From: Sasha Levin Date: Fri, 6 Dec 2019 21:13:25 +0000 (-0500) Subject: fixes for 4.14 X-Git-Tag: v5.4.3~78 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=9c882e121c41b049686ce70f4ecfad824fcc6dc1;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch b/queue-4.14/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch new file mode 100644 index 00000000000..f411d27a675 --- /dev/null +++ b/queue-4.14/acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch @@ -0,0 +1,36 @@ +From f1077f75ca05b85e24945cc8c7dc808b5b85c293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Nov 2018 23:07:14 +0300 +Subject: ACPI: fix acpi_find_child_device() invocation in + acpi_preset_companion() + +From: Alexey Dobriyan + +[ Upstream commit f8c6d1402b89f22a3647705d63cbd171aa19a77e ] + +acpi_find_child_device() accepts boolean not pointer as last argument. + +Signed-off-by: Alexey Dobriyan +[ rjw: Subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + include/linux/acpi.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index d7a9700b93339..4bb3bca75004d 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -99,7 +99,7 @@ static inline bool has_acpi_companion(struct device *dev) + static inline void acpi_preset_companion(struct device *dev, + struct acpi_device *parent, u64 addr) + { +- ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, NULL)); ++ ACPI_COMPANION_SET(dev, acpi_find_child_device(parent, addr, false)); + } + + static inline const char *acpi_dev_name(struct acpi_device *adev) +-- +2.20.1 + diff --git a/queue-4.14/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch b/queue-4.14/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch new file mode 100644 index 00000000000..fe4d7997a6f --- /dev/null +++ b/queue-4.14/alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch @@ -0,0 +1,53 @@ +From 0f3b0f1674ecb55be09661de8cf4ac94d4ebf828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 01:17:14 +0800 +Subject: ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed() + +From: paulhsia + +[ Upstream commit f5cdc9d4003a2f66ea57b3edd3e04acc2b1a4439 ] + +If the nullity check for `substream->runtime` is outside of the lock +region, it is possible to have a null runtime in the critical section +if snd_pcm_detach_substream is called right before the lock. + +Signed-off-by: paulhsia +Link: https://lore.kernel.org/r/20191112171715.128727-2-paulhsia@chromium.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/pcm_lib.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 729a85a6211d6..80453266a2def 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -1803,11 +1803,14 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + unsigned long flags; + +- if (PCM_RUNTIME_CHECK(substream)) ++ if (snd_BUG_ON(!substream)) + return; +- runtime = substream->runtime; + + snd_pcm_stream_lock_irqsave(substream, flags); ++ if (PCM_RUNTIME_CHECK(substream)) ++ goto _unlock; ++ runtime = substream->runtime; ++ + if (!snd_pcm_running(substream) || + snd_pcm_update_hw_ptr0(substream, 1) < 0) + goto _end; +@@ -1818,6 +1821,7 @@ void snd_pcm_period_elapsed(struct snd_pcm_substream *substream) + #endif + _end: + kill_fasync(&runtime->fasync, SIGIO, POLL_IN); ++ _unlock: + snd_pcm_stream_unlock_irqrestore(substream, flags); + } + EXPORT_SYMBOL(snd_pcm_period_elapsed); +-- +2.20.1 + diff --git a/queue-4.14/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch b/queue-4.14/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch new file mode 100644 index 00000000000..565c70fdfea --- /dev/null +++ b/queue-4.14/altera-stapl-check-for-a-null-key-before-strcasecmp-.patch @@ -0,0 +1,41 @@ +From 5f84755f0811a843e5acc219037e5899a1bc0d90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Nov 2018 12:34:10 +0000 +Subject: altera-stapl: check for a null key before strcasecmp'ing it + +From: Colin Ian King + +[ Upstream commit 9ccb645683ef46e3c52c12c088a368baa58447d4 ] + +Currently the null check on key is occurring after the strcasecmp on +the key, hence there is a potential null pointer dereference on key. +Fix this by checking if key is null first. Also replace the == 0 +check on strcasecmp with just the ! operator. + +Detected by CoverityScan, CID#1248787 ("Dereference before null check") + +Fixes: fa766c9be58b ("[media] Altera FPGA firmware download module") +Signed-off-by: Colin Ian King +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/altera-stapl/altera.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c +index f53e217e963f5..494e263daa748 100644 +--- a/drivers/misc/altera-stapl/altera.c ++++ b/drivers/misc/altera-stapl/altera.c +@@ -2176,8 +2176,7 @@ static int altera_get_note(u8 *p, s32 program_size, + key_ptr = &p[note_strings + + get_unaligned_be32( + &p[note_table + (8 * i)])]; +- if ((strncasecmp(key, key_ptr, strlen(key_ptr)) == 0) && +- (key != NULL)) { ++ if (key && !strncasecmp(key, key_ptr, strlen(key_ptr))) { + status = 0; + + value_ptr = &p[note_strings + +-- +2.20.1 + diff --git a/queue-4.14/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch b/queue-4.14/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch new file mode 100644 index 00000000000..c7a1b909dc4 --- /dev/null +++ b/queue-4.14/arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch @@ -0,0 +1,172 @@ +From 9311069f18c17b191693051722ae04ab10cc6760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 10:12:30 +0100 +Subject: ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+ + +From: Vincent Whitchurch + +[ Upstream commit 344eb5539abf3e0b6ce22568c03e86450073e097 ] + +getuser() and putuser() (and there underscored variants) use two +strb[t]/ldrb[t] instructions when they are asked to get/put 16-bits. +This means that the read/write is not atomic even when performed to a +16-bit-aligned address. + +This leads to problems with vhost: vhost uses __getuser() to read the +vring's 16-bit avail.index field, and if it happens to observe a partial +update of the index, wrong descriptors will be used which will lead to a +breakdown of the virtio communication. A similar problem exists for +__putuser() which is used to write to the vring's used.index field. + +The reason these functions use strb[t]/ldrb[t] is because strht/ldrht +instructions did not exist until ARMv6T2/ARMv7. So we should be easily +able to fix this on ARMv7. Also, since all ARMv6 processors also don't +actually use the unprivileged instructions anymore for uaccess (since +CONFIG_CPU_USE_DOMAINS is not used) we can easily fix them too. + +Signed-off-by: Vincent Whitchurch +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/uaccess.h | 18 ++++++++++++++++++ + arch/arm/lib/getuser.S | 11 +++++++++++ + arch/arm/lib/putuser.S | 20 ++++++++++---------- + 3 files changed, 39 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h +index a5807b67ca8a3..fe47d24955ea0 100644 +--- a/arch/arm/include/asm/uaccess.h ++++ b/arch/arm/include/asm/uaccess.h +@@ -349,6 +349,13 @@ do { \ + #define __get_user_asm_byte(x, addr, err) \ + __get_user_asm(x, addr, err, ldrb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __get_user_asm_half(x, addr, err) \ ++ __get_user_asm(x, addr, err, ldrh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __get_user_asm_half(x, __gu_addr, err) \ + ({ \ +@@ -367,6 +374,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __get_user_asm_word(x, addr, err) \ + __get_user_asm(x, addr, err, ldr) + #endif +@@ -442,6 +451,13 @@ do { \ + #define __put_user_asm_byte(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, strb) + ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++#define __put_user_asm_half(x, __pu_addr, err) \ ++ __put_user_asm(x, __pu_addr, err, strh) ++ ++#else ++ + #ifndef __ARMEB__ + #define __put_user_asm_half(x, __pu_addr, err) \ + ({ \ +@@ -458,6 +474,8 @@ do { \ + }) + #endif + ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + #define __put_user_asm_word(x, __pu_addr, err) \ + __put_user_asm(x, __pu_addr, err, str) + +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index 746e7801dcdf7..b2e4bc3a635e2 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -42,6 +42,12 @@ _ASM_NOKPROBE(__get_user_1) + + ENTRY(__get_user_2) + check_uaccess r0, 2, r1, r2, __get_user_bad ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(ldrh) r2, [r0] ++ ++#else ++ + #ifdef CONFIG_CPU_USE_DOMAINS + rb .req ip + 2: ldrbt r2, [r0], #1 +@@ -56,6 +62,9 @@ rb .req r0 + #else + orr r2, rb, r2, lsl #8 + #endif ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ ++ + mov r0, #0 + ret lr + ENDPROC(__get_user_2) +@@ -145,7 +154,9 @@ _ASM_NOKPROBE(__get_user_bad8) + .pushsection __ex_table, "a" + .long 1b, __get_user_bad + .long 2b, __get_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __get_user_bad ++#endif + .long 4b, __get_user_bad + .long 5b, __get_user_bad8 + .long 6b, __get_user_bad8 +diff --git a/arch/arm/lib/putuser.S b/arch/arm/lib/putuser.S +index 38d660d3705f4..515eeaa9975c6 100644 +--- a/arch/arm/lib/putuser.S ++++ b/arch/arm/lib/putuser.S +@@ -41,16 +41,13 @@ ENDPROC(__put_user_1) + + ENTRY(__put_user_2) + check_uaccess r0, 2, r1, ip, __put_user_bad +- mov ip, r2, lsr #8 +-#ifdef CONFIG_THUMB2_KERNEL +-#ifndef __ARMEB__ +-2: TUSER(strb) r2, [r0] +-3: TUSER(strb) ip, [r0, #1] ++#if __LINUX_ARM_ARCH__ >= 6 ++ ++2: TUSER(strh) r2, [r0] ++ + #else +-2: TUSER(strb) ip, [r0] +-3: TUSER(strb) r2, [r0, #1] +-#endif +-#else /* !CONFIG_THUMB2_KERNEL */ ++ ++ mov ip, r2, lsr #8 + #ifndef __ARMEB__ + 2: TUSER(strb) r2, [r0], #1 + 3: TUSER(strb) ip, [r0] +@@ -58,7 +55,8 @@ ENTRY(__put_user_2) + 2: TUSER(strb) ip, [r0], #1 + 3: TUSER(strb) r2, [r0] + #endif +-#endif /* CONFIG_THUMB2_KERNEL */ ++ ++#endif /* __LINUX_ARM_ARCH__ >= 6 */ + mov r0, #0 + ret lr + ENDPROC(__put_user_2) +@@ -91,7 +89,9 @@ ENDPROC(__put_user_bad) + .pushsection __ex_table, "a" + .long 1b, __put_user_bad + .long 2b, __put_user_bad ++#if __LINUX_ARM_ARCH__ < 6 + .long 3b, __put_user_bad ++#endif + .long 4b, __put_user_bad + .long 5b, __put_user_bad + .long 6b, __put_user_bad +-- +2.20.1 + diff --git a/queue-4.14/arm-debug-enable-uart1-for-socfpga-cyclone5.patch b/queue-4.14/arm-debug-enable-uart1-for-socfpga-cyclone5.patch new file mode 100644 index 00000000000..b4027c5e249 --- /dev/null +++ b/queue-4.14/arm-debug-enable-uart1-for-socfpga-cyclone5.patch @@ -0,0 +1,87 @@ +From 2c1c59ff5936068c66547ca5158be55b5478b7d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Oct 2018 13:28:37 +0200 +Subject: ARM: debug: enable UART1 for socfpga Cyclone5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Péron + +[ Upstream commit f6628486c8489e91c513b62608f89ccdb745600d ] + +Cyclone5 and Arria10 doesn't have the same memory map for UART1. + +Split the SOCFPGA_UART1 into 2 options to allow debugging on UART1 for Cyclone5. + +Signed-off-by: Clément Péron +Signed-off-by: Dinh Nguyen +Signed-off-by: Sasha Levin +--- + arch/arm/Kconfig.debug | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/Kconfig.debug b/arch/arm/Kconfig.debug +index fd4b679945d3a..b14f154919a5d 100644 +--- a/arch/arm/Kconfig.debug ++++ b/arch/arm/Kconfig.debug +@@ -1023,14 +1023,21 @@ choice + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + +- config DEBUG_SOCFPGA_UART1 ++ config DEBUG_SOCFPGA_ARRIA10_UART1 + depends on ARCH_SOCFPGA +- bool "Use SOCFPGA UART1 for low-level debug" ++ bool "Use SOCFPGA Arria10 UART1 for low-level debug" + select DEBUG_UART_8250 + help + Say Y here if you want kernel low-level debugging support + on SOCFPGA(Arria 10) based platforms. + ++ config DEBUG_SOCFPGA_CYCLONE5_UART1 ++ depends on ARCH_SOCFPGA ++ bool "Use SOCFPGA Cyclone 5 UART1 for low-level debug" ++ select DEBUG_UART_8250 ++ help ++ Say Y here if you want kernel low-level debugging support ++ on SOCFPGA(Cyclone 5 and Arria 5) based platforms. + + config DEBUG_SUN9I_UART0 + bool "Kernel low-level debugging messages via sun9i UART0" +@@ -1585,7 +1592,8 @@ config DEBUG_UART_PHYS + default 0xfe800000 if ARCH_IOP32X + default 0xff690000 if DEBUG_RK32_UART2 + default 0xffc02000 if DEBUG_SOCFPGA_UART0 +- default 0xffc02100 if DEBUG_SOCFPGA_UART1 ++ default 0xffc02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xffc03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xffd82340 if ARCH_IOP13XX + default 0xffe40000 if DEBUG_RCAR_GEN1_SCIF0 + default 0xffe42000 if DEBUG_RCAR_GEN1_SCIF2 +@@ -1689,7 +1697,8 @@ config DEBUG_UART_VIRT + default 0xfeb30c00 if DEBUG_KEYSTONE_UART0 + default 0xfeb31000 if DEBUG_KEYSTONE_UART1 + default 0xfec02000 if DEBUG_SOCFPGA_UART0 +- default 0xfec02100 if DEBUG_SOCFPGA_UART1 ++ default 0xfec02100 if DEBUG_SOCFPGA_ARRIA10_UART1 ++ default 0xfec03000 if DEBUG_SOCFPGA_CYCLONE5_UART1 + default 0xfec12000 if (DEBUG_MVEBU_UART0 || DEBUG_MVEBU_UART0_ALTERNATE) && ARCH_MVEBU + default 0xfec12100 if DEBUG_MVEBU_UART1_ALTERNATE + default 0xfec10000 if DEBUG_SIRFATLAS7_UART0 +@@ -1737,9 +1746,9 @@ config DEBUG_UART_8250_WORD + depends on DEBUG_LL_UART_8250 || DEBUG_UART_8250 + depends on DEBUG_UART_8250_SHIFT >= 2 + default y if DEBUG_PICOXCELL_UART || \ +- DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_UART1 || \ +- DEBUG_KEYSTONE_UART0 || DEBUG_KEYSTONE_UART1 || \ +- DEBUG_ALPINE_UART0 || \ ++ DEBUG_SOCFPGA_UART0 || DEBUG_SOCFPGA_ARRIA10_UART1 || \ ++ DEBUG_SOCFPGA_CYCLONE5_UART1 || DEBUG_KEYSTONE_UART0 || \ ++ DEBUG_KEYSTONE_UART1 || DEBUG_ALPINE_UART0 || \ + DEBUG_DAVINCI_DMx_UART0 || DEBUG_DAVINCI_DA8XX_UART1 || \ + DEBUG_DAVINCI_DA8XX_UART2 || \ + DEBUG_BCM_KONA_UART || DEBUG_RK32_UART2 +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch b/queue-4.14/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch new file mode 100644 index 00000000000..e5e0faa477a --- /dev/null +++ b/queue-4.14/arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch @@ -0,0 +1,36 @@ +From 536fa7d95260294526be36bb5476c6ecce3cafba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 16:54:28 +0100 +Subject: ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module + +From: Marek Szyprowski + +[ Upstream commit 6035cbcceb069f87296b3cd0bc4736ad5618bf47 ] + +DWC2 hardware module integrated in Samsung SoCs requires some quirks to +operate properly, so use Samsung SoC specific compatible to notify driver +to apply respective fixes. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos3250.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos3250.dtsi b/arch/arm/boot/dts/exynos3250.dtsi +index aa06a02c3ff59..5ba6622549097 100644 +--- a/arch/arm/boot/dts/exynos3250.dtsi ++++ b/arch/arm/boot/dts/exynos3250.dtsi +@@ -359,7 +359,7 @@ + }; + + hsotg: hsotg@12480000 { +- compatible = "snps,dwc2"; ++ compatible = "samsung,s3c6400-hsotg", "snps,dwc2"; + reg = <0x12480000 0x20000>; + interrupts = ; + clocks = <&cmu CLK_USBOTG>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch b/queue-4.14/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch new file mode 100644 index 00000000000..92ed12f1829 --- /dev/null +++ b/queue-4.14/arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch @@ -0,0 +1,36 @@ +From 208431682224827dd5eb7ad41ed3ceca050780d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 18:53:06 +0100 +Subject: ARM: dts: mmp2: fix the gpio interrupt cell number + +From: Lubomir Rintel + +[ Upstream commit 400583983f8a8e95ec02c9c9e2b50188753a87fb ] + +gpio-pxa uses two cell to encode the interrupt source: the pin number +and the trigger type. Adjust the device node accordingly. + +Signed-off-by: Lubomir Rintel +Acked-by: Pavel Machek +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/mmp2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/mmp2.dtsi b/arch/arm/boot/dts/mmp2.dtsi +index 47e5b63339d18..e95deed6a7973 100644 +--- a/arch/arm/boot/dts/mmp2.dtsi ++++ b/arch/arm/boot/dts/mmp2.dtsi +@@ -180,7 +180,7 @@ + clocks = <&soc_clocks MMP2_CLK_GPIO>; + resets = <&soc_clocks MMP2_CLK_GPIO>; + interrupt-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + ranges; + + gcb0: gpio@d4019000 { +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-pxa-clean-up-usb-controller-nodes.patch b/queue-4.14/arm-dts-pxa-clean-up-usb-controller-nodes.patch new file mode 100644 index 00000000000..eb60e8efaa9 --- /dev/null +++ b/queue-4.14/arm-dts-pxa-clean-up-usb-controller-nodes.patch @@ -0,0 +1,73 @@ +From 6c87046fdf7ccb307a1e859a8812a06a3f6237dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Dec 2018 14:54:51 +0100 +Subject: ARM: dts: pxa: clean up USB controller nodes + +From: Daniel Mack + +[ Upstream commit c40ad24254f1dbd54f2df5f5f524130dc1862122 ] + +PXA25xx SoCs don't have a USB controller, so drop the node from the +common pxa2xx.dtsi base file. Both pxa27x and pxa3xx have a dedicated +node already anyway. + +While at it, unify the names for the nodes across all pxa platforms. + +Signed-off-by: Daniel Mack +Reported-by: Sergey Yanovich +Link: https://patchwork.kernel.org/patch/8375421/ +Signed-off-by: Robert Jarzmik +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/pxa27x.dtsi | 2 +- + arch/arm/boot/dts/pxa2xx.dtsi | 7 ------- + arch/arm/boot/dts/pxa3xx.dtsi | 2 +- + 3 files changed, 2 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi +index 3228ad5fb725f..ccbecad9c5c7c 100644 +--- a/arch/arm/boot/dts/pxa27x.dtsi ++++ b/arch/arm/boot/dts/pxa27x.dtsi +@@ -35,7 +35,7 @@ + clocks = <&clks CLK_NONE>; + }; + +- pxa27x_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +diff --git a/arch/arm/boot/dts/pxa2xx.dtsi b/arch/arm/boot/dts/pxa2xx.dtsi +index e4ebcde17837c..a03bca81ae8a6 100644 +--- a/arch/arm/boot/dts/pxa2xx.dtsi ++++ b/arch/arm/boot/dts/pxa2xx.dtsi +@@ -117,13 +117,6 @@ + status = "disabled"; + }; + +- usb0: ohci@4c000000 { +- compatible = "marvell,pxa-ohci"; +- reg = <0x4c000000 0x10000>; +- interrupts = <3>; +- status = "disabled"; +- }; +- + mmc0: mmc@41100000 { + compatible = "marvell,pxa-mmc"; + reg = <0x41100000 0x1000>; +diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi +index 55c75b67351cb..affa5b6f6da14 100644 +--- a/arch/arm/boot/dts/pxa3xx.dtsi ++++ b/arch/arm/boot/dts/pxa3xx.dtsi +@@ -189,7 +189,7 @@ + status = "disabled"; + }; + +- pxa3xx_ohci: usb@4c000000 { ++ usb0: usb@4c000000 { + compatible = "marvell,pxa-ohci"; + reg = <0x4c000000 0x10000>; + interrupts = <3>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch b/queue-4.14/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch new file mode 100644 index 00000000000..60ddb1e3d01 --- /dev/null +++ b/queue-4.14/arm-dts-realview-fix-some-more-duplicate-regulator-n.patch @@ -0,0 +1,73 @@ +From 014adf5437d9e2f011c90febee77ff2561465a11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 13:12:48 -0600 +Subject: ARM: dts: realview: Fix some more duplicate regulator nodes + +From: Rob Herring + +[ Upstream commit f3b2f758ec1e6cdb13c925647cbd8ad4938b78fb ] + +There's a bug in dtc in checking for duplicate node names when there's +another section (e.g. "/ { };"). In this case, skeleton.dtsi provides +another section. Upon removal of skeleton.dtsi, the dtb fails to build +due to a duplicate node 'fixedregulator@0'. As both nodes were pretty +much the same 3.3V fixed regulator, it hasn't really mattered. Fix this +by renaming the nodes to something unique. In the process, drop the +unit-address which shouldn't be present wtihout reg property. + +Signed-off-by: Rob Herring +Reviewed-by: Linus Walleij +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm-realview-pb1176.dts | 4 ++-- + arch/arm/boot/dts/arm-realview-pb11mp.dts | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/arm-realview-pb1176.dts b/arch/arm/boot/dts/arm-realview-pb1176.dts +index c1fd5615ddfe3..939c108c24a6c 100644 +--- a/arch/arm/boot/dts/arm-realview-pb1176.dts ++++ b/arch/arm/boot/dts/arm-realview-pb1176.dts +@@ -45,7 +45,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -53,7 +53,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +diff --git a/arch/arm/boot/dts/arm-realview-pb11mp.dts b/arch/arm/boot/dts/arm-realview-pb11mp.dts +index e306f1cceb4ec..95037c48182de 100644 +--- a/arch/arm/boot/dts/arm-realview-pb11mp.dts ++++ b/arch/arm/boot/dts/arm-realview-pb11mp.dts +@@ -145,7 +145,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -153,7 +153,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch b/queue-4.14/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch new file mode 100644 index 00000000000..0c2d881ebe6 --- /dev/null +++ b/queue-4.14/arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch @@ -0,0 +1,55 @@ +From 2073072808d9d760b523da120aac5357dbc6cfb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 19:05:47 -0600 +Subject: ARM: dts: realview-pbx: Fix duplicate regulator nodes + +From: Rob Herring + +[ Upstream commit 7f4b001b7f6e0480b5bdab9cd8ce1711e43e5cb5 ] + +There's a bug in dtc in checking for duplicate node names when there's +another section (e.g. "/ { };"). In this case, skeleton.dtsi provides +another section. Upon removal of skeleton.dtsi, the dtb fails to build +due to a duplicate node 'fixedregulator@0'. As both nodes were pretty +much the same 3.3V fixed regulator, it hasn't really mattered. Fix this +by renaming the nodes to something unique. In the process, drop the +unit-address which shouldn't be present wtihout reg property. + +Cc: Linus Walleij +Signed-off-by: Rob Herring +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/arm-realview-pbx.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/arm-realview-pbx.dtsi b/arch/arm/boot/dts/arm-realview-pbx.dtsi +index 2bf3958b2e6b9..068293254fbb8 100644 +--- a/arch/arm/boot/dts/arm-realview-pbx.dtsi ++++ b/arch/arm/boot/dts/arm-realview-pbx.dtsi +@@ -43,7 +43,7 @@ + }; + + /* The voltage to the MMC card is hardwired at 3.3V */ +- vmmc: fixedregulator@0 { ++ vmmc: regulator-vmmc { + compatible = "regulator-fixed"; + regulator-name = "vmmc"; + regulator-min-microvolt = <3300000>; +@@ -51,7 +51,7 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { ++ veth: regulator-veth { + compatible = "regulator-fixed"; + regulator-name = "veth"; + regulator-min-microvolt = <3300000>; +@@ -539,4 +539,3 @@ + }; + }; + }; +- +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch b/queue-4.14/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch new file mode 100644 index 00000000000..bfc381d34a9 --- /dev/null +++ b/queue-4.14/arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch @@ -0,0 +1,65 @@ +From e1e6efb68785bfe17d5f4cfde0eccacdfa54ceaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 15:35:04 -0200 +Subject: ARM: dts: rockchip: Assign the proper GPIO clocks for rv1108 + +From: Otavio Salvador + +[ Upstream commit efc2e0bd9594060915696a418564aefd0270b1d6 ] + +It is not correct to assign the 24MHz clock oscillator to the GPIO +ports. + +Fix it by assigning the proper GPIO clocks instead. + +Signed-off-by: Otavio Salvador +Tested-by: Fabio Berton +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rv1108.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi +index 6013d2f888c33..aa4119eaea987 100644 +--- a/arch/arm/boot/dts/rv1108.dtsi ++++ b/arch/arm/boot/dts/rv1108.dtsi +@@ -522,7 +522,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x20030000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO0_PMU>; + + gpio-controller; + #gpio-cells = <2>; +@@ -535,7 +535,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10310000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO1>; + + gpio-controller; + #gpio-cells = <2>; +@@ -548,7 +548,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10320000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO2>; + + gpio-controller; + #gpio-cells = <2>; +@@ -561,7 +561,7 @@ + compatible = "rockchip,gpio-bank"; + reg = <0x10330000 0x100>; + interrupts = ; +- clocks = <&xin24m>; ++ clocks = <&cru PCLK_GPIO3>; + + gpio-controller; + #gpio-cells = <2>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch b/queue-4.14/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch new file mode 100644 index 00000000000..7a61684a137 --- /dev/null +++ b/queue-4.14/arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch @@ -0,0 +1,36 @@ +From 14873fad9ddbbcf801f0c2260490d85dc2d52562 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 15:24:13 +0000 +Subject: ARM: dts: rockchip: Fix rk3288-rock2 vcc_flash name + +From: John Keeping + +[ Upstream commit 03d9f8fa2bfdc791865624d3adc29070cf67814e ] + +There is no functional change from this, but it is confusing to find two +copies of vcc_sys and no vcc_flash when looking in +/sys/class/regulator/*/name. + +Signed-off-by: John Keeping +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3288-rock2-som.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3288-rock2-som.dtsi b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +index b9c471fcbd42b..862c2248fcb6d 100644 +--- a/arch/arm/boot/dts/rk3288-rock2-som.dtsi ++++ b/arch/arm/boot/dts/rk3288-rock2-som.dtsi +@@ -63,7 +63,7 @@ + + vcc_flash: flash-regulator { + compatible = "regulator-fixed"; +- regulator-name = "vcc_sys"; ++ regulator-name = "vcc_flash"; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + startup-delay-us = <150>; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch b/queue-4.14/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch new file mode 100644 index 00000000000..eb5bf2530a8 --- /dev/null +++ b/queue-4.14/arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch @@ -0,0 +1,36 @@ +From a0461ea423455dc132d48762c03970dbf24aed88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 15:35:03 -0200 +Subject: ARM: dts: rockchip: Fix the PMU interrupt number for rv1108 + +From: Otavio Salvador + +[ Upstream commit c955b7aec510145129ca7aaea6ecbf6d748f5ebf ] + +According to the Rockchip vendor tree the PMU interrupt number is +76, so fix it accordingly. + +Signed-off-by: Otavio Salvador +Tested-by: Fabio Berton +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rv1108.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rv1108.dtsi b/arch/arm/boot/dts/rv1108.dtsi +index e7cd1315db1b7..6013d2f888c33 100644 +--- a/arch/arm/boot/dts/rv1108.dtsi ++++ b/arch/arm/boot/dts/rv1108.dtsi +@@ -101,7 +101,7 @@ + + arm-pmu { + compatible = "arm,cortex-a7-pmu"; +- interrupts = ; ++ interrupts = ; + }; + + timer { +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch b/queue-4.14/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch new file mode 100644 index 00000000000..0ebf3a0466d --- /dev/null +++ b/queue-4.14/arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch @@ -0,0 +1,36 @@ +From a27210343063443c00448f9e1af950ec11321011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Sep 2018 16:00:22 +0200 +Subject: ARM: dts: sun5i: a10s: Fix HDMI output DTC warning + +From: Maxime Ripard + +[ Upstream commit ed5fc60b909427be6ca93d3e07a0a5f296d7000a ] + +Our HDMI output endpoint on the A10s DTSI has a warning under DTC: "graph +node has single child node 'endpoint', #address-cells/#size-cells are not +necessary". Fix this by removing those properties. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun5i-a10s.