, 5 Jun 2018 15:27:27 +0300 +Subject: irqchip/ls-scfg-msi: Map MSIs in the iommu + +From: Laurentiu Tudor + +[ Upstream commit 0cdd431c337e99177e68597f3de34bedd3a20a74 ] + +Add the required iommu_dma_map_msi_msg() when composing the MSI message, +otherwise the interrupts will not work. + +Signed-off-by: Laurentiu Tudor +Signed-off-by: Thomas Gleixner +Cc: jason@lakedaemon.net +Cc: marc.zyngier@arm.com +Cc: zhiqiang.hou@nxp.com +Cc: minghuan.lian@nxp.com +Link: https://lkml.kernel.org/r/20180605122727.12831-1-laurentiu.tudor@nxp.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-ls-scfg-msi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/irqchip/irq-ls-scfg-msi.c ++++ b/drivers/irqchip/irq-ls-scfg-msi.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #define MSI_IRQS_PER_MSIR 32 + #define MSI_MSIR_OFFSET 4 +@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(stru + + if (msi_affinity_flag) + msg->data |= cpumask_first(data->common->affinity); ++ ++ iommu_dma_map_msi_msg(data->irq, msg); + } + + static int ls_scfg_msi_set_affinity(struct irq_data *irq_data, diff --git a/queue-4.14/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch b/queue-4.14/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch new file mode 100644 index 00000000000..5f6f056b465 --- /dev/null +++ b/queue-4.14/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Shaul Triebitz +Date: Thu, 22 Mar 2018 14:14:45 +0200 +Subject: iwlwifi: pcie: fix race in Rx buffer allocator + +From: Shaul Triebitz + +[ Upstream commit 0f22e40053bd5378ad1e3250e65c574fd61c0cd6 ] + +Make sure the rx_allocator worker is canceled before running the +rx_init routine. rx_init frees and re-allocates all rxb's pages. The +rx_allocator worker also allocates pages for the used rxb's. Running +rx_init and rx_allocator simultaniously causes a kernel panic. Fix +that by canceling the work in rx_init. + +Signed-off-by: Shaul Triebitz +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_ + } + def_rxq = trans_pcie->rxq; + ++ cancel_work_sync(&rba->rx_alloc); ++ + spin_lock(&rba->lock); + atomic_set(&rba->req_pending, 0); + atomic_set(&rba->req_ready, 0); diff --git a/queue-4.14/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch b/queue-4.14/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch new file mode 100644 index 00000000000..32f3303e1a8 --- /dev/null +++ b/queue-4.14/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Emil Tantilov +Date: Mon, 14 May 2018 11:16:16 -0700 +Subject: ixgbevf: fix MAC address changes through ixgbevf_set_mac() + +From: Emil Tantilov + +[ Upstream commit 6e7d0ba1e59b1a306761a731e67634c0f2efea2a ] + +Set hw->mac.perm_addr in ixgbevf_set_mac() in order to avoid losing the +custom MAC on reset. This can happen in the following case: + +>ip link set $vf address $mac +>ethtool -r $vf + +Signed-off-by: Emil Tantilov +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -3737,6 +3737,7 @@ static int ixgbevf_set_mac(struct net_de + return -EPERM; + + ether_addr_copy(hw->mac.addr, addr->sa_data); ++ ether_addr_copy(hw->mac.perm_addr, addr->sa_data); + ether_addr_copy(netdev->dev_addr, addr->sa_data); + + return 0; diff --git a/queue-4.14/kcov-ensure-irq-code-sees-a-valid-area.patch b/queue-4.14/kcov-ensure-irq-code-sees-a-valid-area.patch new file mode 100644 index 00000000000..b91c8b82031 --- /dev/null +++ b/queue-4.14/kcov-ensure-irq-code-sees-a-valid-area.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mark Rutland +Date: Thu, 14 Jun 2018 15:27:34 -0700 +Subject: kcov: ensure irq code sees a valid area + +From: Mark Rutland + +[ Upstream commit c9484b986ef03492357fddd50afbdd02929cfa72 ] + +Patch series "kcov: fix unexpected faults". + +These patches fix a few issues where KCOV code could trigger recursive +faults, discovered while debugging a patch enabling KCOV for arch/arm: + +* On CONFIG_PREEMPT kernels, there's a small race window where + __sanitizer_cov_trace_pc() can see a bogus kcov_area. + +* Lazy faulting of the vmalloc area can cause mutual recursion between + fault handling code and __sanitizer_cov_trace_pc(). + +* During the context switch, switching the mm can cause the kcov_area to + be transiently unmapped. + +These are prerequisites for enabling KCOV on arm, but the issues +themsevles are generic -- we just happen to avoid them by chance rather +than design on x86-64 and arm64. + +This patch (of 3): + +For kernels built with CONFIG_PREEMPT, some C code may execute before or +after the interrupt handler, while the hardirq count is zero. In these +cases, in_task() can return true. + +A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it +resets the task's kcov data via kcov_task_init(). Instrumented code +executed during this period will call __sanitizer_cov_trace_pc(), and as +in_task() returns true, will inspect t->kcov_mode before trying to write +to t->kcov_area. + +In kcov_init_task() we update t->kcov_{mode,area,size} with plain stores, +which may be re-ordered, torn, etc. Thus __sanitizer_cov_trace_pc() may +see bogus values for any of these fields, and may attempt to write to +memory which is not mapped. + +Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a +barrier() to ensure this is ordered before we clear t->kov_{area,size}. +This ensures that any code execute while kcov_init_task() is preempted +will either see valid values for t->kcov_{area,size}, or will see that +t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching +t->kcov_area. + +Link: http://lkml.kernel.org/r/20180504135535.53744-2-mark.rutland@arm.com +Signed-off-by: Mark Rutland +Acked-by: Andrey Ryabinin +Cc: Dmitry Vyukov +Cc: Ingo Molnar +Cc: Peter Zijlstra +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/kcov.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/kcov.c ++++ b/kernel/kcov.c +@@ -108,7 +108,8 @@ static void kcov_put(struct kcov *kcov) + + void kcov_task_init(struct task_struct *t) + { +- t->kcov_mode = KCOV_MODE_DISABLED; ++ WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED); ++ barrier(); + t->kcov_size = 0; + t->kcov_area = NULL; + t->kcov = NULL; diff --git a/queue-4.14/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch b/queue-4.14/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch new file mode 100644 index 00000000000..95871e3b471 --- /dev/null +++ b/queue-4.14/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch @@ -0,0 +1,118 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Tetsuo Handa +Date: Thu, 7 Jun 2018 17:10:34 -0700 +Subject: kernel/hung_task.c: show all hung tasks before panic + +From: Tetsuo Handa + +[ Upstream commit 401c636a0eeb0d51862fce222da1bf08e3a0ffd0 ] + +When we get a hung task it can often be valuable to see _all_ the hung +tasks on the system before calling panic(). + +Quoting from https://syzkaller.appspot.com/text?tag=CrashReport&id=5316056503549952 +---------------------------------------- +INFO: task syz-executor0:6540 blocked for more than 120 seconds. + Not tainted 4.16.0+ #13 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +syz-executor0 D23560 6540 4521 0x80000004 +Call Trace: + context_switch kernel/sched/core.c:2848 [inline] + __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490 + schedule+0xf5/0x430 kernel/sched/core.c:3549 + schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3607 + __mutex_lock_common kernel/locking/mutex.c:833 [inline] + __mutex_lock+0xb7f/0x1810 kernel/locking/mutex.c:893 + mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 + lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 + __blkdev_driver_ioctl block/ioctl.c:303 [inline] + blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601 + ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2060 + isofs_get_last_session fs/isofs/inode.c:567 [inline] + isofs_fill_super+0x2ba9/0x3bc0 fs/isofs/inode.c:660 + mount_bdev+0x2b7/0x370 fs/super.c:1119 + isofs_mount+0x34/0x40 fs/isofs/inode.c:1560 + mount_fs+0x66/0x2d0 fs/super.c:1222 + vfs_kern_mount.part.26+0xc6/0x4a0 fs/namespace.c:1037 + vfs_kern_mount fs/namespace.c:2514 [inline] + do_new_mount fs/namespace.c:2517 [inline] + do_mount+0xea4/0x2b90 fs/namespace.c:2847 + ksys_mount+0xab/0x120 fs/namespace.c:3063 + SYSC_mount fs/namespace.c:3077 [inline] + SyS_mount+0x39/0x50 fs/namespace.c:3074 + do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x42/0xb7 +(...snipped...) +Showing all locks held in the system: +(...snipped...) +2 locks held by syz-executor0/6540: + #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:211 [inline] + #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x3b2/0xe60 fs/super.c:502 /* down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); */ + #1: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */ +(...snipped...) +3 locks held by syz-executor7/6541: + #0: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */ + #1: 000000007bf3d3f9 (&bdev->bd_mutex){+.+.}, at: blkdev_reread_part+0x1e/0x40 block/ioctl.c:192 + #2: 00000000566d4c39 (&type->s_umount_key#50){.+.+}, at: __get_super.part.10+0x1d3/0x280 fs/super.c:663 /* down_read(&sb->s_umount); */ +---------------------------------------- + +When reporting an AB-BA deadlock like shown above, it would be nice if +trace of PID=6541 is printed as well as trace of PID=6540 before calling +panic(). + +Showing hung tasks up to /proc/sys/kernel/hung_task_warnings could delay +calling panic() but normally there should not be so many hung tasks. + +Link: http://lkml.kernel.org/r/201804050705.BHE57833.HVFOFtSOMQJFOL@I-love.SAKURA.ne.jp +Signed-off-by: Tetsuo Handa +Acked-by: Paul E. McKenney +Acked-by: Dmitry Vyukov +Cc: Vegard Nossum +Cc: Mandeep Singh Baines +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Ingo Molnar +Signed-off-by: Andrew Morton + +Signed-off-by: Linus Torvalds + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/hung_task.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warni + + static int __read_mostly did_panic; + static bool hung_task_show_lock; ++static bool hung_task_call_panic; + + static struct task_struct *watchdog_task; + +@@ -127,10 +128,8 @@ static void check_hung_task(struct task_ + touch_nmi_watchdog(); + + if (sysctl_hung_task_panic) { +- if (hung_task_show_lock) +- debug_show_all_locks(); +- trigger_all_cpu_backtrace(); +- panic("hung_task: blocked tasks"); ++ hung_task_show_lock = true; ++ hung_task_call_panic = true; + } + } + +@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_t + rcu_read_unlock(); + if (hung_task_show_lock) + debug_show_all_locks(); ++ if (hung_task_call_panic) { ++ trigger_all_cpu_backtrace(); ++ panic("hung_task: blocked tasks"); ++ } + } + + static long hung_timeout_jiffies(unsigned long last_checked, diff --git a/queue-4.14/libata-fix-command-retry-decision.patch b/queue-4.14/libata-fix-command-retry-decision.patch new file mode 100644 index 00000000000..840ed86fcce --- /dev/null +++ b/queue-4.14/libata-fix-command-retry-decision.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Damien Le Moal +Date: Wed, 9 May 2018 09:28:12 +0900 +Subject: libata: Fix command retry decision + +From: Damien Le Moal + +[ Upstream commit 804689ad2d9b66d0d3920b48cf05881049d44589 ] + +For failed commands with valid sense data (e.g. NCQ commands), +scsi_check_sense() is used in ata_analyze_tf() to determine if the +command can be retried. In such case, rely on this decision and ignore +the command error mask based decision done in ata_worth_retry(). + +This fixes useless retries of commands such as unaligned writes on zoned +disks (TYPE_ZAC). + +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-eh.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2217,12 +2217,16 @@ static void ata_eh_link_autopsy(struct a + if (qc->err_mask & ~AC_ERR_OTHER) + qc->err_mask &= ~AC_ERR_OTHER; + +- /* SENSE_VALID trumps dev/unknown error and revalidation */ ++ /* ++ * SENSE_VALID trumps dev/unknown error and revalidation. Upper ++ * layers will determine whether the command is worth retrying ++ * based on the sense data and device class/type. Otherwise, ++ * determine directly if the command is worth retrying using its ++ * error mask and flags. ++ */ + if (qc->flags & ATA_QCFLAG_SENSE_VALID) + qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER); +- +- /* determine whether the command is worth retrying */ +- if (ata_eh_worth_retry(qc)) ++ else if (ata_eh_worth_retry(qc)) + qc->flags |= ATA_QCFLAG_RETRY; + + /* accumulate error info */ diff --git a/queue-4.14/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch b/queue-4.14/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch new file mode 100644 index 00000000000..d82fa4458f6 --- /dev/null +++ b/queue-4.14/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Javier González" +Date: Fri, 1 Jun 2018 15:04:19 +0200 +Subject: lightnvm: pblk: warn in case of corrupted write buffer + +From: "Javier González" + +[ Upstream commit e37d07983af9068de0303054542d2652ca917f58 ] + +When cleaning up buffer entries as we wrap up, their state should be +"completed". If any of the entries is in "submitted" state, it means +that something bad has happened. Trigger a warning immediately instead of +waiting for the state flag to eventually be updated, thus hiding the +issue. + +Signed-off-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-rb.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/lightnvm/pblk-rb.c ++++ b/drivers/lightnvm/pblk-rb.c +@@ -142,10 +142,9 @@ static void clean_wctx(struct pblk_w_ctx + { + int flags; + +-try: + flags = READ_ONCE(w_ctx->flags); +- if (!(flags & PBLK_SUBMITTED_ENTRY)) +- goto try; ++ WARN_ONCE(!(flags & PBLK_SUBMITTED_ENTRY), ++ "pblk: overwriting unsubmitted data\n"); + + /* Release flags on context. Protect from writes and reads */ + smp_store_release(&w_ctx->flags, PBLK_WRITABLE_ENTRY); diff --git a/queue-4.14/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch b/queue-4.14/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch new file mode 100644 index 00000000000..541a395f52c --- /dev/null +++ b/queue-4.14/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Yufen Yu +Date: Fri, 4 May 2018 18:08:10 +0800 +Subject: md: fix NULL dereference of mddev->pers in remove_and_add_spares() + +From: Yufen Yu + +[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ] + +We met NULL pointer BUG as follow: + +[ 151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 +[ 151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0 +[ 151.762039] Oops: 0000 [#1] SMP PTI +[ 151.762406] Modules linked in: +[ 151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238 +[ 151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014 +[ 151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0 +[ 151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246 +[ 151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000 +[ 151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000 +[ 151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051 +[ 151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600 +[ 151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000 +[ 151.769160] FS: 00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000 +[ 151.769971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0 +[ 151.771272] Call Trace: +[ 151.771542] md_ioctl+0x1df2/0x1e10 +[ 151.771906] ? __switch_to+0x129/0x440 +[ 151.772295] ? __schedule+0x244/0x850 +[ 151.772672] blkdev_ioctl+0x4bd/0x970 +[ 151.773048] block_ioctl+0x39/0x40 +[ 151.773402] do_vfs_ioctl+0xa4/0x610 +[ 151.773770] ? dput.part.23+0x87/0x100 +[ 151.774151] ksys_ioctl+0x70/0x80 +[ 151.774493] __x64_sys_ioctl+0x16/0x20 +[ 151.774877] do_syscall_64+0x5b/0x180 +[ 151.775258] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +For raid6, when two disk of the array are offline, two spare disks can +be added into the array. Before spare disks recovery completing, +system reboot and mdadm thinks it is ok to restart the degraded +array by md_ioctl(). Since disks in raid6 is not only_parity(), +raid5_run() will abort, when there is no PPL feature or not setting +'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL. + +But, mddev->raid_disks has been set and it will not be cleared when +raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to +remove a disk by mdadm, which will cause NULL pointer dereference +in remove_and_add_spares() finally. + +Signed-off-by: Yufen Yu +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6498,6 +6498,9 @@ static int hot_remove_disk(struct mddev + char b[BDEVNAME_SIZE]; + struct md_rdev *rdev; + ++ if (!mddev->pers) ++ return -ENODEV; ++ + rdev = find_rdev(mddev, dev); + if (!rdev) + return -ENXIO; diff --git a/queue-4.14/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch b/queue-4.14/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch new file mode 100644 index 00000000000..b3232065d64 --- /dev/null +++ b/queue-4.14/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Gioh Kim +Date: Wed, 2 May 2018 13:08:11 +0200 +Subject: md/raid1: add error handling of read error from FailFast device + +From: Gioh Kim + +[ Upstream commit b33d10624fdc15cdf1495f3f00481afccec76783 ] + +Current handle_read_error() function calls fix_read_error() +only if md device is RW and rdev does not include FailFast flag. +It does not handle a read error from a RW device including +FailFast flag. + +I am not sure it is intended. But I found that write IO error +sets rdev faulty. The md module should handle the read IO error and +write IO error equally. So I think read IO error should set rdev faulty. + +Signed-off-by: Gioh Kim +Reviewed-by: Jack Wang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid1.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2462,6 +2462,8 @@ static void handle_read_error(struct r1c + fix_read_error(conf, r1_bio->read_disk, + r1_bio->sector, r1_bio->sectors); + unfreeze_array(conf); ++ } else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) { ++ md_error(mddev, rdev); + } else { + r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED; + } diff --git a/queue-4.14/media-atomisp-compat32-fix-__user-annotations.patch b/queue-4.14/media-atomisp-compat32-fix-__user-annotations.patch new file mode 100644 index 00000000000..bdb35f589ec --- /dev/null +++ b/queue-4.14/media-atomisp-compat32-fix-__user-annotations.patch @@ -0,0 +1,228 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mauro Carvalho Chehab +Date: Thu, 12 Apr 2018 05:31:59 -0400 +Subject: media: atomisp: compat32: fix __user annotations + +From: Mauro Carvalho Chehab + +[ Upstream commit ad4222a0e29664666a71685a6e732923ca7c7e45 ] + +The __user annotations at the compat32 code is not right: + + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: expected void *base + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: expected unsigned int [usertype] *xcoords_y + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: expected unsigned int [usertype] *ycoords_y + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: expected unsigned int [usertype] *xcoords_uv + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: expected unsigned int [usertype] *ycoords_uv + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: expected unsigned int [usertype] *effective_width + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: expected unsigned int [usertype] *effective_width + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: expected struct v4l2_framebuffer *frame + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: expected unsigned short *calb_grp_values + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:701:39: warning: cast removes address space of expression + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: expected void const volatile [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: got unsigned int [usertype] *src + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: expected struct atomisp_shading_table *shading_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: got struct atomisp_shading_table *shading_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: expected struct atomisp_morph_table *morph_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: got struct atomisp_morph_table *morph_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: expected struct atomisp_dvs2_coefficients *dvs2_coefs + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: got struct atomisp_dvs2_coefficients *dvs2_coefs + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: expected struct atomisp_dvs_6axis_config *dvs_6axis_config + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: got struct atomisp_dvs_6axis_config *dvs_6axis_config + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: expected struct atomisp_sensor_ae_bracketing_lut_entry *lut + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: got void [noderef] * + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c | 49 +++++----- + 1 file changed, 26 insertions(+), 23 deletions(-) + +--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c ++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c +@@ -81,7 +81,7 @@ static int get_v4l2_framebuffer32(struct + get_user(kp->flags, &up->flags)) + return -EFAULT; + +- kp->base = compat_ptr(tmp); ++ kp->base = (void __force *)compat_ptr(tmp); + get_v4l2_pix_format((struct v4l2_pix_format *)&kp->fmt, &up->fmt); + return 0; + } +@@ -232,10 +232,10 @@ static int get_atomisp_dvs_6axis_config3 + get_user(ycoords_uv, &up->ycoords_uv)) + return -EFAULT; + +- kp->xcoords_y = compat_ptr(xcoords_y); +- kp->ycoords_y = compat_ptr(ycoords_y); +- kp->xcoords_uv = compat_ptr(xcoords_uv); +- kp->ycoords_uv = compat_ptr(ycoords_uv); ++ kp->xcoords_y = (void __force *)compat_ptr(xcoords_y); ++ kp->ycoords_y = (void __force *)compat_ptr(ycoords_y); ++ kp->xcoords_uv = (void __force *)compat_ptr(xcoords_uv); ++ kp->ycoords_uv = (void __force *)compat_ptr(ycoords_uv); + return 0; + } + +@@ -296,7 +296,7 @@ static int get_atomisp_metadata_stat32(s + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -360,7 +360,7 @@ static int get_atomisp_metadata_by_type_ + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -437,7 +437,7 @@ static int get_atomisp_overlay32(struct + get_user(kp->overlay_start_x, &up->overlay_start_y)) + return -EFAULT; + +- kp->frame = compat_ptr(frame); ++ kp->frame = (void __force *)compat_ptr(frame); + return 0; + } + +@@ -481,7 +481,7 @@ static int get_atomisp_calibration_group + get_user(calb_grp_values, &up->calb_grp_values)) + return -EFAULT; + +- kp->calb_grp_values = compat_ptr(calb_grp_values); ++ kp->calb_grp_values = (void __force *)compat_ptr(calb_grp_values); + return 0; + } + +@@ -703,8 +703,8 @@ static int get_atomisp_parameters32(stru + return -EFAULT; + + while (n >= 0) { +- compat_uptr_t *src = (compat_uptr_t *)up + n; +- uintptr_t *dst = (uintptr_t *)kp + n; ++ compat_uptr_t __user *src = ((compat_uptr_t __user *)up) + n; ++ uintptr_t *dst = ((uintptr_t *)kp) + n; + + if (get_user((*dst), src)) + return -EFAULT; +@@ -751,12 +751,12 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->shading_table = user_ptr + offset; ++ kp->shading_table = (void __force *)user_ptr + offset; + offset = sizeof(struct atomisp_shading_table); + if (!kp->shading_table) + return -EFAULT; + +- if (copy_to_user(kp->shading_table, ++ if (copy_to_user((void __user *)kp->shading_table, + &karg.shading_table, + sizeof(struct atomisp_shading_table))) + return -EFAULT; +@@ -777,13 +777,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->morph_table = user_ptr + offset; ++ kp->morph_table = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_morph_table); + if (!kp->morph_table) + return -EFAULT; + +- if (copy_to_user(kp->morph_table, &karg.morph_table, +- sizeof(struct atomisp_morph_table))) ++ if (copy_to_user((void __user *)kp->morph_table, ++ &karg.morph_table, ++ sizeof(struct atomisp_morph_table))) + return -EFAULT; + } + +@@ -802,13 +803,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->dvs2_coefs = user_ptr + offset; ++ kp->dvs2_coefs = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dis_coefficients); + if (!kp->dvs2_coefs) + return -EFAULT; + +- if (copy_to_user(kp->dvs2_coefs, &karg.dvs2_coefs, +- sizeof(struct atomisp_dis_coefficients))) ++ if (copy_to_user((void __user *)kp->dvs2_coefs, ++ &karg.dvs2_coefs, ++ sizeof(struct atomisp_dis_coefficients))) + return -EFAULT; + } + /* handle dvs 6axis configuration */ +@@ -826,13 +828,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->dvs_6axis_config = user_ptr + offset; ++ kp->dvs_6axis_config = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dvs_6axis_config); + if (!kp->dvs_6axis_config) + return -EFAULT; + +- if (copy_to_user(kp->dvs_6axis_config, &karg.dvs_6axis_config, +- sizeof(struct atomisp_dvs_6axis_config))) ++ if (copy_to_user((void __user *)kp->dvs_6axis_config, ++ &karg.dvs_6axis_config, ++ sizeof(struct atomisp_dvs_6axis_config))) + return -EFAULT; + } + } +@@ -891,7 +894,7 @@ static int get_atomisp_sensor_ae_bracket + get_user(lut, &up->lut)) + return -EFAULT; + +- kp->lut = compat_ptr(lut); ++ kp->lut = (void __force *)compat_ptr(lut); + return 0; + } + diff --git a/queue-4.14/media-atomisp-ov2680-don-t-declare-unused-vars.patch b/queue-4.14/media-atomisp-ov2680-don-t-declare-unused-vars.patch new file mode 100644 index 00000000000..3e303a8326d --- /dev/null +++ b/queue-4.14/media-atomisp-ov2680-don-t-declare-unused-vars.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mauro Carvalho Chehab +Date: Mon, 16 Apr 2018 12:37:09 -0400 +Subject: media: atomisp: ov2680: don't declare unused vars + +From: Mauro Carvalho Chehab + +[ Upstream commit e5c0680fd2c44252868fe4062558925b5506b179 ] + +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘__ov2680_set_exposure’: +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:400:10: warning: variable ‘hts’ set but not used [-Wunused-but-set-variable] + u16 vts,hts; + ^~~ +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘ov2680_detect’: +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:1164:5: warning: variable ‘revision’ set but not used [-Wunused-but-set-variable] + u8 revision; + ^~~~~~~~ + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/i2c/ov2680.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/media/atomisp/i2c/ov2680.c ++++ b/drivers/staging/media/atomisp/i2c/ov2680.c +@@ -396,12 +396,11 @@ static long __ov2680_set_exposure(struct + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov2680_device *dev = to_ov2680_sensor(sd); +- u16 vts,hts; ++ u16 vts; + int ret,exp_val; + + dev_dbg(&client->dev, "+++++++__ov2680_set_exposure coarse_itg %d, gain %d, digitgain %d++\n",coarse_itg, gain, digitgain); + +- hts = ov2680_res[dev->fmt_idx].pixels_per_line; + vts = ov2680_res[dev->fmt_idx].lines_per_frame; + + /* group hold */ +@@ -1190,7 +1189,8 @@ static int ov2680_detect(struct i2c_clie + OV2680_SC_CMMN_SUB_ID, &high); + revision = (u8) high & 0x0f; + +- dev_info(&client->dev, "sensor_revision id = 0x%x\n", id); ++ dev_info(&client->dev, "sensor_revision id = 0x%x, rev= %d\n", ++ id, revision); + + return 0; + } diff --git a/queue-4.14/media-media-device-fix-ioctl-function-types.patch b/queue-4.14/media-media-device-fix-ioctl-function-types.patch new file mode 100644 index 00000000000..6b979dd12b7 --- /dev/null +++ b/queue-4.14/media-media-device-fix-ioctl-function-types.patch @@ -0,0 +1,85 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sami Tolvanen +Date: Mon, 7 May 2018 14:09:46 -0400 +Subject: media: media-device: fix ioctl function types + +From: Sami Tolvanen + +[ Upstream commit daa36370b62428cca6d48d1b2530a8419f631c8c ] + +This change fixes function types for media device ioctls to avoid +indirect call mismatches with Control-Flow Integrity checking. + +Signed-off-by: Sami Tolvanen +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/media-device.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -54,9 +54,10 @@ static int media_device_close(struct fil + return 0; + } + +-static int media_device_get_info(struct media_device *dev, +- struct media_device_info *info) ++static long media_device_get_info(struct media_device *dev, void *arg) + { ++ struct media_device_info *info = arg; ++ + memset(info, 0, sizeof(*info)); + + if (dev->driver_name[0]) +@@ -93,9 +94,9 @@ static struct media_entity *find_entity( + return NULL; + } + +-static long media_device_enum_entities(struct media_device *mdev, +- struct media_entity_desc *entd) ++static long media_device_enum_entities(struct media_device *mdev, void *arg) + { ++ struct media_entity_desc *entd = arg; + struct media_entity *ent; + + ent = find_entity(mdev, entd->id); +@@ -146,9 +147,9 @@ static void media_device_kpad_to_upad(co + upad->flags = kpad->flags; + } + +-static long media_device_enum_links(struct media_device *mdev, +- struct media_links_enum *links) ++static long media_device_enum_links(struct media_device *mdev, void *arg) + { ++ struct media_links_enum *links = arg; + struct media_entity *entity; + + entity = find_entity(mdev, links->entity); +@@ -194,9 +195,9 @@ static long media_device_enum_links(stru + return 0; + } + +-static long media_device_setup_link(struct media_device *mdev, +- struct media_link_desc *linkd) ++static long media_device_setup_link(struct media_device *mdev, void *arg) + { ++ struct media_link_desc *linkd = arg; + struct media_link *link = NULL; + struct media_entity *source; + struct media_entity *sink; +@@ -222,9 +223,9 @@ static long media_device_setup_link(stru + return __media_entity_setup_link(link, linkd->flags); + } + +-static long media_device_get_topology(struct media_device *mdev, +- struct media_v2_topology *topo) ++static long media_device_get_topology(struct media_device *mdev, void *arg) + { ++ struct media_v2_topology *topo = arg; + struct media_entity *entity; + struct media_interface *intf; + struct media_pad *pad; diff --git a/queue-4.14/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch b/queue-4.14/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch new file mode 100644 index 00000000000..150b0a8b2a3 --- /dev/null +++ b/queue-4.14/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Suman Anna +Date: Wed, 14 Mar 2018 11:41:36 -0400 +Subject: media: omap3isp: fix unbalanced dma_iommu_mapping + +From: Suman Anna + +[ Upstream commit b7e1e6859fbf60519fd82d7120cee106a6019512 ] + +The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware +ARM DMA backend. The current code creates a dma_iommu_mapping and +attaches this to the ISP device, but never detaches the mapping in +either the probe failure paths or the driver remove path resulting +in an unbalanced mapping refcount and a memory leak. Fix this properly. + +Reported-by: Pavel Machek +Signed-off-by: Suman Anna +Tested-by: Pavel Machek +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/omap3isp/isp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -1945,6 +1945,7 @@ error_csi2: + + static void isp_detach_iommu(struct isp_device *isp) + { ++ arm_iommu_detach_device(isp->dev); + arm_iommu_release_mapping(isp->mapping); + isp->mapping = NULL; + } +@@ -1961,8 +1962,7 @@ static int isp_attach_iommu(struct isp_d + mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G); + if (IS_ERR(mapping)) { + dev_err(isp->dev, "failed to create ARM IOMMU mapping\n"); +- ret = PTR_ERR(mapping); +- goto error; ++ return PTR_ERR(mapping); + } + + isp->mapping = mapping; +@@ -1977,7 +1977,8 @@ static int isp_attach_iommu(struct isp_d + return 0; + + error: +- isp_detach_iommu(isp); ++ arm_iommu_release_mapping(isp->mapping); ++ isp->mapping = NULL; + return ret; + } + diff --git a/queue-4.14/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch b/queue-4.14/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch new file mode 100644 index 00000000000..ce5768feee6 --- /dev/null +++ b/queue-4.14/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wei Yongjun +Date: Tue, 12 Jul 2016 07:21:46 -0400 +Subject: media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open() + +From: Wei Yongjun + +[ Upstream commit 43d0d3c52787df0221d1c52494daabd824fe84f1 ] + +Add the missing clk_disable_unprepare() before return from +jpu_open() in the software reset error handling case. + +Signed-off-by: Wei Yongjun +Acked-by: Mikhail Ulyanov +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/rcar_jpu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/rcar_jpu.c ++++ b/drivers/media/platform/rcar_jpu.c +@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file) + /* ...issue software reset */ + ret = jpu_reset(jpu); + if (ret) +- goto device_prepare_rollback; ++ goto jpu_reset_rollback; + } + + jpu->ref_count++; +@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file) + mutex_unlock(&jpu->mutex); + return 0; + ++jpu_reset_rollback: ++ clk_disable_unprepare(jpu->clk); + device_prepare_rollback: + mutex_unlock(&jpu->mutex); + v4l_prepare_rollback: diff --git a/queue-4.14/media-saa7164-fix-driver-name-in-debug-output.patch b/queue-4.14/media-saa7164-fix-driver-name-in-debug-output.patch new file mode 100644 index 00000000000..8d4d0a7403d --- /dev/null +++ b/queue-4.14/media-saa7164-fix-driver-name-in-debug-output.