From 722b7c48bcb0005f3c64758b90af29aca74d91d0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 28 Jul 2018 12:07:39 +0200 Subject: [PATCH] 4.17-stable patches added patches: acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch alsa-fm801-add-error-handling-for-snd_ctl_add.patch alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch arm-dts-imx53-fix-ldb-of-graph-warning.patch arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch arm64-defconfig-enable-rockchip-io-domain-driver.patch arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch asoc-compress-only-call-free-for-components-which-have-been-opened.patch asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch ath-add-regulatory-mapping-for-apl13_world.patch ath-add-regulatory-mapping-for-apl2_fcca.patch ath-add-regulatory-mapping-for-bahamas.patch ath-add-regulatory-mapping-for-bermuda.patch ath-add-regulatory-mapping-for-etsi8_world.patch ath-add-regulatory-mapping-for-fcc3_etsic.patch ath-add-regulatory-mapping-for-serbia.patch ath-add-regulatory-mapping-for-tanzania.patch ath-add-regulatory-mapping-for-uganda.patch ath10k-fix-kernel-panic-while-reading-tpc_stats.patch ath10k-search-all-ies-for-variant-before-falling-back.patch audit-allow-not-equal-op-for-audit-by-executable.patch backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch bluetooth-btusb-add-id-for-liteon-04ca-301a.patch bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch bnxt_en-always-forward-vf-mac-address-to-the-pf.patch bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch bpf-fix-references-to-free_bpf_prog_info-in-comments.patch bpf-powerpc64-pad-function-address-loads-with-nops.patch brcmfmac-add-support-for-bcm43364-wireless-chipset.patch btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch ceph-fix-alignment-of-rasize.patch ceph-fix-use-after-free-in-ceph_statfs.patch clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch clk-si544-properly-round-requested-frequency-to-nearest-match.patch clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch delayacct-use-raw_spinlocks.patch disable-loading-f2fs-module-on-page_size-4kb.patch dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch dma-iommu-fix-compilation-when-config_iommu_dma.patch drivers-bus-arm-cci-fix-build-warnings.patch drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch drm-add-dp-psr2-sink-enable-bit.patch drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch drm-amd-display-fix-dim-display-on-dce11.patch drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch drm-amdgpu-remove-vram-from-shared-bo-domains.patch drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch drm-radeon-fix-mode_valid-s-return-type.patch drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch edac-altera-fix-arm64-build-warning.patch f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch f2fs-check-cap_resource-only-for-data-blocks.patch f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch f2fs-fix-deadlock-in-shutdown-ioctl.patch f2fs-fix-error-path-of-move_data_page.patch f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch f2fs-fix-race-in-between-gc-and-atomic-open.patch f2fs-fix-to-detect-failure-of-dquot_initialize.patch f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch fscrypt-use-unbound-workqueue-for-decryption.patch gpu-host1x-acquire-a-reference-to-the-iova-cache.patch hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch hid-i2c-hid-check-if-device-is-there-before-really-probing.patch hv_netvsc-fix-network-namespace-issues-with-vf-support.patch hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch i40e-add-advertising-10g-lr-mode.patch i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch i40e-free-the-skb-after-clearing-the-bitlock.patch ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch igb-fix-queue-selection-on-mac-filters-on-i210.patch ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch infiniband-fix-a-possible-use-after-free-bug.patch ipconfig-correctly-initialise-ic_nameservers.patch irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch kcov-ensure-irq-code-sees-a-valid-area.patch kernel-hung_task.c-show-all-hung-tasks-before-panic.patch kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch libata-fix-command-retry-decision.patch lightnvm-fix-partial-read-error-path.patch lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch md-raid1-add-error-handling-of-read-error-from-failfast-device.patch media-arch-sh-migor-fix-tw9910-pdn-gpio.patch media-atomisp-compat32-fix-__user-annotations.patch media-atomisp-ov2680-don-t-declare-unused-vars.patch media-cec-fix-smatch-error.patch media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch media-em28xx-fix-a-regression-with-hvr-950.patch media-em28xx-fix-dualhd-broken-second-tuner.patch media-media-device-fix-ioctl-function-types.patch media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch media-saa7164-fix-driver-name-in-debug-output.patch media-si470x-fix-__be16-annotations.patch media-siano-get-rid-of-__le32-__le16-cast-warnings.patch media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch memory-tegra-apply-interrupts-mask-per-soc.patch memory-tegra-do-not-handle-spurious-interrupts.patch mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch microblaze-fix-simpleimage-format-generation.patch mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch mm-check-for-sigkill-inside-dup_mmap-loop.patch mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch mm-slub.c-add-__printf-verification-to-slab_err.patch mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch mt76-add-rcu-locking-around-tx-scheduling.patch mt76x2-apply-coverage-class-on-slot-time-too.patch mt76x2-fix-avg_rssi-estimation.patch mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch mwifiex-correct-histogram-data-with-appropriate-index.patch mwifiex-handle-race-during-mwifiex_usb_disconnect.patch net-dsa-qca8k-add-support-for-qca8334-switch.patch net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch net-hns3-fix-for-fiber-link-up-problem.patch net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch net-hns3-fix-the-missing-client-list-node-initialization.patch net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch net-mvpp2-add-missing-vlan-tag-detection.patch net-phy-phylink-release-link-gpio.patch net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch net-socionext-reset-hardware-in-ndo_stop.patch netfilter-ipset-forbid-family-for-hash-mac-sets.patch netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch nfsd-fix-error-handling-in-nfs4_set_delegation.patch nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch nvme-lightnvm-add-granby-support.patch nvme-pci-fix-aer-reset-handling.patch nvme-rdma-stop-admin-queue-before-freeing-it.patch nvmem-properly-handle-returned-value-nvmem_reg_read.patch pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch perf-fix-invalid-bit-in-diagnostic-entry.patch perf-tools-fix-pmu-events-parsing-rule.patch perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch pinctrl-at91-pio4-add-missing-of_node_put.patch pinctrl-msm-fix-gpio-hog-related-boot-issues.patch platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch powerpc-32-add-a-missing-include-header.patch powerpc-64s-add-barrier_nospec.patch powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch powerpc-add-__printf-verification-to-prom_printf.patch powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch powerpc-eeh-fix-use-after-release-of-eeh-driver.patch powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch powerpc-powermac-mark-variable-x-as-unused.patch printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch rdma-mad-convert-bug_ons-to-error-flows.patch regulator-add-dummy-function-of_find_regulator_by_node.patch regulator-don-t-return-or-expect-errno-from-of_map_mode.patch regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch rsi-fix-invalid-vdd-warning-in-mmc.patch rsi-fix-nommu_map_sg-overflow-kernel-panic.patch rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch rtc-tps6586x-fix-possible-race-condition.patch rtc-tps65910-fix-possible-race-condition.patch rtc-vr41xx-fix-possible-race-condition.patch rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch scsi-3w-9xxx-fix-a-missing-check-bug.patch scsi-3w-xxxx-fix-a-missing-check-bug.patch scsi-cxlflash-avoid-clobbering-context-control-register-value.patch scsi-cxlflash-synchronize-reset-and-remove-ops.patch scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch scsi-megaraid-silence-a-static-checker-bug.patch scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch scsi-ufs-fix-exception-event-handling.patch scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch selftests-filesystems-devpts_pts-included-wrong-header.patch selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch selftests-intel_pstate-improve-test-minor-fixes.patch selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch skip-layoutreturn-if-layout-is-invalid.patch soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch soc-qcom-qmi-fix-a-buffer-sizing-bug.patch soc-qcom-smem-byte-swap-values-properly.patch soc-qcom-smem-fix-qcom_smem_set_global_partition.patch soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch staging-lustre-llite-correct-removexattr-detection.patch staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch staging-most-cdev-fix-chrdev_region-leak.patch staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch stop_machine-use-raw-spinlocks.patch thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch vfio-mdev-check-globally-for-duplicate-devices.patch vfio-platform-fix-reset-module-leak-in-error-path.patch vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch watchdog-da9063-fix-updating-timeout-value.patch watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch y2038-ipc-use-ktime_get_real_seconds-consistently.patch --- ...e-for-bay-trail-pwm-if-pmic-hrv-is-2.patch | 67 ++++ ...1-add-error-handling-for-snd_ctl_add.patch | 35 ++ ...mit-error-messages-about-page-errors.patch | 49 +++ ...1-add-error-handling-for-snd_ctl_add.patch | 49 +++ ...ailure-when-a-local-macro-is-defined.patch | 51 +++ ...ng-messages-in-urb-complete-callback.patch | 32 ++ ...ssing-interrupt-affinity-to-pmu-node.patch | 50 +++ ...m-dts-imx53-fix-ldb-of-graph-warning.patch | 65 +++ ...d-let-the-codec-control-mclk-pinctrl.patch | 87 +++++ ...ssing-interrupt-affinity-to-pmu-node.patch | 52 +++ ...x-complain-about-irq_type_none-usage.patch | 69 ++++ ...x-complain-about-irq_type_none-usage.patch | 98 +++++ ...ster-before-arming-exclusive-monitor.patch | 37 ++ ...fig-enable-rockchip-io-domain-driver.patch | 44 +++ ...ommon-use-audio-graph-card-for-sound.patch | 90 +++++ ...or-components-which-have-been-opened.patch | 148 +++++++ ...-fix-be-dai-not-hw_free-and-shutdown.patch | 47 +++ ...variable-type-when-using-regmap_read.patch | 51 +++ ...ng-parameter-when-parsing-hw_configs.patch | 100 +++++ ...sync-inversion-in-set_link_hw_format.patch | 89 +++++ ...d-regulatory-mapping-for-apl13_world.patch | 47 +++ ...add-regulatory-mapping-for-apl2_fcca.patch | 47 +++ ...h-add-regulatory-mapping-for-bahamas.patch | 50 +++ ...h-add-regulatory-mapping-for-bermuda.patch | 50 +++ ...d-regulatory-mapping-for-etsi8_world.patch | 47 +++ ...dd-regulatory-mapping-for-fcc3_etsic.patch | 47 +++ ...th-add-regulatory-mapping-for-serbia.patch | 50 +++ ...-add-regulatory-mapping-for-tanzania.patch | 50 +++ ...th-add-regulatory-mapping-for-uganda.patch | 50 +++ ...kernel-panic-while-reading-tpc_stats.patch | 125 ++++++ ...-ies-for-variant-before-falling-back.patch | 245 ++++++++++++ ...not-equal-op-for-audit-by-executable.patch | 47 +++ ...-use-gpiof_-with-gpiod_get_direction.patch | 44 +++ ...ve-wrong-lock-in-bfq_requests_merged.patch | 46 +++ ...dd-a-new-realtek-8723de-id-2ff8-b011.patch | 62 +++ ...th-btusb-add-id-for-liteon-04ca-301a.patch | 39 ++ ...-sleep-inside-atomic-section-warning.patch | 40 ++ ...ays-forward-vf-mac-address-to-the-pf.patch | 55 +++ ...peeds-in-bnxt_update_link-on-pf-only.patch | 34 ++ ...t-naming-about-emit_a32_lsr_-r64-i64.patch | 77 ++++ ...tion-jited-dump-obtained-via-syscall.patch | 108 +++++ ...es-to-free_bpf_prog_info-in-comments.patch | 42 ++ ...pad-function-address-loads-with-nops.patch | 82 ++++ ...upport-for-bcm43364-wireless-chipset.patch | 51 +++ ...c_log-before-log_commit_wait-wakeups.patch | 97 +++++ ...ata-pages-in-btrfs_finish_ordered_io.patch | 89 +++++ ...bug_on-in-btrfs_truncate_inode_items.patch | 37 ++ ...no-cache-if-inode-item-removal-fails.patch | 66 ++++ ...hen-hit-the-last-leaf-of-extent-tree.patch | 110 ++++++ queue-4.17/ceph-fix-alignment-of-rasize.patch | 35 ++ ...ph-fix-use-after-free-in-ceph_statfs.patch | 110 ++++++ ...ix-usb0-48mhz-phy-clock-registration.patch | 37 ++ ...ck-to-disable-cpu-clock-stop-on-idle.patch | 36 ++ ...requested-frequency-to-nearest-match.patch | 44 +++ ...e-beginning-of-function-declarations.patch | 39 ++ ...-don-t-leak-pointers-to-authenc-keys.patch | 32 ++ ...-don-t-leak-pointers-to-authenc-keys.patch | 32 ++ queue-4.17/delayacct-use-raw_spinlocks.patch | 101 +++++ ...loading-f2fs-module-on-page_size-4kb.patch | 62 +++ ...llocation-with-gfp_dma32-if-possible.patch | 44 +++ ...ix-compilation-when-config_iommu_dma.patch | 48 +++ ...ivers-bus-arm-cci-fix-build-warnings.patch | 53 +++ ...ccn-don-t-log-to-dmesg-in-event_init.patch | 114 ++++++ .../drm-add-dp-psr2-sink-enable-bit.patch | 31 ++ ...am-interrupt-status-on-disabled-crtc.patch | 33 ++ ...amd-display-fix-dim-display-on-dce11.patch | 35 ++ ...f-modeset-flag-for-overlay-planes-v2.patch | 64 +++ ...lk-mclk-frequency-than-dpm7-in-od-v2.patch | 45 +++ ...-holding-locks-taken-in-mmu-notifier.patch | 71 ++++ ...u-remove-vram-from-shared-bo-domains.patch | 41 ++ ...case-when-setting-old-crtc-for-plane.patch | 41 ++ ...-only-for-drm_atomic_helper_shutdown.patch | 174 +++++++++ ...-by-one-typo-when-dump-payload-table.patch | 65 +++ ..._intel_lvds_mode_valid-s-return-type.patch | 47 +++ ...4-poll-for-runlist-update-completion.patch | 39 ++ ...-buffers-referenced-by-pushbuf-ioctl.patch | 101 +++++ ...de-from-deferred-client-work-handler.patch | 82 ++++ ...-radeon-fix-mode_valid-s-return-type.patch | 70 ++++ ...o-not-call-analogix-code-before-bind.patch | 66 ++++ ...fix-warning-in-ltdc_crtc_update_clut.patch | 40 ++ ...-setting-clock-divider-for-omap-l138.patch | 41 ++ ...wmac-new-compatible-name-for-axg-soc.patch | 32 ++ ...son-add-support-for-the-meson8m2-soc.patch | 39 ++ ...l-when-getting-i219-clock-attributes.patch | 75 ++++ .../edac-altera-fix-arm64-build-warning.patch | 45 +++ ...ailure-caused-by-eagain-in-writepage.patch | 38 ++ ...ck-cap_resource-only-for-data-blocks.patch | 58 +++ ...-drop-dentry-pages-after-fs-shutdown.patch | 41 ++ .../f2fs-fix-deadlock-in-shutdown-ioctl.patch | 55 +++ ...2fs-fix-error-path-of-move_data_page.patch | 41 ++ ...ar-fi_no_prealloc-in-some-error-case.patch | 31 ++ ...x-race-in-between-gc-and-atomic-open.patch | 54 +++ ...o-detect-failure-of-dquot_initialize.patch | 33 ++ ...-t-trigger-writeback-during-recovery.patch | 46 +++ ...iteback-during-revoking-atomic-write.patch | 32 ++ ...xt-and-interrupt-context-kill_fasync.patch | 118 ++++++ ...use-unbound-workqueue-for-decryption.patch | 59 +++ ...cquire-a-reference-to-the-iova-cache.patch | 73 ++++ ...pdate-to-map-button-for-ptt-products.patch | 43 ++ ...evice-is-there-before-really-probing.patch | 43 ++ ...ork-namespace-issues-with-vf-support.patch | 131 +++++++ ...ks_per_usec-in-udbg_init_opal_common.patch | 46 +++ .../i40e-add-advertising-10g-lr-mode.patch | 36 ++ ...e-avoid-overflow-in-i40e_ptp_adjfreq.patch | 142 +++++++ ...e-the-skb-after-clearing-the-bitlock.patch | 55 +++ ...rdmavt-dependencies-for-dma_virt_ops.patch | 53 +++ ...eue-selection-on-mac-filters-on-i210.patch | 52 +++ ...ware-signatures-pre-allocated-buffer.patch | 35 ++ ...nd-fix-a-possible-use-after-free-bug.patch | 55 +++ ...-correctly-initialise-ic_nameservers.patch | 86 ++++ ...ip-ls-scfg-msi-map-msis-in-the-iommu.patch | 44 +++ ...-session-only-when-sta-is-authorized.patch | 291 ++++++++++++++ ...pcie-fix-race-in-rx-buffer-allocator.patch | 34 ++ ...of-tc-configuration-for-macvlan-case.patch | 67 ++++ ...ress-changes-through-ixgbevf_set_mac.patch | 34 ++ ...ov-ensure-irq-code-sees-a-valid-area.patch | 77 ++++ ...k.c-show-all-hung-tasks-before-panic.patch | 118 ++++++ ...ows-in-kvm_memory_encrypt_reg_region.patch | 63 +++ ...or_random_bytes-before-plain-p-tests.patch | 46 +++ .../libata-fix-command-retry-decision.patch | 49 +++ ...lightnvm-fix-partial-read-error-path.patch | 47 +++ ...rn-in-case-of-corrupted-write-buffer.patch | 39 ++ ...rror-handling-for-pblk_bio_add_pages.patch | 50 +++ ...-mddev-pers-in-remove_and_add_spares.patch | 72 ++++ ...g-of-read-error-from-failfast-device.patch | 38 ++ ...ia-arch-sh-migor-fix-tw9910-pdn-gpio.patch | 41 ++ ...misp-compat32-fix-__user-annotations.patch | 228 +++++++++++ ...isp-ov2680-don-t-declare-unused-vars.patch | 55 +++ queue-4.17/media-cec-fix-smatch-error.patch | 50 +++ ...d-a-false-positive-spectre-detection.patch | 81 ++++ ...em28xx-fix-a-regression-with-hvr-950.patch | 47 +++ ...m28xx-fix-dualhd-broken-second-tuner.patch | 37 ++ ...edia-device-fix-ioctl-function-types.patch | 85 ++++ ...isp-fix-unbalanced-dma_iommu_mapping.patch | 57 +++ ...timeout-values-cause-double-keydowns.patch | 46 +++ ...sable_unprepare-on-error-in-jpu_open.patch | 43 ++ ...eu-set-mbus_fmt-on-subdev-operations.patch | 95 +++++ ...7164-fix-driver-name-in-debug-output.patch | 39 ++ .../media-si470x-fix-__be16-annotations.patch | 58 +++ ...t-rid-of-__le32-__le16-cast-warnings.patch | 108 +++++ ...-timeout-checking-in-smiapp_read_nvm.patch | 58 +++ ...ut-several-unused-sensor-resolutions.patch | 358 +++++++++++++++++ ...-fix-incorrect-vb2_mem_ops-gfp-flags.patch | 36 ++ ...on-t-call-memop-finish-when-queueing.patch | 42 ++ ...k-and-stat_cpu-in-the-same-cacheline.patch | 136 +++++++ ...-tegra-apply-interrupts-mask-per-soc.patch | 161 ++++++++ ...ra-do-not-handle-spurious-interrupts.patch | 37 ++ ...l-early-if-we-cannot-identify-the-ec.patch | 41 ++ ...ze-fix-simpleimage-format-generation.patch | 47 +++ ...n-an-error-for-non-default-fib-rules.patch | 75 ++++ ..._switchdev-fix-port_vlan-refcounting.patch | 62 +++ ...eck-for-sigkill-inside-dup_mmap-loop.patch | 66 ++++ ...-if-config_arch_has_pkeys-is-enabled.patch | 79 ++++ ...swap-entries-from-unprivileged-users.patch | 93 +++++ ...dd-__printf-verification-to-slab_err.patch | 40 ++ ...y-handling-of-debugobjects-in-vunmap.patch | 64 +++ ...-update-actual-clock-for-mmc-debugfs.patch | 57 +++ ...e-kmalloc_array-instead-of-stack-vla.patch | 65 +++ ...obtained-from-sdhci_capabilities-reg.patch | 66 ++++ ...add-rcu-locking-around-tx-scheduling.patch | 73 ++++ ...pply-coverage-class-on-slot-time-too.patch | 51 +++ .../mt76x2-fix-avg_rssi-estimation.patch | 36 ++ ...ver-to-read-all-onfi-parameter-pages.patch | 57 +++ ...istogram-data-with-appropriate-index.patch | 39 ++ ...e-race-during-mwifiex_usb_disconnect.patch | 47 +++ ...qca8k-add-support-for-qca8334-switch.patch | 31 ++ ...-sel-check-bus_find_device-ret-value.patch | 51 +++ ...d-misc.-interrupt-init-order-problem.patch | 76 ++++ ...t-hns3-fix-for-fiber-link-up-problem.patch | 45 +++ ...ule-is-loaded-multiple-times-problem.patch | 104 +++++ ...-not-link-up-problem-after-resetting.patch | 51 +++ ...-not-running-problem-after-resetting.patch | 49 +++ ...mailbox-cannot-receiving-pf-response.patch | 51 +++ ...sing-client-list-node-initialization.patch | 34 ++ ...roce-handle-and-makes-it-conditional.patch | 59 +++ ...-the-valid-bd-info-in-the-descriptor.patch | 45 +++ ...ut-of-bounds-access-in-hclge_map_tqp.patch | 40 ++ ...mvpp2-add-missing-vlan-tag-detection.patch | 39 ++ .../net-phy-phylink-release-link-gpio.patch | 33 ++ ...e-neither-br-min-nor-br-max-is-given.patch | 42 ++ ...socionext-reset-hardware-in-ndo_stop.patch | 100 +++++ ...pset-forbid-family-for-hash-mac-sets.patch | 48 +++ ...tries-with-timeout-1-instead-of-zero.patch | 45 +++ ...-msg_type-before-nft_trans_set-trans.patch | 142 +++++++ ..._update_inode-to-force-ctime-updates.patch | 31 ++ ...rror-handling-in-nfs4_set_delegation.patch | 40 ++ ...r-free-in-nfsd4_decode_getdeviceinfo.patch | 108 +++++ ...behaviour-on-nfs4err_seq_false_retry.patch | 47 +++ .../nvme-lightnvm-add-granby-support.patch | 32 ++ .../nvme-pci-fix-aer-reset-handling.patch | 55 +++ ...a-stop-admin-queue-before-freeing-it.patch | 68 ++++ ...handle-returned-value-nvmem_reg_read.patch | 53 +++ ...m-l1.2-substate-if-we-don-t-have-ltr.patch | 45 +++ ...status-in-interrupt-handler-top-half.patch | 56 +++ ...vm_pci_alloc_host_bridge-memory-leak.patch | 39 ++ ...-of-native-hotplug-only-if-supported.patch | 41 ++ ...e-of-device-while-driver-is-attached.patch | 47 +++ ...-fix-invalid-bit-in-diagnostic-entry.patch | 39 ++ ...rf-tools-fix-pmu-events-parsing-rule.patch | 82 ++++ ...ct-fixed-counter-index-check-for-nhm.patch | 41 ++ ...-counter-index-check-in-generic-code.patch | 41 ++ ...rl-at91-pio4-add-missing-of_node_put.patch | 55 +++ ...msm-fix-gpio-hog-related-boot-issues.patch | 100 +++++ ...h-on-www.dell.com-in-oem-strings-too.patch | 43 ++ ...keup-make-s2idle_lock-a-raw_spinlock.patch | 76 ++++ ...il-we-ve-processed-layoutget-on-open.patch | 40 ++ ...erpc-32-add-a-missing-include-header.patch | 32 ++ .../powerpc-64s-add-barrier_nospec.patch | 53 +++ ...er-store-ordering-to-slb-shadow-area.patch | 47 +++ ...id-register-expression-in-head_8xx.s.patch | 36 ++ ...__printf-verification-to-prom_printf.patch | 369 ++++++++++++++++++ ...ns-static-add-missing-header-include.patch | 57 +++ ...-fix-use-after-release-of-eeh-driver.patch | 70 ++++ ...rrupts-from-being-handled-by-starlet.patch | 56 +++ ...gn-inside-string-functions-for-ppc32.patch | 87 +++++ ...ing-prototype-for-note_bootable_part.patch | 33 ++ ...c-powermac-mark-variable-x-as-unused.patch | 43 ++ ...heck-from-printk_safe_flush_on_panic.patch | 46 +++ ...x-invalid-sta-state-on-eapol-failure.patch | 92 +++++ ...-memory-leak-in-qtnf_fw_work_handler.patch | 36 ++ ...a-mad-convert-bug_ons-to-error-flows.patch | 47 +++ ...y-function-of_find_regulator_by_node.patch | 78 ++++ ...urn-or-expect-errno-from-of_map_mode.patch | 109 ++++++ ...nable-for-pfuze100_swb_regulator_ops.patch | 33 ++ ...-virtual-interfaces-in-wowlan-config.patch | 46 +++ .../rsi-fix-invalid-vdd-warning-in-mmc.patch | 76 ++++ ...x-nommu_map_sg-overflow-kernel-panic.patch | 209 ++++++++++ ...-fails-when-alarms-are-not-supported.patch | 39 ++ ...tps6586x-fix-possible-race-condition.patch | 77 ++++ ...tps65910-fix-possible-race-condition.patch | 51 +++ ...c-vr41xx-fix-possible-race-condition.patch | 72 ++++ ...connection-id-to-include-the-channel.patch | 44 +++ ...ntry-sizes-to-sampling-trailer-entry.patch | 41 ++ ...ays-include-blocked-fair-utilization.patch | 90 +++++ ...scsi-3w-9xxx-fix-a-missing-check-bug.patch | 48 +++ ...scsi-3w-xxxx-fix-a-missing-check-bug.patch | 47 +++ ...ering-context-control-register-value.patch | 63 +++ ...ash-synchronize-reset-and-remove-ops.patch | 54 +++ ...-as-an-constrained-command-for-v3-hw.patch | 61 +++ ...egaraid-silence-a-static-checker-bug.patch | 33 ++ ...t-by-1-sec-for-non-raid-fastpath-ios.patch | 39 ++ ...unloading-flag-when-removing-a-vport.patch | 70 ++++ ...oad-tp9-string-with-the-exact-models.patch | 46 +++ ...csi-ufs-fix-exception-event-handling.patch | 51 +++ ...x-possible-unclocked-register-access.patch | 70 ++++ ...held-when-tracing-a-recovery-trigger.patch | 75 ++++ ...ems-devpts_pts-included-wrong-header.patch | 44 +++ ...selftest-skip-code-for-skipped-tests.patch | 66 ++++ ...ntel_pstate-improve-test-minor-fixes.patch | 91 +++++ ...selftest-skip-code-for-skipped-tests.patch | 43 ++ ...selftest-skip-code-for-skipped-tests.patch | 75 ++++ ...selftest-skip-code-for-skipped-tests.patch | 74 ++++ ...ler-barfs-for-16-byte-earlycon-names.patch | 50 +++ queue-4.17/series | 285 ++++++++++++++ ...ip-layoutreturn-if-layout-is-invalid.patch | 56 +++ ...-pass-static-memory-as-platform-data.patch | 78 ++++ ...soc-qcom-qmi-fix-a-buffer-sizing-bug.patch | 58 +++ ...-qcom-smem-byte-swap-values-properly.patch | 68 ++++ ...m-fix-qcom_smem_set_global_partition.patch | 59 +++ ...cate-struct-tegra_powergate-on-stack.patch | 63 +++ ..._runtime_put_noidle-after-failed-get.patch | 31 ++ ...-error-handling-in-meson_spicc_probe.patch | 44 +++ ...rmdr1.syncac-to-match-sitmdr1.syncac.patch | 49 +++ ...r-handling-in-ks7010_upload_firmware.patch | 39 ++ ...resource-when-ldlm_lock_create-fails.patch | 44 +++ ...-llite-correct-removexattr-detection.patch | 40 ++ ...iblnd-fix-fastreg-map-unmap-for-mlx5.patch | 80 ++++ ...blnd-fix-race-at-kiblnd_connect_peer.patch | 63 +++ ...ing-most-cdev-fix-chrdev_region-leak.patch | 50 +++ ...sing-semaphore-release-in-error-case.patch | 32 ++ .../stop_machine-use-raw-spinlocks.patch | 109 ++++++ ...ting-rising_threshold-for-exynos5433.patch | 30 ++ ...device-only-if-it-s-cpu-local-device.patch | 40 ++ ...in-tty_insert_flip_string_fixed_flag.patch | 96 +++++ ...tate-at-resume-for-powered-off-ports.patch | 39 ++ ...locate-idev-by-nports-found-in-sysfs.patch | 120 ++++++ ...ix-memory-udev-context-and-udev-leak.patch | 48 +++ ...check-globally-for-duplicate-devices.patch | 284 ++++++++++++++ ...-fix-reset-module-leak-in-error-path.patch | 54 +++ ...-task-tracking-for-qemu-vcpu-hotplug.patch | 241 ++++++++++++ ...og-da9063-fix-updating-timeout-value.patch | 58 +++ ...wdt-add-support-for-the-r8a77965-wdt.patch | 35 ++ ...-platform-device-data-before-suspend.patch | 39 ++ ...update-update_lock-a-raw-lock-for-rt.patch | 50 +++ ...ber-of-slots-in-xennet_get_responses.patch | 55 +++ ...-ktime_get_real_seconds-consistently.patch | 76 ++++ 286 files changed, 18735 insertions(+) create mode 100644 queue-4.17/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch create mode 100644 queue-4.17/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch create mode 100644 queue-4.17/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch create mode 100644 queue-4.17/alsa-fm801-add-error-handling-for-snd_ctl_add.patch create mode 100644 queue-4.17/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch create mode 100644 queue-4.17/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch create mode 100644 queue-4.17/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch create mode 100644 queue-4.17/arm-dts-imx53-fix-ldb-of-graph-warning.patch create mode 100644 queue-4.17/arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch create mode 100644 queue-4.17/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch create mode 100644 queue-4.17/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch create mode 100644 queue-4.17/arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch create mode 100644 queue-4.17/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch create mode 100644 queue-4.17/arm64-defconfig-enable-rockchip-io-domain-driver.patch create mode 100644 queue-4.17/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch create mode 100644 queue-4.17/asoc-compress-only-call-free-for-components-which-have-been-opened.patch create mode 100644 queue-4.17/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch create mode 100644 queue-4.17/asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch create mode 100644 queue-4.17/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch create mode 100644 queue-4.17/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-apl13_world.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-apl2_fcca.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-bahamas.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-bermuda.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-etsi8_world.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-fcc3_etsic.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-serbia.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-tanzania.patch create mode 100644 queue-4.17/ath-add-regulatory-mapping-for-uganda.patch create mode 100644 queue-4.17/ath10k-fix-kernel-panic-while-reading-tpc_stats.patch create mode 100644 queue-4.17/ath10k-search-all-ies-for-variant-before-falling-back.patch create mode 100644 queue-4.17/audit-allow-not-equal-op-for-audit-by-executable.patch create mode 100644 queue-4.17/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch create mode 100644 queue-4.17/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch create mode 100644 queue-4.17/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch create mode 100644 queue-4.17/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch create mode 100644 queue-4.17/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch create mode 100644 queue-4.17/bnxt_en-always-forward-vf-mac-address-to-the-pf.patch create mode 100644 queue-4.17/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch create mode 100644 queue-4.17/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch create mode 100644 queue-4.17/bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch create mode 100644 queue-4.17/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch create mode 100644 queue-4.17/bpf-powerpc64-pad-function-address-loads-with-nops.patch create mode 100644 queue-4.17/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch create mode 100644 queue-4.17/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch create mode 100644 queue-4.17/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch create mode 100644 queue-4.17/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch create mode 100644 queue-4.17/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch create mode 100644 queue-4.17/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch create mode 100644 queue-4.17/ceph-fix-alignment-of-rasize.patch create mode 100644 queue-4.17/ceph-fix-use-after-free-in-ceph_statfs.patch create mode 100644 queue-4.17/clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch create mode 100644 queue-4.17/clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch create mode 100644 queue-4.17/clk-si544-properly-round-requested-frequency-to-nearest-match.patch create mode 100644 queue-4.17/clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch create mode 100644 queue-4.17/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch create mode 100644 queue-4.17/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch create mode 100644 queue-4.17/delayacct-use-raw_spinlocks.patch create mode 100644 queue-4.17/disable-loading-f2fs-module-on-page_size-4kb.patch create mode 100644 queue-4.17/dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch create mode 100644 queue-4.17/dma-iommu-fix-compilation-when-config_iommu_dma.patch create mode 100644 queue-4.17/drivers-bus-arm-cci-fix-build-warnings.patch create mode 100644 queue-4.17/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch create mode 100644 queue-4.17/drm-add-dp-psr2-sink-enable-bit.patch create mode 100644 queue-4.17/drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch create mode 100644 queue-4.17/drm-amd-display-fix-dim-display-on-dce11.patch create mode 100644 queue-4.17/drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch create mode 100644 queue-4.17/drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch create mode 100644 queue-4.17/drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch create mode 100644 queue-4.17/drm-amdgpu-remove-vram-from-shared-bo-domains.patch create mode 100644 queue-4.17/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch create mode 100644 queue-4.17/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch create mode 100644 queue-4.17/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch create mode 100644 queue-4.17/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch create mode 100644 queue-4.17/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch create mode 100644 queue-4.17/drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch create mode 100644 queue-4.17/drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch create mode 100644 queue-4.17/drm-radeon-fix-mode_valid-s-return-type.patch create mode 100644 queue-4.17/drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch create mode 100644 queue-4.17/drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch create mode 100644 queue-4.17/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch create mode 100644 queue-4.17/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch create mode 100644 queue-4.17/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch create mode 100644 queue-4.17/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch create mode 100644 queue-4.17/edac-altera-fix-arm64-build-warning.patch create mode 100644 queue-4.17/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch create mode 100644 queue-4.17/f2fs-check-cap_resource-only-for-data-blocks.patch create mode 100644 queue-4.17/f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch create mode 100644 queue-4.17/f2fs-fix-deadlock-in-shutdown-ioctl.patch create mode 100644 queue-4.17/f2fs-fix-error-path-of-move_data_page.patch create mode 100644 queue-4.17/f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch create mode 100644 queue-4.17/f2fs-fix-race-in-between-gc-and-atomic-open.patch create mode 100644 queue-4.17/f2fs-fix-to-detect-failure-of-dquot_initialize.patch create mode 100644 queue-4.17/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch create mode 100644 queue-4.17/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch create mode 100644 queue-4.17/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch create mode 100644 queue-4.17/fscrypt-use-unbound-workqueue-for-decryption.patch create mode 100644 queue-4.17/gpu-host1x-acquire-a-reference-to-the-iova-cache.patch create mode 100644 queue-4.17/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch create mode 100644 queue-4.17/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch create mode 100644 queue-4.17/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch create mode 100644 queue-4.17/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch create mode 100644 queue-4.17/i40e-add-advertising-10g-lr-mode.patch create mode 100644 queue-4.17/i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch create mode 100644 queue-4.17/i40e-free-the-skb-after-clearing-the-bitlock.patch create mode 100644 queue-4.17/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch create mode 100644 queue-4.17/igb-fix-queue-selection-on-mac-filters-on-i210.patch create mode 100644 queue-4.17/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch create mode 100644 queue-4.17/infiniband-fix-a-possible-use-after-free-bug.patch create mode 100644 queue-4.17/ipconfig-correctly-initialise-ic_nameservers.patch create mode 100644 queue-4.17/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch create mode 100644 queue-4.17/iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch create mode 100644 queue-4.17/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch create mode 100644 queue-4.17/ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch create mode 100644 queue-4.17/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch create mode 100644 queue-4.17/kcov-ensure-irq-code-sees-a-valid-area.patch create mode 100644 queue-4.17/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch create mode 100644 queue-4.17/kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch create mode 100644 queue-4.17/lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch create mode 100644 queue-4.17/libata-fix-command-retry-decision.patch create mode 100644 queue-4.17/lightnvm-fix-partial-read-error-path.patch create mode 100644 queue-4.17/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch create mode 100644 queue-4.17/lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch create mode 100644 queue-4.17/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch create mode 100644 queue-4.17/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch create mode 100644 queue-4.17/media-arch-sh-migor-fix-tw9910-pdn-gpio.patch create mode 100644 queue-4.17/media-atomisp-compat32-fix-__user-annotations.patch create mode 100644 queue-4.17/media-atomisp-ov2680-don-t-declare-unused-vars.patch create mode 100644 queue-4.17/media-cec-fix-smatch-error.patch create mode 100644 queue-4.17/media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch create mode 100644 queue-4.17/media-em28xx-fix-a-regression-with-hvr-950.patch create mode 100644 queue-4.17/media-em28xx-fix-dualhd-broken-second-tuner.patch create mode 100644 queue-4.17/media-media-device-fix-ioctl-function-types.patch create mode 100644 queue-4.17/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch create mode 100644 queue-4.17/media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch create mode 100644 queue-4.17/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch create mode 100644 queue-4.17/media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch create mode 100644 queue-4.17/media-saa7164-fix-driver-name-in-debug-output.patch create mode 100644 queue-4.17/media-si470x-fix-__be16-annotations.patch create mode 100644 queue-4.17/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch create mode 100644 queue-4.17/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch create mode 100644 queue-4.17/media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch create mode 100644 queue-4.17/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch create mode 100644 queue-4.17/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch create mode 100644 queue-4.17/mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch create mode 100644 queue-4.17/memory-tegra-apply-interrupts-mask-per-soc.patch create mode 100644 queue-4.17/memory-tegra-do-not-handle-spurious-interrupts.patch create mode 100644 queue-4.17/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch create mode 100644 queue-4.17/microblaze-fix-simpleimage-format-generation.patch create mode 100644 queue-4.17/mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch create mode 100644 queue-4.17/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch create mode 100644 queue-4.17/mm-check-for-sigkill-inside-dup_mmap-loop.patch create mode 100644 queue-4.17/mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch create mode 100644 queue-4.17/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch create mode 100644 queue-4.17/mm-slub.c-add-__printf-verification-to-slab_err.patch create mode 100644 queue-4.17/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch create mode 100644 queue-4.17/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch create mode 100644 queue-4.17/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch create mode 100644 queue-4.17/mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch create mode 100644 queue-4.17/mt76-add-rcu-locking-around-tx-scheduling.patch create mode 100644 queue-4.17/mt76x2-apply-coverage-class-on-slot-time-too.patch create mode 100644 queue-4.17/mt76x2-fix-avg_rssi-estimation.patch create mode 100644 queue-4.17/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch create mode 100644 queue-4.17/mwifiex-correct-histogram-data-with-appropriate-index.patch create mode 100644 queue-4.17/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch create mode 100644 queue-4.17/net-dsa-qca8k-add-support-for-qca8334-switch.patch create mode 100644 queue-4.17/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch create mode 100644 queue-4.17/net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch create mode 100644 queue-4.17/net-hns3-fix-for-fiber-link-up-problem.patch create mode 100644 queue-4.17/net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch create mode 100644 queue-4.17/net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch create mode 100644 queue-4.17/net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch create mode 100644 queue-4.17/net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch create mode 100644 queue-4.17/net-hns3-fix-the-missing-client-list-node-initialization.patch create mode 100644 queue-4.17/net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch create mode 100644 queue-4.17/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch create mode 100644 queue-4.17/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch create mode 100644 queue-4.17/net-mvpp2-add-missing-vlan-tag-detection.patch create mode 100644 queue-4.17/net-phy-phylink-release-link-gpio.patch create mode 100644 queue-4.17/net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch create mode 100644 queue-4.17/net-socionext-reset-hardware-in-ndo_stop.patch create mode 100644 queue-4.17/netfilter-ipset-forbid-family-for-hash-mac-sets.patch create mode 100644 queue-4.17/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch create mode 100644 queue-4.17/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch create mode 100644 queue-4.17/nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch create mode 100644 queue-4.17/nfsd-fix-error-handling-in-nfs4_set_delegation.patch create mode 100644 queue-4.17/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch create mode 100644 queue-4.17/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch create mode 100644 queue-4.17/nvme-lightnvm-add-granby-support.patch create mode 100644 queue-4.17/nvme-pci-fix-aer-reset-handling.patch create mode 100644 queue-4.17/nvme-rdma-stop-admin-queue-before-freeing-it.patch create mode 100644 queue-4.17/nvmem-properly-handle-returned-value-nvmem_reg_read.patch create mode 100644 queue-4.17/pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch create mode 100644 queue-4.17/pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch create mode 100644 queue-4.17/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch create mode 100644 queue-4.17/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch create mode 100644 queue-4.17/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch create mode 100644 queue-4.17/perf-fix-invalid-bit-in-diagnostic-entry.patch create mode 100644 queue-4.17/perf-tools-fix-pmu-events-parsing-rule.patch create mode 100644 queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch create mode 100644 queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch create mode 100644 queue-4.17/pinctrl-at91-pio4-add-missing-of_node_put.patch create mode 100644 queue-4.17/pinctrl-msm-fix-gpio-hog-related-boot-issues.patch create mode 100644 queue-4.17/platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch create mode 100644 queue-4.17/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch create mode 100644 queue-4.17/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch create mode 100644 queue-4.17/powerpc-32-add-a-missing-include-header.patch create mode 100644 queue-4.17/powerpc-64s-add-barrier_nospec.patch create mode 100644 queue-4.17/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch create mode 100644 queue-4.17/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch create mode 100644 queue-4.17/powerpc-add-__printf-verification-to-prom_printf.patch create mode 100644 queue-4.17/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch create mode 100644 queue-4.17/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch create mode 100644 queue-4.17/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch create mode 100644 queue-4.17/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch create mode 100644 queue-4.17/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch create mode 100644 queue-4.17/powerpc-powermac-mark-variable-x-as-unused.patch create mode 100644 queue-4.17/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch create mode 100644 queue-4.17/qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch create mode 100644 queue-4.17/qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch create mode 100644 queue-4.17/rdma-mad-convert-bug_ons-to-error-flows.patch create mode 100644 queue-4.17/regulator-add-dummy-function-of_find_regulator_by_node.patch create mode 100644 queue-4.17/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch create mode 100644 queue-4.17/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch create mode 100644 queue-4.17/rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch create mode 100644 queue-4.17/rsi-fix-invalid-vdd-warning-in-mmc.patch create mode 100644 queue-4.17/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch create mode 100644 queue-4.17/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch create mode 100644 queue-4.17/rtc-tps6586x-fix-possible-race-condition.patch create mode 100644 queue-4.17/rtc-tps65910-fix-possible-race-condition.patch create mode 100644 queue-4.17/rtc-vr41xx-fix-possible-race-condition.patch create mode 100644 queue-4.17/rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch create mode 100644 queue-4.17/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch create mode 100644 queue-4.17/sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch create mode 100644 queue-4.17/scsi-3w-9xxx-fix-a-missing-check-bug.patch create mode 100644 queue-4.17/scsi-3w-xxxx-fix-a-missing-check-bug.patch create mode 100644 queue-4.17/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch create mode 100644 queue-4.17/scsi-cxlflash-synchronize-reset-and-remove-ops.patch create mode 100644 queue-4.17/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch create mode 100644 queue-4.17/scsi-megaraid-silence-a-static-checker-bug.patch create mode 100644 queue-4.17/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch create mode 100644 queue-4.17/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch create mode 100644 queue-4.17/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch create mode 100644 queue-4.17/scsi-ufs-fix-exception-event-handling.patch create mode 100644 queue-4.17/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch create mode 100644 queue-4.17/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch create mode 100644 queue-4.17/selftests-filesystems-devpts_pts-included-wrong-header.patch create mode 100644 queue-4.17/selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-intel_pstate-improve-test-minor-fixes.patch create mode 100644 queue-4.17/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch create mode 100644 queue-4.17/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch create mode 100644 queue-4.17/skip-layoutreturn-if-layout-is-invalid.patch create mode 100644 queue-4.17/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch create mode 100644 queue-4.17/soc-qcom-qmi-fix-a-buffer-sizing-bug.patch create mode 100644 queue-4.17/soc-qcom-smem-byte-swap-values-properly.patch create mode 100644 queue-4.17/soc-qcom-smem-fix-qcom_smem_set_global_partition.patch create mode 100644 queue-4.17/soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch create mode 100644 queue-4.17/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch create mode 100644 queue-4.17/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch create mode 100644 queue-4.17/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch create mode 100644 queue-4.17/staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch create mode 100644 queue-4.17/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch create mode 100644 queue-4.17/staging-lustre-llite-correct-removexattr-detection.patch create mode 100644 queue-4.17/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch create mode 100644 queue-4.17/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch create mode 100644 queue-4.17/staging-most-cdev-fix-chrdev_region-leak.patch create mode 100644 queue-4.17/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch create mode 100644 queue-4.17/stop_machine-use-raw-spinlocks.patch create mode 100644 queue-4.17/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch create mode 100644 queue-4.17/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch create mode 100644 queue-4.17/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch create mode 100644 queue-4.17/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch create mode 100644 queue-4.17/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch create mode 100644 queue-4.17/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch create mode 100644 queue-4.17/vfio-mdev-check-globally-for-duplicate-devices.patch create mode 100644 queue-4.17/vfio-platform-fix-reset-module-leak-in-error-path.patch create mode 100644 queue-4.17/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch create mode 100644 queue-4.17/watchdog-da9063-fix-updating-timeout-value.patch create mode 100644 queue-4.17/watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch create mode 100644 queue-4.17/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch create mode 100644 queue-4.17/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch create mode 100644 queue-4.17/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch create mode 100644 queue-4.17/y2038-ipc-use-ktime_get_real_seconds-consistently.patch diff --git a/queue-4.17/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch b/queue-4.17/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch new file mode 100644 index 00000000000..49f7cfbc058 --- /dev/null +++ b/queue-4.17/acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Hans de Goede +Date: Fri, 13 Apr 2018 14:54:17 +0200 +Subject: ACPI / LPSS: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 + +From: Hans de Goede + +[ Upstream commit c975e472ec12392a0c34de1350e634310f8a1dea ] + +The Point of View mobii wintab p800w Bay Trail tablet comes with a Crystal +Cove PMIC, yet uses the LPSS PWM for backlight control, rather then the +Crystal Cove's PWM, so we need to call pwm_add_table() to add a +pwm_backlight mapping for the LPSS pwm despite there being an INT33FD +ACPI device present. + +On all Bay Trail devices the _HRV object of the INT33FD ACPI device +will normally return 2, to indicate the Bay Trail variant of the CRC +PMIC is present, except on this tablet where _HRV is 0xffff. I guess this +is a hack to make the windows Crystal Cove PWM driver not bind. + +Out of the 44 DSTDs with an INT33FD device in there which I have (from +different model devices) only the pov mobii wintab p800w uses 0xffff for +the HRV. + +The byt_pwm_setup code calls acpi_dev_present to check for the presence +of a INT33FD ACPI device which indicates that a CRC PMIC is present and +if the INT33FD ACPI device is present then byt_pwm_setup will not add +a pwm_backlight mapping for the LPSS pwm, so that the CRC PWM will get +used instead. + +acpi_dev_present has a hrv parameter, this commit make us pass 2 instead +of -1, so that things still match on normal tablets, but on this special +case with its _HRV of 0xffff, the check will now fail so that the +pwm_backlight mapping for the LPSS pwm gets added fixing backlight +brightness control on this device. + +Signed-off-by: Hans de Goede +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_lpss.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -70,6 +70,10 @@ ACPI_MODULE_NAME("acpi_lpss"); + #define LPSS_SAVE_CTX BIT(4) + #define LPSS_NO_D3_DELAY BIT(5) + ++/* Crystal Cove PMIC shares same ACPI ID between different platforms */ ++#define BYT_CRC_HRV 2 ++#define CHT_CRC_HRV 3 ++ + struct lpss_private_data; + + struct lpss_device_desc { +@@ -163,7 +167,7 @@ static void byt_pwm_setup(struct lpss_pr + if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1")) + return; + +- if (!acpi_dev_present("INT33FD", NULL, -1)) ++ if (!acpi_dev_present("INT33FD", NULL, BYT_CRC_HRV)) + pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup)); + } + diff --git a/queue-4.17/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch b/queue-4.17/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch new file mode 100644 index 00000000000..429949ad396 --- /dev/null +++ b/queue-4.17/alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Zhouyang Jia +Date: Mon, 11 Jun 2018 16:18:40 +0800 +Subject: ALSA: emu10k1: add error handling for snd_ctl_add + +From: Zhouyang Jia + +[ Upstream commit 6d531e7b972cb62ded011c2dfcc2d9f72ea6c421 ] + +When snd_ctl_add fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling snd_ctl_add. + +Signed-off-by: Zhouyang Jia +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/emu10k1/emupcm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -1858,7 +1858,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10 + if (!kctl) + return -ENOMEM; + kctl->id.device = device; +- snd_ctl_add(emu->card, kctl); ++ err = snd_ctl_add(emu->card, kctl); ++ if (err < 0) ++ return err; + + snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024); + diff --git a/queue-4.17/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch b/queue-4.17/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch new file mode 100644 index 00000000000..20a297499a4 --- /dev/null +++ b/queue-4.17/alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Takashi Iwai +Date: Thu, 17 May 2018 20:02:23 +0200 +Subject: ALSA: emu10k1: Rate-limit error messages about page errors + +From: Takashi Iwai + +[ Upstream commit 11d42c81036324697d367600bfc16f6dd37636fd ] + +The error messages at sanity checks of memory pages tend to repeat too +many times once when it hits, and without the rate limit, it may flood +and become unreadable. Replace such messages with the *_ratelimited() +variant. + +Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1093027 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/emu10k1/memory.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -248,13 +248,13 @@ __found_pages: + static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr) + { + if (addr & ~emu->dma_mask) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "max memory size is 0x%lx (addr = 0x%lx)!!\n", + emu->dma_mask, (unsigned long)addr); + return 0; + } + if (addr & (EMUPAGESIZE-1)) { +- dev_err(emu->card->dev, "page is not aligned\n"); ++ dev_err_ratelimited(emu->card->dev, "page is not aligned\n"); + return 0; + } + return 1; +@@ -345,7 +345,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10 + else + addr = snd_pcm_sgbuf_get_addr(substream, ofs); + if (! is_valid_page(emu, addr)) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "emu: failure page = %d\n", idx); + mutex_unlock(&hdr->block_mutex); + return NULL; diff --git a/queue-4.17/alsa-fm801-add-error-handling-for-snd_ctl_add.patch b/queue-4.17/alsa-fm801-add-error-handling-for-snd_ctl_add.patch new file mode 100644 index 00000000000..61de2556664 --- /dev/null +++ b/queue-4.17/alsa-fm801-add-error-handling-for-snd_ctl_add.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Zhouyang Jia +Date: Mon, 11 Jun 2018 16:04:06 +0800 +Subject: ALSA: fm801: add error handling for snd_ctl_add + +From: Zhouyang Jia + +[ Upstream commit ef1ffbe7889e99f5b5cccb41c89e5c94f50f3218 ] + +When snd_ctl_add fails, the lack of error-handling code may +cause unexpected results. + +This patch adds error-handling code after calling snd_ctl_add. + +Signed-off-by: Zhouyang Jia +Acked-by: Andy Shevchenko +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/fm801.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +--- a/sound/pci/fm801.c ++++ b/sound/pci/fm801.c +@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801 + if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0) + return err; + } +- for (i = 0; i < FM801_CONTROLS; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ for (i = 0; i < FM801_CONTROLS; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ if (err < 0) ++ return err; ++ } + if (chip->multichannel) { +- for (i = 0; i < FM801_CONTROLS_MULTI; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ for (i = 0; i < FM801_CONTROLS_MULTI; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ if (err < 0) ++ return err; ++ } + } + return 0; + } diff --git a/queue-4.17/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch b/queue-4.17/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch new file mode 100644 index 00000000000..05a4858e306 --- /dev/null +++ b/queue-4.17/alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Takashi Sakamoto +Date: Wed, 2 May 2018 22:48:16 +0900 +Subject: ALSA: hda/ca0132: fix build failure when a local macro is defined + +From: Takashi Sakamoto + +[ Upstream commit 8e142e9e628975b0dddd05cf1b095331dff6e2de ] + +DECLARE_TLV_DB_SCALE (alias of SNDRV_CTL_TLVD_DECLARE_DB_SCALE) is used but +tlv.h is not included. This causes build failure when local macro is +defined by comment-out. + +This commit fixes the bug. At the same time, the alias macro is replaced +with a destination macro added at a commit 46e860f76804 ("ALSA: rename +TLV-related macros so that they're friendly to user applications") + +Reported-by: Connor McAdams +Fixes: 44f0c9782cc6 ('ALSA: hda/ca0132: Add tuning controls') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_ca0132.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -39,6 +39,10 @@ + /* Enable this to see controls for tuning purpose. */ + /*#define ENABLE_TUNING_CONTROLS*/ + ++#ifdef ENABLE_TUNING_CONTROLS ++#include ++#endif ++ + #define FLOAT_ZERO 0x00000000 + #define FLOAT_ONE 0x3f800000 + #define FLOAT_TWO 0x40000000 +@@ -3068,8 +3072,8 @@ static int equalizer_ctl_put(struct snd_ + return 1; + } + +-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); +-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0); + + static int add_tuning_control(struct hda_codec *codec, + hda_nid_t pnid, hda_nid_t nid, diff --git a/queue-4.17/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch b/queue-4.17/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch new file mode 100644 index 00000000000..4ca57c16c9f --- /dev/null +++ b/queue-4.17/alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Takashi Iwai +Date: Wed, 16 May 2018 20:07:18 +0200 +Subject: ALSA: usb-audio: Apply rate limit to warning messages in URB complete callback + +From: Takashi Iwai + +[ Upstream commit 377a879d9832f4ba69bd6a1fc996bb4181b1e504 ] + +retire_capture_urb() may print warning messages when the given URB +doesn't align, and this may flood the system log easily. +Put the rate limit to the message for avoiding it. + +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1093485 +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/pcm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct sn + if (bytes % (runtime->sample_bits >> 3) != 0) { + int oldbytes = bytes; + bytes = frames * stride; +- dev_warn(&subs->dev->dev, ++ dev_warn_ratelimited(&subs->dev->dev, + "Corrected urb data len. %d->%d\n", + oldbytes, bytes); + } diff --git a/queue-4.17/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch b/queue-4.17/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch new file mode 100644 index 00000000000..d2f015716cc --- /dev/null +++ b/queue-4.17/arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Geert Uytterhoeven +Date: Mon, 7 May 2018 15:40:05 +0200 +Subject: ARM: dts: emev2: Add missing interrupt-affinity to PMU node + +From: Geert Uytterhoeven + +[ Upstream commit 7207b94754b6f503b278b5b200faaf662ffa1da8 ] + +The PMU node references two interrupts, but lacks the interrupt-affinity +property, which is required in that case: + + hw perfevents: no interrupt-affinity property for /pmu, guessing. + +Add the missing property to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/emev2.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/emev2.dtsi ++++ b/arch/arm/boot/dts/emev2.dtsi +@@ -31,13 +31,13 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; + clock-frequency = <533000000>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -57,6 +57,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + clocks@e0110000 { diff --git a/queue-4.17/arm-dts-imx53-fix-ldb-of-graph-warning.patch b/queue-4.17/arm-dts-imx53-fix-ldb-of-graph-warning.patch new file mode 100644 index 00000000000..993668e431c --- /dev/null +++ b/queue-4.17/arm-dts-imx53-fix-ldb-of-graph-warning.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Rob Herring +Date: Tue, 8 May 2018 08:59:27 -0500 +Subject: ARM: dts: imx53: Fix LDB OF graph warning + +From: Rob Herring + +[ Upstream commit 77dd4bd0c0db8e4856e7abc2192f126e226e14c5 ] + +Single child nodes in OF graph don't need an address and now dtc will +warn about this: + +Warning (graph_child_address): /soc/aips@50000000/ldb@53fa8008/lvds-channel@0: graph node has single child node 'port@0', #address-cells/#size-cells are not necessary + +Since the LDB should always have an output port, fix the warning by +adding the output port, 2, to the DT. + +Cc: Sascha Hauer +Cc: Pengutronix Kernel Team +Cc: Fabio Estevam +Signed-off-by: Rob Herring +Reviewed-by: Philipp Zabel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx53-ppd.dts | 2 -- + arch/arm/boot/dts/imx53.dtsi | 8 ++++++++ + 2 files changed, 8 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/imx53-ppd.dts ++++ b/arch/arm/boot/dts/imx53-ppd.dts +@@ -559,8 +559,6 @@ + status = "okay"; + + port@2 { +- reg = <2>; +- + lvds0_out: endpoint { + remote-endpoint = <&panel_in_lvds0>; + }; +--- a/arch/arm/boot/dts/imx53.dtsi ++++ b/arch/arm/boot/dts/imx53.dtsi +@@ -488,6 +488,10 @@ + remote-endpoint = <&ipu_di0_lvds0>; + }; + }; ++ ++ port@2 { ++ reg = <2>; ++ }; + }; + + lvds-channel@1 { +@@ -503,6 +507,10 @@ + remote-endpoint = <&ipu_di1_lvds1>; + }; + }; ++ ++ port@2 { ++ reg = <2>; ++ }; + }; + }; + diff --git a/queue-4.17/arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch b/queue-4.17/arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch new file mode 100644 index 00000000000..2a3371b682f --- /dev/null +++ b/queue-4.17/arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch @@ -0,0 +1,87 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Fabio Estevam +Date: Wed, 14 Mar 2018 17:36:26 -0300 +Subject: ARM: dts: imx6qdl-wandboard: Let the codec control MCLK pinctrl + +From: Fabio Estevam + +[ Upstream commit 6e1386b2ee6822b00ae944a3de2c3304d2d422e6 ] + +sgtl5000 codec needs MCLK clock to be present so that it can +successfully read/write via I2C. + +In the case of wandboard, MCLK is provided via +MX6QDL_PAD_GPIO_0__CCM_CLKO1 pad. + +Move the MCLK pinctrl from hog group to the codec group, so that the +codec clock can be present prior to reading the codec ID. + +This avoids the following error that happens from time to time: + +[ 2.484443] sgtl5000 1-000a: Error reading chip id -6 + +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi | 1 - + arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi | 1 - + arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi | 1 - + arch/arm/boot/dts/imx6qdl-wandboard.dtsi | 8 ++++++++ + 4 files changed, 8 insertions(+), 3 deletions(-) + +--- a/arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revb1.dtsi +@@ -17,7 +17,6 @@ + imx6qdl-wandboard { + pinctrl_hog: hoggrp { + fsl,pins = < +- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 /* GPIO_0_CLKO */ + MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* uSDHC1 CD */ + MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */ + MX6QDL_PAD_EIM_EB1__GPIO2_IO29 0x0f0b0 /* WL_REF_ON */ +--- a/arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revc1.dtsi +@@ -17,7 +17,6 @@ + imx6qdl-wandboard { + pinctrl_hog: hoggrp { + fsl,pins = < +- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 /* GPIO_0_CLKO */ + MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* uSDHC1 CD */ + MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */ + MX6QDL_PAD_CSI0_DAT14__GPIO6_IO00 0x0f0b0 /* WIFI_ON (reset, active low) */ +--- a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi +@@ -147,7 +147,6 @@ + imx6qdl-wandboard { + pinctrl_hog: hoggrp { + fsl,pins = < +- MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 + MX6QDL_PAD_EIM_D22__USB_OTG_PWR 0x80000000 /* USB Power Enable */ + MX6QDL_PAD_GPIO_2__GPIO1_IO02 0x80000000 /* USDHC1 CD */ + MX6QDL_PAD_EIM_DA9__GPIO3_IO09 0x80000000 /* uSDHC3 CD */ +--- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi +@@ -83,6 +83,8 @@ + status = "okay"; + + codec: sgtl5000@a { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_mclk>; + compatible = "fsl,sgtl5000"; + reg = <0x0a>; + clocks = <&clks IMX6QDL_CLK_CKO>; +@@ -142,6 +144,12 @@ + >; + }; + ++ pinctrl_mclk: mclkgrp { ++ fsl,pins = < ++ MX6QDL_PAD_GPIO_0__CCM_CLKO1 0x130b0 ++ >; ++ }; ++ + pinctrl_spdif: spdifgrp { + fsl,pins = < + MX6QDL_PAD_ENET_RXD0__SPDIF_OUT 0x1b0b0 diff --git a/queue-4.17/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch b/queue-4.17/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch new file mode 100644 index 00000000000..22562cd77d1 --- /dev/null +++ b/queue-4.17/arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Geert Uytterhoeven +Date: Mon, 7 May 2018 15:40:04 +0200 +Subject: ARM: dts: sh73a0: Add missing interrupt-affinity to PMU node + +From: Geert Uytterhoeven + +[ Upstream commit 57a66497e1b7486609250a482f05935eae5035e9 ] + +The PMU node references two interrupts, but lacks the interrupt-affinity +property, which is required in that case: + + hw perfevents: no interrupt-affinity property for /pmu, guessing. + +Add the missing property to fix this. + +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/sh73a0.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/sh73a0.dtsi ++++ b/arch/arm/boot/dts/sh73a0.dtsi +@@ -22,7 +22,7 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; +@@ -31,7 +31,7 @@ + power-domains = <&pd_a2sl>; + next-level-cache = <&L2>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -91,6 +91,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + cmt1: timer@e6138000 { diff --git a/queue-4.17/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch b/queue-4.17/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch new file mode 100644 index 00000000000..a7d2577a3ae --- /dev/null +++ b/queue-4.17/arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch @@ -0,0 +1,69 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Patrice Chotard +Date: Fri, 20 Apr 2018 17:41:31 +0200 +Subject: ARM: dts: stih407-pinctrl: Fix complain about IRQ_TYPE_NONE usage + +From: Patrice Chotard + +[ Upstream commit e95b8e718f9bd2386a29639dd21c633b4951dc21 ] + +Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE") +kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't +be used. + +Use IRQ_TYPE_LEVEL_HIGH instead. + +Signed-off-by: Patrice Chotard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/stih407-pinctrl.dtsi | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/boot/dts/stih407-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stih407-pinctrl.dtsi +@@ -52,7 +52,7 @@ + st,syscfg = <&syscfg_sbc>; + reg = <0x0961f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09610000 0x6000>; + +@@ -376,7 +376,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0920f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09200000 0x10000>; + +@@ -936,7 +936,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0921f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09210000 0x10000>; + +@@ -969,7 +969,7 @@ + st,syscfg = <&syscfg_rear>; + reg = <0x0922f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09220000 0x6000>; + +@@ -1164,7 +1164,7 @@ + st,syscfg = <&syscfg_flash>; + reg = <0x0923f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09230000 0x3000>; + diff --git a/queue-4.17/arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch b/queue-4.17/arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch new file mode 100644 index 00000000000..a9553a11df0 --- /dev/null +++ b/queue-4.17/arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch @@ -0,0 +1,98 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Patrice Chotard +Date: Fri, 20 Apr 2018 17:41:54 +0200 +Subject: ARM: dts: stih410: Fix complain about IRQ_TYPE_NONE usage + +From: Patrice Chotard + +[ Upstream commit fd827d0ec86bce8d421423ad2c4add84aa23e1b9 ] + +Since commit 83a86fbb5b56 ("irqchip/gic: Loudly complain about the use of IRQ_TYPE_NONE") +kernel is complaining about the IRQ_TYPE_NONE usage which shouldn't +be used. + +Use IRQ_TYPE_LEVEL_HIGH instead. + +Signed-off-by: Patrice Chotard +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/stih410.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/arch/arm/boot/dts/stih410.dtsi ++++ b/arch/arm/boot/dts/stih410.dtsi +@@ -43,7 +43,7 @@ + ohci0: usb@9a03c00 { + compatible = "st,st-ohci-300x"; + reg = <0x9a03c00 0x100>; +- interrupts = ; ++ interrupts = ; + clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>, + <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>; + resets = <&powerdown STIH407_USB2_PORT0_POWERDOWN>, +@@ -58,7 +58,7 @@ + ehci0: usb@9a03e00 { + compatible = "st,st-ehci-300x"; + reg = <0x9a03e00 0x100>; +- interrupts = ; ++ interrupts = ; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb0>; + clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>, +@@ -75,7 +75,7 @@ + ohci1: usb@9a83c00 { + compatible = "st,st-ohci-300x"; + reg = <0x9a83c00 0x100>; +- interrupts = ; ++ interrupts = ; + clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>, + <&clk_s_c0_flexgen CLK_RX_ICN_DISP_0>; + resets = <&powerdown STIH407_USB2_PORT1_POWERDOWN>, +@@ -90,7 +90,7 @@ + ehci1: usb@9a83e00 { + compatible = "st,st-ehci-300x"; + reg = <0x9a83e00 0x100>; +- interrupts = ; ++ interrupts = ; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_usb1>; + clocks = <&clk_s_c0_flexgen CLK_TX_ICN_DISP_0>, +@@ -202,7 +202,7 @@ + reg = <0x8d04000 0x1000>; + reg-names = "hdmi-reg"; + #sound-dai-cells = <0>; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irq"; + clock-names = "pix", + "tmds", +@@ -254,7 +254,7 @@ + bdisp0:bdisp@9f10000 { + compatible = "st,stih407-bdisp"; + reg = <0x9f10000 0x1000>; +- interrupts = ; ++ interrupts = ; + clock-names = "bdisp"; + clocks = <&clk_s_c0_flexgen CLK_IC_BDISP_0>; + }; +@@ -263,8 +263,8 @@ + compatible = "st,st-hva"; + reg = <0x8c85000 0x400>, <0x6000000 0x40000>; + reg-names = "hva_registers", "hva_esram"; +- interrupts = , +- ; ++ interrupts = , ++ ; + clock-names = "clk_hva"; + clocks = <&clk_s_c0_flexgen CLK_HVA>; + }; +@@ -292,7 +292,7 @@ + reg = <0x94a087c 0x64>; + clocks = <&clk_sysin>; + clock-names = "cec-clk"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "cec-irq"; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_cec0_default>; diff --git a/queue-4.17/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch b/queue-4.17/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch new file mode 100644 index 00000000000..5b2b986789c --- /dev/null +++ b/queue-4.17/arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Will Deacon +Date: Mon, 30 Apr 2018 13:56:32 +0100 +Subject: arm64: cmpwait: Clear event register before arming exclusive monitor + +From: Will Deacon + +[ Upstream commit 1cfc63b5ae60fe7e01773f38132f98d8b13a99a0 ] + +When waiting for a cacheline to change state in cmpwait, we may immediately +wake-up the first time around the outer loop if the event register was +already set (for example, because of the event stream). + +Avoid these spurious wakeups by explicitly clearing the event register +before loading the cacheline and setting the exclusive monitor. + +Signed-off-by: Will Deacon +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/include/asm/cmpxchg.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/arm64/include/asm/cmpxchg.h ++++ b/arch/arm64/include/asm/cmpxchg.h +@@ -204,7 +204,9 @@ static inline void __cmpwait_case_##name + unsigned long tmp; \ + \ + asm volatile( \ +- " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ ++ " sevl\n" \ ++ " wfe\n" \ ++ " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ + " eor %" #w "[tmp], %" #w "[tmp], %" #w "[val]\n" \ + " cbnz %" #w "[tmp], 1f\n" \ + " wfe\n" \ diff --git a/queue-4.17/arm64-defconfig-enable-rockchip-io-domain-driver.patch b/queue-4.17/arm64-defconfig-enable-rockchip-io-domain-driver.patch new file mode 100644 index 00000000000..0958a7db284 --- /dev/null +++ b/queue-4.17/arm64-defconfig-enable-rockchip-io-domain-driver.