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi +index 18f25c5e75aeb..396fb6632bf07 100644 +--- a/arch/arm/boot/dts/sun5i-a10s.dtsi ++++ b/arch/arm/boot/dts/sun5i-a10s.dtsi +@@ -104,8 +104,6 @@ + }; + + hdmi_out: port@1 { +- #address-cells = <1>; +- #size-cells = <0>; + reg = <1>; + }; + }; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch b/queue-4.14/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch new file mode 100644 index 00000000000..72ec3ef5941 --- /dev/null +++ b/queue-4.14/arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch @@ -0,0 +1,93 @@ +From ddd09a8697aeb02054aa9eb52408cbe0a2dd6a86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 10:58:01 +0100 +Subject: ARM: dts: sun8i: v3s: Change pinctrl nodes to avoid warning + +From: Maxime Ripard + +[ Upstream commit 438a44ce7e51ce571f942433c6c7cb87c4c0effd ] + +All our pinctrl nodes were using a node name convention with a unit-address +to differentiate the different muxing options. However, since those nodes +didn't have a reg property, they were generating warnings in DTC. + +In order to accomodate for this, convert the old nodes to the syntax we've +been using for the new SoCs, including removing the letter suffix of the +node labels to the bank of those pins to make things more readable. + +Signed-off-by: Maxime Ripard +Acked-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts | 4 ++-- + arch/arm/boot/dts/sun8i-v3s.dtsi | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +index 387fc2aa546d6..333df90e8037c 100644 +--- a/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts ++++ b/arch/arm/boot/dts/sun8i-v3s-licheepi-zero.dts +@@ -78,7 +78,7 @@ + }; + + &mmc0 { +- pinctrl-0 = <&mmc0_pins_a>; ++ pinctrl-0 = <&mmc0_pins>; + pinctrl-names = "default"; + broken-cd; + bus-width = <4>; +@@ -87,7 +87,7 @@ + }; + + &uart0 { +- pinctrl-0 = <&uart0_pins_a>; ++ pinctrl-0 = <&uart0_pb_pins>; + pinctrl-names = "default"; + status = "okay"; + }; +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index 3a06dc5b37467..da5823c6fa3e6 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -292,17 +292,17 @@ + interrupt-controller; + #interrupt-cells = <3>; + +- i2c0_pins: i2c0 { ++ i2c0_pins: i2c0-pins { + pins = "PB6", "PB7"; + function = "i2c0"; + }; + +- uart0_pins_a: uart0@0 { ++ uart0_pb_pins: uart0-pb-pins { + pins = "PB8", "PB9"; + function = "uart0"; + }; + +- mmc0_pins_a: mmc0@0 { ++ mmc0_pins: mmc0-pins { + pins = "PF0", "PF1", "PF2", "PF3", + "PF4", "PF5"; + function = "mmc0"; +@@ -310,7 +310,7 @@ + bias-pull-up; + }; + +- mmc1_pins: mmc1 { ++ mmc1_pins: mmc1-pins { + pins = "PG0", "PG1", "PG2", "PG3", + "PG4", "PG5"; + function = "mmc1"; +@@ -318,7 +318,7 @@ + bias-pull-up; + }; + +- spi0_pins: spi0 { ++ spi0_pins: spi0-pins { + pins = "PC0", "PC1", "PC2", "PC3"; + function = "spi0"; + }; +-- +2.20.1 + diff --git a/queue-4.14/arm-dts-sunxi-fix-pmu-compatible-strings.patch b/queue-4.14/arm-dts-sunxi-fix-pmu-compatible-strings.patch new file mode 100644 index 00000000000..8e06a7fc29a --- /dev/null +++ b/queue-4.14/arm-dts-sunxi-fix-pmu-compatible-strings.patch @@ -0,0 +1,52 @@ +From b17e0ba4d24b034b382e245bf41de917ac07aa66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 13:11:42 -0600 +Subject: ARM: dts: sunxi: Fix PMU compatible strings + +From: Rob Herring + +[ Upstream commit 5719ac19fc32d892434939c1756c2f9a8322e6ef ] + +"arm,cortex-a15-pmu" is not a valid fallback compatible string for an +Cortex-A7 PMU, so drop it. + +Cc: Maxime Ripard +Cc: Chen-Yu Tsai +Signed-off-by: Rob Herring +Acked-by: Will Deacon +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun6i-a31.dtsi | 2 +- + arch/arm/boot/dts/sun7i-a20.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun6i-a31.dtsi b/arch/arm/boot/dts/sun6i-a31.dtsi +index eef072a21acca..0bb82d0442a59 100644 +--- a/arch/arm/boot/dts/sun6i-a31.dtsi ++++ b/arch/arm/boot/dts/sun6i-a31.dtsi +@@ -173,7 +173,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + , + , +diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi +index 96bee776e1456..77f04dbdf9967 100644 +--- a/arch/arm/boot/dts/sun7i-a20.dtsi ++++ b/arch/arm/boot/dts/sun7i-a20.dtsi +@@ -171,7 +171,7 @@ + }; + + pmu { +- compatible = "arm,cortex-a7-pmu", "arm,cortex-a15-pmu"; ++ compatible = "arm,cortex-a7-pmu"; + interrupts = , + ; + }; +-- +2.20.1 + diff --git a/queue-4.14/arm-omap1-2-fix-soc-name-printing.patch b/queue-4.14/arm-omap1-2-fix-soc-name-printing.patch new file mode 100644 index 00000000000..6086d9fc6df --- /dev/null +++ b/queue-4.14/arm-omap1-2-fix-soc-name-printing.patch @@ -0,0 +1,63 @@ +From 2cbfe58f1c22f58e4d283013eea76bdfca7c2a98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 21:46:41 +0200 +Subject: ARM: OMAP1/2: fix SoC name printing + +From: Aaro Koskinen + +[ Upstream commit 04a92358b3964988c78dfe370a559ae550383886 ] + +Currently we get extra newlines on OMAP1/2 when the SoC name is printed: + +[ 0.000000] OMAP1510 +[ 0.000000] revision 2 handled as 15xx id: bc058c9b93111a16 + +[ 0.000000] OMAP2420 +[ 0.000000] + +Fix by using pr_cont. + +Signed-off-by: Aaro Koskinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/id.c | 6 +++--- + arch/arm/mach-omap2/id.c | 4 ++-- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/mach-omap1/id.c b/arch/arm/mach-omap1/id.c +index 52de382fc8047..7e49dfda3d2f4 100644 +--- a/arch/arm/mach-omap1/id.c ++++ b/arch/arm/mach-omap1/id.c +@@ -200,10 +200,10 @@ void __init omap_check_revision(void) + printk(KERN_INFO "Unknown OMAP cpu type: 0x%02x\n", cpu_type); + } + +- printk(KERN_INFO "OMAP%04x", omap_revision >> 16); ++ pr_info("OMAP%04x", omap_revision >> 16); + if ((omap_revision >> 8) & 0xff) +- printk(KERN_INFO "%x", (omap_revision >> 8) & 0xff); +- printk(KERN_INFO " revision %i handled as %02xxx id: %08x%08x\n", ++ pr_cont("%x", (omap_revision >> 8) & 0xff); ++ pr_cont(" revision %i handled as %02xxx id: %08x%08x\n", + die_rev, omap_revision & 0xff, system_serial_low, + system_serial_high); + } +diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c +index 16cb1c195fd8e..79d71b1eae594 100644 +--- a/arch/arm/mach-omap2/id.c ++++ b/arch/arm/mach-omap2/id.c +@@ -199,8 +199,8 @@ void __init omap2xxx_check_revision(void) + + pr_info("%s", soc_name); + if ((omap_rev() >> 8) & 0x0f) +- pr_info("%s", soc_rev); +- pr_info("\n"); ++ pr_cont("%s", soc_rev); ++ pr_cont("\n"); + } + + #define OMAP3_SHOW_FEATURE(feat) \ +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch b/queue-4.14/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..3cb011bc99e --- /dev/null +++ b/queue-4.14/arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From a15e0cd445c157de8a67682e927ef86aa1597e04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:48 +0100 +Subject: arm64: dts: meson-gxbb-nanopi-k2: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit f0783f5edb52af14ecaae6c5ce4f38e0a358f5d8 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 12ada0513d7a ("ARM64: dts: meson-gxbb-nanopi-k2: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +index 4b17a76959b2f..c83c028e95af0 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +@@ -178,7 +178,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "Power Control", "Power Key In", + "VCCK En", "CON1 Header Pin31", + "I2S Header Pin6", "IR In", "I2S Header Pin7", +@@ -186,7 +186,7 @@ + "I2S Header Pin5", "HDMI CEC", "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch b/queue-4.14/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..5a980e78c76 --- /dev/null +++ b/queue-4.14/arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From ad66bbfd234843d3bf53331772a9ad5a0f3c8973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:49 +0100 +Subject: arm64: dts: meson-gxbb-odroidc2: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 2165b006b65d609140dafafcb14cce5a4aaacbab ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: b03c7d6438bb ("ARM64: dts: meson-gxbb-odroidc2: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index c3c65b06ba76b..4ea23df81f212 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -189,7 +189,7 @@ + pinctrl-names = "default"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", "UART RX", "VCCK En", "TF 3V3/1V8 En", + "USB HUB nRESET", "USB OTG Power En", + "J7 Header Pin2", "IR In", "J7 Header Pin4", +@@ -197,7 +197,7 @@ + "HDMI CEC", "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "Eth MDIO", "Eth MDC", "Eth RGMII RX Clk", + "Eth RX DV", "Eth RX D0", "Eth RX D1", "Eth RX D2", +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch b/queue-4.14/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch new file mode 100644 index 00000000000..4eb9796eeda --- /dev/null +++ b/queue-4.14/arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch @@ -0,0 +1,46 @@ +From b1c4eeeb2c6e92b8363e834b17008d357c655d64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:50 +0100 +Subject: arm64: dts: meson-gxl-khadas-vim: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 5b78012636f537344bd551934387f5772c38ba80 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 60795933b709 ("ARM64: dts: meson-gxl-khadas-vim: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +index edc512ad0bac3..fb5db5f33e8c3 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-khadas-vim.dts +@@ -112,7 +112,7 @@ + linux,rc-map-name = "rc-geekbox"; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Power Key In", +@@ -125,7 +125,7 @@ + "SYS LED"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +-- +2.20.1 + diff --git a/queue-4.14/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch b/queue-4.14/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch new file mode 100644 index 00000000000..6509912d2a7 --- /dev/null +++ b/queue-4.14/arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch @@ -0,0 +1,46 @@ +From 1def23eeb06724a69cc96235c95e79105d0a3d8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 11:45:47 +0100 +Subject: arm64: dts: meson-gxl-libretech-cc: fix GPIO lines names + +From: Neil Armstrong + +[ Upstream commit 11fa9774612decea87144d7f950a9c53a4fe3050 ] + +The gpio line names were set in the pinctrl node instead of the gpio node, +at the time it was merged, it worked, but was obviously wrong. +This patch moves the properties to the gpio nodes. + +Fixes: 47884c5c746e ("ARM64: dts: meson-gxl-libretech-cc: Add GPIO lines names") +Signed-off-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index 0814b6b29b86a..e2c71753e3278 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -139,7 +139,7 @@ + }; + }; + +-&pinctrl_aobus { ++&gpio_ao { + gpio-line-names = "UART TX", + "UART RX", + "Blue LED", +@@ -152,7 +152,7 @@ + "7J1 Header Pin13"; + }; + +-&pinctrl_periphs { ++&gpio { + gpio-line-names = /* Bank GPIOZ */ + "", "", "", "", "", "", "", + "", "", "", "", "", "", "", +-- +2.20.1 + diff --git a/queue-4.14/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch b/queue-4.14/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch new file mode 100644 index 00000000000..00dd53883d8 --- /dev/null +++ b/queue-4.14/arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch @@ -0,0 +1,41 @@ +From d87b6b8fde8f24c39899cde985792637aeb7d1c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 17:47:25 +0100 +Subject: arm64: tegra: Fix power key interrupt type on Jetson TX2 + +From: Thierry Reding + +[ Upstream commit 6f13f10b3bbfed3b29c812f0f65bef802ce05e3c ] + +In order for the correct interrupt type to be configured, the event +action for the power key needs to be "asserted". + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +index c71d762bf697b..a658a253e973e 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts ++++ b/arch/arm64/boot/dts/nvidia/tegra186-p2771-0000.dts +@@ -2,6 +2,7 @@ + /dts-v1/; + + #include ++#include + + #include "tegra186-p3310.dtsi" + +@@ -60,6 +61,7 @@ + linux,input-type = ; + linux,code = ; + debounce-interval = <10>; ++ wakeup-event-action = ; + wakeup-source; + }; + +-- +2.20.1 + diff --git a/queue-4.14/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch b/queue-4.14/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch new file mode 100644 index 00000000000..4c61daa5e1d --- /dev/null +++ b/queue-4.14/asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch @@ -0,0 +1,41 @@ +From 82d733db725b8d05aa09dfcc1e80f785c58edfae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 06:33:16 +0000 +Subject: ASoC: au8540: use 64-bit arithmetic instead of 32-bit + +From: Young_X + +[ Upstream commit cd7fdc45bc69a62b4e22c6e875f1f1aea566256d ] + +Add suffix ULL to constant 256 in order to give the compiler complete +information about the proper arithmetic to use. + +Notice that such constant is used in a context that expects an +expression of type u64 (64 bits, unsigned) and the following +expression is currently being evaluated using 32-bit arithmetic: + + 256 * fs * 2 * mclk_src_scaling[i].param + +Signed-off-by: Young_X +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8540.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/nau8540.c b/sound/soc/codecs/nau8540.c +index f9c9933acffb6..c0c64f90a61b7 100644 +--- a/sound/soc/codecs/nau8540.c ++++ b/sound/soc/codecs/nau8540.c +@@ -548,7 +548,7 @@ static int nau8540_calc_fll_param(unsigned int fll_in, + fvco_max = 0; + fvco_sel = ARRAY_SIZE(mclk_src_scaling); + for (i = 0; i < ARRAY_SIZE(mclk_src_scaling); i++) { +- fvco = 256 * fs * 2 * mclk_src_scaling[i].param; ++ fvco = 256ULL * fs * 2 * mclk_src_scaling[i].param; + if (fvco > NAU_FVCO_MIN && fvco < NAU_FVCO_MAX && + fvco_max < fvco) { + fvco_max = fvco; +-- +2.20.1 + diff --git a/queue-4.14/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch b/queue-4.14/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch new file mode 100644 index 00000000000..34d122ac8db --- /dev/null +++ b/queue-4.14/asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch @@ -0,0 +1,62 @@ +From bdf3e5605c548f736def7277364fe86f7040766a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 07:35:34 +0000 +Subject: ASoC: rsnd: tidyup registering method for rsnd_kctrl_new() + +From: Kuninori Morimoto + +[ Upstream commit 9c698e8481a15237a5b1db5f8391dd66d59e42a4 ] + +Current rsnd dvc.c is using flags to avoid duplicating register for +MIXer case. OTOH, commit e894efef9ac7 ("ASoC: core: add support to card +rebind") allows to rebind sound card without rebinding all drivers. + +Because of above patch and dvc.c flags, it can't re-register kctrl if +only sound card was rebinded, because dvc is keeping old flags. +(Of course it will be no problem if rsnd driver also be rebinded, +but it is not purpose of above patch). + +This patch checks current card registered kctrl when registering. +In MIXer case, it can avoid duplicate register if card already has same +kctrl. In rebind case, it can re-register kctrl because card registered +kctl had been removed when unbinding. + +This patch is updated version of commit b918f1bc7f1ce ("ASoC: rsnd: DVC +kctrl sets once") + +Reported-by: Nguyen Viet Dung +Signed-off-by: Kuninori Morimoto +Tested-by: Nguyen Viet Dung +Cc: Hiroyuki Yokoyama +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/core.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index ab0bbef7eb48a..bb06dd72ca9a7 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -1278,6 +1278,18 @@ int rsnd_kctrl_new(struct rsnd_mod *mod, + }; + int ret; + ++ /* ++ * 1) Avoid duplicate register (ex. MIXer case) ++ * 2) re-register if card was rebinded ++ */ ++ list_for_each_entry(kctrl, &card->controls, list) { ++ struct rsnd_kctrl_cfg *c = kctrl->private_data; ++ ++ if (strcmp(kctrl->id.name, name) == 0 && ++ c->mod == mod) ++ return 0; ++ } ++ + if (size > RSND_MAX_CHANNELS) + return -EINVAL; + +-- +2.20.1 + diff --git a/queue-4.14/audit_get_nd-don-t-unlock-parent-too-early.patch b/queue-4.14/audit_get_nd-don-t-unlock-parent-too-early.patch new file mode 100644 index 00000000000..6e302f43970 --- /dev/null +++ b/queue-4.14/audit_get_nd-don-t-unlock-parent-too-early.patch @@ -0,0 +1,40 @@ +From 2b10712047bd2002790fabe542f1a687ccbe5190 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Nov 2019 13:11:41 -0400 +Subject: audit_get_nd(): don't unlock parent too early + +From: Al Viro + +[ Upstream commit 69924b89687a2923e88cc42144aea27868913d0e ] + +if the child has been negative and just went positive +under us, we want coherent d_is_positive() and ->d_inode. +Don't unlock the parent until we'd done that work... + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + kernel/audit_watch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index 4a98f6e314a9b..35f1d706bd5b4 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -365,12 +365,12 @@ static int audit_get_nd(struct audit_watch *watch, struct path *parent) + struct dentry *d = kern_path_locked(watch->path, parent); + if (IS_ERR(d)) + return PTR_ERR(d); +- inode_unlock(d_backing_inode(parent->dentry)); + if (d_is_positive(d)) { + /* update watch filter fields */ + watch->dev = d->d_sb->s_dev; + watch->ino = d_backing_inode(d)->i_ino; + } ++ inode_unlock(d_backing_inode(parent->dentry)); + dput(d); + return 0; + } +-- +2.20.1 + diff --git a/queue-4.14/autofs-fix-a-leak-in-autofs_expire_indirect.patch b/queue-4.14/autofs-fix-a-leak-in-autofs_expire_indirect.patch new file mode 100644 index 00000000000..58453e08791 --- /dev/null +++ b/queue-4.14/autofs-fix-a-leak-in-autofs_expire_indirect.patch @@ -0,0 +1,39 @@ +From 826605051e7050d7550f631ffd078de030eb8065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Oct 2019 00:03:11 -0400 +Subject: autofs: fix a leak in autofs_expire_indirect() + +From: Al Viro + +[ Upstream commit 03ad0d703df75c43f78bd72e16124b5b94a95188 ] + +if the second call of should_expire() in there ends up +grabbing and returning a new reference to dentry, we need +to drop it before continuing. + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/autofs4/expire.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c +index 141f9bc213a3d..94a0017c923b1 100644 +--- a/fs/autofs4/expire.c ++++ b/fs/autofs4/expire.c +@@ -472,9 +472,10 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb, + */ + flags &= ~AUTOFS_EXP_LEAVES; + found = should_expire(expired, mnt, timeout, how); +- if (!found || found != expired) +- /* Something has changed, continue */ ++ if (found != expired) { // something has changed, continue ++ dput(found); + goto next; ++ } + + if (expired != dentry) + dput(dentry); +-- +2.20.1 + diff --git a/queue-4.14/clk-renesas-r8a77995-correct-parent-clock-of-du.patch b/queue-4.14/clk-renesas-r8a77995-correct-parent-clock-of-du.patch new file mode 100644 index 00000000000..8d788d8b4b5 --- /dev/null +++ b/queue-4.14/clk-renesas-r8a77995-correct-parent-clock-of-du.patch @@ -0,0 +1,40 @@ +From ae7d7eb22d450e7679c65d528695e93cd816ddd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 11:06:37 +0100 +Subject: clk: renesas: r8a77995: Correct parent clock of DU + +From: Geert Uytterhoeven + +[ Upstream commit 515b2915ee08060ad4f6a3b3de38c5c2c5258e8b ] + +According to the R-Car Gen3 Hardware Manual Rev 1.00, the parent clock +of the DU module clocks on R-Car D3 is S1D1. + +Fixes: d71e851d82c6cfe5 ("clk: renesas: cpg-mssr: Add R8A77995 support") +Signed-off-by: Geert Uytterhoeven +Acked-by: Stephen Boyd +Reviewed-by: Laurent Pinchart +Tested-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r8a77995-cpg-mssr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/renesas/r8a77995-cpg-mssr.c b/drivers/clk/renesas/r8a77995-cpg-mssr.c +index e594cf8ee63b6..8434d5530fb15 100644 +--- a/drivers/clk/renesas/r8a77995-cpg-mssr.c ++++ b/drivers/clk/renesas/r8a77995-cpg-mssr.c +@@ -141,8 +141,8 @@ static const struct mssr_mod_clk r8a77995_mod_clks[] __initconst = { + DEF_MOD("vspbs", 627, R8A77995_CLK_S0D1), + DEF_MOD("ehci0", 703, R8A77995_CLK_S3D2), + DEF_MOD("hsusb", 704, R8A77995_CLK_S3D2), +- DEF_MOD("du1", 723, R8A77995_CLK_S2D1), +- DEF_MOD("du0", 724, R8A77995_CLK_S2D1), ++ DEF_MOD("du1", 723, R8A77995_CLK_S1D1), ++ DEF_MOD("du0", 724, R8A77995_CLK_S1D1), + DEF_MOD("lvds", 727, R8A77995_CLK_S2D1), + DEF_MOD("vin7", 804, R8A77995_CLK_S1D2), + DEF_MOD("vin6", 805, R8A77995_CLK_S1D2), +-- +2.20.1 + diff --git a/queue-4.14/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch b/queue-4.14/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch new file mode 100644 index 00000000000..d6bb99abe4e --- /dev/null +++ b/queue-4.14/clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch @@ -0,0 +1,37 @@ +From caf34dd775b5fe8069b9c31c10091191b1f121ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 13:16:12 +0900 +Subject: clk: rockchip: fix I2S1 clock gate register for rk3328 + +From: Katsuhiro Suzuki + +[ Upstream commit 5c73ac2f8b70834a603eb2d92eb0bb464634420b ] + +This patch fixes definition of I2S1 clock gate register for rk3328. +Current setting is not related I2S clocks. + - bit6 of CRU_CLKGATE_CON0 means clk_ddrmon_en + - bit6 of CRU_CLKGATE_CON1 means clk_i2s1_en + +Signed-off-by: Katsuhiro Suzuki +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3328.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3328.c b/drivers/clk/rockchip/clk-rk3328.c +index 33d1cf4e6d803..0e5222d1944b5 100644 +--- a/drivers/clk/rockchip/clk-rk3328.c ++++ b/drivers/clk/rockchip/clk-rk3328.c +@@ -392,7 +392,7 @@ static struct rockchip_clk_branch rk3328_clk_branches[] __initdata = { + RK3328_CLKGATE_CON(1), 5, GFLAGS, + &rk3328_i2s1_fracmux), + GATE(SCLK_I2S1, "clk_i2s1", "i2s1_pre", CLK_SET_RATE_PARENT, +- RK3328_CLKGATE_CON(0), 6, GFLAGS), ++ RK3328_CLKGATE_CON(1), 6, GFLAGS), + COMPOSITE_NODIV(SCLK_I2S1_OUT, "i2s1_out", mux_i2s1out_p, 0, + RK3328_CLKSEL_CON(8), 12, 1, MFLAGS, + RK3328_CLKGATE_CON(1), 7, GFLAGS), +-- +2.20.1 + diff --git a/queue-4.14/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch b/queue-4.14/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch new file mode 100644 index 00000000000..bc55a926ddd --- /dev/null +++ b/queue-4.14/clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch @@ -0,0 +1,35 @@ +From 8f64fb54737d8b3d9806e2c46eba7046110ac8cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 13:18:02 +0900 +Subject: clk: rockchip: fix ID of 8ch clock of I2S1 for rk3328 + +From: Katsuhiro Suzuki + +[ Upstream commit df7b1f2e0a4ae0fceff261e29cde63dafcf2360f ] + +This patch fixes mistakes in HCLK_I2S1_8CH for running I2S1 +successfully. + +Signed-off-by: Katsuhiro Suzuki +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + include/dt-bindings/clock/rk3328-cru.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/dt-bindings/clock/rk3328-cru.h b/include/dt-bindings/clock/rk3328-cru.h +index d2b26a4b43ebd..4a9db1b2669b8 100644 +--- a/include/dt-bindings/clock/rk3328-cru.h ++++ b/include/dt-bindings/clock/rk3328-cru.h +@@ -178,7 +178,7 @@ + #define HCLK_TSP 309 + #define HCLK_GMAC 310 + #define HCLK_I2S0_8CH 311 +-#define HCLK_I2S1_8CH 313 ++#define HCLK_I2S1_8CH 312 + #define HCLK_I2S2_2CH 313 + #define HCLK_SPDIF_8CH 314 + #define HCLK_VOP 315 +-- +2.20.1 + diff --git a/queue-4.14/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch b/queue-4.14/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch new file mode 100644 index 00000000000..2c03f16f137 --- /dev/null +++ b/queue-4.14/clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch @@ -0,0 +1,37 @@ +From 475fdb7472cafbaafc6a7680281f9f9238840537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 12:17:30 +0100 +Subject: clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering + +From: Heiko Stuebner + +[ Upstream commit ac8cb53829a6ba119082e067f5bc8fab3611ce6a ] + +Similar to commit a9f0c0e56371 ("clk: rockchip: fix rk3188 sclk_smc +gate data") there is one other gate clock in the rk3188 clock driver +with a similar wrong ordering, the sclk_mac_lbtest. So fix it as well. + +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3188.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 022fecc9bcdf9..8cdfcd77e3ad9 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -362,8 +362,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + RK2928_CLKGATE_CON(2), 5, GFLAGS), + MUX(SCLK_MAC, "sclk_macref", mux_sclk_macref_p, CLK_SET_RATE_PARENT, + RK2928_CLKSEL_CON(21), 4, 1, MFLAGS), +- GATE(0, "sclk_mac_lbtest", "sclk_macref", +- RK2928_CLKGATE_CON(2), 12, 0, GFLAGS), ++ GATE(0, "sclk_mac_lbtest", "sclk_macref", 0, ++ RK2928_CLKGATE_CON(2), 12, GFLAGS), + + COMPOSITE(0, "hsadc_src", mux_pll_src_gpll_cpll_p, 0, + RK2928_CLKSEL_CON(22), 0, 1, MFLAGS, 8, 8, DFLAGS, +-- +2.20.1 + diff --git a/queue-4.14/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch b/queue-4.14/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch new file mode 100644 index 00000000000..b2b412369bb --- /dev/null +++ b/queue-4.14/clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch @@ -0,0 +1,38 @@ +From d40aa9ea8f7a51da30ee6ad7ad82b00b9a63c529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 15:45:49 +0000 +Subject: clk: rockchip: fix rk3188 sclk_smc gate data + +From: Finley Xiao + +[ Upstream commit a9f0c0e563717b9f63b3bb1c4a7c2df436a206d9 ] + +Fix sclk_smc gate data. +Change variable order, flags come before the register address. + +Signed-off-by: Finley Xiao +Signed-off-by: Johan Jonker +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3188.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/rockchip/clk-rk3188.c b/drivers/clk/rockchip/clk-rk3188.c +index 2b0d772b4f432..022fecc9bcdf9 100644 +--- a/drivers/clk/rockchip/clk-rk3188.c ++++ b/drivers/clk/rockchip/clk-rk3188.c +@@ -391,8 +391,8 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = { + * Clock-Architecture Diagram 4 + */ + +- GATE(SCLK_SMC, "sclk_smc", "hclk_peri", +- RK2928_CLKGATE_CON(2), 4, 0, GFLAGS), ++ GATE(SCLK_SMC, "sclk_smc", "hclk_peri", 0, ++ RK2928_CLKGATE_CON(2), 4, GFLAGS), + + COMPOSITE_NOMUX(SCLK_SPI0, "sclk_spi0", "pclk_peri", 0, + RK2928_CLKSEL_CON(25), 0, 7, DFLAGS, +-- +2.20.1 + diff --git a/queue-4.14/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch b/queue-4.14/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch new file mode 100644 index 00000000000..82cbbfa0fc3 --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch @@ -0,0 +1,36 @@ +From f14edf2f16f570a834a03f0ea8bfc66fac7b3c62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 16:46:08 +0530 +Subject: clk: sunxi-ng: a64: Fix gate bit of DSI DPHY + +From: Jagan Teki + +[ Upstream commit ee678706e46d0d185c27cc214ad97828e0643159 ] + +DSI DPHY gate bit on MIPI DSI clock register is bit 15 +not bit 30. + +Signed-off-by: Jagan Teki +Acked-by: Stephen Boyd +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index 36a30a3cfad71..eaafc038368f5 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -565,7 +565,7 @@ static const char * const dsi_dphy_parents[] = { "pll-video0", "pll-periph0" }; + static const u8 dsi_dphy_table[] = { 0, 2, }; + static SUNXI_CCU_M_WITH_MUX_TABLE_GATE(dsi_dphy_clk, "dsi-dphy", + dsi_dphy_parents, dsi_dphy_table, +- 0x168, 0, 4, 8, 2, BIT(31), CLK_SET_RATE_PARENT); ++ 0x168, 0, 4, 8, 2, BIT(15), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_M_WITH_GATE(gpu_clk, "gpu", "pll-gpu", + 0x1a0, 0, 3, BIT(31), CLK_SET_RATE_PARENT); +-- +2.20.1 + diff --git a/queue-4.14/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch b/queue-4.14/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch new file mode 100644 index 00000000000..03c22515727 --- /dev/null +++ b/queue-4.14/clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch @@ -0,0 +1,36 @@ +From d073896a5c96033ec8e97807e1021667aaa93801 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 13:33:28 +0800 +Subject: clk: sunxi-ng: h3/h5: Fix CSI_MCLK parent + +From: Chen-Yu Tsai + +[ Upstream commit 7bb7d29cffdd24bf419516d14b6768591e74069e ] + +The third parent of CSI_MCLK is PLL_PERIPH1, not PLL_PERIPH0. +Fix it. + +Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks") +Acked-by: Stephen Boyd +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +index 1729ff6a5aaed..b09acda71abe9 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -460,7 +460,7 @@ static const char * const csi_sclk_parents[] = { "pll-periph0", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_sclk_clk, "csi-sclk", csi_sclk_parents, + 0x134, 16, 4, 24, 3, BIT(31), 0); + +-static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph0" }; ++static const char * const csi_mclk_parents[] = { "osc24M", "pll-video", "pll-periph1" }; + static SUNXI_CCU_M_WITH_MUX_GATE(csi_mclk_clk, "csi-mclk", csi_mclk_parents, + 0x134, 0, 5, 8, 3, BIT(15), 0); + +-- +2.20.1 + diff --git a/queue-4.14/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch b/queue-4.14/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch new file mode 100644 index 00000000000..cc5da367873 --- /dev/null +++ b/queue-4.14/crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch @@ -0,0 +1,45 @@ +From a497c5065b929eee4d1dabdf60f1ba43c9887d5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 13:58:58 +0530 +Subject: crypto: bcm - fix normal/non key hash algorithm failure + +From: Raveendra Padasalagi + +[ Upstream commit 4f0129d13e69bad0363fd75553fb22897b32c379 ] + +Remove setkey() callback handler for normal/non key +hash algorithms and keep it for AES-CBC/CMAC which needs key. + +Fixes: 9d12ba86f818 ("crypto: brcm - Add Broadcom SPU driver") +Signed-off-by: Raveendra Padasalagi +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/bcm/cipher.