--- /dev/null
+From e2477233145f2156434afb799583bccd878f3e9f Mon Sep 17 00:00:00 2001
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Thu, 3 Jan 2019 14:14:08 -0600
+Subject: ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
+
+From: Gustavo A. R. Silva <gustavo@embeddedor.com>
+
+commit e2477233145f2156434afb799583bccd878f3e9f upstream.
+
+Fix boolean expressions by using logical AND operator '&&' instead of
+bitwise operator '&'.
+
+This issue was detected with the help of Coccinelle.
+
+Fixes: 4fa084af28ca ("ARM: OSIRIS: DVS (Dynamic Voltage Scaling) supoort.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+[krzk: Fix -Wparentheses warning]
+Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/mach-s3c24xx/mach-osiris-dvs.c
++++ b/arch/arm/mach-s3c24xx/mach-osiris-dvs.c
+@@ -70,16 +70,16 @@ static int osiris_dvs_notify(struct noti
+
+ switch (val) {
+ case CPUFREQ_PRECHANGE:
+- if (old_dvs & !new_dvs ||
+- cur_dvs & !new_dvs) {
++ if ((old_dvs && !new_dvs) ||
++ (cur_dvs && !new_dvs)) {
+ pr_debug("%s: exiting dvs\n", __func__);
+ cur_dvs = false;
+ gpio_set_value(OSIRIS_GPIO_DVS, 1);
+ }
+ break;
+ case CPUFREQ_POSTCHANGE:
+- if (!old_dvs & new_dvs ||
+- !cur_dvs & new_dvs) {
++ if ((!old_dvs && new_dvs) ||
++ (!cur_dvs && new_dvs)) {
+ pr_debug("entering dvs\n");
+ cur_dvs = true;
+ gpio_set_value(OSIRIS_GPIO_DVS, 0);
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- drivers/gpu/drm/i915/i915_gem.c | 3 ++-
+ drivers/gpu/drm/i915/i915_gem.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 6509031098d5..26c4befcd234 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -1600,7 +1600,8 @@ __vma_matches(struct vm_area_struct *vma, struct file *filp,
+@@ -1600,7 +1600,8 @@ __vma_matches(struct vm_area_struct *vma
if (vma->vm_file != filp)
return false;
}
/**
---
-2.19.1
-
--- /dev/null
+From 904cdbd41d749a476863a0ca41f6f396774f26e4 Mon Sep 17 00:00:00 2001
+From: "zhangyi (F)" <yi.zhang@huawei.com>
+Date: Sun, 10 Feb 2019 23:23:04 -0500
+Subject: jbd2: clear dirty flag when revoking a buffer from an older transaction
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+commit 904cdbd41d749a476863a0ca41f6f396774f26e4 upstream.
+
+Now, we capture a data corruption problem on ext4 while we're truncating
+an extent index block. Imaging that if we are revoking a buffer which
+has been journaled by the committing transaction, the buffer's jbddirty
+flag will not be cleared in jbd2_journal_forget(), so the commit code
+will set the buffer dirty flag again after refile the buffer.
+
+fsx kjournald2
+ jbd2_journal_commit_transaction
+jbd2_journal_revoke commit phase 1~5...
+ jbd2_journal_forget
+ belongs to older transaction commit phase 6
+ jbddirty not clear __jbd2_journal_refile_buffer
+ __jbd2_journal_unfile_buffer
+ test_clear_buffer_jbddirty
+ mark_buffer_dirty
+
+Finally, if the freed extent index block was allocated again as data
+block by some other files, it may corrupt the file data after writing
+cached pages later, such as during unmount time. (In general,
+clean_bdev_aliases() related helpers should be invoked after
+re-allocation to prevent the above corruption, but unfortunately we
+missed it when zeroout the head of extra extent blocks in
+ext4_ext_handle_unwritten_extents()).
+
+This patch mark buffer as freed and set j_next_transaction to the new
+transaction when it already belongs to the committing transaction in
+jbd2_journal_forget(), so that commit code knows it should clear dirty
+bits when it is done with the buffer.
+
+This problem can be reproduced by xfstests generic/455 easily with
+seeds (3246 3247 3248 3249).