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Enric Balletbo i Serra +Date: Mon, 16 Apr 2018 11:39:57 -0300 +Subject: arm64: defconfig: Enable Rockchip io-domain driver + +From: Enric Balletbo i Serra + +[ Upstream commit 7c8b77f81552c2b0e5d9c560da70bc4149ce66a5 ] + +Heiko Stübner justified pretty well the change in commit e330eb86ba0b +("ARM: multi_v7_defconfig: enable Rockchip io-domain driver"). This +change is also needed for arm64 rockchip boards, so, do the same for arm64. + +The io-domain driver is necessary to notify the soc about voltages +changes happening on supplying regulators. Probably the most important +user right now is the mmc tuning code, where the soc needs to get +notified when the voltage is dropped to the 1.8V point. + +As this option is necessary to successfully tune UHS cards etc, it +should get built in. Otherwise, tuning will fail with, + + dwmmc_rockchip fe320000.dwmmc: All phases bad! + mmc0: tuning execution failed: -5 + +Signed-off-by: Enric Balletbo i Serra +Acked-by: Robin Murphy +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/configs/defconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -333,6 +333,8 @@ CONFIG_GPIO_XGENE_SB=y + CONFIG_GPIO_PCA953X=y + CONFIG_GPIO_PCA953X_IRQ=y + CONFIG_GPIO_MAX77620=y ++CONFIG_POWER_AVS=y ++CONFIG_ROCKCHIP_IODOMAIN=y + CONFIG_POWER_RESET_MSM=y + CONFIG_POWER_RESET_XGENE=y + CONFIG_POWER_RESET_SYSCON=y diff --git a/queue-4.17/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch b/queue-4.17/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch new file mode 100644 index 00000000000..0bdb8dc03f4 --- /dev/null +++ b/queue-4.17/arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch @@ -0,0 +1,90 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kuninori Morimoto +Date: Mon, 23 Apr 2018 01:40:16 +0000 +Subject: arm64: dts: renesas: salvator-common: use audio-graph-card for Sound + +From: Kuninori Morimoto + +[ Upstream commit 06a574c7ef69bd0bd26ed08e35967acb76622ab3 ] + +Current Sound is using simple-audio-card which can't support HDMI. +To use HDMI sound, we need to use audio-graph-card. +But, one note is that r8a7795 has 2 HDMI ports, but r8a7796 has 1. +Because of this mismatch, supporting HDMI on salvator-common is +impossible. +Thus, this patch exchange sound card to audio-graph-card and keep +supporting ak4613 as 1st sound node. +r8a7795/r8a7796 salvator-x{s} need to add HDMI sound individually. + +Signed-off-by: Kuninori Morimoto +Tested-by: Nguyen Viet Dung +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/renesas/salvator-common.dtsi | 38 +++++++++++++---------- + 1 file changed, 22 insertions(+), 16 deletions(-) + +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -93,20 +93,12 @@ + regulator-always-on; + }; + +- rsnd_ak4613: sound { +- compatible = "simple-audio-card"; ++ sound_card: sound { ++ compatible = "audio-graph-card"; + +- simple-audio-card,format = "left_j"; +- simple-audio-card,bitclock-master = <&sndcpu>; +- simple-audio-card,frame-master = <&sndcpu>; ++ label = "rcar-sound"; + +- sndcpu: simple-audio-card,cpu { +- sound-dai = <&rcar_sound>; +- }; +- +- sndcodec: simple-audio-card,codec { +- sound-dai = <&ak4613>; +- }; ++ dais = <&rsnd_port0>; + }; + + vbus0_usb2: regulator-vbus0-usb2 { +@@ -322,6 +314,12 @@ + asahi-kasei,out4-single-end; + asahi-kasei,out5-single-end; + asahi-kasei,out6-single-end; ++ ++ port { ++ ak4613_endpoint: endpoint { ++ remote-endpoint = <&rsnd_endpoint0>; ++ }; ++ }; + }; + + cs2000: clk_multiplier@4f { +@@ -581,10 +579,18 @@ + <&audio_clk_c>, + <&cpg CPG_CORE CPG_AUDIO_CLK_I>; + +- rcar_sound,dai { +- dai0 { +- playback = <&ssi0 &src0 &dvc0>; +- capture = <&ssi1 &src1 &dvc1>; ++ ports { ++ rsnd_port0: port@0 { ++ rsnd_endpoint0: endpoint { ++ remote-endpoint = <&ak4613_endpoint>; ++ ++ dai-format = "left_j"; ++ bitclock-master = <&rsnd_endpoint0>; ++ frame-master = <&rsnd_endpoint0>; ++ ++ playback = <&ssi0 &src0 &dvc0>; ++ capture = <&ssi1 &src1 &dvc1>; ++ }; + }; + }; + }; diff --git a/queue-4.17/asoc-compress-only-call-free-for-components-which-have-been-opened.patch b/queue-4.17/asoc-compress-only-call-free-for-components-which-have-been-opened.patch new file mode 100644 index 00000000000..b91aa2bfe0e --- /dev/null +++ b/queue-4.17/asoc-compress-only-call-free-for-components-which-have-been-opened.patch @@ -0,0 +1,148 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Charles Keepax +Date: Tue, 24 Apr 2018 16:39:01 +0100 +Subject: ASoC: compress: Only call free for components which have been opened + +From: Charles Keepax + +[ Upstream commit 572e6c8dd174bc6fc7ba5d9b6935e9ec8d2660f5 ] + +The core should only call free on a component if said component has +already had open called on it. This is not presently the case and most +compressed drivers in the kernel assume it will be. This causes null +pointer dereferences in the drivers as they attempt clean up for stuff +that was never put in place. + +This is fixed by aborting calling open callbacks once a failure is +encountered and then during clean up only iterating through the +component list to that point. + +This is a fairly quick fix to the issue, to allow backporting. There +is more refactoring to follow to tidy the code up a little. + +Fixes: 9e7e3738ab0e ("ASoC: snd_soc_component_driver has snd_compr_ops") +Signed-off-by: Charles Keepax +Acked-by: Vinod Koul +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-compress.c | 52 +++++++++++++++++++++++++---------------------- + 1 file changed, 28 insertions(+), 24 deletions(-) + +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -33,7 +33,7 @@ static int soc_compr_open(struct snd_com + struct snd_soc_component *component; + struct snd_soc_rtdcom_list *rtdcom; + struct snd_soc_dai *cpu_dai = rtd->cpu_dai; +- int ret = 0, __ret; ++ int ret; + + mutex_lock_nested(&rtd->pcm_mutex, rtd->pcm_subclass); + +@@ -68,16 +68,15 @@ static int soc_compr_open(struct snd_com + !component->driver->compr_ops->open) + continue; + +- __ret = component->driver->compr_ops->open(cstream); +- if (__ret < 0) { ++ ret = component->driver->compr_ops->open(cstream); ++ if (ret < 0) { + dev_err(component->dev, + "Compress ASoC: can't open platform %s: %d\n", +- component->name, __ret); +- ret = __ret; ++ component->name, ret); ++ goto machine_err; + } + } +- if (ret < 0) +- goto machine_err; ++ component = NULL; + + if (rtd->dai_link->compr_ops && rtd->dai_link->compr_ops->startup) { + ret = rtd->dai_link->compr_ops->startup(cstream); +@@ -97,17 +96,20 @@ static int soc_compr_open(struct snd_com + + machine_err: + for_each_rtdcom(rtd, rtdcom) { +- component = rtdcom->component; ++ struct snd_soc_component *err_comp = rtdcom->component; ++ ++ if (err_comp == component) ++ break; + + /* ignore duplication for now */ +- if (platform && (component == &platform->component)) ++ if (platform && (err_comp == &platform->component)) + continue; + +- if (!component->driver->compr_ops || +- !component->driver->compr_ops->free) ++ if (!err_comp->driver->compr_ops || ++ !err_comp->driver->compr_ops->free) + continue; + +- component->driver->compr_ops->free(cstream); ++ err_comp->driver->compr_ops->free(cstream); + } + + if (platform && platform->driver->compr_ops && platform->driver->compr_ops->free) +@@ -132,7 +134,7 @@ static int soc_compr_open_fe(struct snd_ + struct snd_soc_dpcm *dpcm; + struct snd_soc_dapm_widget_list *list; + int stream; +- int ret = 0, __ret; ++ int ret; + + if (cstream->direction == SND_COMPRESS_PLAYBACK) + stream = SNDRV_PCM_STREAM_PLAYBACK; +@@ -172,16 +174,15 @@ static int soc_compr_open_fe(struct snd_ + !component->driver->compr_ops->open) + continue; + +- __ret = component->driver->compr_ops->open(cstream); +- if (__ret < 0) { ++ ret = component->driver->compr_ops->open(cstream); ++ if (ret < 0) { + dev_err(component->dev, + "Compress ASoC: can't open platform %s: %d\n", +- component->name, __ret); +- ret = __ret; ++ component->name, ret); ++ goto machine_err; + } + } +- if (ret < 0) +- goto machine_err; ++ component = NULL; + + if (fe->dai_link->compr_ops && fe->dai_link->compr_ops->startup) { + ret = fe->dai_link->compr_ops->startup(cstream); +@@ -236,17 +237,20 @@ fe_err: + fe->dai_link->compr_ops->shutdown(cstream); + machine_err: + for_each_rtdcom(fe, rtdcom) { +- component = rtdcom->component; ++ struct snd_soc_component *err_comp = rtdcom->component; ++ ++ if (err_comp == component) ++ break; + + /* ignore duplication for now */ +- if (platform && (component == &platform->component)) ++ if (platform && (err_comp == &platform->component)) + continue; + +- if (!component->driver->compr_ops || +- !component->driver->compr_ops->free) ++ if (!err_comp->driver->compr_ops || ++ !err_comp->driver->compr_ops->free) + continue; + +- component->driver->compr_ops->free(cstream); ++ err_comp->driver->compr_ops->free(cstream); + } + + if (platform && platform->driver->compr_ops && platform->driver->compr_ops->free) diff --git a/queue-4.17/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch b/queue-4.17/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch new file mode 100644 index 00000000000..00ca1fc059c --- /dev/null +++ b/queue-4.17/asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kai Chieh Chuang +Date: Mon, 28 May 2018 10:18:18 +0800 +Subject: ASoC: dpcm: fix BE dai not hw_free and shutdown + +From: Kai Chieh Chuang + +[ Upstream commit 9c0ac70ad24d76b873c1551e27790c7f6a815d5c ] + +In case, one BE is used by two FE1/FE2 +FE1--->BE--> + | +FE2----] +when FE1/FE2 call dpcm_be_dai_hw_free() together +the BE users will be 2 (> 1), hence cannot be hw_free +the be state will leave at, ex. SND_SOC_DPCM_STATE_STOP + +later FE1/FE2 call dpcm_be_dai_shutdown(), +will be skip due to wrong state. +leaving the BE not being hw_free and shutdown. + +The BE dai will be hw_free later when calling +dpcm_be_dai_shutdown() if still in invalid state. + +Signed-off-by: KaiChieh Chuang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/soc-pcm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1965,8 +1965,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_ + continue; + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) +- continue; ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) { ++ soc_pcm_hw_free(be_substream); ++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE; ++ } + + dev_dbg(be->dev, "ASoC: close BE %s\n", + be->dai_link->name); diff --git a/queue-4.17/asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch b/queue-4.17/asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch new file mode 100644 index 00000000000..c7429baaab5 --- /dev/null +++ b/queue-4.17/asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Fabio Estevam +Date: Wed, 25 Apr 2018 19:53:52 -0300 +Subject: ASoC: fsl_ssi: Use u32 variable type when using regmap_read() + +From: Fabio Estevam + +[ Upstream commit 671f8204b12fae98dcc6fc5a5703a5c62cbea187 ] + +Convert the sisr and sisr2 variable types to u32 to avoid the following +sparse warnings: + +sound/soc/fsl/fsl_ssi.c:391:42: warning: incorrect type in argument 3 (different base types) +sound/soc/fsl/fsl_ssi.c:391:42: expected unsigned int *val +sound/soc/fsl/fsl_ssi.c:391:42: got restricted __be32 * +sound/soc/fsl/fsl_ssi.c:393:17: warning: restricted __be32 degrades to integer +sound/soc/fsl/fsl_ssi.c:393:15: warning: incorrect type in assignment (different base types) +sound/soc/fsl/fsl_ssi.c:393:15: expected restricted __be32 [usertype] sisr2 +sound/soc/fsl/fsl_ssi.c:393:15: got unsigned int +sound/soc/fsl/fsl_ssi.c:396:50: warning: incorrect type in argument 3 (different base types) +sound/soc/fsl/fsl_ssi.c:396:50: expected unsigned int [unsigned] val +sound/soc/fsl/fsl_ssi.c:396:50: got restricted __be32 [usertype] sisr2 +sound/soc/fsl/fsl_ssi.c:398:42: warning: incorrect type in argument 2 (different base types) +sound/soc/fsl/fsl_ssi.c:398:42: expected unsigned int [unsigned] [usertype] sisr +sound/soc/fsl/fsl_ssi.c:398:42: got restricted __be32 [addressable] [usertype] sisr + +In other places where regmap_read() is used a u32 variable is passed +to store the register read value, so do the same here as well. + +regmap API already takes care of endianness, so the usage of u32 is safe. + +Signed-off-by: Fabio Estevam +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/fsl/fsl_ssi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/sound/soc/fsl/fsl_ssi.c ++++ b/sound/soc/fsl/fsl_ssi.c +@@ -385,8 +385,7 @@ static irqreturn_t fsl_ssi_isr(int irq, + { + struct fsl_ssi *ssi = dev_id; + struct regmap *regs = ssi->regs; +- __be32 sisr; +- __be32 sisr2; ++ u32 sisr, sisr2; + + regmap_read(regs, REG_SSI_SISR, &sisr); + diff --git a/queue-4.17/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch b/queue-4.17/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch new file mode 100644 index 00000000000..700fd26f5e5 --- /dev/null +++ b/queue-4.17/asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch @@ -0,0 +1,100 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Kirill Marinushkin +Date: Wed, 4 Apr 2018 06:19:38 +0200 +Subject: ASoC: topology: Add missing clock gating parameter when parsing hw_configs + +From: Kirill Marinushkin + +[ Upstream commit 933e1c4a667103c4d10ebdc9505a0a6abd8c3fbd ] + +Clock gating parameter is a part of `dai_fmt`. It is supported by +`alsa-lib` when creating a topology binary file, but ignored by kernel +when loading this topology file. + +After applying this commit, the clock gating parameter is not ignored any +more. This solution is backwards compatible. The existing behaviour is +not broken, because by default the parameter value is 0 and is ignored. + +snd_soc_tplg_hw_config.clock_gated = 0 => no effect +snd_soc_tplg_hw_config.clock_gated = 1 => SND_SOC_DAIFMT_GATED +snd_soc_tplg_hw_config.clock_gated = 2 => SND_SOC_DAIFMT_CONT + +For example, the following config, based on +alsa-lib/src/conf/topology/broadwell/broadwell.conf, is now supported: + +~~~~ +SectionHWConfig."CodecHWConfig" { + id "1" + format "I2S" # physical audio format. + pm_gate_clocks "true" # clock can be gated +} + +SectionLink."Codec" { + + # used for binding to the physical link + id "0" + + hw_configs [ + "CodecHWConfig" + ] + + default_hw_conf_id "1" +} +~~~~ + +Signed-off-by: Kirill Marinushkin +Reviewed-by: Pierre-Louis Bossart +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: Mark Brown +Cc: Pan Xiuli +Cc: Liam Girdwood +Cc: linux-kernel@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/sound/asoc.h | 7 ++++++- + sound/soc/soc-topology.c | 7 +++++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +--- a/include/uapi/sound/asoc.h ++++ b/include/uapi/sound/asoc.h +@@ -139,6 +139,11 @@ + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS (1 << 1) + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + ++/* DAI clock gating */ ++#define SND_SOC_TPLG_DAI_CLK_GATE_UNDEFINED 0 ++#define SND_SOC_TPLG_DAI_CLK_GATE_GATED 1 ++#define SND_SOC_TPLG_DAI_CLK_GATE_CONT 2 ++ + /* DAI physical PCM data formats. + * Add new formats to the end of the list. + */ +@@ -324,7 +329,7 @@ struct snd_soc_tplg_hw_config { + __le32 size; /* in bytes of this structure */ + __le32 id; /* unique ID - - used to match */ + __le32 fmt; /* SND_SOC_DAI_FORMAT_ format value */ +- __u8 clock_gated; /* 1 if clock can be gated to save power */ ++ __u8 clock_gated; /* SND_SOC_TPLG_DAI_CLK_GATE_ value */ + __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */ + __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */ + __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */ +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2006,6 +2006,13 @@ static void set_link_hw_format(struct sn + + link->dai_fmt = hw_config->fmt & SND_SOC_DAIFMT_FORMAT_MASK; + ++ /* clock gating */ ++ if (hw_config->clock_gated == SND_SOC_TPLG_DAI_CLK_GATE_GATED) ++ link->dai_fmt |= SND_SOC_DAIFMT_GATED; ++ else if (hw_config->clock_gated == ++ SND_SOC_TPLG_DAI_CLK_GATE_CONT) ++ link->dai_fmt |= SND_SOC_DAIFMT_CONT; ++ + /* clock signal polarity */ + invert_bclk = hw_config->invert_bclk; + invert_fsync = hw_config->invert_fsync; diff --git a/queue-4.17/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch b/queue-4.17/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch new file mode 100644 index 00000000000..012f330d32e --- /dev/null +++ b/queue-4.17/asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch @@ -0,0 +1,89 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Kirill Marinushkin +Date: Wed, 4 Apr 2018 06:19:37 +0200 +Subject: ASoC: topology: Fix bclk and fsync inversion in set_link_hw_format() + +From: Kirill Marinushkin + +[ Upstream commit a941e2fab3207cb0d57dc4ec47b1b12c8ea78b84 ] + +The values of bclk and fsync are inverted WRT the codec. But the existing +solution already works for Broadwell, see the alsa-lib config: + +`alsa-lib/src/conf/topology/broadwell/broadwell.conf` + +This commit provides the backwards-compatible solution to fix this misuse. + +Signed-off-by: Kirill Marinushkin +Reviewed-by: Pierre-Louis Bossart +Tested-by: Pan Xiuli +Tested-by: Pierre-Louis Bossart +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: Mark Brown +Cc: Liam Girdwood +Cc: linux-kernel@vger.kernel.org +Cc: alsa-devel@alsa-project.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/sound/asoc.h | 16 ++++++++++++++-- + sound/soc/soc-topology.c | 12 +++++++----- + 2 files changed, 21 insertions(+), 7 deletions(-) + +--- a/include/uapi/sound/asoc.h ++++ b/include/uapi/sound/asoc.h +@@ -160,6 +160,18 @@ + #define SND_SOC_TPLG_LNK_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + #define SND_SOC_TPLG_LNK_FLGBIT_VOICE_WAKEUP (1 << 3) + ++/* DAI topology BCLK parameter ++ * For the backwards capability, by default codec is bclk master ++ */ ++#define SND_SOC_TPLG_BCLK_CM 0 /* codec is bclk master */ ++#define SND_SOC_TPLG_BCLK_CS 1 /* codec is bclk slave */ ++ ++/* DAI topology FSYNC parameter ++ * For the backwards capability, by default codec is fsync master ++ */ ++#define SND_SOC_TPLG_FSYNC_CM 0 /* codec is fsync master */ ++#define SND_SOC_TPLG_FSYNC_CS 1 /* codec is fsync slave */ ++ + /* + * Block Header. + * This header precedes all object and object arrays below. +@@ -315,8 +327,8 @@ struct snd_soc_tplg_hw_config { + __u8 clock_gated; /* 1 if clock can be gated to save power */ + __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */ + __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */ +- __u8 bclk_master; /* 1 for master of BCLK, 0 for slave */ +- __u8 fsync_master; /* 1 for master of FSYNC, 0 for slave */ ++ __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */ ++ __u8 fsync_master; /* SND_SOC_TPLG_FSYNC_ value */ + __u8 mclk_direction; /* 0 for input, 1 for output */ + __le16 reserved; /* for 32bit alignment */ + __le32 mclk_rate; /* MCLK or SYSCLK freqency in Hz */ +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -2019,13 +2019,15 @@ static void set_link_hw_format(struct sn + link->dai_fmt |= SND_SOC_DAIFMT_IB_IF; + + /* clock masters */ +- bclk_master = hw_config->bclk_master; +- fsync_master = hw_config->fsync_master; +- if (!bclk_master && !fsync_master) ++ bclk_master = (hw_config->bclk_master == ++ SND_SOC_TPLG_BCLK_CM); ++ fsync_master = (hw_config->fsync_master == ++ SND_SOC_TPLG_FSYNC_CM); ++ if (bclk_master && fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM; +- else if (bclk_master && !fsync_master) +- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; + else if (!bclk_master && fsync_master) ++ link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; ++ else if (bclk_master && !fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFS; + else + link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS; diff --git a/queue-4.17/ath-add-regulatory-mapping-for-apl13_world.patch b/queue-4.17/ath-add-regulatory-mapping-for-apl13_world.patch new file mode 100644 index 00000000000..59c216934cd --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-apl13_world.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:14 +0300 +Subject: ath: Add regulatory mapping for APL13_WORLD + +From: Sven Eckelmann + +[ Upstream commit 9ba8df0c52b3e6baa436374b429d3d73bd09a320 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -69,6 +69,7 @@ enum EnumRd { + APL1_ETSIC = 0x55, + APL2_ETSIC = 0x56, + APL5_WORLD = 0x58, ++ APL13_WORLD = 0x5A, + APL6_WORLD = 0x5B, + APL7_FCCA = 0x5C, + APL8_WORLD = 0x5D, +@@ -195,6 +196,7 @@ static struct reg_dmn_pair_mapping regDo + {APL3_WORLD, CTL_FCC, CTL_ETSI}, + {APL4_WORLD, CTL_FCC, CTL_ETSI}, + {APL5_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL13_WORLD, CTL_ETSI, CTL_ETSI}, + {APL6_WORLD, CTL_ETSI, CTL_ETSI}, + {APL8_WORLD, CTL_ETSI, CTL_ETSI}, + {APL9_WORLD, CTL_ETSI, CTL_ETSI}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-apl2_fcca.patch b/queue-4.17/ath-add-regulatory-mapping-for-apl2_fcca.patch new file mode 100644 index 00000000000..c8f2f2d94ce --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-apl2_fcca.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:05 +0300 +Subject: ath: Add regulatory mapping for APL2_FCCA + +From: Sven Eckelmann + +[ Upstream commit 4f183687e3fad3ce0e06e38976cad81bc4541990 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: FCC +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -61,6 +61,7 @@ enum EnumRd { + MKK1_MKKA1 = 0x4A, + MKK1_MKKA2 = 0x4B, + MKK1_MKKC = 0x4C, ++ APL2_FCCA = 0x4D, + + APL3_FCCA = 0x50, + APL1_WORLD = 0x52, +@@ -193,6 +194,7 @@ static struct reg_dmn_pair_mapping regDo + {FCC1_FCCA, CTL_FCC, CTL_FCC}, + {APL1_WORLD, CTL_FCC, CTL_ETSI}, + {APL2_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL2_FCCA, CTL_FCC, CTL_FCC}, + {APL3_WORLD, CTL_FCC, CTL_ETSI}, + {APL4_WORLD, CTL_FCC, CTL_ETSI}, + {APL5_WORLD, CTL_FCC, CTL_ETSI}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-bahamas.patch b/queue-4.17/ath-add-regulatory-mapping-for-bahamas.patch new file mode 100644 index 00000000000..ded3bf21d54 --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-bahamas.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:09:53 +0300 +Subject: ath: Add regulatory mapping for Bahamas + +From: Sven Eckelmann + +[ Upstream commit 699e2302c286a14afe7b7394151ce6c4e1790cc1 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -68,6 +68,7 @@ enum CountryCode { + CTRY_AUSTRALIA = 36, + CTRY_AUSTRIA = 40, + CTRY_AZERBAIJAN = 31, ++ CTRY_BAHAMAS = 44, + CTRY_BAHRAIN = 48, + CTRY_BANGLADESH = 50, + CTRY_BARBADOS = 52, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -306,6 +306,7 @@ static struct country_code_to_enum_rd al + {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"}, + {CTRY_AUSTRIA, ETSI1_WORLD, "AT"}, + {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"}, ++ {CTRY_BAHAMAS, FCC3_WORLD, "BS"}, + {CTRY_BAHRAIN, APL6_WORLD, "BH"}, + {CTRY_BANGLADESH, NULL1_WORLD, "BD"}, + {CTRY_BARBADOS, FCC2_WORLD, "BB"}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-bermuda.patch b/queue-4.17/ath-add-regulatory-mapping-for-bermuda.patch new file mode 100644 index 00000000000..2f7f299285c --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-bermuda.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:09:59 +0300 +Subject: ath: Add regulatory mapping for Bermuda + +From: Sven Eckelmann + +[ Upstream commit 9c790f2d234f65697e3b0948adbfdf36dbe63dd7 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: FCC +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -74,6 +74,7 @@ enum CountryCode { + CTRY_BELARUS = 112, + CTRY_BELGIUM = 56, + CTRY_BELIZE = 84, ++ CTRY_BERMUDA = 60, + CTRY_BOLIVIA = 68, + CTRY_BOSNIA_HERZ = 70, + CTRY_BRAZIL = 76, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -313,6 +313,7 @@ static struct country_code_to_enum_rd al + {CTRY_BELGIUM, ETSI1_WORLD, "BE"}, + {CTRY_BELGIUM2, ETSI4_WORLD, "BL"}, + {CTRY_BELIZE, APL1_ETSIC, "BZ"}, ++ {CTRY_BERMUDA, FCC3_FCCA, "BM"}, + {CTRY_BOLIVIA, APL1_ETSIC, "BO"}, + {CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"}, + {CTRY_BRAZIL, FCC3_WORLD, "BR"}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-etsi8_world.patch b/queue-4.17/ath-add-regulatory-mapping-for-etsi8_world.patch new file mode 100644 index 00000000000..ee8db4b6f31 --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-etsi8_world.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:18 +0300 +Subject: ath: Add regulatory mapping for ETSI8_WORLD + +From: Sven Eckelmann + +[ Upstream commit 45faf6e096da8bb80e1ddf8c08a26a9601d9469e ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -45,6 +45,7 @@ enum EnumRd { + ETSI4_ETSIC = 0x38, + ETSI5_WORLD = 0x39, + ETSI6_WORLD = 0x34, ++ ETSI8_WORLD = 0x3D, + ETSI_RESERVED = 0x33, + + MKK1_MKKA = 0x40, +@@ -181,6 +182,7 @@ static struct reg_dmn_pair_mapping regDo + {ETSI4_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI5_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI6_WORLD, CTL_ETSI, CTL_ETSI}, ++ {ETSI8_WORLD, CTL_ETSI, CTL_ETSI}, + + /* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */ + {ETSI3_ETSIA, CTL_ETSI, CTL_ETSI}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-fcc3_etsic.patch b/queue-4.17/ath-add-regulatory-mapping-for-fcc3_etsic.patch new file mode 100644 index 00000000000..f307cda69de --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-fcc3_etsic.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:11:30 +0300 +Subject: ath: Add regulatory mapping for FCC3_ETSIC + +From: Sven Eckelmann + +[ Upstream commit 01fb2994a98dc72c8818c274f7b5983d5dd885c7 ] + +The regdomain code is used to select the correct the correct conformance +test limits (CTL) for a country. If the regdomain code isn't available and +it is still programmed in the EEPROM then it will cause an error and stop +the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this regdomain code are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd_common.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -35,6 +35,7 @@ enum EnumRd { + FRANCE_RES = 0x31, + FCC3_FCCA = 0x3A, + FCC3_WORLD = 0x3B, ++ FCC3_ETSIC = 0x3F, + + ETSI1_WORLD = 0x37, + ETSI3_ETSIA = 0x32, +@@ -168,6 +169,7 @@ static struct reg_dmn_pair_mapping regDo + {FCC2_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC3_FCCA, CTL_FCC, CTL_FCC}, + {FCC3_WORLD, CTL_FCC, CTL_ETSI}, ++ {FCC3_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC4_FCCA, CTL_FCC, CTL_FCC}, + {FCC5_FCCA, CTL_FCC, CTL_FCC}, + {FCC6_FCCA, CTL_FCC, CTL_FCC}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-serbia.patch b/queue-4.17/ath-add-regulatory-mapping-for-serbia.patch new file mode 100644 index 00000000000..3d1ce8fe83c --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-serbia.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:43 +0300 +Subject: ath: Add regulatory mapping for Serbia + +From: Sven Eckelmann + +[ Upstream commit 2a3169a54bb53717928392a04fb84deb765b51f1 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: ETSI + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -159,6 +159,7 @@ enum CountryCode { + CTRY_ROMANIA = 642, + CTRY_RUSSIA = 643, + CTRY_SAUDI_ARABIA = 682, ++ CTRY_SERBIA = 688, + CTRY_SERBIA_MONTENEGRO = 891, + CTRY_SINGAPORE = 702, + CTRY_SLOVAKIA = 703, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -452,6 +452,7 @@ static struct country_code_to_enum_rd al + {CTRY_ROMANIA, NULL1_WORLD, "RO"}, + {CTRY_RUSSIA, NULL1_WORLD, "RU"}, + {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"}, ++ {CTRY_SERBIA, ETSI1_WORLD, "RS"}, + {CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"}, + {CTRY_SINGAPORE, APL6_WORLD, "SG"}, + {CTRY_SLOVAKIA, ETSI1_WORLD, "SK"}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-tanzania.patch b/queue-4.17/ath-add-regulatory-mapping-for-tanzania.patch new file mode 100644 index 00000000000..ea7495dcb30 --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-tanzania.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:48 +0300 +Subject: ath: Add regulatory mapping for Tanzania + +From: Sven Eckelmann + +[ Upstream commit 667ddac5745fb9fddfe8f7fd2523070f50bd4442 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -170,6 +170,7 @@ enum CountryCode { + CTRY_SWITZERLAND = 756, + CTRY_SYRIA = 760, + CTRY_TAIWAN = 158, ++ CTRY_TANZANIA = 834, + CTRY_THAILAND = 764, + CTRY_TRINIDAD_Y_TOBAGO = 780, + CTRY_TUNISIA = 788, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -463,6 +463,7 @@ static struct country_code_to_enum_rd al + {CTRY_SWITZERLAND, ETSI1_WORLD, "CH"}, + {CTRY_SYRIA, NULL1_WORLD, "SY"}, + {CTRY_TAIWAN, APL3_FCCA, "TW"}, ++ {CTRY_TANZANIA, APL1_WORLD, "TZ"}, + {CTRY_THAILAND, FCC3_WORLD, "TH"}, + {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"}, + {CTRY_TUNISIA, ETSI3_WORLD, "TN"}, diff --git a/queue-4.17/ath-add-regulatory-mapping-for-uganda.patch b/queue-4.17/ath-add-regulatory-mapping-for-uganda.patch new file mode 100644 index 00000000000..6f7ba6a8a3e --- /dev/null +++ b/queue-4.17/ath-add-regulatory-mapping-for-uganda.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sven Eckelmann +Date: Wed, 23 May 2018 11:10:54 +0300 +Subject: ath: Add regulatory mapping for Uganda + +From: Sven Eckelmann + +[ Upstream commit 1ea3986ad2bc72081c69f3fbc1e5e0eeb3c44f17 ] + +The country code is used by the ath to detect the ISO 3166-1 alpha-2 name +and to select the correct conformance test limits (CTL) for a country. If +the country isn't available and it is still programmed in the EEPROM then +it will cause an error and stop the initialization with: + + Invalid EEPROM contents + +The current CTL mappings for this country are: + +* 2.4GHz: ETSI +* 5GHz: FCC + +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/regd.h | 1 + + drivers/net/wireless/ath/regd_common.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -175,6 +175,7 @@ enum CountryCode { + CTRY_TUNISIA = 788, + CTRY_TURKEY = 792, + CTRY_UAE = 784, ++ CTRY_UGANDA = 800, + CTRY_UKRAINE = 804, + CTRY_UNITED_KINGDOM = 826, + CTRY_UNITED_STATES = 840, +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -467,6 +467,7 @@ static struct country_code_to_enum_rd al + {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"}, + {CTRY_TUNISIA, ETSI3_WORLD, "TN"}, + {CTRY_TURKEY, ETSI3_WORLD, "TR"}, ++ {CTRY_UGANDA, FCC3_WORLD, "UG"}, + {CTRY_UKRAINE, NULL1_WORLD, "UA"}, + {CTRY_UAE, NULL1_WORLD, "AE"}, + {CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"}, diff --git a/queue-4.17/ath10k-fix-kernel-panic-while-reading-tpc_stats.patch b/queue-4.17/ath10k-fix-kernel-panic-while-reading-tpc_stats.patch new file mode 100644 index 00000000000..9f1e064c343 --- /dev/null +++ b/queue-4.17/ath10k-fix-kernel-panic-while-reading-tpc_stats.patch @@ -0,0 +1,125 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Tamizh Chelvam +Date: Wed, 25 Apr 2018 11:36:44 +0300 +Subject: ath10k: fix kernel panic while reading tpc_stats + +From: Tamizh Chelvam + +[ Upstream commit 4b190675ad06f5a6ecbeef0b01890c5fb372e3eb ] + +When attempt to read tpc_stats for the chipsets which support +more than 3 tx chain will trigger kernel panic(kernel stack is corrupted) +due to writing values on rate_code array out of range. +This patch changes the array size depends on the WMI_TPC_TX_N_CHAIN and +added check to avoid write values on the array if the num tx chain +get in tpc config event is greater than WMI_TPC_TX_N_CHAIN. + +Tested on QCA9984 with firmware-5.bin_10.4-3.5.3-00057 + +Kernel panic log : + +[ 323.510944] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: bf90c654 +[ 323.510944] +[ 323.524390] CPU: 0 PID: 1908 Comm: cat Not tainted 3.14.77 #31 +[ 323.530224] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 323.537941] [] (show_stack) from [] (dump_stack+0x80/0xa0) +[ 323.545146] [] (dump_stack) from [] (panic+0x84/0x1e4) +[ 323.552000] [] (panic) from [] (__stack_chk_fail+0x10/0x14) +[ 323.559350] [] (__stack_chk_fail) from [] (ath10k_wmi_event_pdev_tpc_config+0x424/0x438 [ath10k_core]) +[ 323.570471] [] (ath10k_wmi_event_pdev_tpc_config [ath10k_core]) from [] (ath10k_wmi_10_4_op_rx+0x2f0/0x39c [ath10k_core]) +[ 323.583047] [] (ath10k_wmi_10_4_op_rx [ath10k_core]) from [] (ath10k_htc_rx_completion_handler+0x170/0x1a0 [ath10k_core]) +[ 323.595702] [] (ath10k_htc_rx_completion_handler [ath10k_core]) from [] (ath10k_pci_hif_send_complete_check+0x1f0/0x220 [ath10k_pci]) +[ 323.609421] [] (ath10k_pci_hif_send_complete_check [ath10k_pci]) from [] (ath10k_ce_per_engine_service+0x74/0xc4 [ath10k_pci]) +[ 323.622490] [] (ath10k_ce_per_engine_service [ath10k_pci]) from [] (ath10k_ce_per_engine_service_any+0x74/0x80 [ath10k_pci]) +[ 323.635423] [] (ath10k_ce_per_engine_service_any [ath10k_pci]) from [] (ath10k_pci_napi_poll+0x44/0xe8 [ath10k_pci]) +[ 323.647665] [] (ath10k_pci_napi_poll [ath10k_pci]) from [] (net_rx_action+0xac/0x160) +[ 323.657208] [] (net_rx_action) from [] (__do_softirq+0x104/0x294) +[ 323.665017] [] (__do_softirq) from [] (irq_exit+0x9c/0x11c) +[ 323.672314] [] (irq_exit) from [] (handle_IRQ+0x6c/0x90) +[ 323.679341] [] (handle_IRQ) from [] (gic_handle_irq+0x3c/0x60) +[ 323.686893] [] (gic_handle_irq) from [] (__irq_svc+0x40/0x70) +[ 323.694349] Exception stack(0xdd489c58 to 0xdd489ca0) +[ 323.699384] 9c40: 00000000 a0000013 +[ 323.707547] 9c60: 00000000 dc4bce40 60000013 ddc1d800 dd488000 00000990 00000000 c085c800 +[ 323.715707] 9c80: 00000000 dd489d44 0000092d dd489ca0 c026e664 c026e668 60000013 ffffffff +[ 323.723877] [] (__irq_svc) from [] (rcu_note_context_switch+0x170/0x184) +[ 323.732298] [] (rcu_note_context_switch) from [] (__schedule+0x50/0x4d4) +[ 323.740716] [] (__schedule) from [] (schedule_timeout+0x148/0x178) +[ 323.748611] [] (schedule_timeout) from [] (wait_for_common+0x114/0x154) +[ 323.756972] [] (wait_for_common) from [] (ath10k_tpc_stats_open+0xc8/0x340 [ath10k_core]) +[ 323.766873] [] (ath10k_tpc_stats_open [ath10k_core]) from [] (do_dentry_open+0x1ac/0x274) +[ 323.776741] [] (do_dentry_open) from [] (do_last+0x8c0/0xb08) +[ 323.784201] [] (do_last) from [] (path_openat+0x210/0x598) +[ 323.791408] [] (path_openat) from [] (do_filp_open+0x2c/0x78) +[ 323.798873] [] (do_filp_open) from [] (do_sys_open+0x114/0x1b4) +[ 323.806509] [] (do_sys_open) from [] (ret_fast_syscall+0x0/0x44) +[ 323.814241] CPU1: stopping +[ 323.816927] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 3.14.77 #31 +[ 323.823008] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 323.830731] [] (show_stack) from [] (dump_stack+0x80/0xa0) +[ 323.837934] [] (dump_stack) from [] (handle_IPI+0xb8/0x140) +[ 323.845224] [] (handle_IPI) from [] (gic_handle_irq+0x58/0x60) +[ 323.852774] [] (gic_handle_irq) from [] (__irq_svc+0x40/0x70) +[ 323.860233] Exception stack(0xdd499fa0 to 0xdd499fe8) +[ 323.865273] 9fa0: ffffffed 00000000 1d3c9000 00000000 dd498000 dd498030 10c0387d c08b62c8 +[ 323.873432] 9fc0: 4220406a 512f04d0 00000000 00000000 00000001 dd499fe8 c021838c c0218390 +[ 323.881588] 9fe0: 60000013 ffffffff +[ 323.885070] [] (__irq_svc) from [] (arch_cpu_idle+0x30/0x50) +[ 323.892454] [] (arch_cpu_idle) from [] (cpu_startup_entry+0xa4/0x108) +[ 323.900690] [] (cpu_startup_entry) from [<422085a4>] (0x422085a4) + +Signed-off-by: Tamizh chelvam +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/debug.c | 8 +++++++- + drivers/net/wireless/ath/ath10k/wmi.c | 6 ++++++ + drivers/net/wireless/ath/ath10k/wmi.h | 2 +- + 3 files changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -1519,7 +1519,13 @@ static void ath10k_tpc_stats_print(struc + *len += scnprintf(buf + *len, buf_len - *len, + "********************************\n"); + *len += scnprintf(buf + *len, buf_len - *len, +- "No. Preamble Rate_code tpc_value1 tpc_value2 tpc_value3\n"); ++ "No. Preamble Rate_code "); ++ ++ for (i = 0; i < WMI_TPC_TX_N_CHAIN; i++) ++ *len += scnprintf(buf + *len, buf_len - *len, ++ "tpc_value%d ", i); ++ ++ *len += scnprintf(buf + *len, buf_len - *len, "\n"); + + for (i = 0; i < tpc_stats->rate_max; i++) { + *len += scnprintf(buf + *len, buf_len - *len, +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -4479,6 +4479,12 @@ void ath10k_wmi_event_pdev_tpc_config(st + + num_tx_chain = __le32_to_cpu(ev->num_tx_chain); + ++ if (num_tx_chain > WMI_TPC_TX_N_CHAIN) { ++ ath10k_warn(ar, "number of tx chain is %d greater than TPC configured tx chain %d\n", ++ num_tx_chain, WMI_TPC_TX_N_CHAIN); ++ return; ++ } ++ + ath10k_wmi_tpc_config_get_rate_code(rate_code, pream_table, + num_tx_chain); + +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -4008,9 +4008,9 @@ struct wmi_pdev_get_tpc_config_cmd { + } __packed; + + #define WMI_TPC_CONFIG_PARAM 1 +-#define WMI_TPC_RATE_MAX 160 + #define WMI_TPC_FINAL_RATE_MAX 240 + #define WMI_TPC_TX_N_CHAIN 4 ++#define WMI_TPC_RATE_MAX (WMI_TPC_TX_N_CHAIN * 65) + #define WMI_TPC_PREAM_TABLE_MAX 10 + #define WMI_TPC_FLAG 3 + #define WMI_TPC_BUF_SIZE 10 diff --git a/queue-4.17/ath10k-search-all-ies-for-variant-before-falling-back.patch b/queue-4.17/ath10k-search-all-ies-for-variant-before-falling-back.patch new file mode 100644 index 00000000000..9b349c585d7 --- /dev/null +++ b/queue-4.17/ath10k-search-all-ies-for-variant-before-falling-back.patch @@ -0,0 +1,245 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Thomas Hebb +Date: Fri, 13 Apr 2018 17:40:26 +0300 +Subject: ath10k: search all IEs for variant before falling back + +From: Thomas Hebb + +[ Upstream commit c8489668065a283d3027e86e877b103a87f99d22 ] + +commit f2593cb1b291 ("ath10k: Search SMBIOS for OEM board file +extension") added a feature to ath10k that allows Board Data File +(BDF) conflicts between multiple devices that use the same device IDs +but have different calibration requirements to be resolved by allowing +a "variant" string to be stored in SMBIOS [and later device tree, added +by commit d06f26c5c8a4 ("ath10k: search DT for qcom,ath10k-calibration- +variant")] that gets appended to the ID stored in board-2.bin. + +This original patch had a regression, however. Namely that devices with +a variant present in SMBIOS that didn't need custom BDFs could no longer +find the default BDF, which has no variant appended. The patch was +reverted and re-applied with a fix for this issue in commit 1657b8f84ed9 +("search SMBIOS for OEM board file extension"). + +But the fix to fall back to a default BDF introduced another issue: the +driver currently parses IEs in board-2.bin one by one, and for each one +it first checks to see if it matches the ID with the variant appended. +If it doesn't, it checks to see if it matches the "fallback" ID with no +variant. If a matching BDF is found at any point during this search, the +search is terminated and that BDF is used. The issue is that it's very +possible (and is currently the case for board-2.bin files present in the +ath10k-firmware repository) for the default BDF to occur in an earlier +IE than the variant-specific BDF. In this case, the current code will +happily choose the default BDF even though a better-matching BDF is +present later in the file. + +This patch fixes the issue by first searching the entire file for the ID +with variant, and searching for the fallback ID only if that search +fails. It also includes some code cleanup in the area, as +ath10k_core_fetch_board_data_api_n() no longer does its own string +mangling to remove the variant from an ID, instead leaving that job to a +new flag passed to ath10k_core_create_board_name(). + +I've tested this patch on a QCA4019 and verified that the driver behaves +correctly for 1) both fallback and variant BDFs present, 2) only fallback +BDF present, and 3) no matching BDFs present. + +Fixes: 1657b8f84ed9 ("ath10k: search SMBIOS for OEM board file extension") +Signed-off-by: Thomas Hebb +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/core.c | 134 +++++++++++++++++---------------- + 1 file changed, 72 insertions(+), 62 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/core.c ++++ b/drivers/net/wireless/ath/ath10k/core.c +@@ -1253,14 +1253,61 @@ out: + return ret; + } + ++static int ath10k_core_search_bd(struct ath10k *ar, ++ const char *boardname, ++ const u8 *data, ++ size_t len) ++{ ++ size_t ie_len; ++ struct ath10k_fw_ie *hdr; ++ int ret = -ENOENT, ie_id; ++ ++ while (len > sizeof(struct ath10k_fw_ie)) { ++ hdr = (struct ath10k_fw_ie *)data; ++ ie_id = le32_to_cpu(hdr->id); ++ ie_len = le32_to_cpu(hdr->len); ++ ++ len -= sizeof(*hdr); ++ data = hdr->data; ++ ++ if (len < ALIGN(ie_len, 4)) { ++ ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", ++ ie_id, ie_len, len); ++ return -EINVAL; ++ } ++ ++ switch (ie_id) { ++ case ATH10K_BD_IE_BOARD: ++ ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len, ++ boardname); ++ if (ret == -ENOENT) ++ /* no match found, continue */ ++ break; ++ ++ /* either found or error, so stop searching */ ++ goto out; ++ } ++ ++ /* jump over the padding */ ++ ie_len = ALIGN(ie_len, 4); ++ ++ len -= ie_len; ++ data += ie_len; ++ } ++ ++out: ++ /* return result of parse_bd_ie_board() or -ENOENT */ ++ return ret; ++} ++ + static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, + const char *boardname, ++ const char *fallback_boardname, + const char *filename) + { +- size_t len, magic_len, ie_len; +- struct ath10k_fw_ie *hdr; ++ size_t len, magic_len; + const u8 *data; +- int ret, ie_id; ++ int ret; + + ar->normal_mode_fw.board = ath10k_fetch_fw_file(ar, + ar->hw_params.fw.dir, +@@ -1298,69 +1345,23 @@ static int ath10k_core_fetch_board_data_ + data += magic_len; + len -= magic_len; + +- while (len > sizeof(struct ath10k_fw_ie)) { +- hdr = (struct ath10k_fw_ie *)data; +- ie_id = le32_to_cpu(hdr->id); +- ie_len = le32_to_cpu(hdr->len); +- +- len -= sizeof(*hdr); +- data = hdr->data; +- +- if (len < ALIGN(ie_len, 4)) { +- ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", +- ie_id, ie_len, len); +- ret = -EINVAL; +- goto err; +- } ++ /* attempt to find boardname in the IE list */ ++ ret = ath10k_core_search_bd(ar, boardname, data, len); + +- switch (ie_id) { +- case ATH10K_BD_IE_BOARD: +- ret = ath10k_core_parse_bd_ie_board(ar, data, ie_len, +- boardname); +- if (ret == -ENOENT && ar->id.bdf_ext[0] != '\0') { +- /* try default bdf if variant was not found */ +- char *s, *v = ",variant="; +- char boardname2[100]; +- +- strlcpy(boardname2, boardname, +- sizeof(boardname2)); +- +- s = strstr(boardname2, v); +- if (s) +- *s = '\0'; /* strip ",variant=%s" */ +- +- ret = ath10k_core_parse_bd_ie_board(ar, data, +- ie_len, +- boardname2); +- } ++ /* if we didn't find it and have a fallback name, try that */ ++ if (ret == -ENOENT && fallback_boardname) ++ ret = ath10k_core_search_bd(ar, fallback_boardname, data, len); + +- if (ret == -ENOENT) +- /* no match found, continue */ +- break; +- else if (ret) +- /* there was an error, bail out */ +- goto err; +- +- /* board data found */ +- goto out; +- } +- +- /* jump over the padding */ +- ie_len = ALIGN(ie_len, 4); +- +- len -= ie_len; +- data += ie_len; +- } +- +-out: +- if (!ar->normal_mode_fw.board_data || !ar->normal_mode_fw.board_len) { ++ if (ret == -ENOENT) { + ath10k_err(ar, + "failed to fetch board data for %s from %s/%s\n", + boardname, ar->hw_params.fw.dir, filename); + ret = -ENODATA; +- goto err; + } + ++ if (ret) ++ goto err; ++ + return 0; + + err: +@@ -1369,12 +1370,12 @@ err: + } + + static int ath10k_core_create_board_name(struct ath10k *ar, char *name, +- size_t name_len) ++ size_t name_len, bool with_variant) + { + /* strlen(',variant=') + strlen(ar->id.bdf_ext) */ + char variant[9 + ATH10K_SMBIOS_BDF_EXT_STR_LENGTH] = { 0 }; + +- if (ar->id.bdf_ext[0] != '\0') ++ if (with_variant && ar->id.bdf_ext[0] != '\0') + scnprintf(variant, sizeof(variant), ",variant=%s", + ar->id.bdf_ext); + +@@ -1400,17 +1401,26 @@ out: + + static int ath10k_core_fetch_board_file(struct ath10k *ar) + { +- char boardname[100]; ++ char boardname[100], fallback_boardname[100]; + int ret; + +- ret = ath10k_core_create_board_name(ar, boardname, sizeof(boardname)); ++ ret = ath10k_core_create_board_name(ar, boardname, ++ sizeof(boardname), true); + if (ret) { + ath10k_err(ar, "failed to create board name: %d", ret); + return ret; + } + ++ ret = ath10k_core_create_board_name(ar, fallback_boardname, ++ sizeof(boardname), false); ++ if (ret) { ++ ath10k_err(ar, "failed to create fallback board name: %d", ret); ++ return ret; ++ } ++ + ar->bd_api = 2; + ret = ath10k_core_fetch_board_data_api_n(ar, boardname, ++ fallback_boardname, + ATH10K_BOARD_API2_FILE); + if (!ret) + goto success; diff --git a/queue-4.17/audit-allow-not-equal-op-for-audit-by-executable.patch b/queue-4.17/audit-allow-not-equal-op-for-audit-by-executable.patch new file mode 100644 index 00000000000..892300afead --- /dev/null +++ b/queue-4.17/audit-allow-not-equal-op-for-audit-by-executable.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Ondrej Mosnáček" +Date: Mon, 9 Apr 2018 10:00:06 +0200 +Subject: audit: allow not equal op for audit by executable + +From: "Ondrej Mosnáček" + +[ Upstream commit 23bcc480dac204c7dbdf49d96b2c918ed98223c2 ] + +Current implementation of auditing by executable name only implements +the 'equal' operator. This patch extends it to also support the 'not +equal' operator. + +See: https://github.com/linux-audit/audit-kernel/issues/53 + +Signed-off-by: Ondrej Mosnacek +Reviewed-by: Richard Guy Briggs +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/auditfilter.c | 2 +- + kernel/auditsc.c | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/auditfilter.c ++++ b/kernel/auditfilter.c +@@ -426,7 +426,7 @@ static int audit_field_valid(struct audi + return -EINVAL; + break; + case AUDIT_EXE: +- if (f->op != Audit_equal) ++ if (f->op != Audit_not_equal && f->op != Audit_equal) + return -EINVAL; + if (entry->rule.listnr != AUDIT_FILTER_EXIT) + return -EINVAL; +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -471,6 +471,8 @@ static int audit_filter_rules(struct tas + break; + case AUDIT_EXE: + result = audit_exe_compare(tsk, rule->exe); ++ if (f->op == Audit_not_equal) ++ result = !result; + break; + case AUDIT_UID: + result = audit_uid_comparator(cred->uid, f->op, f->uid); diff --git a/queue-4.17/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch b/queue-4.17/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch new file mode 100644 index 00000000000..b7e5209782a --- /dev/null +++ b/queue-4.17/backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wolfram Sang +Date: Sun, 14 Jan 2018 22:07:10 +0100 +Subject: backlight: pwm_bl: Don't use GPIOF_* with gpiod_get_direction + +From: Wolfram Sang + +[ Upstream commit bb084c0f61d659f0e6d371b096e0e57998f191d6 ] + +The documentation was wrong, gpiod_get_direction() returns 0/1 instead +of the GPIOF_* flags. The docs were fixed with commit 94fc73094abe47 +("gpio: correct docs about return value of gpiod_get_direction"). Now, +fix this user (until a better, system-wide solution is in place). + +Signed-off-by: Wolfram Sang +Acked-by: Daniel Thompson +Reviewed-by: Simon Horman +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/backlight/pwm_bl.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -301,14 +301,14 @@ static int pwm_backlight_probe(struct pl + + /* + * If the GPIO is not known to be already configured as output, that +- * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL, +- * change the direction to output and set the GPIO as active. ++ * is, if gpiod_get_direction returns either 1 or -EINVAL, change the ++ * direction to output and set the GPIO as active. + * Do not force the GPIO to active when it was already output as it + * could cause backlight flickering or we would enable the backlight too + * early. Leave the decision of the initial backlight state for later. + */ + if (pb->enable_gpio && +- gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT) ++ gpiod_get_direction(pb->enable_gpio) != 0) + gpiod_direction_output(pb->enable_gpio, 1); + + pb->power_supply = devm_regulator_get(&pdev->dev, "power"); diff --git a/queue-4.17/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch b/queue-4.17/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch new file mode 100644 index 00000000000..b3afe55c405 --- /dev/null +++ b/queue-4.17/block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Filippo Muzzini +Date: Thu, 31 May 2018 15:23:11 +0200 +Subject: block, bfq: remove wrong lock in bfq_requests_merged + +From: Filippo Muzzini + +[ Upstream commit a12bffebc0c9d6a5851f062aaea3aa7c4adc6042 ] + +In bfq_requests_merged(), there is a deadlock because the lock on +bfqq->bfqd->lock is held by the calling function, but the code of +this function tries to grab the lock again. + +This deadlock is currently hidden by another bug (fixed by next commit +for this source file), which causes the body of bfq_requests_merged() +to be never executed. + +This commit removes the deadlock by removing the lock/unlock pair. + +Signed-off-by: Filippo Muzzini +Signed-off-by: Paolo Valente +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + block/bfq-iosched.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -1898,7 +1898,6 @@ static void bfq_requests_merged(struct r + + if (!RB_EMPTY_NODE(&rq->rb_node)) + goto end; +- spin_lock_irq(&bfqq->bfqd->lock); + + /* + * If next and rq belong to the same bfq_queue and next is older +@@ -1923,7 +1922,6 @@ static void bfq_requests_merged(struct r + bfq_remove_request(q, next); + bfqg_stats_update_io_remove(bfqq_group(bfqq), next->cmd_flags); + +- spin_unlock_irq(&bfqq->bfqd->lock); + end: + bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); + } diff --git a/queue-4.17/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch b/queue-4.17/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch new file mode 100644 index 00000000000..0adebc50823 --- /dev/null +++ b/queue-4.17/bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jian-Hong Pan +Date: Mon, 21 May 2018 18:09:20 +0800 +Subject: Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 + +From: Jian-Hong Pan + +[ Upstream commit 66d9975c5a7c40aa7e4bb0ec0b0c37ba1f190923 ] + +Without this patch we cannot turn on the Bluethooth adapter on ASUS +E406MA. + +T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=2ff8 ProdID=b011 Rev= 2.00 +S: Manufacturer=Realtek +S: Product=802.11n WLAN Adapter +S: SerialNumber=00e04c000001 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms +I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms +I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms +I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms +I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms +I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms +E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms + +Signed-off-by: Jian-Hong Pan +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -371,6 +371,9 @@ static const struct usb_device_id blackl + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, + ++ /* Additional Realtek 8723DE Bluetooth devices */ ++ { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, ++ + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, diff --git a/queue-4.17/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch b/queue-4.17/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch new file mode 100644 index 00000000000..a03c98e0e24 --- /dev/null +++ b/queue-4.17/bluetooth-btusb-add-id-for-liteon-04ca-301a.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Vic Wei +Date: Mon, 23 Apr 2018 15:17:07 -0700 +Subject: Bluetooth: btusb: add ID for LiteOn 04ca:301a + +From: Vic Wei + +[ Upstream commit d666fc5479ad76a1bcbe6476d4997cea714bab2d ] + +Contains a QCA6174A chipset, with USB BT. Let's support loading +firmware on it. + +>From usb-devices: +T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 +D: Ver= 2.01 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=04ca ProdID=301a Rev= 0.01 +C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +Signed-off-by: Vic Wei +Signed-off-by: Matthias Kaehlcke +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -276,6 +276,7 @@ static const struct usb_device_id blackl + { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, ++ { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME }, + + /* Broadcom BCM2035 */ + { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, diff --git a/queue-4.17/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch b/queue-4.17/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch new file mode 100644 index 00000000000..bd3a4ba1344 --- /dev/null +++ b/queue-4.17/bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thierry Escande +Date: Tue, 29 May 2018 18:37:16 +0200 +Subject: Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning + +From: Thierry Escande + +[ Upstream commit 9960521c44a5d828f29636ceac0600603ecbddbf ] + +This patch fixes the following warning during boot: + + do not call blocking ops when !TASK_RUNNING; state=1 set at + [<(ptrval)>] qca_setup+0x194/0x750 [hci_uart] + WARNING: CPU: 2 PID: 1878 at kernel/sched/core.c:6135 + __might_sleep+0x7c/0x88 + +In qca_set_baudrate(), the current task state is set to +TASK_UNINTERRUPTIBLE before going to sleep for 300ms. It was then +restored to TASK_INTERRUPTIBLE. This patch sets the current task state +back to TASK_RUNNING instead. + +Signed-off-by: Thierry Escande +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/hci_qca.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -880,7 +880,7 @@ static int qca_set_baudrate(struct hci_d + */ + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS)); +- set_current_state(TASK_INTERRUPTIBLE); ++ set_current_state(TASK_RUNNING); + + return 0; + } diff --git a/queue-4.17/bnxt_en-always-forward-vf-mac-address-to-the-pf.patch b/queue-4.17/bnxt_en-always-forward-vf-mac-address-to-the-pf.patch new file mode 100644 index 00000000000..c437ca34c94 --- /dev/null +++ b/queue-4.17/bnxt_en-always-forward-vf-mac-address-to-the-pf.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Michael Chan +Date: Tue, 8 May 2018 03:18:41 -0400 +Subject: bnxt_en: Always forward VF MAC address to the PF. + +From: Michael Chan + +[ Upstream commit 707e7e96602675beb5e09bb994195663da6eb56d ] + +The current code already forwards the VF MAC address to the PF, except +in one case. If the VF driver gets a valid MAC address from the firmware +during probe time, it will not forward the MAC address to the PF, +incorrectly assuming that the PF already knows the MAC address. This +causes "ip link show" to show zero VF MAC addresses for this case. + +This assumption is not correct. Newer firmware remembers the VF MAC +address last used by the VF and provides it to the VF driver during +probe. So we need to always forward the VF MAC address to the PF. + +The forwarded MAC address may now be the PF assigned MAC address and so we +need to make sure we approve it for this case. + +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8617,8 +8617,8 @@ static int bnxt_init_mac_addr(struct bnx + memcpy(bp->dev->dev_addr, vf->mac_addr, ETH_ALEN); + } else { + eth_hw_addr_random(bp->dev); +- rc = bnxt_approve_mac(bp, bp->dev->dev_addr); + } ++ rc = bnxt_approve_mac(bp, bp->dev->dev_addr); + #endif + } + return rc; +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -914,7 +914,8 @@ static int bnxt_vf_configure_mac(struct + if (req->enables & cpu_to_le32(FUNC_VF_CFG_REQ_ENABLES_DFLT_MAC_ADDR)) { + if (is_valid_ether_addr(req->dflt_mac_addr) && + ((vf->flags & BNXT_VF_TRUST) || +- (!is_valid_ether_addr(vf->mac_addr)))) { ++ !is_valid_ether_addr(vf->mac_addr) || ++ ether_addr_equal(req->dflt_mac_addr, vf->mac_addr))) { + ether_addr_copy(vf->vf_mac_addr, req->dflt_mac_addr); + return bnxt_hwrm_exec_fwd_resp(bp, vf, msg_size); + } diff --git a/queue-4.17/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch b/queue-4.17/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch new file mode 100644 index 00000000000..402301de8f6 --- /dev/null +++ b/queue-4.17/bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Michael Chan +Date: Tue, 8 May 2018 03:18:39 -0400 +Subject: bnxt_en: Check unsupported speeds in bnxt_update_link() on PF only. + +From: Michael Chan + +[ Upstream commit dac0490718bd17df5e3995ffca14255e5f9ed22d ] + +Only non-NPAR PFs need to actively check and manage unsupported link +speeds. NPAR functions and VFs do not control the link speed and +should skip the unsupported speed detection logic, to avoid warning +messages from firmware rejecting the unsupported firmware calls. + +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6457,6 +6457,9 @@ static int bnxt_update_link(struct bnxt + } + mutex_unlock(&bp->hwrm_cmd_lock); + ++ if (!BNXT_SINGLE_PF(bp)) ++ return 0; ++ + diff = link_info->support_auto_speeds ^ link_info->advertising; + if ((link_info->support_auto_speeds | diff) != + link_info->support_auto_speeds) { diff --git a/queue-4.17/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch b/queue-4.17/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch new file mode 100644 index 00000000000..6a3ca4be01a --- /dev/null +++ b/queue-4.17/bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wang YanQing +Date: Fri, 11 May 2018 10:52:17 +0800 +Subject: bpf, arm32: fix inconsistent naming about emit_a32_lsr_{r64,i64} + +From: Wang YanQing + +[ Upstream commit 68565a1af9f7012e6f2fe2bdd612f67d2d830c28 ] + +The names for BPF_ALU64 | BPF_ARSH are emit_a32_arsh_*, +the names for BPF_ALU64 | BPF_LSH are emit_a32_lsh_*, but +the names for BPF_ALU64 | BPF_RSH are emit_a32_lsr_*. + +For consistence reason, let's rename emit_a32_lsr_* to +emit_a32_rsh_*. + +This patch also corrects a wrong comment. + +Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") +Signed-off-by: Wang YanQing +Cc: Shubham Bansal +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux@armlinux.org.uk +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/net/bpf_jit_32.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -708,7 +708,7 @@ static inline void emit_a32_arsh_r64(con + } + + /* dst = dst >> src */ +-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk, ++static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk, + bool sstk, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -724,7 +724,7 @@ static inline void emit_a32_lsr_r64(cons + emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx); + } + +- /* Do LSH operation */ ++ /* Do RSH operation */ + emit(ARM_RSB_I(ARM_IP, rt, 32), ctx); + emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx); + emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx); +@@ -774,7 +774,7 @@ static inline void emit_a32_lsh_i64(cons + } + + /* dst = dst >> val */ +-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk, ++static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk, + const u32 val, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -1330,7 +1330,7 @@ static int build_insn(const struct bpf_i + case BPF_ALU64 | BPF_RSH | BPF_K: + if (unlikely(imm > 63)) + return -EINVAL; +- emit_a32_lsr_i64(dst, dstk, imm, ctx); ++ emit_a32_rsh_i64(dst, dstk, imm, ctx); + break; + /* dst = dst << src */ + case BPF_ALU64 | BPF_LSH | BPF_X: +@@ -1338,7 +1338,7 @@ static int build_insn(const struct bpf_i + break; + /* dst = dst >> src */ + case BPF_ALU64 | BPF_RSH | BPF_X: +- emit_a32_lsr_r64(dst, src, dstk, sstk, ctx); ++ emit_a32_rsh_r64(dst, src, dstk, sstk, ctx); + break; + /* dst = dst >> src (signed) */ + case BPF_ALU64 | BPF_ARSH | BPF_X: diff --git a/queue-4.17/bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch b/queue-4.17/bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch new file mode 100644 index 00000000000..2b621728e32 --- /dev/null +++ b/queue-4.17/bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sandipan Das +Date: Thu, 24 May 2018 12:26:51 +0530 +Subject: bpf: fix multi-function JITed dump obtained via syscall + +From: Sandipan Das + +[ Upstream commit 4d56a76ead2fcd856e677cdc9445ad331a409b8c ] + +Currently, for multi-function programs, we cannot get the JITed +instructions using the bpf system call's BPF_OBJ_GET_INFO_BY_FD +command. Because of this, userspace tools such as bpftool fail +to identify a multi-function program as being JITed or not. + +With the JIT enabled and the test program running, this can be +verified as follows: + + # cat /proc/sys/net/core/bpf_jit_enable + 1 + +Before applying this patch: + + # bpftool prog list + 1: kprobe name foo tag b811aab41a39ad3d gpl + loaded_at 2018-05-16T11:43:38+0530 uid 0 + xlated 216B not jited memlock 65536B + ... + + # bpftool prog dump jited id 1 + no instructions returned + +After applying this patch: + + # bpftool prog list + 1: kprobe name foo tag b811aab41a39ad3d gpl + loaded_at 2018-05-16T12:13:01+0530 uid 0 + xlated 216B jited 308B memlock 65536B + ... + + # bpftool prog dump jited id 1 + 0: nop + 4: nop + 8: mflr r0 + c: std r0,16(r1) + 10: stdu r1,-112(r1) + 14: std r31,104(r1) + 18: addi r31,r1,48 + 1c: li r3,10 + ... + +Signed-off-by: Sandipan Das +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/syscall.c | 37 ++++++++++++++++++++++++++++++++++--- + 1 file changed, 34 insertions(+), 3 deletions(-) + +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1946,13 +1946,44 @@ static int bpf_prog_get_info_by_fd(struc + * for offload. + */ + ulen = info.jited_prog_len; +- info.jited_prog_len = prog->jited_len; ++ if (prog->aux->func_cnt) { ++ u32 i; ++ ++ info.jited_prog_len = 0; ++ for (i = 0; i < prog->aux->func_cnt; i++) ++ info.jited_prog_len += prog->aux->func[i]->jited_len; ++ } else { ++ info.jited_prog_len = prog->jited_len; ++ } ++ + if (info.jited_prog_len && ulen) { + if (bpf_dump_raw_ok()) { + uinsns = u64_to_user_ptr(info.jited_prog_insns); + ulen = min_t(u32, info.jited_prog_len, ulen); +- if (copy_to_user(uinsns, prog->bpf_func, ulen)) +- return -EFAULT; ++ ++ /* for multi-function programs, copy the JITed ++ * instructions for all the functions ++ */ ++ if (prog->aux->func_cnt) { ++ u32 len, free, i; ++ u8 *img; ++ ++ free = ulen; ++ for (i = 0; i < prog->aux->func_cnt; i++) { ++ len = prog->aux->func[i]->jited_len; ++ len = min_t(u32, len, free); ++ img = (u8 *) prog->aux->func[i]->bpf_func; ++ if (copy_to_user(uinsns, img, len)) ++ return -EFAULT; ++ uinsns += len; ++ free -= len; ++ if (!free) ++ break; ++ } ++ } else { ++ if (copy_to_user(uinsns, prog->bpf_func, ulen)) ++ return -EFAULT; ++ } + } else { + info.jited_prog_insns = 0; + } diff --git a/queue-4.17/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch b/queue-4.17/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch new file mode 100644 index 00000000000..7d81987d0fb --- /dev/null +++ b/queue-4.17/bpf-fix-references-to-free_bpf_prog_info-in-comments.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jakub Kicinski +Date: Thu, 3 May 2018 18:37:17 -0700 +Subject: bpf: fix references to free_bpf_prog_info() in comments + +From: Jakub Kicinski + +[ Upstream commit ab7f5bf0928be2f148d000a6eaa6c0a36e74750e ] + +Comments in the verifier refer to free_bpf_prog_info() which +seems to have never existed in tree. Replace it with +free_used_maps(). + +Signed-off-by: Jakub Kicinski +Reviewed-by: Quentin Monnet +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5065,7 +5065,7 @@ static int replace_map_fd_with_map_ptr(s + /* hold the map. If the program is rejected by verifier, + * the map will be released by release_maps() or it + * will be used by the valid program until it's unloaded +- * and all maps are released in free_bpf_prog_info() ++ * and all maps are released in free_used_maps() + */ + map = bpf_map_inc(map, false); + if (IS_ERR(map)) { +@@ -5856,7 +5856,7 @@ skip_full_check: + err_release_maps: + if (!env->prog->aux->used_maps) + /* if we didn't copy map pointers into bpf_prog_info, release +- * them now. Otherwise free_bpf_prog_info() will release them. ++ * them now. Otherwise free_used_maps() will release them. + */ + release_maps(env); + *prog = env->prog; diff --git a/queue-4.17/bpf-powerpc64-pad-function-address-loads-with-nops.patch b/queue-4.17/bpf-powerpc64-pad-function-address-loads-with-nops.patch new file mode 100644 index 00000000000..9945d94770d --- /dev/null +++ b/queue-4.17/bpf-powerpc64-pad-function-address-loads-with-nops.patch @@ -0,0 +1,82 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sandipan Das +Date: Thu, 24 May 2018 12:26:46 +0530 +Subject: bpf: powerpc64: pad function address loads with NOPs + +From: Sandipan Das + +[ Upstream commit 4ea69b2fd623dee2bbc77d3b6b7d8c0924e2026a ] + +For multi-function programs, loading the address of a callee +function to a register requires emitting instructions whose +count varies from one to five depending on the nature of the +address. + +Since we come to know of the callee's address only before the +extra pass, the number of instructions required to load this +address may vary from what was previously generated. This can +make the JITed image grow or shrink. + +To avoid this, we should generate a constant five-instruction +when loading function addresses by padding the optimized load +sequence with NOPs. + +Signed-off-by: Sandipan Das +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/net/bpf_jit_comp64.c | 34 +++++++++++++++++++++++----------- + 1 file changed, 23 insertions(+), 11 deletions(-) + +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -202,25 +202,37 @@ static void bpf_jit_build_epilogue(u32 * + + static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func) + { ++ unsigned int i, ctx_idx = ctx->idx; ++ ++ /* Load function address into r12 */ ++ PPC_LI64(12, func); ++ ++ /* For bpf-to-bpf function calls, the callee's address is unknown ++ * until the last extra pass. As seen above, we use PPC_LI64() to ++ * load the callee's address, but this may optimize the number of ++ * instructions required based on the nature of the address. ++ * ++ * Since we don't want the number of instructions emitted to change, ++ * we pad the optimized PPC_LI64() call with NOPs to guarantee that ++ * we always have a five-instruction sequence, which is the maximum ++ * that PPC_LI64() can emit. ++ */ ++ for (i = ctx->idx - ctx_idx; i < 5; i++) ++ PPC_NOP(); ++ + #ifdef PPC64_ELF_ABI_v1 +- /* func points to the function descriptor */ +- PPC_LI64(b2p[TMP_REG_2], func); +- /* Load actual entry point from function descriptor */ +- PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0); +- /* ... and move it to LR */ +- PPC_MTLR(b2p[TMP_REG_1]); + /* + * Load TOC from function descriptor at offset 8. + * We can clobber r2 since we get called through a + * function pointer (so caller will save/restore r2) + * and since we don't use a TOC ourself. + */ +- PPC_BPF_LL(2, b2p[TMP_REG_2], 8); +-#else +- /* We can clobber r12 */ +- PPC_FUNC_ADDR(12, func); +- PPC_MTLR(12); ++ PPC_BPF_LL(2, 12, 8); ++ /* Load actual entry point from function descriptor */ ++ PPC_BPF_LL(12, 12, 0); + #endif ++ ++ PPC_MTLR(12); + PPC_BLRL(); + } + diff --git a/queue-4.17/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch b/queue-4.17/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch new file mode 100644 index 00000000000..56988aba13d --- /dev/null +++ b/queue-4.17/brcmfmac-add-support-for-bcm43364-wireless-chipset.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sean Lanigan +Date: Fri, 4 May 2018 16:48:23 +1000 +Subject: brcmfmac: Add support for bcm43364 wireless chipset + +From: Sean Lanigan + +[ Upstream commit 9c4a121e82634aa000a702c98cd6f05b27d6e186 ] + +Add support for the BCM43364 chipset via an SDIO interface, as used in +e.g. the Murata 1FX module. + +The BCM43364 uses the same firmware as the BCM43430 (which is already +included), the only difference is the omission of Bluetooth. + +However, the SDIO_ID for the BCM43364 is 02D0:A9A4, giving it a MODALIAS +of sdio:c00v02D0dA9A4, which doesn't get recognised and hence doesn't +load the brcmfmac module. Adding the 'A9A4' ID in the appropriate place +triggers the brcmfmac driver to load, and then correctly use the +firmware file 'brcmfmac43430-sdio.bin'. + +Signed-off-by: Sean Lanigan +Acked-by: Ulf Hansson +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c | 1 + + include/linux/mmc/sdio_ids.h | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -963,6 +963,7 @@ static const struct sdio_device_id brcmf + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430), +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -35,6 +35,7 @@ + #define SDIO_DEVICE_ID_BROADCOM_4335_4339 0x4335 + #define SDIO_DEVICE_ID_BROADCOM_4339 0x4339 + #define SDIO_DEVICE_ID_BROADCOM_43362 0xa962 ++#define SDIO_DEVICE_ID_BROADCOM_43364 0xa9a4 + #define SDIO_DEVICE_ID_BROADCOM_43430 0xa9a6 + #define SDIO_DEVICE_ID_BROADCOM_4345 0x4345 + #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf diff --git a/queue-4.17/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch b/queue-4.17/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch new file mode 100644 index 00000000000..1dc9ba8286c --- /dev/null +++ b/queue-4.17/btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch @@ -0,0 +1,97 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: David Sterba +Date: Tue, 24 Apr 2018 14:53:56 +0200 +Subject: btrfs: add barriers to btrfs_sync_log before log_commit_wait wakeups + +From: David Sterba + +[ Upstream commit 3d3a2e610ea5e7c6d4f9481ecce5d8e2d8317843 ] + +Currently the code assumes that there's an implied barrier by the +sequence of code preceding the wakeup, namely the mutex unlock. + +As Nikolay pointed out: + +I think this is wrong (not your code) but the original assumption that +the RELEASE semantics provided by mutex_unlock is sufficient. +According to memory-barriers.txt: + +Section 'LOCK ACQUISITION FUNCTIONS' states: + + (2) RELEASE operation implication: + + Memory operations issued before the RELEASE will be completed before the + RELEASE operation has completed. + + Memory operations issued after the RELEASE *may* be completed before the + RELEASE operation has completed. + +(I've bolded the may portion) + +The example given there: + +As an example, consider the following: + + *A = a; + *B = b; + ACQUIRE + *C = c; + *D = d; + RELEASE + *E = e; + *F = f; + +The following sequence of events is acceptable: + + ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE + +So if we assume that *C is modifying the flag which the waitqueue is checking, +and *E is the actual wakeup, then those accesses can be re-ordered... + +IMHO this code should be considered broken... +Signed-off-by: Greg Kroah-Hartman +--- + +To be on the safe side, add the barriers. The synchronization logic +around log using the mutexes and several other threads does not make it +easy to reason for/against the barrier. + +CC: Nikolay Borisov +Link: https://lkml.kernel.org/r/6ee068d8-1a69-3728-00d1-d86293d43c9f@suse.com +Reviewed-by: Nikolay Borisov +Signed-off-by: David Sterba + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/tree-log.