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/bcm/cipher.c b/drivers/crypto/bcm/cipher.c +index b6be383a51a6a..84422435f39b4 100644 +--- a/drivers/crypto/bcm/cipher.c ++++ b/drivers/crypto/bcm/cipher.c +@@ -4637,12 +4637,16 @@ static int spu_register_ahash(struct iproc_alg_s *driver_alg) + hash->halg.statesize = sizeof(struct spu_hash_export_s); + + if (driver_alg->auth_info.mode != HASH_MODE_HMAC) { +- hash->setkey = ahash_setkey; + hash->init = ahash_init; + hash->update = ahash_update; + hash->final = ahash_final; + hash->finup = ahash_finup; + hash->digest = ahash_digest; ++ if ((driver_alg->auth_info.alg == HASH_ALG_AES) && ++ ((driver_alg->auth_info.mode == HASH_MODE_XCBC) || ++ (driver_alg->auth_info.mode == HASH_MODE_CMAC))) { ++ hash->setkey = ahash_setkey; ++ } + } else { + hash->setkey = ahash_hmac_setkey; + hash->init = ahash_hmac_init; +-- +2.20.1 + diff --git a/queue-4.14/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch b/queue-4.14/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch new file mode 100644 index 00000000000..fa10ed596c1 --- /dev/null +++ b/queue-4.14/crypto-ecc-check-for-invalid-values-in-the-key-verif.patch @@ -0,0 +1,97 @@ +From a267269ec2dc70a8247475fd69f07d08374822ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Nov 2018 11:36:18 +0300 +Subject: crypto: ecc - check for invalid values in the key verification test + +From: Vitaly Chikunov + +[ Upstream commit 2eb4942b6609d35a4e835644a33203b0aef7443d ] + +Currently used scalar multiplication algorithm (Matthieu Rivain, 2011) +have invalid values for scalar == 1, n-1, and for regularized version +n-2, which was previously not checked. Verify that they are not used as +private keys. + +Signed-off-by: Vitaly Chikunov +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/ecc.c | 42 ++++++++++++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 16 deletions(-) + +diff --git a/crypto/ecc.c b/crypto/ecc.c +index 18f32f2a5e1c9..3b422e24e647e 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -904,30 +904,43 @@ static inline void ecc_swap_digits(const u64 *in, u64 *out, + out[i] = __swab64(in[ndigits - 1 - i]); + } + +-int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, +- const u64 *private_key, unsigned int private_key_len) ++static int __ecc_is_key_valid(const struct ecc_curve *curve, ++ const u64 *private_key, unsigned int ndigits) + { +- int nbytes; +- const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ u64 one[ECC_MAX_DIGITS] = { 1, }; ++ u64 res[ECC_MAX_DIGITS]; + + if (!private_key) + return -EINVAL; + +- nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; +- +- if (private_key_len != nbytes) ++ if (curve->g.ndigits != ndigits) + return -EINVAL; + +- if (vli_is_zero(private_key, ndigits)) ++ /* Make sure the private key is in the range [2, n-3]. */ ++ if (vli_cmp(one, private_key, ndigits) != -1) + return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, private_key, ndigits) != 1) ++ vli_sub(res, curve->n, one, ndigits); ++ vli_sub(res, res, one, ndigits); ++ if (vli_cmp(res, private_key, ndigits) != 1) + return -EINVAL; + + return 0; + } + ++int ecc_is_key_valid(unsigned int curve_id, unsigned int ndigits, ++ const u64 *private_key, unsigned int private_key_len) ++{ ++ int nbytes; ++ const struct ecc_curve *curve = ecc_get_curve(curve_id); ++ ++ nbytes = ndigits << ECC_DIGITS_TO_BYTES_SHIFT; ++ ++ if (private_key_len != nbytes) ++ return -EINVAL; ++ ++ return __ecc_is_key_valid(curve, private_key, ndigits); ++} ++ + /* + * ECC private keys are generated using the method of extra random bits, + * equivalent to that described in FIPS 186-4, Appendix B.4.1. +@@ -971,11 +984,8 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey) + if (err) + return err; + +- if (vli_is_zero(priv, ndigits)) +- return -EINVAL; +- +- /* Make sure the private key is in the range [1, n-1]. */ +- if (vli_cmp(curve->n, priv, ndigits) != 1) ++ /* Make sure the private key is in the valid range. */ ++ if (__ecc_is_key_valid(curve, priv, ndigits)) + return -EINVAL; + + ecc_swap_digits(priv, privkey, ndigits); +-- +2.20.1 + diff --git a/queue-4.14/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch b/queue-4.14/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch new file mode 100644 index 00000000000..86f991b421e --- /dev/null +++ b/queue-4.14/cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch @@ -0,0 +1,51 @@ +From 3af5e1ac03cb58b335c339e71f139a267e16d483 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Nov 2018 14:52:01 +0530 +Subject: cxgb4vf: fix memleak in mac_hlist initialization + +From: Arjun Vynipadath + +[ Upstream commit 24357e06ba511ad874d664d39475dbb01c1ca450 ] + +mac_hlist was initialized during adapter_up, which will be called +every time a vf device is first brought up, or every time when device +is brought up again after bringing all devices down. This means our +state of previous list is lost, causing a memleak if entries are +present in the list. To fix that, move list init to the condition +that performs initial one time adapter setup. + +Signed-off-by: Arjun Vynipadath +Signed-off-by: Ganesh Goudar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +index 8996ebbd222e0..26ba18ea08c6a 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c +@@ -714,6 +714,10 @@ static int adapter_up(struct adapter *adapter) + + if (adapter->flags & USING_MSIX) + name_msix_vecs(adapter); ++ ++ /* Initialize hash mac addr list*/ ++ INIT_LIST_HEAD(&adapter->mac_hlist); ++ + adapter->flags |= FULL_INIT_DONE; + } + +@@ -739,8 +743,6 @@ static int adapter_up(struct adapter *adapter) + enable_rx(adapter); + t4vf_sge_start(adapter); + +- /* Initialize hash mac addr list*/ +- INIT_LIST_HEAD(&adapter->mac_hlist); + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/dlm-fix-invalid-cluster-name-warning.patch b/queue-4.14/dlm-fix-invalid-cluster-name-warning.patch new file mode 100644 index 00000000000..9fd445846d8 --- /dev/null +++ b/queue-4.14/dlm-fix-invalid-cluster-name-warning.patch @@ -0,0 +1,47 @@ +From 0b7ecdc58f2d20cd6d431bc9dcb52836169b6472 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 15:27:37 -0600 +Subject: dlm: fix invalid cluster name warning + +From: David Teigland + +[ Upstream commit 3595c559326d0b660bb088a88e22e0ca630a0e35 ] + +The warning added in commit 3b0e761ba83 + "dlm: print log message when cluster name is not set" + +did not account for the fact that lockspaces created +from userland do not supply a cluster name, so bogus +warnings are printed every time a userland lockspace +is created. + +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index 1f0c071d4a861..02de11695d0ba 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -25,6 +25,7 @@ + #include "lvb_table.h" + #include "user.h" + #include "ast.h" ++#include "config.h" + + static const char name_prefix[] = "dlm"; + static const struct file_operations device_fops; +@@ -404,7 +405,7 @@ static int device_create_lockspace(struct dlm_lspace_params *params) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- error = dlm_new_lockspace(params->name, NULL, params->flags, ++ error = dlm_new_lockspace(params->name, dlm_config.ci_cluster_name, params->flags, + DLM_USER_LVB_LEN, NULL, NULL, NULL, + &lockspace); + if (error) +-- +2.20.1 + diff --git a/queue-4.14/dlm-fix-missing-idr_destroy-for-recover_idr.patch b/queue-4.14/dlm-fix-missing-idr_destroy-for-recover_idr.patch new file mode 100644 index 00000000000..9af424fce3e --- /dev/null +++ b/queue-4.14/dlm-fix-missing-idr_destroy-for-recover_idr.patch @@ -0,0 +1,32 @@ +From 0b08576382a257de4626bdbac90e3434e4a083aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Nov 2018 11:17:40 -0600 +Subject: dlm: fix missing idr_destroy for recover_idr + +From: David Teigland + +[ Upstream commit 8fc6ed9a3508a0435b9270c313600799d210d319 ] + +Which would leak memory for the idr internals. + +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lockspace.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/dlm/lockspace.c b/fs/dlm/lockspace.c +index 610f72ae7ad67..9c8c9a09b4a6d 100644 +--- a/fs/dlm/lockspace.c ++++ b/fs/dlm/lockspace.c +@@ -807,6 +807,7 @@ static int release_lockspace(struct dlm_ls *ls, int force) + + dlm_delete_debug_file(ls); + ++ idr_destroy(&ls->ls_recover_idr); + kfree(ls->ls_recover_buf); + + /* +-- +2.20.1 + diff --git a/queue-4.14/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch b/queue-4.14/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch new file mode 100644 index 00000000000..1479555c7fe --- /dev/null +++ b/queue-4.14/dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch @@ -0,0 +1,38 @@ +From 64e968e1648199fecf81485906fc2e004fdee903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 20:39:50 +0300 +Subject: dlm: fix possible call to kfree() for non-initialized pointer + +From: Denis V. Lunev + +[ Upstream commit 58a923adf4d9aca8bf7205985c9c8fc531c65d72 ] + +Technically dlm_config_nodes() could return error and keep nodes +uninitialized. After that on the fail path of we'll call kfree() +for that uninitialized value. + +The patch is simple - we should just initialize nodes with NULL. + +Signed-off-by: Denis V. Lunev +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/member.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/member.c b/fs/dlm/member.c +index cad6d85911a80..0bc43b35d2c53 100644 +--- a/fs/dlm/member.c ++++ b/fs/dlm/member.c +@@ -671,7 +671,7 @@ int dlm_ls_stop(struct dlm_ls *ls) + int dlm_ls_start(struct dlm_ls *ls) + { + struct dlm_recover *rv, *rv_old; +- struct dlm_config_node *nodes; ++ struct dlm_config_node *nodes = NULL; + int error, count; + + rv = kzalloc(sizeof(*rv), GFP_NOFS); +-- +2.20.1 + diff --git a/queue-4.14/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch b/queue-4.14/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch new file mode 100644 index 00000000000..5eb48de5e78 --- /dev/null +++ b/queue-4.14/dlm-null-check-before-kmem_cache_destroy-is-not-need.patch @@ -0,0 +1,49 @@ +From bf2f18551075a9898b6c7cbb8b674037680e8478 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 15:25:00 +0800 +Subject: dlm: NULL check before kmem_cache_destroy is not needed + +From: Wen Yang + +[ Upstream commit f31a89692830061bceba8469607e4e4b0f900159 ] + +kmem_cache_destroy(NULL) is safe, so removes NULL check before +freeing the mem. This patch also fix ifnullfree.cocci warnings. + +Signed-off-by: Wen Yang +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/memory.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/fs/dlm/memory.c b/fs/dlm/memory.c +index 7cd24bccd4fe5..37be29f21d04d 100644 +--- a/fs/dlm/memory.c ++++ b/fs/dlm/memory.c +@@ -38,10 +38,8 @@ int __init dlm_memory_init(void) + + void dlm_memory_exit(void) + { +- if (lkb_cache) +- kmem_cache_destroy(lkb_cache); +- if (rsb_cache) +- kmem_cache_destroy(rsb_cache); ++ kmem_cache_destroy(lkb_cache); ++ kmem_cache_destroy(rsb_cache); + } + + char *dlm_allocate_lvb(struct dlm_ls *ls) +@@ -86,8 +84,7 @@ void dlm_free_lkb(struct dlm_lkb *lkb) + struct dlm_user_args *ua; + ua = lkb->lkb_ua; + if (ua) { +- if (ua->lksb.sb_lvbptr) +- kfree(ua->lksb.sb_lvbptr); ++ kfree(ua->lksb.sb_lvbptr); + kfree(ua); + } + } +-- +2.20.1 + diff --git a/queue-4.14/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch b/queue-4.14/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch new file mode 100644 index 00000000000..fb2aeaa6d9c --- /dev/null +++ b/queue-4.14/dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch @@ -0,0 +1,41 @@ +From aa3b850bad289b3523c4987f398a42fe57340903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Aug 2018 23:29:21 +0200 +Subject: dma-mapping: fix return type of dma_set_max_seg_size() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit c9d76d0655c06b8c1f944e46c4fd9e9cf4b331c0 ] + +The function dma_set_max_seg_size() can return either 0 on success or +-EIO on error. Change its return type from unsigned int to int to +capture this. + +Signed-off-by: Niklas Söderlund +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + include/linux/dma-mapping.h | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h +index 7bf3b99e6fbb1..9aee5f345e299 100644 +--- a/include/linux/dma-mapping.h ++++ b/include/linux/dma-mapping.h +@@ -650,8 +650,7 @@ static inline unsigned int dma_get_max_seg_size(struct device *dev) + return SZ_64K; + } + +-static inline unsigned int dma_set_max_seg_size(struct device *dev, +- unsigned int size) ++static inline int dma_set_max_seg_size(struct device *dev, unsigned int size) + { + if (dev->dma_parms) { + dev->dma_parms->max_segment_size = size; +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-coh901318-fix-a-double-lock-bug.patch b/queue-4.14/dmaengine-coh901318-fix-a-double-lock-bug.patch new file mode 100644 index 00000000000..0c3cc663dac --- /dev/null +++ b/queue-4.14/dmaengine-coh901318-fix-a-double-lock-bug.patch @@ -0,0 +1,51 @@ +From e2159eb787bb0108793e896aeb700ad626da6687 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 11:33:48 +0800 +Subject: dmaengine: coh901318: Fix a double-lock bug + +From: Jia-Ju Bai + +[ Upstream commit 627469e4445b9b12e0229b3bdf8564d5ce384dd7 ] + +The function coh901318_alloc_chan_resources() calls spin_lock_irqsave() +before calling coh901318_config(). +But coh901318_config() calls spin_lock_irqsave() again in its +definition, which may cause a double-lock bug. + +Because coh901318_config() is only called by +coh901318_alloc_chan_resources(), the bug fix is to remove the +calls to spin-lock and -unlock functions in coh901318_config(). + +Signed-off-by: Jia-Ju Bai +Reviewed-by: Linus Walleij +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/coh901318.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c +index 74794c9859f60..a8886abf0c75c 100644 +--- a/drivers/dma/coh901318.c ++++ b/drivers/dma/coh901318.c +@@ -1802,8 +1802,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + int channel = cohc->id; + void __iomem *virtbase = cohc->base->virtbase; + +- spin_lock_irqsave(&cohc->lock, flags); +- + if (param) + p = param; + else +@@ -1823,8 +1821,6 @@ static int coh901318_config(struct coh901318_chan *cohc, + coh901318_set_conf(cohc, p->config); + coh901318_set_ctrl(cohc, p->ctrl_lli_last); + +- spin_unlock_irqrestore(&cohc->lock, flags); +- + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-dw-dmac-implement-dma-protection-control-s.patch b/queue-4.14/dmaengine-dw-dmac-implement-dma-protection-control-s.patch new file mode 100644 index 00000000000..864a6571504 --- /dev/null +++ b/queue-4.14/dmaengine-dw-dmac-implement-dma-protection-control-s.patch @@ -0,0 +1,145 @@ +From a56d68e5bb1045742d3b9f4cbe15595e3400eb9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Nov 2018 17:17:21 +0100 +Subject: dmaengine: dw-dmac: implement dma protection control setting + +From: Christian Lamparter + +[ Upstream commit 7b0c03ecc42fb223baf015877fee9d517c2c8af1 ] + +This patch adds a new device-tree property that allows to +specify the dma protection control bits for the all of the +DMA controller's channel uniformly. + +Setting the "correct" bits can have a huge impact on the +PPC460EX and APM82181 that use this DMA engine in combination +with a DesignWare' SATA-II core (sata_dwc_460ex driver). + +In the OpenWrt Forum, the user takimata reported that: +|It seems your patch unleashed the full power of the SATA port. +|Where I was previously hitting a really hard limit at around +|82 MB/s for reading and 27 MB/s for writing, I am now getting this: +| +|root@OpenWrt:/mnt# time dd if=/dev/zero of=tempfile bs=1M count=1024 +|1024+0 records in +|1024+0 records out +|real 0m 13.65s +|user 0m 0.01s +|sys 0m 11.89s +| +|root@OpenWrt:/mnt# time dd if=tempfile of=/dev/null bs=1M count=1024 +|1024+0 records in +|1024+0 records out +|real 0m 8.41s +|user 0m 0.01s +|sys 0m 4.70s +| +|This means: 121 MB/s reading and 75 MB/s writing! +| +|The drive is a WD Green WD10EARX taken from an older MBL Single. +|I repeated the test a few times with even larger files to rule out +|any caching, I'm still seeing the same great performance. OpenWrt is +|now completely on par with the original MBL firmware's performance. + +Another user And.short reported: +|I can report that your fix worked! Boots up fine with two +|drives even with more partitions, and no more reboot on +|concurrent disk access! + +A closer look into the sata_dwc_460ex code revealed that +the driver did initally set the correct protection control +bits. However, this feature was lost when the sata_dwc_460ex +driver was converted to the generic DMA driver framework. + +BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/55 +BugLink: https://forum.openwrt.org/t/wd-mybook-live-duo-two-disks/16195/50 +Fixes: 8b3444852a2b ("sata_dwc_460ex: move to generic DMA driver") +Reviewed-by: Andy Shevchenko +Signed-off-by: Christian Lamparter +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/core.c | 2 ++ + drivers/dma/dw/platform.c | 6 ++++++ + drivers/dma/dw/regs.h | 4 ++++ + include/linux/platform_data/dma-dw.h | 6 ++++++ + 4 files changed, 18 insertions(+) + +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index 0f389e008ce64..055d83b6cb68a 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -160,12 +160,14 @@ static void dwc_initialize_chan_idma32(struct dw_dma_chan *dwc) + + static void dwc_initialize_chan_dw(struct dw_dma_chan *dwc) + { ++ struct dw_dma *dw = to_dw_dma(dwc->chan.device); + u32 cfghi = DWC_CFGH_FIFO_MODE; + u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); + bool hs_polarity = dwc->dws.hs_polarity; + + cfghi |= DWC_CFGH_DST_PER(dwc->dws.dst_id); + cfghi |= DWC_CFGH_SRC_PER(dwc->dws.src_id); ++ cfghi |= DWC_CFGH_PROTCTL(dw->pdata->protctl); + + /* Set polarity of handshake interface */ + cfglo |= hs_polarity ? DWC_CFGL_HS_DST_POL | DWC_CFGL_HS_SRC_POL : 0; +diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c +index bc31fe8020619..46a519e07195c 100644 +--- a/drivers/dma/dw/platform.c ++++ b/drivers/dma/dw/platform.c +@@ -162,6 +162,12 @@ dw_dma_parse_dt(struct platform_device *pdev) + pdata->multi_block[tmp] = 1; + } + ++ if (!of_property_read_u32(np, "snps,dma-protection-control", &tmp)) { ++ if (tmp > CHAN_PROTCTL_MASK) ++ return NULL; ++ pdata->protctl = tmp; ++ } ++ + return pdata; + } + #else +diff --git a/drivers/dma/dw/regs.h b/drivers/dma/dw/regs.h +index 09e7dfdbb7907..646c9c960c071 100644 +--- a/drivers/dma/dw/regs.h ++++ b/drivers/dma/dw/regs.h +@@ -200,6 +200,10 @@ enum dw_dma_msize { + #define DWC_CFGH_FCMODE (1 << 0) + #define DWC_CFGH_FIFO_MODE (1 << 1) + #define DWC_CFGH_PROTCTL(x) ((x) << 2) ++#define DWC_CFGH_PROTCTL_DATA (0 << 2) /* data access - always set */ ++#define DWC_CFGH_PROTCTL_PRIV (1 << 2) /* privileged -> AHB HPROT[1] */ ++#define DWC_CFGH_PROTCTL_BUFFER (2 << 2) /* bufferable -> AHB HPROT[2] */ ++#define DWC_CFGH_PROTCTL_CACHE (4 << 2) /* cacheable -> AHB HPROT[3] */ + #define DWC_CFGH_DS_UPD_EN (1 << 5) + #define DWC_CFGH_SS_UPD_EN (1 << 6) + #define DWC_CFGH_SRC_PER(x) ((x) << 7) +diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h +index 896cb71a382cb..1a1d58ebffbf1 100644 +--- a/include/linux/platform_data/dma-dw.h ++++ b/include/linux/platform_data/dma-dw.h +@@ -49,6 +49,7 @@ struct dw_dma_slave { + * @data_width: Maximum data width supported by hardware per AHB master + * (in bytes, power of 2) + * @multi_block: Multi block transfers supported by hardware per channel. ++ * @protctl: Protection control signals setting per channel. + */ + struct dw_dma_platform_data { + unsigned int nr_channels; +@@ -65,6 +66,11 @@ struct dw_dma_platform_data { + unsigned char nr_masters; + unsigned char data_width[DW_DMA_MAX_NR_MASTERS]; + unsigned char multi_block[DW_DMA_MAX_NR_CHANNELS]; ++#define CHAN_PROTCTL_PRIVILEGED BIT(0) ++#define CHAN_PROTCTL_BUFFERABLE BIT(1) ++#define CHAN_PROTCTL_CACHEABLE BIT(2) ++#define CHAN_PROTCTL_MASK GENMASK(2, 0) ++ unsigned char protctl; + }; + + #endif /* _PLATFORM_DATA_DMA_DW_H */ +-- +2.20.1 + diff --git a/queue-4.14/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch b/queue-4.14/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch new file mode 100644 index 00000000000..4bc4c875a16 --- /dev/null +++ b/queue-4.14/dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch @@ -0,0 +1,42 @@ +From e449a06088839de5982c39772720aa61910f5a7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Sep 2018 11:18:00 -0600 +Subject: dmaengine: xilinx_dma: Fix 64-bit simple CDMA transfer + +From: Radhey Shyam Pandey + +[ Upstream commit 0e03aca2659ef7a85eaff1a1ca9b0b498002ede8 ] + +In AXI CDMA simple mode also pass MSB bits of source and destination +address to xilinx_write function. This fixes simple CDMA operation +mode using 64-bit addressing. + +Signed-off-by: Radhey Shyam Pandey +Signed-off-by: Michal Simek +Reviewed-by: Appana Durga Kedareswara Rao +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 2db352308e5c0..c5d22c5d12a06 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -1182,8 +1182,10 @@ static void xilinx_cdma_start_transfer(struct xilinx_dma_chan *chan) + + hw = &segment->hw; + +- xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, hw->src_addr); +- xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, hw->dest_addr); ++ xilinx_write(chan, XILINX_CDMA_REG_SRCADDR, ++ xilinx_prep_dma_addr_t(hw->src_addr)); ++ xilinx_write(chan, XILINX_CDMA_REG_DSTADDR, ++ xilinx_prep_dma_addr_t(hw->dest_addr)); + + /* Start the transfer */ + dma_ctrl_write(chan, XILINX_DMA_REG_BTT, +-- +2.20.1 + diff --git a/queue-4.14/exportfs_decode_fh-negative-pinned-may-become-positi.patch b/queue-4.14/exportfs_decode_fh-negative-pinned-may-become-positi.patch new file mode 100644 index 00000000000..4507abcdb7b --- /dev/null +++ b/queue-4.14/exportfs_decode_fh-negative-pinned-may-become-positi.patch @@ -0,0 +1,69 @@ +From f5281421d504f0e42b8fec476ab015753409c8ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 22:08:29 -0500 +Subject: exportfs_decode_fh(): negative pinned may become positive without the + parent locked + +From: Al Viro + +[ Upstream commit a2ece088882666e1dc7113744ac912eb161e3f87 ] + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/exportfs/expfs.c | 31 +++++++++++++++++++------------ + 1 file changed, 19 insertions(+), 12 deletions(-) + +diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c +index c22cc9d2a5c9a..a561ae17cf435 100644 +--- a/fs/exportfs/expfs.c ++++ b/fs/exportfs/expfs.c +@@ -508,26 +508,33 @@ struct dentry *exportfs_decode_fh(struct vfsmount *mnt, struct fid *fid, + * inode is actually connected to the parent. + */ + err = exportfs_get_name(mnt, target_dir, nbuf, result); +- if (!err) { +- inode_lock(target_dir->d_inode); +- nresult = lookup_one_len(nbuf, target_dir, +- strlen(nbuf)); +- inode_unlock(target_dir->d_inode); +- if (!IS_ERR(nresult)) { +- if (nresult->d_inode) { +- dput(result); +- result = nresult; +- } else +- dput(nresult); +- } ++ if (err) { ++ dput(target_dir); ++ goto err_result; + } + ++ inode_lock(target_dir->d_inode); ++ nresult = lookup_one_len(nbuf, target_dir, strlen(nbuf)); ++ if (!IS_ERR(nresult)) { ++ if (unlikely(nresult->d_inode != result->d_inode)) { ++ dput(nresult); ++ nresult = ERR_PTR(-ESTALE); ++ } ++ } ++ inode_unlock(target_dir->d_inode); + /* + * At this point we are done with the parent, but it's pinned + * by the child dentry anyway. + */ + dput(target_dir); + ++ if (IS_ERR(nresult)) { ++ err = PTR_ERR(nresult); ++ goto err_result; ++ } ++ dput(result); ++ result = nresult; ++ + /* + * And finally make sure the dentry is actually acceptable + * to NFSD. +-- +2.20.1 + diff --git a/queue-4.14/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch b/queue-4.14/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch new file mode 100644 index 00000000000..a3114c0d52c --- /dev/null +++ b/queue-4.14/extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch @@ -0,0 +1,49 @@ +From 3702df8ed3b8ecb9fba77e962837668ed58d666f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 16:38:47 +0100 +Subject: extcon: max8997: Fix lack of path setting in USB device mode + +From: Marek Szyprowski + +[ Upstream commit a2dc50914744eea9f83a70a5db0486be625e5dc0 ] + +MAX8997 driver disables automatic path selection from MicroUSB connector +and manually sets path to either UART or USB lines. However the code for +setting USB path worked only for USB host mode (when ID pin is set +to ground). When standard USB cable (USB device mode) is connected, path +registers are not touched. This means that once the non-USB accessory is +connected to MAX8997-operated micro USB port, the path is no longer set +to USB and USB device mode doesn't work. This patch fixes it by setting +USB path both for USB and USB host modes. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max8997.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 4a0612fb9c070..b9b48d45a6dc4 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -321,12 +321,10 @@ static int max8997_muic_handle_usb(struct max8997_muic_info *info, + { + int ret = 0; + +- if (usb_type == MAX8997_USB_HOST) { +- ret = max8997_muic_set_path(info, info->path_usb, attached); +- if (ret < 0) { +- dev_err(info->dev, "failed to update muic register\n"); +- return ret; +- } ++ ret = max8997_muic_set_path(info, info->path_usb, attached); ++ if (ret < 0) { ++ dev_err(info->dev, "failed to update muic register\n"); ++ return ret; + } + + switch (usb_type) { +-- +2.20.1 + diff --git a/queue-4.14/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch b/queue-4.14/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch new file mode 100644 index 00000000000..cc547989fbd --- /dev/null +++ b/queue-4.14/f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch @@ -0,0 +1,36 @@ +From abffa547833db2ad433ffb0f1d69cdaa0f6cf742 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 20:37:55 +0800 +Subject: f2fs: change segment to section in f2fs_ioc_gc_range + +From: Yunlong Song + +[ Upstream commit 67b0e42b768c9ddc3fd5ca1aee3db815cfaa635c ] + +f2fs_ioc_gc_range skips blocks_per_seg each time, however, f2fs_gc moves +blocks of section each time, so fix it from segment to section. + +Signed-off-by: Yunlong Song +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index d68b0132718a6..a90173b856f6d 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2029,7 +2029,7 @@ do_more: + } + + ret = f2fs_gc(sbi, range.sync, true, GET_SEGNO(sbi, range.start)); +- range.start += sbi->blocks_per_seg; ++ range.start += BLKS_PER_SEC(sbi); + if (range.start <= end) + goto do_more; + out: +-- +2.20.1 + diff --git a/queue-4.14/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch b/queue-4.14/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch new file mode 100644 index 00000000000..220c3592c76 --- /dev/null +++ b/queue-4.14/f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch @@ -0,0 +1,50 @@ +From 0100d9caa05ec38ac0c2d771abab6c785a3cd9c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Oct 2018 16:08:30 +0800 +Subject: f2fs: fix count of seg_freed to make sec_freed correct + +From: Yunlong Song + +[ Upstream commit d6c66cd19ef322fe0d51ba09ce1b7f386acab04a ] + +When sbi->segs_per_sec > 1, and if some segno has 0 valid blocks before +gc starts, do_garbage_collect will skip counting seg_freed++, and this +will cause seg_freed < sbi->segs_per_sec and finally skip sec_freed++. + +Signed-off-by: Yunlong Song +Signed-off-by: Chao Yu +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 67120181dc2af..9865f6d52fe48 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -952,9 +952,9 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + GET_SUM_BLOCK(sbi, segno)); + f2fs_put_page(sum_page, 0); + +- if (get_valid_blocks(sbi, segno, false) == 0 || +- !PageUptodate(sum_page) || +- unlikely(f2fs_cp_error(sbi))) ++ if (get_valid_blocks(sbi, segno, false) == 0) ++ goto freed; ++ if (!PageUptodate(sum_page) || unlikely(f2fs_cp_error(sbi))) + goto next; + + sum = page_address(sum_page); +@@ -981,6 +981,7 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi, + + stat_inc_seg_count(sbi, type, gc_type); + ++freed: + if (gc_type == FG_GC && + get_valid_blocks(sbi, segno, false) == 0) + seg_freed++; +-- +2.20.1 + diff --git a/queue-4.14/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch b/queue-4.14/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch new file mode 100644 index 00000000000..0662c2f48b3 --- /dev/null +++ b/queue-4.14/f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch @@ -0,0 +1,37 @@ +From 25a8d46a5793d7f1f886e105a8d118932c5a03f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 13:31:41 +0530 +Subject: f2fs: fix to allow node segment for GC by ioctl path + +From: Sahitya Tummala + +[ Upstream commit 08ac9a3870f6babb2b1fff46118536ca8a71ef19 ] + +Allow node type segments also to be GC'd via f2fs ioctl +F2FS_IOC_GARBAGE_COLLECT_RANGE. + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 9865f6d52fe48..c2e4c6ce2cf79 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -330,8 +330,7 @@ static int get_victim_by_default(struct f2fs_sb_info *sbi, + p.min_cost = get_max_cost(sbi, &p); + + if (*result != NULL_SEGNO) { +- if (IS_DATASEG(get_seg_entry(sbi, *result)->type) && +- get_valid_blocks(sbi, *result, false) && ++ if (get_valid_blocks(sbi, *result, false) && + !sec_usage_check(sbi, GET_SEC_FROM_SEG(sbi, *result))) + p.min_segno = *result; + goto out; +-- +2.20.1 + diff --git a/queue-4.14/firmware-qcom-scm-fix-compilation-error-when-disable.patch b/queue-4.14/firmware-qcom-scm-fix-compilation-error-when-disable.patch new file mode 100644 index 00000000000..20ec566f373 --- /dev/null +++ b/queue-4.14/firmware-qcom-scm-fix-compilation-error-when-disable.patch @@ -0,0 +1,37 @@ +From 49040b1da03ab1907b12c241c41c397150df8aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 21:32:25 -0500 +Subject: firmware: qcom: scm: fix compilation error when disabled + +From: Jonathan Marek + +[ Upstream commit 16ad9501b1f2edebe24f8cf3c09da0695871986b ] + +This fixes the case when CONFIG_QCOM_SCM is not enabled, and linux/errno.h +has not been included previously. + +Signed-off-by: Jonathan Marek +Reviewed-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +--- + include/linux/qcom_scm.