From c6ac5bc24bfcdf93c0d7dce4f31d3e091509ec9e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 19 Dec 2018 10:15:51 -0500 Subject: [PATCH] patches for 4.19 Signed-off-by: Sasha Levin --- ...er-initiated-ars-to-be-ars-long-rath.patch | 46 ++ .../arc-io.h-implement-reads-x-writes-x.patch | 143 ++++++ ...prove-fix-arm-v7_dma_inv_range-unali.patch | 74 ++++ ...lign-v7m_dma_inv_range-with-v7-count.patch | 63 +++ ...apping-fix-potential-uninitialized-r.patch | 40 ++ ...3ad-state-sent-to-partner-when-unbin.patch | 60 +++ ...ing-signals-while-verifying-programs.patch | 40 ++ ...r-log-string-check-for-bad-alignment.patch | 35 ++ ...config_cifs_posix-needs-depends-on-l.patch | 35 ++ .../clk-mmp-off-by-one-in-mmp_clk_add.patch | 37 ++ ...-off-by-one-bugs-in-cp110_of_clk_get.patch | 47 ++ .../drivers-sbus-char-add-of_node_put.patch | 34 ++ .../drivers-tty-add-missing-of_node_put.patch | 33 ++ ...fix-6x4k-displays-light-up-on-vega20.patch | 43 ++ ...y-issue-pre-display-settings-for-dis.patch | 50 +++ ...-update-vcn.cur_state-during-suspend.patch | 42 ++ ...ait-for-ib-test-on-first-device-open.patch | 49 +++ ...-connector-leak-during-driver-unload.patch | 38 ++ ...-don-t-set-legacy-plane-crtc-pointer.patch | 33 ++ ...warning-invalid-free-of-devm_-alloca.patch | 38 ++ ...nfigure-vco-rate-for-10nm-pll-driver.patch | 46 ++ .../drm-msm-fix-error-return-checking.patch | 44 ++ ...msm-fix-handling-of-cmdstream-offset.patch | 51 +++ ...rm-msm-fix-task-dump-in-gpu-recovery.patch | 55 +++ ...fix-a-couple-memory-leaks-in-debugfs.patch | 59 +++ ...blank-reference-when-waiting-for-com.patch | 39 ++ ...-enable-hpd-after-hdmi-irq-is-set-up.patch | 110 +++++ ...handling-in-ttm_buffer_object_transf.patch | 43 ++ ...x-wrong-of_node_put-in-probe-functio.patch | 51 +++ ...axxia-properly-handle-master-timeout.patch | 173 ++++++++ ...heck-bus-state-before-reinitializing.patch | 52 +++ ...be-error-on-devices-with-an-empty-sm.patch | 72 +++ ...ix-violation-of-tlow-requirement-for.patch | 56 +++ ...-violation-of-tlow-requirement-for-f.patch | 43 ++ queue-4.19/ide-pmac-add-of_node_put.patch | 31 ++ ...er-v-fix-wakeup-from-suspend-to-idle.patch | 56 +++ ...d-fix-keyboard-debounce-configuratio.patch | 67 +++ ...naptics-enable-smbus-for-hp-15-ay000.patch | 40 ++ ...-all-samsung-mz7km-solid-state-disks.patch | 34 ++ ...idio-read-sc-iq_no-before-release-sc.patch | 44 ++ ...ix-module-init-error-paths-for-netli.patch | 59 +++ .../macvlan-return-correct-error-value.patch | 68 +++ ...witchdev-fix-vlan-device-deletion-vi.patch | 61 +++ ...-disable-hardware-level-mac-learning.patch | 52 +++ ...quantia-fix-rx-checksum-offload-bits.patch | 41 ++ ...-replace-net_ip_align-with-ave_frame.patch | 70 +++ ...-build-break-when-config_inet-is-off.patch | 47 ++ ...pp2-fix-detection-of-10g-sfp-modules.patch | 42 ++ ...hylink-handling-of-invalid-phy-modes.patch | 95 ++++ ...ve-debugfs-init-exit-to-probe-remove.patch | 97 +++++ ...dirty-kernel-pages-read-by-direct-io.patch | 109 +++++ ...ntroller-state-before-rescheduling-k.patch | 66 +++ ...met-rdma-fix-response-use-after-free.patch | 44 ++ queue-4.19/sbus-char-add-of_node_put.patch | 31 ++ ...x-null-pointer-dereference-in-iscsi_.patch | 39 ++ ...earrange-code-to-avoid-multiple-call.patch | 55 +++ queue-4.19/series | 64 +++ ...fix-a-potential-race-in-xprt_connect.patch | 46 ++ ...rmada-fix-legacy-validity-test-sense.patch | 47 ++ ...-add-addition-type-tests-to-test_btf.patch | 412 ++++++++++++++++++ ...bpf-fix-two-test_btf-unit-test-cases.patch | 58 +++ ...-nvdimm-align-test-resources-to-128m.patch | 128 ++++++ ...reset-orphans-race-with-close-timeou.patch | 63 +++ ...mpiler-support-check-for-config_retp.patch | 68 +++ ...efi-fix-infinite-loop-on-some-screen.patch | 63 +++ 65 files changed, 4071 insertions(+) create mode 100644 queue-4.19/acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch create mode 100644 queue-4.19/arc-io.h-implement-reads-x-writes-x.patch create mode 100644 queue-4.19/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch create mode 100644 queue-4.19/arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch create mode 100644 queue-4.19/arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch create mode 100644 queue-4.19/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch create mode 100644 queue-4.19/bpf-check-pending-signals-while-verifying-programs.patch create mode 100644 queue-4.19/bpf-fix-verifier-log-string-check-for-bad-alignment.patch create mode 100644 queue-4.19/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch create mode 100644 queue-4.19/clk-mmp-off-by-one-in-mmp_clk_add.patch create mode 100644 queue-4.19/clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch create mode 100644 queue-4.19/drivers-sbus-char-add-of_node_put.patch create mode 100644 queue-4.19/drivers-tty-add-missing-of_node_put.patch create mode 100644 queue-4.19/drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch create mode 100644 queue-4.19/drm-amd-powerplay-issue-pre-display-settings-for-dis.patch create mode 100644 queue-4.19/drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch create mode 100644 queue-4.19/drm-amdgpu-wait-for-ib-test-on-first-device-open.patch create mode 100644 queue-4.19/drm-ast-fix-connector-leak-during-driver-unload.patch create mode 100644 queue-4.19/drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch create mode 100644 queue-4.19/drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch create mode 100644 queue-4.19/drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch create mode 100644 queue-4.19/drm-msm-fix-error-return-checking.patch create mode 100644 queue-4.19/drm-msm-fix-handling-of-cmdstream-offset.patch create mode 100644 queue-4.19/drm-msm-fix-task-dump-in-gpu-recovery.patch create mode 100644 queue-4.19/drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch create mode 100644 queue-4.19/drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch create mode 100644 queue-4.19/drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch create mode 100644 queue-4.19/drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch create mode 100644 queue-4.19/ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch create mode 100644 queue-4.19/i2c-axxia-properly-handle-master-timeout.patch create mode 100644 queue-4.19/i2c-rcar-check-bus-state-before-reinitializing.patch create mode 100644 queue-4.19/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch create mode 100644 queue-4.19/i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch create mode 100644 queue-4.19/i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch create mode 100644 queue-4.19/ide-pmac-add-of_node_put.patch create mode 100644 queue-4.19/input-hyper-v-fix-wakeup-from-suspend-to-idle.patch create mode 100644 queue-4.19/input-omap-keypad-fix-keyboard-debounce-configuratio.patch create mode 100644 queue-4.19/input-synaptics-enable-smbus-for-hp-15-ay000.patch create mode 100644 queue-4.19/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch create mode 100644 queue-4.19/liquidio-read-sc-iq_no-before-release-sc.patch create mode 100644 queue-4.19/mac80211_hwsim-fix-module-init-error-paths-for-netli.patch create mode 100644 queue-4.19/macvlan-return-correct-error-value.patch create mode 100644 queue-4.19/mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch create mode 100644 queue-4.19/mv88e6060-disable-hardware-level-mac-learning.patch create mode 100644 queue-4.19/net-aquantia-fix-rx-checksum-offload-bits.patch create mode 100644 queue-4.19/net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch create mode 100644 queue-4.19/net-mlx4_en-fix-build-break-when-config_inet-is-off.patch create mode 100644 queue-4.19/net-mvpp2-fix-detection-of-10g-sfp-modules.patch create mode 100644 queue-4.19/net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch create mode 100644 queue-4.19/net-stmmac-move-debugfs-init-exit-to-probe-remove.patch create mode 100644 queue-4.19/nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch create mode 100644 queue-4.19/nvme-validate-controller-state-before-rescheduling-k.patch create mode 100644 queue-4.19/nvmet-rdma-fix-response-use-after-free.patch create mode 100644 queue-4.19/sbus-char-add-of_node_put.patch create mode 100644 queue-4.19/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch create mode 100644 queue-4.19/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch create mode 100644 queue-4.19/sunrpc-fix-a-potential-race-in-xprt_connect.patch create mode 100644 queue-4.19/thermal-armada-fix-legacy-validity-test-sense.patch create mode 100644 queue-4.19/tools-bpf-add-addition-type-tests-to-test_btf.patch create mode 100644 queue-4.19/tools-bpf-fix-two-test_btf-unit-test-cases.patch create mode 100644 queue-4.19/tools-testing-nvdimm-align-test-resources-to-128m.patch create mode 100644 queue-4.19/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch create mode 100644 queue-4.19/x86-build-fix-compiler-support-check-for-config_retp.patch create mode 100644 queue-4.19/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch diff --git a/queue-4.19/acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch b/queue-4.19/acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch new file mode 100644 index 00000000000..fe759d3a128 --- /dev/null +++ b/queue-4.19/acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch @@ -0,0 +1,46 @@ +From e70bc26374fa787f531edbec4cbc53debd1b2d87 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Mon, 3 Dec 2018 10:30:25 -0800 +Subject: acpi/nfit: Fix user-initiated ARS to be "ARS-long" rather than + "ARS-short" + +[ Upstream commit b5fd2e00a60248902315fb32210550ac3cb9f44c ] + +A "short" ARS (address range scrub) instructs the platform firmware to +return known errors. In contrast, a "long" ARS instructs platform +firmware to arrange every data address on the DIMM to be read / checked +for poisoned data. + +The conversion of the flags in commit d3abaf43bab8 "acpi, nfit: Fix +Address Range Scrub completion tracking", changed the meaning of passing +'0' to acpi_nfit_ars_rescan(). Previously '0' meant "not short", now '0' +is ARS_REQ_SHORT. Pass ARS_REQ_LONG to restore the expected scrub-type +behavior of user-initiated ARS sessions. + +Fixes: d3abaf43bab8 ("acpi, nfit: Fix Address Range Scrub completion tracking") +Reported-by: Jacek Zloch +Cc: Vishal Verma +Reviewed-by: Dave Jiang +Reviewed-by: Vishal Verma +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/acpi/nfit/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index c5d15752dfb3..75b331f8a16a 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -1303,7 +1303,7 @@ static ssize_t scrub_store(struct device *dev, + if (nd_desc) { + struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc); + +- rc = acpi_nfit_ars_rescan(acpi_desc, 0); ++ rc = acpi_nfit_ars_rescan(acpi_desc, ARS_REQ_LONG); + } + device_unlock(dev); + if (rc) +-- +2.19.1 + diff --git a/queue-4.19/arc-io.h-implement-reads-x-writes-x.patch b/queue-4.19/arc-io.h-implement-reads-x-writes-x.patch new file mode 100644 index 00000000000..34d7a4bd48c --- /dev/null +++ b/queue-4.19/arc-io.h-implement-reads-x-writes-x.patch @@ -0,0 +1,143 @@ +From de6f6dacd50061045c7626f4a451214f84a8defc Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Fri, 30 Nov 2018 09:47:31 +0000 +Subject: ARC: io.h: Implement reads{x}()/writes{x}() + +[ Upstream commit 10d443431dc2bb733cf7add99b453e3fb9047a2e ] + +Some ARC CPU's do not support unaligned loads/stores. Currently, generic +implementation of reads{b/w/l}()/writes{b/w/l}() is being used with ARC. +This can lead to misfunction of some drivers as generic functions do a +plain dereference of a pointer that can be unaligned. + +Let's use {get/put}_unaligned() helpers instead of plain dereference of +pointer in order to fix. The helpers allow to get and store data from an +unaligned address whilst preserving the CPU internal alignment. +According to [1], the use of these helpers are costly in terms of +performance so we added an initial check for a buffer already aligned so +that the usage of the helpers can be avoided, when possible. + +[1] Documentation/unaligned-memory-access.txt + +Cc: Alexey Brodkin +Cc: Joao Pinto +Cc: David Laight +Tested-by: Vitor Soares +Signed-off-by: Jose Abreu +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/include/asm/io.h | 72 +++++++++++++++++++++++++++++++++++++++ + 1 file changed, 72 insertions(+) + +diff --git a/arch/arc/include/asm/io.h b/arch/arc/include/asm/io.h +index c22b181e8206..2f39d9b3886e 100644 +--- a/arch/arc/include/asm/io.h ++++ b/arch/arc/include/asm/io.h +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + #ifdef CONFIG_ISA_ARCV2 + #include +@@ -94,6 +95,42 @@ static inline u32 __raw_readl(const volatile void __iomem *addr) + return w; + } + ++/* ++ * {read,write}s{b,w,l}() repeatedly access the same IO address in ++ * native endianness in 8-, 16-, 32-bit chunks {into,from} memory, ++ * @count times ++ */ ++#define __raw_readsx(t,f) \ ++static inline void __raw_reads##f(const volatile void __iomem *addr, \ ++ void *ptr, unsigned int count) \ ++{ \ ++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \ ++ u##t *buf = ptr; \ ++ \ ++ if (!count) \ ++ return; \ ++ \ ++ /* Some ARC CPU's don't support unaligned accesses */ \ ++ if (is_aligned) { \ ++ do { \ ++ u##t x = __raw_read##f(addr); \ ++ *buf++ = x; \ ++ } while (--count); \ ++ } else { \ ++ do { \ ++ u##t x = __raw_read##f(addr); \ ++ put_unaligned(x, buf++); \ ++ } while (--count); \ ++ } \ ++} ++ ++#define __raw_readsb __raw_readsb ++__raw_readsx(8, b) ++#define __raw_readsw __raw_readsw ++__raw_readsx(16, w) ++#define __raw_readsl __raw_readsl ++__raw_readsx(32, l) ++ + #define __raw_writeb __raw_writeb + static inline void __raw_writeb(u8 b, volatile void __iomem *addr) + { +@@ -126,6 +163,35 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) + + } + ++#define __raw_writesx(t,f) \ ++static inline void __raw_writes##f(volatile void __iomem *addr, \ ++ const void *ptr, unsigned int count) \ ++{ \ ++ bool is_aligned = ((unsigned long)ptr % ((t) / 8)) == 0; \ ++ const u##t *buf = ptr; \ ++ \ ++ if (!count) \ ++ return; \ ++ \ ++ /* Some ARC CPU's don't support unaligned accesses */ \ ++ if (is_aligned) { \ ++ do { \ ++ __raw_write##f(*buf++, addr); \ ++ } while (--count); \ ++ } else { \ ++ do { \ ++ __raw_write##f(get_unaligned(buf++), addr); \ ++ } while (--count); \ ++ } \ ++} ++ ++#define __raw_writesb __raw_writesb ++__raw_writesx(8, b) ++#define __raw_writesw __raw_writesw ++__raw_writesx(16, w) ++#define __raw_writesl __raw_writesl ++__raw_writesx(32, l) ++ + /* + * MMIO can also get buffered/optimized in micro-arch, so barriers needed + * Based on ARM model for the typical use case +@@ -141,10 +207,16 @@ static inline void __raw_writel(u32 w, volatile void __iomem *addr) + #define readb(c) ({ u8 __v = readb_relaxed(c); __iormb(); __v; }) + #define readw(c) ({ u16 __v = readw_relaxed(c); __iormb(); __v; }) + #define readl(c) ({ u32 __v = readl_relaxed(c); __iormb(); __v; }) ++#define readsb(p,d,l) ({ __raw_readsb(p,d,l); __iormb(); }) ++#define readsw(p,d,l) ({ __raw_readsw(p,d,l); __iormb(); }) ++#define readsl(p,d,l) ({ __raw_readsl(p,d,l); __iormb(); }) + + #define writeb(v,c) ({ __iowmb(); writeb_relaxed(v,c); }) + #define writew(v,c) ({ __iowmb(); writew_relaxed(v,c); }) + #define writel(v,c) ({ __iowmb(); writel_relaxed(v,c); }) ++#define writesb(p,d,l) ({ __iowmb(); __raw_writesb(p,d,l); }) ++#define writesw(p,d,l) ({ __iowmb(); __raw_writesw(p,d,l); }) ++#define writesl(p,d,l) ({ __iowmb(); __raw_writesl(p,d,l); }) + + /* + * Relaxed API for drivers which can handle barrier ordering themselves +-- +2.19.1 + diff --git a/queue-4.19/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch b/queue-4.19/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch new file mode 100644 index 00000000000..263725c1d5c --- /dev/null +++ b/queue-4.19/arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch @@ -0,0 +1,74 @@ +From 134405b4333fd6499371375e8eed664cc8e1420c Mon Sep 17 00:00:00 2001 +From: Chris Cole +Date: Fri, 23 Nov 2018 12:20:45 +0100 +Subject: ARM: 8814/1: mm: improve/fix ARM v7_dma_inv_range() unaligned address + handling + +[ Upstream commit a1208f6a822ac29933e772ef1f637c5d67838da9 ] + +This patch addresses possible memory corruption when +v7_dma_inv_range(start_address, end_address) address parameters are not +aligned to whole cache lines. This function issues "invalidate" cache +management operations to all cache lines from start_address (inclusive) +to end_address (exclusive). When start_address and/or end_address are +not aligned, the start and/or end cache lines are first issued "clean & +invalidate" operation. The assumption is this is done to ensure that any +dirty data addresses outside the address range (but part of the first or +last cache lines) are cleaned/flushed so that data is not lost, which +could happen if just an invalidate is issued. + +The problem is that these first/last partial cache lines are issued +"clean & invalidate" and then "invalidate". This second "invalidate" is +not required and worse can cause "lost" writes to addresses outside the +address range but part of the cache line. If another component writes to +its part of the cache line between the "clean & invalidate" and +"invalidate" operations, the write can get lost. This fix is to remove +the extra "invalidate" operation when unaligned addressed are used. + +A kernel module is available that has a stress test to reproduce the +issue and a unit test of the updated v7_dma_inv_range(). It can be +downloaded from +http://ftp.sageembedded.com/outgoing/linux/cache-test-20181107.tgz. + +v7_dma_inv_range() is call by dmac_[un]map_area(addr, len, direction) +when the direction is DMA_FROM_DEVICE. One can (I believe) successfully +argue that DMA from a device to main memory should use buffers aligned +to cache line size, because the "clean & invalidate" might overwrite +data that the device just wrote using DMA. But if a driver does use +unaligned buffers, at least this fix will prevent memory corruption +outside the buffer. + +Signed-off-by: Chris Cole +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/cache-v7.S | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S +index 215df435bfb9..2149b47a0c5a 100644 +--- a/arch/arm/mm/cache-v7.S ++++ b/arch/arm/mm/cache-v7.S +@@ -360,14 +360,16 @@ v7_dma_inv_range: + ALT_UP(W(nop)) + #endif + mcrne p15, 0, r0, c7, c14, 1 @ clean & invalidate D / U line ++ addne r0, r0, r2 + + tst r1, r3 + bic r1, r1, r3 + mcrne p15, 0, r1, c7, c14, 1 @ clean & invalidate D / U line +-1: +- mcr p15, 0, r0, c7, c6, 1 @ invalidate D / U line +- add r0, r0, r2 + cmp r0, r1 ++1: ++ mcrlo p15, 0, r0, c7, c6, 1 @ invalidate D / U line ++ addlo r0, r0, r2 ++ cmplo r0, r1 + blo 1b + dsb st + ret lr +-- +2.19.1 + diff --git a/queue-4.19/arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch