From 1ca9d2603394882db0aef78b0850e32d2f7c2d50 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Tue, 21 Apr 2020 23:25:54 -0400 Subject: [PATCH] Fixes for 5.6 Signed-off-by: Sasha Levin --- ...pi-update-tiger-lake-acpi-device-ids.patch | 88 +++++ ...xes-for-acpiexec-namespace-init-file.patch | 299 +++++++++++++++++ ...-fix-lvds-encoder-ports-subnode-for-.patch | 74 +++++ ...-fix-vqmmc-supply-property-name-for-.patch | 62 ++++ ...ner-a64-fix-display-clock-register-r.patch | 39 +++ ...og-gt-8k-set-gigabit-phy-reset-deass.patch | 44 +++ ...rvell-espressobin-add-ethernet-alias.patch | 40 +++ ...ll-fix-cpu-compatible-for-ap807-quad.patch | 126 ++++++++ ...pcie-endpoint-controllers-nodes-for-.patch | 132 ++++++++ ...-fix-tegra194-pcie-compatible-string.patch | 106 ++++++ ...eliably-preserve-btf_trace_xxx-types.patch | 66 ++++ ...cks-around-block-group-initializatio.patch | 57 ++++ ..._file_range-and-fix-some-error-paths.patch | 289 +++++++++++++++++ ...te-encryption-header-through-kmalloc.patch | 83 +++++ ...tinue-if-clk_hw_round_rate-return-ze.patch | 49 +++ ...-cache-errors-from-clk_ops-get_phase.patch | 134 ++++++++ ...add-new-frequency-entries-for-pll144.patch | 38 +++ ...egra-fix-tegra-pmc-clock-out-parents.patch | 56 ++++ ...-fix-error-in-build_bug_on-reporting.patch | 70 ++++ ...e-use-cryptlen-when-adding-extra-sgl.patch | 103 ++++++ ...cpu-speculative-execution-to-io-area.patch | 212 ++++++++++++ ...get-wrong-psr-value-from-phyical-reg.patch | 126 ++++++++ ...init_fpu-compile-warning-with-__init.patch | 73 +++++ ...-integer-overflow-in-the-reserved-me.patch | 84 +++++ ...eflect-shadow-copy-of-traffic-class-.patch | 45 +++ ...tsens-release-device-in-success-path.patch | 62 ++++ ...don-t-try-hdcp1.4-when-content_type-.patch | 56 ++++ .../drm-amdkfd-kfree-the-wrong-pointer.patch | 39 +++ ...p107-gp108-implement-workaround-for-.patch | 73 +++++ ...check-for-svm-initialized-before-mig.patch | 40 +++ ...vm-fix-vma-range-check-for-migration.patch | 40 +++ ...around-runpm-fail-by-disabling-pci-p.patch | 146 +++++++++ ...e-fence-on-the-bo-after-we-individua.patch | 51 +++ .../drm-vc4-fix-hdmi-mode-validation.patch | 61 ++++ ...mal-tsens-fix-nvmem-cell-names-schem.patch | 63 ++++ ...-debug-reference-to-ext2_xattr_cache.patch | 51 +++ ...ty-body-warnings-when-wextra-is-used.patch | 60 ++++ ...o-not-commit-super-on-read-only-bdev.patch | 50 +++ ...p-flag-to-help-fsck-fix-resize-spo-i.patch | 64 ++++ ...x-to-call-missing-destroy_compress_c.patch | 34 ++ ...-uninitialized-memory-in-compressed-.patch | 47 +++ ...ailure-due-to-spo-after-a-successful.patch | 53 +++ ...inter-dereference-in-f2fs_verity_wor.patch | 104 ++++++ ...inter-dereference-in-f2fs_write_begi.patch | 77 +++++ ...al-.flags-overflow-on-32bit-architec.patch | 213 ++++++++++++ ...al-deadlock-on-compressed-quota-file.patch | 147 +++++++++ .../f2fs-fix-the-panic-in-do_checkpoint.patch | 135 ++++++++ ...unt-compressed-blocks-in-f2fs_compre.patch | 100 ++++++ ...f2fs-fix-to-avoid-potential-deadlock.patch | 47 +++ ...d-use-after-free-in-f2fs_write_multi.patch | 58 ++++ ...-fix-to-show-norecovery-mount-option.patch | 67 ++++ ...te-f2fs_super_block-fields-under-sb_.patch | 60 ++++ ...-fix-to-wait-all-node-page-writeback.patch | 58 ++++ ...x-wrong-check-on-f2fs_ioc_fssetxattr.patch | 68 ++++ .../f2fs-skip-gc-when-section-is-full.patch | 35 ++ ...-clear-ail1-list-when-gfs2-withdraws.patch | 77 +++++ ...rnate-allow-uswsusp-to-write-to-swap.patch | 50 +++ ...apops.h-correct-guards-for-non_swap_.patch | 62 ++++ ...e-configuration-of-gcr3-table-root-p.patch | 38 +++ ...io-fix-freeing-of-incomplete-domains.patch | 63 ++++ ...-vt-d-add-build-dependency-on-ioasid.patch | 39 +++ .../iommu-vt-d-fix-mm-reference-leak.patch | 47 +++ ...t-d-fix-page-request-descriptor-size.patch | 40 +++ ...ce-rcu-list-debugging-warning-in-dma.patch | 55 ++++ ...v-fix-h_cede-return-code-for-nested-.patch | 67 ++++ ...x-possible-race-when-shadowing-regio.patch | 52 +++ ...e-fix-warning-message-when-init_data.patch | 39 +++ ...imm-out-of-bounds-read-in-__nd_ioctl.patch | 43 +++ ...ll-dereference-in-macsec_upd_offload.patch | 40 +++ ...rect-debugfs-clk-rate-range-on-tegra.patch | 40 +++ ...debugfs-clk-rate-range-on-tegra.patch-2042 | 40 +++ ...ebugfs-clk-rate-range-on-tegra.patch-23140 | 40 +++ ...c-check-dt-node-for-usbpd-notify-add.patch | 39 +++ ...s-dts-ci20-add-dt-node-for-ir-sensor.patch | 41 +++ ...uild-failure-with-hugetlb_page-but-n.patch | 95 ++++++ ...enforce-setting-of-a-single-fec-mode.patch | 38 +++ ...en_context-must-use-the-file-cred-wh.patch | 48 +++ ...-memory-leak-of-dreq-when-nfs_get_lo.patch | 51 +++ ...y-leaks-in-nfs_pageio_stop_mirroring.patch | 56 ++++ ...cp-as-the-default-transport-protocol.patch | 38 +++ ...n-valid-stateids-in-nfs_layout_find_.patch | 37 +++ ...sv4.2-error-out-when-relink-swapfile.patch | 35 ++ ...r-fix-a-data-race-at-vm_committed_as.patch | 72 +++++ ...phy-uniphier-usb3ss-add-pro5-support.patch | 37 +++ ...cros_ec-query-ec-protocol-version-if.patch | 105 ++++++ ...el-hid-fix-update-tiger-lake-acpi-de.patch | 42 +++ ...288_fuel_gauge-broaden-vendor-check-.patch | 50 +++ ...7xxx_battery-silence-deferred-probe-.patch | 45 +++ ...ix-declaration-made-after-definition.patch | 92 ++++++ ...t-pass-the-os-term-message-to-hyperv.patch | 42 +++ ...88pm860x-fix-possible-race-condition.patch | 62 ++++ ...ix-wrong-output-when-cpu0-is-offline.patch | 49 +++ ...ix-wrong-page-count-in-error-message.patch | 70 ++++ ...icitly-memzero-stack-key-material-in.patch | 46 +++ queue-5.6/series | 108 +++++++ .../soc-imx-gpc-fix-power-up-sequencing.patch | 78 +++++ ...nrpc-fix-gss_unwrap_resp_integ-again.patch | 178 ++++++++++ ...-mount-to-provide-large-enough-buffe.patch | 124 +++++++ ...cpufreq_cooling-fix-return-of-cpufre.patch | 61 ++++ .../thermal-qoriq-fix-a-compiling-issue.patch | 38 +++ ...s-to-be-directly-included-for-older-.patch | 47 +++ ...buffer-overrun-on-command-completion.patch | 41 +++ ...witch-back-to-oom-handler-for-virtio.patch | 306 ++++++++++++++++++ .../x86-acpi-fix-cpu-hotplug-deadlock.patch | 169 ++++++++++ ...make-the-boot-cpu-idle-task-reliable.patch | 58 ++++ ...lease-error-check-race-with-shutdown.patch | 74 +++++ ...t-test-in-xfs_alloc_ag_vextent_lastb.patch | 38 +++ ...on-in-cleanup-xfs_dir2_block_getdent.patch | 80 +++++ ...r-free-when-aborting-corrupt-attr-in.patch | 37 +++ 109 files changed, 8113 insertions(+) create mode 100644 queue-5.6/acpi-update-tiger-lake-acpi-device-ids.patch create mode 100644 queue-5.6/acpica-fixes-for-acpiexec-namespace-init-file.patch create mode 100644 queue-5.6/arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch create mode 100644 queue-5.6/arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch create mode 100644 queue-5.6/arm64-dts-allwinner-a64-fix-display-clock-register-r.patch create mode 100644 queue-5.6/arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch create mode 100644 queue-5.6/arm64-dts-marvell-espressobin-add-ethernet-alias.patch create mode 100644 queue-5.6/arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch create mode 100644 queue-5.6/arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch create mode 100644 queue-5.6/arm64-tegra-fix-tegra194-pcie-compatible-string.patch create mode 100644 queue-5.6/bpf-reliably-preserve-btf_trace_xxx-types.patch create mode 100644 queue-5.6/btrfs-add-rcu-locks-around-block-group-initializatio.patch create mode 100644 queue-5.6/ceph-re-org-copy_file_range-and-fix-some-error-paths.patch create mode 100644 queue-5.6/cifs-allocate-encryption-header-through-kmalloc.patch create mode 100644 queue-5.6/clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch create mode 100644 queue-5.6/clk-don-t-cache-errors-from-clk_ops-get_phase.patch create mode 100644 queue-5.6/clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch create mode 100644 queue-5.6/clk-tegra-fix-tegra-pmc-clock-out-parents.patch create mode 100644 queue-5.6/compiler.h-fix-error-in-build_bug_on-reporting.patch create mode 100644 queue-5.6/crypto-qce-use-cryptlen-when-adding-extra-sgl.patch create mode 100644 queue-5.6/csky-fixup-cpu-speculative-execution-to-io-area.patch create mode 100644 queue-5.6/csky-fixup-get-wrong-psr-value-from-phyical-reg.patch create mode 100644 queue-5.6/csky-fixup-init_fpu-compile-warning-with-__init.patch create mode 100644 queue-5.6/dma-coherent-fix-integer-overflow-in-the-reserved-me.patch create mode 100644 queue-5.6/dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch create mode 100644 queue-5.6/drivers-thermal-tsens-release-device-in-success-path.patch create mode 100644 queue-5.6/drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch create mode 100644 queue-5.6/drm-amdkfd-kfree-the-wrong-pointer.patch create mode 100644 queue-5.6/drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch create mode 100644 queue-5.6/drm-nouveau-svm-check-for-svm-initialized-before-mig.patch create mode 100644 queue-5.6/drm-nouveau-svm-fix-vma-range-check-for-migration.patch create mode 100644 queue-5.6/drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch create mode 100644 queue-5.6/drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch create mode 100644 queue-5.6/drm-vc4-fix-hdmi-mode-validation.patch create mode 100644 queue-5.6/dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch create mode 100644 queue-5.6/ext2-fix-debug-reference-to-ext2_xattr_cache.patch create mode 100644 queue-5.6/ext2-fix-empty-body-warnings-when-wextra-is-used.patch create mode 100644 queue-5.6/ext4-do-not-commit-super-on-read-only-bdev.patch create mode 100644 queue-5.6/f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch create mode 100644 queue-5.6/f2fs-compress-fix-to-call-missing-destroy_compress_c.patch create mode 100644 queue-5.6/f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch create mode 100644 queue-5.6/f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch create mode 100644 queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch create mode 100644 queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch create mode 100644 queue-5.6/f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch create mode 100644 queue-5.6/f2fs-fix-potential-deadlock-on-compressed-quota-file.patch create mode 100644 queue-5.6/f2fs-fix-the-panic-in-do_checkpoint.patch create mode 100644 queue-5.6/f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch create mode 100644 queue-5.6/f2fs-fix-to-avoid-potential-deadlock.patch create mode 100644 queue-5.6/f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch create mode 100644 queue-5.6/f2fs-fix-to-show-norecovery-mount-option.patch create mode 100644 queue-5.6/f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch create mode 100644 queue-5.6/f2fs-fix-to-wait-all-node-page-writeback.patch create mode 100644 queue-5.6/f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch create mode 100644 queue-5.6/f2fs-skip-gc-when-section-is-full.patch create mode 100644 queue-5.6/gfs2-clear-ail1-list-when-gfs2-withdraws.patch create mode 100644 queue-5.6/hibernate-allow-uswsusp-to-write-to-swap.patch create mode 100644 queue-5.6/include-linux-swapops.h-correct-guards-for-non_swap_.patch create mode 100644 queue-5.6/iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch create mode 100644 queue-5.6/iommu-virtio-fix-freeing-of-incomplete-domains.patch create mode 100644 queue-5.6/iommu-vt-d-add-build-dependency-on-ioasid.patch create mode 100644 queue-5.6/iommu-vt-d-fix-mm-reference-leak.patch create mode 100644 queue-5.6/iommu-vt-d-fix-page-request-descriptor-size.patch create mode 100644 queue-5.6/iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch create mode 100644 queue-5.6/kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch create mode 100644 queue-5.6/kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch create mode 100644 queue-5.6/leds-core-fix-warning-message-when-init_data.patch create mode 100644 queue-5.6/libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch create mode 100644 queue-5.6/macsec-fix-null-dereference-in-macsec_upd_offload.patch create mode 100644 queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch create mode 100644 queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042 create mode 100644 queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140 create mode 100644 queue-5.6/mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch create mode 100644 queue-5.6/mips-dts-ci20-add-dt-node-for-ir-sensor.patch create mode 100644 queue-5.6/mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch create mode 100644 queue-5.6/net-mlx5e-enforce-setting-of-a-single-fec-mode.patch create mode 100644 queue-5.6/nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch create mode 100644 queue-5.6/nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch create mode 100644 queue-5.6/nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch create mode 100644 queue-5.6/nfsroot-set-tcp-as-the-default-transport-protocol.patch create mode 100644 queue-5.6/nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch create mode 100644 queue-5.6/nfsv4.2-error-out-when-relink-swapfile.patch create mode 100644 queue-5.6/percpu_counter-fix-a-data-race-at-vm_committed_as.patch create mode 100644 queue-5.6/phy-uniphier-usb3ss-add-pro5-support.patch create mode 100644 queue-5.6/platform-chrome-cros_ec-query-ec-protocol-version-if.patch create mode 100644 queue-5.6/platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch create mode 100644 queue-5.6/power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch create mode 100644 queue-5.6/power-supply-bq27xxx_battery-silence-deferred-probe-.patch create mode 100644 queue-5.6/powerpc-maple-fix-declaration-made-after-definition.patch create mode 100644 queue-5.6/powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch create mode 100644 queue-5.6/rtc-88pm860x-fix-possible-race-condition.patch create mode 100644 queue-5.6/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch create mode 100644 queue-5.6/s390-cpum_sf-fix-wrong-page-count-in-error-message.patch create mode 100644 queue-5.6/s390-crypto-explicitly-memzero-stack-key-material-in.patch create mode 100644 queue-5.6/soc-imx-gpc-fix-power-up-sequencing.patch create mode 100644 queue-5.6/sunrpc-fix-gss_unwrap_resp_integ-again.patch create mode 100644 queue-5.6/sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch create mode 100644 queue-5.6/thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch create mode 100644 queue-5.6/thermal-qoriq-fix-a-compiling-issue.patch create mode 100644 queue-5.6/um-falloc.h-needs-to-be-directly-included-for-older-.patch create mode 100644 queue-5.6/um-ubd-prevent-buffer-overrun-on-command-completion.patch create mode 100644 queue-5.6/virtio-balloon-switch-back-to-oom-handler-for-virtio.patch create mode 100644 queue-5.6/x86-acpi-fix-cpu-hotplug-deadlock.patch create mode 100644 queue-5.6/x86-xen-make-the-boot-cpu-idle-task-reliable.patch create mode 100644 queue-5.6/xfs-fix-iclog-release-error-check-race-with-shutdown.patch create mode 100644 queue-5.6/xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch create mode 100644 queue-5.6/xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch create mode 100644 queue-5.6/xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch diff --git a/queue-5.6/acpi-update-tiger-lake-acpi-device-ids.patch b/queue-5.6/acpi-update-tiger-lake-acpi-device-ids.patch new file mode 100644 index 00000000000..49859a35d9d --- /dev/null +++ b/queue-5.6/acpi-update-tiger-lake-acpi-device-ids.patch @@ -0,0 +1,88 @@ +From e179c0acf8c5fdb6eb3919ea664bae9b0c8c228d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Mar 2020 14:28:19 -0700 +Subject: ACPI: Update Tiger Lake ACPI device IDs + +From: Gayatri Kammela + +[ Upstream commit b62c770fee699a137359e1f1da9bf14a7f348567 ] + +Tiger Lake's new unique ACPI device IDs for DPTF and fan drivers are not +valid as the IDs are missing 'C'. Fix the IDs by updating them. + +After the update, the new IDs should now look like +INT1047 --> INTC1047 +INT1040 --> INTC1040 +INT1043 --> INTC1043 +INT1044 --> INTC1044 + +Fixes: 55cfe6a5c582 ("ACPI: DPTF: Add Tiger Lake ACPI device IDs") +Fixes: c248dfe7e0ca ("ACPI: fan: Add Tiger Lake ACPI device ID") +Suggested-by: Srinivas Pandruvada +Signed-off-by: Gayatri Kammela +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/device_pm.c | 2 +- + drivers/acpi/dptf/dptf_power.c | 2 +- + drivers/acpi/dptf/int340x_thermal.c | 8 ++++---- + 3 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index b64c62bfcea56..b2263ec67b432 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -1321,8 +1321,8 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on) + */ + static const struct acpi_device_id special_pm_ids[] = { + {"PNP0C0B", }, /* Generic ACPI fan */ +- {"INT1044", }, /* Fan for Tiger Lake generation */ + {"INT3404", }, /* Fan */ ++ {"INTC1044", }, /* Fan for Tiger Lake generation */ + {} + }; + struct acpi_device *adev = ACPI_COMPANION(dev); +diff --git a/drivers/acpi/dptf/dptf_power.c b/drivers/acpi/dptf/dptf_power.c +index 387f27ef3368b..e4e8b75d39f09 100644 +--- a/drivers/acpi/dptf/dptf_power.c ++++ b/drivers/acpi/dptf/dptf_power.c +@@ -97,8 +97,8 @@ static int dptf_power_remove(struct platform_device *pdev) + } + + static const struct acpi_device_id int3407_device_ids[] = { +- {"INT1047", 0}, + {"INT3407", 0}, ++ {"INTC1047", 0}, + {"", 0}, + }; + MODULE_DEVICE_TABLE(acpi, int3407_device_ids); +diff --git a/drivers/acpi/dptf/int340x_thermal.c b/drivers/acpi/dptf/int340x_thermal.c +index 1ec7b6900662c..bc71a6a603345 100644 +--- a/drivers/acpi/dptf/int340x_thermal.c ++++ b/drivers/acpi/dptf/int340x_thermal.c +@@ -13,10 +13,6 @@ + + #define INT3401_DEVICE 0X01 + static const struct acpi_device_id int340x_thermal_device_ids[] = { +- {"INT1040"}, +- {"INT1043"}, +- {"INT1044"}, +- {"INT1047"}, + {"INT3400"}, + {"INT3401", INT3401_DEVICE}, + {"INT3402"}, +@@ -28,6 +24,10 @@ static const struct acpi_device_id int340x_thermal_device_ids[] = { + {"INT3409"}, + {"INT340A"}, + {"INT340B"}, ++ {"INTC1040"}, ++ {"INTC1043"}, ++ {"INTC1044"}, ++ {"INTC1047"}, + {""}, + }; + +-- +2.20.1 + diff --git a/queue-5.6/acpica-fixes-for-acpiexec-namespace-init-file.patch b/queue-5.6/acpica-fixes-for-acpiexec-namespace-init-file.patch new file mode 100644 index 00000000000..988f9dd0a90 --- /dev/null +++ b/queue-5.6/acpica-fixes-for-acpiexec-namespace-init-file.patch @@ -0,0 +1,299 @@ +From 520b96de6bbf4398961f1d8c0c1921b158c29666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Mar 2020 15:21:09 -0700 +Subject: ACPICA: Fixes for acpiExec namespace init file + +From: Bob Moore + +[ Upstream commit 9a1ae80412dcaa67a29eecf19de44f32b5f1c357 ] + +This is the result of squashing the following ACPICA commit ID's: +6803997e5b4f3635cea6610b51ff69e29d251de3 +f31cdf8bfda22fe265c1a176d0e33d311c82a7f7 + +This change fixes several problems with the support for the +acpi_exec namespace init file (-fi option). Specifically, it +fixes AE_ALREADY_EXISTS errors, as well as various seg faults. + +Link: https://github.com/acpica/acpica/commit/f31cdf8b +Link: https://github.com/acpica/acpica/commit/6803997e +Signed-off-by: Bob Moore +Signed-off-by: Erik Kaneda +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/acnamesp.h | 2 ++ + drivers/acpi/acpica/dbinput.c | 16 +++++++--------- + drivers/acpi/acpica/dswexec.c | 33 ++++++++++++++++++++++++++++++++ + drivers/acpi/acpica/dswload.c | 2 -- + drivers/acpi/acpica/dswload2.c | 35 ++++++++++++++++++++++++++++++++++ + drivers/acpi/acpica/nsnames.c | 6 +----- + drivers/acpi/acpica/utdelete.c | 9 +++++---- + 7 files changed, 83 insertions(+), 20 deletions(-) + +diff --git a/drivers/acpi/acpica/acnamesp.h b/drivers/acpi/acpica/acnamesp.h +index e618ddfab2fd1..40f6a3c33a150 100644 +--- a/drivers/acpi/acpica/acnamesp.h ++++ b/drivers/acpi/acpica/acnamesp.h +@@ -256,6 +256,8 @@ u32 + acpi_ns_build_normalized_path(struct acpi_namespace_node *node, + char *full_path, u32 path_size, u8 no_trailing); + ++void acpi_ns_normalize_pathname(char *original_path); ++ + char *acpi_ns_get_normalized_pathname(struct acpi_namespace_node *node, + u8 no_trailing); + +diff --git a/drivers/acpi/acpica/dbinput.c b/drivers/acpi/acpica/dbinput.c +index aa71f65395d25..ee6a1b77af3f1 100644 +--- a/drivers/acpi/acpica/dbinput.c ++++ b/drivers/acpi/acpica/dbinput.c +@@ -468,16 +468,14 @@ char *acpi_db_get_next_token(char *string, + return (NULL); + } + +- /* Remove any spaces at the beginning */ ++ /* Remove any spaces at the beginning, ignore blank lines */ + +- if (*string == ' ') { +- while (*string && (*string == ' ')) { +- string++; +- } ++ while (*string && isspace(*string)) { ++ string++; ++ } + +- if (!(*string)) { +- return (NULL); +- } ++ if (!(*string)) { ++ return (NULL); + } + + switch (*string) { +@@ -570,7 +568,7 @@ char *acpi_db_get_next_token(char *string, + + /* Find end of token */ + +- while (*string && (*string != ' ')) { ++ while (*string && !isspace(*string)) { + string++; + } + break; +diff --git a/drivers/acpi/acpica/dswexec.c b/drivers/acpi/acpica/dswexec.c +index 5e81a1ae44cff..1d4f8c81028c2 100644 +--- a/drivers/acpi/acpica/dswexec.c ++++ b/drivers/acpi/acpica/dswexec.c +@@ -16,6 +16,9 @@ + #include "acinterp.h" + #include "acnamesp.h" + #include "acdebug.h" ++#ifdef ACPI_EXEC_APP ++#include "aecommon.h" ++#endif + + #define _COMPONENT ACPI_DISPATCHER + ACPI_MODULE_NAME("dswexec") +@@ -329,6 +332,10 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state) + u32 op_class; + union acpi_parse_object *next_op; + union acpi_parse_object *first_arg; ++#ifdef ACPI_EXEC_APP ++ char *namepath; ++ union acpi_operand_object *obj_desc; ++#endif + + ACPI_FUNCTION_TRACE_PTR(ds_exec_end_op, walk_state); + +@@ -537,6 +544,32 @@ acpi_status acpi_ds_exec_end_op(struct acpi_walk_state *walk_state) + + status = + acpi_ds_eval_buffer_field_operands(walk_state, op); ++ if (ACPI_FAILURE(status)) { ++ break; ++ } ++#ifdef ACPI_EXEC_APP ++ /* ++ * acpi_exec support for namespace initialization file (initialize ++ * buffer_fields in this code.) ++ */ ++ namepath = ++ acpi_ns_get_external_pathname(op->common.node); ++ status = ae_lookup_init_file_entry(namepath, &obj_desc); ++ if (ACPI_SUCCESS(status)) { ++ status = ++ acpi_ex_write_data_to_field(obj_desc, ++ op->common. ++ node->object, ++ NULL); ++ if ACPI_FAILURE ++ (status) { ++ ACPI_EXCEPTION((AE_INFO, status, ++ "While writing to buffer field")); ++ } ++ } ++ ACPI_FREE(namepath); ++ status = AE_OK; ++#endif + break; + + case AML_TYPE_CREATE_OBJECT: +diff --git a/drivers/acpi/acpica/dswload.c b/drivers/acpi/acpica/dswload.c +index 697974e37edfb..27069325b6de0 100644 +--- a/drivers/acpi/acpica/dswload.c ++++ b/drivers/acpi/acpica/dswload.c +@@ -14,7 +14,6 @@ + #include "acdispat.h" + #include "acinterp.h" + #include "acnamesp.h" +- + #ifdef ACPI_ASL_COMPILER + #include "acdisasm.h" + #endif +@@ -399,7 +398,6 @@ acpi_status acpi_ds_load1_end_op(struct acpi_walk_state *walk_state) + union acpi_parse_object *op; + acpi_object_type object_type; + acpi_status status = AE_OK; +- + #ifdef ACPI_ASL_COMPILER + u8 param_count; + #endif +diff --git a/drivers/acpi/acpica/dswload2.c b/drivers/acpi/acpica/dswload2.c +index b31457ca926cc..edadbe1465069 100644 +--- a/drivers/acpi/acpica/dswload2.c ++++ b/drivers/acpi/acpica/dswload2.c +@@ -15,6 +15,9 @@ + #include "acinterp.h" + #include "acnamesp.h" + #include "acevents.h" ++#ifdef ACPI_EXEC_APP ++#include "aecommon.h" ++#endif + + #define _COMPONENT ACPI_DISPATCHER + ACPI_MODULE_NAME("dswload2") +@@ -373,6 +376,10 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state) + struct acpi_namespace_node *new_node; + u32 i; + u8 region_space; ++#ifdef ACPI_EXEC_APP ++ union acpi_operand_object *obj_desc; ++ char *namepath; ++#endif + + ACPI_FUNCTION_TRACE(ds_load2_end_op); + +@@ -466,6 +473,11 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state) + * be evaluated later during the execution phase + */ + status = acpi_ds_create_buffer_field(op, walk_state); ++ if (ACPI_FAILURE(status)) { ++ ACPI_EXCEPTION((AE_INFO, status, ++ "CreateBufferField failure")); ++ goto cleanup; ++ } + break; + + case AML_TYPE_NAMED_FIELD: +@@ -604,6 +616,29 @@ acpi_status acpi_ds_load2_end_op(struct acpi_walk_state *walk_state) + case AML_NAME_OP: + + status = acpi_ds_create_node(walk_state, node, op); ++ if (ACPI_FAILURE(status)) { ++ goto cleanup; ++ } ++#ifdef ACPI_EXEC_APP ++ /* ++ * acpi_exec support for namespace initialization file (initialize ++ * Name opcodes in this code.) ++ */ ++ namepath = acpi_ns_get_external_pathname(node); ++ status = ae_lookup_init_file_entry(namepath, &obj_desc); ++ if (ACPI_SUCCESS(status)) { ++ ++ /* Detach any existing object, attach new object */ ++ ++ if (node->object) { ++ acpi_ns_detach_object(node); ++ } ++ acpi_ns_attach_object(node, obj_desc, ++ obj_desc->common.type); ++ } ++ ACPI_FREE(namepath); ++ status = AE_OK; ++#endif + break; + + case AML_METHOD_OP: +diff --git a/drivers/acpi/acpica/nsnames.c b/drivers/acpi/acpica/nsnames.c +index 370bbc8677453..c717fff7d9b57 100644 +--- a/drivers/acpi/acpica/nsnames.c ++++ b/drivers/acpi/acpica/nsnames.c +@@ -13,9 +13,6 @@ + #define _COMPONENT ACPI_NAMESPACE + ACPI_MODULE_NAME("nsnames") + +-/* Local Prototypes */ +-static void acpi_ns_normalize_pathname(char *original_path); +- + /******************************************************************************* + * + * FUNCTION: acpi_ns_get_external_pathname +@@ -30,7 +27,6 @@ static void acpi_ns_normalize_pathname(char *original_path); + * for error and debug statements. + * + ******************************************************************************/ +- + char *acpi_ns_get_external_pathname(struct acpi_namespace_node *node) + { + char *name_buffer; +@@ -411,7 +407,7 @@ char *acpi_ns_build_prefixed_pathname(union acpi_generic_state *prefix_scope, + * + ******************************************************************************/ + +-static void acpi_ns_normalize_pathname(char *original_path) ++void acpi_ns_normalize_pathname(char *original_path) + { + char *input_path = original_path; + char *new_path_buffer; +diff --git a/drivers/acpi/acpica/utdelete.c b/drivers/acpi/acpica/utdelete.c +index eee263cb7beb0..c365faf4e6cd4 100644 +--- a/drivers/acpi/acpica/utdelete.c ++++ b/drivers/acpi/acpica/utdelete.c +@@ -452,13 +452,13 @@ acpi_ut_update_ref_count(union acpi_operand_object *object, u32 action) + * + * FUNCTION: acpi_ut_update_object_reference + * +- * PARAMETERS: object - Increment ref count for this object +- * and all sub-objects ++ * PARAMETERS: object - Increment or decrement the ref count for ++ * this object and all sub-objects + * action - Either REF_INCREMENT or REF_DECREMENT + * + * RETURN: Status + * +- * DESCRIPTION: Increment the object reference count ++ * DESCRIPTION: Increment or decrement the object reference count + * + * Object references are incremented when: + * 1) An object is attached to a Node (namespace object) +@@ -492,7 +492,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + } + + /* +- * All sub-objects must have their reference count incremented ++ * All sub-objects must have their reference count updated + * also. Different object types have different subobjects. + */ + switch (object->common.type) { +@@ -559,6 +559,7 @@ acpi_ut_update_object_reference(union acpi_operand_object *object, u16 action) + break; + } + } ++ + next_object = NULL; + break; + +-- +2.20.1 + diff --git a/queue-5.6/arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch b/queue-5.6/arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch new file mode 100644 index 00000000000..3c962c48c55 --- /dev/null +++ b/queue-5.6/arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch @@ -0,0 +1,74 @@ +From 15937473690b2107641dc36dd71d5184761c5c48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Mar 2020 18:46:47 +0100 +Subject: ARM: dts: rockchip: fix lvds-encoder ports subnode for + rk3188-bqedison2qc + +From: Johan Jonker + +[ Upstream commit 1a7e99599dffd836fcb720cdc0eaf3cd43d7af4a ] + +A test with the command below gives this error: + +arch/arm/boot/dts/rk3188-bqedison2qc.dt.yaml: lvds-encoder: +'ports' is a required property + +Fix error by adding a ports wrapper for port@0 and port@1 +inside the 'lvds-encoder' node for rk3188-bqedison2qc. + +make ARCH=arm dtbs_check +DT_SCHEMA_FILES=Documentation/devicetree/bindings/display/ +bridge/lvds-codec.yaml + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/20200316174647.5598-1-jbx6244@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3188-bqedison2qc.dts | 27 ++++++++++++++---------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts +index 8afb2fd5d9f1b..66a0ff196eb1f 100644 +--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts ++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts +@@ -58,20 +58,25 @@ + + lvds-encoder { + compatible = "ti,sn75lvds83", "lvds-encoder"; +- #address-cells = <1>; +- #size-cells = <0>; + +- port@0 { +- reg = <0>; +- lvds_in_vop0: endpoint { +- remote-endpoint = <&vop0_out_lvds>; ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ ++ lvds_in_vop0: endpoint { ++ remote-endpoint = <&vop0_out_lvds>; ++ }; + }; +- }; + +- port@1 { +- reg = <1>; +- lvds_out_panel: endpoint { +- remote-endpoint = <&panel_in_lvds>; ++ port@1 { ++ reg = <1>; ++ ++ lvds_out_panel: endpoint { ++ remote-endpoint = <&panel_in_lvds>; ++ }; + }; + }; + }; +-- +2.20.1 + diff --git a/queue-5.6/arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch b/queue-5.6/arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch new file mode 100644 index 00000000000..07c9fa1a388 --- /dev/null +++ b/queue-5.6/arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch @@ -0,0 +1,62 @@ +From 738b180f2f10a34b6a199b1e3c1bfd9b683d49e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Mar 2020 14:48:37 +0100 +Subject: ARM: dts: rockchip: fix vqmmc-supply property name for + rk3188-bqedison2qc + +From: Johan Jonker + +[ Upstream commit 9cd568dc588c5d168615bf34f325fabe33b2c9a0 ] + +A test with the command below does not detect all errors +in combination with 'additionalProperties: false' and +allOf: + - $ref: "synopsys-dw-mshc-common.yaml#" +allOf: + - $ref: "mmc-controller.yaml#" + +'additionalProperties' applies to all properties that are not +accounted-for by 'properties' or 'patternProperties' in +the immediate schema. + +First when we combine rockchip-dw-mshc.yaml, +synopsys-dw-mshc-common.yaml and mmc-controller.yaml it gives +this error: + +arch/arm/boot/dts/rk3188-bqedison2qc.dt.yaml: mmc@10218000: +'vmmcq-supply' does not match any of the regexes: +'^.*@[0-9]+$', +'^clk-phase-(legacy|sd-hs|mmc-(hs|hs[24]00|ddr52)| +uhs-(sdr(12|25|50|104)|ddr50))$', +'pinctrl-[0-9]+' + +'vmmcq-supply' is not a valid property name for mmc nodes. +Fix this error by renaming it to 'vqmmc-supply'. + +make ARCH=arm dtbs_check +DT_SCHEMA_FILES=Documentation/devicetree/bindings/mmc/rockchip-dw-mshc.yaml + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/20200307134841.13803-1-jbx6244@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3188-bqedison2qc.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/rk3188-bqedison2qc.dts b/arch/arm/boot/dts/rk3188-bqedison2qc.dts +index ad1afd403052a..8afb2fd5d9f1b 100644 +--- a/arch/arm/boot/dts/rk3188-bqedison2qc.dts ++++ b/arch/arm/boot/dts/rk3188-bqedison2qc.dts +@@ -465,7 +465,7 @@ + non-removable; + pinctrl-names = "default"; + pinctrl-0 = <&sd1_clk>, <&sd1_cmd>, <&sd1_bus4>; +- vmmcq-supply = <&vccio_wl>; ++ vqmmc-supply = <&vccio_wl>; + #address-cells = <1>; + #size-cells = <0>; + status = "okay"; +-- +2.20.1 + diff --git a/queue-5.6/arm64-dts-allwinner-a64-fix-display-clock-register-r.patch b/queue-5.6/arm64-dts-allwinner-a64-fix-display-clock-register-r.patch new file mode 100644 index 00000000000..33dc46fc82d --- /dev/null +++ b/queue-5.6/arm64-dts-allwinner-a64-fix-display-clock-register-r.patch @@ -0,0 +1,39 @@ +From e65c2528c99685229c6dac1a5e4d5e73bb305935 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jan 2020 00:20:10 +0100 +Subject: arm64: dts: allwinner: a64: Fix display clock register range + +From: Jernej Skrabec + +[ Upstream commit 3e9a1a8b7f811de3eb1445d72f68766b704ad17c ] + +Register range of display clocks is 0x10000, as it can be seen from +DE2 documentation. + +Fix it. + +Signed-off-by: Jernej Skrabec +Fixes: 2c796fc8f5dbd ("arm64: dts: allwinner: a64: add necessary device tree nodes for DE2 CCU") +[wens@csie.org: added fixes tag] +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +index 862b47dc9dc90..baa6f08dc1087 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-a64.dtsi +@@ -264,7 +264,7 @@ + + display_clocks: clock@0 { + compatible = "allwinner,sun50i-a64-de2-clk"; +- reg = <0x0 0x100000>; ++ reg = <0x0 0x10000>; + clocks = <&ccu CLK_BUS_DE>, + <&ccu CLK_DE>; + clock-names = "bus", +-- +2.20.1 + diff --git a/queue-5.6/arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch b/queue-5.6/arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch new file mode 100644 index 00000000000..570b7b3385b --- /dev/null +++ b/queue-5.6/arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch @@ -0,0 +1,44 @@ +From 4cfdc0b50581486d1d0d64e6bc35a6759d57a1d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 11:45:12 +0000 +Subject: arm64: dts: clearfog-gt-8k: set gigabit PHY reset deassert delay + +From: Russell King + +[ Upstream commit 46f94c7818e7ab82758fca74935ef3d454340b4e ] + +If the mv88e6xxx DSA driver is built as a module, it causes the +ethernet driver to re-probe when it's loaded. This in turn causes +the gigabit PHY to be momentarily reset and reprogrammed. However, +we attempt to reprogram the PHY immediately after deasserting reset, +and the PHY ignores the writes. + +This results in the PHY operating in the wrong mode, and the copper +link states down. + +Set a reset deassert delay of 10ms for the gigabit PHY to avoid this. + +Fixes: babc5544c293 ("arm64: dts: clearfog-gt-8k: 1G eth PHY reset signal") +Signed-off-by: Russell King +Acked-by: Baruch Siach +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts +index a211a046b2f2f..b90d78a5724b2 100644 +--- a/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts ++++ b/arch/arm64/boot/dts/marvell/armada-8040-clearfog-gt-8k.dts +@@ -367,6 +367,7 @@ + pinctrl-0 = <&cp0_copper_eth_phy_reset>; + reset-gpios = <&cp0_gpio2 11 GPIO_ACTIVE_LOW>; + reset-assert-us = <10000>; ++ reset-deassert-us = <10000>; + }; + + switch0: switch0@4 { +-- +2.20.1 + diff --git a/queue-5.6/arm64-dts-marvell-espressobin-add-ethernet-alias.patch b/queue-5.6/arm64-dts-marvell-espressobin-add-ethernet-alias.patch new file mode 100644 index 00000000000..3067da2d0cf --- /dev/null +++ b/queue-5.6/arm64-dts-marvell-espressobin-add-ethernet-alias.patch @@ -0,0 +1,40 @@ +From 35472088293dd16d45889bf738756659291d4369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 17:52:32 +0100 +Subject: arm64: dts: marvell: espressobin: add ethernet alias + +From: Tomasz Maciej Nowak + +[ Upstream commit 5253cb8c00a6f4356760efb38bca0e0393aa06de ] + +The maker of this board and its variants, stores MAC address in U-Boot +environment. Add alias for bootloader to recognise, to which ethernet +node inject the factory MAC address. + +Signed-off-by: Tomasz Maciej Nowak +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi +index 53b8ac55a7f3d..e5262dab28f58 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi +@@ -13,6 +13,12 @@ + #include "armada-372x.dtsi" + + / { ++ aliases { ++ ethernet0 = ð0; ++ serial0 = &uart0; ++ serial1 = &uart1; ++ }; ++ + chosen { + stdout-path = "serial0:115200n8"; + }; +-- +2.20.1 + diff --git a/queue-5.6/arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch b/queue-5.6/arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch new file mode 100644 index 00000000000..5dea47dfd8a --- /dev/null +++ b/queue-5.6/arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch @@ -0,0 +1,126 @@ +From 426660198c2030561a9c22a6459b043a2bce0e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 03:30:15 +0530 +Subject: arm64: dts: marvell: Fix cpu compatible for AP807-quad + +From: Amit Kucheria + +[ Upstream commit d136d2588b21b1a07515632ed61120c9f262909b ] + +make -k ARCH=arm64 dtbs_check shows the following errors. Fix them by +removing the "arm,armv8" compatible. + +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@0: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long CHECK +arch/arm64/boot/dts/renesas/r8a774a1-hihope-rzg2m-ex.dt.yaml +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@1: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@100: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@101: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9130-db.dt.yaml: +cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long + +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@0: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@1: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@100: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@101: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9131-db.dt.yaml: +cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long + +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@0: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@0: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@1: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@1: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@100: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@100: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@101: compatible: Additional items are not allowed ('arm,armv8' was +unexpected) +/home/amit/work/builds/build-check/arch/arm64/boot/dts/marvell/cn9132-db.dt.yaml: +cpu@101: compatible: ['arm,cortex-a72', 'arm,armv8'] is too long + +Signed-off-by: Amit Kucheria +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi b/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi +index 840466e143b47..68782f161f122 100644 +--- a/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-ap807-quad.dtsi +@@ -17,7 +17,7 @@ + + cpu0: cpu@0 { + device_type = "cpu"; +- compatible = "arm,cortex-a72", "arm,armv8"; ++ compatible = "arm,cortex-a72"; + reg = <0x000>; + enable-method = "psci"; + #cooling-cells = <2>; +@@ -32,7 +32,7 @@ + }; + cpu1: cpu@1 { + device_type = "cpu"; +- compatible = "arm,cortex-a72", "arm,armv8"; ++ compatible = "arm,cortex-a72"; + reg = <0x001>; + enable-method = "psci"; + #cooling-cells = <2>; +@@ -47,7 +47,7 @@ + }; + cpu2: cpu@100 { + device_type = "cpu"; +- compatible = "arm,cortex-a72", "arm,armv8"; ++ compatible = "arm,cortex-a72"; + reg = <0x100>; + enable-method = "psci"; + #cooling-cells = <2>; +@@ -62,7 +62,7 @@ + }; + cpu3: cpu@101 { + device_type = "cpu"; +- compatible = "arm,cortex-a72", "arm,armv8"; ++ compatible = "arm,cortex-a72"; + reg = <0x101>; + enable-method = "psci"; + #cooling-cells = <2>; +-- +2.20.1 + diff --git a/queue-5.6/arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch b/queue-5.6/arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch new file mode 100644 index 00000000000..008d60d0824 --- /dev/null +++ b/queue-5.6/arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch @@ -0,0 +1,132 @@ +From f4d8b06a8f5eaf8d51f1342b9964c49d086d669a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 23:40:50 +0530 +Subject: arm64: tegra: Add PCIe endpoint controllers nodes for Tegra194 + +From: Vidya Sagar + +[ Upstream commit 0c988b731e6430f0081991fdb4f63f7fc837df9a ] + +Add endpoint mode controllers nodes for the dual mode PCIe controllers +present in Tegra194 SoC. + +Signed-off-by: Vidya Sagar +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 99 ++++++++++++++++++++++++ + 1 file changed, 99 insertions(+) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index ccac43be12acc..844e7fac30c58 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -1481,6 +1481,105 @@ + 0x82000000 0x0 0x40000000 0x1f 0x40000000 0x0 0xc0000000>; /* non-prefetchable memory (3GB) */ + }; + ++ pcie_ep@14160000 { ++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; ++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; ++ reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */ ++ 0x00 0x36040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ ++ 0x00 0x36080000 0x0 0x00040000 /* DBI reg space (256K) */ ++ 0x14 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ ++ reg-names = "appl", "atu_dma", "dbi", "addr_space"; ++ ++ status = "disabled"; ++ ++ num-lanes = <4>; ++ num-ib-windows = <2>; ++ num-ob-windows = <8>; ++ ++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_4>; ++ clock-names = "core"; ++ ++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_4_APB>, ++ <&bpmp TEGRA194_RESET_PEX0_CORE_4>; ++ reset-names = "apb", "core"; ++ ++ interrupts = ; /* controller interrupt */ ++ interrupt-names = "intr"; ++ ++ nvidia,bpmp = <&bpmp 4>; ++ ++ nvidia,aspm-cmrt-us = <60>; ++ nvidia,aspm-pwr-on-t-us = <20>; ++ nvidia,aspm-l0s-entrance-latency-us = <3>; ++ }; ++ ++ pcie_ep@14180000 { ++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; ++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; ++ reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */ ++ 0x00 0x38040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ ++ 0x00 0x38080000 0x0 0x00040000 /* DBI reg space (256K) */ ++ 0x18 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ ++ reg-names = "appl", "atu_dma", "dbi", "addr_space"; ++ ++ status = "disabled"; ++ ++ num-lanes = <8>; ++ num-ib-windows = <2>; ++ num-ob-windows = <8>; ++ ++ clocks = <&bpmp TEGRA194_CLK_PEX0_CORE_0>; ++ clock-names = "core"; ++ ++ resets = <&bpmp TEGRA194_RESET_PEX0_CORE_0_APB>, ++ <&bpmp TEGRA194_RESET_PEX0_CORE_0>; ++ reset-names = "apb", "core"; ++ ++ interrupts = ; /* controller interrupt */ ++ interrupt-names = "intr"; ++ ++ nvidia,bpmp = <&bpmp 0>; ++ ++ nvidia,aspm-cmrt-us = <60>; ++ nvidia,aspm-pwr-on-t-us = <20>; ++ nvidia,aspm-l0s-entrance-latency-us = <3>; ++ }; ++ ++ pcie_ep@141a0000 { ++ compatible = "nvidia,tegra194-pcie-ep", "snps,dw-pcie-ep"; ++ power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; ++ reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */ ++ 0x00 0x3a040000 0x0 0x00040000 /* iATU_DMA reg space (256K) */ ++ 0x00 0x3a080000 0x0 0x00040000 /* DBI reg space (256K) */ ++ 0x1c 0x00000000 0x4 0x00000000>; /* Address Space (16G) */ ++ reg-names = "appl", "atu_dma", "dbi", "addr_space"; ++ ++ status = "disabled"; ++ ++ num-lanes = <8>; ++ num-ib-windows = <2>; ++ num-ob-windows = <8>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&clkreq_c5_bi_dir_state>; ++ ++ clocks = <&bpmp TEGRA194_CLK_PEX1_CORE_5>; ++ clock-names = "core"; ++ ++ resets = <&bpmp TEGRA194_RESET_PEX1_CORE_5_APB>, ++ <&bpmp TEGRA194_RESET_PEX1_CORE_5>; ++ reset-names = "apb", "core"; ++ ++ interrupts = ; /* controller interrupt */ ++ interrupt-names = "intr"; ++ ++ nvidia,bpmp = <&bpmp 5>; ++ ++ nvidia,aspm-cmrt-us = <60>; ++ nvidia,aspm-pwr-on-t-us = <20>; ++ nvidia,aspm-l0s-entrance-latency-us = <3>; ++ }; ++ + sysram@40000000 { + compatible = "nvidia,tegra194-sysram", "mmio-sram"; + reg = <0x0 0x40000000 0x0 0x50000>; +-- +2.20.1 + diff --git a/queue-5.6/arm64-tegra-fix-tegra194-pcie-compatible-string.patch b/queue-5.6/arm64-tegra-fix-tegra194-pcie-compatible-string.patch new file mode 100644 index 00000000000..fe31c21629a --- /dev/null +++ b/queue-5.6/arm64-tegra-fix-tegra194-pcie-compatible-string.patch @@ -0,0 +1,106 @@ +From 359388f61af037925311983963d05c7b7728db56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 13:53:53 +0000 +Subject: arm64: tegra: Fix Tegra194 PCIe compatible string + +From: Jon Hunter + +[ Upstream commit f9f711efd441ad0d22874be49986d92121862335 ] + +If the kernel configuration option CONFIG_PCIE_DW_PLAT_HOST is enabled +then this can cause the kernel to incorrectly probe the generic +designware PCIe platform driver instead of the Tegra194 designware PCIe +driver. This causes a boot failure on Tegra194 because the necessary +configuration to access the hardware is not performed. + +The order in which the compatible strings are populated in Device-Tree +is not relevant in this case, because the kernel will attempt to probe +the device as soon as a driver is loaded and if the generic designware +PCIe driver is loaded first, then this driver will be probed first. +Therefore, to fix this problem, remove the "snps,dw-pcie" string from +the compatible string as we never want this driver to be probe on +Tegra194. + +Fixes: 2602c32f15e7 ("arm64: tegra: Add P2U and PCIe controller nodes to Tegra194 DT") +Signed-off-by: Jon Hunter +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/pci/nvidia,tegra194-pcie.txt | 2 +- + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 12 ++++++------ + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt b/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt +index b739f92da58e5..1f90eb39870be 100644 +--- a/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt ++++ b/Documentation/devicetree/bindings/pci/nvidia,tegra194-pcie.txt +@@ -118,7 +118,7 @@ Tegra194: + -------- + + pcie@14180000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x38000000 0x0 0x00040000 /* configuration space (256K) */ +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index 844e7fac30c58..a8f024662e60e 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -1208,7 +1208,7 @@ + }; + + pcie@14100000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14100000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x30000000 0x0 0x00040000 /* configuration space (256K) */ +@@ -1253,7 +1253,7 @@ + }; + + pcie@14120000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14120000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x32000000 0x0 0x00040000 /* configuration space (256K) */ +@@ -1298,7 +1298,7 @@ + }; + + pcie@14140000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX1A>; + reg = <0x00 0x14140000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x34000000 0x0 0x00040000 /* configuration space (256K) */ +@@ -1343,7 +1343,7 @@ + }; + + pcie@14160000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX4A>; + reg = <0x00 0x14160000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x36000000 0x0 0x00040000 /* configuration space (256K) */ +@@ -1388,7 +1388,7 @@ + }; + + pcie@14180000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8B>; + reg = <0x00 0x14180000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x38000000 0x0 0x00040000 /* configuration space (256K) */ +@@ -1433,7 +1433,7 @@ + }; + + pcie@141a0000 { +- compatible = "nvidia,tegra194-pcie", "snps,dw-pcie"; ++ compatible = "nvidia,tegra194-pcie"; + power-domains = <&bpmp TEGRA194_POWER_DOMAIN_PCIEX8A>; + reg = <0x00 0x141a0000 0x0 0x00020000 /* appl registers (128K) */ + 0x00 0x3a000000 0x0 0x00040000 /* configuration space (256K) */ +-- +2.20.1 + diff --git a/queue-5.6/bpf-reliably-preserve-btf_trace_xxx-types.patch b/queue-5.6/bpf-reliably-preserve-btf_trace_xxx-types.patch new file mode 100644 index 00000000000..732aeadfaaa --- /dev/null +++ b/queue-5.6/bpf-reliably-preserve-btf_trace_xxx-types.patch @@ -0,0 +1,66 @@ +From 83fd2490448accf3e116fca47511305a32533e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Mar 2020 00:10:43 -0800 +Subject: bpf: Reliably preserve btf_trace_xxx types + +From: Andrii Nakryiko + +[ Upstream commit 441420a1f0b3031f228453697406c86f110e59d4 ] + +btf_trace_xxx types, crucial for tp_btf BPF programs (raw tracepoint with +verifier-checked direct memory access), have to be preserved in kernel BTF to +allow verifier do its job and enforce type/memory safety. It was reported +([0]) that for kernels built with Clang current type-casting approach doesn't +preserve these types. + +This patch fixes it by declaring an anonymous union for each registered +tracepoint, capturing both struct bpf_raw_event_map information, as well as +recording btf_trace_##call type reliably. Structurally, it's still the same +content as for a plain struct bpf_raw_event_map, so no other changes are +necessary. + + [0] https://github.com/iovisor/bcc/issues/2770#issuecomment-591007692 + +Fixes: e8c423fb31fa ("bpf: Add typecast to raw_tracepoints to help BTF generation") +Reported-by: Wenbo Zhang +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Yonghong Song +Link: https://lore.kernel.org/bpf/20200301081045.3491005-2-andriin@fb.com +Signed-off-by: Sasha Levin +--- + include/trace/bpf_probe.h | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/include/trace/bpf_probe.h b/include/trace/bpf_probe.h +index b04c292709730..1ce3be63add1f 100644 +--- a/include/trace/bpf_probe.h ++++ b/include/trace/bpf_probe.h +@@ -75,13 +75,17 @@ static inline void bpf_test_probe_##call(void) \ + check_trace_callback_type_##call(__bpf_trace_##template); \ + } \ + typedef void (*btf_trace_##call)(void *__data, proto); \ +-static struct bpf_raw_event_map __used \ +- __attribute__((section("__bpf_raw_tp_map"))) \ +-__bpf_trace_tp_map_##call = { \ +- .tp = &__tracepoint_##call, \ +- .bpf_func = (void *)(btf_trace_##call)__bpf_trace_##template, \ +- .num_args = COUNT_ARGS(args), \ +- .writable_size = size, \ ++static union { \ ++ struct bpf_raw_event_map event; \ ++ btf_trace_##call handler; \ ++} __bpf_trace_tp_map_##call __used \ ++__attribute__((section("__bpf_raw_tp_map"))) = { \ ++ .event = { \ ++ .tp = &__tracepoint_##call, \ ++ .bpf_func = __bpf_trace_##template, \ ++ .num_args = COUNT_ARGS(args), \ ++ .writable_size = size, \ ++ }, \ + }; + + #define FIRST(x, ...) x +-- +2.20.1 + diff --git a/queue-5.6/btrfs-add-rcu-locks-around-block-group-initializatio.patch b/queue-5.6/btrfs-add-rcu-locks-around-block-group-initializatio.patch new file mode 100644 index 00000000000..acd292fb61d --- /dev/null +++ b/queue-5.6/btrfs-add-rcu-locks-around-block-group-initializatio.patch @@ -0,0 +1,57 @@ +From fe9d2d4b67bf8818840c9c40c1f3f93cbc0b64d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 12:22:43 +0530 +Subject: btrfs: add RCU locks around block group initialization + +From: Madhuparna Bhowmik + +[ Upstream commit 29566c9c773456467933ee22bbca1c2b72a3506c ] + +The space_info list is normally RCU protected and should be traversed +with rcu_read_lock held. There's a warning + + [29.104756] WARNING: suspicious RCU usage + [29.105046] 5.6.0-rc4-next-20200305 #1 Not tainted + [29.105231] ----------------------------- + [29.105401] fs/btrfs/block-group.c:2011 RCU-list traversed in non-reader section!! + +pointing out that the locking is missing in btrfs_read_block_groups. +However this is not necessary as the list traversal happens at mount +time when there's no other thread potentially accessing the list. + +To fix the warning and for consistency let's add the RCU lock/unlock, +the code won't be affected much as it's doing some lightweight +operations. + +Reported-by: Guenter Roeck +Signed-off-by: Madhuparna Bhowmik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-group.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index 7f09147872dc7..c9a3bbc8c6afb 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1987,6 +1987,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info) + btrfs_release_path(path); + } + ++ rcu_read_lock(); + list_for_each_entry_rcu(space_info, &info->space_info, list) { + if (!(btrfs_get_alloc_profile(info, space_info->flags) & + (BTRFS_BLOCK_GROUP_RAID10 | +@@ -2007,6 +2008,7 @@ int btrfs_read_block_groups(struct btrfs_fs_info *info) + list) + inc_block_group_ro(cache, 1); + } ++ rcu_read_unlock(); + + btrfs_init_global_block_rsv(info); + ret = check_chunk_block_group_mappings(info); +-- +2.20.1 + diff --git a/queue-5.6/ceph-re-org-copy_file_range-and-fix-some-error-paths.patch b/queue-5.6/ceph-re-org-copy_file_range-and-fix-some-error-paths.patch new file mode 100644 index 00000000000..ffa7c9eb869 --- /dev/null +++ b/queue-5.6/ceph-re-org-copy_file_range-and-fix-some-error-paths.patch @@ -0,0 +1,289 @@ +From dd4b3d14f01fdd5bcefdf924887b76c5aef0bc6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2020 13:44:32 +0000 +Subject: ceph: re-org copy_file_range and fix some error paths + +From: Luis Henriques + +[ Upstream commit 1b0c3b9f91f0df03088d293fc9e62743fd789ad2 ] + +This patch re-organizes copy_file_range, trying to fix a few issues in the +error handling. Here's the summary: + +- Abort copy if initial do_splice_direct() returns fewer bytes than + requested. + +- Move the 'size' initialization (with i_size_read()) further down in the + code, after the initial call to do_splice_direct(). This avoids issues + with a possibly stale value if a manual copy is done. + +- Move the object copy loop into a separate function. This makes it + easier to handle errors (e.g, dirtying caps and updating the MDS + metadata if only some objects have been copied before an error has + occurred). + +- Added calls to ceph_oloc_destroy() to avoid leaking memory with src_oloc + and dst_oloc + +- After the object copy loop, the new file size to be reported to the MDS + (if there's file size change) is now the actual file size, and not the + size after an eventual extra manual copy. + +- Added a few dout() to show the number of bytes copied in the two manual + copies and in the object copy loop. + +Signed-off-by: Luis Henriques +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/file.c | 173 ++++++++++++++++++++++++++++--------------------- + 1 file changed, 100 insertions(+), 73 deletions(-) + +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 5a478cd06e113..7f8c4e3083018 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -1944,6 +1944,71 @@ static int is_file_size_ok(struct inode *src_inode, struct inode *dst_inode, + return 0; + } + ++static ssize_t ceph_do_objects_copy(struct ceph_inode_info *src_ci, u64 *src_off, ++ struct ceph_inode_info *dst_ci, u64 *dst_off, ++ struct ceph_fs_client *fsc, ++ size_t len, unsigned int flags) ++{ ++ struct ceph_object_locator src_oloc, dst_oloc; ++ struct ceph_object_id src_oid, dst_oid; ++ size_t bytes = 0; ++ u64 src_objnum, src_objoff, dst_objnum, dst_objoff; ++ u32 src_objlen, dst_objlen; ++ u32 object_size = src_ci->i_layout.object_size; ++ int ret; ++ ++ src_oloc.pool = src_ci->i_layout.pool_id; ++ src_oloc.pool_ns = ceph_try_get_string(src_ci->i_layout.pool_ns); ++ dst_oloc.pool = dst_ci->i_layout.pool_id; ++ dst_oloc.pool_ns = ceph_try_get_string(dst_ci->i_layout.pool_ns); ++ ++ while (len >= object_size) { ++ ceph_calc_file_object_mapping(&src_ci->i_layout, *src_off, ++ object_size, &src_objnum, ++ &src_objoff, &src_objlen); ++ ceph_calc_file_object_mapping(&dst_ci->i_layout, *dst_off, ++ object_size, &dst_objnum, ++ &dst_objoff, &dst_objlen); ++ ceph_oid_init(&src_oid); ++ ceph_oid_printf(&src_oid, "%llx.%08llx", ++ src_ci->i_vino.ino, src_objnum); ++ ceph_oid_init(&dst_oid); ++ ceph_oid_printf(&dst_oid, "%llx.%08llx", ++ dst_ci->i_vino.ino, dst_objnum); ++ /* Do an object remote copy */ ++ ret = ceph_osdc_copy_from(&fsc->client->osdc, ++ src_ci->i_vino.snap, 0, ++ &src_oid, &src_oloc, ++ CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL | ++ CEPH_OSD_OP_FLAG_FADVISE_NOCACHE, ++ &dst_oid, &dst_oloc, ++ CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL | ++ CEPH_OSD_OP_FLAG_FADVISE_DONTNEED, ++ dst_ci->i_truncate_seq, ++ dst_ci->i_truncate_size, ++ CEPH_OSD_COPY_FROM_FLAG_TRUNCATE_SEQ); ++ if (ret) { ++ if (ret == -EOPNOTSUPP) { ++ fsc->have_copy_from2 = false; ++ pr_notice("OSDs don't support copy-from2; disabling copy offload\n"); ++ } ++ dout("ceph_osdc_copy_from returned %d\n", ret); ++ if (!bytes) ++ bytes = ret; ++ goto out; ++ } ++ len -= object_size; ++ bytes += object_size; ++ *src_off += object_size; ++ *dst_off += object_size; ++ } ++ ++out: ++ ceph_oloc_destroy(&src_oloc); ++ ceph_oloc_destroy(&dst_oloc); ++ return bytes; ++} ++ + static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + struct file *dst_file, loff_t dst_off, + size_t len, unsigned int flags) +@@ -1954,14 +2019,11 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + struct ceph_inode_info *dst_ci = ceph_inode(dst_inode); + struct ceph_cap_flush *prealloc_cf; + struct ceph_fs_client *src_fsc = ceph_inode_to_client(src_inode); +- struct ceph_object_locator src_oloc, dst_oloc; +- struct ceph_object_id src_oid, dst_oid; +- loff_t endoff = 0, size; +- ssize_t ret = -EIO; ++ loff_t size; ++ ssize_t ret = -EIO, bytes; + u64 src_objnum, dst_objnum, src_objoff, dst_objoff; +- u32 src_objlen, dst_objlen, object_size; ++ u32 src_objlen, dst_objlen; + int src_got = 0, dst_got = 0, err, dirty; +- bool do_final_copy = false; + + if (src_inode->i_sb != dst_inode->i_sb) { + struct ceph_fs_client *dst_fsc = ceph_inode_to_client(dst_inode); +@@ -2039,22 +2101,14 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + if (ret < 0) + goto out_caps; + +- size = i_size_read(dst_inode); +- endoff = dst_off + len; +- + /* Drop dst file cached pages */ + ret = invalidate_inode_pages2_range(dst_inode->i_mapping, + dst_off >> PAGE_SHIFT, +- endoff >> PAGE_SHIFT); ++ (dst_off + len) >> PAGE_SHIFT); + if (ret < 0) { + dout("Failed to invalidate inode pages (%zd)\n", ret); + ret = 0; /* XXX */ + } +- src_oloc.pool = src_ci->i_layout.pool_id; +- src_oloc.pool_ns = ceph_try_get_string(src_ci->i_layout.pool_ns); +- dst_oloc.pool = dst_ci->i_layout.pool_id; +- dst_oloc.pool_ns = ceph_try_get_string(dst_ci->i_layout.pool_ns); +- + ceph_calc_file_object_mapping(&src_ci->i_layout, src_off, + src_ci->i_layout.object_size, + &src_objnum, &src_objoff, &src_objlen); +@@ -2073,6 +2127,8 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + * starting at the src_off + */ + if (src_objoff) { ++ dout("Initial partial copy of %u bytes\n", src_objlen); ++ + /* + * we need to temporarily drop all caps as we'll be calling + * {read,write}_iter, which will get caps again. +@@ -2080,8 +2136,9 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + put_rd_wr_caps(src_ci, src_got, dst_ci, dst_got); + ret = do_splice_direct(src_file, &src_off, dst_file, + &dst_off, src_objlen, flags); +- if (ret < 0) { +- dout("do_splice_direct returned %d\n", err); ++ /* Abort on short copies or on error */ ++ if (ret < src_objlen) { ++ dout("Failed partial copy (%zd)\n", ret); + goto out; + } + len -= ret; +@@ -2094,62 +2151,29 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + if (err < 0) + goto out_caps; + } +- object_size = src_ci->i_layout.object_size; +- while (len >= object_size) { +- ceph_calc_file_object_mapping(&src_ci->i_layout, src_off, +- object_size, &src_objnum, +- &src_objoff, &src_objlen); +- ceph_calc_file_object_mapping(&dst_ci->i_layout, dst_off, +- object_size, &dst_objnum, +- &dst_objoff, &dst_objlen); +- ceph_oid_init(&src_oid); +- ceph_oid_printf(&src_oid, "%llx.%08llx", +- src_ci->i_vino.ino, src_objnum); +- ceph_oid_init(&dst_oid); +- ceph_oid_printf(&dst_oid, "%llx.%08llx", +- dst_ci->i_vino.ino, dst_objnum); +- /* Do an object remote copy */ +- err = ceph_osdc_copy_from( +- &src_fsc->client->osdc, +- src_ci->i_vino.snap, 0, +- &src_oid, &src_oloc, +- CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL | +- CEPH_OSD_OP_FLAG_FADVISE_NOCACHE, +- &dst_oid, &dst_oloc, +- CEPH_OSD_OP_FLAG_FADVISE_SEQUENTIAL | +- CEPH_OSD_OP_FLAG_FADVISE_DONTNEED, +- dst_ci->i_truncate_seq, dst_ci->i_truncate_size, +- CEPH_OSD_COPY_FROM_FLAG_TRUNCATE_SEQ); +- if (err) { +- if (err == -EOPNOTSUPP) { +- src_fsc->have_copy_from2 = false; +- pr_notice("OSDs don't support copy-from2; disabling copy offload\n"); +- } +- dout("ceph_osdc_copy_from returned %d\n", err); +- if (!ret) +- ret = err; +- goto out_caps; +- } +- len -= object_size; +- src_off += object_size; +- dst_off += object_size; +- ret += object_size; +- } + +- if (len) +- /* We still need one final local copy */ +- do_final_copy = true; ++ size = i_size_read(dst_inode); ++ bytes = ceph_do_objects_copy(src_ci, &src_off, dst_ci, &dst_off, ++ src_fsc, len, flags); ++ if (bytes <= 0) { ++ if (!ret) ++ ret = bytes; ++ goto out_caps; ++ } ++ dout("Copied %zu bytes out of %zu\n", bytes, len); ++ len -= bytes; ++ ret += bytes; + + file_update_time(dst_file); + inode_inc_iversion_raw(dst_inode); + +- if (endoff > size) { ++ if (dst_off > size) { + int caps_flags = 0; + + /* Let the MDS know about dst file size change */ +- if (ceph_quota_is_max_bytes_approaching(dst_inode, endoff)) ++ if (ceph_quota_is_max_bytes_approaching(dst_inode, dst_off)) + caps_flags |= CHECK_CAPS_NODELAY; +- if (ceph_inode_set_size(dst_inode, endoff)) ++ if (ceph_inode_set_size(dst_inode, dst_off)) + caps_flags |= CHECK_CAPS_AUTHONLY; + if (caps_flags) + ceph_check_caps(dst_ci, caps_flags, NULL); +@@ -2165,15 +2189,18 @@ static ssize_t __ceph_copy_file_range(struct file *src_file, loff_t src_off, + out_caps: + put_rd_wr_caps(src_ci, src_got, dst_ci, dst_got); + +- if (do_final_copy) { +- err = do_splice_direct(src_file, &src_off, dst_file, +- &dst_off, len, flags); +- if (err < 0) { +- dout("do_splice_direct returned %d\n", err); +- goto out; +- } +- len -= err; +- ret += err; ++ /* ++ * Do the final manual copy if we still have some bytes left, unless ++ * there were errors in remote object copies (len >= object_size). ++ */ ++ if (len && (len < src_ci->i_layout.object_size)) { ++ dout("Final partial copy of %zu bytes\n", len); ++ bytes = do_splice_direct(src_file, &src_off, dst_file, ++ &dst_off, len, flags); ++ if (bytes > 0) ++ ret += bytes; ++ else ++ dout("Failed partial copy (%zd)\n", bytes); + } + + out: +-- +2.20.1 + diff --git a/queue-5.6/cifs-allocate-encryption-header-through-kmalloc.patch b/queue-5.6/cifs-allocate-encryption-header-through-kmalloc.patch new file mode 100644 index 00000000000..ea89d4aa9a1 --- /dev/null +++ b/queue-5.6/cifs-allocate-encryption-header-through-kmalloc.patch @@ -0,0 +1,83 @@ +From 851d2d8ac583131b5c30c6d51122c81c9e482515 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Mar 2020 22:09:20 -0700 +Subject: cifs: Allocate encryption header through kmalloc + +From: Long Li + +[ Upstream commit 3946d0d04bb360acca72db5efe9ae8440012d9dc ] + +When encryption is used, smb2_transform_hdr is defined on the stack and is +passed to the transport. This doesn't work with RDMA as the buffer needs to +be DMA'ed. + +Fix it by using kmalloc. + +Signed-off-by: Long Li +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/transport.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index cb3ee916f5275..c97570eb2c180 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -466,7 +466,7 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + struct smb_rqst *rqst, int flags) + { + struct kvec iov; +- struct smb2_transform_hdr tr_hdr; ++ struct smb2_transform_hdr *tr_hdr; + struct smb_rqst cur_rqst[MAX_COMPOUND]; + int rc; + +@@ -476,28 +476,34 @@ smb_send_rqst(struct TCP_Server_Info *server, int num_rqst, + if (num_rqst > MAX_COMPOUND - 1) + return -ENOMEM; + +- memset(&cur_rqst[0], 0, sizeof(cur_rqst)); +- memset(&iov, 0, sizeof(iov)); +- memset(&tr_hdr, 0, sizeof(tr_hdr)); +- +- iov.iov_base = &tr_hdr; +- iov.iov_len = sizeof(tr_hdr); +- cur_rqst[0].rq_iov = &iov; +- cur_rqst[0].rq_nvec = 1; +- + if (!server->ops->init_transform_rq) { + cifs_server_dbg(VFS, "Encryption requested but transform " + "callback is missing\n"); + return -EIO; + } + ++ tr_hdr = kmalloc(sizeof(*tr_hdr), GFP_NOFS); ++ if (!tr_hdr) ++ return -ENOMEM; ++ ++ memset(&cur_rqst[0], 0, sizeof(cur_rqst)); ++ memset(&iov, 0, sizeof(iov)); ++ memset(tr_hdr, 0, sizeof(*tr_hdr)); ++ ++ iov.iov_base = tr_hdr; ++ iov.iov_len = sizeof(*tr_hdr); ++ cur_rqst[0].rq_iov = &iov; ++ cur_rqst[0].rq_nvec = 1; ++ + rc = server->ops->init_transform_rq(server, num_rqst + 1, + &cur_rqst[0], rqst); + if (rc) +- return rc; ++ goto out; + + rc = __smb_send_rqst(server, num_rqst + 1, &cur_rqst[0]); + smb3_free_compound_rqst(num_rqst, &cur_rqst[1]); ++out: ++ kfree(tr_hdr); + return rc; + } + +-- +2.20.1 + diff --git a/queue-5.6/clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch b/queue-5.6/clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch new file mode 100644 index 00000000000..8ff765ac759 --- /dev/null +++ b/queue-5.6/clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch @@ -0,0 +1,49 @@ +From 03bfd25c82cb6d0118b1c00d12d02620e8e8b7a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jan 2020 13:36:46 +0200 +Subject: clk: at91: usb: continue if clk_hw_round_rate() return zero + +From: Claudiu Beznea + +[ Upstream commit b0ecf1c6c6e82da4847900fad0272abfd014666d ] + +clk_hw_round_rate() may call round rate function of its parents. In case +of SAM9X60 two of USB parrents are PLLA and UPLL. These clocks are +controlled by clk-sam9x60-pll.c driver. The round rate function for this +driver is sam9x60_pll_round_rate() which call in turn +sam9x60_pll_get_best_div_mul(). In case the requested rate is not in the +proper range (rate < characteristics->output[0].min && +rate > characteristics->output[0].max) the sam9x60_pll_round_rate() will +return a negative number to its caller (called by +clk_core_round_rate_nolock()). clk_hw_round_rate() will return zero in +case a negative number is returned by clk_core_round_rate_nolock(). With +this, the USB clock will continue its rate computation even caller of +clk_hw_round_rate() returned an error. With this, the USB clock on SAM9X60 +may not chose the best parent. I detected this after a suspend/resume +cycle on SAM9X60. + +Signed-off-by: Claudiu Beznea +Link: https://lkml.kernel.org/r/1579261009-4573-2-git-send-email-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/at91/clk-usb.c b/drivers/clk/at91/clk-usb.c +index bda92980e0155..c0895c993cce2 100644 +--- a/drivers/clk/at91/clk-usb.c ++++ b/drivers/clk/at91/clk-usb.c +@@ -75,6 +75,9 @@ static int at91sam9x5_clk_usb_determine_rate(struct clk_hw *hw, + tmp_parent_rate = req->rate * div; + tmp_parent_rate = clk_hw_round_rate(parent, + tmp_parent_rate); ++ if (!tmp_parent_rate) ++ continue; ++ + tmp_rate = DIV_ROUND_CLOSEST(tmp_parent_rate, div); + if (tmp_rate < req->rate) + tmp_diff = req->rate - tmp_rate; +-- +2.20.1 + diff --git a/queue-5.6/clk-don-t-cache-errors-from-clk_ops-get_phase.patch b/queue-5.6/clk-don-t-cache-errors-from-clk_ops-get_phase.patch new file mode 100644 index 00000000000..1776677ad70 --- /dev/null +++ b/queue-5.6/clk-don-t-cache-errors-from-clk_ops-get_phase.patch @@ -0,0 +1,134 @@ +From c33f3bb815df1ff63e56f6358423a61da746f5ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2020 15:27:59 -0800 +Subject: clk: Don't cache errors from clk_ops::get_phase() + +From: Stephen Boyd + +[ Upstream commit f21cf9c77ee82ef8adfeb2143adfacf21ec1d5cc ] + +We don't check for errors from clk_ops::get_phase() before storing away +the result into the clk_core::phase member. This can lead to some fairly +confusing debugfs information if these ops do return an error. Let's +skip the store when this op fails to fix this. While we're here, move +the locking outside of clk_core_get_phase() to simplify callers from +the debugfs side. + +Cc: Douglas Anderson +Cc: Heiko Stuebner +Cc: Jerome Brunet +Signed-off-by: Stephen Boyd +Link: https://lkml.kernel.org/r/20200205232802.29184-2-sboyd@kernel.org +Acked-by: Jerome Brunet +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 48 +++++++++++++++++++++++++++++++---------------- + 1 file changed, 32 insertions(+), 16 deletions(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 95adf6c6db3db..305544b68b8a7 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2660,12 +2660,14 @@ static int clk_core_get_phase(struct clk_core *core) + { + int ret; + +- clk_prepare_lock(); ++ lockdep_assert_held(&prepare_lock); ++ if (!core->ops->get_phase) ++ return 0; ++ + /* Always try to update cached phase if possible */ +- if (core->ops->get_phase) +- core->phase = core->ops->get_phase(core->hw); +- ret = core->phase; +- clk_prepare_unlock(); ++ ret = core->ops->get_phase(core->hw); ++ if (ret >= 0) ++ core->phase = ret; + + return ret; + } +@@ -2679,10 +2681,16 @@ static int clk_core_get_phase(struct clk_core *core) + */ + int clk_get_phase(struct clk *clk) + { ++ int ret; ++ + if (!clk) + return 0; + +- return clk_core_get_phase(clk->core); ++ clk_prepare_lock(); ++ ret = clk_core_get_phase(clk->core); ++ clk_prepare_unlock(); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(clk_get_phase); + +@@ -2896,13 +2904,21 @@ static struct hlist_head *orphan_list[] = { + static void clk_summary_show_one(struct seq_file *s, struct clk_core *c, + int level) + { +- seq_printf(s, "%*s%-*s %7d %8d %8d %11lu %10lu %5d %6d\n", ++ int phase; ++ ++ seq_printf(s, "%*s%-*s %7d %8d %8d %11lu %10lu ", + level * 3 + 1, "", + 30 - level * 3, c->name, + c->enable_count, c->prepare_count, c->protect_count, +- clk_core_get_rate(c), clk_core_get_accuracy(c), +- clk_core_get_phase(c), +- clk_core_get_scaled_duty_cycle(c, 100000)); ++ clk_core_get_rate(c), clk_core_get_accuracy(c)); ++ ++ phase = clk_core_get_phase(c); ++ if (phase >= 0) ++ seq_printf(s, "%5d", phase); ++ else ++ seq_puts(s, "-----"); ++ ++ seq_printf(s, " %6d\n", clk_core_get_scaled_duty_cycle(c, 100000)); + } + + static void clk_summary_show_subtree(struct seq_file *s, struct clk_core *c, +@@ -2939,6 +2955,7 @@ DEFINE_SHOW_ATTRIBUTE(clk_summary); + + static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + { ++ int phase; + unsigned long min_rate, max_rate; + + clk_core_get_boundaries(c, &min_rate, &max_rate); +@@ -2952,7 +2969,9 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level) + seq_printf(s, "\"min_rate\": %lu,", min_rate); + seq_printf(s, "\"max_rate\": %lu,", max_rate); + seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c)); +- seq_printf(s, "\"phase\": %d,", clk_core_get_phase(c)); ++ phase = clk_core_get_phase(c); ++ if (phase >= 0) ++ seq_printf(s, "\"phase\": %d,", phase); + seq_printf(s, "\"duty_cycle\": %u", + clk_core_get_scaled_duty_cycle(c, 100000)); + } +@@ -3434,14 +3453,11 @@ static int __clk_core_init(struct clk_core *core) + core->accuracy = 0; + + /* +- * Set clk's phase. ++ * Set clk's phase by clk_core_get_phase() caching the phase. + * Since a phase is by definition relative to its parent, just + * query the current clock phase, or just assume it's in phase. + */ +- if (core->ops->get_phase) +- core->phase = core->ops->get_phase(core->hw); +- else +- core->phase = 0; ++ clk_core_get_phase(core); + + /* + * Set clk's duty cycle. +-- +2.20.1 + diff --git a/queue-5.6/clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch b/queue-5.6/clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch new file mode 100644 index 00000000000..bfaf39b8cd6 --- /dev/null +++ b/queue-5.6/clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch @@ -0,0 +1,38 @@ +From 66e4460c58770f837e643a2e5ea95d4d13e77e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jan 2020 14:50:49 +0800 +Subject: clk: imx: pll14xx: Add new frequency entries for pll1443x table + +From: Anson Huang + +[ Upstream commit 57795654fb553a78f07a9f92d87fb2582379cd93 ] + +Add new frequency entries to pll1443x table to meet different +display settings requirement. + +Signed-off-by: Anson Huang +Reviewed-by: Peng Fan +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-pll14xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/imx/clk-pll14xx.c b/drivers/clk/imx/clk-pll14xx.c +index 5b0519a81a7af..37e311e1d0586 100644 +--- a/drivers/clk/imx/clk-pll14xx.c ++++ b/drivers/clk/imx/clk-pll14xx.c +@@ -55,8 +55,10 @@ static const struct imx_pll14xx_rate_table imx_pll1416x_tbl[] = { + }; + + static const struct imx_pll14xx_rate_table imx_pll1443x_tbl[] = { ++ PLL_1443X_RATE(1039500000U, 173, 2, 1, 16384), + PLL_1443X_RATE(650000000U, 325, 3, 2, 0), + PLL_1443X_RATE(594000000U, 198, 2, 2, 0), ++ PLL_1443X_RATE(519750000U, 173, 2, 2, 16384), + PLL_1443X_RATE(393216000U, 262, 2, 3, 9437), + PLL_1443X_RATE(361267200U, 361, 3, 3, 17511), + }; +-- +2.20.1 + diff --git a/queue-5.6/clk-tegra-fix-tegra-pmc-clock-out-parents.patch b/queue-5.6/clk-tegra-fix-tegra-pmc-clock-out-parents.patch new file mode 100644 index 00000000000..fa9b9c20e8e --- /dev/null +++ b/queue-5.6/clk-tegra-fix-tegra-pmc-clock-out-parents.patch @@ -0,0 +1,56 @@ +From 59fb84dda858df2e5fb9e9b889309461ec57bea9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jan 2020 23:24:09 -0800 +Subject: clk: tegra: Fix Tegra PMC clock out parents + +From: Sowjanya Komatineni + +[ Upstream commit 6fe38aa8cac3a5db38154331742835a4d9740788 ] + +Tegra PMC clocks clk_out_1, clk_out_2, and clk_out_3 supported parents +are osc, osc_div2, osc_div4 and extern clock. + +Clock driver is using incorrect parents clk_m, clk_m_div2, clk_m_div4 +for PMC clocks. + +This patch fixes this. + +Tested-by: Dmitry Osipenko +Reviewed-by: Dmitry Osipenko +Signed-off-by: Sowjanya Komatineni +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra-pmc.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/tegra/clk-tegra-pmc.c b/drivers/clk/tegra/clk-tegra-pmc.c +index bec3e008335f3..5e044ba1ae364 100644 +--- a/drivers/clk/tegra/clk-tegra-pmc.c ++++ b/drivers/clk/tegra/clk-tegra-pmc.c +@@ -49,16 +49,16 @@ struct pmc_clk_init_data { + + static DEFINE_SPINLOCK(clk_out_lock); + +-static const char *clk_out1_parents[] = { "clk_m", "clk_m_div2", +- "clk_m_div4", "extern1", ++static const char *clk_out1_parents[] = { "osc", "osc_div2", ++ "osc_div4", "extern1", + }; + +-static const char *clk_out2_parents[] = { "clk_m", "clk_m_div2", +- "clk_m_div4", "extern2", ++static const char *clk_out2_parents[] = { "osc", "osc_div2", ++ "osc_div4", "extern2", + }; + +-static const char *clk_out3_parents[] = { "clk_m", "clk_m_div2", +- "clk_m_div4", "extern3", ++static const char *clk_out3_parents[] = { "osc", "osc_div2", ++ "osc_div4", "extern3", + }; + + static struct pmc_clk_init_data pmc_clks[] = { +-- +2.20.1 + diff --git a/queue-5.6/compiler.h-fix-error-in-build_bug_on-reporting.patch b/queue-5.6/compiler.h-fix-error-in-build_bug_on-reporting.patch new file mode 100644 index 00000000000..832ff088d07 --- /dev/null +++ b/queue-5.6/compiler.h-fix-error-in-build_bug_on-reporting.patch @@ -0,0 +1,70 @@ +From bf73285e0e6a5a9d3ff9904c10f8106bf9668d61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Apr 2020 20:09:37 -0700 +Subject: compiler.h: fix error in BUILD_BUG_ON() reporting + +From: Vegard Nossum + +[ Upstream commit af9c5d2e3b355854ff0e4acfbfbfadcd5198a349 ] + +compiletime_assert() uses __LINE__ to create a unique function name. This +means that if you have more than one BUILD_BUG_ON() in the same source +line (which can happen if they appear e.g. in a macro), then the error +message from the compiler might output the wrong condition. + +For this source file: + + #include + + #define macro() \ + BUILD_BUG_ON(1); \ + BUILD_BUG_ON(0); + + void foo() + { + macro(); + } + +gcc would output: + +./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_9' declared with attribute error: BUILD_BUG_ON failed: 0 + _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) + +However, it was not the BUILD_BUG_ON(0) that failed, so it should say 1 +instead of 0. With this patch, we use __COUNTER__ instead of __LINE__, so +each BUILD_BUG_ON() gets a different function name and the correct +condition is printed: + +./include/linux/compiler.h:350:38: error: call to `__compiletime_assert_0' declared with attribute error: BUILD_BUG_ON failed: 1 + _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) + +Signed-off-by: Vegard Nossum +Signed-off-by: Andrew Morton +Reviewed-by: Masahiro Yamada +Reviewed-by: Daniel Santos +Cc: Rasmus Villemoes +Cc: Ian Abbott +Cc: Joe Perches +Link: http://lkml.kernel.org/r/20200331112637.25047-1-vegard.nossum@oracle.