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/include/linux/qcom_scm.h b/include/linux/qcom_scm.h +index e5380471c2cd2..428278a44c7db 100644 +--- a/include/linux/qcom_scm.h ++++ b/include/linux/qcom_scm.h +@@ -44,6 +44,9 @@ extern int qcom_scm_restore_sec_cfg(u32 device_id, u32 spare); + extern int qcom_scm_iommu_secure_ptbl_size(u32 spare, size_t *size); + extern int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare); + #else ++ ++#include ++ + static inline + int qcom_scm_set_cold_boot_addr(void *entry, const cpumask_t *cpus) + { +-- +2.20.1 + diff --git a/queue-4.14/i2c-core-fix-use-after-free-in-of_i2c_notify.patch b/queue-4.14/i2c-core-fix-use-after-free-in-of_i2c_notify.patch new file mode 100644 index 00000000000..1ad51fd7d55 --- /dev/null +++ b/queue-4.14/i2c-core-fix-use-after-free-in-of_i2c_notify.patch @@ -0,0 +1,43 @@ +From e9a7aca3aa68e11cfdd522a9d343c0b8be2a26a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2019 16:36:48 +0800 +Subject: i2c: core: fix use after free in of_i2c_notify + +From: Wen Yang + +[ Upstream commit a4c2fec16f5e6a5fee4865e6e0e91e2bc2d10f37 ] + +We can't use "adap->dev" after it has been freed. + +Fixes: 5bf4fa7daea6 ("i2c: break out OF support into separate file") +Signed-off-by: Wen Yang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-of.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/i2c-core-of.c b/drivers/i2c/i2c-core-of.c +index 8d474bb1dc157..17d727e0b8424 100644 +--- a/drivers/i2c/i2c-core-of.c ++++ b/drivers/i2c/i2c-core-of.c +@@ -238,14 +238,14 @@ static int of_i2c_notify(struct notifier_block *nb, unsigned long action, + } + + client = of_i2c_register_device(adap, rd->dn); +- put_device(&adap->dev); +- + if (IS_ERR(client)) { + dev_err(&adap->dev, "failed to create client for '%pOF'\n", + rd->dn); ++ put_device(&adap->dev); + of_node_clear_flag(rd->dn, OF_POPULATED); + return notifier_from_errno(PTR_ERR(client)); + } ++ put_device(&adap->dev); + break; + case OF_RECONFIG_CHANGE_REMOVE: + /* already depopulated? */ +-- +2.20.1 + diff --git a/queue-4.14/i2c-imx-don-t-print-error-message-on-probe-defer.patch b/queue-4.14/i2c-imx-don-t-print-error-message-on-probe-defer.patch new file mode 100644 index 00000000000..feea1d623f9 --- /dev/null +++ b/queue-4.14/i2c-imx-don-t-print-error-message-on-probe-defer.patch @@ -0,0 +1,40 @@ +From 64cafbc646115e5e53fe57fa5dc08b27bfc25cb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:29:13 +0100 +Subject: i2c: imx: don't print error message on probe defer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lucas Stach + +[ Upstream commit fece4978510e43f09c8cd386fee15210e8c68493 ] + +Probe deferral is a normal operating condition in the probe function, +so don't spam the log with an error in this case. + +Signed-off-by: Lucas Stach +Acked-by: Uwe Kleine-König +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-imx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index b73dd837fb533..26f83029f64ae 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -1088,7 +1088,8 @@ static int i2c_imx_probe(struct platform_device *pdev) + /* Get I2C clock */ + i2c_imx->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(i2c_imx->clk)) { +- dev_err(&pdev->dev, "can't get I2C clock\n"); ++ if (PTR_ERR(i2c_imx->clk) != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "can't get I2C clock\n"); + return PTR_ERR(i2c_imx->clk); + } + +-- +2.20.1 + diff --git a/queue-4.14/i40e-don-t-restart-nway-if-autoneg-not-supported.patch b/queue-4.14/i40e-don-t-restart-nway-if-autoneg-not-supported.patch new file mode 100644 index 00000000000..b8a5d3d37cf --- /dev/null +++ b/queue-4.14/i40e-don-t-restart-nway-if-autoneg-not-supported.patch @@ -0,0 +1,67 @@ +From 49fe468d20db423142703dd3c92abfdf1787f26a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 14:33:28 -0700 +Subject: i40e: don't restart nway if autoneg not supported + +From: Mitch Williams + +[ Upstream commit 7c3758f7839377ab67529cc50264a640636c47af ] + +On link types that do not support autoneg, we cannot attempt to restart +nway negotiation. This results in a dead link that requires a power +cycle to remedy. + +Fix this by saving off the autoneg state and checking this value before +we try to restart nway. + +Signed-off-by: Mitch Williams +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index ef22793d6a032..751ac56168843 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -969,6 +969,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + i40e_status status; + u8 aq_failures; + int err = 0; ++ u32 is_an; + + /* Changing the port's flow control is not supported if this isn't the + * port's controlling PF +@@ -981,15 +982,14 @@ static int i40e_set_pauseparam(struct net_device *netdev, + if (vsi != pf->vsi[pf->lan_vsi]) + return -EOPNOTSUPP; + +- if (pause->autoneg != ((hw_link_info->an_info & I40E_AQ_AN_COMPLETED) ? +- AUTONEG_ENABLE : AUTONEG_DISABLE)) { ++ is_an = hw_link_info->an_info & I40E_AQ_AN_COMPLETED; ++ if (pause->autoneg != is_an) { + netdev_info(netdev, "To change autoneg please use: ethtool -s autoneg \n"); + return -EOPNOTSUPP; + } + + /* If we have link and don't have autoneg */ +- if (!test_bit(__I40E_DOWN, pf->state) && +- !(hw_link_info->an_info & I40E_AQ_AN_COMPLETED)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && !is_an) { + /* Send message that it might not necessarily work*/ + netdev_info(netdev, "Autoneg did not complete so changing settings may not result in an actual change.\n"); + } +@@ -1040,7 +1040,7 @@ static int i40e_set_pauseparam(struct net_device *netdev, + err = -EAGAIN; + } + +- if (!test_bit(__I40E_DOWN, pf->state)) { ++ if (!test_bit(__I40E_DOWN, pf->state) && is_an) { + /* Give it a little more time to try to come back */ + msleep(75); + if (!test_bit(__I40E_DOWN, pf->state)) +-- +2.20.1 + diff --git a/queue-4.14/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch b/queue-4.14/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch new file mode 100644 index 00000000000..13e7f7f2608 --- /dev/null +++ b/queue-4.14/ib-hfi1-close-vnic-sdma_progress-sleep-window.patch @@ -0,0 +1,90 @@ +From 8736b44e775ec831f0bc80085d2884dd92e84f0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:32:48 -0800 +Subject: IB/hfi1: Close VNIC sdma_progress sleep window + +From: Mike Marciniszyn + +[ Upstream commit 18912c4524385dd6532c682cb9d4f6aa39ba8d47 ] + +The call to sdma_progress() is called outside the wait lock. + +In this case, there is a race condition where sdma_progress() can return +false and the sdma_engine can idle. If that happens, there will be no +more sdma interrupts to cause the wakeup and the vnic_sdma xmit will hang. + +Fix by moving the lock to enclose the sdma_progress() call. + +Also, delete the tx_retry. The need for this was removed by: +commit bcad29137a97 ("IB/hfi1: Serve the most starved iowait entry first") + +Fixes: 64551ede6cd1 ("IB/hfi1: VNIC SDMA support") +Reviewed-by: Gary Leshner +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/vnic_sdma.c | 15 +++++---------- + 1 file changed, 5 insertions(+), 10 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/vnic_sdma.c b/drivers/infiniband/hw/hfi1/vnic_sdma.c +index c3c96c5869ed4..718dcdef946ee 100644 +--- a/drivers/infiniband/hw/hfi1/vnic_sdma.c ++++ b/drivers/infiniband/hw/hfi1/vnic_sdma.c +@@ -57,7 +57,6 @@ + + #define HFI1_VNIC_TXREQ_NAME_LEN 32 + #define HFI1_VNIC_SDMA_DESC_WTRMRK 64 +-#define HFI1_VNIC_SDMA_RETRY_COUNT 1 + + /* + * struct vnic_txreq - VNIC transmit descriptor +@@ -67,7 +66,6 @@ + * @pad: pad buffer + * @plen: pad length + * @pbc_val: pbc value +- * @retry_count: tx retry count + */ + struct vnic_txreq { + struct sdma_txreq txreq; +@@ -77,8 +75,6 @@ struct vnic_txreq { + unsigned char pad[HFI1_VNIC_MAX_PAD]; + u16 plen; + __le64 pbc_val; +- +- u32 retry_count; + }; + + static void vnic_sdma_complete(struct sdma_txreq *txreq, +@@ -196,7 +192,6 @@ int hfi1_vnic_send_dma(struct hfi1_devdata *dd, u8 q_idx, + ret = build_vnic_tx_desc(sde, tx, pbc); + if (unlikely(ret)) + goto free_desc; +- tx->retry_count = 0; + + ret = sdma_send_txreq(sde, &vnic_sdma->wait, &tx->txreq, + vnic_sdma->pkts_sent); +@@ -238,14 +233,14 @@ static int hfi1_vnic_sdma_sleep(struct sdma_engine *sde, + struct hfi1_vnic_sdma *vnic_sdma = + container_of(wait, struct hfi1_vnic_sdma, wait); + struct hfi1_ibdev *dev = &vnic_sdma->dd->verbs_dev; +- struct vnic_txreq *tx = container_of(txreq, struct vnic_txreq, txreq); + +- if (sdma_progress(sde, seq, txreq)) +- if (tx->retry_count++ < HFI1_VNIC_SDMA_RETRY_COUNT) +- return -EAGAIN; ++ write_seqlock(&dev->iowait_lock); ++ if (sdma_progress(sde, seq, txreq)) { ++ write_sequnlock(&dev->iowait_lock); ++ return -EAGAIN; ++ } + + vnic_sdma->state = HFI1_VNIC_SDMA_Q_DEFERRED; +- write_seqlock(&dev->iowait_lock); + if (list_empty(&vnic_sdma->wait.list)) + iowait_queue(pkts_sent, wait, &sde->dmawait); + write_sequnlock(&dev->iowait_lock); +-- +2.20.1 + diff --git a/queue-4.14/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch b/queue-4.14/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch new file mode 100644 index 00000000000..52317b0aee3 --- /dev/null +++ b/queue-4.14/ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch @@ -0,0 +1,122 @@ +From 1875cbfe03a392d3b9ab0a030ddfefea0acff94d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 10:19:04 -0800 +Subject: IB/hfi1: Ignore LNI errors before DC8051 transitions to Polling state + +From: Kaike Wan + +[ Upstream commit c1a797c0818e0122c7ec8422edd971cfec9b15ea ] + +When it is requested to change its physical state back to Offline while in +the process to go up, DC8051 will set the ERROR field in the +DC8051_DBG_ERR_INFO_SET_BY_8051 register. This ERROR field will remain +until the next time when DC8051 transitions from Offline to Polling. +Subsequently, when the host requests DC8051 to change its physical state +to Polling again, it may receive a DC8051 interrupt with the stale ERROR +field still in DC8051_DBG_ERR_INFO_SET_BY_8051. If the host link state has +been changed to Polling, this stale ERROR will force the host to +transition to Offline state, resulting in a vicious cycle of Polling +->Offline->Polling->Offline. On the other hand, if the host link state is +still Offline when the stale ERROR is received, the stale ERROR will be +ignored, and the link will come up correctly. This patch implements the +correct behavior by changing host link state to Polling only after DC8051 +changes its physical state to Polling. + +Reviewed-by: Mike Marciniszyn +Signed-off-by: Krzysztof Goreczny +Signed-off-by: Kaike Wan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/chip.c | 47 ++++++++++++++++++++++++++++++- + 1 file changed, 46 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 9dcdc0a8685e7..9f78bb07744c7 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -1074,6 +1074,8 @@ static void log_state_transition(struct hfi1_pportdata *ppd, u32 state); + static void log_physical_state(struct hfi1_pportdata *ppd, u32 state); + static int wait_physical_linkstate(struct hfi1_pportdata *ppd, u32 state, + int msecs); ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs); + static void read_planned_down_reason_code(struct hfi1_devdata *dd, u8 *pdrrc); + static void read_link_down_reason(struct hfi1_devdata *dd, u8 *ldr); + static void handle_temp_err(struct hfi1_devdata *dd); +@@ -10731,13 +10733,15 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + break; + + ppd->port_error_action = 0; +- ppd->host_link_state = HLS_DN_POLL; + + if (quick_linkup) { + /* quick linkup does not go into polling */ + ret = do_quick_linkup(dd); + } else { + ret1 = set_physical_link_state(dd, PLS_POLLING); ++ if (!ret1) ++ ret1 = wait_phys_link_out_of_offline(ppd, ++ 3000); + if (ret1 != HCMD_SUCCESS) { + dd_dev_err(dd, + "Failed to transition to Polling link state, return 0x%x\n", +@@ -10745,6 +10749,14 @@ int set_link_state(struct hfi1_pportdata *ppd, u32 state) + ret = -EINVAL; + } + } ++ ++ /* ++ * Change the host link state after requesting DC8051 to ++ * change its physical state so that we can ignore any ++ * interrupt with stale LNI(XX) error, which will not be ++ * cleared until DC8051 transitions to Polling state. ++ */ ++ ppd->host_link_state = HLS_DN_POLL; + ppd->offline_disabled_reason = + HFI1_ODR_MASK(OPA_LINKDOWN_REASON_NONE); + /* +@@ -12870,6 +12882,39 @@ static int wait_phys_link_offline_substates(struct hfi1_pportdata *ppd, + return read_state; + } + ++/* ++ * wait_phys_link_out_of_offline - wait for any out of offline state ++ * @ppd: port device ++ * @msecs: the number of milliseconds to wait ++ * ++ * Wait up to msecs milliseconds for any out of offline physical link ++ * state change to occur. ++ * Returns 0 if at least one state is reached, otherwise -ETIMEDOUT. ++ */ ++static int wait_phys_link_out_of_offline(struct hfi1_pportdata *ppd, ++ int msecs) ++{ ++ u32 read_state; ++ unsigned long timeout; ++ ++ timeout = jiffies + msecs_to_jiffies(msecs); ++ while (1) { ++ read_state = read_physical_state(ppd->dd); ++ if ((read_state & 0xF0) != PLS_OFFLINE) ++ break; ++ if (time_after(jiffies, timeout)) { ++ dd_dev_err(ppd->dd, ++ "timeout waiting for phy link out of offline. Read state 0x%x, %dms\n", ++ read_state, msecs); ++ return -ETIMEDOUT; ++ } ++ usleep_range(1950, 2050); /* sleep 2ms-ish */ ++ } ++ ++ log_state_transition(ppd, read_state); ++ return read_state; ++} ++ + #define CLEAR_STATIC_RATE_CONTROL_SMASK(r) \ + (r &= ~SEND_CTXT_CHECK_ENABLE_DISALLOW_PBC_STATIC_RATE_CONTROL_SMASK) + +-- +2.20.1 + diff --git a/queue-4.14/input-cyttsp4_core-fix-use-after-free-bug.patch b/queue-4.14/input-cyttsp4_core-fix-use-after-free-bug.patch new file mode 100644 index 00000000000..03ca9f326f2 --- /dev/null +++ b/queue-4.14/input-cyttsp4_core-fix-use-after-free-bug.patch @@ -0,0 +1,51 @@ +From 2365d43740c54918c801d3aefed980782bd295ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Nov 2019 17:04:54 -0800 +Subject: Input: cyttsp4_core - fix use after free bug + +From: Pan Bian + +[ Upstream commit 79aae6acbef16f720a7949f8fc6ac69816c79d62 ] + +The device md->input is used after it is released. Setting the device +data to NULL is unnecessary as the device is never used again. Instead, +md->input should be assigned NULL to avoid accessing the freed memory +accidently. Besides, checking md->si against NULL is superfluous as it +points to a variable address, which cannot be NULL. + +Signed-off-by: Pan Bian +Link: https://lore.kernel.org/r/1572936379-6423-1-git-send-email-bianpan2016@163.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/cyttsp4_core.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c +index beaf61ce775b7..a9af83de88bb2 100644 +--- a/drivers/input/touchscreen/cyttsp4_core.c ++++ b/drivers/input/touchscreen/cyttsp4_core.c +@@ -1972,11 +1972,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + /* get sysinfo */ + md->si = &cd->sysinfo; +- if (!md->si) { +- dev_err(dev, "%s: Fail get sysinfo pointer from core p=%p\n", +- __func__, md->si); +- goto error_get_sysinfo; +- } + + rc = cyttsp4_setup_input_device(cd); + if (rc) +@@ -1986,8 +1981,6 @@ static int cyttsp4_mt_probe(struct cyttsp4 *cd) + + error_init_input: + input_free_device(md->input); +-error_get_sysinfo: +- input_set_drvdata(md->input, NULL); + error_alloc_failed: + dev_err(dev, "%s failed.\n", __func__); + return rc; +-- +2.20.1 + diff --git a/queue-4.14/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch b/queue-4.14/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch new file mode 100644 index 00000000000..784d40ea281 --- /dev/null +++ b/queue-4.14/iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch @@ -0,0 +1,50 @@ +From 3240d7f95ad4bcd1bfee7b57e1a4af8835762f12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 13:31:10 -0800 +Subject: iomap: sub-block dio needs to zeroout beyond EOF + +From: Dave Chinner + +[ Upstream commit b450672fb66b4a991a5b55ee24209ac7ae7690ce ] + +If we are doing sub-block dio that extends EOF, we need to zero +the unused tail of the block to initialise the data in it it. If we +do not zero the tail of the block, then an immediate mmap read of +the EOF block will expose stale data beyond EOF to userspace. Found +with fsx running sub-block DIO sizes vs MAPREAD/MAPWRITE operations. + +Fix this by detecting if the end of the DIO write is beyond EOF +and zeroing the tail if necessary. + +Signed-off-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/fs/iomap.c b/fs/iomap.c +index 467d98bf70542..1cf160ced0d46 100644 +--- a/fs/iomap.c ++++ b/fs/iomap.c +@@ -941,7 +941,14 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length, + dio->submit.cookie = submit_bio(bio); + } while (nr_pages); + +- if (need_zeroout) { ++ /* ++ * We need to zeroout the tail of a sub-block write if the extent type ++ * requires zeroing or the write extends beyond EOF. If we don't zero ++ * the block tail in the latter case, we can expose stale data via mmap ++ * reads of the EOF block. ++ */ ++ if (need_zeroout || ++ ((dio->flags & IOMAP_DIO_WRITE) && pos >= i_size_read(inode))) { + /* zero out from the end of the write to the end of the block */ + pad = pos & (fs_block_size - 1); + if (pad) +-- +2.20.1 + diff --git a/queue-4.14/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch b/queue-4.14/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch new file mode 100644 index 00000000000..e9edf134a5b --- /dev/null +++ b/queue-4.14/iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch @@ -0,0 +1,39 @@ +From f88ffd053ad629db259b45bdef0d3c61f2acd162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Nov 2018 05:27:39 -0800 +Subject: iw_cxgb4: only reconnect with MPAv1 if the peer aborts + +From: Steve Wise + +[ Upstream commit 9828ca654b52848e7eb7dcc9b0994ff130dd4546 ] + +Only retry connection setup with MPAv1 if the peer actually aborted the +connection upon receiving the MPAv2 start message. This avoids retrying +with MPAv1 in the case where the connection was aborted due to retransmit +timeouts. + +Fixes: d2fe99e86bb2 ("RDMA/cxgb4: Add support for MPAv2 Enhanced RDMA Negotiation") +Signed-off-by: Steve Wise +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index bb36cdf82a8d6..cdde7048891c0 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -2774,7 +2774,8 @@ static int peer_abort(struct c4iw_dev *dev, struct sk_buff *skb) + break; + case MPA_REQ_SENT: + (void)stop_ep_timer(ep); +- if (mpa_rev == 1 || (mpa_rev == 2 && ep->tried_with_mpa_v1)) ++ if (status != CPL_ERR_CONN_RESET || mpa_rev == 1 || ++ (mpa_rev == 2 && ep->tried_with_mpa_v1)) + connect_reply_upcall(ep, -ECONNRESET); + else { + /* +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch b/queue-4.14/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch new file mode 100644 index 00000000000..4ebf4538c68 --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch @@ -0,0 +1,51 @@ +From 827de7b81d5ba034236d6f9e8158c7a4b5d3ea1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jul 2018 21:57:50 +0300 +Subject: iwlwifi: mvm: Send non offchannel traffic via AP sta + +From: Andrei Otcheretianski + +[ Upstream commit dc1aca22f8f38b7e2ad7b118db87404d11e68771 ] + +TDLS discovery response frame is a unicast direct frame to the peer. +Since we don't have a STA for this peer, this frame goes through +iwl_tx_skb_non_sta(). As the result aux_sta and some completely +arbitrary queue would be selected for this frame, resulting in a queue +hang. Fix that by sending such frames through AP sta instead. + +Signed-off-by: Andrei Otcheretianski +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 77ed6ecf5ee54..b86c7a36d3f17 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -822,6 +822,21 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw, + !ieee80211_is_bufferable_mmpdu(hdr->frame_control)) + sta = NULL; + ++ /* If there is no sta, and it's not offchannel - send through AP */ ++ if (info->control.vif->type == NL80211_IFTYPE_STATION && ++ info->hw_queue != IWL_MVM_OFFCHANNEL_QUEUE && !sta) { ++ struct iwl_mvm_vif *mvmvif = ++ iwl_mvm_vif_from_mac80211(info->control.vif); ++ u8 ap_sta_id = READ_ONCE(mvmvif->ap_sta_id); ++ ++ if (ap_sta_id < IWL_MVM_STATION_COUNT) { ++ /* mac80211 holds rcu read lock */ ++ sta = rcu_dereference(mvm->fw_id_to_mac_id[ap_sta_id]); ++ if (IS_ERR_OR_NULL(sta)) ++ goto drop; ++ } ++ } ++ + if (sta) { + if (iwl_mvm_defer_tx(mvm, sta, skb)) + return; +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-mvm-synchronize-tid-queue-removal.patch b/queue-4.14/iwlwifi-mvm-synchronize-tid-queue-removal.patch new file mode 100644 index 00000000000..3f66d479598 --- /dev/null +++ b/queue-4.14/iwlwifi-mvm-synchronize-tid-queue-removal.patch @@ -0,0 +1,47 @@ +From db0a75c4d9143a08d935d8c8f659b5965a4419f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 23:12:33 +0200 +Subject: iwlwifi: mvm: synchronize TID queue removal + +From: Johannes Berg + +[ Upstream commit 06bc6f6ed4ae0246a5e52094d1be90906a1361c7 ] + +When we mark a TID as no longer having a queue, there's no +guarantee the TX path isn't using this txq_id right now, +having accessed it just before we reset the value. To fix +this, add synchronize_net() when we change the TIDs from +having a queue to not having one, so that we can then be +sure that the TX path is no longer accessing that queue. + +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index d16e2ed4419fe..0cfdbaa2af3a7 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -436,6 +436,16 @@ static int iwl_mvm_remove_sta_queue_marking(struct iwl_mvm *mvm, int queue) + + rcu_read_unlock(); + ++ /* ++ * The TX path may have been using this TXQ_ID from the tid_data, ++ * so make sure it's no longer running so that we can safely reuse ++ * this TXQ later. We've set all the TIDs to IWL_MVM_INVALID_QUEUE ++ * above, but nothing guarantees we've stopped using them. Thus, ++ * without this, we could get to iwl_mvm_disable_txq() and remove ++ * the queue while still sending frames to it. ++ */ ++ synchronize_net(); ++ + return disable_agg_tids; + } + +-- +2.20.1 + diff --git a/queue-4.14/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch b/queue-4.14/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch new file mode 100644 index 00000000000..7e638c3aa4b --- /dev/null +++ b/queue-4.14/iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch @@ -0,0 +1,90 @@ +From 474be47eec6efbfbc715d133fdb676c8abcdf314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Nov 2019 13:51:47 +0200 +Subject: iwlwifi: pcie: don't consider IV len in A-MSDU + +From: Mordechay Goodstein + +[ Upstream commit cb1a4badf59275eb7221dcec621e8154917eabd1 ] + +From gen2 PN is totally offloaded to hardware (also the space for the +IV isn't part of the skb). As you can see in mvm/mac80211.c:3545, the +MAC for cipher types CCMP/GCMP doesn't set +IEEE80211_KEY_FLAG_PUT_IV_SPACE for gen2 NICs. + +This causes all the AMSDU data to be corrupted with cipher enabled. + +Signed-off-by: Mordechay Goodstein +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + .../net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 20 +++++++------------ + 1 file changed, 7 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +index 6f45c8148b279..bbb39d6ec2ee3 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c +@@ -232,27 +232,23 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + struct ieee80211_hdr *hdr = (void *)skb->data; + unsigned int snap_ip_tcp_hdrlen, ip_hdrlen, total_len, hdr_room; + unsigned int mss = skb_shinfo(skb)->gso_size; +- u16 length, iv_len, amsdu_pad; ++ u16 length, amsdu_pad; + u8 *start_hdr; + struct iwl_tso_hdr_page *hdr_page; + struct page **page_ptr; + struct tso_t tso; + +- /* if the packet is protected, then it must be CCMP or GCMP */ +- iv_len = ieee80211_has_protected(hdr->frame_control) ? +- IEEE80211_CCMP_HDR_LEN : 0; +- + trace_iwlwifi_dev_tx(trans->dev, skb, tfd, sizeof(*tfd), + &dev_cmd->hdr, start_len, 0); + + ip_hdrlen = skb_transport_header(skb) - skb_network_header(skb); + snap_ip_tcp_hdrlen = 8 + ip_hdrlen + tcp_hdrlen(skb); +- total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len - iv_len; ++ total_len = skb->len - snap_ip_tcp_hdrlen - hdr_len; + amsdu_pad = 0; + + /* total amount of header we may need for this A-MSDU */ + hdr_room = DIV_ROUND_UP(total_len, mss) * +- (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)) + iv_len; ++ (3 + snap_ip_tcp_hdrlen + sizeof(struct ethhdr)); + + /* Our device supports 9 segments at most, it will fit in 1 page */ + hdr_page = get_page_hdr(trans, hdr_room); +@@ -263,14 +259,12 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + start_hdr = hdr_page->pos; + page_ptr = (void *)((u8 *)skb->cb + trans_pcie->page_offs); + *page_ptr = hdr_page->page; +- memcpy(hdr_page->pos, skb->data + hdr_len, iv_len); +- hdr_page->pos += iv_len; + + /* +- * Pull the ieee80211 header + IV to be able to use TSO core, ++ * Pull the ieee80211 header to be able to use TSO core, + * we will restore it for the tx_status flow. + */ +- skb_pull(skb, hdr_len + iv_len); ++ skb_pull(skb, hdr_len); + + /* + * Remove the length of all the headers that we don't actually +@@ -348,8 +342,8 @@ static int iwl_pcie_gen2_build_amsdu(struct iwl_trans *trans, + } + } + +- /* re -add the WiFi header and IV */ +- skb_push(skb, hdr_len + iv_len); ++ /* re -add the WiFi header */ ++ skb_push(skb, hdr_len); + + return 0; + +-- +2.20.1 + diff --git a/queue-4.14/kbuild-fix-single-target-build-for-external-module.patch b/queue-4.14/kbuild-fix-single-target-build-for-external-module.patch new file mode 100644 index 00000000000..e240a15f95e --- /dev/null +++ b/queue-4.14/kbuild-fix-single-target-build-for-external-module.patch @@ -0,0 +1,85 @@ +From e22ea6fcb1c3655de6f71156ef204754cba2cd16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 08:11:54 +0900 +Subject: kbuild: fix single target build for external module + +From: Masahiro Yamada + +[ Upstream commit e07db28eea38ed4e332b3a89f3995c86b713cb5b ] + +Building a single target in an external module fails due to missing +.tmp_versions directory. + +For example, + + $ make -C /lib/modules/$(uname -r)/build M=$PWD foo.o + +will fail in the following way: + + CC [M] /home/masahiro/foo/foo.o +/bin/sh: 1: cannot create /home/masahiro/foo/.tmp_versions/foo.mod: Directory nonexistent + +This is because $(cmd_crmodverdir) is executed only before building +/, %/, %.ko single targets of external modules. Create .tmp_versions +in the 'prepare' target. + +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + Makefile | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/Makefile b/Makefile +index d97288c0754fe..4de172b2e1fba 100644 +--- a/Makefile ++++ b/Makefile +@@ -1529,9 +1529,6 @@ else # KBUILD_EXTMOD + + # We are always building modules + KBUILD_MODULES := 1 +-PHONY += crmodverdir +-crmodverdir: +- $(cmd_crmodverdir) + + PHONY += $(objtree)/Module.symvers + $(objtree)/Module.symvers: +@@ -1543,7 +1540,7 @@ $(objtree)/Module.symvers: + + module-dirs := $(addprefix _module_,$(KBUILD_EXTMOD)) + PHONY += $(module-dirs) modules +-$(module-dirs): crmodverdir $(objtree)/Module.symvers ++$(module-dirs): prepare $(objtree)/Module.symvers + $(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@) + + modules: $(module-dirs) +@@ -1584,7 +1581,8 @@ help: + + # Dummies... + PHONY += prepare scripts +-prepare: ; ++prepare: ++ $(cmd_crmodverdir) + scripts: ; + endif # KBUILD_EXTMOD + +@@ -1709,17 +1707,14 @@ endif + + # Modules + /: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + # Make sure the latest headers are built for Documentation + Documentation/ samples/: headers_install + %/: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) + %.ko: prepare scripts FORCE +- $(cmd_crmodverdir) + $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \ + $(build)=$(build-dir) $(@:.ko=.o) + $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost +-- +2.20.1 + diff --git a/queue-4.14/lockd-fix-decoding-of-test-results.patch b/queue-4.14/lockd-fix-decoding-of-test-results.patch new file mode 100644 index 00000000000..9daf766261d --- /dev/null +++ b/queue-4.14/lockd-fix-decoding-of-test-results.patch @@ -0,0 +1,98 @@ +From 1f61fecd76553711c0637aa683aa433e4ef04f76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 11:36:52 -0500 +Subject: lockd: fix decoding of TEST results + +From: J. Bruce Fields + +[ Upstream commit b8db159239b3f51e2b909859935cc25cb3ff3eed ] + +We fail to advance the read pointer when reading the stat.oh field that +identifies the lock-holder in a TEST result. + +This turns out not to matter if the server is knfsd, which always +returns a zero-length field. But other servers (Ganesha is an example) +may not do this. The result is bad values in fcntl F_GETLK results. + +Fix this. + +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/lockd/clnt4xdr.c | 22 ++++++---------------- + fs/lockd/clntxdr.c | 22 ++++++---------------- + 2 files changed, 12 insertions(+), 32 deletions(-) + +diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c +index 00d5ef5f99f73..214a2fa1f1e39 100644 +--- a/fs/lockd/clnt4xdr.c ++++ b/fs/lockd/clnt4xdr.c +@@ -128,24 +128,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c +index 2c6176387143c..747b9c8c940ac 100644 +--- a/fs/lockd/clntxdr.c ++++ b/fs/lockd/clntxdr.c +@@ -125,24 +125,14 @@ static void encode_netobj(struct xdr_stream *xdr, + static int decode_netobj(struct xdr_stream *xdr, + struct xdr_netobj *obj) + { +- u32 length; +- __be32 *p; ++ ssize_t ret; + +- p = xdr_inline_decode(xdr, 4); +- if (unlikely(p == NULL)) +- goto out_overflow; +- length = be32_to_cpup(p++); +- if (unlikely(length > XDR_MAX_NETOBJ)) +- goto out_size; +- obj->len = length; +- obj->data = (u8 *)p; ++ ret = xdr_stream_decode_opaque_inline(xdr, (void *)&obj->data, ++ XDR_MAX_NETOBJ); ++ if (unlikely(ret < 0)) ++ return -EIO; ++ obj->len = ret; + return 0; +-out_size: +- dprintk("NFS: returned netobj was too long: %u\n", length); +- return -EIO; +-out_overflow: +- print_overflow_msg(__func__, xdr); +- return -EIO; + } + + /* +-- +2.20.1 + diff --git a/queue-4.14/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch b/queue-4.14/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch new file mode 100644 index 00000000000..23cba4c5814 --- /dev/null +++ b/queue-4.14/math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch @@ -0,0 +1,41 @@ +From 9402e57a880f38eefc6871896cd932b15e516f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 11:14:38 +0800 +Subject: math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning + +From: Vincent Chen + +[ Upstream commit 83312f1b7ae205dca647bf52bbe2d51303cdedfb ] + +_FP_ROUND_ZERO is defined as 0 and used as a statemente in macro +_FP_ROUND. This generates "error: statement with no effect +[-Werror=unused-value]" from gcc. Defining _FP_ROUND_ZERO as (void)0 to +fix it. + +This modification is quoted from glibc 'commit +(8ed1e7d5894000c155acbd06f)' + +Signed-off-by: Vincent Chen +Acked-by: Greentime Hu +Signed-off-by: Greentime Hu +Signed-off-by: Sasha Levin +--- + include/math-emu/soft-fp.