b/queue-4.19/arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch new file mode 100644 index 00000000000..d7ec7646568 --- /dev/null +++ b/queue-4.19/arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch @@ -0,0 +1,63 @@ +From d18bf0f0fcbfbc6fc2c5959fc4a0111eda4b7a36 Mon Sep 17 00:00:00 2001 +From: Vladimir Murzin +Date: Fri, 23 Nov 2018 12:25:21 +0100 +Subject: ARM: 8815/1: V7M: align v7m_dma_inv_range() with v7 counterpart + +[ Upstream commit 3d0358d0ba048c5afb1385787aaec8fa5ad78fcc ] + +Chris has discovered and reported that v7_dma_inv_range() may corrupt +memory if address range is not aligned to cache line size. + +Since the whole cache-v7m.S was lifted form cache-v7.S the same +observation applies to v7m_dma_inv_range(). So the fix just mirrors +what has been done for v7 with a little specific of M-class. + +Cc: Chris Cole +Signed-off-by: Vladimir Murzin +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/cache-v7m.S | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/mm/cache-v7m.S b/arch/arm/mm/cache-v7m.S +index 788486e830d3..32aa2a2aa260 100644 +--- a/arch/arm/mm/cache-v7m.S ++++ b/arch/arm/mm/cache-v7m.S +@@ -73,9 +73,11 @@ + /* + * dcimvac: Invalidate data cache line by MVA to PoC + */ +-.macro dcimvac, rt, tmp +- v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC ++.irp c,,eq,ne,cs,cc,mi,pl,vs,vc,hi,ls,ge,lt,gt,le,hs,lo ++.macro dcimvac\c, rt, tmp ++ v7m_cacheop \rt, \tmp, V7M_SCB_DCIMVAC, \c + .endm ++.endr + + /* + * dccmvau: Clean data cache line by MVA to PoU +@@ -369,14 +371,16 @@ v7m_dma_inv_range: + tst r0, r3 + bic r0, r0, r3 + dccimvacne r0, r3 ++ addne r0, r0, r2 + subne r3, r2, #1 @ restore r3, corrupted by v7m's dccimvac + tst r1, r3 + bic r1, r1, r3 + dccimvacne r1, r3 +-1: +- dcimvac r0, r3 +- add r0, r0, r2 + cmp r0, r1 ++1: ++ dcimvaclo r0, r3 ++ addlo r0, r0, r2 ++ cmplo r0, r1 + blo 1b + dsb st + ret lr +-- +2.19.1 + diff --git a/queue-4.19/arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch b/queue-4.19/arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch new file mode 100644 index 00000000000..c772ca7c245 --- /dev/null +++ b/queue-4.19/arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch @@ -0,0 +1,40 @@ +From 3ea6d4d6dfb6c625637da704d4e36272ac6a0d0b Mon Sep 17 00:00:00 2001 +From: Nathan Jones +Date: Tue, 4 Dec 2018 10:05:32 +0100 +Subject: ARM: 8816/1: dma-mapping: fix potential uninitialized return + +[ Upstream commit c2a3831df6dc164af66d8d86cf356a90c021b86f ] + +While trying to use the dma_mmap_*() interface, it was noticed that this +interface returns strange values when passed an incorrect length. + +If neither of the if() statements fire then the return value is +uninitialized. In the worst case it returns 0 which means the caller +will think the function succeeded. + +Fixes: 1655cf8829d8 ("ARM: dma-mapping: Remove traces of NOMMU code") +Signed-off-by: Nathan Jones +Reviewed-by: Robin Murphy +Acked-by: Vladimir Murzin +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/dma-mapping.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c +index 66566472c153..1cb9c0f9b5d6 100644 +--- a/arch/arm/mm/dma-mapping.c ++++ b/arch/arm/mm/dma-mapping.c +@@ -830,7 +830,7 @@ static int __arm_dma_mmap(struct device *dev, struct vm_area_struct *vma, + void *cpu_addr, dma_addr_t dma_addr, size_t size, + unsigned long attrs) + { +- int ret; ++ int ret = -ENXIO; + unsigned long nr_vma_pages = vma_pages(vma); + unsigned long nr_pages = PAGE_ALIGN(size) >> PAGE_SHIFT; + unsigned long pfn = dma_to_pfn(dev, dma_addr); +-- +2.19.1 + diff --git a/queue-4.19/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch b/queue-4.19/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch new file mode 100644 index 00000000000..373c8b83897 --- /dev/null +++ b/queue-4.19/bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch @@ -0,0 +1,60 @@ +From 673fef155459d2f0276eee04b480fc413e5c7afd Mon Sep 17 00:00:00 2001 +From: Toni Peltonen +Date: Tue, 27 Nov 2018 16:56:57 +0200 +Subject: bonding: fix 802.3ad state sent to partner when unbinding slave + +[ Upstream commit 3b5b3a3331d141e8f2a7aaae3a94dfa1e61ecbe4 ] + +Previously when unbinding a slave the 802.3ad implementation only told +partner that the port is not suitable for aggregation by setting the port +aggregation state from aggregatable to individual. This is not enough. If the +physical layer still stays up and we only unbinded this port from the bond there +is nothing in the aggregation status alone to prevent the partner from sending +traffic towards us. To ensure that the partner doesn't consider this +port at all anymore we should also disable collecting and distributing to +signal that this actor is going away. Also clear AD_STATE_SYNCHRONIZATION to +ensure partner exits collecting + distributing state. + +I have tested this behaviour againts Arista EOS switches with mlx5 cards +(physical link stays up even when interface is down) and simulated +the same situation virtually Linux <-> Linux with two network namespaces +running two veth device pairs. In both cases setting aggregation to +individual doesn't alone prevent traffic from being to sent towards this +port given that the link stays up in partners end. Partner still keeps +it's end in collecting + distributing state and continues until timeout is +reached. In most cases this means we are losing the traffic partner sends +towards our port while we wait for timeout. This is most visible with slow +periodic time (LACP rate slow). + +Other open source implementations like Open VSwitch and libreswitch, and +vendor implementations like Arista EOS, seem to disable collecting + +distributing to when doing similar port disabling/detaching/removing change. +With this patch kernel implementation would behave the same way and ensure +partner doesn't consider our actor viable anymore. + +Signed-off-by: Toni Peltonen +Signed-off-by: Jay Vosburgh +Acked-by: Jonathan Toppins +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_3ad.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c +index f43fb2f958a5..93dfcef8afc4 100644 +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -2086,6 +2086,9 @@ void bond_3ad_unbind_slave(struct slave *slave) + aggregator->aggregator_identifier); + + /* Tell the partner that this port is not suitable for aggregation */ ++ port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION; ++ port->actor_oper_port_state &= ~AD_STATE_COLLECTING; ++ port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING; + port->actor_oper_port_state &= ~AD_STATE_AGGREGATION; + __update_lacpdu_from_port(port); + ad_lacpdu_send(port); +-- +2.19.1 + diff --git a/queue-4.19/bpf-check-pending-signals-while-verifying-programs.patch b/queue-4.19/bpf-check-pending-signals-while-verifying-programs.patch new file mode 100644 index 00000000000..260c6d098ca --- /dev/null +++ b/queue-4.19/bpf-check-pending-signals-while-verifying-programs.patch @@ -0,0 +1,40 @@ +From b9b4ea0220a0ec580d0b7ff67bfea70349184b41 Mon Sep 17 00:00:00 2001 +From: Alexei Starovoitov +Date: Mon, 3 Dec 2018 22:46:04 -0800 +Subject: bpf: check pending signals while verifying programs + +[ Upstream commit c3494801cd1785e2c25f1a5735fa19ddcf9665da ] + +Malicious user space may try to force the verifier to use as much cpu +time and memory as possible. Hence check for pending signals +while verifying the program. +Note that suspend of sys_bpf(PROG_LOAD) syscall will lead to EAGAIN, +since the kernel has to release the resources used for program verification. + +Reported-by: Anatoly Trosinenko +Signed-off-by: Alexei Starovoitov +Acked-by: Daniel Borkmann +Acked-by: Edward Cree +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 56acfbb80104..2954e4b3abd5 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4792,6 +4792,9 @@ static int do_check(struct bpf_verifier_env *env) + goto process_bpf_exit; + } + ++ if (signal_pending(current)) ++ return -EAGAIN; ++ + if (need_resched()) + cond_resched(); + +-- +2.19.1 + diff --git a/queue-4.19/bpf-fix-verifier-log-string-check-for-bad-alignment.patch b/queue-4.19/bpf-fix-verifier-log-string-check-for-bad-alignment.patch new file mode 100644 index 00000000000..8d8404f2a73 --- /dev/null +++ b/queue-4.19/bpf-fix-verifier-log-string-check-for-bad-alignment.patch @@ -0,0 +1,35 @@ +From d18cf092f9d9b37e73cf0729bdfaec67c7424e47 Mon Sep 17 00:00:00 2001 +From: David Miller +Date: Wed, 28 Nov 2018 22:33:53 -0800 +Subject: bpf: Fix verifier log string check for bad alignment. + +[ Upstream commit c01ac66b38660f2b507ccd0b75d28e3002d56fbb ] + +The message got changed a lot time ago. + +This was responsible for 36 test case failures on sparc64. + +Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") +Signed-off-by: David S. Miller +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_verifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index 2bde9ee04db7..e436b67f2426 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -12765,7 +12765,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv, + + reject_from_alignment = fd_prog < 0 && + (test->flags & F_NEEDS_EFFICIENT_UNALIGNED_ACCESS) && +- strstr(bpf_vlog, "Unknown alignment."); ++ strstr(bpf_vlog, "misaligned"); + #ifdef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + if (reject_from_alignment) { + printf("FAIL\nFailed due to alignment despite having efficient unaligned access: '%s'!\n", +-- +2.19.1 + diff --git a/queue-4.19/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch b/queue-4.19/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch new file mode 100644 index 00000000000..5dc666d7b44 --- /dev/null +++ b/queue-4.19/cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch @@ -0,0 +1,35 @@ +From ecfa86816913c7d7f22ad806a78b7cbf8c201f9d Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Sat, 3 Nov 2018 15:02:44 -0500 +Subject: cifs: In Kconfig CONFIG_CIFS_POSIX needs depends on legacy (insecure + cifs) + +[ Upstream commit 6e785302dad32228819d8066e5376acd15d0e6ba ] + +Missing a dependency. Shouldn't show cifs posix extensions +in Kconfig if CONFIG_CIFS_ALLOW_INSECURE_DIALECTS (ie SMB1 +protocol) is disabled. + +Signed-off-by: Steve French +Reviewed-by: Pavel Shilovsky +Signed-off-by: Sasha Levin +--- + fs/cifs/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig +index abcd78e332fe..85dadb93c992 100644 +--- a/fs/cifs/Kconfig ++++ b/fs/cifs/Kconfig +@@ -133,7 +133,7 @@ config CIFS_XATTR + + config CIFS_POSIX + bool "CIFS POSIX Extensions" +- depends on CIFS_XATTR ++ depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR + help + Enabling this option will cause the cifs client to attempt to + negotiate a newer dialect with servers, such as Samba 3.0.5 +-- +2.19.1 + diff --git a/queue-4.19/clk-mmp-off-by-one-in-mmp_clk_add.patch b/queue-4.19/clk-mmp-off-by-one-in-mmp_clk_add.patch new file mode 100644 index 00000000000..6ae64f3afa9 --- /dev/null +++ b/queue-4.19/clk-mmp-off-by-one-in-mmp_clk_add.patch @@ -0,0 +1,37 @@ +From adfe6ced9637a9bc4added935f2c37c75eecec80 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 3 Dec 2018 17:51:43 +0300 +Subject: clk: mmp: Off by one in mmp_clk_add() + +[ Upstream commit 2e85c57493e391b93445c1e0d530b36b95becc64 ] + +The > comparison should be >= or we write one element beyond the end of +the unit->clk_table[] array. + +(The unit->clk_table[] array is allocated in the mmp_clk_init() function +and it has unit->nr_clks elements). + +Fixes: 4661fda10f8b ("clk: mmp: add basic support functions for DT support") +Signed-off-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mmp/clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/mmp/clk.c b/drivers/clk/mmp/clk.c +index ad8d483a35cd..ca7d37e2c7be 100644 +--- a/drivers/clk/mmp/clk.c ++++ b/drivers/clk/mmp/clk.c +@@ -183,7 +183,7 @@ void mmp_clk_add(struct mmp_clk_unit *unit, unsigned int id, + pr_err("CLK %d has invalid pointer %p\n", id, clk); + return; + } +- if (id > unit->nr_clks) { ++ if (id >= unit->nr_clks) { + pr_err("CLK %d is invalid\n", id); + return; + } +-- +2.19.1 + diff --git a/queue-4.19/clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch b/queue-4.19/clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch new file mode 100644 index 00000000000..cf3f3eaac0e --- /dev/null +++ b/queue-4.19/clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch @@ -0,0 +1,47 @@ +From 0d09f322194e4f8a6bf5680d7033ce13e6afa24c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 3 Dec 2018 17:50:55 +0300 +Subject: clk: mvebu: Off by one bugs in cp110_of_clk_get() + +[ Upstream commit d9f5b7f5dd0fa74a89de5a7ac1e26366f211ccee ] + +These > comparisons should be >= to prevent reading beyond the end of +of the clk_data->hws[] buffer. + +The clk_data->hws[] array is allocated in cp110_syscon_common_probe() +when we do: + cp110_clk_data = devm_kzalloc(dev, sizeof(*cp110_clk_data) + + sizeof(struct clk_hw *) * CP110_CLK_NUM, + GFP_KERNEL); +As you can see, it has CP110_CLK_NUM elements which is equivalent to +CP110_MAX_CORE_CLOCKS + CP110_MAX_GATABLE_CLOCKS. + +Fixes: d3da3eaef7f4 ("clk: mvebu: new driver for Armada CP110 system controller") +Signed-off-by: Dan Carpenter +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mvebu/cp110-system-controller.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mvebu/cp110-system-controller.c b/drivers/clk/mvebu/cp110-system-controller.c +index 75bf7b8f282f..0153c76d4a20 100644 +--- a/drivers/clk/mvebu/cp110-system-controller.c ++++ b/drivers/clk/mvebu/cp110-system-controller.c +@@ -202,11 +202,11 @@ static struct clk_hw *cp110_of_clk_get(struct of_phandle_args *clkspec, + unsigned int idx = clkspec->args[1]; + + if (type == CP110_CLK_TYPE_CORE) { +- if (idx > CP110_MAX_CORE_CLOCKS) ++ if (idx >= CP110_MAX_CORE_CLOCKS) + return ERR_PTR(-EINVAL); + return clk_data->hws[idx]; + } else if (type == CP110_CLK_TYPE_GATABLE) { +- if (idx > CP110_MAX_GATABLE_CLOCKS) ++ if (idx >= CP110_MAX_GATABLE_CLOCKS) + return ERR_PTR(-EINVAL); + return clk_data->hws[CP110_MAX_CORE_CLOCKS + idx]; + } +-- +2.19.1 + diff --git a/queue-4.19/drivers-sbus-char-add-of_node_put.patch b/queue-4.19/drivers-sbus-char-add-of_node_put.patch new file mode 100644 index 00000000000..bdf8cddadcd --- /dev/null +++ b/queue-4.19/drivers-sbus-char-add-of_node_put.patch @@ -0,0 +1,34 @@ +From 561590e4ce80d27681785e596991a087d61512d1 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:38:26 -0500 +Subject: drivers/sbus/char: add of_node_put() + +[ Upstream commit 6bd520ab7cf69486ea81fd3cdfd2d5a390ad1100 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/sbus/char/envctrl.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c +index 56e962a01493..b8481927bfe4 100644 +--- a/drivers/sbus/char/envctrl.c ++++ b/drivers/sbus/char/envctrl.c +@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp, + for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) { + pchild->mon_type[len] = ENVCTRL_NOMON; + } ++ of_node_put(root_node); + return; + } ++ of_node_put(root_node); + } + + /* Get the monitor channels. */ +-- +2.19.1 + diff --git a/queue-4.19/drivers-tty-add-missing-of_node_put.patch b/queue-4.19/drivers-tty-add-missing-of_node_put.patch new file mode 100644 index 00000000000..7c1927baaf1 --- /dev/null +++ b/queue-4.19/drivers-tty-add-missing-of_node_put.patch @@ -0,0 +1,33 @@ +From 942750732081a3c886203160de201a3dcfd1945a Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Wed, 21 Nov 2018 10:22:54 -0500 +Subject: drivers/tty: add missing of_node_put() + +[ Upstream commit dac097c4546e4c5b16dd303a1e97c1d319c8ab3e ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +This place is not doing this, so fix it. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/suncore.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c +index 70a4ea4eaa6e..990376576970 100644 +--- a/drivers/tty/serial/suncore.c ++++ b/drivers/tty/serial/suncore.c +@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct device_node *uart_dp) + mode = of_get_property(dp, mode_prop, NULL); + if (!mode) + mode = "9600,8,n,1,-"; ++ of_node_put(dp); + } + + cflag = CREAD | HUPCL | CLOCAL; +-- +2.19.1 + diff --git a/queue-4.19/drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch b/queue-4.19/drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch new file mode 100644 index 00000000000..e9b5527d5d3 --- /dev/null +++ b/queue-4.19/drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch @@ -0,0 +1,43 @@ +From 68ac27c82f3c3e254d4653ccfee1acfd3a1aa080 Mon Sep 17 00:00:00 2001 +From: Roman Li +Date: Tue, 27 Nov 2018 17:16:37 -0500 +Subject: drm/amd/display: Fix 6x4K displays light-up on Vega20 (v2) + +[ Upstream commit c6888879fd55b1ba903c2a770127edbf6aef6f27 ] + +[Why] +More than 4x4K didn't lightup on Vega20 due to low dcfclk value. +Powerplay expects valid min requirement for dcfclk from DC. + +[How] +Update min_dcfclock_khz based on min_engine_clock value. + +v2: backport to 4.20 (Alex) + +Reviewed-by: Hersen Wu +Reviewed-by: Feifei Xu +Reviewed-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Roman Li +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +index b2f308766a9e..0941f3c689bc 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -2530,6 +2530,8 @@ static void pplib_apply_display_requirements( + dc, + context->bw.dce.sclk_khz); + ++ pp_display_cfg->min_dcfclock_khz = pp_display_cfg->min_engine_clock_khz; ++ + pp_display_cfg->min_engine_clock_deep_sleep_khz + = context->bw.dce.sclk_deep_sleep_khz; + +-- +2.19.1 + diff --git a/queue-4.19/drm-amd-powerplay-issue-pre-display-settings-for-dis.patch b/queue-4.19/drm-amd-powerplay-issue-pre-display-settings-for-dis.patch new file mode 100644 index 00000000000..8f72c862e27 --- /dev/null +++ b/queue-4.19/drm-amd-powerplay-issue-pre-display-settings-for-dis.patch @@ -0,0 +1,50 @@ +From b22fb932f5eb71a866f9e488a0962eadbeb5552e Mon Sep 17 00:00:00 2001 +From: Evan Quan +Date: Wed, 28 Nov 2018 16:36:12 +0800 +Subject: drm/amd/powerplay: issue pre-display settings for display change + event + +[ Upstream commit 10cb3e6b63bf4266a5198813526fdd7259ffb8be ] + +For display config change event only, pre-display config settings are +needed. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c | 3 +++ + drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c | 2 -- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c +index 8994aa5c8cf8..64596029b696 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/hwmgr.c +@@ -365,6 +365,9 @@ int hwmgr_handle_task(struct pp_hwmgr *hwmgr, enum amd_pp_task task_id, + + switch (task_id) { + case AMD_PP_TASK_DISPLAY_CONFIG_CHANGE: ++ ret = phm_pre_display_configuration_changed(hwmgr); ++ if (ret) ++ return ret; + ret = phm_set_cpu_power_state(hwmgr); + if (ret) + return ret; +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c +index 91ffb7bc4ee7..56437866d120 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pp_psm.c +@@ -265,8 +265,6 @@ int psm_adjust_power_state_dynamic(struct pp_hwmgr *hwmgr, bool skip, + if (skip) + return 0; + +- phm_pre_display_configuration_changed(hwmgr); +- + phm_display_configuration_changed(hwmgr); + + if (hwmgr->ps) +-- +2.19.1 + diff --git a/queue-4.19/drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch b/queue-4.19/drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch new file mode 100644 index 00000000000..32501e7f643 --- /dev/null +++ b/queue-4.19/drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch @@ -0,0 +1,42 @@ +From 39c4b8b53aa952c946c8caa3f69f86b8e2c8ca6b Mon Sep 17 00:00:00 2001 +From: James Zhu +Date: Mon, 3 Dec 2018 22:04:28 -0500 +Subject: drm/amdgpu/vcn: Update vcn.cur_state during suspend + +[ Upstream commit 0a9b89b2e2e7b6d90f81ddc47e489be1043e01b1 ] + +Replace vcn_v1_0_stop with vcn_v1_0_set_powergating_state during suspend, +to keep adev->vcn.cur_state update. It will fix VCN S3 hung issue. + +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c +index 072371ef5975..4f8f3bb21832 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v1_0.c +@@ -43,6 +43,7 @@ static void vcn_v1_0_set_enc_ring_funcs(struct amdgpu_device *adev); + static void vcn_v1_0_set_jpeg_ring_funcs(struct amdgpu_device *adev); + static void vcn_v1_0_set_irq_funcs(struct amdgpu_device *adev); + static void vcn_v1_0_jpeg_ring_set_patch_ring(struct amdgpu_ring *ring, uint32_t ptr); ++static int vcn_v1_0_set_powergating_state(void *handle, enum amd_powergating_state state); + + /** + * vcn_v1_0_early_init - set function pointers +@@ -216,7 +217,7 @@ static int vcn_v1_0_hw_fini(void *handle) + struct amdgpu_ring *ring = &adev->vcn.ring_dec; + + if (RREG32_SOC15(VCN, 0, mmUVD_STATUS)) +- vcn_v1_0_stop(adev); ++ vcn_v1_0_set_powergating_state(adev, AMD_PG_STATE_GATE); + + ring->ready = false; + +-- +2.19.1 + diff --git a/queue-4.19/drm-amdgpu-wait-for-ib-test-on-first-device-open.patch b/queue-4.19/drm-amdgpu-wait-for-ib-test-on-first-device-open.patch new file mode 100644 index 00000000000..a76eaa579ef --- /dev/null +++ b/queue-4.19/drm-amdgpu-wait-for-ib-test-on-first-device-open.patch @@ -0,0 +1,49 @@ +From ed7b5a5908c5ba8a162623c39341b2efeb711069 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Fri, 26 Oct 2018 15:59:05 +0200 +Subject: drm/amdgpu: wait for IB test on first device open +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3bfa8897e4d08f822d1d58cf6cbbffbccef82e08 ] + +Instead of delaying that to the first query. Otherwise we could try to use the +SDMA for VM updates before the IB tests are done. + +Signed-off-by: Christian König +Reviewed-by: Chunming Zhou +Reviewed-by: Junwei Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +index bd98cc5fb97b..fd825d30edf1 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -292,9 +292,6 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file + if (!info->return_size || !info->return_pointer) + return -EINVAL; + +- /* Ensure IB tests are run on ring */ +- flush_delayed_work(&adev->late_init_work); +- + switch (info->query) { + case AMDGPU_INFO_ACCEL_WORKING: + ui32 = adev->accel_working; +@@ -861,6 +858,9 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv) + struct amdgpu_fpriv *fpriv; + int r, pasid; + ++ /* Ensure IB tests are run on ring */ ++ flush_delayed_work(&adev->late_init_work); ++ + file_priv->driver_priv = NULL; + + r = pm_runtime_get_sync(dev->dev); +-- +2.19.1 + diff --git a/queue-4.19/drm-ast-fix-connector-leak-during-driver-unload.patch b/queue-4.19/drm-ast-fix-connector-leak-during-driver-unload.patch new file mode 100644 index 00000000000..f2e227c39e0 --- /dev/null +++ b/queue-4.19/drm-ast-fix-connector-leak-during-driver-unload.patch @@ -0,0 +1,38 @@ +From fe2601f2462871fe9b68f06b5f5b6e3bc199b17b Mon Sep 17 00:00:00 2001 +From: Sam Bobroff +Date: Mon, 3 Dec 2018 11:53:21 +1100 +Subject: drm/ast: Fix connector leak during driver unload + +[ Upstream commit e594a5e349ddbfdaca1951bb3f8d72f3f1660d73 ] + +When unloading the ast driver, a warning message is printed by +drm_mode_config_cleanup() because a reference is still held to one of +the drm_connector structs. + +Correct this by calling drm_crtc_force_disable_all() in +ast_fbdev_destroy(). + +Signed-off-by: Sam Bobroff +Reviewed-by: Daniel Vetter +Signed-off-by: Dave Airlie +Link: https://patchwork.freedesktop.org/patch/msgid/1e613f3c630c7bbc72e04a44b178259b9164d2f6.1543798395.git.sbobroff@linux.ibm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_fb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c +index 0cd827e11fa2..de26df0c6044 100644 +--- a/drivers/gpu/drm/ast/ast_fb.c ++++ b/drivers/gpu/drm/ast/ast_fb.c +@@ -263,6 +263,7 @@ static void ast_fbdev_destroy(struct drm_device *dev, + { + struct ast_framebuffer *afb = &afbdev->afb; + ++ drm_crtc_force_disable_all(dev); + drm_fb_helper_unregister_fbi(&afbdev->helper); + + if (afb->obj) { +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch b/queue-4.19/drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch new file mode 100644 index 00000000000..a7ff900f97f --- /dev/null +++ b/queue-4.19/drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch @@ -0,0 +1,33 @@ +From fd9d9d898ba2fb40f3ac41d4ea999e87cba889cf Mon Sep 17 00:00:00 2001 +From: Sean Paul +Date: Tue, 16 Oct 2018 11:52:45 -0400 +Subject: drm/msm: dpu: Don't set legacy plane->crtc pointer + +[ Upstream commit 081679c51ef2fd7b23cf9ddb7d775b17f75de18c ] + +It causes a WARN in drm_atomic_get_plane_state(), and is not used by +atomic (or dpu). + +Signed-off-by: Sean Paul +Reviewed-by: Daniel Vetter +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index cd02eae884cc..4752f08f0884 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -2122,7 +2122,6 @@ struct drm_crtc *dpu_crtc_init(struct drm_device *dev, struct drm_plane *plane) + NULL); + + drm_crtc_helper_add(crtc, &dpu_crtc_helper_funcs); +- plane->crtc = crtc; + + /* save user friendly CRTC name for later */ + snprintf(dpu_crtc->name, DPU_CRTC_NAME_SIZE, "crtc%u", crtc->base.id); +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch b/queue-4.19/drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch new file mode 100644 index 00000000000..9455a72c3d9 --- /dev/null +++ b/queue-4.19/drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch @@ -0,0 +1,38 @@ +From 337b3186f1d73f51bb160364fbea6378db427a2f Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Fri, 16 Nov 2018 19:25:26 +0800 +Subject: drm/msm: dpu: Fix "WARNING: invalid free of devm_ allocated data" + +[ Upstream commit ce25aa3ee6939d83979cccf7adc5737cba9a0cb7 ] + +'dpu_enc' is a member of 'drm_enc' +And 'drm_enc' got allocated with devm_kzalloc in dpu_encoder_init. + +This gives this error message: +./drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c:459:1-6: + WARNING: invalid free of devm_ allocated data + +Signed-off-by: YueHaibing +Signed-off-by: Rob Clark +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index 1b4de3486ef9..ec3fd67378c1 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -503,8 +503,6 @@ static void dpu_encoder_destroy(struct drm_encoder *drm_enc) + + drm_encoder_cleanup(drm_enc); + mutex_destroy(&dpu_enc->enc_lock); +- +- kfree(dpu_enc); + } + + void dpu_encoder_helper_split_config( +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch b/queue-4.19/drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch new file mode 100644 index 00000000000..8f87249991e --- /dev/null +++ b/queue-4.19/drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch @@ -0,0 +1,46 @@ +From 52381a548d97be2ca799b9fb0b0b9b6020c8d66f Mon Sep 17 00:00:00 2001 +From: Abhinav Kumar +Date: Thu, 14 Jun 2018 21:01:10 -0700 +Subject: drm/msm/dsi: configure VCO rate for 10nm PLL driver + +[ Upstream commit 8531f0587f5c9e1a74cd9543a97617349f5e0706 ] + +Currenty the VCO rate in the 10nm PLL driver relies +on the parent rate which is not configured. + +Configure the VCO rate to 19.2 Mhz as required by +the 10nm PLL driver. + +Signed-off-by: Abhinav Kumar +Signed-off-by: Sean Paul +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +index 4c03f0b7343e..41bec570c518 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +@@ -39,6 +39,8 @@ + #define DSI_PIXEL_PLL_CLK 1 + #define NUM_PROVIDED_CLKS 2 + ++#define VCO_REF_CLK_RATE 19200000 ++ + struct dsi_pll_regs { + u32 pll_prop_gain_rate; + u32 pll_lockdet_rate; +@@ -316,7 +318,7 @@ static int dsi_pll_10nm_vco_set_rate(struct clk_hw *hw, unsigned long rate, + parent_rate); + + pll_10nm->vco_current_rate = rate; +- pll_10nm->vco_ref_clk_rate = parent_rate; ++ pll_10nm->vco_ref_clk_rate = VCO_REF_CLK_RATE; + + dsi_pll_setup_config(pll_10nm); + +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-fix-error-return-checking.patch b/queue-4.19/drm-msm-fix-error-return-checking.patch new file mode 100644 index 00000000000..51d6bbf3e39 --- /dev/null +++ b/queue-4.19/drm-msm-fix-error-return-checking.patch @@ -0,0 +1,44 @@ +From 245f83599ecaa2637c1e8eeeffc353d7b1992041 Mon Sep 17 00:00:00 2001 +From: Wen Yang +Date: Thu, 29 Nov 2018 14:01:50 +0800 +Subject: drm/msm: Fix error return checking + +[ Upstream commit 098336deb946f37a70afc0979af388b615c378bf ] + +The error checks on ret for a negative error return always fails because +the return value of iommu_map_sg() is unsigned and can never be negative. + +Detected with Coccinelle: +drivers/gpu/drm/msm/msm_iommu.c:69:9-12: WARNING: Unsigned expression +compared with zero: ret < 0 + +Signed-off-by: Wen Yang +CC: Rob Clark +CC: David Airlie +CC: Julia Lawall +CC: linux-arm-msm@vger.kernel.org +CC: dri-devel@lists.freedesktop.org +CC: freedreno@lists.freedesktop.org +CC: linux-kernel@vger.kernel.org +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c +index b23d33622f37..2a90aa4caec0 100644 +--- a/drivers/gpu/drm/msm/msm_iommu.c ++++ b/drivers/gpu/drm/msm/msm_iommu.c +@@ -66,7 +66,7 @@ static int msm_iommu_map(struct msm_mmu *mmu, uint64_t iova, + // pm_runtime_get_sync(mmu->dev); + ret = iommu_map_sg(iommu->domain, iova, sgt->sgl, sgt->nents, prot); + // pm_runtime_put_sync(mmu->dev); +- WARN_ON(ret < 0); ++ WARN_ON(!ret); + + return (ret == len) ? 0 : -EINVAL; + } +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-fix-handling-of-cmdstream-offset.patch b/queue-4.19/drm-msm-fix-handling-of-cmdstream-offset.patch new file mode 100644 index 00000000000..c2391623513 --- /dev/null +++ b/queue-4.19/drm-msm-fix-handling-of-cmdstream-offset.patch @@ -0,0 +1,51 @@ +From 2e4428495c26ea2c80261efe5c07eedf78764a6e Mon Sep 17 00:00:00 2001 +From: Rob Clark +Date: Mon, 15 Oct 2018 11:22:57 -0400 +Subject: drm/msm: fix handling of cmdstream offset + +[ Upstream commit 47e7f506ee6590ceb2efa1f08aca7f9f2ee5c1d3 ] + +Userspace hasn't used submit cmds with submit_offset != 0 for a while, +but this starts cropping up again with cmdstream sub-buffer-allocation +in libdrm_freedreno. + +Doesn't do much good to increment the buf ptr before assigning it. + +Fixes: 78b8e5b847b4 drm/msm: dump a rd GPUADDR header for all buffers in the command +Reviewed-by: Kristian H. Kristensen +Signed-off-by: Rob Clark +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_rd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/msm_rd.c b/drivers/gpu/drm/msm/msm_rd.c +index 3aa8a8576abe..f7a0edea4705 100644 +--- a/drivers/gpu/drm/msm/msm_rd.c ++++ b/drivers/gpu/drm/msm/msm_rd.c +@@ -316,10 +316,11 @@ static void snapshot_buf(struct msm_rd_state *rd, + uint64_t iova, uint32_t size) + { + struct msm_gem_object *obj = submit->bos[idx].obj; ++ unsigned offset = 0; + const char *buf; + + if (iova) { +- buf += iova - submit->bos[idx].iova; ++ offset = iova - submit->bos[idx].iova; + } else { + iova = submit->bos[idx].iova; + size = obj->base.size; +@@ -340,6 +341,8 @@ static void snapshot_buf(struct msm_rd_state *rd, + if (IS_ERR(buf)) + return; + ++ buf += offset; ++ + rd_write_section(rd, RD_BUFFER_CONTENTS, buf, size); + + msm_gem_put_vaddr(&obj->base); +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-fix-task-dump-in-gpu-recovery.patch b/queue-4.19/drm-msm-fix-task-dump-in-gpu-recovery.patch new file mode 100644 index 00000000000..5a4f33a6f2d --- /dev/null +++ b/queue-4.19/drm-msm-fix-task-dump-in-gpu-recovery.patch @@ -0,0 +1,55 @@ +From b6aedf7c97181940a83d9122b225a0368a564c9d Mon Sep 17 00:00:00 2001 +From: Sharat Masetty +Date: Fri, 12 Oct 2018 14:26:56 +0530 +Subject: drm/msm: Fix task dump in gpu recovery + +[ Upstream commit 482f96324a4e08818db7d75bb12beaaea6c9561d ] + +The current recovery code gets a pointer to the task struct and does a +few things all within the rcu_read_lock. This puts constraints on the +types of gfp flags that can be used within the rcu lock. This patch +instead gets a reference to the task within the rcu lock and releases +the lock immediately, this way the task stays afloat until we need it and +we also get to use the desired gfp flags. + +Signed-off-by: Sharat Masetty +Signed-off-by: Rob Clark +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_gpu.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c +index 46e6b82f7b66..52a2146dc1f2 100644 +--- a/drivers/gpu/drm/msm/msm_gpu.c ++++ b/drivers/gpu/drm/msm/msm_gpu.c +@@ -425,10 +425,9 @@ static void recover_worker(struct work_struct *work) + if (submit) { + struct task_struct *task; + +- rcu_read_lock(); +- task = pid_task(submit->pid, PIDTYPE_PID); ++ task = get_pid_task(submit->pid, PIDTYPE_PID); + if (task) { +- comm = kstrdup(task->comm, GFP_ATOMIC); ++ comm = kstrdup(task->comm, GFP_KERNEL); + + /* + * So slightly annoying, in other paths like +@@ -441,10 +440,10 @@ static void recover_worker(struct work_struct *work) + * about the submit going away. + */ + mutex_unlock(&dev->struct_mutex); +- cmd = kstrdup_quotable_cmdline(task, GFP_ATOMIC); ++ cmd = kstrdup_quotable_cmdline(task, GFP_KERNEL); ++ put_task_struct(task); + mutex_lock(&dev->struct_mutex); + } +- rcu_read_unlock(); + + if (comm && cmd) { + dev_err(dev->dev, "%s: offending task: %s (%s)\n", +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch b/queue-4.19/drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch new file mode 100644 index 00000000000..928e30fdc5a --- /dev/null +++ b/queue-4.19/drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch @@ -0,0 +1,59 @@ +From 21d18c13a72d8631d7f9535c2e7f51f010742778 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 13 Oct 2018 13:28:06 +0300 +Subject: drm/msm/gpu: Fix a couple memory leaks in debugfs + +[ Upstream commit 51270de91412b819f654b849db3bf92dac0a0855 ] + +The msm_gpu_open() function should free "show_priv" on error or it +causes static checker warnings. + +Fixes: 4f776f4511c7 ("drm/msm/gpu: Convert the GPU show function to use the GPU state") +Signed-off-by: Dan Carpenter +Signed-off-by: Rob Clark +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_debugfs.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/msm_debugfs.c b/drivers/gpu/drm/msm/msm_debugfs.c +index f0da0d3c8a80..d756436c1fcd 100644 +--- a/drivers/gpu/drm/msm/msm_debugfs.c ++++ b/drivers/gpu/drm/msm/msm_debugfs.c +@@ -84,7 +84,7 @@ static int msm_gpu_open(struct inode *inode, struct file *file) + + ret = mutex_lock_interruptible(&dev->struct_mutex); + if (ret) +- return ret; ++ goto free_priv; + + pm_runtime_get_sync(&gpu->pdev->dev); + show_priv->state = gpu->funcs->gpu_state_get(gpu); +@@ -94,13 +94,20 @@ static int msm_gpu_open(struct inode *inode, struct file *file) + + if (IS_ERR(show_priv->state)) { + ret = PTR_ERR(show_priv->state); +- kfree(show_priv); +- return ret; ++ goto free_priv; + } + + show_priv->dev = dev; + +- return single_open(file, msm_gpu_show, show_priv); ++ ret = single_open(file, msm_gpu_show, show_priv); ++ if (ret) ++ goto free_priv; ++ ++ return 0; ++ ++free_priv: ++ kfree(show_priv); ++ return ret; + } + + static const struct file_operations msm_gpu_fops = { +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch b/queue-4.19/drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch new file mode 100644 index 00000000000..8fdf0aba2c1 --- /dev/null +++ b/queue-4.19/drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch @@ -0,0 +1,39 @@ +From 5009d6624b7f3ded50ce312e852d60c75d7b168f Mon Sep 17 00:00:00 2001 +From: Sean Paul +Date: Wed, 3 Oct 2018 16:22:31 -0400 +Subject: drm/msm: Grab a vblank reference when waiting for commit_done + +[ Upstream commit 3b712e43e3876b42b38321ecf790a1f5fe59c834 ] + +Similar to the atomic helpers, we should enable vblank while we're +waiting for the commit to finish. DPU needs this, MDP5 seems to work +fine without it. + +Reviewed-by: Abhinav Kumar +Signed-off-by: Sean Paul +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_atomic.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c +index c1f1779c980f..2b7bb6e166d3 100644 +--- a/drivers/gpu/drm/msm/msm_atomic.c ++++ b/drivers/gpu/drm/msm/msm_atomic.c +@@ -32,7 +32,12 @@ static void msm_atomic_wait_for_commit_done(struct drm_device *dev, + if (!new_crtc_state->active) + continue; + ++ if (drm_crtc_vblank_get(crtc)) ++ continue; ++ + kms->funcs->wait_for_crtc_commit_done(kms, crtc); ++ ++ drm_crtc_vblank_put(crtc); + } + } + +-- +2.19.1 + diff --git a/queue-4.19/drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch b/queue-4.19/drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch new file mode 100644 index 00000000000..0c3621e04ed --- /dev/null +++ b/queue-4.19/drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch @@ -0,0 +1,110 @@ +From 4beddfa450f4fc9afedb69d84008df7d6ddbdd0b Mon Sep 17 00:00:00 2001 +From: Todor Tomov +Date: Fri, 19 Oct 2018 17:07:22 +0300 +Subject: drm/msm/hdmi: Enable HPD after HDMI IRQ is set up + +[ Upstream commit ee4456359640defe3f51cc6b728bfce4bc444c9e ] + +SoCs that contain MDP5 have a top level wrapper called MDSS that +manages locks, power and irq for the sub-blocks within it. + +Irq for HDMI is also routed through the MDSS. + +Shortly after the Hot Plug Detection (HPD) is enabled in HDMI, +HDMI interrupts are recieved by the MDSS interrupt handler. +However at this moment the HDMI irq is still not mapped to +the MDSS irq domain so the HDMI irq handler cannot be called +to process the interrupts. + +This leads to a flood of HDMI interrupts on CPU 0. + +If we are lucky to have the HDMI initialization running on a +different CPU, it will eventually map the HDMI irq to MDSS irq +domain, the next HDMI interrupt will be handled by the HDMI irq +handler, the interrupt flood will stop and we will recover. + +If the HDMI initialization is running on CPU 0, then it cannot +complete and there is nothing to stop the interrupt flood on +CPU 0. The system is stuck. + +Fix this by moving the HPD enablement after the HDMI irq is +mapped to the MDSS irq domain. + +Signed-off-by: Todor Tomov +Signed-off-by: Rob Clark +Signed-off-by: Sean Paul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 6 ++++++ + drivers/gpu/drm/msm/hdmi/hdmi.h | 1 + + drivers/gpu/drm/msm/hdmi/hdmi_connector.c | 10 ++-------- + 3 files changed, 9 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.c b/drivers/gpu/drm/msm/hdmi/hdmi.c +index c79659ca5706..33e083f71a17 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -332,6 +332,12 @@ int msm_hdmi_modeset_init(struct hdmi *hdmi, + goto fail; + } + ++ ret = msm_hdmi_hpd_enable(hdmi->connector); ++ if (ret < 0) { ++ DRM_DEV_ERROR(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret); ++ goto fail; ++ } ++ + encoder->bridge = hdmi->bridge; + + priv->bridges[priv->num_bridges++] = hdmi->bridge; +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi.h b/drivers/gpu/drm/msm/hdmi/hdmi.h +index accc9a61611d..5c5df6ab2a57 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi.h ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.h +@@ -245,6 +245,7 @@ void msm_hdmi_bridge_destroy(struct drm_bridge *bridge); + + void msm_hdmi_connector_irq(struct drm_connector *connector); + struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi); ++int msm_hdmi_hpd_enable(struct drm_connector *connector); + + /* + * i2c adapter for ddc: +diff --git a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c +index e9c9a0af508e..30e908dfded7 100644 +--- a/drivers/gpu/drm/msm/hdmi/hdmi_connector.