From: Sasha Levin Date: Thu, 21 May 2020 14:04:51 +0000 (-0400) Subject: Fixes for 5.6 X-Git-Tag: v4.4.225~67^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=21338233edc4d37bcdd731b3a4eb28ca7c2ee549;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.6 Signed-off-by: Sasha Levin --- diff --git a/queue-5.6/acpi-ec-pm-avoid-flushing-ec-work-when-ec-gpe-is-ina.patch b/queue-5.6/acpi-ec-pm-avoid-flushing-ec-work-when-ec-gpe-is-ina.patch new file mode 100644 index 00000000000..283f974223b --- /dev/null +++ b/queue-5.6/acpi-ec-pm-avoid-flushing-ec-work-when-ec-gpe-is-ina.patch @@ -0,0 +1,101 @@ +From 705e20f112327326c5d5e8e7803171827b411055 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 May 2020 12:58:19 +0200 +Subject: ACPI: EC: PM: Avoid flushing EC work when EC GPE is inactive + +From: Rafael J. Wysocki + +[ Upstream commit 607b9df63057a56f6172d560d5366cca6a030c76 ] + +Flushing the EC work while suspended to idle when the EC GPE status +is not set causes some EC wakeup events (notably power button and +lid ones) to be missed after a series of spurious wakeups on the Dell +XPS13 9360 in my office. + +If that happens, the machine cannot be woken up from suspend-to-idle +by the power button or lid status change and it needs to be woken up +in some other way (eg. by a key press). + +Flushing the EC work only after successful dispatching the EC GPE, +which means that its status has been set, avoids the issue, so change +the code in question accordingly. + +Fixes: 7b301750f7f8 ("ACPI: EC: PM: Avoid premature returns from acpi_s2idle_wake()") +Cc: 5.4+ # 5.4+ +Signed-off-by: Rafael J. Wysocki +Tested-by: Chris Chiu +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 6 +++++- + drivers/acpi/sleep.c | 15 ++++----------- + 2 files changed, 9 insertions(+), 12 deletions(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 03b3067811c9..2713ddb3348c 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -2064,9 +2064,13 @@ bool acpi_ec_dispatch_gpe(void) + * to allow the caller to process events properly after that. + */ + ret = acpi_dispatch_gpe(NULL, first_ec->gpe); +- if (ret == ACPI_INTERRUPT_HANDLED) ++ if (ret == ACPI_INTERRUPT_HANDLED) { + pm_pr_dbg("EC GPE dispatched\n"); + ++ /* Flush the event and query workqueues. */ ++ acpi_ec_flush_work(); ++ } ++ + return false; + } + #endif /* CONFIG_PM_SLEEP */ +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 3850704570c0..fd9d4e8318e9 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -980,13 +980,6 @@ static int acpi_s2idle_prepare_late(void) + return 0; + } + +-static void acpi_s2idle_sync(void) +-{ +- /* The EC driver uses special workqueues that need to be flushed. */ +- acpi_ec_flush_work(); +- acpi_os_wait_events_complete(); /* synchronize Notify handling */ +-} +- + static bool acpi_s2idle_wake(void) + { + if (!acpi_sci_irq_valid()) +@@ -1018,7 +1011,7 @@ static bool acpi_s2idle_wake(void) + return true; + + /* +- * Cancel the wakeup and process all pending events in case ++ * Cancel the SCI wakeup and process all pending events in case + * there are any wakeup ones in there. + * + * Note that if any non-EC GPEs are active at this point, the +@@ -1026,8 +1019,7 @@ static bool acpi_s2idle_wake(void) + * should be missed by canceling the wakeup here. + */ + pm_system_cancel_wakeup(); +- +- acpi_s2idle_sync(); ++ acpi_os_wait_events_complete(); + + /* + * The SCI is in the "suspended" state now and it cannot produce +@@ -1060,7 +1052,8 @@ static void acpi_s2idle_restore(void) + * of GPEs. + */ + acpi_os_wait_events_complete(); /* synchronize GPE processing */ +- acpi_s2idle_sync(); ++ acpi_ec_flush_work(); /* flush the EC driver's workqueues */ ++ acpi_os_wait_events_complete(); /* synchronize Notify handling */ + + s2idle_wakeup = false; + +-- +2.25.1 + diff --git a/queue-5.6/afs-don-t-unlock-fetched-data-pages-until-the-op-com.patch b/queue-5.6/afs-don-t-unlock-fetched-data-pages-until-the-op-com.patch new file mode 100644 index 00000000000..8966f463814 --- /dev/null +++ b/queue-5.6/afs-don-t-unlock-fetched-data-pages-until-the-op-com.patch @@ -0,0 +1,129 @@ +From f69ea5fedcb8503cd2f2714053f3e54cfd2d2bd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 May 2020 21:21:05 +0100 +Subject: afs: Don't unlock fetched data pages until the op completes + successfully + +From: David Howells + +[ Upstream commit 9d1be4f4dc5ff1c66c86acfd2c35765d9e3776b3 ] + +Don't call req->page_done() on each page as we finish filling it with +the data coming from the network. Whilst this might speed up the +application a bit, it's a problem if there's a network failure and the +operation has to be reissued. + +If this happens, an oops occurs because afs_readpages_page_done() clears +the pointer to each page it unlocks and when a retry happens, the +pointers to the pages it wants to fill are now NULL (and the pages have +been unlocked anyway). + +Instead, wait till the operation completes successfully and only then +release all the pages after clearing any terminal gap (the server can +give us less data than we requested as we're allowed to ask for more +than is available). + +KASAN produces a bug like the following, and even without KASAN, it can +oops and panic. + + BUG: KASAN: wild-memory-access in _copy_to_iter+0x323/0x5f4 + Write of size 1404 at addr 0005088000000000 by task md5sum/5235 + + CPU: 0 PID: 5235 Comm: md5sum Not tainted 5.7.0-rc3-fscache+ #250 + Hardware name: ASUS All Series/H97-PLUS, BIOS 2306 10/09/2014 + Call Trace: + memcpy+0x39/0x58 + _copy_to_iter+0x323/0x5f4 + __skb_datagram_iter+0x89/0x2a6 + skb_copy_datagram_iter+0x129/0x135 + rxrpc_recvmsg_data.isra.0+0x615/0xd42 + rxrpc_kernel_recv_data+0x1e9/0x3ae + afs_extract_data+0x139/0x33a + yfs_deliver_fs_fetch_data64+0x47a/0x91b + afs_deliver_to_call+0x304/0x709 + afs_wait_for_call_to_complete+0x1cc/0x4ad + yfs_fs_fetch_data+0x279/0x288 + afs_fetch_data+0x1e1/0x38d + afs_readpages+0x593/0x72e + read_pages+0xf5/0x21e + __do_page_cache_readahead+0x128/0x23f + ondemand_readahead+0x36e/0x37f + generic_file_buffered_read+0x234/0x680 + new_sync_read+0x109/0x17e + vfs_read+0xe6/0x138 + ksys_read+0xd8/0x14d + do_syscall_64+0x6e/0x8a + entry_SYSCALL_64_after_hwframe+0x49/0xb3 + +Fixes: 196ee9cd2d04 ("afs: Make afs_fs_fetch_data() take a list of pages") +Fixes: 30062bd13e36 ("afs: Implement YFS support in the fs client") +Signed-off-by: David Howells +Reviewed-by: Matthew Wilcox (Oracle) +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/fsclient.c | 8 ++++---- + fs/afs/yfsclient.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c +index 68fc46634346..d2b3798c1932 100644 +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -385,8 +385,6 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call) + ASSERTCMP(req->offset, <=, PAGE_SIZE); + if (req->offset == PAGE_SIZE) { + req->offset = 0; +- if (req->page_done) +- req->page_done(req); + req->index++; + if (req->remain > 0) + goto begin_page; +@@ -440,11 +438,13 @@ static int afs_deliver_fs_fetch_data(struct afs_call *call) + if (req->offset < PAGE_SIZE) + zero_user_segment(req->pages[req->index], + req->offset, PAGE_SIZE); +- if (req->page_done) +- req->page_done(req); + req->offset = 0; + } + ++ if (req->page_done) ++ for (req->index = 0; req->index < req->nr_pages; req->index++) ++ req->page_done(req); ++ + _leave(" = 0 [done]"); + return 0; + } +diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c +index b5b45c57e1b1..fe413e7a5cf4 100644 +--- a/fs/afs/yfsclient.c ++++ b/fs/afs/yfsclient.c +@@ -497,8 +497,6 @@ static int yfs_deliver_fs_fetch_data64(struct afs_call *call) + ASSERTCMP(req->offset, <=, PAGE_SIZE); + if (req->offset == PAGE_SIZE) { + req->offset = 0; +- if (req->page_done) +- req->page_done(req); + req->index++; + if (req->remain > 0) + goto begin_page; +@@ -556,11 +554,13 @@ static int yfs_deliver_fs_fetch_data64(struct afs_call *call) + if (req->offset < PAGE_SIZE) + zero_user_segment(req->pages[req->index], + req->offset, PAGE_SIZE); +- if (req->page_done) +- req->page_done(req); + req->offset = 0; + } + ++ if (req->page_done) ++ for (req->index = 0; req->index < req->nr_pages; req->index++) ++ req->page_done(req); ++ + _leave(" = 0 [done]"); + return 0; + } +-- +2.25.1 + diff --git a/queue-5.6/aquantia-fix-the-media-type-of-aqc100-ethernet-contr.patch b/queue-5.6/aquantia-fix-the-media-type-of-aqc100-ethernet-contr.patch new file mode 100644 index 00000000000..9c4c2f28102 --- /dev/null +++ b/queue-5.6/aquantia-fix-the-media-type-of-aqc100-ethernet-contr.patch @@ -0,0 +1,39 @@ +From d47ddfe6afb992b1fc04a3e3280ccff4a9279df3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2020 08:58:11 +0800 +Subject: aquantia: Fix the media type of AQC100 ethernet controller in the + driver + +From: Richard Clark + +[ Upstream commit 6de556c31061e3b9c36546ffaaac5fdb679a2f14 ] + +The Aquantia AQC100 controller enables a SFP+ port, so the driver should +configure the media type as '_TYPE_FIBRE' instead of '_TYPE_TP'. + +Signed-off-by: Richard Clark +Cc: Igor Russkikh +Cc: "David S. Miller" +Acked-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index 78b6f3248756..e0625c67eed3 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -56,7 +56,7 @@ static const struct aq_board_revision_s hw_atl_boards[] = { + { AQ_DEVICE_ID_D108, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc108, }, + { AQ_DEVICE_ID_D109, AQ_HWREV_2, &hw_atl_ops_b0, &hw_atl_b0_caps_aqc109, }, + +- { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, }, ++ { AQ_DEVICE_ID_AQC100, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc100, }, + { AQ_DEVICE_ID_AQC107, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc107, }, + { AQ_DEVICE_ID_AQC108, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc108, }, + { AQ_DEVICE_ID_AQC109, AQ_HWREV_ANY, &hw_atl_ops_b1, &hw_atl_b0_caps_aqc109, }, +-- +2.25.1 + diff --git a/queue-5.6/arc-plat-hsdk-fix-usb-regression.patch b/queue-5.6/arc-plat-hsdk-fix-usb-regression.patch new file mode 100644 index 00000000000..4ceb7710a84 --- /dev/null +++ b/queue-5.6/arc-plat-hsdk-fix-usb-regression.patch @@ -0,0 +1,44 @@ +From 704113a05bf88ea07bc1a88bc3c8f90803667862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Apr 2020 23:06:42 +0300 +Subject: ARC: [plat-hsdk]: fix USB regression + +From: Eugeniy Paltsev + +[ Upstream commit 4c13ca86dcf80a8c705b1f3674ff43d318e970e0 ] + +As of today the CONFIG_USB isn't explicitly present in HSDK defconfig +as it is implicitly forcibly enabled by UDL driver which selects CONFIG_USB +in its kconfig. +The commit 5d50bd440bc2 ("drm/udl: Make udl driver depend on CONFIG_USB") +reverse the dependencies between UDL and USB so UDL now depends on +CONFIG_USB and not selects it. This introduces regression for ARC HSDK +board as HSDK defconfig wasn't adjusted and now it misses USB support +due to lack of CONFIG_USB enabled. + +Fix that. + +Cc: # 5.6.x +Fixes: 5d50bd440bc2 ("drm/udl: Make udl driver depend on CONFIG_USB") +Signed-off-by: Eugeniy Paltsev +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/configs/hsdk_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig +index 0974226fab55..aa000075a575 100644 +--- a/arch/arc/configs/hsdk_defconfig ++++ b/arch/arc/configs/hsdk_defconfig +@@ -65,6 +65,7 @@ CONFIG_DRM_UDL=y + CONFIG_DRM_ETNAVIV=y + CONFIG_FB=y + CONFIG_FRAMEBUFFER_CONSOLE=y ++CONFIG_USB=y + CONFIG_USB_EHCI_HCD=y + CONFIG_USB_EHCI_HCD_PLATFORM=y + CONFIG_USB_OHCI_HCD=y +-- +2.25.1 + diff --git a/queue-5.6/arm-futex-address-build-warning.patch b/queue-5.6/arm-futex-address-build-warning.patch new file mode 100644 index 00000000000..4dbc4801ef9 --- /dev/null +++ b/queue-5.6/arm-futex-address-build-warning.patch @@ -0,0 +1,70 @@ +From 853851641e4c1f261e2d7f588244419ae1b62b41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Apr 2020 11:07:22 +0200 +Subject: ARM: futex: Address build warning + +From: Thomas Gleixner + +[ Upstream commit 8101b5a1531f3390b3a69fa7934c70a8fd6566ad ] + +Stephen reported the following build warning on a ARM multi_v7_defconfig +build with GCC 9.2.1: + +kernel/futex.c: In function 'do_futex': +kernel/futex.c:1676:17: warning: 'oldval' may be used uninitialized in this function [-Wmaybe-uninitialized] + 1676 | return oldval == cmparg; + | ~~~~~~~^~~~~~~~~ +kernel/futex.c:1652:6: note: 'oldval' was declared here + 1652 | int oldval, ret; + | ^~~~~~ + +introduced by commit a08971e9488d ("futex: arch_futex_atomic_op_inuser() +calling conventions change"). + +While that change should not make any difference it confuses GCC which +fails to work out that oldval is not referenced when the return value is +not zero. + +GCC fails to properly analyze arch_futex_atomic_op_inuser(). It's not the +early return, the issue is with the assembly macros. GCC fails to detect +that those either set 'ret' to 0 and set oldval or set 'ret' to -EFAULT +which makes oldval uninteresting. The store to the callsite supplied oldval +pointer is conditional on ret == 0. + +The straight forward way to solve this is to make the store unconditional. + +Aside of addressing the build warning this makes sense anyway because it +removes the conditional from the fastpath. In the error case the stored +value is uninteresting and the extra store does not matter at all. + +Reported-by: Stephen Rothwell +Signed-off-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/87pncao2ph.fsf@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/futex.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h +index 83c391b597d4..fdc4ae3e7378 100644 +--- a/arch/arm/include/asm/futex.h ++++ b/arch/arm/include/asm/futex.h +@@ -164,8 +164,13 @@ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr) + preempt_enable(); + #endif + +- if (!ret) +- *oval = oldval; ++ /* ++ * Store unconditionally. If ret != 0 the extra store is the least ++ * of the worries but GCC cannot figure out that __futex_atomic_op() ++ * is either setting ret to -EFAULT or storing the old value in ++ * oldval which results in a uninitialized warning at the call site. ++ */ ++ *oval = oldval; + + return ret; + } +-- +2.25.1 + diff --git a/queue-5.6/ceph-fix-double-unlock-in-handle_cap_export.patch b/queue-5.6/ceph-fix-double-unlock-in-handle_cap_export.patch new file mode 100644 index 00000000000..18034041614 --- /dev/null +++ b/queue-5.6/ceph-fix-double-unlock-in-handle_cap_export.patch @@ -0,0 +1,37 @@ +From 4e57ddf77b5c501d353b6fe715542d7fa1462575 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 14:12:49 +0800 +Subject: ceph: fix double unlock in handle_cap_export() + +From: Wu Bo + +[ Upstream commit 4d8e28ff3106b093d98bfd2eceb9b430c70a8758 ] + +If the ceph_mdsc_open_export_target_session() return fails, it will +do a "goto retry", but the session mutex has already been unlocked. +Re-lock the mutex in that case to ensure that we don't unlock it +twice. + +Signed-off-by: Wu Bo +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/caps.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c +index d050acc1fd5d..f50204380a65 100644 +--- a/fs/ceph/caps.c ++++ b/fs/ceph/caps.c +@@ -3707,6 +3707,7 @@ retry: + WARN_ON(1); + tsession = NULL; + target = -1; ++ mutex_lock(&session->s_mutex); + } + goto retry; + +-- +2.25.1 + diff --git a/queue-5.6/component-silence-bind-error-on-eprobe_defer.patch b/queue-5.6/component-silence-bind-error-on-eprobe_defer.patch new file mode 100644 index 00000000000..99756fb723d --- /dev/null +++ b/queue-5.6/component-silence-bind-error-on-eprobe_defer.patch @@ -0,0 +1,53 @@ +From 7daf29fb4635fa813bfb9dabeede6b7e4d07e23c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Apr 2020 13:02:41 -0600 +Subject: component: Silence bind error on -EPROBE_DEFER + +From: James Hilliard + +[ Upstream commit 7706b0a76a9697021e2bf395f3f065c18f51043d ] + +If a component fails to bind due to -EPROBE_DEFER we should not log an +error as this is not a real failure. + +Fixes messages like: +vc4-drm soc:gpu: failed to bind 3f902000.hdmi (ops vc4_hdmi_ops): -517 +vc4-drm soc:gpu: master bind failed: -517 + +Signed-off-by: James Hilliard +Link: https://lore.kernel.org/r/20200411190241.89404-1-james.hilliard1@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/component.