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3116,8 +3116,11 @@ out_wake_log_root: + mutex_unlock(&log_root_tree->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&log_root_tree->log_commit_wait[index2])) + wake_up(&log_root_tree->log_commit_wait[index2]); + out: +@@ -3128,8 +3131,11 @@ out: + mutex_unlock(&root->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&root->log_commit_wait[index1])) + wake_up(&root->log_commit_wait[index1]); + return ret; diff --git a/queue-4.17/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch b/queue-4.17/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch new file mode 100644 index 00000000000..ae0d0bd28c1 --- /dev/null +++ b/queue-4.17/btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch @@ -0,0 +1,89 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ethan Lien +Date: Mon, 28 May 2018 13:48:20 +0800 +Subject: btrfs: balance dirty metadata pages in btrfs_finish_ordered_io + +From: Ethan Lien + +[ Upstream commit e73e81b6d0114d4a303205a952ab2e87c44bd279 ] + +[Problem description and how we fix it] +We should balance dirty metadata pages at the end of +btrfs_finish_ordered_io, since a small, unmergeable random write can +potentially produce dirty metadata which is multiple times larger than +the data itself. For example, a small, unmergeable 4KiB write may +produce: + + 16KiB dirty leaf (and possibly 16KiB dirty node) in subvolume tree + 16KiB dirty leaf (and possibly 16KiB dirty node) in checksum tree + 16KiB dirty leaf (and possibly 16KiB dirty node) in extent tree + +Although we do call balance dirty pages in write side, but in the +buffered write path, most metadata are dirtied only after we reach the +dirty background limit (which by far only counts dirty data pages) and +wakeup the flusher thread. If there are many small, unmergeable random +writes spread in a large btree, we'll find a burst of dirty pages +exceeds the dirty_bytes limit after we wakeup the flusher thread - which +is not what we expect. In our machine, it caused out-of-memory problem +since a page cannot be dropped if it is marked dirty. + +Someone may worry about we may sleep in btrfs_btree_balance_dirty_nodelay, +but since we do btrfs_finish_ordered_io in a separate worker, it will not +stop the flusher consuming dirty pages. Also, we use different worker for +metadata writeback endio, sleep in btrfs_finish_ordered_io help us throttle +the size of dirty metadata pages. + +[Reproduce steps] +To reproduce the problem, we need to do 4KiB write randomly spread in a +large btree. In our 2GiB RAM machine: + +1) Create 4 subvolumes. +2) Run fio on each subvolume: + + [global] + direct=0 + rw=randwrite + ioengine=libaio + bs=4k + iodepth=16 + numjobs=1 + group_reporting + size=128G + runtime=1800 + norandommap + time_based + randrepeat=0 + +3) Take snapshot on each subvolume and repeat fio on existing files. +4) Repeat step (3) until we get large btrees. + In our case, by observing btrfs_root_item->bytes_used, we have 2GiB of + metadata in each subvolume tree and 12GiB of metadata in extent tree. +5) Stop all fio, take snapshot again, and wait until all delayed work is + completed. +6) Start all fio. Few seconds later we hit OOM when the flusher starts + to work. + +It can be reproduced even when using nocow write. + +Signed-off-by: Ethan Lien +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3160,6 +3160,9 @@ out: + /* once for the tree */ + btrfs_put_ordered_extent(ordered_extent); + ++ /* Try to release some metadata so we don't get an OOM but don't wait */ ++ btrfs_btree_balance_dirty_nodelay(fs_info); ++ + return ret; + } + diff --git a/queue-4.17/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch b/queue-4.17/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch new file mode 100644 index 00000000000..f0649483a06 --- /dev/null +++ b/queue-4.17/btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Omar Sandoval +Date: Fri, 11 May 2018 13:13:31 -0700 +Subject: Btrfs: don't BUG_ON() in btrfs_truncate_inode_items() + +From: Omar Sandoval + +[ Upstream commit 0552210997badb6a60740a26ff9d976a416510f0 ] + +btrfs_free_extent() can fail because of ENOMEM. There's no reason to +panic here, we can just abort the transaction. + +Fixes: f4b9aa8d3b87 ("btrfs_truncate") +Reviewed-by: Nikolay Borisov +Signed-off-by: Omar Sandoval +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4671,7 +4671,10 @@ delete: + extent_num_bytes, 0, + btrfs_header_owner(leaf), + ino, extent_offset); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + if (btrfs_should_throttle_delayed_refs(trans, fs_info)) + btrfs_async_run_delayed_refs(fs_info, + trans->delayed_ref_updates * 2, diff --git a/queue-4.17/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch b/queue-4.17/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch new file mode 100644 index 00000000000..6ae29848c5b --- /dev/null +++ b/queue-4.17/btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Omar Sandoval +Date: Fri, 11 May 2018 13:13:35 -0700 +Subject: Btrfs: don't return ino to ino cache if inode item removal fails + +From: Omar Sandoval + +[ Upstream commit c08db7d8d295a4f3a10faaca376de011afff7950 ] + +In btrfs_evict_inode(), if btrfs_truncate_inode_items() fails, the inode +item will still be in the tree but we still return the ino to the ino +cache. That will blow up later when someone tries to allocate that ino, +so don't return it to the cache. + +Fixes: 581bb050941b ("Btrfs: Cache free inode numbers in memory") +Reviewed-by: Josef Bacik +Signed-off-by: Omar Sandoval +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -5426,13 +5426,18 @@ void btrfs_evict_inode(struct inode *ino + trans->block_rsv = rsv; + + ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0); +- if (ret != -ENOSPC && ret != -EAGAIN) ++ if (ret) { ++ trans->block_rsv = &fs_info->trans_block_rsv; ++ btrfs_end_transaction(trans); ++ btrfs_btree_balance_dirty(fs_info); ++ if (ret != -ENOSPC && ret != -EAGAIN) { ++ btrfs_orphan_del(NULL, BTRFS_I(inode)); ++ btrfs_free_block_rsv(fs_info, rsv); ++ goto no_delete; ++ } ++ } else { + break; +- +- trans->block_rsv = &fs_info->trans_block_rsv; +- btrfs_end_transaction(trans); +- trans = NULL; +- btrfs_btree_balance_dirty(fs_info); ++ } + } + + btrfs_free_block_rsv(fs_info, rsv); +@@ -5441,12 +5446,8 @@ void btrfs_evict_inode(struct inode *ino + * Errors here aren't a big deal, it just means we leave orphan items + * in the tree. They will be cleaned up on the next mount. + */ +- if (ret == 0) { +- trans->block_rsv = root->orphan_block_rsv; +- btrfs_orphan_del(trans, BTRFS_I(inode)); +- } else { +- btrfs_orphan_del(NULL, BTRFS_I(inode)); +- } ++ trans->block_rsv = root->orphan_block_rsv; ++ btrfs_orphan_del(trans, BTRFS_I(inode)); + + trans->block_rsv = &fs_info->trans_block_rsv; + if (!(root == fs_info->tree_root || diff --git a/queue-4.17/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch b/queue-4.17/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch new file mode 100644 index 00000000000..3856fef42db --- /dev/null +++ b/queue-4.17/btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch @@ -0,0 +1,110 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Qu Wenruo +Date: Mon, 14 May 2018 09:38:13 +0800 +Subject: btrfs: qgroup: Finish rescan when hit the last leaf of extent tree + +From: Qu Wenruo + +[ Upstream commit ff3d27a048d926b3920ccdb75d98788c567cae0d ] + +Under the following case, qgroup rescan can double account cowed tree +blocks: + +In this case, extent tree only has one tree block. + +- +| transid=5 last committed=4 +| btrfs_qgroup_rescan_worker() +| |- btrfs_start_transaction() +| | transid = 5 +| |- qgroup_rescan_leaf() +| |- btrfs_search_slot_for_read() on extent tree +| Get the only extent tree block from commit root (transid = 4). +| Scan it, set qgroup_rescan_progress to the last +| EXTENT/META_ITEM + 1 +| now qgroup_rescan_progress = A + 1. +| +| fs tree get CoWed, new tree block is at A + 16K +| transid 5 get committed +- +| transid=6 last committed=5 +| btrfs_qgroup_rescan_worker() +| btrfs_qgroup_rescan_worker() +| |- btrfs_start_transaction() +| | transid = 5 +| |- qgroup_rescan_leaf() +| |- btrfs_search_slot_for_read() on extent tree +| Get the only extent tree block from commit root (transid = 5). +| scan it using qgroup_rescan_progress (A + 1). +| found new tree block beyong A, and it's fs tree block, +| account it to increase qgroup numbers. +- + +In above case, tree block A, and tree block A + 16K get accounted twice, +while qgroup rescan should stop when it already reach the last leaf, +other than continue using its qgroup_rescan_progress. + +Such case could happen by just looping btrfs/017 and with some +possibility it can hit such double qgroup accounting problem. + +Fix it by checking the path to determine if we should finish qgroup +rescan, other than relying on next loop to exit. + +Reported-by: Nikolay Borisov +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/qgroup.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2580,6 +2580,21 @@ out: + } + + /* ++ * Check if the leaf is the last leaf. Which means all node pointers ++ * are at their last position. ++ */ ++static bool is_last_leaf(struct btrfs_path *path) ++{ ++ int i; ++ ++ for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) { ++ if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1) ++ return false; ++ } ++ return true; ++} ++ ++/* + * returns < 0 on error, 0 when more leafs are to be scanned. + * returns 1 when done. + */ +@@ -2592,6 +2607,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info + struct ulist *roots = NULL; + struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem); + u64 num_bytes; ++ bool done; + int slot; + int ret; + +@@ -2620,6 +2636,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info + mutex_unlock(&fs_info->qgroup_rescan_lock); + return ret; + } ++ done = is_last_leaf(path); + + btrfs_item_key_to_cpu(path->nodes[0], &found, + btrfs_header_nritems(path->nodes[0]) - 1); +@@ -2666,6 +2683,8 @@ out: + } + btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem); + ++ if (done && !ret) ++ ret = 1; + return ret; + } + diff --git a/queue-4.17/ceph-fix-alignment-of-rasize.patch b/queue-4.17/ceph-fix-alignment-of-rasize.patch new file mode 100644 index 00000000000..8eee2f1e6b9 --- /dev/null +++ b/queue-4.17/ceph-fix-alignment-of-rasize.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chengguang Xu +Date: Wed, 30 May 2018 10:13:11 +0800 +Subject: ceph: fix alignment of rasize + +From: Chengguang Xu + +[ Upstream commit c36ed50de2ad1649ce0369a4a6fc2cc11b20dfb7 ] + +On currently logic: +when I specify rasize=0~1 then it will be 4096. +when I specify rasize=2~4097 then it will be 8192. + +Make it the same as rsize & wsize. + +Signed-off-by: Chengguang Xu +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -268,7 +268,7 @@ static int parse_fsopt_token(char *c, vo + case Opt_rasize: + if (intval < 0) + return -EINVAL; +- fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE); ++ fsopt->rasize = ALIGN(intval, PAGE_SIZE); + break; + case Opt_caps_wanted_delay_min: + if (intval < 1) diff --git a/queue-4.17/ceph-fix-use-after-free-in-ceph_statfs.patch b/queue-4.17/ceph-fix-use-after-free-in-ceph_statfs.patch new file mode 100644 index 00000000000..3bd77cee173 --- /dev/null +++ b/queue-4.17/ceph-fix-use-after-free-in-ceph_statfs.patch @@ -0,0 +1,110 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Luis Henriques +Date: Mon, 28 May 2018 18:37:40 +0100 +Subject: ceph: fix use-after-free in ceph_statfs() + +From: Luis Henriques + +[ Upstream commit 73fb0949cf246b212ff63d692a0ec88db954bb35 ] + +KASAN found an UAF in ceph_statfs. This was a one-off bug but looking at +the code it looks like the monmap access needs to be protected as it can +be modified while we're accessing it. Fix this by protecting the access +with the monc->mutex. + + BUG: KASAN: use-after-free in ceph_statfs+0x21d/0x2c0 + Read of size 8 at addr ffff88006844f2e0 by task trinity-c5/304 + + CPU: 0 PID: 304 Comm: trinity-c5 Not tainted 4.17.0-rc6+ #172 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.0.0-prebuilt.qemu-project.org 04/01/2014 + Call Trace: + dump_stack+0xa5/0x11b + ? show_regs_print_info+0x5/0x5 + ? kmsg_dump_rewind+0x118/0x118 + ? ceph_statfs+0x21d/0x2c0 + print_address_description+0x73/0x2b0 + ? ceph_statfs+0x21d/0x2c0 + kasan_report+0x243/0x360 + ceph_statfs+0x21d/0x2c0 + ? ceph_umount_begin+0x80/0x80 + ? kmem_cache_alloc+0xdf/0x1a0 + statfs_by_dentry+0x79/0xb0 + vfs_statfs+0x28/0x110 + user_statfs+0x8c/0xe0 + ? vfs_statfs+0x110/0x110 + ? __fdget_raw+0x10/0x10 + __se_sys_statfs+0x5d/0xa0 + ? user_statfs+0xe0/0xe0 + ? mutex_unlock+0x1d/0x40 + ? __x64_sys_statfs+0x20/0x30 + do_syscall_64+0xee/0x290 + ? syscall_return_slowpath+0x1c0/0x1c0 + ? page_fault+0x1e/0x30 + ? syscall_return_slowpath+0x13c/0x1c0 + ? prepare_exit_to_usermode+0xdb/0x140 + ? syscall_trace_enter+0x330/0x330 + ? __put_user_4+0x1c/0x30 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + Allocated by task 130: + __kmalloc+0x124/0x210 + ceph_monmap_decode+0x1c1/0x400 + dispatch+0x113/0xd20 + ceph_con_workfn+0xa7e/0x44e0 + process_one_work+0x5f0/0xa30 + worker_thread+0x184/0xa70 + kthread+0x1a0/0x1c0 + ret_from_fork+0x35/0x40 + + Freed by task 130: + kfree+0xb8/0x210 + dispatch+0x15a/0xd20 + ceph_con_workfn+0xa7e/0x44e0 + process_one_work+0x5f0/0xa30 + worker_thread+0x184/0xa70 + kthread+0x1a0/0x1c0 + ret_from_fork+0x35/0x40 + +Signed-off-by: Luis Henriques +Reviewed-by: "Yan, Zheng" +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/super.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -45,7 +45,7 @@ static void ceph_put_super(struct super_ + static int ceph_statfs(struct dentry *dentry, struct kstatfs *buf) + { + struct ceph_fs_client *fsc = ceph_inode_to_client(d_inode(dentry)); +- struct ceph_monmap *monmap = fsc->client->monc.monmap; ++ struct ceph_mon_client *monc = &fsc->client->monc; + struct ceph_statfs st; + u64 fsid; + int err; +@@ -58,7 +58,7 @@ static int ceph_statfs(struct dentry *de + } + + dout("statfs\n"); +- err = ceph_monc_do_statfs(&fsc->client->monc, data_pool, &st); ++ err = ceph_monc_do_statfs(monc, data_pool, &st); + if (err < 0) + return err; + +@@ -94,8 +94,11 @@ static int ceph_statfs(struct dentry *de + buf->f_namelen = NAME_MAX; + + /* Must convert the fsid, for consistent values across arches */ +- fsid = le64_to_cpu(*(__le64 *)(&monmap->fsid)) ^ +- le64_to_cpu(*((__le64 *)&monmap->fsid + 1)); ++ mutex_lock(&monc->mutex); ++ fsid = le64_to_cpu(*(__le64 *)(&monc->monmap->fsid)) ^ ++ le64_to_cpu(*((__le64 *)&monc->monmap->fsid + 1)); ++ mutex_unlock(&monc->mutex); ++ + buf->f_fsid.val[0] = fsid & 0xffffffff; + buf->f_fsid.val[1] = fsid >> 32; + diff --git a/queue-4.17/clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch b/queue-4.17/clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch new file mode 100644 index 00000000000..5714dc65dd4 --- /dev/null +++ b/queue-4.17/clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sekhar Nori +Date: Mon, 7 May 2018 17:04:57 +0530 +Subject: clk: davinci: psc-da830: fix USB0 48MHz PHY clock registration + +From: Sekhar Nori + +[ Upstream commit a714dceb721407c2a5d2887938f37e34ed00669c ] + +USB0 48MHz PHY clock registration fails on DA830 because the +da8xx-cfgchip clock driver cannot get a reference to USB0 +LPSC clock. + +The USB0 LPSC needs to be enabled during PHY clock enable. Setup +the clock lookup correctly to fix this. + +Signed-off-by: Sekhar Nori +Reviewed-by: David Lechner +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/davinci/psc-da830.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clk/davinci/psc-da830.c ++++ b/drivers/clk/davinci/psc-da830.c +@@ -55,7 +55,8 @@ const struct davinci_psc_init_data da830 + .psc_init = &da830_psc0_init, + }; + +-LPSC_CLKDEV2(usb0_clkdev, NULL, "musb-da8xx", ++LPSC_CLKDEV3(usb0_clkdev, "fck", "da830-usb-phy-clks", ++ NULL, "musb-da8xx", + NULL, "cppi41-dmaengine"); + LPSC_CLKDEV1(usb1_clkdev, NULL, "ohci-da8xx"); + /* REVISIT: gpio-davinci.c should be modified to drop con_id */ diff --git a/queue-4.17/clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch b/queue-4.17/clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch new file mode 100644 index 00000000000..2dff18d95c9 --- /dev/null +++ b/queue-4.17/clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Paul Cercueil +Date: Sun, 20 May 2018 16:31:15 +0000 +Subject: clk: ingenic: jz4770: Modify C1CLK clock to disable CPU clock stop on idle + +From: Paul Cercueil + +[ Upstream commit 45ba63a29fd9b8a461110185e3abc5b4c90b806a ] + +When the main processor goes idle, by default its clock is stopped. +However, this also stops the clock of the co-processor. + +Here, if the C1CLK clock is enabled, we disable this functionality. + +Signed-off-by: Paul Cercueil +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/ingenic/jz4770-cgu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/clk/ingenic/jz4770-cgu.c ++++ b/drivers/clk/ingenic/jz4770-cgu.c +@@ -194,9 +194,10 @@ static const struct ingenic_cgu_clk_info + .div = { CGU_REG_CPCCR, 16, 1, 4, 22, -1, -1 }, + }, + [JZ4770_CLK_C1CLK] = { +- "c1clk", CGU_CLK_DIV, ++ "c1clk", CGU_CLK_DIV | CGU_CLK_GATE, + .parents = { JZ4770_CLK_PLL0, }, + .div = { CGU_REG_CPCCR, 12, 1, 4, 22, -1, -1 }, ++ .gate = { CGU_REG_OPCR, 31, true }, // disable CCLK stop on idle + }, + [JZ4770_CLK_PCLK] = { + "pclk", CGU_CLK_DIV, diff --git a/queue-4.17/clk-si544-properly-round-requested-frequency-to-nearest-match.patch b/queue-4.17/clk-si544-properly-round-requested-frequency-to-nearest-match.patch new file mode 100644 index 00000000000..1c21bc09e5d --- /dev/null +++ b/queue-4.17/clk-si544-properly-round-requested-frequency-to-nearest-match.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mike Looijmans +Date: Thu, 31 May 2018 16:03:55 +0200 +Subject: clk-si544: Properly round requested frequency to nearest match + +From: Mike Looijmans + +[ Upstream commit 4d3f36c5e9ca0f947eed71660239c529c501141a ] + +The si544 driver had a rounding problem that using the result of clk_round_rate +may set the clock to yet another rate, for example: +clk_round_rate(195000000) = 194999999 +clk_round_rate(194999999) = 194999998 + +Clients would expect that after clk_set_rate(clk, freq2=clk_round_rate(clk, freq)) the +chip will be running at exactly freq2. + +The problem was in the calculation of the feedback divider, it was always rounded +down instead of to the nearest possible VCO value. + +After this change, the following holds true for any supported frequency: +actual_freq = clk_round_rate(clk, freq); +clk_set_rate(clk, actual_freq); +clk_round_rate(clk, actual_freq) == actual_freq && clk_get_rate(clk) == actual_freq + +Signed-off-by: Mike Looijmans +Fixes: 953cc3e81170 ("clk: Add driver for the si544 clock generator chip") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk-si544.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/clk/clk-si544.c ++++ b/drivers/clk/clk-si544.c +@@ -207,6 +207,7 @@ static int si544_calc_muldiv(struct clk_ + + /* And the fractional bits using the remainder */ + vco = (u64)tmp << 32; ++ vco += FXO / 2; /* Round to nearest multiple */ + do_div(vco, FXO); + settings->fb_div_frac = vco; + diff --git a/queue-4.17/clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch b/queue-4.17/clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch new file mode 100644 index 00000000000..3de388e8a11 --- /dev/null +++ b/queue-4.17/clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Wed, 16 May 2018 21:59:43 +0200 +Subject: clocksource: Move inline keyword to the beginning of function declarations + +From: Mathieu Malaterre + +[ Upstream commit db6f9e55c8d80a4a1a329b9b68a1d370bffb6aad ] + +The inline keyword was not at the beginning of the function declarations. +Fix the following warnings triggered when using W=1: + + kernel/time/clocksource.c:456:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] + kernel/time/clocksource.c:457:1: warning: ‘inline’ is not at beginning of declaration [-Wold-style-declaration] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Thomas Gleixner +Cc: Stephen Boyd +Cc: John Stultz +Link: https://lkml.kernel.org/r/20180516195943.31924-1-malat@debian.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/clocksource.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -453,8 +453,8 @@ static inline int __clocksource_watchdog + static bool clocksource_is_watchdog(struct clocksource *cs) { return false; } + void clocksource_mark_unstable(struct clocksource *cs) { } + +-static void inline clocksource_watchdog_lock(unsigned long *flags) { } +-static void inline clocksource_watchdog_unlock(unsigned long *flags) { } ++static inline void clocksource_watchdog_lock(unsigned long *flags) { } ++static inline void clocksource_watchdog_unlock(unsigned long *flags) { } + + #endif /* CONFIG_CLOCKSOURCE_WATCHDOG */ + diff --git a/queue-4.17/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch b/queue-4.17/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch new file mode 100644 index 00000000000..501224337d1 --- /dev/null +++ b/queue-4.17/crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Tudor-Dan Ambarus +Date: Tue, 3 Apr 2018 09:39:00 +0300 +Subject: crypto: authenc - don't leak pointers to authenc keys + +From: Tudor-Dan Ambarus + +[ Upstream commit ad2fdcdf75d169e7a5aec6c7cb421c0bec8ec711 ] + +In crypto_authenc_setkey we save pointers to the authenc keys in +a local variable of type struct crypto_authenc_keys and we don't +zeroize it after use. Fix this and don't leak pointers to the +authenc keys. + +Signed-off-by: Tudor Ambarus +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/authenc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -108,6 +108,7 @@ static int crypto_authenc_setkey(struct + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: diff --git a/queue-4.17/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch b/queue-4.17/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch new file mode 100644 index 00000000000..44dd57df9ac --- /dev/null +++ b/queue-4.17/crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Tudor-Dan Ambarus +Date: Tue, 3 Apr 2018 09:39:01 +0300 +Subject: crypto: authencesn - don't leak pointers to authenc keys + +From: Tudor-Dan Ambarus + +[ Upstream commit 31545df391d58a3bb60e29b1192644a6f2b5a8dd ] + +In crypto_authenc_esn_setkey we save pointers to the authenc keys +in a local variable of type struct crypto_authenc_keys and we don't +zeroize it after use. Fix this and don't leak pointers to the +authenc keys. + +Signed-off-by: Tudor Ambarus +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/authencesn.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/crypto/authencesn.c ++++ b/crypto/authencesn.c +@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(str + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: diff --git a/queue-4.17/delayacct-use-raw_spinlocks.patch b/queue-4.17/delayacct-use-raw_spinlocks.patch new file mode 100644 index 00000000000..4bf0311ae5e --- /dev/null +++ b/queue-4.17/delayacct-use-raw_spinlocks.patch @@ -0,0 +1,101 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sebastian Andrzej Siewior +Date: Mon, 23 Apr 2018 18:10:23 +0200 +Subject: delayacct: Use raw_spinlocks + +From: Sebastian Andrzej Siewior + +[ Upstream commit 02acc80d19edb0d5684c997b2004ad19f9f5236e ] + +try_to_wake_up() might invoke delayacct_blkio_end() while holding the +pi_lock (which is a raw_spinlock_t). delayacct_blkio_end() acquires +task_delay_info.lock which is a spinlock_t. This causes a might sleep splat +on -RT where non raw spinlocks are converted to 'sleeping' spinlocks. + +task_delay_info.lock is only held for a short amount of time so it's not a +problem latency wise to make convert it to a raw spinlock. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Cc: Balbir Singh +Link: https://lkml.kernel.org/r/20180423161024.6710-1-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/delayacct.h | 2 +- + kernel/delayacct.c | 17 +++++++++-------- + 2 files changed, 10 insertions(+), 9 deletions(-) + +--- a/include/linux/delayacct.h ++++ b/include/linux/delayacct.h +@@ -29,7 +29,7 @@ + + #ifdef CONFIG_TASK_DELAY_ACCT + struct task_delay_info { +- spinlock_t lock; ++ raw_spinlock_t lock; + unsigned int flags; /* Private per-task flags */ + + /* For each stat XXX, add following, aligned appropriately +--- a/kernel/delayacct.c ++++ b/kernel/delayacct.c +@@ -44,23 +44,24 @@ void __delayacct_tsk_init(struct task_st + { + tsk->delays = kmem_cache_zalloc(delayacct_cache, GFP_KERNEL); + if (tsk->delays) +- spin_lock_init(&tsk->delays->lock); ++ raw_spin_lock_init(&tsk->delays->lock); + } + + /* + * Finish delay accounting for a statistic using its timestamps (@start), + * accumalator (@total) and @count + */ +-static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count) ++static void delayacct_end(raw_spinlock_t *lock, u64 *start, u64 *total, ++ u32 *count) + { + s64 ns = ktime_get_ns() - *start; + unsigned long flags; + + if (ns > 0) { +- spin_lock_irqsave(lock, flags); ++ raw_spin_lock_irqsave(lock, flags); + *total += ns; + (*count)++; +- spin_unlock_irqrestore(lock, flags); ++ raw_spin_unlock_irqrestore(lock, flags); + } + } + +@@ -127,7 +128,7 @@ int __delayacct_add_tsk(struct taskstats + + /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */ + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + tmp = d->blkio_delay_total + tsk->delays->blkio_delay; + d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp; + tmp = d->swapin_delay_total + tsk->delays->swapin_delay; +@@ -137,7 +138,7 @@ int __delayacct_add_tsk(struct taskstats + d->blkio_count += tsk->delays->blkio_count; + d->swapin_count += tsk->delays->swapin_count; + d->freepages_count += tsk->delays->freepages_count; +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + + return 0; + } +@@ -147,10 +148,10 @@ __u64 __delayacct_blkio_ticks(struct tas + __u64 ret; + unsigned long flags; + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + ret = nsec_to_clock_t(tsk->delays->blkio_delay + + tsk->delays->swapin_delay); +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + return ret; + } + diff --git a/queue-4.17/disable-loading-f2fs-module-on-page_size-4kb.patch b/queue-4.17/disable-loading-f2fs-module-on-page_size-4kb.patch new file mode 100644 index 00000000000..6a6ff032780 --- /dev/null +++ b/queue-4.17/disable-loading-f2fs-module-on-page_size-4kb.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Anatoly Pugachev +Date: Mon, 28 May 2018 02:06:37 +0300 +Subject: disable loading f2fs module on PAGE_SIZE > 4KB + +From: Anatoly Pugachev + +[ Upstream commit 4071e67cffcc5c2a007116a02437471351f550eb ] + +The following patch disables loading of f2fs module on architectures +which have PAGE_SIZE > 4096 , since it is impossible to mount f2fs on +such architectures , log messages are: + +mount: /mnt: wrong fs type, bad option, bad superblock on +/dev/vdiskb1, missing codepage or helper program, or other error. +/dev/vdiskb1: F2FS filesystem, +UUID=1d8b9ca4-2389-4910-af3b-10998969f09c, volume name "" + +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS +filesystem in 1th superblock +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Can't find valid F2FS +filesystem in 2th superblock +May 15 18:03:13 ttip kernel: F2FS-fs (vdiskb1): Invalid +page_cache_size (8192), supports only 4KB + +which was introduced by git commit 5c9b469295fb6b10d98923eab5e79c4edb80ed20 + +tested on git kernel 4.17.0-rc6-00309-gec30dcf7f425 + +with patch applied: + +modprobe: ERROR: could not insert 'f2fs': Invalid argument +May 28 01:40:28 v215 kernel: F2FS not supported on PAGE_SIZE(8192) != 4096 + +Signed-off-by: Anatoly Pugachev +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3063,6 +3063,12 @@ static int __init init_f2fs_fs(void) + { + int err; + ++ if (PAGE_SIZE != F2FS_BLKSIZE) { ++ printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n", ++ PAGE_SIZE, F2FS_BLKSIZE); ++ return -EINVAL; ++ } ++ + f2fs_build_trace_ios(); + + err = init_inodecache(); diff --git a/queue-4.17/dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch b/queue-4.17/dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch new file mode 100644 index 00000000000..c2173332afc --- /dev/null +++ b/queue-4.17/dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Takashi Iwai +Date: Mon, 16 Apr 2018 17:18:19 +0200 +Subject: dma-direct: try reallocation with GFP_DMA32 if possible + +From: Takashi Iwai + +[ Upstream commit de7eab301de78869322104ea13e124c936ad3e1f ] + +As the recent swiotlb bug revealed, we seem to have given up the direct +DMA allocation too early and felt back to swiotlb allocation. The reason +is that swiotlb allocator expected that dma_direct_alloc() would try +harder to get pages even below 64bit DMA mask with GFP_DMA32, but the +function doesn't do that but only deals with GFP_DMA case. + +This patch adds a similar fallback reallocation with GFP_DMA32 as we've +done with GFP_DMA. The condition is that the coherent mask is smaller +than 64bit (i.e. some address limitation), and neither GFP_DMA nor +GFP_DMA32 is set beforehand. + +Signed-off-by: Takashi Iwai +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/dma-direct.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/lib/dma-direct.c ++++ b/lib/dma-direct.c +@@ -84,6 +84,13 @@ again: + __free_pages(page, page_order); + page = NULL; + ++ if (IS_ENABLED(CONFIG_ZONE_DMA32) && ++ dev->coherent_dma_mask < DMA_BIT_MASK(64) && ++ !(gfp & (GFP_DMA32 | GFP_DMA))) { ++ gfp |= GFP_DMA32; ++ goto again; ++ } ++ + if (IS_ENABLED(CONFIG_ZONE_DMA) && + dev->coherent_dma_mask < DMA_BIT_MASK(32) && + !(gfp & GFP_DMA)) { diff --git a/queue-4.17/dma-iommu-fix-compilation-when-config_iommu_dma.patch b/queue-4.17/dma-iommu-fix-compilation-when-config_iommu_dma.patch new file mode 100644 index 00000000000..a2ebc5c24bb --- /dev/null +++ b/queue-4.17/dma-iommu-fix-compilation-when-config_iommu_dma.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Marc Zyngier +Date: Tue, 8 May 2018 13:14:33 +0100 +Subject: dma-iommu: Fix compilation when !CONFIG_IOMMU_DMA + +From: Marc Zyngier + +[ Upstream commit 8a22a3e1e768c309b718f99bd86f9f25a453e0dc ] + +Inclusion of include/dma-iommu.h when CONFIG_IOMMU_DMA is not selected +results in the following splat: + +In file included from drivers/irqchip/irq-gic-v3-mbi.c:20:0: +./include/linux/dma-iommu.h:95:69: error: unknown type name ‘dma_addr_t’ + static inline int iommu_get_msi_cookie(struct iommu_domain *domain, dma_addr_t base) + ^~~~~~~~~~ +./include/linux/dma-iommu.h:108:74: warning: ‘struct list_head’ declared inside parameter list will not be visible outside of this definition or declaration + static inline void iommu_dma_get_resv_regions(struct device *dev, struct list_head *list) + ^~~~~~~~~ +scripts/Makefile.build:312: recipe for target 'drivers/irqchip/irq-gic-v3-mbi.o' failed + +Fix it by including linux/types.h. + +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Cc: Rob Herring +Cc: Jason Cooper +Cc: Ard Biesheuvel +Cc: Srinivas Kandagatla +Cc: Thomas Petazzoni +Cc: Miquel Raynal +Link: https://lkml.kernel.org/r/20180508121438.11301-5-marc.zyngier@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/dma-iommu.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/linux/dma-iommu.h ++++ b/include/linux/dma-iommu.h +@@ -17,6 +17,7 @@ + #define __DMA_IOMMU_H + + #ifdef __KERNEL__ ++#include + #include + + #ifdef CONFIG_IOMMU_DMA diff --git a/queue-4.17/drivers-bus-arm-cci-fix-build-warnings.patch b/queue-4.17/drivers-bus-arm-cci-fix-build-warnings.patch new file mode 100644 index 00000000000..1ea1f1fd978 --- /dev/null +++ b/queue-4.17/drivers-bus-arm-cci-fix-build-warnings.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Arnd Bergmann +Date: Mon, 28 May 2018 17:41:47 +0200 +Subject: drivers/bus: arm-cci: fix build warnings + +From: Arnd Bergmann + +[ Upstream commit 984e9cf1b9eaab08e4f1f082ce49ed2670e99d90 ] + +When the arm-cci driver is enabled, but both CONFIG_ARM_CCI5xx_PMU and +CONFIG_ARM_CCI400_PMU are not, we get a warning about how parts of +the driver are never used: + +drivers/perf/arm-cci.c:1454:29: error: 'cci_pmu_models' defined but not used [-Werror=unused-variable] +drivers/perf/arm-cci.c:693:16: error: 'cci_pmu_event_show' defined but not used [-Werror=unused-function] +drivers/perf/arm-cci.c:685:16: error: 'cci_pmu_format_show' defined but not used [-Werror=unused-function] + +Marking all three functions as __maybe_unused avoids the warnings in +randconfig builds. I'm doing this lacking any ideas for a better fix. + +Fixes: 3de6be7a3dd8 ("drivers/bus: Split Arm CCI driver") +Reviewed-by: Robin Murphy +Signed-off-by: Arnd Bergmann +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/perf/arm-cci.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/perf/arm-cci.c ++++ b/drivers/perf/arm-cci.c +@@ -120,9 +120,9 @@ enum cci_models { + + static void pmu_write_counters(struct cci_pmu *cci_pmu, + unsigned long *mask); +-static ssize_t cci_pmu_format_show(struct device *dev, ++static ssize_t __maybe_unused cci_pmu_format_show(struct device *dev, + struct device_attribute *attr, char *buf); +-static ssize_t cci_pmu_event_show(struct device *dev, ++static ssize_t __maybe_unused cci_pmu_event_show(struct device *dev, + struct device_attribute *attr, char *buf); + + #define CCI_EXT_ATTR_ENTRY(_name, _func, _config) \ +@@ -1466,7 +1466,7 @@ static int cci_pmu_offline_cpu(unsigned + return 0; + } + +-static struct cci_pmu_model cci_pmu_models[] = { ++static __maybe_unused struct cci_pmu_model cci_pmu_models[] = { + #ifdef CONFIG_ARM_CCI400_PMU + [CCI400_R0] = { + .name = "CCI_400", diff --git a/queue-4.17/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch b/queue-4.17/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch new file mode 100644 index 00000000000..eb953a4b176 --- /dev/null +++ b/queue-4.17/drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch @@ -0,0 +1,114 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mark Rutland +Date: Mon, 21 May 2018 18:19:49 +0100 +Subject: drivers/perf: arm-ccn: don't log to dmesg in event_init + +From: Mark Rutland + +[ Upstream commit 1898eb61fbc9703efee886d3abec27a388cf28c3 ] + +The ARM CCN PMU driver uses dev_warn() to complain about parameters in +the user-provided perf_event_attr. This means that under normal +operation (e.g. a single invocation of the perf tool), a number of +messages warnings may be logged to dmesg. + +Tools may issue multiple syscalls to probe for feature support, and +multiple applications (from multiple users) can attempt to open events +simultaneously, so this is not very helpful, even if a user happens to +have access to dmesg. Worse, this can push important information out of +the dmesg ring buffer, and can significantly slow down syscall fuzzers, +vastly increasing the time it takes to find critical bugs. + +Demote the dev_warn() instances to dev_dbg(), as is the case for all +other PMU drivers under drivers/perf/. Users who wish to debug PMU event +initialisation can enable dynamic debug to receive these messages. + +Signed-off-by: Mark Rutland +Cc: Pawel Moll +Cc: Will Deacon +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/perf/arm-ccn.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/perf/arm-ccn.c ++++ b/drivers/perf/arm-ccn.c +@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct + ccn = pmu_to_arm_ccn(event->pmu); + + if (hw->sample_period) { +- dev_warn(ccn->dev, "Sampling not supported!\n"); ++ dev_dbg(ccn->dev, "Sampling not supported!\n"); + return -EOPNOTSUPP; + } + +@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct + event->attr.exclude_kernel || event->attr.exclude_hv || + event->attr.exclude_idle || event->attr.exclude_host || + event->attr.exclude_guest) { +- dev_warn(ccn->dev, "Can't exclude execution levels!\n"); ++ dev_dbg(ccn->dev, "Can't exclude execution levels!\n"); + return -EINVAL; + } + + if (event->cpu < 0) { +- dev_warn(ccn->dev, "Can't provide per-task data!\n"); ++ dev_dbg(ccn->dev, "Can't provide per-task data!\n"); + return -EOPNOTSUPP; + } + /* +@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct + switch (type) { + case CCN_TYPE_MN: + if (node_xp != ccn->mn_id) { +- dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp); + return -EINVAL; + } + break; + case CCN_TYPE_XP: + if (node_xp >= ccn->num_xps) { +- dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp); + return -EINVAL; + } + break; +@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct + break; + default: + if (node_xp >= ccn->num_nodes) { +- dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp); + return -EINVAL; + } + if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) { +- dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n", ++ dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n", + type, node_xp); + return -EINVAL; + } +@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct + if (event_id != e->event) + continue; + if (e->num_ports && port >= e->num_ports) { +- dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n", + port, node_xp); + return -EINVAL; + } + if (e->num_vcs && vc >= e->num_vcs) { +- dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n", + vc, node_xp); + return -EINVAL; + } + valid = 1; + } + if (!valid) { +- dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", + event_id, node_xp); + return -EINVAL; + } diff --git a/queue-4.17/drm-add-dp-psr2-sink-enable-bit.patch b/queue-4.17/drm-add-dp-psr2-sink-enable-bit.patch new file mode 100644 index 00000000000..cf92f0906ad --- /dev/null +++ b/queue-4.17/drm-add-dp-psr2-sink-enable-bit.