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Brad Love +Date: Fri, 4 May 2018 17:53:35 -0400 +Subject: media: saa7164: Fix driver name in debug output + +From: Brad Love + +[ Upstream commit 0cc4655cb57af0b7e105d075c4f83f8046efafe7 ] + +This issue was reported by a user who downloaded a corrupt saa7164 +firmware, then went looking for a valid xc5000 firmware to fix the +error displayed...but the device in question has no xc5000, thus after +much effort, the wild goose chase eventually led to a support call. + +The xc5000 has nothing to do with saa7164 (as far as I can tell), +so replace the string with saa7164 as well as give a meaningful +hint on the firmware mismatch. + +Signed-off-by: Brad Love +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-fw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/pci/saa7164/saa7164-fw.c ++++ b/drivers/media/pci/saa7164/saa7164-fw.c +@@ -426,7 +426,8 @@ int saa7164_downloadfirmware(struct saa7 + __func__, fw->size); + + if (fw->size != fwlength) { +- printk(KERN_ERR "xc5000: firmware incorrect size\n"); ++ printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n", ++ fw->size, fwlength); + ret = -ENOMEM; + goto out; + } diff --git a/queue-4.14/media-si470x-fix-__be16-annotations.patch b/queue-4.14/media-si470x-fix-__be16-annotations.patch new file mode 100644 index 00000000000..3ee8e97990d --- /dev/null +++ b/queue-4.14/media-si470x-fix-__be16-annotations.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mauro Carvalho Chehab +Date: Fri, 6 Apr 2018 07:54:51 -0400 +Subject: media: si470x: fix __be16 annotations + +From: Mauro Carvalho Chehab + +[ Upstream commit 90db5c829692a0a7845e977e45719b4699216bd4 ] + +The annotations there are wrong as warned: + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: warning: incorrect type in assignment (different base types) + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: expected unsigned short [unsigned] [short] + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: got restricted __be16 [usertype] + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -92,7 +92,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS ma + */ + int si470x_get_register(struct si470x_device *radio, int regnr) + { +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -117,7 +117,7 @@ int si470x_get_register(struct si470x_de + int si470x_set_register(struct si470x_device *radio, int regnr) + { + int i; +- u16 buf[WRITE_REG_NUM]; ++ __be16 buf[WRITE_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -147,7 +147,7 @@ int si470x_set_register(struct si470x_de + static int si470x_get_all_registers(struct si470x_device *radio) + { + int i; +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, diff --git a/queue-4.14/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch b/queue-4.14/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch new file mode 100644 index 00000000000..14b17ec19aa --- /dev/null +++ b/queue-4.14/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mauro Carvalho Chehab +Date: Fri, 20 Apr 2018 08:32:16 -0400 +Subject: media: siano: get rid of __le32/__le16 cast warnings + +From: Mauro Carvalho Chehab + +[ Upstream commit e1b7f11b37def5f3021c06e8c2b4953e099357aa ] + +Those are all false-positives that appear with smatch when building for +arm: + + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + +Get rid of them by adding explicit forced casts. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/siano/smsendian.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/media/common/siano/smsendian.c ++++ b/drivers/media/common/siano/smsendian.c +@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *b + switch (msg->x_msg_header.msg_type) { + case MSG_SMS_DATA_DOWNLOAD_REQ: + { +- msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]); ++ msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0])); + break; + } + +@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *b + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *b + { + struct sms_version_res *ver = + (struct sms_version_res *) msg; +- ver->chip_model = le16_to_cpu(ver->chip_model); ++ ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model); + break; + } + +@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *b + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -95,9 +95,9 @@ void smsendian_handle_message_header(voi + #ifdef __BIG_ENDIAN + struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg; + +- phdr->msg_type = le16_to_cpu(phdr->msg_type); +- phdr->msg_length = le16_to_cpu(phdr->msg_length); +- phdr->msg_flags = le16_to_cpu(phdr->msg_flags); ++ phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type); ++ phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length); ++ phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags); + #endif /* __BIG_ENDIAN */ + } + EXPORT_SYMBOL_GPL(smsendian_handle_message_header); diff --git a/queue-4.14/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch b/queue-4.14/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch new file mode 100644 index 00000000000..c39e2b8010e --- /dev/null +++ b/queue-4.14/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Colin Ian King +Date: Wed, 25 Apr 2018 11:04:21 -0400 +Subject: media: smiapp: fix timeout checking in smiapp_read_nvm + +From: Colin Ian King + +[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ] + +The current code decrements the timeout counter i and the end of +each loop i is incremented, so the check for timeout will always +be false and hence the timeout mechanism is just a dead code path. +Potentially, if the RD_READY bit is not set, we could end up in +an infinite loop. + +Fix this so the timeout starts from 1000 and decrements to zero, +if at the end of the loop i is zero we have a timeout condition. + +Detected by CoverityScan, CID#1324008 ("Logically dead code") + +Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver") + +Signed-off-by: Colin Ian King +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/smiapp/smiapp-core.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp + if (rval) + goto out; + +- for (i = 0; i < 1000; i++) { ++ for (i = 1000; i > 0; i--) { + rval = smiapp_read( + sensor, + SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s); +@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp + if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY) + break; + +- if (--i == 0) { +- rval = -ETIMEDOUT; +- goto out; +- } +- ++ } ++ if (!i) { ++ rval = -ETIMEDOUT; ++ goto out; + } + + for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) { diff --git a/queue-4.14/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch b/queue-4.14/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch new file mode 100644 index 00000000000..8e5ce275058 --- /dev/null +++ b/queue-4.14/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Ezequiel Garcia +Date: Fri, 18 May 2018 17:07:48 -0400 +Subject: media: tw686x: Fix incorrect vb2_mem_ops GFP flags + +From: Ezequiel Garcia + +[ Upstream commit 636757ab6c93e19e2f58d3b3af1312e34eaffbab ] + +When the driver is configured in the "memcpy" dma-mode, +it uses vb2_vmalloc_memops, which is backed by a SLAB +allocator and so shouldn't be using GFP_DMA32. + +Fix it. + +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/tw686x/tw686x-video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/pci/tw686x/tw686x-video.c ++++ b/drivers/media/pci/tw686x/tw686x-video.c +@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev + vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; + vc->vidq.min_buffers_needed = 2; + vc->vidq.lock = &vc->vb_mutex; +- vc->vidq.gfp_flags = GFP_DMA32; ++ vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ? ++ GFP_DMA32 : 0; + vc->vidq.dev = &dev->pci_dev->dev; + + err = vb2_queue_init(&vc->vidq); diff --git a/queue-4.14/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch b/queue-4.14/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch new file mode 100644 index 00000000000..6ae2906d50f --- /dev/null +++ b/queue-4.14/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Hans Verkuil +Date: Mon, 21 May 2018 08:43:02 -0400 +Subject: media: videobuf2-core: don't call memop 'finish' when queueing + +From: Hans Verkuil + +[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ] + +When a buffer is queued or requeued in vb2_buffer_done, then don't +call the finish memop. In this case the buffer is only returned to vb2, +not to userspace. + +Calling 'finish' here will cause an unbalance when the queue is +canceled, since the core will call the same memop again. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/v4l2-core/videobuf2-core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -912,9 +912,12 @@ void vb2_buffer_done(struct vb2_buffer * + dprintk(4, "done processing on buffer %d, state: %d\n", + vb->index, state); + +- /* sync buffers */ +- for (plane = 0; plane < vb->num_planes; ++plane) +- call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ if (state != VB2_BUF_STATE_QUEUED && ++ state != VB2_BUF_STATE_REQUEUEING) { ++ /* sync buffers */ ++ for (plane = 0; plane < vb->num_planes; ++plane) ++ call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ } + + spin_lock_irqsave(&q->done_lock, flags); + if (state == VB2_BUF_STATE_QUEUED || diff --git a/queue-4.14/memory-tegra-apply-interrupts-mask-per-soc.patch b/queue-4.14/memory-tegra-apply-interrupts-mask-per-soc.patch new file mode 100644 index 00000000000..464dc0ff092 --- /dev/null +++ b/queue-4.14/memory-tegra-apply-interrupts-mask-per-soc.patch @@ -0,0 +1,161 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Dmitry Osipenko +Date: Mon, 9 Apr 2018 22:28:29 +0300 +Subject: memory: tegra: Apply interrupts mask per SoC + +From: Dmitry Osipenko + +[ Upstream commit 1c74d5c0de0c2cc29fef97a19251da2ad6f579bd ] + +Currently we are enabling handling of interrupts specific to Tegra124+ +which happen to overlap with previous generations. Let's specify +interrupts mask per SoC generation for consistency and in a preparation +of squashing of Tegra20 driver into the common one that will enable +handling of GART faults which may be undesirable by newer generations. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/tegra/mc.c | 21 +++------------------ + drivers/memory/tegra/mc.h | 9 +++++++++ + drivers/memory/tegra/tegra114.c | 2 ++ + drivers/memory/tegra/tegra124.c | 6 ++++++ + drivers/memory/tegra/tegra210.c | 3 +++ + drivers/memory/tegra/tegra30.c | 2 ++ + include/soc/tegra/mc.h | 2 ++ + 7 files changed, 27 insertions(+), 18 deletions(-) + +--- a/drivers/memory/tegra/mc.c ++++ b/drivers/memory/tegra/mc.c +@@ -20,14 +20,6 @@ + #include "mc.h" + + #define MC_INTSTATUS 0x000 +-#define MC_INT_DECERR_MTS (1 << 16) +-#define MC_INT_SECERR_SEC (1 << 13) +-#define MC_INT_DECERR_VPR (1 << 12) +-#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) +-#define MC_INT_INVALID_SMMU_PAGE (1 << 10) +-#define MC_INT_ARBITRATION_EMEM (1 << 9) +-#define MC_INT_SECURITY_VIOLATION (1 << 8) +-#define MC_INT_DECERR_EMEM (1 << 6) + + #define MC_INTMASK 0x004 + +@@ -248,13 +240,11 @@ static const char *const error_names[8] + static irqreturn_t tegra_mc_irq(int irq, void *data) + { + struct tegra_mc *mc = data; +- unsigned long status, mask; ++ unsigned long status; + unsigned int bit; + + /* mask all interrupts to avoid flooding */ +- mask = mc_readl(mc, MC_INTMASK); +- status = mc_readl(mc, MC_INTSTATUS) & mask; +- ++ status = mc_readl(mc, MC_INTSTATUS) & mc->soc->intmask; + if (!status) + return IRQ_NONE; + +@@ -349,7 +339,6 @@ static int tegra_mc_probe(struct platfor + const struct of_device_id *match; + struct resource *res; + struct tegra_mc *mc; +- u32 value; + int err; + + match = of_match_node(tegra_mc_of_match, pdev->dev.of_node); +@@ -417,11 +406,7 @@ static int tegra_mc_probe(struct platfor + + WARN(!mc->soc->client_id_mask, "Missing client ID mask for this SoC\n"); + +- value = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | +- MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | +- MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM; +- +- mc_writel(mc, value, MC_INTMASK); ++ mc_writel(mc, mc->soc->intmask, MC_INTMASK); + + return 0; + } +--- a/drivers/memory/tegra/mc.h ++++ b/drivers/memory/tegra/mc.h +@@ -14,6 +14,15 @@ + + #include + ++#define MC_INT_DECERR_MTS (1 << 16) ++#define MC_INT_SECERR_SEC (1 << 13) ++#define MC_INT_DECERR_VPR (1 << 12) ++#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) ++#define MC_INT_INVALID_SMMU_PAGE (1 << 10) ++#define MC_INT_ARBITRATION_EMEM (1 << 9) ++#define MC_INT_SECURITY_VIOLATION (1 << 8) ++#define MC_INT_DECERR_EMEM (1 << 6) ++ + static inline u32 mc_readl(struct tegra_mc *mc, unsigned long offset) + { + return readl(mc->regs + offset); +--- a/drivers/memory/tegra/tegra114.c ++++ b/drivers/memory/tegra/tegra114.c +@@ -930,4 +930,6 @@ const struct tegra_mc_soc tegra114_mc_so + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra114_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +--- a/drivers/memory/tegra/tegra124.c ++++ b/drivers/memory/tegra/tegra124.c +@@ -1020,6 +1020,9 @@ const struct tegra_mc_soc tegra124_mc_so + .smmu = &tegra124_smmu_soc, + .emem_regs = tegra124_mc_emem_regs, + .num_emem_regs = ARRAY_SIZE(tegra124_mc_emem_regs), ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_124_SOC */ + +@@ -1042,5 +1045,8 @@ const struct tegra_mc_soc tegra132_mc_so + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra132_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_132_SOC */ +--- a/drivers/memory/tegra/tegra210.c ++++ b/drivers/memory/tegra/tegra210.c +@@ -1077,4 +1077,7 @@ const struct tegra_mc_soc tegra210_mc_so + .atom_size = 64, + .client_id_mask = 0xff, + .smmu = &tegra210_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; +--- a/drivers/memory/tegra/tegra30.c ++++ b/drivers/memory/tegra/tegra30.c +@@ -952,4 +952,6 @@ const struct tegra_mc_soc tegra30_mc_soc + .atom_size = 16, + .client_id_mask = 0x7f, + .smmu = &tegra30_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +--- a/include/soc/tegra/mc.h ++++ b/include/soc/tegra/mc.h +@@ -99,6 +99,8 @@ struct tegra_mc_soc { + u8 client_id_mask; + + const struct tegra_smmu_soc *smmu; ++ ++ u32 intmask; + }; + + struct tegra_mc { diff --git a/queue-4.14/memory-tegra-do-not-handle-spurious-interrupts.patch b/queue-4.14/memory-tegra-do-not-handle-spurious-interrupts.patch new file mode 100644 index 00000000000..5907881ac5b --- /dev/null +++ b/queue-4.14/memory-tegra-do-not-handle-spurious-interrupts.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Dmitry Osipenko +Date: Mon, 9 Apr 2018 22:28:27 +0300 +Subject: memory: tegra: Do not handle spurious interrupts + +From: Dmitry Osipenko + +[ Upstream commit bf3fbdfbec947cdd04b2f2c4bce11534c8786eee ] + +The ISR reads interrupts-enable mask, but doesn't utilize it. Apply the +mask to the interrupt status and don't handle interrupts that MC driver +haven't asked for. Kernel would disable spurious MC IRQ and report the +error. This would happen only in a case of a very severe bug. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/tegra/mc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/memory/tegra/mc.c ++++ b/drivers/memory/tegra/mc.c +@@ -252,8 +252,11 @@ static irqreturn_t tegra_mc_irq(int irq, + unsigned int bit; + + /* mask all interrupts to avoid flooding */ +- status = mc_readl(mc, MC_INTSTATUS); + mask = mc_readl(mc, MC_INTMASK); ++ status = mc_readl(mc, MC_INTSTATUS) & mask; ++ ++ if (!status) ++ return IRQ_NONE; + + for_each_set_bit(bit, &status, 32) { + const char *error = status_names[bit] ?: "unknown"; diff --git a/queue-4.14/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch b/queue-4.14/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch new file mode 100644 index 00000000000..a6b08b2fd77 --- /dev/null +++ b/queue-4.14/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Vincent Palatin +Date: Wed, 18 Apr 2018 12:23:58 +0200 +Subject: mfd: cros_ec: Fail early if we cannot identify the EC + +From: Vincent Palatin + +[ Upstream commit 0dbbf25561b29ffab5ba6277429760abdf49ceff ] + +If we cannot communicate with the EC chip to detect the protocol version +and its features, it's very likely useless to continue. Else we will +commit all kind of uninformed mistakes (using the wrong protocol, the +wrong buffer size, mixing the EC with other chips). + +Signed-off-by: Vincent Palatin +Acked-by: Benson Leung +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Gwendal Grignou +Reviewed-by: Andy Shevchenko +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/cros_ec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/cros_ec.c ++++ b/drivers/mfd/cros_ec.c +@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_devi + + mutex_init(&ec_dev->lock); + +- cros_ec_query_all(ec_dev); ++ err = cros_ec_query_all(ec_dev); ++ if (err) { ++ dev_err(dev, "Cannot identify the EC: error %d\n", err); ++ return err; ++ } + + if (ec_dev->irq) { + err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread, diff --git a/queue-4.14/microblaze-fix-simpleimage-format-generation.patch b/queue-4.14/microblaze-fix-simpleimage-format-generation.patch new file mode 100644 index 00000000000..aac247a1608 --- /dev/null +++ b/queue-4.14/microblaze-fix-simpleimage-format-generation.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Michal Simek +Date: Tue, 10 Apr 2018 15:05:42 +0200 +Subject: microblaze: Fix simpleImage format generation + +From: Michal Simek + +[ Upstream commit ece97f3a5fb50cf5f98886fbc63c9665f2bb199d ] + +simpleImage generation was broken for some time. This patch is fixing +steps how simpleImage.*.ub file is generated. Steps are objdump of +vmlinux and create .ub. +Also make sure that there is striped elf version with .strip suffix. + +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/microblaze/boot/Makefile | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/microblaze/boot/Makefile ++++ b/arch/microblaze/boot/Makefile +@@ -22,17 +22,19 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FO + quiet_cmd_cp = CP $< $@$2 + cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) + +-quiet_cmd_strip = STRIP $@ ++quiet_cmd_strip = STRIP $< $@$2 + cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \ +- -K _fdt_start vmlinux -o $@ ++ -K _fdt_start $< -o $@$2 + + UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR) ++UIMAGE_IN = $@ ++UIMAGE_OUT = $@.ub + + $(obj)/simpleImage.%: vmlinux FORCE + $(call if_changed,cp,.unstrip) + $(call if_changed,objcopy) + $(call if_changed,uimage) +- $(call if_changed,strip) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' ++ $(call if_changed,strip,.strip) ++ @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' + + clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb diff --git a/queue-4.14/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch b/queue-4.14/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch new file mode 100644 index 00000000000..61a610da41f --- /dev/null +++ b/queue-4.14/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Petr Machata +Date: Fri, 15 Jun 2018 16:23:38 +0300 +Subject: mlxsw: spectrum_switchdev: Fix port_vlan refcounting + +From: Petr Machata + +[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ] + +Switchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are +distributed not only on clean addition, but also when flags on an +existing VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls +mlxsw_sp_port_vlan_get() to get at the port_vlan in question, which +implicitly references the object. This then leads to discrepancies in +reference counting when the VLAN is removed. spectrum.c warns about the +problem when the module is removed: + +[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum] +[...] +[13578.627106] Call Trace: +[13578.629617] mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum] +[13578.634748] mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core] +[13578.641290] mlxsw_pci_remove+0x13/0x40 [mlxsw_pci] +[13578.646238] pci_device_remove+0x31/0xb0 +[13578.650244] device_release_driver_internal+0x14f/0x220 +[13578.655562] driver_detach+0x32/0x70 +[13578.659183] bus_remove_driver+0x47/0xa0 +[13578.663134] pci_unregister_driver+0x1e/0x80 +[13578.667486] mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum] +[13578.673207] __x64_sys_delete_module+0x13b/0x1e0 +[13578.677888] ? exit_to_usermode_loop+0x78/0x80 +[13578.682374] do_syscall_64+0x39/0xe0 +[13578.685976] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join() +determines it's a flag-only change. + +Fixes: b3529af6bb0d ("spectrum: Reference count VLAN entries") +Signed-off-by: Petr Machata +Acked-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -912,8 +912,10 @@ mlxsw_sp_port_vlan_bridge_join(struct ml + int err; + + /* No need to continue if only VLAN flags were changed */ +- if (mlxsw_sp_port_vlan->bridge_port) ++ if (mlxsw_sp_port_vlan->bridge_port) { ++ mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan); + return 0; ++ } + + err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port); + if (err) diff --git a/queue-4.14/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch b/queue-4.14/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch new file mode 100644 index 00000000000..6156dc6d287 --- /dev/null +++ b/queue-4.14/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch @@ -0,0 +1,93 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Huang Ying +Date: Thu, 7 Jun 2018 17:07:39 -0700 +Subject: mm: /proc/pid/pagemap: hide swap entries from unprivileged users + +From: Huang Ying + +[ Upstream commit ab6ecf247a9321e3180e021a6a60164dee53ab2e ] + +In commit ab676b7d6fbf ("pagemap: do not leak physical addresses to +non-privileged userspace"), the /proc/PID/pagemap is restricted to be +readable only by CAP_SYS_ADMIN to address some security issue. + +In commit 1c90308e7a77 ("pagemap: hide physical addresses from +non-privileged users"), the restriction is relieved to make +/proc/PID/pagemap readable, but hide the physical addresses for +non-privileged users. + +But the swap entries are readable for non-privileged users too. This +has some security issues. For example, for page under migrating, the +swap entry has physical address information. So, in this patch, the +swap entries are hided for non-privileged users too. + +Link: http://lkml.kernel.org/r/20180508012745.7238-1-ying.huang@intel.com +Fixes: 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users") +Signed-off-by: "Huang, Ying" +Suggested-by: Kirill A. Shutemov +Reviewed-by: Naoya Horiguchi +Reviewed-by: Konstantin Khlebnikov +Acked-by: Michal Hocko +Cc: Konstantin Khlebnikov +Cc: Andrei Vagin +Cc: Jerome Glisse +Cc: Daniel Colascione +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/task_mmu.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1275,8 +1275,9 @@ static pagemap_entry_t pte_to_pagemap_en + if (pte_swp_soft_dirty(pte)) + flags |= PM_SOFT_DIRTY; + entry = pte_to_swp_entry(pte); +- frame = swp_type(entry) | +- (swp_offset(entry) << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) ++ frame = swp_type(entry) | ++ (swp_offset(entry) << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; + if (is_migration_entry(entry)) + page = migration_entry_to_page(entry); +@@ -1327,11 +1328,14 @@ static int pagemap_pmd_range(pmd_t *pmdp + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { + swp_entry_t entry = pmd_to_swp_entry(pmd); +- unsigned long offset = swp_offset(entry); ++ unsigned long offset; + +- offset += (addr & ~PMD_MASK) >> PAGE_SHIFT; +- frame = swp_type(entry) | +- (offset << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ offset = swp_offset(entry) + ++ ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ frame = swp_type(entry) | ++ (offset << MAX_SWAPFILES_SHIFT); ++ } + flags |= PM_SWAP; + if (pmd_swp_soft_dirty(pmd)) + flags |= PM_SOFT_DIRTY; +@@ -1349,10 +1353,12 @@ static int pagemap_pmd_range(pmd_t *pmdp + err = add_to_pagemap(addr, &pme, pm); + if (err) + break; +- if (pm->show_pfn && (flags & PM_PRESENT)) +- frame++; +- else if (flags & PM_SWAP) +- frame += (1 << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ if (flags & PM_PRESENT) ++ frame++; ++ else if (flags & PM_SWAP) ++ frame += (1 << MAX_SWAPFILES_SHIFT); ++ } + } + spin_unlock(ptl); + return err; diff --git a/queue-4.14/mm-slub.c-add-__printf-verification-to-slab_err.patch b/queue-4.14/mm-slub.c-add-__printf-verification-to-slab_err.patch new file mode 100644 index 00000000000..dfb4f915fd1 --- /dev/null +++ b/queue-4.14/mm-slub.c-add-__printf-verification-to-slab_err.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 7 Jun 2018 17:05:17 -0700 +Subject: mm/slub.c: add __printf verification to slab_err() + +From: Mathieu Malaterre + +[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ] + +__printf is useful to verify format and arguments. Remove the following +warning (with W=1): + + mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format] + +Link: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org +Signed-off-by: Mathieu Malaterre +Reviewed-by: Andrew Morton +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: David Rientjes +Cc: Joonsoo Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/slub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -708,7 +708,7 @@ void object_err(struct kmem_cache *s, st + print_trailer(s, page, object); + } + +-static void slab_err(struct kmem_cache *s, struct page *page, ++static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, + const char *fmt, ...) + { + va_list args; diff --git a/queue-4.14/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch b/queue-4.14/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch new file mode 100644 index 00000000000..232a19ae43d --- /dev/null +++ b/queue-4.14/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch @@ -0,0 +1,64 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chintan Pandya +Date: Thu, 7 Jun 2018 17:06:50 -0700 +Subject: mm: vmalloc: avoid racy handling of debugobjects in vunmap + +From: Chintan Pandya + +[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ] + +Currently, __vunmap flow is, + 1) Release the VM area + 2) Free the debug objects corresponding to that vm area. + +This leave some race window open. + 1) Release the VM area + 1.5) Some other client gets the same vm area + 1.6) This client allocates new debug objects on the same + vm area + 2) Free the debug objects corresponding to this vm area. + +Here, we actually free 'other' client's debug objects. + +Fix this by freeing the debug objects first and then releasing the VM +area. + +Link: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org +Signed-off-by: Chintan Pandya +Reviewed-by: Andrew Morton +Cc: Ard Biesheuvel +Cc: Byungchul Park +Cc: Catalin Marinas +Cc: Florian Fainelli +Cc: Johannes Weiner +Cc: Laura Abbott +Cc: Vlastimil Babka +Cc: Wei Yang +Cc: Yisheng Xie +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/vmalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, i + addr)) + return; + +- area = remove_vm_area(addr); ++ area = find_vmap_area((unsigned long)addr)->vm; + if (unlikely(!area)) { + WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n", + addr); +@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, i + debug_check_no_locks_freed(addr, get_vm_area_size(area)); + debug_check_no_obj_freed(addr, get_vm_area_size(area)); + ++ remove_vm_area(addr); + if (deallocate_pages) { + int i; + diff --git a/queue-4.14/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch b/queue-4.14/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch new file mode 100644 index 00000000000..8b7a37e77b2 --- /dev/null +++ b/queue-4.14/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Shawn Lin +Date: Mon, 26 Mar 2018 17:26:25 +0800 +Subject: mmc: dw_mmc: update actual clock for mmc debugfs + +From: Shawn Lin + +[ Upstream commit ff178981bd5fd1667f373098740cb1c6d6efa1ba ] + +Respect the actual clock for mmc debugfs to help better debug +the hardware. + +mmc_host mmc0: Bus speed (slot 0) = 135475200Hz (slot req 150000000Hz, +actual 135475200HZ div = 0) + +cat /sys/kernel/debug/mmc0/ios +clock: 150000000 Hz +actual clock: 135475200 Hz +vdd: 21 (3.3 ~ 3.4 V) +bus mode: 2 (push-pull) +chip select: 0 (don't care) +power mode: 2 (on) +bus width: 3 (8 bits) +timing spec: 9 (mmc HS200) +signal voltage: 0 (1.80 V) +driver type: 0 (driver type B) + +Cc: Xiao Yao +Cc: Ziyuan +Signed-off-by: Shawn Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/dw_mmc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -1255,6 +1255,8 @@ static void dw_mci_setup_bus(struct dw_m + if (host->state == STATE_WAITING_CMD11_DONE) + sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH; + ++ slot->mmc->actual_clock = 0; ++ + if (!clock) { + mci_writel(host, CLKENA, 0); + mci_send_cmd(slot, sdmmc_cmd_bits, 0); +@@ -1313,6 +1315,8 @@ static void dw_mci_setup_bus(struct dw_m + + /* keep the last clock value that was requested from core */ + slot->__clk_old = clock; ++ slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) : ++ host->bus_hz; + } + + host->current_speed = clock; diff --git a/queue-4.14/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch b/queue-4.14/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch new file mode 100644 index 00000000000..a3a2d614220 --- /dev/null +++ b/queue-4.14/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Tobin C. Harding" +Date: Mon, 26 Mar 2018 17:33:14 +1100 +Subject: mmc: pwrseq: Use kmalloc_array instead of stack VLA + +From: "Tobin C. Harding" + +[ Upstream commit 486e6661367b40f927aadbed73237693396cbf94 ] + +The use of stack Variable Length Arrays needs to be avoided, as they +can be a vector for stack exhaustion, which can be both a runtime bug +(kernel Oops) or a security flaw (overwriting memory beyond the +stack). Also, in general, as code evolves it is easy to lose track of +how big a VLA can get. Thus, we can end up having runtime failures +that are hard to debug. As part of the directive[1] to remove all VLAs +from the kernel, and build with -Wvla. + +Currently driver is using a VLA declared using the number of descriptors. This +array is used to store integer values and is later used as an argument to +`gpiod_set_array_value_cansleep()` This can be avoided by using +`kmalloc_array()` to allocate memory for the array of integer values. Memory is +free'd before return from function. + +>From the code it appears that it is safe to sleep so we can use GFP_KERNEL +(based _cansleep() suffix of function `gpiod_set_array_value_cansleep()`. + +It can be expected that this patch will result in a small increase in overhead +due to the use of `kmalloc_array()` + +[1] https://lkml.org/lkml/2018/3/7/621 + +Signed-off-by: Tobin C. Harding +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/pwrseq_simple.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/core/pwrseq_simple.c ++++ b/drivers/mmc/core/pwrseq_simple.c +@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_ + struct gpio_descs *reset_gpios = pwrseq->reset_gpios; + + if (!IS_ERR(reset_gpios)) { +- int i; +- int values[reset_gpios->ndescs]; ++ int i, *values; ++ int nvalues = reset_gpios->ndescs; + +- for (i = 0; i < reset_gpios->ndescs; i++) ++ values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL); ++ if (!values) ++ return; ++ ++ for (i = 0; i < nvalues; i++) + values[i] = value; + +- gpiod_set_array_value_cansleep( +- reset_gpios->ndescs, reset_gpios->desc, values); ++ gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values); ++ kfree(values); + } + } + diff --git a/queue-4.14/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch b/queue-4.14/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch new file mode 100644 index 00000000000..ca35bbb79ee --- /dev/null +++ b/queue-4.14/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jane Wan +Date: Tue, 8 May 2018 14:19:53 -0700 +Subject: mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages + +From: Jane Wan + +[ Upstream commit a75bbe71a27875fdc61cde1af6d799037cef6bed ] + +Per ONFI specification (Rev. 4.0), if the CRC of the first parameter page +read is not valid, the host should read redundant parameter page copies. +Fix FSL NAND driver to read the two redundant copies which are mandatory +in the specification. + +Signed-off-by: Jane Wan +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/fsl_ifc_nand.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -342,9 +342,16 @@ static void fsl_ifc_cmdfunc(struct mtd_i + + case NAND_CMD_READID: + case NAND_CMD_PARAM: { ++ /* ++ * For READID, read 8 bytes that are currently used. ++ * For PARAM, read all 3 copies of 256-bytes pages. ++ */ ++ int len = 8; + int timing = IFC_FIR_OP_RB; +- if (command == NAND_CMD_PARAM) ++ if (command == NAND_CMD_PARAM) { + timing = IFC_FIR_OP_RBCD; ++ len = 256 * 3; ++ } + + ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | + (IFC_FIR_OP_UA << IFC_NAND_FIR0_OP1_SHIFT) | +@@ -354,12 +361,8 @@ static void fsl_ifc_cmdfunc(struct mtd_i + &ifc->ifc_nand.nand_fcr0); + ifc_out32(column, &ifc->ifc_nand.row3); + +- /* +- * although currently it's 8 bytes for READID, we always read +- * the maximum 256 bytes(for PARAM) +- */ +- ifc_out32(256, &ifc->ifc_nand.nand_fbcr); +- ifc_nand_ctrl->read_bytes = 256; ++ ifc_out32(len, &ifc->ifc_nand.nand_fbcr); ++ ifc_nand_ctrl->read_bytes = len; + + set_addr(mtd, 0, 0, 0); + fsl_ifc_run_command(mtd); diff --git a/queue-4.14/mwifiex-correct-histogram-data-with-appropriate-index.patch b/queue-4.14/mwifiex-correct-histogram-data-with-appropriate-index.patch new file mode 100644 index 00000000000..8d7f608720b --- /dev/null +++ b/queue-4.14/mwifiex-correct-histogram-data-with-appropriate-index.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Xinming Hu +Date: Fri, 18 May 2018 15:38:54 +0800 +Subject: mwifiex: correct histogram data with appropriate index + +From: Xinming Hu + +[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ] + +Correct snr/nr/rssi data index to avoid possible buffer underflow. + +Signed-off-by: Xinming Hu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/util.