+
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1568,14 +1568,21 @@ int jbd2_journal_forget (handle_t *handl
+ /* However, if the buffer is still owned by a prior
+ * (committing) transaction, we can't drop it yet... */
+ JBUFFER_TRACE(jh, "belongs to older transaction");
+- /* ... but we CAN drop it from the new transaction if we
+- * have also modified it since the original commit. */
++ /* ... but we CAN drop it from the new transaction through
++ * marking the buffer as freed and set j_next_transaction to
++ * the new transaction, so that not only the commit code
++ * knows it should clear dirty bits when it is done with the
++ * buffer, but also the buffer can be checkpointed only
++ * after the new transaction commits. */
+
+- if (jh->b_next_transaction) {
+- J_ASSERT(jh->b_next_transaction == transaction);
++ set_buffer_freed(bh);
++
++ if (!jh->b_next_transaction) {
+ spin_lock(&journal->j_list_lock);
+- jh->b_next_transaction = NULL;
++ jh->b_next_transaction = transaction;
+ spin_unlock(&journal->j_list_lock);
++ } else {
++ J_ASSERT(jh->b_next_transaction == transaction);
+
+ /*
+ * only drop a reference if this transaction modified
--- /dev/null
+From 01215d3edb0f384ddeaa5e4a22c1ae5ff634149f Mon Sep 17 00:00:00 2001
+From: "zhangyi (F)" <yi.zhang@huawei.com>
+Date: Thu, 21 Feb 2019 11:24:09 -0500
+Subject: jbd2: fix compile warning when using JBUFFER_TRACE
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: zhangyi (F) <yi.zhang@huawei.com>
+
+commit 01215d3edb0f384ddeaa5e4a22c1ae5ff634149f upstream.
+
+The jh pointer may be used uninitialized in the two cases below and the
+compiler complain about it when enabling JBUFFER_TRACE macro, fix them.
+
+In file included from fs/jbd2/transaction.c:19:0:
+fs/jbd2/transaction.c: In function ‘jbd2_journal_get_undo_access’:
+./include/linux/jbd2.h:1637:38: warning: ‘jh’ is used uninitialized in this function [-Wuninitialized]
+ #define JBUFFER_TRACE(jh, info) do { printk("%s: %d\n", __func__, jh->b_jcount);} while (0)
+ ^
+fs/jbd2/transaction.c:1219:23: note: ‘jh’ was declared here
+ struct journal_head *jh;
+ ^
+In file included from fs/jbd2/transaction.c:19:0:
+fs/jbd2/transaction.c: In function ‘jbd2_journal_dirty_metadata’:
+./include/linux/jbd2.h:1637:38: warning: ‘jh’ may be used uninitialized in this function [-Wmaybe-uninitialized]
+ #define JBUFFER_TRACE(jh, info) do { printk("%s: %d\n", __func__, jh->b_jcount);} while (0)
+ ^
+fs/jbd2/transaction.c:1332:23: note: ‘jh’ was declared here
+ struct journal_head *jh;
+ ^
+
+Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@vger.kernel.org
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1211,11 +1211,12 @@ int jbd2_journal_get_undo_access(handle_
+ struct journal_head *jh;
+ char *committed_data = NULL;
+
+- JBUFFER_TRACE(jh, "entry");
+ if (jbd2_write_access_granted(handle, bh, true))
+ return 0;
+
+ jh = jbd2_journal_add_journal_head(bh);
++ JBUFFER_TRACE(jh, "entry");
++
+ /*
+ * Do this first --- it can drop the journal lock, so we want to
+ * make sure that obtaining the committed_data is done
+@@ -1326,15 +1327,17 @@ int jbd2_journal_dirty_metadata(handle_t
+
+ if (is_handle_aborted(handle))
+ return -EROFS;
+- if (!buffer_jbd(bh)) {
+- ret = -EUCLEAN;
+- goto out;
+- }
++ if (!buffer_jbd(bh))
++ return -EUCLEAN;
++
+ /*
+ * We don't grab jh reference here since the buffer must be part
+ * of the running transaction.