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/base/component.c b/drivers/base/component.c +index c7879f5ae2fb..53b19daca750 100644 +--- a/drivers/base/component.c ++++ b/drivers/base/component.c +@@ -256,7 +256,8 @@ static int try_to_bring_up_master(struct master *master, + ret = master->ops->bind(master->dev); + if (ret < 0) { + devres_release_group(master->dev, NULL); +- dev_info(master->dev, "master bind failed: %d\n", ret); ++ if (ret != -EPROBE_DEFER) ++ dev_info(master->dev, "master bind failed: %d\n", ret); + return ret; + } + +@@ -610,8 +611,9 @@ static int component_bind(struct component *component, struct master *master, + devres_release_group(component->dev, NULL); + devres_release_group(master->dev, NULL); + +- dev_err(master->dev, "failed to bind %s (ops %ps): %d\n", +- dev_name(component->dev), component->ops, ret); ++ if (ret != -EPROBE_DEFER) ++ dev_err(master->dev, "failed to bind %s (ops %ps): %d\n", ++ dev_name(component->dev), component->ops, ret); + } + + return ret; +-- +2.25.1 + diff --git a/queue-5.6/configfs-fix-config_item-refcnt-leak-in-configfs_rmd.patch b/queue-5.6/configfs-fix-config_item-refcnt-leak-in-configfs_rmd.patch new file mode 100644 index 00000000000..067280fc88d --- /dev/null +++ b/queue-5.6/configfs-fix-config_item-refcnt-leak-in-configfs_rmd.patch @@ -0,0 +1,47 @@ +From 2ca3a994964399424abeb1e0aff36b8c5fb45709 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2020 20:52:26 +0800 +Subject: configfs: fix config_item refcnt leak in configfs_rmdir() + +From: Xiyu Yang + +[ Upstream commit 8aebfffacfa379ba400da573a5bf9e49634e38cb ] + +configfs_rmdir() invokes configfs_get_config_item(), which returns a +reference of the specified config_item object to "parent_item" with +increased refcnt. + +When configfs_rmdir() returns, local variable "parent_item" becomes +invalid, so the refcount should be decreased to keep refcount balanced. + +The reference counting issue happens in one exception handling path of +configfs_rmdir(). When down_write_killable() fails, the function forgets +to decrease the refcnt increased by configfs_get_config_item(), causing +a refcnt leak. + +Fix this issue by calling config_item_put() when down_write_killable() +fails. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/configfs/dir.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index cf7b7e1d5bd7..cb733652ecca 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -1519,6 +1519,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry) + spin_lock(&configfs_dirent_lock); + configfs_detach_rollback(dentry); + spin_unlock(&configfs_dirent_lock); ++ config_item_put(parent_item); + return -EINTR; + } + frag->frag_dead = true; +-- +2.25.1 + diff --git a/queue-5.6/drm-amd-display-fix-counter-in-wait_for_no_pipes_pen.patch b/queue-5.6/drm-amd-display-fix-counter-in-wait_for_no_pipes_pen.patch new file mode 100644 index 00000000000..7336ee224b5 --- /dev/null +++ b/queue-5.6/drm-amd-display-fix-counter-in-wait_for_no_pipes_pen.patch @@ -0,0 +1,45 @@ +From 0852248b936056564270b1fbcf9144298e929f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2020 17:30:29 -0500 +Subject: drm/amd/display: fix counter in wait_for_no_pipes_pending + +From: Roman Li + +[ Upstream commit 80797dd6f1a525d1160c463d6a9f9d29af182cbb ] + +[Why] +Wait counter is not being reset for each pipe. + +[How] +Move counter reset into pipe loop scope. + +Signed-off-by: Roman Li +Reviewed-by: Zhan Liu +Acked-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index 188e51600070..b3987124183a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -803,11 +803,10 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context) + static void wait_for_no_pipes_pending(struct dc *dc, struct dc_state *context) + { + int i; +- int count = 0; +- struct pipe_ctx *pipe; + PERF_TRACE(); + for (i = 0; i < MAX_PIPES; i++) { +- pipe = &context->res_ctx.pipe_ctx[i]; ++ int count = 0; ++ struct pipe_ctx *pipe = &context->res_ctx.pipe_ctx[i]; + + if (!pipe->plane_state) + continue; +-- +2.25.1 + diff --git a/queue-5.6/drm-amd-display-prevent-dpcd-reads-with-passive-dong.patch b/queue-5.6/drm-amd-display-prevent-dpcd-reads-with-passive-dong.patch new file mode 100644 index 00000000000..0e5385fb45e --- /dev/null +++ b/queue-5.6/drm-amd-display-prevent-dpcd-reads-with-passive-dong.patch @@ -0,0 +1,63 @@ +From a62ed3478b9fa5d44ef99e024b9e0086120f3585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Apr 2020 14:37:33 -0400 +Subject: drm/amd/display: Prevent dpcd reads with passive dongles + +From: Aurabindo Pillai + +[ Upstream commit e6142dd511425cb827b5db869f489eb81f5f994d ] + +[why] +During hotplug, a DP port may be connected to the sink through +passive adapter which does not support DPCD reads. Issuing reads +without checking for this condition will result in errors + +[how] +Ensure the link is in aux_mode before initiating operation that result +in a DPCD read. + +Signed-off-by: Aurabindo Pillai +Reviewed-by: Harry Wentland +Acked-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 5e27a67fbc58..0cd11d3d4cf4 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1941,17 +1941,22 @@ amdgpu_dm_update_connector_after_detect(struct amdgpu_dm_connector *aconnector) + dc_sink_retain(aconnector->dc_sink); + if (sink->dc_edid.length == 0) { + aconnector->edid = NULL; +- drm_dp_cec_unset_edid(&aconnector->dm_dp_aux.aux); ++ if (aconnector->dc_link->aux_mode) { ++ drm_dp_cec_unset_edid( ++ &aconnector->dm_dp_aux.aux); ++ } + } else { + aconnector->edid = +- (struct edid *) sink->dc_edid.raw_edid; +- ++ (struct edid *)sink->dc_edid.raw_edid; + + drm_connector_update_edid_property(connector, +- aconnector->edid); +- drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux, +- aconnector->edid); ++ aconnector->edid); ++ ++ if (aconnector->dc_link->aux_mode) ++ drm_dp_cec_set_edid(&aconnector->dm_dp_aux.aux, ++ aconnector->edid); + } ++ + amdgpu_dm_update_freesync_caps(connector, aconnector->edid); + + } else { +-- +2.25.1 + diff --git a/queue-5.6/evm-check-also-if-tfm-is-an-error-pointer-in-init_de.patch b/queue-5.6/evm-check-also-if-tfm-is-an-error-pointer-in-init_de.patch new file mode 100644 index 00000000000..8e0c2e3bef8 --- /dev/null +++ b/queue-5.6/evm-check-also-if-tfm-is-an-error-pointer-in-init_de.patch @@ -0,0 +1,49 @@ +From 385eacde884a9163d980f9ed0156e57f8028414c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 12:28:56 +0200 +Subject: evm: Check also if *tfm is an error pointer in init_desc() + +From: Roberto Sassu + +[ Upstream commit 53de3b080d5eae31d0de219617155dcc34e7d698 ] + +This patch avoids a kernel panic due to accessing an error pointer set by +crypto_alloc_shash(). It occurs especially when there are many files that +require an unsupported algorithm, as it would increase the likelihood of +the following race condition: + +Task A: *tfm = crypto_alloc_shash() <= error pointer +Task B: if (*tfm == NULL) <= *tfm is not NULL, use it +Task B: rc = crypto_shash_init(desc) <= panic +Task A: *tfm = NULL + +This patch uses the IS_ERR_OR_NULL macro to determine whether or not a new +crypto context must be created. + +Cc: stable@vger.kernel.org +Fixes: d46eb3699502b ("evm: crypto hash replaced by shash") +Co-developed-by: Krzysztof Struczynski +Signed-off-by: Krzysztof Struczynski +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index d485f6fc908e..302adeb2d37b 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -93,7 +93,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo) + algo = hash_algo_name[hash_algo]; + } + +- if (*tfm == NULL) { ++ if (IS_ERR_OR_NULL(*tfm)) { + mutex_lock(&mutex); + if (*tfm) + goto out; +-- +2.25.1 + diff --git a/queue-5.6/evm-fix-a-small-race-in-init_desc.patch b/queue-5.6/evm-fix-a-small-race-in-init_desc.patch new file mode 100644 index 00000000000..4c25f436e17 --- /dev/null +++ b/queue-5.6/evm-fix-a-small-race-in-init_desc.patch @@ -0,0 +1,98 @@ +From e55b2cbf572d3f7ea93a7b7e98ee516dfd886854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 May 2020 16:19:17 +0300 +Subject: evm: Fix a small race in init_desc() + +From: Dan Carpenter + +[ Upstream commit 8433856947217ebb5697a8ff9c4c9cad4639a2cf ] + +The IS_ERR_OR_NULL() function has two conditions and if we got really +unlucky we could hit a race where "ptr" started as an error pointer and +then was set to NULL. Both conditions would be false even though the +pointer at the end was NULL. + +This patch fixes the problem by ensuring that "*tfm" can only be NULL +or valid. I have introduced a "tmp_tfm" variable to make that work. I +also reversed a condition and pulled the code in one tab. + +Reported-by: Roberto Sassu +Fixes: 53de3b080d5e ("evm: Check also if *tfm is an error pointer in init_desc()") +Signed-off-by: Dan Carpenter +Acked-by: Roberto Sassu +Acked-by: Krzysztof Struczynski +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_crypto.c | 44 ++++++++++++++--------------- + 1 file changed, 22 insertions(+), 22 deletions(-) + +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index 302adeb2d37b..cc826c2767a3 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -75,7 +75,7 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo) + { + long rc; + const char *algo; +- struct crypto_shash **tfm; ++ struct crypto_shash **tfm, *tmp_tfm; + struct shash_desc *desc; + + if (type == EVM_XATTR_HMAC) { +@@ -93,31 +93,31 @@ static struct shash_desc *init_desc(char type, uint8_t hash_algo) + algo = hash_algo_name[hash_algo]; + } + +- if (IS_ERR_OR_NULL(*tfm)) { +- mutex_lock(&mutex); +- if (*tfm) +- goto out; +- *tfm = crypto_alloc_shash(algo, 0, CRYPTO_NOLOAD); +- if (IS_ERR(*tfm)) { +- rc = PTR_ERR(*tfm); +- pr_err("Can not allocate %s (reason: %ld)\n", algo, rc); +- *tfm = NULL; ++ if (*tfm) ++ goto alloc; ++ mutex_lock(&mutex); ++ if (*tfm) ++ goto unlock; ++ ++ tmp_tfm = crypto_alloc_shash(algo, 0, CRYPTO_NOLOAD); ++ if (IS_ERR(tmp_tfm)) { ++ pr_err("Can not allocate %s (reason: %ld)\n", algo, ++ PTR_ERR(tmp_tfm)); ++ mutex_unlock(&mutex); ++ return ERR_CAST(tmp_tfm); ++ } ++ if (type == EVM_XATTR_HMAC) { ++ rc = crypto_shash_setkey(tmp_tfm, evmkey, evmkey_len); ++ if (rc) { ++ crypto_free_shash(tmp_tfm); + mutex_unlock(&mutex); + return ERR_PTR(rc); + } +- if (type == EVM_XATTR_HMAC) { +- rc = crypto_shash_setkey(*tfm, evmkey, evmkey_len); +- if (rc) { +- crypto_free_shash(*tfm); +- *tfm = NULL; +- mutex_unlock(&mutex); +- return ERR_PTR(rc); +- } +- } +-out: +- mutex_unlock(&mutex); + } +- ++ *tfm = tmp_tfm; ++unlock: ++ mutex_unlock(&mutex); ++alloc: + desc = kmalloc(sizeof(*desc) + crypto_shash_descsize(*tfm), + GFP_KERNEL); + if (!desc) +-- +2.25.1 + diff --git a/queue-5.6/fix-multiplication-overflow-in-copy_fdtable.patch b/queue-5.6/fix-multiplication-overflow-in-copy_fdtable.patch new file mode 100644 index 00000000000..4717cc7c7b5 --- /dev/null +++ b/queue-5.6/fix-multiplication-overflow-in-copy_fdtable.patch @@ -0,0 +1,40 @@ +From b5a857e47ab916118419f4be6eeed55e74f47d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 May 2020 17:48:52 -0400 +Subject: fix multiplication overflow in copy_fdtable() + +From: Al Viro + +[ Upstream commit 4e89b7210403fa4a8acafe7c602b6212b7af6c3b ] + +cpy and set really should be size_t; we won't get an overflow on that, +since sysctl_nr_open can't be set above ~(size_t)0 / sizeof(void *), +so nr that would've managed to overflow size_t on that multiplication +won't get anywhere near copy_fdtable() - we'll fail with EMFILE +before that. + +Cc: stable@kernel.org # v2.6.25+ +Fixes: 9cfe015aa424 (get rid of NR_OPEN and introduce a sysctl_nr_open) +Reported-by: Thiago Macieira +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/file.c b/fs/file.c +index c8a4e4c86e55..abb8b7081d7a 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -70,7 +70,7 @@ static void copy_fd_bitmaps(struct fdtable *nfdt, struct fdtable *ofdt, + */ + static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) + { +- unsigned int cpy, set; ++ size_t cpy, set; + + BUG_ON(nfdt->max_fds < ofdt->max_fds); + +-- +2.25.1 + diff --git a/queue-5.6/ftrace-selftest-make-unresolved-cases-cause-failure-.patch b/queue-5.6/ftrace-selftest-make-unresolved-cases-cause-failure-.patch new file mode 100644 index 00000000000..69ee1ca469a --- /dev/null +++ b/queue-5.6/ftrace-selftest-make-unresolved-cases-cause-failure-.patch @@ -0,0 +1,71 @@ +From cc4164614c5a6ad56eb12e7969630a46598c9c26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2020 09:33:30 +0000 +Subject: ftrace/selftest: make unresolved cases cause failure if + --fail-unresolved set + +From: Alan Maguire + +[ Upstream commit b730d668138cb3dd9ce78f8003986d1adae5523a ] + +Currently, ftracetest will return 1 (failure) if any unresolved cases +are encountered. The unresolved status results from modules and +programs not being available, and as such does not indicate any +issues with ftrace itself. As such, change the behaviour of +ftracetest in line with unsupported cases; if unsupported cases +happen, ftracetest still returns 0 unless --fail-unsupported. Here +--fail-unresolved is added and the default is to return 0 if +unresolved results occur. + +Signed-off-by: Alan Maguire +Acked-by: Masami Hiramatsu +Acked-by: Steven Rostedt (VMware) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/ftrace/ftracetest | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/ftrace/ftracetest b/tools/testing/selftests/ftrace/ftracetest +index 144308a757b7..19e9236dec5e 100755 +--- a/tools/testing/selftests/ftrace/ftracetest ++++ b/tools/testing/selftests/ftrace/ftracetest +@@ -17,6 +17,7 @@ echo " -v|--verbose Increase verbosity of test messages" + echo " -vv Alias of -v -v (Show all results in stdout)" + echo " -vvv Alias of -v -v -v (Show all commands immediately)" + echo " --fail-unsupported Treat UNSUPPORTED as a failure" ++echo " --fail-unresolved Treat UNRESOLVED as a failure" + echo " -d|--debug Debug mode (trace all shell commands)" + echo " -l|--logdir Save logs on the " + echo " If is -, all logs output in console only" +@@ -112,6 +113,10 @@ parse_opts() { # opts + UNSUPPORTED_RESULT=1 + shift 1 + ;; ++ --fail-unresolved) ++ UNRESOLVED_RESULT=1 ++ shift 1 ++ ;; + --logdir|-l) + LOG_DIR=$2 + shift 2 +@@ -176,6 +181,7 @@ KEEP_LOG=0 + DEBUG=0 + VERBOSE=0 + UNSUPPORTED_RESULT=0 ++UNRESOLVED_RESULT=0 + STOP_FAILURE=0 + # Parse command-line options + parse_opts $* +@@ -280,7 +286,7 @@ eval_result() { # sigval + $UNRESOLVED) + prlog " [${color_blue}UNRESOLVED${color_reset}]" + UNRESOLVED_CASES="$UNRESOLVED_CASES $CASENO" +- return 1 # this is a kind of bug.. something happened. ++ return $UNRESOLVED_RESULT # depends on use case + ;; + $UNTESTED) + prlog " [${color_blue}UNTESTED${color_reset}]" +-- +2.25.1 + diff --git a/queue-5.6/gcc-common.h-update-for-gcc-10.patch b/queue-5.6/gcc-common.h-update-for-gcc-10.patch new file mode 100644 index 00000000000..d4dd103c5ba --- /dev/null +++ b/queue-5.6/gcc-common.h-update-for-gcc-10.patch @@ -0,0 +1,90 @@ +From 654e2d5e47e0edb13f1302c55b79b510faa6bc99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Apr 2020 13:32:59 +0200 +Subject: gcc-common.h: Update for GCC 10 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Frédéric Pierret (fepitre) + +[ Upstream commit c7527373fe28f97d8a196ab562db5589be0d34b9 ] + +Remove "params.h" include, which has been dropped in GCC 10. + +Remove is_a_helper() macro, which is now defined in gimple.h, as seen +when running './scripts/gcc-plugin.sh g++ g++ gcc': + +In file included from :1: +./gcc-plugins/gcc-common.h:852:13: error: redefinition of ‘static bool is_a_helper::test(U*) [with U = const gimple; T = const ggoto*]’ + 852 | inline bool is_a_helper::test(const_gimple gs) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ./gcc-plugins/gcc-common.h:125, + from :1: +/usr/lib/gcc/x86_64-redhat-linux/10/plugin/include/gimple.h:1037:1: note: ‘static bool is_a_helper::test(U*) [with U = const gimple; T = const ggoto*]’ previously declared here + 1037 | is_a_helper ::test (const gimple *gs) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Add -Wno-format-diag to scripts/gcc-plugins/Makefile to avoid +meaningless warnings from error() formats used by plugins: + +scripts/gcc-plugins/structleak_plugin.c: In function ‘int plugin_init(plugin_name_args*, plugin_gcc_version*)’: +scripts/gcc-plugins/structleak_plugin.c:253:12: warning: unquoted sequence of 2 consecutive punctuation characters ‘'-’ in format [-Wformat-diag] + 253 | error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Frédéric Pierret (fepitre) +Link: https://lore.kernel.org/r/20200407113259.270172-1-frederic.pierret@qubes-os.org +[kees: include -Wno-format-diag for plugin builds] +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + scripts/gcc-plugins/Makefile | 1 + + scripts/gcc-plugins/gcc-common.h | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile +index f2ee8bd7abc6..1d0b9382e759 100644 +--- a/scripts/gcc-plugins/Makefile ++++ b/scripts/gcc-plugins/Makefile +@@ -11,6 +11,7 @@ else + HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti + HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb + HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable ++ HOST_EXTRACXXFLAGS += -Wno-format-diag + export HOST_EXTRACXXFLAGS + endif + +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 17f06079a712..9ad76b7f3f10 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -35,7 +35,9 @@ + #include "ggc.h" + #include "timevar.h" + ++#if BUILDING_GCC_VERSION < 10000 + #include "params.h" ++#endif + + #if BUILDING_GCC_VERSION <= 4009 + #include "pointer-set.h" +@@ -847,6 +849,7 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l + return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT); + } + ++#if BUILDING_GCC_VERSION < 10000 + template <> + template <> + inline bool is_a_helper::test(const_gimple gs) +@@ -860,6 +863,7 @@ inline bool is_a_helper::test(const_gimple gs) + { + return gs->code == GIMPLE_RETURN; + } ++#endif + + static inline gasm *as_a_gasm(gimple stmt) + { +-- +2.25.1 + diff --git a/queue-5.6/gtp-set-nlm_f_multi-flag-in-gtp_genl_dump_pdp.patch b/queue-5.6/gtp-set-nlm_f_multi-flag-in-gtp_genl_dump_pdp.patch new file mode 100644 index 00000000000..95a0a45bfec --- /dev/null +++ b/queue-5.6/gtp-set-nlm_f_multi-flag-in-gtp_genl_dump_pdp.patch @@ -0,0 +1,61 @@ +From 9ad4d7c529478e64a242dbc2c1b41017d94bef26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 14:01:36 +0900 +Subject: gtp: set NLM_F_MULTI flag in gtp_genl_dump_pdp() + +From: Yoshiyuki Kurauchi + +[ Upstream commit 846c68f7f1ac82c797a2f1db3344a2966c0fe2e1 ] + +In drivers/net/gtp.c, gtp_genl_dump_pdp() should set NLM_F_MULTI +flag since it returns multipart message. +This patch adds a new arg "flags" in gtp_genl_fill_info() so that +flags can be set by the callers. + +Signed-off-by: Yoshiyuki Kurauchi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/gtp.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index 672cd2caf2fb..21640a035d7d 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -1169,11 +1169,11 @@ out_unlock: + static struct genl_family gtp_genl_family; + + static int gtp_genl_fill_info(struct sk_buff *skb, u32 snd_portid, u32 snd_seq, +- u32 type, struct pdp_ctx *pctx) ++ int flags, u32 type, struct pdp_ctx *pctx) + { + void *genlh; + +- genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, 0, ++ genlh = genlmsg_put(skb, snd_portid, snd_seq, >p_genl_family, flags, + type); + if (genlh == NULL) + goto nlmsg_failure; +@@ -1227,8 +1227,8 @@ static int gtp_genl_get_pdp(struct sk_buff *skb, struct genl_info *info) + goto err_unlock; + } + +- err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, +- info->snd_seq, info->nlhdr->nlmsg_type, pctx); ++ err = gtp_genl_fill_info(skb2, NETLINK_CB(skb).portid, info->snd_seq, ++ 0, info->nlhdr->nlmsg_type, pctx); + if (err < 0) + goto err_unlock_free; + +@@ -1271,6 +1271,7 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb, + gtp_genl_fill_info(skb, + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, ++ NLM_F_MULTI, + cb->nlh->nlmsg_type, pctx)) { + cb->args[0] = i; + cb->args[1] = j; +-- +2.25.1 + diff --git a/queue-5.6/hid-alps-add-aui1657-device-id.patch b/queue-5.6/hid-alps-add-aui1657-device-id.patch new file mode 100644 index 00000000000..3b01e99e0cd --- /dev/null +++ b/queue-5.6/hid-alps-add-aui1657-device-id.patch @@ -0,0 +1,48 @@ +From 98bda25e580086c584b4a547f5c6b4a9e2232652 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Apr 2020 03:55:15 +0400 +Subject: HID: alps: Add AUI1657 device ID + +From: Artem Borisov + +[ Upstream commit 640e403b1fd24e7f31ac6f29f0b6a21d285ed729 ] + +This device is used on Lenovo V130-15IKB variants and uses +the same registers as U1. + +Signed-off-by: Artem Borisov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 1 + + drivers/hid/hid-ids.h | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index fa704153cb00..c2a2bd528890 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -802,6 +802,7 @@ static int alps_probe(struct hid_device *hdev, const struct hid_device_id *id) + break; + case HID_DEVICE_ID_ALPS_U1_DUAL: + case HID_DEVICE_ID_ALPS_U1: ++ case HID_DEVICE_ID_ALPS_1657: + data->dev_type = U1; + break; + default: +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 40697af0ca35..7d769ca864a7 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -81,7 +81,7 @@ + #define HID_DEVICE_ID_ALPS_U1 0x1215 + #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C + #define HID_DEVICE_ID_ALPS_1222 0x1222 +- ++#define HID_DEVICE_ID_ALPS_1657 0x121E + + #define USB_VENDOR_ID_AMI 0x046b + #define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10 +-- +2.25.1 + diff --git a/queue-5.6/hid-alps-alps_1657-is-too-specific-use-u1_unicorn_le.patch b/queue-5.6/hid-alps-alps_1657-is-too-specific-use-u1_unicorn_le.patch new file mode 100644 index 00000000000..929cafd7070 --- /dev/null +++ b/queue-5.6/hid-alps-alps_1657-is-too-specific-use-u1_unicorn_le.patch @@ -0,0 +1,55 @@ +From f945f0e62719fbe19824f161aad3296b0622e9a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Apr 2020 14:51:42 +0200 +Subject: HID: alps: ALPS_1657 is too specific; use U1_UNICORN_LEGACY instead + +From: Jiri Kosina + +[ Upstream commit 185af3e775b693f773d9a4b5a8c3cda69fc8ca0f ] + +HID_DEVICE_ID_ALPS_1657 PID is too specific, as there are many other +ALPS hardware IDs using this particular touchpad. + +Rename the identifier to HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY in order +to describe reality better. + +Fixes: 640e403b1fd24 ("HID: alps: Add AUI1657 device ID") +Reported-by: Xiaojian Cao +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-alps.c | 2 +- + drivers/hid/hid-ids.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-alps.c b/drivers/hid/hid-alps.c +index c2a2bd528890..b2ad319a74b9 100644 +--- a/drivers/hid/hid-alps.c ++++ b/drivers/hid/hid-alps.c +@@ -802,7 +802,7 @@ static int alps_probe(struct hid_device *hdev, const struct hid_device_id *id) + break; + case HID_DEVICE_ID_ALPS_U1_DUAL: + case HID_DEVICE_ID_ALPS_U1: +- case HID_DEVICE_ID_ALPS_1657: ++ case HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY: + data->dev_type = U1; + break; + default: +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 7d769ca864a7..b3cc26ca375f 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -79,9 +79,9 @@ + #define HID_DEVICE_ID_ALPS_U1_DUAL_PTP 0x121F + #define HID_DEVICE_ID_ALPS_U1_DUAL_3BTN_PTP 0x1220 + #define HID_DEVICE_ID_ALPS_U1 0x1215 ++#define HID_DEVICE_ID_ALPS_U1_UNICORN_LEGACY 0x121E + #define HID_DEVICE_ID_ALPS_T4_BTNLESS 0x120C + #define HID_DEVICE_ID_ALPS_1222 0x1222 +-#define HID_DEVICE_ID_ALPS_1657 0x121E + + #define USB_VENDOR_ID_AMI 0x046b + #define USB_DEVICE_ID_AMI_VIRT_KEYBOARD_AND_MOUSE 0xff10 +-- +2.25.1 + diff --git a/queue-5.6/hid-i2c-hid-reset-synaptics-syna2393-on-resume.patch b/queue-5.6/hid-i2c-hid-reset-synaptics-syna2393-on-resume.patch new file mode 100644 index 00000000000..00aa5ca97f0 --- /dev/null +++ b/queue-5.6/hid-i2c-hid-reset-synaptics-syna2393-on-resume.patch @@ -0,0 +1,55 @@ +From 600c962656375bc4cb5c851c2d8c98f1ee365f08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Apr 2020 20:58:17 +1000 +Subject: HID: i2c-hid: reset Synaptics SYNA2393 on resume + +From: Daniel Playfair Cal + +[ Upstream commit 538f67407e2c0e5ed2a46e7d7ffa52f2e30c7ef8 ] + +On the Dell XPS 9570, the Synaptics SYNA2393 touchpad generates spurious +interrupts after resuming from suspend until it receives some input or +is reset. Add it to the quirk I2C_HID_QUIRK_RESET_ON_RESUME so that it +is reset when resuming from suspend. + +More information about the bug can be found in this mailing list +discussion: https://www.spinics.net/lists/linux-input/msg59530.html + +Signed-off-by: Daniel Playfair Cal +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/i2c-hid/i2c-hid-core.c | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b3cc26ca375f..55afc089cb25 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1094,6 +1094,9 @@ + #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300 + #define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200 + ++#define I2C_VENDOR_ID_SYNAPTICS 0x06cb ++#define I2C_PRODUCT_ID_SYNAPTICS_SYNA2393 0x7a13 ++ + #define USB_VENDOR_ID_SYNAPTICS 0x06cb + #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001 + #define USB_DEVICE_ID_SYNAPTICS_INT_TP 0x0002 +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 009000c5d55c..294c84e136d7 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -177,6 +177,8 @@ static const struct i2c_hid_quirks { + I2C_HID_QUIRK_BOGUS_IRQ }, + { USB_VENDOR_ID_ALPS_JP, HID_ANY_ID, + I2C_HID_QUIRK_RESET_ON_RESUME }, ++ { I2C_VENDOR_ID_SYNAPTICS, I2C_PRODUCT_ID_SYNAPTICS_SYNA2393, ++ I2C_HID_QUIRK_RESET_ON_RESUME }, + { USB_VENDOR_ID_ITE, I2C_DEVICE_ID_ITE_LENOVO_LEGION_Y720, + I2C_HID_QUIRK_BAD_INPUT_SIZE }, + { 0, 0 } +-- +2.25.1 + diff --git a/queue-5.6/hid-logitech-add-support-for-logitech-g11-extra-keys.patch b/queue-5.6/hid-logitech-add-support-for-logitech-g11-extra-keys.patch new file mode 100644 index 00000000000..9d2d0be16ba --- /dev/null +++ b/queue-5.6/hid-logitech-add-support-for-logitech-g11-extra-keys.patch @@ -0,0 +1,55 @@ +From bf494853ba07c412823fbdb04bacb7303f19d80e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Apr 2020 18:46:28 +0200 +Subject: HID: logitech: Add support for Logitech G11 extra keys + +From: Fabian Schindlatz + +[ Upstream commit b1bd0f75288f60e8d142a1b3e979ed0192c04931 ] + +The Logitech G11 keyboard is a cheap variant of the G15 without the LCD +screen. It uses the same layout for its extra and macro keys (G1 - G18, +M1-M3, MR) and - from the input subsystem's perspective - behaves just +like the G15, so we can treat it as such. + +Tested it with my own keyboard. + +Signed-off-by: Fabian Schindlatz +Reviewed-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-lg-g15.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 309510a72c5e..40697af0ca35 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -756,6 +756,7 @@ + #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD2 0xc218 + #define USB_DEVICE_ID_LOGITECH_RUMBLEPAD2_2 0xc219 + #define USB_DEVICE_ID_LOGITECH_G15_LCD 0xc222 ++#define USB_DEVICE_ID_LOGITECH_G11 0xc225 + #define USB_DEVICE_ID_LOGITECH_G15_V2_LCD 0xc227 + #define USB_DEVICE_ID_LOGITECH_G510 0xc22d + #define USB_DEVICE_ID_LOGITECH_G510_USB_AUDIO 0xc22e +diff --git a/drivers/hid/hid-lg-g15.c b/drivers/hid/hid-lg-g15.c +index ad4b5412a9f4..ef0cbcd7540d 100644 +--- a/drivers/hid/hid-lg-g15.c ++++ b/drivers/hid/hid-lg-g15.c +@@ -872,6 +872,10 @@ error_hw_stop: + } + + static const struct hid_device_id lg_g15_devices[] = { ++ /* The G11 is a G15 without the LCD, treat it as a G15 */ ++ { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, ++ USB_DEVICE_ID_LOGITECH_G11), ++ .driver_data = LG_G15 }, + { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, + USB_DEVICE_ID_LOGITECH_G15_LCD), + .driver_data = LG_G15 }, +-- +2.25.1 + diff --git a/queue-5.6/hid-multitouch-add-egalaxtouch-p80h84-support.patch b/queue-5.6/hid-multitouch-add-egalaxtouch-p80h84-support.patch new file mode 100644 index 00000000000..6402eec6def --- /dev/null +++ b/queue-5.6/hid-multitouch-add-egalaxtouch-p80h84-support.patch @@ -0,0 +1,53 @@ +From ef05eda46e7a3886ed14c459d4263482b81abca5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Apr 2020 18:02:37 +0200 +Subject: HID: multitouch: add eGalaxTouch P80H84 support + +From: Sebastian Reichel + +[ Upstream commit f9e82295eec141a0569649d400d249333d74aa91 ] + +Add support for P80H84 touchscreen from eGalaxy: + + idVendor 0x0eef D-WAV Scientific Co., Ltd + idProduct 0xc002 + iManufacturer 1 eGalax Inc. + iProduct 2 eGalaxTouch P80H84 2019 vDIVA_1204_T01 k4.02.146 + +Signed-off-by: Sebastian Reichel +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 9f2213426556..309510a72c5e 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -385,6 +385,7 @@ + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_7349 0x7349 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_73F7 0x73f7 + #define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001 0xa001 ++#define USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002 0xc002 + + #define USB_VENDOR_ID_ELAN 0x04f3 + #define USB_DEVICE_ID_TOSHIBA_CLICK_L9W 0x0401 +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 362805ddf377..03c720b47306 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1922,6 +1922,9 @@ static const struct hid_device_id mt_devices[] = { + { .driver_data = MT_CLS_EGALAX_SERIAL, + MT_USB_DEVICE(USB_VENDOR_ID_DWAV, + USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_A001) }, ++ { .driver_data = MT_CLS_EGALAX, ++ MT_USB_DEVICE(USB_VENDOR_ID_DWAV, ++ USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH_C002) }, + + /* Elitegroup panel */ + { .driver_data = MT_CLS_SERIAL, +-- +2.25.1 + diff --git a/queue-5.6/hid-quirks-add-hid_quirk_no_init_reports-quirk-for-d.patch b/queue-5.6/hid-quirks-add-hid_quirk_no_init_reports-quirk-for-d.patch new file mode 100644 index 00000000000..f70e5d7ad04 --- /dev/null +++ b/queue-5.6/hid-quirks-add-hid_quirk_no_init_reports-quirk-for-d.patch @@ -0,0 +1,53 @@ +From c40e218dc95169b8207fa2314550ed3f1b8409fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 May 2020 20:18:42 +0200 +Subject: HID: quirks: Add HID_QUIRK_NO_INIT_REPORTS quirk for Dell K12A + keyboard-dock + +From: Hans de Goede + +[ Upstream commit 1e189f267015a098bdcb82cc652d13fbf2203fa0 ] + +Add a HID_QUIRK_NO_INIT_REPORTS quirk for the Dell K12A keyboard-dock, +which can be used with various Dell Venue 11 models. + +Without this quirk the keyboard/touchpad combo works fine when connected +at boot, but when hotplugged 9 out of 10 times it will not work properly. +Adding the quirk fixes this. + +Cc: Mario Limonciello +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 55afc089cb25..b1d6156ebf9d 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1111,6 +1111,7 @@ + #define USB_DEVICE_ID_SYNAPTICS_LTS2 0x1d10 + #define USB_DEVICE_ID_SYNAPTICS_HD 0x0ac3 + #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD 0x1ac3 ++#define USB_DEVICE_ID_SYNAPTICS_DELL_K12A 0x2819 + #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012 0x2968 + #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710 + #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5 0x81a7 +diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c +index 3735546bb524..acc7c14f7fbc 100644 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -163,6 +163,7 @@ static const struct hid_device_id hid_quirks[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103), HID_QUIRK_NO_INIT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_DELL_K12A), HID_QUIRK_NO_INIT_REPORTS }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOPMAX, USB_DEVICE_ID_TOPMAX_COBRAPAD), HID_QUIRK_BADPAD }, + { HID_USB_DEVICE(USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_TPV, USB_DEVICE_ID_TPV_OPTICAL_TOUCHSCREEN_8882), HID_QUIRK_NOGET }, +-- +2.25.1 + diff --git a/queue-5.6/i2c-fix-missing-pm_runtime_put_sync-in-i2c_device_pr.patch b/queue-5.6/i2c-fix-missing-pm_runtime_put_sync-in-i2c_device_pr.patch new file mode 100644 index 00000000000..7ecdcf6b79e --- /dev/null +++ b/queue-5.6/i2c-fix-missing-pm_runtime_put_sync-in-i2c_device_pr.patch @@ -0,0 +1,79 @@ +From bfaa53c21b5a95a78b20cd45ba00988761a35e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 17:43:21 +0200 +Subject: i2c: fix missing pm_runtime_put_sync in i2c_device_probe + +From: Alain Volmat + +[ Upstream commit 3c3dd56f760da056e821ac177e3ad0de4209a435 ] + +In case of the I2C client exposes the flag I2C_CLIENT_HOST_NOTIFY, +pm_runtime_get_sync is called in order to always keep active the +adapter. However later on, pm_runtime_put_sync is never called +within the function in case of an error. This commit add this +error handling. + +Fixes: 72bfcee11cf8 ("i2c: Prevent runtime suspend of adapter when Host Notify is required") +Signed-off-by: Alain Volmat +Reviewed-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index cefad0881942..fd3199782b6e 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -338,8 +338,10 @@ static int i2c_device_probe(struct device *dev) + } else if (ACPI_COMPANION(dev)) { + irq = i2c_acpi_get_irq(client); + } +- if (irq == -EPROBE_DEFER) +- return irq; ++ if (irq == -EPROBE_DEFER) { ++ status = irq; ++ goto put_sync_adapter; ++ } + + if (irq < 0) + irq = 0; +@@ -353,15 +355,19 @@ static int i2c_device_probe(struct device *dev) + */ + if (!driver->id_table && + !i2c_acpi_match_device(dev->driver->acpi_match_table, client) && +- !i2c_of_match_device(dev->driver->of_match_table, client)) +- return -ENODEV; ++ !i2c_of_match_device(dev->driver->of_match_table, client)) { ++ status = -ENODEV; ++ goto put_sync_adapter; ++ } + + if (client->flags & I2C_CLIENT_WAKE) { + int wakeirq; + + wakeirq = of_irq_get_byname(dev->of_node, "wakeup"); +- if (wakeirq == -EPROBE_DEFER) +- return wakeirq; ++ if (wakeirq == -EPROBE_DEFER) { ++ status = wakeirq; ++ goto put_sync_adapter; ++ } + + device_init_wakeup(&client->dev, true); + +@@ -408,6 +414,10 @@ err_detach_pm_domain: + err_clear_wakeup_irq: + dev_pm_clear_wake_irq(&client->dev); + device_init_wakeup(&client->dev, false); ++put_sync_adapter: ++ if (client->flags & I2C_CLIENT_HOST_NOTIFY) ++ pm_runtime_put_sync(&client->adapter->dev); ++ + return status; + } + +-- +2.25.1 + diff --git a/queue-5.6/i2c-mux-demux-pinctrl-fix-an-error-handling-path-in-.patch b/queue-5.6/i2c-mux-demux-pinctrl-fix-an-error-handling-path-in-.patch new file mode 100644 index 00000000000..1b4226602dd --- /dev/null +++ b/queue-5.6/i2c-mux-demux-pinctrl-fix-an-error-handling-path-in-.patch @@ -0,0 +1,36 @@ +From c30265e8117e3a658565a3902ebe7fded583f432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 May 2020 21:21:00 +0200 +Subject: i2c: mux: demux-pinctrl: Fix an error handling path in + 'i2c_demux_pinctrl_probe()' + +From: Christophe JAILLET + +[ Upstream commit e9d1a0a41d4486955e96552293c1fcf1fce61602 ] + +A call to 'i2c_demux_deactivate_master()' is missing in the error handling +path, as already done in the remove function. + +Fixes: 50a5ba876908 ("i2c: mux: demux-pinctrl: add driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 0e16490eb3a1..5365199a31f4 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -272,6 +272,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); + err_rollback: ++ i2c_demux_deactivate_master(priv); + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +-- +2.25.1 + diff --git a/queue-5.6/ibmvnic-skip-fatal-error-reset-after-passive-init.patch b/queue-5.6/ibmvnic-skip-fatal-error-reset-after-passive-init.patch new file mode 100644 index 00000000000..4020de8a7d5 --- /dev/null +++ b/queue-5.6/ibmvnic-skip-fatal-error-reset-after-passive-init.patch @@ -0,0 +1,50 @@ +From 4eb698950ba24e63d63026c26998c17f81ee6585 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 13:22:11 -0500 +Subject: ibmvnic: Skip fatal error reset after passive init +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juliet Kim + +[ Upstream commit f9c6cea0b38518741c8dcf26ac056d26ee2fd61d ] + +During MTU change, the following events may happen. +Client-driven CRQ initialization fails due to partner’s CRQ closed, +causing client to enqueue a reset task for FATAL_ERROR. Then passive +(server-driven) CRQ initialization succeeds, causing client to +release CRQ and enqueue a reset task for failover. If the passive +CRQ initialization occurs before the FATAL reset task is processed, +the FATAL error reset task would try to access a CRQ message queue +that was freed, causing an oops. The problem may be most likely to +occur during DLPAR add vNIC with a non-default MTU, because the DLPAR +process will automatically issue a change MTU request. + +Fix this by not processing fatal error reset if CRQ is passively +initialized after client-driven CRQ initialization fails. + +Signed-off-by: Juliet Kim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 4bd33245bad6..3de549c6c693 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2189,7 +2189,8 @@ static void __ibmvnic_reset(struct work_struct *work) + rc = do_hard_reset(adapter, rwi, reset_state); + rtnl_unlock(); + } +- } else { ++ } else if (!(rwi->reset_reason == VNIC_RESET_FATAL && ++ adapter->from_passive_init)) { + rc = do_reset(adapter, rwi, reset_state); + } + kfree(rwi); +-- +2.25.1 + diff --git a/queue-5.6/ima-fix-return-value-of-ima_write_policy.patch b/queue-5.6/ima-fix-return-value-of-ima_write_policy.patch new file mode 100644 index 00000000000..688b3e5de04 --- /dev/null +++ b/queue-5.6/ima-fix-return-value-of-ima_write_policy.patch @@ -0,0 +1,43 @@ +From ef79165898edec2a4fcb7bc84c74f5d844b03fe4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 12:31:28 +0200 +Subject: ima: Fix return value of ima_write_policy() + +From: Roberto Sassu + +[ Upstream commit 2e3a34e9f409ebe83d1af7cd2f49fca7af97dfac ] + +This patch fixes the return value of ima_write_policy() when a new policy +is directly passed to IMA and the current policy requires appraisal of the +file containing the policy. Currently, if appraisal is not in ENFORCE mode, +ima_write_policy() returns 0 and leads user space applications to an +endless loop. Fix this issue by denying the operation regardless of the +appraisal mode. + +Cc: stable@vger.kernel.org # 4.10.x +Fixes: 19f8a84713edc ("ima: measure and appraise the IMA policy itself") +Signed-off-by: Roberto Sassu +Reviewed-by: Krzysztof Struczynski +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_fs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c +index 2000e8df0301..68571c40d61f 100644 +--- a/security/integrity/ima/ima_fs.c ++++ b/security/integrity/ima/ima_fs.c +@@ -340,8 +340,7 @@ static ssize_t ima_write_policy(struct file *file, const char __user *buf, + integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL, NULL, + "policy_update", "signed policy required", + 1, 0); +- if (ima_appraise & IMA_APPRAISE_ENFORCE) +- result = -EACCES; ++ result = -EACCES; + } else { + result = ima_parse_add_rule(data); + } +-- +2.25.1 + diff --git a/queue-5.6/ima-set-file-f_mode-instead-of-file-f_flags-in-ima_c.patch b/queue-5.6/ima-set-file-f_mode-instead-of-file-f_flags-in-ima_c.patch new file mode 100644 index 00000000000..1bdebbc5266 --- /dev/null +++ b/queue-5.6/ima-set-file-f_mode-instead-of-file-f_flags-in-ima_c.patch @@ -0,0 +1,73 @@ +From 75fc1f3b72805a0b86baa144a4784a2e0696f944 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 12:28:55 +0200 +Subject: ima: Set file->f_mode instead of file->f_flags in + ima_calc_file_hash() + +From: Roberto Sassu + +[ Upstream commit 0014cc04e8ec077dc482f00c87dfd949cfe2b98f ] + +Commit a408e4a86b36 ("ima: open a new file instance if no read +permissions") tries to create a new file descriptor to calculate a file +digest if the file has not been opened with O_RDONLY flag. However, if a +new file descriptor cannot be obtained, it sets the FMODE_READ flag to +file->f_flags instead of file->f_mode. + +This patch fixes this issue by replacing f_flags with f_mode as it was +before that commit. + +Cc: stable@vger.kernel.org # 4.20.x +Fixes: a408e4a86b36 ("ima: open a new file instance if no read permissions") +Signed-off-by: Roberto Sassu +Reviewed-by: Goldwyn Rodrigues +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_crypto.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index 7967a6904851..e8fa23cd4a6c 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -413,7 +413,7 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + loff_t i_size; + int rc; + struct file *f = file; +- bool new_file_instance = false, modified_flags = false; ++ bool new_file_instance = false, modified_mode = false; + + /* + * For consistency, fail file's opened with the O_DIRECT flag on +@@ -433,13 +433,13 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + f = dentry_open(&file->f_path, flags, file->f_cred); + if (IS_ERR(f)) { + /* +- * Cannot open the file again, lets modify f_flags ++ * Cannot open the file again, lets modify f_mode + * of original and continue + */ + pr_info_ratelimited("Unable to reopen file for reading.\n"); + f = file; +- f->f_flags |= FMODE_READ; +- modified_flags = true; ++ f->f_mode |= FMODE_READ; ++ modified_mode = true; + } else { + new_file_instance = true; + } +@@ -457,8 +457,8 @@ int ima_calc_file_hash(struct file *file, struct ima_digest_data *hash) + out: + if (new_file_instance) + fput(f); +- else if (modified_flags) +- f->f_flags &= ~FMODE_READ; ++ else if (modified_mode) ++ f->f_mode &= ~FMODE_READ; + return rc; + } + +-- +2.25.1 + diff --git a/queue-5.6/iommu-amd-call-domain_flush_complete-in-update_domai.patch b/queue-5.6/iommu-amd-call-domain_flush_complete-in-update_domai.patch new file mode 100644 index 00000000000..6bca3221095 --- /dev/null +++ b/queue-5.6/iommu-amd-call-domain_flush_complete-in-update_domai.patch @@ -0,0 +1,37 @@ +From 535b2653bb949dc787852549e68cbe09af9ae9d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2020 14:54:11 +0200 +Subject: iommu/amd: Call domain_flush_complete() in update_domain() + +From: Joerg Roedel + +[ Upstream commit f44a4d7e4f1cdef73c90b1dc749c4d8a7372a8eb ] + +The update_domain() function is expected to also inform the hardware +about domain changes. This needs a COMPLETION_WAIT command to be sent +to all IOMMUs which use the domain. + +Signed-off-by: Joerg Roedel +Tested-by: Qian Cai +Link: https://lore.kernel.org/r/20200504125413.16798-4-joro@8bytes.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 18c995a16d80..2aa46a6de172 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2345,6 +2345,7 @@ static void update_domain(struct protection_domain *domain) + + /* Flush domain TLB(s) and wait for completion */ + domain_flush_tlb_pde(domain); ++ domain_flush_complete(domain); + } + + int __init amd_iommu_init_api(void) +-- +2.25.1 + diff --git a/queue-5.6/iommu-amd-do-not-loop-forever-when-trying-to-increas.patch b/queue-5.6/iommu-amd-do-not-loop-forever-when-trying-to-increas.patch new file mode 100644 index 00000000000..c223c99c0f8 --- /dev/null +++ b/queue-5.6/iommu-amd-do-not-loop-forever-when-trying-to-increas.patch @@ -0,0 +1,50 @@ +From e9d63b9fb8423db31ebc70979e28cbd7ad90c238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2020 14:54:10 +0200 +Subject: iommu/amd: Do not loop forever when trying to increase address space + +From: Joerg Roedel + +[ Upstream commit 5b8a9a047b6cad361405c7900c1e1cdd378c4589 ] + +When increase_address_space() fails to allocate memory, alloc_pte() +will call it again until it succeeds. Do not loop forever while trying +to increase the address space and just return an error instead. + +Signed-off-by: Joerg Roedel +Tested-by: Qian Cai +Link: https://lore.kernel.org/r/20200504125413.16798-3-joro@8bytes.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 1d8634250afc..18c995a16d80 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -1500,8 +1500,19 @@ static u64 *alloc_pte(struct protection_domain *domain, + amd_iommu_domain_get_pgtable(domain, &pgtable); + + while (address > PM_LEVEL_SIZE(pgtable.mode)) { +- *updated = increase_address_space(domain, address, gfp) || *updated; ++ bool upd = increase_address_space(domain, address, gfp); ++ ++ /* Read new values to check if update was successful */ + amd_iommu_domain_get_pgtable(domain, &pgtable); ++ ++ /* ++ * Return an error if there is no memory to update the ++ * page-table. ++ */ ++ if (!upd && (address > PM_LEVEL_SIZE(pgtable.mode))) ++ return NULL; ++ ++ *updated = *updated || upd; + } + + +-- +2.25.1 + diff --git a/queue-5.6/iommu-amd-fix-get_acpihid_device_id.patch b/queue-5.6/iommu-amd-fix-get_acpihid_device_id.patch new file mode 100644 index 00000000000..13a67de8306 --- /dev/null +++ b/queue-5.6/iommu-amd-fix-get_acpihid_device_id.patch @@ -0,0 +1,44 @@ +From 681d42a6634a217432b03ea2f49e4773ecc2a2e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 May 2020 10:33:36 -0600 +Subject: iommu/amd: Fix get_acpihid_device_id() + +From: Raul E Rangel + +[ Upstream commit ea90228c7b2ae6646bb6381385229aabb6f14cd2 ] + +acpi_dev_hid_uid_match() expects a null pointer for UID if it doesn't +exist. The acpihid_map_entry contains a char buffer for holding the +UID. If no UID was provided in the IVRS table, this buffer will be +zeroed. If we pass in a null string, acpi_dev_hid_uid_match() will +return false because it will try and match an empty string to the ACPI +UID of the device. + +Fixes: ae5e6c6439c3 ("iommu/amd: Switch to use acpi_dev_hid_uid_match()") +Suggested-by: Andy Shevchenko +Signed-off-by: Raul E Rangel +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20200511103229.v2.1.I6f1b6f973ee6c8af1348611370c73a0ec0ea53f1@changeid +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 500d0a8c966f..1d8634250afc 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -127,7 +127,8 @@ static inline int get_acpihid_device_id(struct device *dev, + return -ENODEV; + + list_for_each_entry(p, &acpihid_map, list) { +- if (acpi_dev_hid_uid_match(adev, p->hid, p->uid)) { ++ if (acpi_dev_hid_uid_match(adev, p->hid, ++ p->uid[0] ? p->uid : NULL)) { + if (entry) + *entry = p; + return p->devid; +-- +2.25.1 + diff --git a/queue-5.6/iommu-amd-fix-over-read-of-acpi-uid-from-ivrs-table.patch b/queue-5.6/iommu-amd-fix-over-read-of-acpi-uid-from-ivrs-table.patch new file mode 100644 index 00000000000..f8fab0ba8a7 --- /dev/null +++ b/queue-5.6/iommu-amd-fix-over-read-of-acpi-uid-from-ivrs-table.patch @@ -0,0 +1,82 @@ +From 5ec3cfdc475b9808403c11c40d8bbe8f6782f809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 May 2020 10:23:52 +0000 +Subject: iommu/amd: Fix over-read of ACPI UID from IVRS table + +From: Alexander Monakov + +[ Upstream commit e461b8c991b9202b007ea2059d953e264240b0c9 ] + +IVRS parsing code always tries to read 255 bytes from memory when +retrieving ACPI device path, and makes an assumption that firmware +provides a zero-terminated string. Both of those are bugs: the entry +is likely to be shorter than 255 bytes, and zero-termination is not +guaranteed. + +With Acer SF314-42 firmware these issues manifest visibly in dmesg: + +AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR0\xf0\xa5, rdevid:160 +AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR1\xf0\xa5, rdevid:160 +AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR2\xf0\xa5, rdevid:160 +AMD-Vi: ivrs, add hid:AMDI0020, uid:\_SB.FUR3>\x83e\x8d\x9a\xd1... + +The first three lines show how the code over-reads adjacent table +entries into the UID, and in the last line it even reads garbage data +beyond the end of the IVRS table itself. + +Since each entry has the length of the UID (uidl member of ivhd_entry +struct), use that for memcpy, and manually add a zero terminator. + +Avoid zero-filling hid and uid arrays up front, and instead ensure +the uid array is always zero-terminated. No change needed for the hid +array, as it was already properly zero-terminated. + +Fixes: 2a0cb4e2d423c ("iommu/amd: Add new map for storing IVHD dev entry type HID") + +Signed-off-by: Alexander Monakov +Cc: Joerg Roedel +Cc: iommu@lists.linux-foundation.org +Link: https://lore.kernel.org/r/20200511102352.1831-1-amonakov@ispras.