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/compiler.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 5e88e7e33abec..034b0a644efcc 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -347,7 +347,7 @@ static inline void *offset_to_ptr(const int *off) + * compiler has support to do so. + */ + #define compiletime_assert(condition, msg) \ +- _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__) ++ _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) + + #define compiletime_assert_atomic_type(t) \ + compiletime_assert(__native_word(t), \ +-- +2.20.1 + diff --git a/queue-5.6/crypto-qce-use-cryptlen-when-adding-extra-sgl.patch b/queue-5.6/crypto-qce-use-cryptlen-when-adding-extra-sgl.patch new file mode 100644 index 00000000000..f04ebc30df0 --- /dev/null +++ b/queue-5.6/crypto-qce-use-cryptlen-when-adding-extra-sgl.patch @@ -0,0 +1,103 @@ +From 49b79b680c7c481d49f788cd386fe7a151e29072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2020 12:02:25 -0300 +Subject: crypto: qce - use cryptlen when adding extra sgl + +From: Eneas U de Queiroz + +[ Upstream commit d6364b8128439a8c0e381f80c38667de9f15eef8 ] + +The qce crypto driver appends an extra entry to the dst sgl, to maintain +private state information. + +When the gcm driver sends requests to the ctr skcipher, it passes the +authentication tag after the actual crypto payload, but it must not be +touched. + +Commit 1336c2221bee ("crypto: qce - save a sg table slot for result +buf") limited the destination sgl to avoid overwriting the +authentication tag but it assumed the tag would be in a separate sgl +entry. + +This is not always the case, so it is better to limit the length of the +destination buffer to req->cryptlen before appending the result buf. + +Signed-off-by: Eneas U de Queiroz +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qce/dma.c | 11 ++++++----- + drivers/crypto/qce/dma.h | 2 +- + drivers/crypto/qce/skcipher.c | 5 +++-- + 3 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/crypto/qce/dma.c b/drivers/crypto/qce/dma.c +index 7da893dc00e73..46db5bf366b44 100644 +--- a/drivers/crypto/qce/dma.c ++++ b/drivers/crypto/qce/dma.c +@@ -48,9 +48,10 @@ void qce_dma_release(struct qce_dma_data *dma) + + struct scatterlist * + qce_sgtable_add(struct sg_table *sgt, struct scatterlist *new_sgl, +- int max_ents) ++ unsigned int max_len) + { + struct scatterlist *sg = sgt->sgl, *sg_last = NULL; ++ unsigned int new_len; + + while (sg) { + if (!sg_page(sg)) +@@ -61,13 +62,13 @@ qce_sgtable_add(struct sg_table *sgt, struct scatterlist *new_sgl, + if (!sg) + return ERR_PTR(-EINVAL); + +- while (new_sgl && sg && max_ents) { +- sg_set_page(sg, sg_page(new_sgl), new_sgl->length, +- new_sgl->offset); ++ while (new_sgl && sg && max_len) { ++ new_len = new_sgl->length > max_len ? max_len : new_sgl->length; ++ sg_set_page(sg, sg_page(new_sgl), new_len, new_sgl->offset); + sg_last = sg; + sg = sg_next(sg); + new_sgl = sg_next(new_sgl); +- max_ents--; ++ max_len -= new_len; + } + + return sg_last; +diff --git a/drivers/crypto/qce/dma.h b/drivers/crypto/qce/dma.h +index ed25a0d9829e5..7864021693608 100644 +--- a/drivers/crypto/qce/dma.h ++++ b/drivers/crypto/qce/dma.h +@@ -43,6 +43,6 @@ void qce_dma_issue_pending(struct qce_dma_data *dma); + int qce_dma_terminate_all(struct qce_dma_data *dma); + struct scatterlist * + qce_sgtable_add(struct sg_table *sgt, struct scatterlist *sg_add, +- int max_ents); ++ unsigned int max_len); + + #endif /* _DMA_H_ */ +diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c +index 4217b745f1242..63ae75809cb70 100644 +--- a/drivers/crypto/qce/skcipher.c ++++ b/drivers/crypto/qce/skcipher.c +@@ -97,13 +97,14 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req) + + sg_init_one(&rctx->result_sg, qce->dma.result_buf, QCE_RESULT_BUF_SZ); + +- sg = qce_sgtable_add(&rctx->dst_tbl, req->dst, rctx->dst_nents - 1); ++ sg = qce_sgtable_add(&rctx->dst_tbl, req->dst, req->cryptlen); + if (IS_ERR(sg)) { + ret = PTR_ERR(sg); + goto error_free; + } + +- sg = qce_sgtable_add(&rctx->dst_tbl, &rctx->result_sg, 1); ++ sg = qce_sgtable_add(&rctx->dst_tbl, &rctx->result_sg, ++ QCE_RESULT_BUF_SZ); + if (IS_ERR(sg)) { + ret = PTR_ERR(sg); + goto error_free; +-- +2.20.1 + diff --git a/queue-5.6/csky-fixup-cpu-speculative-execution-to-io-area.patch b/queue-5.6/csky-fixup-cpu-speculative-execution-to-io-area.patch new file mode 100644 index 00000000000..006ea0a0b6e --- /dev/null +++ b/queue-5.6/csky-fixup-cpu-speculative-execution-to-io-area.patch @@ -0,0 +1,212 @@ +From cd3f03aa17db0d02b4ea1c07ea408d522f3b955c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Mar 2020 19:14:37 +0800 +Subject: csky: Fixup cpu speculative execution to IO area + +From: Guo Ren + +[ Upstream commit aefd9461d34a1b0a2acad0750c43216c1c27b9d4 ] + +For the memory size ( > 512MB, < 1GB), the MSA setting is: + + - SSEG0: PHY_START , PHY_START + 512MB + - SSEG1: PHY_START + 512MB, PHY_START + 1GB + +But the real memory is no more than 1GB, there is a gap between the +end size of memory and border of 1GB. CPU could speculatively +execute to that gap and if the gap of the bus couldn't respond to +the CPU request, then the crash will happen. + +Now make the setting with: + + - SSEG0: PHY_START , PHY_START + 512MB (no change) + - SSEG1: Disabled (We use highmem to use the memory of 512MB~1GB) + +We also deprecated zhole_szie[] settings, it's only used by arm +style CPUs. All memory gap should use Reserved setting of dts in +csky system. + +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/abiv1/inc/abi/entry.h | 5 +-- + arch/csky/abiv2/inc/abi/entry.h | 7 ++-- + arch/csky/kernel/head.S | 5 +++ + arch/csky/kernel/setup.c | 63 ++++++++------------------------- + arch/csky/kernel/smp.c | 3 ++ + 5 files changed, 25 insertions(+), 58 deletions(-) + +diff --git a/arch/csky/abiv1/inc/abi/entry.h b/arch/csky/abiv1/inc/abi/entry.h +index f35a9f3315ee6..5056ebb902d18 100644 +--- a/arch/csky/abiv1/inc/abi/entry.h ++++ b/arch/csky/abiv1/inc/abi/entry.h +@@ -172,10 +172,7 @@ + addi r6, 0xe + cpwcr r6, cpcr30 + +- lsri r6, 28 +- addi r6, 2 +- lsli r6, 28 +- addi r6, 0xe ++ movi r6, 0 + cpwcr r6, cpcr31 + .endm + +diff --git a/arch/csky/abiv2/inc/abi/entry.h b/arch/csky/abiv2/inc/abi/entry.h +index 94a7a58765dff..111973c6c713f 100644 +--- a/arch/csky/abiv2/inc/abi/entry.h ++++ b/arch/csky/abiv2/inc/abi/entry.h +@@ -230,11 +230,8 @@ + addi r6, 0x1ce + mtcr r6, cr<30, 15> /* Set MSA0 */ + +- lsri r6, 28 +- addi r6, 2 +- lsli r6, 28 +- addi r6, 0x1ce +- mtcr r6, cr<31, 15> /* Set MSA1 */ ++ movi r6, 0 ++ mtcr r6, cr<31, 15> /* Clr MSA1 */ + + /* enable MMU */ + mfcr r6, cr18 +diff --git a/arch/csky/kernel/head.S b/arch/csky/kernel/head.S +index 61989f9241c02..17ed9d2504807 100644 +--- a/arch/csky/kernel/head.S ++++ b/arch/csky/kernel/head.S +@@ -21,6 +21,11 @@ END(_start) + ENTRY(_start_smp_secondary) + SETUP_MMU + ++ /* copy msa1 from CPU0 */ ++ lrw r6, secondary_msa1 ++ ld.w r6, (r6, 0) ++ mtcr r6, cr<31, 15> ++ + /* set stack point */ + lrw r6, secondary_stack + ld.w r6, (r6, 0) +diff --git a/arch/csky/kernel/setup.c b/arch/csky/kernel/setup.c +index 3821e55742f46..819a9a7bf786d 100644 +--- a/arch/csky/kernel/setup.c ++++ b/arch/csky/kernel/setup.c +@@ -24,26 +24,9 @@ struct screen_info screen_info = { + }; + #endif + +-phys_addr_t __init_memblock memblock_end_of_REG0(void) +-{ +- return (memblock.memory.regions[0].base + +- memblock.memory.regions[0].size); +-} +- +-phys_addr_t __init_memblock memblock_start_of_REG1(void) +-{ +- return memblock.memory.regions[1].base; +-} +- +-size_t __init_memblock memblock_size_of_REG1(void) +-{ +- return memblock.memory.regions[1].size; +-} +- + static void __init csky_memblock_init(void) + { + unsigned long zone_size[MAX_NR_ZONES]; +- unsigned long zhole_size[MAX_NR_ZONES]; + signed long size; + + memblock_reserve(__pa(_stext), _end - _stext); +@@ -54,54 +37,36 @@ static void __init csky_memblock_init(void) + memblock_dump_all(); + + memset(zone_size, 0, sizeof(zone_size)); +- memset(zhole_size, 0, sizeof(zhole_size)); + + min_low_pfn = PFN_UP(memblock_start_of_DRAM()); +- max_pfn = PFN_DOWN(memblock_end_of_DRAM()); +- +- max_low_pfn = PFN_UP(memblock_end_of_REG0()); +- if (max_low_pfn == 0) +- max_low_pfn = max_pfn; ++ max_low_pfn = max_pfn = PFN_DOWN(memblock_end_of_DRAM()); + + size = max_pfn - min_low_pfn; + +- if (memblock.memory.cnt > 1) { +- zone_size[ZONE_NORMAL] = +- PFN_DOWN(memblock_start_of_REG1()) - min_low_pfn; +- zhole_size[ZONE_NORMAL] = +- PFN_DOWN(memblock_start_of_REG1()) - max_low_pfn; ++ if (size <= PFN_DOWN(SSEG_SIZE - PHYS_OFFSET_OFFSET)) ++ zone_size[ZONE_NORMAL] = size; ++ else if (size < PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET)) { ++ zone_size[ZONE_NORMAL] = ++ PFN_DOWN(SSEG_SIZE - PHYS_OFFSET_OFFSET); ++ max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL]; + } else { +- if (size <= PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET)) +- zone_size[ZONE_NORMAL] = max_pfn - min_low_pfn; +- else { +- zone_size[ZONE_NORMAL] = ++ zone_size[ZONE_NORMAL] = + PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET); +- max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL]; +- } ++ max_low_pfn = min_low_pfn + zone_size[ZONE_NORMAL]; ++ write_mmu_msa1(read_mmu_msa0() + SSEG_SIZE); + } + + #ifdef CONFIG_HIGHMEM +- size = 0; +- if (memblock.memory.cnt > 1) { +- size = PFN_DOWN(memblock_size_of_REG1()); +- highstart_pfn = PFN_DOWN(memblock_start_of_REG1()); +- } else { +- size = max_pfn - min_low_pfn - +- PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET); +- highstart_pfn = min_low_pfn + +- PFN_DOWN(LOWMEM_LIMIT - PHYS_OFFSET_OFFSET); +- } +- +- if (size > 0) +- zone_size[ZONE_HIGHMEM] = size; ++ zone_size[ZONE_HIGHMEM] = max_pfn - max_low_pfn; + +- highend_pfn = max_pfn; ++ highstart_pfn = max_low_pfn; ++ highend_pfn = max_pfn; + #endif + memblock_set_current_limit(PFN_PHYS(max_low_pfn)); + + dma_contiguous_reserve(0); + +- free_area_init_node(0, zone_size, min_low_pfn, zhole_size); ++ free_area_init_node(0, zone_size, min_low_pfn, NULL); + } + + void __init setup_arch(char **cmdline_p) +diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c +index 0bb0954d55709..de61feb4b6df2 100644 +--- a/arch/csky/kernel/smp.c ++++ b/arch/csky/kernel/smp.c +@@ -156,6 +156,8 @@ volatile unsigned int secondary_hint; + volatile unsigned int secondary_ccr; + volatile unsigned int secondary_stack; + ++unsigned long secondary_msa1; ++ + int __cpu_up(unsigned int cpu, struct task_struct *tidle) + { + unsigned long mask = 1 << cpu; +@@ -164,6 +166,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle) + (unsigned int) task_stack_page(tidle) + THREAD_SIZE - 8; + secondary_hint = mfcr("cr31"); + secondary_ccr = mfcr("cr18"); ++ secondary_msa1 = read_mmu_msa1(); + + /* + * Because other CPUs are in reset status, we must flush data +-- +2.20.1 + diff --git a/queue-5.6/csky-fixup-get-wrong-psr-value-from-phyical-reg.patch b/queue-5.6/csky-fixup-get-wrong-psr-value-from-phyical-reg.patch new file mode 100644 index 00000000000..940874ce18c --- /dev/null +++ b/queue-5.6/csky-fixup-get-wrong-psr-value-from-phyical-reg.patch @@ -0,0 +1,126 @@ +From a9250b1ecb33e5b9250c1be299f9e272c3df4fa5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Mar 2020 23:45:52 +0800 +Subject: csky: Fixup get wrong psr value from phyical reg + +From: Guo Ren + +[ Upstream commit 9c0e343d7654a329d1f9b53d253cbf7fb6eff85d ] + +We should get psr value from regs->psr in stack, not directly get +it from phyiscal register then save the vector number in +tsk->trap_no. + +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/include/asm/processor.h | 1 + + arch/csky/kernel/traps.c | 11 ++++++++++- + arch/csky/mm/fault.c | 7 +++++++ + 3 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/arch/csky/include/asm/processor.h b/arch/csky/include/asm/processor.h +index 21e0bd5293dde..c6bcd7f7c720b 100644 +--- a/arch/csky/include/asm/processor.h ++++ b/arch/csky/include/asm/processor.h +@@ -43,6 +43,7 @@ extern struct cpuinfo_csky cpu_data[]; + struct thread_struct { + unsigned long ksp; /* kernel stack pointer */ + unsigned long sr; /* saved status register */ ++ unsigned long trap_no; /* saved status register */ + + /* FPU regs */ + struct user_fp __aligned(16) user_fp; +diff --git a/arch/csky/kernel/traps.c b/arch/csky/kernel/traps.c +index b057480e7463c..63715cb90ee99 100644 +--- a/arch/csky/kernel/traps.c ++++ b/arch/csky/kernel/traps.c +@@ -115,8 +115,9 @@ asmlinkage void trap_c(struct pt_regs *regs) + int sig; + unsigned long vector; + siginfo_t info; ++ struct task_struct *tsk = current; + +- vector = (mfcr("psr") >> 16) & 0xff; ++ vector = (regs->sr >> 16) & 0xff; + + switch (vector) { + case VEC_ZERODIV: +@@ -129,6 +130,7 @@ asmlinkage void trap_c(struct pt_regs *regs) + sig = SIGTRAP; + break; + case VEC_ILLEGAL: ++ tsk->thread.trap_no = vector; + die_if_kernel("Kernel mode ILLEGAL", regs, vector); + #ifndef CONFIG_CPU_NO_USER_BKPT + if (*(uint16_t *)instruction_pointer(regs) != USR_BKPT) +@@ -146,16 +148,20 @@ asmlinkage void trap_c(struct pt_regs *regs) + sig = SIGTRAP; + break; + case VEC_ACCESS: ++ tsk->thread.trap_no = vector; + return buserr(regs); + #ifdef CONFIG_CPU_NEED_SOFTALIGN + case VEC_ALIGN: ++ tsk->thread.trap_no = vector; + return csky_alignment(regs); + #endif + #ifdef CONFIG_CPU_HAS_FPU + case VEC_FPE: ++ tsk->thread.trap_no = vector; + die_if_kernel("Kernel mode FPE", regs, vector); + return fpu_fpe(regs); + case VEC_PRIV: ++ tsk->thread.trap_no = vector; + die_if_kernel("Kernel mode PRIV", regs, vector); + if (fpu_libc_helper(regs)) + return; +@@ -164,5 +170,8 @@ asmlinkage void trap_c(struct pt_regs *regs) + sig = SIGSEGV; + break; + } ++ ++ tsk->thread.trap_no = vector; ++ + send_sig(sig, current, 0); + } +diff --git a/arch/csky/mm/fault.c b/arch/csky/mm/fault.c +index f76618b630f91..562c7f7087490 100644 +--- a/arch/csky/mm/fault.c ++++ b/arch/csky/mm/fault.c +@@ -179,11 +179,14 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write, + bad_area_nosemaphore: + /* User mode accesses just cause a SIGSEGV */ + if (user_mode(regs)) { ++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff; + force_sig_fault(SIGSEGV, si_code, (void __user *)address); + return; + } + + no_context: ++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff; ++ + /* Are we prepared to handle this kernel fault? */ + if (fixup_exception(regs)) + return; +@@ -198,6 +201,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write, + die_if_kernel("Oops", regs, write); + + out_of_memory: ++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff; ++ + /* + * We ran out of memory, call the OOM killer, and return the userspace + * (which will retry the fault, or kill us if we got oom-killed). +@@ -206,6 +211,8 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long write, + return; + + do_sigbus: ++ tsk->thread.trap_no = (regs->sr >> 16) & 0xff; ++ + up_read(&mm->mmap_sem); + + /* Kernel mode? Handle exceptions or die */ +-- +2.20.1 + diff --git a/queue-5.6/csky-fixup-init_fpu-compile-warning-with-__init.patch b/queue-5.6/csky-fixup-init_fpu-compile-warning-with-__init.patch new file mode 100644 index 00000000000..c1961e0a97a --- /dev/null +++ b/queue-5.6/csky-fixup-init_fpu-compile-warning-with-__init.patch @@ -0,0 +1,73 @@ +From 8246c54d288092002b1f7eb13ad63a0aeba073ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2020 10:23:26 +0800 +Subject: csky: Fixup init_fpu compile warning with __init + +From: Guo Ren + +[ Upstream commit 12879bda3c2a974b7e4fe199a9c21f0c5f6bca04 ] + +WARNING: vmlinux.o(.text+0x2366): Section mismatch in reference from the +function csky_start_secondary() to the function .init.text:init_fpu() + +The function csky_start_secondary() references +the function __init init_fpu(). +This is often because csky_start_secondary lacks a __init +annotation or the annotation of init_fpu is wrong. + +Reported-by: Lu Chongzhi +Signed-off-by: Guo Ren +Signed-off-by: Sasha Levin +--- + arch/csky/abiv2/fpu.c | 5 ----- + arch/csky/abiv2/inc/abi/fpu.h | 3 ++- + arch/csky/kernel/smp.c | 3 +++ + 3 files changed, 5 insertions(+), 6 deletions(-) + +diff --git a/arch/csky/abiv2/fpu.c b/arch/csky/abiv2/fpu.c +index 86d187d4e5af1..5acc5c2e544e1 100644 +--- a/arch/csky/abiv2/fpu.c ++++ b/arch/csky/abiv2/fpu.c +@@ -10,11 +10,6 @@ + #define MTCR_DIST 0xC0006420 + #define MFCR_DIST 0xC0006020 + +-void __init init_fpu(void) +-{ +- mtcr("cr<1, 2>", 0); +-} +- + /* + * fpu_libc_helper() is to help libc to excute: + * - mfcr %a, cr<1, 2> +diff --git a/arch/csky/abiv2/inc/abi/fpu.h b/arch/csky/abiv2/inc/abi/fpu.h +index 22ca3cf2794a1..09e2700a36936 100644 +--- a/arch/csky/abiv2/inc/abi/fpu.h ++++ b/arch/csky/abiv2/inc/abi/fpu.h +@@ -9,7 +9,8 @@ + + int fpu_libc_helper(struct pt_regs *regs); + void fpu_fpe(struct pt_regs *regs); +-void __init init_fpu(void); ++ ++static inline void init_fpu(void) { mtcr("cr<1, 2>", 0); } + + void save_to_user_fp(struct user_fp *user_fp); + void restore_from_user_fp(struct user_fp *user_fp); +diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c +index de61feb4b6df2..b5c5bc3afeb5c 100644 +--- a/arch/csky/kernel/smp.c ++++ b/arch/csky/kernel/smp.c +@@ -22,6 +22,9 @@ + #include + #include + #include ++#ifdef CONFIG_CPU_HAS_FPU ++#include ++#endif + + struct ipi_data_struct { + unsigned long bits ____cacheline_aligned; +-- +2.20.1 + diff --git a/queue-5.6/dma-coherent-fix-integer-overflow-in-the-reserved-me.patch b/queue-5.6/dma-coherent-fix-integer-overflow-in-the-reserved-me.patch new file mode 100644 index 00000000000..18db211310c --- /dev/null +++ b/queue-5.6/dma-coherent-fix-integer-overflow-in-the-reserved-me.patch @@ -0,0 +1,84 @@ +From c4e43d5be322b16b4d59000da8967138c1b6c87a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 15:41:45 +0000 +Subject: dma-coherent: fix integer overflow in the reserved-memory dma + allocation + +From: Kevin Grandemange + +[ Upstream commit 286c21de32b904131f8cf6a36ce40b8b0c9c5da3 ] + +pageno is an int and the PAGE_SHIFT shift is done on an int, +overflowing if the memory is bigger than 2G + +This can be reproduced using for example a reserved-memory of 4G + +reserved-memory { + #address-cells = <2>; + #size-cells = <2>; + ranges; + + reserved_dma: buffer@0 { + compatible = "shared-dma-pool"; + no-map; + reg = <0x5 0x00000000 0x1 0x0>; + }; +}; + +Signed-off-by: Kevin Grandemange +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/coherent.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c +index 551b0eb7028a3..2a0c4985f38e4 100644 +--- a/kernel/dma/coherent.c ++++ b/kernel/dma/coherent.c +@@ -134,7 +134,7 @@ static void *__dma_alloc_from_coherent(struct device *dev, + + spin_lock_irqsave(&mem->spinlock, flags); + +- if (unlikely(size > (mem->size << PAGE_SHIFT))) ++ if (unlikely(size > ((dma_addr_t)mem->size << PAGE_SHIFT))) + goto err; + + pageno = bitmap_find_free_region(mem->bitmap, mem->size, order); +@@ -144,8 +144,9 @@ static void *__dma_alloc_from_coherent(struct device *dev, + /* + * Memory was found in the coherent area. + */ +- *dma_handle = dma_get_device_base(dev, mem) + (pageno << PAGE_SHIFT); +- ret = mem->virt_base + (pageno << PAGE_SHIFT); ++ *dma_handle = dma_get_device_base(dev, mem) + ++ ((dma_addr_t)pageno << PAGE_SHIFT); ++ ret = mem->virt_base + ((dma_addr_t)pageno << PAGE_SHIFT); + spin_unlock_irqrestore(&mem->spinlock, flags); + memset(ret, 0, size); + return ret; +@@ -194,7 +195,7 @@ static int __dma_release_from_coherent(struct dma_coherent_mem *mem, + int order, void *vaddr) + { + if (mem && vaddr >= mem->virt_base && vaddr < +- (mem->virt_base + (mem->size << PAGE_SHIFT))) { ++ (mem->virt_base + ((dma_addr_t)mem->size << PAGE_SHIFT))) { + int page = (vaddr - mem->virt_base) >> PAGE_SHIFT; + unsigned long flags; + +@@ -238,10 +239,10 @@ static int __dma_mmap_from_coherent(struct dma_coherent_mem *mem, + struct vm_area_struct *vma, void *vaddr, size_t size, int *ret) + { + if (mem && vaddr >= mem->virt_base && vaddr + size <= +- (mem->virt_base + (mem->size << PAGE_SHIFT))) { ++ (mem->virt_base + ((dma_addr_t)mem->size << PAGE_SHIFT))) { + unsigned long off = vma->vm_pgoff; + int start = (vaddr - mem->virt_base) >> PAGE_SHIFT; +- int user_count = vma_pages(vma); ++ unsigned long user_count = vma_pages(vma); + int count = PAGE_ALIGN(size) >> PAGE_SHIFT; + + *ret = -ENXIO; +-- +2.20.1 + diff --git a/queue-5.6/dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch b/queue-5.6/dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch new file mode 100644 index 00000000000..067598bd08d --- /dev/null +++ b/queue-5.6/dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch @@ -0,0 +1,45 @@ +From 47398bc5cbf86a1ffbf4bb81881e2261a0b97505 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Mar 2020 10:50:30 -0700 +Subject: dmaengine: idxd: reflect shadow copy of traffic class programming + +From: Dave Jiang + +[ Upstream commit a1fcaf07ec718bb1f11e29e952c9a4cb733d57a5 ] + +The traffic class are set to -1 at initialization until the user programs +them. If the user choose not to, the driver will program appropriate +defaults. The driver also needs to update the shadowed copies of the values +after doing the programming. + +Fixes: c52ca478233c ("dmaengine: idxd: add configuration component of driver") +Reported-by: Yixin Zhang +Signed-off-by: Dave Jiang +Link: https://lore.kernel.org/r/158386263076.10898.4586509576813094559.stgit@djiang5-desk3.ch.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/idxd/device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/idxd/device.c b/drivers/dma/idxd/device.c +index ada69e722f84a..f6f49f0f6fae2 100644 +--- a/drivers/dma/idxd/device.c ++++ b/drivers/dma/idxd/device.c +@@ -584,11 +584,11 @@ static void idxd_group_flags_setup(struct idxd_device *idxd) + struct idxd_group *group = &idxd->groups[i]; + + if (group->tc_a == -1) +- group->grpcfg.flags.tc_a = 0; ++ group->tc_a = group->grpcfg.flags.tc_a = 0; + else + group->grpcfg.flags.tc_a = group->tc_a; + if (group->tc_b == -1) +- group->grpcfg.flags.tc_b = 1; ++ group->tc_b = group->grpcfg.flags.tc_b = 1; + else + group->grpcfg.flags.tc_b = group->tc_b; + group->grpcfg.flags.use_token_limit = group->use_token_limit; +-- +2.20.1 + diff --git a/queue-5.6/drivers-thermal-tsens-release-device-in-success-path.patch b/queue-5.6/drivers-thermal-tsens-release-device-in-success-path.patch new file mode 100644 index 00000000000..345411c71f8 --- /dev/null +++ b/queue-5.6/drivers-thermal-tsens-release-device-in-success-path.patch @@ -0,0 +1,62 @@ +From 20af7062a303b99d9afefc237d627554a5c50eba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 18:07:01 +0530 +Subject: drivers: thermal: tsens: Release device in success path + +From: Amit Kucheria + +[ Upstream commit f22a3bf0d2225fba438c46a25d3ab8823585a5e0 ] + +We don't currently call put_device in case of successfully initialising +the device. So we hold the reference and keep the device pinned forever. + +Allow control to fall through so we can use same code for success and +error paths to put_device. + +As a part of this fixup, change devm_ioremap_resource to act on the same +device pointer as that used to allocate regmap memory. That ensures that +we are free to release op->dev after examining its resources. + +Signed-off-by: Amit Kucheria +Reviewed-by: Bjorn Andersson +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/d3996667e9f976bb30e97e301585cb1023be422e.1584015867.git.amit.kucheria@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/thermal/qcom/tsens-common.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/thermal/qcom/tsens-common.c b/drivers/thermal/qcom/tsens-common.c +index c8d57ee0a5bb2..2cc276cdfcdb1 100644 +--- a/drivers/thermal/qcom/tsens-common.c ++++ b/drivers/thermal/qcom/tsens-common.c +@@ -602,7 +602,7 @@ int __init init_common(struct tsens_priv *priv) + /* DT with separate SROT and TM address space */ + priv->tm_offset = 0; + res = platform_get_resource(op, IORESOURCE_MEM, 1); +- srot_base = devm_ioremap_resource(&op->dev, res); ++ srot_base = devm_ioremap_resource(dev, res); + if (IS_ERR(srot_base)) { + ret = PTR_ERR(srot_base); + goto err_put_device; +@@ -620,7 +620,7 @@ int __init init_common(struct tsens_priv *priv) + } + + res = platform_get_resource(op, IORESOURCE_MEM, 0); +- tm_base = devm_ioremap_resource(&op->dev, res); ++ tm_base = devm_ioremap_resource(dev, res); + if (IS_ERR(tm_base)) { + ret = PTR_ERR(tm_base); + goto err_put_device; +@@ -687,8 +687,6 @@ int __init init_common(struct tsens_priv *priv) + tsens_enable_irq(priv); + tsens_debug_init(op); + +- return 0; +- + err_put_device: + put_device(&op->dev); + return ret; +-- +2.20.1 + diff --git a/queue-5.6/drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch b/queue-5.6/drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch new file mode 100644 index 00000000000..574bccc5b4a --- /dev/null +++ b/queue-5.6/drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch @@ -0,0 +1,56 @@ +From 9c69b00062b064184b62702d0fc8ff21524d80b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Mar 2020 13:29:46 -0400 +Subject: drm/amd/display: Don't try hdcp1.4 when content_type is set to type1 + +From: Bhawanpreet Lakha + +[ Upstream commit c2850c125d919efbb3a9ab46410d23912934f585 ] + +[Why] +When content type property is set to 1. We should enable hdcp2.2 and if we cant +then stop. Currently the way it works in DC is that if we fail hdcp2, we will +try hdcp1 after. + +[How] +Use link config to force disable hdcp1.4 when type1 is set. + +Signed-off-by: Bhawanpreet Lakha +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +index 0acd3409dd6ce..3abeff7722e3d 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_hdcp.c +@@ -113,10 +113,13 @@ void hdcp_update_display(struct hdcp_workqueue *hdcp_work, + + if (enable_encryption) { + display->adjust.disable = 0; +- if (content_type == DRM_MODE_HDCP_CONTENT_TYPE0) ++ if (content_type == DRM_MODE_HDCP_CONTENT_TYPE0) { ++ hdcp_w->link.adjust.hdcp1.disable = 0; + hdcp_w->link.adjust.hdcp2.force_type = MOD_HDCP_FORCE_TYPE_0; +- else if (content_type == DRM_MODE_HDCP_CONTENT_TYPE1) ++ } else if (content_type == DRM_MODE_HDCP_CONTENT_TYPE1) { ++ hdcp_w->link.adjust.hdcp1.disable = 1; + hdcp_w->link.adjust.hdcp2.force_type = MOD_HDCP_FORCE_TYPE_1; ++ } + + schedule_delayed_work(&hdcp_w->property_validate_dwork, + msecs_to_jiffies(DRM_HDCP_CHECK_PERIOD_MS)); +@@ -334,6 +337,7 @@ static void update_config(void *handle, struct cp_psp_stream_config *config) + link->dp.rev = aconnector->dc_link->dpcd_caps.dpcd_rev.raw; + display->adjust.disable = 1; + link->adjust.auth_delay = 2; ++ link->adjust.hdcp1.disable = 0; + + hdcp_update_display(hdcp_work, link_index, aconnector, DRM_MODE_HDCP_CONTENT_TYPE0, false); + } +-- +2.20.1 + diff --git a/queue-5.6/drm-amdkfd-kfree-the-wrong-pointer.patch b/queue-5.6/drm-amdkfd-kfree-the-wrong-pointer.patch new file mode 100644 index 00000000000..d34872d83c2 --- /dev/null +++ b/queue-5.6/drm-amdkfd-kfree-the-wrong-pointer.patch @@ -0,0 +1,39 @@ +From d9708acc3b788fb6f9c72a3c47752dfba285bbe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Apr 2020 20:06:58 +0800 +Subject: drm/amdkfd: kfree the wrong pointer + +From: Jack Zhang + +[ Upstream commit 3148a6a0ef3cf93570f30a477292768f7eb5d3c3 ] + +Originally, it kfrees the wrong pointer for mem_obj. +It would cause memory leak under stress test. + +Signed-off-by: Jack Zhang +Acked-by: Nirmoy Das +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +index 2a9e401317353..0d70cb2248fe9 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c +@@ -1104,9 +1104,9 @@ int kfd_gtt_sa_allocate(struct kfd_dev *kfd, unsigned int size, + return 0; + + kfd_gtt_no_free_chunk: +- pr_debug("Allocation failed with mem_obj = %p\n", mem_obj); ++ pr_debug("Allocation failed with mem_obj = %p\n", *mem_obj); + mutex_unlock(&kfd->gtt_sa_lock); +- kfree(mem_obj); ++ kfree(*mem_obj); + return -ENOMEM; + } + +-- +2.20.1 + diff --git a/queue-5.6/drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch b/queue-5.6/drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch new file mode 100644 index 00000000000..325e5b556ae --- /dev/null +++ b/queue-5.6/drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch @@ -0,0 +1,73 @@ +From 8605c0687b615177e06f8a1ae4eaefbf17dd09c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Mar 2020 16:08:44 +1000 +Subject: drm/nouveau/gr/gp107,gp108: implement workaround for HW hanging + during init + +From: Ben Skeggs + +[ Upstream commit 028a12f5aa829b4ba6ac011530b815eda4960e89 ] + +Certain boards with GP107/GP108 chipsets hang (often, but randomly) for +unknown reasons during GR initialisation. + +The first tell-tale symptom of this issue is: + +nouveau 0000:01:00.0: bus: MMIO read of 00000000 FAULT at 409800 [ TIMEOUT ] + +appearing in dmesg, likely followed by many other failures being logged. + +Karol found this WAR for the issue a while back, but efforts to isolate +the root cause and proper fix have not yielded success so far. I've +modified the original patch to include a few more details, limit it to +GP107/GP108 by default, and added a config option to override this choice. + +Signed-off-by: Ben Skeggs +Reviewed-by: Karol Herbst +Signed-off-by: Sasha Levin +--- + .../gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 26 +++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +index dd8f85b8b3a7e..f2f5636efac45 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +@@ -1981,8 +1981,34 @@ gf100_gr_init_(struct nvkm_gr *base) + { + struct gf100_gr *gr = gf100_gr(base); + struct nvkm_subdev *subdev = &base->engine.subdev; ++ struct nvkm_device *device = subdev->device; ++ bool reset = device->chipset == 0x137 || device->chipset == 0x138; + u32 ret; + ++ /* On certain GP107/GP108 boards, we trigger a weird issue where ++ * GR will stop responding to PRI accesses after we've asked the ++ * SEC2 RTOS to boot the GR falcons. This happens with far more ++ * frequency when cold-booting a board (ie. returning from D3). ++ * ++ * The root cause for this is not known and has proven difficult ++ * to isolate, with many avenues being dead-ends. ++ * ++ * A workaround was discovered by Karol, whereby putting GR into ++ * reset for an extended period right before initialisation ++ * prevents the problem from occuring. ++ * ++ * XXX: As RM does not require any such workaround, this is more ++ * of a hack than a true fix. ++ */ ++ reset = nvkm_boolopt(device->cfgopt, "NvGrResetWar", reset); ++ if (reset) { ++ nvkm_mask(device, 0x000200, 0x00001000, 0x00000000); ++ nvkm_rd32(device, 0x000200); ++ msleep(50); ++ nvkm_mask(device, 0x000200, 0x00001000, 0x00001000); ++ nvkm_rd32(device, 0x000200); ++ } ++ + nvkm_pmu_pgob(gr->base.engine.subdev.device->pmu, false); + + ret = nvkm_falcon_get(&gr->fecs.falcon, subdev); +-- +2.20.1 + diff --git a/queue-5.6/drm-nouveau-svm-check-for-svm-initialized-before-mig.patch b/queue-5.6/drm-nouveau-svm-check-for-svm-initialized-before-mig.patch new file mode 100644 index 00000000000..f674bd6080c --- /dev/null +++ b/queue-5.6/drm-nouveau-svm-check-for-svm-initialized-before-mig.patch @@ -0,0 +1,40 @@ +From 80a217f24685373cb2995b87e1559aef2ad48a73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 16:13:37 -0800 +Subject: drm/nouveau/svm: check for SVM initialized before migrating + +From: Ralph Campbell + +[ Upstream commit 822cab6150d3002952407a8297ff5a0d32bb7b54 ] + +When migrating system memory to GPU memory, check that SVM has been +enabled. Even though most errors can be ignored since migration is +a performance optimization, return an error because this is a violation +of the API. + +Signed-off-by: Ralph Campbell +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_svm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c +index df9bf1fd1bc0b..3ec5da025bea7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_svm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c +@@ -171,6 +171,11 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + mm = get_task_mm(current); + down_read(&mm->mmap_sem); + ++ if (!cli->svm.svmm) { ++ up_read(&mm->mmap_sem); ++ return -EINVAL; ++ } ++ + for (addr = args->va_start, end = args->va_start + size; addr < end;) { + struct vm_area_struct *vma; + unsigned long next; +-- +2.20.1 + diff --git a/queue-5.6/drm-nouveau-svm-fix-vma-range-check-for-migration.patch b/queue-5.6/drm-nouveau-svm-fix-vma-range-check-for-migration.patch new file mode 100644 index 00000000000..46af22f7764 --- /dev/null +++ b/queue-5.6/drm-nouveau-svm-fix-vma-range-check-for-migration.patch @@ -0,0 +1,40 @@ +From c50ea0f018047f42c2dcea1a66dc0cb7a910a328 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 16:13:36 -0800 +Subject: drm/nouveau/svm: fix vma range check for migration + +From: Ralph Campbell + +[ Upstream commit b92103b559c77abc5f8b7bec269230a219c880b7 ] + +find_vma_intersection(mm, start, end) only guarantees that end is greater +than or equal to vma->vm_start but doesn't guarantee that start is +greater than or equal to vma->vm_start. The calculation for the +intersecting range in nouveau_svmm_bind() isn't accounting for this and +can call migrate_vma_setup() with a starting address less than +vma->vm_start. This results in migrate_vma_setup() returning -EINVAL for +the range instead of nouveau skipping that part of the range and migrating +the rest. + +Signed-off-by: Ralph Campbell +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_svm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c +index 3ec5da025bea7..c567526b75b83 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_svm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_svm.c +@@ -184,6 +184,7 @@ nouveau_svmm_bind(struct drm_device *dev, void *data, + if (!vma) + break; + ++ addr = max(addr, vma->vm_start); + next = min(vma->vm_end, end); + /* This is a best effort so we ignore errors */ + nouveau_dmem_migrate_vma(cli->drm, vma, addr, next); +-- +2.20.1 + diff --git a/queue-5.6/drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch b/queue-5.6/drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch new file mode 100644 index 00000000000..28381a55e2d --- /dev/null +++ b/queue-5.6/drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch @@ -0,0 +1,146 @@ +From 08775902d8d3f4894d243259cbe7fdcc6f3e48ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Mar 2020 21:29:23 +0100 +Subject: drm/nouveau: workaround runpm fail by disabling PCI power management + on certain intel bridges + +From: Karol Herbst + +[ Upstream commit 434fdb51513bf3057ac144d152e6f2f2b509e857 ] + +Fixes the infamous 'runtime PM' bug many users are facing on Laptops with +Nvidia Pascal GPUs by skipping said PCI power state changes on the GPU. + +Depending on the used kernel there might be messages like those in demsg: + +"nouveau 0000:01:00.0: Refused to change power state, currently in D3" +"nouveau 0000:01:00.0: can't change power state from D3cold to D0 (config +space inaccessible)" +followed by backtraces of kernel crashes or timeouts within nouveau. + +It's still unkown why this issue exists, but this is a reliable workaround +and solves a very annoying issue for user having to choose between a +crashing kernel or higher power consumption of their Laptops. + +Signed-off-by: Karol Herbst +Cc: Bjorn Helgaas +Cc: Lyude Paul +Cc: Rafael J. Wysocki +Cc: Mika Westerberg +Cc: linux-pci@vger.kernel.org +Cc: linux-pm@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Cc: nouveau@lists.freedesktop.org +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=205623 +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_drm.c | 63 +++++++++++++++++++++++++++ + drivers/gpu/drm/nouveau/nouveau_drv.h | 2 + + 2 files changed, 65 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index b65ae817eabf5..2d4c899e1f8b9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -618,6 +618,64 @@ nouveau_drm_device_fini(struct drm_device *dev) + kfree(drm); + } + ++/* ++ * On some Intel PCIe bridge controllers doing a ++ * D0 -> D3hot -> D3cold -> D0 sequence causes Nvidia GPUs to not reappear. ++ * Skipping the intermediate D3hot step seems to make it work again. This is ++ * probably caused by not meeting the expectation the involved AML code has ++ * when the GPU is put into D3hot state before invoking it. ++ * ++ * This leads to various manifestations of this issue: ++ * - AML code execution to power on the GPU hits an infinite loop (as the ++ * code waits on device memory to change). ++ * - kernel crashes, as all PCI reads return -1, which most code isn't able ++ * to handle well enough. ++ * ++ * In all cases dmesg will contain at least one line like this: ++ * 'nouveau 0000:01:00.0: Refused to change power state, currently in D3' ++ * followed by a lot of nouveau timeouts. ++ * ++ * In the \_SB.PCI0.PEG0.PG00._OFF code deeper down writes bit 0x80 to the not ++ * documented PCI config space register 0x248 of the Intel PCIe bridge ++ * controller (0x1901) in order to change the state of the PCIe link between ++ * the PCIe port and the GPU. There are alternative code paths using other ++ * registers, which seem to work fine (executed pre Windows 8): ++ * - 0xbc bit 0x20 (publicly available documentation claims 'reserved') ++ * - 0xb0 bit 0x10 (link disable) ++ * Changing the conditions inside the firmware by poking into the relevant ++ * addresses does resolve the issue, but it seemed to be ACPI private memory ++ * and not any device accessible memory at all, so there is no portable way of ++ * changing the conditions. ++ * On a XPS 9560 that means bits [0,3] on \CPEX need to be cleared. ++ * ++ * The only systems where this behavior can be seen are hybrid graphics laptops ++ * with a secondary Nvidia Maxwell, Pascal or Turing GPU. It's unclear whether ++ * this issue only occurs in combination with listed Intel PCIe bridge ++ * controllers and the mentioned GPUs or other devices as well. ++ * ++ * documentation on the PCIe bridge controller can be found in the ++ * "7th Generation Intel® Processor Families for H Platforms Datasheet Volume 2" ++ * Section "12 PCI Express* Controller (x16) Registers" ++ */ ++ ++static void quirk_broken_nv_runpm(struct pci_dev *pdev) ++{ ++ struct drm_device *dev = pci_get_drvdata(pdev); ++ struct nouveau_drm *drm = nouveau_drm(dev); ++ struct pci_dev *bridge = pci_upstream_bridge(pdev); ++ ++ if (!bridge || bridge->vendor != PCI_VENDOR_ID_INTEL) ++ return; ++ ++ switch (bridge->device) { ++ case 0x1901: ++ drm->old_pm_cap = pdev->pm_cap; ++ pdev->pm_cap = 0; ++ NV_INFO(drm, "Disabling PCI power management to avoid bug\n"); ++ break; ++ } ++} ++ + static int nouveau_drm_probe(struct pci_dev *pdev, + const struct pci_device_id *pent) + { +@@ -699,6 +757,7 @@ static int nouveau_drm_probe(struct pci_dev *pdev, + if (ret) + goto fail_drm_dev_init; + ++ quirk_broken_nv_runpm(pdev); + return 0; + + fail_drm_dev_init: +@@ -734,7 +793,11 @@ static void + nouveau_drm_remove(struct pci_dev *pdev) + { + struct drm_device *dev = pci_get_drvdata(pdev); ++ struct nouveau_drm *drm = nouveau_drm(dev); + ++ /* revert our workaround */ ++ if (drm->old_pm_cap) ++ pdev->pm_cap = drm->old_pm_cap; + nouveau_drm_device_remove(dev); + pci_disable_device(pdev); + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h +index c2c332fbde979..2a6519737800c 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drv.h ++++ b/drivers/gpu/drm/nouveau/nouveau_drv.h +@@ -140,6 +140,8 @@ struct nouveau_drm { + + struct list_head clients; + ++ u8 old_pm_cap; ++ + struct { + struct agp_bridge_data *bridge; + u32 base; +-- +2.20.1 + diff --git a/queue-5.6/drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch b/queue-5.6/drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch new file mode 100644 index 00000000000..bf2ce452a3f --- /dev/null +++ b/queue-5.6/drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch @@ -0,0 +1,51 @@ +From ab5406a9824df841617ed006abb8e0999f52701e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jan 2020 14:07:45 +0800 +Subject: drm/ttm: flush the fence on the bo after we individualize the + reservation object +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +[ Upstream commit 1bbcf69e42fe7fd49b6f4339c970729d0e343753 ] + +As we move the ttm_bo_individualize_resv() upwards, we need flush the +copied fence too. Otherwise the driver keeps waiting for fence. + +run&Kill kfdtest, then perf top. + + 25.53% [ttm] [k] ttm_bo_delayed_delete + 24.29% [kernel] [k] dma_resv_test_signaled_rcu + 19.72% [kernel] [k] ww_mutex_lock + +Fix: 378e2d5b("drm/ttm: fix ttm_bo_cleanup_refs_or_queue once more") +Signed-off-by: xinhui pan +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/series/72339/ +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 5df596fb0280c..fe420ca454e0a 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -498,8 +498,10 @@ static void ttm_bo_cleanup_refs_or_queue(struct ttm_buffer_object *bo) + + dma_resv_unlock(bo->base.resv); + } +- if (bo->base.resv != &bo->base._resv) ++ if (bo->base.resv != &bo->base._resv) { ++ ttm_bo_flush_all_fences(bo); + dma_resv_unlock(&bo->base._resv); ++ } + + error: + kref_get(&bo->list_kref); +-- +2.20.1 + diff --git a/queue-5.6/drm-vc4-fix-hdmi-mode-validation.patch b/queue-5.6/drm-vc4-fix-hdmi-mode-validation.patch new file mode 100644 index 00000000000..3e845d1f0d3 --- /dev/null +++ b/queue-5.6/drm-vc4-fix-hdmi-mode-validation.patch @@ -0,0 +1,61 @@ +From bcfffca23b4508cee5431be8d8ccc587e09f99e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Mar 2020 13:20:01 +0100 +Subject: drm/vc4: Fix HDMI mode validation + +From: Nicolas Saenz Julienne + +[ Upstream commit b1e7396a1d0e6af6806337fdaaa44098d6b3343c ] + +Current mode validation impedes setting up some video modes which should +be supported otherwise. Namely 1920x1200@60Hz. + +Fix this by lowering the minimum HDMI state machine clock to pixel clock +ratio allowed. + +Fixes: 32e823c63e90 ("drm/vc4: Reject HDMI modes with too high of clocks.") +Reported-by: Stefan Wahren +Suggested-by: Dave Stevenson +Signed-off-by: Nicolas Saenz Julienne +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20200326122001.22215-1-nsaenzjulienne@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index cea18dc15f77c..340719238753d 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -681,11 +681,23 @@ static enum drm_mode_status + vc4_hdmi_encoder_mode_valid(struct drm_encoder *crtc, + const struct drm_display_mode *mode) + { +- /* HSM clock must be 108% of the pixel clock. Additionally, +- * the AXI clock needs to be at least 25% of pixel clock, but +- * HSM ends up being the limiting factor. ++ /* ++ * As stated in RPi's vc4 firmware "HDMI state machine (HSM) clock must ++ * be faster than pixel clock, infinitesimally faster, tested in ++ * simulation. Otherwise, exact value is unimportant for HDMI ++ * operation." This conflicts with bcm2835's vc4 documentation, which ++ * states HSM's clock has to be at least 108% of the pixel clock. ++ * ++ * Real life tests reveal that vc4's firmware statement holds up, and ++ * users are able to use pixel clocks closer to HSM's, namely for ++ * 1920x1200@60Hz. So it was decided to have leave a 1% margin between ++ * both clocks. Which, for RPi0-3 implies a maximum pixel clock of ++ * 162MHz. ++ * ++ * Additionally, the AXI clock needs to be at least 25% of ++ * pixel clock, but HSM ends up being the limiting factor. + */ +- if (mode->clock > HSM_CLOCK_FREQ / (1000 * 108 / 100)) ++ if (mode->clock > HSM_CLOCK_FREQ / (1000 * 101 / 100)) + return MODE_CLOCK_HIGH; + + return MODE_OK; +-- +2.20.1 + diff --git a/queue-5.6/dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch b/queue-5.6/dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch new file mode 100644 index 00000000000..7393ad0295d --- /dev/null +++ b/queue-5.6/dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch @@ -0,0 +1,63 @@ +From 9dc587bb8f957d68c9c961e60aa01d75c87a0e88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Mar 2020 12:05:12 -0600 +Subject: dt-bindings: thermal: tsens: Fix nvmem-cell-names schema + +From: Rob Herring + +[ Upstream commit b9589def9f9af93d9d4c5969c9a6c166f070e36e ] + +There's a typo 'nvmem-cells-names' in the schema which means the correct +'nvmem-cell-names' in the examples are not checked. The possible values +are wrong too both in that the 2nd entry is not specified correctly and the +values are just wrong based on the dts files in the kernel. + +Fixes: a877e768f655 ("dt-bindings: thermal: tsens: Convert over to a yaml schema") +Cc: Andy Gross +Cc: Bjorn Andersson +Cc: Amit Kucheria +Cc: Zhang Rui +Cc: Daniel Lezcano +Cc: linux-arm-msm@vger.kernel.org +Cc: linux-pm@vger.kernel.org +Cc: devicetree@vger.kernel.org +Signed-off-by: Rob Herring +Reviewed-by: Amit Kucheria +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/thermal/qcom-tsens.yaml | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml b/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml +index eef13b9446a87..a4df53228122a 100644 +--- a/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml ++++ b/Documentation/devicetree/bindings/thermal/qcom-tsens.yaml +@@ -53,13 +53,12 @@ properties: + description: + Reference to an nvmem node for the calibration data + +- nvmem-cells-names: ++ nvmem-cell-names: + minItems: 1 + maxItems: 2 + items: +- - enum: +- - caldata +- - calsel ++ - const: calib ++ - const: calib_sel + + "#qcom,sensors": + allOf: +@@ -125,7 +124,7 @@ examples: + <0x4a8000 0x1000>; /* SROT */ + + nvmem-cells = <&tsens_caldata>, <&tsens_calsel>; +- nvmem-cell-names = "caldata", "calsel"; ++ nvmem-cell-names = "calib", "calib_sel"; + + interrupts = ; + interrupt-names = "uplow"; +-- +2.20.1 + diff --git a/queue-5.6/ext2-fix-debug-reference-to-ext2_xattr_cache.patch b/queue-5.6/ext2-fix-debug-reference-to-ext2_xattr_cache.patch new file mode 100644 index 00000000000..2128761ac8d --- /dev/null +++ b/queue-5.6/ext2-fix-debug-reference-to-ext2_xattr_cache.patch @@ -0,0 +1,51 @@ +From 90d169c0a412a21d13bafbcefb2714135b9a5271 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Mar 2020 12:40:02 +0100 +Subject: ext2: fix debug reference to ext2_xattr_cache +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Kara + +[ Upstream commit 32302085a8d90859c40cf1a5e8313f575d06ec75 ] + +Fix a debug-only build error in ext2/xattr.c: + +When building without extra debugging, (and with another patch that uses +no_printk() instead of for the ext2-xattr debug-print macros, +this build error happens: + +../fs/ext2/xattr.c: In function ‘ext2_xattr_cache_insert’: +../fs/ext2/xattr.c:869:18: error: ‘ext2_xattr_cache’ undeclared (first use in +this function); did you mean ‘ext2_xattr_list’? + atomic_read(&ext2_xattr_cache->c_entry_count)); + +Fix the problem by removing cached entry count from the debug message +since otherwise we'd have to export the mbcache structure just for that. + +Fixes: be0726d33cb8 ("ext2: convert to mbcache2") +Reported-by: Randy Dunlap +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/ext2/xattr.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c +index b91f99d9482e9..62acbe27d8bf4 100644 +--- a/fs/ext2/xattr.c ++++ b/fs/ext2/xattr.c +@@ -865,8 +865,7 @@ ext2_xattr_cache_insert(struct mb_cache *cache, struct buffer_head *bh) + true); + if (error) { + if (error == -EBUSY) { +- ea_bdebug(bh, "already in cache (%d cache entries)", +- atomic_read(&ext2_xattr_cache->c_entry_count)); ++ ea_bdebug(bh, "already in cache"); + error = 0; + } + } else +-- +2.20.1 + diff --git a/queue-5.6/ext2-fix-empty-body-warnings-when-wextra-is-used.patch b/queue-5.6/ext2-fix-empty-body-warnings-when-wextra-is-used.patch new file mode 100644 index 00000000000..d45cbc297c2 --- /dev/null +++ b/queue-5.6/ext2-fix-empty-body-warnings-when-wextra-is-used.patch @@ -0,0 +1,60 @@ +From 4b48c1d4c7619a648caabe6c9600e593d454e0ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 22 Mar 2020 19:45:41 -0700 +Subject: ext2: fix empty body warnings when -Wextra is used +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit 44a52022e7f15cbaab957df1c14f7a4f527ef7cf ] + +When EXT2_ATTR_DEBUG is not defined, modify the 2 debug macros +to use the no_printk() macro instead of . +This fixes gcc warnings when -Wextra is used: + +../fs/ext2/xattr.c:252:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] +../fs/ext2/xattr.c:258:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] +../fs/ext2/xattr.c:330:42: warning: suggest braces around empty body in an ‘if’ statement [-Wempty-body] +../fs/ext2/xattr.c:872:45: warning: suggest braces around empty body in an ‘else’ statement [-Wempty-body] + +I have verified that the only object code change (with gcc 7.5.0) is +the reversal of some instructions from 'cmp a,b' to 'cmp b,a'. + +Link: https://lore.kernel.org/r/e18a7395-61fb-2093-18e8-ed4f8cf56248@infradead.org +Signed-off-by: Randy Dunlap +Cc: Jan Kara +Cc: linux-ext4@vger.kernel.org +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/ext2/xattr.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c +index 0456bc990b5ee..b91f99d9482e9 100644 +--- a/fs/ext2/xattr.c ++++ b/fs/ext2/xattr.c +@@ -56,6 +56,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -84,8 +85,8 @@ + printk("\n"); \ + } while (0) + #else +-# define ea_idebug(f...) +-# define ea_bdebug(f...) ++# define ea_idebug(inode, f...) no_printk(f) ++# define ea_bdebug(bh, f...) no_printk(f) + #endif + + static int ext2_xattr_set2(struct inode *, struct buffer_head *, +-- +2.20.1 + diff --git a/queue-5.6/ext4-do-not-commit-super-on-read-only-bdev.patch b/queue-5.6/ext4-do-not-commit-super-on-read-only-bdev.patch new file mode 100644 index 00000000000..9f86a588c38 --- /dev/null +++ b/queue-5.6/ext4-do-not-commit-super-on-read-only-bdev.patch @@ -0,0 +1,50 @@ +From d116dc9e9a4936c8f614826094199ba98cb29a83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Mar 2020 14:19:38 -0500 +Subject: ext4: do not commit super on read-only bdev + +From: Eric Sandeen + +[ Upstream commit c96e2b8564adfb8ac14469ebc51ddc1bfecb3ae2 ] + +Under some circumstances we may encounter a filesystem error on a +read-only block device, and if we try to save the error info to the +superblock and commit it, we'll wind up with a noisy error and +backtrace, i.e.: + +[ 3337.146838] EXT4-fs error (device pmem1p2): ext4_get_journal_inode:4634: comm mount: inode #0: comm mount: iget: illegal inode # +------------[ cut here ]------------ +generic_make_request: Trying to write to read-only block-device pmem1p2 (partno 2) +WARNING: CPU: 107 PID: 115347 at block/blk-core.c:788 generic_make_request_checks+0x6b4/0x7d0 +... + +To avoid this, commit the error info in the superblock only if the +block device is writable. + +Reported-by: Ritesh Harjani +Signed-off-by: Eric Sandeen +Reviewed-by: Andreas Dilger +Link: https://lore.kernel.org/r/4b6e774d-cc00-3469-7abb-108eb151071a@sandeen.net +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index a985b2c585d24..16da3b3481a4d 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -372,7 +372,8 @@ static void save_error_info(struct super_block *sb, const char *func, + unsigned int line) + { + __save_error_info(sb, func, line); +- ext4_commit_super(sb, 1); ++ if (!bdev_read_only(sb->s_bdev)) ++ ext4_commit_super(sb, 1); + } + + /* +-- +2.20.1 + diff --git a/queue-5.6/f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch b/queue-5.6/f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch new file mode 100644 index 00000000000..d963516d2b9 --- /dev/null +++ b/queue-5.6/f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch @@ -0,0 +1,64 @@ +From 4a9e6dfb2cf659378f1f964c745e42f58e223420 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 19:59:26 +0530 +Subject: f2fs: Add a new CP flag to help fsck fix resize SPO issues + +From: Sahitya Tummala + +[ Upstream commit c84ef3c5e65ccf99a7a91a4d731ebb5d6331a178 ] + +Add and set a new CP flag CP_RESIZEFS_FLAG during +online resize FS to help fsck fix the metadata mismatch +that may happen due to SPO during resize, where SB +got updated but CP data couldn't be written yet. + +fsck errors - +Info: CKPT version = 6ed7bccb + Wrong user_block_count(2233856) +[f2fs_do_mount:3365] Checkpoint is polluted + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/checkpoint.c | 8 ++++++-- + include/linux/f2fs_fs.h | 1 + + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 9c88fb3d255a2..79aaf06004f65 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1301,10 +1301,14 @@ static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc) + else + __clear_ckpt_flags(ckpt, CP_ORPHAN_PRESENT_FLAG); + +- if (is_sbi_flag_set(sbi, SBI_NEED_FSCK) || +- is_sbi_flag_set(sbi, SBI_IS_RESIZEFS)) ++ if (is_sbi_flag_set(sbi, SBI_NEED_FSCK)) + __set_ckpt_flags(ckpt, CP_FSCK_FLAG); + ++ if (is_sbi_flag_set(sbi, SBI_IS_RESIZEFS)) ++ __set_ckpt_flags(ckpt, CP_RESIZEFS_FLAG); ++ else ++ __clear_ckpt_flags(ckpt, CP_RESIZEFS_FLAG); ++ + if (is_sbi_flag_set(sbi, SBI_CP_DISABLED)) + __set_ckpt_flags(ckpt, CP_DISABLED_FLAG); + else +diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h +index ac3f4888b3dfa..3c383ddd92ddd 100644 +--- a/include/linux/f2fs_fs.h ++++ b/include/linux/f2fs_fs.h +@@ -125,6 +125,7 @@ struct f2fs_super_block { + /* + * For checkpoint + */ ++#define CP_RESIZEFS_FLAG 0x00004000 + #define CP_DISABLED_QUICK_FLAG 0x00002000 + #define CP_DISABLED_FLAG 0x00001000 + #define CP_QUOTA_NEED_FSCK_FLAG 0x00000800 +-- +2.20.1 + diff --git a/queue-5.6/f2fs-compress-fix-to-call-missing-destroy_compress_c.patch b/queue-5.6/f2fs-compress-fix-to-call-missing-destroy_compress_c.patch new file mode 100644 index 00000000000..4fe6749f43e --- /dev/null +++ b/queue-5.6/f2fs-compress-fix-to-call-missing-destroy_compress_c.patch @@ -0,0 +1,34 @@ +From 711788372890342fd0043f7e5517f1ef346305ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 16:57:06 +0800 +Subject: f2fs: compress: fix to call missing destroy_compress_ctx() + +From: Chao Yu + +[ Upstream commit 09ff48011e220e2b4f1d9ce2f472ecb63645cbfc ] + +Otherwise, it will cause memory leak. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 927db1205bd81..1a86e483b0907 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -395,6 +395,8 @@ static int f2fs_compress_pages(struct compress_ctx *cc) + cc->cpages[i] = NULL; + } + ++ cops->destroy_compress_ctx(cc); ++ + cc->nr_cpages = nr_cpages; + + trace_f2fs_compress_pages_end(cc->inode, cc->cluster_idx, +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch b/queue-5.6/f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch new file mode 100644 index 00000000000..54425e1a0b7 --- /dev/null +++ b/queue-5.6/f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch @@ -0,0 +1,47 @@ +From b8f3ff8ea69110817bd03b642858dda3edc4b4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Feb 2020 20:50:37 -0800 +Subject: f2fs: fix leaking uninitialized memory in compressed clusters + +From: Eric Biggers + +[ Upstream commit 7fa6d59816e7d81cfd4f854468c477c12b85c789 ] + +When the compressed data of a cluster doesn't end on a page boundary, +the remainder of the last page must be zeroed in order to avoid leaking +uninitialized memory to disk. + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Signed-off-by: Eric Biggers +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 11b13b881ada5..837e14b7ef523 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -385,11 +385,15 @@ static int f2fs_compress_pages(struct compress_ctx *cc) + for (i = 0; i < COMPRESS_DATA_RESERVED_SIZE; i++) + cc->cbuf->reserved[i] = cpu_to_le32(0); + ++ nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE); ++ ++ /* zero out any unused part of the last page */ ++ memset(&cc->cbuf->cdata[cc->clen], 0, ++ (nr_cpages * PAGE_SIZE) - (cc->clen + COMPRESS_HEADER_SIZE)); ++ + vunmap(cc->cbuf); + vunmap(cc->rbuf); + +- nr_cpages = DIV_ROUND_UP(cc->clen + COMPRESS_HEADER_SIZE, PAGE_SIZE); +- + for (i = nr_cpages; i < cc->nr_cpages; i++) { + f2fs_put_compressed_page(cc->cpages[i]); + cc->cpages[i] = NULL; +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch b/queue-5.6/f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch new file mode 100644 index 00000000000..08d173dbf70 --- /dev/null +++ b/queue-5.6/f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch @@ -0,0 +1,53 @@ +From 461b9c13d0975d6ae5f25854aaaece87b8acd752 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 19:59:25 +0530 +Subject: f2fs: Fix mount failure due to SPO after a successful online resize + FS + +From: Sahitya Tummala + +[ Upstream commit 682756827501dc52593bf490f2d437c65ec9efcb ] + +Even though online resize is successfully done, a SPO immediately +after resize, still causes below error in the next mount. + +[ 11.294650] F2FS-fs (sda8): Wrong user_block_count: 2233856 +[ 11.300272] F2FS-fs (sda8): Failed to get valid F2FS checkpoint + +This is because after FS metadata is updated in update_fs_metadata() +if the SBI_IS_DIRTY is not dirty, then CP will not be done to reflect +the new user_block_count. + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 9cff2502e3bc6..2f645c591a000 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1579,11 +1579,17 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) + goto out; + } + ++ mutex_lock(&sbi->cp_mutex); + update_fs_metadata(sbi, -secs); + clear_sbi_flag(sbi, SBI_IS_RESIZEFS); ++ set_sbi_flag(sbi, SBI_IS_DIRTY); ++ mutex_unlock(&sbi->cp_mutex); ++ + err = f2fs_sync_fs(sbi->sb, 1); + if (err) { ++ mutex_lock(&sbi->cp_mutex); + update_fs_metadata(sbi, secs); ++ mutex_unlock(&sbi->cp_mutex); + update_sb_metadata(sbi, secs); + f2fs_commit_super(sbi, false); + } +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch b/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch new file mode 100644 index 00000000000..22b5b688c40 --- /dev/null +++ b/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch @@ -0,0 +1,104 @@ +From cdf72acee5d87dca8afe89041ecb15df504dd815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Mar 2020 17:43:04 +0800 +Subject: f2fs: fix NULL pointer dereference in f2fs_verity_work() + +From: Chao Yu + +[ Upstream commit 79bbefb19f1359fb2cbd144d5a054649e7e583be ] + +If both compression and fsverity feature is on, generic/572 will +report below NULL pointer dereference bug. + + BUG: kernel NULL pointer dereference, address: 0000000000000018 + RIP: 0010:f2fs_verity_work+0x60/0x90 [f2fs] + #PF: supervisor read access in kernel mode + Workqueue: fsverity_read_queue f2fs_verity_work [f2fs] + RIP: 0010:f2fs_verity_work+0x60/0x90 [f2fs] + Call Trace: + process_one_work+0x16c/0x3f0 + worker_thread+0x4c/0x440 + ? rescuer_thread+0x350/0x350 + kthread+0xf8/0x130 + ? kthread_unpark+0x70/0x70 + ret_from_fork+0x35/0x40 + +There are two issue in f2fs_verity_work(): +- it needs to traverse and verify all pages in bio. +- if pages in bio belong to non-compressed cluster, accessing +decompress IO context stored in page private will cause NULL +pointer dereference. + +Fix them. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 ++ + fs/f2fs/data.c | 35 ++++++++++++++++++++++++++++++----- + 2 files changed, 32 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index 1a86e483b0907..eb84c13c1182c 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -476,6 +476,8 @@ void f2fs_decompress_pages(struct bio *bio, struct page *page, bool verity) + out_vunmap_rbuf: + vunmap(dic->rbuf); + out_free_dic: ++ if (verity) ++ refcount_add(dic->nr_cpages - 1, &dic->ref); + if (!verity) + f2fs_decompress_end_io(dic->rpages, dic->cluster_size, + ret, false); +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index b27b721079116..34990866cfe96 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -191,12 +191,37 @@ static void f2fs_verify_pages(struct page **rpages, unsigned int cluster_size) + + static void f2fs_verify_bio(struct bio *bio) + { +- struct page *page = bio_first_page_all(bio); +- struct decompress_io_ctx *dic = +- (struct decompress_io_ctx *)page_private(page); ++ struct bio_vec *bv; ++ struct bvec_iter_all iter_all; ++ ++ bio_for_each_segment_all(bv, bio, iter_all) { ++ struct page *page = bv->bv_page; ++ struct decompress_io_ctx *dic; ++ ++ dic = (struct decompress_io_ctx *)page_private(page); ++ ++ if (dic) { ++ if (refcount_dec_not_one(&dic->ref)) ++ continue; ++ f2fs_verify_pages(dic->rpages, ++ dic->cluster_size); ++ f2fs_free_dic(dic); ++ continue; ++ } ++ ++ if (bio->bi_status || PageError(page)) ++ goto clear_uptodate; + +- f2fs_verify_pages(dic->rpages, dic->cluster_size); +- f2fs_free_dic(dic); ++ if (fsverity_verify_page(page)) { ++ SetPageUptodate(page); ++ goto unlock; ++ } ++clear_uptodate: ++ ClearPageUptodate(page); ++ ClearPageError(page); ++unlock: ++ unlock_page(page); ++ } + } + #endif + +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch b/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch new file mode 100644 index 00000000000..1d07e858c3c --- /dev/null +++ b/queue-5.6/f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch @@ -0,0 +1,77 @@ +From cf36e3a860fc9c96e48d57ea09b66a9e6c86f146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Mar 2020 19:58:00 +0800 +Subject: f2fs: fix NULL pointer dereference in f2fs_write_begin() + +From: Chao Yu + +[ Upstream commit 62f63eea291b50a5677ae7503ac128803174698a ] + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +RIP: 0010:f2fs_write_begin+0x823/0xb90 [f2fs] +Call Trace: + f2fs_quota_write+0x139/0x1d0 [f2fs] + write_blk+0x36/0x80 [quota_tree] + get_free_dqblk+0x42/0xa0 [quota_tree] + do_insert_tree+0x235/0x4a0 [quota_tree] + do_insert_tree+0x26e/0x4a0 [quota_tree] + do_insert_tree+0x26e/0x4a0 [quota_tree] + do_insert_tree+0x26e/0x4a0 [quota_tree] + qtree_write_dquot+0x70/0x190 [quota_tree] + v2_write_dquot+0x43/0x90 [quota_v2] + dquot_acquire+0x77/0x100 + f2fs_dquot_acquire+0x2f/0x60 [f2fs] + dqget+0x310/0x450 + dquot_transfer+0x7e/0x120 + f2fs_setattr+0x11a/0x4a0 [f2fs] + notify_change+0x349/0x480 + chown_common+0x168/0x1c0 + do_fchownat+0xbc/0xf0 + __x64_sys_fchownat+0x20/0x30 + do_syscall_64+0x5f/0x220 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Passing fsdata parameter to .write_{begin,end} in f2fs_quota_write(), +so that if quota file is compressed one, we can avoid above NULL +pointer dereference when updating quota content. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 3669f060b6257..8deb0a260d928 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1929,6 +1929,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type, + int offset = off & (sb->s_blocksize - 1); + size_t towrite = len; + struct page *page; ++ void *fsdata = NULL; + char *kaddr; + int err = 0; + int tocopy; +@@ -1938,7 +1939,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type, + towrite); + retry: + err = a_ops->write_begin(NULL, mapping, off, tocopy, 0, +- &page, NULL); ++ &page, &fsdata); + if (unlikely(err)) { + if (err == -ENOMEM) { + congestion_wait(BLK_RW_ASYNC, HZ/50); +@@ -1954,7 +1955,7 @@ static ssize_t f2fs_quota_write(struct super_block *sb, int type, + flush_dcache_page(page); + + a_ops->write_end(NULL, mapping, off, tocopy, tocopy, +- page, NULL); ++ page, fsdata); + offset = 0; + towrite -= tocopy; + off += tocopy; +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch b/queue-5.6/f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch new file mode 100644 index 00000000000..b453b527f0c --- /dev/null +++ b/queue-5.6/f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch @@ -0,0 +1,213 @@ +From 3b2769e4930a0ebc4c195f885305251b80943794 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Mar 2020 11:18:07 +0800 +Subject: f2fs: fix potential .flags overflow on 32bit architecture + +From: Chao Yu + +[ Upstream commit 7653b9d87516ed65e112d2273c65eca6f97d0a27 ] + +f2fs_inode_info.flags is unsigned long variable, it has 32 bits +in 32bit architecture, since we introduced FI_MMAP_FILE flag +when we support data compression, we may access memory cross +the border of .flags field, corrupting .i_sem field, result in +below deadlock. + +To fix this issue, let's expand .flags as an array to grab enough +space to store new flags. + +Call Trace: + __schedule+0x8d0/0x13fc + ? mark_held_locks+0xac/0x100 + schedule+0xcc/0x260 + rwsem_down_write_slowpath+0x3ab/0x65d + down_write+0xc7/0xe0 + f2fs_drop_nlink+0x3d/0x600 [f2fs] + f2fs_delete_inline_entry+0x300/0x440 [f2fs] + f2fs_delete_entry+0x3a1/0x7f0 [f2fs] + f2fs_unlink+0x500/0x790 [f2fs] + vfs_unlink+0x211/0x490 + do_unlinkat+0x483/0x520 + sys_unlink+0x4a/0x70 + do_fast_syscall_32+0x12b/0x683 + entry_SYSENTER_32+0xaa/0x102 + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Tested-by: Ondrej Jirman +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 99 ++++++++++++++++++++++++------------------------- + fs/f2fs/inode.c | 2 +- + 2 files changed, 50 insertions(+), 51 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 64caa46f0c8bd..71801a1709f0f 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -676,6 +676,44 @@ enum { + MAX_GC_FAILURE + }; + ++/* used for f2fs_inode_info->flags */ ++enum { ++ FI_NEW_INODE, /* indicate newly allocated inode */ ++ FI_DIRTY_INODE, /* indicate inode is dirty or not */ ++ FI_AUTO_RECOVER, /* indicate inode is recoverable */ ++ FI_DIRTY_DIR, /* indicate directory has dirty pages */ ++ FI_INC_LINK, /* need to increment i_nlink */ ++ FI_ACL_MODE, /* indicate acl mode */ ++ FI_NO_ALLOC, /* should not allocate any blocks */ ++ FI_FREE_NID, /* free allocated nide */ ++ FI_NO_EXTENT, /* not to use the extent cache */ ++ FI_INLINE_XATTR, /* used for inline xattr */ ++ FI_INLINE_DATA, /* used for inline data*/ ++ FI_INLINE_DENTRY, /* used for inline dentry */ ++ FI_APPEND_WRITE, /* inode has appended data */ ++ FI_UPDATE_WRITE, /* inode has in-place-update data */ ++ FI_NEED_IPU, /* used for ipu per file */ ++ FI_ATOMIC_FILE, /* indicate atomic file */ ++ FI_ATOMIC_COMMIT, /* indicate the state of atomical committing */ ++ FI_VOLATILE_FILE, /* indicate volatile file */ ++ FI_FIRST_BLOCK_WRITTEN, /* indicate #0 data block was written */ ++ FI_DROP_CACHE, /* drop dirty page cache */ ++ FI_DATA_EXIST, /* indicate data exists */ ++ FI_INLINE_DOTS, /* indicate inline dot dentries */ ++ FI_DO_DEFRAG, /* indicate defragment is running */ ++ FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */ ++ FI_NO_PREALLOC, /* indicate skipped preallocated blocks */ ++ FI_HOT_DATA, /* indicate file is hot */ ++ FI_EXTRA_ATTR, /* indicate file has extra attribute */ ++ FI_PROJ_INHERIT, /* indicate file inherits projectid */ ++ FI_PIN_FILE, /* indicate file should not be gced */ ++ FI_ATOMIC_REVOKE_REQUEST, /* request to drop atomic data */ ++ FI_VERITY_IN_PROGRESS, /* building fs-verity Merkle tree */ ++ FI_COMPRESSED_FILE, /* indicate file's data can be compressed */ ++ FI_MMAP_FILE, /* indicate file was mmapped */ ++ FI_MAX, /* max flag, never be used */ ++}; ++ + struct f2fs_inode_info { + struct inode vfs_inode; /* serve a vfs inode */ + unsigned long i_flags; /* keep an inode flags for ioctl */ +@@ -688,7 +726,7 @@ struct f2fs_inode_info { + umode_t i_acl_mode; /* keep file acl mode temporarily */ + + /* Use below internally in f2fs*/ +- unsigned long flags; /* use to pass per-file flags */ ++ unsigned long flags[BITS_TO_LONGS(FI_MAX)]; /* use to pass per-file flags */ + struct rw_semaphore i_sem; /* protect fi info */ + atomic_t dirty_pages; /* # of dirty pages */ + f2fs_hash_t chash; /* hash value of given file name */ +@@ -2498,43 +2536,6 @@ static inline __u32 f2fs_mask_flags(umode_t mode, __u32 flags) + return flags & F2FS_OTHER_FLMASK; + } + +-/* used for f2fs_inode_info->flags */ +-enum { +- FI_NEW_INODE, /* indicate newly allocated inode */ +- FI_DIRTY_INODE, /* indicate inode is dirty or not */ +- FI_AUTO_RECOVER, /* indicate inode is recoverable */ +- FI_DIRTY_DIR, /* indicate directory has dirty pages */ +- FI_INC_LINK, /* need to increment i_nlink */ +- FI_ACL_MODE, /* indicate acl mode */ +- FI_NO_ALLOC, /* should not allocate any blocks */ +- FI_FREE_NID, /* free allocated nide */ +- FI_NO_EXTENT, /* not to use the extent cache */ +- FI_INLINE_XATTR, /* used for inline xattr */ +- FI_INLINE_DATA, /* used for inline data*/ +- FI_INLINE_DENTRY, /* used for inline dentry */ +- FI_APPEND_WRITE, /* inode has appended data */ +- FI_UPDATE_WRITE, /* inode has in-place-update data */ +- FI_NEED_IPU, /* used for ipu per file */ +- FI_ATOMIC_FILE, /* indicate atomic file */ +- FI_ATOMIC_COMMIT, /* indicate the state of atomical committing */ +- FI_VOLATILE_FILE, /* indicate volatile file */ +- FI_FIRST_BLOCK_WRITTEN, /* indicate #0 data block was written */ +- FI_DROP_CACHE, /* drop dirty page cache */ +- FI_DATA_EXIST, /* indicate data exists */ +- FI_INLINE_DOTS, /* indicate inline dot dentries */ +- FI_DO_DEFRAG, /* indicate defragment is running */ +- FI_DIRTY_FILE, /* indicate regular/symlink has dirty pages */ +- FI_NO_PREALLOC, /* indicate skipped preallocated blocks */ +- FI_HOT_DATA, /* indicate file is hot */ +- FI_EXTRA_ATTR, /* indicate file has extra attribute */ +- FI_PROJ_INHERIT, /* indicate file inherits projectid */ +- FI_PIN_FILE, /* indicate file should not be gced */ +- FI_ATOMIC_REVOKE_REQUEST, /* request to drop atomic data */ +- FI_VERITY_IN_PROGRESS, /* building fs-verity Merkle tree */ +- FI_COMPRESSED_FILE, /* indicate file's data can be compressed */ +- FI_MMAP_FILE, /* indicate file was mmapped */ +-}; +- + static inline void __mark_inode_dirty_flag(struct inode *inode, + int flag, bool set) + { +@@ -2556,20 +2557,18 @@ static inline void __mark_inode_dirty_flag(struct inode *inode, + + static inline void set_inode_flag(struct inode *inode, int flag) + { +- if (!test_bit(flag, &F2FS_I(inode)->flags)) +- set_bit(flag, &F2FS_I(inode)->flags); ++ test_and_set_bit(flag, F2FS_I(inode)->flags); + __mark_inode_dirty_flag(inode, flag, true); + } + + static inline int is_inode_flag_set(struct inode *inode, int flag) + { +- return test_bit(flag, &F2FS_I(inode)->flags); ++ return test_bit(flag, F2FS_I(inode)->flags); + } + + static inline void clear_inode_flag(struct inode *inode, int flag) + { +- if (test_bit(flag, &F2FS_I(inode)->flags)) +- clear_bit(flag, &F2FS_I(inode)->flags); ++ test_and_clear_bit(flag, F2FS_I(inode)->flags); + __mark_inode_dirty_flag(inode, flag, false); + } + +@@ -2660,19 +2659,19 @@ static inline void get_inline_info(struct inode *inode, struct f2fs_inode *ri) + struct f2fs_inode_info *fi = F2FS_I(inode); + + if (ri->i_inline & F2FS_INLINE_XATTR) +- set_bit(FI_INLINE_XATTR, &fi->flags); ++ set_bit(FI_INLINE_XATTR, fi->flags); + if (ri->i_inline & F2FS_INLINE_DATA) +- set_bit(FI_INLINE_DATA, &fi->flags); ++ set_bit(FI_INLINE_DATA, fi->flags); + if (ri->i_inline & F2FS_INLINE_DENTRY) +- set_bit(FI_INLINE_DENTRY, &fi->flags); ++ set_bit(FI_INLINE_DENTRY, fi->flags); + if (ri->i_inline & F2FS_DATA_EXIST) +- set_bit(FI_DATA_EXIST, &fi->flags); ++ set_bit(FI_DATA_EXIST, fi->flags); + if (ri->i_inline & F2FS_INLINE_DOTS) +- set_bit(FI_INLINE_DOTS, &fi->flags); ++ set_bit(FI_INLINE_DOTS, fi->flags); + if (ri->i_inline & F2FS_EXTRA_ATTR) +- set_bit(FI_EXTRA_ATTR, &fi->flags); ++ set_bit(FI_EXTRA_ATTR, fi->flags); + if (ri->i_inline & F2FS_PIN_FILE) +- set_bit(FI_PIN_FILE, &fi->flags); ++ set_bit(FI_PIN_FILE, fi->flags); + } + + static inline void set_raw_inline(struct inode *inode, struct f2fs_inode *ri) +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 78c3f1d70f1dc..901e9f4ce12b5 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -345,7 +345,7 @@ static int do_read_inode(struct inode *inode) + fi->i_flags = le32_to_cpu(ri->i_flags); + if (S_ISREG(inode->i_mode)) + fi->i_flags &= ~F2FS_PROJINHERIT_FL; +- fi->flags = 0; ++ bitmap_zero(fi->flags, FI_MAX); + fi->i_advise = ri->i_advise; + fi->i_pino = le32_to_cpu(ri->i_pino); + fi->i_dir_level = ri->i_dir_level; +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-potential-deadlock-on-compressed-quota-file.patch b/queue-5.6/f2fs-fix-potential-deadlock-on-compressed-quota-file.patch new file mode 100644 index 00000000000..c26fc2f3d83 --- /dev/null +++ b/queue-5.6/f2fs-fix-potential-deadlock-on-compressed-quota-file.patch @@ -0,0 +1,147 @@ +From 310f693b9def7c94052404088ce829f7e2dc27c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Mar 2020 18:14:31 +0800 +Subject: f2fs: fix potential deadlock on compressed quota file + +From: Chao Yu + +[ Upstream commit 466357dc9b5ff555d16b7f9a0ff264eb9d5d908b ] + +generic/232 reports below deadlock: + +fsstress D 0 96980 96969 0x00084000 +Call Trace: + schedule+0x4a/0xb0 + io_schedule+0x12/0x40 + __lock_page+0x127/0x1d0 + pagecache_get_page+0x1d8/0x250 + prepare_compress_overwrite+0xe0/0x490 [f2fs] + f2fs_prepare_compress_overwrite+0x5d/0x80 [f2fs] + f2fs_write_begin+0x833/0xb90 [f2fs] + f2fs_quota_write+0x145/0x1e0 [f2fs] + write_blk+0x36/0x80 [quota_tree] + do_insert_tree+0x2ac/0x4a0 [quota_tree] + do_insert_tree+0x26e/0x4a0 [quota_tree] + qtree_write_dquot+0x70/0x190 [quota_tree] + v2_write_dquot+0x43/0x90 [quota_v2] + dquot_acquire+0x77/0x100 + f2fs_dquot_acquire+0x2f/0x60 [f2fs] + dqget+0x310/0x450 + dquot_transfer+0xb2/0x120 + f2fs_setattr+0x11a/0x4a0 [f2fs] + notify_change+0x349/0x480 + chown_common+0x168/0x1c0 + do_fchownat+0xbc/0xf0 + __x64_sys_lchown+0x21/0x30 + do_syscall_64+0x5f/0x220 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + task PC stack pid father +kworker/u256:0 D 0 103444 2 0x80084000 +Workqueue: writeback wb_workfn (flush-251:1) +Call Trace: + schedule+0x4a/0xb0 + schedule_timeout+0x15e/0x2f0 + io_schedule_timeout+0x19/0x40 + congestion_wait+0x7e/0x120 + f2fs_write_multi_pages+0x12a/0x840 [f2fs] + f2fs_write_cache_pages+0x48f/0x790 [f2fs] + f2fs_write_data_pages+0x2db/0x330 [f2fs] + do_writepages+0x1a/0x60 + __writeback_single_inode+0x3d/0x340 + writeback_sb_inodes+0x225/0x4a0 + wb_writeback+0xf7/0x320 + wb_workfn+0xba/0x470 + process_one_work+0x16c/0x3f0 + worker_thread+0x4c/0x440 + kthread+0xf8/0x130 + ret_from_fork+0x35/0x40 + +fsstress D 0 5277 5266 0x00084000 +Call Trace: + schedule+0x4a/0xb0 + rwsem_down_write_slowpath+0x29d/0x540 + block_operations+0x105/0x360 [f2fs] + f2fs_write_checkpoint+0x101/0x1010 [f2fs] + f2fs_sync_fs+0xa8/0x130 [f2fs] + f2fs_do_sync_file+0x1ad/0x890 [f2fs] + do_fsync+0x38/0x60 + __x64_sys_fdatasync+0x13/0x20 + do_syscall_64+0x5f/0x220 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The root cause is there is potential deadlock between quota data +update and writeback. + +Kworker Thread B Thread C +- f2fs_write_cache_pages + - lock whole cluster --- A + - f2fs_write_multi_pages + - f2fs_write_raw_pages + - f2fs_write_single_data_page + - f2fs_do_write_data_page + - f2fs_setattr + - f2fs_lock_op --- B + - f2fs_write_checkpoint + - block_operations + - f2fs_lock_all --- B + - dquot_transfer + - f2fs_quota_write + - f2fs_prepare_compress_overwrite + - pagecache_get_page --- A + - f2fs_trylock_op failed --- B + - congestion_wait + - goto rewrite + +To fix this issue, during quota file writeback, just redirty all pages +left in cluster rather holding pages' lock in cluster and looping retrying +lock cp_rwsem. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index eb84c13c1182c..ad8e25a1fbc26 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -988,6 +988,15 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc, + unlock_page(cc->rpages[i]); + ret = 0; + } else if (ret == -EAGAIN) { ++ /* ++ * for quota file, just redirty left pages to ++ * avoid deadlock caused by cluster update race ++ * from foreground operation. ++ */ ++ if (IS_NOQUOTA(cc->inode)) { ++ err = 0; ++ goto out_err; ++ } + ret = 0; + cond_resched(); + congestion_wait(BLK_RW_ASYNC, HZ/50); +@@ -996,16 +1005,12 @@ static int f2fs_write_raw_pages(struct compress_ctx *cc, + goto retry_write; + } + err = ret; +- goto out_fail; ++ goto out_err; + } + + *submitted += _submitted; + } + return 0; +- +-out_fail: +- /* TODO: revoke partially updated block addresses */ +- BUG_ON(compr_blocks); + out_err: + for (++i; i < cc->cluster_size; i++) { + if (!cc->rpages[i]) +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-the-panic-in-do_checkpoint.patch b/queue-5.6/f2fs-fix-the-panic-in-do_checkpoint.patch new file mode 100644 index 00000000000..24388a7dc49 --- /dev/null +++ b/queue-5.6/f2fs-fix-the-panic-in-do_checkpoint.patch @@ -0,0 +1,135 @@ +From e1233817c8379fc55d545a79d64a2913a2c14285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Feb 2020 09:19:07 +0530 +Subject: f2fs: fix the panic in do_checkpoint() + +From: Sahitya Tummala + +[ Upstream commit bf22c3cc8ce71454dddd772284773306a68031d8 ] + +There could be a scenario where f2fs_sync_meta_pages() will not +ensure that all F2FS_DIRTY_META pages are submitted for IO. Thus, +resulting in the below panic in do_checkpoint() - + +f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) && + !f2fs_cp_error(sbi)); + +This can happen in a low-memory condition, where shrinker could +also be doing the writepage operation (stack shown below) +at the same time when checkpoint is running on another core. + +schedule +down_write +f2fs_submit_page_write -> by this time, this page in page cache is tagged + as PAGECACHE_TAG_WRITEBACK and PAGECACHE_TAG_DIRTY + is cleared, due to which f2fs_sync_meta_pages() + cannot sync this page in do_checkpoint() path. +f2fs_do_write_meta_page +__f2fs_write_meta_page +f2fs_write_meta_page +shrink_page_list +shrink_inactive_list +shrink_node_memcg +shrink_node +kswapd + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/checkpoint.c | 16 +++++++--------- + fs/f2fs/f2fs.h | 2 +- + fs/f2fs/super.c | 2 +- + 3 files changed, 9 insertions(+), 11 deletions(-) + +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 44e84ac5c9411..9c88fb3d255a2 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1250,20 +1250,20 @@ static void unblock_operations(struct f2fs_sb_info *sbi) + f2fs_unlock_all(sbi); + } + +-void f2fs_wait_on_all_pages_writeback(struct f2fs_sb_info *sbi) ++void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type) + { + DEFINE_WAIT(wait); + + for (;;) { + prepare_to_wait(&sbi->cp_wait, &wait, TASK_UNINTERRUPTIBLE); + +- if (!get_pages(sbi, F2FS_WB_CP_DATA)) ++ if (!get_pages(sbi, type)) + break; + + if (unlikely(f2fs_cp_error(sbi))) + break; + +- io_schedule_timeout(5*HZ); ++ io_schedule_timeout(HZ/50); + } + finish_wait(&sbi->cp_wait, &wait); + } +@@ -1384,8 +1384,6 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) + + /* Flush all the NAT/SIT pages */ + f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_CP_META_IO); +- f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) && +- !f2fs_cp_error(sbi)); + + /* + * modify checkpoint +@@ -1493,11 +1491,11 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) + + /* Here, we have one bio having CP pack except cp pack 2 page */ + f2fs_sync_meta_pages(sbi, META, LONG_MAX, FS_CP_META_IO); +- f2fs_bug_on(sbi, get_pages(sbi, F2FS_DIRTY_META) && +- !f2fs_cp_error(sbi)); ++ /* Wait for all dirty meta pages to be submitted for IO */ ++ f2fs_wait_on_all_pages(sbi, F2FS_DIRTY_META); + + /* wait for previous submitted meta pages writeback */ +- f2fs_wait_on_all_pages_writeback(sbi); ++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA); + + /* flush all device cache */ + err = f2fs_flush_device_cache(sbi); +@@ -1506,7 +1504,7 @@ static int do_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc) + + /* barrier and flush checkpoint cp pack 2 page if it can */ + commit_checkpoint(sbi, ckpt, start_blk); +- f2fs_wait_on_all_pages_writeback(sbi); ++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA); + + /* + * invalidate intermediate page cache borrowed from meta inode which are +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 5355be6b6755c..d39f5de114208 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -3308,7 +3308,7 @@ int f2fs_get_valid_checkpoint(struct f2fs_sb_info *sbi); + void f2fs_update_dirty_page(struct inode *inode, struct page *page); + void f2fs_remove_dirty_inode(struct inode *inode); + int f2fs_sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type); +-void f2fs_wait_on_all_pages_writeback(struct f2fs_sb_info *sbi); ++void f2fs_wait_on_all_pages(struct f2fs_sb_info *sbi, int type); + int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc); + void f2fs_init_ino_entry_info(struct f2fs_sb_info *sbi); + int __init f2fs_create_checkpoint_caches(void); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 65a7a432dfee2..686f5402660ed 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -1172,7 +1172,7 @@ static void f2fs_put_super(struct super_block *sb) + /* our cp_error case, we can wait for any writeback page */ + f2fs_flush_merged_writes(sbi); + +- f2fs_wait_on_all_pages_writeback(sbi); ++ f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA); + + f2fs_bug_on(sbi, sbi->fsync_node_num); + +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch b/queue-5.6/f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch new file mode 100644 index 00000000000..960c79ada76 --- /dev/null +++ b/queue-5.6/f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch @@ -0,0 +1,100 @@ +From f84b1177fc36f5fea4cddc6830816f166b4c0fbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 10:45:29 +0800 +Subject: f2fs: fix to account compressed blocks in f2fs_compressed_blocks() + +From: Chao Yu + +[ Upstream commit 1a67cbe141cf991af252a88143d0fd975be2d9e7 ] + +por_fsstress reports inconsistent status in orphan inode, the root cause +of this is in f2fs_write_raw_pages() we decrease i_compr_blocks incorrectly +due to wrong calculation in f2fs_compressed_blocks(). + +So this patch exposes below two functions based on __f2fs_cluster_blocks: +- f2fs_compressed_blocks: get count of compressed blocks in compressed cluster +- f2fs_cluster_blocks: get count of valid blocks (including reserved blocks) +in compressed cluster. + +Then use f2fs_compress_blocks() to get correct compressed blocks count in +f2fs_write_raw_pages(). + +sanity_check_inode: inode (ino=ad80) hash inconsistent i_compr_blocks:2, i_blocks:1, run fsck to fix + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index ad8e25a1fbc26..11b13b881ada5 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -536,8 +536,7 @@ static bool __cluster_may_compress(struct compress_ctx *cc) + return true; + } + +-/* return # of compressed block addresses */ +-static int f2fs_compressed_blocks(struct compress_ctx *cc) ++static int __f2fs_cluster_blocks(struct compress_ctx *cc, bool compr) + { + struct dnode_of_data dn; + int ret; +@@ -560,8 +559,13 @@ static int f2fs_compressed_blocks(struct compress_ctx *cc) + + blkaddr = datablock_addr(dn.inode, + dn.node_page, dn.ofs_in_node + i); +- if (blkaddr != NULL_ADDR) +- ret++; ++ if (compr) { ++ if (__is_valid_data_blkaddr(blkaddr)) ++ ret++; ++ } else { ++ if (blkaddr != NULL_ADDR) ++ ret++; ++ } + } + } + fail: +@@ -569,6 +573,18 @@ static int f2fs_compressed_blocks(struct compress_ctx *cc) + return ret; + } + ++/* return # of compressed blocks in compressed cluster */ ++static int f2fs_compressed_blocks(struct compress_ctx *cc) ++{ ++ return __f2fs_cluster_blocks(cc, true); ++} ++ ++/* return # of valid blocks in compressed cluster */ ++static int f2fs_cluster_blocks(struct compress_ctx *cc, bool compr) ++{ ++ return __f2fs_cluster_blocks(cc, false); ++} ++ + int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index) + { + struct compress_ctx cc = { +@@ -578,7 +594,7 @@ int f2fs_is_compressed_cluster(struct inode *inode, pgoff_t index) + .cluster_idx = index >> F2FS_I(inode)->i_log_cluster_size, + }; + +- return f2fs_compressed_blocks(&cc); ++ return f2fs_cluster_blocks(&cc, false); + } + + static bool cluster_may_compress(struct compress_ctx *cc) +@@ -627,7 +643,7 @@ static int prepare_compress_overwrite(struct compress_ctx *cc, + bool prealloc; + + retry: +- ret = f2fs_compressed_blocks(cc); ++ ret = f2fs_cluster_blocks(cc, false); + if (ret <= 0) + return ret; + +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-avoid-potential-deadlock.patch b/queue-5.6/f2fs-fix-to-avoid-potential-deadlock.patch new file mode 100644 index 00000000000..527c7ff16a4 --- /dev/null +++ b/queue-5.6/f2fs-fix-to-avoid-potential-deadlock.patch @@ -0,0 +1,47 @@ +From 10abb1cc9256b38c7a968be92eaf93ceb40b870c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Feb 2020 19:20:16 +0800 +Subject: f2fs: fix to avoid potential deadlock + +From: Chao Yu + +[ Upstream commit df77fbd8c5b222c680444801ffd20e8bbc90a56e ] + +Using f2fs_trylock_op() in f2fs_write_compressed_pages() to avoid potential +deadlock like we did in f2fs_write_single_data_page(). + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index d8a64be90a501..c847523ab4a2e 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -772,7 +772,6 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + .encrypted_page = NULL, + .compressed_page = NULL, + .submitted = false, +- .need_lock = LOCK_RETRY, + .io_type = io_type, + .io_wbc = wbc, + .encrypted = f2fs_encrypted_file(cc->inode), +@@ -785,9 +784,10 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + loff_t psize; + int i, err; + +- set_new_dnode(&dn, cc->inode, NULL, NULL, 0); ++ if (!f2fs_trylock_op(sbi)) ++ return -EAGAIN; + +- f2fs_lock_op(sbi); ++ set_new_dnode(&dn, cc->inode, NULL, NULL, 0); + + err = f2fs_get_dnode_of_data(&dn, start_idx, LOOKUP_NODE); + if (err) +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch b/queue-5.6/f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch new file mode 100644 index 00000000000..4be83ebc9c5 --- /dev/null +++ b/queue-5.6/f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch @@ -0,0 +1,58 @@ +From cf5bff02dc4bef560b6b7cc347fc841b4f2b94b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Feb 2020 18:08:46 +0800 +Subject: f2fs: fix to avoid use-after-free in f2fs_write_multi_pages() + +From: Chao Yu + +[ Upstream commit 95978caa138948054e06d00bfc3432b518699f1b ] + +In compress cluster, if physical block number is less than logic +page number, race condition will cause use-after-free issue as +described below: + +- f2fs_write_compressed_pages + - fio.page = cic->rpages[0]; + - f2fs_outplace_write_data + - f2fs_compress_write_end_io + - kfree(cic->rpages); + - kfree(cic); + - fio.page = cic->rpages[1]; + +f2fs_write_multi_pages+0xfd0/0x1a98 +f2fs_write_data_pages+0x74c/0xb5c +do_writepages+0x64/0x108 +__writeback_single_inode+0xdc/0x4b8 +writeback_sb_inodes+0x4d0/0xa68 +__writeback_inodes_wb+0x88/0x178 +wb_writeback+0x1f0/0x424 +wb_workfn+0x2f4/0x574 +process_one_work+0x210/0x48c +worker_thread+0x2e8/0x44c +kthread+0x110/0x120 +ret_from_fork+0x10/0x18 + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index c847523ab4a2e..927db1205bd81 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -845,7 +845,7 @@ static int f2fs_write_compressed_pages(struct compress_ctx *cc, + + blkaddr = datablock_addr(dn.inode, dn.node_page, + dn.ofs_in_node); +- fio.page = cic->rpages[i]; ++ fio.page = cc->rpages[i]; + fio.old_blkaddr = blkaddr; + + /* cluster header */ +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-show-norecovery-mount-option.patch b/queue-5.6/f2fs-fix-to-show-norecovery-mount-option.patch new file mode 100644 index 00000000000..6eb42256e65 --- /dev/null +++ b/queue-5.6/f2fs-fix-to-show-norecovery-mount-option.patch @@ -0,0 +1,67 @@ +From 8c6e05e0ce92fb5c817e177cf9ca2327164153f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 17:45:11 +0800 +Subject: f2fs: fix to show norecovery mount option + +From: Chao Yu + +[ Upstream commit a9117eca1de6b738e713d2142126db2cfbf6fb36 ] + +Previously, 'norecovery' mount option will be shown as +'disable_roll_forward', fix to show original option name correctly. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/f2fs.h | 1 + + fs/f2fs/super.c | 7 +++++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index d39f5de114208..64caa46f0c8bd 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -100,6 +100,7 @@ extern const char *f2fs_fault_name[FAULT_MAX]; + #define F2FS_MOUNT_INLINE_XATTR_SIZE 0x00800000 + #define F2FS_MOUNT_RESERVE_ROOT 0x01000000 + #define F2FS_MOUNT_DISABLE_CHECKPOINT 0x02000000 ++#define F2FS_MOUNT_NORECOVERY 0x04000000 + + #define F2FS_OPTION(sbi) ((sbi)->mount_opt) + #define clear_opt(sbi, option) (F2FS_OPTION(sbi).opt &= ~F2FS_MOUNT_##option) +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 686f5402660ed..3669f060b6257 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -446,7 +446,7 @@ static int parse_options(struct super_block *sb, char *options) + break; + case Opt_norecovery: + /* this option mounts f2fs with ro */ +- set_opt(sbi, DISABLE_ROLL_FORWARD); ++ set_opt(sbi, NORECOVERY); + if (!f2fs_readonly(sb)) + return -EINVAL; + break; +@@ -1446,6 +1446,8 @@ static int f2fs_show_options(struct seq_file *seq, struct dentry *root) + } + if (test_opt(sbi, DISABLE_ROLL_FORWARD)) + seq_puts(seq, ",disable_roll_forward"); ++ if (test_opt(sbi, NORECOVERY)) ++ seq_puts(seq, ",norecovery"); + if (test_opt(sbi, DISCARD)) + seq_puts(seq, ",discard"); + else +@@ -3598,7 +3600,8 @@ static int f2fs_fill_super(struct super_block *sb, void *data, int silent) + goto reset_checkpoint; + + /* recover fsynced data */ +- if (!test_opt(sbi, DISABLE_ROLL_FORWARD)) { ++ if (!test_opt(sbi, DISABLE_ROLL_FORWARD) && ++ !test_opt(sbi, NORECOVERY)) { + /* + * mount should be failed, when device has readonly mode, and + * previous checkpoint was not done by clean system shutdown. +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch b/queue-5.6/f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch new file mode 100644 index 00000000000..4fd9d07b2f8 --- /dev/null +++ b/queue-5.6/f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch @@ -0,0 +1,60 @@ +From 63e8d996a7eada2d6f1272a087be48ed78242d2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 20:09:25 +0800 +Subject: f2fs: fix to update f2fs_super_block fields under sb_lock + +From: Chao Yu + +[ Upstream commit a4ba5dfc5c88e49bb03385abfdd28c5a0acfbb54 ] + +Fields in struct f2fs_super_block should be updated under coverage +of sb_lock, fix to adjust update_sb_metadata() for that rule. + +Fixes: 04f0b2eaa3b3 ("f2fs: ioctl for removing a range from F2FS") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index db8725d473b52..9cff2502e3bc6 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1434,12 +1434,19 @@ static int free_segment_range(struct f2fs_sb_info *sbi, unsigned int start, + static void update_sb_metadata(struct f2fs_sb_info *sbi, int secs) + { + struct f2fs_super_block *raw_sb = F2FS_RAW_SUPER(sbi); +- int section_count = le32_to_cpu(raw_sb->section_count); +- int segment_count = le32_to_cpu(raw_sb->segment_count); +- int segment_count_main = le32_to_cpu(raw_sb->segment_count_main); +- long long block_count = le64_to_cpu(raw_sb->block_count); ++ int section_count; ++ int segment_count; ++ int segment_count_main; ++ long long block_count; + int segs = secs * sbi->segs_per_sec; + ++ down_write(&sbi->sb_lock); ++ ++ section_count = le32_to_cpu(raw_sb->section_count); ++ segment_count = le32_to_cpu(raw_sb->segment_count); ++ segment_count_main = le32_to_cpu(raw_sb->segment_count_main); ++ block_count = le64_to_cpu(raw_sb->block_count); ++ + raw_sb->section_count = cpu_to_le32(section_count + secs); + raw_sb->segment_count = cpu_to_le32(segment_count + segs); + raw_sb->segment_count_main = cpu_to_le32(segment_count_main + segs); +@@ -1453,6 +1460,8 @@ static void update_sb_metadata(struct f2fs_sb_info *sbi, int secs) + raw_sb->devs[last_dev].total_segments = + cpu_to_le32(dev_segs + segs); + } ++ ++ up_write(&sbi->sb_lock); + } + + static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs) +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-to-wait-all-node-page-writeback.patch b/queue-5.6/f2fs-fix-to-wait-all-node-page-writeback.patch new file mode 100644 index 00000000000..b89c63884de --- /dev/null +++ b/queue-5.6/f2fs-fix-to-wait-all-node-page-writeback.patch @@ -0,0 +1,58 @@ +From c5432f9f90f2fa52e573d9d4a5d84ccb2159dde3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 17:45:12 +0800 +Subject: f2fs: fix to wait all node page writeback + +From: Chao Yu + +[ Upstream commit dc5a941223edd803f476a153abd950cc3a83c3e1 ] + +There is a race condition that we may miss to wait for all node pages +writeback, fix it. + +- fsync() - shrink + - f2fs_do_sync_file + - __write_node_page + - set_page_writeback(page#0) + : remove DIRTY/TOWRITE flag + - f2fs_fsync_node_pages + : won't find page #0 as TOWRITE flag was removeD + - f2fs_wait_on_node_pages_writeback + : wont' wait page #0 writeback as it was not in fsync_node_list list. + - f2fs_add_fsync_node_entry + +Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list") +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 9d02cdcdbb073..e58c4c6288346 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -1562,15 +1562,16 @@ static int __write_node_page(struct page *page, bool atomic, bool *submitted, + if (atomic && !test_opt(sbi, NOBARRIER)) + fio.op_flags |= REQ_PREFLUSH | REQ_FUA; + +- set_page_writeback(page); +- ClearPageError(page); +- ++ /* should add to global list before clearing PAGECACHE status */ + if (f2fs_in_warm_node_list(sbi, page)) { + seq = f2fs_add_fsync_node_entry(sbi, page); + if (seq_id) + *seq_id = seq; + } + ++ set_page_writeback(page); ++ ClearPageError(page); ++ + fio.old_blkaddr = ni.blk_addr; + f2fs_do_write_node_page(nid, &fio); + set_node_addr(sbi, &ni, fio.new_blkaddr, is_fsync_dnode(page)); +-- +2.20.1 + diff --git a/queue-5.6/f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch b/queue-5.6/f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch new file mode 100644 index 00000000000..ef880f3a217 --- /dev/null +++ b/queue-5.6/f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch @@ -0,0 +1,68 @@ +From 4c8bafa1f14a19ebbbaeef9f5aaaefd9f9b938a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Mar 2020 15:20:26 -0800 +Subject: f2fs: fix wrong check on F2FS_IOC_FSSETXATTR + +From: Jaegeuk Kim + +[ Upstream commit 99eabb914e0f870445d065e83e857507f9728a33 ] + +This fixes the incorrect failure when enabling project quota on casefold-enabled +file. + +Cc: Daniel Rosenberg +Cc: kernel-team@android.com +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/file.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 0d4da644df3bc..a41c633ac6cfe 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1787,12 +1787,15 @@ static int f2fs_file_flush(struct file *file, fl_owner_t id) + static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask) + { + struct f2fs_inode_info *fi = F2FS_I(inode); ++ u32 masked_flags = fi->i_flags & mask; ++ ++ f2fs_bug_on(F2FS_I_SB(inode), (iflags & ~mask)); + + /* Is it quota file? Do not allow user to mess with it */ + if (IS_NOQUOTA(inode)) + return -EPERM; + +- if ((iflags ^ fi->i_flags) & F2FS_CASEFOLD_FL) { ++ if ((iflags ^ masked_flags) & F2FS_CASEFOLD_FL) { + if (!f2fs_sb_has_casefold(F2FS_I_SB(inode))) + return -EOPNOTSUPP; + if (!f2fs_empty_dir(inode)) +@@ -1806,9 +1809,9 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask) + return -EINVAL; + } + +- if ((iflags ^ fi->i_flags) & F2FS_COMPR_FL) { ++ if ((iflags ^ masked_flags) & F2FS_COMPR_FL) { + if (S_ISREG(inode->i_mode) && +- (fi->i_flags & F2FS_COMPR_FL || i_size_read(inode) || ++ (masked_flags & F2FS_COMPR_FL || i_size_read(inode) || + F2FS_HAS_BLOCKS(inode))) + return -EINVAL; + if (iflags & F2FS_NOCOMP_FL) +@@ -1825,8 +1828,8 @@ static int f2fs_setflags_common(struct inode *inode, u32 iflags, u32 mask) + set_compress_context(inode); + } + } +- if ((iflags ^ fi->i_flags) & F2FS_NOCOMP_FL) { +- if (fi->i_flags & F2FS_COMPR_FL) ++ if ((iflags ^ masked_flags) & F2FS_NOCOMP_FL) { ++ if (masked_flags & F2FS_COMPR_FL) + return -EINVAL; + } + +-- +2.20.1 + diff --git a/queue-5.6/f2fs-skip-gc-when-section-is-full.patch b/queue-5.6/f2fs-skip-gc-when-section-is-full.patch new file mode 100644 index 00000000000..e313ff14a46 --- /dev/null +++ b/queue-5.6/f2fs-skip-gc-when-section-is-full.patch @@ -0,0 +1,35 @@ +From 82e617c6cf65afb618cc96a4c37db23b83c0b389 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Feb 2020 13:23:28 -0800 +Subject: f2fs: skip GC when section is full + +From: Jaegeuk Kim + +[ Upstream commit 2bac07635ddf9ed59268e61e415d8de9c5eaded7 ] + +This fixes skipping GC when segment is full in large section. + +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 2f645c591a000..3cced15efebc2 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -1018,8 +1018,8 @@ static int gc_data_segment(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + * race condition along with SSR block allocation. + */ + if ((gc_type == BG_GC && has_not_enough_free_secs(sbi, 0, 0)) || +- get_valid_blocks(sbi, segno, false) == +- sbi->blocks_per_seg) ++ get_valid_blocks(sbi, segno, true) == ++ BLKS_PER_SEC(sbi)) + return submitted; + + if (check_valid_map(sbi, segno, off) == 0) +-- +2.20.1 + diff --git a/queue-5.6/gfs2-clear-ail1-list-when-gfs2-withdraws.patch b/queue-5.6/gfs2-clear-ail1-list-when-gfs2-withdraws.patch new file mode 100644 index 00000000000..5e7a7d0536d --- /dev/null +++ b/queue-5.6/gfs2-clear-ail1-list-when-gfs2-withdraws.patch @@ -0,0 +1,77 @@ +From bcc8a109c6cb36e6e20d66043fc41131d54ae9a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2019 11:47:09 -0600 +Subject: gfs2: clear ail1 list when gfs2 withdraws + +From: Bob Peterson + +[ Upstream commit 30fe70a85a909a23dcbc2c628ca6655b2c85e7a1 ] + +This patch fixes a bug in which function gfs2_log_flush can get into +an infinite loop when a gfs2 file system is withdrawn. The problem +is the infinite loop "for (;;)" in gfs2_log_flush which would never +finish because the io error and subsequent withdraw prevented the +items from being taken off the ail list. + +This patch tries to clean up the mess by allowing withdraw situations +to move not-in-flight buffer_heads to the ail2 list, where they will +be dealt with later. + +Signed-off-by: Bob Peterson +Reviewed-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/log.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c +index 08dd6a4302344..60d911e293e68 100644 +--- a/fs/gfs2/log.c ++++ b/fs/gfs2/log.c +@@ -104,16 +104,22 @@ __acquires(&sdp->sd_ail_lock) + gfs2_assert(sdp, bd->bd_tr == tr); + + if (!buffer_busy(bh)) { +- if (!buffer_uptodate(bh) && +- !test_and_set_bit(SDF_AIL1_IO_ERROR, ++ if (buffer_uptodate(bh)) { ++ list_move(&bd->bd_ail_st_list, ++ &tr->tr_ail2_list); ++ continue; ++ } ++ if (!test_and_set_bit(SDF_AIL1_IO_ERROR, + &sdp->sd_flags)) { + gfs2_io_error_bh(sdp, bh); + *withdraw = true; + } +- list_move(&bd->bd_ail_st_list, &tr->tr_ail2_list); +- continue; + } + ++ if (gfs2_withdrawn(sdp)) { ++ gfs2_remove_from_ail(bd); ++ continue; ++ } + if (!buffer_dirty(bh)) + continue; + if (gl == bd->bd_gl) +@@ -862,6 +868,8 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + if (gfs2_ail1_empty(sdp)) + break; + } ++ if (gfs2_withdrawn(sdp)) ++ goto out; + atomic_dec(&sdp->sd_log_blks_free); /* Adjust for unreserved buffer */ + trace_gfs2_log_blocks(sdp, -1); + log_write_header(sdp, flags); +@@ -874,6 +882,7 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) + atomic_set(&sdp->sd_freeze_state, SFS_FROZEN); + } + ++out: + trace_gfs2_log_flush(sdp, 0, flags); + up_write(&sdp->sd_log_flush_lock); + +-- +2.20.1 + diff --git a/queue-5.6/hibernate-allow-uswsusp-to-write-to-swap.patch b/queue-5.6/hibernate-allow-uswsusp-to-write-to-swap.patch new file mode 100644 index 00000000000..b170c1f41fa --- /dev/null +++ b/queue-5.6/hibernate-allow-uswsusp-to-write-to-swap.patch @@ -0,0 +1,50 @@ +From 3e37e37d0b8657b7905c2a13362bbbb14de72e8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Mar 2020 08:22:15 -0700 +Subject: hibernate: Allow uswsusp to write to swap + +From: Domenico Andreoli + +[ Upstream commit 56939e014a6c212b317414faa307029e2e80c3b9 ] + +It turns out that there is one use case for programs being able to +write to swap devices, and that is the userspace hibernation code. + +Quick fix: disable the S_SWAPFILE check if hibernation is configured. + +Fixes: dc617f29dbe5 ("vfs: don't allow writes to swap files") +Reported-by: Domenico Andreoli +Reported-by: Marian Klein +Signed-off-by: Domenico Andreoli +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/block_dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 69bf2fb6f7cda..84fe0162ff13e 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + #include "internal.h" + + struct bdev_inode { +@@ -2001,7 +2002,8 @@ ssize_t blkdev_write_iter(struct kiocb *iocb, struct iov_iter *from) + if (bdev_read_only(I_BDEV(bd_inode))) + return -EPERM; + +- if (IS_SWAPFILE(bd_inode)) ++ /* uswsusp needs write permission to the swap */ ++ if (IS_SWAPFILE(bd_inode) && !hibernation_available()) + return -ETXTBSY; + + if (!iov_iter_count(from)) +-- +2.20.1 + diff --git a/queue-5.6/include-linux-swapops.h-correct-guards-for-non_swap_.patch b/queue-5.6/include-linux-swapops.h-correct-guards-for-non_swap_.patch new file mode 100644 index 00000000000..4ab3638a466 --- /dev/null +++ b/queue-5.6/include-linux-swapops.h-correct-guards-for-non_swap_.patch @@ -0,0 +1,62 @@ +From 7fc57824335df6d9b2d5672fd29db07cd08cf6ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Apr 2020 20:08:43 -0700 +Subject: include/linux/swapops.h: correct guards for non_swap_entry() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steven Price + +[ Upstream commit 3f3673d7d324d872d9d8ddb73b3e5e47fbf12e0d ] + +If CONFIG_DEVICE_PRIVATE is defined, but neither CONFIG_MEMORY_FAILURE nor +CONFIG_MIGRATION, then non_swap_entry() will return 0, meaning that the +condition (non_swap_entry(entry) && is_device_private_entry(entry)) in +zap_pte_range() will never be true even if the entry is a device private +one. + +Equally any other code depending on non_swap_entry() will not function as +expected. + +I originally spotted this just by looking at the code, I haven't actually +observed any problems. + +Looking a bit more closely it appears that actually this situation +(currently at least) cannot occur: + +DEVICE_PRIVATE depends on ZONE_DEVICE +ZONE_DEVICE depends on MEMORY_HOTREMOVE +MEMORY_HOTREMOVE depends on MIGRATION + +Fixes: 5042db43cc26 ("mm/ZONE_DEVICE: new type of ZONE_DEVICE for unaddressable memory") +Signed-off-by: Steven Price +Signed-off-by: Andrew Morton +Cc: Jérôme Glisse +Cc: Arnd Bergmann +Cc: Dan Williams +Cc: John Hubbard +Link: http://lkml.kernel.org/r/20200305130550.22693-1-steven.price@arm.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/swapops.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/include/linux/swapops.h b/include/linux/swapops.h +index 877fd239b6fff..3208a520d0be3 100644 +--- a/include/linux/swapops.h ++++ b/include/linux/swapops.h +@@ -348,7 +348,8 @@ static inline void num_poisoned_pages_inc(void) + } + #endif + +-#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION) ++#if defined(CONFIG_MEMORY_FAILURE) || defined(CONFIG_MIGRATION) || \ ++ defined(CONFIG_DEVICE_PRIVATE) + static inline int non_swap_entry(swp_entry_t entry) + { + return swp_type(entry) >= MAX_SWAPFILES; +-- +2.20.1 + diff --git a/queue-5.6/iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch b/queue-5.6/iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch new file mode 100644 index 00000000000..8bb7ae2d070 --- /dev/null +++ b/queue-5.6/iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch @@ -0,0 +1,38 @@ +From 16302da3a8c8fda2827597c8d88dedb0b95daca4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 18:44:51 +0800 +Subject: iommu/amd: Fix the configuration of GCR3 table root pointer + +From: Adrian Huang + +[ Upstream commit c20f36534666e37858a14e591114d93cc1be0d34 ] + +The SPA of the GCR3 table root pointer[51:31] masks 20 bits. However, +this requires 21 bits (Please see the AMD IOMMU specification). +This leads to the potential failure when the bit 51 of SPA of +the GCR3 table root pointer is 1'. + +Signed-off-by: Adrian Huang +Fixes: 52815b75682e2 ("iommu/amd: Add support for IOMMUv2 domain mode") +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd_iommu_types.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h +index f8d01d6b00da7..ca8c4522045b3 100644 +--- a/drivers/iommu/amd_iommu_types.h ++++ b/drivers/iommu/amd_iommu_types.h +@@ -348,7 +348,7 @@ + + #define DTE_GCR3_VAL_A(x) (((x) >> 12) & 0x00007ULL) + #define DTE_GCR3_VAL_B(x) (((x) >> 15) & 0x0ffffULL) +-#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0xfffffULL) ++#define DTE_GCR3_VAL_C(x) (((x) >> 31) & 0x1fffffULL) + + #define DTE_GCR3_INDEX_A 0 + #define DTE_GCR3_INDEX_B 1 +-- +2.20.1 + diff --git a/queue-5.6/iommu-virtio-fix-freeing-of-incomplete-domains.patch b/queue-5.6/iommu-virtio-fix-freeing-of-incomplete-domains.patch new file mode 100644 index 00000000000..1ff2e5c5eaa --- /dev/null +++ b/queue-5.6/iommu-virtio-fix-freeing-of-incomplete-domains.patch @@ -0,0 +1,63 @@ +From 046b899467692ad67de9206ddcc9817b30298821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Mar 2020 10:35:57 +0100 +Subject: iommu/virtio: Fix freeing of incomplete domains + +From: Jean-Philippe Brucker + +[ Upstream commit 7062af3ed2ba451029e3733d9f677c68f5ea9e77 ] + +Calling viommu_domain_free() on a domain that hasn't been finalised (not +attached to any device, for example) can currently cause an Oops, +because we attempt to call ida_free() on ID 0, which may either be +unallocated or used by another domain. + +Only initialise the vdomain->viommu pointer, which denotes a finalised +domain, at the end of a successful viommu_domain_finalise(). + +Fixes: edcd69ab9a32 ("iommu: Add virtio-iommu driver") +Reported-by: Eric Auger +Signed-off-by: Jean-Philippe Brucker +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20200326093558.2641019-3-jean-philippe@linaro.org +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/virtio-iommu.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/iommu/virtio-iommu.c b/drivers/iommu/virtio-iommu.c +index cce329d71fbad..5eed75cd121f1 100644 +--- a/drivers/iommu/virtio-iommu.c ++++ b/drivers/iommu/virtio-iommu.c +@@ -613,18 +613,20 @@ static int viommu_domain_finalise(struct viommu_dev *viommu, + int ret; + struct viommu_domain *vdomain = to_viommu_domain(domain); + +- vdomain->viommu = viommu; +- vdomain->map_flags = viommu->map_flags; ++ ret = ida_alloc_range(&viommu->domain_ids, viommu->first_domain, ++ viommu->last_domain, GFP_KERNEL); ++ if (ret < 0) ++ return ret; ++ ++ vdomain->id = (unsigned int)ret; + + domain->pgsize_bitmap = viommu->pgsize_bitmap; + domain->geometry = viommu->geometry; + +- ret = ida_alloc_range(&viommu->domain_ids, viommu->first_domain, +- viommu->last_domain, GFP_KERNEL); +- if (ret >= 0) +- vdomain->id = (unsigned int)ret; ++ vdomain->map_flags = viommu->map_flags; ++ vdomain->viommu = viommu; + +- return ret > 0 ? 0 : ret; ++ return 0; + } + + static void viommu_domain_free(struct iommu_domain *domain) +-- +2.20.1 + diff --git a/queue-5.6/iommu-vt-d-add-build-dependency-on-ioasid.patch b/queue-5.6/iommu-vt-d-add-build-dependency-on-ioasid.patch new file mode 100644 index 00000000000..a8629bcde1c --- /dev/null +++ b/queue-5.6/iommu-vt-d-add-build-dependency-on-ioasid.patch @@ -0,0 +1,39 @@ +From aa610fd9b90f29eb87346efc7f7302694f6ac462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Mar 2020 21:32:31 -0700 +Subject: iommu/vt-d: Add build dependency on IOASID + +From: Jacob Pan + +[ Upstream commit 4a663dae47316ae8b97d5b77025fe7dfd9d3487f ] + +IOASID code is needed by VT-d scalable mode for PASID allocation. +Add explicit dependency such that IOASID is built-in whenever Intel +IOMMU is enabled. +Otherwise, aux domain code will fail when IOMMU is built-in and IOASID +is compiled as a module. + +Fixes: 59a623374dc38 ("iommu/vt-d: Replace Intel specific PASID allocator with IOASID") +Signed-off-by: Jacob Pan +Acked-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig +index d2fade9849997..25149544d57c9 100644 +--- a/drivers/iommu/Kconfig ++++ b/drivers/iommu/Kconfig +@@ -188,6 +188,7 @@ config INTEL_IOMMU + select NEED_DMA_MAP_STATE + select DMAR_TABLE + select SWIOTLB ++ select IOASID + help + DMA remapping (DMAR) devices support enables independent address + translations for Direct Memory Access (DMA) from devices. +-- +2.20.1 + diff --git a/queue-5.6/iommu-vt-d-fix-mm-reference-leak.patch b/queue-5.6/iommu-vt-d-fix-mm-reference-leak.patch new file mode 100644 index 00000000000..a3b806f3610 --- /dev/null +++ b/queue-5.6/iommu-vt-d-fix-mm-reference-leak.patch @@ -0,0 +1,47 @@ +From 9bc47c3557d907cefae8fe6bc011112b328a6f0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Mar 2020 21:32:30 -0700 +Subject: iommu/vt-d: Fix mm reference leak + +From: Jacob Pan + +[ Upstream commit 902baf61adf6b187f0a6b789e70d788ea71ff5bc ] + +Move canonical address check before mmget_not_zero() to avoid mm +reference leak. + +Fixes: 9d8c3af31607 ("iommu/vt-d: IOMMU Page Request needs to check if address is canonical.") +Signed-off-by: Jacob Pan +Acked-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-svm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index d7f2a53589002..fc7d78876e021 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -611,14 +611,15 @@ static irqreturn_t prq_event_thread(int irq, void *d) + * any faults on kernel addresses. */ + if (!svm->mm) + goto bad_req; +- /* If the mm is already defunct, don't handle faults. */ +- if (!mmget_not_zero(svm->mm)) +- goto bad_req; + + /* If address is not canonical, return invalid response */ + if (!is_canonical_address(address)) + goto bad_req; + ++ /* If the mm is already defunct, don't handle faults. */ ++ if (!mmget_not_zero(svm->mm)) ++ goto bad_req; ++ + down_read(&svm->mm->mmap_sem); + vma = find_extend_vma(svm->mm, address); + if (!vma || address < vma->vm_start) +-- +2.20.1 + diff --git a/queue-5.6/iommu-vt-d-fix-page-request-descriptor-size.patch b/queue-5.6/iommu-vt-d-fix-page-request-descriptor-size.patch new file mode 100644 index 00000000000..e1f901ff6f1 --- /dev/null +++ b/queue-5.6/iommu-vt-d-fix-page-request-descriptor-size.patch @@ -0,0 +1,40 @@ +From 52f502a3fb169f028fcfbbf8c8a15c3e375229ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Mar 2020 09:10:18 +0800 +Subject: iommu/vt-d: Fix page request descriptor size + +From: Jacob Pan + +[ Upstream commit 52355fb1919ef7ed9a38e0f3de6e928de1f57217 ] + +Intel VT-d might support PRS (Page Reqest Support) when it's +running in the scalable mode. Each page request descriptor +occupies 32 bytes and is 32-bytes aligned. The page request +descriptor offset mask should be 32-bytes aligned. + +Fixes: 5b438f4ba315d ("iommu/vt-d: Support page request in scalable mode") +Signed-off-by: Lu Baolu +Signed-off-by: Liu Yi L +Signed-off-by: Jacob Pan +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index fc7d78876e021..2998418f0a383 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -531,7 +531,7 @@ struct page_req_dsc { + u64 priv_data[2]; + }; + +-#define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x10) ++#define PRQ_RING_MASK ((0x1000 << PRQ_ORDER) - 0x20) + + static bool access_error(struct vm_area_struct *vma, struct page_req_dsc *req) + { +-- +2.20.1 + diff --git a/queue-5.6/iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch b/queue-5.6/iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch new file mode 100644 index 00000000000..839d14c93c8 --- /dev/null +++ b/queue-5.6/iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch @@ -0,0 +1,55 @@ +From a36363f6d8deb3c1f3d41daa3eccdefc2204fa8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Mar 2020 11:03:26 -0400 +Subject: iommu/vt-d: Silence RCU-list debugging warning in dmar_find_atsr() + +From: Qian Cai + +[ Upstream commit c6f4ebdeba4cff590594df931ff1ee610c426431 ] + +dmar_find_atsr() calls list_for_each_entry_rcu() outside of an RCU read +side critical section but with dmar_global_lock held. Silence this +false positive. + + drivers/iommu/intel-iommu.c:4504 RCU-list traversed in non-reader section!! + 1 lock held by swapper/0/1: + #0: ffffffff9755bee8 (dmar_global_lock){+.