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: "José Roberto de Souza" +Date: Wed, 28 Mar 2018 15:30:37 -0700 +Subject: drm: Add DP PSR2 sink enable bit + +From: "José Roberto de Souza" + +[ Upstream commit 4f212e40468650e220c1770876c7f25b8e0c1ff5 ] + +To comply with eDP1.4a this bit should be set when enabling PSR2. + +Signed-off-by: José Roberto de Souza +Reviewed-by: Rodrigo Vivi +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20180328223046.16125-1-jose.souza@intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/drm/drm_dp_helper.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/drm/drm_dp_helper.h ++++ b/include/drm/drm_dp_helper.h +@@ -478,6 +478,7 @@ + # define DP_PSR_FRAME_CAPTURE (1 << 3) + # define DP_PSR_SELECTIVE_UPDATE (1 << 4) + # define DP_PSR_IRQ_HPD_WITH_CRC_ERRORS (1 << 5) ++# define DP_PSR_ENABLE_PSR2 (1 << 6) /* eDP 1.4a */ + + #define DP_ADAPTER_CTRL 0x1a0 + # define DP_ADAPTER_CTRL_FORCE_LOAD_SENSE (1 << 0) diff --git a/queue-4.17/drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch b/queue-4.17/drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch new file mode 100644 index 00000000000..2e3533b7d50 --- /dev/null +++ b/queue-4.17/drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mikita Lipski +Date: Thu, 3 May 2018 17:08:51 -0400 +Subject: drm/amd/display: Do not program interrupt status on disabled crtc + +From: Mikita Lipski + +[ Upstream commit 4ea7fc09539bd2399c1fa7acea14529406120d9e ] + +Prevent interrupt programming of a crtc on which the stream is disabled and +it doesn't have an OTG to reference. + +Signed-off-by: Mikita Lipski +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c +@@ -555,6 +555,9 @@ static inline int dm_irq_state(struct am + return 0; + } + ++ if (acrtc->otg_inst == -1) ++ return 0; ++ + irq_source = dal_irq_type + acrtc->otg_inst; + + st = (state == AMDGPU_IRQ_STATE_ENABLE); diff --git a/queue-4.17/drm-amd-display-fix-dim-display-on-dce11.patch b/queue-4.17/drm-amd-display-fix-dim-display-on-dce11.patch new file mode 100644 index 00000000000..e060a59a18e --- /dev/null +++ b/queue-4.17/drm-amd-display-fix-dim-display-on-dce11.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Leo (Sunpeng) Li" +Date: Thu, 29 Mar 2018 17:04:12 -0400 +Subject: drm/amd/display: Fix dim display on DCE11 + +From: "Leo (Sunpeng) Li" + +[ Upstream commit 84ffa80123f56f80145dc638f21dfcbedda5610d ] + +Before programming the input gamma, check that we're not using the +identity correction. + +Signed-off-by: Leo (Sunpeng) Li +Reviewed-by: Anthony Koo +Acked-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c ++++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +@@ -279,7 +279,9 @@ dce110_set_input_transfer_func(struct pi + build_prescale_params(&prescale_params, plane_state); + ipp->funcs->ipp_program_prescale(ipp, &prescale_params); + +- if (plane_state->gamma_correction && dce_use_lut(plane_state->format)) ++ if (plane_state->gamma_correction && ++ !plane_state->gamma_correction->is_identity && ++ dce_use_lut(plane_state->format)) + ipp->funcs->ipp_program_input_lut(ipp, plane_state->gamma_correction); + + if (tf == NULL) { diff --git a/queue-4.17/drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch b/queue-4.17/drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch new file mode 100644 index 00000000000..c8e07484669 --- /dev/null +++ b/queue-4.17/drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch @@ -0,0 +1,64 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Shirish S +Date: Fri, 27 Apr 2018 15:47:21 +0530 +Subject: drm/amd/display: remove need of modeset flag for overlay planes (V2) + +From: Shirish S + +[ Upstream commit a2a330ad66313084c9432b32862aa7e1255da9b4 ] + +This patch is in continuation to the +"843e3c7 drm/amd/display: defer modeset check in dm_update_planes_state" +where we started to eliminate the dependency on +DRM_MODE_ATOMIC_ALLOW_MODESET to be set by the user space, +which as such is not mandatory. + +After deferring, this patch eliminates the dependency on the flag +for overlay planes. + +This has to be done in stages as its a pretty complex and requires thorough +testing before we free primary planes as well from dependency on modeset +flag. + +V2: Simplified the plane type check. + +Signed-off-by: Shirish S +Reviewed-by: Harry Wentland +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -4037,7 +4037,7 @@ static void amdgpu_dm_commit_planes(stru + } + spin_unlock_irqrestore(&crtc->dev->event_lock, flags); + +- if (!pflip_needed) { ++ if (!pflip_needed || plane->type == DRM_PLANE_TYPE_OVERLAY) { + WARN_ON(!dm_new_plane_state->dc_state); + + plane_states_constructed[planes_count] = dm_new_plane_state->dc_state; +@@ -4783,7 +4783,8 @@ static int dm_update_planes_state(struct + + /* Remove any changed/removed planes */ + if (!enable) { +- if (pflip_needed) ++ if (pflip_needed && ++ plane->type != DRM_PLANE_TYPE_OVERLAY) + continue; + + if (!old_plane_crtc) +@@ -4830,7 +4831,8 @@ static int dm_update_planes_state(struct + if (!dm_new_crtc_state->stream) + continue; + +- if (pflip_needed) ++ if (pflip_needed && ++ plane->type != DRM_PLANE_TYPE_OVERLAY) + continue; + + WARN_ON(dm_new_plane_state->dc_state); diff --git a/queue-4.17/drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch b/queue-4.17/drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch new file mode 100644 index 00000000000..733e8d0100f --- /dev/null +++ b/queue-4.17/drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kenneth Feng +Date: Tue, 12 Jun 2018 15:07:37 +0800 +Subject: drm/amd/powerplay: Set higher SCLK&MCLK frequency than dpm7 in OD (v2) + +From: Kenneth Feng + +[ Upstream commit 5c16f36f6f003b4415237acca59384a074cd8030 ] + +Fix the issue that SCLK&MCLK can't be set higher than dpm7 when +OD is enabled in SMU7. + +v2: fix warning (Alex) + +Signed-off-by: Kenneth Feng +Acked-by: Rex Zhu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -3715,14 +3715,17 @@ static int smu7_trim_dpm_states(struct p + static int smu7_generate_dpm_level_enable_mask( + struct pp_hwmgr *hwmgr, const void *input) + { +- int result; ++ int result = 0; + const struct phm_set_power_state_input *states = + (const struct phm_set_power_state_input *)input; + struct smu7_hwmgr *data = (struct smu7_hwmgr *)(hwmgr->backend); + const struct smu7_power_state *smu7_ps = + cast_const_phw_smu7_power_state(states->pnew_state); + +- result = smu7_trim_dpm_states(hwmgr, smu7_ps); ++ /*skip the trim if od is enabled*/ ++ if (!hwmgr->od_enabled) ++ result = smu7_trim_dpm_states(hwmgr, smu7_ps); ++ + if (result) + return result; + diff --git a/queue-4.17/drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch b/queue-4.17/drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch new file mode 100644 index 00000000000..1edd40424f1 --- /dev/null +++ b/queue-4.17/drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch @@ -0,0 +1,71 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Felix Kuehling +Date: Fri, 23 Mar 2018 15:32:30 -0400 +Subject: drm/amdgpu: Avoid reclaim while holding locks taken in MMU notifier + +From: Felix Kuehling + +[ Upstream commit 6e08e0995b8f339fd2a7ee4fa11f17396405ef60 ] + +When an MMU notifier runs in memory reclaim context, it can deadlock +trying to take locks that are already held in the thread causing the +memory reclaim. The solution is to avoid memory reclaim while holding +locks that are taken in MMU notifiers. + +This commit fixes kmalloc while holding rmn->lock by moving the call +outside the lock. The GFX MMU notifier also locks reservation objects. +I have no good solution for avoiding reclaim while holding reservation +objects. The HSA MMU notifier will not lock any reservation objects. + +v2: Moved allocation outside lock instead of using GFP_NOIO + +Signed-off-by: Felix Kuehling +Acked-by: Oded Gabbay +Reviewed-by: Christian König +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c +@@ -316,7 +316,7 @@ int amdgpu_mn_register(struct amdgpu_bo + unsigned long end = addr + amdgpu_bo_size(bo) - 1; + struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); + struct amdgpu_mn *rmn; +- struct amdgpu_mn_node *node = NULL; ++ struct amdgpu_mn_node *node = NULL, *new_node; + struct list_head bos; + struct interval_tree_node *it; + +@@ -324,6 +324,10 @@ int amdgpu_mn_register(struct amdgpu_bo + if (IS_ERR(rmn)) + return PTR_ERR(rmn); + ++ new_node = kmalloc(sizeof(*new_node), GFP_KERNEL); ++ if (!new_node) ++ return -ENOMEM; ++ + INIT_LIST_HEAD(&bos); + + down_write(&rmn->lock); +@@ -337,13 +341,10 @@ int amdgpu_mn_register(struct amdgpu_bo + list_splice(&node->bos, &bos); + } + +- if (!node) { +- node = kmalloc(sizeof(struct amdgpu_mn_node), GFP_KERNEL); +- if (!node) { +- up_write(&rmn->lock); +- return -ENOMEM; +- } +- } ++ if (!node) ++ node = new_node; ++ else ++ kfree(new_node); + + bo->mn = rmn; + diff --git a/queue-4.17/drm-amdgpu-remove-vram-from-shared-bo-domains.patch b/queue-4.17/drm-amdgpu-remove-vram-from-shared-bo-domains.patch new file mode 100644 index 00000000000..6fd217aa37a --- /dev/null +++ b/queue-4.17/drm-amdgpu-remove-vram-from-shared-bo-domains.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Samuel Li +Date: Wed, 18 Apr 2018 16:26:18 -0400 +Subject: drm/amdgpu: Remove VRAM from shared bo domains. + +From: Samuel Li + +[ Upstream commit 9b3f217faf48603c91d4ca44a18e6ff74c3c1c0c ] + +This fixes an issue introduced by change "allow framebuffer in GART +memory as well" which could lead to a shared buffer ending up +pinned in vram. Use GTT if it is included in the domain, otherwise +return an error. + +Signed-off-by: Samuel Li +Reviewed-by: Alex Deucher +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -689,8 +689,12 @@ int amdgpu_bo_pin_restricted(struct amdg + return -EINVAL; + + /* A shared bo cannot be migrated to VRAM */ +- if (bo->prime_shared_count && (domain == AMDGPU_GEM_DOMAIN_VRAM)) +- return -EINVAL; ++ if (bo->prime_shared_count) { ++ if (domain & AMDGPU_GEM_DOMAIN_GTT) ++ domain = AMDGPU_GEM_DOMAIN_GTT; ++ else ++ return -EINVAL; ++ } + + if (bo->pin_count) { + uint32_t mem_type = bo->tbo.mem.mem_type; diff --git a/queue-4.17/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch b/queue-4.17/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch new file mode 100644 index 00000000000..3f887ea65d1 --- /dev/null +++ b/queue-4.17/drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Satendra Singh Thakur +Date: Thu, 3 May 2018 11:19:32 +0530 +Subject: drm/atomic: Handling the case when setting old crtc for plane + +From: Satendra Singh Thakur + +[ Upstream commit fc2a69f3903dfd97cd47f593e642b47918c949df ] + +In the func drm_atomic_set_crtc_for_plane, with the current code, +if crtc of the plane_state and crtc passed as argument to the func +are same, entire func will executed in vein. +It will get state of crtc and clear and set the bits in plane_mask. +All these steps are not required for same old crtc. +Ideally, we should do nothing in this case, this patch handles the same, +and causes the program to return without doing anything in such scenario. + +Signed-off-by: Satendra Singh Thakur +Cc: Madhur Verma +Cc: Hemanshu Srivastava +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/1525326572-25854-1-git-send-email-satendra.t@samsung.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1429,7 +1429,9 @@ drm_atomic_set_crtc_for_plane(struct drm + { + struct drm_plane *plane = plane_state->plane; + struct drm_crtc_state *crtc_state; +- ++ /* Nothing to do for same crtc*/ ++ if (plane_state->crtc == crtc) ++ return 0; + if (plane_state->crtc) { + crtc_state = drm_atomic_get_crtc_state(plane_state->state, + plane_state->crtc); diff --git a/queue-4.17/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch b/queue-4.17/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch new file mode 100644 index 00000000000..a35553a9c68 --- /dev/null +++ b/queue-4.17/drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch @@ -0,0 +1,174 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: "Ville Syrjälä" +Date: Thu, 22 Mar 2018 17:22:51 +0200 +Subject: drm/atomic-helper: Drop plane->fb references only for drm_atomic_helper_shutdown() + +From: "Ville Syrjälä" + +[ Upstream commit 5e9cfeba6abb7e1a3f240bd24eb29178f0b83716 ] + +drm_atomic_helper_shutdown() needs to release the reference held by +plane->fb. Since commit 49d70aeaeca8 ("drm/atomic-helper: Fix leak in +disable_all") we're doing that by calling drm_atomic_clean_old_fb() in +drm_atomic_helper_disable_all(). This also leaves plane->fb == NULL +afterwards. However, since drm_atomic_helper_disable_all() is also +used by the i915 gpu reset code +drm_atomic_helper_commit_duplicated_state() then has to undo the +damage and put the correct plane->fb pointers back in (and also +adjust the ref counts to match again as well). + +That approach doesn't work so well for load detection as nothing +sets up the plane->old_fb pointers for us. This causes us to +leak an extra reference for each plane->fb when +drm_atomic_helper_commit_duplicated_state() calls +drm_atomic_clean_old_fb() after load detection. + +To fix this let's call drm_atomic_clean_old_fb() only for +drm_atomic_helper_shutdown() as that's the only time we need to +actually drop the plane->fb references. In all the other cases +(load detection, gpu reset) we want to leave plane->fb alone. + +v2: Don't inflict the clean_old_fbs bool to drivers (Daniel) +v3: Squash in the revert and rewrite the commit msg (Daniel) + +Cc: martin.peres@free.fr +Cc: chris@chris-wilson.co.uk +Cc: Dave Airlie +Cc: Maarten Lankhorst +Cc: Daniel Vetter +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20180322152313.6561-3-ville.syrjala@linux.intel.com +Reviewed-by: Maarten Lankhorst #pre-squash +Reviewed-by: Daniel Vetter +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_atomic_helper.c | 78 ++++++++++++++++++------------------ + 1 file changed, 39 insertions(+), 39 deletions(-) + +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -2881,31 +2881,9 @@ commit: + return 0; + } + +-/** +- * drm_atomic_helper_disable_all - disable all currently active outputs +- * @dev: DRM device +- * @ctx: lock acquisition context +- * +- * Loops through all connectors, finding those that aren't turned off and then +- * turns them off by setting their DPMS mode to OFF and deactivating the CRTC +- * that they are connected to. +- * +- * This is used for example in suspend/resume to disable all currently active +- * functions when suspending. If you just want to shut down everything at e.g. +- * driver unload, look at drm_atomic_helper_shutdown(). +- * +- * Note that if callers haven't already acquired all modeset locks this might +- * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). +- * +- * Returns: +- * 0 on success or a negative error code on failure. +- * +- * See also: +- * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and +- * drm_atomic_helper_shutdown(). +- */ +-int drm_atomic_helper_disable_all(struct drm_device *dev, +- struct drm_modeset_acquire_ctx *ctx) ++static int __drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx, ++ bool clean_old_fbs) + { + struct drm_atomic_state *state; + struct drm_connector_state *conn_state; +@@ -2957,8 +2935,11 @@ int drm_atomic_helper_disable_all(struct + goto free; + + drm_atomic_set_fb_for_plane(plane_state, NULL); +- plane_mask |= BIT(drm_plane_index(plane)); +- plane->old_fb = plane->fb; ++ ++ if (clean_old_fbs) { ++ plane->old_fb = plane->fb; ++ plane_mask |= BIT(drm_plane_index(plane)); ++ } + } + + ret = drm_atomic_commit(state); +@@ -2969,6 +2950,34 @@ free: + return ret; + } + ++/** ++ * drm_atomic_helper_disable_all - disable all currently active outputs ++ * @dev: DRM device ++ * @ctx: lock acquisition context ++ * ++ * Loops through all connectors, finding those that aren't turned off and then ++ * turns them off by setting their DPMS mode to OFF and deactivating the CRTC ++ * that they are connected to. ++ * ++ * This is used for example in suspend/resume to disable all currently active ++ * functions when suspending. If you just want to shut down everything at e.g. ++ * driver unload, look at drm_atomic_helper_shutdown(). ++ * ++ * Note that if callers haven't already acquired all modeset locks this might ++ * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). ++ * ++ * Returns: ++ * 0 on success or a negative error code on failure. ++ * ++ * See also: ++ * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and ++ * drm_atomic_helper_shutdown(). ++ */ ++int drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx) ++{ ++ return __drm_atomic_helper_disable_all(dev, ctx, false); ++} + EXPORT_SYMBOL(drm_atomic_helper_disable_all); + + /** +@@ -2991,7 +3000,7 @@ void drm_atomic_helper_shutdown(struct d + while (1) { + ret = drm_modeset_lock_all_ctx(dev, &ctx); + if (!ret) +- ret = drm_atomic_helper_disable_all(dev, &ctx); ++ ret = __drm_atomic_helper_disable_all(dev, &ctx, true); + + if (ret != -EDEADLK) + break; +@@ -3095,16 +3104,11 @@ int drm_atomic_helper_commit_duplicated_ + struct drm_connector_state *new_conn_state; + struct drm_crtc *crtc; + struct drm_crtc_state *new_crtc_state; +- unsigned plane_mask = 0; +- struct drm_device *dev = state->dev; +- int ret; + + state->acquire_ctx = ctx; + +- for_each_new_plane_in_state(state, plane, new_plane_state, i) { +- plane_mask |= BIT(drm_plane_index(plane)); ++ for_each_new_plane_in_state(state, plane, new_plane_state, i) + state->planes[i].old_state = plane->state; +- } + + for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) + state->crtcs[i].old_state = crtc->state; +@@ -3112,11 +3116,7 @@ int drm_atomic_helper_commit_duplicated_ + for_each_new_connector_in_state(state, connector, new_conn_state, i) + state->connectors[i].old_state = connector->state; + +- ret = drm_atomic_commit(state); +- if (plane_mask) +- drm_atomic_clean_old_fb(dev, plane_mask, ret); +- +- return ret; ++ return drm_atomic_commit(state); + } + EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state); + diff --git a/queue-4.17/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch b/queue-4.17/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch new file mode 100644 index 00000000000..ea98a1321cb --- /dev/null +++ b/queue-4.17/drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Andy Shevchenko +Date: Mon, 19 Mar 2018 16:19:32 +0200 +Subject: drm/dp/mst: Fix off-by-one typo when dump payload table + +From: Andy Shevchenko + +[ Upstream commit 7056a2bccc3b5afc51f9b35b30a46f0d9219968d ] + +It seems there is a classical off-by-one typo from the beginning +when commit + + ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") + +introduced a new helper. + +Fix a typo by introducing a macro constant. + +Cc: Dave Airlie +Signed-off-by: Andy Shevchenko +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20180319141932.37290-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_dp_mst_topology.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2941,12 +2941,14 @@ static void drm_dp_mst_dump_mstb(struct + } + } + ++#define DP_PAYLOAD_TABLE_SIZE 64 ++ + static bool dump_dp_payload_table(struct drm_dp_mst_topology_mgr *mgr, + char *buf) + { + int i; + +- for (i = 0; i < 64; i += 16) { ++ for (i = 0; i < DP_PAYLOAD_TABLE_SIZE; i += 16) { + if (drm_dp_dpcd_read(mgr->aux, + DP_PAYLOAD_TABLE_UPDATE_STATUS + i, + &buf[i], 16) != 16) +@@ -3015,7 +3017,7 @@ void drm_dp_mst_dump_topology(struct seq + + mutex_lock(&mgr->lock); + if (mgr->mst_primary) { +- u8 buf[64]; ++ u8 buf[DP_PAYLOAD_TABLE_SIZE]; + int ret; + + ret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, buf, DP_RECEIVER_CAP_SIZE); +@@ -3033,8 +3035,7 @@ void drm_dp_mst_dump_topology(struct seq + seq_printf(m, " revision: hw: %x.%x sw: %x.%x\n", + buf[0x9] >> 4, buf[0x9] & 0xf, buf[0xa], buf[0xb]); + if (dump_dp_payload_table(mgr, buf)) +- seq_printf(m, "payload table: %*ph\n", 63, buf); +- ++ seq_printf(m, "payload table: %*ph\n", DP_PAYLOAD_TABLE_SIZE, buf); + } + + mutex_unlock(&mgr->lock); diff --git a/queue-4.17/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch b/queue-4.17/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch new file mode 100644 index 00000000000..2adb43f5bbd --- /dev/null +++ b/queue-4.17/drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Luc Van Oostenryck +Date: Tue, 24 Apr 2018 15:14:57 +0200 +Subject: drm/gma500: fix psb_intel_lvds_mode_valid()'s return type + +From: Luc Van Oostenryck + +[ Upstream commit 2ea009095c6e7396915a1d0dd480c41f02985f79 ] + +The method struct drm_connector_helper_funcs::mode_valid is defined +as returning an 'enum drm_mode_status' but the driver implementation +for this method, psb_intel_lvds_mode_valid(), uses an 'int' for it. + +Fix this by using 'enum drm_mode_status' for psb_intel_lvds_mode_valid(). + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20180424131458.2060-1-luc.vanoostenryck@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/psb_intel_drv.h | 2 +- + drivers/gpu/drm/gma500/psb_intel_lvds.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/gma500/psb_intel_drv.h ++++ b/drivers/gpu/drm/gma500/psb_intel_drv.h +@@ -255,7 +255,7 @@ extern int intelfb_remove(struct drm_dev + extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder, + const struct drm_display_mode *mode, + struct drm_display_mode *adjusted_mode); +-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode); + extern int psb_intel_lvds_set_property(struct drm_connector *connector, + struct drm_property *property, +--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c ++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c +@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struc + } + } + +-int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_psb_private *dev_priv = connector->dev->dev_private; diff --git a/queue-4.17/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch b/queue-4.17/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch new file mode 100644 index 00000000000..2c6d21cf32b --- /dev/null +++ b/queue-4.17/drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ben Skeggs +Date: Tue, 8 May 2018 20:39:46 +1000 +Subject: drm/nouveau/fifo/gk104-: poll for runlist update completion + +From: Ben Skeggs + +[ Upstream commit 4f2fc25c0f8bcc8db1b8a7b21e88c3d7f35c5acb ] + +Newer HW doesn't appear to send this event, which will cause long delays +in runlist updates if they don't complete immediately. + +RM doesn't use these events anywhere, and an NVGPU commit message notes +that polling is the preferred method even on HW that supports the event. + +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c +@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_f + (target << 28)); + nvkm_wr32(device, 0x002274, (runl << 20) | nr); + +- if (wait_event_timeout(fifo->runlist[runl].wait, +- !(nvkm_rd32(device, 0x002284 + (runl * 0x08)) +- & 0x00100000), +- msecs_to_jiffies(2000)) == 0) ++ if (nvkm_msec(device, 2000, ++ if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000)) ++ break; ++ ) < 0) + nvkm_error(subdev, "runlist %d update timeout\n", runl); + unlock: + mutex_unlock(&subdev->mutex); diff --git a/queue-4.17/drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch b/queue-4.17/drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch new file mode 100644 index 00000000000..01ab6eded9f --- /dev/null +++ b/queue-4.17/drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch @@ -0,0 +1,101 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ben Skeggs +Date: Tue, 8 May 2018 20:39:47 +1000 +Subject: drm/nouveau/gem: lookup VMAs for buffers referenced by pushbuf ioctl + +From: Ben Skeggs + +[ Upstream commit 19ca10d82e33bcfe92412c461fc3534ec1e14747 ] + +We previously only did this for push buffers, but an upcoming patch will +need to attach fences to all VMAs to resolve another issue. + +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_dma.c | 10 +--------- + drivers/gpu/drm/nouveau/nouveau_dma.h | 5 ++--- + drivers/gpu/drm/nouveau/nouveau_gem.c | 19 ++++++++++++++++--- + 3 files changed, 19 insertions(+), 15 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_dma.c ++++ b/drivers/gpu/drm/nouveau/nouveau_dma.c +@@ -80,18 +80,10 @@ READ_GET(struct nouveau_channel *chan, u + } + + void +-nv50_dma_push(struct nouveau_channel *chan, struct nouveau_bo *bo, +- int delta, int length) ++nv50_dma_push(struct nouveau_channel *chan, u64 offset, int length) + { +- struct nouveau_cli *cli = (void *)chan->user.client; + struct nouveau_bo *pb = chan->push.buffer; +- struct nouveau_vma *vma; + int ip = (chan->dma.ib_put * 2) + chan->dma.ib_base; +- u64 offset; +- +- vma = nouveau_vma_find(bo, &cli->vmm); +- BUG_ON(!vma); +- offset = vma->addr + delta; + + BUG_ON(chan->dma.ib_free < 1); + +--- a/drivers/gpu/drm/nouveau/nouveau_dma.h ++++ b/drivers/gpu/drm/nouveau/nouveau_dma.h +@@ -31,8 +31,7 @@ + #include "nouveau_chan.h" + + int nouveau_dma_wait(struct nouveau_channel *, int slots, int size); +-void nv50_dma_push(struct nouveau_channel *, struct nouveau_bo *, +- int delta, int length); ++void nv50_dma_push(struct nouveau_channel *, u64 addr, int length); + + /* + * There's a hw race condition where you can't jump to your PUT offset, +@@ -151,7 +150,7 @@ FIRE_RING(struct nouveau_channel *chan) + chan->accel_done = true; + + if (chan->dma.ib_max) { +- nv50_dma_push(chan, chan->push.buffer, chan->dma.put << 2, ++ nv50_dma_push(chan, chan->push.addr + (chan->dma.put << 2), + (chan->dma.cur - chan->dma.put) << 2); + } else { + WRITE_PUT(chan->dma.cur); +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -432,7 +432,20 @@ retry: + } + } + +- b->user_priv = (uint64_t)(unsigned long)nvbo; ++ if (cli->vmm.vmm.object.oclass >= NVIF_CLASS_VMM_NV50) { ++ struct nouveau_vmm *vmm = &cli->vmm; ++ struct nouveau_vma *vma = nouveau_vma_find(nvbo, vmm); ++ if (!vma) { ++ NV_PRINTK(err, cli, "vma not found!\n"); ++ ret = -EINVAL; ++ break; ++ } ++ ++ b->user_priv = (uint64_t)(unsigned long)vma; ++ } else { ++ b->user_priv = (uint64_t)(unsigned long)nvbo; ++ } ++ + nvbo->reserved_by = file_priv; + nvbo->pbbo_index = i; + if ((b->valid_domains & NOUVEAU_GEM_DOMAIN_VRAM) && +@@ -763,10 +776,10 @@ nouveau_gem_ioctl_pushbuf(struct drm_dev + } + + for (i = 0; i < req->nr_push; i++) { +- struct nouveau_bo *nvbo = (void *)(unsigned long) ++ struct nouveau_vma *vma = (void *)(unsigned long) + bo[push[i].bo_index].user_priv; + +- nv50_dma_push(chan, nvbo, push[i].offset, ++ nv50_dma_push(chan, vma->addr + push[i].offset, + push[i].length); + } + } else diff --git a/queue-4.17/drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch b/queue-4.17/drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch new file mode 100644 index 00000000000..a3f4c040224 --- /dev/null +++ b/queue-4.17/drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch @@ -0,0 +1,82 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ben Skeggs +Date: Tue, 8 May 2018 20:39:47 +1000 +Subject: drm/nouveau: remove fence wait code from deferred client work handler + +From: Ben Skeggs + +[ Upstream commit 11e451e74050d9e9030581ce40337838acfcea5b ] + +Fences attached to deferred client work items now originate from channels +belonging to the client, meaning we can be certain they've been signalled +before we destroy a client. + +This closes a race that could happen if the dma_fence_wait_timeout() call +didn't succeed. When the fence was later signalled, a use-after-free was +possible. + +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nouveau_drm.c | 30 ++++++++++++++---------------- + 1 file changed, 14 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -116,24 +116,22 @@ nouveau_name(struct drm_device *dev) + } + + static inline bool +-nouveau_cli_work_ready(struct dma_fence *fence, bool wait) ++nouveau_cli_work_ready(struct dma_fence *fence) + { +- if (!dma_fence_is_signaled(fence)) { +- if (!wait) +- return false; +- WARN_ON(dma_fence_wait_timeout(fence, false, 2 * HZ) <= 0); +- } ++ if (!dma_fence_is_signaled(fence)) ++ return false; + dma_fence_put(fence); + return true; + } + + static void +-nouveau_cli_work_flush(struct nouveau_cli *cli, bool wait) ++nouveau_cli_work(struct work_struct *w) + { ++ struct nouveau_cli *cli = container_of(w, typeof(*cli), work); + struct nouveau_cli_work *work, *wtmp; + mutex_lock(&cli->lock); + list_for_each_entry_safe(work, wtmp, &cli->worker, head) { +- if (!work->fence || nouveau_cli_work_ready(work->fence, wait)) { ++ if (!work->fence || nouveau_cli_work_ready(work->fence)) { + list_del(&work->head); + work->func(work); + } +@@ -162,16 +160,16 @@ nouveau_cli_work_queue(struct nouveau_cl + } + + static void +-nouveau_cli_work(struct work_struct *w) +-{ +- struct nouveau_cli *cli = container_of(w, typeof(*cli), work); +- nouveau_cli_work_flush(cli, false); +-} +- +-static void + nouveau_cli_fini(struct nouveau_cli *cli) + { +- nouveau_cli_work_flush(cli, true); ++ /* All our channels are dead now, which means all the fences they ++ * own are signalled, and all callback functions have been called. ++ * ++ * So, after flushing the workqueue, there should be nothing left. ++ */ ++ flush_work(&cli->work); ++ WARN_ON(!list_empty(&cli->worker)); ++ + usif_client_fini(cli); + nouveau_vmm_fini(&cli->vmm); + nvif_mmu_fini(&cli->mmu); diff --git a/queue-4.17/drm-radeon-fix-mode_valid-s-return-type.patch b/queue-4.17/drm-radeon-fix-mode_valid-s-return-type.patch new file mode 100644 index 00000000000..2388f305438 --- /dev/null +++ b/queue-4.17/drm-radeon-fix-mode_valid-s-return-type.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Luc Van Oostenryck +Date: Tue, 24 Apr 2018 15:15:13 +0200 +Subject: drm/radeon: fix mode_valid's return type + +From: Luc Van Oostenryck + +[ Upstream commit 7a47f20eb1fb8fa8d7a8fe3a4fd8c721f04c2174 ] + +The method struct drm_connector_helper_funcs::mode_valid is defined +as returning an 'enum drm_mode_status' but the driver implementation +for this method uses an 'int' for it. + +Fix this by using 'enum drm_mode_status' in the driver too. + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/radeon_connectors.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -852,7 +852,7 @@ static int radeon_lvds_get_modes(struct + return ret; + } + +-static int radeon_lvds_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_encoder *encoder = radeon_best_single_encoder(connector); +@@ -1012,7 +1012,7 @@ static int radeon_vga_get_modes(struct d + return ret; + } + +-static int radeon_vga_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1156,7 +1156,7 @@ static int radeon_tv_get_modes(struct dr + return 1; + } + +-static int radeon_tv_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + if ((mode->hdisplay > 1024) || (mode->vdisplay > 768)) +@@ -1498,7 +1498,7 @@ static void radeon_dvi_force(struct drm_ + radeon_connector->use_digital = true; + } + +-static int radeon_dvi_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1800,7 +1800,7 @@ out: + return ret; + } + +-static int radeon_dp_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; diff --git a/queue-4.17/drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch b/queue-4.17/drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch new file mode 100644 index 00000000000..db08d892bfa --- /dev/null +++ b/queue-4.17/drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Tomasz Figa +Date: Mon, 23 Apr 2018 12:49:59 +0200 +Subject: drm/rockchip: analogix_dp: Do not call Analogix code before bind + +From: Tomasz Figa + +[ Upstream commit a4169609def769c66f88140678970b2be6f64ac7 ] + +Driver callbacks, such as system suspend or resume can be called any +time, specifically they can be called before the component bind +callback. Let's use dp->adp pointer as a safeguard and skip calling +Analogix entry points if it is an ERR_PTR(). + +Signed-off-by: Tomasz Figa +Signed-off-by: Thierry Escande +Signed-off-by: Enric Balletbo i Serra +Tested-by: Marek Szyprowski +Reviewed-by: Archit Taneja +Signed-off-by: Andrzej Hajda +Link: https://patchwork.freedesktop.org/patch/msgid/20180423105003.9004-24-enric.balletbo@collabora.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/analogix_dp-rockchip.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c ++++ b/drivers/gpu/drm/rockchip/analogix_dp-rockchip.c +@@ -358,6 +358,8 @@ static void rockchip_dp_unbind(struct de + analogix_dp_unbind(dp->adp); + rockchip_drm_psr_unregister(&dp->encoder); + dp->encoder.funcs->destroy(&dp->encoder); ++ ++ dp->adp = ERR_PTR(-ENODEV); + } + + static const struct component_ops rockchip_dp_component_ops = { +@@ -381,6 +383,7 @@ static int rockchip_dp_probe(struct plat + return -ENOMEM; + + dp->dev = dev; ++ dp->adp = ERR_PTR(-ENODEV); + dp->plat_data.panel = panel; + + ret = rockchip_dp_of_probe(dp); +@@ -404,6 +407,9 @@ static int rockchip_dp_suspend(struct de + { + struct rockchip_dp_device *dp = dev_get_drvdata(dev); + ++ if (IS_ERR(dp->adp)) ++ return 0; ++ + return analogix_dp_suspend(dp->adp); + } + +@@ -411,6 +417,9 @@ static int rockchip_dp_resume(struct dev + { + struct rockchip_dp_device *dp = dev_get_drvdata(dev); + ++ if (IS_ERR(dp->adp)) ++ return 0; ++ + return analogix_dp_resume(dp->adp); + } + #endif diff --git a/queue-4.17/drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch b/queue-4.17/drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch new file mode 100644 index 00000000000..cf16505c0bd --- /dev/null +++ b/queue-4.17/drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Philippe CORNU +Date: Tue, 10 Apr 2018 15:53:12 +0200 +Subject: drm/stm: ltdc: fix warning in ltdc_crtc_update_clut() + +From: Philippe CORNU + +[ Upstream commit c20f5f69c898899027c3e573afaab837195895b6 ] + +Fix the warning +"warn: variable dereferenced before check 'crtc' (see line 390)" +by removing unnecessary checks as ltdc_crtc_update_clut() is +only called from ltdc_crtc_atomic_flush() where crtc and +crtc->state are not NULL. + +Many thanks to Dan Carpenter for the bug report +https://lists.freedesktop.org/archives/dri-devel/2018-February/166918.html + +Signed-off-by: Philippe Cornu +Reported-by: Dan Carpenter +Reviewed-by: yannick fertre +Link: https://patchwork.freedesktop.org/patch/msgid/20180410135312.3553-1-philippe.cornu@st.