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifie + s8 nflr) + { + struct mwifiex_histogram_data *phist_data = priv->hist_data; ++ s8 nf = -nflr; ++ s8 rssi = snr - nflr; + + atomic_inc(&phist_data->num_samples); + atomic_inc(&phist_data->rx_rate[rx_rate]); +- atomic_inc(&phist_data->snr[snr]); +- atomic_inc(&phist_data->noise_flr[128 + nflr]); +- atomic_inc(&phist_data->sig_str[nflr - snr]); ++ atomic_inc(&phist_data->snr[snr + 128]); ++ atomic_inc(&phist_data->noise_flr[nf + 128]); ++ atomic_inc(&phist_data->sig_str[rssi + 128]); + } + + /* function to reset histogram data during init/reset */ diff --git a/queue-4.14/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch b/queue-4.14/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch new file mode 100644 index 00000000000..3d50dc27ae8 --- /dev/null +++ b/queue-4.14/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Ganapathi Bhat +Date: Thu, 24 May 2018 19:18:27 +0530 +Subject: mwifiex: handle race during mwifiex_usb_disconnect + +From: Ganapathi Bhat + +[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ] + +Race condition is observed during rmmod of mwifiex_usb: + +1. The rmmod thread will call mwifiex_usb_disconnect(), download + SHUTDOWN command and do wait_event_interruptible_timeout(), + waiting for response. + +2. The main thread will handle the response and will do a + wake_up_interruptible(), unblocking rmmod thread. + +3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in + mwifiex_usb_free(). + +4. The main thread will try to resubmit rx_cmd.urb in + mwifiex_usb_submit_rx_urb(), which is NULL. + +To fix, wait for main thread to complete before calling +mwifiex_usb_free(). + +Signed-off-by: Ganapathi Bhat +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc + MWIFIEX_FUNC_SHUTDOWN); + } + ++ if (adapter->workqueue) ++ flush_workqueue(adapter->workqueue); ++ + mwifiex_usb_free(card); + + mwifiex_dbg(adapter, FATAL, diff --git a/queue-4.14/net-dsa-qca8k-add-support-for-qca8334-switch.patch b/queue-4.14/net-dsa-qca8k-add-support-for-qca8334-switch.patch new file mode 100644 index 00000000000..cf203d07f94 --- /dev/null +++ b/queue-4.14/net-dsa-qca8k-add-support-for-qca8334-switch.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Michal Vokáč" +Date: Wed, 23 May 2018 08:20:19 +0200 +Subject: net: dsa: qca8k: Add support for QCA8334 switch + +From: "Michal Vokáč" + +[ Upstream commit 64cf81675a1f64c1b311e4611dd3b6a961607612 ] + +Add support for the four-port variant of the Qualcomm QCA833x switch. + +Signed-off-by: Michal Vokáč +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/qca8k.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -934,6 +934,7 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops, + qca8k_suspend, qca8k_resume); + + static const struct of_device_id qca8k_of_match[] = { ++ { .compatible = "qca,qca8334" }, + { .compatible = "qca,qca8337" }, + { /* sentinel */ }, + }; diff --git a/queue-4.14/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch b/queue-4.14/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch new file mode 100644 index 00000000000..6ec6ef094cb --- /dev/null +++ b/queue-4.14/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Grygorii Strashko +Date: Tue, 15 May 2018 18:37:25 -0500 +Subject: net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value + +From: Grygorii Strashko + +[ Upstream commit c6213eb1aee308e67377fd1890d84f7284caf531 ] + +This fixes klockworks warnings: Pointer 'dev' returned from call to +function 'bus_find_device' at line 179 may be NULL and will be dereferenced +at line 181. + + cpsw-phy-sel.c:179: 'dev' is assigned the return value from function 'bus_find_device'. + bus.c:342: 'bus_find_device' explicitly returns a NULL value. + cpsw-phy-sel.c:181: 'dev' is dereferenced by passing argument 1 to function 'dev_get_drvdata'. + device.h:1024: 'dev' is passed to function 'dev_get_drvdata'. + device.h:1026: 'dev' is explicitly dereferenced. + +Signed-off-by: Grygorii Strashko +[nsekhar@ti.com: add an error message, fix return path] +Signed-off-by: Sekhar Nori +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw-phy-sel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c ++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c +@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, ph + } + + dev = bus_find_device(&platform_bus_type, NULL, node, match); +- of_node_put(node); ++ if (!dev) { ++ dev_err(dev, "unable to find platform device for %pOF\n", node); ++ goto out; ++ } ++ + priv = dev_get_drvdata(dev); + + priv->cpsw_phy_sel(priv, phy_mode, slave); + + put_device(dev); ++out: ++ of_node_put(node); + } + EXPORT_SYMBOL_GPL(cpsw_phy_sel); + diff --git a/queue-4.14/net-hns3-fix-the-missing-client-list-node-initialization.patch b/queue-4.14/net-hns3-fix-the-missing-client-list-node-initialization.patch new file mode 100644 index 00000000000..4b95d653f41 --- /dev/null +++ b/queue-4.14/net-hns3-fix-the-missing-client-list-node-initialization.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Xi Wang +Date: Sat, 19 May 2018 16:53:18 +0100 +Subject: net: hns3: Fix the missing client list node initialization + +From: Xi Wang + +[ Upstream commit 13562d1f5e2fbe2cf33b23a00abca3f71264c4ac ] + +This patch fixes the missing initialization of the client list node +in the hnae3_register_client() function. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Xi Wang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +@@ -2883,6 +2883,8 @@ static int __init hns3_init_module(void) + + client.ops = &client_ops; + ++ INIT_LIST_HEAD(&client.node); ++ + ret = hnae3_register_client(&client); + if (ret) + return ret; diff --git a/queue-4.14/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch b/queue-4.14/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch new file mode 100644 index 00000000000..e196bb664d6 --- /dev/null +++ b/queue-4.14/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Fuyun Liang +Date: Fri, 25 May 2018 19:43:02 +0100 +Subject: net: hns3: Fixes the init of the VALID BD info in the descriptor + +From: Fuyun Liang + +[ Upstream commit 7d0b130cbbfa4651cc1ab9268a2956c1b9d82ff9 ] + +RX Buffer Descriptor contains a VALID bit which indicates if the BD +is valid and has some data. This field is set by HNS3 hardware to +intimate the driver of some valid data present in the BD. nd should +be reset by the driver when BD is being used again. In the existing +code this bit was not being (re-)initialized properly and hence was +causing problems. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Fuyun Liang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +@@ -1598,6 +1598,7 @@ static void hns3_replace_buffer(struct h + hns3_unmap_buffer(ring, &ring->desc_cb[i]); + ring->desc_cb[i] = *res_cb; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) +@@ -1605,6 +1606,7 @@ static void hns3_reuse_buffer(struct hns + ring->desc_cb[i].reuse_flag = 0; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma + + ring->desc_cb[i].page_offset); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes, diff --git a/queue-4.14/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch b/queue-4.14/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch new file mode 100644 index 00000000000..881bb3711f1 --- /dev/null +++ b/queue-4.14/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Huazhong Tan +Date: Tue, 1 May 2018 19:55:59 +0100 +Subject: net: hns3: Fixes the out of bounds access in hclge_map_tqp + +From: Huazhong Tan + +[ Upstream commit 38e62046d4c95272e2fb001d2d72baf48fa090e9 ] + +This patch fixes the handling of the check when number of vports +are detected to be more than available TPQs. Current handling causes +an out of bounds access in hclge_map_tqp(). + +Fixes: 7df7dad633e2 ("net: hns3: Refactor the mapping of tqp to vport") +Signed-off-by: Huazhong Tan +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -1272,8 +1272,11 @@ static int hclge_alloc_vport(struct hclg + /* We need to alloc a vport for main NIC of PF */ + num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1; + +- if (hdev->num_tqps < num_vport) +- num_vport = hdev->num_tqps; ++ if (hdev->num_tqps < num_vport) { ++ dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)", ++ hdev->num_tqps, num_vport); ++ return -EINVAL; ++ } + + /* Alloc the same number of TQPs for every vport */ + tqp_per_vport = hdev->num_tqps / num_vport; diff --git a/queue-4.14/net-phy-phylink-release-link-gpio.patch b/queue-4.14/net-phy-phylink-release-link-gpio.patch new file mode 100644 index 00000000000..8b8b7a861c0 --- /dev/null +++ b/queue-4.14/net-phy-phylink-release-link-gpio.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Florian Fainelli +Date: Thu, 10 May 2018 13:17:30 -0700 +Subject: net: phy: phylink: Release link GPIO + +From: Florian Fainelli + +[ Upstream commit daab3349ad1a69663ccad278ed71d55974d104b4 ] + +We are not releasing the link GPIO descriptor with gpiod_put() which results in +subsequent probing to get -EBUSY when calling fwnode_get_named_gpiod(). Fix this +by doing the release in phylink_destroy(). + +Fixes: 9525ae83959b ("phylink: add phylink infrastructure") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phylink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -561,6 +561,8 @@ void phylink_destroy(struct phylink *pl) + { + if (pl->sfp_bus) + sfp_unregister_upstream(pl->sfp_bus); ++ if (!IS_ERR(pl->link_gpio)) ++ gpiod_put(pl->link_gpio); + + cancel_work_sync(&pl->resolve); + kfree(pl); diff --git a/queue-4.14/netfilter-ipset-forbid-family-for-hash-mac-sets.patch b/queue-4.14/netfilter-ipset-forbid-family-for-hash-mac-sets.patch new file mode 100644 index 00000000000..e81009762f7 --- /dev/null +++ b/queue-4.14/netfilter-ipset-forbid-family-for-hash-mac-sets.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Florent Fourcot +Date: Mon, 4 Jun 2018 16:51:19 +0200 +Subject: netfilter: ipset: forbid family for hash:mac sets + +From: Florent Fourcot + +[ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ] + +Userspace `ipset` command forbids family option for hash:mac type: + +ipset create test hash:mac family inet4 +ipset v6.30: Unknown argument: `family' + +However, this check is not done in kernel itself. When someone use +external netlink applications (pyroute2 python library for example), one +can create hash:mac with invalid family and inconsistant results from +userspace (`ipset` command cannot read set content anymore). + +This patch enforce the logic in kernel, and forbids insertion of +hash:mac with a family set. + +Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no +impact on other hash:* sets + +Signed-off-by: Florent Fourcot +Signed-off-by: Victorien Molle +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -1241,7 +1241,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net * + pr_debug("Create set %s with family %s\n", + set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6"); + +-#ifndef IP_SET_PROTO_UNDEF ++#ifdef IP_SET_PROTO_UNDEF ++ if (set->family != NFPROTO_UNSPEC) ++ return -IPSET_ERR_INVALID_FAMILY; ++#else + if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6)) + return -IPSET_ERR_INVALID_FAMILY; + #endif diff --git a/queue-4.14/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch b/queue-4.14/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch new file mode 100644 index 00000000000..236f6bebe22 --- /dev/null +++ b/queue-4.14/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jozsef Kadlecsik +Date: Thu, 31 May 2018 18:45:21 +0200 +Subject: netfilter: ipset: List timing out entries with "timeout 1" instead of zero + +From: Jozsef Kadlecsik + +[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ] + +When listing sets with timeout support, there's a probability that +just timing out entries with "0" timeout value is listed/saved. +However when restoring the saved list, the zero timeout value means +permanent elelements. + +The new behaviour is that timing out entries are listed with "timeout 1" +instead of zero. + +Fixes netfilter bugzilla #1258. + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netfilter/ipset/ip_set_timeout.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/include/linux/netfilter/ipset/ip_set_timeout.h ++++ b/include/linux/netfilter/ipset/ip_set_timeout.h +@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeou + static inline u32 + ip_set_timeout_get(const unsigned long *timeout) + { +- return *timeout == IPSET_ELEM_PERMANENT ? 0 : +- jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ u32 t; ++ ++ if (*timeout == IPSET_ELEM_PERMANENT) ++ return 0; ++ ++ t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ /* Zero value in userspace means no timeout */ ++ return t == 0 ? 1 : t; + } + + #endif /* __KERNEL__ */ diff --git a/queue-4.14/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch b/queue-4.14/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch new file mode 100644 index 00000000000..f4e7d9a6fbe --- /dev/null +++ b/queue-4.14/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch @@ -0,0 +1,142 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexey Kodanev +Date: Thu, 31 May 2018 19:53:33 +0300 +Subject: netfilter: nf_tables: check msg_type before nft_trans_set(trans) + +From: Alexey Kodanev + +[ Upstream commit 9c7f96fd77b0dbe1fe7ed1f9c462c45dc48a1076 ] + +The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before +using nft_trans_set(trans). Otherwise we can get out of bounds read. + +For example, KASAN reported the one when running 0001_cache_handling_0 nft +test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE: + +[75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356 +... +[75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G E 4.17.0-rc7.1.x86_64 #1 +[75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2 +[75517.618129] Call Trace: +[75517.648821] dump_stack+0xd1/0x13b +[75517.691040] ? show_regs_print_info+0x5/0x5 +[75517.742519] ? kmsg_dump_rewind_nolock+0xf5/0xf5 +[75517.799300] ? lock_acquire+0x143/0x310 +[75517.846738] print_address_description+0x85/0x3a0 +[75517.904547] kasan_report+0x18d/0x4b0 +[75517.949892] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.019153] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.088420] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.157689] nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.224869] nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables] +[75518.291024] ? nft_add_set_elem+0x2280/0x2280 [nf_tables] +[75518.357154] ? nla_parse+0x1a5/0x300 +[75518.401455] ? kasan_kmalloc+0xa6/0xd0 +[75518.447842] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] +[75518.507743] ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink] +[75518.569745] ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink] +[75518.631711] ? lock_acquire+0x143/0x310 +[75518.679133] ? netlink_deliver_tap+0x9b/0x1070 +[75518.733840] ? kasan_unpoison_shadow+0x31/0x40 +[75518.788542] netlink_unicast+0x45d/0x680 +[75518.837111] ? __isolate_free_page+0x890/0x890 +[75518.891913] ? netlink_attachskb+0x6b0/0x6b0 +[75518.944542] netlink_sendmsg+0x6fa/0xd30 +[75518.993107] ? netlink_unicast+0x680/0x680 +[75519.043758] ? netlink_unicast+0x680/0x680 +[75519.094402] sock_sendmsg+0xd9/0x160 +[75519.138810] ___sys_sendmsg+0x64d/0x980 +[75519.186234] ? copy_msghdr_from_user+0x350/0x350 +[75519.243118] ? lock_downgrade+0x650/0x650 +[75519.292738] ? do_raw_spin_unlock+0x5d/0x250 +[75519.345456] ? _raw_spin_unlock+0x24/0x30 +[75519.395065] ? __handle_mm_fault+0xbde/0x3410 +[75519.448830] ? sock_setsockopt+0x3d2/0x1940 +[75519.500516] ? __lock_acquire.isra.25+0xdc/0x19d0 +[75519.558448] ? lock_downgrade+0x650/0x650 +[75519.608057] ? __audit_syscall_entry+0x317/0x720 +[75519.664960] ? __fget_light+0x58/0x250 +[75519.711325] ? __sys_sendmsg+0xde/0x170 +[75519.758850] __sys_sendmsg+0xde/0x170 +[75519.804193] ? __ia32_sys_shutdown+0x90/0x90 +[75519.856725] ? syscall_trace_enter+0x897/0x10e0 +[75519.912354] ? trace_event_raw_event_sys_enter+0x920/0x920 +[75519.979432] ? __audit_syscall_entry+0x720/0x720 +[75520.036118] do_syscall_64+0xa3/0x3d0 +[75520.081248] ? prepare_exit_to_usermode+0x47/0x1d0 +[75520.139904] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[75520.201680] RIP: 0033:0x7fc153320ba0 +[75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0 +[75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003 +[75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090 +[75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660 +[75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001 + +[75520.790946] Allocated by task 7356: +[75520.833994] kasan_kmalloc+0xa6/0xd0 +[75520.878088] __kmalloc+0x189/0x450 +[75520.920107] nft_trans_alloc_gfp+0x20/0x190 [nf_tables] +[75520.983961] nf_tables_newtable+0xcd0/0x1bd0 [nf_tables] +[75521.048857] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] +[75521.108655] netlink_unicast+0x45d/0x680 +[75521.157013] netlink_sendmsg+0x6fa/0xd30 +[75521.205271] sock_sendmsg+0xd9/0x160 +[75521.249365] ___sys_sendmsg+0x64d/0x980 +[75521.296686] __sys_sendmsg+0xde/0x170 +[75521.341822] do_syscall_64+0xa3/0x3d0 +[75521.386957] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[75521.467867] Freed by task 23454: +[75521.507804] __kasan_slab_free+0x132/0x180 +[75521.558137] kfree+0x14d/0x4d0 +[75521.596005] free_rt_sched_group+0x153/0x280 +[75521.648410] sched_autogroup_create_attach+0x19a/0x520 +[75521.711330] ksys_setsid+0x2ba/0x400 +[75521.755529] __ia32_sys_setsid+0xa/0x10 +[75521.802850] do_syscall_64+0xa3/0x3d0 +[75521.848090] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[75521.929000] The buggy address belongs to the object at ffff881bdb643f80 + which belongs to the cache kmalloc-96 of size 96 +[75522.079797] The buggy address is located 72 bytes inside of + 96-byte region [ffff881bdb643f80, ffff881bdb643fe0) +[75522.221234] The buggy address belongs to the page: +[75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0 +[75522.377443] flags: 0x2fffff80000100(slab) +[75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020 +[75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000 +[75522.615601] page dumped because: kasan: bad access detected + +Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets") +Signed-off-by: Alexey Kodanev +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2710,12 +2710,13 @@ static struct nft_set *nf_tables_set_loo + u32 id = ntohl(nla_get_be32(nla)); + + list_for_each_entry(trans, &net->nft.commit_list, list) { +- struct nft_set *set = nft_trans_set(trans); ++ if (trans->msg_type == NFT_MSG_NEWSET) { ++ struct nft_set *set = nft_trans_set(trans); + +- if (trans->msg_type == NFT_MSG_NEWSET && +- id == nft_trans_set_id(trans) && +- nft_active_genmask(set, genmask)) +- return set; ++ if (id == nft_trans_set_id(trans) && ++ nft_active_genmask(set, genmask)) ++ return set; ++ } + } + return ERR_PTR(-ENOENT); + } diff --git a/queue-4.14/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch b/queue-4.14/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch new file mode 100644 index 00000000000..36fd8d19fad --- /dev/null +++ b/queue-4.14/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Scott Mayhew +Date: Fri, 8 Jun 2018 16:31:46 -0400 +Subject: nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo + +From: Scott Mayhew + +[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ] + +When running a fuzz tester against a KASAN-enabled kernel, the following +splat periodically occurs. + +The problem occurs when the test sends a GETDEVICEINFO request with a +malformed xdr array (size but no data) for gdia_notify_types and the +array size is > 0x3fffffff, which results in an overflow in the value of +nbytes which is passed to read_buf(). + +If the array size is 0x40000000, 0x80000000, or 0xc0000000, then after +the overflow occurs, the value of nbytes 0, and when that happens the +pointer returned by read_buf() points to the end of the xdr data (i.e. +argp->end) when really it should be returning NULL. + +Fix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this +value is arbitrary, but it's the same threshold used by +nfsd4_decode_bitmap()... in could really be any value >= 1 since it's +expected to get at most a single bitmap in gdia_notify_types). + +[ 119.256854] ================================================================== +[ 119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538 + +[ 119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1 +[ 119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014 +[ 119.261202] Call Trace: +[ 119.262265] dump_stack+0x71/0xab +[ 119.263371] print_address_description+0x6a/0x270 +[ 119.264609] kasan_report+0x258/0x380 +[ 119.265854] ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.267291] nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.268549] ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd] +[ 119.269873] ? nfsd4_decode_sequence+0x490/0x490 [nfsd] +[ 119.271095] nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd] +[ 119.272393] ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd] +[ 119.273658] nfsd_dispatch+0x183/0x850 [nfsd] +[ 119.274918] svc_process+0x161c/0x31a0 [sunrpc] +[ 119.276172] ? svc_printk+0x190/0x190 [sunrpc] +[ 119.277386] ? svc_xprt_release+0x451/0x680 [sunrpc] +[ 119.278622] nfsd+0x2b9/0x430 [nfsd] +[ 119.279771] ? nfsd_destroy+0x1c0/0x1c0 [nfsd] +[ 119.281157] kthread+0x2db/0x390 +[ 119.282347] ? kthread_create_worker_on_cpu+0xc0/0xc0 +[ 119.283756] ret_from_fork+0x35/0x40 + +[ 119.286041] Allocated by task 436: +[ 119.287525] kasan_kmalloc+0xa0/0xd0 +[ 119.288685] kmem_cache_alloc+0xe9/0x1f0 +[ 119.289900] get_empty_filp+0x7b/0x410 +[ 119.291037] path_openat+0xca/0x4220 +[ 119.292242] do_filp_open+0x182/0x280 +[ 119.293411] do_sys_open+0x216/0x360 +[ 119.294555] do_syscall_64+0xa0/0x2f0 +[ 119.295721] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[ 119.298068] Freed by task 436: +[ 119.299271] __kasan_slab_free+0x130/0x180 +[ 119.300557] kmem_cache_free+0x78/0x210 +[ 119.301823] rcu_process_callbacks+0x35b/0xbd0 +[ 119.303162] __do_softirq+0x192/0x5ea + +[ 119.305443] The buggy address belongs to the object at ffff880113ada000 + which belongs to the cache filp of size 256 +[ 119.308556] The buggy address is located 0 bytes inside of + 256-byte region [ffff880113ada000, ffff880113ada100) +[ 119.311376] The buggy address belongs to the page: +[ 119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780 +[ 119.314428] flags: 0x17ffe000000100(slab) +[ 119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001 +[ 119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000 +[ 119.319050] page dumped because: kasan: bad access detected + +[ 119.321652] Memory state around the buggy address: +[ 119.322993] ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 119.324515] ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 119.327547] ^ +[ 119.328730] ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 119.330218] ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb +[ 119.331740] ================================================================== + +Signed-off-by: Scott Mayhew +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4xdr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1586,6 +1586,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_ + gdev->gd_maxcount = be32_to_cpup(p++); + num = be32_to_cpup(p++); + if (num) { ++ if (num > 1000) ++ goto xdr_error; + READ_BUF(4 * num); + gdev->gd_notify_types = be32_to_cpup(p++); + for (i = 1; i < num; i++) { diff --git a/queue-4.14/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch b/queue-4.14/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch new file mode 100644 index 00000000000..ce9c1ebc82c --- /dev/null +++ b/queue-4.14/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Trond Myklebust +Date: Sat, 9 Jun 2018 19:10:31 -0400 +Subject: NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY + +From: Trond Myklebust + +[ Upstream commit f9312a541050007ec59eb0106273a0a10718cd83 ] + +If the server returns NFS4ERR_SEQ_FALSE_RETRY or NFS4ERR_RETRY_UNCACHED_REP, +then it thinks we're trying to replay an existing request. If so, then +let's just bump the sequence ID and retry the operation. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -745,6 +745,13 @@ static int nfs41_sequence_process(struct + slot->slot_nr, + slot->seq_nr); + goto out_retry; ++ case -NFS4ERR_RETRY_UNCACHED_REP: ++ case -NFS4ERR_SEQ_FALSE_RETRY: ++ /* ++ * The server thinks we tried to replay a request. ++ * Retry the call after bumping the sequence ID. ++ */ ++ goto retry_new_seq; + case -NFS4ERR_BADSLOT: + /* + * The slot id we used was probably retired. Try again +@@ -769,10 +776,6 @@ static int nfs41_sequence_process(struct + goto retry_nowait; + } + goto session_recover; +- case -NFS4ERR_SEQ_FALSE_RETRY: +- if (interrupted) +- goto retry_new_seq; +- goto session_recover; + default: + /* Just update the slot sequence no. */ + slot->seq_done = 1; diff --git a/queue-4.14/nvme-lightnvm-add-granby-support.patch b/queue-4.14/nvme-lightnvm-add-granby-support.patch new file mode 100644 index 00000000000..56a5b0841c1 --- /dev/null +++ b/queue-4.14/nvme-lightnvm-add-granby-support.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wei Xu +Date: Thu, 26 Apr 2018 14:59:19 -0600 +Subject: nvme: lightnvm: add granby support + +From: Wei Xu + +[ Upstream commit ea48e877994f086af481427bac110aa63686c3ce ] + +Add a new lightnvm quirk to identify CNEX’s Granby controller. + +Signed-off-by: Wei Xu +Reviewed-by: Javier González +Reviewed-by: Matias Bjørling +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2565,6 +2565,8 @@ static const struct pci_device_id nvme_i + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, ++ { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */ ++ .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, diff --git a/queue-4.14/nvme-pci-fix-aer-reset-handling.patch b/queue-4.14/nvme-pci-fix-aer-reset-handling.patch new file mode 100644 index 00000000000..4a92a0e5df0 --- /dev/null +++ b/queue-4.14/nvme-pci-fix-aer-reset-handling.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Keith Busch +Date: Thu, 24 May 2018 16:16:04 -0600 +Subject: nvme-pci: Fix AER reset handling + +From: Keith Busch + +[ Upstream commit 72cd4cc28e234ed7189ee508ed65ab60c80a97c8 ] + +The nvme timeout handling doesn't do anything if the pci channel is +offline, which is the case when recovering from PCI error event, so it +was a bad idea to sync the controller reset in this state. This patch +flushes the reset work in the error_resume callback instead when the +channel is back to online. This keeps AER handling serialized and +can recover from timeouts. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199757 +Fixes: cc1d5e749a2e ("nvme/pci: Sync controller reset for AER slot_reset") +Reported-by: Alex Gagniuc +Tested-by: Alex Gagniuc +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2519,6 +2519,9 @@ static pci_ers_result_t nvme_slot_reset( + + static void nvme_error_resume(struct pci_dev *pdev) + { ++ struct nvme_dev *dev = pci_get_drvdata(pdev); ++ ++ flush_work(&dev->ctrl.reset_work); + pci_cleanup_aer_uncorrect_error_status(pdev); + } + diff --git a/queue-4.14/nvme-rdma-stop-admin-queue-before-freeing-it.patch b/queue-4.14/nvme-rdma-stop-admin-queue-before-freeing-it.patch new file mode 100644 index 00000000000..ec8b02fffc1 --- /dev/null +++ b/queue-4.14/nvme-rdma-stop-admin-queue-before-freeing-it.patch @@ -0,0 +1,68 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jianchao Wang +Date: Thu, 24 May 2018 09:27:38 +0800 +Subject: nvme-rdma: stop admin queue before freeing it + +From: Jianchao Wang + +[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ] + +For any failure after nvme_rdma_start_queue in +nvme_rdma_configure_admin_queue, the admin queue will be freed with the +NVME_RDMA_Q_LIVE flag still set. Once nvme_rdma_stop_queue is invoked, +that will cause a use-after-free. +BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm] + +To fix it, call nvme_rdma_stop_queue for all the failed cases after +nvme_rdma_start_queue. + +Signed-off-by: Jianchao Wang +Suggested-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -796,7 +796,7 @@ static int nvme_rdma_configure_admin_que + if (error) { + dev_err(ctrl->ctrl.device, + "prop_get NVME_REG_CAP failed\n"); +- goto out_cleanup_queue; ++ goto out_stop_queue; + } + + ctrl->ctrl.sqsize = +@@ -804,23 +804,25 @@ static int nvme_rdma_configure_admin_que + + error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + ctrl->ctrl.max_hw_sectors = + (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9); + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev, + &ctrl->async_event_sqe, sizeof(struct nvme_command), + DMA_TO_DEVICE); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + return 0; + ++out_stop_queue: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->ctrl.admin_q); diff --git a/queue-4.14/nvmem-properly-handle-returned-value-nvmem_reg_read.patch b/queue-4.14/nvmem-properly-handle-returned-value-nvmem_reg_read.patch new file mode 100644 index 00000000000..12d2090f2bd --- /dev/null +++ b/queue-4.14/nvmem-properly-handle-returned-value-nvmem_reg_read.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Fri, 11 May 2018 12:07:03 +0100 +Subject: nvmem: properly handle returned value nvmem_reg_read + +From: Mathieu Malaterre + +[ Upstream commit 50808bfcc14b854775a9f1d0abe3dac2babcf5c3 ] + +Function nvmem_reg_read can return a non zero value indicating an error. +This returned value must be read and error propagated to +nvmem_cell_prepare_write_buffer. Silence the following gcc warning (W=1): + +drivers/nvmem/core.c:1093:9: warning: variable 'rc' set but + not used [-Wunused-but-set-variable] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -1049,6 +1049,8 @@ static inline void *nvmem_cell_prepare_w + + /* setup the first byte with lsb bits from nvmem */ + rc = nvmem_reg_read(nvmem, cell->offset, &v, 1); ++ if (rc) ++ goto err; + *b++ |= GENMASK(bit_offset - 1, 0) & v; + + /* setup rest of the byte if any */ +@@ -1067,11 +1069,16 @@ static inline void *nvmem_cell_prepare_w + /* setup the last byte with msb bits from nvmem */ + rc = nvmem_reg_read(nvmem, + cell->offset + cell->bytes - 1, &v, 1); ++ if (rc) ++ goto err; + *p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v; + + } + + return buf; ++err: ++ kfree(buf); ++ return ERR_PTR(rc); + } + + /** diff --git a/queue-4.14/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch b/queue-4.14/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch new file mode 100644 index 00000000000..02ed7988e77 --- /dev/null +++ b/queue-4.14/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jan Kiszka +Date: Tue, 15 May 2018 11:07:01 +0200 +Subject: PCI: Fix devm_pci_alloc_host_bridge() memory leak + +From: Jan Kiszka + +[ Upstream commit 3bbce531788719749520f28052cabdef16af6b16 ] + +Fix a memory leak by freeing the PCI resource list in +devm_pci_release_host_bridge_dev(). + +Fixes: 5c3f18cce083 ("PCI: Add devm_pci_alloc_host_bridge() interface") +Signed-off-by: Jan Kiszka +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/probe.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -516,12 +516,14 @@ static void devm_pci_release_host_bridge + + if (bridge->release_fn) + bridge->release_fn(bridge); ++ ++ pci_free_resource_list(&bridge->windows); + } + + static void pci_release_host_bridge_dev(struct device *dev) + { + devm_pci_release_host_bridge_dev(dev); +- pci_free_host_bridge(to_pci_host_bridge(dev)); ++ kfree(to_pci_host_bridge(dev)); + } + + struct pci_host_bridge *pci_alloc_host_bridge(size_t priv) diff --git a/queue-4.14/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch b/queue-4.14/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch new file mode 100644 index 00000000000..c559d734596 --- /dev/null +++ b/queue-4.14/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mika Westerberg +Date: Wed, 23 May 2018 17:19:22 -0500 +Subject: PCI: pciehp: Request control of native hotplug only if supported + +From: Mika Westerberg + +[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ] + +Currently we request control of native PCIe hotplug unconditionally. +Native PCIe hotplug events are handled by the pciehp driver, and if it is +not enabled those events will be lost. + +Request control of native PCIe hotplug only if the pciehp driver is +enabled, so we will actually handle native PCIe hotplug events. + +Suggested-by: Bjorn Helgaas +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/pci_root.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -472,9 +472,11 @@ static void negotiate_os_control(struct + } + + control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL +- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL + | OSC_PCI_EXPRESS_PME_CONTROL; + ++ if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) ++ control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL; ++ + if (pci_aer_available()) { + if (aer_acpi_firmware_first()) + dev_info(&device->dev, diff --git a/queue-4.14/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch b/queue-4.14/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch new file mode 100644 index 00000000000..91ef63a8807 --- /dev/null +++ b/queue-4.14/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Christoph Hellwig +Date: Fri, 18 May 2018 18:56:24 +0200 +Subject: PCI: Prevent sysfs disable of device while driver is attached + +From: Christoph Hellwig + +[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ] + +Manipulating the enable_cnt behind the back of the driver will wreak +complete havoc with the kernel state, so disallow it. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Bjorn Helgaas +Reviewed-by: Johannes Thumshirn +Acked-by: Keith Busch +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-sysfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -305,13 +305,16 @@ static ssize_t enable_store(struct devic + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- if (!val) { +- if (pci_is_enabled(pdev)) +- pci_disable_device(pdev); +- else +- result = -EIO; +- } else ++ device_lock(dev); ++ if (dev->driver) ++ result = -EBUSY; ++ else if (val) + result = pci_enable_device(pdev); ++ else if (pci_is_enabled(pdev)) ++ pci_disable_device(pdev); ++ else ++ result = -EIO; ++ device_unlock(dev); + + return result < 0 ? result : count; + } diff --git a/queue-4.14/perf-fix-invalid-bit-in-diagnostic-entry.patch b/queue-4.14/perf-fix-invalid-bit-in-diagnostic-entry.patch new file mode 100644 index 00000000000..77e891c5153 --- /dev/null +++ b/queue-4.14/perf-fix-invalid-bit-in-diagnostic-entry.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Thomas Richter +Date: Tue, 8 May 2018 07:53:39 +0200 +Subject: perf: fix invalid bit in diagnostic entry + +From: Thomas Richter + +[ Upstream commit 3c0a83b14ea71fef5ccc93a3bd2de5f892be3194 ] + +The s390 CPU measurement facility sampling mode supports basic entries +and diagnostic entries. Each entry has a valid bit to indicate the +status of the entry as valid or invalid. + +This bit is bit 31 in the diagnostic entry, but the bit mask definition +refers to bit 30. + +Fix this by making the reserved field one bit larger. + +Fixes: 7e75fc3ff4cf ("s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function") +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/cpu_mf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/include/asm/cpu_mf.h ++++ b/arch/s390/include/asm/cpu_mf.h +@@ -116,7 +116,7 @@ struct hws_basic_entry { + + struct hws_diag_entry { + unsigned int def:16; /* 0-15 Data Entry Format */ +- unsigned int R:14; /* 16-19 and 20-30 reserved */ ++ unsigned int R:15; /* 16-19 and 20-30 reserved */ + unsigned int I:1; /* 31 entry valid or invalid */ + u8 data[]; /* Machine-dependent sample data */ + } __packed; diff --git a/queue-4.14/perf-tools-fix-pmu-events-parsing-rule.patch b/queue-4.14/perf-tools-fix-pmu-events-parsing-rule.patch new file mode 100644 index 00000000000..6f5795105ba --- /dev/null +++ b/queue-4.14/perf-tools-fix-pmu-events-parsing-rule.patch @@ -0,0 +1,82 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jiri Olsa +Date: Tue, 5 Jun 2018 14:14:16 +0200 +Subject: perf tools: Fix pmu events parsing rule + +From: Jiri Olsa + +[ Upstream commit ceac7b79df7bd67ef9aaf464b0179a2686aff4ee ] + +Currently all the event parsing fails end up +in the event_pmu rule, and display misleading +help like: + + $ perf stat -e inst kill + event syntax error: 'inst' + \___ Cannot find PMU `inst'. Missing kernel support? + ... + +The reason is that the event_pmu is too strong +and match also single string. Changing it to +force the '/' separators to be part of the rule, +and getting the proper error now: + + $ perf stat -e inst kill + event syntax error: 'inst' + \___ parser error + Run 'perf list' for a list of valid events + ... + +Suggested-by: Adrian Hunter +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180605121416.31645-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/parse-events.y | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -72,6 +72,7 @@ static void inc_group_count(struct list_ + %type value_sym + %type event_config + %type opt_event_config ++%type opt_pmu_config + %type event_term + %type event_pmu + %type event_legacy_symbol +@@ -223,7 +224,7 @@ event_def: event_pmu | + event_bpf_file + + event_pmu: +-PE_NAME opt_event_config ++PE_NAME opt_pmu_config + { + struct list_head *list, *orig_terms, *terms; + +@@ -485,6 +486,17 @@ opt_event_config: + { + $$ = NULL; + } ++ ++opt_pmu_config: ++'/' event_config '/' ++{ ++ $$ = $2; ++} ++| ++'/' '/' ++{ ++ $$ = NULL; ++} + + start_terms: event_config + { diff --git a/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch b/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch new file mode 100644 index 00000000000..50546eae228 --- /dev/null +++ b/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kan Liang +Date: Thu, 3 May 2018 11:25:07 -0700 +Subject: perf/x86/intel/uncore: Correct fixed counter index check for NHM + +From: Kan Liang + +[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ] + +For Nehalem and Westmere, there is only one fixed counter for W-Box. +There is no index which is bigger than UNCORE_PMC_IDX_FIXED. +It is not correct to use >= to check fixed counter. +The code quality issue will bring problem when new counter index is +introduced. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: acme@kernel.org +Cc: eranian@google.com +Link: http://lkml.kernel.org/r/1525371913-10597-2-git-send-email-kan.liang@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore_nhmex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/uncore_nhmex.c ++++ b/arch/x86/events/intel/uncore_nhmex.c +@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_even + { + struct hw_perf_event *hwc = &event->hw; + +- if (hwc->idx >= UNCORE_PMC_IDX_FIXED) ++ if (hwc->idx == UNCORE_PMC_IDX_FIXED) + wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0); + else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0) + wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22); diff --git a/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch b/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch new file mode 100644 index 00000000000..9b9f47d39a7 --- /dev/null +++ b/queue-4.14/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Kan Liang +Date: Thu, 3 May 2018 11:25:08 -0700 +Subject: perf/x86/intel/uncore: Correct fixed counter index check in generic code + +From: Kan Liang + +[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ] + +There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only +exception is client IMC uncore, which has been specially handled. +For generic code, it is not correct to use >= to check fixed counter. +The code quality issue will bring problem when a new counter index is +introduced. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: acme@kernel.org +Cc: eranian@google.com +Link: http://lkml.kernel.org/r/1525371913-10597-3-git-send-email-kan.liang@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct int + u64 prev_count, new_count, delta; + int shift; + +- if (event->hw.idx >= UNCORE_PMC_IDX_FIXED) ++ if (event->hw.idx == UNCORE_PMC_IDX_FIXED) + shift = 64 - uncore_fixed_ctr_bits(box); + else + shift = 64 - uncore_perf_ctr_bits(box); diff --git a/queue-4.14/pinctrl-at91-pio4-add-missing-of_node_put.patch b/queue-4.14/pinctrl-at91-pio4-add-missing-of_node_put.patch new file mode 100644 index 00000000000..507701fb845 --- /dev/null +++ b/queue-4.14/pinctrl-at91-pio4-add-missing-of_node_put.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Julia Lawall +Date: Wed, 23 May 2018 21:07:12 +0200 +Subject: pinctrl: at91-pio4: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit 21816364715f508c10da1e087e352bc1e326614f ] + +The device node iterators perform an of_node_get on each iteration, so a +jump out of the loop requires an of_node_put. + +The semantic patch that fixes this problem is as follows +(http://coccinelle.lip6.fr): + +// +@@ +expression root,e; +local idexpression child; +iterator name for_each_child_of_node; +@@ + + for_each_child_of_node(root, child) { + ... when != of_node_put(child) + when != e = child ++ of_node_put(child); +? break; + ... +} +... when != child +// + +Signed-off-by: Julia Lawall +Acked-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(str + for_each_child_of_node(np_config, np) { + ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map, + &reserved_maps, num_maps); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(np); + break; ++ } + } + } + diff --git a/queue-4.14/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch b/queue-4.14/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch new file mode 100644 index 00000000000..09f64a38ee7 --- /dev/null +++ b/queue-4.14/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sebastian Andrzej Siewior +Date: Fri, 25 May 2018 11:46:48 +0200 +Subject: PM / wakeup: Make s2idle_lock a RAW_SPINLOCK + +From: Sebastian Andrzej Siewior + +[ Upstream commit 62fc00a6611a0014c85763f9def1fc07c15d1302 ] + +The `s2idle_lock' is acquired during suspend while interrupts are +disabled even on RT. The lock is acquired for short sections only. +Make it a RAW lock which avoids "sleeping while atomic" warnings on RT. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/power/suspend.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops + static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head); + + enum s2idle_states __read_mostly s2idle_state; +-static DEFINE_SPINLOCK(s2idle_lock); ++static DEFINE_RAW_SPINLOCK(s2idle_lock); + + void s2idle_set_ops(const struct platform_s2idle_ops *ops) + { +@@ -78,12 +78,12 @@ static void s2idle_enter(void) + { + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + if (pm_wakeup_pending()) + goto out; + + s2idle_state = S2IDLE_STATE_ENTER; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + get_online_cpus(); + cpuidle_resume(); +@@ -97,11 +97,11 @@ static void s2idle_enter(void) + cpuidle_pause(); + put_online_cpus(); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + + out: + s2idle_state = S2IDLE_STATE_NONE; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false); + } +@@ -156,12 +156,12 @@ void s2idle_wake(void) + { + unsigned long flags; + +- spin_lock_irqsave(&s2idle_lock, flags); ++ raw_spin_lock_irqsave(&s2idle_lock, flags); + if (s2idle_state > S2IDLE_STATE_NONE) { + s2idle_state = S2IDLE_STATE_WAKE; + wake_up(&s2idle_wait_head); + } +- spin_unlock_irqrestore(&s2idle_lock, flags); ++ raw_spin_unlock_irqrestore(&s2idle_lock, flags); + } + EXPORT_SYMBOL_GPL(s2idle_wake); + diff --git a/queue-4.14/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch b/queue-4.14/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch new file mode 100644 index 00000000000..a9637861803 --- /dev/null +++ b/queue-4.14/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Trond Myklebust +Date: Tue, 22 May 2018 11:17:16 -0400 +Subject: pnfs: Don't release the sequence slot until we've processed layoutget on open + +From: Trond Myklebust + +[ Upstream commit ae55e59da0e401893b3c52b575fc18a00623d0a1 ] + +If the server recalls the layout that was just handed out, we risk hitting +a race as described in RFC5661 Section 2.10.6.3 unless we ensure that we +release the sequence slot after processing the LAYOUTGET operation that +was sent as part of the OPEN compound. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2695,7 +2695,7 @@ static int _nfs4_open_and_get_state(stru + if (ret != 0) + goto out; + +- state = nfs4_opendata_to_nfs4_state(opendata); ++ state = _nfs4_opendata_to_nfs4_state(opendata); + ret = PTR_ERR(state); + if (IS_ERR(state)) + goto out; +@@ -2731,6 +2731,7 @@ static int _nfs4_open_and_get_state(stru + nfs4_schedule_stateid_recovery(server, state); + } + out: ++ nfs4_sequence_free_slot(&opendata->o_res.seq_res); + return ret; + } + diff --git a/queue-4.14/powerpc-32-add-a-missing-include-header.patch b/queue-4.14/powerpc-32-add-a-missing-include-header.patch new file mode 100644 index 00000000000..8f8bbcbb77a --- /dev/null +++ b/queue-4.14/powerpc-32-add-a-missing-include-header.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 22 Mar 2018 21:20:03 +0100 +Subject: powerpc/32: Add a missing include header + +From: Mathieu Malaterre + +[ Upstream commit c89ca593220931c150cffda24b4d4ccf82f13fc8 ] + +The header file was missing from the includes. Fix the +following warning, treated as error with W=1: + + arch/powerpc/kernel/pci_32.c:286:6: error: no previous prototype for ‘sys_pciconfig_iobase’ [-Werror=missing-prototypes] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/pci_32.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/pci_32.c ++++ b/arch/powerpc/kernel/pci_32.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-4.14/powerpc-64s-add-barrier_nospec.patch b/queue-4.14/powerpc-64s-add-barrier_nospec.patch new file mode 100644 index 00000000000..470b4da2f66 --- /dev/null +++ b/queue-4.14/powerpc-64s-add-barrier_nospec.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Michal Suchanek +Date: Tue, 24 Apr 2018 14:15:54 +1000 +Subject: powerpc/64s: Add barrier_nospec + +From: Michal Suchanek + +[ Upstream commit a6b3964ad71a61bb7c61d80a60bea7d42187b2eb ] + +A no-op form of ori (or immediate of 0 into r31 and the result stored +in r31) has been re-tasked as a speculation barrier. The instruction +only acts as a barrier on newer machines with appropriate firmware +support. On older CPUs it remains a harmless no-op. + +Implement barrier_nospec using this instruction. + +mpe: The semantics of the instruction are believed to be that it +prevents execution of subsequent instructions until preceding branches +have been fully resolved and are no longer executing speculatively. +There is no further documentation available at this time. + +Signed-off-by: Michal Suchanek +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/barrier.h | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -76,6 +76,21 @@ do { \ + ___p1; \ + }) + ++#ifdef CONFIG_PPC_BOOK3S_64 ++/* ++ * Prevent execution of subsequent instructions until preceding branches have ++ * been fully resolved and are no longer executing speculatively. ++ */ ++#define barrier_nospec_asm ori 31,31,0 ++ ++// This also acts as a compiler barrier due to the memory clobber. ++#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory") ++ ++#else /* !CONFIG_PPC_BOOK3S_64 */ ++#define barrier_nospec_asm ++#define barrier_nospec() ++#endif ++ + #include + + #endif /* _ASM_POWERPC_BARRIER_H */ diff --git a/queue-4.14/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch b/queue-4.14/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch new file mode 100644 index 00000000000..8a1ea1ebb0b --- /dev/null +++ b/queue-4.14/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Nicholas Piggin +Date: Wed, 30 May 2018 20:31:22 +1000 +Subject: powerpc/64s: Fix compiler store ordering to SLB shadow area + +From: Nicholas Piggin + +[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ] + +The stores to update the SLB shadow area must be made as they appear +in the C code, so that the hypervisor does not see an entry with +mismatched vsid and esid. Use WRITE_ONCE for this. + +GCC has been observed to elide the first store to esid in the update, +which means that if the hypervisor interrupts the guest after storing +to vsid, it could see an entry with old esid and new vsid, which may +possibly result in memory corruption. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/slb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -62,14 +62,14 @@ static inline void slb_shadow_update(uns + * updating it. No write barriers are needed here, provided + * we only update the current CPU's SLB shadow buffer. + */ +- p->save_area[index].esid = 0; +- p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags)); +- p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index)); ++ WRITE_ONCE(p->save_area[index].esid, 0); ++ WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags))); ++ WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index))); + } + + static inline void slb_shadow_clear(enum slb_index index) + { +- get_slb_shadow()->save_area[index].esid = 0; ++ WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0); + } + + static inline void create_shadowed_slbe(unsigned long ea, int ssize, diff --git a/queue-4.14/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch b/queue-4.14/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch new file mode 100644 index 00000000000..b170605ad94 --- /dev/null +++ b/queue-4.14/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Christophe Leroy +Date: Thu, 24 May 2018 11:02:06 +0000 +Subject: powerpc/8xx: fix invalid register expression in head_8xx.S + +From: Christophe Leroy + +[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ] + +New binutils generate the following warning + + AS arch/powerpc/kernel/head_8xx.o +arch/powerpc/kernel/head_8xx.S: Assembler messages: +arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression + +This patch fixes it. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/head_8xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -958,7 +958,7 @@ start_here: + tovirt(r6,r6) + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l +- stw r5, 0xf0(r0) /* Must match your Abatron config file */ ++ stw r5, 0xf0(0) /* Must match your Abatron config file */ + tophys(r5,r5) + stw r6, 0(r5) + diff --git a/queue-4.14/powerpc-add-__printf-verification-to-prom_printf.patch b/queue-4.14/powerpc-add-__printf-verification-to-prom_printf.patch new file mode 100644 index 00000000000..85c6f4cdd42 --- /dev/null +++ b/queue-4.14/powerpc-add-__printf-verification-to-prom_printf.patch @@ -0,0 +1,369 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Fri, 6 Apr 2018 22:12:19 +0200 +Subject: powerpc: Add __printf verification to prom_printf + +From: Mathieu Malaterre + +[ Upstream commit eae5f709a4d738c52b6ab636981755d76349ea9e ] + +__printf is useful to verify format and arguments. Fix arg mismatch +reported by gcc, remove the following warnings (with W=1): + + arch/powerpc/kernel/prom_init.c:1467:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1471:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1504:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1505:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1506:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1507:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1508:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1509:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1975:39: error: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘unsigned int’ + arch/powerpc/kernel/prom_init.c:1986:27: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2567:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2567:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2569:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2569:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’ + +The patch also include arg mismatch fix for case with #define DEBUG_PROM +(warning not listed here). + +This patch fix also the following warnings revealed by checkpatch: + + WARNING: Prefer using '"%s...", __func__' to using 'alloc_up', this function's name, in a string + #101: FILE: arch/powerpc/kernel/prom_init.c:1235: + + prom_debug("alloc_up(%lx, %lx)\n", size, align); + +and + + WARNING: Prefer using '"%s...", __func__' to using 'alloc_down', this function's name, in a string + #138: FILE: arch/powerpc/kernel/prom_init.c:1278: + + prom_debug("alloc_down(%lx, %lx, %s)\n", size, align, + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/prom_init.c | 114 ++++++++++++++++++++-------------------- + 1 file changed, 58 insertions(+), 56 deletions(-) + +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -334,6 +334,7 @@ static void __init prom_print_dec(unsign + call_prom("write", 3, 1, prom.stdout, buf+i, size); + } + ++__printf(1, 2) + static void __init prom_printf(const char *format, ...) + { + const char *p, *q, *s; +@@ -1148,7 +1149,7 @@ static void __init prom_send_capabilitie + */ + + cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads()); +- prom_printf("Max number of cores passed to firmware: %lu (NR_CPUS = %lu)\n", ++ prom_printf("Max number of cores passed to firmware: %u (NR_CPUS = %d)\n", + cores, NR_CPUS); + + ibm_architecture_vec.vec5.max_cpus = cpu_to_be32(cores); +@@ -1230,7 +1231,7 @@ static unsigned long __init alloc_up(uns + + if (align) + base = _ALIGN_UP(base, align); +- prom_debug("alloc_up(%x, %x)\n", size, align); ++ prom_debug("%s(%lx, %lx)\n", __func__, size, align); + if (ram_top == 0) + prom_panic("alloc_up() called with mem not initialized\n"); + +@@ -1241,7 +1242,7 @@ static unsigned long __init alloc_up(uns + + for(; (base + size) <= alloc_top; + base = _ALIGN_UP(base + 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1253,12 +1254,12 @@ static unsigned long __init alloc_up(uns + return 0; + alloc_bottom = addr + size; + +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1273,7 +1274,7 @@ static unsigned long __init alloc_down(u + { + unsigned long base, addr = 0; + +- prom_debug("alloc_down(%x, %x, %s)\n", size, align, ++ prom_debug("%s(%lx, %lx, %s)\n", __func__, size, align, + highmem ? "(high)" : "(low)"); + if (ram_top == 0) + prom_panic("alloc_down() called with mem not initialized\n"); +@@ -1301,7 +1302,7 @@ static unsigned long __init alloc_down(u + base = _ALIGN_DOWN(alloc_top - size, align); + for (; base > alloc_bottom; + base = _ALIGN_DOWN(base - 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1312,12 +1313,12 @@ static unsigned long __init alloc_down(u + alloc_top = addr; + + bail: +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1443,7 +1444,7 @@ static void __init prom_init_mem(void) + + if (size == 0) + continue; +- prom_debug(" %x %x\n", base, size); ++ prom_debug(" %lx %lx\n", base, size); + if (base == 0 && (of_platform & PLATFORM_LPAR)) + rmo_top = size; + if ((base + size) > ram_top) +@@ -1463,12 +1464,12 @@ static void __init prom_init_mem(void) + + if (prom_memory_limit) { + if (prom_memory_limit <= alloc_bottom) { +- prom_printf("Ignoring mem=%x <= alloc_bottom.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx <= alloc_bottom.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else if (prom_memory_limit >= ram_top) { +- prom_printf("Ignoring mem=%x >= ram_top.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx >= ram_top.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else { + ram_top = prom_memory_limit; +@@ -1500,12 +1501,13 @@ static void __init prom_init_mem(void) + alloc_bottom = PAGE_ALIGN(prom_initrd_end); + + prom_printf("memory layout at init:\n"); +- prom_printf(" memory_limit : %x (16 MB aligned)\n", prom_memory_limit); +- prom_printf(" alloc_bottom : %x\n", alloc_bottom); +- prom_printf(" alloc_top : %x\n", alloc_top); +- prom_printf(" alloc_top_hi : %x\n", alloc_top_high); +- prom_printf(" rmo_top : %x\n", rmo_top); +- prom_printf(" ram_top : %x\n", ram_top); ++ prom_printf(" memory_limit : %lx (16 MB aligned)\n", ++ prom_memory_limit); ++ prom_printf(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_printf(" alloc_top : %lx\n", alloc_top); ++ prom_printf(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_printf(" rmo_top : %lx\n", rmo_top); ++ prom_printf(" ram_top : %lx\n", ram_top); + } + + static void __init prom_close_stdin(void) +@@ -1566,7 +1568,7 @@ static void __init prom_instantiate_opal + return; + } + +- prom_printf("instantiating opal at 0x%x...", base); ++ prom_printf("instantiating opal at 0x%llx...", base); + + if (call_prom_ret("call-method", 4, 3, rets, + ADDR("load-opal-runtime"), +@@ -1582,10 +1584,10 @@ static void __init prom_instantiate_opal + + reserve_mem(base, size); + +- prom_debug("opal base = 0x%x\n", base); +- prom_debug("opal align = 0x%x\n", align); +- prom_debug("opal entry = 0x%x\n", entry); +- prom_debug("opal size = 0x%x\n", (long)size); ++ prom_debug("opal base = 0x%llx\n", base); ++ prom_debug("opal align = 0x%llx\n", align); ++ prom_debug("opal entry = 0x%llx\n", entry); ++ prom_debug("opal size = 0x%llx\n", size); + + prom_setprop(opal_node, "/ibm,opal", "opal-base-address", + &base, sizeof(base)); +@@ -1662,7 +1664,7 @@ static void __init prom_instantiate_rtas + + prom_debug("rtas base = 0x%x\n", base); + prom_debug("rtas entry = 0x%x\n", entry); +- prom_debug("rtas size = 0x%x\n", (long)size); ++ prom_debug("rtas size = 0x%x\n", size); + + prom_debug("prom_instantiate_rtas: end...\n"); + } +@@ -1720,7 +1722,7 @@ static void __init prom_instantiate_sml( + if (base == 0) + prom_panic("Could not allocate memory for sml\n"); + +- prom_printf("instantiating sml at 0x%x...", base); ++ prom_printf("instantiating sml at 0x%llx...", base); + + memset((void *)base, 0, size); + +@@ -1739,8 +1741,8 @@ static void __init prom_instantiate_sml( + prom_setprop(ibmvtpm_node, "/vdevice/vtpm", "linux,sml-size", + &size, sizeof(size)); + +- prom_debug("sml base = 0x%x\n", base); +- prom_debug("sml size = 0x%x\n", (long)size); ++ prom_debug("sml base = 0x%llx\n", base); ++ prom_debug("sml size = 0x%x\n", size); + + prom_debug("prom_instantiate_sml: end...\n"); + } +@@ -1841,7 +1843,7 @@ static void __init prom_initialize_tce_t + + prom_debug("TCE table: %s\n", path); + prom_debug("\tnode = 0x%x\n", node); +- prom_debug("\tbase = 0x%x\n", base); ++ prom_debug("\tbase = 0x%llx\n", base); + prom_debug("\tsize = 0x%x\n", minsize); + + /* Initialize the table to have a one-to-one mapping +@@ -1928,12 +1930,12 @@ static void __init prom_hold_cpus(void) + } + + prom_debug("prom_hold_cpus: start...\n"); +- prom_debug(" 1) spinloop = 0x%x\n", (unsigned long)spinloop); +- prom_debug(" 1) *spinloop = 0x%x\n", *spinloop); +- prom_debug(" 1) acknowledge = 0x%x\n", ++ prom_debug(" 1) spinloop = 0x%lx\n", (unsigned long)spinloop); ++ prom_debug(" 1) *spinloop = 0x%lx\n", *spinloop); ++ prom_debug(" 1) acknowledge = 0x%lx\n", + (unsigned long)acknowledge); +- prom_debug(" 1) *acknowledge = 0x%x\n", *acknowledge); +- prom_debug(" 1) secondary_hold = 0x%x\n", secondary_hold); ++ prom_debug(" 1) *acknowledge = 0x%lx\n", *acknowledge); ++ prom_debug(" 1) secondary_hold = 0x%lx\n", secondary_hold); + + /* Set the common spinloop variable, so all of the secondary cpus + * will block when they are awakened from their OF spinloop. +@@ -1961,7 +1963,7 @@ static void __init prom_hold_cpus(void) + prom_getprop(node, "reg", ®, sizeof(reg)); + cpu_no = be32_to_cpu(reg); + +- prom_debug("cpu hw idx = %lu\n", cpu_no); ++ prom_debug("cpu hw idx = %u\n", cpu_no); + + /* Init the acknowledge var which will be reset by + * the secondary cpu when it awakens from its OF +@@ -1971,7 +1973,7 @@ static void __init prom_hold_cpus(void) + + if (cpu_no != prom.cpu) { + /* Primary Thread of non-boot cpu or any thread */ +- prom_printf("starting cpu hw idx %lu... ", cpu_no); ++ prom_printf("starting cpu hw idx %u... ", cpu_no); + call_prom("start-cpu", 3, 0, node, + secondary_hold, cpu_no); + +@@ -1982,11 +1984,11 @@ static void __init prom_hold_cpus(void) + if (*acknowledge == cpu_no) + prom_printf("done\n"); + else +- prom_printf("failed: %x\n", *acknowledge); ++ prom_printf("failed: %lx\n", *acknowledge); + } + #ifdef CONFIG_SMP + else +- prom_printf("boot cpu hw idx %lu\n", cpu_no); ++ prom_printf("boot cpu hw idx %u\n", cpu_no); + #endif /* CONFIG_SMP */ + } + +@@ -2264,7 +2266,7 @@ static void __init *make_room(unsigned l + while ((*mem_start + needed) > *mem_end) { + unsigned long room, chunk; + +- prom_debug("Chunk exhausted, claiming more at %x...\n", ++ prom_debug("Chunk exhausted, claiming more at %lx...\n", + alloc_bottom); + room = alloc_top - alloc_bottom; + if (room > DEVTREE_CHUNK_SIZE) +@@ -2490,7 +2492,7 @@ static void __init flatten_device_tree(v + room = alloc_top - alloc_bottom - 0x4000; + if (room > DEVTREE_CHUNK_SIZE) + room = DEVTREE_CHUNK_SIZE; +- prom_debug("starting device tree allocs at %x\n", alloc_bottom); ++ prom_debug("starting device tree allocs at %lx\n", alloc_bottom); + + /* Now try to claim that */ + mem_start = (unsigned long)alloc_up(room, PAGE_SIZE); +@@ -2553,7 +2555,7 @@ static void __init flatten_device_tree(v + int i; + prom_printf("reserved memory map:\n"); + for (i = 0; i < mem_reserve_cnt; i++) +- prom_printf(" %x - %x\n", ++ prom_printf(" %llx - %llx\n", + be64_to_cpu(mem_reserve_map[i].base), + be64_to_cpu(mem_reserve_map[i].size)); + } +@@ -2563,9 +2565,9 @@ static void __init flatten_device_tree(v + */ + mem_reserve_cnt = MEM_RESERVE_MAP_SIZE; + +- prom_printf("Device tree strings 0x%x -> 0x%x\n", ++ prom_printf("Device tree strings 0x%lx -> 0x%lx\n", + dt_string_start, dt_string_end); +- prom_printf("Device tree struct 0x%x -> 0x%x\n", ++ prom_printf("Device tree struct 0x%lx -> 0x%lx\n", + dt_struct_start, dt_struct_end); + } + +@@ -2997,7 +2999,7 @@ static void __init prom_find_boot_cpu(vo + prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval)); + prom.cpu = be32_to_cpu(rval); + +- prom_debug("Booting CPU hw index = %lu\n", prom.cpu); ++ prom_debug("Booting CPU hw index = %d\n", prom.cpu); + } + + static void __init prom_check_initrd(unsigned long r3, unsigned long r4) +@@ -3019,8 +3021,8 @@ static void __init prom_check_initrd(uns + reserve_mem(prom_initrd_start, + prom_initrd_end - prom_initrd_start); + +- prom_debug("initrd_start=0x%x\n", prom_initrd_start); +- prom_debug("initrd_end=0x%x\n", prom_initrd_end); ++ prom_debug("initrd_start=0x%lx\n", prom_initrd_start); ++ prom_debug("initrd_end=0x%lx\n", prom_initrd_end); + } + #endif /* CONFIG_BLK_DEV_INITRD */ + } +@@ -3273,7 +3275,7 @@ unsigned long __init prom_init(unsigned + /* Don't print anything after quiesce under OPAL, it crashes OFW */ + if (of_platform != PLATFORM_OPAL) { + prom_printf("Booting Linux via __start() @ 0x%lx ...\n", kbase); +- prom_debug("->dt_header_start=0x%x\n", hdr); ++ prom_debug("->dt_header_start=0x%lx\n", hdr); + } + + #ifdef CONFIG_PPC32 diff --git a/queue-4.14/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch b/queue-4.14/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch new file mode 100644 index 00000000000..0b317ae57c4 --- /dev/null +++ b/queue-4.14/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 22 Mar 2018 21:19:56 +0100 +Subject: powerpc/chrp/time: Make some functions static, add missing header include + +From: Mathieu Malaterre + +[ Upstream commit b87a358b4a1421abd544c0b554b1b7159b2b36c0 ] + +Add a missing include . + +These functions can all be static, make it so. Fix warnings treated as +errors with W=1: + + arch/powerpc/platforms/chrp/time.c:41:13: error: no previous prototype for ‘chrp_time_init’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:66:5: error: no previous prototype for ‘chrp_cmos_clock_read’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:74:6: error: no previous prototype for ‘chrp_cmos_clock_write’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:86:5: error: no previous prototype for ‘chrp_set_rtc_time’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:130:6: error: no previous prototype for ‘chrp_get_rtc_time’ [-Werror=missing-prototypes] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/chrp/time.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/platforms/chrp/time.c ++++ b/arch/powerpc/platforms/chrp/time.c +@@ -28,6 +28,8 @@ + #include + #include + ++#include ++ + extern spinlock_t rtc_lock; + + #define NVRAM_AS0 0x74 +@@ -63,7 +65,7 @@ long __init chrp_time_init(void) + return 0; + } + +-int chrp_cmos_clock_read(int addr) ++static int chrp_cmos_clock_read(int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); +@@ -71,7 +73,7 @@ int chrp_cmos_clock_read(int addr) + return (inb(nvram_data)); + } + +-void chrp_cmos_clock_write(unsigned long val, int addr) ++static void chrp_cmos_clock_write(unsigned long val, int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); diff --git a/queue-4.14/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch b/queue-4.14/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch new file mode 100644 index 00000000000..e657a699534 --- /dev/null +++ b/queue-4.14/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sam Bobroff +Date: Fri, 25 May 2018 13:11:30 +1000 +Subject: powerpc/eeh: Fix use-after-release of EEH driver + +From: Sam Bobroff + +[ Upstream commit 46d4be41b987a6b2d25a2ebdd94cafb44e21d6c5 ] + +Correct two cases where eeh_pcid_get() is used to reference the driver's +module but the reference is dropped before the driver pointer is used. + +In eeh_rmv_device() also refactor a little so that only two calls to +eeh_pcid_put() are needed, rather than three and the reference isn't +taken at all if it wasn't needed. + +Signed-off-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/eeh_driver.