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_init.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c +index 2b9a67ecc6ac..5b81fd16f5fa 100644 +--- a/drivers/iommu/amd_iommu_init.c ++++ b/drivers/iommu/amd_iommu_init.c +@@ -1329,8 +1329,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + } + case IVHD_DEV_ACPI_HID: { + u16 devid; +- u8 hid[ACPIHID_HID_LEN] = {0}; +- u8 uid[ACPIHID_UID_LEN] = {0}; ++ u8 hid[ACPIHID_HID_LEN]; ++ u8 uid[ACPIHID_UID_LEN]; + int ret; + + if (h->type != 0x40) { +@@ -1347,6 +1347,7 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + break; + } + ++ uid[0] = '\0'; + switch (e->uidf) { + case UID_NOT_PRESENT: + +@@ -1361,8 +1362,8 @@ static int __init init_iommu_from_acpi(struct amd_iommu *iommu, + break; + case UID_IS_CHARACTER: + +- memcpy(uid, (u8 *)(&e->uid), ACPIHID_UID_LEN - 1); +- uid[ACPIHID_UID_LEN - 1] = '\0'; ++ memcpy(uid, &e->uid, e->uidl); ++ uid[e->uidl] = '\0'; + + break; + default: +-- +2.25.1 + diff --git a/queue-5.6/iommu-fix-deferred-domain-attachment.patch b/queue-5.6/iommu-fix-deferred-domain-attachment.patch new file mode 100644 index 00000000000..ad37af69d36 --- /dev/null +++ b/queue-5.6/iommu-fix-deferred-domain-attachment.patch @@ -0,0 +1,90 @@ +From b890b33803d03c9f9886be7eb481d9bd0f878645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 May 2020 15:03:40 +0200 +Subject: iommu: Fix deferred domain attachment + +From: Joerg Roedel + +[ Upstream commit bd421264ed307dd296eab036851221b225071a32 ] + +The IOMMU core code has support for deferring the attachment of a domain +to a device. This is needed in kdump kernels where the new domain must +not be attached to a device before the device driver takes it over. + +When the AMD IOMMU driver got converted to use the dma-iommu +implementation, the deferred attaching got lost. The code in +dma-iommu.c has support for deferred attaching, but it calls into +iommu_attach_device() to actually do it. But iommu_attach_device() +will check if the device should be deferred in it code-path and do +nothing, breaking deferred attachment. + +Move the is_deferred_attach() check out of the attach_device path and +into iommu_group_add_device() to make deferred attaching work from the +dma-iommu code. + +Fixes: 795bbbb9b6f8 ("iommu/dma-iommu: Handle deferred devices") +Reported-by: Jerry Snitselaar +Suggested-by: Robin Murphy +Signed-off-by: Joerg Roedel +Tested-by: Jerry Snitselaar +Cc: Jerry Snitselaar +Cc: Tom Murphy +Cc: Robin Murphy +Link: https://lore.kernel.org/r/20200519130340.14564-1-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 8d2477941fd9..22b28076d48e 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -692,6 +692,15 @@ out: + return ret; + } + ++static bool iommu_is_attach_deferred(struct iommu_domain *domain, ++ struct device *dev) ++{ ++ if (domain->ops->is_attach_deferred) ++ return domain->ops->is_attach_deferred(domain, dev); ++ ++ return false; ++} ++ + /** + * iommu_group_add_device - add a device to an iommu group + * @group: the group into which to add the device (reference should be held) +@@ -746,7 +755,7 @@ rename: + + mutex_lock(&group->mutex); + list_add_tail(&device->list, &group->devices); +- if (group->domain) ++ if (group->domain && !iommu_is_attach_deferred(group->domain, dev)) + ret = __iommu_attach_device(group->domain, dev); + mutex_unlock(&group->mutex); + if (ret) +@@ -1652,9 +1661,6 @@ static int __iommu_attach_device(struct iommu_domain *domain, + struct device *dev) + { + int ret; +- if ((domain->ops->is_attach_deferred != NULL) && +- domain->ops->is_attach_deferred(domain, dev)) +- return 0; + + if (unlikely(domain->ops->attach_dev == NULL)) + return -ENODEV; +@@ -1726,8 +1732,7 @@ EXPORT_SYMBOL_GPL(iommu_sva_unbind_gpasid); + static void __iommu_detach_device(struct iommu_domain *domain, + struct device *dev) + { +- if ((domain->ops->is_attach_deferred != NULL) && +- domain->ops->is_attach_deferred(domain, dev)) ++ if (iommu_is_attach_deferred(domain, dev)) + return; + + if (unlikely(domain->ops->detach_dev == NULL)) +-- +2.25.1 + diff --git a/queue-5.6/kbuild-avoid-concurrency-issue-in-parallel-building-.patch b/queue-5.6/kbuild-avoid-concurrency-issue-in-parallel-building-.patch new file mode 100644 index 00000000000..f82ab9b3d8f --- /dev/null +++ b/queue-5.6/kbuild-avoid-concurrency-issue-in-parallel-building-.patch @@ -0,0 +1,87 @@ +From e93e0edb29243564e694ac81d05574a1d84a45ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 12:20:36 +0900 +Subject: kbuild: avoid concurrency issue in parallel building dtbs and + dtbs_check + +From: Masahiro Yamada + +[ Upstream commit b5154bf63e5577faaaca1d942df274f7de91dd2a ] + +'make dtbs_check' checks the shecma in addition to building *.dtb files, +in other words, 'make dtbs_check' is a super-set of 'make dtbs'. +So, you do not have to do 'make dtbs dtbs_check', but I want to keep +the build system as robust as possible in any use. + +Currently, 'dtbs' and 'dtbs_check' are independent of each other. +In parallel building, two threads descend into arch/*/boot/dts/, +one for dtbs and the other for dtbs_check, then end up with building +the same DTB simultaneously. + +This commit fixes the concurrency issue. Otherwise, I see build errors +like follows: + +$ make ARCH=arm64 defconfig +$ make -j16 ARCH=arm64 DT_SCHEMA_FILES=Documentation/devicetree/bindings/arm/psci.yaml dtbs dtbs_check + + DTC arch/arm64/boot/dts/qcom/sdm845-cheza-r2.dtb + DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905x-p212.dtb + DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb + DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb + DTC arch/arm64/boot/dts/freescale/imx8mn-evk.dtb + DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb + DTC arch/arm64/boot/dts/zte/zx296718-pcbox.dtb + DTC arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml + DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dtb + DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1254-revA.dtb + DTC arch/arm64/boot/dts/allwinner/sun50i-h6-pine-h64.dtb + DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-inx.dtb + DTC arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb + CHECK arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dt.yaml +fixdep: error opening file: arch/arm64/boot/dts/allwinner/.sun50i-h6-orangepi-lite2.dtb.d: No such file or directory +make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb] Error 2 +make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-lite2.dtb' +make[2]: *** Waiting for unfinished jobs.... + DTC arch/arm64/boot/dts/rockchip/rk3399-gru-scarlet-kd.dtb + DTC arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p231.dtb + DTC arch/arm64/boot/dts/xilinx/zynqmp-zc1275-revA.dtb + DTC arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dtb +fixdep: parse error; no targets found +make[2]: *** [scripts/Makefile.lib:296: arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb] Error 1 +make[2]: *** Deleting file 'arch/arm64/boot/dts/allwinner/sun50i-h6-orangepi-one-plus.dtb' +make[1]: *** [scripts/Makefile.build:505: arch/arm64/boot/dts/allwinner] Error 2 +make[1]: *** Waiting for unfinished jobs.... + DTC arch/arm64/boot/dts/renesas/r8a77951-salvator-xs.dtb + +Signed-off-by: Masahiro Yamada +Reviewed-by: Rob Herring +Signed-off-by: Sasha Levin +--- + Makefile | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/Makefile b/Makefile +index 713f93cceffe..d00e14219e27 100644 +--- a/Makefile ++++ b/Makefile +@@ -1248,11 +1248,15 @@ ifneq ($(dtstree),) + $(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@ + + PHONY += dtbs dtbs_install dtbs_check +-dtbs dtbs_check: include/config/kernel.release scripts_dtc ++dtbs: include/config/kernel.release scripts_dtc + $(Q)$(MAKE) $(build)=$(dtstree) + ++ifneq ($(filter dtbs_check, $(MAKECMDGOALS)),) ++dtbs: dt_binding_check ++endif ++ + dtbs_check: export CHECK_DTBS=1 +-dtbs_check: dt_binding_check ++dtbs_check: dtbs + + dtbs_install: + $(Q)$(MAKE) $(dtbinst)=$(dtstree) +-- +2.25.1 + diff --git a/queue-5.6/kvm-selftests-fix-build-for-evmcs.h.patch b/queue-5.6/kvm-selftests-fix-build-for-evmcs.h.patch new file mode 100644 index 00000000000..38eed4eb859 --- /dev/null +++ b/queue-5.6/kvm-selftests-fix-build-for-evmcs.h.patch @@ -0,0 +1,60 @@ +From 07570b1a6630f7674791356ee729022465b9aff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2020 18:06:07 -0400 +Subject: KVM: selftests: Fix build for evmcs.h + +From: Peter Xu + +[ Upstream commit 8ffdaf9155ebe517cdec5edbcca19ba6e7ee9c3c ] + +I got this error when building kvm selftests: + +/usr/bin/ld: /home/xz/git/linux/tools/testing/selftests/kvm/libkvm.a(vmx.o):/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:222: multiple definition of `current_evmcs'; /tmp/cco1G48P.o:/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:222: first defined here +/usr/bin/ld: /home/xz/git/linux/tools/testing/selftests/kvm/libkvm.a(vmx.o):/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:223: multiple definition of `current_vp_assist'; /tmp/cco1G48P.o:/home/xz/git/linux/tools/testing/selftests/kvm/include/evmcs.h:223: first defined here + +I think it's because evmcs.h is included both in a test file and a lib file so +the structs have multiple declarations when linking. After all it's not a good +habit to declare structs in the header files. + +Cc: Vitaly Kuznetsov +Signed-off-by: Peter Xu +Message-Id: <20200504220607.99627-1-peterx@redhat.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/include/evmcs.h | 4 ++-- + tools/testing/selftests/kvm/lib/x86_64/vmx.c | 3 +++ + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/kvm/include/evmcs.h b/tools/testing/selftests/kvm/include/evmcs.h +index 4912d23844bc..e31ac9c5ead0 100644 +--- a/tools/testing/selftests/kvm/include/evmcs.h ++++ b/tools/testing/selftests/kvm/include/evmcs.h +@@ -217,8 +217,8 @@ struct hv_enlightened_vmcs { + #define HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_MASK \ + (~((1ull << HV_X64_MSR_VP_ASSIST_PAGE_ADDRESS_SHIFT) - 1)) + +-struct hv_enlightened_vmcs *current_evmcs; +-struct hv_vp_assist_page *current_vp_assist; ++extern struct hv_enlightened_vmcs *current_evmcs; ++extern struct hv_vp_assist_page *current_vp_assist; + + int vcpu_enable_evmcs(struct kvm_vm *vm, int vcpu_id); + +diff --git a/tools/testing/selftests/kvm/lib/x86_64/vmx.c b/tools/testing/selftests/kvm/lib/x86_64/vmx.c +index 7aaa99ca4dbc..ce528f3cf093 100644 +--- a/tools/testing/selftests/kvm/lib/x86_64/vmx.c ++++ b/tools/testing/selftests/kvm/lib/x86_64/vmx.c +@@ -17,6 +17,9 @@ + + bool enable_evmcs; + ++struct hv_enlightened_vmcs *current_evmcs; ++struct hv_vp_assist_page *current_vp_assist; ++ + struct eptPageTableEntry { + uint64_t readable:1; + uint64_t writable:1; +-- +2.25.1 + diff --git a/queue-5.6/mtd-fix-mtd-not-registered-due-to-nvmem-name-collisi.patch b/queue-5.6/mtd-fix-mtd-not-registered-due-to-nvmem-name-collisi.patch new file mode 100644 index 00000000000..c9004d64952 --- /dev/null +++ b/queue-5.6/mtd-fix-mtd-not-registered-due-to-nvmem-name-collisi.patch @@ -0,0 +1,60 @@ +From 1c3d1a761ce0dbad8d7b2d07cbdcce5ffb14d9d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 15:17:21 +0200 +Subject: mtd: Fix mtd not registered due to nvmem name collision + +From: Ricardo Ribalda Delgado + +[ Upstream commit 7b01b7239d0dc9832e0d0d23605c1ff047422a2c ] + +When the nvmem framework is enabled, a nvmem device is created per mtd +device/partition. + +It is not uncommon that a device can have multiple mtd devices with +partitions that have the same name. Eg, when there DT overlay is allowed +and the same device with mtd is attached twice. + +Under that circumstances, the mtd fails to register due to a name +duplication on the nvmem framework. + +With this patch we use the mtdX name instead of the partition name, +which is unique. + +[ 8.948991] sysfs: cannot create duplicate filename '/bus/nvmem/devices/Production Data' +[ 8.948992] CPU: 7 PID: 246 Comm: systemd-udevd Not tainted 5.5.0-qtec-standard #13 +[ 8.948993] Hardware name: AMD Dibbler/Dibbler, BIOS 05.22.04.0019 10/26/2019 +[ 8.948994] Call Trace: +[ 8.948996] dump_stack+0x50/0x70 +[ 8.948998] sysfs_warn_dup.cold+0x17/0x2d +[ 8.949000] sysfs_do_create_link_sd.isra.0+0xc2/0xd0 +[ 8.949002] bus_add_device+0x74/0x140 +[ 8.949004] device_add+0x34b/0x850 +[ 8.949006] nvmem_register.part.0+0x1bf/0x640 +... +[ 8.948926] mtd mtd8: Failed to register NVMEM device + +Fixes: c4dfa25ab307 ("mtd: add support for reading MTD devices via the nvmem API") +Signed-off-by: Ricardo Ribalda Delgado +Acked-by: Miquel Raynal +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdcore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c +index 5fac4355b9c2..559b6930b6f6 100644 +--- a/drivers/mtd/mtdcore.c ++++ b/drivers/mtd/mtdcore.c +@@ -551,7 +551,7 @@ static int mtd_nvmem_add(struct mtd_info *mtd) + + config.id = -1; + config.dev = &mtd->dev; +- config.name = mtd->name; ++ config.name = dev_name(&mtd->dev); + config.owner = THIS_MODULE; + config.reg_read = mtd_nvmem_reg_read; + config.size = mtd->size; +-- +2.25.1 + diff --git a/queue-5.6/mtd-spinand-propagate-ecc-information-to-the-mtd-str.patch b/queue-5.6/mtd-spinand-propagate-ecc-information-to-the-mtd-str.patch new file mode 100644 index 00000000000..456e8adc0b5 --- /dev/null +++ b/queue-5.6/mtd-spinand-propagate-ecc-information-to-the-mtd-str.patch @@ -0,0 +1,41 @@ +From d15dda59d3b37331b2c1111452ce6eb9319d73b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 May 2020 15:10:29 +0200 +Subject: mtd: spinand: Propagate ECC information to the MTD structure + +From: Miquel Raynal + +[ Upstream commit 3507273d5a4d3c2e46f9d3f9ed9449805f5dff07 ] + +This is done by default in the raw NAND core (nand_base.c) but was +missing in the SPI-NAND core. Without these two lines the ecc_strength +and ecc_step_size values are not exported to the user through sysfs. + +Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Reviewed-by: Boris Brezillon +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index 8dda51bbdd11..0d21c68bfe24 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -1049,6 +1049,10 @@ static int spinand_init(struct spinand_device *spinand) + + mtd->oobavail = ret; + ++ /* Propagate ECC information to mtd_info */ ++ mtd->ecc_strength = nand->eccreq.strength; ++ mtd->ecc_step_size = nand->eccreq.step_size; ++ + return 0; + + err_cleanup_nanddev: +-- +2.25.1 + diff --git a/queue-5.6/net-drop_monitor-use-is_reachable-to-guard-net_dm_hw.patch b/queue-5.6/net-drop_monitor-use-is_reachable-to-guard-net_dm_hw.patch new file mode 100644 index 00000000000..c9cf7101828 --- /dev/null +++ b/queue-5.6/net-drop_monitor-use-is_reachable-to-guard-net_dm_hw.patch @@ -0,0 +1,43 @@ +From 0626ceef83c1791ba36804fb49fb50c013dc1436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 15:29:25 +0900 +Subject: net: drop_monitor: use IS_REACHABLE() to guard net_dm_hw_report() + +From: Masahiro Yamada + +[ Upstream commit 1cd9b3abf5332102d4d967555e7ed861a75094bf ] + +In net/Kconfig, NET_DEVLINK implies NET_DROP_MONITOR. + +The original behavior of the 'imply' keyword prevents NET_DROP_MONITOR +from being 'm' when NET_DEVLINK=y. + +With the planned Kconfig change that relaxes the 'imply', the +combination of NET_DEVLINK=y and NET_DROP_MONITOR=m would be allowed. + +Use IS_REACHABLE() to avoid the vmlinux link error for this case. + +Reported-by: Stephen Rothwell +Signed-off-by: Masahiro Yamada +Acked-by: Neil Horman +Signed-off-by: Sasha Levin +--- + include/net/drop_monitor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/drop_monitor.h b/include/net/drop_monitor.h +index 2ab668461463..f68bc373544a 100644 +--- a/include/net/drop_monitor.h ++++ b/include/net/drop_monitor.h +@@ -19,7 +19,7 @@ struct net_dm_hw_metadata { + struct