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi_connector.c +@@ -167,8 +167,9 @@ static void enable_hpd_clocks(struct hdmi *hdmi, bool enable) + } + } + +-static int hpd_enable(struct hdmi_connector *hdmi_connector) ++int msm_hdmi_hpd_enable(struct drm_connector *connector) + { ++ struct hdmi_connector *hdmi_connector = to_hdmi_connector(connector); + struct hdmi *hdmi = hdmi_connector->hdmi; + const struct hdmi_platform_config *config = hdmi->config; + struct device *dev = &hdmi->pdev->dev; +@@ -450,7 +451,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi) + { + struct drm_connector *connector = NULL; + struct hdmi_connector *hdmi_connector; +- int ret; + + hdmi_connector = kzalloc(sizeof(*hdmi_connector), GFP_KERNEL); + if (!hdmi_connector) +@@ -471,12 +471,6 @@ struct drm_connector *msm_hdmi_connector_init(struct hdmi *hdmi) + connector->interlace_allowed = 0; + connector->doublescan_allowed = 0; + +- ret = hpd_enable(hdmi_connector); +- if (ret) { +- dev_err(&hdmi->pdev->dev, "failed to enable HPD: %d\n", ret); +- return ERR_PTR(ret); +- } +- + drm_connector_attach_encoder(connector, hdmi->encoder); + + return connector; +-- +2.19.1 + diff --git a/queue-4.19/drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch b/queue-4.19/drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch new file mode 100644 index 00000000000..ccfd85c0e81 --- /dev/null +++ b/queue-4.19/drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch @@ -0,0 +1,43 @@ +From 30ad75d31edbc01c8266b113c99b832741c673d2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20K=C3=B6nig?= +Date: Thu, 29 Nov 2018 16:25:10 +0100 +Subject: drm/ttm: fix LRU handling in ttm_buffer_object_transfer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit d6e820fcd4cf08b11d291a1dd7bbd0636914647c ] + +We need to set the NO_EVICT flag on the ghost object or otherwise we are +adding it to the LRU. + +When it is added to the LRU we can run into a race between destroying +and evicting it again. + +Signed-off-by: Christian König +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo_util.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c +index 046a6dda690a..40904e84f883 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo_util.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c +@@ -492,8 +492,10 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo, + if (!fbo) + return -ENOMEM; + +- ttm_bo_get(bo); + fbo->base = *bo; ++ fbo->base.mem.placement |= TTM_PL_FLAG_NO_EVICT; ++ ++ ttm_bo_get(bo); + fbo->bo = bo; + + /** +-- +2.19.1 + diff --git a/queue-4.19/ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch b/queue-4.19/ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch new file mode 100644 index 00000000000..ca0fec0634c --- /dev/null +++ b/queue-4.19/ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch @@ -0,0 +1,51 @@ +From 2ae903a5f872b568c1ef9b2e00b5b328c96106cd Mon Sep 17 00:00:00 2001 +From: Nicolas Saenz Julienne +Date: Mon, 3 Dec 2018 13:21:01 +0100 +Subject: ethernet: fman: fix wrong of_node_put() in probe function + +[ Upstream commit ecb239d96d369c23c33d41708646df646de669f4 ] + +After getting a reference to the platform device's of_node the probe +function ends up calling of_find_matching_node() using the node as an +argument. The function takes care of decreasing the refcount on it. We +are then incorrectly decreasing the refcount on that node again. + +This patch removes the unwarranted call to of_node_put(). + +Fixes: 414fd46e7762 ("fsl/fman: Add FMan support") +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fman/fman.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fman/fman.c b/drivers/net/ethernet/freescale/fman/fman.c +index c415ac67cb7b..e80fedb27cee 100644 +--- a/drivers/net/ethernet/freescale/fman/fman.c ++++ b/drivers/net/ethernet/freescale/fman/fman.c +@@ -2786,7 +2786,7 @@ static struct fman *read_dts_node(struct platform_device *of_dev) + if (!muram_node) { + dev_err(&of_dev->dev, "%s: could not find MURAM node\n", + __func__); +- goto fman_node_put; ++ goto fman_free; + } + + err = of_address_to_resource(muram_node, 0, +@@ -2795,11 +2795,10 @@ static struct fman *read_dts_node(struct platform_device *of_dev) + of_node_put(muram_node); + dev_err(&of_dev->dev, "%s: of_address_to_resource() = %d\n", + __func__, err); +- goto fman_node_put; ++ goto fman_free; + } + + of_node_put(muram_node); +- of_node_put(fm_node); + + err = devm_request_irq(&of_dev->dev, irq, fman_irq, IRQF_SHARED, + "fman", fman); +-- +2.19.1 + diff --git a/queue-4.19/i2c-axxia-properly-handle-master-timeout.patch b/queue-4.19/i2c-axxia-properly-handle-master-timeout.patch new file mode 100644 index 00000000000..8f729b649b5 --- /dev/null +++ b/queue-4.19/i2c-axxia-properly-handle-master-timeout.patch @@ -0,0 +1,173 @@ +From 46265c2106ccf68ba07a928b86812c1c4d843631 Mon Sep 17 00:00:00 2001 +From: "Adamski, Krzysztof (Nokia - PL/Wroclaw)" +Date: Fri, 16 Nov 2018 13:24:41 +0000 +Subject: i2c: axxia: properly handle master timeout + +[ Upstream commit 6c7f25cae54b840302e4f1b371dbf318fbf09ab2 ] + +According to Intel (R) Axxia TM Lionfish Communication Processor +Peripheral Subsystem Hardware Reference Manual, the AXXIA I2C module +have a programmable Master Wait Timer, which among others, checks the +time between commands send in manual mode. When a timeout (25ms) passes, +TSS bit is set in Master Interrupt Status register and a Stop command is +issued by the hardware. + +The axxia_i2c_xfer(), does not properly handle this situation, however. +For each message a separate axxia_i2c_xfer_msg() is called and this +function incorrectly assumes that any interrupt might happen only when +waiting for completion. This is mostly correct but there is one +exception - a master timeout can trigger if enough time has passed +between individual transfers. It will, by definition, happen between +transfers when the interrupts are disabled by the code. If that happens, +the hardware issues Stop command. + +The interrupt indicating timeout will not be triggered as soon as we +enable them since the Master Interrupt Status is cleared when master +mode is entered again (which happens before enabling irqs) meaning this +error is lost and the transfer is continued even though the Stop was +issued on the bus. The subsequent operations completes without error but +a bogus value (0xFF in case of read) is read as the client device is +confused because aborted transfer. No error is returned from +master_xfer() making caller believe that a valid value was read. + +To fix the problem, the TSS bit (indicating timeout) in Master Interrupt +Status register is checked before each transfer. If it is set, there was +a timeout before this transfer and (as described above) the hardware +already issued Stop command so the transaction should be aborted thus +-ETIMEOUT is returned from the master_xfer() callback. In order to be +sure no timeout was issued we can't just read the status just before +starting new transaction as there will always be a small window of time +(few CPU cycles at best) where this might still happen. For this reason +we have to temporally disable the timer before checking for TSS bit. +Disabling it will, however, clear the TSS bit so in order to preserve +that information, we have to read it in ISR so we have to ensure that +the TSS interrupt is not masked between transfers of one transaction. +There is no need to call bus recovery or controller reinitialization if +that happens so it's skipped. + +Signed-off-by: Krzysztof Adamski +Reviewed-by: Alexander Sverdlin +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-axxia.c | 40 ++++++++++++++++++++++++---------- + 1 file changed, 29 insertions(+), 11 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-axxia.c b/drivers/i2c/busses/i2c-axxia.c +index 8e60048a33f8..51d34959709b 100644 +--- a/drivers/i2c/busses/i2c-axxia.c ++++ b/drivers/i2c/busses/i2c-axxia.c +@@ -74,8 +74,7 @@ + MST_STATUS_ND) + #define MST_STATUS_ERR (MST_STATUS_NAK | \ + MST_STATUS_AL | \ +- MST_STATUS_IP | \ +- MST_STATUS_TSS) ++ MST_STATUS_IP) + #define MST_TX_BYTES_XFRD 0x50 + #define MST_RX_BYTES_XFRD 0x54 + #define SCL_HIGH_PERIOD 0x80 +@@ -241,7 +240,7 @@ static int axxia_i2c_empty_rx_fifo(struct axxia_i2c_dev *idev) + */ + if (c <= 0 || c > I2C_SMBUS_BLOCK_MAX) { + idev->msg_err = -EPROTO; +- i2c_int_disable(idev, ~0); ++ i2c_int_disable(idev, ~MST_STATUS_TSS); + complete(&idev->msg_complete); + break; + } +@@ -299,14 +298,19 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev) + + if (status & MST_STATUS_SCC) { + /* Stop completed */ +- i2c_int_disable(idev, ~0); ++ i2c_int_disable(idev, ~MST_STATUS_TSS); + complete(&idev->msg_complete); + } else if (status & MST_STATUS_SNS) { + /* Transfer done */ +- i2c_int_disable(idev, ~0); ++ i2c_int_disable(idev, ~MST_STATUS_TSS); + if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len) + axxia_i2c_empty_rx_fifo(idev); + complete(&idev->msg_complete); ++ } else if (status & MST_STATUS_TSS) { ++ /* Transfer timeout */ ++ idev->msg_err = -ETIMEDOUT; ++ i2c_int_disable(idev, ~MST_STATUS_TSS); ++ complete(&idev->msg_complete); + } else if (unlikely(status & MST_STATUS_ERR)) { + /* Transfer error */ + i2c_int_disable(idev, ~0); +@@ -339,10 +343,10 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) + u32 rx_xfer, tx_xfer; + u32 addr_1, addr_2; + unsigned long time_left; ++ unsigned int wt_value; + + idev->msg = msg; + idev->msg_xfrd = 0; +- idev->msg_err = 0; + reinit_completion(&idev->msg_complete); + + if (i2c_m_ten(msg)) { +@@ -383,9 +387,18 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) + else if (axxia_i2c_fill_tx_fifo(idev) != 0) + int_mask |= MST_STATUS_TFL; + ++ wt_value = WT_VALUE(readl(idev->base + WAIT_TIMER_CONTROL)); ++ /* Disable wait timer temporarly */ ++ writel(wt_value, idev->base + WAIT_TIMER_CONTROL); ++ /* Check if timeout error happened */ ++ if (idev->msg_err) ++ goto out; ++ + /* Start manual mode */ + writel(CMD_MANUAL, idev->base + MST_COMMAND); + ++ writel(WT_EN | wt_value, idev->base + WAIT_TIMER_CONTROL); ++ + i2c_int_enable(idev, int_mask); + + time_left = wait_for_completion_timeout(&idev->msg_complete, +@@ -396,13 +409,15 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) + if (readl(idev->base + MST_COMMAND) & CMD_BUSY) + dev_warn(idev->dev, "busy after xfer\n"); + +- if (time_left == 0) ++ if (time_left == 0) { + idev->msg_err = -ETIMEDOUT; +- +- if (idev->msg_err == -ETIMEDOUT) + i2c_recover_bus(&idev->adapter); ++ axxia_i2c_init(idev); ++ } + +- if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO) ++out: ++ if (unlikely(idev->msg_err) && idev->msg_err != -ENXIO && ++ idev->msg_err != -ETIMEDOUT) + axxia_i2c_init(idev); + + return idev->msg_err; +@@ -410,7 +425,7 @@ static int axxia_i2c_xfer_msg(struct axxia_i2c_dev *idev, struct i2c_msg *msg) + + static int axxia_i2c_stop(struct axxia_i2c_dev *idev) + { +- u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC; ++ u32 int_mask = MST_STATUS_ERR | MST_STATUS_SCC | MST_STATUS_TSS; + unsigned long time_left; + + reinit_completion(&idev->msg_complete); +@@ -437,6 +452,9 @@ axxia_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num) + int i; + int ret = 0; + ++ idev->msg_err = 0; ++ i2c_int_enable(idev, MST_STATUS_TSS); ++ + for (i = 0; ret == 0 && i < num; ++i) + ret = axxia_i2c_xfer_msg(idev, &msgs[i]); + +-- +2.19.1 + diff --git a/queue-4.19/i2c-rcar-check-bus-state-before-reinitializing.patch b/queue-4.19/i2c-rcar-check-bus-state-before-reinitializing.patch new file mode 100644 index 00000000000..48fd60a2081 --- /dev/null +++ b/queue-4.19/i2c-rcar-check-bus-state-before-reinitializing.patch @@ -0,0 +1,52 @@ +From d2d43ba8bc24f03a614c0752c7b151ab12317d1d Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Tue, 13 Nov 2018 12:15:42 +0100 +Subject: i2c: rcar: check bus state before reinitializing + +[ Upstream commit 0b57436f15bf40e432487086c4f2d01fd3529393 ] + +We should check the bus state before reinitializing the IP core. +Otherwise, the internal bus busy state which also tracks multi-master +activity is lost. + +Credits go to the Renesas BSP team for suggesting this change. + +Reported-by: Yoshihiro Shimoda +Signed-off-by: Wolfram Sang +Fixes: ae481cc13965 ("i2c: rcar: fix resume by always initializing registers before transfer") +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 4aa7dde876f3..254e6219e538 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -779,6 +779,11 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, + + pm_runtime_get_sync(dev); + ++ /* Check bus state before init otherwise bus busy info will be lost */ ++ ret = rcar_i2c_bus_barrier(priv); ++ if (ret < 0) ++ goto out; ++ + /* Gen3 needs a reset before allowing RXDMA once */ + if (priv->devtype == I2C_RCAR_GEN3) { + priv->flags |= ID_P_NO_RXDMA; +@@ -791,10 +796,6 @@ static int rcar_i2c_master_xfer(struct i2c_adapter *adap, + + rcar_i2c_init(priv); + +- ret = rcar_i2c_bus_barrier(priv); +- if (ret < 0) +- goto out; +- + for (i = 0; i < num; i++) + rcar_i2c_request_dma(priv, msgs + i); + +-- +2.19.1 + diff --git a/queue-4.19/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch b/queue-4.19/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch new file mode 100644 index 00000000000..d26e40a7006 --- /dev/null +++ b/queue-4.19/i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch @@ -0,0 +1,72 @@ +From 39213b26d0114749a20e5c44a7bc9224d971b6d6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 21 Nov 2018 10:19:55 +0100 +Subject: i2c: scmi: Fix probe error on devices with an empty SMB0001 ACPI + device node + +[ Upstream commit 0544ee4b1ad574aec3b6379af5f5cdee42840971 ] + +Some AMD based HP laptops have a SMB0001 ACPI device node which does not +define any methods. + +This leads to the following error in dmesg: + +[ 5.222731] cmi: probe of SMB0001:00 failed with error -5 + +This commit makes acpi_smbus_cmi_add() return -ENODEV instead in this case +silencing the error. In case of a failure of the i2c_add_adapter() call +this commit now propagates the error from that call instead of -EIO. + +Signed-off-by: Hans de Goede +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-scmi.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c +index 7e9a2bbf5ddc..ff3f4553648f 100644 +--- a/drivers/i2c/busses/i2c-scmi.c ++++ b/drivers/i2c/busses/i2c-scmi.c +@@ -367,6 +367,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + { + struct acpi_smbus_cmi *smbus_cmi; + const struct acpi_device_id *id; ++ int ret; + + smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL); + if (!smbus_cmi) +@@ -388,8 +389,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1, + acpi_smbus_cmi_query_methods, NULL, smbus_cmi, NULL); + +- if (smbus_cmi->cap_info == 0) ++ if (smbus_cmi->cap_info == 0) { ++ ret = -ENODEV; + goto err; ++ } + + snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name), + "SMBus CMI adapter %s", +@@ -400,7 +403,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD; + smbus_cmi->adapter.dev.parent = &device->dev; + +- if (i2c_add_adapter(&smbus_cmi->adapter)) { ++ ret = i2c_add_adapter(&smbus_cmi->adapter); ++ if (ret) { + dev_err(&device->dev, "Couldn't register adapter!\n"); + goto err; + } +@@ -410,7 +414,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device) + err: + kfree(smbus_cmi); + device->driver_data = NULL; +- return -EIO; ++ return ret; + } + + static int acpi_smbus_cmi_remove(struct acpi_device *device) +-- +2.19.1 + diff --git a/queue-4.19/i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch b/queue-4.19/i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch new file mode 100644 index 00000000000..131985f4093 --- /dev/null +++ b/queue-4.19/i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch @@ -0,0 +1,56 @@ +From 796c67751de917e43ec83c5391f2ade6cc50ee8d Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Thu, 6 Dec 2018 12:55:28 +0900 +Subject: i2c: uniphier-f: fix violation of tLOW requirement for Fast-mode + +[ Upstream commit ece27a337d42a3197935711997f2880f0957ed7e ] + +Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode, +tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us. + +tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode: + Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us + Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us + +Signed-off-by: Masahiro Yamada +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-uniphier-f.c | 19 ++++++++++++++++++- + 1 file changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-uniphier-f.c b/drivers/i2c/busses/i2c-uniphier-f.c +index a403e8579b65..bc26ec822e26 100644 +--- a/drivers/i2c/busses/i2c-uniphier-f.c ++++ b/drivers/i2c/busses/i2c-uniphier-f.c +@@ -470,9 +470,26 @@ static void uniphier_fi2c_hw_init(struct uniphier_fi2c_priv *priv) + + uniphier_fi2c_reset(priv); + ++ /* ++ * Standard-mode: tLOW + tHIGH = 10 us ++ * Fast-mode: tLOW + tHIGH = 2.5 us ++ */ + writel(cyc, priv->membase + UNIPHIER_FI2C_CYC); +- writel(cyc / 2, priv->membase + UNIPHIER_FI2C_LCTL); ++ /* ++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us, tBUF = 4.7 us ++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us, tBUF = 1.3 us ++ * "tLow/tHIGH = 5/4" meets both. ++ */ ++ writel(cyc * 5 / 9, priv->membase + UNIPHIER_FI2C_LCTL); ++ /* ++ * Standard-mode: tHD;STA = 4.0 us, tSU;STA = 4.7 us, tSU;STO = 4.0 us ++ * Fast-mode: tHD;STA = 0.6 us, tSU;STA = 0.6 us, tSU;STO = 0.6 us ++ */ + writel(cyc / 2, priv->membase + UNIPHIER_FI2C_SSUT); ++ /* ++ * Standard-mode: tSU;DAT = 250 ns ++ * Fast-mode: tSU;DAT = 100 ns ++ */ + writel(cyc / 16, priv->membase + UNIPHIER_FI2C_DSUT); + + uniphier_fi2c_prepare_operation(priv); +-- +2.19.1 + diff --git a/queue-4.19/i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch b/queue-4.19/i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch new file mode 100644 index 00000000000..57f50a0f11d --- /dev/null +++ b/queue-4.19/i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch @@ -0,0 +1,43 @@ +From ec679b158eb8f098000539de0938c1b2591e8682 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Thu, 6 Dec 2018 12:55:27 +0900 +Subject: i2c: uniphier: fix violation of tLOW requirement for Fast-mode + +[ Upstream commit 8469636ab5d8c77645b953746c10fda6983a8830 ] + +Currently, the clock duty is set as tLOW/tHIGH = 1/1. For Fast-mode, +tLOW is set to 1.25 us while the I2C spec requires tLOW >= 1.3 us. + +tLOW/tHIGH = 5/4 would meet both Standard-mode and Fast-mode: + Standard-mode: tLOW = 5.56 us, tHIGH = 4.44 us + Fast-mode: tLOW = 1.39 us, tHIGH = 1.11 us + +Signed-off-by: Masahiro Yamada +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-uniphier.