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -450,9 +450,11 @@ static void *eeh_add_virt_device(void *d + + driver = eeh_pcid_get(dev); + if (driver) { +- eeh_pcid_put(dev); +- if (driver->err_handler) ++ if (driver->err_handler) { ++ eeh_pcid_put(dev); + return NULL; ++ } ++ eeh_pcid_put(dev); + } + + #ifdef CONFIG_PPC_POWERNV +@@ -489,17 +491,19 @@ static void *eeh_rmv_device(void *data, + if (eeh_dev_removed(edev)) + return NULL; + +- driver = eeh_pcid_get(dev); +- if (driver) { +- eeh_pcid_put(dev); +- if (removed && +- eeh_pe_passed(edev->pe)) +- return NULL; +- if (removed && +- driver->err_handler && +- driver->err_handler->error_detected && +- driver->err_handler->slot_reset) ++ if (removed) { ++ if (eeh_pe_passed(edev->pe)) + return NULL; ++ driver = eeh_pcid_get(dev); ++ if (driver) { ++ if (driver->err_handler && ++ driver->err_handler->error_detected && ++ driver->err_handler->slot_reset) { ++ eeh_pcid_put(dev); ++ return NULL; ++ } ++ eeh_pcid_put(dev); ++ } + } + + /* Remove it from PCI subsystem */ diff --git a/queue-4.14/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch b/queue-4.14/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch new file mode 100644 index 00000000000..da3027d6204 --- /dev/null +++ b/queue-4.14/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch @@ -0,0 +1,56 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Jonathan Neuschäfer" +Date: Thu, 10 May 2018 23:59:19 +0200 +Subject: powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by Starlet + +From: "Jonathan Neuschäfer" + +[ Upstream commit 9dcb3df4281876731e4e8bff7940514d72375154 ] + +The interrupt controller inside the Wii's Hollywood chip is connected to +two masters, the "Broadway" PowerPC and the "Starlet" ARM926, each with +their own interrupt status and mask registers. + +When booting the Wii with mini[1], interrupts from the SD card +controller (IRQ 7) are handled by the ARM, because mini provides SD +access over IPC. Linux however can't currently use or disable this IPC +service, so both sides try to handle IRQ 7 without coordination. + +Let's instead make sure that all interrupts that are unmasked on the PPC +side are masked on the ARM side; this will also make sure that Linux can +properly talk to the SD card controller (and potentially other devices). + +If access to a device through IPC is desired in the future, interrupts +from that device should not be handled by Linux directly. + +[1]: https://github.com/lewurm/mini + +Signed-off-by: Jonathan Neuschäfer +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -35,6 +35,8 @@ + */ + #define HW_BROADWAY_ICR 0x00 + #define HW_BROADWAY_IMR 0x04 ++#define HW_STARLET_ICR 0x08 ++#define HW_STARLET_IMR 0x0c + + + /* +@@ -74,6 +76,9 @@ static void hlwd_pic_unmask(struct irq_d + void __iomem *io_base = irq_data_get_irq_chip_data(d); + + setbits32(io_base + HW_BROADWAY_IMR, 1 << irq); ++ ++ /* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */ ++ clrbits32(io_base + HW_STARLET_IMR, 1 << irq); + } + + diff --git a/queue-4.14/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch b/queue-4.14/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch new file mode 100644 index 00000000000..fd2529889f2 --- /dev/null +++ b/queue-4.14/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch @@ -0,0 +1,87 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Christophe Leroy +Date: Fri, 18 May 2018 15:01:16 +0200 +Subject: powerpc/lib: Adjust .balign inside string functions for PPC32 + +From: Christophe Leroy + +[ Upstream commit 1128bb7813a896bd608fb622eee3c26aaf33b473 ] + +commit 87a156fb18fe1 ("Align hot loops of some string functions") +degraded the performance of string functions by adding useless +nops + +A simple benchmark on an 8xx calling 100000x a memchr() that +matches the first byte runs in 41668 TB ticks before this patch +and in 35986 TB ticks after this patch. So this gives an +improvement of approx 10% + +Another benchmark doing the same with a memchr() matching the 128th +byte runs in 1011365 TB ticks before this patch and 1005682 TB ticks +after this patch, so regardless on the number of loops, removing +those useless nops improves the test by 5683 TB ticks. + +Fixes: 87a156fb18fe1 ("Align hot loops of some string functions") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/cache.h | 3 +++ + arch/powerpc/lib/string.S | 7 ++++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/include/asm/cache.h ++++ b/arch/powerpc/include/asm/cache.h +@@ -9,11 +9,14 @@ + #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX) + #define L1_CACHE_SHIFT 4 + #define MAX_COPY_PREFETCH 1 ++#define IFETCH_ALIGN_SHIFT 2 + #elif defined(CONFIG_PPC_E500MC) + #define L1_CACHE_SHIFT 6 + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 + #elif defined(CONFIG_PPC32) + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 /* 603 fetches 2 insn at a time */ + #if defined(CONFIG_PPC_47x) + #define L1_CACHE_SHIFT 7 + #else +--- a/arch/powerpc/lib/string.S ++++ b/arch/powerpc/lib/string.S +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + .text + +@@ -23,7 +24,7 @@ _GLOBAL(strncpy) + mtctr r5 + addi r6,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r4) + cmpwi 0,r0,0 + stbu r0,1(r6) +@@ -43,7 +44,7 @@ _GLOBAL(strncmp) + mtctr r5 + addi r5,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r3,1(r5) + cmpwi 1,r3,0 + lbzu r0,1(r4) +@@ -77,7 +78,7 @@ _GLOBAL(memchr) + beq- 2f + mtctr r5 + addi r3,r3,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r3) + cmpw 0,r0,r4 + bdnzf 2,1b diff --git a/queue-4.14/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch b/queue-4.14/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch new file mode 100644 index 00000000000..c0afeb143f6 --- /dev/null +++ b/queue-4.14/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Wed, 4 Apr 2018 22:13:05 +0200 +Subject: powerpc/powermac: Add missing prototype for note_bootable_part() + +From: Mathieu Malaterre + +[ Upstream commit f72cf3f1d49f2c35d6cb682af2e8c93550f264e4 ] + +Add a missing prototype for function `note_bootable_part` to silence a +warning treated as error with W=1: + + arch/powerpc/platforms/powermac/setup.c:361:12: error: no previous prototype for ‘note_bootable_part’ [-Werror=missing-prototypes] + +Suggested-by: Christophe Leroy +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/powermac/setup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/platforms/powermac/setup.c ++++ b/arch/powerpc/platforms/powermac/setup.c +@@ -352,6 +352,7 @@ static int pmac_late_init(void) + } + machine_late_initcall(powermac, pmac_late_init); + ++void note_bootable_part(dev_t dev, int part, int goodness); + /* + * This is __ref because we check for "initializing" before + * touching any of the __init sensitive things and "initializing" diff --git a/queue-4.14/powerpc-powermac-mark-variable-x-as-unused.patch b/queue-4.14/powerpc-powermac-mark-variable-x-as-unused.patch new file mode 100644 index 00000000000..c31afc233b1 --- /dev/null +++ b/queue-4.14/powerpc-powermac-mark-variable-x-as-unused.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Mathieu Malaterre +Date: Wed, 4 Apr 2018 22:07:46 +0200 +Subject: powerpc/powermac: Mark variable x as unused + +From: Mathieu Malaterre + +[ Upstream commit 5a4b475cf8511da721f20ba432c244061db7139f ] + +Since the value of x is never intended to be read, declare it with gcc +attribute as unused. Fix warning treated as error with W=1: + + arch/powerpc/platforms/powermac/bootx_init.c:471:21: error: variable ‘x’ set but not used [-Werror=unused-but-set-variable] + +Suggested-by: Christophe Leroy +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/powermac/bootx_init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powermac/bootx_init.c ++++ b/arch/powerpc/platforms/powermac/bootx_init.c +@@ -468,7 +468,7 @@ void __init bootx_init(unsigned long r3, + boot_infos_t *bi = (boot_infos_t *) r4; + unsigned long hdr; + unsigned long space; +- unsigned long ptr, x; ++ unsigned long ptr; + char *model; + unsigned long offset = reloc_offset(); + +@@ -562,6 +562,8 @@ void __init bootx_init(unsigned long r3, + * MMU switched OFF, so this should not be useful anymore. + */ + if (bi->version < 4) { ++ unsigned long x __maybe_unused; ++ + bootx_printf("Touching pages...\n"); + + /* diff --git a/queue-4.14/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch b/queue-4.14/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch new file mode 100644 index 00000000000..cd233c417d2 --- /dev/null +++ b/queue-4.14/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sergey Senozhatsky +Date: Wed, 30 May 2018 16:03:50 +0900 +Subject: printk: drop in_nmi check from printk_safe_flush_on_panic() + +From: Sergey Senozhatsky + +[ Upstream commit 554755be08fba31c74f66b82a485e5513205af84 ] + +Drop the in_nmi() check from printk_safe_flush_on_panic() +and attempt to re-init (IOW unlock) locked logbuf spinlock +from panic CPU regardless of its context. + +Otherwise, theoretically, we can deadlock on logbuf trying to flush +per-CPU buffers: + + a) Panic CPU is running in non-NMI context + b) Panic CPU sends out shutdown IPI via reboot vector + c) Panic CPU fails to stop all remote CPUs + d) Panic CPU sends out shutdown IPI via NMI vector + One of the CPUs that we bring down via NMI vector can hold + logbuf spin lock (theoretically). + +Link: http://lkml.kernel.org/r/20180530070350.10131-1-sergey.senozhatsky@gmail.com +To: Steven Rostedt +Cc: Peter Zijlstra +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/printk/printk_safe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/printk/printk_safe.c ++++ b/kernel/printk/printk_safe.c +@@ -284,7 +284,7 @@ void printk_safe_flush_on_panic(void) + * Make sure that we could access the main ring buffer. + * Do not risk a double release when more CPUs are up. + */ +- if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) { ++ if (raw_spin_is_locked(&logbuf_lock)) { + if (num_online_cpus() > 1) + return; + diff --git a/queue-4.14/rdma-mad-convert-bug_ons-to-error-flows.patch b/queue-4.14/rdma-mad-convert-bug_ons-to-error-flows.patch new file mode 100644 index 00000000000..63637767d63 --- /dev/null +++ b/queue-4.14/rdma-mad-convert-bug_ons-to-error-flows.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Leon Romanovsky +Date: Tue, 29 May 2018 14:56:19 +0300 +Subject: RDMA/mad: Convert BUG_ONs to error flows + +From: Leon Romanovsky + +[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ] + +Let's perform checks in-place instead of BUG_ONs. + +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/mad.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -1558,7 +1558,8 @@ static int add_oui_reg_req(struct ib_mad + mad_reg_req->oui, 3)) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(!*method); ++ if (!*method) ++ goto error3; + goto check_in_use; + } + } +@@ -1568,10 +1569,12 @@ static int add_oui_reg_req(struct ib_mad + vclass]->oui[i])) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(*method); + /* Allocate method table for this OUI */ +- if ((ret = allocate_method_table(method))) +- goto error3; ++ if (!*method) { ++ ret = allocate_method_table(method); ++ if (ret) ++ goto error3; ++ } + memcpy((*vendor_table)->vendor_class[vclass]->oui[i], + mad_reg_req->oui, 3); + goto check_in_use; diff --git a/queue-4.14/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch b/queue-4.14/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch new file mode 100644 index 00000000000..1fed14ba3b2 --- /dev/null +++ b/queue-4.14/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch @@ -0,0 +1,109 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Douglas Anderson +Date: Wed, 18 Apr 2018 08:54:18 -0700 +Subject: regulator: Don't return or expect -errno from of_map_mode() + +From: Douglas Anderson + +[ Upstream commit 02f3703934a42417021405ef336fe45add13c3d1 ] + +In of_get_regulation_constraints() we were taking the result of +of_map_mode() (an unsigned int) and assigning it to an int. We were +then checking whether this value was -EINVAL. Some implementers of +of_map_mode() were returning -EINVAL (even though the return type of +their function needed to be unsigned int) because they needed to +signal an error back to of_get_regulation_constraints(). + +In general in the regulator framework the mode is always referred to +as an unsigned int. While we could fix this to be a signed int (the +highest value we store in there right now is 0x8), it's actually +pretty clean to just define the regulator mode 0x0 (the lack of any +bits set) as an invalid mode. Let's do that. + +Fixes: 5e5e3a42c653 ("regulator: of: Add support for parsing initial and suspend modes") +Suggested-by: Javier Martinez Canillas +Signed-off-by: Douglas Anderson +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/cpcap-regulator.c | 2 +- + drivers/regulator/of_regulator.c | 13 +++++++------ + drivers/regulator/twl-regulator.c | 2 +- + include/linux/regulator/consumer.h | 1 + + 4 files changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/regulator/cpcap-regulator.c ++++ b/drivers/regulator/cpcap-regulator.c +@@ -222,7 +222,7 @@ static unsigned int cpcap_map_mode(unsig + case CPCAP_BIT_AUDIO_LOW_PWR: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -31,6 +31,7 @@ static void of_get_regulation_constraint + struct regulation_constraints *constraints = &(*init_data)->constraints; + struct regulator_state *suspend_state; + struct device_node *suspend_np; ++ unsigned int mode; + int ret, i; + u32 pval; + +@@ -124,11 +125,11 @@ static void of_get_regulation_constraint + + if (!of_property_read_u32(np, "regulator-initial-mode", &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", np->name, pval); + else +- constraints->initial_mode = ret; ++ constraints->initial_mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +@@ -163,12 +164,12 @@ static void of_get_regulation_constraint + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", + np->name, pval); + else +- suspend_state->mode = ret; ++ suspend_state->mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +--- a/drivers/regulator/twl-regulator.c ++++ b/drivers/regulator/twl-regulator.c +@@ -274,7 +274,7 @@ static inline unsigned int twl4030reg_ma + case RES_STATE_SLEEP: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -80,6 +80,7 @@ struct regmap; + * These modes can be OR'ed together to make up a mask of valid register modes. + */ + ++#define REGULATOR_MODE_INVALID 0x0 + #define REGULATOR_MODE_FAST 0x1 + #define REGULATOR_MODE_NORMAL 0x2 + #define REGULATOR_MODE_IDLE 0x4 diff --git a/queue-4.14/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch b/queue-4.14/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch new file mode 100644 index 00000000000..23cbf122be1 --- /dev/null +++ b/queue-4.14/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Anson Huang +Date: Thu, 17 May 2018 15:27:22 +0800 +Subject: regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops + +From: Anson Huang + +[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ] + +If is_enabled() is not defined, regulator core will assume +this regulator is already enabled, then it can NOT be really +enabled after disabled. + +Based on Li Jun's patch from the NXP kernel tree. + +Signed-off-by: Anson Huang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/pfuze100-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze1 + static const struct regulator_ops pfuze100_swb_regulator_ops = { + .enable = regulator_enable_regmap, + .disable = regulator_disable_regmap, ++ .is_enabled = regulator_is_enabled_regmap, + .list_voltage = regulator_list_voltage_table, + .map_voltage = regulator_map_voltage_ascend, + .set_voltage_sel = regulator_set_voltage_sel_regmap, diff --git a/queue-4.14/rsi-fix-invalid-vdd-warning-in-mmc.patch b/queue-4.14/rsi-fix-invalid-vdd-warning-in-mmc.patch new file mode 100644 index 00000000000..10bc819a283 --- /dev/null +++ b/queue-4.14/rsi-fix-invalid-vdd-warning-in-mmc.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Siva Rebbagondla +Date: Wed, 11 Apr 2018 12:13:32 +0530 +Subject: rsi: Fix 'invalid vdd' warning in mmc + +From: Siva Rebbagondla + +[ Upstream commit 78e450719c702784e42af6da912d3692fd3da0cb ] + +While performing cleanup, driver is messing with card->ocr +value by not masking rocr against ocr_avail. Below panic +is observed with some of the SDIO host controllers due to +this. Issue is resolved by reverting incorrect modifications +to vdd. + +[ 927.423821] mmc1: Invalid vdd 0x1f +[ 927.423925] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x + mac80211 cfg80211 btrsi rfcomm bluetooth ecdh_generic +[ 927.424073] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000-caracalla #1 +[ 927.424075] Hardware name: Dell Inc. Edge Gateway 3003/ , BIOS 01.00.06 01/22/2018 +[ 927.424082] RIP: 0010:sdhci_set_power_noreg+0xdd/0x190[sdhci] +[ 927.424085] RSP: 0018:ffffac3fc064b930 EFLAGS: 00010282 +[ 927.424107] Call Trace: +[ 927.424118] sdhci_set_power+0x5a/0x60 [sdhci] +[ 927.424125] sdhci_set_ios+0x360/0x3b0 [sdhci] +[ 927.424133] mmc_set_initial_state+0x92/0x120 +[ 927.424137] mmc_power_up.part.34+0x33/0x1d0 +[ 927.424141] mmc_power_up+0x17/0x20 +[ 927.424147] mmc_sdio_runtime_resume+0x2d/0x50 +[ 927.424151] mmc_runtime_resume+0x17/0x20 +[ 927.424156] __rpm_callback+0xc4/0x200 +[ 927.424161] ? idr_alloc_cyclic+0x57/0xd0 +[ 927.424165] ? mmc_runtime_suspend+0x20/0x20 +[ 927.424169] rpm_callback+0x24/0x80 +[ 927.424172] ? mmc_runtime_suspend+0x20/0x20 +[ 927.424176] rpm_resume+0x4b3/0x6c0 +[ 927.424181] __pm_runtime_resume+0x4e/0x80 +[ 927.424188] driver_probe_device+0x41/0x490 +[ 927.424192] __driver_attach+0xdf/0xf0 +[ 927.424196] ? driver_probe_device+0x490/0x490 +[ 927.424201] bus_for_each_dev+0x6c/0xc0 +[ 927.424205] driver_attach+0x1e/0x20 +[ 927.424209] bus_add_driver+0x1f4/0x270 +[ 927.424217] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.424221] driver_register+0x60/0xe0 +[ 927.424227] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.424231] sdio_register_driver+0x20/0x30 +[ 927.424237] rsi_module_init+0x16/0x40 [rsi_sdio] + +Signed-off-by: Siva Rebbagondla +Signed-off-by: Amitkumar Karwar +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -161,7 +161,6 @@ static void rsi_reset_card(struct sdio_f + int err; + struct mmc_card *card = pfunction->card; + struct mmc_host *host = card->host; +- s32 bit = (fls(host->ocr_avail) - 1); + u8 cmd52_resp; + u32 clock, resp, i; + u16 rca; +@@ -181,7 +180,6 @@ static void rsi_reset_card(struct sdio_f + msleep(20); + + /* Initialize the SDIO card */ +- host->ios.vdd = bit; + host->ios.chip_select = MMC_CS_DONTCARE; + host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN; + host->ios.power_mode = MMC_POWER_UP; diff --git a/queue-4.14/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch b/queue-4.14/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch new file mode 100644 index 00000000000..ebe2b428a51 --- /dev/null +++ b/queue-4.14/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch @@ -0,0 +1,209 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Siva Rebbagondla +Date: Wed, 11 Apr 2018 12:13:31 +0530 +Subject: rsi: fix nommu_map_sg overflow kernel panic + +From: Siva Rebbagondla + +[ Upstream commit f700546682a62a87a9615121a37ee7452dab4b76 ] + +Following overflow kernel panic is observed on some platforms while +loading the driver. It is fixed if dynamically allocated memory is +passed to SDIO instead of static one + +[ 927.513963] nommu_map_sg: overflow 17d54064ba7c+20 of device mask ffffffff +[ 927.517712] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x mac80211 cfg80211 + btrsi rfcomm bluetooth ecdh_generic snd_soc_sst_bytcr_rt5660 +[ 927.517861] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000 #1 +[ 927.517870] RIP: 0010:sdhci_send_command+0x5f0/0xa90 [sdhci] +[ 927.517873] RSP: 0000:ffffac3fc064b6d8 EFLAGS: 00010086 +[ 927.517895] Call Trace: +[ 927.517908] ? __schedule+0x3cd/0x890 +[ 927.517915] ? mod_timer+0x17b/0x3c0 +[ 927.517922] sdhci_request+0x7c/0xf0 [sdhci] +[ 927.517928] __mmc_start_request+0x5a/0x170 +[ 927.517932] mmc_start_request+0x74/0x90 +[ 927.517936] mmc_wait_for_req+0x87/0xe0 +[ 927.517940] mmc_io_rw_extended+0x2fd/0x330 +[ 927.517946] ? mmc_wait_data_done+0x30/0x30 +[ 927.517951] sdio_io_rw_ext_helper+0x160/0x210 +[ 927.517956] sdio_writesb+0x1d/0x20 +[ 927.517966] rsi_sdio_write_register_multiple+0x68/0x110 [rsi_sdio] +[ 927.517976] rsi_hal_device_init+0x357/0x910 [rsi_91x] +[ 927.517983] ? rsi_hal_device_init+0x357/0x910 [rsi_91x] +[ 927.517990] rsi_probe+0x2c6/0x450 [rsi_sdio] +[ 927.517995] sdio_bus_probe+0xfc/0x110 +[ 927.518000] driver_probe_device+0x2b3/0x490 +[ 927.518005] __driver_attach+0xdf/0xf0 +[ 927.518008] ? driver_probe_device+0x490/0x490 +[ 927.518014] bus_for_each_dev+0x6c/0xc0 +[ 927.518018] driver_attach+0x1e/0x20 +[ 927.518021] bus_add_driver+0x1f4/0x270 +[ 927.518028] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.518031] driver_register+0x60/0xe0 +[ 927.518038] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.518041] sdio_register_driver+0x20/0x30 +[ 927.518047] rsi_module_init+0x16/0x40 [rsi_sdio] + +Signed-off-by: Siva Rebbagondla +Signed-off-by: Amitkumar Karwar +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_hal.c | 35 +++++++++++++++++++------------- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 21 ++++++++++++------- + drivers/net/wireless/rsi/rsi_sdio.h | 2 - + 3 files changed, 36 insertions(+), 22 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -557,28 +557,32 @@ static int bl_write_header(struct rsi_hw + u32 content_size) + { + struct rsi_host_intf_ops *hif_ops = adapter->host_intf_ops; +- struct bl_header bl_hdr; ++ struct bl_header *bl_hdr; + u32 write_addr, write_len; + int status; + +- bl_hdr.flags = 0; +- bl_hdr.image_no = cpu_to_le32(adapter->priv->coex_mode); +- bl_hdr.check_sum = cpu_to_le32( +- *(u32 *)&flash_content[CHECK_SUM_OFFSET]); +- bl_hdr.flash_start_address = cpu_to_le32( +- *(u32 *)&flash_content[ADDR_OFFSET]); +- bl_hdr.flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); ++ bl_hdr = kzalloc(sizeof(*bl_hdr), GFP_KERNEL); ++ if (!bl_hdr) ++ return -ENOMEM; ++ ++ bl_hdr->flags = 0; ++ bl_hdr->image_no = cpu_to_le32(adapter->priv->coex_mode); ++ bl_hdr->check_sum = ++ cpu_to_le32(*(u32 *)&flash_content[CHECK_SUM_OFFSET]); ++ bl_hdr->flash_start_address = ++ cpu_to_le32(*(u32 *)&flash_content[ADDR_OFFSET]); ++ bl_hdr->flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); + write_len = sizeof(struct bl_header); + + if (adapter->rsi_host_intf == RSI_HOST_INTF_USB) { + write_addr = PING_BUFFER_ADDRESS; + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } else { + write_addr = PING_BUFFER_ADDRESS >> 16; +@@ -587,20 +591,23 @@ static int bl_write_header(struct rsi_hw + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return status; ++ goto fail; + } + write_addr = RSI_SD_REQUEST_MASTER | + (PING_BUFFER_ADDRESS & 0xFFFF); + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } +- return 0; ++ status = 0; ++fail: ++ kfree(bl_hdr); ++ return status; + } + + static u32 read_flash_capacity(struct rsi_hw *adapter) +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -968,17 +968,21 @@ static void ulp_read_write(struct rsi_hw + /*This function resets and re-initializes the chip.*/ + static void rsi_reset_chip(struct rsi_hw *adapter) + { +- __le32 data; ++ u8 *data; + u8 sdio_interrupt_status = 0; + u8 request = 1; + int ret; + ++ data = kzalloc(sizeof(u32), GFP_KERNEL); ++ if (!data) ++ return; ++ + rsi_dbg(INFO_ZONE, "Writing disable to wakeup register\n"); + ret = rsi_sdio_write_register(adapter, 0, SDIO_WAKEUP_REG, &request); + if (ret < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to write SDIO wakeup register\n", __func__); +- return; ++ goto err; + } + msleep(20); + ret = rsi_sdio_read_register(adapter, RSI_FN1_INT_REGISTER, +@@ -986,7 +990,7 @@ static void rsi_reset_chip(struct rsi_hw + if (ret < 0) { + rsi_dbg(ERR_ZONE, "%s: Failed to Read Intr Status Register\n", + __func__); +- return; ++ goto err; + } + rsi_dbg(INFO_ZONE, "%s: Intr Status Register value = %d\n", + __func__, sdio_interrupt_status); +@@ -996,17 +1000,17 @@ static void rsi_reset_chip(struct rsi_hw + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return; ++ goto err; + } + +- data = TA_HOLD_THREAD_VALUE; ++ put_unaligned_le32(TA_HOLD_THREAD_VALUE, data); + if (rsi_sdio_write_register_multiple(adapter, TA_HOLD_THREAD_REG | + RSI_SD_REQUEST_MASTER, +- (u8 *)&data, 4)) { ++ data, 4)) { + rsi_dbg(ERR_ZONE, + "%s: Unable to hold Thread-Arch processor threads\n", + __func__); +- return; ++ goto err; + } + + /* This msleep will ensure Thread-Arch processor to go to hold +@@ -1027,6 +1031,9 @@ static void rsi_reset_chip(struct rsi_hw + * read write operations to complete for chip reset. + */ + msleep(500); ++err: ++ kfree(data); ++ return; + } + + /** +--- a/drivers/net/wireless/rsi/rsi_sdio.h ++++ b/drivers/net/wireless/rsi/rsi_sdio.h +@@ -85,7 +85,7 @@ enum sdio_interrupt_type { + #define TA_SOFT_RST_CLR 0 + #define TA_SOFT_RST_SET BIT(0) + #define TA_PC_ZERO 0 +-#define TA_HOLD_THREAD_VALUE cpu_to_le32(0xF) ++#define TA_HOLD_THREAD_VALUE 0xF + #define TA_RELEASE_THREAD_VALUE cpu_to_le32(0xF) + #define TA_BASE_ADDR 0x2200 + #define MISC_CFG_BASE_ADDR 0x4105 diff --git a/queue-4.14/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch b/queue-4.14/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch new file mode 100644 index 00000000000..b368b29e390 --- /dev/null +++ b/queue-4.14/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexandre Belloni +Date: Tue, 5 Jun 2018 23:09:14 +0200 +Subject: rtc: ensure rtc_set_alarm fails when alarms are not supported + +From: Alexandre Belloni + +[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ] + +When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set, +rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the +subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that +case. + +Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting +programs think the alarms are working for a particular RTC when they are +not. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/interface.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -359,6 +359,11 @@ int rtc_set_alarm(struct rtc_device *rtc + { + int err; + ++ if (!rtc->ops) ++ return -ENODEV; ++ else if (!rtc->ops->set_alarm) ++ return -EINVAL; ++ + err = rtc_valid_tm(&alarm->time); + if (err != 0) + return err; diff --git a/queue-4.14/rtc-tps6586x-fix-possible-race-condition.patch b/queue-4.14/rtc-tps6586x-fix-possible-race-condition.patch new file mode 100644 index 00000000000..190c981ac88 --- /dev/null +++ b/queue-4.14/rtc-tps6586x-fix-possible-race-condition.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:48:17 +0200 +Subject: rtc: tps6586x: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit 63d22063073b0ab46d1e06fe633fb5de8f5c58e1 ] + +The probe function is not allowed to fail after the RTC is registered +because the following may happen: + +CPU0: CPU1: +sys_load_module() + do_init_module() + do_one_initcall() + cmos_do_probe() + rtc_device_register() + __register_chrdev() + cdev->owner = struct module* + open("/dev/rtc0") + rtc_device_unregister() + module_put() + free_module() + module_free(mod->module_core) + /* struct module *module is now + freed */ + chrdev_open() + spin_lock(cdev_lock) + cdev_get() + try_module_get() + module_is_live() + /* dereferences already + freed struct module* */ + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-tps6586x.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/rtc/rtc-tps6586x.c ++++ b/drivers/rtc/rtc-tps6586x.c +@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct pla + device_init_wakeup(&pdev->dev, 1); + + platform_set_drvdata(pdev, rtc); +- rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev), +- &tps6586x_rtc_ops, THIS_MODULE); ++ rtc->rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc->rtc)) { + ret = PTR_ERR(rtc->rtc); +- dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret); + goto fail_rtc_register; + } + ++ rtc->rtc->ops = &tps6586x_rtc_ops; ++ + ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL, + tps6586x_rtc_irq, + IRQF_ONESHOT, +@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct pla + goto fail_rtc_register; + } + disable_irq(rtc->irq); ++ ++ ret = rtc_register_device(rtc->rtc); ++ if (ret) { ++ dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ goto fail_rtc_register; ++ } ++ + return 0; + + fail_rtc_register: diff --git a/queue-4.14/rtc-tps65910-fix-possible-race-condition.patch b/queue-4.14/rtc-tps65910-fix-possible-race-condition.patch new file mode 100644 index 00000000000..453f6935ac5 --- /dev/null +++ b/queue-4.14/rtc-tps65910-fix-possible-race-condition.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:26:21 +0200 +Subject: rtc: tps65910: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit e6000a438e534ee0afd9e83b67f4e23a26dd1067 ] + +The IRQ is requested before the struct rtc is allocated and registered, but +this struct is used in the IRQ handler. This may lead to a NULL pointer +dereference. + +Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc +before requesting the IRQ. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-tps65910.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/rtc/rtc-tps65910.c ++++ b/drivers/rtc/rtc-tps65910.c +@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct pla + if (!tps_rtc) + return -ENOMEM; + ++ tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(tps_rtc->rtc)) ++ return PTR_ERR(tps_rtc->rtc); ++ + /* Clear pending interrupts */ + ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg); + if (ret < 0) +@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct pla + tps_rtc->irq = irq; + device_set_wakeup_capable(&pdev->dev, 1); + +- tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name, +- &tps65910_rtc_ops, THIS_MODULE); +- if (IS_ERR(tps_rtc->rtc)) { +- ret = PTR_ERR(tps_rtc->rtc); ++ tps_rtc->rtc->ops = &tps65910_rtc_ops; ++ ++ ret = rtc_register_device(tps_rtc->rtc); ++ if (ret) { + dev_err(&pdev->dev, "RTC device register: err %d\n", ret); + return ret; + } diff --git a/queue-4.14/rtc-vr41xx-fix-possible-race-condition.patch b/queue-4.14/rtc-vr41xx-fix-possible-race-condition.patch new file mode 100644 index 00000000000..3b21c7bb6b9 --- /dev/null +++ b/queue-4.14/rtc-vr41xx-fix-possible-race-condition.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:47:05 +0200 +Subject: rtc: vr41xx: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit 9a99247c9c1d1c95c6e8153d013979aac6111c6e ] + +The probe function is not allowed to fail after the RTC is registered +because the following may happen: + +CPU0: CPU1: +sys_load_module() + do_init_module() + do_one_initcall() + cmos_do_probe() + rtc_device_register() + __register_chrdev() + cdev->owner = struct module* + open("/dev/rtc0") + rtc_device_unregister() + module_put() + free_module() + module_free(mod->module_core) + /* struct module *module is now + freed */ + chrdev_open() + spin_lock(cdev_lock) + cdev_get() + try_module_get() + module_is_live() + /* dereferences already + freed struct module* */ + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-vr41xx.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-vr41xx.c ++++ b/drivers/rtc/rtc-vr41xx.c +@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_dev + goto err_rtc1_iounmap; + } + +- rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops, +- THIS_MODULE); ++ rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc)) { + retval = PTR_ERR(rtc); + goto err_iounmap_all; + } + ++ rtc->ops = &vr41xx_rtc_ops; ++ + rtc->max_user_freq = MAX_PERIODIC_RATE; + + spin_lock_irq(&rtc_lock); +@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_dev + + dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n"); + ++ retval = rtc_register_device(rtc); ++ if (retval) ++ goto err_iounmap_all; ++ + return 0; + + err_iounmap_all: diff --git a/queue-4.14/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch b/queue-4.14/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch new file mode 100644 index 00000000000..202c0f38196 --- /dev/null +++ b/queue-4.14/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Thomas Richter +Date: Tue, 8 May 2018 10:18:39 +0200 +Subject: s390/cpum_sf: Add data entry sizes to sampling trailer entry + +From: Thomas Richter + +[ Upstream commit 77715b7ddb446bd39a06f3376e85f4bb95b29bb8 ] + +The CPU Measurement sampling facility creates a trailer entry for each +Sample-Data-Block of stored samples. The trailer entry contains the sizes +(in bytes) of the stored sampling types: + - basic-sampling data entry size + - diagnostic-sampling data entry size +Both sizes are 2 bytes long. + +This patch changes the trailer entry definition to reflect this. + +Fixes: fcc77f507333 ("s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks") +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/cpu_mf.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/s390/include/asm/cpu_mf.h ++++ b/arch/s390/include/asm/cpu_mf.h +@@ -132,7 +132,9 @@ struct hws_trailer_entry { + unsigned int f:1; /* 0 - Block Full Indicator */ + unsigned int a:1; /* 1 - Alert request control */ + unsigned int t:1; /* 2 - Timestamp format */ +- unsigned long long:61; /* 3 - 63: Reserved */ ++ unsigned int :29; /* 3 - 31: Reserved */ ++ unsigned int bsdes:16; /* 32-47: size of basic SDE */ ++ unsigned int dsdes:16; /* 48-63: size of diagnostic SDE */ + }; + unsigned long long flags; /* 0 - 63: All indicators */ + }; diff --git a/queue-4.14/scsi-3w-9xxx-fix-a-missing-check-bug.patch b/queue-4.14/scsi-3w-9xxx-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..53cdbaa7ca7 --- /dev/null +++ b/queue-4.14/scsi-3w-9xxx-fix-a-missing-check-bug.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wenwen Wang +Date: Mon, 7 May 2018 19:46:43 -0500 +Subject: scsi: 3w-9xxx: fix a missing-check bug + +From: Wenwen Wang + +[ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ] + +In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from +the userspace pointer 'argp' and saved to the kernel object +'driver_command'. Then a security check is performed on the data buffer +size indicated by 'driver_command', which is +'driver_command.buffer_length'. If the security check is passed, the +entire ioctl command is copied again from the 'argp' pointer and saved +to the kernel object 'tw_ioctl'. Then, various operations are performed +on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer +resides in userspace, a malicious userspace process can race to change +the buffer size between the two copies. This way, the user can bypass +the security check and inject invalid data buffer size. This can cause +potential security issues in the following execution. + +This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o +avoid the above issues. + +Signed-off-by: Wenwen Wang +Acked-by: Adam Radford +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/3w-9xxx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -886,6 +886,11 @@ static int twa_chrdev_open(struct inode + unsigned int minor_number; + int retval = TW_IOCTL_ERROR_OS_ENODEV; + ++ if (!capable(CAP_SYS_ADMIN)) { ++ retval = -EACCES; ++ goto out; ++ } ++ + minor_number = iminor(inode); + if (minor_number >= twa_device_extension_count) + goto out; diff --git a/queue-4.14/scsi-3w-xxxx-fix-a-missing-check-bug.patch b/queue-4.14/scsi-3w-xxxx-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..228ac615273 --- /dev/null +++ b/queue-4.14/scsi-3w-xxxx-fix-a-missing-check-bug.