+.}, at: intel_iommu_init+0x1a6/0xe19 + + Call Trace: + dump_stack+0xa4/0xfe + lockdep_rcu_suspicious+0xeb/0xf5 + dmar_find_atsr+0x1ab/0x1c0 + dmar_parse_one_atsr+0x64/0x220 + dmar_walk_remapping_entries+0x130/0x380 + dmar_table_init+0x166/0x243 + intel_iommu_init+0x1ab/0xe19 + pci_iommu_init+0x1a/0x44 + do_one_initcall+0xae/0x4d0 + kernel_init_freeable+0x412/0x4c5 + kernel_init+0x19/0x193 + +Signed-off-by: Qian Cai +Acked-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 4be5494786918..ef0a5246700e5 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -4501,7 +4501,8 @@ static struct dmar_atsr_unit *dmar_find_atsr(struct acpi_dmar_atsr *atsr) + struct dmar_atsr_unit *atsru; + struct acpi_dmar_atsr *tmp; + +- list_for_each_entry_rcu(atsru, &dmar_atsr_units, list) { ++ list_for_each_entry_rcu(atsru, &dmar_atsr_units, list, ++ dmar_rcu_check()) { + tmp = (struct acpi_dmar_atsr *)atsru->hdr; + if (atsr->segment != tmp->segment) + continue; +-- +2.20.1 + diff --git a/queue-5.6/kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch b/queue-5.6/kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch new file mode 100644 index 00000000000..1b95b86cf9b --- /dev/null +++ b/queue-5.6/kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch @@ -0,0 +1,67 @@ +From 0d9384a74bb34c050547d0a182530d7a227331b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Mar 2020 16:11:28 -0500 +Subject: KVM: PPC: Book3S HV: Fix H_CEDE return code for nested guests + +From: Michael Roth + +[ Upstream commit 1f50cc1705350a4697923203fedd7d8fb1087fe2 ] + +The h_cede_tm kvm-unit-test currently fails when run inside an L1 guest +via the guest/nested hypervisor. + + ./run-tests.sh -v + ... + TESTNAME=h_cede_tm TIMEOUT=90s ACCEL= ./powerpc/run powerpc/tm.elf -smp 2,threads=2 -machine cap-htm=on -append "h_cede_tm" + FAIL h_cede_tm (2 tests, 1 unexpected failures) + +While the test relates to transactional memory instructions, the actual +failure is due to the return code of the H_CEDE hypercall, which is +reported as 224 instead of 0. This happens even when no TM instructions +are issued. + +224 is the value placed in r3 to execute a hypercall for H_CEDE, and r3 +is where the caller expects the return code to be placed upon return. + +In the case of guest running under a nested hypervisor, issuing H_CEDE +causes a return from H_ENTER_NESTED. In this case H_CEDE is +specially-handled immediately rather than later in +kvmppc_pseries_do_hcall() as with most other hcalls, but we forget to +set the return code for the caller, hence why kvm-unit-test sees the +224 return code and reports an error. + +Guest kernels generally don't check the return value of H_CEDE, so +that likely explains why this hasn't caused issues outside of +kvm-unit-tests so far. + +Fix this by setting r3 to 0 after we finish processing the H_CEDE. + +RHBZ: 1778556 + +Fixes: 4bad77799fed ("KVM: PPC: Book3S HV: Handle hypercalls correctly when nested") +Cc: linuxppc-dev@ozlabs.org +Cc: David Gibson +Cc: Paul Mackerras +Signed-off-by: Michael Roth +Reviewed-by: David Gibson +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 2cefd071b8483..c0c43a7338304 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -3616,6 +3616,7 @@ int kvmhv_p9_guest_entry(struct kvm_vcpu *vcpu, u64 time_limit, + if (trap == BOOK3S_INTERRUPT_SYSCALL && !vcpu->arch.nested && + kvmppc_get_gpr(vcpu, 3) == H_CEDE) { + kvmppc_nested_cede(vcpu); ++ kvmppc_set_gpr(vcpu, 3, 0); + trap = 0; + } + } else { +-- +2.20.1 + diff --git a/queue-5.6/kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch b/queue-5.6/kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch new file mode 100644 index 00000000000..34a4c0150b3 --- /dev/null +++ b/queue-5.6/kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch @@ -0,0 +1,52 @@ +From ecbe46c08b436b5a63867be78a13928ef78a887e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Apr 2020 17:30:48 +0200 +Subject: KVM: s390: vsie: Fix possible race when shadowing region 3 tables + +From: David Hildenbrand + +[ Upstream commit 1493e0f944f3c319d11e067c185c904d01c17ae5 ] + +We have to properly retry again by returning -EINVAL immediately in case +somebody else instantiated the table concurrently. We missed to add the +goto in this function only. The code now matches the other, similar +shadowing functions. + +We are overwriting an existing region 2 table entry. All allocated pages +are added to the crst_list to be freed later, so they are not lost +forever. However, when unshadowing the region 2 table, we wouldn't trigger +unshadowing of the original shadowed region 3 table that we replaced. It +would get unshadowed when the original region 3 table is modified. As it's +not connected to the page table hierarchy anymore, it's not going to get +used anymore. However, for a limited time, this page table will stick +around, so it's in some sense a temporary memory leak. + +Identified by manual code inspection. I don't think this classifies as +stable material. + +Fixes: 998f637cc4b9 ("s390/mm: avoid races on region/segment/page table shadowing") +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20200403153050.20569-4-david@redhat.com +Reviewed-by: Claudio Imbrenda +Reviewed-by: Christian Borntraeger +Signed-off-by: Christian Borntraeger +Signed-off-by: Sasha Levin +--- + arch/s390/mm/gmap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c +index 9d9ab77d02dd3..364e3a89c0969 100644 +--- a/arch/s390/mm/gmap.c ++++ b/arch/s390/mm/gmap.c +@@ -1844,6 +1844,7 @@ int gmap_shadow_r3t(struct gmap *sg, unsigned long saddr, unsigned long r3t, + goto out_free; + } else if (*table & _REGION_ENTRY_ORIGIN) { + rc = -EAGAIN; /* Race with shadow */ ++ goto out_free; + } + crst_table_init(s_r3t, _REGION3_ENTRY_EMPTY); + /* mark as invalid as long as the parent table is not protected */ +-- +2.20.1 + diff --git a/queue-5.6/leds-core-fix-warning-message-when-init_data.patch b/queue-5.6/leds-core-fix-warning-message-when-init_data.patch new file mode 100644 index 00000000000..3747b3ab903 --- /dev/null +++ b/queue-5.6/leds-core-fix-warning-message-when-init_data.patch @@ -0,0 +1,39 @@ +From 7c196dcfe77dc2e2d91d030782057be935cf3cce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Apr 2020 11:51:47 +0200 +Subject: leds: core: Fix warning message when init_data + +From: Ricardo Ribalda Delgado + +[ Upstream commit 64ed6588c2ea618d3f9ca9d8b365ae4c19f76225 ] + +The warning message when a led is renamed due to name collition can fail +to show proper original name if init_data is used. Eg: + +[ 9.073996] leds-gpio a0040000.leds_0: Led (null) renamed to red_led_1 due to name collision + +Fixes: bb4e9af0348d ("leds: core: Add support for composing LED class device names") +Signed-off-by: Ricardo Ribalda Delgado +Acked-by: Jacek Anaszewski +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 1fc40e8af75eb..3363a6551a708 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -376,7 +376,7 @@ int led_classdev_register_ext(struct device *parent, + + if (ret) + dev_warn(parent, "Led %s renamed to %s due to name collision", +- led_cdev->name, dev_name(led_cdev->dev)); ++ proposed_name, dev_name(led_cdev->dev)); + + if (led_cdev->flags & LED_BRIGHT_HW_CHANGED) { + ret = led_add_brightness_hw_changed(led_cdev); +-- +2.20.1 + diff --git a/queue-5.6/libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch b/queue-5.6/libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch new file mode 100644 index 00000000000..b1acc1ac2a7 --- /dev/null +++ b/queue-5.6/libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch @@ -0,0 +1,43 @@ +From a9bde710ab2c3b63d7df0454b2cffe2702c41769 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 19:20:56 +0300 +Subject: libnvdimm: Out of bounds read in __nd_ioctl() + +From: Dan Carpenter + +[ Upstream commit f84afbdd3a9e5e10633695677b95422572f920dc ] + +The "cmd" comes from the user and it can be up to 255. It it's more +than the number of bits in long, it results out of bounds read when we +check test_bit(cmd, &cmd_mask). The highest valid value for "cmd" is +ND_CMD_CALL (10) so I added a compare against that. + +Fixes: 62232e45f4a2 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200225162055.amtosfy7m35aivxg@kili.mountain +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/bus.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index a8b5159685699..09087c38fabdc 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -1042,8 +1042,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, + return -EFAULT; + } + +- if (!desc || (desc->out_num + desc->in_num == 0) || +- !test_bit(cmd, &cmd_mask)) ++ if (!desc || ++ (desc->out_num + desc->in_num == 0) || ++ cmd > ND_CMD_CALL || ++ !test_bit(cmd, &cmd_mask)) + return -ENOTTY; + + /* fail write commands (when read-only) */ +-- +2.20.1 + diff --git a/queue-5.6/macsec-fix-null-dereference-in-macsec_upd_offload.patch b/queue-5.6/macsec-fix-null-dereference-in-macsec_upd_offload.patch new file mode 100644 index 00000000000..da8e906fc65 --- /dev/null +++ b/queue-5.6/macsec-fix-null-dereference-in-macsec_upd_offload.patch @@ -0,0 +1,40 @@ +From 72215742296de24811ce59f8395c479cc2b57400 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Apr 2020 11:38:29 +0200 +Subject: macsec: fix NULL dereference in macsec_upd_offload() + +From: Davide Caratti + +[ Upstream commit aa81700cf2326e288c9ca1fe7b544039617f1fc2 ] + +macsec_upd_offload() gets the value of MACSEC_OFFLOAD_ATTR_TYPE +without checking its presence in the request message, and this causes +a NULL dereference. Fix it rejecting any configuration that does not +include this attribute. + +Reported-and-tested-by: syzbot+7022ab7c383875c17eff@syzkaller.appspotmail.com +Fixes: dcb780fb2795 ("net: macsec: add nla support for changing the offloading selection") +Signed-off-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macsec.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 061aada4748a7..9b4ae5c36da6b 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -2398,6 +2398,9 @@ static int macsec_upd_offload(struct sk_buff *skb, struct genl_info *info) + return PTR_ERR(dev); + macsec = macsec_priv(dev); + ++ if (!tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]) ++ return -EINVAL; ++ + offload = nla_get_u8(tb_offload[MACSEC_OFFLOAD_ATTR_TYPE]); + if (macsec->offload == offload) + return 0; +-- +2.20.1 + diff --git a/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch new file mode 100644 index 00000000000..502d78a09a1 --- /dev/null +++ b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch @@ -0,0 +1,40 @@ +From 522a7713b99fb6a8bb2eefecf43265c71e8d17be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 02:58:34 +0300 +Subject: memory: tegra: Correct debugfs clk rate-range on Tegra20 + +From: Dmitry Osipenko + +[ Upstream commit 2243af41115d0e36e6414df6dd2a0386e022d9f8 ] + +Correctly set clk rate-range if number of available timings is zero. +This fixes noisy "invalid range [4294967295, 0]" error messages during +boot. + +Fixes: 8209eefa3d37 ("memory: tegra: Implement EMC debugfs interface on Tegra20") +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra20-emc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c +index 8ae474d9bfb90..b16715e9515d0 100644 +--- a/drivers/memory/tegra/tegra20-emc.c ++++ b/drivers/memory/tegra/tegra20-emc.c +@@ -628,6 +628,11 @@ static void tegra_emc_debugfs_init(struct tegra_emc *emc) + emc->debugfs.max_rate = emc->timings[i].rate; + } + ++ if (!emc->num_timings) { ++ emc->debugfs.min_rate = clk_get_rate(emc->clk); ++ emc->debugfs.max_rate = emc->debugfs.min_rate; ++ } ++ + err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate, + emc->debugfs.max_rate); + if (err < 0) { +-- +2.20.1 + diff --git a/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042 b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042 new file mode 100644 index 00000000000..e70bdfdc4f5 --- /dev/null +++ b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042 @@ -0,0 +1,40 @@ +From f62d285a8597cb63943f0c7392e85dae75a872aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 02:58:35 +0300 +Subject: memory: tegra: Correct debugfs clk rate-range on Tegra30 + +From: Dmitry Osipenko + +[ Upstream commit a53670e1a734ba56fac84cf2b93b838bd4a6b835 ] + +Correctly set clk rate-range if number of available timings is zero. +This fixes noisy "invalid range [4294967295, 0]" error messages during +boot. + +Fixes: 8cee32b40040 ("memory: tegra: Implement EMC debugfs interface on Tegra30") +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra30-emc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/memory/tegra/tegra30-emc.c b/drivers/memory/tegra/tegra30-emc.c +index e3efd9529506e..b42bdb667e853 100644 +--- a/drivers/memory/tegra/tegra30-emc.c ++++ b/drivers/memory/tegra/tegra30-emc.c +@@ -1256,6 +1256,11 @@ static void tegra_emc_debugfs_init(struct tegra_emc *emc) + emc->debugfs.max_rate = emc->timings[i].rate; + } + ++ if (!emc->num_timings) { ++ emc->debugfs.min_rate = clk_get_rate(emc->clk); ++ emc->debugfs.max_rate = emc->debugfs.min_rate; ++ } ++ + err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate, + emc->debugfs.max_rate); + if (err < 0) { +-- +2.20.1 + diff --git a/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140 b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140 new file mode 100644 index 00000000000..d527cdc645d --- /dev/null +++ b/queue-5.6/memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140 @@ -0,0 +1,40 @@ +From 9100d0c1be2fc7372e63d7f8f0b3fb4317a2e90a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 02:58:36 +0300 +Subject: memory: tegra: Correct debugfs clk rate-range on Tegra124 + +From: Dmitry Osipenko + +[ Upstream commit 141267bffd1dc19a76e4d50e3e4829f85a806875 ] + +Correctly set clk rate-range if number of available timings is zero. +This fixes noisy "invalid range [4294967295, 0]" error messages during +boot. + +Fixes: 6b9acd935546 ("memory: tegra: Refashion EMC debugfs interface on Tegra124") +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/memory/tegra/tegra124-emc.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/memory/tegra/tegra124-emc.c b/drivers/memory/tegra/tegra124-emc.c +index 21f05240682b8..33b8216bac30c 100644 +--- a/drivers/memory/tegra/tegra124-emc.c ++++ b/drivers/memory/tegra/tegra124-emc.c +@@ -1158,6 +1158,11 @@ static void emc_debugfs_init(struct device *dev, struct tegra_emc *emc) + emc->debugfs.max_rate = emc->timings[i].rate; + } + ++ if (!emc->num_timings) { ++ emc->debugfs.min_rate = clk_get_rate(emc->clk); ++ emc->debugfs.max_rate = emc->debugfs.min_rate; ++ } ++ + err = clk_set_rate_range(emc->clk, emc->debugfs.min_rate, + emc->debugfs.max_rate); + if (err < 0) { +-- +2.20.1 + diff --git a/queue-5.6/mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch b/queue-5.6/mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch new file mode 100644 index 00000000000..f67e520bed2 --- /dev/null +++ b/queue-5.6/mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch @@ -0,0 +1,39 @@ +From c6970ae579843a658e28334e4ba3d2b224222afc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Feb 2020 11:06:24 -0800 +Subject: mfd: cros_ec: Check DT node for usbpd-notify add + +From: Prashant Malani + +[ Upstream commit f8db89d14efb770dd59aa0ca74386e5de68310d5 ] + +Add a check to ensure there is indeed an EC device tree entry before +adding the cros-usbpd-notify device. This covers configs where both +CONFIG_ACPI and CONFIG_OF are defined, but the EC device is defined +using device tree and not in ACPI. + +Fixes: 4602dce0361e ("mfd: cros_ec: Add cros-usbpd-notify subdevice") +Signed-off-by: Prashant Malani +Tested-by: Enric Balletbo i Serra +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/cros_ec_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/cros_ec_dev.c b/drivers/mfd/cros_ec_dev.c +index 39e6116950536..32c2b912b58b2 100644 +--- a/drivers/mfd/cros_ec_dev.c ++++ b/drivers/mfd/cros_ec_dev.c +@@ -211,7 +211,7 @@ static int ec_device_probe(struct platform_device *pdev) + * explicitly added on platforms that don't have the PD notifier ACPI + * device entry defined. + */ +- if (IS_ENABLED(CONFIG_OF)) { ++ if (IS_ENABLED(CONFIG_OF) && ec->ec_dev->dev->of_node) { + if (cros_ec_check_features(ec, EC_FEATURE_USB_PD)) { + retval = mfd_add_hotplug_devices(ec->dev, + cros_usbpd_notify_cells, +-- +2.20.1 + diff --git a/queue-5.6/mips-dts-ci20-add-dt-node-for-ir-sensor.patch b/queue-5.6/mips-dts-ci20-add-dt-node-for-ir-sensor.patch new file mode 100644 index 00000000000..6d38149395a --- /dev/null +++ b/queue-5.6/mips-dts-ci20-add-dt-node-for-ir-sensor.patch @@ -0,0 +1,41 @@ +From c9bc640f1b485f754c05c3cccce2d760a6a5e2f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Mar 2020 22:06:31 +0100 +Subject: MIPS: DTS: CI20: add DT node for IR sensor + +From: Alex Smith + +[ Upstream commit f5e8fcf85a25bac26c32a0000dbab5857ead9113 ] + +The infrared sensor on the CI20 board is connected to a GPIO and can +be operated by using the gpio-ir-recv driver. Add a DT node for the +sensor to allow that driver to be used. + +Signed-off-by: Alex Smith +Signed-off-by: H. Nikolaus Schaller +Reviewed-by: Paul Cercueil +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/dts/ingenic/ci20.dts | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/mips/boot/dts/ingenic/ci20.dts b/arch/mips/boot/dts/ingenic/ci20.dts +index c340f947baa03..fc4e64200c3d5 100644 +--- a/arch/mips/boot/dts/ingenic/ci20.dts ++++ b/arch/mips/boot/dts/ingenic/ci20.dts +@@ -62,6 +62,11 @@ + enable-active-high; + }; + ++ ir: ir { ++ compatible = "gpio-ir-receiver"; ++ gpios = <&gpe 3 GPIO_ACTIVE_LOW>; ++ }; ++ + wlan0_power: fixedregulator@1 { + compatible = "regulator-fixed"; + regulator-name = "wlan0_power"; +-- +2.20.1 + diff --git a/queue-5.6/mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch b/queue-5.6/mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch new file mode 100644 index 00000000000..3725875a825 --- /dev/null +++ b/queue-5.6/mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch @@ -0,0 +1,95 @@ +From f993aaa7ec8acf916e9b443a5aeb6189bbd57831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Apr 2020 21:11:54 -0700 +Subject: mm/hugetlb: fix build failure with HUGETLB_PAGE but not HUGEBTLBFS + +From: Christophe Leroy + +[ Upstream commit bb297bb2de517e41199185021f043bbc5d75b377 ] + +When CONFIG_HUGETLB_PAGE is set but not CONFIG_HUGETLBFS, the following +build failure is encoutered: + + In file included from arch/powerpc/mm/fault.c:33:0: + include/linux/hugetlb.h: In function 'hstate_inode': + include/linux/hugetlb.h:477:9: error: implicit declaration of function 'HUGETLBFS_SB' [-Werror=implicit-function-declaration] + return HUGETLBFS_SB(i->i_sb)->hstate; + ^ + include/linux/hugetlb.h:477:30: error: invalid type argument of '->' (have 'int') + return HUGETLBFS_SB(i->i_sb)->hstate; + ^ + +Gate hstate_inode() with CONFIG_HUGETLBFS instead of CONFIG_HUGETLB_PAGE. + +Fixes: a137e1cc6d6e ("hugetlbfs: per mount huge page sizes") +Reported-by: kbuild test robot +Signed-off-by: Christophe Leroy +Signed-off-by: Andrew Morton +Reviewed-by: Mike Kravetz +Cc: Baoquan He +Cc: Nishanth Aravamudan +Cc: Nick Piggin +Cc: Adam Litke +Cc: Andi Kleen +Link: http://lkml.kernel.org/r/7e8c3a3c9a587b9cd8a2f146df32a421b961f3a2.1584432148.git.christophe.leroy@c-s.fr +Link: https://patchwork.ozlabs.org/patch/1255548/#2386036 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/hugetlb.h | 19 ++++++++----------- + 1 file changed, 8 insertions(+), 11 deletions(-) + +diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h +index 1e897e4168ac1..dafb3d70ff819 100644 +--- a/include/linux/hugetlb.h ++++ b/include/linux/hugetlb.h +@@ -390,7 +390,10 @@ static inline bool is_file_hugepages(struct file *file) + return is_file_shm_hugepages(file); + } + +- ++static inline struct hstate *hstate_inode(struct inode *i) ++{ ++ return HUGETLBFS_SB(i->i_sb)->hstate; ++} + #else /* !CONFIG_HUGETLBFS */ + + #define is_file_hugepages(file) false +@@ -402,6 +405,10 @@ hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag, + return ERR_PTR(-ENOSYS); + } + ++static inline struct hstate *hstate_inode(struct inode *i) ++{ ++ return NULL; ++} + #endif /* !CONFIG_HUGETLBFS */ + + #ifdef HAVE_ARCH_HUGETLB_UNMAPPED_AREA +@@ -472,11 +479,6 @@ extern unsigned int default_hstate_idx; + + #define default_hstate (hstates[default_hstate_idx]) + +-static inline struct hstate *hstate_inode(struct inode *i) +-{ +- return HUGETLBFS_SB(i->i_sb)->hstate; +-} +- + static inline struct hstate *hstate_file(struct file *f) + { + return hstate_inode(file_inode(f)); +@@ -729,11 +731,6 @@ static inline struct hstate *hstate_vma(struct vm_area_struct *vma) + return NULL; + } + +-static inline struct hstate *hstate_inode(struct inode *i) +-{ +- return NULL; +-} +- + static inline struct hstate *page_hstate(struct page *page) + { + return NULL; +-- +2.20.1 + diff --git a/queue-5.6/net-mlx5e-enforce-setting-of-a-single-fec-mode.patch b/queue-5.6/net-mlx5e-enforce-setting-of-a-single-fec-mode.patch new file mode 100644 index 00000000000..e13010827d0 --- /dev/null +++ b/queue-5.6/net-mlx5e-enforce-setting-of-a-single-fec-mode.patch @@ -0,0 +1,38 @@ +From f39d13ce7f0a0160640c20a9841fcc6a6a87b021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Feb 2020 14:32:49 -0800 +Subject: net/mlx5e: Enforce setting of a single FEC mode + +From: Aya Levin + +[ Upstream commit 4bd9d5070b92da012f2715cf8e4859acb78b8f35 ] + +Ethtool command allow setting of several FEC modes in a single set +command. The driver can only set a single FEC mode at a time. With this +patch driver will reply not-supported on setting several FEC modes. + +Signed-off-by: Aya Levin +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index d2cfa247abc86..9710cdecb63af 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -1535,6 +1535,10 @@ static int mlx5e_set_fecparam(struct net_device *netdev, + int mode; + int err; + ++ if (bitmap_weight((unsigned long *)&fecparam->fec, ++ ETHTOOL_FEC_BASER_BIT + 1) > 1) ++ return -EOPNOTSUPP; ++ + for (mode = 0; mode < ARRAY_SIZE(pplm_fec_2_ethtool); mode++) { + if (!(pplm_fec_2_ethtool[mode] & fecparam->fec)) + continue; +-- +2.20.1 + diff --git a/queue-5.6/nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch b/queue-5.6/nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch new file mode 100644 index 00000000000..94c30b6f768 --- /dev/null +++ b/queue-5.6/nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch @@ -0,0 +1,48 @@ +From 25adca27052e2e3fb46f7b5a375c93d7d24d4e94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Feb 2020 19:32:49 -0500 +Subject: NFS: alloc_nfs_open_context() must use the file cred when available + +From: Trond Myklebust + +[ Upstream commit 1d179d6bd67369a52edea8562154b31ee20be1cc ] + +If we're creating a nfs_open_context() for a specific file pointer, +we must use the cred assigned to that file. + +Fixes: a52458b48af1 ("NFS/NFSD/SUNRPC: replace generic creds with 'struct cred'.") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 11bf15800ac99..a10fb87c6ac33 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -959,16 +959,16 @@ struct nfs_open_context *alloc_nfs_open_context(struct dentry *dentry, + struct file *filp) + { + struct nfs_open_context *ctx; +- const struct cred *cred = get_current_cred(); + + ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); +- if (!ctx) { +- put_cred(cred); ++ if (!ctx) + return ERR_PTR(-ENOMEM); +- } + nfs_sb_active(dentry->d_sb); + ctx->dentry = dget(dentry); +- ctx->cred = cred; ++ if (filp) ++ ctx->cred = get_cred(filp->f_cred); ++ else ++ ctx->cred = get_current_cred(); + ctx->ll_cred = NULL; + ctx->state = NULL; + ctx->mode = f_mode; +-- +2.20.1 + diff --git a/queue-5.6/nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch b/queue-5.6/nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch new file mode 100644 index 00000000000..17896a52107 --- /dev/null +++ b/queue-5.6/nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch @@ -0,0 +1,51 @@ +From d41093d8bd8874f5f5dcfc513c461b2bcc0e1e6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Aug 2019 17:01:22 +0900 +Subject: NFS: direct.c: Fix memory leak of dreq when nfs_get_lock_context + fails + +From: Misono Tomohiro + +[ Upstream commit 8605cf0e852af3b2c771c18417499dc4ceed03d5 ] + +When dreq is allocated by nfs_direct_req_alloc(), dreq->kref is +initialized to 2. Therefore we need to call nfs_direct_req_release() +twice to release the allocated dreq. Usually it is called in +nfs_file_direct_{read, write}() and nfs_direct_complete(). + +However, current code only calls nfs_direct_req_relese() once if +nfs_get_lock_context() fails in nfs_file_direct_{read, write}(). +So, that case would result in memory leak. + +Fix this by adding the missing call. + +Signed-off-by: Misono Tomohiro +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/direct.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index b768a0b42e82e..ade2435551c89 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -571,6 +571,7 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + l_ctx = nfs_get_lock_context(dreq->ctx); + if (IS_ERR(l_ctx)) { + result = PTR_ERR(l_ctx); ++ nfs_direct_req_release(dreq); + goto out_release; + } + dreq->l_ctx = l_ctx; +@@ -990,6 +991,7 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + l_ctx = nfs_get_lock_context(dreq->ctx); + if (IS_ERR(l_ctx)) { + result = PTR_ERR(l_ctx); ++ nfs_direct_req_release(dreq); + goto out_release; + } + dreq->l_ctx = l_ctx; +-- +2.20.1 + diff --git a/queue-5.6/nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch b/queue-5.6/nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch new file mode 100644 index 00000000000..483a5c3973e --- /dev/null +++ b/queue-5.6/nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch @@ -0,0 +1,56 @@ +From 66c224b4384e3caf62564b45a3f90ed913502076 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Mar 2020 20:06:45 -0400 +Subject: NFS: Fix memory leaks in nfs_pageio_stop_mirroring() + +From: Trond Myklebust + +[ Upstream commit 862f35c94730c9270833f3ad05bd758a29f204ed ] + +If we just set the mirror count to 1 without first clearing out +the mirrors, we can leak queued up requests. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pagelist.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c +index 8b7c525dbbf7c..b736912098eee 100644 +--- a/fs/nfs/pagelist.c ++++ b/fs/nfs/pagelist.c +@@ -886,15 +886,6 @@ static void nfs_pageio_setup_mirroring(struct nfs_pageio_descriptor *pgio, + pgio->pg_mirror_count = mirror_count; + } + +-/* +- * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1) +- */ +-void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio) +-{ +- pgio->pg_mirror_count = 1; +- pgio->pg_mirror_idx = 0; +-} +- + static void nfs_pageio_cleanup_mirroring(struct nfs_pageio_descriptor *pgio) + { + pgio->pg_mirror_count = 1; +@@ -1320,6 +1311,14 @@ void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index) + } + } + ++/* ++ * nfs_pageio_stop_mirroring - stop using mirroring (set mirror count to 1) ++ */ ++void nfs_pageio_stop_mirroring(struct nfs_pageio_descriptor *pgio) ++{ ++ nfs_pageio_complete(pgio); ++} ++ + int __init nfs_init_nfspagecache(void) + { + nfs_page_cachep = kmem_cache_create("nfs_page", +-- +2.20.1 + diff --git a/queue-5.6/nfsroot-set-tcp-as-the-default-transport-protocol.patch b/queue-5.6/nfsroot-set-tcp-as-the-default-transport-protocol.patch new file mode 100644 index 00000000000..c0b13cff537 --- /dev/null +++ b/queue-5.6/nfsroot-set-tcp-as-the-default-transport-protocol.patch @@ -0,0 +1,38 @@ +From 12bea344f2639f180f6ab420c7d21e37895b2766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Mar 2020 11:50:13 +0800 +Subject: nfsroot: set tcp as the default transport protocol + +From: Liwei Song + +[ Upstream commit 89c8023fd46167a41246a56b31d1b3c9a20b6970 ] + +UDP is disabled by default in commit b24ee6c64ca7 ("NFS: allow +deprecation of NFS UDP protocol"), but the default mount options +is still udp, change it to tcp to avoid the "Unsupported transport +protocol udp" error if no protocol is specified when mount nfs. + +Fixes: b24ee6c64ca7 ("NFS: allow deprecation of NFS UDP protocol") +Signed-off-by: Liwei Song +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfsroot.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/nfsroot.c b/fs/nfs/nfsroot.c +index effaa4247b912..8d32788056022 100644 +--- a/fs/nfs/nfsroot.c ++++ b/fs/nfs/nfsroot.c +@@ -88,7 +88,7 @@ + #define NFS_ROOT "/tftpboot/%s" + + /* Default NFSROOT mount options. */ +-#define NFS_DEF_OPTIONS "vers=2,udp,rsize=4096,wsize=4096" ++#define NFS_DEF_OPTIONS "vers=2,tcp,rsize=4096,wsize=4096" + + /* Parameters passed from the kernel command line */ + static char nfs_root_parms[NFS_MAXPATHLEN + 1] __initdata = ""; +-- +2.20.1 + diff --git a/queue-5.6/nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch b/queue-5.6/nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch new file mode 100644 index 00000000000..365417d1bb5 --- /dev/null +++ b/queue-5.6/nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch @@ -0,0 +1,37 @@ +From 2f905e59c2158a611067ca35638d714755914a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Feb 2020 11:01:12 -0500 +Subject: NFSv4/pnfs: Return valid stateids in + nfs_layout_find_inode_by_stateid() + +From: Trond Myklebust + +[ Upstream commit d911c57a19551c6bef116a3b55c6b089901aacb0 ] + +Make sure to test the stateid for validity so that we catch instances +where the server may have been reusing stateids in +nfs_layout_find_inode_by_stateid(). + +Fixes: 7b410d9ce460 ("pNFS: Delay getting the layout header in CB_LAYOUTRECALL handlers") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_proc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index cd4c6bc81caed..40d31024b72d1 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -128,6 +128,8 @@ static struct inode *nfs_layout_find_inode_by_stateid(struct nfs_client *clp, + + list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) { + list_for_each_entry(lo, &server->layouts, plh_layouts) { ++ if (!pnfs_layout_is_valid(lo)) ++ continue; + if (stateid != NULL && + !nfs4_stateid_match_other(stateid, &lo->plh_stateid)) + continue; +-- +2.20.1 + diff --git a/queue-5.6/nfsv4.2-error-out-when-relink-swapfile.patch b/queue-5.6/nfsv4.2-error-out-when-relink-swapfile.patch new file mode 100644 index 00000000000..883d126ad95 --- /dev/null +++ b/queue-5.6/nfsv4.2-error-out-when-relink-swapfile.patch @@ -0,0 +1,35 @@ +From 965ad70d5163824db3506ce0f45bb3fd87a4cade Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2020 22:34:09 +0800 +Subject: NFSv4.2: error out when relink swapfile + +From: Murphy Zhou + +[ Upstream commit f5fdf1243fb750598b46305dd03c553949cfa14f ] + +This fixes xfstests generic/356 failure on NFSv4.2. + +Signed-off-by: Murphy Zhou +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4file.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index 1297919e0fce3..8e5d6223ddd35 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -252,6 +252,9 @@ static loff_t nfs42_remap_file_range(struct file *src_file, loff_t src_off, + if (remap_flags & ~REMAP_FILE_ADVISORY) + return -EINVAL; + ++ if (IS_SWAPFILE(dst_inode) || IS_SWAPFILE(src_inode)) ++ return -ETXTBSY; ++ + /* check alignment w.r.t. clone_blksize */ + ret = -EINVAL; + if (bs) { +-- +2.20.1 + diff --git a/queue-5.6/percpu_counter-fix-a-data-race-at-vm_committed_as.patch b/queue-5.6/percpu_counter-fix-a-data-race-at-vm_committed_as.patch new file mode 100644 index 00000000000..b52690633ef --- /dev/null +++ b/queue-5.6/percpu_counter-fix-a-data-race-at-vm_committed_as.patch @@ -0,0 +1,72 @@ +From d1e3f721471b2a48d5529e836b336dfcf4b708aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Apr 2020 20:10:25 -0700 +Subject: percpu_counter: fix a data race at vm_committed_as + +From: Qian Cai + +[ Upstream commit 7e2345200262e4a6056580f0231cccdaffc825f3 ] + +"vm_committed_as.count" could be accessed concurrently as reported by +KCSAN, + + BUG: KCSAN: data-race in __vm_enough_memory / percpu_counter_add_batch + + write to 0xffffffff9451c538 of 8 bytes by task 65879 on cpu 35: + percpu_counter_add_batch+0x83/0xd0 + percpu_counter_add_batch at lib/percpu_counter.c:91 + __vm_enough_memory+0xb9/0x260 + dup_mm+0x3a4/0x8f0 + copy_process+0x2458/0x3240 + _do_fork+0xaa/0x9f0 + __do_sys_clone+0x125/0x160 + __x64_sys_clone+0x70/0x90 + do_syscall_64+0x91/0xb05 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + + read to 0xffffffff9451c538 of 8 bytes by task 66773 on cpu 19: + __vm_enough_memory+0x199/0x260 + percpu_counter_read_positive at include/linux/percpu_counter.h:81 + (inlined by) __vm_enough_memory at mm/util.c:839 + mmap_region+0x1b2/0xa10 + do_mmap+0x45c/0x700 + vm_mmap_pgoff+0xc0/0x130 + ksys_mmap_pgoff+0x6e/0x300 + __x64_sys_mmap+0x33/0x40 + do_syscall_64+0x91/0xb05 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +The read is outside percpu_counter::lock critical section which results in +a data race. Fix it by adding a READ_ONCE() in +percpu_counter_read_positive() which could also service as the existing +compiler memory barrier. + +Signed-off-by: Qian Cai +Signed-off-by: Andrew Morton +Acked-by: Marco Elver +Link: http://lkml.kernel.org/r/1582302724-2804-1-git-send-email-cai@lca.pw +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/percpu_counter.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/percpu_counter.h b/include/linux/percpu_counter.h +index 4f052496cdfd7..0a4f54dd4737b 100644 +--- a/include/linux/percpu_counter.h ++++ b/include/linux/percpu_counter.h +@@ -78,9 +78,9 @@ static inline s64 percpu_counter_read(struct percpu_counter *fbc) + */ + static inline s64 percpu_counter_read_positive(struct percpu_counter *fbc) + { +- s64 ret = fbc->count; ++ /* Prevent reloads of fbc->count */ ++ s64 ret = READ_ONCE(fbc->count); + +- barrier(); /* Prevent reloads of fbc->count */ + if (ret >= 0) + return ret; + return 0; +-- +2.20.1 + diff --git a/queue-5.6/phy-uniphier-usb3ss-add-pro5-support.patch b/queue-5.6/phy-uniphier-usb3ss-add-pro5-support.patch new file mode 100644 index 00000000000..84e71b5b561 --- /dev/null +++ b/queue-5.6/phy-uniphier-usb3ss-add-pro5-support.patch @@ -0,0 +1,37 @@ +From ce08c17e77b5bf793a036bf94c6d4314a7baa36d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jan 2020 15:52:41 +0900 +Subject: phy: uniphier-usb3ss: Add Pro5 support + +From: Kunihiko Hayashi + +[ Upstream commit 9376fa634afc207a3ce99e0957e04948c34d6510 ] + +Pro5 SoC has same scheme of USB3 ss-phy as Pro4, so the data for Pro5 is +equivalent to Pro4. + +Signed-off-by: Kunihiko Hayashi +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/socionext/phy-uniphier-usb3ss.