+ */
+ jh = bh2jh(bh);
++ jbd_debug(5, "journal_head %p\n", jh);
++ JBUFFER_TRACE(jh, "entry");
++
+ /*
+ * This and the following assertions are unreliable since we may see jh
+ * in inconsistent state unless we grab bh_state lock. But this is
+@@ -1368,9 +1371,6 @@ int jbd2_journal_dirty_metadata(handle_t
+ }
+
+ journal = transaction->t_journal;
+- jbd_debug(5, "journal_head %p\n", jh);
+- JBUFFER_TRACE(jh, "entry");
+-
+ jbd_lock_bh_state(bh);
+
+ if (jh->b_modified == 0) {
--- /dev/null
+From 9580b71b5a7863c24a9bd18bcd2ad759b86b1eff Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Wed, 27 Feb 2019 11:45:30 +0000
+Subject: powerpc/32: Clear on-stack exception marker upon exception return
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 9580b71b5a7863c24a9bd18bcd2ad759b86b1eff upstream.
+
+Clear the on-stack STACK_FRAME_REGS_MARKER on exception exit in order
+to avoid confusing stacktrace like the one below.
+
+ Call Trace:
+ [c0e9dca0] [c01c42a0] print_address_description+0x64/0x2bc (unreliable)
+ [c0e9dcd0] [c01c4684] kasan_report+0xfc/0x180
+ [c0e9dd10] [c0895130] memchr+0x24/0x74
+ [c0e9dd30] [c00a9e38] msg_print_text+0x124/0x574
+ [c0e9dde0] [c00ab710] console_unlock+0x114/0x4f8
+ [c0e9de40] [c00adc60] vprintk_emit+0x188/0x1c4
+ --- interrupt: c0e9df00 at 0x400f330
+ LR = init_stack+0x1f00/0x2000
+ [c0e9de80] [c00ae3c4] printk+0xa8/0xcc (unreliable)
+ [c0e9df20] [c0c27e44] early_irq_init+0x38/0x108
+ [c0e9df50] [c0c15434] start_kernel+0x310/0x488
+ [c0e9dff0] [00003484] 0x3484
+
+With this patch the trace becomes:
+
+ Call Trace:
+ [c0e9dca0] [c01c42c0] print_address_description+0x64/0x2bc (unreliable)
+ [c0e9dcd0] [c01c46a4] kasan_report+0xfc/0x180
+ [c0e9dd10] [c0895150] memchr+0x24/0x74
+ [c0e9dd30] [c00a9e58] msg_print_text+0x124/0x574
+ [c0e9dde0] [c00ab730] console_unlock+0x114/0x4f8
+ [c0e9de40] [c00adc80] vprintk_emit+0x188/0x1c4
+ [c0e9de80] [c00ae3e4] printk+0xa8/0xcc
+ [c0e9df20] [c0c27e44] early_irq_init+0x38/0x108
+ [c0e9df50] [c0c15434] start_kernel+0x310/0x488
+ [c0e9dff0] [00003484] 0x3484
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/entry_32.S | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/powerpc/kernel/entry_32.S
++++ b/arch/powerpc/kernel/entry_32.S
+@@ -698,6 +698,9 @@ fast_exception_return:
+ mtcr r10
+ lwz r10,_LINK(r11)
+ mtlr r10
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r11)
+ REST_GPR(10, r11)
+ mtspr SPRN_SRR1,r9
+ mtspr SPRN_SRR0,r12
+@@ -932,6 +935,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRE
+ mtcrf 0xFF,r10
+ mtlr r11
+
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r1)
+ /*
+ * Once we put values in SRR0 and SRR1, we are in a state
+ * where exceptions are not recoverable, since taking an
+@@ -969,6 +975,9 @@ exc_exit_restart_end:
+ mtlr r11
+ lwz r10,_CCR(r1)
+ mtcrf 0xff,r10
++ /* Clear the exception_marker on the stack to avoid confusing stacktrace */
++ li r10, 0
++ stw r10, 8(r1)
+ REST_2GPRS(9, r1)
+ .globl exc_exit_restart
+ exc_exit_restart:
--- /dev/null
+From 36da5ff0bea2dc67298150ead8d8471575c54c7d Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Fri, 25 Jan 2019 12:03:55 +0000
+Subject: powerpc/83xx: Also save/restore SPRG4-7 during suspend
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 36da5ff0bea2dc67298150ead8d8471575c54c7d upstream.