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-uniphier.c b/drivers/i2c/busses/i2c-uniphier.c +index 454f914ae66d..c488e558aef7 100644 +--- a/drivers/i2c/busses/i2c-uniphier.c ++++ b/drivers/i2c/busses/i2c-uniphier.c +@@ -320,7 +320,13 @@ static void uniphier_i2c_hw_init(struct uniphier_i2c_priv *priv) + + uniphier_i2c_reset(priv, true); + +- writel((cyc / 2 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK); ++ /* ++ * Bit30-16: clock cycles of tLOW. ++ * Standard-mode: tLOW = 4.7 us, tHIGH = 4.0 us ++ * Fast-mode: tLOW = 1.3 us, tHIGH = 0.6 us ++ * "tLow/tHIGH = 5/4" meets both. ++ */ ++ writel((cyc * 5 / 9 << 16) | cyc, priv->membase + UNIPHIER_I2C_CLK); + + uniphier_i2c_reset(priv, false); + } +-- +2.19.1 + diff --git a/queue-4.19/ide-pmac-add-of_node_put.patch b/queue-4.19/ide-pmac-add-of_node_put.patch new file mode 100644 index 00000000000..8f571eb53b5 --- /dev/null +++ b/queue-4.19/ide-pmac-add-of_node_put.patch @@ -0,0 +1,31 @@ +From ef59cdfbdd822e91ee25dd5504ab5b3e8e1bbce7 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:02:49 -0500 +Subject: ide: pmac: add of_node_put() + +[ Upstream commit a51921c0db3fd26c4ed83dc0ec5d32988fa02aa5 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ide/pmac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c +index c5b902b86b44..203ed4adc04a 100644 +--- a/drivers/ide/pmac.c ++++ b/drivers/ide/pmac.c +@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif) + struct device_node *root = of_find_node_by_path("/"); + const char *model = of_get_property(root, "model", NULL); + ++ of_node_put(root); + /* Get cable type from device-tree. */ + if (cable && !strncmp(cable, "80-", 3)) { + /* Some drives fail to detect 80c cable in PowerBook */ +-- +2.19.1 + diff --git a/queue-4.19/input-hyper-v-fix-wakeup-from-suspend-to-idle.patch b/queue-4.19/input-hyper-v-fix-wakeup-from-suspend-to-idle.patch new file mode 100644 index 00000000000..918465c68ac --- /dev/null +++ b/queue-4.19/input-hyper-v-fix-wakeup-from-suspend-to-idle.patch @@ -0,0 +1,56 @@ +From 929e2f05b06e3c8b1c21622cb7931473feb0d3ce Mon Sep 17 00:00:00 2001 +From: Vitaly Kuznetsov +Date: Thu, 15 Nov 2018 11:05:10 -0800 +Subject: Input: hyper-v - fix wakeup from suspend-to-idle + +[ Upstream commit 10f91c73cc41ceead210a905dbd196398e99c7d2 ] + +It makes little sense but still possible to put Hyper-V guests into +suspend-to-idle state. To wake them up two wakeup sources were registered +in the past: hyperv-keyboard and hid-hyperv. However, since +commit eed4d47efe95 ("ACPI / sleep: Ignore spurious SCI wakeups from +suspend-to-idle") pm_wakeup_event() from these devices is ignored. Switch +to pm_wakeup_hard_event() API as these devices are actually the only +possible way to wakeup Hyper-V guests. + +Fixes: eed4d47efe95 (ACPI / sleep: Ignore spurious SCI wakeups from suspend-to-idle) +Reviewed-by: Rafael J. Wysocki +Acked-by: K. Y. Srinivasan +Acked-by: Jiri Kosina +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-hyperv.c | 2 +- + drivers/input/serio/hyperv-keyboard.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-hyperv.c b/drivers/hid/hid-hyperv.c +index b372854cf38d..704049e62d58 100644 +--- a/drivers/hid/hid-hyperv.c ++++ b/drivers/hid/hid-hyperv.c +@@ -309,7 +309,7 @@ static void mousevsc_on_receive(struct hv_device *device, + hid_input_report(input_dev->hid_device, HID_INPUT_REPORT, + input_dev->input_buf, len, 1); + +- pm_wakeup_event(&input_dev->device->device, 0); ++ pm_wakeup_hard_event(&input_dev->device->device); + + break; + default: +diff --git a/drivers/input/serio/hyperv-keyboard.c b/drivers/input/serio/hyperv-keyboard.c +index 47a0e81a2989..a8b9be3e28db 100644 +--- a/drivers/input/serio/hyperv-keyboard.c ++++ b/drivers/input/serio/hyperv-keyboard.c +@@ -177,7 +177,7 @@ static void hv_kbd_on_receive(struct hv_device *hv_dev, + * state because the Enter-UP can trigger a wakeup at once. + */ + if (!(info & IS_BREAK)) +- pm_wakeup_event(&hv_dev->device, 0); ++ pm_wakeup_hard_event(&hv_dev->device); + + break; + +-- +2.19.1 + diff --git a/queue-4.19/input-omap-keypad-fix-keyboard-debounce-configuratio.patch b/queue-4.19/input-omap-keypad-fix-keyboard-debounce-configuratio.patch new file mode 100644 index 00000000000..a4f74ce28f0 --- /dev/null +++ b/queue-4.19/input-omap-keypad-fix-keyboard-debounce-configuratio.patch @@ -0,0 +1,67 @@ +From 827958b0100188b3b69bf551c947fd30d0f3f08c Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 3 Dec 2018 11:24:30 -0800 +Subject: Input: omap-keypad - fix keyboard debounce configuration + +[ Upstream commit 6c3516fed7b61a3527459ccfa67fab130d910610 ] + +I noticed that the Android v3.0.8 kernel on droid4 is using different +keypad values from the mainline kernel and does not have issues with +keys occasionally being stuck until pressed again. Turns out there was +an earlier patch posted to fix this as "Input: omap-keypad: errata i689: +Correct debounce time", but it was never reposted to fix use macros +for timing calculations. + +This updated version is using macros, and also fixes the use of the +input clock rate to use 32768KiHz instead of 32000KiHz. And we want to +use the known good Android kernel values of 3 and 6 instead of 2 and 6 +in the earlier patch. + +Reported-by: Pavel Machek +Signed-off-by: Tony Lindgren +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/omap4-keypad.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c +index 46406345742b..a7dc286f406c 100644 +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -60,8 +60,18 @@ + + /* OMAP4 values */ + #define OMAP4_VAL_IRQDISABLE 0x0 +-#define OMAP4_VAL_DEBOUNCINGTIME 0x7 +-#define OMAP4_VAL_PVT 0x7 ++ ++/* ++ * Errata i689: If a key is released for a time shorter than debounce time, ++ * the keyboard will idle and never detect the key release. The workaround ++ * is to use at least a 12ms debounce time. See omap5432 TRM chapter ++ * "26.4.6.2 Keyboard Controller Timer" for more information. ++ */ ++#define OMAP4_KEYPAD_PTV_DIV_128 0x6 ++#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv) \ ++ ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1) ++#define OMAP4_VAL_DEBOUNCINGTIME_16MS \ ++ OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128) + + enum { + KBD_REVISION_OMAP4 = 0, +@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input) + + kbd_writel(keypad_data, OMAP4_KBD_CTRL, + OMAP4_DEF_CTRL_NOSOFTMODE | +- (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT)); ++ (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT)); + kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME, +- OMAP4_VAL_DEBOUNCINGTIME); ++ OMAP4_VAL_DEBOUNCINGTIME_16MS); + /* clear pending interrupts */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, + kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); +-- +2.19.1 + diff --git a/queue-4.19/input-synaptics-enable-smbus-for-hp-15-ay000.patch b/queue-4.19/input-synaptics-enable-smbus-for-hp-15-ay000.patch new file mode 100644 index 00000000000..ad55dfd719a --- /dev/null +++ b/queue-4.19/input-synaptics-enable-smbus-for-hp-15-ay000.patch @@ -0,0 +1,40 @@ +From cd9f0bcd0aaf570cbe15725e8644ea51e39dba81 Mon Sep 17 00:00:00 2001 +From: Teika Kazura +Date: Mon, 3 Dec 2018 11:26:03 -0800 +Subject: Input: synaptics - enable SMBus for HP 15-ay000 + +[ Upstream commit 5a6dab15f7a79817cab4af612ddd99eda793fce6 ] + +SMBus works fine for the touchpad with id SYN3221, used in the HP 15-ay000 +series, + +This device has been reported in these messages in the "linux-input" +mailing list: +* https://marc.info/?l=linux-input&m=152016683003369&w=2 +* https://www.spinics.net/lists/linux-input/msg52525.html + +Reported-by: Nitesh Debnath +Reported-by: Teika Kazura +Signed-off-by: Teika Kazura +Reviewed-by: Benjamin Tissoires +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/synaptics.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index c42813d50591..2bd5bb11c8ba 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -178,6 +178,7 @@ static const char * const smbus_pnp_ids[] = { + "LEN0096", /* X280 */ + "LEN0097", /* X280 -> ALPS trackpoint */ + "LEN200f", /* T450s */ ++ "SYN3221", /* HP 15-ay000 */ + NULL + }; + +-- +2.19.1 + diff --git a/queue-4.19/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch b/queue-4.19/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch new file mode 100644 index 00000000000..1d69ac2da98 --- /dev/null +++ b/queue-4.19/libata-whitelist-all-samsung-mz7km-solid-state-disks.patch @@ -0,0 +1,34 @@ +From 8b46655a4fd0d099eecb5698033a86d135bccec0 Mon Sep 17 00:00:00 2001 +From: Juha-Matti Tilli +Date: Sun, 2 Dec 2018 12:47:08 +0200 +Subject: libata: whitelist all SAMSUNG MZ7KM* solid-state disks + +[ Upstream commit fd6f32f78645db32b6b95a42e45da2ddd6de0e67 ] + +These devices support read zero after trim (RZAT), as they advertise to +the OS. However, the OS doesn't believe the SSDs unless they are +explicitly whitelisted. + +Acked-by: Martin K. Petersen +Signed-off-by: Juha-Matti Tilli +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index a7f5202a4815..b8c3f9e6af89 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4602,6 +4602,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "SSD*INTEL*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "SAMSUNG*SSD*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "SAMSUNG*MZ7KM*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "ST[1248][0248]0[FH]*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM, }, + + /* +-- +2.19.1 + diff --git a/queue-4.19/liquidio-read-sc-iq_no-before-release-sc.patch b/queue-4.19/liquidio-read-sc-iq_no-before-release-sc.patch new file mode 100644 index 00000000000..3bd6a795ce4 --- /dev/null +++ b/queue-4.19/liquidio-read-sc-iq_no-before-release-sc.patch @@ -0,0 +1,44 @@ +From 372ab42f7187ecf1e995aca3a3fa0e48ce8bcf2d Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Thu, 29 Nov 2018 07:54:22 +0800 +Subject: liquidio: read sc->iq_no before release sc + +[ Upstream commit c0f53771ba45745e5870daf880127925c93f232f ] + +The function lio_vf_rep_packet_sent_callback releases the occupation of +sc via octeon_free_soft_command. sc should not be used after that. +Unfortunately, sc->iq_no is read. To fix this, the patch stores sc->iq_no +into a local variable before releasing sc and then uses the local variable +instead of sc->iq_no. + +Signed-off-by: Pan Bian +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c +index ddd7431579f4..c99b59fe4c8f 100644 +--- a/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c ++++ b/drivers/net/ethernet/cavium/liquidio/lio_vf_rep.c +@@ -367,13 +367,15 @@ lio_vf_rep_packet_sent_callback(struct octeon_device *oct, + struct octeon_soft_command *sc = (struct octeon_soft_command *)buf; + struct sk_buff *skb = sc->ctxptr; + struct net_device *ndev = skb->dev; ++ u32 iq_no; + + dma_unmap_single(&oct->pci_dev->dev, sc->dmadptr, + sc->datasize, DMA_TO_DEVICE); + dev_kfree_skb_any(skb); ++ iq_no = sc->iq_no; + octeon_free_soft_command(oct, sc); + +- if (octnet_iq_is_full(oct, sc->iq_no)) ++ if (octnet_iq_is_full(oct, iq_no)) + return; + + if (netif_queue_stopped(ndev)) +-- +2.19.1 + diff --git a/queue-4.19/mac80211_hwsim-fix-module-init-error-paths-for-netli.patch b/queue-4.19/mac80211_hwsim-fix-module-init-error-paths-for-netli.patch new file mode 100644 index 00000000000..eb1297f359e --- /dev/null +++ b/queue-4.19/mac80211_hwsim-fix-module-init-error-paths-for-netli.patch @@ -0,0 +1,59 @@ +From a6fd6f8f421b3bf581ab34ec6c9d64235c0d4bf2 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Fri, 5 Oct 2018 23:22:06 +0300 +Subject: mac80211_hwsim: fix module init error paths for netlink + +[ Upstream commit 05cc09de4c017663a217630682041066f2f9a5cd ] + +There is no unregister netlink notifier and family on error paths +in init_mac80211_hwsim(). Also there is an error path where +hwsim_class is not destroyed. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Fixes: 62759361eb49 ("mac80211-hwsim: Provide multicast event for HWSIM_CMD_NEW_RADIO") +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mac80211_hwsim.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 62ab42e94c9d..4ca6592f5b3a 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3712,16 +3712,16 @@ static int __init init_mac80211_hwsim(void) + if (err) + goto out_unregister_pernet; + ++ err = hwsim_init_netlink(); ++ if (err) ++ goto out_unregister_driver; ++ + hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim"); + if (IS_ERR(hwsim_class)) { + err = PTR_ERR(hwsim_class); +- goto out_unregister_driver; ++ goto out_exit_netlink; + } + +- err = hwsim_init_netlink(); +- if (err < 0) +- goto out_unregister_driver; +- + for (i = 0; i < radios; i++) { + struct hwsim_new_radio_params param = { 0 }; + +@@ -3827,6 +3827,8 @@ out_free_mon: + free_netdev(hwsim_mon); + out_free_radios: + mac80211_hwsim_free(); ++out_exit_netlink: ++ hwsim_exit_netlink(); + out_unregister_driver: + platform_driver_unregister(&mac80211_hwsim_driver); + out_unregister_pernet: +-- +2.19.1 + diff --git a/queue-4.19/macvlan-return-correct-error-value.patch b/queue-4.19/macvlan-return-correct-error-value.patch new file mode 100644 index 00000000000..de39c8c016d --- /dev/null +++ b/queue-4.19/macvlan-return-correct-error-value.patch @@ -0,0 +1,68 @@ +From d37f2a953ede40558f82dd8983db3fc4b3827ea2 Mon Sep 17 00:00:00 2001 +From: Matteo Croce +Date: Sat, 1 Dec 2018 00:26:27 +0100 +Subject: macvlan: return correct error value + +[ Upstream commit 59f997b088d26a774958cb7b17b0763cd82de7ec ] + +A MAC address must be unique among all the macvlan devices with the same +lower device. The only exception is the passthru [sic] mode, +which shares the lower device address. + +When duplicate addresses are detected, EBUSY is returned when bringing +the interface up: + + # ip link add macvlan0 link eth0 type macvlan + # read addr +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macvlan.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index cfda146f3b3b..6372cdc4a510 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -608,7 +608,7 @@ static int macvlan_open(struct net_device *dev) + goto hash_add; + } + +- err = -EBUSY; ++ err = -EADDRINUSE; + if (macvlan_addr_busy(vlan->port, dev->dev_addr)) + goto out; + +@@ -706,7 +706,7 @@ static int macvlan_sync_address(struct net_device *dev, unsigned char *addr) + } else { + /* Rehash and update the device filters */ + if (macvlan_addr_busy(vlan->port, addr)) +- return -EBUSY; ++ return -EADDRINUSE; + + if (!macvlan_passthru(port)) { + err = dev_uc_add(lowerdev, addr); +@@ -747,6 +747,9 @@ static int macvlan_set_mac_address(struct net_device *dev, void *p) + return dev_set_mac_address(vlan->lowerdev, addr); + } + ++ if (macvlan_addr_busy(vlan->port, addr->sa_data)) ++ return -EADDRINUSE; ++ + return macvlan_sync_address(dev, addr->sa_data); + } + +-- +2.19.1 + diff --git a/queue-4.19/mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch b/queue-4.19/mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch new file mode 100644 index 00000000000..5bfd5583906 --- /dev/null +++ b/queue-4.19/mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch @@ -0,0 +1,61 @@ +From 68c6b9906b3decae5746a5f56e5b36227a382127 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Thu, 6 Dec 2018 17:44:53 +0000 +Subject: mlxsw: spectrum_switchdev: Fix VLAN device deletion via ioctl + +[ Upstream commit 993107fea5eefdfdfde1ca38d3f01f0bebf76e77 ] + +When deleting a VLAN device using an ioctl the netdev is unregistered +before the VLAN filter is updated via ndo_vlan_rx_kill_vid(). It can +lead to a use-after-free in mlxsw in case the VLAN device is deleted +while being enslaved to a bridge. + +The reason for the above is that when mlxsw receives the CHANGEUPPER +event, it wrongly assumes that the VLAN device is no longer its upper +and thus destroys the internal representation of the bridge port despite +the reference count being non-zero. + +Fix this by checking if the VLAN device is our upper using its real +device. In net-next I'm going to remove this trick and instead make +mlxsw completely agnostic to the order of the events. + +Fixes: c57529e1d5d8 ("mlxsw: spectrum: Replace vPorts with Port-VLAN") +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 7715f1ed2bcb..4eb64cb0d9a1 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -286,7 +286,13 @@ static bool + mlxsw_sp_bridge_port_should_destroy(const struct mlxsw_sp_bridge_port * + bridge_port) + { +- struct mlxsw_sp *mlxsw_sp = mlxsw_sp_lower_get(bridge_port->dev); ++ struct net_device *dev = bridge_port->dev; ++ struct mlxsw_sp *mlxsw_sp; ++ ++ if (is_vlan_dev(dev)) ++ mlxsw_sp = mlxsw_sp_lower_get(vlan_dev_real_dev(dev)); ++ else ++ mlxsw_sp = mlxsw_sp_lower_get(dev); + + /* In case ports were pulled from out of a bridged LAG, then + * it's possible the reference count isn't zero, yet the bridge +@@ -2020,7 +2026,7 @@ mlxsw_sp_bridge_8021d_port_leave(struct mlxsw_sp_bridge_device *bridge_device, + + vid = is_vlan_dev(dev) ? vlan_dev_vlan_id(dev) : 1; + mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid); +- if (WARN_ON(!mlxsw_sp_port_vlan)) ++ if (!mlxsw_sp_port_vlan) + return; + + mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan); +-- +2.19.1 + diff --git a/queue-4.19/mv88e6060-disable-hardware-level-mac-learning.patch b/queue-4.19/mv88e6060-disable-hardware-level-mac-learning.patch new file mode 100644 index 00000000000..0e8aa269114 --- /dev/null +++ b/queue-4.19/mv88e6060-disable-hardware-level-mac-learning.patch @@ -0,0 +1,52 @@ +From 1e92d6658a2b4137e8c5570546fd71c0a019eea5 Mon Sep 17 00:00:00 2001 +From: Anderson Luiz Alves +Date: Fri, 30 Nov 2018 21:58:36 -0200 +Subject: mv88e6060: disable hardware level MAC learning + +[ Upstream commit a74515604a7b171f2702bdcbd1e231225fb456d0 ] + +Disable hardware level MAC learning because it breaks station roaming. +When enabled it drops all frames that arrive from a MAC address +that is on a different port at learning table. + +Signed-off-by: Anderson Luiz Alves +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6060.