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/stm/ltdc.c | 3 --- + 1 file changed, 3 deletions(-) + +--- a/drivers/gpu/drm/stm/ltdc.c ++++ b/drivers/gpu/drm/stm/ltdc.c +@@ -392,9 +392,6 @@ static void ltdc_crtc_update_clut(struct + u32 val; + int i; + +- if (!crtc || !crtc->state) +- return; +- + if (!crtc->state->color_mgmt_changed || !crtc->state->gamma_lut) + return; + diff --git a/queue-4.17/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch b/queue-4.17/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch new file mode 100644 index 00000000000..79b8b06fa0e --- /dev/null +++ b/queue-4.17/drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: David Lechner +Date: Wed, 14 Mar 2018 17:58:45 -0500 +Subject: drm/tilcdc: Fix setting clock divider for omap-l138 + +From: David Lechner + +[ Upstream commit a88ad3ded15daa0389106779c60b8a5e76d4b20a ] + +This fixes setting the clock divider on the TI OMAP-L138 LCDK board. + +The clock drivers for OMAP-L138 are being covernted to the common clock +framework. When this happens, clk_set_rate() will no longer return an +error. However, on this SoC, the clock rate cannot actually be changed +because the clock has to maintain a fixed ratio to the ARM clock. So +after attempting to set the clock rate, we need to check to see if the +new rate is actually close enough. If not, then follow the previous +error path to adjust the divider in LCDC IP block to compensate for not +being able to change the parent clock rate. + +Tested working on a TI OMAP-L138 LCDK board. + +Signed-off-by: David Lechner +Signed-off-by: Jyri Sarha +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c ++++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +@@ -224,7 +224,7 @@ static void tilcdc_crtc_set_clk(struct d + + ret = clk_set_rate(priv->clk, req_rate * clkdiv); + clk_rate = clk_get_rate(priv->clk); +- if (ret < 0) { ++ if (ret < 0 || tilcdc_pclk_diff(req_rate, clk_rate) > 5) { + /* + * If we fail to set the clock rate (some architectures don't + * use the common clock framework yet and may not implement diff --git a/queue-4.17/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch b/queue-4.17/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch new file mode 100644 index 00000000000..292eb0de9eb --- /dev/null +++ b/queue-4.17/dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yixun Lan +Date: Sat, 28 Apr 2018 10:21:10 +0000 +Subject: dt-bindings: net: meson-dwmac: new compatible name for AXG SoC + +From: Yixun Lan + +[ Upstream commit 7e5d05e18ba1ed491c6f836edee7f0b90f3167bc ] + +We need to introduce a new compatible name for the Meson-AXG SoC +in order to support the RMII 100M ethernet PHY, since the PRG_ETH0 +register of the dwmac glue layer is changed from previous old SoC. + +Signed-off-by: Yixun Lan +Reviewed-by: Rob Herring +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/net/meson-dwmac.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt ++++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt +@@ -11,6 +11,7 @@ Required properties on all platforms: + - "amlogic,meson8b-dwmac" + - "amlogic,meson8m2-dwmac" + - "amlogic,meson-gxbb-dwmac" ++ - "amlogic,meson-axg-dwmac" + Additionally "snps,dwmac" and any applicable more + detailed version number described in net/stmmac.txt + should be used. diff --git a/queue-4.17/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch b/queue-4.17/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch new file mode 100644 index 00000000000..0dc9c506df6 --- /dev/null +++ b/queue-4.17/dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Martin Blumenstingl +Date: Sun, 22 Apr 2018 12:53:28 +0200 +Subject: dt-bindings: pinctrl: meson: add support for the Meson8m2 SoC + +From: Martin Blumenstingl + +[ Upstream commit 03d9fbc39730b3e6b2e7047dc85f0f70de8fb97d ] + +The Meson8m2 SoC is a variant of Meson8 with some updates from Meson8b +(such as the Gigabit capable DesignWare MAC). +It is mostly pin compatible with Meson8, only 10 (existing) CBUS pins +get an additional function (four of these are Ethernet RXD2, RXD3, TXD2 +and TXD3 which are required when the board uses an RGMII PHY). +The AOBUS pins seem to be identical on Meson8 and Meson8m2. + +Signed-off-by: Martin Blumenstingl +Reviewed-by: Rob Herring +Reviewed-by: Kevin Hilman +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt +@@ -3,8 +3,10 @@ + Required properties for the root node: + - compatible: one of "amlogic,meson8-cbus-pinctrl" + "amlogic,meson8b-cbus-pinctrl" ++ "amlogic,meson8m2-cbus-pinctrl" + "amlogic,meson8-aobus-pinctrl" + "amlogic,meson8b-aobus-pinctrl" ++ "amlogic,meson8m2-aobus-pinctrl" + "amlogic,meson-gxbb-periphs-pinctrl" + "amlogic,meson-gxbb-aobus-pinctrl" + "amlogic,meson-gxl-periphs-pinctrl" diff --git a/queue-4.17/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch b/queue-4.17/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch new file mode 100644 index 00000000000..180b2b308ea --- /dev/null +++ b/queue-4.17/e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Benjamin Poirier +Date: Thu, 10 May 2018 16:28:35 +0900 +Subject: e1000e: Ignore TSYNCRXCTL when getting I219 clock attributes + +From: Benjamin Poirier + +[ Upstream commit fff200caf6f9179dd9a7fc67acd659e614c3f72f ] + +There have been multiple reports of crashes that look like +kernel: RIP: 0010:[] timecounter_read+0xf/0x50 +[...] +kernel: Call Trace: +kernel: [] e1000e_phc_gettime+0x2f/0x60 [e1000e] +kernel: [] e1000e_systim_overflow_work+0x1d/0x80 [e1000e] +kernel: [] process_one_work+0x155/0x440 +kernel: [] worker_thread+0x116/0x4b0 +kernel: [] kthread+0xd2/0xf0 +kernel: [] ret_from_fork+0x3f/0x70 + +These can be traced back to the fact that e1000e_systim_reset() skips the +timecounter_init() call if e1000e_get_base_timinca() returns -EINVAL, which +leads to a null deref in timecounter_read(). + +Commit 83129b37ef35 ("e1000e: fix systim issues", v4.2-rc1) reworked +e1000e_get_base_timinca() in such a way that it can return -EINVAL for +e1000_pch_spt if the SYSCFI bit is not set in TSYNCRXCTL. + +Some experimentation has shown that on I219 (e1000_pch_spt, "MAC: 12") +adapters, the E1000_TSYNCRXCTL_SYSCFI flag is unstable; TSYNCRXCTL reads +sometimes don't have the SYSCFI bit set. Retrying the read shortly after +finds the bit to be set. This was observed at boot (probe) but also link up +and link down. + +Moreover, the phc (PTP Hardware Clock) seems to operate normally even after +reads where SYSCFI=0. Therefore, remove this register read and +unconditionally set the clock parameters. + +Reported-by: Achim Mildenberger +Message-Id: <20180425065243.g5mqewg5irkwgwgv@f2> +Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1075876 +Fixes: 83129b37ef35 ("e1000e: fix systim issues") +Signed-off-by: Benjamin Poirier +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3546,15 +3546,12 @@ s32 e1000e_get_base_timinca(struct e1000 + } + break; + case e1000_pch_spt: +- if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { +- /* Stable 24MHz frequency */ +- incperiod = INCPERIOD_24MHZ; +- incvalue = INCVALUE_24MHZ; +- shift = INCVALUE_SHIFT_24MHZ; +- adapter->cc.shift = shift; +- break; +- } +- return -EINVAL; ++ /* Stable 24MHz frequency */ ++ incperiod = INCPERIOD_24MHZ; ++ incvalue = INCVALUE_24MHZ; ++ shift = INCVALUE_SHIFT_24MHZ; ++ adapter->cc.shift = shift; ++ break; + case e1000_pch_cnp: + if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { + /* Stable 24MHz frequency */ diff --git a/queue-4.17/edac-altera-fix-arm64-build-warning.patch b/queue-4.17/edac-altera-fix-arm64-build-warning.patch new file mode 100644 index 00000000000..46e1c785c65 --- /dev/null +++ b/queue-4.17/edac-altera-fix-arm64-build-warning.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thor Thayer +Date: Mon, 14 May 2018 12:04:01 -0500 +Subject: EDAC, altera: Fix ARM64 build warning + +From: Thor Thayer + +[ Upstream commit 9ef20753e044f7468c4113e5aecd785419b0b3cc ] + +The kbuild test robot reported the following warning: + + drivers/edac/altera_edac.c: In function 'ocram_free_mem': + drivers/edac/altera_edac.c:1410:42: warning: cast from pointer to integer + of different size [-Wpointer-to-int-cast] + gen_pool_free((struct gen_pool *)other, (u32)p, size); + ^ + +After adding support for ARM64 architectures, the unsigned long +parameter is 64 bits and causes a build warning on 64-bit configs. Fix +by casting to the correct size (unsigned long) instead of u32. + +Reported-by: kbuild test robot +Signed-off-by: Thor Thayer +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-edac +Fixes: c3eea1942a16 ("EDAC, altera: Add Altera L2 cache and OCRAM support") +Link: http://lkml.kernel.org/r/1526317441-4996-1-git-send-email-thor.thayer@linux.intel.com +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/altera_edac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size + + static void ocram_free_mem(void *p, size_t size, void *other) + { +- gen_pool_free((struct gen_pool *)other, (u32)p, size); ++ gen_pool_free((struct gen_pool *)other, (unsigned long)p, size); + } + + static const struct edac_device_prv_data ocramecc_data = { diff --git a/queue-4.17/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch b/queue-4.17/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch new file mode 100644 index 00000000000..4ce5d3f7b3e --- /dev/null +++ b/queue-4.17/f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jaegeuk Kim +Date: Thu, 3 May 2018 23:26:02 -0700 +Subject: f2fs: avoid fsync() failure caused by EAGAIN in writepage() + +From: Jaegeuk Kim + +[ Upstream commit 5b19d284f5195a925dd015a6397bfce184097378 ] + +pageout() in MM traslates EAGAIN, so calls handle_write_error() + -> mapping_set_error() -> set_bit(AS_EIO, ...). + file_write_and_wait_range() will see EIO error, which is critical + to return value of fsync() followed by atomic_write failure to user. + +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1848,7 +1848,13 @@ out: + + redirty_out: + redirty_page_for_writepage(wbc, page); +- if (!err) ++ /* ++ * pageout() in MM traslates EAGAIN, so calls handle_write_error() ++ * -> mapping_set_error() -> set_bit(AS_EIO, ...). ++ * file_write_and_wait_range() will see EIO error, which is critical ++ * to return value of fsync() followed by atomic_write failure to user. ++ */ ++ if (!err || wbc->for_reclaim) + return AOP_WRITEPAGE_ACTIVATE; + unlock_page(page); + return err; diff --git a/queue-4.17/f2fs-check-cap_resource-only-for-data-blocks.patch b/queue-4.17/f2fs-check-cap_resource-only-for-data-blocks.patch new file mode 100644 index 00000000000..fcc1782bdab --- /dev/null +++ b/queue-4.17/f2fs-check-cap_resource-only-for-data-blocks.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jaegeuk Kim +Date: Fri, 20 Apr 2018 23:44:59 -0700 +Subject: f2fs: check cap_resource only for data blocks + +From: Jaegeuk Kim + +[ Upstream commit a90a0884ac75f825157470a1c17e707d487bceb6 ] + +This patch changes the rule to check cap_resource for data blocks, not inode +or node blocks in order to avoid selinux denial. + +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/f2fs.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1602,7 +1602,7 @@ static inline bool f2fs_has_xattr_block( + } + + static inline bool __allow_reserved_blocks(struct f2fs_sb_info *sbi, +- struct inode *inode) ++ struct inode *inode, bool cap) + { + if (!inode) + return true; +@@ -1615,7 +1615,7 @@ static inline bool __allow_reserved_bloc + if (!gid_eq(F2FS_OPTION(sbi).s_resgid, GLOBAL_ROOT_GID) && + in_group_p(F2FS_OPTION(sbi).s_resgid)) + return true; +- if (capable(CAP_SYS_RESOURCE)) ++ if (cap && capable(CAP_SYS_RESOURCE)) + return true; + return false; + } +@@ -1650,7 +1650,7 @@ static inline int inc_valid_block_count( + avail_user_block_count = sbi->user_block_count - + sbi->current_reserved_blocks; + +- if (!__allow_reserved_blocks(sbi, inode)) ++ if (!__allow_reserved_blocks(sbi, inode, true)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(sbi->total_valid_block_count > avail_user_block_count)) { +@@ -1857,7 +1857,7 @@ static inline int inc_valid_node_count(s + valid_block_count = sbi->total_valid_block_count + + sbi->current_reserved_blocks + 1; + +- if (!__allow_reserved_blocks(sbi, inode)) ++ if (!__allow_reserved_blocks(sbi, inode, false)) + valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks; + + if (unlikely(valid_block_count > sbi->user_block_count)) { diff --git a/queue-4.17/f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch b/queue-4.17/f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch new file mode 100644 index 00000000000..dc278b88c50 --- /dev/null +++ b/queue-4.17/f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Mon, 28 May 2018 16:59:26 +0800 +Subject: f2fs: don't drop dentry pages after fs shutdown + +From: Chao Yu + +[ Upstream commit 1174abfd8309f4c47d454734233aa3b694560e10 ] + +As description in commit "f2fs: don't drop any page on f2fs_cp_error() +case": + +"We still provide readdir() after shtudown, so we should keep pages to +avoid additional IOs." + +In order to provider lastest directory structure, let's keep dentry +pages in cache after fs shutdown. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1745,6 +1745,12 @@ static int __write_data_page(struct page + /* we should bypass data pages to proceed the kworkder jobs */ + if (unlikely(f2fs_cp_error(sbi))) { + mapping_set_error(page->mapping, -EIO); ++ /* ++ * don't drop any dirty dentry pages for keeping lastest ++ * directory structure. ++ */ ++ if (S_ISDIR(inode->i_mode)) ++ goto redirty_out; + goto out; + } + diff --git a/queue-4.17/f2fs-fix-deadlock-in-shutdown-ioctl.patch b/queue-4.17/f2fs-fix-deadlock-in-shutdown-ioctl.patch new file mode 100644 index 00000000000..05416efea9b --- /dev/null +++ b/queue-4.17/f2fs-fix-deadlock-in-shutdown-ioctl.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sahitya Tummala +Date: Fri, 18 May 2018 11:51:52 +0530 +Subject: f2fs: Fix deadlock in shutdown ioctl + +From: Sahitya Tummala + +[ Upstream commit 60b2b4ee2bc01dd052f99fa9d65da2232102ef8e ] + +f2fs_ioc_shutdown() ioctl gets stuck in the below path +when issued with F2FS_GOING_DOWN_FULLSYNC option. + +__switch_to+0x90/0xc4 +percpu_down_write+0x8c/0xc0 +freeze_super+0xec/0x1e4 +freeze_bdev+0xc4/0xcc +f2fs_ioctl+0xc0c/0x1ce0 +f2fs_compat_ioctl+0x98/0x1f0 + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1851,9 +1851,11 @@ static int f2fs_ioc_shutdown(struct file + if (get_user(in, (__u32 __user *)arg)) + return -EFAULT; + +- ret = mnt_want_write_file(filp); +- if (ret) +- return ret; ++ if (in != F2FS_GOING_DOWN_FULLSYNC) { ++ ret = mnt_want_write_file(filp); ++ if (ret) ++ return ret; ++ } + + switch (in) { + case F2FS_GOING_DOWN_FULLSYNC: +@@ -1894,7 +1896,8 @@ static int f2fs_ioc_shutdown(struct file + + f2fs_update_time(sbi, REQ_TIME); + out: +- mnt_drop_write_file(filp); ++ if (in != F2FS_GOING_DOWN_FULLSYNC) ++ mnt_drop_write_file(filp); + return ret; + } + diff --git a/queue-4.17/f2fs-fix-error-path-of-move_data_page.patch b/queue-4.17/f2fs-fix-error-path-of-move_data_page.patch new file mode 100644 index 00000000000..9c3ecdc0fcc --- /dev/null +++ b/queue-4.17/f2fs-fix-error-path-of-move_data_page.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Mon, 28 May 2018 16:59:27 +0800 +Subject: f2fs: fix error path of move_data_page + +From: Chao Yu + +[ Upstream commit 14a28559f43ac7c0b98dd1b0e73ec9ec8ab4fc45 ] + +This patch fixes error path of move_data_page: +- clear cold data flag if it fails to write page. +- redirty page for non-ENOMEM case. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/gc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -778,9 +778,14 @@ retry: + set_cold_data(page); + + err = do_write_data_page(&fio); +- if (err == -ENOMEM && is_dirty) { +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; ++ if (err) { ++ clear_cold_data(page); ++ if (err == -ENOMEM) { ++ congestion_wait(BLK_RW_ASYNC, HZ/50); ++ goto retry; ++ } ++ if (is_dirty) ++ set_page_dirty(page); + } + } + out: diff --git a/queue-4.17/f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch b/queue-4.17/f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch new file mode 100644 index 00000000000..26b104a137b --- /dev/null +++ b/queue-4.17/f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yunlei He +Date: Tue, 24 Apr 2018 11:40:19 +0800 +Subject: f2fs: fix missing clear FI_NO_PREALLOC in some error case + +From: Yunlei He + +[ Upstream commit cba41be08cb182476fec4d318a8a8f2f8361a901 ] + +This patch fix missing clear FI_NO_PREALLOC in some error case + +Signed-off-by: Yunlei He +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2927,6 +2927,8 @@ static ssize_t f2fs_file_write_iter(stru + iov_iter_count(from)) || + f2fs_has_inline_data(inode) || + f2fs_force_buffered_io(inode, WRITE)) { ++ clear_inode_flag(inode, ++ FI_NO_PREALLOC); + inode_unlock(inode); + return -EAGAIN; + } diff --git a/queue-4.17/f2fs-fix-race-in-between-gc-and-atomic-open.patch b/queue-4.17/f2fs-fix-race-in-between-gc-and-atomic-open.patch new file mode 100644 index 00000000000..801ac8c21f5 --- /dev/null +++ b/queue-4.17/f2fs-fix-race-in-between-gc-and-atomic-open.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Tue, 17 Apr 2018 17:51:28 +0800 +Subject: f2fs: fix race in between GC and atomic open + +From: Chao Yu + +[ Upstream commit 27319ba4044c0c67d62ae39e53c0118c89f0a029 ] + +Thread GC thread +- f2fs_ioc_start_atomic_write + - get_dirty_pages + - filemap_write_and_wait_range + - f2fs_gc + - do_garbage_collect + - gc_data_segment + - move_data_page + - f2fs_is_atomic_file + - set_page_dirty + - set_inode_flag(, FI_ATOMIC_FILE) + +Dirty data page can still be generated by GC in race condition as +above call stack. + +This patch adds fi->dio_rwsem[WRITE] in f2fs_ioc_start_atomic_write +to avoid such race. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1670,6 +1670,8 @@ static int f2fs_ioc_start_atomic_write(s + + inode_lock(inode); + ++ down_write(&F2FS_I(inode)->dio_rwsem[WRITE]); ++ + if (f2fs_is_atomic_file(inode)) + goto out; + +@@ -1699,6 +1701,7 @@ inc_stat: + stat_inc_atomic_write(inode); + stat_update_max_atomic_write(inode); + out: ++ up_write(&F2FS_I(inode)->dio_rwsem[WRITE]); + inode_unlock(inode); + mnt_drop_write_file(filp); + return ret; diff --git a/queue-4.17/f2fs-fix-to-detect-failure-of-dquot_initialize.patch b/queue-4.17/f2fs-fix-to-detect-failure-of-dquot_initialize.patch new file mode 100644 index 00000000000..6f00560522f --- /dev/null +++ b/queue-4.17/f2fs-fix-to-detect-failure-of-dquot_initialize.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Sat, 21 Apr 2018 17:53:52 +0800 +Subject: f2fs: fix to detect failure of dquot_initialize + +From: Chao Yu + +[ Upstream commit c22aecd75919511abea872b201751e0be1add898 ] + +dquot_initialize() can fail due to any exception inside quota subsystem, +f2fs needs to be aware of it, and return correct return value to caller. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/file.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2571,7 +2571,9 @@ static int f2fs_ioc_setproject(struct fi + } + f2fs_put_page(ipage, 1); + +- dquot_initialize(inode); ++ err = dquot_initialize(inode); ++ if (err) ++ goto out_unlock; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); + if (!IS_ERR(transfer_to[PRJQUOTA])) { diff --git a/queue-4.17/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch b/queue-4.17/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch new file mode 100644 index 00000000000..66d2e434611 --- /dev/null +++ b/queue-4.17/f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Sat, 26 May 2018 18:03:34 +0800 +Subject: f2fs: fix to don't trigger writeback during recovery + +From: Chao Yu + +[ Upstream commit 64c74a7ab505ea40d1b3e5d02735ecab08ae1b14 ] + +- f2fs_fill_super + - recover_fsync_data + - recover_data + - del_fsync_inode + - iput + - iput_final + - write_inode_now + - f2fs_write_inode + - f2fs_balance_fs + - f2fs_balance_fs_bg + - sync_dirty_inodes + +With data_flush mount option, during recovery, in order to avoid entering +above writeback flow, let's detect recovery status and do skip in +f2fs_balance_fs_bg. + +Signed-off-by: Chao Yu +Signed-off-by: Yunlei He +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/segment.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -478,6 +478,9 @@ void f2fs_balance_fs(struct f2fs_sb_info + + void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi) + { ++ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING))) ++ return; ++ + /* try to shrink extent cache when there is no enough memory */ + if (!available_free_memory(sbi, EXTENT_CACHE)) + f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER); diff --git a/queue-4.17/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch b/queue-4.17/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch new file mode 100644 index 00000000000..755f79548e5 --- /dev/null +++ b/queue-4.17/f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chao Yu +Date: Mon, 23 Apr 2018 10:36:13 +0800 +Subject: f2fs: fix to wait page writeback during revoking atomic write + +From: Chao Yu + +[ Upstream commit e5e5732d8120654159254c16834bc8663d8be124 ] + +After revoking atomic write, related LBA can be reused by others, so we +need to wait page writeback before reusing the LBA, in order to avoid +interference between old atomic written in-flight IO and new IO. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/segment.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -230,6 +230,8 @@ static int __revoke_inmem_pages(struct i + + lock_page(page); + ++ f2fs_wait_on_page_writeback(page, DATA, true); ++ + if (recover) { + struct dnode_of_data dn; + struct node_info ni; diff --git a/queue-4.17/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch b/queue-4.17/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch new file mode 100644 index 00000000000..dfa531fbb4b --- /dev/null +++ b/queue-4.17/fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch @@ -0,0 +1,118 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kirill Tkhai +Date: Thu, 5 Apr 2018 14:58:06 +0300 +Subject: fasync: Fix deadlock between task-context and interrupt-context kill_fasync() + +From: Kirill Tkhai + +[ Upstream commit 7a107c0f55a3b4c6f84a4323df5610360bde1684 ] + +I observed the following deadlock between them: + +[task 1] [task 2] [task 3] +kill_fasync() mm_update_next_owner() copy_process() + spin_lock_irqsave(&fa->fa_lock) read_lock(&tasklist_lock) write_lock_irq(&tasklist_lock) + send_sigio() ... + read_lock(&fown->lock) kill_fasync() ... + read_lock(&tasklist_lock) spin_lock_irqsave(&fa->fa_lock) ... + +Task 1 can't acquire read locked tasklist_lock, since there is +already task 3 expressed its wish to take the lock exclusive. +Task 2 holds the read locked lock, but it can't take the spin lock. + +Also, there is possible another deadlock (which I haven't observed): + +[task 1] [task 2] +f_getown() kill_fasync() + read_lock(&f_own->lock) spin_lock_irqsave(&fa->fa_lock,) + send_sigio() write_lock_irq(&f_own->lock) + kill_fasync() read_lock(&fown->lock) + spin_lock_irqsave(&fa->fa_lock,) + +Actually, we do not need exclusive fa->fa_lock in kill_fasync_rcu(), +as it guarantees fa->fa_file->f_owner integrity only. It may seem, +that it used to give a task a small possibility to receive two sequential +signals, if there are two parallel kill_fasync() callers, and task +handles the first signal fastly, but the behaviour won't become +different, since there is exclusive sighand lock in do_send_sig_info(). + +The patch converts fa_lock into rwlock_t, and this fixes two above +deadlocks, as rwlock is allowed to be taken from interrupt handler +by qrwlock design. + +Signed-off-by: Kirill Tkhai +Signed-off-by: Jeff Layton +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/fcntl.c | 15 +++++++-------- + include/linux/fs.h | 2 +- + 2 files changed, 8 insertions(+), 9 deletions(-) + +--- a/fs/fcntl.c ++++ b/fs/fcntl.c +@@ -871,9 +871,9 @@ int fasync_remove_entry(struct file *fil + if (fa->fa_file != filp) + continue; + +- spin_lock_irq(&fa->fa_lock); ++ write_lock_irq(&fa->fa_lock); + fa->fa_file = NULL; +- spin_unlock_irq(&fa->fa_lock); ++ write_unlock_irq(&fa->fa_lock); + + *fp = fa->fa_next; + call_rcu(&fa->fa_rcu, fasync_free_rcu); +@@ -918,13 +918,13 @@ struct fasync_struct *fasync_insert_entr + if (fa->fa_file != filp) + continue; + +- spin_lock_irq(&fa->fa_lock); ++ write_lock_irq(&fa->fa_lock); + fa->fa_fd = fd; +- spin_unlock_irq(&fa->fa_lock); ++ write_unlock_irq(&fa->fa_lock); + goto out; + } + +- spin_lock_init(&new->fa_lock); ++ rwlock_init(&new->fa_lock); + new->magic = FASYNC_MAGIC; + new->fa_file = filp; + new->fa_fd = fd; +@@ -987,14 +987,13 @@ static void kill_fasync_rcu(struct fasyn + { + while (fa) { + struct fown_struct *fown; +- unsigned long flags; + + if (fa->magic != FASYNC_MAGIC) { + printk(KERN_ERR "kill_fasync: bad magic number in " + "fasync_struct!\n"); + return; + } +- spin_lock_irqsave(&fa->fa_lock, flags); ++ read_lock(&fa->fa_lock); + if (fa->fa_file) { + fown = &fa->fa_file->f_owner; + /* Don't send SIGURG to processes which have not set a +@@ -1003,7 +1002,7 @@ static void kill_fasync_rcu(struct fasyn + if (!(sig == SIGURG && fown->signum == 0)) + send_sigio(fown, fa->fa_fd, band); + } +- spin_unlock_irqrestore(&fa->fa_lock, flags); ++ read_unlock(&fa->fa_lock); + fa = rcu_dereference(fa->fa_next); + } + } +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1250,7 +1250,7 @@ static inline int locks_lock_file_wait(s + } + + struct fasync_struct { +- spinlock_t fa_lock; ++ rwlock_t fa_lock; + int magic; + int fa_fd; + struct fasync_struct *fa_next; /* singly linked list */ diff --git a/queue-4.17/fscrypt-use-unbound-workqueue-for-decryption.patch b/queue-4.17/fscrypt-use-unbound-workqueue-for-decryption.patch new file mode 100644 index 00000000000..540fb617e89 --- /dev/null +++ b/queue-4.17/fscrypt-use-unbound-workqueue-for-decryption.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Eric Biggers +Date: Fri, 20 Apr 2018 16:30:02 -0700 +Subject: fscrypt: use unbound workqueue for decryption + +From: Eric Biggers + +[ Upstream commit 36dd26e0c8d42699eeba87431246c07c28075bae ] + +Improve fscrypt read performance by switching the decryption workqueue +from bound to unbound. With the bound workqueue, when multiple bios +completed on the same CPU, they were decrypted on that same CPU. But +with the unbound queue, they are now decrypted in parallel on any CPU. + +Although fscrypt read performance can be tough to measure due to the +many sources of variation, this change is most beneficial when +decryption is slow, e.g. on CPUs without AES instructions. For example, +I timed tarring up encrypted directories on f2fs. On x86 with AES-NI +instructions disabled, the unbound workqueue improved performance by +about 25-35%, using 1 to NUM_CPUs jobs with 4 or 8 CPUs available. But +with AES-NI enabled, performance was unchanged to within ~2%. + +I also did the same test on a quad-core ARM CPU using xts-speck128-neon +encryption. There performance was usually about 10% better with the +unbound workqueue, bringing it closer to the unencrypted speed. + +The unbound workqueue may be worse in some cases due to worse locality, +but I think it's still the better default. dm-crypt uses an unbound +workqueue by default too, so this change makes fscrypt match. + +Signed-off-by: Eric Biggers +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/crypto/crypto.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/crypto/crypto.c ++++ b/fs/crypto/crypto.c +@@ -427,8 +427,17 @@ fail: + */ + static int __init fscrypt_init(void) + { ++ /* ++ * Use an unbound workqueue to allow bios to be decrypted in parallel ++ * even when they happen to complete on the same CPU. This sacrifices ++ * locality, but it's worthwhile since decryption is CPU-intensive. ++ * ++ * Also use a high-priority workqueue to prioritize decryption work, ++ * which blocks reads from completing, over regular application tasks. ++ */ + fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue", +- WQ_HIGHPRI, 0); ++ WQ_UNBOUND | WQ_HIGHPRI, ++ num_online_cpus()); + if (!fscrypt_read_workqueue) + goto fail; + diff --git a/queue-4.17/gpu-host1x-acquire-a-reference-to-the-iova-cache.patch b/queue-4.17/gpu-host1x-acquire-a-reference-to-the-iova-cache.patch new file mode 100644 index 00000000000..cadefee59e6 --- /dev/null +++ b/queue-4.17/gpu-host1x-acquire-a-reference-to-the-iova-cache.patch @@ -0,0 +1,73 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thierry Reding +Date: Mon, 14 May 2018 11:14:00 +0200 +Subject: gpu: host1x: Acquire a reference to the IOVA cache + +From: Thierry Reding + +[ Upstream commit f40e1590c5270e5559fb95a5a0a7c1f5266a522d ] + +The IOVA API uses a memory cache to allocate IOVA nodes from. To make +sure that this cache is available, obtain a reference to it and release +the reference when the cache is no longer needed. + +On 64-bit ARM this is hidden by the fact that the DMA mapping API gets +that reference and never releases it. On 32-bit ARM, this is papered +over by the Tegra DRM driver (the sole user of the host1x API requiring +the cache) acquiring a reference to the IOVA cache for its own purposes. +However, there may be additional users of this API in the future, so fix +this upfront to avoid surprises. + +Fixes: 404bfb78daf3 ("gpu: host1x: Add IOMMU support") +Reviewed-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/host1x/dev.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -223,10 +223,14 @@ static int host1x_probe(struct platform_ + struct iommu_domain_geometry *geometry; + unsigned long order; + ++ err = iova_cache_get(); ++ if (err < 0) ++ goto put_group; ++ + host->domain = iommu_domain_alloc(&platform_bus_type); + if (!host->domain) { + err = -ENOMEM; +- goto put_group; ++ goto put_cache; + } + + err = iommu_attach_group(host->domain, host->group); +@@ -234,6 +238,7 @@ static int host1x_probe(struct platform_ + if (err == -ENODEV) { + iommu_domain_free(host->domain); + host->domain = NULL; ++ iova_cache_put(); + iommu_group_put(host->group); + host->group = NULL; + goto skip_iommu; +@@ -308,6 +313,9 @@ fail_detach_device: + fail_free_domain: + if (host->domain) + iommu_domain_free(host->domain); ++put_cache: ++ if (host->group) ++ iova_cache_put(); + put_group: + iommu_group_put(host->group); + +@@ -328,6 +336,7 @@ static int host1x_remove(struct platform + put_iova_domain(&host->iova); + iommu_detach_group(host->domain, host->group); + iommu_domain_free(host->domain); ++ iova_cache_put(); + iommu_group_put(host->group); + } + diff --git a/queue-4.17/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch b/queue-4.17/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch new file mode 100644 index 00000000000..5a099f14894 --- /dev/null +++ b/queue-4.17/hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Terry Junge +Date: Mon, 30 Apr 2018 13:32:46 -0700 +Subject: HID: hid-plantronics: Re-resend Update to map button for PTT products + +From: Terry Junge + +[ Upstream commit 37e376df5f4993677c33968a0c19b0c5acbf1108 ] + +Add a mapping for Push-To-Talk joystick trigger button. + +Tested on ChromeBox/ChromeBook with various Plantronics devices. + +Signed-off-by: Terry Junge +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-plantronics.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -2,7 +2,7 @@ + * Plantronics USB HID Driver + * + * Copyright (c) 2014 JD Cole +- * Copyright (c) 2015 Terry Junge ++ * Copyright (c) 2015-2018 Terry Junge + */ + + /* +@@ -48,6 +48,10 @@ static int plantronics_input_mapping(str + unsigned short mapped_key; + unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); + ++ /* special case for PTT products */ ++ if (field->application == HID_GD_JOYSTICK) ++ goto defaulted; ++ + /* handle volume up/down mapping */ + /* non-standard types or multi-HID interfaces - plt_type is PID */ + if (!(plt_type & HID_USAGE_PAGE)) { diff --git a/queue-4.17/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch b/queue-4.17/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch new file mode 100644 index 00000000000..cd6c713dfb1 --- /dev/null +++ b/queue-4.17/hid-i2c-hid-check-if-device-is-there-before-really-probing.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Dmitry Torokhov +Date: Wed, 9 May 2018 12:12:15 -0700 +Subject: HID: i2c-hid: check if device is there before really probing + +From: Dmitry Torokhov + +[ Upstream commit b3a81b6c4fc6730ac49e20d789a93c0faabafc98 ] + +On many Chromebooks touch devices are multi-sourced; the components are +electrically compatible and one can be freely swapped for another without +changing the OS image or firmware. + +To avoid bunch of scary messages when device is not actually present in the +system let's try testing basic communication with it and if there is no +response terminate probe early with -ENXIO. + +Signed-off-by: Dmitry Torokhov +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/i2c-hid/i2c-hid.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -1054,6 +1054,14 @@ static int i2c_hid_probe(struct i2c_clie + pm_runtime_enable(&client->dev); + device_enable_async_suspend(&client->dev); + ++ /* Make sure there is something at this address */ ++ ret = i2c_smbus_read_byte(client); ++ if (ret < 0) { ++ dev_dbg(&client->dev, "nothing at this address: %d\n", ret); ++ ret = -ENXIO; ++ goto err_pm; ++ } ++ + ret = i2c_hid_fetch_hid_descriptor(ihid); + if (ret < 0) + goto err_pm; diff --git a/queue-4.17/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch b/queue-4.17/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch new file mode 100644 index 00000000000..c97b4676d5b --- /dev/null +++ b/queue-4.17/hv_netvsc-fix-network-namespace-issues-with-vf-support.patch @@ -0,0 +1,131 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Stephen Hemminger +Date: Mon, 11 Jun 2018 12:44:55 -0700 +Subject: hv_netvsc: fix network namespace issues with VF support + +From: Stephen Hemminger + +[ Upstream commit 7bf7bb37f16a80465ee3bd7c6c966f96f5a075a6 ] + +When finding the parent netvsc device, the search needs to be across +all netvsc device instances (independent of network namespace). + +Find parent device of VF using upper_dev_get routine which +searches only adjacent list. + +Fixes: e8ff40d4bff1 ("hv_netvsc: improve VF device matching") +Signed-off-by: Stephen Hemminger + +netns aware byref +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/hyperv/hyperv_net.h | 2 + + drivers/net/hyperv/netvsc_drv.c | 45 ++++++++++++++++++---------------------- + 2 files changed, 23 insertions(+), 24 deletions(-) + +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -738,6 +738,8 @@ struct net_device_context { + struct hv_device *device_ctx; + /* netvsc_device */ + struct netvsc_device __rcu *nvdev; ++ /* list of netvsc net_devices */ ++ struct list_head list; + /* reconfigure work */ + struct delayed_work dwork; + /* last reconfig time */ +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -69,6 +69,8 @@ static int debug = -1; + module_param(debug, int, 0444); + MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)"); + ++static LIST_HEAD(netvsc_dev_list); ++ + static void netvsc_change_rx_flags(struct net_device *net, int change) + { + struct net_device_context *ndev_ctx = netdev_priv(net); +@@ -1779,13 +1781,10 @@ out_unlock: + + static struct net_device *get_netvsc_bymac(const u8 *mac) + { +- struct net_device *dev; +- +- ASSERT_RTNL(); ++ struct net_device_context *ndev_ctx; + +- for_each_netdev(&init_net, dev) { +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ ++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { ++ struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx); + + if (ether_addr_equal(mac, dev->perm_addr)) + return dev; +@@ -1796,25 +1795,18 @@ static struct net_device *get_netvsc_bym + + static struct net_device *get_netvsc_byref(struct net_device *vf_netdev) + { ++ struct net_device_context *net_device_ctx; + struct net_device *dev; + +- ASSERT_RTNL(); +- +- for_each_netdev(&init_net, dev) { +- struct net_device_context *net_device_ctx; +- +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ +- +- net_device_ctx = netdev_priv(dev); +- if (!rtnl_dereference(net_device_ctx->nvdev)) +- continue; /* device is removed */ ++ dev = netdev_master_upper_dev_get(vf_netdev); ++ if (!dev || dev->netdev_ops != &device_ops) ++ return NULL; /* not a netvsc device */ ++ ++ net_device_ctx = netdev_priv(dev); ++ if (!rtnl_dereference(net_device_ctx->nvdev)) ++ return NULL; /* device is removed */ + +- if (rtnl_dereference(net_device_ctx->vf_netdev) == vf_netdev) +- return dev; /* a match */ +- } +- +- return NULL; ++ return dev; + } + + /* Called when VF is injecting data into network stack. +@@ -2094,15 +2086,19 @@ static int netvsc_probe(struct hv_device + else + net->max_mtu = ETH_DATA_LEN; + +- ret = register_netdev(net); ++ rtnl_lock(); ++ ret = register_netdevice(net); + if (ret != 0) { + pr_err("Unable to register netdev.