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Wenwen Wang +Date: Mon, 7 May 2018 19:54:01 -0500 +Subject: scsi: 3w-xxxx: fix a missing-check bug + +From: Wenwen Wang + +[ Upstream commit 9899e4d3523faaef17c67141aa80ff2088f17871 ] + +In tw_chrdev_ioctl(), the length of the data buffer is firstly copied +from the userspace pointer 'argp' and saved to the kernel object +'data_buffer_length'. Then a security check is performed on it to make +sure that the length is not more than 'TW_MAX_IOCTL_SECTORS * +512'. Otherwise, an error code -EINVAL is returned. If the security +check is passed, the entire ioctl command is copied again from the +'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various +operations are performed on 'tw_ioctl' according to the 'cmd'. Given +that the 'argp' pointer resides in userspace, a malicious userspace +process can race to change the buffer length between the two +copies. This way, the user can bypass the security check and inject +invalid data buffer length. This can cause potential security issues in +the following execution. + +This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to +avoid the above issues. + +Signed-off-by: Wenwen Wang +Acked-by: Adam Radford +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/3w-xxxx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode * + + dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n"); + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + minor_number = iminor(inode); + if (minor_number >= tw_device_extension_count) + return -ENODEV; diff --git a/queue-4.14/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch b/queue-4.14/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch new file mode 100644 index 00000000000..6070933901f --- /dev/null +++ b/queue-4.14/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Matthew R. Ochs" +Date: Mon, 26 Mar 2018 11:30:22 -0500 +Subject: scsi: cxlflash: Avoid clobbering context control register value + +From: "Matthew R. Ochs" + +[ Upstream commit 465891fe9237b02f8d0fd26448f733fae7236f4a ] + +The SISLite specification originally defined the context control register with +a single field of bits to represent the LISN and also stipulated that the +register reset value be 0. The cxlflash driver took advantage of this when +programming the LISN for the master contexts via an unconditional write - no +other bits were preserved. + +When unmap support was added, SISLite was updated to define bit 0 of the +context control register as a way for the AFU to notify the context owner that +unmap operations were supported. Thus the assumptions under which the register +is setup changed and the existing unconditional write is clobbering the unmap +state for master contexts. This is presently not an issue due to the order in +which the context control register is programmed in relation to the unmap bit +being queried but should be addressed to avoid a future regression in the +event this code is moved elsewhere. + +To remedy this issue, preserve the bits when programming the LISN field in the +context control register. Since the LISN will now be programmed using a read +value, assert that the initial state of the LISN field is as described in +SISLite (0). + +Signed-off-by: Matthew R. Ochs +Signed-off-by: Uma Krishnan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/cxlflash/main.c | 5 ++++- + drivers/scsi/cxlflash/sislite.h | 1 + + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/cxlflash/main.c ++++ b/drivers/scsi/cxlflash/main.c +@@ -1303,7 +1303,10 @@ static void afu_err_intr_init(struct afu + for (i = 0; i < afu->num_hwqs; i++) { + hwq = get_hwq(afu, i); + +- writeq_be(SISL_MSI_SYNC_ERROR, &hwq->host_map->ctx_ctrl); ++ reg = readq_be(&hwq->host_map->ctx_ctrl); ++ WARN_ON((reg & SISL_CTX_CTRL_LISN_MASK) != 0); ++ reg |= SISL_MSI_SYNC_ERROR; ++ writeq_be(reg, &hwq->host_map->ctx_ctrl); + writeq_be(SISL_ISTATUS_MASK, &hwq->host_map->intr_mask); + } + } +--- a/drivers/scsi/cxlflash/sislite.h ++++ b/drivers/scsi/cxlflash/sislite.h +@@ -284,6 +284,7 @@ struct sisl_host_map { + __be64 cmd_room; + __be64 ctx_ctrl; /* least significant byte or b56:63 is LISN# */ + #define SISL_CTX_CTRL_UNMAP_SECTOR 0x8000000000000000ULL /* b0 */ ++#define SISL_CTX_CTRL_LISN_MASK (0xFFULL) + __be64 mbox_w; /* restricted use */ + __be64 sq_start; /* Submission Queue (R/W): write sequence and */ + __be64 sq_end; /* inclusion semantics are the same as RRQ */ diff --git a/queue-4.14/scsi-cxlflash-synchronize-reset-and-remove-ops.patch b/queue-4.14/scsi-cxlflash-synchronize-reset-and-remove-ops.patch new file mode 100644 index 00000000000..3dfc647317d --- /dev/null +++ b/queue-4.14/scsi-cxlflash-synchronize-reset-and-remove-ops.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Uma Krishnan +Date: Mon, 26 Mar 2018 11:35:27 -0500 +Subject: scsi: cxlflash: Synchronize reset and remove ops + +From: Uma Krishnan + +[ Upstream commit a3feb6ef50def7c91244d7bd15a3625b7b49b81f ] + +The following Oops can be encountered if a device removal or system shutdown +is initiated while an EEH recovery is in process: + +[c000000ff2f479c0] c008000015256f18 cxlflash_pci_slot_reset+0xa0/0x100 + [cxlflash] +[c000000ff2f47a30] c00800000dae22e0 cxl_pci_slot_reset+0x168/0x290 [cxl] +[c000000ff2f47ae0] c00000000003ef1c eeh_report_reset+0xec/0x170 +[c000000ff2f47b20] c00000000003d0b8 eeh_pe_dev_traverse+0x98/0x170 +[c000000ff2f47bb0] c00000000003f80c eeh_handle_normal_event+0x56c/0x580 +[c000000ff2f47c60] c00000000003fba4 eeh_handle_event+0x2a4/0x338 +[c000000ff2f47d10] c0000000000400b8 eeh_event_handler+0x1f8/0x200 +[c000000ff2f47dc0] c00000000013da48 kthread+0x1a8/0x1b0 +[c000000ff2f47e30] c00000000000b528 ret_from_kernel_thread+0x5c/0xb4 + +The remove handler frees AFU memory while the EEH recovery is in progress, +leading to a race condition. This can result in a crash if the recovery thread +tries to access this memory. + +To resolve this issue, the cxlflash remove handler will evaluate the device +state and yield to any active reset or probing threads. + +Signed-off-by: Uma Krishnan +Acked-by: Matthew R. Ochs +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/cxlflash/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/cxlflash/main.c ++++ b/drivers/scsi/cxlflash/main.c +@@ -946,9 +946,9 @@ static void cxlflash_remove(struct pci_d + return; + } + +- /* If a Task Management Function is active, wait for it to complete +- * before continuing with remove. +- */ ++ /* Yield to running recovery threads before continuing with remove */ ++ wait_event(cfg->reset_waitq, cfg->state != STATE_RESET && ++ cfg->state != STATE_PROBING); + spin_lock_irqsave(&cfg->tmf_slock, lock_flags); + if (cfg->tmf_active) + wait_event_interruptible_lock_irq(cfg->tmf_waitq, diff --git a/queue-4.14/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch b/queue-4.14/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch new file mode 100644 index 00000000000..12e25becc5b --- /dev/null +++ b/queue-4.14/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch @@ -0,0 +1,61 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Xiang Chen +Date: Wed, 2 May 2018 23:56:31 +0800 +Subject: scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw + +From: Xiang Chen + +[ Upstream commit 9413532788df7470297dd0475995c5dc5b07f362 ] + +As a unconstrained command, a command can be sent to SATA disk even if +SATA disk status is BUSY, ERR or DRQ. + +If an ATA reset assert is successful but ATA reset de-assert fails, then +it will retry the reset de-assert. If reset de- assert retry is +successful, we think it is okay to probe the device but actually it +still has Err status. + +Apparently we need to retry the ATA reset assertion and de- assertion +instead for this mentioned scenario. + +As such, we config ATA reset assert as a constrained command, if ATA +reset de-assert fails, then ATA reset de-assert retry will also +fail. Then we will retry the proper process of ATA reset assert and +de-assert again. + +Signed-off-by: Xiang Chen +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -328,10 +328,11 @@ enum { + #define DIR_TO_DEVICE 2 + #define DIR_RESERVED 3 + +-#define CMD_IS_UNCONSTRAINT(cmd) \ +- ((cmd == ATA_CMD_READ_LOG_EXT) || \ +- (cmd == ATA_CMD_READ_LOG_DMA_EXT) || \ +- (cmd == ATA_CMD_DEV_RESET)) ++#define FIS_CMD_IS_UNCONSTRAINED(fis) \ ++ ((fis.command == ATA_CMD_READ_LOG_EXT) || \ ++ (fis.command == ATA_CMD_READ_LOG_DMA_EXT) || \ ++ ((fis.command == ATA_CMD_DEV_RESET) && \ ++ ((fis.control & ATA_SRST) != 0))) + + static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off) + { +@@ -1044,7 +1045,7 @@ static int prep_ata_v3_hw(struct hisi_hb + << CMD_HDR_FRAME_TYPE_OFF; + dw1 |= sas_dev->device_id << CMD_HDR_DEV_ID_OFF; + +- if (CMD_IS_UNCONSTRAINT(task->ata_task.fis.command)) ++ if (FIS_CMD_IS_UNCONSTRAINED(task->ata_task.fis)) + dw1 |= 1 << CMD_HDR_UNCON_CMD_OFF; + + hdr->dw1 = cpu_to_le32(dw1); diff --git a/queue-4.14/scsi-megaraid-silence-a-static-checker-bug.patch b/queue-4.14/scsi-megaraid-silence-a-static-checker-bug.patch new file mode 100644 index 00000000000..b999832f660 --- /dev/null +++ b/queue-4.14/scsi-megaraid-silence-a-static-checker-bug.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Dan Carpenter +Date: Thu, 3 May 2018 13:54:32 +0300 +Subject: scsi: megaraid: silence a static checker bug + +From: Dan Carpenter + +[ Upstream commit 27e833dabab74ee665e487e291c9afc6d71effba ] + +If we had more than 32 megaraid cards then it would cause memory +corruption. That's not likely, of course, but it's handy to enforce it +and make the static checker happy. + +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -4199,6 +4199,9 @@ megaraid_probe_one(struct pci_dev *pdev, + int irq, i, j; + int error = -ENODEV; + ++ if (hba_count >= MAX_CONTROLLERS) ++ goto out; ++ + if (pci_enable_device(pdev)) + goto out; + pci_set_master(pdev); diff --git a/queue-4.14/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch b/queue-4.14/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch new file mode 100644 index 00000000000..3d3cd8e513b --- /dev/null +++ b/queue-4.14/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Shivasharan S +Date: Fri, 6 Apr 2018 02:02:11 -0700 +Subject: scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs + +From: Shivasharan S + +[ Upstream commit 3239b8cd28fd849a2023483257d35d68c5876c74 ] + +Hardware could time out Fastpath IOs one second earlier than the timeout +provided by the host. + +For non-RAID devices, driver provides timeout value based on OS provided +timeout value. Under certain scenarios, if the OS provides a timeout +value of 1 second, due to above behavior hardware will timeout +immediately. + +Increase timeout value for non-RAID fastpath IOs by 1 second. + +Signed-off-by: Shivasharan S +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -2677,6 +2677,9 @@ megasas_build_syspd_fusion(struct megasa + pRAID_Context->timeout_value = cpu_to_le16(os_timeout_value); + pRAID_Context->virtual_disk_tgt_id = cpu_to_le16(device_id); + } else { ++ if (os_timeout_value) ++ os_timeout_value++; ++ + /* system pd Fast Path */ + io_request->Function = MPI2_FUNCTION_SCSI_IO_REQUEST; + timeout_limit = (scmd->device->type == TYPE_DISK) ? diff --git a/queue-4.14/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch b/queue-4.14/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch new file mode 100644 index 00000000000..67d866c49e5 --- /dev/null +++ b/queue-4.14/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Chad Dupuis +Date: Wed, 25 Apr 2018 06:09:02 -0700 +Subject: scsi: qedf: Set the UNLOADING flag when removing a vport + +From: Chad Dupuis + +[ Upstream commit 4f4616ceebaf045c59e8a6aa01f08826d18d5c63 ] + +Similar to what we do when we remove a PCI function, set the +QEDF_UNLOADING flag to prevent any requests from being queued while a +vport is being deleted. This prevents any requests from getting stuck +in limbo when the vport is unloaded or deleted. + +Fixes the crash: + +PID: 106676 TASK: ffff9a436aa90000 CPU: 12 COMMAND: "multipathd" + #0 [ffff9a43567d3550] machine_kexec+522 at ffffffffaca60b2a + #1 [ffff9a43567d35b0] __crash_kexec+114 at ffffffffacb13512 + #2 [ffff9a43567d3680] crash_kexec+48 at ffffffffacb13600 + #3 [ffff9a43567d3698] oops_end+168 at ffffffffad117768 + #4 [ffff9a43567d36c0] no_context+645 at ffffffffad106f52 + #5 [ffff9a43567d3710] __bad_area_nosemaphore+116 at ffffffffad106fe9 + #6 [ffff9a43567d3760] bad_area+70 at ffffffffad107379 + #7 [ffff9a43567d3788] __do_page_fault+1247 at ffffffffad11a8cf + #8 [ffff9a43567d37f0] do_page_fault+53 at ffffffffad11a915 + #9 [ffff9a43567d3820] page_fault+40 at ffffffffad116768 + [exception RIP: qedf_init_task+61] + RIP: ffffffffc0e13c2d RSP: ffff9a43567d38d0 RFLAGS: 00010046 + RAX: 0000000000000000 RBX: ffffbe920472c738 RCX: ffff9a434fa0e3e8 + RDX: ffff9a434f695280 RSI: ffffbe920472c738 RDI: ffff9a43aa359c80 + RBP: ffff9a43567d3950 R8: 0000000000000c15 R9: ffff9a3fb09b9880 + R10: ffff9a434fa0e3e8 R11: ffff9a43567d35ce R12: 0000000000000000 + R13: ffff9a434f695280 R14: ffff9a43aa359c80 R15: ffff9a3fb9e005c0 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Signed-off-by: Chad Dupuis +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qedf/qedf_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1649,6 +1649,15 @@ static int qedf_vport_destroy(struct fc_ + struct Scsi_Host *shost = vport_to_shost(vport); + struct fc_lport *n_port = shost_priv(shost); + struct fc_lport *vn_port = vport->dd_data; ++ struct qedf_ctx *qedf = lport_priv(vn_port); ++ ++ if (!qedf) { ++ QEDF_ERR(NULL, "qedf is NULL.\n"); ++ goto out; ++ } ++ ++ /* Set unloading bit on vport qedf_ctx to prevent more I/O */ ++ set_bit(QEDF_UNLOADING, &qedf->flags); + + mutex_lock(&n_port->lp_mutex); + list_del(&vn_port->list); +@@ -1675,6 +1684,7 @@ static int qedf_vport_destroy(struct fc_ + if (vn_port->host) + scsi_host_put(vn_port->host); + ++out: + return 0; + } + diff --git a/queue-4.14/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch b/queue-4.14/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch new file mode 100644 index 00000000000..29e9e2259e1 --- /dev/null +++ b/queue-4.14/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Xose Vazquez Perez +Date: Sat, 7 Apr 2018 00:47:23 +0200 +Subject: scsi: scsi_dh: replace too broad "TP9" string with the exact models + +From: Xose Vazquez Perez + +[ Upstream commit 37b37d2609cb0ac267280ef27350b962d16d272e ] + +SGI/TP9100 is not an RDAC array: + ^^^ +https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=blob;f=libmultipath/hwtable.c;h=88b4700beb1d8940008020fbe4c3cd97d62f4a56;hb=HEAD#l235 + +This partially reverts commit 35204772ea03 ("[SCSI] scsi_dh_rdac : +Consolidate rdac strings together") + +[mkp: fixed up the new entries to align with rest of struct] + +Cc: NetApp RDAC team +Cc: Hannes Reinecke +Cc: James E.J. Bottomley +Cc: Martin K. Petersen +Cc: SCSI ML +Cc: DM ML +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_dh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -58,7 +58,10 @@ static const struct scsi_dh_blist scsi_d + {"IBM", "3526", "rdac", }, + {"IBM", "3542", "rdac", }, + {"IBM", "3552", "rdac", }, +- {"SGI", "TP9", "rdac", }, ++ {"SGI", "TP9300", "rdac", }, ++ {"SGI", "TP9400", "rdac", }, ++ {"SGI", "TP9500", "rdac", }, ++ {"SGI", "TP9700", "rdac", }, + {"SGI", "IS", "rdac", }, + {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, diff --git a/queue-4.14/scsi-ufs-fix-exception-event-handling.patch b/queue-4.14/scsi-ufs-fix-exception-event-handling.patch new file mode 100644 index 00000000000..5c1546ed784 --- /dev/null +++ b/queue-4.14/scsi-ufs-fix-exception-event-handling.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Maya Erez +Date: Thu, 3 May 2018 16:37:16 +0530 +Subject: scsi: ufs: fix exception event handling + +From: Maya Erez + +[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ] + +The device can set the exception event bit in one of the response UPIU, +for example to notify the need for urgent BKOPs operation. In such a +case, the host driver calls ufshcd_exception_event_handler to handle +this notification. When trying to check the exception event status (for +finding the cause for the exception event), the device may be busy with +additional SCSI commands handling and may not respond within the 100ms +timeout. + +To prevent that, we need to block SCSI commands during handling of +exception events and allow retransmissions of the query requests, in +case of timeout. + +Signed-off-by: Subhash Jadavani +Signed-off-by: Maya Erez +Signed-off-by: Can Guo +Signed-off-by: Asutosh Das +Reviewed-by: Subhash Jadavani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4947,6 +4947,7 @@ static void ufshcd_exception_event_handl + hba = container_of(work, struct ufs_hba, eeh_work); + + pm_runtime_get_sync(hba->dev); ++ scsi_block_requests(hba->host); + err = ufshcd_get_ee_status(hba, &status); + if (err) { + dev_err(hba->dev, "%s: failed to get exception status %d\n", +@@ -4960,6 +4961,7 @@ static void ufshcd_exception_event_handl + ufshcd_bkops_exception_event_handler(hba); + + out: ++ scsi_unblock_requests(hba->host); + pm_runtime_put_sync(hba->dev); + return; + } diff --git a/queue-4.14/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch b/queue-4.14/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch new file mode 100644 index 00000000000..4feb87377e2 --- /dev/null +++ b/queue-4.14/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Subhash Jadavani +Date: Thu, 3 May 2018 16:37:17 +0530 +Subject: scsi: ufs: ufshcd: fix possible unclocked register access + +From: Subhash Jadavani + +[ Upstream commit b334456ec2021b1addc19806990115e69ec4ac32 ] + +Vendor specific setup_clocks ops may depend on clocks managed by ufshcd +driver so if the vendor specific setup_clocks callback is called when +the required clocks are turned off, it results into unclocked register +access. + +This change make sure that required clocks are enabled before vendor +specific setup_clocks callback is called. + +Signed-off-by: Subhash Jadavani +Signed-off-by: Venkat Gopalakrishnan +Signed-off-by: Can Guo +Signed-off-by: Asutosh Das +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6761,9 +6761,16 @@ static int __ufshcd_setup_clocks(struct + if (list_empty(head)) + goto out; + +- ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * before disabling the clocks managed here. ++ */ ++ if (!on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); ++ if (ret) ++ return ret; ++ } + + list_for_each_entry(clki, head, list) { + if (!IS_ERR_OR_NULL(clki->clk)) { +@@ -6787,9 +6794,16 @@ static int __ufshcd_setup_clocks(struct + } + } + +- ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * after enabling the clocks managed here. ++ */ ++ if (on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); ++ if (ret) ++ return ret; ++ } + + out: + if (ret) { diff --git a/queue-4.14/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch b/queue-4.14/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch new file mode 100644 index 00000000000..06498a572fc --- /dev/null +++ b/queue-4.14/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Jens Remus +Date: Thu, 17 May 2018 19:15:05 +0200 +Subject: scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger + +From: Jens Remus + +[ Upstream commit 9e156c54ace310ce7fb1cd960e62416947f3d47c ] + +Otherwise iterating with list_for_each() over the adapter->erp_ready_head +and adapter->erp_running_head lists can lead to an infinite loop. See commit +"zfcp: fix infinite iteration on erp_ready_head list". + +The run-time check is only performed for debug kernels which have the kernel +lock validator enabled. Following is an example of the warning that is +reported, if the ERP lock is not held when calling zfcp_dbf_rec_trig(): + +WARNING: CPU: 0 PID: 604 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x172/0x188 +Modules linked in: ... +CPU: 0 PID: 604 Comm: kworker/u128:3 Not tainted 4.16.0-... #1 +Hardware name: IBM 2964 N96 702 (z/VM 6.4.0) +Workqueue: zfcp_q_0.0.1906 zfcp_scsi_rport_work +Krnl PSW : 00000000330fdbf9 00000000367e9728 (zfcp_dbf_rec_trig+0x172/0x188) + R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 +Krnl GPRS: 00000000c57a5d99 3288200000000000 0000000000000000 000000006cc82740 + 00000000009d09d6 0000000000000000 00000000000000ff 0000000000000000 + 0000000000000000 0000000000e1b5fe 000000006de01d38 0000000076130958 + 000000006cc82548 000000006de01a98 00000000009d09d6 000000006a6d3c80 +Krnl Code: 00000000009d0ad2: eb7ff0b80004 lmg %r7,%r15,184(%r15) + 00000000009d0ad8: c0f4000d7dd0 brcl 15,b80678 + #00000000009d0ade: a7f40001 brc 15,9d0ae0 + >00000000009d0ae2: a7f4ff7d brc 15,9d09dc + 00000000009d0ae6: e340f0f00004 lg %r4,240(%r15) + 00000000009d0aec: eb7ff0b80004 lmg %r7,%r15,184(%r15) + 00000000009d0af2: 07f4 bcr 15,%r4 + 00000000009d0af4: 0707 bcr 0,%r7 +Call Trace: +([<00000000009d09d6>] zfcp_dbf_rec_trig+0x66/0x188) + [<00000000009dd740>] zfcp_scsi_rport_work+0x98/0x190 + [<0000000000169b34>] process_one_work+0x3d4/0x6f8 + [<000000000016a08a>] worker_thread+0x232/0x418 + [<000000000017219e>] kthread+0x166/0x178 + [<0000000000b815ea>] kernel_thread_starter+0x6/0xc + [<0000000000b815e4>] kernel_thread_starter+0x0/0xc +2 locks held by kworker/u128:3/604: + #0: ((wq_completion)name){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8 + #1: ((work_completion)(&port->rport_work)){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8 +Last Breaking-Event-Address: + [<00000000009d0ade>] zfcp_dbf_rec_trig+0x16e/0x188 +---[ end trace b2f4020572e2c124 ]--- + +Suggested-by: Steffen Maier +Signed-off-by: Jens Remus +Reviewed-by: Benjamin Block +Reviewed-by: Steffen Maier +Signed-off-by: Steffen Maier +Signed-off-by: Martin K. Petersen + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/scsi/zfcp_dbf.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct + struct list_head *entry; + unsigned long flags; + ++ lockdep_assert_held(&adapter->erp_lock); ++ + if (unlikely(!debug_level_enabled(dbf->rec, level))) + return; + diff --git a/queue-4.14/selftests-intel_pstate-improve-test-minor-fixes.patch b/queue-4.14/selftests-intel_pstate-improve-test-minor-fixes.patch new file mode 100644 index 00000000000..29dbbcb8f45 --- /dev/null +++ b/queue-4.14/selftests-intel_pstate-improve-test-minor-fixes.patch @@ -0,0 +1,91 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Daniel Díaz" +Date: Tue, 10 Apr 2018 17:11:15 -0500 +Subject: selftests/intel_pstate: Improve test, minor fixes + +From: "Daniel Díaz" + +[ Upstream commit e9d33f149f52981fd856a0b16aa8ebda89b02e34 ] + +A few changes improve the overall usability of the test: +* fix a hard-coded maximum frequency (3300), +* don't adjust the CPU frequency if only evaluating results, +* fix a comparison for multiple frequencies. + +A symptom of that last issue looked like this: + ./run.sh: line 107: [: too many arguments + ./run.sh: line 110: 3099 + 3099 + 3100-3100: syntax error in expression (error token is \"3099 + 3100-3100\") + +Because a check will count how many differente frequencies +there are among the CPUs of the system, and after they are +tallied another read is performed, which might produce +different results. + +Signed-off-by: Daniel Díaz +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/intel_pstate/run.sh | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +--- a/tools/testing/selftests/intel_pstate/run.sh ++++ b/tools/testing/selftests/intel_pstate/run.sh +@@ -48,11 +48,12 @@ function run_test () { + + echo "sleeping for 5 seconds" + sleep 5 +- num_freqs=$(cat /proc/cpuinfo | grep MHz | sort -u | wc -l) +- if [ $num_freqs -le 2 ]; then +- cat /proc/cpuinfo | grep MHz | sort -u | tail -1 > /tmp/result.$1 ++ grep MHz /proc/cpuinfo | sort -u > /tmp/result.freqs ++ num_freqs=$(wc -l /tmp/result.freqs | awk ' { print $1 } ') ++ if [ $num_freqs -ge 2 ]; then ++ tail -n 1 /tmp/result.freqs > /tmp/result.$1 + else +- cat /proc/cpuinfo | grep MHz | sort -u > /tmp/result.$1 ++ cp /tmp/result.freqs /tmp/result.$1 + fi + ./msr 0 >> /tmp/result.$1 + +@@ -82,21 +83,20 @@ _max_freq=$(cpupower frequency-info -l | + max_freq=$(($_max_freq / 1000)) + + +-for freq in `seq $max_freq -100 $min_freq` ++[ $EVALUATE_ONLY -eq 0 ] && for freq in `seq $max_freq -100 $min_freq` + do + echo "Setting maximum frequency to $freq" + cpupower frequency-set -g powersave --max=${freq}MHz >& /dev/null +- [ $EVALUATE_ONLY -eq 0 ] && run_test $freq ++ run_test $freq + done + +-echo "==============================================================================" ++[ $EVALUATE_ONLY -eq 0 ] && cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null + ++echo "==============================================================================" + echo "The marketing frequency of the cpu is $mkt_freq MHz" + echo "The maximum frequency of the cpu is $max_freq MHz" + echo "The minimum frequency of the cpu is $min_freq MHz" + +-cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null +- + # make a pretty table + echo "Target Actual Difference MSR(0x199) max_perf_pct" + for freq in `seq $max_freq -100 $min_freq` +@@ -104,10 +104,6 @@ do + result_freq=$(cat /tmp/result.${freq} | grep "cpu MHz" | awk ' { print $4 } ' | awk -F "." ' { print $1 } ') + msr=$(cat /tmp/result.${freq} | grep "msr" | awk ' { print $3 } ') + max_perf_pct=$(cat /tmp/result.${freq} | grep "max_perf_pct" | awk ' { print $2 } ' ) +- if [ $result_freq -eq $freq ]; then +- echo " $freq $result_freq 0 $msr $(($max_perf_pct*3300))" +- else +- echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" +- fi ++ echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" + done + exit 0 diff --git a/queue-4.14/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.14/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..1ff72883615 --- /dev/null +++ b/queue-4.14/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Thu, 3 May 2018 17:09:40 -0600 +Subject: selftests: intel_pstate: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 5c30a038fb8ec8cdff011e6b5d5d51eb415381d4 ] + +When intel_pstate test is skipped because of unmet dependencies and/or +unsupported configuration, it returns 0 which is treated as a pass +by the Kselftest framework. This leads to false positive result even +when the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/intel_pstate/run.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/intel_pstate/run.sh ++++ b/tools/testing/selftests/intel_pstate/run.sh +@@ -30,9 +30,12 @@ + + EVALUATE_ONLY=0 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then + echo "$0 # Skipped: Test can only run on x86 architectures." +- exit 0 ++ exit $ksft_skip + fi + + max_cpus=$(($(nproc)-1)) diff --git a/queue-4.14/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.14/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..37cc37a747b --- /dev/null +++ b/queue-4.14/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,74 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Fri, 4 May 2018 13:33:37 -0600 +Subject: selftests: memfd: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit b27f0259e8cea74c627327c063742a83613dd460 ] + +When memfd test is skipped because of unmet dependencies and/or unsupported +configuration, it returns non-zero value which is treated as a fail by the +Kselftest framework. This leads to false negative result even when the test +could not be run. + +Change it to return kselftest skip code when a test gets skipped to clearly +report that the test could not be run. + +Added an explicit check for root user at the start of memfd hugetlbfs test +and return skip code if a non-root user attempts to run it. + +In addition, return skip code when not enough huge pages are available to +run the test. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Reviewed-by: Mike Kravetz +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/memfd/run_tests.sh | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/tools/testing/selftests/memfd/run_tests.sh ++++ b/tools/testing/selftests/memfd/run_tests.sh +@@ -1,6 +1,9 @@ + #!/bin/bash + # please run as root + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + # + # Normal tests requiring no special resources + # +@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $ + nr_hugepgs=`cat /proc/sys/vm/nr_hugepages` + hpages_needed=`expr $hpages_test - $freepgs` + ++ if [ $UID != 0 ]; then ++ echo "Please run memfd with hugetlbfs test as root" ++ exit $ksft_skip ++ fi ++ + echo 3 > /proc/sys/vm/drop_caches + echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages +- if [ $? -ne 0 ]; then +- echo "Please run this test as root" +- exit 1 +- fi + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then + freepgs=$size +@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then + fi + printf "Not enough huge pages available (%d < %d)\n" \ + $freepgs $needpgs +- exit 1 ++ exit $ksft_skip + fi + + # diff --git a/queue-4.14/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch b/queue-4.14/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch new file mode 100644 index 00000000000..f65143e8023 --- /dev/null +++ b/queue-4.14/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Douglas Anderson +Date: Fri, 23 Mar 2018 10:58:31 -0700 +Subject: serial: core: Make sure compiler barfs for 16-byte earlycon names + +From: Douglas Anderson + +[ Upstream commit c1c734cb1f54b062f7e67ffc9656d82f5b412b9c ] + +As part of bringup I ended up wanting to call an earlycon driver by a +name that was exactly 16-bytes big, specifically "qcom_geni_serial". + +Unfortunately, when I tried this I found that things compiled just +fine. They just didn't work. + +Specifically the compiler felt perfectly justified in initting the +".name" field of "struct earlycon_id" with the full 16-bytes and just +skipping the '\0'. Needless to say, that behavior didn't seem ideal, +but I guess someone must have allowed it for a reason. + +One way to fix this is to shorten the name field to 15 bytes and then +add an extra byte after that nobody touches. This should always be +initted to 0 and we're golden. + +There are, of course, other ways to fix this too. We could audit all +the users of the "name" field and make them stop at both null +termination or at 16 bytes. We could also just make the name field +much bigger so that we're not likely to run into this. ...but both +seem like we'll just hit the bug again. + +Signed-off-by: Douglas Anderson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/serial_core.