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/phy/socionext/phy-uniphier-usb3ss.c b/drivers/phy/socionext/phy-uniphier-usb3ss.c +index ec231e40ef2ac..a7577e316baf5 100644 +--- a/drivers/phy/socionext/phy-uniphier-usb3ss.c ++++ b/drivers/phy/socionext/phy-uniphier-usb3ss.c +@@ -314,6 +314,10 @@ static const struct of_device_id uniphier_u3ssphy_match[] = { + .compatible = "socionext,uniphier-pro4-usb3-ssphy", + .data = &uniphier_pro4_data, + }, ++ { ++ .compatible = "socionext,uniphier-pro5-usb3-ssphy", ++ .data = &uniphier_pro4_data, ++ }, + { + .compatible = "socionext,uniphier-pxs2-usb3-ssphy", + .data = &uniphier_pxs2_data, +-- +2.20.1 + diff --git a/queue-5.6/platform-chrome-cros_ec-query-ec-protocol-version-if.patch b/queue-5.6/platform-chrome-cros_ec-query-ec-protocol-version-if.patch new file mode 100644 index 00000000000..927f17be59b --- /dev/null +++ b/queue-5.6/platform-chrome-cros_ec-query-ec-protocol-version-if.patch @@ -0,0 +1,105 @@ +From a96ca4750bb0d998a3be24007461abaf0b5c5b7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Feb 2020 14:53:56 -0800 +Subject: platform/chrome: cros_ec: Query EC protocol version if EC transitions + between RO/RW + +From: Yicheng Li + +[ Upstream commit 42cd0ab476e2daffc23982c37822a78f9a53cdd5 ] + +RO and RW of EC may have different EC protocol version. If EC transitions +between RO and RW, but AP does not reboot (this is true for fingerprint +microcontroller / cros_fp, but not true for main ec / cros_ec), the AP +still uses the protocol version queried before transition, which can +cause problems. In the case of fingerprint microcontroller, this causes +AP to send the wrong version of EC_CMD_GET_NEXT_EVENT to RO in the +interrupt handler, which in turn prevents RO to clear the interrupt +line to AP, in an infinite loop. + +Once an EC_HOST_EVENT_INTERFACE_READY is received, we know that there +might have been a transition between RO and RW, so re-query the protocol. + +Signed-off-by: Yicheng Li +Tested-by: Marek Szyprowski +Reviewed-by: Gwendal Grignou +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec.c | 30 +++++++++++++++++++++ + include/linux/platform_data/cros_ec_proto.h | 4 +++ + 2 files changed, 34 insertions(+) + +diff --git a/drivers/platform/chrome/cros_ec.c b/drivers/platform/chrome/cros_ec.c +index 6fc8f2c3ac517..7ee43b2e0654a 100644 +--- a/drivers/platform/chrome/cros_ec.c ++++ b/drivers/platform/chrome/cros_ec.c +@@ -138,6 +138,24 @@ static int cros_ec_sleep_event(struct cros_ec_device *ec_dev, u8 sleep_event) + return ret; + } + ++static int cros_ec_ready_event(struct notifier_block *nb, ++ unsigned long queued_during_suspend, ++ void *_notify) ++{ ++ struct cros_ec_device *ec_dev = container_of(nb, struct cros_ec_device, ++ notifier_ready); ++ u32 host_event = cros_ec_get_host_event(ec_dev); ++ ++ if (host_event & EC_HOST_EVENT_MASK(EC_HOST_EVENT_INTERFACE_READY)) { ++ mutex_lock(&ec_dev->lock); ++ cros_ec_query_all(ec_dev); ++ mutex_unlock(&ec_dev->lock); ++ return NOTIFY_OK; ++ } ++ ++ return NOTIFY_DONE; ++} ++ + /** + * cros_ec_register() - Register a new ChromeOS EC, using the provided info. + * @ec_dev: Device to register. +@@ -237,6 +255,18 @@ int cros_ec_register(struct cros_ec_device *ec_dev) + dev_dbg(ec_dev->dev, "Error %d clearing sleep event to ec", + err); + ++ if (ec_dev->mkbp_event_supported) { ++ /* ++ * Register the notifier for EC_HOST_EVENT_INTERFACE_READY ++ * event. ++ */ ++ ec_dev->notifier_ready.notifier_call = cros_ec_ready_event; ++ err = blocking_notifier_chain_register(&ec_dev->event_notifier, ++ &ec_dev->notifier_ready); ++ if (err) ++ return err; ++ } ++ + dev_info(dev, "Chrome EC device registered\n"); + + return 0; +diff --git a/include/linux/platform_data/cros_ec_proto.h b/include/linux/platform_data/cros_ec_proto.h +index ba59147701918..3832433266762 100644 +--- a/include/linux/platform_data/cros_ec_proto.h ++++ b/include/linux/platform_data/cros_ec_proto.h +@@ -125,6 +125,9 @@ struct cros_ec_command { + * @host_event_wake_mask: Mask of host events that cause wake from suspend. + * @last_event_time: exact time from the hard irq when we got notified of + * a new event. ++ * @notifier_ready: The notifier_block to let the kernel re-query EC ++ * communication protocol when the EC sends ++ * EC_HOST_EVENT_INTERFACE_READY. + * @ec: The platform_device used by the mfd driver to interface with the + * main EC. + * @pd: The platform_device used by the mfd driver to interface with the +@@ -166,6 +169,7 @@ struct cros_ec_device { + u32 host_event_wake_mask; + u32 last_resume_result; + ktime_t last_event_time; ++ struct notifier_block notifier_ready; + + /* The platform devices used by the mfd driver */ + struct platform_device *ec; +-- +2.20.1 + diff --git a/queue-5.6/platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch b/queue-5.6/platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch new file mode 100644 index 00000000000..e49c863bfd2 --- /dev/null +++ b/queue-5.6/platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch @@ -0,0 +1,42 @@ +From 9c7b68a86307fc425d21b96f018bdf6c2b4c1825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Mar 2020 14:28:20 -0700 +Subject: platform/x86: intel-hid: fix: Update Tiger Lake ACPI device ID + +From: Gayatri Kammela + +[ Upstream commit d5764dc597467664a1a70ab66a2314a011aeccd4 ] + +Tiger Lake's new unique ACPI device IDs for intel-hid driver is not +valid because of missing 'C' in the ID. Fix the ID by updating it. + +After the update, the new ID should now look like +INT1051 --> INTC1051 + +Fixes: bdd11b654035 ("platform/x86: intel-hid: Add Tiger Lake ACPI device ID") +Suggested-by: Srinivas Pandruvada +Signed-off-by: Gayatri Kammela +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel-hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 43d590250228c..9c0e6e0fabdff 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -19,8 +19,8 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Alex Hung"); + + static const struct acpi_device_id intel_hid_ids[] = { +- {"INT1051", 0}, + {"INT33D5", 0}, ++ {"INTC1051", 0}, + {"", 0}, + }; + +-- +2.20.1 + diff --git a/queue-5.6/power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch b/queue-5.6/power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch new file mode 100644 index 00000000000..4ca7eb2366f --- /dev/null +++ b/queue-5.6/power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch @@ -0,0 +1,50 @@ +From 8e8d0e56c7bf037443f8e012f0538d32ea35ed69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 16:59:41 -0600 +Subject: power: supply: axp288_fuel_gauge: Broaden vendor check for Intel + Compute Sticks. + +From: Jeffery Miller + +[ Upstream commit e42fe5b29ac07210297e75f36deefe54edbdbf80 ] + +The Intel Compute Stick `STK1A32SC` can have a system vendor of +"Intel(R) Client Systems". +Broaden the Intel Compute Stick DMI checks so that they match "Intel +Corporation" as well as "Intel(R) Client Systems". + +This fixes an issue where the STK1A32SC compute sticks were still +exposing a battery with the existing blacklist entry. + +Signed-off-by: Jeffery Miller +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp288_fuel_gauge.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/power/supply/axp288_fuel_gauge.c b/drivers/power/supply/axp288_fuel_gauge.c +index e1bc4e6e6f30e..f40fa0e63b6e5 100644 +--- a/drivers/power/supply/axp288_fuel_gauge.c ++++ b/drivers/power/supply/axp288_fuel_gauge.c +@@ -706,14 +706,14 @@ static const struct dmi_system_id axp288_fuel_gauge_blacklist[] = { + { + /* Intel Cherry Trail Compute Stick, Windows version */ + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"), + DMI_MATCH(DMI_PRODUCT_NAME, "STK1AW32SC"), + }, + }, + { + /* Intel Cherry Trail Compute Stick, version without an OS */ + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "Intel Corporation"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"), + DMI_MATCH(DMI_PRODUCT_NAME, "STK1A32SC"), + }, + }, +-- +2.20.1 + diff --git a/queue-5.6/power-supply-bq27xxx_battery-silence-deferred-probe-.patch b/queue-5.6/power-supply-bq27xxx_battery-silence-deferred-probe-.patch new file mode 100644 index 00000000000..9ee4f0562fd --- /dev/null +++ b/queue-5.6/power-supply-bq27xxx_battery-silence-deferred-probe-.patch @@ -0,0 +1,45 @@ +From 637c7c18d7b8107af93135d21bd66b020872a31e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Mar 2020 00:51:43 +0300 +Subject: power: supply: bq27xxx_battery: Silence deferred-probe error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Osipenko + +[ Upstream commit 583b53ece0b0268c542a1eafadb62e3d4b0aab8c ] + +The driver fails to probe with -EPROBE_DEFER if battery's power supply +(charger driver) isn't ready yet and this results in a bit noisy error +message in KMSG during kernel's boot up. Let's silence the harmless +error message. + +Signed-off-by: Dmitry Osipenko +Reviewed-by: Andrew F. Davis +Reviewed-by: Pali Rohár +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq27xxx_battery.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/bq27xxx_battery.c b/drivers/power/supply/bq27xxx_battery.c +index 195c18c2f426e..664e50103eaaf 100644 +--- a/drivers/power/supply/bq27xxx_battery.c ++++ b/drivers/power/supply/bq27xxx_battery.c +@@ -1885,7 +1885,10 @@ int bq27xxx_battery_setup(struct bq27xxx_device_info *di) + + di->bat = power_supply_register_no_ws(di->dev, psy_desc, &psy_cfg); + if (IS_ERR(di->bat)) { +- dev_err(di->dev, "failed to register battery\n"); ++ if (PTR_ERR(di->bat) == -EPROBE_DEFER) ++ dev_dbg(di->dev, "failed to register battery, deferring probe\n"); ++ else ++ dev_err(di->dev, "failed to register battery\n"); + return PTR_ERR(di->bat); + } + +-- +2.20.1 + diff --git a/queue-5.6/powerpc-maple-fix-declaration-made-after-definition.patch b/queue-5.6/powerpc-maple-fix-declaration-made-after-definition.patch new file mode 100644 index 00000000000..4a8af408bd6 --- /dev/null +++ b/queue-5.6/powerpc-maple-fix-declaration-made-after-definition.patch @@ -0,0 +1,92 @@ +From 60c90371ebcb8cfa7452eb9f090688b99b41716f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Mar 2020 15:27:29 -0700 +Subject: powerpc/maple: Fix declaration made after definition + +From: Nathan Chancellor + +[ Upstream commit af6cf95c4d003fccd6c2ecc99a598fb854b537e7 ] + +When building ppc64 defconfig, Clang errors (trimmed for brevity): + + arch/powerpc/platforms/maple/setup.c:365:1: error: attribute declaration + must precede definition [-Werror,-Wignored-attributes] + machine_device_initcall(maple, maple_cpc925_edac_setup); + ^ + +machine_device_initcall expands to __define_machine_initcall, which in +turn has the macro machine_is used in it, which declares mach_##name +with an __attribute__((weak)). define_machine actually defines +mach_##name, which in this file happens before the declaration, hence +the warning. + +To fix this, move define_machine after machine_device_initcall so that +the declaration occurs before the definition, which matches how +machine_device_initcall and define_machine work throughout +arch/powerpc. + +While we're here, remove some spaces before tabs. + +Fixes: 8f101a051ef0 ("edac: cpc925 MC platform device setup") +Reported-by: Nick Desaulniers +Suggested-by: Ilie Halip +Signed-off-by: Nathan Chancellor +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200323222729.15365-1-natechancellor@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/maple/setup.c | 34 ++++++++++++++-------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/arch/powerpc/platforms/maple/setup.c b/arch/powerpc/platforms/maple/setup.c +index 6f019df37916f..15b2c6eb506d0 100644 +--- a/arch/powerpc/platforms/maple/setup.c ++++ b/arch/powerpc/platforms/maple/setup.c +@@ -291,23 +291,6 @@ static int __init maple_probe(void) + return 1; + } + +-define_machine(maple) { +- .name = "Maple", +- .probe = maple_probe, +- .setup_arch = maple_setup_arch, +- .init_IRQ = maple_init_IRQ, +- .pci_irq_fixup = maple_pci_irq_fixup, +- .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq, +- .restart = maple_restart, +- .halt = maple_halt, +- .get_boot_time = maple_get_boot_time, +- .set_rtc_time = maple_set_rtc_time, +- .get_rtc_time = maple_get_rtc_time, +- .calibrate_decr = generic_calibrate_decr, +- .progress = maple_progress, +- .power_save = power4_idle, +-}; +- + #ifdef CONFIG_EDAC + /* + * Register a platform device for CPC925 memory controller on +@@ -364,3 +347,20 @@ static int __init maple_cpc925_edac_setup(void) + } + machine_device_initcall(maple, maple_cpc925_edac_setup); + #endif ++ ++define_machine(maple) { ++ .name = "Maple", ++ .probe = maple_probe, ++ .setup_arch = maple_setup_arch, ++ .init_IRQ = maple_init_IRQ, ++ .pci_irq_fixup = maple_pci_irq_fixup, ++ .pci_get_legacy_ide_irq = maple_pci_get_legacy_ide_irq, ++ .restart = maple_restart, ++ .halt = maple_halt, ++ .get_boot_time = maple_get_boot_time, ++ .set_rtc_time = maple_set_rtc_time, ++ .get_rtc_time = maple_get_rtc_time, ++ .calibrate_decr = generic_calibrate_decr, ++ .progress = maple_progress, ++ .power_save = power4_idle, ++}; +-- +2.20.1 + diff --git a/queue-5.6/powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch b/queue-5.6/powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch new file mode 100644 index 00000000000..90b7c0e0b2c --- /dev/null +++ b/queue-5.6/powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch @@ -0,0 +1,42 @@ +From 90f1cadb06695a05b73bfe35a8109c8732f9f5e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 18:44:04 +1100 +Subject: powerpc/prom_init: Pass the "os-term" message to hypervisor + +From: Alexey Kardashevskiy + +[ Upstream commit 74bb84e5117146fa73eb9d01305975c53022b3c3 ] + +The "os-term" RTAS calls has one argument with a message address of OS +termination cause. rtas_os_term() already passes it but the recently +added prom_init's version of that missed it; it also does not fill +args correctly. + +This passes the message address and initializes the number of arguments. + +Fixes: 6a9c930bd775 ("powerpc/prom_init: Add the ESM call to prom_init") +Signed-off-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200312074404.87293-1-aik@ozlabs.ru +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/prom_init.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index 577345382b23f..673f13b87db13 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -1773,6 +1773,9 @@ static void __init prom_rtas_os_term(char *str) + if (token == 0) + prom_panic("Could not get token for ibm,os-term\n"); + os_term_args.token = cpu_to_be32(token); ++ os_term_args.nargs = cpu_to_be32(1); ++ os_term_args.nret = cpu_to_be32(1); ++ os_term_args.args[0] = cpu_to_be32(__pa(str)); + prom_rtas_hcall((uint64_t)&os_term_args); + } + #endif /* CONFIG_PPC_SVM */ +-- +2.20.1 + diff --git a/queue-5.6/rtc-88pm860x-fix-possible-race-condition.patch b/queue-5.6/rtc-88pm860x-fix-possible-race-condition.patch new file mode 100644 index 00000000000..3e8b57d986b --- /dev/null +++ b/queue-5.6/rtc-88pm860x-fix-possible-race-condition.patch @@ -0,0 +1,62 @@ +From f3bc1c7a7c61d3473b987e67815441084eb6de8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 23:39:51 +0100 +Subject: rtc: 88pm860x: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit 9cf4789e6e4673d0b2c96fa6bb0c35e81b43111a ] + +The RTC IRQ is requested before the struct rtc_device is allocated, +this may lead to a NULL pointer dereference in the IRQ handler. + +To fix this issue, allocating the rtc_device struct before requesting +the RTC IRQ using devm_rtc_allocate_device, and use rtc_register_device +to register the RTC device. + +Also remove the unnecessary error message as the core already prints the +info. + +Link: https://lore.kernel.org/r/20200311223956.51352-1-alexandre.belloni@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-88pm860x.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/rtc/rtc-88pm860x.c b/drivers/rtc/rtc-88pm860x.c +index 4743b16a8d849..1526402e126b2 100644 +--- a/drivers/rtc/rtc-88pm860x.c ++++ b/drivers/rtc/rtc-88pm860x.c +@@ -336,6 +336,10 @@ static int pm860x_rtc_probe(struct platform_device *pdev) + info->dev = &pdev->dev; + dev_set_drvdata(&pdev->dev, info); + ++ info->rtc_dev = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(info->rtc_dev)) ++ return PTR_ERR(info->rtc_dev); ++ + ret = devm_request_threaded_irq(&pdev->dev, info->irq, NULL, + rtc_update_handler, IRQF_ONESHOT, "rtc", + info); +@@ -377,13 +381,11 @@ static int pm860x_rtc_probe(struct platform_device *pdev) + } + } + +- info->rtc_dev = devm_rtc_device_register(&pdev->dev, "88pm860x-rtc", +- &pm860x_rtc_ops, THIS_MODULE); +- ret = PTR_ERR(info->rtc_dev); +- if (IS_ERR(info->rtc_dev)) { +- dev_err(&pdev->dev, "Failed to register RTC device: %d\n", ret); ++ info->rtc_dev->ops = &pm860x_rtc_ops; ++ ++ ret = rtc_register_device(info->rtc_dev); ++ if (ret) + return ret; +- } + + /* + * enable internal XO instead of internal 3.25MHz clock since it can +-- +2.20.1 + diff --git a/queue-5.6/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch b/queue-5.6/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch new file mode 100644 index 00000000000..824e0387913 --- /dev/null +++ b/queue-5.6/s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch @@ -0,0 +1,49 @@ +From 3a4b8e4f9f02d60660b31137bf0c10011cbfdf7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Mar 2020 12:39:55 +0100 +Subject: s390/cpuinfo: fix wrong output when CPU0 is offline + +From: Alexander Gordeev + +[ Upstream commit 872f27103874a73783aeff2aac2b41a489f67d7c ] + +/proc/cpuinfo should not print information about CPU 0 when it is offline. + +Fixes: 281eaa8cb67c ("s390/cpuinfo: simplify locking and skip offline cpus early") +Signed-off-by: Alexander Gordeev +Reviewed-by: Heiko Carstens +[heiko.carstens@de.ibm.com: shortened commit message] +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/processor.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c +index 6ebc2117c66c7..91b9b3f73de6e 100644 +--- a/arch/s390/kernel/processor.c ++++ b/arch/s390/kernel/processor.c +@@ -165,8 +165,9 @@ static void show_cpu_mhz(struct seq_file *m, unsigned long n) + static int show_cpuinfo(struct seq_file *m, void *v) + { + unsigned long n = (unsigned long) v - 1; ++ unsigned long first = cpumask_first(cpu_online_mask); + +- if (!n) ++ if (n == first) + show_cpu_summary(m, v); + if (!machine_has_cpu_mhz) + return 0; +@@ -179,6 +180,8 @@ static inline void *c_update(loff_t *pos) + { + if (*pos) + *pos = cpumask_next(*pos - 1, cpu_online_mask); ++ else ++ *pos = cpumask_first(cpu_online_mask); + return *pos < nr_cpu_ids ? (void *)*pos + 1 : NULL; + } + +-- +2.20.1 + diff --git a/queue-5.6/s390-cpum_sf-fix-wrong-page-count-in-error-message.patch b/queue-5.6/s390-cpum_sf-fix-wrong-page-count-in-error-message.patch new file mode 100644 index 00000000000..bd8b86b7b04 --- /dev/null +++ b/queue-5.6/s390-cpum_sf-fix-wrong-page-count-in-error-message.patch @@ -0,0 +1,70 @@ +From 907744331898564c1a5953e3a64df3cd71fb7008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Mar 2020 11:09:07 +0100 +Subject: s390/cpum_sf: Fix wrong page count in error message + +From: Thomas Richter + +[ Upstream commit 4141b6a5e9f171325effc36a22eb92bf961e7a5c ] + +When perf record -e SF_CYCLES_BASIC_DIAG runs with very high +frequency, the samples arrive faster than the perf process can +save them to file. Eventually, for longer running processes, this +leads to the siutation where the trace buffers allocated by perf +slowly fills up. At one point the auxiliary trace buffer is full +and the CPU Measurement sampling facility is turned off. Furthermore +a warning is printed to the kernel log buffer: + +cpum_sf: The AUX buffer with 0 pages for the diagnostic-sampling + mode is full + +The number of allocated pages for the auxiliary trace buffer is shown +as zero pages. That is wrong. + +Fix this by saving the number of allocated pages before entering the +work loop in the interrupt handler. When the interrupt handler processes +the samples, it may detect the buffer full condition and stop sampling, +reducing the buffer size to zero. +Print the correct value in the error message: + +cpum_sf: The AUX buffer with 256 pages for the diagnostic-sampling + mode is full + +Signed-off-by: Thomas Richter +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index b095b1c78987d..05b908b3a6b38 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1576,6 +1576,7 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw) + unsigned long range = 0, size; + unsigned long long overflow = 0; + struct perf_output_handle *handle = &cpuhw->handle; ++ unsigned long num_sdb; + + aux = perf_get_aux(handle); + if (WARN_ON_ONCE(!aux)) +@@ -1587,13 +1588,14 @@ static void hw_collect_aux(struct cpu_hw_sf *cpuhw) + size >> PAGE_SHIFT); + perf_aux_output_end(handle, size); + ++ num_sdb = aux->sfb.num_sdb; + while (!done) { + /* Get an output handle */ + aux = perf_aux_output_begin(handle, cpuhw->event); + if (handle->size == 0) { + pr_err("The AUX buffer with %lu pages for the " + "diagnostic-sampling mode is full\n", +- aux->sfb.num_sdb); ++ num_sdb); + debug_sprintf_event(sfdbg, 1, + "%s: AUX buffer used up\n", + __func__); +-- +2.20.1 + diff --git a/queue-5.6/s390-crypto-explicitly-memzero-stack-key-material-in.patch b/queue-5.6/s390-crypto-explicitly-memzero-stack-key-material-in.patch new file mode 100644 index 00000000000..6132004401d --- /dev/null +++ b/queue-5.6/s390-crypto-explicitly-memzero-stack-key-material-in.patch @@ -0,0 +1,46 @@ +From 9dfbd3c16667a0f5371a3debc4a6c20515543ce2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Feb 2020 15:34:30 +0100 +Subject: s390/crypto: explicitly memzero stack key material in aes_s390.c + +From: Torsten Duwe + +[ Upstream commit 4a559cd15dbc79958fa9b18ad4e8afe4a0bf4744 ] + +aes_s390.c has several functions which allocate space for key material on +the stack and leave the used keys there. It is considered good practice +to clean these locations before the function returns. + +Link: https://lkml.kernel.org/r/20200221165511.GB6928@lst.de +Signed-off-by: Torsten Duwe +Signed-off-by: Harald Freudenberger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/crypto/aes_s390.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/s390/crypto/aes_s390.c b/arch/s390/crypto/aes_s390.c +index 1c23d84a9097d..73044634d3427 100644 +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -342,6 +342,7 @@ static int cbc_aes_crypt(struct skcipher_request *req, unsigned long modifier) + memcpy(walk.iv, param.iv, AES_BLOCK_SIZE); + ret = skcipher_walk_done(&walk, nbytes - n); + } ++ memzero_explicit(¶m, sizeof(param)); + return ret; + } + +@@ -470,6 +471,8 @@ static int xts_aes_crypt(struct skcipher_request *req, unsigned long modifier) + walk.dst.virt.addr, walk.src.virt.addr, n); + ret = skcipher_walk_done(&walk, nbytes - n); + } ++ memzero_explicit(&pcc_param, sizeof(pcc_param)); ++ memzero_explicit(&xts_param, sizeof(xts_param)); + return ret; + } + +-- +2.20.1 + diff --git a/queue-5.6/series b/queue-5.6/series index 7434eb2d759..525bab832bf 100644 --- a/queue-5.6/series +++ b/queue-5.6/series @@ -36,3 +36,111 @@ afs-fix-race-between-post-modification-dir-edit-and-readdir-d_revalidate.patch block-bfq-turn-put_queue-into-release_process_ref-in-__bfq_bic_change_cgroup.patch block-bfq-make-reparent_leaf_entity-actually-work-only-on-leaf-entities.patch block-bfq-invoke-flush_idle_tree-after-reparent_active_queues-in-pd_offline.patch +drm-ttm-flush-the-fence-on-the-bo-after-we-individua.patch +gfs2-clear-ail1-list-when-gfs2-withdraws.patch +clk-don-t-cache-errors-from-clk_ops-get_phase.patch +clk-at91-usb-continue-if-clk_hw_round_rate-return-ze.patch +clk-imx-pll14xx-add-new-frequency-entries-for-pll144.patch +crypto-qce-use-cryptlen-when-adding-extra-sgl.patch +net-mlx5e-enforce-setting-of-a-single-fec-mode.patch +s390-crypto-explicitly-memzero-stack-key-material-in.patch +f2fs-fix-to-avoid-potential-deadlock.patch +f2fs-fix-the-panic-in-do_checkpoint.patch +bpf-reliably-preserve-btf_trace_xxx-types.patch +xfs-fix-iclog-release-error-check-race-with-shutdown.patch +f2fs-fix-wrong-check-on-f2fs_ioc_fssetxattr.patch +f2fs-fix-to-avoid-use-after-free-in-f2fs_write_multi.patch +arm-dts-rockchip-fix-vqmmc-supply-property-name-for-.patch +dmaengine-idxd-reflect-shadow-copy-of-traffic-class-.patch +memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch +memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-2042 +memory-tegra-correct-debugfs-clk-rate-range-on-tegra.patch-23140 +arm64-dts-allwinner-a64-fix-display-clock-register-r.patch +power-supply-bq27xxx_battery-silence-deferred-probe-.patch +clk-tegra-fix-tegra-pmc-clock-out-parents.patch +arm64-tegra-add-pcie-endpoint-controllers-nodes-for-.patch +arm64-tegra-fix-tegra194-pcie-compatible-string.patch +xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch +xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch +arm64-dts-marvell-espressobin-add-ethernet-alias.patch +arm64-dts-clearfog-gt-8k-set-gigabit-phy-reset-deass.patch +arm64-dts-marvell-fix-cpu-compatible-for-ap807-quad.patch +soc-imx-gpc-fix-power-up-sequencing.patch +dma-coherent-fix-integer-overflow-in-the-reserved-me.patch +rtc-88pm860x-fix-possible-race-condition.patch +nfs-alloc_nfs_open_context-must-use-the-file-cred-wh.patch +nfsv4-pnfs-return-valid-stateids-in-nfs_layout_find_.patch +nfsv4.2-error-out-when-relink-swapfile.patch +arm-dts-rockchip-fix-lvds-encoder-ports-subnode-for-.patch +xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch +kvm-ppc-book3s-hv-fix-h_cede-return-code-for-nested-.patch +f2fs-fix-to-show-norecovery-mount-option.patch +drivers-thermal-tsens-release-device-in-success-path.patch +phy-uniphier-usb3ss-add-pro5-support.patch +nfs-direct.c-fix-memory-leak-of-dreq-when-nfs_get_lo.patch +f2fs-fix-to-update-f2fs_super_block-fields-under-sb_.patch +f2fs-fix-mount-failure-due-to-spo-after-a-successful.patch +f2fs-add-a-new-cp-flag-to-help-fsck-fix-resize-spo-i.patch +s390-cpuinfo-fix-wrong-output-when-cpu0-is-offline.patch +mips-dts-ci20-add-dt-node-for-ir-sensor.patch +thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch +hibernate-allow-uswsusp-to-write-to-swap.patch +btrfs-add-rcu-locks-around-block-group-initializatio.patch +powerpc-prom_init-pass-the-os-term-message-to-hyperv.patch +powerpc-maple-fix-declaration-made-after-definition.patch +s390-cpum_sf-fix-wrong-page-count-in-error-message.patch +nfsroot-set-tcp-as-the-default-transport-protocol.patch +ext4-do-not-commit-super-on-read-only-bdev.patch +um-ubd-prevent-buffer-overrun-on-command-completion.patch +cifs-allocate-encryption-header-through-kmalloc.patch +x86-xen-make-the-boot-cpu-idle-task-reliable.patch +drm-amd-display-don-t-try-hdcp1.4-when-content_type-.patch +dt-bindings-thermal-tsens-fix-nvmem-cell-names-schem.patch +platform-x86-intel-hid-fix-update-tiger-lake-acpi-de.patch +mm-hugetlb-fix-build-failure-with-hugetlb_page-but-n.patch +macsec-fix-null-dereference-in-macsec_upd_offload.patch +drm-nouveau-svm-check-for-svm-initialized-before-mig.patch +drm-nouveau-svm-fix-vma-range-check-for-migration.patch +include-linux-swapops.h-correct-guards-for-non_swap_.patch +percpu_counter-fix-a-data-race-at-vm_committed_as.patch +compiler.h-fix-error-in-build_bug_on-reporting.patch +kvm-s390-vsie-fix-possible-race-when-shadowing-regio.patch +drm-nouveau-workaround-runpm-fail-by-disabling-pci-p.patch +leds-core-fix-warning-message-when-init_data.patch +x86-acpi-fix-cpu-hotplug-deadlock.patch +csky-fixup-cpu-speculative-execution-to-io-area.patch +drm-amdkfd-kfree-the-wrong-pointer.patch +nfs-fix-memory-leaks-in-nfs_pageio_stop_mirroring.patch +acpi-update-tiger-lake-acpi-device-ids.patch +csky-fixup-get-wrong-psr-value-from-phyical-reg.patch +f2fs-compress-fix-to-call-missing-destroy_compress_c.patch +f2fs-fix-potential-.flags-overflow-on-32bit-architec.patch +f2fs-fix-null-pointer-dereference-in-f2fs_verity_wor.patch +f2fs-fix-null-pointer-dereference-in-f2fs_write_begi.patch +f2fs-fix-potential-deadlock-on-compressed-quota-file.patch +acpica-fixes-for-acpiexec-namespace-init-file.patch +ceph-re-org-copy_file_range-and-fix-some-error-paths.patch +mfd-cros_ec-check-dt-node-for-usbpd-notify-add.patch +um-falloc.h-needs-to-be-directly-included-for-older-.patch +drm-vc4-fix-hdmi-mode-validation.patch +iommu-virtio-fix-freeing-of-incomplete-domains.patch +iommu-vt-d-add-build-dependency-on-ioasid.patch +iommu-vt-d-fix-mm-reference-leak.patch +sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch +virtio-balloon-switch-back-to-oom-handler-for-virtio.patch +ext2-fix-empty-body-warnings-when-wextra-is-used.patch +f2fs-fix-to-account-compressed-blocks-in-f2fs_compre.patch +f2fs-skip-gc-when-section-is-full.patch +iommu-vt-d-silence-rcu-list-debugging-warning-in-dma.patch +iommu-vt-d-fix-page-request-descriptor-size.patch +ext2-fix-debug-reference-to-ext2_xattr_cache.patch +sunrpc-fix-gss_unwrap_resp_integ-again.patch +thermal-qoriq-fix-a-compiling-issue.patch +csky-fixup-init_fpu-compile-warning-with-__init.patch +power-supply-axp288_fuel_gauge-broaden-vendor-check-.patch +libnvdimm-out-of-bounds-read-in-__nd_ioctl.patch +iommu-amd-fix-the-configuration-of-gcr3-table-root-p.patch +f2fs-fix-leaking-uninitialized-memory-in-compressed-.patch +f2fs-fix-to-wait-all-node-page-writeback.patch +platform-chrome-cros_ec-query-ec-protocol-version-if.patch +drm-nouveau-gr-gp107-gp108-implement-workaround-for-.patch diff --git a/queue-5.6/soc-imx-gpc-fix-power-up-sequencing.patch b/queue-5.6/soc-imx-gpc-fix-power-up-sequencing.patch new file mode 100644 index 00000000000..7aca6b45b87 --- /dev/null +++ b/queue-5.6/soc-imx-gpc-fix-power-up-sequencing.patch @@ -0,0 +1,78 @@ +From a582783f61a6a9b82242176dea184807b853a02f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Mar 2020 11:09:12 +0100 +Subject: soc: imx: gpc: fix power up sequencing + +From: Lucas Stach + +[ Upstream commit e0ea2d11f8a08ba7066ff897e16c5217215d1e68 ] + +Currently we wait only until the PGC inverts the isolation setting +before disabling the peripheral clocks. This doesn't ensure that the +reset is properly propagated through the peripheral devices in the +power domain. + +Wait until the PGC signals that the power up request is done and +wait a bit for resets to propagate before disabling the clocks. + +Signed-off-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/gpc.c | 24 +++++++++++++----------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c +index 98b9d9a902ae3..90a8b2c0676ff 100644 +--- a/drivers/soc/imx/gpc.c ++++ b/drivers/soc/imx/gpc.c +@@ -87,8 +87,8 @@ static int imx6_pm_domain_power_off(struct generic_pm_domain *genpd) + static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd) + { + struct imx_pm_domain *pd = to_imx_pm_domain(genpd); +- int i, ret, sw, sw2iso; +- u32 val; ++ int i, ret; ++ u32 val, req; + + if (pd->supply) { + ret = regulator_enable(pd->supply); +@@ -107,17 +107,18 @@ static int imx6_pm_domain_power_on(struct generic_pm_domain *genpd) + regmap_update_bits(pd->regmap, pd->reg_offs + GPC_PGC_CTRL_OFFS, + 0x1, 0x1); + +- /* Read ISO and ISO2SW power up delays */ +- regmap_read(pd->regmap, pd->reg_offs + GPC_PGC_PUPSCR_OFFS, &val); +- sw = val & 0x3f; +- sw2iso = (val >> 8) & 0x3f; +- + /* Request GPC to power up domain */ +- val = BIT(pd->cntr_pdn_bit + 1); +- regmap_update_bits(pd->regmap, GPC_CNTR, val, val); ++ req = BIT(pd->cntr_pdn_bit + 1); ++ regmap_update_bits(pd->regmap, GPC_CNTR, req, req); + +- /* Wait ISO + ISO2SW IPG clock cycles */ +- udelay(DIV_ROUND_UP(sw + sw2iso, pd->ipg_rate_mhz)); ++ /* Wait for the PGC to handle the request */ ++ ret = regmap_read_poll_timeout(pd->regmap, GPC_CNTR, val, !(val & req), ++ 1, 50); ++ if (ret) ++ pr_err("powerup request on domain %s timed out\n", genpd->name); ++ ++ /* Wait for reset to propagate through peripherals */ ++ usleep_range(5, 10); + + /* Disable reset clocks for all devices in the domain */ + for (i = 0; i < pd->num_clks; i++) +@@ -343,6 +344,7 @@ static const struct regmap_config imx_gpc_regmap_config = { + .rd_table = &access_table, + .wr_table = &access_table, + .max_register = 0x2ac, ++ .fast_io = true, + }; + + static struct generic_pm_domain *imx_gpc_onecell_domains[] = { +-- +2.20.1 + diff --git a/queue-5.6/sunrpc-fix-gss_unwrap_resp_integ-again.patch b/queue-5.6/sunrpc-fix-gss_unwrap_resp_integ-again.patch new file mode 100644 index 00000000000..567b1dc7a42 --- /dev/null +++ b/queue-5.6/sunrpc-fix-gss_unwrap_resp_integ-again.patch @@ -0,0 +1,178 @@ +From 0d64f63ef34a928b13e005a80249122cf4db98b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 11:21:07 -0400 +Subject: sunrpc: Fix gss_unwrap_resp_integ() again + +From: Chuck Lever + +[ Upstream commit 4047aa909c4a40fceebc36fff708d465a4d3c6e2 ] + +xdr_buf_read_mic() tries to find unused contiguous space in a +received xdr_buf in order to linearize the checksum for the call +to gss_verify_mic. However, the corner cases in this code are +numerous and we seem to keep missing them. I've just hit yet +another buffer overrun related to it. + +This overrun is at the end of xdr_buf_read_mic(): + +1284 if (buf->tail[0].iov_len != 0) +1285 mic->data = buf->tail[0].iov_base + buf->tail[0].iov_len; +1286 else +1287 mic->data = buf->head[0].iov_base + buf->head[0].iov_len; +1288 __read_bytes_from_xdr_buf(&subbuf, mic->data, mic->len); +1289 return 0; + +This logic assumes the transport has set the length of the tail +based on the size of the received message. base + len is then +supposed to be off the end of the message but still within the +actual buffer. + +In fact, the length of the tail is set by the upper layer when the +Call is encoded so that the end of the tail is actually the end of +the allocated buffer itself. This causes the logic above to set +mic->data to point past the end of the receive buffer. + +The "mic->data = head" arm of this if statement is no less fragile. + +As near as I can tell, this has been a problem forever. I'm not sure +that minimizing au_rslack recently changed this pathology much. + +So instead, let's use a more straightforward approach: kmalloc a +separate buffer to linearize the checksum. This is similar to +how gss_validate() currently works. + +Coming back to this code, I had some trouble understanding what +was going on. So I've cleaned up the variable naming and added +a few comments that point back to the XDR definition in RFC 2203 +to help guide future spelunkers, including myself. + +As an added clean up, the functionality that was in +xdr_buf_read_mic() is folded directly into gss_unwrap_resp_integ(), +as that is its only caller. + +Signed-off-by: Chuck Lever +Reviewed-by: Benjamin Coddington +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/auth_gss.c | 77 +++++++++++++++++++++++++--------- + 1 file changed, 58 insertions(+), 19 deletions(-) + +diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c +index d6cd2a519d9fb..2dc740acb3bf3 100644 +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -1935,35 +1935,69 @@ gss_unwrap_resp_auth(struct rpc_cred *cred) + return 0; + } + ++/* ++ * RFC 2203, Section 5.3.2.2 ++ * ++ * struct rpc_gss_integ_data { ++ * opaque databody_integ<>; ++ * opaque checksum<>; ++ * }; ++ * ++ * struct rpc_gss_data_t { ++ * unsigned int seq_num; ++ * proc_req_arg_t arg; ++ * }; ++ */ + static int + gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred, + struct gss_cl_ctx *ctx, struct rpc_rqst *rqstp, + struct xdr_stream *xdr) + { +- struct xdr_buf integ_buf, *rcv_buf = &rqstp->rq_rcv_buf; +- u32 data_offset, mic_offset, integ_len, maj_stat; ++ struct xdr_buf gss_data, *rcv_buf = &rqstp->rq_rcv_buf; + struct rpc_auth *auth = cred->cr_auth; ++ u32 len, offset, seqno, maj_stat; + struct xdr_netobj mic; +- __be32 *p; ++ int ret; + +- p = xdr_inline_decode(xdr, 2 * sizeof(*p)); +- if (unlikely(!p)) ++ ret = -EIO; ++ mic.data = NULL; ++ ++ /* opaque databody_integ<>; */ ++ if (xdr_stream_decode_u32(xdr, &len)) + goto unwrap_failed; +- integ_len = be32_to_cpup(p++); +- if (integ_len & 3) ++ if (len & 3) + goto unwrap_failed; +- data_offset = (u8 *)(p) - (u8 *)rcv_buf->head[0].iov_base; +- mic_offset = integ_len + data_offset; +- if (mic_offset > rcv_buf->len) ++ offset = rcv_buf->len - xdr_stream_remaining(xdr); ++ if (xdr_stream_decode_u32(xdr, &seqno)) + goto unwrap_failed; +- if (be32_to_cpup(p) != rqstp->rq_seqno) ++ if (seqno != rqstp->rq_seqno) + goto bad_seqno; ++ if (xdr_buf_subsegment(rcv_buf, &gss_data, offset, len)) ++ goto unwrap_failed; + +- if (xdr_buf_subsegment(rcv_buf, &integ_buf, data_offset, integ_len)) ++ /* ++ * The xdr_stream now points to the beginning of the ++ * upper layer payload, to be passed below to ++ * rpcauth_unwrap_resp_decode(). The checksum, which ++ * follows the upper layer payload in @rcv_buf, is ++ * located and parsed without updating the xdr_stream. ++ */ ++ ++ /* opaque checksum<>; */ ++ offset += len; ++ if (xdr_decode_word(rcv_buf, offset, &len)) ++ goto unwrap_failed; ++ offset += sizeof(__be32); ++ if (offset + len > rcv_buf->len) + goto unwrap_failed; +- if (xdr_buf_read_mic(rcv_buf, &mic, mic_offset)) ++ mic.len = len; ++ mic.data = kmalloc(len, GFP_NOFS); ++ if (!mic.data) ++ goto unwrap_failed; ++ if (read_bytes_from_xdr_buf(rcv_buf, offset, mic.data, mic.len)) + goto unwrap_failed; +- maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &integ_buf, &mic); ++ ++ maj_stat = gss_verify_mic(ctx->gc_gss_ctx, &gss_data, &mic); + if (maj_stat == GSS_S_CONTEXT_EXPIRED) + clear_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags); + if (maj_stat != GSS_S_COMPLETE) +@@ -1971,16 +2005,21 @@ gss_unwrap_resp_integ(struct rpc_task *task, struct rpc_cred *cred, + + auth->au_rslack = auth->au_verfsize + 2 + 1 + XDR_QUADLEN(mic.len); + auth->au_ralign = auth->au_verfsize + 2; +- return 0; ++ ret = 0; ++ ++out: ++ kfree(mic.data); ++ return ret; ++ + unwrap_failed: + trace_rpcgss_unwrap_failed(task); +- return -EIO; ++ goto out; + bad_seqno: +- trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, be32_to_cpup(p)); +- return -EIO; ++ trace_rpcgss_bad_seqno(task, rqstp->rq_seqno, seqno); ++ goto out; + bad_mic: + trace_rpcgss_verify_mic(task, maj_stat); +- return -EIO; ++ goto out; + } + + static int +-- +2.20.1 + diff --git a/queue-5.6/sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch b/queue-5.6/sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch new file mode 100644 index 00000000000..86ff8607029 --- /dev/null +++ b/queue-5.6/sunrpc-fix-krb5p-mount-to-provide-large-enough-buffe.patch @@ -0,0 +1,124 @@ +From 197c9d0b44d0fe21b1aaedcab7fb06a23892d116 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Mar 2020 10:24:51 -0400 +Subject: SUNRPC: fix krb5p mount to provide large enough buffer in rq_rcvsize + +From: Olga Kornievskaia + +[ Upstream commit df513a7711712758b9cb1a48d86712e7e1ee03f4 ] + +Ever since commit 2c94b8eca1a2 ("SUNRPC: Use au_rslack when computing +reply buffer size"). It changed how "req->rq_rcvsize" is calculated. It +used to use au_cslack value which was nice and large and changed it to +au_rslack value which turns out to be too small. + +Since 5.1, v3 mount with sec=krb5p fails against an Ontap server +because client's receive buffer it too small. + +For gss krb5p, we need to account for the mic token in the verifier, +and the wrap token in the wrap token. + +RFC 4121 defines: +mic token +Octet no Name Description + -------------------------------------------------------------- + 0..1 TOK_ID Identification field. Tokens emitted by + GSS_GetMIC() contain the hex value 04 04 + expressed in big-endian order in this + field. + 2 Flags Attributes field, as described in section + 4.2.2. + 3..7 Filler Contains five octets of hex value FF. + 8..15 SND_SEQ Sequence number field in clear text, + expressed in big-endian order. + 16..last SGN_CKSUM Checksum of the "to-be-signed" data and + octet 0..15, as described in section 4.2.4. + +that's 16bytes (GSS_KRB5_TOK_HDR_LEN) + chksum + +wrap token +Octet no Name Description + -------------------------------------------------------------- + 0..1 TOK_ID Identification field. Tokens emitted by + GSS_Wrap() contain the hex value 05 04 + expressed in big-endian order in this + field. + 2 Flags Attributes field, as described in section + 4.2.2. + 3 Filler Contains the hex value FF. + 4..5 EC Contains the "extra count" field, in big- + endian order as described in section 4.2.3. + 6..7 RRC Contains the "right rotation count" in big- + endian order, as described in section + 4.2.5. + 8..15 SND_SEQ Sequence number field in clear text, + expressed in big-endian order. + 16..last Data Encrypted data for Wrap tokens with + confidentiality, or plaintext data followed + by the checksum for Wrap tokens without + confidentiality, as described in section + 4.2.4. + +Also 16bytes of header (GSS_KRB5_TOK_HDR_LEN), encrypted data, and cksum +(other things like padding) + +RFC 3961 defines known cksum sizes: +Checksum type sumtype checksum section or + value size reference + --------------------------------------------------------------------- + CRC32 1 4 6.1.3 + rsa-md4 2 16 6.1.2 + rsa-md4-des 3 24 6.2.5 + des-mac 4 16 6.2.7 + des-mac-k 5 8 6.2.8 + rsa-md4-des-k 6 16 6.2.6 + rsa-md5 7 16 6.1.1 + rsa-md5-des 8 24 6.2.4 + rsa-md5-des3 9 24 ?? + sha1 (unkeyed) 10 20 ?? + hmac-sha1-des3-kd 12 20 6.3 + hmac-sha1-des3 13 20 ?? + sha1 (unkeyed) 14 20 ?? + hmac-sha1-96-aes128 15 20 [KRB5-AES] + hmac-sha1-96-aes256 16 20 [KRB5-AES] + [reserved] 0x8003 ? [GSS-KRB5] + +Linux kernel now mainly supports type 15,16 so max cksum size is 20bytes. +(GSS_KRB5_MAX_CKSUM_LEN) + +Re-use already existing define of GSS_KRB5_MAX_SLACK_NEEDED that's used +for encoding the gss_wrap tokens (same tokens are used in reply). + +Fixes: 2c94b8eca1a2 ("SUNRPC: Use au_rslack when computing reply buffer size") +Signed-off-by: Olga Kornievskaia +Reviewed-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/auth_gss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c +index 24ca861815b1d..d6cd2a519d9fb 100644 +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1050,7 +1051,7 @@ gss_create_new(const struct rpc_auth_create_args *args, struct rpc_clnt *clnt) + goto err_put_mech; + auth = &gss_auth->rpc_auth; + auth->au_cslack = GSS_CRED_SLACK >> 2; +- auth->au_rslack = GSS_VERF_SLACK >> 2; ++ auth->au_rslack = GSS_KRB5_MAX_SLACK_NEEDED >> 2; + auth->au_verfsize = GSS_VERF_SLACK >> 2; + auth->au_ralign = GSS_VERF_SLACK >> 2; + auth->au_flags = 0; +-- +2.20.1 + diff --git a/queue-5.6/thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch b/queue-5.6/thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch new file mode 100644 index 00000000000..366fec1b2d0 --- /dev/null +++ b/queue-5.6/thermal-drivers-cpufreq_cooling-fix-return-of-cpufre.patch @@ -0,0 +1,61 @@ +From 9342f7ff93c798a12e8836efe7a2bda4f6d9709d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Mar 2020 09:27:40 +0000 +Subject: thermal/drivers/cpufreq_cooling: Fix return of cpufreq_set_cur_state + +From: Willy Wolff + +[ Upstream commit ff44f672d74178b3be19d41a169b98b3e391d4ce ] + +When setting the cooling device current state from userspace via sysfs, +the operation fails by returning an -EINVAL. + +It appears the recent changes with the per-policy frequency QoS +introduced a regression as reported by: + + https://lkml.org/lkml/2020/3/20/599 + +The function freq_qos_update_request returns 0 or 1 describing update +effectiveness, and a negative error code on failure. However, +cpufreq_set_cur_state returns 0 on success or an error code otherwise. + +Consider the QoS update as successful if the function does not return +an error. + +Fixes: 3000ce3c52f8b ("cpufreq: Use per-policy frequency QoS") +Signed-off-by: Willy Wolff +Acked-by: Viresh Kumar +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200321092740.7vvwfxsebcrznydh@macmini.local +Signed-off-by: Sasha Levin +--- + drivers/thermal/cpufreq_cooling.