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/math-emu/soft-fp.h b/include/math-emu/soft-fp.h +index 3f284bc031809..5650c16283830 100644 +--- a/include/math-emu/soft-fp.h ++++ b/include/math-emu/soft-fp.h +@@ -138,7 +138,7 @@ do { \ + _FP_FRAC_ADDI_##wc(X, _FP_WORK_ROUND); \ + } while (0) + +-#define _FP_ROUND_ZERO(wc, X) 0 ++#define _FP_ROUND_ZERO(wc, X) (void)0 + + #define _FP_ROUND_PINF(wc, X) \ + do { \ +-- +2.20.1 + diff --git a/queue-4.14/media-cec-report-vendor-id-after-initialization.patch b/queue-4.14/media-cec-report-vendor-id-after-initialization.patch new file mode 100644 index 00000000000..28060e1fa87 --- /dev/null +++ b/queue-4.14/media-cec-report-vendor-id-after-initialization.patch @@ -0,0 +1,42 @@ +From 98ba21f573fc4842264eefebb8d31913da9d43c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 03:44:20 -0400 +Subject: media: cec: report Vendor ID after initialization + +From: Hans Verkuil + +[ Upstream commit 7f02ac77c768ba2bcdd0ce719c1fca0870ffe2fb ] + +The CEC specification requires that the Vendor ID (if any) is reported +after a logical address was claimed. + +This was never done, so add support for this. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/cec-adap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/media/cec/cec-adap.c b/drivers/media/cec/cec-adap.c +index f8a808d45034e..27e57915eb4d1 100644 +--- a/drivers/media/cec/cec-adap.c ++++ b/drivers/media/cec/cec-adap.c +@@ -1403,6 +1403,13 @@ configured: + las->log_addr[i], + cec_phys_addr_exp(adap->phys_addr)); + cec_transmit_msg_fh(adap, &msg, NULL, false); ++ ++ /* Report Vendor ID */ ++ if (adap->log_addrs.vendor_id != CEC_VENDOR_ID_NONE) { ++ cec_msg_device_vendor_id(&msg, ++ adap->log_addrs.vendor_id); ++ cec_transmit_msg_fh(adap, &msg, NULL, false); ++ } + } + adap->kthread_config = NULL; + complete(&adap->config_completion); +-- +2.20.1 + diff --git a/queue-4.14/media-coda-fix-memory-corruption-in-case-more-than-3.patch b/queue-4.14/media-coda-fix-memory-corruption-in-case-more-than-3.patch new file mode 100644 index 00000000000..3e6b2a858eb --- /dev/null +++ b/queue-4.14/media-coda-fix-memory-corruption-in-case-more-than-3.patch @@ -0,0 +1,140 @@ +From 0139af208d3499abd38af388a359691015e605a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 05:40:54 -0500 +Subject: media: coda: fix memory corruption in case more than 32 instances are + opened + +From: Philipp Zabel + +[ Upstream commit 649cfc2bdfeeb98ff7d8fdff0af3f8fb9c8da50f ] + +The ffz() return value is undefined if the instance mask does not +contain any zeros. If it returned 32, the following set_bit would +corrupt the debugfs_root pointer. +Switch to IDA for context index allocation. This also removes the +artificial 32 instance limit for all except CodaDx6. + +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-common.c | 26 +++++++++-------------- + drivers/media/platform/coda/coda.h | 3 ++- + 2 files changed, 12 insertions(+), 17 deletions(-) + +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 5b87c488ee111..ab5d00a4eb342 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1931,17 +1932,6 @@ int coda_decoder_queue_init(void *priv, struct vb2_queue *src_vq, + return coda_queue_init(priv, dst_vq); + } + +-static int coda_next_free_instance(struct coda_dev *dev) +-{ +- int idx = ffz(dev->instance_mask); +- +- if ((idx < 0) || +- (dev->devtype->product == CODA_DX6 && idx > CODADX6_MAX_INSTANCES)) +- return -EBUSY; +- +- return idx; +-} +- + /* + * File operations + */ +@@ -1950,7 +1940,8 @@ static int coda_open(struct file *file) + { + struct video_device *vdev = video_devdata(file); + struct coda_dev *dev = video_get_drvdata(vdev); +- struct coda_ctx *ctx = NULL; ++ struct coda_ctx *ctx; ++ unsigned int max = ~0; + char *name; + int ret; + int idx; +@@ -1959,12 +1950,13 @@ static int coda_open(struct file *file) + if (!ctx) + return -ENOMEM; + +- idx = coda_next_free_instance(dev); ++ if (dev->devtype->product == CODA_DX6) ++ max = CODADX6_MAX_INSTANCES - 1; ++ idx = ida_alloc_max(&dev->ida, max, GFP_KERNEL); + if (idx < 0) { + ret = idx; + goto err_coda_max; + } +- set_bit(idx, &dev->instance_mask); + + name = kasprintf(GFP_KERNEL, "context%d", idx); + if (!name) { +@@ -2072,8 +2064,8 @@ err_clk_per: + err_pm_get: + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +- clear_bit(ctx->idx, &dev->instance_mask); + err_coda_name_init: ++ ida_free(&dev->ida, ctx->idx); + err_coda_max: + kfree(ctx); + return ret; +@@ -2115,7 +2107,7 @@ static int coda_release(struct file *file) + pm_runtime_put_sync(&dev->plat_dev->dev); + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +- clear_bit(ctx->idx, &dev->instance_mask); ++ ida_free(&dev->ida, ctx->idx); + if (ctx->ops->release) + ctx->ops->release(ctx); + debugfs_remove_recursive(ctx->debugfs_entry); +@@ -2558,6 +2550,7 @@ static int coda_probe(struct platform_device *pdev) + + mutex_init(&dev->dev_mutex); + mutex_init(&dev->coda_mutex); ++ ida_init(&dev->ida); + + dev->debugfs_root = debugfs_create_dir("coda", NULL); + if (!dev->debugfs_root) +@@ -2645,6 +2638,7 @@ static int coda_remove(struct platform_device *pdev) + coda_free_aux_buf(dev, &dev->tempbuf); + coda_free_aux_buf(dev, &dev->workbuf); + debugfs_remove_recursive(dev->debugfs_root); ++ ida_destroy(&dev->ida); + return 0; + } + +diff --git a/drivers/media/platform/coda/coda.h b/drivers/media/platform/coda/coda.h +index 389a882cc3dab..2b187f83e5447 100644 +--- a/drivers/media/platform/coda/coda.h ++++ b/drivers/media/platform/coda/coda.h +@@ -16,6 +16,7 @@ + #define __CODA_H__ + + #include ++#include + #include + #include + #include +@@ -94,7 +95,7 @@ struct coda_dev { + struct workqueue_struct *workqueue; + struct v4l2_m2m_dev *m2m_dev; + struct list_head instances; +- unsigned long instance_mask; ++ struct ida ida; + struct dentry *debugfs_root; + }; + +-- +2.20.1 + diff --git a/queue-4.14/media-pulse8-cec-return-0-when-invalidating-the-logi.patch b/queue-4.14/media-pulse8-cec-return-0-when-invalidating-the-logi.patch new file mode 100644 index 00000000000..9e3d16378d7 --- /dev/null +++ b/queue-4.14/media-pulse8-cec-return-0-when-invalidating-the-logi.patch @@ -0,0 +1,37 @@ +From 7125603265e340687316a7f3869a71a67ecd5e45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 08:25:53 -0500 +Subject: media: pulse8-cec: return 0 when invalidating the logical address + +From: Hans Verkuil + +[ Upstream commit 2e84eb9affac43eeaf834992888b72426a8cd442 ] + +Return 0 when invalidating the logical address. The cec core produces +a warning for drivers that do this. + +Signed-off-by: Hans Verkuil +Reported-by: Torbjorn Jansson +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pulse8-cec/pulse8-cec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/pulse8-cec/pulse8-cec.c b/drivers/media/usb/pulse8-cec/pulse8-cec.c +index 50146f263d904..12da631c0fda0 100644 +--- a/drivers/media/usb/pulse8-cec/pulse8-cec.c ++++ b/drivers/media/usb/pulse8-cec/pulse8-cec.c +@@ -585,7 +585,7 @@ unlock: + else + pulse8->config_pending = true; + mutex_unlock(&pulse8->config_lock); +- return err; ++ return log_addr == CEC_LOG_ADDR_INVALID ? 0 : err; + } + + static int pulse8_cec_adap_transmit(struct cec_adapter *adap, u8 attempts, +-- +2.20.1 + diff --git a/queue-4.14/media-stkwebcam-bugfix-for-wrong-return-values.patch b/queue-4.14/media-stkwebcam-bugfix-for-wrong-return-values.patch new file mode 100644 index 00000000000..0e905900c8e --- /dev/null +++ b/queue-4.14/media-stkwebcam-bugfix-for-wrong-return-values.patch @@ -0,0 +1,42 @@ +From f2702601fff75dec35d80b3ce09cc6ef217e9de0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Nov 2018 11:14:54 -0500 +Subject: media: stkwebcam: Bugfix for wrong return values + +From: Andreas Pape + +[ Upstream commit 3c28b91380dd1183347d32d87d820818031ebecf ] + +usb_control_msg returns in case of a successfully sent message the number +of sent bytes as a positive number. Don't use this value as a return value +for stk_camera_read_reg, as a non-zero return value is used as an error +condition in some cases when stk_camera_read_reg is called. + +Signed-off-by: Andreas Pape +Reviewed-by: Kieran Bingham +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/stkwebcam/stk-webcam.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/stkwebcam/stk-webcam.c b/drivers/media/usb/stkwebcam/stk-webcam.c +index a7da1356a36ef..6992e84f8a8bb 100644 +--- a/drivers/media/usb/stkwebcam/stk-webcam.c ++++ b/drivers/media/usb/stkwebcam/stk-webcam.c +@@ -164,7 +164,11 @@ int stk_camera_read_reg(struct stk_camera *dev, u16 index, u8 *value) + *value = *buf; + + kfree(buf); +- return ret; ++ ++ if (ret < 0) ++ return ret; ++ else ++ return 0; + } + + static int stk_start_stream(struct stk_camera *dev) +-- +2.20.1 + diff --git a/queue-4.14/media-vimc-fix-start-stream-when-link-is-disabled.patch b/queue-4.14/media-vimc-fix-start-stream-when-link-is-disabled.patch new file mode 100644 index 00000000000..e2acf82cb01 --- /dev/null +++ b/queue-4.14/media-vimc-fix-start-stream-when-link-is-disabled.patch @@ -0,0 +1,36 @@ +From 4fb53c75ec30e5575014bc529fb959bdd32e0bb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 12:56:41 -0500 +Subject: media: vimc: fix start stream when link is disabled + +From: Helen Fornazier + +[ Upstream commit e159b6074c82fe31b79aad672e02fa204dbbc6d8 ] + +If link is disabled, media_entity_remote_pad returns NULL, causing a +NULL pointer deference. +Ignore links that are not enabled instead. + +Signed-off-by: Helen Koike +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vimc/vimc-common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/vimc/vimc-common.c b/drivers/media/platform/vimc/vimc-common.c +index 743554de724d8..a9ab3871ccda2 100644 +--- a/drivers/media/platform/vimc/vimc-common.c ++++ b/drivers/media/platform/vimc/vimc-common.c +@@ -241,6 +241,8 @@ int vimc_pipeline_s_stream(struct media_entity *ent, int enable) + + /* Start the stream in the subdevice direct connected */ + pad = media_entity_remote_pad(&ent->pads[i]); ++ if (!pad) ++ continue; + + if (!is_media_entity_v4l2_subdev(pad->entity)) + return -EINVAL; +-- +2.20.1 + diff --git a/queue-4.14/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch b/queue-4.14/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch new file mode 100644 index 00000000000..a144ee37cad --- /dev/null +++ b/queue-4.14/mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch @@ -0,0 +1,53 @@ +From e71eb6d47b3fd8f3cb3992ebaa0022bc1885dab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 22:12:17 +0200 +Subject: MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible + definition + +From: Aaro Koskinen + +[ Upstream commit 1c6121c39677175bd372076020948e184bad4b6b ] + +cn58xx is compatible with cn50xx, so use the latter. + +Signed-off-by: Aaro Koskinen +[paul.burton@mips.com: s/cn52xx/cn50xx/ in commit message.] +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c | 2 +- + arch/mips/include/asm/octeon/cvmx-pko.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +index 8241fc6aa17d8..3839feba68f20 100644 +--- a/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c ++++ b/arch/mips/cavium-octeon/executive/cvmx-cmd-queue.c +@@ -266,7 +266,7 @@ int cvmx_cmd_queue_length(cvmx_cmd_queue_id_t queue_id) + } else { + union cvmx_pko_mem_debug8 debug8; + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- return debug8.cn58xx.doorbell; ++ return debug8.cn50xx.doorbell; + } + case CVMX_CMD_QUEUE_ZIP: + case CVMX_CMD_QUEUE_DFA: +diff --git a/arch/mips/include/asm/octeon/cvmx-pko.h b/arch/mips/include/asm/octeon/cvmx-pko.h +index 5f47f76ed510a..20eb9c46a75ab 100644 +--- a/arch/mips/include/asm/octeon/cvmx-pko.h ++++ b/arch/mips/include/asm/octeon/cvmx-pko.h +@@ -611,7 +611,7 @@ static inline void cvmx_pko_get_port_status(uint64_t port_num, uint64_t clear, + pko_reg_read_idx.s.index = cvmx_pko_get_base_queue(port_num); + cvmx_write_csr(CVMX_PKO_REG_READ_IDX, pko_reg_read_idx.u64); + debug8.u64 = cvmx_read_csr(CVMX_PKO_MEM_DEBUG8); +- status->doorbell = debug8.cn58xx.doorbell; ++ status->doorbell = debug8.cn50xx.doorbell; + } + } + +-- +2.20.1 + diff --git a/queue-4.14/mips-octeon-octeon-platform-fix-typing.patch b/queue-4.14/mips-octeon-octeon-platform-fix-typing.patch new file mode 100644 index 00000000000..2cfe35ebc50 --- /dev/null +++ b/queue-4.14/mips-octeon-octeon-platform-fix-typing.patch @@ -0,0 +1,38 @@ +From 44f75b2807e36dc6f4d38aedf478f37da7b0a241 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Nov 2018 00:37:29 +0200 +Subject: MIPS: OCTEON: octeon-platform: fix typing + +From: Aaro Koskinen + +[ Upstream commit 2cf1c8933dd93088cfb5f8f58b3bb9bbdf1781b9 ] + +Use correct type for fdt_property nameoff field. + +Signed-off-by: Aaro Koskinen +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/21204/ +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Signed-off-by: Sasha Levin +--- + arch/mips/cavium-octeon/octeon-platform.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c +index 1d92efb82c372..e1e24118c169e 100644 +--- a/arch/mips/cavium-octeon/octeon-platform.c ++++ b/arch/mips/cavium-octeon/octeon-platform.c +@@ -501,7 +501,7 @@ static void __init octeon_fdt_set_phy(int eth, int phy_addr) + if (phy_addr >= 256 && alt_phy > 0) { + const struct fdt_property *phy_prop; + struct fdt_property *alt_prop; +- u32 phy_handle_name; ++ fdt32_t phy_handle_name; + + /* Use the alt phy node instead.*/ + phy_prop = fdt_get_property(initial_boot_params, eth, "phy-handle", NULL); +-- +2.20.1 + diff --git a/queue-4.14/mips-sibyte-enable-zone_dma32-for-littlesur.patch b/queue-4.14/mips-sibyte-enable-zone_dma32-for-littlesur.patch new file mode 100644 index 00000000000..7595ced7956 --- /dev/null +++ b/queue-4.14/mips-sibyte-enable-zone_dma32-for-littlesur.patch @@ -0,0 +1,53 @@ +From 82fcc83982a3f03e63b568d3365e9506c0186ad6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 22:42:37 +0000 +Subject: MIPS: SiByte: Enable ZONE_DMA32 for LittleSur + +From: Maciej W. Rozycki + +[ Upstream commit 756d6d836dbfb04a5a486bc2ec89397aa4533737 ] + +The LittleSur board is marked for high memory support and therefore +clearly must provide a way to have enough memory installed for some to +be present outside the low 4GiB physical address range. With the memory +map of the BCM1250 SOC it has been built around it means over 1GiB of +actual DRAM, as only the first 1GiB is mapped in the low 4GiB physical +address range[1]. + +Complement commit cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need +DMA32.") then and also enable ZONE_DMA32 for LittleSur. + +References: + +[1] "BCM1250/BCM1125/BCM1125H User Manual", Revision 1250_1125-UM100-R, + Broadcom Corporation, 21 Oct 2002, Section 3: "System Overview", + "Memory Map", pp. 34-38 + +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Paul Burton +Reviewed-by: Christoph Hellwig +Patchwork: https://patchwork.linux-mips.org/patch/21107/ +Fixes: cce335ae47e2 ("[MIPS] 64-bit Sibyte kernels need DMA32.") +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index ae4450e891abc..7e267d657c561 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -812,6 +812,7 @@ config SIBYTE_LITTLESUR + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_SUPPORTS_HIGHMEM + select SYS_SUPPORTS_LITTLE_ENDIAN ++ select ZONE_DMA32 if 64BIT + + config SIBYTE_SENTOSA + bool "Sibyte BCM91250E-Sentosa" +-- +2.20.1 + diff --git a/queue-4.14/mlx4-use-snprintf-instead-of-complicated-strcpy.patch b/queue-4.14/mlx4-use-snprintf-instead-of-complicated-strcpy.patch new file mode 100644 index 00000000000..172eaa37c97 --- /dev/null +++ b/queue-4.14/mlx4-use-snprintf-instead-of-complicated-strcpy.patch @@ -0,0 +1,53 @@ +From 807fd44a432e339b68ab5f918907821740838866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Nov 2018 21:18:07 -0500 +Subject: mlx4: Use snprintf instead of complicated strcpy + +From: Qian Cai + +[ Upstream commit 0fbc9b8b4ea3f688a5da141a64f97aa33ad02ae9 ] + +This fixes a compilation warning in sysfs.c + +drivers/infiniband/hw/mlx4/sysfs.c:360:2: warning: 'strncpy' output may be +truncated copying 8 bytes from a string of length 31 +[-Wstringop-truncation] + +By eliminating the temporary stack buffer. + +Signed-off-by: Qian Cai +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/sysfs.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/sysfs.c b/drivers/infiniband/hw/mlx4/sysfs.c +index e219093d27645..d2da28d613f2c 100644 +--- a/drivers/infiniband/hw/mlx4/sysfs.c ++++ b/drivers/infiniband/hw/mlx4/sysfs.c +@@ -353,16 +353,12 @@ err: + + static void get_name(struct mlx4_ib_dev *dev, char *name, int i, int max) + { +- char base_name[9]; +- +- /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n */ +- strlcpy(name, pci_name(dev->dev->persist->pdev), max); +- strncpy(base_name, name, 8); /*till xxxx:yy:*/ +- base_name[8] = '\0'; +- /* with no ARI only 3 last bits are used so when the fn is higher than 8 ++ /* pci_name format is: bus:dev:func -> xxxx:yy:zz.n ++ * with no ARI only 3 last bits are used so when the fn is higher than 8 + * need to add it to the dev num, so count in the last number will be + * modulo 8 */ +- sprintf(name, "%s%.2d.%d", base_name, (i/8), (i%8)); ++ snprintf(name, max, "%.8s%.2d.%d", pci_name(dev->dev->persist->pdev), ++ i / 8, i % 8); + } + + struct mlx4_port { +-- +2.20.1 + diff --git a/queue-4.14/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch b/queue-4.14/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch new file mode 100644 index 00000000000..08e11cc98a5 --- /dev/null +++ b/queue-4.14/mlxsw-spectrum_router-relax-gre-decap-matching-check.patch @@ -0,0 +1,52 @@ +From 4c70a38018ff938fc6622497198a83c93a360f57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Dec 2018 17:44:52 +0000 +Subject: mlxsw: spectrum_router: Relax GRE decap matching check + +From: Nir Dotan + +[ Upstream commit da93d2913fdf43d5cde3c5a53ac9cc29684d5c7c ] + +GRE decap offload is configured when local routes prefix correspond to the +local address of one of the offloaded GRE tunnels. The matching check was +found to be too strict, such that for a flat GRE configuration, in which +the overlay and underlay traffic share the same non-default VRF, decap flow +was not offloaded. + +Relax the check for decap flow offloading. A match occurs if the local +address of the tunnel matches the local route address while both share the +same VRF table. + +Fixes: 4607f6d26950 ("mlxsw: spectrum_router: Support IPv4 underlay decap") +Signed-off-by: Nir Dotan +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 3ed4fb346f235..5b9a5c3834d9e 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -1252,15 +1252,12 @@ mlxsw_sp_ipip_entry_matches_decap(struct mlxsw_sp *mlxsw_sp, + { + u32 ul_tb_id = l3mdev_fib_table(ul_dev) ? : RT_TABLE_MAIN; + enum mlxsw_sp_ipip_type ipipt = ipip_entry->ipipt; +- struct net_device *ipip_ul_dev; + + if (mlxsw_sp->router->ipip_ops_arr[ipipt]->ul_proto != ul_proto) + return false; + +- ipip_ul_dev = __mlxsw_sp_ipip_netdev_ul_dev_get(ipip_entry->ol_dev); + return mlxsw_sp_ipip_entry_saddr_matches(mlxsw_sp, ul_proto, ul_dip, +- ul_tb_id, ipip_entry) && +- (!ipip_ul_dev || ipip_ul_dev == ul_dev); ++ ul_tb_id, ipip_entry); + } + + /* Given decap parameters, find the corresponding IPIP entry. */ +-- +2.20.1 + diff --git a/queue-4.14/mm-vmstat.c-fix-numa-statistics-updates.patch b/queue-4.14/mm-vmstat.c-fix-numa-statistics-updates.patch new file mode 100644 index 00000000000..ca5c04754cd --- /dev/null +++ b/queue-4.14/mm-vmstat.c-fix-numa-statistics-updates.patch @@ -0,0 +1,55 @@ +From 5ed2aeb59a4fbff9083f0ab8de83df7ba14dd55a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 15:08:32 -0800 +Subject: mm/vmstat.c: fix NUMA statistics updates + +From: Janne Huttunen + +[ Upstream commit 13c9aaf7fa01cc7600c61981609feadeef3354ec ] + +Scan through the whole array to see if an update is needed. While we're +at it, use sizeof() to be safe against any possible type changes in the +future. + +The bug here is that we wouldn't sync per-cpu counters into global ones +if there was an update of numa_stats for higher cpus. Highly +theoretical one though because it is much more probable that zone_stats +are updated so we would refresh anyway. So I wouldn't bother to mark +this for stable, yet something nice to fix. + +[mhocko@suse.com: changelog enhancement] +Link: http://lkml.kernel.org/r/1541601517-17282-1-git-send-email-janne.huttunen@nokia.com +Fixes: 1d90ca897cb0 ("mm: update NUMA counter threshold size") +Signed-off-by: Janne Huttunen +Acked-by: Michal Hocko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/vmstat.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/mm/vmstat.c b/mm/vmstat.c +index ba91683264134..e2197b03da574 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1805,12 +1805,13 @@ static bool need_update(int cpu) + + /* + * The fast way of checking if there are any vmstat diffs. +- * This works because the diffs are byte sized items. + */ +- if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS)) ++ if (memchr_inv(p->vm_stat_diff, 0, NR_VM_ZONE_STAT_ITEMS * ++ sizeof(p->vm_stat_diff[0]))) + return true; + #ifdef CONFIG_NUMA +- if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS)) ++ if (memchr_inv(p->vm_numa_stat_diff, 0, NR_VM_NUMA_STAT_ITEMS * ++ sizeof(p->vm_numa_stat_diff[0]))) + return true; + #endif + } +-- +2.20.1 + diff --git a/queue-4.14/modpost-skip-elf-local-symbols-during-section-mismat.patch b/queue-4.14/modpost-skip-elf-local-symbols-during-section-mismat.patch new file mode 100644 index 00000000000..84e747df281 --- /dev/null +++ b/queue-4.14/modpost-skip-elf-local-symbols-during-section-mismat.patch @@ -0,0 +1,96 @@ +From 45c9fbd1f8398bdb6801ef19fb2a6c6a0d5a29c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 13:14:13 -0800 +Subject: modpost: skip ELF local symbols during section mismatch check + +From: Paul Walmsley + +[ Upstream commit a4d26f1a0958bb1c2b60c6f1e67c6f5d43e2647b ] + +During development of a serial console driver with a gcc 8.2.0 +toolchain for RISC-V, the following modpost warning appeared: + +---- +WARNING: vmlinux.o(.data+0x19b10): Section mismatch in reference from the variable .LANCHOR1 to the function .init.text:sifive_serial_console_setup() +The variable .LANCHOR1 references +the function __init sifive_serial_console_setup() +If the reference is valid then annotate the +variable with __init* or __refdata (see linux/init.h) or name the variable: +*_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console +---- + +".LANCHOR1" is an ELF local symbol, automatically created by gcc's section +anchor generation code: + +https://gcc.gnu.org/onlinedocs/gccint/Anchored-Addresses.html + +https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=gcc/varasm.c;h=cd9591a45617464946dcf9a126dde277d9de9804;hb=9fb89fa845c1b2e0a18d85ada0b077c84508ab78#l7473 + +This was verified by compiling the kernel with -fno-section-anchors +and observing that the ".LANCHOR1" ELF local symbol disappeared, and +modpost no longer warned about the section mismatch. The serial +driver code idiom triggering the warning is standard Linux serial +driver practice that has a specific whitelist inclusion in modpost.c. + +I'm neither a modpost nor an ELF expert, but naively, it doesn't seem +useful for modpost to report section mismatch warnings caused by ELF +local symbols by default. Local symbols have compiler-generated +names, and thus bypass modpost's whitelisting algorithm, which relies +on the presence of a non-autogenerated symbol name. This increases +the likelihood that false positive warnings will be generated (as in +the above case). + +Thus, disable section mismatch reporting on ELF local symbols. The +rationale here is similar to that of commit 2e3a10a1551d ("ARM: avoid +ARM binutils leaking ELF local symbols") and of similar code already +present in modpost.c: + +https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scripts/mod/modpost.c?h=v4.19-rc4&id=7876320f88802b22d4e2daf7eb027dd14175a0f8#n1256 + +This third version of the patch implements a suggestion from Masahiro +Yamada to restructure the code as an +additional pattern matching step inside secref_whitelist(), and +further improves the patch description. + +Signed-off-by: Paul Walmsley +Signed-off-by: Paul Walmsley +Acked-by: Sam Ravnborg +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/modpost.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index c22041a4fc360..b6eb929899c55 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -1174,6 +1174,14 @@ static const struct sectioncheck *section_mismatch( + * fromsec = text section + * refsymname = *.constprop.* + * ++ * Pattern 6: ++ * Hide section mismatch warnings for ELF local symbols. The goal ++ * is to eliminate false positive modpost warnings caused by ++ * compiler-generated ELF local symbol names such as ".LANCHOR1". ++ * Autogenerated symbol names bypass modpost's "Pattern 2" ++ * whitelisting, which relies on pattern-matching against symbol ++ * names to work. (One situation where gcc can autogenerate ELF ++ * local symbols is when "-fsection-anchors" is used.) + **/ + static int secref_whitelist(const struct sectioncheck *mismatch, + const char *fromsec, const char *fromsym, +@@ -1212,6 +1220,10 @@ static int secref_whitelist(const struct sectioncheck *mismatch, + match(fromsym, optim_symbols)) + return 0; + ++ /* Check for pattern 6 */ ++ if (strstarts(fromsym, ".L")) ++ return 0; ++ + return 1; + } + +-- +2.20.1 + diff --git a/queue-4.14/mtd-fix-mtd_oobavail-incoherent-returned-value.patch b/queue-4.14/mtd-fix-mtd_oobavail-incoherent-returned-value.patch new file mode 100644 index 00000000000..ea4a60574ae --- /dev/null +++ b/queue-4.14/mtd-fix-mtd_oobavail-incoherent-returned-value.patch @@ -0,0 +1,36 @@ +From 0d8412b211c17f6880c42bf9a1335fd99f6f1a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Nov 2018 21:18:30 +0100 +Subject: mtd: fix mtd_oobavail() incoherent returned value + +From: Miquel Raynal + +[ Upstream commit 4348433d8c0234f44adb6e12112e69343f50f0c5 ] + +mtd_oobavail() returns either mtd->oovabail or mtd->oobsize. Both +values are unsigned 32-bit entities, so there is no reason to pretend +returning a signed one. + +Signed-off-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + include/linux/mtd/mtd.