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -348,7 +348,8 @@ struct earlycon_device { + }; + + struct earlycon_id { +- char name[16]; ++ char name[15]; ++ char name_term; /* In case compiler didn't '\0' term name */ + char compatible[128]; + int (*setup)(struct earlycon_device *, const char *options); + }; diff --git a/queue-4.14/series b/queue-4.14/series index 8b9cf72cc9b..ca70a2721bf 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -16,4 +16,201 @@ kthread-tracing-don-t-expose-half-written-comm-when-creating-kthreads.patch tracing-kprobes-fix-trace_probe-flags-on-enable_trace_kprobe-failure.patch tracing-quiet-gcc-warning-about-maybe-unused-link-variable.patch arm64-fix-vmemmap-build_bug_on-triggering-on-vmemmap-setups.patch -drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch +mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch +kcov-ensure-irq-code-sees-a-valid-area.patch +xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch +hv_netvsc-fix-network-namespace-issues-with-vf-support.patch +skip-layoutreturn-if-layout-is-invalid.patch +alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch +alsa-fm801-add-error-handling-for-snd_ctl_add.patch +nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch +nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch +vfio-platform-fix-reset-module-leak-in-error-path.patch +vfio-mdev-check-globally-for-duplicate-devices.patch +vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch +kernel-hung_task.c-show-all-hung-tasks-before-panic.patch +mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch +mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch +mm-slub.c-add-__printf-verification-to-slab_err.patch +rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch +perf-tools-fix-pmu-events-parsing-rule.patch +netfilter-ipset-forbid-family-for-hash-mac-sets.patch +netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch +irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch +watchdog-da9063-fix-updating-timeout-value.patch +printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch +bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch +ceph-fix-alignment-of-rasize.patch +e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch +infiniband-fix-a-possible-use-after-free-bug.patch +powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch +powerpc-64s-add-barrier_nospec.patch +powerpc-eeh-fix-use-after-release-of-eeh-driver.patch +hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch +powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch +rdma-mad-convert-bug_ons-to-error-flows.patch +lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch +netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch +pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch +disable-loading-f2fs-module-on-page_size-4kb.patch +f2fs-fix-error-path-of-move_data_page.patch +f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch +f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch +f2fs-fix-deadlock-in-shutdown-ioctl.patch +f2fs-fix-to-detect-failure-of-dquot_initialize.patch +f2fs-fix-race-in-between-gc-and-atomic-open.patch +block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch +usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch +usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch +perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch +perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch +selftests-intel_pstate-improve-test-minor-fixes.patch +selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch +selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch +pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch +btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch +iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch +bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch +bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch +asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch +mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch +mwifiex-handle-race-during-mwifiex_usb_disconnect.patch +wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch +net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch +media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch +media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch +btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch +btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch +btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch +btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch +x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch +pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch +pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch +nvme-rdma-stop-admin-queue-before-freeing-it.patch +nvme-pci-fix-aer-reset-handling.patch +ath-add-regulatory-mapping-for-fcc3_etsic.patch +ath-add-regulatory-mapping-for-etsi8_world.patch +ath-add-regulatory-mapping-for-apl13_world.patch +ath-add-regulatory-mapping-for-apl2_fcca.patch +ath-add-regulatory-mapping-for-uganda.patch +ath-add-regulatory-mapping-for-tanzania.patch +ath-add-regulatory-mapping-for-serbia.patch +ath-add-regulatory-mapping-for-bermuda.patch +ath-add-regulatory-mapping-for-bahamas.patch +powerpc-32-add-a-missing-include-header.patch +powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch +powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch +powerpc-powermac-mark-variable-x-as-unused.patch +powerpc-add-__printf-verification-to-prom_printf.patch +spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch +powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch +pinctrl-at91-pio4-add-missing-of_node_put.patch +bpf-powerpc64-pad-function-address-loads-with-nops.patch +pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch +net-dsa-qca8k-add-support-for-qca8334-switch.patch +mwifiex-correct-histogram-data-with-appropriate-index.patch +ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch +drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch +spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch +net-hns3-fix-the-missing-client-list-node-initialization.patch +fscrypt-use-unbound-workqueue-for-decryption.patch +scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch +scsi-ufs-fix-exception-event-handling.patch +scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch +drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch +bluetooth-btusb-add-id-for-liteon-04ca-301a.patch +rtc-tps6586x-fix-possible-race-condition.patch +rtc-vr41xx-fix-possible-race-condition.patch +rtc-tps65910-fix-possible-race-condition.patch +alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch +regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch +md-raid1-add-error-handling-of-read-error-from-failfast-device.patch +md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch +ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch +media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch +net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch +alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch +media-atomisp-ov2680-don-t-declare-unused-vars.patch +arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch +hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch +arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch +drm-radeon-fix-mode_valid-s-return-type.patch +drm-amdgpu-remove-vram-from-shared-bo-domains.patch +powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch +hid-i2c-hid-check-if-device-is-there-before-really-probing.patch +edac-altera-fix-arm64-build-warning.patch +arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch +arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch +arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch +nvmem-properly-handle-returned-value-nvmem_reg_read.patch +i40e-free-the-skb-after-clearing-the-bitlock.patch +tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch +dma-iommu-fix-compilation-when-config_iommu_dma.patch +tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch +net-phy-phylink-release-link-gpio.patch +media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch +libata-fix-command-retry-decision.patch +acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch +media-media-device-fix-ioctl-function-types.patch +media-saa7164-fix-driver-name-in-debug-output.patch +drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch +mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch +brcmfmac-add-support-for-bcm43364-wireless-chipset.patch +s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch +perf-fix-invalid-bit-in-diagnostic-entry.patch +bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch +scsi-3w-9xxx-fix-a-missing-check-bug.patch +scsi-3w-xxxx-fix-a-missing-check-bug.patch +scsi-megaraid-silence-a-static-checker-bug.patch +scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch +scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch +staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch +staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch +thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch +bpf-fix-references-to-free_bpf_prog_info-in-comments.patch +f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch +media-siano-get-rid-of-__le32-__le16-cast-warnings.patch +drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch +alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch +mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch +mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch +dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch +spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch +net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch +dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch +fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch +backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch +stop_machine-use-raw-spinlocks.patch +delayacct-use-raw_spinlocks.patch +memory-tegra-do-not-handle-spurious-interrupts.patch +memory-tegra-apply-interrupts-mask-per-soc.patch +nvme-lightnvm-add-granby-support.patch +arm64-defconfig-enable-rockchip-io-domain-driver.patch +igb-fix-queue-selection-on-mac-filters-on-i210.patch +drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch +ipconfig-correctly-initialise-ic_nameservers.patch +rsi-fix-invalid-vdd-warning-in-mmc.patch +rsi-fix-nommu_map_sg-overflow-kernel-panic.patch +audit-allow-not-equal-op-for-audit-by-executable.patch +staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch +staging-lustre-llite-correct-removexattr-detection.patch +staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch +serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch +soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch +microblaze-fix-simpleimage-format-generation.patch +usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch +crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch +crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch +media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch +regulator-don-t-return-or-expect-errno-from-of_map_mode.patch +scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch +scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch +scsi-cxlflash-synchronize-reset-and-remove-ops.patch +scsi-cxlflash-avoid-clobbering-context-control-register-value.patch +media-atomisp-compat32-fix-__user-annotations.patch +media-si470x-fix-__be16-annotations.patch +asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch +asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch +drm-add-dp-psr2-sink-enable-bit.patch +drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch +drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch diff --git a/queue-4.14/skip-layoutreturn-if-layout-is-invalid.patch b/queue-4.14/skip-layoutreturn-if-layout-is-invalid.patch new file mode 100644 index 00000000000..5d919533337 --- /dev/null +++ b/queue-4.14/skip-layoutreturn-if-layout-is-invalid.patch @@ -0,0 +1,56 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Olga Kornievskaia +Date: Mon, 11 Jun 2018 15:32:06 -0400 +Subject: skip LAYOUTRETURN if layout is invalid + +From: Olga Kornievskaia + +[ Upstream commit 93b7f7ad2018d2037559b1d0892417864c78b371 ] + +Currently, when IO to DS fails, client returns the layout and +retries against the MDS. However, then on umounting (inode eviction) +it returns the layout again. + +This is because pnfs_return_layout() was changed in +commit d78471d32bb6 ("pnfs/blocklayout: set PNFS_LAYOUTRETURN_ON_ERROR") +to always set NFS_LAYOUT_RETURN_REQUESTED so even if we returned +the layout, it will be returned again. Instead, let's also check +if we have already marked the layout invalid. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1126,7 +1126,7 @@ _pnfs_return_layout(struct inode *ino) + LIST_HEAD(tmp_list); + nfs4_stateid stateid; + int status = 0; +- bool send; ++ bool send, valid_layout; + + dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino); + +@@ -1147,6 +1147,7 @@ _pnfs_return_layout(struct inode *ino) + goto out_put_layout_hdr; + spin_lock(&ino->i_lock); + } ++ valid_layout = pnfs_layout_is_valid(lo); + pnfs_clear_layoutcommit(ino, &tmp_list); + pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0); + +@@ -1160,7 +1161,8 @@ _pnfs_return_layout(struct inode *ino) + } + + /* Don't send a LAYOUTRETURN if list was initially empty */ +- if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) { ++ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) || ++ !valid_layout) { + spin_unlock(&ino->i_lock); + dprintk("NFS: %s no layout segments to return\n", __func__); + goto out_put_layout_hdr; diff --git a/queue-4.14/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch b/queue-4.14/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch new file mode 100644 index 00000000000..bca81417174 --- /dev/null +++ b/queue-4.14/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch @@ -0,0 +1,78 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Andrey Smirnov +Date: Tue, 10 Apr 2018 11:32:09 -0700 +Subject: soc: imx: gpcv2: Do not pass static memory as platform data + +From: Andrey Smirnov + +[ Upstream commit 050f810e238f268670f14a8f8b793ba2dbf2e92f ] + +Platform device core assumes the ownership of dev.platform_data as +well as that it is dynamically allocated and it will try to kfree it +as a part of platform_device_release(). Change the code to use +platform_device_add_data() n instead of a pointer to a static memory +to avoid causing a BUG() when calling platform_device_put(). + +The problem can be reproduced by artificially enabling the error path +of platform_device_add() call (around line 357). + +Note that this change also allows us to constify imx7_pgc_domains, +since we no longer need to be able to modify it. + +Cc: Stefan Agner +Cc: Lucas Stach +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Andrey Smirnov +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/imx/gpcv2.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -155,7 +155,7 @@ static int imx7_gpc_pu_pgc_sw_pdn_req(st + return imx7_gpc_pu_pgc_sw_pxx_req(genpd, false); + } + +-static struct imx7_pgc_domain imx7_pgc_domains[] = { ++static const struct imx7_pgc_domain imx7_pgc_domains[] = { + [IMX7_POWER_DOMAIN_MIPI_PHY] = { + .genpd = { + .name = "mipi-phy", +@@ -321,11 +321,6 @@ static int imx_gpcv2_probe(struct platfo + continue; + } + +- domain = &imx7_pgc_domains[domain_index]; +- domain->regmap = regmap; +- domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; +- domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; +- + pd_pdev = platform_device_alloc("imx7-pgc-domain", + domain_index); + if (!pd_pdev) { +@@ -334,7 +329,20 @@ static int imx_gpcv2_probe(struct platfo + return -ENOMEM; + } + +- pd_pdev->dev.platform_data = domain; ++ ret = platform_device_add_data(pd_pdev, ++ &imx7_pgc_domains[domain_index], ++ sizeof(imx7_pgc_domains[domain_index])); ++ if (ret) { ++ platform_device_put(pd_pdev); ++ of_node_put(np); ++ return ret; ++ } ++ ++ domain = pd_pdev->dev.platform_data; ++ domain->regmap = regmap; ++ domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; ++ domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; ++ + pd_pdev->dev.parent = dev; + pd_pdev->dev.of_node = np; + diff --git a/queue-4.14/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch b/queue-4.14/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch new file mode 100644 index 00000000000..5d68a140c8f --- /dev/null +++ b/queue-4.14/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Tony Lindgren +Date: Fri, 18 May 2018 10:30:07 -0700 +Subject: spi: Add missing pm_runtime_put_noidle() after failed get + +From: Tony Lindgren + +[ Upstream commit 7e48e23a1f4a50f93ac1073f1326e0a73829b631 ] + +If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle(). +This is probably not a critical fix as we should only hit this when +things are broken elsewhere. + +Signed-off-by: Tony Lindgren +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct s + if (!was_busy && ctlr->auto_runtime_pm) { + ret = pm_runtime_get_sync(ctlr->dev.parent); + if (ret < 0) { ++ pm_runtime_put_noidle(ctlr->dev.parent); + dev_err(&ctlr->dev, "Failed to power device: %d\n", + ret); + mutex_unlock(&ctlr->io_mutex); diff --git a/queue-4.14/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch b/queue-4.14/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch new file mode 100644 index 00000000000..efb9be63ca2 --- /dev/null +++ b/queue-4.14/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alexey Khoroshilov +Date: Sun, 29 Apr 2018 01:46:23 +0300 +Subject: spi: meson-spicc: Fix error handling in meson_spicc_probe() + +From: Alexey Khoroshilov + +[ Upstream commit ded5fa4e8bac25612caab8f0822691308a28a552 ] + +If devm_spi_register_master() fails in meson_spicc_probe(), +spicc->core is left undisabled. The patch fixes that. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Reviewed-by: Neil Armstrong +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -574,10 +574,15 @@ static int meson_spicc_probe(struct plat + master->max_speed_hz = rate >> 2; + + ret = devm_spi_register_master(&pdev->dev, master); +- if (!ret) +- return 0; ++ if (ret) { ++ dev_err(&pdev->dev, "spi master registration failed\n"); ++ goto out_clk; ++ } + +- dev_err(&pdev->dev, "spi master registration failed\n"); ++ return 0; ++ ++out_clk: ++ clk_disable_unprepare(spicc->core); + + out_master: + spi_master_put(master); diff --git a/queue-4.14/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch b/queue-4.14/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch new file mode 100644 index 00000000000..0c74145f4ae --- /dev/null +++ b/queue-4.14/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Geert Uytterhoeven +Date: Wed, 23 May 2018 11:02:04 +0200 +Subject: spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC + +From: Geert Uytterhoeven + +[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ] + +According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in +the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit +must match the value of the SITMDR1.SYNCAC bit. However, +sh_msiof_spi_setup() changes only the latter. + +Fix this by updating the SIRMDR1 register like the SITMDR1 register, +taking into account register bits that exist in SITMDR1 only. + +Reported-by: Renesas BSP team via Yoshihiro Shimoda +Fixes: 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sh-msiof.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -555,14 +555,16 @@ static int sh_msiof_spi_setup(struct spi + + /* Configure native chip select mode/polarity early */ + clr = MDR1_SYNCMD_MASK; +- set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI; ++ set = MDR1_SYNCMD_SPI; + if (spi->mode & SPI_CS_HIGH) + clr |= BIT(MDR1_SYNCAC_SHIFT); + else + set |= BIT(MDR1_SYNCAC_SHIFT); + pm_runtime_get_sync(&p->pdev->dev); + tmp = sh_msiof_read(p, TMDR1) & ~clr; +- sh_msiof_write(p, TMDR1, tmp | set); ++ sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON); ++ tmp = sh_msiof_read(p, RMDR1) & ~clr; ++ sh_msiof_write(p, RMDR1, tmp | set); + pm_runtime_put(&p->pdev->dev); + p->native_cs_high = spi->mode & SPI_CS_HIGH; + p->native_cs_inited = true; diff --git a/queue-4.14/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch b/queue-4.14/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch new file mode 100644 index 00000000000..3bf9a95a577 --- /dev/null +++ b/queue-4.14/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: NeilBrown +Date: Thu, 29 Mar 2018 15:26:48 +1100 +Subject: staging: lustre: ldlm: free resource when ldlm_lock_create() fails. + +From: NeilBrown + +[ Upstream commit d8caf662b4aeeb2ac83ac0b22e40db88e9360c77 ] + +ldlm_lock_create() gets a resource, but don't put it on +all failure paths. It should. + +Signed-off-by: NeilBrown +Reviewed-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/ldlm/ldlm_lock.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c ++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c +@@ -1571,8 +1571,10 @@ struct ldlm_lock *ldlm_lock_create(struc + return ERR_CAST(res); + + lock = ldlm_lock_new(res); +- if (!lock) ++ if (!lock) { ++ ldlm_resource_putref(res); + return ERR_PTR(-ENOMEM); ++ } + + lock->l_req_mode = mode; + lock->l_ast_data = data; +@@ -1615,6 +1617,8 @@ out: + return ERR_PTR(rc); + } + ++ ++ + /** + * Enqueue (request) a lock. + * On the client this is called from ldlm_cli_enqueue_fini diff --git a/queue-4.14/staging-lustre-llite-correct-removexattr-detection.patch b/queue-4.14/staging-lustre-llite-correct-removexattr-detection.patch new file mode 100644 index 00000000000..d61fb42f79b --- /dev/null +++ b/queue-4.14/staging-lustre-llite-correct-removexattr-detection.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: James Simmons +Date: Mon, 16 Apr 2018 00:15:10 -0400 +Subject: staging: lustre: llite: correct removexattr detection + +From: James Simmons + +[ Upstream commit 1b60f6dfa38403ff7c4d0b4b7ecdb810f9789a2a ] + +In ll_xattr_set_common() detect the removexattr() case correctly by +testing for a NULL value as well as XATTR_REPLACE. + +Signed-off-by: John L. Hammond +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10787 +Reviewed-on: https://review.whamcloud.com/ +Reviewed-by: Dmitry Eremin +Reviewed-by: James Simmons +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/llite/xattr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/llite/xattr.c ++++ b/drivers/staging/lustre/lustre/llite/xattr.c +@@ -93,7 +93,11 @@ ll_xattr_set_common(const struct xattr_h + __u64 valid; + int rc; + +- if (flags == XATTR_REPLACE) { ++ /* When setxattr() is called with a size of 0 the value is ++ * unconditionally replaced by "". When removexattr() is ++ * called we get a NULL value and XATTR_REPLACE for flags. ++ */ ++ if (!value && flags == XATTR_REPLACE) { + ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_REMOVEXATTR, 1); + valid = OBD_MD_FLXATTRRM; + } else { diff --git a/queue-4.14/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch b/queue-4.14/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch new file mode 100644 index 00000000000..5669aa418dc --- /dev/null +++ b/queue-4.14/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch @@ -0,0 +1,80 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Doug Oucharek +Date: Tue, 1 May 2018 23:49:18 -0400 +Subject: staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5 + +From: Doug Oucharek + +[ Upstream commit 24d4b7c8de007cff9c7d83c06ae76099fdcce008 ] + +The FastReg support in ko2iblnd was not unmapping pool items +causing the items to leak. In addition, the mapping code +is not growing the pool like we do with FMR. + +This patch makes sure we are unmapping FastReg pool elements +when we are done with them. It also makes sure the pool +will grow when we depleat the pool. + +Signed-off-by: Doug Oucharek +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9472 +Reviewed-on: https://review.whamcloud.com/27015 +Reviewed-by: Andrew Perepechko +Reviewed-by: Dmitry Eremin +Reviewed-by: James Simmons +Reviewed-by: Oleg Drokin +Signed-off-by: Doug Oucharek +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c | 2 +- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 12 ++++-------- + 2 files changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +@@ -1710,7 +1710,7 @@ int kiblnd_fmr_pool_map(struct kib_fmr_p + return 0; + } + spin_unlock(&fps->fps_lock); +- rc = -EBUSY; ++ rc = -EAGAIN; + } + + spin_lock(&fps->fps_lock); +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -47,7 +47,7 @@ static int kiblnd_init_rdma(struct kib_c + __u64 dstcookie); + static void kiblnd_queue_tx_locked(struct kib_tx *tx, struct kib_conn *conn); + static void kiblnd_queue_tx(struct kib_tx *tx, struct kib_conn *conn); +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx); ++static void kiblnd_unmap_tx(struct kib_tx *tx); + static void kiblnd_check_sends_locked(struct kib_conn *conn); + + static void +@@ -65,7 +65,7 @@ kiblnd_tx_done(struct lnet_ni *ni, struc + LASSERT(!tx->tx_waiting); /* mustn't be awaiting peer response */ + LASSERT(tx->tx_pool); + +- kiblnd_unmap_tx(ni, tx); ++ kiblnd_unmap_tx(tx); + + /* tx may have up to 2 lnet msgs to finalise */ + lntmsg[0] = tx->tx_lntmsg[0]; tx->tx_lntmsg[0] = NULL; +@@ -590,13 +590,9 @@ kiblnd_fmr_map_tx(struct kib_net *net, s + return 0; + } + +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx) ++static void kiblnd_unmap_tx(struct kib_tx *tx) + { +- struct kib_net *net = ni->ni_data; +- +- LASSERT(net); +- +- if (net->ibn_fmr_ps) ++ if (tx->fmr.fmr_pfmr || tx->fmr.fmr_frd) + kiblnd_fmr_pool_unmap(&tx->fmr, tx->tx_status); + + if (tx->tx_nfrags) { diff --git a/queue-4.14/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch b/queue-4.14/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch new file mode 100644 index 00000000000..cb9301af9c5 --- /dev/null +++ b/queue-4.14/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Doug Oucahrek +Date: Tue, 1 May 2018 22:22:19 -0700 +Subject: staging: lustre: o2iblnd: fix race at kiblnd_connect_peer + +From: Doug Oucahrek + +[ Upstream commit cf04968efe341b9b1c30a527e5dd61b2af9c43d2 ] + +cmid will be destroyed at OFED if kiblnd_cm_callback return error. +if error happen before the end of kiblnd_connect_peer, it will touch +destroyed cmid and fail as +(o2iblnd_cb.c:1315:kiblnd_connect_peer()) + ASSERTION( cmid->device != ((void *)0) ) failed: + +Signed-off-by: Alexander Boyko +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10015 +Reviewed-by: Alexey Lyashkov +Reviewed-by: Doug Oucharek +Reviewed-by: John L. Hammond +Signed-off-by: Doug Oucharek +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 18 +++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -1289,11 +1289,6 @@ kiblnd_connect_peer(struct kib_peer *pee + goto failed2; + } + +- LASSERT(cmid->device); +- CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n", +- libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname, +- &dev->ibd_ifip, cmid->device->name); +- + return; + + failed2: +@@ -2995,8 +2990,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cm + } else { + rc = rdma_resolve_route( + cmid, *kiblnd_tunables.kib_timeout * 1000); +- if (!rc) ++ if (!rc) { ++ struct kib_net *net = peer->ibp_ni->ni_data; ++ struct kib_dev *dev = net->ibn_dev; ++ ++ CDEBUG(D_NET, "%s: connection bound to "\ ++ "%s:%pI4h:%s\n", ++ libcfs_nid2str(peer->ibp_nid), ++ dev->ibd_ifname, ++ &dev->ibd_ifip, cmid->device->name); ++ + return 0; ++ } ++ + /* Can't initiate route resolution */ + CERROR("Can't resolve route for %s: %d\n", + libcfs_nid2str(peer->ibp_nid), rc); diff --git a/queue-4.14/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch b/queue-4.14/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch new file mode 100644 index 00000000000..660965ce3a9 --- /dev/null +++ b/queue-4.14/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Stefan Wahren +Date: Sat, 31 Mar 2018 22:09:37 +0200 +Subject: staging: vchiq_core: Fix missing semaphore release in error case + +From: Stefan Wahren + +[ Upstream commit 8113b89fc615cfb531df0334fb3a091cf6a45ce0 ] + +The bail out branch in case of a invalid tx_pos missed a semaphore +release. Dan Carpenter found this with a static checker. + +Fixes: d1eab9dec610 ("staging: vchiq_core: Bail out in case of invalid tx_pos") +Reported-by: Dan Carpenter +Signed-off-by: Stefan Wahren +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -601,6 +601,7 @@ reserve_space(VCHIQ_STATE_T *state, size + } + + if (tx_pos == (state->slot_queue_available * VCHIQ_SLOT_SIZE)) { ++ up(&state->slot_available_event); + pr_warn("%s: invalid tx_pos: %d\n", __func__, tx_pos); + return NULL; + } diff --git a/queue-4.14/stop_machine-use-raw-spinlocks.patch b/queue-4.14/stop_machine-use-raw-spinlocks.patch new file mode 100644 index 00000000000..cabb1e3e068 --- /dev/null +++ b/queue-4.14/stop_machine-use-raw-spinlocks.patch @@ -0,0 +1,109 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Thomas Gleixner +Date: Mon, 23 Apr 2018 21:16:35 +0200 +Subject: stop_machine: Use raw spinlocks + +From: Thomas Gleixner + +[ Upstream commit de5b55c1d4e30740009864eb35ce4ed856aac01d ] + +Use raw-locks in stop_machine() to allow locking in irq-off and +preempt-disabled regions on -RT. This also documents the possible locking +context in general. + +[bigeasy: update patch description.] +Signed-off-by: Thomas Gleixner +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lkml.kernel.org/r/20180423191635.6014-1-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/stop_machine.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -37,7 +37,7 @@ struct cpu_stop_done { + struct cpu_stopper { + struct task_struct *thread; + +- spinlock_t lock; ++ raw_spinlock_t lock; + bool enabled; /* is this stopper enabled? */ + struct list_head works; /* list of pending works */ + +@@ -81,13 +81,13 @@ static bool cpu_stop_queue_work(unsigned + unsigned long flags; + bool enabled; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + enabled = stopper->enabled; + if (enabled) + __cpu_stop_queue_work(stopper, work, &wakeq); + else if (work->done) + cpu_stop_signal_done(work->done); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + + wake_up_q(&wakeq); + +@@ -237,8 +237,8 @@ static int cpu_stop_queue_two_works(int + DEFINE_WAKE_Q(wakeq); + int err; + retry: +- spin_lock_irq(&stopper1->lock); +- spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); ++ raw_spin_lock_irq(&stopper1->lock); ++ raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); + + err = -ENOENT; + if (!stopper1->enabled || !stopper2->enabled) +@@ -261,8 +261,8 @@ retry: + __cpu_stop_queue_work(stopper1, work1, &wakeq); + __cpu_stop_queue_work(stopper2, work2, &wakeq); + unlock: +- spin_unlock(&stopper2->lock); +- spin_unlock_irq(&stopper1->lock); ++ raw_spin_unlock(&stopper2->lock); ++ raw_spin_unlock_irq(&stopper1->lock); + + if (unlikely(err == -EDEADLK)) { + while (stop_cpus_in_progress) +@@ -461,9 +461,9 @@ static int cpu_stop_should_run(unsigned + unsigned long flags; + int run; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + run = !list_empty(&stopper->works); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + return run; + } + +@@ -474,13 +474,13 @@ static void cpu_stopper_thread(unsigned + + repeat: + work = NULL; +- spin_lock_irq(&stopper->lock); ++ raw_spin_lock_irq(&stopper->lock); + if (!list_empty(&stopper->works)) { + work = list_first_entry(&stopper->works, + struct cpu_stop_work, list); + list_del_init(&work->list); + } +- spin_unlock_irq(&stopper->lock); ++ raw_spin_unlock_irq(&stopper->lock); + + if (work) { + cpu_stop_fn_t fn = work->fn; +@@ -554,7 +554,7 @@ static int __init cpu_stop_init(void) + for_each_possible_cpu(cpu) { + struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu); + +- spin_lock_init(&stopper->lock); ++ raw_spin_lock_init(&stopper->lock); + INIT_LIST_HEAD(&stopper->works); + } + diff --git a/queue-4.14/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch b/queue-4.14/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch new file mode 100644 index 00000000000..72c50edae9b --- /dev/null +++ b/queue-4.14/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch @@ -0,0 +1,30 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Bartlomiej Zolnierkiewicz +Date: Thu, 26 Apr 2018 13:51:16 +0200 +Subject: thermal: exynos: fix setting rising_threshold for Exynos5433 + +From: Bartlomiej Zolnierkiewicz + +[ Upstream commit 8bfc218d0ebbabcba8ed2b8ec1831e0cf1f71629 ] + +Add missing clearing of the previous value when setting rising +temperature threshold. + +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/samsung/exynos_tmu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(str + threshold_code = temp_to_code(data, temp); + + rising_threshold = readl(data->base + rising_reg_offset); ++ rising_threshold &= ~(0xff << j * 8); + rising_threshold |= (threshold_code << j * 8); + writel(rising_threshold, data->base + rising_reg_offset); + diff --git a/queue-4.14/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch b/queue-4.14/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch new file mode 100644 index 00000000000..b33b431f74c --- /dev/null +++ b/queue-4.14/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Sudeep Holla +Date: Wed, 9 May 2018 17:02:08 +0100 +Subject: tick: Prefer a lower rating device only if it's CPU local device + +From: Sudeep Holla + +[ Upstream commit 1332a90558013ae4242e3dd7934bdcdeafb06c0d ] + +Checking the equality of cpumask for both new and old tick device doesn't +ensure that it's CPU local device. This will cause issue if a low rating +clockevent tick device is registered first followed by the registration +of higher rating clockevent tick device. + +In such case, clockevents_released list will never get emptied as both +the devices get selected as preferred one and we will loop forever in +clockevents_notify_released. + +Signed-off-by: Sudeep Holla +Signed-off-by: Thomas Gleixner +Cc: Frederic Weisbecker +Link: https://lkml.kernel.org/r/1525881728-4858-1-git-send-email-sudeep.holla@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/tick-common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -277,7 +277,8 @@ static bool tick_check_preferred(struct + */ + return !curdev || + newdev->rating > curdev->rating || +- !cpumask_equal(curdev->cpumask, newdev->cpumask); ++ (!cpumask_equal(curdev->cpumask, newdev->cpumask) && ++ !tick_check_percpu(curdev, newdev, smp_processor_id())); + } + + /* diff --git a/queue-4.14/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch b/queue-4.14/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch new file mode 100644 index 00000000000..739dec1064f --- /dev/null +++ b/queue-4.14/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch @@ -0,0 +1,96 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: DaeRyong Jeong +Date: Tue, 1 May 2018 00:27:04 +0900 +Subject: tty: Fix data race in tty_insert_flip_string_fixed_flag + +From: DaeRyong Jeong + +[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ] + +Unlike normal serials, in pty layer, there is no guarantee that multiple +threads don't insert input characters at the same time. If it is happened, +tty_insert_flip_string_fixed_flag can be executed concurrently. This can +lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag. + +Call sequences are as follows. +CPU0 CPU1 +n_tty_ioctl_helper n_tty_ioctl_helper +__start_tty tty_send_xchar +tty_wakeup pty_write +n_hdlc_tty_wakeup tty_insert_flip_string +n_hdlc_send_frames tty_insert_flip_string_fixed_flag +pty_write +tty_insert_flip_string +tty_insert_flip_string_fixed_flag + +To fix the race, acquire port->lock in pty_write() before it inserts input +characters to tty buffer. It prevents multiple threads from inserting +input characters concurrently. + +The crash log is as follows: +BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/ +0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121 +Write of size 1792 by task syz-executor0/30017 +CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), +BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 + 0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140 + ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0 + ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121 +Call Trace: + __dump_stack lib/dump_stack.c:15 [inline] + dump_stack+0xb3/0x110 lib/dump_stack.c:51 + kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 + print_address_description mm/kasan/report.c:194 [inline] + kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283 + kasan_report+0x36/0x40 mm/kasan/report.c:303 + check_memory_region_inline mm/kasan/kasan.c:292 [inline] + check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299 + memcpy+0x37/0x50 mm/kasan/kasan.c:335 + tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316 + tty_insert_flip_string include/linux/tty_flip.h:35 [inline] + pty_write+0x7f/0xc0 drivers/tty/pty.c:115 + n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419 + n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496 + tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601 + __start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018 + __start_tty+0x34/0x40 drivers/tty/tty_io.c:1013 + n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138 + n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794 + tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992 + vfs_ioctl fs/ioctl.c:43 [inline] + do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679 + SYSC_ioctl fs/ioctl.c:694 [inline] + SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 + entry_SYSCALL_64_fastpath+0x1f/0xbd + +Signed-off-by: DaeRyong Jeong +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/pty.