+
+The 83xx has 8 SPRG registers and uses at least SPRG4
+for DTLB handling LRU.
+
+Fixes: 2319f1239592 ("powerpc/mm: e300c2/c3/c4 TLB errata workaround")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/83xx/suspend-asm.S | 34 +++++++++++++++++++++++-------
+ 1 file changed, 27 insertions(+), 7 deletions(-)
+
+--- a/arch/powerpc/platforms/83xx/suspend-asm.S
++++ b/arch/powerpc/platforms/83xx/suspend-asm.S
+@@ -26,13 +26,13 @@
+ #define SS_MSR 0x74
+ #define SS_SDR1 0x78
+ #define SS_LR 0x7c
+-#define SS_SPRG 0x80 /* 4 SPRGs */
+-#define SS_DBAT 0x90 /* 8 DBATs */
+-#define SS_IBAT 0xd0 /* 8 IBATs */
+-#define SS_TB 0x110
+-#define SS_CR 0x118
+-#define SS_GPREG 0x11c /* r12-r31 */
+-#define STATE_SAVE_SIZE 0x16c
++#define SS_SPRG 0x80 /* 8 SPRGs */
++#define SS_DBAT 0xa0 /* 8 DBATs */
++#define SS_IBAT 0xe0 /* 8 IBATs */
++#define SS_TB 0x120
++#define SS_CR 0x128
++#define SS_GPREG 0x12c /* r12-r31 */
++#define STATE_SAVE_SIZE 0x17c
+
+ .section .data
+ .align 5
+@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep)
+ stw r7, SS_SPRG+12(r3)
+ stw r8, SS_SDR1(r3)
+
++ mfspr r4, SPRN_SPRG4
++ mfspr r5, SPRN_SPRG5
++ mfspr r6, SPRN_SPRG6
++ mfspr r7, SPRN_SPRG7
++
++ stw r4, SS_SPRG+16(r3)
++ stw r5, SS_SPRG+20(r3)
++ stw r6, SS_SPRG+24(r3)
++ stw r7, SS_SPRG+28(r3)
++
+ mfspr r4, SPRN_DBAT0U
+ mfspr r5, SPRN_DBAT0L
+ mfspr r6, SPRN_DBAT1U
+@@ -493,6 +503,16 @@ mpc83xx_deep_resume:
+ mtspr SPRN_IBAT7U, r6
+ mtspr SPRN_IBAT7L, r7
+
++ lwz r4, SS_SPRG+16(r3)
++ lwz r5, SS_SPRG+20(r3)
++ lwz r6, SS_SPRG+24(r3)
++ lwz r7, SS_SPRG+28(r3)
++
++ mtspr SPRN_SPRG4, r4
++ mtspr SPRN_SPRG5, r5
++ mtspr SPRN_SPRG6, r6
++ mtspr SPRN_SPRG7, r7
++
+ lwz r4, SS_SPRG+0(r3)
+ lwz r5, SS_SPRG+4(r3)
+ lwz r6, SS_SPRG+8(r3)
--- /dev/null
+From fe1ef6bcdb4fca33434256a802a3ed6aacf0bd2f Mon Sep 17 00:00:00 2001
+From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+Date: Fri, 8 Feb 2019 14:33:19 +0000
+Subject: powerpc: Fix 32-bit KVM-PR lockup and host crash with MacOS guest
+
+From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+
+commit fe1ef6bcdb4fca33434256a802a3ed6aacf0bd2f upstream.
+
+Commit 8792468da5e1 "powerpc: Add the ability to save FPU without
+giving it up" unexpectedly removed the MSR_FE0 and MSR_FE1 bits from
+the bitmask used to update the MSR of the previous thread in
+__giveup_fpu() causing a KVM-PR MacOS guest to lockup and panic the
+host kernel.