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h +index 6cd0f6b7658b3..aadc2ee050f16 100644 +--- a/include/linux/mtd/mtd.h ++++ b/include/linux/mtd/mtd.h +@@ -401,7 +401,7 @@ static inline struct device_node *mtd_get_of_node(struct mtd_info *mtd) + return dev_of_node(&mtd->dev); + } + +-static inline int mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) ++static inline u32 mtd_oobavail(struct mtd_info *mtd, struct mtd_oob_ops *ops) + { + return ops->mode == MTD_OPS_AUTO_OOB ? mtd->oobavail : mtd->oobsize; + } +-- +2.20.1 + diff --git a/queue-4.14/net-aquantia-fix-rss-table-and-key-sizes.patch b/queue-4.14/net-aquantia-fix-rss-table-and-key-sizes.patch new file mode 100644 index 00000000000..2a4f493c07a --- /dev/null +++ b/queue-4.14/net-aquantia-fix-rss-table-and-key-sizes.patch @@ -0,0 +1,51 @@ +From 7e1c436e89c0f3628aeeaebd9a13e59d06f4c110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 14:00:11 +0000 +Subject: net: aquantia: fix RSS table and key sizes + +From: Dmitry Bogdanov + +[ Upstream commit 474fb1150d40780e71f0b569aeac4f375df3af3d ] + +Set RSS indirection table and RSS hash key sizes to their real size. + +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_cfg.h | 4 ++-- + drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +index 57e796870595b..ea4b7e97c61ea 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_cfg.h +@@ -40,8 +40,8 @@ + #define AQ_CFG_IS_LRO_DEF 1U + + /* RSS */ +-#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 128U +-#define AQ_CFG_RSS_HASHKEY_SIZE 320U ++#define AQ_CFG_RSS_INDIRECTION_TABLE_MAX 64U ++#define AQ_CFG_RSS_HASHKEY_SIZE 40U + + #define AQ_CFG_IS_RSS_DEF 1U + #define AQ_CFG_NUM_RSS_QUEUES_DEF AQ_CFG_VECS_DEF +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index cc658a29cc33e..a69f5f1ad32a8 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -43,7 +43,7 @@ static void aq_nic_rss_init(struct aq_nic_s *self, unsigned int num_rss_queues) + struct aq_rss_parameters *rss_params = &cfg->aq_rss; + int i = 0; + +- static u8 rss_key[40] = { ++ static u8 rss_key[AQ_CFG_RSS_HASHKEY_SIZE] = { + 0x1e, 0xad, 0x71, 0x87, 0x65, 0xfc, 0x26, 0x7d, + 0x0d, 0x45, 0x67, 0x74, 0xcd, 0x06, 0x1a, 0x18, + 0xb6, 0xc1, 0xf0, 0xc7, 0xbb, 0x18, 0xbe, 0xf8, +-- +2.20.1 + diff --git a/queue-4.14/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch b/queue-4.14/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch new file mode 100644 index 00000000000..1a74d0b4026 --- /dev/null +++ b/queue-4.14/net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch @@ -0,0 +1,64 @@ +From db0f3aad14bd988512b1df301137916cc2547cde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 18:51:01 +0100 +Subject: net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing + MII_PHYSID2 + +From: Andrew Lunn + +[ Upstream commit ddc49acb659a2d8bfc5fdb0de0ef197712c11d75 ] + +We already have a workaround for a couple of switches whose internal +PHYs only have the Marvel OUI, but no model number. We detect such +PHYs and give them the 6390 ID as the model number. However the +mv88e6161 has two SERDES interfaces in the same address range as its +internal PHYs. These suffer from the same problem, the Marvell OUI, +but no model number. As a result, these SERDES interfaces were getting +the same PHY ID as the mv88e6390, even though they are not PHYs, and +the Marvell PHY driver was trying to drive them. + +Add a special case to stop this from happen. + +Reported-by: Chris Healy +Signed-off-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index be17194487c68..10ea01459a36b 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2196,11 +2196,22 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg) + mutex_unlock(&chip->reg_lock); + + if (reg == MII_PHYSID2) { +- /* Some internal PHYS don't have a model number. Use +- * the mv88e6390 family model number instead. +- */ +- if (!(val & 0x3f0)) +- val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; ++ /* Some internal PHYs don't have a model number. */ ++ if (chip->info->family != MV88E6XXX_FAMILY_6165) ++ /* Then there is the 6165 family. It gets is ++ * PHYs correct. But it can also have two ++ * SERDES interfaces in the PHY address ++ * space. And these don't have a model ++ * number. But they are not PHYs, so we don't ++ * want to give them something a PHY driver ++ * will recognise. ++ * ++ * Use the mv88e6390 family model number ++ * instead, for anything which really could be ++ * a PHY, ++ */ ++ if (!(val & 0x3f0)) ++ val |= MV88E6XXX_PORT_SWITCH_ID_PROD_6390 >> 4; + } + + return err ? err : val; +-- +2.20.1 + diff --git a/queue-4.14/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch b/queue-4.14/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch new file mode 100644 index 00000000000..64242e7a986 --- /dev/null +++ b/queue-4.14/net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch @@ -0,0 +1,46 @@ +From b15092d04324e756c99ca97ded0125b4caa0a724 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2019 23:43:24 +0800 +Subject: net: ep93xx_eth: fix mismatch of request_mem_region in remove + +From: Chuhong Yuan + +[ Upstream commit 3df70afe8d33f4977d0e0891bdcfb639320b5257 ] + +The driver calls release_resource in remove to match request_mem_region +in probe, which is incorrect. +Fix it by using the right one, release_mem_region. + +Signed-off-by: Chuhong Yuan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cirrus/ep93xx_eth.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c +index e2a702996db41..82bd918bf967f 100644 +--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c ++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c +@@ -767,6 +767,7 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + { + struct net_device *dev; + struct ep93xx_priv *ep; ++ struct resource *mem; + + dev = platform_get_drvdata(pdev); + if (dev == NULL) +@@ -782,8 +783,8 @@ static int ep93xx_eth_remove(struct platform_device *pdev) + iounmap(ep->base_addr); + + if (ep->res != NULL) { +- release_resource(ep->res); +- kfree(ep->res); ++ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ release_mem_region(mem->start, resource_size(mem)); + } + + free_netdev(dev); +-- +2.20.1 + diff --git a/queue-4.14/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch b/queue-4.14/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch new file mode 100644 index 00000000000..9885d0bc5d7 --- /dev/null +++ b/queue-4.14/net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch @@ -0,0 +1,37 @@ +From 9b930666594c46db2c0d927349e2959d64817b5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Nov 2018 16:00:20 +0200 +Subject: net: ethernet: ti: cpts: correct debug for expired txq skb + +From: Ivan Khoronzhuk + +[ Upstream commit d0e14c4d9bcef0d4aa1057d2959adaa6f18d4a17 ] + +The msgtype and seqid that is smth that belongs to event for +comparison but not for staled txq skb. + +Signed-off-by: Ivan Khoronzhuk +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/cpts.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c +index 7d1281d812480..23c953496a0d1 100644 +--- a/drivers/net/ethernet/ti/cpts.c ++++ b/drivers/net/ethernet/ti/cpts.c +@@ -116,9 +116,7 @@ static bool cpts_match_tx_ts(struct cpts *cpts, struct cpts_event *event) + mtype, seqid); + } else if (time_after(jiffies, skb_cb->tmo)) { + /* timeout any expired skbs over 1s */ +- dev_dbg(cpts->dev, +- "expiring tx timestamp mtype %u seqid %04x\n", +- mtype, seqid); ++ dev_dbg(cpts->dev, "expiring tx timestamp from txq\n"); + __skb_unlink(skb, &cpts->txq); + dev_consume_skb_any(skb); + } +-- +2.20.1 + diff --git a/queue-4.14/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch b/queue-4.14/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch new file mode 100644 index 00000000000..1fa3318d676 --- /dev/null +++ b/queue-4.14/net-mlx4_core-fix-return-codes-of-unsupported-operat.patch @@ -0,0 +1,76 @@ +From f589fdb7f85af6d87f6557871394de7a10ea7bae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Dec 2018 17:40:25 +0200 +Subject: net/mlx4_core: Fix return codes of unsupported operations + +From: Erez Alfasi + +[ Upstream commit 95aac2cdafd8c8298c9b2589c52f44db0d824e0e ] + +Functions __set_port_type and mlx4_check_port_params returned +-EINVAL while the proper return code is -EOPNOTSUPP as a +result of an unsupported operation. All drivers should generate +this and all users should check for it when detecting an +unsupported functionality. + +Signed-off-by: Erez Alfasi +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/main.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index c273a3ebb8e8e..12d4b891301b6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -199,7 +199,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + for (i = 0; i < dev->caps.num_ports - 1; i++) { + if (port_type[i] != port_type[i + 1]) { + mlx4_err(dev, "Only same port types supported on this HCA, aborting\n"); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + } +@@ -208,7 +208,7 @@ int mlx4_check_port_params(struct mlx4_dev *dev, + if (!(port_type[i] & dev->caps.supported_type[i+1])) { + mlx4_err(dev, "Requested port type for port %d is not supported on this HCA\n", + i + 1); +- return -EINVAL; ++ return -EOPNOTSUPP; + } + } + return 0; +@@ -1152,8 +1152,7 @@ static int __set_port_type(struct mlx4_port_info *info, + mlx4_err(mdev, + "Requested port type for port %d is not supported on this HCA\n", + info->port); +- err = -EINVAL; +- goto err_sup; ++ return -EOPNOTSUPP; + } + + mlx4_stop_sense(mdev); +@@ -1175,7 +1174,7 @@ static int __set_port_type(struct mlx4_port_info *info, + for (i = 1; i <= mdev->caps.num_ports; i++) { + if (mdev->caps.possible_type[i] == MLX4_PORT_TYPE_AUTO) { + mdev->caps.possible_type[i] = mdev->caps.port_type[i]; +- err = -EINVAL; ++ err = -EOPNOTSUPP; + } + } + } +@@ -1201,7 +1200,7 @@ static int __set_port_type(struct mlx4_port_info *info, + out: + mlx4_start_sense(mdev); + mutex_unlock(&priv->port_mutex); +-err_sup: ++ + return err; + } + +-- +2.20.1 + diff --git a/queue-4.14/net-mlx5-release-resource-on-error-flow.patch b/queue-4.14/net-mlx5-release-resource-on-error-flow.patch new file mode 100644 index 00000000000..8d3ac5748c2 --- /dev/null +++ b/queue-4.14/net-mlx5-release-resource-on-error-flow.patch @@ -0,0 +1,46 @@ +From f56abf0d224c456300410f5981b05e5bf785c4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 21:10:08 +0200 +Subject: net/mlx5: Release resource on error flow + +From: Moni Shoua + +[ Upstream commit 698114968a22f6c0c9f42e983ba033cc36bb7217 ] + +Fix reference counting leakage when the event handler aborts due to an +unsupported event for the resource type. + +Fixes: a14c2d4beee5 ("net/mlx5_core: Warn on unsupported events of QP/RQ/SQ") +Signed-off-by: Moni Shoua +Reviewed-by: Majd Dibbiny +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/qp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/qp.c b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +index 889130edb7152..5f091c6ea049d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/qp.c +@@ -124,7 +124,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + if (!is_event_type_allowed((rsn >> MLX5_USER_INDEX_LEN), event_type)) { + mlx5_core_warn(dev, "event 0x%.2x is not allowed on resource 0x%.8x\n", + event_type, rsn); +- return; ++ goto out; + } + + switch (common->res) { +@@ -138,7 +138,7 @@ void mlx5_rsc_event(struct mlx5_core_dev *dev, u32 rsn, int event_type) + default: + mlx5_core_warn(dev, "invalid resource type for 0x%x\n", rsn); + } +- ++out: + mlx5_core_put_rsc(common); + } + +-- +2.20.1 + diff --git a/queue-4.14/net-next-hinic-fix-a-bug-in-set-mac-address.patch b/queue-4.14/net-next-hinic-fix-a-bug-in-set-mac-address.patch new file mode 100644 index 00000000000..30305f9fc83 --- /dev/null +++ b/queue-4.14/net-next-hinic-fix-a-bug-in-set-mac-address.patch @@ -0,0 +1,55 @@ +From fdf52fb1830f177e7ace868e8183619527bc9a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 05:47:33 +0000 +Subject: net-next/hinic:fix a bug in set mac address + +From: Xue Chaojing + +[ Upstream commit 9ea72dc9430306b77c73a8a21beb51437cde1d6d ] + +In add_mac_addr(), if the MAC address is a muliticast address, +it will not be set, which causes the network card fail to receive +the multicast packet. This patch fixes this bug. + +Signed-off-by: Xue Chaojing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/huawei/hinic/hinic_main.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c +index a696b5b2d40e6..44c73215d0264 100644 +--- a/drivers/net/ethernet/huawei/hinic/hinic_main.c ++++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c +@@ -598,9 +598,6 @@ static int add_mac_addr(struct net_device *netdev, const u8 *addr) + u16 vid = 0; + int err; + +- if (!is_valid_ether_addr(addr)) +- return -EADDRNOTAVAIL; +- + netif_info(nic_dev, drv, netdev, "set mac addr = %02x %02x %02x %02x %02x %02x\n", + addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); + +@@ -724,6 +721,7 @@ static void set_rx_mode(struct work_struct *work) + { + struct hinic_rx_mode_work *rx_mode_work = work_to_rx_mode_work(work); + struct hinic_dev *nic_dev = rx_mode_work_to_nic_dev(rx_mode_work); ++ struct netdev_hw_addr *ha; + + netif_info(nic_dev, drv, nic_dev->netdev, "set rx mode work\n"); + +@@ -731,6 +729,9 @@ static void set_rx_mode(struct work_struct *work) + + __dev_uc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); + __dev_mc_sync(nic_dev->netdev, add_mac_addr, remove_mac_addr); ++ ++ netdev_for_each_mc_addr(ha, nic_dev->netdev) ++ add_mac_addr(nic_dev->netdev, ha->addr); + } + + static void hinic_set_rx_mode(struct net_device *netdev) +-- +2.20.1 + diff --git a/queue-4.14/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch b/queue-4.14/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch new file mode 100644 index 00000000000..9ca04d97ea8 --- /dev/null +++ b/queue-4.14/net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch @@ -0,0 +1,44 @@ +From 344b6d63772563548b424504cc346aa2c3c20a5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Nov 2018 16:46:43 +0100 +Subject: net/smc: use after free fix in smc_wr_tx_put_slot() + +From: Ursula Braun + +[ Upstream commit e438bae43c1e08e688c09c410407b59fc1c173b4 ] + +In smc_wr_tx_put_slot() field pend->idx is used after being +cleared. That means always idx 0 is cleared in the wr_tx_mask. +This results in a broken administration of available WR send +payload buffers. + +Signed-off-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_wr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_wr.c b/net/smc/smc_wr.c +index de4537f66832a..ed6736a1a112e 100644 +--- a/net/smc/smc_wr.c ++++ b/net/smc/smc_wr.c +@@ -223,12 +223,14 @@ int smc_wr_tx_put_slot(struct smc_link *link, + + pend = container_of(wr_pend_priv, struct smc_wr_tx_pend, priv); + if (pend->idx < link->wr_tx_cnt) { ++ u32 idx = pend->idx; ++ + /* clear the full struct smc_wr_tx_pend including .priv */ + memset(&link->wr_tx_pends[pend->idx], 0, + sizeof(link->wr_tx_pends[pend->idx])); + memset(&link->wr_tx_bufs[pend->idx], 0, + sizeof(link->wr_tx_bufs[pend->idx])); +- test_and_clear_bit(pend->idx, link->wr_tx_mask); ++ test_and_clear_bit(idx, link->wr_tx_mask); + return 1; + } + +-- +2.20.1 + diff --git a/queue-4.14/net-x25-fix-called-calling-length-calculation-in-x25.patch b/queue-4.14/net-x25-fix-called-calling-length-calculation-in-x25.patch new file mode 100644 index 00000000000..ddb6aa31474 --- /dev/null +++ b/queue-4.14/net-x25-fix-called-calling-length-calculation-in-x25.patch @@ -0,0 +1,36 @@ +From e01581de9fff417a1258d64be4ef2ae62feebca6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 09:50:27 +0100 +Subject: net/x25: fix called/calling length calculation in + x25_parse_address_block + +From: Martin Schiller + +[ Upstream commit d449ba3d581ed29f751a59792fdc775572c66904 ] + +The length of the called and calling address was not calculated +correctly (BCD encoding). + +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 1b830a6ee3ff6..6e7ad4c6f83c8 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -100,7 +100,7 @@ int x25_parse_address_block(struct sk_buff *skb, + } + + len = *skb->data; +- needed = 1 + (len >> 4) + (len & 0x0f); ++ needed = 1 + ((len >> 4) + (len & 0x0f) + 1) / 2; + + if (!pskb_may_pull(skb, needed)) { + /* packet is too short to hold the addresses it claims +-- +2.20.1 + diff --git a/queue-4.14/net-x25-fix-null_x25_address-handling.patch b/queue-4.14/net-x25-fix-null_x25_address-handling.patch new file mode 100644 index 00000000000..ecce1014cd8 --- /dev/null +++ b/queue-4.14/net-x25-fix-null_x25_address-handling.patch @@ -0,0 +1,59 @@ +From c8dc3744001a42336eb210ee7fc8900576e6ed20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Nov 2018 09:50:28 +0100 +Subject: net/x25: fix null_x25_address handling + +From: Martin Schiller + +[ Upstream commit 06137619f061f498c2924f6543fa45b7d39f0501 ] + +o x25_find_listener(): the compare for the null_x25_address was wrong. + We have to check the x25_addr of the listener socket instead of the + x25_addr of the incomming call. + + o x25_bind(): it was not possible to bind a socket to null_x25_address + +Signed-off-by: Martin Schiller +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 6e7ad4c6f83c8..a156b6dc3a724 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -288,7 +288,7 @@ static struct sock *x25_find_listener(struct x25_address *addr, + sk_for_each(s, &x25_list) + if ((!strcmp(addr->x25_addr, + x25_sk(s)->source_addr.x25_addr) || +- !strcmp(addr->x25_addr, ++ !strcmp(x25_sk(s)->source_addr.x25_addr, + null_x25_address.x25_addr)) && + s->sk_state == TCP_LISTEN) { + /* +@@ -684,11 +684,15 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + +- len = strlen(addr->sx25_addr.x25_addr); +- for (i = 0; i < len; i++) { +- if (!isdigit(addr->sx25_addr.x25_addr[i])) { +- rc = -EINVAL; +- goto out; ++ /* check for the null_x25_address */ ++ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { ++ ++ len = strlen(addr->sx25_addr.x25_addr); ++ for (i = 0; i < len; i++) { ++ if (!isdigit(addr->sx25_addr.x25_addr[i])) { ++ rc = -EINVAL; ++ goto out; ++ } + } + } + +-- +2.20.1 + diff --git a/queue-4.14/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch b/queue-4.14/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch new file mode 100644 index 00000000000..7fbc2d28bec --- /dev/null +++ b/queue-4.14/nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch @@ -0,0 +1,73 @@ +From 48129fc9640434ce543627a52d6c13609b8c2905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Nov 2019 17:19:15 +0100 +Subject: NFC: nxp-nci: Fix NULL pointer dereference after I2C communication + error + +From: Stephan Gerhold + +[ Upstream commit a71a29f50de1ef97ab55c151a1598eb12dde379d ] + +I2C communication errors (-EREMOTEIO) during the IRQ handler of nxp-nci +result in a NULL pointer dereference at the moment: + + BUG: kernel NULL pointer dereference, address: 0000000000000000 + Oops: 0002 [#1] PREEMPT SMP NOPTI + CPU: 1 PID: 355 Comm: irq/137-nxp-nci Not tainted 5.4.0-rc6 #1 + RIP: 0010:skb_queue_tail+0x25/0x50 + Call Trace: + nci_recv_frame+0x36/0x90 [nci] + nxp_nci_i2c_irq_thread_fn+0xd1/0x285 [nxp_nci_i2c] + ? preempt_count_add+0x68/0xa0 + ? irq_forced_thread_fn+0x80/0x80 + irq_thread_fn+0x20/0x60 + irq_thread+0xee/0x180 + ? wake_threads_waitq+0x30/0x30 + kthread+0xfb/0x130 + ? irq_thread_check_affinity+0xd0/0xd0 + ? kthread_park+0x90/0x90 + ret_from_fork+0x1f/0x40 + +Afterward the kernel must be rebooted to work properly again. + +This happens because it attempts to call nci_recv_frame() with skb == NULL. +However, unlike nxp_nci_fw_recv_frame(), nci_recv_frame() does not have any +NULL checks for skb, causing the NULL pointer dereference. + +Change the code to call only nxp_nci_fw_recv_frame() in case of an error. +Make sure to log it so it is obvious that a communication error occurred. +The error above then becomes: + + nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 + nci: __nci_request: wait_for_completion_interruptible_timeout failed 0 + nxp-nci_i2c i2c-NXP1001:00: NFC: Read failed with error -121 + +Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") +Signed-off-by: Stephan Gerhold +Reviewed-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/nfc/nxp-nci/i2c.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nfc/nxp-nci/i2c.c b/drivers/nfc/nxp-nci/i2c.c +index 198585bbc7711..d9492cffd00e5 100644 +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -236,8 +236,10 @@ static irqreturn_t nxp_nci_i2c_irq_thread_fn(int irq, void *phy_id) + + if (r == -EREMOTEIO) { + phy->hard_fault = r; +- skb = NULL; +- } else if (r < 0) { ++ if (info->mode == NXP_NCI_MODE_FW) ++ nxp_nci_fw_recv_frame(phy->ndev, NULL); ++ } ++ if (r < 0) { + nfc_err(&client->dev, "Read failed with error %d\n", r); + goto exit_irq_handled; + } +-- +2.20.1 + diff --git a/queue-4.14/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch b/queue-4.14/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch new file mode 100644 index 00000000000..e8099aad9c8 --- /dev/null +++ b/queue-4.14/nfsd-fix-a-warning-in-__cld_pipe_upcall.patch @@ -0,0 +1,89 @@ +From 32e984b23899baeaa8b8690b4b9f492e0e2a38e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Nov 2018 13:35:08 -0500 +Subject: nfsd: fix a warning in __cld_pipe_upcall() + +From: Scott Mayhew + +[ Upstream commit b493fd31c0b89d9453917e977002de58bebc3802 ] + +__cld_pipe_upcall() emits a "do not call blocking ops when +!TASK_RUNNING" warning due to the dput() call in rpc_queue_upcall(). +Fix it by using a completion instead of hand coding the wait. + +Signed-off-by: Scott Mayhew +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4recover.c | 17 ++++++----------- + 1 file changed, 6 insertions(+), 11 deletions(-) + +diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c +index 66eaeb1e8c2ce..dc9586feab317 100644 +--- a/fs/nfsd/nfs4recover.c ++++ b/fs/nfsd/nfs4recover.c +@@ -661,7 +661,7 @@ struct cld_net { + struct cld_upcall { + struct list_head cu_list; + struct cld_net *cu_net; +- struct task_struct *cu_task; ++ struct completion cu_done; + struct cld_msg cu_msg; + }; + +@@ -670,23 +670,18 @@ __cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg) + { + int ret; + struct rpc_pipe_msg msg; ++ struct cld_upcall *cup = container_of(cmsg, struct cld_upcall, cu_msg); + + memset(&msg, 0, sizeof(msg)); + msg.data = cmsg; + msg.len = sizeof(*cmsg); + +- /* +- * Set task state before we queue the upcall. That prevents +- * wake_up_process in the downcall from racing with schedule. +- */ +- set_current_state(TASK_UNINTERRUPTIBLE); + ret = rpc_queue_upcall(pipe, &msg); + if (ret < 0) { +- set_current_state(TASK_RUNNING); + goto out; + } + +- schedule(); ++ wait_for_completion(&cup->cu_done); + + if (msg.errno < 0) + ret = msg.errno; +@@ -753,7 +748,7 @@ cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen) + if (copy_from_user(&cup->cu_msg, src, mlen) != 0) + return -EFAULT; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + return mlen; + } + +@@ -768,7 +763,7 @@ cld_pipe_destroy_msg(struct rpc_pipe_msg *msg) + if (msg->errno >= 0) + return; + +- wake_up_process(cup->cu_task); ++ complete(&cup->cu_done); + } + + static const struct rpc_pipe_ops cld_upcall_ops = { +@@ -899,7 +894,7 @@ restart_search: + goto restart_search; + } + } +- new->cu_task = current; ++ init_completion(&new->cu_done); + new->cu_msg.cm_vers = CLD_UPCALL_VERSION; + put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid); + new->cu_net = cn; +-- +2.20.1 + diff --git a/queue-4.14/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch b/queue-4.14/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch new file mode 100644 index 00000000000..6187ae44bb2 --- /dev/null +++ b/queue-4.14/nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch @@ -0,0 +1,57 @@ +From cd1f45a098260c4038b22913c9f3d5d948b770d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Nov 2018 16:04:25 +0800 +Subject: nfsd: Return EPERM, not EACCES, in some SETATTR cases + +From: zhengbin + +[ Upstream commit 255fbca65137e25b12bced18ec9a014dc77ecda0 ] + +As the man(2) page for utime/utimes states, EPERM is returned when the +second parameter of utime or utimes is not NULL, the caller's effective UID +does not match the owner of the file, and the caller is not privileged. + +However, in a NFS directory mounted from knfsd, it will return EACCES +(from nfsd_setattr-> fh_verify->nfsd_permission). This patch fixes +that. + +Signed-off-by: zhengbin +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/vfs.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index f55527ef21e84..06d1f2edf2ec6 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -396,10 +396,23 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + bool get_write_count; + bool size_change = (iap->ia_valid & ATTR_SIZE); + +- if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) ++ if (iap->ia_valid & ATTR_SIZE) { + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +- if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; ++ } ++ ++ /* ++ * If utimes(2) and friends are called with times not NULL, we should ++ * not set NFSD_MAY_WRITE bit. Otherwise fh_verify->nfsd_permission ++ * will return EACCESS, when the caller's effective UID does not match ++ * the owner of the file, and the caller is not privileged. In this ++ * situation, we should return EPERM(notify_change will return this). ++ */ ++ if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME)) { ++ accmode |= NFSD_MAY_OWNER_OVERRIDE; ++ if (!(iap->ia_valid & (ATTR_ATIME_SET | ATTR_MTIME_SET))) ++ accmode |= NFSD_MAY_WRITE; ++ } + + /* Callers that do fh_verify should do the fh_want_write: */ + get_write_count = !fhp->fh_dentry; +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch b/queue-4.14/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch new file mode 100644 index 00000000000..f12263ce377 --- /dev/null +++ b/queue-4.14/pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch @@ -0,0 +1,69 @@ +From 69a836ffeb23342e0dbbe2c85d3de79afeaaee59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Nov 2018 20:34:11 -0500 +Subject: pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues + +From: Brian Masney + +[ Upstream commit 7ed07855773814337b9814f1c3e866df52ebce68 ] + +When attempting to setup up a gpio hog, device probing will repeatedly +fail with -EPROBE_DEFERED errors. It is caused by a circular dependency +between the gpio and pinctrl frameworks. If the gpio-ranges property is +present in device tree, then the gpio framework will handle the gpio pin +registration and eliminate the circular dependency. + +See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix +gpio-hog related boot issues") for a detailed commit message that +explains the issue in much more detail. The code comment in this commit +came from Christian's commit. + +I did not test this change against any hardware supported by this +particular driver, however I was able to validate this same fix works +for pinctrl-spmi-gpio.c using a LG Nexus 5 (hammerhead) phone. + +Signed-off-by: Brian Masney +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c | 23 +++++++++++++++++------ + 1 file changed, 17 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +index 0e153bae322ee..6bed433e54205 100644 +--- a/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-ssbi-gpio.c +@@ -762,12 +762,23 @@ static int pm8xxx_gpio_probe(struct platform_device *pdev) + return ret; + } + +- ret = gpiochip_add_pin_range(&pctrl->chip, +- dev_name(pctrl->dev), +- 0, 0, pctrl->chip.ngpio); +- if (ret) { +- dev_err(pctrl->dev, "failed to add pin range\n"); +- goto unregister_gpiochip; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), ++ 0, 0, pctrl->chip.ngpio); ++ if (ret) { ++ dev_err(pctrl->dev, "failed to add pin range\n"); ++ goto unregister_gpiochip; ++ } + } + + platform_set_drvdata(pdev, pctrl); +-- +2.20.1 + diff --git a/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch b/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch new file mode 100644 index 00000000000..0ccb2c09c25 --- /dev/null +++ b/queue-4.14/pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch @@ -0,0 +1,46 @@ +From 10a7167c6301ea85fe0f61672ada0a42fc829da0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 17:07:25 +0100 +Subject: pinctrl: sh-pfc: r8a7792: Fix VIN versioned groups + +From: Jacopo Mondi + +[ Upstream commit 11c8f8df85e77329d5a3cacc08682722cb80b95b ] + +Versioned VIN groups can appear on different sets of pins. Using the +VIN_DATA_PIN_GROUP macro now supports proper naming of said groups +through an optional 'version' argument. + +Use the 'version' argument for said macro to fix naming of versioned +groups for the R-Car V2H R8A7792 SoC. + +Fixes: 7dd74bb1f058 ("pinctrl: sh-pfc: r8a7792: Add VIN pin groups") +Signed-off-by: Jacopo Mondi +Reviewed-by: Simon Horman +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/sh-pfc/pfc-r8a7792.