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6060.c b/drivers/net/dsa/mv88e6060.c +index 65f10fec25b3..0b3e51f248c2 100644 +--- a/drivers/net/dsa/mv88e6060.c ++++ b/drivers/net/dsa/mv88e6060.c +@@ -116,8 +116,7 @@ static int mv88e6060_switch_reset(struct dsa_switch *ds) + /* Reset the switch. */ + REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL, + GLOBAL_ATU_CONTROL_SWRESET | +- GLOBAL_ATU_CONTROL_ATUSIZE_1024 | +- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN); ++ GLOBAL_ATU_CONTROL_LEARNDIS); + + /* Wait up to one second for reset to complete. */ + timeout = jiffies + 1 * HZ; +@@ -142,13 +141,10 @@ static int mv88e6060_setup_global(struct dsa_switch *ds) + */ + REG_WRITE(REG_GLOBAL, GLOBAL_CONTROL, GLOBAL_CONTROL_MAX_FRAME_1536); + +- /* Enable automatic address learning, set the address +- * database size to 1024 entries, and set the default aging +- * time to 5 minutes. ++ /* Disable automatic address learning. + */ + REG_WRITE(REG_GLOBAL, GLOBAL_ATU_CONTROL, +- GLOBAL_ATU_CONTROL_ATUSIZE_1024 | +- GLOBAL_ATU_CONTROL_ATE_AGE_5MIN); ++ GLOBAL_ATU_CONTROL_LEARNDIS); + + return 0; + } +-- +2.19.1 + diff --git a/queue-4.19/net-aquantia-fix-rx-checksum-offload-bits.patch b/queue-4.19/net-aquantia-fix-rx-checksum-offload-bits.patch new file mode 100644 index 00000000000..fe0dd5ea421 --- /dev/null +++ b/queue-4.19/net-aquantia-fix-rx-checksum-offload-bits.patch @@ -0,0 +1,41 @@ +From f763822016d16697336ebbbad7508a89f23b7da5 Mon Sep 17 00:00:00 2001 +From: Dmitry Bogdanov +Date: Tue, 27 Nov 2018 14:51:17 +0000 +Subject: net: aquantia: fix rx checksum offload bits + +[ Upstream commit 37c4b91f955fdd5f4ad771956b97d35f1321098e ] + +The last set of csum offload fixes had a leak: + +Checksum enabled status bits from rx descriptor were incorrectly +interpreted. Consequently all the other valid logic worked on zero bits. +That caused rx checksum offloads never to trigger. + +Tested by dumping rx descriptors and validating resulting csum_level. + +Reported-by: Igor Russkikh +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Fixes: ad703c2b9127f ("net: aquantia: invalid checksumm offload implementation") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 88705dee5b95..56363ff5c891 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -667,7 +667,7 @@ static int hw_atl_b0_hw_ring_rx_receive(struct aq_hw_s *self, + + rx_stat = (0x0000003CU & rxd_wb->status) >> 2; + +- is_rx_check_sum_enabled = (rxd_wb->type) & (0x3U << 19); ++ is_rx_check_sum_enabled = (rxd_wb->type >> 19) & 0x3U; + + pkt_type = 0xFFU & (rxd_wb->type >> 4); + +-- +2.19.1 + diff --git a/queue-4.19/net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch b/queue-4.19/net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch new file mode 100644 index 00000000000..3452d3c037f --- /dev/null +++ b/queue-4.19/net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch @@ -0,0 +1,70 @@ +From 467c58f9729f7e325b50439194b8ac7d64eed0a8 Mon Sep 17 00:00:00 2001 +From: Kunihiko Hayashi +Date: Thu, 29 Nov 2018 17:08:37 +0900 +Subject: net: ethernet: ave: Replace NET_IP_ALIGN with AVE_FRAME_HEADROOM + +[ Upstream commit 88113957ddb7b7d5451e28cd708c82ea7e63b097 ] + +In commit 26a4676faa1a ("arm64: mm: define NET_IP_ALIGN to 0"), +AVE controller affects this modification because the controller forces +to ignore lower 2bits of buffer start address, and make 2-byte headroom, +that is, data reception starts from (buffer + 2). + +This patch defines AVE_FRAME_HEADROOM macro as hardware-specific value, +and replaces NET_IP_ALIGN with it. + +Signed-off-by: Kunihiko Hayashi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/socionext/sni_ave.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/socionext/sni_ave.c b/drivers/net/ethernet/socionext/sni_ave.c +index f7ecceeb1e28..f27d67a4d304 100644 +--- a/drivers/net/ethernet/socionext/sni_ave.c ++++ b/drivers/net/ethernet/socionext/sni_ave.c +@@ -194,6 +194,7 @@ + + /* Parameter for ethernet frame */ + #define AVE_MAX_ETHFRAME 1518 ++#define AVE_FRAME_HEADROOM 2 + + /* Parameter for interrupt */ + #define AVE_INTM_COUNT 20 +@@ -585,12 +586,13 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry) + + skb = priv->rx.desc[entry].skbs; + if (!skb) { +- skb = netdev_alloc_skb_ip_align(ndev, +- AVE_MAX_ETHFRAME); ++ skb = netdev_alloc_skb(ndev, AVE_MAX_ETHFRAME); + if (!skb) { + netdev_err(ndev, "can't allocate skb for Rx\n"); + return -ENOMEM; + } ++ skb->data += AVE_FRAME_HEADROOM; ++ skb->tail += AVE_FRAME_HEADROOM; + } + + /* set disable to cmdsts */ +@@ -603,12 +605,12 @@ static int ave_rxdesc_prepare(struct net_device *ndev, int entry) + * - Rx buffer begins with 2 byte headroom, and data will be put from + * (buffer + 2). + * To satisfy this, specify the address to put back the buffer +- * pointer advanced by NET_IP_ALIGN by netdev_alloc_skb_ip_align(), +- * and expand the map size by NET_IP_ALIGN. ++ * pointer advanced by AVE_FRAME_HEADROOM, and expand the map size ++ * by AVE_FRAME_HEADROOM. + */ + ret = ave_dma_map(ndev, &priv->rx.desc[entry], +- skb->data - NET_IP_ALIGN, +- AVE_MAX_ETHFRAME + NET_IP_ALIGN, ++ skb->data - AVE_FRAME_HEADROOM, ++ AVE_MAX_ETHFRAME + AVE_FRAME_HEADROOM, + DMA_FROM_DEVICE, &paddr); + if (ret) { + netdev_err(ndev, "can't map skb for Rx\n"); +-- +2.19.1 + diff --git a/queue-4.19/net-mlx4_en-fix-build-break-when-config_inet-is-off.patch b/queue-4.19/net-mlx4_en-fix-build-break-when-config_inet-is-off.patch new file mode 100644 index 00000000000..46059175030 --- /dev/null +++ b/queue-4.19/net-mlx4_en-fix-build-break-when-config_inet-is-off.patch @@ -0,0 +1,47 @@ +From fd3667552042ccafab441fb41dcd059f0ee877b7 Mon Sep 17 00:00:00 2001 +From: Saeed Mahameed +Date: Sun, 2 Dec 2018 14:34:37 +0200 +Subject: net/mlx4_en: Fix build break when CONFIG_INET is off +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 1b603f9e4313348608f256b564ed6e3d9e67f377 ] + +MLX4_EN depends on NETDEVICES, ETHERNET and INET Kconfigs. +Make sure they are listed in MLX4_EN Kconfig dependencies. + +This fixes the following build break: + +drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: ‘struct iphdr’ declared inside parameter list [enabled by default] +struct iphdr *iph) +^ +drivers/net/ethernet/mellanox/mlx4/en_rx.c:582:18: warning: its scope is only this definition or declaration, which is probably not what you want [enabled by default] +drivers/net/ethernet/mellanox/mlx4/en_rx.c: In function ‘get_fixed_ipv4_csum’: +drivers/net/ethernet/mellanox/mlx4/en_rx.c:586:20: error: dereferencing pointer to incomplete type +_u8 ipproto = iph->protocol; + +Signed-off-by: Saeed Mahameed +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/Kconfig b/drivers/net/ethernet/mellanox/mlx4/Kconfig +index 36054e6fb9d3..f200b8c420d5 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/Kconfig ++++ b/drivers/net/ethernet/mellanox/mlx4/Kconfig +@@ -5,7 +5,7 @@ + config MLX4_EN + tristate "Mellanox Technologies 1/10/40Gbit Ethernet support" + depends on MAY_USE_DEVLINK +- depends on PCI ++ depends on PCI && NETDEVICES && ETHERNET && INET + select MLX4_CORE + imply PTP_1588_CLOCK + ---help--- +-- +2.19.1 + diff --git a/queue-4.19/net-mvpp2-fix-detection-of-10g-sfp-modules.patch b/queue-4.19/net-mvpp2-fix-detection-of-10g-sfp-modules.patch new file mode 100644 index 00000000000..febffd182f3 --- /dev/null +++ b/queue-4.19/net-mvpp2-fix-detection-of-10g-sfp-modules.patch @@ -0,0 +1,42 @@ +From 2fd9df4a9154655aed4920fcad5d9aec1b098ddb Mon Sep 17 00:00:00 2001 +From: Baruch Siach +Date: Tue, 4 Dec 2018 16:03:52 +0200 +Subject: net: mvpp2: fix detection of 10G SFP modules + +[ Upstream commit 01b3fd5ac97caffb8e5d5bd85086da33db3b361f ] + +The mvpp2_phylink_validate() relies on the interface field of +phylink_link_state to determine valid link modes. However, when called +from phylink_sfp_module_insert() this field in not initialized. The +default switch case then excludes 10G link modes. This allows 10G SFP +modules that are detected correctly to be configured at max rate of +2.5G. + +Catch the uninitialized PHY mode case, and allow 10G rates. + +Fixes: d97c9f4ab000b ("net: mvpp2: 1000baseX support") +Cc: Maxime Chevallier +Cc: Antoine Tenart +Acked-by: Russell King +Signed-off-by: Baruch Siach +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index a74002b43b51..1b3b64fea038 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4271,6 +4271,7 @@ static void mvpp2_phylink_validate(struct net_device *dev, + + switch (state->interface) { + case PHY_INTERFACE_MODE_10GKR: ++ case PHY_INTERFACE_MODE_NA: + phylink_set(mask, 10000baseCR_Full); + phylink_set(mask, 10000baseSR_Full); + phylink_set(mask, 10000baseLR_Full); +-- +2.19.1 + diff --git a/queue-4.19/net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch b/queue-4.19/net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch new file mode 100644 index 00000000000..a7386c1dc85 --- /dev/null +++ b/queue-4.19/net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch @@ -0,0 +1,95 @@ +From e98826b1e23e33c55e3b9103ccffe4baa2c37b82 Mon Sep 17 00:00:00 2001 +From: Baruch Siach +Date: Tue, 4 Dec 2018 16:03:53 +0200 +Subject: net: mvpp2: fix phylink handling of invalid PHY modes + +[ Upstream commit 0fb628f0f250c74b1023edd0ca4a57c8b35b9b2c ] + +The .validate phylink callback should empty the supported bitmap when +the interface mode is invalid. + +Cc: Maxime Chevallier +Cc: Antoine Tenart +Reported-by: Russell King +Signed-off-by: Baruch Siach +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 33 ++++++++++++++++++- + 1 file changed, 32 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 1b3b64fea038..6320e080b831 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4262,8 +4262,27 @@ static void mvpp2_phylink_validate(struct net_device *dev, + unsigned long *supported, + struct phylink_link_state *state) + { ++ struct mvpp2_port *port = netdev_priv(dev); + __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; + ++ /* Invalid combinations */ ++ switch (state->interface) { ++ case PHY_INTERFACE_MODE_10GKR: ++ case PHY_INTERFACE_MODE_XAUI: ++ if (port->gop_id != 0) ++ goto empty_set; ++ break; ++ case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: ++ if (port->gop_id == 0) ++ goto empty_set; ++ break; ++ default: ++ break; ++ } ++ + phylink_set(mask, Autoneg); + phylink_set_port_modes(mask); + phylink_set(mask, Pause); +@@ -4271,6 +4290,7 @@ static void mvpp2_phylink_validate(struct net_device *dev, + + switch (state->interface) { + case PHY_INTERFACE_MODE_10GKR: ++ case PHY_INTERFACE_MODE_XAUI: + case PHY_INTERFACE_MODE_NA: + phylink_set(mask, 10000baseCR_Full); + phylink_set(mask, 10000baseSR_Full); +@@ -4279,7 +4299,11 @@ static void mvpp2_phylink_validate(struct net_device *dev, + phylink_set(mask, 10000baseER_Full); + phylink_set(mask, 10000baseKR_Full); + /* Fall-through */ +- default: ++ case PHY_INTERFACE_MODE_RGMII: ++ case PHY_INTERFACE_MODE_RGMII_ID: ++ case PHY_INTERFACE_MODE_RGMII_RXID: ++ case PHY_INTERFACE_MODE_RGMII_TXID: ++ case PHY_INTERFACE_MODE_SGMII: + phylink_set(mask, 10baseT_Half); + phylink_set(mask, 10baseT_Full); + phylink_set(mask, 100baseT_Half); +@@ -4291,11 +4315,18 @@ static void mvpp2_phylink_validate(struct net_device *dev, + phylink_set(mask, 1000baseT_Full); + phylink_set(mask, 1000baseX_Full); + phylink_set(mask, 2500baseX_Full); ++ break; ++ default: ++ goto empty_set; + } + + bitmap_and(supported, supported, mask, __ETHTOOL_LINK_MODE_MASK_NBITS); + bitmap_and(state->advertising, state->advertising, mask, + __ETHTOOL_LINK_MODE_MASK_NBITS); ++ return; ++ ++empty_set: ++ bitmap_zero(supported, __ETHTOOL_LINK_MODE_MASK_NBITS); + } + + static void mvpp22_xlg_link_state(struct mvpp2_port *port, +-- +2.19.1 + diff --git a/queue-4.19/net-stmmac-move-debugfs-init-exit-to-probe-remove.patch b/queue-4.19/net-stmmac-move-debugfs-init-exit-to-probe-remove.patch new file mode 100644 index 00000000000..e78a4e85838 --- /dev/null +++ b/queue-4.19/net-stmmac-move-debugfs-init-exit-to-probe-remove.patch @@ -0,0 +1,97 @@ +From 781db879903afa873f6e010a59692659f1cbfa58 Mon Sep 17 00:00:00 2001 +From: Thierry Reding +Date: Tue, 27 Nov 2018 14:21:43 +0100 +Subject: net: stmmac: Move debugfs init/exit to ->probe()/->remove() + +[ Upstream commit 5f2b8b62786853341a20d4cd4948f9cbca3db002 ] + +Setting up and tearing down debugfs is current unbalanced, as seen by +this error during resume from suspend: + + [ 752.134067] dwc-eth-dwmac 2490000.ethernet eth0: ERROR failed to create debugfs directory + [ 752.134347] dwc-eth-dwmac 2490000.ethernet eth0: stmmac_hw_setup: failed debugFS registration + +The imbalance happens because the driver creates the debugfs hierarchy +when the device is opened and tears it down when the device is closed. +There's little gain in that, and it could be argued that it is even +surprising because it's not usually done for other devices. Fix the +imbalance by moving the debugfs creation and teardown to the driver's +->probe() and ->remove() implementations instead. + +Note that the ring descriptors cannot be read while the interface is +down, so make sure to return an empty file when the descriptors_status +debugfs file is read. + +Signed-off-by: Thierry Reding +Acked-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 23 +++++++++++-------- + 1 file changed, 13 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 75896d6ba6e2..99ea5c4ce29c 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -2547,12 +2547,6 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp) + netdev_warn(priv->dev, "PTP init failed\n"); + } + +-#ifdef CONFIG_DEBUG_FS +- ret = stmmac_init_fs(dev); +- if (ret < 0) +- netdev_warn(priv->dev, "%s: failed debugFS registration\n", +- __func__); +-#endif + priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS; + + if (priv->use_riwt) { +@@ -2753,10 +2747,6 @@ static int stmmac_release(struct net_device *dev) + + netif_carrier_off(dev); + +-#ifdef CONFIG_DEBUG_FS +- stmmac_exit_fs(dev); +-#endif +- + stmmac_release_ptp(priv); + + return 0; +@@ -3896,6 +3886,9 @@ static int stmmac_sysfs_ring_read(struct seq_file *seq, void *v) + u32 tx_count = priv->plat->tx_queues_to_use; + u32 queue; + ++ if ((dev->flags & IFF_UP) == 0) ++ return 0; ++ + for (queue = 0; queue < rx_count; queue++) { + struct stmmac_rx_queue *rx_q = &priv->rx_queue[queue]; + +@@ -4394,6 +4387,13 @@ int stmmac_dvr_probe(struct device *device, + goto error_netdev_register; + } + ++#ifdef CONFIG_DEBUG_FS ++ ret = stmmac_init_fs(ndev); ++ if (ret < 0) ++ netdev_warn(priv->dev, "%s: failed debugFS registration\n", ++ __func__); ++#endif ++ + return ret; + + error_netdev_register: +@@ -4429,6 +4429,9 @@ int stmmac_dvr_remove(struct device *dev) + + netdev_info(priv->dev, "%s: removing driver", __func__); + ++#ifdef CONFIG_DEBUG_FS ++ stmmac_exit_fs(ndev); ++#endif + stmmac_stop_all_dma(priv); + + stmmac_mac_set(priv, priv->ioaddr, false); +-- +2.19.1 + diff --git a/queue-4.19/nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch b/queue-4.19/nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch new file mode 100644 index 00000000000..09846a8dda2 --- /dev/null +++ b/queue-4.19/nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch @@ -0,0 +1,109 @@ +From e36ee4e04f03cb81949f083ab7e25c6f3e7bf212 Mon Sep 17 00:00:00 2001 +From: Dave Kleikamp +Date: Tue, 27 Nov 2018 19:31:30 +0000 +Subject: nfs: don't dirty kernel pages read by direct-io + +[ Upstream commit ad3cba223ac02dc769c3bbe88efe277bbb457566 ] + +When we use direct_IO with an NFS backing store, we can trigger a +WARNING in __set_page_dirty(), as below, since we're dirtying the page +unnecessarily in nfs_direct_read_completion(). + +To fix, replicate the logic in commit 53cbf3b157a0 ("fs: direct-io: +don't dirtying pages for ITER_BVEC/ITER_KVEC direct read"). + +Other filesystems that implement direct_IO handle this; most use +blockdev_direct_IO(). ceph and cifs have similar logic. + +mount 127.0.0.1:/export /nfs +dd if=/dev/zero of=/nfs/image bs=1M count=200 +losetup --direct-io=on -f /nfs/image +mkfs.btrfs /dev/loop0 +mount -t btrfs /dev/loop0 /mnt/ + +kernel: WARNING: CPU: 0 PID: 8067 at fs/buffer.c:580 __set_page_dirty+0xaf/0xd0 +kernel: Modules linked in: loop(E) nfsv3(E) rpcsec_gss_krb5(E) nfsv4(E) dns_resolver(E) nfs(E) fscache(E) nfsd(E) auth_rpcgss(E) nfs_acl(E) lockd(E) grace(E) fuse(E) tun(E) ip6t_rpfilter(E) ipt_REJECT(E) nf_ +kernel: snd_seq(E) snd_seq_device(E) snd_pcm(E) video(E) snd_timer(E) snd(E) soundcore(E) ip_tables(E) xfs(E) libcrc32c(E) sd_mod(E) sr_mod(E) cdrom(E) ata_generic(E) pata_acpi(E) crc32c_intel(E) ahci(E) li +kernel: CPU: 0 PID: 8067 Comm: kworker/0:2 Tainted: G E 4.20.0-rc1.master.20181111.ol7.x86_64 #1 +kernel: Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 +kernel: Workqueue: nfsiod rpc_async_release [sunrpc] +kernel: RIP: 0010:__set_page_dirty+0xaf/0xd0 +kernel: Code: c3 48 8b 02 f6 c4 04 74 d4 48 89 df e8 ba 05 f7 ff 48 89 c6 eb cb 48 8b 43 08 a8 01 75 1f 48 89 d8 48 8b 00 a8 04 74 02 eb 87 <0f> 0b eb 83 48 83 e8 01 eb 9f 48 83 ea 01 0f 1f 00 eb 8b 48 83 e8 +kernel: RSP: 0000:ffffc1c8825b7d78 EFLAGS: 00013046 +kernel: RAX: 000fffffc0020089 RBX: fffff2b603308b80 RCX: 0000000000000001 +kernel: RDX: 0000000000000001 RSI: ffff9d11478115c8 RDI: ffff9d11478115d0 +kernel: RBP: ffffc1c8825b7da0 R08: 0000646f6973666e R09: 8080808080808080 +kernel: R10: 0000000000000001 R11: 0000000000000000 R12: ffff9d11478115d0 +kernel: R13: ffff9d11478115c8 R14: 0000000000003246 R15: 0000000000000001 +kernel: FS: 0000000000000000(0000) GS:ffff9d115ba00000(0000) knlGS:0000000000000000 +kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +kernel: CR2: 00007f408686f640 CR3: 0000000104d8e004 CR4: 00000000000606f0 +kernel: DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +kernel: DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +kernel: Call Trace: +kernel: __set_page_dirty_buffers+0xb6/0x110 +kernel: set_page_dirty+0x52/0xb0 +kernel: nfs_direct_read_completion+0xc4/0x120 [nfs] +kernel: nfs_pgio_release+0x10/0x20 [nfs] +kernel: rpc_free_task+0x30/0x70 [sunrpc] +kernel: rpc_async_release+0x12/0x20 [sunrpc] +kernel: process_one_work+0x174/0x390 +kernel: worker_thread+0x4f/0x3e0 +kernel: kthread+0x102/0x140 +kernel: ? drain_workqueue+0x130/0x130 +kernel: ? kthread_stop+0x110/0x110 +kernel: ret_from_fork+0x35/0x40 +kernel: ---[ end trace 01341980905412c9 ]--- + +Signed-off-by: Dave Kleikamp +Signed-off-by: Santosh Shilimkar + +[forward-ported to v4.20] +Signed-off-by: Calum Mackay +Reviewed-by: Dave Kleikamp +Reviewed-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index aa12c3063bae..33824a0a57bf 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -98,8 +98,11 @@ struct nfs_direct_req { + struct pnfs_ds_commit_info ds_cinfo; /* Storage for cinfo */ + struct work_struct work; + int flags; ++ /* for write */ + #define NFS_ODIRECT_DO_COMMIT (1) /* an unstable reply was received */ + #define NFS_ODIRECT_RESCHED_WRITES (2) /* write verification