+
+Leaving FE0/1 enabled means unrelated processes might receive FPEs
+when they're not expecting them and crash. In particular if this
+happens to init the host will then panic.
+
+eg (transcribed):
+ qemu-system-ppc[837]: unhandled signal 8 at 12cc9ce4 nip 12cc9ce4 lr 12cc9ca4 code 0
+ systemd[1]: unhandled signal 8 at 202f02e0 nip 202f02e0 lr 001003d4 code 0
+ Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
+
+Reinstate these bits to the MSR bitmask to enable MacOS guests to run
+under 32-bit KVM-PR once again without issue.
+
+Fixes: 8792468da5e1 ("powerpc: Add the ability to save FPU without giving it up")
+Cc: stable@vger.kernel.org # v4.6+
+Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -153,7 +153,7 @@ void __giveup_fpu(struct task_struct *ts
+
+ save_fpu(tsk);
+ msr = tsk->thread.regs->msr;
+- msr &= ~MSR_FP;
++ msr &= ~(MSR_FP|MSR_FE0|MSR_FE1);
+ #ifdef CONFIG_VSX
+ if (cpu_has_feature(CPU_FTR_VSX))
+ msr &= ~MSR_VSX;
--- /dev/null
+From 7b62f9bd2246b7d3d086e571397c14ba52645ef1 Mon Sep 17 00:00:00 2001
+From: Jordan Niethe <jniethe5@gmail.com>
+Date: Wed, 27 Feb 2019 14:02:29 +1100
+Subject: powerpc/powernv: Make opal log only readable by root
+
+From: Jordan Niethe <jniethe5@gmail.com>
+
+commit 7b62f9bd2246b7d3d086e571397c14ba52645ef1 upstream.
+
+Currently the opal log is globally readable. It is kernel policy to
+limit the visibility of physical addresses / kernel pointers to root.
+Given this and the fact the opal log may contain this information it
+would be better to limit the readability to root.
+
+Fixes: bfc36894a48b ("powerpc/powernv: Add OPAL message log interface")
+Cc: stable@vger.kernel.org # v3.15+
+Signed-off-by: Jordan Niethe <jniethe5@gmail.com>
+Reviewed-by: Stewart Smith <stewart@linux.ibm.com>
+Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/powernv/opal-msglog.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/powerpc/platforms/powernv/opal-msglog.c
++++ b/arch/powerpc/platforms/powernv/opal-msglog.c
+@@ -98,7 +98,7 @@ static ssize_t opal_msglog_read(struct f
+ }
+
+ static struct bin_attribute opal_msglog_attr = {
+- .attr = {.name = "msglog", .mode = 0444},
++ .attr = {.name = "msglog", .mode = 0400},
+ .read = opal_msglog_read
+ };
+
--- /dev/null
+From ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0 Mon Sep 17 00:00:00 2001
+From: Michael Ellerman <mpe@ellerman.id.au>
+Date: Thu, 14 Feb 2019 11:08:29 +1100
+Subject: powerpc/ptrace: Simplify vr_get/set() to avoid GCC warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michael Ellerman <mpe@ellerman.id.au>
+
+commit ca6d5149d2ad0a8d2f9c28cbe379802260a0a5e0 upstream.
+
+GCC 8 warns about the logic in vr_get/set(), which with -Werror breaks
+the build:
+
+ In function ‘user_regset_copyin’,
+ inlined from ‘vr_set’ at arch/powerpc/kernel/ptrace.c:628:9:
+ include/linux/regset.h:295:4: error: ‘memcpy’ offset [-527, -529] is
+ out of the bounds [0, 16] of object ‘vrsave’ with type ‘union
+ <anonymous>’ [-Werror=array-bounds]
+ arch/powerpc/kernel/ptrace.c: In function ‘vr_set’:
+ arch/powerpc/kernel/ptrace.c:623:5: note: ‘vrsave’ declared here
+ } vrsave;
+
+This has been identified as a regression in GCC, see GCC bug 88273.
+
+However we can avoid the warning and also simplify the logic and make
+it more robust.
+
+Currently we pass -1 as end_pos to user_regset_copyout(). This says
+"copy up to the end of the regset".