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +index cc3597f66605a..b3814ca009b02 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7792.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7792.c +@@ -1747,10 +1747,10 @@ static const struct sh_pfc_pin_group pinmux_groups[] = { + VIN_DATA_PIN_GROUP(vin1_data, 12), + VIN_DATA_PIN_GROUP(vin1_data, 10), + VIN_DATA_PIN_GROUP(vin1_data, 8), +- VIN_DATA_PIN_GROUP(vin1_data_b, 24), +- VIN_DATA_PIN_GROUP(vin1_data_b, 20), ++ VIN_DATA_PIN_GROUP(vin1_data, 24, _b), ++ VIN_DATA_PIN_GROUP(vin1_data, 20, _b), + SH_PFC_PIN_GROUP(vin1_data18_b), +- VIN_DATA_PIN_GROUP(vin1_data_b, 16), ++ VIN_DATA_PIN_GROUP(vin1_data, 16, _b), + SH_PFC_PIN_GROUP(vin1_sync), + SH_PFC_PIN_GROUP(vin1_field), + SH_PFC_PIN_GROUP(vin1_clkenb), +-- +2.20.1 + diff --git a/queue-4.14/powerpc-math-emu-update-macros-from-gcc.patch b/queue-4.14/powerpc-math-emu-update-macros-from-gcc.patch new file mode 100644 index 00000000000..b88e97e9e8e --- /dev/null +++ b/queue-4.14/powerpc-math-emu-update-macros-from-gcc.patch @@ -0,0 +1,191 @@ +From f160e4648b01a56cd9a3dee1d9c2850256be5746 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Dec 2018 09:37:46 +1030 +Subject: powerpc/math-emu: Update macros from GCC + +From: Joel Stanley + +[ Upstream commit b682c8692442711684befe413cf93cf01c5324ea ] + +The add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros originate +from GCC's longlong.h which in turn was copied from GMP's longlong.h a +few decades ago. + +This was found when compiling with clang: + + arch/powerpc/math-emu/fnmsub.c:46:2: error: invalid use of a cast in a + inline asm context requiring an l-value: remove the cast or build with + -fheinous-gnu-extensions + FP_ADD_D(R, T, B); + ^~~~~~~~~~~~~~~~~ + ... + + ./arch/powerpc/include/asm/sfp-machine.h:283:27: note: expanded from + macro 'sub_ddmmss' + : "=r" ((USItype)(sh)), \ + ~~~~~~~~~~^~~ + +Segher points out: this was fixed in GCC over 16 years ago +( https://gcc.gnu.org/r56600 ), and in GMP (where it comes from) +presumably before that. + +Update the add_ssaaaa, sub_ddmmss, umul_ppmm and udiv_qrnnd macros to +the latest GCC version in order to git rid of the invalid casts. These +were taken as-is from GCC's longlong in order to make future syncs +obvious. Other parts of sfp-machine.h were left as-is as the file +contains more features than present in longlong.h. + +Link: https://github.com/ClangBuiltLinux/linux/issues/260 +Signed-off-by: Joel Stanley +Reviewed-by: Nick Desaulniers +Reviewed-by: Segher Boessenkool +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/sfp-machine.h | 92 ++++++++------------------ + 1 file changed, 29 insertions(+), 63 deletions(-) + +diff --git a/arch/powerpc/include/asm/sfp-machine.h b/arch/powerpc/include/asm/sfp-machine.h +index d89beaba26ff9..8b957aabb826d 100644 +--- a/arch/powerpc/include/asm/sfp-machine.h ++++ b/arch/powerpc/include/asm/sfp-machine.h +@@ -213,30 +213,18 @@ + * respectively. The result is placed in HIGH_SUM and LOW_SUM. Overflow + * (i.e. carry out) is not stored anywhere, and is lost. + */ +-#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ ++#define add_ssaaaa(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{a%I4|add%I4c} %1,%3,%4\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("add%I4c %1,%3,%4\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "%r" (al), "rI" (bl));\ + else \ +- __asm__ ("{a%I5|add%I5c} %1,%4,%5\n\t{ae|adde} %0,%2,%3" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "%r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "%r" ((USItype)(al)), \ +- "rI" ((USItype)(bl))); \ ++ __asm__ ("add%I5c %1,%4,%5\n\tadde %0,%2,%3" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "%r" (ah), "r" (bh), "%r" (al), "rI" (bl)); \ + } while (0) + + /* sub_ddmmss is used in op-2.h and udivmodti4.c and should be equivalent to +@@ -248,44 +236,24 @@ + * and LOW_DIFFERENCE. Overflow (i.e. carry out) is not stored anywhere, + * and is lost. + */ +-#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ ++#define sub_ddmmss(sh, sl, ah, al, bh, bl) \ + do { \ + if (__builtin_constant_p (ah) && (ah) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfze|subfze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (ah) && (ah) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{sfme|subfme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (ah) && (ah) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\tsubfme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (bh), "rI" (al), "r" (bl));\ + else if (__builtin_constant_p (bh) && (bh) == 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{ame|addme} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ +- else if (__builtin_constant_p (bh) && (bh) ==~(USItype) 0) \ +- __asm__ ("{sf%I3|subf%I3c} %1,%4,%3\n\t{aze|addze} %0,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddme %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ ++ else if (__builtin_constant_p (bh) && (bh) == ~(USItype) 0) \ ++ __asm__ ("subf%I3c %1,%4,%3\n\taddze %0,%2" \ ++ : "=r" (sh), "=&r" (sl) : "r" (ah), "rI" (al), "r" (bl));\ + else \ +- __asm__ ("{sf%I4|subf%I4c} %1,%5,%4\n\t{sfe|subfe} %0,%3,%2" \ +- : "=r" ((USItype)(sh)), \ +- "=&r" ((USItype)(sl)) \ +- : "r" ((USItype)(ah)), \ +- "r" ((USItype)(bh)), \ +- "rI" ((USItype)(al)), \ +- "r" ((USItype)(bl))); \ ++ __asm__ ("subf%I4c %1,%5,%4\n\tsubfe %0,%3,%2" \ ++ : "=r" (sh), "=&r" (sl) \ ++ : "r" (ah), "r" (bh), "rI" (al), "r" (bl)); \ + } while (0) + + /* asm fragments for mul and div */ +@@ -294,13 +262,10 @@ + * UWtype integers MULTIPLER and MULTIPLICAND, and generates a two UWtype + * word product in HIGH_PROD and LOW_PROD. + */ +-#define umul_ppmm(ph, pl, m0, m1) \ ++#define umul_ppmm(ph, pl, m0, m1) \ + do { \ + USItype __m0 = (m0), __m1 = (m1); \ +- __asm__ ("mulhwu %0,%1,%2" \ +- : "=r" ((USItype)(ph)) \ +- : "%r" (__m0), \ +- "r" (__m1)); \ ++ __asm__ ("mulhwu %0,%1,%2" : "=r" (ph) : "%r" (m0), "r" (m1)); \ + (pl) = __m0 * __m1; \ + } while (0) + +@@ -312,9 +277,10 @@ + * significant bit of DENOMINATOR must be 1, then the pre-processor symbol + * UDIV_NEEDS_NORMALIZATION is defined to 1. + */ +-#define udiv_qrnnd(q, r, n1, n0, d) \ ++#define udiv_qrnnd(q, r, n1, n0, d) \ + do { \ +- UWtype __d1, __d0, __q1, __q0, __r1, __r0, __m; \ ++ UWtype __d1, __d0, __q1, __q0; \ ++ UWtype __r1, __r0, __m; \ + __d1 = __ll_highpart (d); \ + __d0 = __ll_lowpart (d); \ + \ +@@ -325,7 +291,7 @@ + if (__r1 < __m) \ + { \ + __q1--, __r1 += (d); \ +- if (__r1 >= (d)) /* we didn't get carry when adding to __r1 */ \ ++ if (__r1 >= (d)) /* i.e. we didn't get carry when adding to __r1 */\ + if (__r1 < __m) \ + __q1--, __r1 += (d); \ + } \ +-- +2.20.1 + diff --git a/queue-4.14/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch b/queue-4.14/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch new file mode 100644 index 00000000000..5d0624e12bd --- /dev/null +++ b/queue-4.14/pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch @@ -0,0 +1,50 @@ +From a419a84083ce8ad7309bd1a8f0b3dcb7c501e739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Dec 2018 16:39:01 -0800 +Subject: pstore/ram: Avoid NULL deref in ftrace merging failure path + +From: Kees Cook + +[ Upstream commit 8665569e97dd52920713b95675409648986b5b0d ] + +Given corruption in the ftrace records, it might be possible to allocate +tmp_prz without assigning prz to it, but still marking it as needing to +be freed, which would cause at least a NULL dereference. + +smatch warnings: +fs/pstore/ram.c:340 ramoops_pstore_read() error: we previously assumed 'prz' could be null (see line 255) + +https://lists.01.org/pipermail/kbuild-all/2018-December/055528.html + +Reported-by: Dan Carpenter +Fixes: 2fbea82bbb89 ("pstore: Merge per-CPU ftrace records into one") +Cc: "Joel Fernandes (Google)" +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + fs/pstore/ram.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c +index 40bfc6c583749..1e675be10926d 100644 +--- a/fs/pstore/ram.c ++++ b/fs/pstore/ram.c +@@ -297,6 +297,7 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + GFP_KERNEL); + if (!tmp_prz) + return -ENOMEM; ++ prz = tmp_prz; + free_prz = true; + + while (cxt->ftrace_read_cnt < cxt->max_ftrace_cnt) { +@@ -319,7 +320,6 @@ static ssize_t ramoops_pstore_read(struct pstore_record *record) + goto out; + } + record->id = 0; +- prz = tmp_prz; + } + } + +-- +2.20.1 + diff --git a/queue-4.14/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch b/queue-4.14/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch new file mode 100644 index 00000000000..c37d52528e7 --- /dev/null +++ b/queue-4.14/rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch @@ -0,0 +1,39 @@ +From 0996fab836ae7ed472a1d40d2cf16176aa45713c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 10:33:29 +0800 +Subject: RDMA/hns: Correct the value of HNS_ROCE_HEM_CHUNK_LEN + +From: Sirong Wang + +[ Upstream commit 531eb45b3da4267fc2a64233ba256c8ffb02edd2 ] + +Size of pointer to buf field of struct hns_roce_hem_chunk should be +considered when calculating HNS_ROCE_HEM_CHUNK_LEN, or sg table size will +be larger than expected when allocating hem. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/1572575610-52530-2-git-send-email-liweihang@hisilicon.com +Signed-off-by: Sirong Wang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.h b/drivers/infiniband/hw/hns/hns_roce_hem.h +index 435748858252d..8e8917ebb013b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.h +@@ -52,7 +52,7 @@ enum { + + #define HNS_ROCE_HEM_CHUNK_LEN \ + ((256 - sizeof(struct list_head) - 2 * sizeof(int)) / \ +- (sizeof(struct scatterlist))) ++ (sizeof(struct scatterlist) + sizeof(void *))) + + enum { + HNS_ROCE_HEM_PAGE_SHIFT = 12, +-- +2.20.1 + diff --git a/queue-4.14/regulator-fix-return-value-of-_set_load-stub.patch b/queue-4.14/regulator-fix-return-value-of-_set_load-stub.patch new file mode 100644 index 00000000000..1e1deed9a9a --- /dev/null +++ b/queue-4.14/regulator-fix-return-value-of-_set_load-stub.patch @@ -0,0 +1,39 @@ +From 240cffb8becbf639d8095c3dc469525685d54c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Nov 2018 19:19:30 -0800 +Subject: regulator: Fix return value of _set_load() stub + +From: Mark Brown + +[ Upstream commit f1abf67217de91f5cd3c757ae857632ca565099a ] + +The stub implementation of _set_load() returns a mode value which is +within the bounds of valid return codes for success (the documentation +just says that failures are negative error codes) but not sensible or +what the actual implementation does. Fix it to just return 0. + +Reported-by: Cheng-Yi Chiang +Signed-off-by: Mark Brown +Reviewed-by: Douglas Anderson +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/linux/regulator/consumer.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h +index 25602afd48447..f3f76051e8b00 100644 +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -508,7 +508,7 @@ static inline int regulator_get_error_flags(struct regulator *regulator, + + static inline int regulator_set_load(struct regulator *regulator, int load_uA) + { +- return REGULATOR_MODE_NORMAL; ++ return 0; + } + + static inline int regulator_allow_bypass(struct regulator *regulator, +-- +2.20.1 + diff --git a/queue-4.14/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch b/queue-4.14/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch new file mode 100644 index 00000000000..79cb134d775 --- /dev/null +++ b/queue-4.14/rsxx-add-missed-destroy_workqueue-calls-in-remove.patch @@ -0,0 +1,38 @@ +From b5e0573ce51b0ca69e1596c4028a8b6a74aac40e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 14:38:47 +0800 +Subject: rsxx: add missed destroy_workqueue calls in remove + +From: Chuhong Yuan + +[ Upstream commit dcb77e4b274b8f13ac6482dfb09160cd2fae9a40 ] + +The driver misses calling destroy_workqueue in remove like what is done +when probe fails. +Add the missed calls to fix it. + +Signed-off-by: Chuhong Yuan +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/rsxx/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c +index 34997df132e24..6beafaa335c71 100644 +--- a/drivers/block/rsxx/core.c ++++ b/drivers/block/rsxx/core.c +@@ -1025,8 +1025,10 @@ static void rsxx_pci_remove(struct pci_dev *dev) + + cancel_work_sync(&card->event_work); + ++ destroy_workqueue(card->event_wq); + rsxx_destroy_dev(card); + rsxx_dma_destroy(card); ++ destroy_workqueue(card->creg_ctrl.creg_wq); + + spin_lock_irqsave(&card->irq_lock, flags); + rsxx_disable_ier_and_isr(card, CR_INTR_ALL); +-- +2.20.1 + diff --git a/queue-4.14/rtc-dt-binding-abx80x-fix-resistance-scale.patch b/queue-4.14/rtc-dt-binding-abx80x-fix-resistance-scale.patch new file mode 100644 index 00000000000..946c5dc152a --- /dev/null +++ b/queue-4.14/rtc-dt-binding-abx80x-fix-resistance-scale.patch @@ -0,0 +1,31 @@ +From 3500a1a7e3f34def361a4722e39466e03f598c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Nov 2018 14:34:02 +0200 +Subject: rtc: dt-binding: abx80x: fix resistance scale + +From: Baruch Siach + +[ Upstream commit 73852e56827f5cb5db9d6e8dd8191fc2f2e8f424 ] + +The abracon,tc-resistor property value is in kOhm. + +Signed-off-by: Baruch Siach +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + Documentation/devicetree/bindings/rtc/abracon,abx80x.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +index be789685a1c24..18b892d010d87 100644 +--- a/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt ++++ b/Documentation/devicetree/bindings/rtc/abracon,abx80x.txt +@@ -27,4 +27,4 @@ and valid to enable charging: + + - "abracon,tc-diode": should be "standard" (0.6V) or "schottky" (0.3V) + - "abracon,tc-resistor": should be <0>, <3>, <6> or <11>. 0 disables the output +- resistor, the other values are in ohm. ++ resistor, the other values are in kOhm. +-- +2.20.1 + diff --git a/queue-4.14/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch b/queue-4.14/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch new file mode 100644 index 00000000000..99b63f48da7 --- /dev/null +++ b/queue-4.14/rtc-max8997-fix-the-returned-value-in-case-of-error-.patch @@ -0,0 +1,37 @@ +From 9b86a00b0a7dc56b386e0396e145281c1c726a29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:19:51 +0100 +Subject: rtc: max8997: Fix the returned value in case of error in + 'max8997_rtc_read_alarm()' + +From: Christophe JAILLET + +[ Upstream commit 41ef3878203cd9218d92eaa07df4b85a2cb128fb ] + +In case of error, we return 0. +This is spurious and not consistent with the other functions of the driver. +Propagate the error code instead. + +Signed-off-by: Christophe JAILLET +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-max8997.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-max8997.c b/drivers/rtc/rtc-max8997.c +index db984d4bf9526..4cce5bd448f65 100644 +--- a/drivers/rtc/rtc-max8997.c ++++ b/drivers/rtc/rtc-max8997.c +@@ -221,7 +221,7 @@ static int max8997_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + + out: + mutex_unlock(&info->lock); +- return 0; ++ return ret; + } + + static int max8997_rtc_stop_alarm(struct max8997_rtc_info *info) +-- +2.20.1 + diff --git a/queue-4.14/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch b/queue-4.14/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch new file mode 100644 index 00000000000..9312189eaab --- /dev/null +++ b/queue-4.14/rtc-s3c-rtc-avoid-using-broken-almyear-register.patch @@ -0,0 +1,60 @@ +From 7a87f02b2067017c158c0c578cada0368321e971 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Nov 2018 12:32:50 +0100 +Subject: rtc: s3c-rtc: Avoid using broken ALMYEAR register + +From: Marek Szyprowski + +[ Upstream commit 50c8aec4212a966817e868056efc9bfbb73337c0 ] + +(RTC,ALM)YEAR registers of Exynos built-in RTC device contains 3 BCD +characters. s3c-rtc driver uses only 2 lower of them and supports years +from 2000..2099 range. The third BCD value is typically set to 0, but it +looks that handling of it is broken in the hardware. It sometimes +defaults to a random (even non-BCD) value. This is not an issue +for handling RTCYEAR register, because bcd2bin() properly handles only +8bit values (2 BCD characters, the third one is skipped). The problem +is however with ALMYEAR register and proper RTC alarm operation. When +YEAREN bit is set for the configured alarm, RTC hardware triggers alarm +only when ALMYEAR and RTCYEAR matches. This usually doesn't happen +because of the random noise on the third BCD character. + +Fix this by simply skipping setting ALMYEAR register in alarm +configuration. This workaround fixes broken alarm operation on Exynos +built-in rtc device. My tests revealed that the issue happens on the +following Exynos series: 3250, 4210, 4412, 5250 and 5410. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-s3c.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c +index a8992c227f611..4120a305954af 100644 +--- a/drivers/rtc/rtc-s3c.c ++++ b/drivers/rtc/rtc-s3c.c +@@ -327,7 +327,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + struct rtc_time *tm = &alrm->time; + unsigned int alrm_en; + int ret; +- int year = tm->tm_year - 100; + + dev_dbg(dev, "s3c_rtc_setalarm: %d, %04d.%02d.%02d %02d:%02d:%02d\n", + alrm->enabled, +@@ -356,11 +355,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm) + writeb(bin2bcd(tm->tm_hour), info->base + S3C2410_ALMHOUR); + } + +- if (year < 100 && year >= 0) { +- alrm_en |= S3C2410_RTCALM_YEAREN; +- writeb(bin2bcd(year), info->base + S3C2410_ALMYEAR); +- } +- + if (tm->tm_mon < 12 && tm->tm_mon >= 0) { + alrm_en |= S3C2410_RTCALM_MONEN; + writeb(bin2bcd(tm->tm_mon + 1), info->base + S3C2410_ALMMON); +-- +2.20.1 + diff --git a/queue-4.14/sched-core-avoid-spurious-lock-dependencies.patch b/queue-4.14/sched-core-avoid-spurious-lock-dependencies.patch new file mode 100644 index 00000000000..25b5d628666 --- /dev/null +++ b/queue-4.14/sched-core-avoid-spurious-lock-dependencies.patch @@ -0,0 +1,67 @@ +From 8a20a0319c6b00a4d949594b0929f3879cb7d54a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Oct 2019 11:18:37 +0200 +Subject: sched/core: Avoid spurious lock dependencies + +From: Peter Zijlstra + +[ Upstream commit ff51ff84d82aea5a889b85f2b9fb3aa2b8691668 ] + +While seemingly harmless, __sched_fork() does hrtimer_init(), which, +when DEBUG_OBJETS, can end up doing allocations. + +This then results in the following lock order: + + rq->lock + zone->lock.rlock + batched_entropy_u64.lock + +Which in turn causes deadlocks when we do wakeups while holding that +batched_entropy lock -- as the random code does. + +Solve this by moving __sched_fork() out from under rq->lock. This is +safe because nothing there relies on rq->lock, as also evident from the +other __sched_fork() callsite. + +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Qian Cai +Cc: Thomas Gleixner +Cc: akpm@linux-foundation.org +Cc: bigeasy@linutronix.de +Cc: cl@linux.com +Cc: keescook@chromium.org +Cc: penberg@kernel.org +Cc: rientjes@google.com +Cc: thgarnie@google.com +Cc: tytso@mit.edu +Cc: will@kernel.org +Fixes: b7d5dc21072c ("random: add a spinlock_t to struct batched_entropy") +Link: https://lkml.kernel.org/r/20191001091837.GK4536@hirez.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index bbf8b32fc69ec..97a27726ea217 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5242,10 +5242,11 @@ void init_idle(struct task_struct *idle, int cpu) + struct rq *rq = cpu_rq(cpu); + unsigned long flags; + ++ __sched_fork(0, idle); ++ + raw_spin_lock_irqsave(&idle->pi_lock, flags); + raw_spin_lock(&rq->lock); + +- __sched_fork(0, idle); + idle->state = TASK_RUNNING; + idle->se.exec_start = sched_clock(); + idle->flags |= PF_IDLE; +-- +2.20.1 + diff --git a/queue-4.14/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch b/queue-4.14/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch new file mode 100644 index 00000000000..724dcf8e1e7 --- /dev/null +++ b/queue-4.14/scsi-qedi-allocate-irqs-based-on-msix_cnt.patch @@ -0,0 +1,39 @@ +From 0c8d6332455e6a063b9fecb7b2116c536edc82b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Nov 2018 01:25:18 -0800 +Subject: scsi: qedi: Allocate IRQs based on msix_cnt + +From: Nilesh Javali + +[ Upstream commit 1a291bce5eaf5374627d337157544aa6499ce34a ] + +The driver load on some systems failed with error, +[0004:01:00.5]:[qedi_request_msix_irq:2524]:8: request_irq failed. + +Allocate the IRQs based on MSIX count obtained from qed module instead of +number of queues. + +Signed-off-by: Nilesh Javali +Reviewed-by: Lee Duncan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 24b945b555ba3..6e318a995dcc4 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1099,7 +1099,7 @@ static int qedi_request_msix_irq(struct qedi_ctx *qedi) + int i, rc, cpu; + + cpu = cpumask_first(cpu_online_mask); +- for (i = 0; i < MIN_NUM_CPUS_MSIX(qedi); i++) { ++ for (i = 0; i < qedi->int_info.msix_cnt; i++) { + rc = request_irq(qedi->int_info.msix[i].vector, + qedi_msix_handler, 0, "qedi", + &qedi->fp_array[i]); +-- +2.20.1 + diff --git a/queue-4.14/scsi-zfcp-drop-default-switch-case-which-might-paper.patch b/queue-4.14/scsi-zfcp-drop-default-switch-case-which-might-paper.patch new file mode 100644 index 00000000000..a89f740daef --- /dev/null +++ b/queue-4.14/scsi-zfcp-drop-default-switch-case-which-might-paper.patch @@ -0,0 +1,54 @@ +From 13fba4d9c2c91126df2be5309c4c15aeb28a0f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 15:44:57 +0100 +Subject: scsi: zfcp: drop default switch case which might paper over missing + case + +From: Steffen Maier + +[ Upstream commit 0c902936e55cff9335b27ed632fc45e7115ced75 ] + +This was introduced with v4.18 commit 8c3d20aada70 ("scsi: zfcp: fix +missing REC trigger trace for all objects in ERP_FAILED") but would now +suppress helpful -Wswitch compiler warnings when building with W=1 such as +the following forced example: + +drivers/s390/scsi/zfcp_erp.c: In function 'zfcp_erp_handle_failed': +drivers/s390/scsi/zfcp_erp.c:126:2: warning: enumeration value 'ZFCP_ERP_ACTION_REOPEN_PORT_FORCED' not handled in switch [-Wswitch] + switch (want) { + ^~~~~~ + +But then again, only with W=1 we would notice unhandled enum cases. +Without the default cases and a missed unhandled enum case, the code might +perform unforeseen things we might not want... + +As of today, we never run through the removed default case, so removing it +is no functional change. In the future, we never should run through a +default case but introduce the necessary specific case(s) to handle new +functionality. + +Signed-off-by: Steffen Maier +Reviewed-by: Benjamin Block +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/s390/scsi/zfcp_erp.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index 64d70de98cdb6..8f90e4cea2545 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -179,9 +179,6 @@ static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, + adapter, ZFCP_STATUS_COMMON_ERP_FAILED); + } + break; +- default: +- need = 0; +- break; + } + + return need; +-- +2.20.1 + diff --git a/queue-4.14/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch b/queue-4.14/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch new file mode 100644 index 00000000000..adcf4a1e22c --- /dev/null +++ b/queue-4.14/serial-core-allow-processing-sysrq-at-port-unlock-ti.patch @@ -0,0 +1,160 @@ +From 072baaa590934b993298e3ca984bed61ace6abf1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:11:04 -0700 +Subject: serial: core: Allow processing sysrq at port unlock time + +From: Douglas Anderson + +[ Upstream commit d6e1935819db0c91ce4a5af82466f3ab50d17346 ] + +Right now serial drivers process sysrq keys deep in their character +receiving code. This means that they've already grabbed their +port->lock spinlock. This can end up getting in the way if we've go +to do serial stuff (especially kgdb) in response to the sysrq. + +Serial drivers have various hacks in them to handle this. Looking at +'8250_port.c' you can see that the console_write() skips locking if +we're in the sysrq handler. Looking at 'msm_serial.c' you can see +that the port lock is dropped around uart_handle_sysrq_char(). + +It turns out that these hacks aren't exactly perfect. If you have +lockdep turned on and use something like the 8250_port hack you'll get +a splat that looks like: + + WARNING: possible circular locking dependency detected + [...] is trying to acquire lock: + ... (console_owner){-.-.}, at: console_unlock+0x2e0/0x5e4 + + but task is already holding lock: + ... (&port_lock_key){-.-.}, at: serial8250_handle_irq+0x30/0xe4 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (&port_lock_key){-.-.}: + _raw_spin_lock_irqsave+0x58/0x70 + serial8250_console_write+0xa8/0x250 + univ8250_console_write+0x40/0x4c + console_unlock+0x528/0x5e4 + register_console+0x2c4/0x3b0 + uart_add_one_port+0x350/0x478 + serial8250_register_8250_port+0x350/0x3a8 + dw8250_probe+0x67c/0x754 + platform_drv_probe+0x58/0xa4 + really_probe+0x150/0x294 + driver_probe_device+0xac/0xe8 + __driver_attach+0x98/0xd0 + bus_for_each_dev+0x84/0xc8 + driver_attach+0x2c/0x34 + bus_add_driver+0xf0/0x1ec + driver_register+0xb4/0x100 + __platform_driver_register+0x60/0x6c + dw8250_platform_driver_init+0x20/0x28 + ... + + -> #0 (console_owner){-.-.