net_device *input_dev; + }; + +-#if IS_ENABLED(CONFIG_NET_DROP_MONITOR) ++#if IS_REACHABLE(CONFIG_NET_DROP_MONITOR) + void net_dm_hw_report(struct sk_buff *skb, + const struct net_dm_hw_metadata *hw_metadata); + #else +-- +2.25.1 + diff --git a/queue-5.6/net-ena-fix-build-warning-in-ena_xdp_set.patch b/queue-5.6/net-ena-fix-build-warning-in-ena_xdp_set.patch new file mode 100644 index 00000000000..b7a352a2a25 --- /dev/null +++ b/queue-5.6/net-ena-fix-build-warning-in-ena_xdp_set.patch @@ -0,0 +1,51 @@ +From 753fa945ce0a112cf3ca8ffd44e26e22d788de82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Apr 2020 14:49:45 +1000 +Subject: net/ena: Fix build warning in ena_xdp_set() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gavin Shan + +[ Upstream commit caec66198d137c26f0d234abc498866a58c64150 ] + +This fixes the following build warning in ena_xdp_set(), which is +observed on aarch64 with 64KB page size. + + In file included from ./include/net/inet_sock.h:19, + from ./include/net/ip.h:27, + from drivers/net/ethernet/amazon/ena/ena_netdev.c:46: + drivers/net/ethernet/amazon/ena/ena_netdev.c: In function \ + ‘ena_xdp_set’: \ + drivers/net/ethernet/amazon/ena/ena_netdev.c:557:6: warning: \ + format ‘%lu’ \ + expects argument of type ‘long unsigned int’, but argument 4 \ + has type ‘int’ \ + [-Wformat=] "Failed to set xdp program, the current MTU (%d) is \ + larger than the maximum allowed MTU (%lu) while xdp is on", + +Signed-off-by: Gavin Shan +Acked-by: Shay Agroskin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.h b/drivers/net/ethernet/amazon/ena/ena_netdev.h +index 8795e0b1dc3c..8984aa211112 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h +@@ -69,7 +69,7 @@ + * 16kB. + */ + #if PAGE_SIZE > SZ_16K +-#define ENA_PAGE_SIZE SZ_16K ++#define ENA_PAGE_SIZE (_AC(SZ_16K, UL)) + #else + #define ENA_PAGE_SIZE PAGE_SIZE + #endif +-- +2.25.1 + diff --git a/queue-5.6/ovl-potential-crash-in-ovl_fid_to_fh.patch b/queue-5.6/ovl-potential-crash-in-ovl_fid_to_fh.patch new file mode 100644 index 00000000000..6f765e90e2a --- /dev/null +++ b/queue-5.6/ovl-potential-crash-in-ovl_fid_to_fh.patch @@ -0,0 +1,55 @@ +From 989f4d879a072ca1fa2f5ee7b790945ae00fd474 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 May 2020 21:33:31 +0300 +Subject: ovl: potential crash in ovl_fid_to_fh() + +From: Dan Carpenter + +[ Upstream commit 9aafc1b0187322fa4fd4eb905d0903172237206c ] + +The "buflen" value comes from the user and there is a potential that it +could be zero. In do_handle_to_path() we know that "handle->handle_bytes" +is non-zero and we do: + + handle_dwords = handle->handle_bytes >> 2; + +So values 1-3 become zero. Then in ovl_fh_to_dentry() we do: + + int len = fh_len << 2; + +So now len is in the "0,4-128" range and a multiple of 4. But if +"buflen" is zero it will try to copy negative bytes when we do the +memcpy in ovl_fid_to_fh(). + + memcpy(&fh->fb, fid, buflen - OVL_FH_WIRE_OFFSET); + +And that will lead to a crash. Thanks to Amir Goldstein for his help +with this patch. + +Fixes: cbe7fba8edfc ("ovl: make sure that real fid is 32bit aligned in memory") +Signed-off-by: Dan Carpenter +Reviewed-by: Amir Goldstein +Cc: # v5.5 +Signed-off-by: Miklos Szeredi +Signed-off-by: Sasha Levin +--- + fs/overlayfs/export.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/overlayfs/export.c b/fs/overlayfs/export.c +index 6f54d70cef27..e605017031ee 100644 +--- a/fs/overlayfs/export.c ++++ b/fs/overlayfs/export.c +@@ -777,6 +777,9 @@ static struct ovl_fh *ovl_fid_to_fh(struct fid *fid, int buflen, int fh_type) + if (fh_type != OVL_FILEID_V0) + return ERR_PTR(-EINVAL); + ++ if (buflen <= OVL_FH_WIRE_OFFSET) ++ return ERR_PTR(-EINVAL); ++ + fh = kzalloc(buflen, GFP_KERNEL); + if (!fh) + return ERR_PTR(-ENOMEM); +-- +2.25.1 + diff --git a/queue-5.6/pipe-fix-pipe_full-test-in-opipe_prep.patch b/queue-5.6/pipe-fix-pipe_full-test-in-opipe_prep.patch new file mode 100644 index 00000000000..5f5d383c3be --- /dev/null +++ b/queue-5.6/pipe-fix-pipe_full-test-in-opipe_prep.patch @@ -0,0 +1,59 @@ +From efadde7aaa7c444a1711c973d9c2e4280fc5fadc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 May 2020 08:51:59 +0900 +Subject: pipe: Fix pipe_full() test in opipe_prep(). + +From: Tetsuo Handa + +[ Upstream commit 566d136289dc57816ac290de87a9a0f7d9bd3cbb ] + +syzbot is reporting that splice()ing from non-empty read side to +already-full write side causes unkillable task, for opipe_prep() is by +error not inverting pipe_full() test. + + CPU: 0 PID: 9460 Comm: syz-executor.5 Not tainted 5.6.0-rc3-next-20200228-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + RIP: 0010:rol32 include/linux/bitops.h:105 [inline] + RIP: 0010:iterate_chain_key kernel/locking/lockdep.c:369 [inline] + RIP: 0010:__lock_acquire+0x6a3/0x5270 kernel/locking/lockdep.c:4178 + Call Trace: + lock_acquire+0x197/0x420 kernel/locking/lockdep.c:4720 + __mutex_lock_common kernel/locking/mutex.c:956 [inline] + __mutex_lock+0x156/0x13c0 kernel/locking/mutex.c:1103 + pipe_lock_nested fs/pipe.c:66 [inline] + pipe_double_lock+0x1a0/0x1e0 fs/pipe.c:104 + splice_pipe_to_pipe fs/splice.c:1562 [inline] + do_splice+0x35f/0x1520 fs/splice.c:1141 + __do_sys_splice fs/splice.c:1447 [inline] + __se_sys_splice fs/splice.c:1427 [inline] + __x64_sys_splice+0x2b5/0x320 fs/splice.c:1427 + do_syscall_64+0xf6/0x790 arch/x86/entry/common.c:295 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Reported-by: syzbot+b48daca8639150bc5e73@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=9386d051e11e09973d5a4cf79af5e8cedf79386d +Fixes: 8cefc107ca54c8b0 ("pipe: Use head and tail pointers for the ring, not cursor and length") +Cc: stable@vger.kernel.org # 5.5+ +Signed-off-by: Tetsuo Handa +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/splice.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/splice.c b/fs/splice.c +index d671936d0aad..39b11a9a6b98 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -1503,7 +1503,7 @@ static int opipe_prep(struct pipe_inode_info *pipe, unsigned int flags) + * Check pipe occupancy without the inode lock first. This function + * is speculative anyways, so missing one is ok. + */ +- if (pipe_full(pipe->head, pipe->tail, pipe->max_usage)) ++ if (!pipe_full(pipe->head, pipe->tail, pipe->max_usage)) + return 0; + + ret = 0; +-- +2.25.1 + diff --git a/queue-5.6/platform-x86-asus-nb-wmi-do-not-load-on-asus-t100ta-.patch b/queue-5.6/platform-x86-asus-nb-wmi-do-not-load-on-asus-t100ta-.patch new file mode 100644 index 00000000000..9f495863b92 --- /dev/null +++ b/queue-5.6/platform-x86-asus-nb-wmi-do-not-load-on-asus-t100ta-.patch @@ -0,0 +1,73 @@ +From ee2f3a437f1b175b5ddf619bdf08163c09730e48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Apr 2020 00:05:59 +0200 +Subject: platform/x86: asus-nb-wmi: Do not load on Asus T100TA and T200TA + +From: Hans de Goede + +[ Upstream commit 3bd12da7f50b8bc191fcb3bab1f55c582234df59 ] + +asus-nb-wmi does not add any extra functionality on these Asus +Transformer books. They have detachable keyboards, so the hotkeys are +send through a HID device (and handled by the hid-asus driver) and also +the rfkill functionality is not used on these devices. + +Besides not adding any extra functionality, initializing the WMI interface +on these devices actually has a negative side-effect. For some reason +the \_SB.ATKD.INIT() function which asus_wmi_platform_init() calls drives +GPO2 (INT33FC:02) pin 8, which is connected to the front facing webcam LED, +high and there is no (WMI or other) interface to drive this low again +causing the LED to be permanently on, even during suspend. + +This commit adds a blacklist of DMI system_ids on which not to load the +asus-nb-wmi and adds these Transformer books to this list. This fixes +the webcam LED being permanently on under Linux. + +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 6f12747a359a..c4404d9c1de4 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -515,9 +515,33 @@ static struct asus_wmi_driver asus_nb_wmi_driver = { + .detect_quirks = asus_nb_wmi_quirks, + }; + ++static const struct dmi_system_id asus_nb_wmi_blacklist[] __initconst = { ++ { ++ /* ++ * asus-nb-wm adds no functionality. The T100TA has a detachable ++ * USB kbd, so no hotkeys and it has no WMI rfkill; and loading ++ * asus-nb-wm causes the camera LED to turn and _stay_ on. ++ */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"), ++ }, ++ }, ++ { ++ /* The Asus T200TA has the same issue as the T100TA */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T200TA"), ++ }, ++ }, ++ {} /* Terminating entry */ ++}; + + static int __init asus_nb_wmi_init(void) + { ++ if (dmi_check_system(asus_nb_wmi_blacklist)) ++ return -ENODEV; ++ + return asus_wmi_register_driver(&asus_nb_wmi_driver); + } + +-- +2.25.1 + diff --git a/queue-5.6/scripts-gdb-repair-rb_first-and-rb_last.patch b/queue-5.6/scripts-gdb-repair-rb_first-and-rb_last.patch new file mode 100644 index 00000000000..bde0a7e3a79 --- /dev/null +++ b/queue-5.6/scripts-gdb-repair-rb_first-and-rb_last.patch @@ -0,0 +1,57 @@ +From d228ca05b60a61d614ae97e2bc1bbaff7593f31d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 May 2020 18:36:03 -0700 +Subject: scripts/gdb: repair rb_first() and rb_last() + +From: Aymeric Agon-Rambosson + +[ Upstream commit 50e36be1fb9572b2e4f2753340bdce3116bf2ce7 ] + +The current implementations of the rb_first() and rb_last() gdb +functions have a variable that references itself in its instanciation, +which causes the function to throw an error if a specific condition on +the argument is met. The original author rather intended to reference +the argument and made a typo. Referring the argument instead makes the +function work as intended. + +Signed-off-by: Aymeric Agon-Rambosson +Signed-off-by: Andrew Morton +Reviewed-by: Stephen Boyd +Cc: Jan Kiszka +Cc: Kieran Bingham +Cc: Douglas Anderson +Cc: Nikolay Borisov +Cc: Jackie Liu +Cc: Jason Wessel +Link: http://lkml.kernel.org/r/20200427051029.354840-1-aymeric.agon@yandex.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/gdb/linux/rbtree.py | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/scripts/gdb/linux/rbtree.py b/scripts/gdb/linux/rbtree.py +index 39db889b874c..c4b991607917 100644 +--- a/scripts/gdb/linux/rbtree.py ++++ b/scripts/gdb/linux/rbtree.py +@@ -12,7 +12,7 @@ rb_node_type = utils.CachedType("struct rb_node") + + def rb_first(root): + if root.type == rb_root_type.get_type(): +- node = node.address.cast(rb_root_type.get_type().pointer()) ++ node = root.address.cast(rb_root_type.get_type().pointer()) + elif root.type != rb_root_type.get_type().pointer(): + raise gdb.GdbError("Must be struct rb_root not {}".format(root.type)) + +@@ -28,7 +28,7 @@ def rb_first(root): + + def rb_last(root): + if root.type == rb_root_type.get_type(): +- node = node.address.cast(rb_root_type.get_type().pointer()) ++ node = root.address.cast(rb_root_type.get_type().pointer()) + elif root.type != rb_root_type.get_type().pointer(): + raise gdb.GdbError("Must be struct rb_root not {}".format(root.type)) + +-- +2.25.1 + diff --git a/queue-5.6/scsi-ibmvscsi-fix-warn_on-during-event-pool-release.patch b/queue-5.6/scsi-ibmvscsi-fix-warn_on-during-event-pool-release.patch new file mode 100644 index 00000000000..d036274ff85 --- /dev/null +++ b/queue-5.6/scsi-ibmvscsi-fix-warn_on-during-event-pool-release.patch @@ -0,0 +1,94 @@ +From 538e7ae1eb8f057e003d70449a387ad022801044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 15:49:53 -0700 +Subject: scsi: ibmvscsi: Fix WARN_ON during event pool release + +From: Tyrel Datwyler + +[ Upstream commit b36522150e5b85045f868768d46fbaaa034174b2 ] + +While removing an ibmvscsi client adapter a WARN_ON like the following is +seen in the kernel log: + +drmgr: drmgr: -r -c slot -s U9080.M9S.783AEC8-V11-C11 -w 5 -d 1 +WARNING: CPU: 9 PID: 24062 at ../kernel/dma/mapping.c:311 dma_free_attrs+0x78/0x110 +Supported: No, Unreleased kernel +CPU: 9 PID: 24062 Comm: drmgr Kdump: loaded Tainted: G X 5.3.18-12-default +NIP: c0000000001fa758 LR: c0000000001fa744 CTR: c0000000001fa6e0 +REGS: c0000002173375d0 TRAP: 0700 Tainted: G X (5.3.18-12-default) +MSR: 8000000000029033 CR: 28088282 XER: 20000000 +CFAR: c0000000001fbf0c IRQMASK: 1 +GPR00: c0000000001fa744 c000000217337860 c00000000161ab00 0000000000000000 +GPR04: 0000000000000000 c000011e12250000 0000000018010000 0000000000000000 +GPR08: 0000000000000000 0000000000000001 0000000000000001 c0080000190f4fa8 +GPR12: c0000000001fa6e0 c000000007fc2a00 0000000000000000 0000000000000000 +GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +GPR24: 000000011420e310 0000000000000000 0000000000000000 0000000018010000 +GPR28: c00000000159de50 c000011e12250000 0000000000006600 c000011e5c994848 +NIP [c0000000001fa758] dma_free_attrs+0x78/0x110 +LR [c0000000001fa744] dma_free_attrs+0x64/0x110 +Call Trace: +[c000000217337860] [000000011420e310] 0x11420e310 (unreliable) +[c0000002173378b0] [c0080000190f0280] release_event_pool+0xd8/0x120 [ibmvscsi] +[c000000217337930] [c0080000190f3f74] ibmvscsi_remove+0x6c/0x160 [ibmvscsi] +[c000000217337960] [c0000000000f3cac] vio_bus_remove+0x5c/0x100 +[c0000002173379a0] [c00000000087a0a4] device_release_driver_internal+0x154/0x280 +[c0000002173379e0] [c0000000008777cc] bus_remove_device+0x11c/0x220 +[c000000217337a60] [c000000000870fc4] device_del+0x1c4/0x470 +[c000000217337b10] [c0000000008712a0] device_unregister+0x30/0xa0 +[c000000217337b80] [c0000000000f39ec] vio_unregister_device+0x2c/0x60 +[c000000217337bb0] [c00800001a1d0964] dlpar_remove_slot+0x14c/0x250 [rpadlpar_io] +[c000000217337c50] [c00800001a1d0bcc] remove_slot_store+0xa4/0x110 [rpadlpar_io] +[c000000217337cd0] [c000000000c091a0] kobj_attr_store+0x30/0x50 +[c000000217337cf0] [c00000000057c934] sysfs_kf_write+0x64/0x90 +[c000000217337d10] [c00000000057be10] kernfs_fop_write+0x1b0/0x290 +[c000000217337d60] [c000000000488c4c] __vfs_write+0x3c/0x70 +[c000000217337d80] [c00000000048c648] vfs_write+0xd8/0x260 +[c000000217337dd0] [c00000000048ca8c] ksys_write+0xdc/0x130 +[c000000217337e20] [c00000000000b488] system_call+0x5c/0x70 +Instruction dump: +7c840074 f8010010 f821ffb1 20840040 eb830218 7c8407b4 48002019 60000000 +2fa30000 409e003c 892d0988 792907e0 <0b090000> 2fbd0000 419e0028 2fbc0000 +---[ end trace 5955b3c0cc079942 ]--- +rpadlpar_io: slot U9080.M9S.783AEC8-V11-C11 removed + +This is tripped as a result of irqs being disabled during the call to +dma_free_coherent() by release_event_pool(). At this point in the code path +we have quiesced the adapter and it is overly paranoid to be holding the +host lock. + +[mkp: fixed build warning reported by sfr] + +Link: https://lore.kernel.org/r/1588027793-17952-1-git-send-email-tyreld@linux.ibm.com +Signed-off-by: Tyrel Datwyler +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvscsi.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index 7f66a7783209..59f0f1030c54 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -2320,16 +2320,12 @@ static int ibmvscsi_probe(struct vio_dev *vdev, const struct vio_device_id *id) + static int ibmvscsi_remove(struct vio_dev *vdev) + { + struct ibmvscsi_host_data *hostdata = dev_get_drvdata(&vdev->dev); +- unsigned long flags; + + srp_remove_host(hostdata->host); + scsi_remove_host(hostdata->host); + + purge_requests(hostdata, DID_ERROR); +- +- spin_lock_irqsave(hostdata->host->host_lock, flags); + release_event_pool(&hostdata->pool, hostdata); +- spin_unlock_irqrestore(hostdata->host->host_lock, flags); + + ibmvscsi_release_crq_queue(&hostdata->queue, hostdata, + max_events); +-- +2.25.1 + diff --git a/queue-5.6/scsi-qla2xxx-delete-all-sessions-before-unregister-l.patch b/queue-5.6/scsi-qla2xxx-delete-all-sessions-before-unregister-l.patch new file mode 100644 index 00000000000..c020f3f233c --- /dev/null +++ b/queue-5.6/scsi-qla2xxx-delete-all-sessions-before-unregister-l.patch @@ -0,0 +1,66 @@ +From 7fe0c5fe55eb8536a76cdd7a0015bfd0662b5b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Mar 2020 03:40:15 -0700 +Subject: scsi: qla2xxx: Delete all sessions before unregister local nvme port + +From: Quinn Tran + +[ Upstream commit c48f849d3f7a4ec1025105f446e29d395c4dcc2f ] + +Delete all sessions before unregistering local nvme port. This allows nvme +layer to decrement all active rport count down to zero. Once the count is +down to zero, nvme would call qla to continue with the npiv port deletion. + +PID: 27448 TASK: ffff9e34b777c1c0 CPU: 0 COMMAND: "qaucli" + 0 [ffff9e25e84abbd8] __schedule at ffffffff977858ca + 1 [ffff9e25e84abc68] schedule at ffffffff97785d79 + 2 [ffff9e25e84abc78] schedule_timeout at ffffffff97783881 + 3 [ffff9e25e84abd28] wait_for_completion at ffffffff9778612d + 4 [ffff9e25e84abd88] qla_nvme_delete at ffffffffc0e3024e [qla2xxx] + 5 [ffff9e25e84abda8] qla24xx_vport_delete at ffffffffc0e024b9 [qla2xxx] + 6 [ffff9e25e84abdf0] fc_vport_terminate at ffffffffc011c247 [scsi_transport_fc] + 7 [ffff9e25e84abe28] store_fc_host_vport_delete at ffffffffc011cd94 [scsi_transport_fc] + 8 [ffff9e25e84abe70] dev_attr_store at ffffffff974b376b + 9 [ffff9e25e84abe80] sysfs_kf_write at ffffffff972d9a92 +10 [ffff9e25e84abe90] kernfs_fop_write at ffffffff972d907b +11 [ffff9e25e84abec8] vfs_write at ffffffff9724c790 +12 [ffff9e25e84abf08] sys_write at ffffffff9724d55f +13 [ffff9e25e84abf50] system_call_fastpath at ffffffff97792ed2 + RIP: 00007fc0bd81a6fd RSP: 00007ffff78d9648 RFLAGS: 00010202 + RAX: 0000000000000001 RBX: 0000000000000022 RCX: 00007ffff78d96e0 + RDX: 0000000000000022 RSI: 00007ffff78d94e0 RDI: 0000000000000008 + RBP: 00007ffff78d9440 R8: 0000000000000000 R9: 00007fc0bd48b2cd + R10: 0000000000000017 R11: 0000000000000293 R12: 0000000000000000 + R13: 00005624e4dac840 R14: 00005624e4da9a10 R15: 0000000000000000 + ORIG_RAX: 0000000000000001 CS: 0033 SS: 002b + +Link: https://lore.kernel.org/r/20200331104015.24868-4-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_attr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index d7e7043f9eab..9556392652e3 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2928,11 +2928,11 @@ qla24xx_vport_delete(struct fc_vport *fc_vport) + test_bit(FCPORT_UPDATE_NEEDED, &vha->dpc_flags)) + msleep(1000); + +- qla_nvme_delete(vha); + + qla24xx_disable_vp(vha); + qla2x00_wait_for_sess_deletion(vha); + ++ qla_nvme_delete(vha); + vha->flags.delete_progress = 1; + + qlt_remove_target(ha, vha); +-- +2.25.1 + diff --git a/queue-5.6/scsi-qla2xxx-fix-hang-when-issuing-nvme-disconnect-a.patch b/queue-5.6/scsi-qla2xxx-fix-hang-when-issuing-nvme-disconnect-a.patch new file mode 100644 index 00000000000..939f17267c9 --- /dev/null +++ b/queue-5.6/scsi-qla2xxx-fix-hang-when-issuing-nvme-disconnect-a.patch @@ -0,0 +1,42 @@ +From 3edebfa944dd5015355f8986ec81e6f83464a0b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Mar 2020 03:40:14 -0700 +Subject: scsi: qla2xxx: Fix hang when issuing nvme disconnect-all in NPIV + +From: Arun Easi + +[ Upstream commit 45a76264c26fd8cfd0c9746196892d9b7e2657ee ] + +In NPIV environment, a NPIV host may use a queue pair created by base host +or other NPIVs, so the check for a queue pair created by this NPIV is not +correct, and can cause an abort to fail, which in turn means the NVME +command not returned. This leads to hang in nvme_fc layer in +nvme_fc_delete_association() which waits for all I/Os to be returned, which +is seen as hang in the application. + +Link: https://lore.kernel.org/r/20200331104015.24868-3-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 9e09964f5c0e..7b341e41bb85 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3117,7 +3117,7 @@ qla24xx_abort_command(srb_t *sp) + ql_dbg(ql_dbg_mbx + ql_dbg_verbose, vha, 0x108c, + "Entered %s.\n", __func__); + +- if (vha->flags.qpairs_available && sp->qpair) ++ if (sp->qpair) + req = sp->qpair->req; + else + return QLA_FUNCTION_FAILED; +-- +2.25.1 + diff --git a/queue-5.6/selftests-fix-kvm-relocatable-native-cross-builds-an.patch b/queue-5.6/selftests-fix-kvm-relocatable-native-cross-builds-an.patch new file mode 100644 index 00000000000..38da29ab661 --- /dev/null +++ b/queue-5.6/selftests-fix-kvm-relocatable-native-cross-builds-an.patch @@ -0,0 +1,129 @@ +From ccf88a0b65bd4bbd2e37fc6ca5e0f0ed2f7965ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 18:11:07 -0600 +Subject: selftests: fix kvm relocatable native/cross builds and installs + +From: Shuah Khan + +[ Upstream commit 66d69e081b526b6a6031f0d3ca8ddff71e5707a5 ] + +kvm test Makefile doesn't fully support cross-builds and installs. +UNAME_M = $(shell uname -m) variable is used to define the target +programs and libraries to be built from arch specific sources in +sub-directories. + +For cross-builds to work, UNAME_M has to map to ARCH and arch specific +directories and targets in this Makefile. + +UNAME_M variable to used to run the compiles pointing to the right arch +directories and build the right targets for these supported architectures. + +TEST_GEN_PROGS and LIBKVM are set using UNAME_M variable. +LINUX_TOOL_ARCH_INCLUDE is set using ARCH variable. + +x86_64 targets are named to include x86_64 as a suffix and directories +for includes are in x86_64 sub-directory. s390x and aarch64 follow the +same convention. "uname -m" doesn't result in the correct mapping for +s390x and aarch64. Fix it to set UNAME_M correctly for s390x and aarch64 +cross-builds. + +In addition, Makefile doesn't create arch sub-directories in the case of +relocatable builds and test programs under s390x and x86_64 directories +fail to build. This is a problem for native and cross-builds. Fix it to +create all necessary directories keying off of TEST_GEN_PROGS. + +The following use-cases work with this change: + +Native x86_64: +make O=/tmp/kselftest -C tools/testing/selftests TARGETS=kvm install \ + INSTALL_PATH=$HOME/x86_64 + +arm64 cross-build: +make O=$HOME/arm64_build/ ARCH=arm64 HOSTCC=gcc \ + CROSS_COMPILE=aarch64-linux-gnu- defconfig + +make O=$HOME/arm64_build/ ARCH=arm64 HOSTCC=gcc \ + CROSS_COMPILE=aarch64-linux-gnu- all + +make kselftest-install TARGETS=kvm O=$HOME/arm64_build ARCH=arm64 \ + HOSTCC=gcc CROSS_COMPILE=aarch64-linux-gnu- + +s390x cross-build: +make O=$HOME/s390x_build/ ARCH=s390 HOSTCC=gcc \ + CROSS_COMPILE=s390x-linux-gnu- defconfig + +make O=$HOME/s390x_build/ ARCH=s390 HOSTCC=gcc \ + CROSS_COMPILE=s390x-linux-gnu- all + +make kselftest-install TARGETS=kvm O=$HOME/s390x_build/ ARCH=s390 \ + HOSTCC=gcc CROSS_COMPILE=s390x-linux-gnu- all + +No regressions in the following use-cases: +make -C tools/testing/selftests TARGETS=kvm +make kselftest-all TARGETS=kvm + +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/Makefile | 29 +++++++++++++++++++++++++++- + 1 file changed, 28 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/kvm/Makefile b/tools/testing/selftests/kvm/Makefile +index d91c53b726e6..75dec268787f 100644 +--- a/tools/testing/selftests/kvm/Makefile ++++ b/tools/testing/selftests/kvm/Makefile +@@ -5,8 +5,34 @@ all: + + top_srcdir = ../../../.. + KSFT_KHDR_INSTALL := 1 ++ ++# For cross-builds to work, UNAME_M has to map to ARCH and arch specific ++# directories and targets in this Makefile. "uname -m" doesn't map to ++# arch specific sub-directory names. ++# ++# UNAME_M variable to used to run the compiles pointing to the right arch ++# directories and build the right targets for these supported architectures. ++# ++# TEST_GEN_PROGS and LIBKVM are set using UNAME_M variable. ++# LINUX_TOOL_ARCH_INCLUDE is set using ARCH variable. ++# ++# x86_64 targets are named to include x86_64 as a suffix and directories ++# for includes are in x86_64 sub-directory. s390x and aarch64 follow the ++# same convention. "uname -m" doesn't result in the correct mapping for ++# s390x and aarch64. ++# ++# No change necessary for x86_64 + UNAME_M := $(shell uname -m) + ++# Set UNAME_M for arm64 compile/install to work ++ifeq ($(ARCH),arm64) ++ UNAME_M := aarch64 ++endif ++# Set UNAME_M s390x compile/install to work ++ifeq ($(ARCH),s390) ++ UNAME_M := s390x ++endif ++ + LIBKVM = lib/assert.c lib/elf.c lib/io.c lib/kvm_util.c lib/sparsebit.c + LIBKVM_x86_64 = lib/x86_64/processor.c lib/x86_64/vmx.c lib/x86_64/svm.c lib/x86_64/ucall.c + LIBKVM_aarch64 = lib/aarch64/processor.c lib/aarch64/ucall.c +@@ -47,7 +73,7 @@ LIBKVM += $(LIBKVM_$(UNAME_M)) + INSTALL_HDR_PATH = $(top_srcdir)/usr + LINUX_HDR_PATH = $(INSTALL_HDR_PATH)/include/ + LINUX_TOOL_INCLUDE = $(top_srcdir)/tools/include +-LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/x86/include ++LINUX_TOOL_ARCH_INCLUDE = $(top_srcdir)/tools/arch/$(ARCH)/include + CFLAGS += -Wall -Wstrict-prototypes -Wuninitialized -O2 -g -std=gnu99 \ + -fno-stack-protector -fno-PIE -I$(LINUX_TOOL_INCLUDE) \ + -I$(LINUX_TOOL_ARCH_INCLUDE) -I$(LINUX_HDR_PATH) -Iinclude \ +@@ -78,6 +104,7 @@ $(LIBKVM_OBJ): $(OUTPUT)/%.o: %.c + $(OUTPUT)/libkvm.a: $(LIBKVM_OBJ) + $(AR) crs $@ $^ + ++x := $(shell mkdir -p $(sort $(dir $(TEST_GEN_PROGS)))) + all: $(STATIC_LIBS) + $(TEST_GEN_PROGS): $(STATIC_LIBS) + +-- +2.25.1 + diff --git a/queue-5.6/series b/queue-5.6/series index 05836028b71..dc27b5eb4c0 100644 --- a/queue-5.6/series +++ b/queue-5.6/series @@ -1 +1,55 @@ i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch +arc-plat-hsdk-fix-usb-regression.patch +ima-set-file-f_mode-instead-of-file-f_flags-in-ima_c.patch +evm-check-also-if-tfm-is-an-error-pointer-in-init_de.patch +ima-fix-return-value-of-ima_write_policy.patch +ovl-potential-crash-in-ovl_fid_to_fh.patch +ubifs-fix-wrong-use-of-crypto_shash_descsize.patch +acpi-ec-pm-avoid-flushing-ec-work-when-ec-gpe-is-ina.patch +mtd-spinand-propagate-ecc-information-to-the-mtd-str.patch +fix-multiplication-overflow-in-copy_fdtable.patch +pipe-fix-pipe_full-test-in-opipe_prep.patch +ubifs-remove-broken-lazytime-support.patch +i2c-fix-missing-pm_runtime_put_sync-in-i2c_device_pr.patch +iommu-amd-fix-over-read-of-acpi-uid-from-ivrs-table.patch +iommu-amd-fix-get_acpihid_device_id.patch +evm-fix-a-small-race-in-init_desc.patch +i2c-mux-demux-pinctrl-fix-an-error-handling-path-in-.patch +ubi-fix-seq_file-usage-in-detailed_erase_block_info-.patch +afs-don-t-unlock-fetched-data-pages-until-the-op-com.patch +mtd-fix-mtd-not-registered-due-to-nvmem-name-collisi.patch +iommu-fix-deferred-domain-attachment.patch +kbuild-avoid-concurrency-issue-in-parallel-building-.patch +net-drop_monitor-use-is_reachable-to-guard-net_dm_hw.patch +gcc-common.h-update-for-gcc-10.patch +hid-multitouch-add-egalaxtouch-p80h84-support.patch +hid-logitech-add-support-for-logitech-g11-extra-keys.patch +hid-alps-add-aui1657-device-id.patch +hid-alps-alps_1657-is-too-specific-use-u1_unicorn_le.patch +scsi-qla2xxx-fix-hang-when-issuing-nvme-disconnect-a.patch +scsi-qla2xxx-delete-all-sessions-before-unregister-l.patch +configfs-fix-config_item-refcnt-leak-in-configfs_rmd.patch +vhost-vsock-fix-packet-delivery-order-to-monitoring-.patch +aquantia-fix-the-media-type-of-aqc100-ethernet-contr.patch +component-silence-bind-error-on-eprobe_defer.patch +net-ena-fix-build-warning-in-ena_xdp_set.patch +scsi-ibmvscsi-fix-warn_on-during-event-pool-release.patch +hid-i2c-hid-reset-synaptics-syna2393-on-resume.patch +ibmvnic-skip-fatal-error-reset-after-passive-init.patch +ftrace-selftest-make-unresolved-cases-cause-failure-.patch +selftests-fix-kvm-relocatable-native-cross-builds-an.patch +x86-apic-move-tsc-deadline-timer-debug-printk.patch +gtp-set-nlm_f_multi-flag-in-gtp_genl_dump_pdp.patch +hid-quirks-add-hid_quirk_no_init_reports-quirk-for-d.patch +ceph-fix-double-unlock-in-handle_cap_export.patch +stmmac-fix-pointer-check-after-utilization-in-stmmac.patch +usb-core-fix-misleading-driver-bug-report.patch +platform-x86-asus-nb-wmi-do-not-load-on-asus-t100ta-.patch +iommu-amd-do-not-loop-forever-when-trying-to-increas.patch +iommu-amd-call-domain_flush_complete-in-update_domai.patch +drm-amd-display-fix-counter-in-wait_for_no_pipes_pen.patch +drm-amd-display-prevent-dpcd-reads-with-passive-dong.patch +kvm-selftests-fix-build-for-evmcs.h.patch +arm-futex-address-build-warning.patch +tools-bootconfig-fix-resource-leak-in-apply_xbc.patch +scripts-gdb-repair-rb_first-and-rb_last.patch diff --git a/queue-5.6/stmmac-fix-pointer-check-after-utilization-in-stmmac.patch b/queue-5.6/stmmac-fix-pointer-check-after-utilization-in-stmmac.patch new file mode 100644 index 00000000000..65807d66a8c --- /dev/null +++ b/queue-5.6/stmmac-fix-pointer-check-after-utilization-in-stmmac.patch @@ -0,0 +1,51 @@ +From 674978701f5e2c9cd9d27375d360fba800c95d26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 May 2020 09:26:43 +0300 +Subject: stmmac: fix pointer check after utilization in stmmac_interrupt + +From: Maxim Petrov + +[ Upstream commit f42234ffd531ca6b13d9da02faa60b72eccf8334 ] + +The paranoidal pointer check in IRQ handler looks very strange - it +really protects us only against bogus drivers which request IRQ line +with null pointer dev_id. However, the code fragment is incorrect +because the dev pointer is used before the actual check which leads +to undefined behavior. Remove the check to avoid confusing people +with incorrect code. + +Signed-off-by: Maxim Petrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 7da18c9afa01..d564459290ce 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3988,7 +3988,7 @@ static int stmmac_set_features(struct net_device *netdev, + /** + * stmmac_interrupt - main ISR + * @irq: interrupt number. +- * @dev_id: to pass the net device pointer. ++ * @dev_id: to pass the net device pointer (must be valid). + * Description: this is the main driver interrupt service routine. + * It can call: + * o DMA service routine (to manage incoming frame reception and transmission +@@ -4012,11 +4012,6 @@ static irqreturn_t stmmac_interrupt(int irq, void *dev_id) + if (priv->irq_wake) + pm_wakeup_event(priv->device, 0); + +- if (unlikely(!dev)) { +- netdev_err(priv->dev, "%s: invalid dev pointer\n", __func__); +- return IRQ_NONE; +- } +- + /* Check if adapter is up */ + if (test_bit(STMMAC_DOWN, &priv->state)) + return IRQ_HANDLED; +-- +2.25.1 + diff --git a/queue-5.6/tools-bootconfig-fix-resource-leak-in-apply_xbc.patch b/queue-5.6/tools-bootconfig-fix-resource-leak-in-apply_xbc.patch new file mode 100644 index 00000000000..cf71424a4d6 --- /dev/null +++ b/queue-5.6/tools-bootconfig-fix-resource-leak-in-apply_xbc.patch @@ -0,0 +1,67 @@ +From a9cf632e85e5632a3924287d8744f6d6e1e01e0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 May 2020 17:23:36 +0800 +Subject: tools/bootconfig: Fix resource leak in apply_xbc() + +From: Yunfeng Ye + +[ Upstream commit 8842604446d1f005abcbf8c63c12eabdb5695094 ] + +Fix the @data and @fd allocations that are leaked in the error path of +apply_xbc(). + +Link: http://lkml.kernel.org/r/583a49c9-c27a-931d-e6c2-6f63a4b18bea@huawei.com + +Acked-by: Masami Hiramatsu +Signed-off-by: Yunfeng Ye +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + tools/bootconfig/main.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/bootconfig/main.c b/tools/bootconfig/main.c +index a9b97814d1a9..5dbe893cf00c 100644 +--- a/tools/bootconfig/main.c ++++ b/tools/bootconfig/main.c +@@ -287,6 +287,7 @@ int apply_xbc(const char *path, const char *xbc_path) + ret = delete_xbc(path); + if (ret < 0) { + pr_err("Failed to delete previous boot config: %d\n", ret); ++ free(data); + return ret; + } + +@@ -294,24 +295,26 @@ int apply_xbc(const char *path, const char *xbc_path) + fd = open(path, O_RDWR | O_APPEND); + if (fd < 0) { + pr_err("Failed to open %s: %d\n", path, fd); ++ free(data); + return fd; + } + /* TODO: Ensure the @path is initramfs/initrd image */ + ret = write(fd, data, size + 8); + if (ret < 0) { + pr_err("Failed to apply a boot config: %d\n", ret); +- return ret; ++ goto out; + } + /* Write a magic word of the bootconfig */ + ret = write(fd, BOOTCONFIG_MAGIC, BOOTCONFIG_MAGIC_LEN); + if (ret < 0) { + pr_err("Failed to apply a boot config magic: %d\n", ret); +- return ret; ++ goto out; + } ++out: + close(fd); + free(data); + +- return 0; ++ return ret; + } + + int usage(void) +-- +2.25.1 + diff --git a/queue-5.6/ubi-fix-seq_file-usage-in-detailed_erase_block_info-.patch b/queue-5.6/ubi-fix-seq_file-usage-in-detailed_erase_block_info-.patch new file mode 100644 index 00000000000..af5036c8fec --- /dev/null +++ b/queue-5.6/ubi-fix-seq_file-usage-in-detailed_erase_block_info-.patch @@ -0,0 +1,60 @@ +From 02af64508389275075bc4f6eeb77bf0b5a2752fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 May 2020 14:48:02 +0200 +Subject: ubi: Fix seq_file usage in detailed_erase_block_info debugfs file + +From: Richard Weinberger + +[ Upstream commit 0e7572cffe442290c347e779bf8bd4306bb0aa7c ] + +3bfa7e141b0b ("fs/seq_file.c: seq_read(): add info message about buggy .next functions") +showed that we don't use seq_file correctly. +So make sure that our ->next function always updates the position. + +Fixes: 7bccd12d27b7 ("ubi: Add debugfs file for tracking PEB state") +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/debug.