+
+The definition of the regset is:
+ [REGSET_VMX] = {
+ .core_note_type = NT_PPC_VMX, .n = 34,
+ .size = sizeof(vector128), .align = sizeof(vector128),
+ .active = vr_active, .get = vr_get, .set = vr_set
+ },
+
+The end is calculated as (n * size), ie. 34 * sizeof(vector128).
+
+In vr_get/set() we pass start_pos as 33 * sizeof(vector128), meaning
+we can copy up to sizeof(vector128) into/out-of vrsave.
+
+The on-stack vrsave is defined as:
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+ } vrsave;
+
+And elf_vrreg_t is:
+ typedef __vector128 elf_vrreg_t;
+
+So there is no bug, but we rely on all those sizes lining up,
+otherwise we would have a kernel stack exposure/overwrite on our
+hands.
+
+Rather than relying on that we can pass an explict end_pos based on
+the sizeof(vrsave). The result should be exactly the same but it's
+more obviously not over-reading/writing the stack and it avoids the
+compiler warning.
+
+Reported-by: Meelis Roos <mroos@linux.ee>
+Reported-by: Mathieu Malaterre <malat@debian.org>
+Cc: stable@vger.kernel.org
+Tested-by: Mathieu Malaterre <malat@debian.org>
+Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/ptrace.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/powerpc/kernel/ptrace.c
++++ b/arch/powerpc/kernel/ptrace.c
+@@ -547,6 +547,7 @@ static int vr_get(struct task_struct *ta
+ /*
+ * Copy out only the low-order word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -555,8 +556,10 @@ static int vr_get(struct task_struct *ta
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ }
+
+ return ret;
+@@ -594,6 +597,7 @@ static int vr_set(struct task_struct *ta
+ /*
+ * We use only the first word of vrsave.
+ */
++ int start, end;
+ union {
+ elf_vrreg_t reg;
+ u32 word;
+@@ -602,8 +606,10 @@ static int vr_set(struct task_struct *ta
+
+ vrsave.word = target->thread.vrsave;
+
++ start = 33 * sizeof(vector128);
++ end = start + sizeof(vrsave);
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &vrsave,
+- 33 * sizeof(vector128), -1);
++ start, end);
+ if (!ret)
+ target->thread.vrsave = vrsave.word;
+ }
--- /dev/null
+From 6d183ca8baec983dc4208ca45ece3c36763df912 Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Thu, 21 Feb 2019 19:08:37 +0000
+Subject: powerpc/wii: properly disable use of BATs when requested.
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 6d183ca8baec983dc4208ca45ece3c36763df912 upstream.
+
+'nobats' kernel parameter or some options like CONFIG_DEBUG_PAGEALLOC
+deny the use of BATS for mapping memory.
+
+This patch makes sure that the specific wii RAM mapping function
+takes it into account as well.
+
+Fixes: de32400dd26e ("wii: use both mem1 and mem2 as ram")
+Cc: stable@vger.kernel.org
+Reviewed-by: Jonathan Neuschafer <j.neuschaefer@gmx.net>
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/platforms/embedded6xx/wii.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/arch/powerpc/platforms/embedded6xx/wii.c
++++ b/arch/powerpc/platforms/embedded6xx/wii.c
+@@ -104,6 +104,10 @@ unsigned long __init wii_mmu_mapin_mem2(
+ /* MEM2 64MB@0x10000000 */
+ delta = wii_hole_start + wii_hole_size;
+ size = top - delta;
++
++ if (__map_without_bats)
++ return delta;
++
+ for (bl = 128<<10; bl < max_size; bl <<= 1) {
+ if (bl * 2 > size)
+ break;
--- /dev/null
+From f4817843e39ce78aace0195a57d4e8500a65a898 Mon Sep 17 00:00:00 2001
+From: Lubomir Rintel <lkundrak@v3.sk>
+Date: Sun, 24 Feb 2019 13:00:53 +0100
+Subject: serial: 8250_of: assume reg-shift of 2 for mrvl,mmp-uart
+
+From: Lubomir Rintel <lkundrak@v3.sk>
+
+commit f4817843e39ce78aace0195a57d4e8500a65a898 upstream.