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -110,16 +110,19 @@ static void pty_unthrottle(struct tty_st + static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) + { + struct tty_struct *to = tty->link; ++ unsigned long flags; + + if (tty->stopped) + return 0; + + if (c > 0) { ++ spin_lock_irqsave(&to->port->lock, flags); + /* Stuff the data into the input queue of the other end */ + c = tty_insert_flip_string(to->port, buf, c); + /* And shovel */ + if (c) + tty_flip_buffer_push(to->port); ++ spin_unlock_irqrestore(&to->port->lock, flags); + } + return c; + } diff --git a/queue-4.14/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch b/queue-4.14/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch new file mode 100644 index 00000000000..79821010870 --- /dev/null +++ b/queue-4.14/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Dominik Bozek +Date: Fri, 13 Apr 2018 10:42:31 -0700 +Subject: usb: hub: Don't wait for connect state at resume for powered-off ports + +From: Dominik Bozek + +[ Upstream commit 5d111f5190848d6fb1c414dc57797efea3526a2f ] + +wait_for_connected() wait till a port change status to +USB_PORT_STAT_CONNECTION, but this is not possible if +the port is unpowered. The loop will only exit at timeout. + +Such case take place if an over-current incident happen +while system is in S3. Then during resume wait_for_connected() +will wait 2s, which may be noticeable by the user. + +Signed-off-by: Dominik Bozek +Signed-off-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3361,6 +3361,10 @@ static int wait_for_connected(struct usb + while (delay_ms < 2000) { + if (status || *portstatus & USB_PORT_STAT_CONNECTION) + break; ++ if (!port_is_power_on(hub, *portstatus)) { ++ status = -ENODEV; ++ break; ++ } + msleep(20); + delay_ms += 20; + status = hub_port_status(hub, *port1, portstatus, portchange); diff --git a/queue-4.14/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch b/queue-4.14/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch new file mode 100644 index 00000000000..95493e44850 --- /dev/null +++ b/queue-4.14/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch @@ -0,0 +1,120 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Michael Grzeschik +Date: Fri, 25 May 2018 16:23:46 +0200 +Subject: usbip: dynamically allocate idev by nports found in sysfs + +From: Michael Grzeschik + +[ Upstream commit de19ca6fd72c7dd45ad82403e7b3fe9c74ef6767 ] + +As the amount of available ports varies by the kernels build +configuration. To remove the limitation of the fixed 128 ports +we allocate the amount of idevs by using the number we get +from the kernel. + +Signed-off-by: Michael Grzeschik +Acked-by: Shuah Khan (Samsung OSG) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/libsrc/vhci_driver.c | 32 +++++++++++++++++++------------- + tools/usb/usbip/libsrc/vhci_driver.h | 3 +-- + 2 files changed, 20 insertions(+), 15 deletions(-) + +--- a/tools/usb/usbip/libsrc/vhci_driver.c ++++ b/tools/usb/usbip/libsrc/vhci_driver.c +@@ -135,11 +135,11 @@ static int refresh_imported_device_list( + return 0; + } + +-static int get_nports(void) ++static int get_nports(struct udev_device *hc_device) + { + const char *attr_nports; + +- attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports"); ++ attr_nports = udev_device_get_sysattr_value(hc_device, "nports"); + if (!attr_nports) { + err("udev_device_get_sysattr_value nports failed"); + return -1; +@@ -242,35 +242,41 @@ static int read_record(int rhport, char + + int usbip_vhci_driver_open(void) + { ++ int nports; ++ struct udev_device *hc_device; ++ + udev_context = udev_new(); + if (!udev_context) { + err("udev_new failed"); + return -1; + } + +- vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver)); +- + /* will be freed in usbip_driver_close() */ +- vhci_driver->hc_device = ++ hc_device = + udev_device_new_from_subsystem_sysname(udev_context, + USBIP_VHCI_BUS_TYPE, + USBIP_VHCI_DEVICE_NAME); +- if (!vhci_driver->hc_device) { ++ if (!hc_device) { + err("udev_device_new_from_subsystem_sysname failed"); + goto err; + } + +- vhci_driver->nports = get_nports(); +- dbg("available ports: %d", vhci_driver->nports); +- +- if (vhci_driver->nports <= 0) { ++ nports = get_nports(hc_device); ++ if (nports <= 0) { + err("no available ports"); + goto err; +- } else if (vhci_driver->nports > MAXNPORT) { +- err("port number exceeds %d", MAXNPORT); ++ } ++ dbg("available ports: %d", nports); ++ ++ vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) + ++ nports * sizeof(struct usbip_imported_device)); ++ if (!vhci_driver) { ++ err("vhci_driver allocation failed"); + goto err; + } + ++ vhci_driver->nports = nports; ++ vhci_driver->hc_device = hc_device; + vhci_driver->ncontrollers = get_ncontrollers(); + dbg("available controllers: %d", vhci_driver->ncontrollers); + +@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void) + return 0; + + err: +- udev_device_unref(vhci_driver->hc_device); ++ udev_device_unref(hc_device); + + if (vhci_driver) + free(vhci_driver); +--- a/tools/usb/usbip/libsrc/vhci_driver.h ++++ b/tools/usb/usbip/libsrc/vhci_driver.h +@@ -13,7 +13,6 @@ + + #define USBIP_VHCI_BUS_TYPE "platform" + #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0" +-#define MAXNPORT 128 + + enum hub_speed { + HUB_SPEED_HIGH = 0, +@@ -41,7 +40,7 @@ struct usbip_vhci_driver { + + int ncontrollers; + int nports; +- struct usbip_imported_device idev[MAXNPORT]; ++ struct usbip_imported_device idev[]; + }; + + diff --git a/queue-4.14/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch b/queue-4.14/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch new file mode 100644 index 00000000000..d5b07252c5c --- /dev/null +++ b/queue-4.14/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Tue, 29 May 2018 16:13:03 -0600 +Subject: usbip: usbip_detach: Fix memory, udev context and udev leak + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ] + +detach_port() fails to call usbip_vhci_driver_close() from its error +path after usbip_vhci_detach_device() returns failure, leaking memory +allocated in usbip_vhci_driver_open() and holding udev_context and udev +references. Fix it to call usbip_vhci_driver_close(). + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/src/usbip_detach.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/tools/usb/usbip/src/usbip_detach.c ++++ b/tools/usb/usbip/src/usbip_detach.c +@@ -43,7 +43,7 @@ void usbip_detach_usage(void) + + static int detach_port(char *port) + { +- int ret; ++ int ret = 0; + uint8_t portnum; + char path[PATH_MAX+1]; + +@@ -73,9 +73,12 @@ static int detach_port(char *port) + } + + ret = usbip_vhci_detach_device(portnum); +- if (ret < 0) +- return -1; ++ if (ret < 0) { ++ ret = -1; ++ goto call_driver_close; ++ } + ++call_driver_close: + usbip_vhci_driver_close(); + + return ret; diff --git a/queue-4.14/vfio-mdev-check-globally-for-duplicate-devices.patch b/queue-4.14/vfio-mdev-check-globally-for-duplicate-devices.patch new file mode 100644 index 00000000000..1ec70a3113d --- /dev/null +++ b/queue-4.14/vfio-mdev-check-globally-for-duplicate-devices.patch @@ -0,0 +1,284 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alex Williamson +Date: Tue, 15 May 2018 13:53:55 -0600 +Subject: vfio/mdev: Check globally for duplicate devices + +From: Alex Williamson + +[ Upstream commit 002fe996f67f4f46d8917b14cfb6e4313c20685a ] + +When we create an mdev device, we check for duplicates against the +parent device and return -EEXIST if found, but the mdev device +namespace is global since we'll link all devices from the bus. We do +catch this later in sysfs_do_create_link_sd() to return -EEXIST, but +with it comes a kernel warning and stack trace for trying to create +duplicate sysfs links, which makes it an undesirable response. + +Therefore we should really be looking for duplicates across all mdev +parent devices, or as implemented here, against our mdev device list. +Using mdev_list to prevent duplicates means that we can remove +mdev_parent.lock, but in order not to serialize mdev device creation +and removal globally, we add mdev_device.active which allows UUIDs to +be reserved such that we can drop the mdev_list_lock before the mdev +device is fully in place. + +Two behavioral notes; first, mdev_parent.lock had the side-effect of +serializing mdev create and remove ops per parent device. This was +an implementation detail, not an intentional guarantee provided to +the mdev vendor drivers. Vendor drivers can trivially provide this +serialization internally if necessary. Second, review comments note +the new -EAGAIN behavior when the device, and in particular the remove +attribute, becomes visible in sysfs. If a remove is triggered prior +to completion of mdev_device_create() the user will see a -EAGAIN +error. While the errno is different, receiving an error during this +period is not, the previous implementation returned -ENODEV for the +same condition. Furthermore, the consistency to the user is improved +in the case where mdev_device_remove_ops() returns error. Previously +concurrent calls to mdev_device_remove() could see the device +disappear with -ENODEV and return in the case of error. Now a user +would see -EAGAIN while the device is in this transitory state. + +Reviewed-by: Kirti Wankhede +Reviewed-by: Cornelia Huck +Acked-by: Halil Pasic +Acked-by: Zhenyu Wang +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/vfio-mediated-device.txt | 5 + + drivers/vfio/mdev/mdev_core.c | 102 +++++++++++---------------------- + drivers/vfio/mdev/mdev_private.h | 2 + 3 files changed, 42 insertions(+), 67 deletions(-) + +--- a/Documentation/vfio-mediated-device.txt ++++ b/Documentation/vfio-mediated-device.txt +@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops str + * create: allocate basic resources in a driver for a mediated device + * remove: free resources in a driver when a mediated device is destroyed + ++(Note that mdev-core provides no implicit serialization of create/remove ++callbacks per mdev parent device, per mdev type, or any other categorization. ++Vendor drivers are expected to be fully asynchronous in this respect or ++provide their own internal resource protection.) ++ + The callbacks in the mdev_parent_ops structure are as follows: + + * open: open callback of mediated device +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -66,34 +66,6 @@ uuid_le mdev_uuid(struct mdev_device *md + } + EXPORT_SYMBOL(mdev_uuid); + +-static int _find_mdev_device(struct device *dev, void *data) +-{ +- struct mdev_device *mdev; +- +- if (!dev_is_mdev(dev)) +- return 0; +- +- mdev = to_mdev_device(dev); +- +- if (uuid_le_cmp(mdev->uuid, *(uuid_le *)data) == 0) +- return 1; +- +- return 0; +-} +- +-static bool mdev_device_exist(struct mdev_parent *parent, uuid_le uuid) +-{ +- struct device *dev; +- +- dev = device_find_child(parent->dev, &uuid, _find_mdev_device); +- if (dev) { +- put_device(dev); +- return true; +- } +- +- return false; +-} +- + /* Should be called holding parent_list_lock */ + static struct mdev_parent *__find_parent_device(struct device *dev) + { +@@ -221,7 +193,6 @@ int mdev_register_device(struct device * + } + + kref_init(&parent->ref); +- mutex_init(&parent->lock); + + parent->dev = dev; + parent->ops = ops; +@@ -297,6 +268,10 @@ static void mdev_device_release(struct d + { + struct mdev_device *mdev = to_mdev_device(dev); + ++ mutex_lock(&mdev_list_lock); ++ list_del(&mdev->next); ++ mutex_unlock(&mdev_list_lock); ++ + dev_dbg(&mdev->dev, "MDEV: destroying\n"); + kfree(mdev); + } +@@ -304,7 +279,7 @@ static void mdev_device_release(struct d + int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid) + { + int ret; +- struct mdev_device *mdev; ++ struct mdev_device *mdev, *tmp; + struct mdev_parent *parent; + struct mdev_type *type = to_mdev_type(kobj); + +@@ -312,21 +287,28 @@ int mdev_device_create(struct kobject *k + if (!parent) + return -EINVAL; + +- mutex_lock(&parent->lock); ++ mutex_lock(&mdev_list_lock); + + /* Check for duplicate */ +- if (mdev_device_exist(parent, uuid)) { +- ret = -EEXIST; +- goto create_err; ++ list_for_each_entry(tmp, &mdev_list, next) { ++ if (!uuid_le_cmp(tmp->uuid, uuid)) { ++ mutex_unlock(&mdev_list_lock); ++ ret = -EEXIST; ++ goto mdev_fail; ++ } + } + + mdev = kzalloc(sizeof(*mdev), GFP_KERNEL); + if (!mdev) { ++ mutex_unlock(&mdev_list_lock); + ret = -ENOMEM; +- goto create_err; ++ goto mdev_fail; + } + + memcpy(&mdev->uuid, &uuid, sizeof(uuid_le)); ++ list_add(&mdev->next, &mdev_list); ++ mutex_unlock(&mdev_list_lock); ++ + mdev->parent = parent; + kref_init(&mdev->ref); + +@@ -338,35 +320,28 @@ int mdev_device_create(struct kobject *k + ret = device_register(&mdev->dev); + if (ret) { + put_device(&mdev->dev); +- goto create_err; ++ goto mdev_fail; + } + + ret = mdev_device_create_ops(kobj, mdev); + if (ret) +- goto create_failed; ++ goto create_fail; + + ret = mdev_create_sysfs_files(&mdev->dev, type); + if (ret) { + mdev_device_remove_ops(mdev, true); +- goto create_failed; ++ goto create_fail; + } + + mdev->type_kobj = kobj; ++ mdev->active = true; + dev_dbg(&mdev->dev, "MDEV: created\n"); + +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- +- return ret; ++ return 0; + +-create_failed: ++create_fail: + device_unregister(&mdev->dev); +- +-create_err: +- mutex_unlock(&parent->lock); ++mdev_fail: + mdev_put_parent(parent); + return ret; + } +@@ -377,44 +352,39 @@ int mdev_device_remove(struct device *de + struct mdev_parent *parent; + struct mdev_type *type; + int ret; +- bool found = false; + + mdev = to_mdev_device(dev); + + mutex_lock(&mdev_list_lock); + list_for_each_entry(tmp, &mdev_list, next) { +- if (tmp == mdev) { +- found = true; ++ if (tmp == mdev) + break; +- } + } + +- if (found) +- list_del(&mdev->next); ++ if (tmp != mdev) { ++ mutex_unlock(&mdev_list_lock); ++ return -ENODEV; ++ } + +- mutex_unlock(&mdev_list_lock); ++ if (!mdev->active) { ++ mutex_unlock(&mdev_list_lock); ++ return -EAGAIN; ++ } + +- if (!found) +- return -ENODEV; ++ mdev->active = false; ++ mutex_unlock(&mdev_list_lock); + + type = to_mdev_type(mdev->type_kobj); + parent = mdev->parent; +- mutex_lock(&parent->lock); + + ret = mdev_device_remove_ops(mdev, force_remove); + if (ret) { +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- ++ mdev->active = true; + return ret; + } + + mdev_remove_sysfs_files(dev, type); + device_unregister(dev); +- mutex_unlock(&parent->lock); + mdev_put_parent(parent); + + return 0; +--- a/drivers/vfio/mdev/mdev_private.h ++++ b/drivers/vfio/mdev/mdev_private.h +@@ -20,7 +20,6 @@ struct mdev_parent { + struct device *dev; + const struct mdev_parent_ops *ops; + struct kref ref; +- struct mutex lock; + struct list_head next; + struct kset *mdev_types_kset; + struct list_head type_list; +@@ -34,6 +33,7 @@ struct mdev_device { + struct kref ref; + struct list_head next; + struct kobject *type_kobj; ++ bool active; + }; + + #define to_mdev_device(dev) container_of(dev, struct mdev_device, dev) diff --git a/queue-4.14/vfio-platform-fix-reset-module-leak-in-error-path.patch b/queue-4.14/vfio-platform-fix-reset-module-leak-in-error-path.patch new file mode 100644 index 00000000000..87cef432bf9 --- /dev/null +++ b/queue-4.14/vfio-platform-fix-reset-module-leak-in-error-path.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Geert Uytterhoeven +Date: Wed, 11 Apr 2018 11:15:48 +0200 +Subject: vfio: platform: Fix reset module leak in error path + +From: Geert Uytterhoeven + +[ Upstream commit 28a68387888997e8a7fa57940ea5d55f2e16b594 ] + +If the IOMMU group setup fails, the reset module is not released. + +Fixes: b5add544d677d363 ("vfio, platform: make reset driver a requirement by default") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Eric Auger +Reviewed-by: Simon Horman +Acked-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/platform/vfio_platform_common.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vf + group = vfio_iommu_group_get(dev); + if (!group) { + pr_err("VFIO: No IOMMU group for device %s\n", vdev->name); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_reset; + } + + ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev); +- if (ret) { +- vfio_iommu_group_put(group, dev); +- return ret; +- } ++ if (ret) ++ goto put_iommu; + + mutex_init(&vdev->igate); + + return 0; ++ ++put_iommu: ++ vfio_iommu_group_put(group, dev); ++put_reset: ++ vfio_platform_put_reset(vdev); ++ return ret; + } + EXPORT_SYMBOL_GPL(vfio_platform_probe_common); + diff --git a/queue-4.14/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch b/queue-4.14/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch new file mode 100644 index 00000000000..443e814db3e --- /dev/null +++ b/queue-4.14/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch @@ -0,0 +1,241 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Alex Williamson +Date: Fri, 11 May 2018 09:05:02 -0600 +Subject: vfio/type1: Fix task tracking for QEMU vCPU hotplug + +From: Alex Williamson + +[ Upstream commit 48d8476b41eed63567dd2f0ad125c895b9ac648a ] + +MAP_DMA ioctls might be called from various threads within a process, +for example when using QEMU, the vCPU threads are often generating +these calls and we therefore take a reference to that vCPU task. +However, QEMU also supports vCPU hotplug on some machines and the task +that called MAP_DMA may have exited by the time UNMAP_DMA is called, +resulting in the mm_struct pointer being NULL and thus a failure to +match against the existing mapping. + +To resolve this, we instead take a reference to the thread +group_leader, which has the same mm_struct and resource limits, but +is less likely exit, at least in the QEMU case. A difficulty here is +guaranteeing that the capabilities of the group_leader match that of +the calling thread, which we resolve by tracking CAP_IPC_LOCK at the +time of calling rather than at an indeterminate time in the future. +Potentially this also results in better efficiency as this is now +recorded once per MAP_DMA ioctl. + +Reported-by: Xu Yandong +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/vfio_iommu_type1.c | 73 +++++++++++++++++++++++++--------------- + 1 file changed, 47 insertions(+), 26 deletions(-) + +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -83,6 +83,7 @@ struct vfio_dma { + size_t size; /* Map size (bytes) */ + int prot; /* IOMMU_READ/WRITE */ + bool iommu_mapped; ++ bool lock_cap; /* capable(CAP_IPC_LOCK) */ + struct task_struct *task; + struct rb_root pfn_list; /* Ex-user pinned pfn list */ + }; +@@ -246,29 +247,25 @@ static int vfio_iova_put_vfio_pfn(struct + return ret; + } + +-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap) ++static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + { + struct mm_struct *mm; +- bool is_current; + int ret; + + if (!npage) + return 0; + +- is_current = (task->mm == current->mm); +- +- mm = is_current ? task->mm : get_task_mm(task); ++ mm = async ? get_task_mm(dma->task) : dma->task->mm; + if (!mm) + return -ESRCH; /* process exited */ + + ret = down_write_killable(&mm->mmap_sem); + if (!ret) { + if (npage > 0) { +- if (lock_cap ? !*lock_cap : +- !has_capability(task, CAP_IPC_LOCK)) { ++ if (!dma->lock_cap) { + unsigned long limit; + +- limit = task_rlimit(task, ++ limit = task_rlimit(dma->task, + RLIMIT_MEMLOCK) >> PAGE_SHIFT; + + if (mm->locked_vm + npage > limit) +@@ -282,7 +279,7 @@ static int vfio_lock_acct(struct task_st + up_write(&mm->mmap_sem); + } + +- if (!is_current) ++ if (async) + mmput(mm); + + return ret; +@@ -391,7 +388,7 @@ static int vaddr_get_pfn(struct mm_struc + */ + static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + long npage, unsigned long *pfn_base, +- bool lock_cap, unsigned long limit) ++ unsigned long limit) + { + unsigned long pfn = 0; + long ret, pinned = 0, lock_acct = 0; +@@ -414,7 +411,7 @@ static long vfio_pin_pages_remote(struct + * pages are already counted against the user. + */ + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && current->mm->locked_vm + 1 > limit) { ++ if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) { + put_pfn(*pfn_base, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__, + limit << PAGE_SHIFT); +@@ -440,7 +437,7 @@ static long vfio_pin_pages_remote(struct + } + + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && ++ if (!dma->lock_cap && + current->mm->locked_vm + lock_acct + 1 > limit) { + put_pfn(pfn, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", +@@ -453,7 +450,7 @@ static long vfio_pin_pages_remote(struct + } + + out: +- ret = vfio_lock_acct(current, lock_acct, &lock_cap); ++ ret = vfio_lock_acct(dma, lock_acct, false); + + unpin_out: + if (ret) { +@@ -484,7 +481,7 @@ static long vfio_unpin_pages_remote(stru + } + + if (do_accounting) +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + + return unlocked; + } +@@ -501,7 +498,7 @@ static int vfio_pin_page_external(struct + + ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base); + if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { +- ret = vfio_lock_acct(dma->task, 1, NULL); ++ ret = vfio_lock_acct(dma, 1, true); + if (ret) { + put_pfn(*pfn_base, dma->prot); + if (ret == -ENOMEM) +@@ -528,7 +525,7 @@ static int vfio_unpin_page_external(stru + unlocked = vfio_iova_put_vfio_pfn(dma, vpfn); + + if (do_accounting) +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + + return unlocked; + } +@@ -723,7 +720,7 @@ static long vfio_unmap_unpin(struct vfio + + dma->iommu_mapped = false; + if (do_accounting) { +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + return 0; + } + return unlocked; +@@ -935,14 +932,12 @@ static int vfio_pin_map_dma(struct vfio_ + size_t size = map_size; + long npage; + unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret = 0; + + while (size) { + /* Pin a contiguous chunk of memory */ + npage = vfio_pin_pages_remote(dma, vaddr + dma->size, +- size >> PAGE_SHIFT, &pfn, +- lock_cap, limit); ++ size >> PAGE_SHIFT, &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1017,8 +1012,36 @@ static int vfio_dma_do_map(struct vfio_i + dma->iova = iova; + dma->vaddr = vaddr; + dma->prot = prot; +- get_task_struct(current); +- dma->task = current; ++ ++ /* ++ * We need to be able to both add to a task's locked memory and test ++ * against the locked memory limit and we need to be able to do both ++ * outside of this call path as pinning can be asynchronous via the ++ * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a ++ * task_struct and VM locked pages requires an mm_struct, however ++ * holding an indefinite mm reference is not recommended, therefore we ++ * only hold a reference to a task. We could hold a reference to ++ * current, however QEMU uses this call path through vCPU threads, ++ * which can be killed resulting in a NULL mm and failure in the unmap ++ * path when called via a different thread. Avoid this problem by ++ * using the group_leader as threads within the same group require ++ * both CLONE_THREAD and CLONE_VM and will therefore use the same ++ * mm_struct. ++ * ++ * Previously we also used the task for testing CAP_IPC_LOCK at the ++ * time of pinning and accounting, however has_capability() makes use ++ * of real_cred, a copy-on-write field, so we can't guarantee that it ++ * matches group_leader, or in fact that it might not change by the ++ * time it's evaluated. If a process were to call MAP_DMA with ++ * CAP_IPC_LOCK but later drop it, it doesn't make sense that they ++ * possibly see different results for an iommu_mapped vfio_dma vs ++ * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the ++ * time of calling MAP_DMA. ++ */ ++ get_task_struct(current->group_leader); ++ dma->task = current->group_leader; ++ dma->lock_cap = capable(CAP_IPC_LOCK); ++ + dma->pfn_list = RB_ROOT; + + /* Insert zero-sized and grow as we map chunks of it */ +@@ -1053,7 +1076,6 @@ static int vfio_iommu_replay(struct vfio + struct vfio_domain *d; + struct rb_node *n; + unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret; + + /* Arbitrarily pick the first domain in the list for lookups */ +@@ -1100,8 +1122,7 @@ static int vfio_iommu_replay(struct vfio + + npage = vfio_pin_pages_remote(dma, vaddr, + n >> PAGE_SHIFT, +- &pfn, lock_cap, +- limit); ++ &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1378,7 +1399,7 @@ static void vfio_iommu_unmap_unpin_reacc + if (!is_invalid_reserved_pfn(vpfn->pfn)) + locked++; + } +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + } + } + diff --git a/queue-4.14/watchdog-da9063-fix-updating-timeout-value.patch b/queue-4.14/watchdog-da9063-fix-updating-timeout-value.patch new file mode 100644 index 00000000000..7f37062ab67 --- /dev/null +++ b/queue-4.14/watchdog-da9063-fix-updating-timeout-value.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Marco Felsch +Date: Mon, 28 May 2018 08:45:45 +0200 +Subject: watchdog: da9063: Fix updating timeout value + +From: Marco Felsch + +[ Upstream commit 44ee54aabfdb3b35866ed909bde3ab01e9679385 ] + +The DA9063 watchdog has only one register field to store the timeout value +and to enable the watchdog. The watchdog gets enabled if the value is +not zero. There is no issue if the watchdog is already running but it +leads into problems if the watchdog is disabled. + +If the watchdog is disabled and only the timeout value should be prepared +the watchdog gets enabled too. Add a check to get the current watchdog +state and update the watchdog timeout value on hw-side only if the +watchdog is already active. + +Fixes: 5e9c16e37608 ("watchdog: Add DA9063 PMIC watchdog driver.") +Signed-off-by: Marco Felsch +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/watchdog/da9063_wdt.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/watchdog/da9063_wdt.c ++++ b/drivers/watchdog/da9063_wdt.c +@@ -102,10 +102,23 @@ static int da9063_wdt_set_timeout(struct + { + struct da9063 *da9063 = watchdog_get_drvdata(wdd); + unsigned int selector; +- int ret; ++ int ret = 0; + + selector = da9063_wdt_timeout_to_sel(timeout); +- ret = _da9063_wdt_set_timeout(da9063, selector); ++ ++ /* ++ * There are two cases when a set_timeout() will be called: ++ * 1. The watchdog is off and someone wants to set the timeout for the ++ * further use. ++ * 2. The watchdog is already running and a new timeout value should be ++ * set. ++ * ++ * The watchdog can't store a timeout value not equal zero without ++ * enabling the watchdog, so the timeout must be buffered by the driver. ++ */ ++ if (watchdog_active(wdd)) ++ ret = _da9063_wdt_set_timeout(da9063, selector); ++ + if (ret) + dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n", + ret); diff --git a/queue-4.14/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch b/queue-4.14/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch new file mode 100644 index 00000000000..9d178261c26 --- /dev/null +++ b/queue-4.14/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Eyal Reizer +Date: Mon, 28 May 2018 11:36:42 +0300 +Subject: wlcore: sdio: check for valid platform device data before suspend + +From: Eyal Reizer + +[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ] + +the wl pointer can be null In case only wlcore_sdio is probed while +no WiLink module is successfully probed, as in the case of mounting a +wl12xx module while using a device tree file configured with wl18xx +related settings. +In this case the system was crashing in wl1271_suspend() as platform +device data is not set. +Make sure wl the pointer is valid before using it. + +Signed-off-by: Eyal Reizer +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ti/wlcore/sdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ti/wlcore/sdio.c ++++ b/drivers/net/wireless/ti/wlcore/sdio.c +@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device + mmc_pm_flag_t sdio_flags; + int ret = 0; + ++ if (!wl) { ++ dev_err(dev, "no wilink module was probed\n"); ++ goto out; ++ } ++ + dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n", + wl->wow_enabled); + diff --git a/queue-4.14/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch b/queue-4.14/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch new file mode 100644 index 00000000000..75837b80e97 --- /dev/null +++ b/queue-4.14/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Scott Wood +Date: Thu, 24 May 2018 10:44:20 -0500 +Subject: x86/microcode: Make the late update update_lock a raw lock for RT + +From: Scott Wood + +[ Upstream commit ff987fcf011d20c53b3a613edf6e2055ea48e26e ] + +__reload_late() is called from stop_machine context and thus cannot +acquire a non-raw spinlock on PREEMPT_RT. + +Signed-off-by: Scott Wood +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Acked-by: Thomas Gleixner +Cc: Ashok Raj +Cc: Clark Williams +Cc: Pei Zhang +Cc: x86-ml +Link: http://lkml.kernel.org/r/20180524154420.24455-1-swood@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex); + /* + * Serialize late loading so that CPUs get updated one-by-one. + */ +-static DEFINE_SPINLOCK(update_lock); ++static DEFINE_RAW_SPINLOCK(update_lock); + + struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; + +@@ -560,9 +560,9 @@ static int __reload_late(void *info) + if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) + return -1; + +- spin_lock(&update_lock); ++ raw_spin_lock(&update_lock); + apply_microcode_local(&err); +- spin_unlock(&update_lock); ++ raw_spin_unlock(&update_lock); + + /* siblings return UCODE_OK because their engine got updated already */ + if (err > UCODE_NFOUND) { diff --git a/queue-4.14/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch b/queue-4.14/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch new file mode 100644 index 00000000000..3f407d4683c --- /dev/null +++ b/queue-4.14/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:25:26 CEST 2018 +From: Juergen Gross +Date: Tue, 12 Jun 2018 08:57:53 +0200 +Subject: xen/netfront: raise max number of slots in xennet_get_responses() + +From: Juergen Gross + +[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ] + +The max number of slots used in xennet_get_responses() is set to +MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD). + +In old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This +difference is resulting in frequent messages "too many slots" and a +reduced network throughput for some workloads (factor 10 below that of +a kernel-xen based guest). + +Replacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of +the max number of slots to use solves that problem (tests showed no +more messages "too many slots" and throughput was as high as with the +kernel-xen based guest system). + +Replace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in +netfront_tx_slot_available() for making it clearer what is really being +tested without actually modifying the tested value. + +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netfront.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -239,7 +239,7 @@ static void rx_refill_timeout(unsigned l + static int netfront_tx_slot_available(struct netfront_queue *queue) + { + return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) < +- (NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2); ++ (NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1); + } + + static void xennet_maybe_wake_tx(struct netfront_queue *queue) +@@ -790,7 +790,7 @@ static int xennet_get_responses(struct n + RING_IDX cons = queue->rx.rsp_cons; + struct sk_buff *skb = xennet_get_rx_skb(queue, cons); + grant_ref_t ref = xennet_get_rx_ref(queue, cons); +- int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD); ++ int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD); + int slots = 1; + int err = 0; + unsigned long ret; -- 2.47.3