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/mtd/ubi/debug.c b/drivers/mtd/ubi/debug.c +index 54646c2c2744..ac2bdba8bb1a 100644 +--- a/drivers/mtd/ubi/debug.c ++++ b/drivers/mtd/ubi/debug.c +@@ -393,9 +393,6 @@ static void *eraseblk_count_seq_start(struct seq_file *s, loff_t *pos) + { + struct ubi_device *ubi = s->private; + +- if (*pos == 0) +- return SEQ_START_TOKEN; +- + if (*pos < ubi->peb_count) + return pos; + +@@ -409,8 +406,6 @@ static void *eraseblk_count_seq_next(struct seq_file *s, void *v, loff_t *pos) + { + struct ubi_device *ubi = s->private; + +- if (v == SEQ_START_TOKEN) +- return pos; + (*pos)++; + + if (*pos < ubi->peb_count) +@@ -432,11 +427,8 @@ static int eraseblk_count_seq_show(struct seq_file *s, void *iter) + int err; + + /* If this is the start, print a header */ +- if (iter == SEQ_START_TOKEN) { +- seq_puts(s, +- "physical_block_number\terase_count\tblock_status\tread_status\n"); +- return 0; +- } ++ if (*block_number == 0) ++ seq_puts(s, "physical_block_number\terase_count\n"); + + err = ubi_io_is_bad(ubi, *block_number); + if (err) +-- +2.25.1 + diff --git a/queue-5.6/ubifs-fix-wrong-use-of-crypto_shash_descsize.patch b/queue-5.6/ubifs-fix-wrong-use-of-crypto_shash_descsize.patch new file mode 100644 index 00000000000..d03080bafcd --- /dev/null +++ b/queue-5.6/ubifs-fix-wrong-use-of-crypto_shash_descsize.patch @@ -0,0 +1,111 @@ +From cf56ca34b1de3f57c4e0aafcae7d2948c53ce3ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 May 2020 22:59:45 -0700 +Subject: ubifs: fix wrong use of crypto_shash_descsize() + +From: Eric Biggers + +[ Upstream commit 3c3c32f85b6cc05e5db78693457deff03ac0f434 ] + +crypto_shash_descsize() returns the size of the shash_desc context +needed to compute the hash, not the size of the hash itself. + +crypto_shash_digestsize() would be correct, or alternatively using +c->hash_len and c->hmac_desc_len which already store the correct values. +But actually it's simpler to just use stack arrays, so do that instead. + +Fixes: 49525e5eecca ("ubifs: Add helper functions for authentication support") +Fixes: da8ef65f9573 ("ubifs: Authenticate replayed journal") +Cc: # v4.20+ +Cc: Sascha Hauer +Signed-off-by: Eric Biggers +Acked-by: Sascha Hauer +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/auth.c | 17 ++++------------- + fs/ubifs/replay.c | 13 ++----------- + 2 files changed, 6 insertions(+), 24 deletions(-) + +diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c +index 8cdbd53d780c..f985a3fbbb36 100644 +--- a/fs/ubifs/auth.c ++++ b/fs/ubifs/auth.c +@@ -79,13 +79,9 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node, + struct shash_desc *inhash) + { + struct ubifs_auth_node *auth = node; +- u8 *hash; ++ u8 hash[UBIFS_HASH_ARR_SZ]; + int err; + +- hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS); +- if (!hash) +- return -ENOMEM; +- + { + SHASH_DESC_ON_STACK(hash_desc, c->hash_tfm); + +@@ -94,21 +90,16 @@ int ubifs_prepare_auth_node(struct ubifs_info *c, void *node, + + err = crypto_shash_final(hash_desc, hash); + if (err) +- goto out; ++ return err; + } + + err = ubifs_hash_calc_hmac(c, hash, auth->hmac); + if (err) +- goto out; ++ return err; + + auth->ch.node_type = UBIFS_AUTH_NODE; + ubifs_prepare_node(c, auth, ubifs_auth_node_sz(c), 0); +- +- err = 0; +-out: +- kfree(hash); +- +- return err; ++ return 0; + } + + static struct shash_desc *ubifs_get_desc(const struct ubifs_info *c, +diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c +index b28ac4dfb407..01fcf7975047 100644 +--- a/fs/ubifs/replay.c ++++ b/fs/ubifs/replay.c +@@ -601,18 +601,12 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb, + struct ubifs_scan_node *snod; + int n_nodes = 0; + int err; +- u8 *hash, *hmac; ++ u8 hash[UBIFS_HASH_ARR_SZ]; ++ u8 hmac[UBIFS_HMAC_ARR_SZ]; + + if (!ubifs_authenticated(c)) + return sleb->nodes_cnt; + +- hash = kmalloc(crypto_shash_descsize(c->hash_tfm), GFP_NOFS); +- hmac = kmalloc(c->hmac_desc_len, GFP_NOFS); +- if (!hash || !hmac) { +- err = -ENOMEM; +- goto out; +- } +- + list_for_each_entry(snod, &sleb->nodes, list) { + + n_nodes++; +@@ -662,9 +656,6 @@ static int authenticate_sleb(struct ubifs_info *c, struct ubifs_scan_leb *sleb, + err = 0; + } + out: +- kfree(hash); +- kfree(hmac); +- + return err ? err : n_nodes - n_not_auth; + } + +-- +2.25.1 + diff --git a/queue-5.6/ubifs-remove-broken-lazytime-support.patch b/queue-5.6/ubifs-remove-broken-lazytime-support.patch new file mode 100644 index 00000000000..26df5c041f5 --- /dev/null +++ b/queue-5.6/ubifs-remove-broken-lazytime-support.patch @@ -0,0 +1,53 @@ +From d18e10b9e2c9fa7b275bac7a404629a084ce4e76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Apr 2020 13:33:05 +0200 +Subject: ubifs: remove broken lazytime support + +From: Christoph Hellwig + +[ Upstream commit ecf84096a526f2632ee85c32a3d05de3fa60ce80 ] + +When "ubifs: introduce UBIFS_ATIME_SUPPORT to ubifs" introduced atime +support to ubifs, it also added lazytime support. As far as I can tell +the lazytime support is terminally broken, as it causes +mark_inode_dirty_sync to be called from __writeback_single_inode, which +will then trigger the locking assert in ubifs_dirty_inode. Just remove +the broken lazytime support for now, it can be added back later, +especially as some infrastructure changes should make that easier soon. + +Fixes: 8c1c5f263833 ("ubifs: introduce UBIFS_ATIME_SUPPORT to ubifs") +Signed-off-by: Christoph Hellwig +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/file.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 743928efffc1..49fe062ce45e 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -1375,7 +1375,6 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time, + struct ubifs_info *c = inode->i_sb->s_fs_info; + struct ubifs_budget_req req = { .dirtied_ino = 1, + .dirtied_ino_d = ALIGN(ui->data_len, 8) }; +- int iflags = I_DIRTY_TIME; + int err, release; + + if (!IS_ENABLED(CONFIG_UBIFS_ATIME_SUPPORT)) +@@ -1393,11 +1392,8 @@ int ubifs_update_time(struct inode *inode, struct timespec64 *time, + if (flags & S_MTIME) + inode->i_mtime = *time; + +- if (!(inode->i_sb->s_flags & SB_LAZYTIME)) +- iflags |= I_DIRTY_SYNC; +- + release = ui->dirty; +- __mark_inode_dirty(inode, iflags); ++ __mark_inode_dirty(inode, I_DIRTY_SYNC); + mutex_unlock(&ui->ui_mutex); + if (release) + ubifs_release_budget(c, &req); +-- +2.25.1 + diff --git a/queue-5.6/usb-core-fix-misleading-driver-bug-report.patch b/queue-5.6/usb-core-fix-misleading-driver-bug-report.patch new file mode 100644 index 00000000000..455bff1e7c4 --- /dev/null +++ b/queue-5.6/usb-core-fix-misleading-driver-bug-report.patch @@ -0,0 +1,69 @@ +From c8f5ac56c435fa452b85dcd07999ac183cf52573 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 May 2020 16:07:28 -0400 +Subject: USB: core: Fix misleading driver bug report + +From: Alan Stern + +[ Upstream commit ac854131d9844f79e2fdcef67a7707227538d78a ] + +The syzbot fuzzer found a race between URB submission to endpoint 0 +and device reset. Namely, during the reset we call usb_ep0_reinit() +because the characteristics of ep0 may have changed (if the reset +follows a firmware update, for example). While usb_ep0_reinit() is +running there is a brief period during which the pointers stored in +udev->ep_in[0] and udev->ep_out[0] are set to NULL, and if an URB is +submitted to ep0 during that period, usb_urb_ep_type_check() will +report it as a driver bug. In the absence of those pointers, the +routine thinks that the endpoint doesn't exist. The log message looks +like this: + +------------[ cut here ]------------ +usb 2-1: BOGUS urb xfer, pipe 2 != type 2 +WARNING: CPU: 0 PID: 9241 at drivers/usb/core/urb.c:478 +usb_submit_urb+0x1188/0x1460 drivers/usb/core/urb.c:478 + +Now, although submitting an URB while the device is being reset is a +questionable thing to do, it shouldn't count as a driver bug as severe +as submitting an URB for an endpoint that doesn't exist. Indeed, +endpoint 0 always exists, even while the device is in its unconfigured +state. + +To prevent these misleading driver bug reports, this patch updates +usb_disable_endpoint() to avoid clearing the ep_in[] and ep_out[] +pointers when the endpoint being disabled is ep0. There's no danger +of leaving a stale pointer in place, because the usb_host_endpoint +structure being pointed to is stored permanently in udev->ep0; it +doesn't get deallocated until the entire usb_device structure does. + +Reported-and-tested-by: syzbot+db339689b2101f6f6071@syzkaller.appspotmail.com +Signed-off-by: Alan Stern + +Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.2005011558590.903-100000@netrider.rowland.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/message.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 02eaac7e1e34..a1ac2f0723b0 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1143,11 +1143,11 @@ void usb_disable_endpoint(struct usb_device *dev, unsigned int epaddr, + + if (usb_endpoint_out(epaddr)) { + ep = dev->ep_out[epnum]; +- if (reset_hardware) ++ if (reset_hardware && epnum != 0) + dev->ep_out[epnum] = NULL; + } else { + ep = dev->ep_in[epnum]; +- if (reset_hardware) ++ if (reset_hardware && epnum != 0) + dev->ep_in[epnum] = NULL; + } + if (ep) { +-- +2.25.1 + diff --git a/queue-5.6/vhost-vsock-fix-packet-delivery-order-to-monitoring-.patch b/queue-5.6/vhost-vsock-fix-packet-delivery-order-to-monitoring-.patch new file mode 100644 index 00000000000..4d8e9945219 --- /dev/null +++ b/queue-5.6/vhost-vsock-fix-packet-delivery-order-to-monitoring-.patch @@ -0,0 +1,47 @@ +From 2b9563bf2133e37ed0cea87b119f3a194d062ffd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Apr 2020 17:08:29 +0200 +Subject: vhost/vsock: fix packet delivery order to monitoring devices + +From: Stefano Garzarella + +[ Upstream commit 107bc0766b9feb5113074c753735a3f115c2141f ] + +We want to deliver packets to monitoring devices before it is +put in the virtqueue, to avoid that replies can appear in the +packet capture before the transmitted packet. + +Signed-off-by: Stefano Garzarella +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/vhost/vsock.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c +index bb3f63386b47..53294c2f8cff 100644 +--- a/drivers/vhost/vsock.c ++++ b/drivers/vhost/vsock.c +@@ -181,14 +181,14 @@ vhost_transport_do_send_pkt(struct vhost_vsock *vsock, + break; + } + +- vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len); +- added = true; +- +- /* Deliver to monitoring devices all correctly transmitted +- * packets. ++ /* Deliver to monitoring devices all packets that we ++ * will transmit. + */ + virtio_transport_deliver_tap_pkt(pkt); + ++ vhost_add_used(vq, head, sizeof(pkt->hdr) + payload_len); ++ added = true; ++ + pkt->off += payload_len; + total_len += payload_len; + +-- +2.25.1 + diff --git a/queue-5.6/x86-apic-move-tsc-deadline-timer-debug-printk.patch b/queue-5.6/x86-apic-move-tsc-deadline-timer-debug-printk.patch new file mode 100644 index 00000000000..68d83934b80 --- /dev/null +++ b/queue-5.6/x86-apic-move-tsc-deadline-timer-debug-printk.patch @@ -0,0 +1,132 @@ +From 3d447c3d6b23fd4a5ba8d5ec628554b3a01d72ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 16:55:57 +0200 +Subject: x86/apic: Move TSC deadline timer debug printk + +From: Thomas Gleixner + +[ Upstream commit c84cb3735fd53c91101ccdb191f2e3331a9262cb ] + +Leon reported that the printk_once() in __setup_APIC_LVTT() triggers a +lockdep splat due to a lock order violation between hrtimer_base::lock and +console_sem, when the 'once' condition is reset via +/sys/kernel/debug/clear_warn_once after boot. + +The initial printk cannot trigger this because that happens during boot +when the local APIC timer is set up on the boot CPU. + +Prevent it by moving the printk to a place which is guaranteed to be only +called once during boot. + +Mark the deadline timer check related functions and data __init while at +it. + +Reported-by: Leon Romanovsky +Signed-off-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/87y2qhoshi.fsf@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/apic/apic.c | 27 ++++++++++++++------------- + 1 file changed, 14 insertions(+), 13 deletions(-) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 5f973fed3c9f..e289722b04f6 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -352,8 +352,6 @@ static void __setup_APIC_LVTT(unsigned int clocks, int oneshot, int irqen) + * According to Intel, MFENCE can do the serialization here. + */ + asm volatile("mfence" : : : "memory"); +- +- printk_once(KERN_DEBUG "TSC deadline timer enabled\n"); + return; + } + +@@ -552,7 +550,7 @@ static DEFINE_PER_CPU(struct clock_event_device, lapic_events); + #define DEADLINE_MODEL_MATCH_REV(model, rev) \ + { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)rev } + +-static u32 hsx_deadline_rev(void) ++static __init u32 hsx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x02: return 0x3a; /* EP */ +@@ -562,7 +560,7 @@ static u32 hsx_deadline_rev(void) + return ~0U; + } + +-static u32 bdx_deadline_rev(void) ++static __init u32 bdx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x02: return 0x00000011; +@@ -574,7 +572,7 @@ static u32 bdx_deadline_rev(void) + return ~0U; + } + +-static u32 skx_deadline_rev(void) ++static __init u32 skx_deadline_rev(void) + { + switch (boot_cpu_data.x86_stepping) { + case 0x03: return 0x01000136; +@@ -587,7 +585,7 @@ static u32 skx_deadline_rev(void) + return ~0U; + } + +-static const struct x86_cpu_id deadline_match[] = { ++static const struct x86_cpu_id deadline_match[] __initconst = { + DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_HASWELL_X, hsx_deadline_rev), + DEADLINE_MODEL_MATCH_REV ( INTEL_FAM6_BROADWELL_X, 0x0b000020), + DEADLINE_MODEL_MATCH_FUNC( INTEL_FAM6_BROADWELL_D, bdx_deadline_rev), +@@ -609,18 +607,19 @@ static const struct x86_cpu_id deadline_match[] = { + {}, + }; + +-static void apic_check_deadline_errata(void) ++static __init bool apic_validate_deadline_timer(void) + { + const struct x86_cpu_id *m; + u32 rev; + +- if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER) || +- boot_cpu_has(X86_FEATURE_HYPERVISOR)) +- return; ++ if (!boot_cpu_has(X86_FEATURE_TSC_DEADLINE_TIMER)) ++ return false; ++ if (boot_cpu_has(X86_FEATURE_HYPERVISOR)) ++ return true; + + m = x86_match_cpu(deadline_match); + if (!m) +- return; ++ return true; + + /* + * Function pointers will have the MSB set due to address layout, +@@ -632,11 +631,12 @@ static void apic_check_deadline_errata(void) + rev = (u32)m->driver_data; + + if (boot_cpu_data.microcode >= rev) +- return; ++ return true; + + setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER); + pr_err(FW_BUG "TSC_DEADLINE disabled due to Errata; " + "please update microcode to version: 0x%x (or later)\n", rev); ++ return false; + } + + /* +@@ -2098,7 +2098,8 @@ void __init init_apic_mappings(void) + { + unsigned int new_apicid; + +- apic_check_deadline_errata(); ++ if (apic_validate_deadline_timer()) ++ pr_debug("TSC deadline timer available\n"); + + if (x2apic_mode) { + boot_cpu_physical_apicid = read_apic_id(); +-- +2.25.1 +