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/cpufreq_cooling.c b/drivers/thermal/cpufreq_cooling.c +index fe83d7a210d47..af55ac08e1bd5 100644 +--- a/drivers/thermal/cpufreq_cooling.c ++++ b/drivers/thermal/cpufreq_cooling.c +@@ -431,6 +431,7 @@ static int cpufreq_set_cur_state(struct thermal_cooling_device *cdev, + unsigned long state) + { + struct cpufreq_cooling_device *cpufreq_cdev = cdev->devdata; ++ int ret; + + /* Request state should be less than max_level */ + if (WARN_ON(state > cpufreq_cdev->max_level)) +@@ -442,8 +443,9 @@ static int cpufreq_set_cur_state(struct thermal_cooling_device *cdev, + + cpufreq_cdev->cpufreq_state = state; + +- return freq_qos_update_request(&cpufreq_cdev->qos_req, +- get_state_freq(cpufreq_cdev, state)); ++ ret = freq_qos_update_request(&cpufreq_cdev->qos_req, ++ get_state_freq(cpufreq_cdev, state)); ++ return ret < 0 ? ret : 0; + } + + /* Bind cpufreq callbacks to thermal cooling device ops */ +-- +2.20.1 + diff --git a/queue-5.6/thermal-qoriq-fix-a-compiling-issue.patch b/queue-5.6/thermal-qoriq-fix-a-compiling-issue.patch new file mode 100644 index 00000000000..ef17c9566d5 --- /dev/null +++ b/queue-5.6/thermal-qoriq-fix-a-compiling-issue.patch @@ -0,0 +1,38 @@ +From f7664afb0f6061d78e13b397a665380efda3d8ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Mar 2020 16:46:41 +0800 +Subject: thermal: qoriq: Fix a compiling issue + +From: Yuantian Tang + +[ Upstream commit cbe259fd80b7b02fba0dad79d8fdda8b70a8b963 ] + +Qoriq thermal driver is used by both PowerPC and ARM architecture. +When built for PowerPC architecture, it reports error: +undefined reference to `.__devm_regmap_init_mmio_clk' +To fix it, select config REGMAP_MMIO. + +Fixes: 4316237bd627 (thermal: qoriq: Convert driver to use regmap API) +Signed-off-by: Yuantian Tang +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20200303084641.35687-1-andy.tang@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/thermal/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig +index 5a05db5438d60..5a0df0e54ce3e 100644 +--- a/drivers/thermal/Kconfig ++++ b/drivers/thermal/Kconfig +@@ -265,6 +265,7 @@ config QORIQ_THERMAL + tristate "QorIQ Thermal Monitoring Unit" + depends on THERMAL_OF + depends on HAS_IOMEM ++ select REGMAP_MMIO + help + Support for Thermal Monitoring Unit (TMU) found on QorIQ platforms. + It supports one critical trip point and one passive trip point. The +-- +2.20.1 + diff --git a/queue-5.6/um-falloc.h-needs-to-be-directly-included-for-older-.patch b/queue-5.6/um-falloc.h-needs-to-be-directly-included-for-older-.patch new file mode 100644 index 00000000000..f70f6688a50 --- /dev/null +++ b/queue-5.6/um-falloc.h-needs-to-be-directly-included-for-older-.patch @@ -0,0 +1,47 @@ +From f808df4bf46a7e3b4bfcc75e6cb0e16d1ead1600 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Mar 2020 17:35:34 +0000 +Subject: um: falloc.h needs to be directly included for older libc + +From: Alan Maguire + +[ Upstream commit 35f3401317a3b26aa01fde8facfd320f2628fdcc ] + +When building UML with glibc 2.17 installed, compilation +of arch/um/os-Linux/file.c fails due to failure to find +FALLOC_FL_PUNCH_HOLE and FALLOC_FL_KEEP_SIZE definitions. + +It appears that /usr/include/bits/fcntl-linux.h (indirectly +included by /usr/include/fcntl.h) does not include falloc.h +with an older glibc, whereas a more up-to-date version +does. + +Adding the direct include to file.c resolves the issue +and does not cause problems for more recent glibc. + +Fixes: 50109b5a03b4 ("um: Add support for DISCARD in the UBD Driver") +Cc: Brendan Higgins +Signed-off-by: Alan Maguire +Reviewed-by: Brendan Higgins +Acked-By: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/file.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c +index fbda10535dab0..5c819f89b8c21 100644 +--- a/arch/um/os-Linux/file.c ++++ b/arch/um/os-Linux/file.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + #include + #include + #include +-- +2.20.1 + diff --git a/queue-5.6/um-ubd-prevent-buffer-overrun-on-command-completion.patch b/queue-5.6/um-ubd-prevent-buffer-overrun-on-command-completion.patch new file mode 100644 index 00000000000..33b1389debe --- /dev/null +++ b/queue-5.6/um-ubd-prevent-buffer-overrun-on-command-completion.patch @@ -0,0 +1,41 @@ +From e3335a72b855988cf18937a0c0cea6775d26e272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Mar 2020 20:45:06 -0400 +Subject: um: ubd: Prevent buffer overrun on command completion + +From: Gabriel Krisman Bertazi + +[ Upstream commit 6e682d53fc1ef73a169e2a5300326cb23abb32ee ] + +On the hypervisor side, when completing commands and the pipe is full, +we retry writing only the entries that failed, by offsetting +io_req_buffer, but we don't reduce the number of bytes written, which +can cause a buffer overrun of io_req_buffer, and write garbage to the +pipe. + +Cc: Martyn Welch +Signed-off-by: Gabriel Krisman Bertazi +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/ubd_kern.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c +index 247f95da057b5..eca45ad2166c9 100644 +--- a/arch/um/drivers/ubd_kern.c ++++ b/arch/um/drivers/ubd_kern.c +@@ -1607,7 +1607,9 @@ int io_thread(void *arg) + written = 0; + + do { +- res = os_write_file(kernel_fd, ((char *) io_req_buffer) + written, n); ++ res = os_write_file(kernel_fd, ++ ((char *) io_req_buffer) + written, ++ n - written); + if (res >= 0) { + written += res; + } +-- +2.20.1 + diff --git a/queue-5.6/virtio-balloon-switch-back-to-oom-handler-for-virtio.patch b/queue-5.6/virtio-balloon-switch-back-to-oom-handler-for-virtio.patch new file mode 100644 index 00000000000..c9d63c2fa23 --- /dev/null +++ b/queue-5.6/virtio-balloon-switch-back-to-oom-handler-for-virtio.patch @@ -0,0 +1,306 @@ +From e5093a70dd4ed006eaa7c0472a108794d03a5957 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2020 17:34:02 +0100 +Subject: virtio-balloon: Switch back to OOM handler for + VIRTIO_BALLOON_F_DEFLATE_ON_OOM + +From: David Hildenbrand + +[ Upstream commit 5a6b4cc5b7a1892a8d7f63d6cbac6e0ae2a9d031 ] + +Commit 71994620bb25 ("virtio_balloon: replace oom notifier with shrinker") +changed the behavior when deflation happens automatically. Instead of +deflating when called by the OOM handler, the shrinker is used. + +However, the balloon is not simply some slab cache that should be +shrunk when under memory pressure. The shrinker does not have a concept of +priorities, so this behavior cannot be configured. + +There was a report that this results in undesired side effects when +inflating the balloon to shrink the page cache. [1] + "When inflating the balloon against page cache (i.e. no free memory + remains) vmscan.c will both shrink page cache, but also invoke the + shrinkers -- including the balloon's shrinker. So the balloon + driver allocates memory which requires reclaim, vmscan gets this + memory by shrinking the balloon, and then the driver adds the + memory back to the balloon. Basically a busy no-op." + +The name "deflate on OOM" makes it pretty clear when deflation should +happen - after other approaches to reclaim memory failed, not while +reclaiming. This allows to minimize the footprint of a guest - memory +will only be taken out of the balloon when really needed. + +Especially, a drop_slab() will result in the whole balloon getting +deflated - undesired. While handling it via the OOM handler might not be +perfect, it keeps existing behavior. If we want a different behavior, then +we need a new feature bit and document it properly (although, there should +be a clear use case and the intended effects should be well described). + +Keep using the shrinker for VIRTIO_BALLOON_F_FREE_PAGE_HINT, because +this has no such side effects. Always register the shrinker with +VIRTIO_BALLOON_F_FREE_PAGE_HINT now. We are always allowed to reuse free +pages that are still to be processed by the guest. The hypervisor takes +care of identifying and resolving possible races between processing a +hinting request and the guest reusing a page. + +In contrast to pre commit 71994620bb25 ("virtio_balloon: replace oom +notifier with shrinker"), don't add a moodule parameter to configure the +number of pages to deflate on OOM. Can be re-added if really needed. +Also, pay attention that leak_balloon() returns the number of 4k pages - +convert it properly in virtio_balloon_oom_notify(). + +Note1: using the OOM handler is frowned upon, but it really is what we + need for this feature. + +Note2: without VIRTIO_BALLOON_F_MUST_TELL_HOST (iow, always with QEMU) we + could actually skip sending deflation requests to our hypervisor, + making the OOM path *very* simple. Besically freeing pages and + updating the balloon. If the communication with the host ever + becomes a problem on this call path. + +[1] https://www.spinics.net/lists/linux-virtualization/msg40863.html + +Test report by Tyler Sanderson: + +Test setup: VM with 16 CPU, 64GB RAM. Running Debian 10. We have a 42 +GB file full of random bytes that we continually cat to /dev/null. +This fills the page cache as the file is read. Meanwhile we trigger +the balloon to inflate, with a target size of 53 GB. This setup causes +the balloon inflation to pressure the page cache as the page cache is +also trying to grow. Afterwards we shrink the balloon back to zero (so +total deflate = total inflate). + +Without patch (kernel 4.19.0-5): +Inflation never reaches the target until we stop the "cat file > +/dev/null" process. Total inflation time was 542 seconds. The longest +period that made no net forward progress was 315 seconds (see attached +graph). +Result of "grep balloon /proc/vmstat" after the test: +balloon_inflate 154828377 +balloon_deflate 154828377 + +With patch (kernel 5.6.0-rc4+): +Total inflation duration was 63 seconds. No deflate-queue activity +occurs when pressuring the page-cache. +Result of "grep balloon /proc/vmstat" after the test: +balloon_inflate 12968539 +balloon_deflate 12968539 + +Conclusion: This patch fixes the issue. In the test it reduced +inflate/deflate activity by 12x, and reduced inflation time by 8.6x. +But more importantly, if we hadn't killed the "grep balloon +/proc/vmstat" process then, without the patch, the inflation process +would never reach the target. + +Attached [1] is a png of a graph showing the problematic behavior without +this patch. It shows deflate-queue activity increasing linearly while +balloon size stays constant over the course of more than 8 minutes of +the test. + +[1] https://lore.kernel.org/linux-mm/CAJuQAmphPcfew1v_EOgAdSFiprzjiZjmOf3iJDmFX0gD6b9TYQ@mail.gmail.com/2-without_patch.png + +Full test report and discussion [2]: + +[2] https://lore.kernel.org/r/CAJuQAmphPcfew1v_EOgAdSFiprzjiZjmOf3iJDmFX0gD6b9TYQ@mail.gmail.com + +Tested-by: Tyler Sanderson +Reported-by: Tyler Sanderson +Cc: Michael S. Tsirkin +Cc: Wei Wang +Cc: Alexander Duyck +Cc: David Rientjes +Cc: Nadav Amit +Cc: Michal Hocko +Signed-off-by: David Hildenbrand +Link: https://lore.kernel.org/r/20200205163402.42627-4-david@redhat.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_balloon.c | 107 +++++++++++++------------------- + 1 file changed, 44 insertions(+), 63 deletions(-) + +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index 341458fd95ca4..44375a22307b3 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -27,7 +28,9 @@ + */ + #define VIRTIO_BALLOON_PAGES_PER_PAGE (unsigned)(PAGE_SIZE >> VIRTIO_BALLOON_PFN_SHIFT) + #define VIRTIO_BALLOON_ARRAY_PFNS_MAX 256 +-#define VIRTBALLOON_OOM_NOTIFY_PRIORITY 80 ++/* Maximum number of (4k) pages to deflate on OOM notifications. */ ++#define VIRTIO_BALLOON_OOM_NR_PAGES 256 ++#define VIRTIO_BALLOON_OOM_NOTIFY_PRIORITY 80 + + #define VIRTIO_BALLOON_FREE_PAGE_ALLOC_FLAG (__GFP_NORETRY | __GFP_NOWARN | \ + __GFP_NOMEMALLOC) +@@ -112,8 +115,11 @@ struct virtio_balloon { + /* Memory statistics */ + struct virtio_balloon_stat stats[VIRTIO_BALLOON_S_NR]; + +- /* To register a shrinker to shrink memory upon memory pressure */ ++ /* Shrinker to return free pages - VIRTIO_BALLOON_F_FREE_PAGE_HINT */ + struct shrinker shrinker; ++ ++ /* OOM notifier to deflate on OOM - VIRTIO_BALLOON_F_DEFLATE_ON_OOM */ ++ struct notifier_block oom_nb; + }; + + static struct virtio_device_id id_table[] = { +@@ -788,50 +794,13 @@ static unsigned long shrink_free_pages(struct virtio_balloon *vb, + return blocks_freed * VIRTIO_BALLOON_HINT_BLOCK_PAGES; + } + +-static unsigned long leak_balloon_pages(struct virtio_balloon *vb, +- unsigned long pages_to_free) +-{ +- return leak_balloon(vb, pages_to_free * VIRTIO_BALLOON_PAGES_PER_PAGE) / +- VIRTIO_BALLOON_PAGES_PER_PAGE; +-} +- +-static unsigned long shrink_balloon_pages(struct virtio_balloon *vb, +- unsigned long pages_to_free) +-{ +- unsigned long pages_freed = 0; +- +- /* +- * One invocation of leak_balloon can deflate at most +- * VIRTIO_BALLOON_ARRAY_PFNS_MAX balloon pages, so we call it +- * multiple times to deflate pages till reaching pages_to_free. +- */ +- while (vb->num_pages && pages_freed < pages_to_free) +- pages_freed += leak_balloon_pages(vb, +- pages_to_free - pages_freed); +- +- update_balloon_size(vb); +- +- return pages_freed; +-} +- + static unsigned long virtio_balloon_shrinker_scan(struct shrinker *shrinker, + struct shrink_control *sc) + { +- unsigned long pages_to_free, pages_freed = 0; + struct virtio_balloon *vb = container_of(shrinker, + struct virtio_balloon, shrinker); + +- pages_to_free = sc->nr_to_scan; +- +- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) +- pages_freed = shrink_free_pages(vb, pages_to_free); +- +- if (pages_freed >= pages_to_free) +- return pages_freed; +- +- pages_freed += shrink_balloon_pages(vb, pages_to_free - pages_freed); +- +- return pages_freed; ++ return shrink_free_pages(vb, sc->nr_to_scan); + } + + static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker, +@@ -839,26 +808,22 @@ static unsigned long virtio_balloon_shrinker_count(struct shrinker *shrinker, + { + struct virtio_balloon *vb = container_of(shrinker, + struct virtio_balloon, shrinker); +- unsigned long count; +- +- count = vb->num_pages / VIRTIO_BALLOON_PAGES_PER_PAGE; +- count += vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES; + +- return count; ++ return vb->num_free_page_blocks * VIRTIO_BALLOON_HINT_BLOCK_PAGES; + } + +-static void virtio_balloon_unregister_shrinker(struct virtio_balloon *vb) ++static int virtio_balloon_oom_notify(struct notifier_block *nb, ++ unsigned long dummy, void *parm) + { +- unregister_shrinker(&vb->shrinker); +-} ++ struct virtio_balloon *vb = container_of(nb, ++ struct virtio_balloon, oom_nb); ++ unsigned long *freed = parm; + +-static int virtio_balloon_register_shrinker(struct virtio_balloon *vb) +-{ +- vb->shrinker.scan_objects = virtio_balloon_shrinker_scan; +- vb->shrinker.count_objects = virtio_balloon_shrinker_count; +- vb->shrinker.seeks = DEFAULT_SEEKS; ++ *freed += leak_balloon(vb, VIRTIO_BALLOON_OOM_NR_PAGES) / ++ VIRTIO_BALLOON_PAGES_PER_PAGE; ++ update_balloon_size(vb); + +- return register_shrinker(&vb->shrinker); ++ return NOTIFY_OK; + } + + static int virtballoon_probe(struct virtio_device *vdev) +@@ -935,22 +900,35 @@ static int virtballoon_probe(struct virtio_device *vdev) + virtio_cwrite(vb->vdev, struct virtio_balloon_config, + poison_val, &poison_val); + } +- } +- /* +- * We continue to use VIRTIO_BALLOON_F_DEFLATE_ON_OOM to decide if a +- * shrinker needs to be registered to relieve memory pressure. +- */ +- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) { +- err = virtio_balloon_register_shrinker(vb); ++ ++ /* ++ * We're allowed to reuse any free pages, even if they are ++ * still to be processed by the host. ++ */ ++ vb->shrinker.scan_objects = virtio_balloon_shrinker_scan; ++ vb->shrinker.count_objects = virtio_balloon_shrinker_count; ++ vb->shrinker.seeks = DEFAULT_SEEKS; ++ err = register_shrinker(&vb->shrinker); + if (err) + goto out_del_balloon_wq; + } ++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) { ++ vb->oom_nb.notifier_call = virtio_balloon_oom_notify; ++ vb->oom_nb.priority = VIRTIO_BALLOON_OOM_NOTIFY_PRIORITY; ++ err = register_oom_notifier(&vb->oom_nb); ++ if (err < 0) ++ goto out_unregister_shrinker; ++ } ++ + virtio_device_ready(vdev); + + if (towards_target(vb)) + virtballoon_changed(vdev); + return 0; + ++out_unregister_shrinker: ++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) ++ unregister_shrinker(&vb->shrinker); + out_del_balloon_wq: + if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) + destroy_workqueue(vb->balloon_wq); +@@ -989,8 +967,11 @@ static void virtballoon_remove(struct virtio_device *vdev) + { + struct virtio_balloon *vb = vdev->priv; + +- if (virtio_has_feature(vb->vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) +- virtio_balloon_unregister_shrinker(vb); ++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_DEFLATE_ON_OOM)) ++ unregister_oom_notifier(&vb->oom_nb); ++ if (virtio_has_feature(vdev, VIRTIO_BALLOON_F_FREE_PAGE_HINT)) ++ unregister_shrinker(&vb->shrinker); ++ + spin_lock_irq(&vb->stop_update_lock); + vb->stop_update = true; + spin_unlock_irq(&vb->stop_update_lock); +-- +2.20.1 + diff --git a/queue-5.6/x86-acpi-fix-cpu-hotplug-deadlock.patch b/queue-5.6/x86-acpi-fix-cpu-hotplug-deadlock.patch new file mode 100644 index 00000000000..b66546a60a5 --- /dev/null +++ b/queue-5.6/x86-acpi-fix-cpu-hotplug-deadlock.patch @@ -0,0 +1,169 @@ +From 4caa0c97c8e5c498468d44949bbc5954b5dc288d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Apr 2020 10:03:45 -0400 +Subject: x86: ACPI: fix CPU hotplug deadlock + +From: Qian Cai + +[ Upstream commit 696ac2e3bf267f5a2b2ed7d34e64131f2287d0ad ] + +Similar to commit 0266d81e9bf5 ("acpi/processor: Prevent cpu hotplug +deadlock") except this is for acpi_processor_ffh_cstate_probe(): + +"The problem is that the work is scheduled on the current CPU from the +hotplug thread associated with that CPU. + +It's not required to invoke these functions via the workqueue because +the hotplug thread runs on the target CPU already. + +Check whether current is a per cpu thread pinned on the target CPU and +invoke the function directly to avoid the workqueue." + + WARNING: possible circular locking dependency detected + ------------------------------------------------------ + cpuhp/1/15 is trying to acquire lock: + ffffc90003447a28 ((work_completion)(&wfc.work)){+.+.}-{0:0}, at: __flush_work+0x4c6/0x630 + + but task is already holding lock: + ffffffffafa1c0e8 (cpuidle_lock){+.+.}-{3:3}, at: cpuidle_pause_and_lock+0x17/0x20 + + which lock already depends on the new lock. + + the existing dependency chain (in reverse order) is: + + -> #1 (cpu_hotplug_lock){++++}-{0:0}: + cpus_read_lock+0x3e/0xc0 + irq_calc_affinity_vectors+0x5f/0x91 + __pci_enable_msix_range+0x10f/0x9a0 + pci_alloc_irq_vectors_affinity+0x13e/0x1f0 + pci_alloc_irq_vectors_affinity at drivers/pci/msi.c:1208 + pqi_ctrl_init+0x72f/0x1618 [smartpqi] + pqi_pci_probe.cold.63+0x882/0x892 [smartpqi] + local_pci_probe+0x7a/0xc0 + work_for_cpu_fn+0x2e/0x50 + process_one_work+0x57e/0xb90 + worker_thread+0x363/0x5b0 + kthread+0x1f4/0x220 + ret_from_fork+0x27/0x50 + + -> #0 ((work_completion)(&wfc.work)){+.+.}-{0:0}: + __lock_acquire+0x2244/0x32a0 + lock_acquire+0x1a2/0x680 + __flush_work+0x4e6/0x630 + work_on_cpu+0x114/0x160 + acpi_processor_ffh_cstate_probe+0x129/0x250 + acpi_processor_evaluate_cst+0x4c8/0x580 + acpi_processor_get_power_info+0x86/0x740 + acpi_processor_hotplug+0xc3/0x140 + acpi_soft_cpu_online+0x102/0x1d0 + cpuhp_invoke_callback+0x197/0x1120 + cpuhp_thread_fun+0x252/0x2f0 + smpboot_thread_fn+0x255/0x440 + kthread+0x1f4/0x220 + ret_from_fork+0x27/0x50 + + other info that might help us debug this: + + Chain exists of: + (work_completion)(&wfc.work) --> cpuhp_state-up --> cpuidle_lock + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(cpuidle_lock); + lock(cpuhp_state-up); + lock(cpuidle_lock); + lock((work_completion)(&wfc.work)); + + *** DEADLOCK *** + + 3 locks held by cpuhp/1/15: + #0: ffffffffaf51ab10 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x69/0x2f0 + #1: ffffffffaf51ad40 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x69/0x2f0 + #2: ffffffffafa1c0e8 (cpuidle_lock){+.+.}-{3:3}, at: cpuidle_pause_and_lock+0x17/0x20 + + Call Trace: + dump_stack+0xa0/0xea + print_circular_bug.cold.52+0x147/0x14c + check_noncircular+0x295/0x2d0 + __lock_acquire+0x2244/0x32a0 + lock_acquire+0x1a2/0x680 + __flush_work+0x4e6/0x630 + work_on_cpu+0x114/0x160 + acpi_processor_ffh_cstate_probe+0x129/0x250 + acpi_processor_evaluate_cst+0x4c8/0x580 + acpi_processor_get_power_info+0x86/0x740 + acpi_processor_hotplug+0xc3/0x140 + acpi_soft_cpu_online+0x102/0x1d0 + cpuhp_invoke_callback+0x197/0x1120 + cpuhp_thread_fun+0x252/0x2f0 + smpboot_thread_fn+0x255/0x440 + kthread+0x1f4/0x220 + ret_from_fork+0x27/0x50 + +Signed-off-by: Qian Cai +Tested-by: Borislav Petkov +[ rjw: Subject ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/acpi/cstate.c | 3 ++- + drivers/acpi/processor_throttling.c | 7 ------- + include/acpi/processor.h | 8 ++++++++ + 3 files changed, 10 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c +index caf2edccbad2e..49ae4e1ac9cd8 100644 +--- a/arch/x86/kernel/acpi/cstate.c ++++ b/arch/x86/kernel/acpi/cstate.c +@@ -161,7 +161,8 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu, + + /* Make sure we are running on right CPU */ + +- retval = work_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx); ++ retval = call_on_cpu(cpu, acpi_processor_ffh_cstate_probe_cpu, cx, ++ false); + if (retval == 0) { + /* Use the hint in CST */ + percpu_entry->states[cx->index].eax = cx->address; +diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c +index 532a1ae3595a7..a0bd56ece3ff5 100644 +--- a/drivers/acpi/processor_throttling.c ++++ b/drivers/acpi/processor_throttling.c +@@ -897,13 +897,6 @@ static long __acpi_processor_get_throttling(void *data) + return pr->throttling.acpi_processor_get_throttling(pr); + } + +-static int call_on_cpu(int cpu, long (*fn)(void *), void *arg, bool direct) +-{ +- if (direct || (is_percpu_thread() && cpu == smp_processor_id())) +- return fn(arg); +- return work_on_cpu(cpu, fn, arg); +-} +- + static int acpi_processor_get_throttling(struct acpi_processor *pr) + { + if (!pr) +diff --git a/include/acpi/processor.h b/include/acpi/processor.h +index 47805172e73d8..683e124ad517d 100644 +--- a/include/acpi/processor.h ++++ b/include/acpi/processor.h +@@ -297,6 +297,14 @@ static inline void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx + } + #endif + ++static inline int call_on_cpu(int cpu, long (*fn)(void *), void *arg, ++ bool direct) ++{ ++ if (direct || (is_percpu_thread() && cpu == smp_processor_id())) ++ return fn(arg); ++ return work_on_cpu(cpu, fn, arg); ++} ++ + /* in processor_perflib.c */ + + #ifdef CONFIG_CPU_FREQ +-- +2.20.1 + diff --git a/queue-5.6/x86-xen-make-the-boot-cpu-idle-task-reliable.patch b/queue-5.6/x86-xen-make-the-boot-cpu-idle-task-reliable.patch new file mode 100644 index 00000000000..72a99276928 --- /dev/null +++ b/queue-5.6/x86-xen-make-the-boot-cpu-idle-task-reliable.patch @@ -0,0 +1,58 @@ +From 8f8d2ac966ef634df023ffd0bc89f7a9a350c038 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Mar 2020 10:26:02 +0100 +Subject: x86/xen: Make the boot CPU idle task reliable + +From: Miroslav Benes + +[ Upstream commit 2f62f36e62daec43aa7b9633ef7f18e042a80bed ] + +The unwinder reports the boot CPU idle task's stack on XEN PV as +unreliable, which affects at least live patching. There are two reasons +for this. First, the task does not follow the x86 convention that its +stack starts at the offset right below saved pt_regs. It allows the +unwinder to easily detect the end of the stack and verify it. Second, +startup_xen() function does not store the return address before jumping +to xen_start_kernel() which confuses the unwinder. + +Amend both issues by moving the starting point of initial stack in +startup_xen() and storing the return address before the jump, which is +exactly what call instruction does. + +Signed-off-by: Miroslav Benes +Reviewed-by: Juergen Gross +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +--- + arch/x86/xen/xen-head.S | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S +index 1d0cee3163e41..d63806e1ff7ae 100644 +--- a/arch/x86/xen/xen-head.S ++++ b/arch/x86/xen/xen-head.S +@@ -35,7 +35,11 @@ SYM_CODE_START(startup_xen) + rep __ASM_SIZE(stos) + + mov %_ASM_SI, xen_start_info +- mov $init_thread_union+THREAD_SIZE, %_ASM_SP ++#ifdef CONFIG_X86_64 ++ mov initial_stack(%rip), %rsp ++#else ++ mov pa(initial_stack), %esp ++#endif + + #ifdef CONFIG_X86_64 + /* Set up %gs. +@@ -51,7 +55,7 @@ SYM_CODE_START(startup_xen) + wrmsr + #endif + +- jmp xen_start_kernel ++ call xen_start_kernel + SYM_CODE_END(startup_xen) + __FINIT + #endif +-- +2.20.1 + diff --git a/queue-5.6/xfs-fix-iclog-release-error-check-race-with-shutdown.patch b/queue-5.6/xfs-fix-iclog-release-error-check-race-with-shutdown.patch new file mode 100644 index 00000000000..556a052f1f4 --- /dev/null +++ b/queue-5.6/xfs-fix-iclog-release-error-check-race-with-shutdown.patch @@ -0,0 +1,74 @@ +From d63faea6c3e865cb29ca494fb69502dc028c2fe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Feb 2020 07:36:24 -0800 +Subject: xfs: fix iclog release error check race with shutdown + +From: Brian Foster + +[ Upstream commit 6b789c337a5963ae57cbc7fe9e41488c40a9b014 ] + +Prior to commit df732b29c8 ("xfs: call xlog_state_release_iclog with +l_icloglock held"), xlog_state_release_iclog() always performed a +locked check of the iclog error state before proceeding into the +sync state processing code. As of this commit, part of +xlog_state_release_iclog() was open-coded into +xfs_log_release_iclog() and as a result the locked error state check +was lost. + +The lockless check still exists, but this doesn't account for the +possibility of a race with a shutdown being performed by another +task causing the iclog state to change while the original task waits +on ->l_icloglock. This has reproduced very rarely via generic/475 +and manifests as an assert failure in __xlog_state_release_iclog() +due to an unexpected iclog state. + +Restore the locked error state check in xlog_state_release_iclog() +to ensure that an iclog state update via shutdown doesn't race with +the iclog release state processing code. + +Fixes: df732b29c807 ("xfs: call xlog_state_release_iclog with l_icloglock held") +Reported-by: Zorro Lang +Signed-off-by: Brian Foster +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_log.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c +index f6006d94a581e..796ff37d5bb5b 100644 +--- a/fs/xfs/xfs_log.c ++++ b/fs/xfs/xfs_log.c +@@ -605,18 +605,23 @@ xfs_log_release_iclog( + struct xlog *log = mp->m_log; + bool sync; + +- if (iclog->ic_state == XLOG_STATE_IOERROR) { +- xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR); +- return -EIO; +- } ++ if (iclog->ic_state == XLOG_STATE_IOERROR) ++ goto error; + + if (atomic_dec_and_lock(&iclog->ic_refcnt, &log->l_icloglock)) { ++ if (iclog->ic_state == XLOG_STATE_IOERROR) { ++ spin_unlock(&log->l_icloglock); ++ goto error; ++ } + sync = __xlog_state_release_iclog(log, iclog); + spin_unlock(&log->l_icloglock); + if (sync) + xlog_sync(log, iclog); + } + return 0; ++error: ++ xfs_force_shutdown(mp, SHUTDOWN_LOG_IO_ERROR); ++ return -EIO; + } + + /* +-- +2.20.1 + diff --git a/queue-5.6/xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch b/queue-5.6/xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch new file mode 100644 index 00000000000..75b72943d6d --- /dev/null +++ b/queue-5.6/xfs-fix-incorrect-test-in-xfs_alloc_ag_vextent_lastb.patch @@ -0,0 +1,38 @@ +From 8c325c74b828ee324c968456c9cb4d8c3b3c6dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Mar 2020 13:57:58 -0700 +Subject: xfs: fix incorrect test in xfs_alloc_ag_vextent_lastblock + +From: Darrick J. Wong + +[ Upstream commit 77ca1eed5a7d2bf0905562eb1a15aac76bc19fe4 ] + +When I lifted the code in xfs_alloc_ag_vextent_lastblock out of a loop, +I forgot to convert all the accesses to len to be pointer dereferences. + +Coverity-id: 1457918 +Fixes: 5113f8ec3753ed ("xfs: clean up weird while loop in xfs_alloc_ag_vextent_near") +Signed-off-by: Darrick J. Wong +Reviewed-by: Brian Foster +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c +index d8053bc96c4d2..5a130409f173e 100644 +--- a/fs/xfs/libxfs/xfs_alloc.c ++++ b/fs/xfs/libxfs/xfs_alloc.c +@@ -1515,7 +1515,7 @@ xfs_alloc_ag_vextent_lastblock( + * maxlen, go to the start of this block, and skip all those smaller + * than minlen. + */ +- if (len || args->alignment > 1) { ++ if (*len || args->alignment > 1) { + acur->cnt->bc_ptrs[0] = 1; + do { + error = xfs_alloc_get_rec(acur->cnt, bno, len, &i); +-- +2.20.1 + diff --git a/queue-5.6/xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch b/queue-5.6/xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch new file mode 100644 index 00000000000..478ad2a0602 --- /dev/null +++ b/queue-5.6/xfs-fix-regression-in-cleanup-xfs_dir2_block_getdent.patch @@ -0,0 +1,80 @@ +From 9579941a0f10210c5fb9718b84d2bffcdda79cfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Mar 2020 07:43:53 -0700 +Subject: xfs: fix regression in "cleanup xfs_dir2_block_getdents" + +From: Tommi Rantala + +[ Upstream commit 3d28e7e278913a267b1de360efcd5e5274065ce2 ] + +Commit 263dde869bd09 ("xfs: cleanup xfs_dir2_block_getdents") introduced +a getdents regression, when it converted the pointer arithmetics to +offset calculations: offset is updated in the loop already for the next +iteration, but the updated offset value is used incorrectly in two +places, where we should have used the not-yet-updated value. + +This caused for example "git clean -ffdx" failures to cleanup certain +directory structures when running in a container. + +Fix the regression by making sure we use proper offset in the loop body. +Thanks to Christoph Hellwig for suggestion how to best fix the code. + +Cc: Christoph Hellwig +Fixes: 263dde869bd09 ("xfs: cleanup xfs_dir2_block_getdents") +Signed-off-by: Tommi Rantala +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_dir2_readdir.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c +index 0d3b640cf1cce..871ec22c9aee9 100644 +--- a/fs/xfs/xfs_dir2_readdir.c ++++ b/fs/xfs/xfs_dir2_readdir.c +@@ -147,7 +147,7 @@ xfs_dir2_block_getdents( + xfs_off_t cook; + struct xfs_da_geometry *geo = args->geo; + int lock_mode; +- unsigned int offset; ++ unsigned int offset, next_offset; + unsigned int end; + + /* +@@ -173,9 +173,10 @@ xfs_dir2_block_getdents( + * Loop over the data portion of the block. + * Each object is a real entry (dep) or an unused one (dup). + */ +- offset = geo->data_entry_offset; + end = xfs_dir3_data_end_offset(geo, bp->b_addr); +- while (offset < end) { ++ for (offset = geo->data_entry_offset; ++ offset < end; ++ offset = next_offset) { + struct xfs_dir2_data_unused *dup = bp->b_addr + offset; + struct xfs_dir2_data_entry *dep = bp->b_addr + offset; + uint8_t filetype; +@@ -184,14 +185,15 @@ xfs_dir2_block_getdents( + * Unused, skip it. + */ + if (be16_to_cpu(dup->freetag) == XFS_DIR2_DATA_FREE_TAG) { +- offset += be16_to_cpu(dup->length); ++ next_offset = offset + be16_to_cpu(dup->length); + continue; + } + + /* + * Bump pointer for the next iteration. + */ +- offset += xfs_dir2_data_entsize(dp->i_mount, dep->namelen); ++ next_offset = offset + ++ xfs_dir2_data_entsize(dp->i_mount, dep->namelen); + + /* + * The entry is before the desired starting point, skip it. +-- +2.20.1 + diff --git a/queue-5.6/xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch b/queue-5.6/xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch new file mode 100644 index 00000000000..e05d7fd1f92 --- /dev/null +++ b/queue-5.6/xfs-fix-use-after-free-when-aborting-corrupt-attr-in.patch @@ -0,0 +1,37 @@ +From 174beb50a0d1873fd5a87e4ebdcfa451b2b1a696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Mar 2020 10:37:53 -0700 +Subject: xfs: fix use-after-free when aborting corrupt attr inactivation + +From: Darrick J. Wong + +[ Upstream commit 496b9bcd62b0b3a160be61e3265a086f97adcbd3 ] + +Log the corrupt buffer before we release the buffer. + +Fixes: a5155b870d687 ("xfs: always log corruption errors") +Signed-off-by: Darrick J. Wong +Reviewed-by: Dave Chinner +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_attr_inactive.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c +index bbfa6ba84dcd7..fe8f60b59ec4d 100644 +--- a/fs/xfs/xfs_attr_inactive.c ++++ b/fs/xfs/xfs_attr_inactive.c +@@ -145,8 +145,8 @@ xfs_attr3_node_inactive( + * Since this code is recursive (gasp!) we must protect ourselves. + */ + if (level > XFS_DA_NODE_MAXDEPTH) { +- xfs_trans_brelse(*trans, bp); /* no locks for later trans */ + xfs_buf_corruption_error(bp); ++ xfs_trans_brelse(*trans, bp); /* no locks for later trans */ + return -EFSCORRUPTED; + } + +-- +2.20.1 + -- 2.47.3