+
+There are two other drivers that bind to mrvl,mmp-uart and both of them
+assume register shift of 2 bits. There are device trees that lack the
+property and rely on that assumption.
+
+If this driver wins the race to bind to those devices, it should behave
+the same as the older deprecated driver.
+
+Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_of.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_of.c
++++ b/drivers/tty/serial/8250/8250_of.c
+@@ -97,6 +97,10 @@ static int of_platform_serial_setup(stru
+ if (of_property_read_u32(np, "reg-offset", &prop) == 0)
+ port->mapbase += prop;
+
++ /* Compatibility with the deprecated pxa driver and 8250_pxa drivers. */
++ if (of_device_is_compatible(np, "mrvl,mmp-uart"))
++ port->regshift = 2;
++
+ /* Check for registers offset within the devices address range */
+ if (of_property_read_u32(np, "reg-shift", &prop) == 0)
+ port->regshift = prop;
--- /dev/null
+From b896b03bc7fce43a07012cc6bf5e2ab2fddf3364 Mon Sep 17 00:00:00 2001
+From: Jay Dolan <jay.dolan@accesio.com>
+Date: Tue, 12 Feb 2019 21:43:11 -0800
+Subject: serial: 8250_pci: Fix number of ports for ACCES serial cards
+
+From: Jay Dolan <jay.dolan@accesio.com>
+
+commit b896b03bc7fce43a07012cc6bf5e2ab2fddf3364 upstream.
+
+Have the correct number of ports created for ACCES serial cards. Two port
+cards show up as four ports, and four port cards show up as eight.
+
+Fixes: c8d192428f52 ("serial: 8250: added acces i/o products quad and octal serial cards")
+Signed-off-by: Jay Dolan <jay.dolan@accesio.com>
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 36 ++++++++++++++++++------------------
+ 1 file changed, 18 insertions(+), 18 deletions(-)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -4976,10 +4976,10 @@ static struct pci_device_id serial_pci_t
+ */
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -4988,10 +4988,10 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_2DB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -5000,10 +5000,10 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_2SMDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_COM_2SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -5012,13 +5012,13 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_1,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7951 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -5027,16 +5027,16 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7954 },
+@@ -5045,13 +5045,13 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_2SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7954 },
++ pbn_pericom_PI7C9X7952 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM422_8,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+@@ -5060,19 +5060,19 @@ static struct pci_device_id serial_pci_t
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM232_8,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_COM_8SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+ pbn_pericom_PI7C9X7958 },
+ { PCI_VENDOR_ID_ACCESIO, PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+- pbn_pericom_PI7C9X7958 },
++ pbn_pericom_PI7C9X7954 },
+ /*
+ * Topic TP560 Data/Fax/Voice 56k modem (reported by Evan Clarke)
+ */
--- /dev/null
+From 78d3820b9bd39028727c6aab7297b63c093db343 Mon Sep 17 00:00:00 2001
+From: Jay Dolan <jay.dolan@accesio.com>
+Date: Tue, 12 Feb 2019 21:43:12 -0800
+Subject: serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
+
+From: Jay Dolan <jay.dolan@accesio.com>
+
+commit 78d3820b9bd39028727c6aab7297b63c093db343 upstream.
+
+The four port Pericom chips have the fourth port at the wrong address.
+Make use of quirk to fix it.
+
+Fixes: c8d192428f52 ("serial: 8250: added acces i/o products quad and octal serial cards")
+Cc: stable <stable@vger.kernel.org>
+Signed-off-by: Jay Dolan <jay.dolan@accesio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/8250/8250_pci.c | 105 +++++++++++++++++++++++++++++++++++++
+ 1 file changed, 105 insertions(+)
+
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -2126,6 +2126,111 @@ static struct pci_serial_quirk pci_seria
+ .setup = pci_default_setup,
+ .exit = pci_plx9050_exit,
+ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SDB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4S,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4DB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SMDB,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_COM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM422_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM485_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4S,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_MPCIE_ICM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM422_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM485_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM232_4,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_COM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
++ {
++ .vendor = PCI_VENDOR_ID_ACCESIO,
++ .device = PCI_DEVICE_ID_ACCESIO_PCIE_ICM_4SM,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_pericom_setup,
++ },
+ /*
+ * SBS Technologies, Inc., PMC-OCTALPRO 232
+ */
--- /dev/null
+From 7abab1605139bc41442864c18f9573440f7ca105 Mon Sep 17 00:00:00 2001
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+Date: Fri, 15 Feb 2019 18:45:08 +0200
+Subject: serial: uartps: Fix stuck ISR if RX disabled with non-empty FIFO
+
+From: Anssi Hannula <anssi.hannula@bitwise.fi>
+
+commit 7abab1605139bc41442864c18f9573440f7ca105 upstream.