failed */ ++ /* for read */ ++#define NFS_ODIRECT_SHOULD_DIRTY (3) /* dirty user-space page after read */ + struct nfs_writeverf verf; /* unstable write verifier */ + }; + +@@ -412,7 +415,8 @@ static void nfs_direct_read_completion(struct nfs_pgio_header *hdr) + struct nfs_page *req = nfs_list_entry(hdr->pages.next); + struct page *page = req->wb_page; + +- if (!PageCompound(page) && bytes < hdr->good_bytes) ++ if (!PageCompound(page) && bytes < hdr->good_bytes && ++ (dreq->flags == NFS_ODIRECT_SHOULD_DIRTY)) + set_page_dirty(page); + bytes += req->wb_bytes; + nfs_list_remove_request(req); +@@ -587,6 +591,9 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (!is_sync_kiocb(iocb)) + dreq->iocb = iocb; + ++ if (iter_is_iovec(iter)) ++ dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; ++ + nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; +-- +2.19.1 + diff --git a/queue-4.19/nvme-validate-controller-state-before-rescheduling-k.patch b/queue-4.19/nvme-validate-controller-state-before-rescheduling-k.patch new file mode 100644 index 00000000000..5bd84918097 --- /dev/null +++ b/queue-4.19/nvme-validate-controller-state-before-rescheduling-k.patch @@ -0,0 +1,66 @@ +From 3a49ef6e71c48348d2f93c39b9757e2a0bae4874 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Tue, 27 Nov 2018 17:04:44 -0800 +Subject: nvme: validate controller state before rescheduling keep alive + +[ Upstream commit 86880d646122240596d6719b642fee3213239994 ] + +Delete operations are seeing NULL pointer references in call_timer_fn. +Tracking these back, the timer appears to be the keep alive timer. + +nvme_keep_alive_work() which is tied to the timer that is cancelled +by nvme_stop_keep_alive(), simply starts the keep alive io but doesn't +wait for it's completion. So nvme_stop_keep_alive() only stops a timer +when it's pending. When a keep alive is in flight, there is no timer +running and the nvme_stop_keep_alive() will have no affect on the keep +alive io. Thus, if the io completes successfully, the keep alive timer +will be rescheduled. In the failure case, delete is called, the +controller state is changed, the nvme_stop_keep_alive() is called while +the io is outstanding, and the delete path continues on. The keep +alive happens to successfully complete before the delete paths mark it +as aborted as part of the queue termination, so the timer is restarted. +The delete paths then tear down the controller, and later on the timer +code fires and the timer entry is now corrupt. + +Fix by validating the controller state before rescheduling the keep +alive. Testing with the fix has confirmed the condition above was hit. + +Signed-off-by: James Smart +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b7b2659e02fa..e5bddae16ed4 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -831,6 +831,8 @@ static int nvme_submit_user_cmd(struct request_queue *q, + static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status) + { + struct nvme_ctrl *ctrl = rq->end_io_data; ++ unsigned long flags; ++ bool startka = false; + + blk_mq_free_request(rq); + +@@ -841,7 +843,13 @@ static void nvme_keep_alive_end_io(struct request *rq, blk_status_t status) + return; + } + +- schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ); ++ spin_lock_irqsave(&ctrl->lock, flags); ++ if (ctrl->state == NVME_CTRL_LIVE || ++ ctrl->state == NVME_CTRL_CONNECTING) ++ startka = true; ++ spin_unlock_irqrestore(&ctrl->lock, flags); ++ if (startka) ++ schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ); + } + + static int nvme_keep_alive(struct nvme_ctrl *ctrl) +-- +2.19.1 + diff --git a/queue-4.19/nvmet-rdma-fix-response-use-after-free.patch b/queue-4.19/nvmet-rdma-fix-response-use-after-free.patch new file mode 100644 index 00000000000..f91d1ed0897 --- /dev/null +++ b/queue-4.19/nvmet-rdma-fix-response-use-after-free.patch @@ -0,0 +1,44 @@ +From e4ae5277504e1aab8b418f91b257d917aea3e574 Mon Sep 17 00:00:00 2001 +From: Israel Rukshin +Date: Wed, 5 Dec 2018 16:54:57 +0000 +Subject: nvmet-rdma: fix response use after free + +[ Upstream commit d7dcdf9d4e15189ecfda24cc87339a3425448d5c ] + +nvmet_rdma_release_rsp() may free the response before using it at error +flow. + +Fixes: 8407879 ("nvmet-rdma: fix possible bogus dereference under heavy load") +Signed-off-by: Israel Rukshin +Reviewed-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/rdma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/rdma.c b/drivers/nvme/target/rdma.c +index bfc4da660bb4..e57f3902beb3 100644 +--- a/drivers/nvme/target/rdma.c ++++ b/drivers/nvme/target/rdma.c +@@ -529,6 +529,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc) + { + struct nvmet_rdma_rsp *rsp = + container_of(wc->wr_cqe, struct nvmet_rdma_rsp, send_cqe); ++ struct nvmet_rdma_queue *queue = cq->cq_context; + + nvmet_rdma_release_rsp(rsp); + +@@ -536,7 +537,7 @@ static void nvmet_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc) + wc->status != IB_WC_WR_FLUSH_ERR)) { + pr_err("SEND for CQE 0x%p failed with status %s (%d).\n", + wc->wr_cqe, ib_wc_status_msg(wc->status), wc->status); +- nvmet_rdma_error_comp(rsp->queue); ++ nvmet_rdma_error_comp(queue); + } + } + +-- +2.19.1 + diff --git a/queue-4.19/sbus-char-add-of_node_put.patch b/queue-4.19/sbus-char-add-of_node_put.patch new file mode 100644 index 00000000000..05c61dc868e --- /dev/null +++ b/queue-4.19/sbus-char-add-of_node_put.patch @@ -0,0 +1,31 @@ +From b4d36e78a8d954fb181b3dc44b34a50518f16232 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Tue, 20 Nov 2018 08:30:40 -0500 +Subject: sbus: char: add of_node_put() + +[ Upstream commit 87d81a23e24f24ebe014891e8bdf3ff8785031e8 ] + +use of_node_put() to release the refcount. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/sbus/char/display7seg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c +index 5c8ed7350a04..a36e4cf1841d 100644 +--- a/drivers/sbus/char/display7seg.c ++++ b/drivers/sbus/char/display7seg.c +@@ -220,6 +220,7 @@ static int d7s_probe(struct platform_device *op) + dev_set_drvdata(&op->dev, p); + d7s_device = p; + err = 0; ++ of_node_put(opts); + + out: + return err; +-- +2.19.1 + diff --git a/queue-4.19/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch b/queue-4.19/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch new file mode 100644 index 00000000000..d3ab245df6a --- /dev/null +++ b/queue-4.19/scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch @@ -0,0 +1,39 @@ +From 9c09d21bb154075b53c4792d1f97fef256e8b02c Mon Sep 17 00:00:00 2001 +From: Fred Herard +Date: Tue, 20 Nov 2018 20:22:45 -0500 +Subject: scsi: libiscsi: Fix NULL pointer dereference in + iscsi_eh_session_reset + +[ Upstream commit 5db6dd14b31397e8cccaaddab2ff44ebec1acf25 ] + +This commit addresses NULL pointer dereference in iscsi_eh_session_reset. +Reference should not be made to session->leadconn when session->state is +set to ISCSI_STATE_TERMINATE. + +Signed-off-by: Fred Herard +Reviewed-by: Konrad Rzeszutek Wilk +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 93c66ebad907..f78d2e5c1471 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -2416,8 +2416,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc) + failed: + ISCSI_DBG_EH(session, + "failing session reset: Could not log back into " +- "%s, %s [age %d]\n", session->targetname, +- conn->persistent_address, session->age); ++ "%s [age %d]\n", session->targetname, ++ session->age); + spin_unlock_bh(&session->frwd_lock); + mutex_unlock(&session->eh_mutex); + return FAILED; +-- +2.19.1 + diff --git a/queue-4.19/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch b/queue-4.19/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch new file mode 100644 index 00000000000..b7b7ae0800e --- /dev/null +++ b/queue-4.19/scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch @@ -0,0 +1,55 @@ +From 10a1d96a1c16a68e43bee5636cadc0ebaf4ab9c8 Mon Sep 17 00:00:00 2001 +From: Cathy Avery +Date: Tue, 27 Nov 2018 14:28:53 -0500 +Subject: scsi: vmw_pscsi: Rearrange code to avoid multiple calls to free_irq + during unload + +[ Upstream commit 02f425f811cefcc4d325d7a72272651e622dc97e ] + +Currently pvscsi_remove calls free_irq more than once as +pvscsi_release_resources and __pvscsi_shutdown both call +pvscsi_shutdown_intr. This results in a 'Trying to free already-free IRQ' +warning and stack trace. To solve the problem pvscsi_shutdown_intr has been +moved out of pvscsi_release_resources. + +Signed-off-by: Cathy Avery +Reviewed-by: Ewan D. Milne +Reviewed-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 0cd947f78b5b..890b8aaf95e1 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -1202,8 +1202,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter *adapter) + + static void pvscsi_release_resources(struct pvscsi_adapter *adapter) + { +- pvscsi_shutdown_intr(adapter); +- + if (adapter->workqueue) + destroy_workqueue(adapter->workqueue); + +@@ -1535,6 +1533,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const struct pci_device_id *id) + out_reset_adapter: + ll_adapter_reset(adapter); + out_release_resources: ++ pvscsi_shutdown_intr(adapter); + pvscsi_release_resources(adapter); + scsi_host_put(host); + out_disable_device: +@@ -1543,6 +1542,7 @@ out_disable_device: + return error; + + out_release_resources_and_disable: ++ pvscsi_shutdown_intr(adapter); + pvscsi_release_resources(adapter); + goto out_disable_device; + } +-- +2.19.1 + diff --git a/queue-4.19/series b/queue-4.19/series index 210802f2385..fc9b4678de1 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,3 +1,67 @@ locking-qspinlock-re-order-code.patch locking-qspinlock-x86-provide-liveness-guarantee.patch ib-hfi1-remove-race-conditions-in-user_sdma-send-pat.patch +mac80211_hwsim-fix-module-init-error-paths-for-netli.patch +input-hyper-v-fix-wakeup-from-suspend-to-idle.patch +i2c-rcar-check-bus-state-before-reinitializing.patch +scsi-libiscsi-fix-null-pointer-dereference-in-iscsi_.patch +scsi-vmw_pscsi-rearrange-code-to-avoid-multiple-call.patch +tools-bpf-fix-two-test_btf-unit-test-cases.patch +tools-bpf-add-addition-type-tests-to-test_btf.patch +net-ethernet-ave-replace-net_ip_align-with-ave_frame.patch +drm-amd-display-fix-6x4k-displays-light-up-on-vega20.patch +x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch +drm-msm-fix-task-dump-in-gpu-recovery.patch +drm-msm-gpu-fix-a-couple-memory-leaks-in-debugfs.patch +drm-msm-fix-handling-of-cmdstream-offset.patch +drm-msm-dsi-configure-vco-rate-for-10nm-pll-driver.patch +drm-msm-grab-a-vblank-reference-when-waiting-for-com.patch +drm-ttm-fix-lru-handling-in-ttm_buffer_object_transf.patch +drm-amdgpu-wait-for-ib-test-on-first-device-open.patch +arc-io.h-implement-reads-x-writes-x.patch +net-stmmac-move-debugfs-init-exit-to-probe-remove.patch +net-aquantia-fix-rx-checksum-offload-bits.patch +bonding-fix-802.3ad-state-sent-to-partner-when-unbin.patch +bpf-fix-verifier-log-string-check-for-bad-alignment.patch +liquidio-read-sc-iq_no-before-release-sc.patch +nfs-don-t-dirty-kernel-pages-read-by-direct-io.patch +sunrpc-fix-a-potential-race-in-xprt_connect.patch +sbus-char-add-of_node_put.patch +drivers-sbus-char-add-of_node_put.patch +drivers-tty-add-missing-of_node_put.patch +ide-pmac-add-of_node_put.patch +drm-msm-hdmi-enable-hpd-after-hdmi-irq-is-set-up.patch +drm-msm-dpu-don-t-set-legacy-plane-crtc-pointer.patch +drm-msm-dpu-fix-warning-invalid-free-of-devm_-alloca.patch +drm-msm-fix-error-return-checking.patch +drm-amd-powerplay-issue-pre-display-settings-for-dis.patch +clk-mvebu-off-by-one-bugs-in-cp110_of_clk_get.patch +clk-mmp-off-by-one-in-mmp_clk_add.patch +input-synaptics-enable-smbus-for-hp-15-ay000.patch +input-omap-keypad-fix-keyboard-debounce-configuratio.patch +libata-whitelist-all-samsung-mz7km-solid-state-disks.patch +macvlan-return-correct-error-value.patch +mv88e6060-disable-hardware-level-mac-learning.patch +net-mlx4_en-fix-build-break-when-config_inet-is-off.patch +bpf-check-pending-signals-while-verifying-programs.patch +arm-8814-1-mm-improve-fix-arm-v7_dma_inv_range-unali.patch +arm-8815-1-v7m-align-v7m_dma_inv_range-with-v7-count.patch +arm-8816-1-dma-mapping-fix-potential-uninitialized-r.patch +ethernet-fman-fix-wrong-of_node_put-in-probe-functio.patch +thermal-armada-fix-legacy-validity-test-sense.patch +net-mvpp2-fix-detection-of-10g-sfp-modules.patch +net-mvpp2-fix-phylink-handling-of-invalid-phy-modes.patch +x86-build-fix-compiler-support-check-for-config_retp.patch +drm-amdgpu-vcn-update-vcn.cur_state-during-suspend.patch +tools-testing-nvdimm-align-test-resources-to-128m.patch +acpi-nfit-fix-user-initiated-ars-to-be-ars-long-rath.patch +drm-ast-fix-connector-leak-during-driver-unload.patch +cifs-in-kconfig-config_cifs_posix-needs-depends-on-l.patch +vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch +mlxsw-spectrum_switchdev-fix-vlan-device-deletion-vi.patch +i2c-axxia-properly-handle-master-timeout.patch +i2c-scmi-fix-probe-error-on-devices-with-an-empty-sm.patch +i2c-uniphier-fix-violation-of-tlow-requirement-for-f.patch +i2c-uniphier-f-fix-violation-of-tlow-requirement-for.patch +nvme-validate-controller-state-before-rescheduling-k.patch +nvmet-rdma-fix-response-use-after-free.patch diff --git a/queue-4.19/sunrpc-fix-a-potential-race-in-xprt_connect.patch b/queue-4.19/sunrpc-fix-a-potential-race-in-xprt_connect.patch new file mode 100644 index 00000000000..bb35ebf3ac5 --- /dev/null +++ b/queue-4.19/sunrpc-fix-a-potential-race-in-xprt_connect.patch @@ -0,0 +1,46 @@ +From ce09b4d73ba8d1f06d9670f1b542ce6499d6402e Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 1 Dec 2018 23:18:00 -0500 +Subject: SUNRPC: Fix a potential race in xprt_connect() + +[ Upstream commit 0a9a4304f3614e25d9de9b63502ca633c01c0d70 ] + +If an asynchronous connection attempt completes while another task is +in xprt_connect(), then the call to rpc_sleep_on() could end up +racing with the call to xprt_wake_pending_tasks(). +So add a second test of the connection state after we've put the +task to sleep and set the XPRT_CONNECTING flag, when we know that there +can be no asynchronous connection attempts still in progress. + +Fixes: 0b9e79431377d ("SUNRPC: Move the test for XPRT_CONNECTING into...") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprt.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index a8db2e3f8904..d066aae3cb6d 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -781,8 +781,15 @@ void xprt_connect(struct rpc_task *task) + return; + if (xprt_test_and_set_connecting(xprt)) + return; +- xprt->stat.connect_start = jiffies; +- xprt->ops->connect(xprt, task); ++ /* Race breaker */ ++ if (!xprt_connected(xprt)) { ++ xprt->stat.connect_start = jiffies; ++ xprt->ops->connect(xprt, task); ++ } else { ++ xprt_clear_connecting(xprt); ++ task->tk_status = 0; ++ rpc_wake_up_queued_task(&xprt->pending, task); ++ } + } + xprt_release_write(xprt, task); + } +-- +2.19.1 + diff --git a/queue-4.19/thermal-armada-fix-legacy-validity-test-sense.patch b/queue-4.19/thermal-armada-fix-legacy-validity-test-sense.patch new file mode 100644 index 00000000000..77deaa11c07 --- /dev/null +++ b/queue-4.19/thermal-armada-fix-legacy-validity-test-sense.patch @@ -0,0 +1,47 @@ +From 2cdfb852666b0bd362261a19de15556c69aa8fee Mon Sep 17 00:00:00 2001 +From: Russell King +Date: Fri, 9 Nov 2018 16:44:14 +0000 +Subject: thermal: armada: fix legacy validity test sense + +[ Upstream commit 70bb27b79adf63ea39e37371d09c823c7a8f93ce ] + +Commit 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid() +pointer") removed the unnecessary indirection through a function +pointer, but in doing so, also removed the negation operator too: + +- if (priv->data->is_valid && !priv->data->is_valid(priv)) { ++ if (armada_is_valid(priv)) { + +which results in: + +armada_thermal f06f808c.thermal: Temperature sensor reading not valid +armada_thermal f2400078.thermal: Temperature sensor reading not valid +armada_thermal f4400078.thermal: Temperature sensor reading not valid + +at boot, or whenever the "temp" sysfs file is read. Replace the +negation operator. + +Fixes: 8c0e64ac4075 ("thermal: armada: get rid of the ->is_valid() pointer") +Signed-off-by: Russell King +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/armada_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/armada_thermal.c b/drivers/thermal/armada_thermal.c +index 2c2f6d93034e..e16b3cb1808c 100644 +--- a/drivers/thermal/armada_thermal.c ++++ b/drivers/thermal/armada_thermal.c +@@ -357,7 +357,7 @@ static int armada_get_temp_legacy(struct thermal_zone_device *thermal, + int ret; + + /* Valid check */ +- if (armada_is_valid(priv)) { ++ if (!armada_is_valid(priv)) { + dev_err(priv->dev, + "Temperature sensor reading not valid\n"); + return -EIO; +-- +2.19.1 + diff --git a/queue-4.19/tools-bpf-add-addition-type-tests-to-test_btf.patch b/queue-4.19/tools-bpf-add-addition-type-tests-to-test_btf.patch new file mode 100644 index 00000000000..e911b87e1a5 --- /dev/null +++ b/queue-4.19/tools-bpf-add-addition-type-tests-to-test_btf.patch @@ -0,0 +1,412 @@ +From eb1f5e159fa7975e59f57750453b3335603b1a33 Mon Sep 17 00:00:00 2001 +From: Yonghong Song +Date: Tue, 27 Nov 2018 13:23:30 -0800 +Subject: tools/bpf: add addition type tests to test_btf + +[ Upstream commit d08489125e04a9f73d9323caea43270fd22d395f ] + +The following additional unit testcases are added to test_btf: +... +BTF raw test[42] (typedef (invalid name, name_off = 0)): OK +BTF raw test[43] (typedef (invalid name, invalid identifier)): OK +BTF raw test[44] (ptr type (invalid name, name_off <> 0)): OK +BTF raw test[45] (volatile type (invalid name, name_off <> 0)): OK +BTF raw test[46] (const type (invalid name, name_off <> 0)): OK +BTF raw test[47] (restrict type (invalid name, name_off <> 0)): OK +BTF raw test[48] (fwd type (invalid name, name_off = 0)): OK +BTF raw test[49] (fwd type (invalid name, invalid identifier)): OK +BTF raw test[50] (array type (invalid name, name_off <> 0)): OK +BTF raw test[51] (struct type (name_off = 0)): OK +BTF raw test[52] (struct type (invalid name, invalid identifier)): OK +BTF raw test[53] (struct member (name_off = 0)): OK +BTF raw test[54] (struct member (invalid name, invalid identifier)): OK +BTF raw test[55] (enum type (name_off = 0)): OK +BTF raw test[56] (enum type (invalid name, invalid identifier)): OK +BTF raw test[57] (enum member (invalid name, name_off = 0)): OK +BTF raw test[58] (enum member (invalid name, invalid identifier)): OK +... + +Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests") +Acked-by: Martin KaFai Lau +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_btf.c | 361 +++++++++++++++++++++++++ + 1 file changed, 361 insertions(+) + +diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c +index 4909aab4d6ab..29116366a9fc 100644 +--- a/tools/testing/selftests/bpf/test_btf.c ++++ b/tools/testing/selftests/bpf/test_btf.c +@@ -1291,6 +1291,367 @@ static struct btf_raw_test raw_tests[] = { + .err_str = "type != 0", + }, + ++{ ++ .descr = "typedef (invalid name, name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPEDEF_ENC(0, 1), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__int", ++ .str_sec_size = sizeof("\0__int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "typedef_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "typedef (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPEDEF_ENC(NAME_TBD, 1), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__!int", ++ .str_sec_size = sizeof("\0__!int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "typedef_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "ptr type (invalid name, name_off <> 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__int", ++ .str_sec_size = sizeof("\0__int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "ptr_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "volatile type (invalid name, name_off <> 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_VOLATILE, 0, 0), 1), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__int", ++ .str_sec_size = sizeof("\0__int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "volatile_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "const type (invalid name, name_off <> 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 1), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__int", ++ .str_sec_size = sizeof("\0__int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "const_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "restrict type (invalid name, name_off <> 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 1), /* [2] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_RESTRICT, 0, 0), 2), /* [3] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__int", ++ .str_sec_size = sizeof("\0__int"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "restrict_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "fwd type (invalid name, name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__skb", ++ .str_sec_size = sizeof("\0__skb"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "fwd_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "fwd type (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_FWD, 0, 0), 0), /* [2] */ ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__!skb", ++ .str_sec_size = sizeof("\0__!skb"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "fwd_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "array type (invalid name, name_off <> 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_ARRAY, 0, 0), 0), /* [2] */ ++ BTF_ARRAY_ENC(1, 1, 4), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0__skb", ++ .str_sec_size = sizeof("\0__skb"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "array_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "struct type (name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, ++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */ ++ BTF_MEMBER_ENC(NAME_TBD, 1, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A", ++ .str_sec_size = sizeof("\0A"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "struct_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++}, ++ ++{ ++ .descr = "struct type (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */ ++ BTF_MEMBER_ENC(NAME_TBD, 1, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A!\0B", ++ .str_sec_size = sizeof("\0A!\0B"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "struct_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "struct member (name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, ++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */ ++ BTF_MEMBER_ENC(NAME_TBD, 1, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A", ++ .str_sec_size = sizeof("\0A"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "struct_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++}, ++ ++{ ++ .descr = "struct member (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), 4), /* [2] */ ++ BTF_MEMBER_ENC(NAME_TBD, 1, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A\0B*", ++ .str_sec_size = sizeof("\0A\0B*"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "struct_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "enum type (name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, ++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), ++ sizeof(int)), /* [2] */ ++ BTF_ENUM_ENC(NAME_TBD, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A\0B", ++ .str_sec_size = sizeof("\0A\0B"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "enum_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++}, ++ ++{ ++ .descr = "enum type (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(NAME_TBD, ++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), ++ sizeof(int)), /* [2] */ ++ BTF_ENUM_ENC(NAME_TBD, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A!\0B", ++ .str_sec_size = sizeof("\0A!\0B"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "enum_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "enum member (invalid name, name_off = 0)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, ++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), ++ sizeof(int)), /* [2] */ ++ BTF_ENUM_ENC(0, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "", ++ .str_sec_size = sizeof(""), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "enum_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, ++ ++{ ++ .descr = "enum member (invalid name, invalid identifier)", ++ .raw_types = { ++ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */ ++ BTF_TYPE_ENC(0, ++ BTF_INFO_ENC(BTF_KIND_ENUM, 0, 1), ++ sizeof(int)), /* [2] */ ++ BTF_ENUM_ENC(NAME_TBD, 0), ++ BTF_END_RAW, ++ }, ++ .str_sec = "\0A!", ++ .str_sec_size = sizeof("\0A!"), ++ .map_type = BPF_MAP_TYPE_ARRAY, ++ .map_name = "enum_type_check_btf", ++ .key_size = sizeof(int), ++ .value_size = sizeof(int), ++ .key_type_id = 1, ++ .value_type_id = 1, ++ .max_entries = 4, ++ .btf_load_err = true, ++ .err_str = "Invalid name", ++}, + { + .descr = "arraymap invalid btf key (a bit field)", + .raw_types = { +-- +2.19.1 + diff --git a/queue-4.19/tools-bpf-fix-two-test_btf-unit-test-cases.patch b/queue-4.19/tools-bpf-fix-two-test_btf-unit-test-cases.patch new file mode 100644 index 00000000000..641dc6526e8 --- /dev/null +++ b/queue-4.19/tools-bpf-fix-two-test_btf-unit-test-cases.patch @@ -0,0 +1,58 @@ +From d49958e0936c7ff238646bf8b6c1c822c34505d0 Mon Sep 17 00:00:00 2001 +From: Martin KaFai Lau +Date: Tue, 27 Nov 2018 13:23:29 -0800 +Subject: tools/bpf: fix two test_btf unit test cases + +[ Upstream commit 8800cd031af085807028656c6ba7eb7908d78262 ] + +There are two unit test cases, which should encode +TYPEDEF type, but instead encode PTR type. +The error is flagged out after enforcing name +checking in the previous patch. + +Fixes: c0fa1b6c3efc ("bpf: btf: Add BTF tests") +Signed-off-by: Martin KaFai Lau +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_btf.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/test_btf.c b/tools/testing/selftests/bpf/test_btf.c +index 6b5cfeb7a9cc..4909aab4d6ab 100644 +--- a/tools/testing/selftests/bpf/test_btf.c ++++ b/tools/testing/selftests/bpf/test_btf.c +@@ -431,11 +431,11 @@ static struct btf_raw_test raw_tests[] = { + /* const void* */ /* [3] */ + BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), + /* typedef const void * const_void_ptr */ +- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3), +- /* struct A { */ /* [4] */ ++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */ ++ /* struct A { */ /* [5] */ + BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_STRUCT, 0, 1), sizeof(void *)), + /* const_void_ptr m; */ +- BTF_MEMBER_ENC(NAME_TBD, 3, 0), ++ BTF_MEMBER_ENC(NAME_TBD, 4, 0), + /* } */ + BTF_END_RAW, + }, +@@ -493,10 +493,10 @@ static struct btf_raw_test raw_tests[] = { + BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 0), + /* const void* */ /* [3] */ + BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2), +- /* typedef const void * const_void_ptr */ /* [4] */ +- BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 3), +- /* const_void_ptr[4] */ /* [5] */ +- BTF_TYPE_ARRAY_ENC(3, 1, 4), ++ /* typedef const void * const_void_ptr */ ++ BTF_TYPEDEF_ENC(NAME_TBD, 3), /* [4] */ ++ /* const_void_ptr[4] */ ++ BTF_TYPE_ARRAY_ENC(4, 1, 4), /* [5] */ + BTF_END_RAW, + }, + .str_sec = "\0const_void_ptr", +-- +2.19.1 + diff --git a/queue-4.19/tools-testing-nvdimm-align-test-resources-to-128m.patch b/queue-4.19/tools-testing-nvdimm-align-test-resources-to-128m.patch new file mode 100644 index 00000000000..689757302f4 --- /dev/null +++ b/queue-4.19/tools-testing-nvdimm-align-test-resources-to-128m.patch @@ -0,0 +1,128 @@ +From c52c213f861b1294ff4ef999dd66d0fd20650ccc Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Wed, 5 Dec 2018 14:11:48 -0800 +Subject: tools/testing/nvdimm: Align test resources to 128M + +[ Upstream commit e3f5df762d4a6ef6326c3c09bc9f89ea8a2eab2c ] + +In preparation for libnvdimm growing new restrictions to detect section +conflicts between persistent memory regions, enable nfit_test to +allocate aligned resources. Use a gen_pool to allocate nfit_test's fake +resources in a separate address space from the virtual translation of +the same. + +Reviewed-by: Vishal Verma +Tested-by: Vishal Verma +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + tools/testing/nvdimm/test/nfit.c | 35 ++++++++++++++++++++++++++++++-- + 1 file changed, 33 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/nvdimm/test/nfit.c b/tools/testing/nvdimm/test/nfit.c +index ec50d2a95076..fa763dbfdad7 100644 +--- a/tools/testing/nvdimm/test/nfit.c ++++ b/tools/testing/nvdimm/test/nfit.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -213,6 +214,8 @@ struct nfit_test { + + static struct workqueue_struct *nfit_wq; + ++static struct gen_pool *nfit_pool; ++ + static struct nfit_test *to_nfit_test(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); +@@ -1130,6 +1133,9 @@ static void release_nfit_res(void *data) + list_del(&nfit_res->list); + spin_unlock(&nfit_test_lock); + ++ if (resource_size(&nfit_res->res) >= DIMM_SIZE) ++ gen_pool_free(nfit_pool, nfit_res->res.start, ++ resource_size(&nfit_res->res)); + vfree(nfit_res->buf); + kfree(nfit_res); + } +@@ -1142,7 +1148,7 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma, + GFP_KERNEL); + int rc; + +- if (!buf || !nfit_res) ++ if (!buf || !nfit_res || !*dma) + goto err; + rc = devm_add_action(dev, release_nfit_res, nfit_res); + if (rc) +@@ -1162,6 +1168,8 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma, + + return nfit_res->buf; + err: ++ if (*dma && size >= DIMM_SIZE) ++ gen_pool_free(nfit_pool, *dma, size); + if (buf) + vfree(buf); + kfree(nfit_res); +@@ -1170,9 +1178,16 @@ static void *__test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma, + + static void *test_alloc(struct nfit_test *t, size_t size, dma_addr_t *dma) + { ++ struct genpool_data_align data = { ++ .align = SZ_128M, ++ }; + void *buf = vmalloc(size); + +- *dma = (unsigned long) buf; ++ if (size >= DIMM_SIZE) ++ *dma = gen_pool_alloc_algo(nfit_pool, size, ++ gen_pool_first_fit_align, &data); ++ else ++ *dma = (unsigned long) buf; + return __test_alloc(t, size, dma, buf); + } + +@@ -2837,6 +2852,17 @@ static __init int nfit_test_init(void) + goto err_register; + } + ++ nfit_pool = gen_pool_create(ilog2(SZ_4M), NUMA_NO_NODE); ++ if (!nfit_pool) { ++ rc = -ENOMEM; ++ goto err_register; ++ } ++ ++ if (gen_pool_add(nfit_pool, SZ_4G, SZ_4G, NUMA_NO_NODE)) { ++ rc = -ENOMEM; ++ goto err_register; ++ } ++ + for (i = 0; i < NUM_NFITS; i++) { + struct nfit_test *nfit_test; + struct platform_device *pdev; +@@ -2892,6 +2918,9 @@ static __init int nfit_test_init(void) + return 0; + + err_register: ++ if (nfit_pool) ++ gen_pool_destroy(nfit_pool); ++ + destroy_workqueue(nfit_wq); + for (i = 0; i < NUM_NFITS; i++) + if (instances[i]) +@@ -2915,6 +2944,8 @@ static __exit void nfit_test_exit(void) + platform_driver_unregister(&nfit_test_driver); + nfit_test_teardown(); + ++ gen_pool_destroy(nfit_pool); ++ + for (i = 0; i < NUM_NFITS; i++) + put_device(&instances[i]->pdev.dev); + class_destroy(nfit_test_dimm); +-- +2.19.1 + diff --git a/queue-4.19/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch b/queue-4.19/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch new file mode 100644 index 00000000000..ac6dcd3f3cb --- /dev/null +++ b/queue-4.19/vhost-vsock-fix-reset-orphans-race-with-close-timeou.patch @@ -0,0 +1,63 @@ +From 7a2e24876a525f8b7ee78ba36d7ca8d0ab30816f Mon Sep 17 00:00:00 2001 +From: Stefan Hajnoczi +Date: Thu, 6 Dec 2018 19:14:34 +0000 +Subject: vhost/vsock: fix reset orphans race with close timeout + +[ Upstream commit c38f57da428b033f2721b611d84b1f40bde674a8 ] + +If a local process has closed a connected socket and hasn't received a +RST packet yet, then the socket remains in the table until a timeout +expires. + +When a vhost_vsock instance is released with the timeout still pending, +the socket is never freed because vhost_vsock has already set the +SOCK_DONE flag. + +Check if the close timer is pending and let it close the socket. This +prevents the race which can leak sockets. + +Reported-by: Maximilian Riemensberger +Cc: Graham Whaley +Signed-off-by: Stefan Hajnoczi +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vsock.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index 51879ed18652..98ed5be132c6 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -563,13 +563,21 @@ static void vhost_vsock_reset_orphans(struct sock *sk) + * executing. + */ + +- if (!vhost_vsock_get(vsk->remote_addr.svm_cid)) { +- sock_set_flag(sk, SOCK_DONE); +- vsk->peer_shutdown = SHUTDOWN_MASK; +- sk->sk_state = SS_UNCONNECTED; +- sk->sk_err = ECONNRESET; +- sk->sk_error_report(sk); +- } ++ /* If the peer is still valid, no need to reset connection */ ++ if (vhost_vsock_get(vsk->remote_addr.svm_cid)) ++ return; ++ ++ /* If the close timeout is pending, let it expire. This avoids races ++ * with the timeout callback. ++ */ ++ if (vsk->close_work_scheduled) ++ return; ++ ++ sock_set_flag(sk, SOCK_DONE); ++ vsk->peer_shutdown = SHUTDOWN_MASK; ++ sk->sk_state = SS_UNCONNECTED; ++ sk->sk_err = ECONNRESET; ++ sk->sk_error_report(sk); + } + + static int vhost_vsock_dev_release(struct inode *inode, struct file *file) +-- +2.19.1 + diff --git a/queue-4.19/x86-build-fix-compiler-support-check-for-config_retp.patch b/queue-4.19/x86-build-fix-compiler-support-check-for-config_retp.patch new file mode 100644 index 00000000000..4d2b776bc29 --- /dev/null +++ b/queue-4.19/x86-build-fix-compiler-support-check-for-config_retp.patch @@ -0,0 +1,68 @@ +From fe7443c2e9788ea18a4174995385c603a7835671 Mon Sep 17 00:00:00 2001 +From: Masahiro Yamada +Date: Wed, 5 Dec 2018 15:27:19 +0900 +Subject: x86/build: Fix compiler support check for CONFIG_RETPOLINE + +[ Upstream commit 25896d073d8a0403b07e6dec56f58e6c33678207 ] + +It is troublesome to add a diagnostic like this to the Makefile +parse stage because the top-level Makefile could be parsed with +a stale include/config/auto.conf. + +Once you are hit by the error about non-retpoline compiler, the +compilation still breaks even after disabling CONFIG_RETPOLINE. + +The easiest fix is to move this check to the "archprepare" like +this commit did: + + 829fe4aa9ac1 ("x86: Allow generating user-space headers without a compiler") + +Reported-by: Meelis Roos +Tested-by: Meelis Roos +Signed-off-by: Masahiro Yamada +Acked-by: Zhenzhong Duan +Cc: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Zhenzhong Duan +Fixes: 4cd24de3a098 ("x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support") +Link: http://lkml.kernel.org/r/1543991239-18476-1-git-send-email-yamada.masahiro@socionext.com +Link: https://lkml.org/lkml/2018/12/4/206 +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/Makefile | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 9298f0f3817a..b84f61bc5e7a 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -223,9 +223,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables + + # Avoid indirect branches in kernel to deal with Spectre + ifdef CONFIG_RETPOLINE +-ifeq ($(RETPOLINE_CFLAGS),) +- $(error You are building kernel with non-retpoline compiler, please update your compiler.) +-endif + KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) + endif + +@@ -303,6 +300,13 @@ ifndef CC_HAVE_ASM_GOTO + @echo Compiler lacks asm-goto support. + @exit 1 + endif ++ifdef CONFIG_RETPOLINE ++ifeq ($(RETPOLINE_CFLAGS),) ++ @echo "You are building kernel with non-retpoline compiler." >&2 ++ @echo "Please update your compiler." >&2 ++ @false ++endif ++endif + + archclean: + $(Q)rm -rf $(objtree)/arch/i386 +-- +2.19.1 + diff --git a/queue-4.19/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch b/queue-4.19/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch new file mode 100644 index 00000000000..2b879cc4a75 --- /dev/null +++ b/queue-4.19/x86-earlyprintk-efi-fix-infinite-loop-on-some-screen.patch @@ -0,0 +1,63 @@ +From ae7fc3f71641d7a5d503f0d6cde379512d9b7587 Mon Sep 17 00:00:00 2001 +From: YiFei Zhu +Date: Thu, 29 Nov 2018 18:12:30 +0100 +Subject: x86/earlyprintk/efi: Fix infinite loop on some screen widths + +[ Upstream commit 79c2206d369b87b19ac29cb47601059b6bf5c291 ] + +An affected screen resolution is 1366 x 768, which width is not +divisible by 8, the default font width. On such screens, when longer +lines are earlyprintk'ed, overflow-to-next-line can never trigger, +due to the left-most x-coordinate of the next character always less +than the screen width. Earlyprintk will infinite loop in trying to +print the rest of the string but unable to, due to the line being +full. + +This patch makes the trigger consider the right-most x-coordinate, +instead of left-most, as the value to compare against the screen +width threshold. + +Signed-off-by: YiFei Zhu +Signed-off-by: Ard Biesheuvel +Cc: Andy Lutomirski +Cc: Arend van Spriel +Cc: Bhupesh Sharma +Cc: Borislav Petkov +Cc: Dave Hansen +Cc: Eric Snowberg +Cc: Hans de Goede +Cc: Joe Perches +Cc: Jon Hunter +Cc: Julien Thierry +Cc: Linus Torvalds +Cc: Marc Zyngier +Cc: Matt Fleming +Cc: Nathan Chancellor +Cc: Peter Zijlstra +Cc: Sai Praneeth Prakhya +Cc: Sedat Dilek +Cc: Thomas Gleixner +Cc: linux-efi@vger.kernel.org +Link: http://lkml.kernel.org/r/20181129171230.18699-12-ard.biesheuvel@linaro.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/platform/efi/early_printk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/platform/efi/early_printk.c b/arch/x86/platform/efi/early_printk.c +index 5fdacb322ceb..c3e6be110b7d 100644 +--- a/arch/x86/platform/efi/early_printk.c ++++ b/arch/x86/platform/efi/early_printk.c +@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, unsigned int num) + num--; + } + +- if (efi_x >= si->lfb_width) { ++ if (efi_x + font->width > si->lfb_width) { + efi_x = 0; + efi_y += font->height; + } +-- +2.19.1 + -- 2.47.3