}: + lock_acquire+0x1e8/0x214 + console_unlock+0x35c/0x5e4 + vprintk_emit+0x230/0x274 + vprintk_default+0x7c/0x84 + vprintk_func+0x190/0x1bc + printk+0x80/0xa0 + __handle_sysrq+0x104/0x21c + handle_sysrq+0x30/0x3c + serial8250_read_char+0x15c/0x18c + serial8250_rx_chars+0x34/0x74 + serial8250_handle_irq+0x9c/0xe4 + dw8250_handle_irq+0x98/0xcc + serial8250_interrupt+0x50/0xe8 + ... + + other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&port_lock_key); + lock(console_owner); + lock(&port_lock_key); + lock(console_owner); + + *** DEADLOCK *** + +The hack used in 'msm_serial.c' doesn't cause the above splats but it +seems a bit ugly to unlock / lock our spinlock deep in our irq +handler. + +It seems like we could defer processing the sysrq until the end of the +interrupt handler right after we've unlocked the port. With this +scheme if a whole batch of sysrq characters comes in one irq then we +won't handle them all, but that seems like it should be a fine +compromise. + +Signed-off-by: Douglas Anderson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + include/linux/serial_core.h | 37 ++++++++++++++++++++++++++++++++++++- + 1 file changed, 36 insertions(+), 1 deletion(-) + +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 868b60a79c0b8..b2a7b7c15451b 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -166,6 +166,7 @@ struct uart_port { + struct console *cons; /* struct console, if any */ + #if defined(CONFIG_SERIAL_CORE_CONSOLE) || defined(SUPPORT_SYSRQ) + unsigned long sysrq; /* sysrq timeout */ ++ unsigned int sysrq_ch; /* char for sysrq */ + #endif + + /* flags must be updated while holding port mutex */ +@@ -474,8 +475,42 @@ uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) + } + return 0; + } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) ++{ ++ if (port->sysrq) { ++ if (ch && time_before(jiffies, port->sysrq)) { ++ port->sysrq_ch = ch; ++ port->sysrq = 0; ++ return 1; ++ } ++ port->sysrq = 0; ++ } ++ return 0; ++} ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ int sysrq_ch; ++ ++ sysrq_ch = port->sysrq_ch; ++ port->sysrq_ch = 0; ++ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++ ++ if (sysrq_ch) ++ handle_sysrq(sysrq_ch); ++} + #else +-#define uart_handle_sysrq_char(port,ch) ({ (void)port; 0; }) ++static inline int ++uart_handle_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline int ++uart_prepare_sysrq_char(struct uart_port *port, unsigned int ch) { return 0; } ++static inline void ++uart_unlock_and_check_sysrq(struct uart_port *port, unsigned long irqflags) ++{ ++ spin_unlock_irqrestore(&port->lock, irqflags); ++} + #endif + + /* +-- +2.20.1 + diff --git a/queue-4.14/serial-imx-fix-error-handling-in-console_setup.patch b/queue-4.14/serial-imx-fix-error-handling-in-console_setup.patch new file mode 100644 index 00000000000..1ba55cc00ba --- /dev/null +++ b/queue-4.14/serial-imx-fix-error-handling-in-console_setup.patch @@ -0,0 +1,40 @@ +From 92599de87b6f003e179d561f143119b10ee0204a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Nov 2018 18:49:38 +0100 +Subject: serial: imx: fix error handling in console_setup +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Stefan Agner + +[ Upstream commit 63fd4b94b948c14eeb27a3bbf50ea0f7f0593bad ] + +The ipg clock only needs to be unprepared in case preparing +per clock fails. The ipg clock has already disabled at the point. + +Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check") +Signed-off-by: Stefan Agner +Reviewed-by: Uwe Kleine-König +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/imx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 4e827e5a52a36..aae68230fb7b8 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1956,7 +1956,7 @@ imx_console_setup(struct console *co, char *options) + + retval = clk_prepare(sport->clk_per); + if (retval) +- clk_disable_unprepare(sport->clk_ipg); ++ clk_unprepare(sport->clk_ipg); + + error_console: + return retval; +-- +2.20.1 + diff --git a/queue-4.14/series b/queue-4.14/series index f8c6a0e9791..8fb58b7f826 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -6,3 +6,118 @@ tty-serial-msm_serial-fix-flow-control.patch serial-pl011-fix-dma-flush_buffer.patch serial-serial_core-perform-null-checks-for-break_ctl-ops.patch serial-ifx6x60-add-missed-pm_runtime_disable.patch +autofs-fix-a-leak-in-autofs_expire_indirect.patch +rdma-hns-correct-the-value-of-hns_roce_hem_chunk_len.patch +iwlwifi-pcie-don-t-consider-iv-len-in-a-msdu.patch +exportfs_decode_fh-negative-pinned-may-become-positi.patch +audit_get_nd-don-t-unlock-parent-too-early.patch +nfc-nxp-nci-fix-null-pointer-dereference-after-i2c-c.patch +xfrm-release-device-reference-for-invalid-state.patch +input-cyttsp4_core-fix-use-after-free-bug.patch +sched-core-avoid-spurious-lock-dependencies.patch +alsa-pcm-fix-stream-lock-usage-in-snd_pcm_period_ela.patch +rsxx-add-missed-destroy_workqueue-calls-in-remove.patch +net-ep93xx_eth-fix-mismatch-of-request_mem_region-in.patch +i2c-core-fix-use-after-free-in-of_i2c_notify.patch +serial-core-allow-processing-sysrq-at-port-unlock-ti.patch +cxgb4vf-fix-memleak-in-mac_hlist-initialization.patch +iwlwifi-mvm-synchronize-tid-queue-removal.patch +iwlwifi-mvm-send-non-offchannel-traffic-via-ap-sta.patch +dmaengine-xilinx_dma-fix-64-bit-simple-cdma-transfer.patch +arm-8813-1-make-aligned-2-byte-getuser-putuser-atomi.patch +net-mlx5-release-resource-on-error-flow.patch +pinctrl-sh-pfc-r8a7792-fix-vin-versioned-groups.patch +clk-sunxi-ng-a64-fix-gate-bit-of-dsi-dphy.patch +dlm-fix-possible-call-to-kfree-for-non-initialized-p.patch +extcon-max8997-fix-lack-of-path-setting-in-usb-devic.patch +net-ethernet-ti-cpts-correct-debug-for-expired-txq-s.patch +rtc-s3c-rtc-avoid-using-broken-almyear-register.patch +i40e-don-t-restart-nway-if-autoneg-not-supported.patch +clk-rockchip-fix-rk3188-sclk_smc-gate-data.patch +clk-rockchip-fix-rk3188-sclk_mac_lbtest-parameter-or.patch +arm-dts-rockchip-fix-rk3288-rock2-vcc_flash-name.patch +dlm-fix-missing-idr_destroy-for-recover_idr.patch +mips-sibyte-enable-zone_dma32-for-littlesur.patch +net-dsa-mv88e6xxx-work-around-mv886e6161-serdes-miss.patch +scsi-zfcp-drop-default-switch-case-which-might-paper.patch +crypto-ecc-check-for-invalid-values-in-the-key-verif.patch +crypto-bcm-fix-normal-non-key-hash-algorithm-failure.patch +pinctrl-qcom-ssbi-gpio-fix-gpio-hog-related-boot-iss.patch +staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch +mm-vmstat.c-fix-numa-statistics-updates.patch +clk-rockchip-fix-i2s1-clock-gate-register-for-rk3328.patch +clk-rockchip-fix-id-of-8ch-clock-of-i2s1-for-rk3328.patch +regulator-fix-return-value-of-_set_load-stub.patch +net-next-hinic-fix-a-bug-in-set-mac-address.patch +iomap-sub-block-dio-needs-to-zeroout-beyond-eof.patch +iw_cxgb4-only-reconnect-with-mpav1-if-the-peer-abort.patch +mips-octeon-octeon-platform-fix-typing.patch +net-smc-use-after-free-fix-in-smc_wr_tx_put_slot.patch +math-emu-soft-fp.h-_fp_round_zero-cast-0-to-void-to-.patch +rtc-max8997-fix-the-returned-value-in-case-of-error-.patch +rtc-dt-binding-abx80x-fix-resistance-scale.patch +arm-dts-exynos-use-samsung-soc-specific-compatible-f.patch +media-coda-fix-memory-corruption-in-case-more-than-3.patch +media-pulse8-cec-return-0-when-invalidating-the-logi.patch +media-cec-report-vendor-id-after-initialization.patch +dmaengine-coh901318-fix-a-double-lock-bug.patch +dmaengine-dw-dmac-implement-dma-protection-control-s.patch +usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch +usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch +acpi-fix-acpi_find_child_device-invocation-in-acpi_p.patch +f2fs-fix-count-of-seg_freed-to-make-sec_freed-correc.patch +f2fs-change-segment-to-section-in-f2fs_ioc_gc_range.patch +arm-dts-rockchip-fix-the-pmu-interrupt-number-for-rv.patch +arm-dts-rockchip-assign-the-proper-gpio-clocks-for-r.patch +f2fs-fix-to-allow-node-segment-for-gc-by-ioctl-path.patch +sparc-correct-ctx-saw_frame_pointer-logic.patch +dma-mapping-fix-return-type-of-dma_set_max_seg_size.patch +altera-stapl-check-for-a-null-key-before-strcasecmp-.patch +serial-imx-fix-error-handling-in-console_setup.patch +i2c-imx-don-t-print-error-message-on-probe-defer.patch +lockd-fix-decoding-of-test-results.patch +asoc-rsnd-tidyup-registering-method-for-rsnd_kctrl_n.patch +arm-dts-sun5i-a10s-fix-hdmi-output-dtc-warning.patch +arm-dts-sun8i-v3s-change-pinctrl-nodes-to-avoid-warn.patch +dlm-null-check-before-kmem_cache_destroy-is-not-need.patch +arm-debug-enable-uart1-for-socfpga-cyclone5.patch +nfsd-fix-a-warning-in-__cld_pipe_upcall.patch +scsi-qedi-allocate-irqs-based-on-msix_cnt.patch +asoc-au8540-use-64-bit-arithmetic-instead-of-32-bit.patch +arm-omap1-2-fix-soc-name-printing.patch +arm64-dts-meson-gxl-libretech-cc-fix-gpio-lines-name.patch +arm64-dts-meson-gxbb-nanopi-k2-fix-gpio-lines-names.patch +arm64-dts-meson-gxbb-odroidc2-fix-gpio-lines-names.patch +arm64-dts-meson-gxl-khadas-vim-fix-gpio-lines-names.patch +net-x25-fix-called-calling-length-calculation-in-x25.patch +net-x25-fix-null_x25_address-handling.patch +arm-dts-mmp2-fix-the-gpio-interrupt-cell-number.patch +arm-dts-realview-pbx-fix-duplicate-regulator-nodes.patch +tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch +tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch +tcp-fix-snmp-tcp-timeout-under-estimation.patch +modpost-skip-elf-local-symbols-during-section-mismat.patch +kbuild-fix-single-target-build-for-external-module.patch +mtd-fix-mtd_oobavail-incoherent-returned-value.patch +arm-dts-pxa-clean-up-usb-controller-nodes.patch +arm64-tegra-fix-power-key-interrupt-type-on-jetson-t.patch +clk-sunxi-ng-h3-h5-fix-csi_mclk-parent.patch +arm-dts-realview-fix-some-more-duplicate-regulator-n.patch +dlm-fix-invalid-cluster-name-warning.patch +net-mlx4_core-fix-return-codes-of-unsupported-operat.patch +pstore-ram-avoid-null-deref-in-ftrace-merging-failur.patch +powerpc-math-emu-update-macros-from-gcc.patch +clk-renesas-r8a77995-correct-parent-clock-of-du.patch +mips-octeon-cvmx_pko_mem_debug8-use-oldest-forward-c.patch +nfsd-return-eperm-not-eacces-in-some-setattr-cases.patch +tty-don-t-block-on-io-when-ldisc-change-is-pending.patch +media-stkwebcam-bugfix-for-wrong-return-values.patch +firmware-qcom-scm-fix-compilation-error-when-disable.patch +mlxsw-spectrum_router-relax-gre-decap-matching-check.patch +ib-hfi1-ignore-lni-errors-before-dc8051-transitions-.patch +ib-hfi1-close-vnic-sdma_progress-sleep-window.patch +mlx4-use-snprintf-instead-of-complicated-strcpy.patch +usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch +arm-dts-sunxi-fix-pmu-compatible-strings.patch +media-vimc-fix-start-stream-when-link-is-disabled.patch +net-aquantia-fix-rss-table-and-key-sizes.patch diff --git a/queue-4.14/sparc-correct-ctx-saw_frame_pointer-logic.patch b/queue-4.14/sparc-correct-ctx-saw_frame_pointer-logic.patch new file mode 100644 index 00000000000..8b323c7bc3f --- /dev/null +++ b/queue-4.14/sparc-correct-ctx-saw_frame_pointer-logic.patch @@ -0,0 +1,70 @@ +From 76a1d0c26657d948677b48e3fa57271beb45b92e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Nov 2018 14:52:18 -0800 +Subject: sparc: Correct ctx->saw_frame_pointer logic. + +From: David Miller + +[ Upstream commit e2ac579a7a18bcd9e8cf14cf42eac0b8a2ba6c4b ] + +We need to initialize the frame pointer register not just if it is +seen as a source operand, but also if it is seen as the destination +operand of a store or an atomic instruction (which effectively is a +source operand). + +This is exercised by test_verifier's "non-invalid fp arithmetic" + +Signed-off-by: David S. Miller +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + arch/sparc/net/bpf_jit_comp_64.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c +index adfb4581bd809..dfb1a62abe932 100644 +--- a/arch/sparc/net/bpf_jit_comp_64.c ++++ b/arch/sparc/net/bpf_jit_comp_64.c +@@ -1326,6 +1326,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_2_used = true; + emit_loadimm(imm, tmp2, ctx); + +@@ -1364,6 +1367,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp = bpf2sparc[TMP_REG_1]; + u32 opcode = 0, rs2; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + switch (BPF_SIZE(code)) { + case BPF_W: + opcode = ST32; +@@ -1396,6 +1402,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +@@ -1416,6 +1425,9 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + const u8 tmp2 = bpf2sparc[TMP_REG_2]; + const u8 tmp3 = bpf2sparc[TMP_REG_3]; + ++ if (insn->dst_reg == BPF_REG_FP) ++ ctx->saw_frame_pointer = true; ++ + ctx->tmp_1_used = true; + ctx->tmp_2_used = true; + ctx->tmp_3_used = true; +-- +2.20.1 + diff --git a/queue-4.14/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch b/queue-4.14/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch new file mode 100644 index 00000000000..5f234fc5ebe --- /dev/null +++ b/queue-4.14/staging-iio-adt7316-fix-i2c-data-reading-set-the-dat.patch @@ -0,0 +1,39 @@ +From cddc575f94091294b51e56123634ce94a7617ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Nov 2018 04:19:07 +0530 +Subject: Staging: iio: adt7316: Fix i2c data reading, set the data field + +From: Shreeya Patel + +[ Upstream commit 688cd642ba0c393344c802647848da5f0d925d0e ] + +adt7316_i2c_read function nowhere sets the data field. +It is necessary to have an appropriate value for it. +Hence, assign the value stored in 'ret' variable to data field. + +This is an ancient bug, and as no one seems to have noticed, +probably no sense in applying it to stable. + +Signed-off-by: Shreeya Patel +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/staging/iio/addac/adt7316-i2c.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/iio/addac/adt7316-i2c.c b/drivers/staging/iio/addac/adt7316-i2c.c +index f66dd3ebbab1f..856bcfa60c6c4 100644 +--- a/drivers/staging/iio/addac/adt7316-i2c.c ++++ b/drivers/staging/iio/addac/adt7316-i2c.c +@@ -35,6 +35,8 @@ static int adt7316_i2c_read(void *client, u8 reg, u8 *data) + return ret; + } + ++ *data = ret; ++ + return 0; + } + +-- +2.20.1 + diff --git a/queue-4.14/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch b/queue-4.14/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch new file mode 100644 index 00000000000..9845c9c6bd4 --- /dev/null +++ b/queue-4.14/tcp-fix-off-by-one-bug-on-aborting-window-probing-so.patch @@ -0,0 +1,38 @@ +From 34f6afb5fca2b5cf21b37cc1b16bac8d08b0de2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:43 -0800 +Subject: tcp: fix off-by-one bug on aborting window-probing socket + +From: Yuchung Cheng + +[ Upstream commit 3976535af0cb9fe34a55f2ffb8d7e6b39a2f8188 ] + +Previously there is an off-by-one bug on determining when to abort +a stalled window-probing socket. This patch fixes that so it is +consistent with tcp_write_timeout(). + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 592d6e9967a91..04e2c43a43a5a 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -358,7 +358,7 @@ static void tcp_probe_timer(struct sock *sk) + return; + } + +- if (icsk->icsk_probes_out > max_probes) { ++ if (icsk->icsk_probes_out >= max_probes) { + abort: tcp_write_err(sk); + } else { + /* Only send another probe if we didn't close things up. */ +-- +2.20.1 + diff --git a/queue-4.14/tcp-fix-snmp-tcp-timeout-under-estimation.patch b/queue-4.14/tcp-fix-snmp-tcp-timeout-under-estimation.patch new file mode 100644 index 00000000000..e38b1d21836 --- /dev/null +++ b/queue-4.14/tcp-fix-snmp-tcp-timeout-under-estimation.patch @@ -0,0 +1,62 @@ +From 07e39765cb3b9b215996bb31dfa50dd661b695d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:45 -0800 +Subject: tcp: fix SNMP TCP timeout under-estimation + +From: Yuchung Cheng + +[ Upstream commit e1561fe2dd69dc5dddd69bd73aa65355bdfb048b ] + +Previously the SNMP TCPTIMEOUTS counter has inconsistent accounting: +1. It counts all SYN and SYN-ACK timeouts +2. It counts timeouts in other states except recurring timeouts and + timeouts after fast recovery or disorder state. + +Such selective accounting makes analysis difficult and complicated. For +example the monitoring system needs to collect many other SNMP counters +to infer the total amount of timeout events. This patch makes TCPTIMEOUTS +counter simply counts all the retransmit timeout (SYN or data or FIN). + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_timer.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 04e2c43a43a5a..65f66bd585e62 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -464,11 +464,12 @@ void tcp_retransmit_timer(struct sock *sk) + goto out_reset_timer; + } + ++ __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPTIMEOUTS); + if (tcp_write_timeout(sk)) + goto out; + + if (icsk->icsk_retransmits == 0) { +- int mib_idx; ++ int mib_idx = 0; + + if (icsk->icsk_ca_state == TCP_CA_Recovery) { + if (tcp_is_sack(tp)) +@@ -483,10 +484,9 @@ void tcp_retransmit_timer(struct sock *sk) + mib_idx = LINUX_MIB_TCPSACKFAILURES; + else + mib_idx = LINUX_MIB_TCPRENOFAILURES; +- } else { +- mib_idx = LINUX_MIB_TCPTIMEOUTS; + } +- __NET_INC_STATS(sock_net(sk), mib_idx); ++ if (mib_idx) ++ __NET_INC_STATS(sock_net(sk), mib_idx); + } + + tcp_enter_loss(sk); +-- +2.20.1 + diff --git a/queue-4.14/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch b/queue-4.14/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch new file mode 100644 index 00000000000..bdd5927f195 --- /dev/null +++ b/queue-4.14/tcp-fix-snmp-under-estimation-on-failed-retransmissi.patch @@ -0,0 +1,37 @@ +From 70c9babedaf9ffe0277450688cc30a9ec76bb1f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Nov 2018 16:06:44 -0800 +Subject: tcp: fix SNMP under-estimation on failed retransmission + +From: Yuchung Cheng + +[ Upstream commit ec641b39457e17774313b66697a8a1dc070257bd ] + +Previously the SNMP counter LINUX_MIB_TCPRETRANSFAIL is not counting +the TSO/GSO properly on failed retransmission. This patch fixes that. + +Signed-off-by: Yuchung Cheng +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 5b808089eff89..6025cc509d974 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2932,7 +2932,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + if (likely(!err)) { + TCP_SKB_CB(skb)->sacked |= TCPCB_EVER_RETRANS; + } else if (err != -EBUSY) { +- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL); ++ NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL, segs); + } + return err; + } +-- +2.20.1 + diff --git a/queue-4.14/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch b/queue-4.14/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch new file mode 100644 index 00000000000..a01b6be8529 --- /dev/null +++ b/queue-4.14/tty-don-t-block-on-io-when-ldisc-change-is-pending.patch @@ -0,0 +1,161 @@ +From c761aae7426f70e4cdc4a33d4d0d16241016e529 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Nov 2018 00:24:48 +0000 +Subject: tty: Don't block on IO when ldisc change is pending + +From: Dmitry Safonov + +[ Upstream commit c96cf923a98d1b094df9f0cf97a83e118817e31b ] + +There might be situations where tty_ldisc_lock() has blocked, but there +is already IO on tty and it prevents line discipline changes. +It might theoretically turn into dead-lock. + +Basically, provide more priority to pending tty_ldisc_lock() than to +servicing reads/writes over tty. + +User-visible issue was reported by Mikulas where on pa-risc with +Debian 5 reboot took either 80 seconds, 3 minutes or 3:25 after proper +locking in tty_reopen(). + +Cc: Jiri Slaby +Reported-by: Mikulas Patocka +Signed-off-by: Dmitry Safonov +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_hdlc.c | 4 ++-- + drivers/tty/n_r3964.c | 2 +- + drivers/tty/n_tty.c | 8 ++++---- + drivers/tty/tty_ldisc.c | 7 +++++++ + include/linux/tty.h | 7 +++++++ + 5 files changed, 21 insertions(+), 7 deletions(-) + +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index e83dea8d6633a..19c4aa800c810 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -614,7 +614,7 @@ static ssize_t n_hdlc_tty_read(struct tty_struct *tty, struct file *file, + } + + /* no data */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + break; + } +@@ -681,7 +681,7 @@ static ssize_t n_hdlc_tty_write(struct tty_struct *tty, struct file *file, + if (tbuf) + break; + +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + error = -EAGAIN; + break; + } +diff --git a/drivers/tty/n_r3964.c b/drivers/tty/n_r3964.c +index 305b6490d4053..08ac04d089916 100644 +--- a/drivers/tty/n_r3964.c ++++ b/drivers/tty/n_r3964.c +@@ -1080,7 +1080,7 @@ static ssize_t r3964_read(struct tty_struct *tty, struct file *file, + pMsg = remove_msg(pInfo, pClient); + if (pMsg == NULL) { + /* no messages available. */ +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + ret = -EAGAIN; + goto unlock; + } +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 904fc9c37fdea..8214b0326b3a1 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -1704,7 +1704,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + + down_read(&tty->termios_rwsem); + +- while (1) { ++ do { + /* + * When PARMRK is set, each input char may take up to 3 chars + * in the read buf; reduce the buffer space avail by 3x +@@ -1746,7 +1746,7 @@ n_tty_receive_buf_common(struct tty_struct *tty, const unsigned char *cp, + fp += n; + count -= n; + rcvd += n; +- } ++ } while (!test_bit(TTY_LDISC_CHANGING, &tty->flags)); + + tty->receive_room = room; + +@@ -2213,7 +2213,7 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + break; + if (!timeout) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +@@ -2367,7 +2367,7 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file, + } + if (!nr) + break; +- if (file->f_flags & O_NONBLOCK) { ++ if (tty_io_nonblock(tty, file)) { + retval = -EAGAIN; + break; + } +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 01fcdc7ff0771..62dd2abb57fea 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -348,6 +348,11 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + { + int ret; + ++ /* Kindly asking blocked readers to release the read side */ ++ set_bit(TTY_LDISC_CHANGING, &tty->flags); ++ wake_up_interruptible_all(&tty->read_wait); ++ wake_up_interruptible_all(&tty->write_wait); ++ + ret = __tty_ldisc_lock(tty, timeout); + if (!ret) + return -EBUSY; +@@ -358,6 +363,8 @@ int tty_ldisc_lock(struct tty_struct *tty, unsigned long timeout) + void tty_ldisc_unlock(struct tty_struct *tty) + { + clear_bit(TTY_LDISC_HALTED, &tty->flags); ++ /* Can be cleared here - ldisc_unlock will wake up writers firstly */ ++ clear_bit(TTY_LDISC_CHANGING, &tty->flags); + __tty_ldisc_unlock(tty); + } + +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 1dd587ba6d882..0cd621d8c7f05 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -365,6 +365,7 @@ struct tty_file_private { + #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ + #define TTY_HUPPED 18 /* Post driver->hangup() */ + #define TTY_HUPPING 19 /* Hangup in progress */ ++#define TTY_LDISC_CHANGING 20 /* Change pending - non-block IO */ + #define TTY_LDISC_HALTED 22 /* Line discipline is halted */ + + /* Values for tty->flow_change */ +@@ -382,6 +383,12 @@ static inline void tty_set_flow_change(struct tty_struct *tty, int val) + smp_mb(); + } + ++static inline bool tty_io_nonblock(struct tty_struct *tty, struct file *file) ++{ ++ return file->f_flags & O_NONBLOCK || ++ test_bit(TTY_LDISC_CHANGING, &tty->flags); ++} ++ + static inline bool tty_io_error(struct tty_struct *tty) + { + return test_bit(TTY_IO_ERROR, &tty->flags); +-- +2.20.1 + diff --git a/queue-4.14/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch b/queue-4.14/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch new file mode 100644 index 00000000000..a93ce1d4184 --- /dev/null +++ b/queue-4.14/usb-dwc3-debugfs-properly-print-set-link-state-for-h.patch @@ -0,0 +1,113 @@ +From c6eeee9af3b160b43110caae00dc925e737db284 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 17:55:19 -0800 +Subject: usb: dwc3: debugfs: Properly print/set link state for HS + +From: Thinh Nguyen + +[ Upstream commit 0d36dede457873404becd7c9cb9d0f2bcfd0dcd9 ] + +Highspeed device and below has different state names than superspeed and +higher. Add proper checks and printouts of link states for highspeed and +below. + +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/debug.h | 29 +++++++++++++++++++++++++++++ + drivers/usb/dwc3/debugfs.c | 19 +++++++++++++++++-- + 2 files changed, 46 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/dwc3/debug.h b/drivers/usb/dwc3/debug.h +index 5e9c070ec8747..1b4c2f8bb3daf 100644 +--- a/drivers/usb/dwc3/debug.h ++++ b/drivers/usb/dwc3/debug.h +@@ -124,6 +124,35 @@ dwc3_gadget_link_string(enum dwc3_link_state link_state) + } + } + ++/** ++ * dwc3_gadget_hs_link_string - returns highspeed and below link name ++ * @link_state: link state code ++ */ ++static inline const char * ++dwc3_gadget_hs_link_string(enum dwc3_link_state link_state) ++{ ++ switch (link_state) { ++ case DWC3_LINK_STATE_U0: ++ return "On"; ++ case DWC3_LINK_STATE_U2: ++ return "Sleep"; ++ case DWC3_LINK_STATE_U3: ++ return "Suspend"; ++ case DWC3_LINK_STATE_SS_DIS: ++ return "Disconnected"; ++ case DWC3_LINK_STATE_RX_DET: ++ return "Early Suspend"; ++ case DWC3_LINK_STATE_RECOV: ++ return "Recovery"; ++ case DWC3_LINK_STATE_RESET: ++ return "Reset"; ++ case DWC3_LINK_STATE_RESUME: ++ return "Resume"; ++ default: ++ return "UNKNOWN link state\n"; ++ } ++} ++ + /** + * dwc3_trb_type_string - returns TRB type as a string + * @type: the type of the TRB +diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c +index 4e09be80e59f9..0d6a6a168a7ec 100644 +--- a/drivers/usb/dwc3/debugfs.c ++++ b/drivers/usb/dwc3/debugfs.c +@@ -436,13 +436,17 @@ static int dwc3_link_state_show(struct seq_file *s, void *unused) + unsigned long flags; + enum dwc3_link_state state; + u32 reg; ++ u8 speed; + + spin_lock_irqsave(&dwc->lock, flags); + reg = dwc3_readl(dwc->regs, DWC3_DSTS); + state = DWC3_DSTS_USBLNKST(reg); +- spin_unlock_irqrestore(&dwc->lock, flags); ++ speed = reg & DWC3_DSTS_CONNECTSPD; + +- seq_printf(s, "%s\n", dwc3_gadget_link_string(state)); ++ seq_printf(s, "%s\n", (speed >= DWC3_DSTS_SUPERSPEED) ? ++ dwc3_gadget_link_string(state) : ++ dwc3_gadget_hs_link_string(state)); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + return 0; + } +@@ -460,6 +464,8 @@ static ssize_t dwc3_link_state_write(struct file *file, + unsigned long flags; + enum dwc3_link_state state = 0; + char buf[32]; ++ u32 reg; ++ u8 speed; + + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; +@@ -480,6 +486,15 @@ static ssize_t dwc3_link_state_write(struct file *file, + return -EINVAL; + + spin_lock_irqsave(&dwc->lock, flags); ++ reg = dwc3_readl(dwc->regs, DWC3_DSTS); ++ speed = reg & DWC3_DSTS_CONNECTSPD; ++ ++ if (speed < DWC3_DSTS_SUPERSPEED && ++ state != DWC3_LINK_STATE_RECOV) { ++ spin_unlock_irqrestore(&dwc->lock, flags); ++ return -EINVAL; ++ } ++ + dwc3_gadget_set_link_state(dwc, state); + spin_unlock_irqrestore(&dwc->lock, flags); + +-- +2.20.1 + diff --git a/queue-4.14/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch b/queue-4.14/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch new file mode 100644 index 00000000000..78ce6053b46 --- /dev/null +++ b/queue-4.14/usb-dwc3-don-t-log-probe-deferrals-but-do-log-other-.patch @@ -0,0 +1,37 @@ +From 32c4336c22651de8893c3314ab17a3ec27983b7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 12:40:29 -0800 +Subject: usb: dwc3: don't log probe deferrals; but do log other error codes + +From: Brian Norris + +[ Upstream commit 408d3ba006af57380fa48858b39f72fde6405031 ] + +It's not very useful to repeat a bunch of probe deferral errors. And +it's also not very useful to log "failed" without telling the error +code. + +Signed-off-by: Brian Norris +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 48755c501201d..a497b878c3e2b 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1261,7 +1261,8 @@ static int dwc3_probe(struct platform_device *pdev) + + ret = dwc3_core_init(dwc); + if (ret) { +- dev_err(dev, "failed to initialize core\n"); ++ if (ret != -EPROBE_DEFER) ++ dev_err(dev, "failed to initialize core: %d\n", ret); + goto err4; + } + +-- +2.20.1 + diff --git a/queue-4.14/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch b/queue-4.14/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch new file mode 100644 index 00000000000..c8b3346c34b --- /dev/null +++ b/queue-4.14/usb-mtu3-fix-dbginfo-in-qmu_tx_zlp_error_handler.patch @@ -0,0 +1,41 @@ +From 0f5be1efe0504b85942435d620bc59758a413e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Dec 2018 03:52:43 +0000 +Subject: usb: mtu3: fix dbginfo in qmu_tx_zlp_error_handler + +From: YueHaibing + +[ Upstream commit f770e3bc236ee954a3b4052bdf55739e26ee25db ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/usb/mtu3/mtu3_qmu.c: In function 'qmu_tx_zlp_error_handler': +drivers/usb/mtu3/mtu3_qmu.c:385:22: warning: + variable 'req' set but not used [-Wunused-but-set-variable] + +It seems dbginfo original intention is print 'req' other than 'mreq' + +Acked-by: Chunfeng Yun +Signed-off-by: YueHaibing +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/mtu3/mtu3_qmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/mtu3/mtu3_qmu.c b/drivers/usb/mtu3/mtu3_qmu.c +index 7d9ba8a52368f..c87947fb26940 100644 +--- a/drivers/usb/mtu3/mtu3_qmu.c ++++ b/drivers/usb/mtu3/mtu3_qmu.c +@@ -372,7 +372,7 @@ static void qmu_tx_zlp_error_handler(struct mtu3 *mtu, u8 epnum) + return; + } + +- dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, mreq); ++ dev_dbg(mtu->dev, "%s send ZLP for req=%p\n", __func__, req); + + mtu3_clrbits(mbase, MU3D_EP_TXCR0(mep->epnum), TX_DMAREQEN); + +-- +2.20.1 + diff --git a/queue-4.14/xfrm-release-device-reference-for-invalid-state.patch b/queue-4.14/xfrm-release-device-reference-for-invalid-state.patch new file mode 100644 index 00000000000..7f137d6d31d --- /dev/null +++ b/queue-4.14/xfrm-release-device-reference-for-invalid-state.patch @@ -0,0 +1,62 @@ +From b4c88fd1852cd8730c78e3900205f47360bc2770 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Nov 2019 15:05:46 -0800 +Subject: xfrm: release device reference for invalid state + +From: Xiaodong Xu + +[ Upstream commit 4944a4b1077f74d89073624bd286219d2fcbfce3 ] + +An ESP packet could be decrypted in async mode if the input handler for +this packet returns -EINPROGRESS in xfrm_input(). At this moment the device +reference in skb is held. Later xfrm_input() will be invoked again to +resume the processing. +If the transform state is still valid it would continue to release the +device reference and there won't be a problem; however if the transform +state is not valid when async resumption happens, the packet will be +dropped while the device reference is still being held. +When the device is deleted for some reason and the reference to this +device is not properly released, the kernel will keep logging like: + +unregister_netdevice: waiting for ppp2 to become free. Usage count = 1 + +The issue is observed when running IPsec traffic over a PPPoE device based +on a bridge interface. By terminating the PPPoE connection on the server +end for multiple times, the PPPoE device on the client side will eventually +get stuck on the above warning message. + +This patch will check the async mode first and continue to release device +reference in async resumption, before it is dropped due to invalid state. + +v2: Do not assign address family from outer_mode in the transform if the +state is invalid + +v3: Release device reference in the error path instead of jumping to resume + +Fixes: 4ce3dbe397d7b ("xfrm: Fix xfrm_input() to verify state is valid when (encap_type < 0)") +Signed-off-by: Xiaodong Xu +Reported-by: Bo Chen +Tested-by: Bo Chen +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_input.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index fc0a9ce1be18f..311597401b821 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -245,6 +245,9 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type) + else + XFRM_INC_STATS(net, + LINUX_MIB_XFRMINSTATEINVALID); ++ ++ if (encap_type == -1) ++ dev_put(skb->dev); + goto drop; + } + +-- +2.20.1 +