+
+If RX is disabled while there are still unprocessed bytes in RX FIFO,
+cdns_uart_handle_rx() called from interrupt handler will get stuck in
+the receive loop as read bytes will not get removed from the RX FIFO
+and CDNS_UART_SR_RXEMPTY bit will never get set.
+
+Avoid the stuck handler by checking first if RX is disabled. port->lock
+protects against race with RX-disabling functions.
+
+This HW behavior was mentioned by Nathan Rossi in 43e98facc4a3 ("tty:
+xuartps: Fix RX hang, and TX corruption in termios call") which fixed a
+similar issue in cdns_uart_set_termios().
+The behavior can also be easily verified by e.g. setting
+CDNS_UART_CR_RX_DIS at the beginning of cdns_uart_handle_rx() - the
+following loop will then get stuck.
+
+Resetting the FIFO using RXRST would not set RXEMPTY either so simply
+issuing a reset after RX-disable would not work.
+
+I observe this frequently on a ZynqMP board during heavy RX load at 1M
+baudrate when the reader process exits and thus RX gets disabled.
+
+Fixes: 61ec9016988f ("tty/serial: add support for Xilinx PS UART")
+Signed-off-by: Anssi Hannula <anssi.hannula@bitwise.fi>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/xilinx_uartps.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -362,7 +362,13 @@ static irqreturn_t cdns_uart_isr(int irq
+ cdns_uart_handle_tx(dev_id);
+ isrstatus &= ~CDNS_UART_IXR_TXEMPTY;
+ }
+- if (isrstatus & CDNS_UART_IXR_RXMASK)
++
++ /*
++ * Skip RX processing if RX is disabled as RXEMPTY will never be set
++ * as read bytes will not be removed from the FIFO.
++ */
++ if (isrstatus & CDNS_UART_IXR_RXMASK &&
++ !(readl(port->membase + CDNS_UART_CR) & CDNS_UART_CR_RX_DIS))
+ cdns_uart_handle_rx(dev_id, isrstatus);
+
+ spin_unlock(&port->lock);
parport_pc-fix-find_superio-io-compare-code-should-use-equal-test.patch
i2c-tegra-fix-maximum-transfer-size.patch
drm-i915-relax-mmap-vma-check.patch
+serial-uartps-fix-stuck-isr-if-rx-disabled-with-non-empty-fifo.patch
+serial-8250_of-assume-reg-shift-of-2-for-mrvl-mmp-uart.patch
+serial-8250_pci-fix-number-of-ports-for-acces-serial-cards.patch
+serial-8250_pci-have-acces-cards-that-use-the-four-port-pericom-pi7c9x7954-chip-use-the-pci_pericom_setup.patch
+jbd2-clear-dirty-flag-when-revoking-a-buffer-from-an-older-transaction.patch
+jbd2-fix-compile-warning-when-using-jbuffer_trace.patch
+powerpc-32-clear-on-stack-exception-marker-upon-exception-return.patch
+powerpc-wii-properly-disable-use-of-bats-when-requested.patch
+powerpc-powernv-make-opal-log-only-readable-by-root.patch
+powerpc-83xx-also-save-restore-sprg4-7-during-suspend.patch
+powerpc-fix-32-bit-kvm-pr-lockup-and-host-crash-with-macos-guest.patch
+powerpc-ptrace-simplify-vr_get-set-to-avoid-gcc-warning.patch
+arm-s3c24xx-fix-boolean-expressions-in-osiris_dvs_notify.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