\n"); + goto register_failed; + } + +- return ret; ++ list_add(&net_device_ctx->list, &netvsc_dev_list); ++ rtnl_unlock(); ++ return 0; + + register_failed: ++ rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: + free_percpu(net_device_ctx->vf_stats); +@@ -2148,6 +2144,7 @@ static int netvsc_remove(struct hv_devic + rndis_filter_device_remove(dev, nvdev); + + unregister_netdevice(net); ++ list_del(&ndev_ctx->list); + + rtnl_unlock(); + rcu_read_unlock(); diff --git a/queue-4.17/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch b/queue-4.17/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch new file mode 100644 index 00000000000..10c7b4fd89a --- /dev/null +++ b/queue-4.17/hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Stewart Smith +Date: Thu, 29 Mar 2018 17:02:46 +1100 +Subject: hvc_opal: don't set tb_ticks_per_usec in udbg_init_opal_common() + +From: Stewart Smith + +[ Upstream commit 447808bf500a7cc92173266a59f8a494e132b122 ] + +time_init() will set up tb_ticks_per_usec based on reality. +time_init() is called *after* udbg_init_opal_common() during boot. + +from arch/powerpc/kernel/time.c: + unsigned long tb_ticks_per_usec = 100; /* sane default */ + +Currently, all powernv systems have a timebase frequency of 512mhz +(512000000/1000000 == 0x200) - although there's nothing written +down anywhere that I can find saying that we couldn't make that +different based on the requirements in the ISA. + +So, we've been (accidentally) thwacking the (currently) correct +(for powernv at least) value for tb_ticks_per_usec earlier than +we otherwise would have. + +The "sane default" seems to be adequate for our purposes between +udbg_init_opal_common() and time_init() being called, and if it isn't, +then we should probably be setting it somewhere that isn't hvc_opal.c! + +Signed-off-by: Stewart Smith +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/hvc/hvc_opal.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/tty/hvc/hvc_opal.c ++++ b/drivers/tty/hvc/hvc_opal.c +@@ -318,7 +318,6 @@ static void udbg_init_opal_common(void) + udbg_putc = udbg_opal_putc; + udbg_getc = udbg_opal_getc; + udbg_getc_poll = udbg_opal_getc_poll; +- tb_ticks_per_usec = 0x200; /* Make udelay not suck */ + } + + void __init hvc_opal_init_early(void) diff --git a/queue-4.17/i40e-add-advertising-10g-lr-mode.patch b/queue-4.17/i40e-add-advertising-10g-lr-mode.patch new file mode 100644 index 00000000000..19172fff7ff --- /dev/null +++ b/queue-4.17/i40e-add-advertising-10g-lr-mode.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jakub Pawlak +Date: Fri, 20 Apr 2018 01:41:35 -0700 +Subject: i40e: Add advertising 10G LR mode + +From: Jakub Pawlak + +[ Upstream commit 6ee4d32255865fc4b383355a8354603d60ab9f8a ] + +The advertising 10G LR mode should be possible to set +but in the function i40e_set_link_ksettings() check for this +is missed. This patch adds check for 10000baseLR_Full +flag for 10G modes. + +Signed-off-by: Jakub Pawlak +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -977,7 +977,9 @@ static int i40e_set_link_ksettings(struc + ethtool_link_ksettings_test_link_mode(ks, advertising, + 10000baseCR_Full) || + ethtool_link_ksettings_test_link_mode(ks, advertising, +- 10000baseSR_Full)) ++ 10000baseSR_Full) || ++ ethtool_link_ksettings_test_link_mode(ks, advertising, ++ 10000baseLR_Full)) + config.link_speed |= I40E_LINK_SPEED_10GB; + if (ethtool_link_ksettings_test_link_mode(ks, advertising, + 20000baseKR2_Full)) diff --git a/queue-4.17/i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch b/queue-4.17/i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch new file mode 100644 index 00000000000..b0f07739bcd --- /dev/null +++ b/queue-4.17/i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch @@ -0,0 +1,142 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jacob Keller +Date: Fri, 20 Apr 2018 01:41:38 -0700 +Subject: i40e: avoid overflow in i40e_ptp_adjfreq() + +From: Jacob Keller + +[ Upstream commit 830e0dd9996c4644e42412aa6c46ed8f8eab0cca ] + +When operating at 1GbE, the base incval for the PTP clock is so large +that multiplying it by numbers close to the max_adj can overflow the +u64. + +Rather than attempting to limit the max_adj to a value small enough to +avoid overflow, instead calculate the incvalue adjustment based on the +40GbE incvalue, and then multiply that by the scaling factor for the +link speed. + +This sacrifices a small amount of precision in the adjustment but we +avoid erratic behavior of the clock due to the overflow caused if ppb is +very near the maximum adjustment. + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e.h | 2 - + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 41 +++++++++++++++++++---------- + 2 files changed, 28 insertions(+), 15 deletions(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -608,7 +608,7 @@ struct i40e_pf { + unsigned long ptp_tx_start; + struct hwtstamp_config tstamp_config; + struct mutex tmreg_lock; /* Used to protect the SYSTIME registers. */ +- u64 ptp_base_adj; ++ u32 ptp_adj_mult; + u32 tx_hwtstamp_timeouts; + u32 tx_hwtstamp_skipped; + u32 rx_hwtstamp_cleared; +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -40,9 +40,9 @@ + * At 1Gb link, the period is multiplied by 20. (32ns) + * 1588 functionality is not supported at 100Mbps. + */ +-#define I40E_PTP_40GB_INCVAL 0x0199999999ULL +-#define I40E_PTP_10GB_INCVAL 0x0333333333ULL +-#define I40E_PTP_1GB_INCVAL 0x2000000000ULL ++#define I40E_PTP_40GB_INCVAL 0x0199999999ULL ++#define I40E_PTP_10GB_INCVAL_MULT 2 ++#define I40E_PTP_1GB_INCVAL_MULT 20 + + #define I40E_PRTTSYN_CTL1_TSYNTYPE_V1 BIT(I40E_PRTTSYN_CTL1_TSYNTYPE_SHIFT) + #define I40E_PRTTSYN_CTL1_TSYNTYPE_V2 (2 << \ +@@ -130,17 +130,24 @@ static int i40e_ptp_adjfreq(struct ptp_c + ppb = -ppb; + } + +- smp_mb(); /* Force any pending update before accessing. */ +- adj = READ_ONCE(pf->ptp_base_adj); +- +- freq = adj; ++ freq = I40E_PTP_40GB_INCVAL; + freq *= ppb; + diff = div_u64(freq, 1000000000ULL); + + if (neg_adj) +- adj -= diff; ++ adj = I40E_PTP_40GB_INCVAL - diff; + else +- adj += diff; ++ adj = I40E_PTP_40GB_INCVAL + diff; ++ ++ /* At some link speeds, the base incval is so large that directly ++ * multiplying by ppb would result in arithmetic overflow even when ++ * using a u64. Avoid this by instead calculating the new incval ++ * always in terms of the 40GbE clock rate and then multiplying by the ++ * link speed factor afterwards. This does result in slightly lower ++ * precision at lower link speeds, but it is fairly minor. ++ */ ++ smp_mb(); /* Force any pending update before accessing. */ ++ adj *= READ_ONCE(pf->ptp_adj_mult); + + wr32(hw, I40E_PRTTSYN_INC_L, adj & 0xFFFFFFFF); + wr32(hw, I40E_PRTTSYN_INC_H, adj >> 32); +@@ -467,6 +474,7 @@ void i40e_ptp_set_increment(struct i40e_ + struct i40e_link_status *hw_link_info; + struct i40e_hw *hw = &pf->hw; + u64 incval; ++ u32 mult; + + hw_link_info = &hw->phy.link_info; + +@@ -474,10 +482,10 @@ void i40e_ptp_set_increment(struct i40e_ + + switch (hw_link_info->link_speed) { + case I40E_LINK_SPEED_10GB: +- incval = I40E_PTP_10GB_INCVAL; ++ mult = I40E_PTP_10GB_INCVAL_MULT; + break; + case I40E_LINK_SPEED_1GB: +- incval = I40E_PTP_1GB_INCVAL; ++ mult = I40E_PTP_1GB_INCVAL_MULT; + break; + case I40E_LINK_SPEED_100MB: + { +@@ -488,15 +496,20 @@ void i40e_ptp_set_increment(struct i40e_ + "1588 functionality is not supported at 100 Mbps. Stopping the PHC.\n"); + warn_once++; + } +- incval = 0; ++ mult = 0; + break; + } + case I40E_LINK_SPEED_40GB: + default: +- incval = I40E_PTP_40GB_INCVAL; ++ mult = 1; + break; + } + ++ /* The increment value is calculated by taking the base 40GbE incvalue ++ * and multiplying it by a factor based on the link speed. ++ */ ++ incval = I40E_PTP_40GB_INCVAL * mult; ++ + /* Write the new increment value into the increment register. The + * hardware will not update the clock until both registers have been + * written. +@@ -505,7 +518,7 @@ void i40e_ptp_set_increment(struct i40e_ + wr32(hw, I40E_PRTTSYN_INC_H, incval >> 32); + + /* Update the base adjustement value. */ +- WRITE_ONCE(pf->ptp_base_adj, incval); ++ WRITE_ONCE(pf->ptp_adj_mult, mult); + smp_mb(); /* Force the above update. */ + } + diff --git a/queue-4.17/i40e-free-the-skb-after-clearing-the-bitlock.patch b/queue-4.17/i40e-free-the-skb-after-clearing-the-bitlock.patch new file mode 100644 index 00000000000..1b2d77a1663 --- /dev/null +++ b/queue-4.17/i40e-free-the-skb-after-clearing-the-bitlock.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jacob Keller +Date: Thu, 10 May 2018 05:59:48 -0700 +Subject: i40e: free the skb after clearing the bitlock + +From: Jacob Keller + +[ Upstream commit c79756cb5f084736b138da9319a02f7c72644548 ] + +In commit bbc4e7d273b5 ("i40e: fix race condition with PTP_TX_IN_PROGRESS +bits") we modified the code which handles Tx timestamps so that we would +clear the progress bit as soon as possible. + +A later commit 0bc0706b46cd ("i40e: check for Tx timestamp timeouts during +watchdog") introduced similar code for detecting and handling cleanup of +a blocked Tx timestamp. This code did not use the same pattern for cleaning +up the skb. + +Update this code to wait to free the skb until after the bit lock is +free, by first setting the ptp_tx_skb to NULL and clearing the lock. + +Signed-off-by: Jacob Keller +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ptp.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -338,6 +338,8 @@ void i40e_ptp_rx_hang(struct i40e_pf *pf + **/ + void i40e_ptp_tx_hang(struct i40e_pf *pf) + { ++ struct sk_buff *skb; ++ + if (!(pf->flags & I40E_FLAG_PTP) || !pf->ptp_tx) + return; + +@@ -350,9 +352,12 @@ void i40e_ptp_tx_hang(struct i40e_pf *pf + * within a second it is reasonable to assume that we never will. + */ + if (time_is_before_jiffies(pf->ptp_tx_start + HZ)) { +- dev_kfree_skb_any(pf->ptp_tx_skb); ++ skb = pf->ptp_tx_skb; + pf->ptp_tx_skb = NULL; + clear_bit_unlock(__I40E_PTP_TX_IN_PROGRESS, pf->state); ++ ++ /* Free the skb after we clear the bitlock */ ++ dev_kfree_skb_any(skb); + pf->tx_hwtstamp_timeouts++; + } + } diff --git a/queue-4.17/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch b/queue-4.17/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch new file mode 100644 index 00000000000..6ded8ef39b9 --- /dev/null +++ b/queue-4.17/ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ben Hutchings +Date: Wed, 9 May 2018 22:48:41 +0100 +Subject: IB: Fix RDMA_RXE and INFINIBAND_RDMAVT dependencies for DMA_VIRT_OPS + +From: Ben Hutchings + +[ Upstream commit e02637e97d68a54b1527bc654bf8377eda310226 ] + +DMA_VIRT_OPS requires that dma_addr_t is at least as wide as a +pointer, which is expressed as a dependency on !64BIT || +ARCH_DMA_ADDR_T_64BIT. + +For parisc64 this is not true, and if these IB modules are enabled, +kconfig warns: + +WARNING: unmet direct dependencies detected for DMA_VIRT_OPS + Depends on [n]: HAS_DMA [=y] && (!64BIT [=y] || ARCH_DMA_ADDR_T_64BIT) + Selected by [m]: + - INFINIBAND_RDMAVT [=m] && INFINIBAND [=m] && 64BIT [=y] && PCI [=y] + - RDMA_RXE [=m] && INET [=y] && PCI [=y] && INFINIBAND [=m] + +Add dependencies to fix this. + +Signed-off-by: Ben Hutchings +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rdmavt/Kconfig | 2 +- + drivers/infiniband/sw/rxe/Kconfig | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/sw/rdmavt/Kconfig ++++ b/drivers/infiniband/sw/rdmavt/Kconfig +@@ -1,6 +1,6 @@ + config INFINIBAND_RDMAVT + tristate "RDMA verbs transport library" +- depends on 64BIT ++ depends on 64BIT && ARCH_DMA_ADDR_T_64BIT + depends on PCI + select DMA_VIRT_OPS + ---help--- +--- a/drivers/infiniband/sw/rxe/Kconfig ++++ b/drivers/infiniband/sw/rxe/Kconfig +@@ -1,6 +1,7 @@ + config RDMA_RXE + tristate "Software RDMA over Ethernet (RoCE) driver" + depends on INET && PCI && INFINIBAND ++ depends on !64BIT || ARCH_DMA_ADDR_T_64BIT + select NET_UDP_TUNNEL + select CRYPTO_CRC32 + select DMA_VIRT_OPS diff --git a/queue-4.17/igb-fix-queue-selection-on-mac-filters-on-i210.patch b/queue-4.17/igb-fix-queue-selection-on-mac-filters-on-i210.patch new file mode 100644 index 00000000000..79d9f961706 --- /dev/null +++ b/queue-4.17/igb-fix-queue-selection-on-mac-filters-on-i210.patch @@ -0,0 +1,52 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Vinicius Costa Gomes +Date: Tue, 10 Apr 2018 10:49:51 -0700 +Subject: igb: Fix queue selection on MAC filters on i210 + +From: Vinicius Costa Gomes + +[ Upstream commit 4dc93fcf0b95dc3fda4db917effae31fbb8ad2a8 ] + +On the RAH registers there are semantic differences on the meaning of +the "queue" parameter for traffic steering depending on the controller +model: there is the 82575 meaning, which "queue" means a RX Hardware +Queue, and the i350 meaning, where it is a reception pool. + +The previous behaviour was having no effect for i210 based controllers +because the QSEL bit of the RAH register wasn't being set. + +This patch separates the condition in discrete cases, so the different +handling is clearer. + +Fixes: 83c21335c876 ("igb: improve MAC filter handling") +Signed-off-by: Vinicius Costa Gomes +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igb/igb_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8763,12 +8763,17 @@ static void igb_rar_set_index(struct igb + if (is_valid_ether_addr(addr)) + rar_high |= E1000_RAH_AV; + +- if (hw->mac.type == e1000_82575) ++ switch (hw->mac.type) { ++ case e1000_82575: ++ case e1000_i210: + rar_high |= E1000_RAH_POOL_1 * + adapter->mac_table[index].queue; +- else ++ break; ++ default: + rar_high |= E1000_RAH_POOL_1 << + adapter->mac_table[index].queue; ++ break; ++ } + } + + wr32(E1000_RAL(index), rar_low); diff --git a/queue-4.17/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch b/queue-4.17/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch new file mode 100644 index 00000000000..ea3f256f320 --- /dev/null +++ b/queue-4.17/ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mimi Zohar +Date: Fri, 27 Apr 2018 14:31:40 -0400 +Subject: ima: based on policy verify firmware signatures (pre-allocated buffer) + +From: Mimi Zohar + +[ Upstream commit fd90bc559bfba743ae8de87ff23b92a5e4668062 ] + +Don't differentiate, for now, between kernel_read_file_id READING_FIRMWARE +and READING_FIRMWARE_PREALLOC_BUFFER enumerations. + +Fixes: a098ecd firmware: support loading into a pre-allocated buffer (since 4.8) +Signed-off-by: Mimi Zohar +Cc: Luis R. Rodriguez +Cc: David Howells +Cc: Kees Cook +Cc: Serge E. Hallyn +Cc: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/integrity/ima/ima_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -449,6 +449,7 @@ int ima_read_file(struct file *file, enu + + static int read_idmap[READING_MAX_ID] = { + [READING_FIRMWARE] = FIRMWARE_CHECK, ++ [READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK, + [READING_MODULE] = MODULE_CHECK, + [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK, + [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK, diff --git a/queue-4.17/infiniband-fix-a-possible-use-after-free-bug.patch b/queue-4.17/infiniband-fix-a-possible-use-after-free-bug.patch new file mode 100644 index 00000000000..1a8484a5fa1 --- /dev/null +++ b/queue-4.17/infiniband-fix-a-possible-use-after-free-bug.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Cong Wang +Date: Fri, 1 Jun 2018 11:31:44 -0700 +Subject: infiniband: fix a possible use-after-free bug + +From: Cong Wang + +[ Upstream commit cb2595c1393b4a5211534e6f0a0fbad369e21ad8 ] + +ucma_process_join() will free the new allocated "mc" struct, +if there is any error after that, especially the copy_to_user(). + +But in parallel, ucma_leave_multicast() could find this "mc" +through idr_find() before ucma_process_join() frees it, since it +is already published. + +So "mc" could be used in ucma_leave_multicast() after it is been +allocated and freed in ucma_process_join(), since we don't refcnt +it. + +Fix this by separating "publish" from ID allocation, so that we +can get an ID first and publish it later after copy_to_user(). + +Fixes: c8f6a362bf3e ("RDMA/cma: Add multicast communication support") +Reported-by: Noam Rathaus +Signed-off-by: Cong Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/ucma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -235,7 +235,7 @@ static struct ucma_multicast* ucma_alloc + return NULL; + + mutex_lock(&mut); +- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); ++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); + mutex_unlock(&mut); + if (mc->id < 0) + goto error; +@@ -1421,6 +1421,10 @@ static ssize_t ucma_process_join(struct + goto err3; + } + ++ mutex_lock(&mut); ++ idr_replace(&multicast_idr, mc, mc->id); ++ mutex_unlock(&mut); ++ + mutex_unlock(&file->mut); + ucma_put_ctx(ctx); + return 0; diff --git a/queue-4.17/ipconfig-correctly-initialise-ic_nameservers.patch b/queue-4.17/ipconfig-correctly-initialise-ic_nameservers.patch new file mode 100644 index 00000000000..8e026c885ba --- /dev/null +++ b/queue-4.17/ipconfig-correctly-initialise-ic_nameservers.patch @@ -0,0 +1,86 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chris Novakovic +Date: Tue, 24 Apr 2018 03:56:37 +0100 +Subject: ipconfig: Correctly initialise ic_nameservers + +From: Chris Novakovic + +[ Upstream commit 300eec7c0a2495f771709c7642aa15f7cc148b83 ] + +ic_nameservers, which stores the list of name servers discovered by +ipconfig, is initialised (i.e. has all of its elements set to NONE, or +0xffffffff) by ic_nameservers_predef() in the following scenarios: + + - before the "ip=" and "nfsaddrs=" kernel command line parameters are + parsed (in ip_auto_config_setup()); + - before autoconfiguring via DHCP or BOOTP (in ic_bootp_init()), in + order to clear any values that may have been set after parsing "ip=" + or "nfsaddrs=" and are no longer needed. + +This means that ic_nameservers_predef() is not called when neither "ip=" +nor "nfsaddrs=" is specified on the kernel command line. In this +scenario, every element in ic_nameservers remains set to 0x00000000, +which is indistinguishable from ANY and causes pnp_seq_show() to write +the following (bogus) information to /proc/net/pnp: + + #MANUAL + nameserver 0.0.0.0 + nameserver 0.0.0.0 + nameserver 0.0.0.0 + +This is potentially problematic for systems that blindly link +/etc/resolv.conf to /proc/net/pnp. + +Ensure that ic_nameservers is also initialised when neither "ip=" nor +"nfsaddrs=" are specified by calling ic_nameservers_predef() in +ip_auto_config(), but only when ip_auto_config_setup() was not called +earlier. This causes the following to be written to /proc/net/pnp, and +is consistent with what gets written when ipconfig is configured +manually but no name servers are specified on the kernel command line: + + #MANUAL + +Signed-off-by: Chris Novakovic +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ipconfig.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/net/ipv4/ipconfig.c ++++ b/net/ipv4/ipconfig.c +@@ -748,6 +748,11 @@ static void __init ic_bootp_init_ext(u8 + */ + static inline void __init ic_bootp_init(void) + { ++ /* Re-initialise all name servers to NONE, in case any were set via the ++ * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses ++ * specified there will already have been decoded but are no longer ++ * needed ++ */ + ic_nameservers_predef(); + + dev_add_pack(&bootp_packet_type); +@@ -1368,6 +1373,13 @@ static int __init ip_auto_config(void) + int err; + unsigned int i; + ++ /* Initialise all name servers to NONE (but only if the "ip=" or ++ * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise ++ * we'll overwrite the IP addresses specified there) ++ */ ++ if (ic_set_manually == 0) ++ ic_nameservers_predef(); ++ + #ifdef CONFIG_PROC_FS + proc_create("pnp", 0444, init_net.proc_net, &pnp_seq_fops); + #endif /* CONFIG_PROC_FS */ +@@ -1588,6 +1600,7 @@ static int __init ip_auto_config_setup(c + return 1; + } + ++ /* Initialise all name servers to NONE */ + ic_nameservers_predef(); + + /* Parse string for static IP assignment. */ diff --git a/queue-4.17/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch b/queue-4.17/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch new file mode 100644 index 00000000000..3eb5451792f --- /dev/null +++ b/queue-4.17/irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Laurentiu Tudor +Date: Tue, 5 Jun 2018 15:27:27 +0300 +Subject: irqchip/ls-scfg-msi: Map MSIs in the iommu + +From: Laurentiu Tudor + +[ Upstream commit 0cdd431c337e99177e68597f3de34bedd3a20a74 ] + +Add the required iommu_dma_map_msi_msg() when composing the MSI message, +otherwise the interrupts will not work. + +Signed-off-by: Laurentiu Tudor +Signed-off-by: Thomas Gleixner +Cc: jason@lakedaemon.net +Cc: marc.zyngier@arm.com +Cc: zhiqiang.hou@nxp.com +Cc: minghuan.lian@nxp.com +Link: https://lkml.kernel.org/r/20180605122727.12831-1-laurentiu.tudor@nxp.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-ls-scfg-msi.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/irqchip/irq-ls-scfg-msi.c ++++ b/drivers/irqchip/irq-ls-scfg-msi.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #define MSI_IRQS_PER_MSIR 32 + #define MSI_MSIR_OFFSET 4 +@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(stru + + if (msi_affinity_flag) + msg->data |= cpumask_first(data->common->affinity); ++ ++ iommu_dma_map_msi_msg(data->irq, msg); + } + + static int ls_scfg_msi_set_affinity(struct irq_data *irq_data, diff --git a/queue-4.17/iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch b/queue-4.17/iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch new file mode 100644 index 00000000000..ad19194a623 --- /dev/null +++ b/queue-4.17/iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch @@ -0,0 +1,291 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Gregory Greenman +Date: Tue, 24 Apr 2018 06:26:41 +0300 +Subject: iwlwifi: mvm: open BA session only when sta is authorized + +From: Gregory Greenman + +[ Upstream commit d94c5a820d107fdde711ec72c16848876027713d ] + +Currently, a BA session is opened when the tx traffic exceeds +10 frames per second. As a result of inter-op problems with some +APs, add a condition to open BA session only when station is +already authorized. + +Fixes: 482e48440a0e ("iwlwifi: mvm: change open and close criteria of a BA session") +Signed-off-by: Gregory Greenman +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 +--- + drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 38 +++++++++++----------- + drivers/net/wireless/intel/iwlwifi/mvm/rs.h | 7 +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 2 - + drivers/net/wireless/intel/iwlwifi/mvm/sta.h | 10 ++--- + 5 files changed, 29 insertions(+), 36 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -2652,7 +2652,7 @@ static int iwl_mvm_mac_sta_state(struct + + mutex_lock(&mvm->mutex); + /* track whether or not the station is associated */ +- mvm_sta->associated = new_state >= IEEE80211_STA_ASSOC; ++ mvm_sta->sta_state = new_state; + + if (old_state == IEEE80211_STA_NOTEXIST && + new_state == IEEE80211_STA_NONE) { +@@ -2704,8 +2704,7 @@ static int iwl_mvm_mac_sta_state(struct + iwl_mvm_mac_ctxt_changed(mvm, vif, false, NULL); + } + +- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band, +- true); ++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band); + ret = iwl_mvm_update_sta(mvm, vif, sta); + } else if (old_state == IEEE80211_STA_ASSOC && + new_state == IEEE80211_STA_AUTHORIZED) { +@@ -2721,8 +2720,7 @@ static int iwl_mvm_mac_sta_state(struct + /* enable beacon filtering */ + WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0)); + +- iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band, +- false); ++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band); + + ret = 0; + } else if (old_state == IEEE80211_STA_AUTHORIZED && +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -3,6 +3,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as +@@ -13,10 +14,6 @@ + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * +- * You should have received a copy of the GNU General Public License along with +- * this program; if not, write to the Free Software Foundation, Inc., +- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +- * + * The full GNU General Public License is included in this distribution in the + * file called LICENSE. + * +@@ -651,9 +648,10 @@ static void rs_tl_turn_on_agg(struct iwl + } + + tid_data = &mvmsta->tid_data[tid]; +- if ((tid_data->state == IWL_AGG_OFF) && ++ if (mvmsta->sta_state >= IEEE80211_STA_AUTHORIZED && ++ tid_data->state == IWL_AGG_OFF && + (lq_sta->tx_agg_tid_en & BIT(tid)) && +- (tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD)) { ++ tid_data->tx_count_last >= IWL_MVM_RS_AGG_START_THRESHOLD) { + IWL_DEBUG_RATE(mvm, "try to aggregate tid %d\n", tid); + if (rs_tl_turn_on_agg_for_tid(mvm, lq_sta, tid, sta) == 0) + tid_data->state = IWL_AGG_QUEUED; +@@ -1257,7 +1255,7 @@ void iwl_mvm_rs_tx_status(struct iwl_mvm + (unsigned long)(lq_sta->last_tx + + (IWL_MVM_RS_IDLE_TIMEOUT * HZ)))) { + IWL_DEBUG_RATE(mvm, "Tx idle for too long. reinit rs\n"); +- iwl_mvm_rs_rate_init(mvm, sta, info->band, false); ++ iwl_mvm_rs_rate_init(mvm, sta, info->band); + return; + } + lq_sta->last_tx = jiffies; +@@ -2684,9 +2682,9 @@ static void rs_get_initial_rate(struct i + struct ieee80211_sta *sta, + struct iwl_lq_sta *lq_sta, + enum nl80211_band band, +- struct rs_rate *rate, +- bool init) ++ struct rs_rate *rate) + { ++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + int i, nentries; + unsigned long active_rate; + s8 best_rssi = S8_MIN; +@@ -2748,7 +2746,8 @@ static void rs_get_initial_rate(struct i + * bandwidth rate, and after authorization, when the phy context + * is already up-to-date, re-init rs with the correct bw. + */ +- u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta); ++ u32 bw = mvmsta->sta_state < IEEE80211_STA_AUTHORIZED ? ++ RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta); + + switch (bw) { + case RATE_MCS_CHAN_WIDTH_40: +@@ -2833,9 +2832,9 @@ void rs_update_last_rssi(struct iwl_mvm + static void rs_initialize_lq(struct iwl_mvm *mvm, + struct ieee80211_sta *sta, + struct iwl_lq_sta *lq_sta, +- enum nl80211_band band, +- bool init) ++ enum nl80211_band band) + { ++ struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta); + struct iwl_scale_tbl_info *tbl; + struct rs_rate *rate; + u8 active_tbl = 0; +@@ -2851,7 +2850,7 @@ static void rs_initialize_lq(struct iwl_ + tbl = &(lq_sta->lq_info[active_tbl]); + rate = &tbl->rate; + +- rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init); ++ rs_get_initial_rate(mvm, sta, lq_sta, band, rate); + rs_init_optimal_rate(mvm, sta, lq_sta); + + WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B, +@@ -2864,7 +2863,8 @@ static void rs_initialize_lq(struct iwl_ + rs_set_expected_tpt_table(lq_sta, tbl); + rs_fill_lq_cmd(mvm, sta, lq_sta, rate); + /* TODO restore station should remember the lq cmd */ +- iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init); ++ iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, ++ mvmsta->sta_state < IEEE80211_STA_AUTHORIZED); + } + + static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta, +@@ -3117,7 +3117,7 @@ void iwl_mvm_update_frame_stats(struct i + * Called after adding a new station to initialize rate scaling + */ + static void rs_drv_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, +- enum nl80211_band band, bool init) ++ enum nl80211_band band) + { + int i, j; + struct ieee80211_hw *hw = mvm->hw; +@@ -3196,7 +3196,7 @@ static void rs_drv_rate_init(struct iwl_ + #ifdef CONFIG_IWLWIFI_DEBUGFS + iwl_mvm_reset_frame_stats(mvm); + #endif +- rs_initialize_lq(mvm, sta, lq_sta, band, init); ++ rs_initialize_lq(mvm, sta, lq_sta, band); + } + + static void rs_drv_rate_update(void *mvm_r, +@@ -3216,7 +3216,7 @@ static void rs_drv_rate_update(void *mvm + for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++) + ieee80211_stop_tx_ba_session(sta, tid); + +- iwl_mvm_rs_rate_init(mvm, sta, sband->band, false); ++ iwl_mvm_rs_rate_init(mvm, sta, sband->band); + } + + #ifdef CONFIG_MAC80211_DEBUGFS +@@ -4062,12 +4062,12 @@ static const struct rate_control_ops rs_ + }; + + void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, +- enum nl80211_band band, bool init) ++ enum nl80211_band band) + { + if (iwl_mvm_has_tlc_offload(mvm)) + rs_fw_rate_init(mvm, sta, band); + else +- rs_drv_rate_init(mvm, sta, band, init); ++ rs_drv_rate_init(mvm, sta, band); + } + + int iwl_mvm_rate_control_register(void) +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.h +@@ -3,6 +3,7 @@ + * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2015 Intel Mobile Communications GmbH + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of version 2 of the GNU General Public License as +@@ -13,10 +14,6 @@ + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for + * more details. + * +- * You should have received a copy of the GNU General Public License along with +- * this program; if not, write to the Free Software Foundation, Inc., +- * 51 Franklin Street, Fifth Floor, Boston, MA 02110, USA +- * + * The full GNU General Public License is included in this distribution in the + * file called LICENSE. + * +@@ -410,7 +407,7 @@ struct iwl_lq_sta { + + /* Initialize station's rate scaling information after adding station */ + void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta, +- enum nl80211_band band, bool init); ++ enum nl80211_band band); + + /* Notify RS about Tx status */ + void iwl_mvm_rs_tx_status(struct iwl_mvm *mvm, struct ieee80211_sta *sta, +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -214,7 +214,7 @@ int iwl_mvm_sta_send_to_fw(struct iwl_mv + cpu_to_le32(agg_size << STA_FLG_MAX_AGG_SIZE_SHIFT); + add_sta_cmd.station_flags |= + cpu_to_le32(mpdu_dens << STA_FLG_AGG_MPDU_DENS_SHIFT); +- if (mvm_sta->associated) ++ if (mvm_sta->sta_state >= IEEE80211_STA_ASSOC) + add_sta_cmd.assoc_id = cpu_to_le16(sta->aid); + + if (sta->wme) { +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.h +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2016 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -18,11 +19,6 @@ + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, +- * USA +- * + * The full GNU General Public License is included in this distribution + * in the file called COPYING. + * +@@ -35,6 +31,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2016 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -376,6 +373,7 @@ struct iwl_mvm_rxq_dup_data { + * tid. + * @max_agg_bufsize: the maximal size of the AGG buffer for this station + * @sta_type: station type ++ * @sta_state: station state according to enum %ieee80211_sta_state + * @bt_reduced_txpower: is reduced tx power enabled for this station + * @next_status_eosp: the next reclaimed packet is a PS-Poll response and + * we need to signal the EOSP +@@ -414,6 +412,7 @@ struct iwl_mvm_sta { + u16 tid_disable_agg; + u8 max_agg_bufsize; + enum iwl_sta_type sta_type; ++ enum ieee80211_sta_state sta_state; + bool bt_reduced_txpower; + bool next_status_eosp; + spinlock_t lock; +@@ -438,7 +437,6 @@ struct iwl_mvm_sta { + bool disable_tx; + bool tlc_amsdu; + bool sleeping; +- bool associated; + u8 agg_tids; + u8 sleep_tx_count; + u8 avg_energy; diff --git a/queue-4.17/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch b/queue-4.17/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch new file mode 100644 index 00000000000..33aa55ece11 --- /dev/null +++ b/queue-4.17/iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Shaul Triebitz +Date: Thu, 22 Mar 2018 14:14:45 +0200 +Subject: iwlwifi: pcie: fix race in Rx buffer allocator + +From: Shaul Triebitz + +[ Upstream commit 0f22e40053bd5378ad1e3250e65c574fd61c0cd6 ] + +Make sure the rx_allocator worker is canceled before running the +rx_init routine. rx_init frees and re-allocates all rxb's pages. The +rx_allocator worker also allocates pages for the used rxb's. Running +rx_init and rx_allocator simultaniously causes a kernel panic. Fix +that by canceling the work in rx_init. + +Signed-off-by: Shaul Triebitz +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_ + } + def_rxq = trans_pcie->rxq; + ++ cancel_work_sync(&rba->rx_alloc); ++ + spin_lock(&rba->lock); + atomic_set(&rba->req_pending, 0); + atomic_set(&rba->req_ready, 0); diff --git a/queue-4.17/ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch b/queue-4.17/ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch new file mode 100644 index 00000000000..ae4a8b8113b --- /dev/null +++ b/queue-4.17/ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch @@ -0,0 +1,67 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexander Duyck +Date: Mon, 4 Jun 2018 11:07:24 -0400 +Subject: ixgbe: Fix setting of TC configuration for macvlan case + +From: Alexander Duyck + +[ Upstream commit 646bb57ce86e4d7b0bd9d33244450ae009411e48 ] + +When we were enabling macvlan interfaces we weren't correctly configuring +things until ixgbe_setup_tc was called a second time either by tweaking the +number of queues or increasing the macvlan count past 15. + +The issue came down to the fact that num_rx_pools is not populated until +after the queues and interrupts are reinitialized. + +Instead of trying to set it sooner we can just move the call to setup at +least 1 traffic class to the SR-IOV/VMDq setup function so that we just set +it for this one case. We already had a spot that was configuring the queues +for TC 0 in the code here anyway so it makes sense to also set the number +of TCs here as well. + +Fixes: 49cfbeb7a95c ("ixgbe: Fix handling of macvlan Tx offload") +Signed-off-by: Alexander Duyck +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 8 ++++++++ + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 -------- + 2 files changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +@@ -618,6 +618,14 @@ static bool ixgbe_set_sriov_queues(struc + } + + #endif ++ /* To support macvlan offload we have to use num_tc to ++ * restrict the queues that can be used by the device. ++ * By doing this we can avoid reporting a false number of ++ * queues. ++ */ ++ if (vmdq_i > 1) ++ netdev_set_num_tc(adapter->netdev, 1); ++ + /* populate TC0 for use by pool 0 */ + netdev_set_tc_queue(adapter->netdev, 0, + adapter->num_rx_queues_per_pool, 0); +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8875,14 +8875,6 @@ int ixgbe_setup_tc(struct net_device *de + } else { + netdev_reset_tc(dev); + +- /* To support macvlan offload we have to use num_tc to +- * restrict the queues that can be used by the device. +- * By doing this we can avoid reporting a false number of +- * queues. +- */ +- if (!tc && adapter->num_rx_pools > 1) +- netdev_set_num_tc(dev, 1); +- + if (adapter->hw.mac.type == ixgbe_mac_82598EB) + adapter->hw.fc.requested_mode = adapter->last_lfc_mode; + diff --git a/queue-4.17/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch b/queue-4.17/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch new file mode 100644 index 00000000000..d2fd5a7983b --- /dev/null +++ b/queue-4.17/ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Emil Tantilov +Date: Mon, 14 May 2018 11:16:16 -0700 +Subject: ixgbevf: fix MAC address changes through ixgbevf_set_mac() + +From: Emil Tantilov + +[ Upstream commit 6e7d0ba1e59b1a306761a731e67634c0f2efea2a ] + +Set hw->mac.perm_addr in ixgbevf_set_mac() in order to avoid losing the +custom MAC on reset. This can happen in the following case: + +>ip link set $vf address $mac +>ethtool -r $vf + +Signed-off-by: Emil Tantilov +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -4187,6 +4187,7 @@ static int ixgbevf_set_mac(struct net_de + return -EPERM; + + ether_addr_copy(hw->mac.addr, addr->sa_data); ++ ether_addr_copy(hw->mac.perm_addr, addr->sa_data); + ether_addr_copy(netdev->dev_addr, addr->sa_data); + + return 0; diff --git a/queue-4.17/kcov-ensure-irq-code-sees-a-valid-area.patch b/queue-4.17/kcov-ensure-irq-code-sees-a-valid-area.patch new file mode 100644 index 00000000000..c486d65b9d4 --- /dev/null +++ b/queue-4.17/kcov-ensure-irq-code-sees-a-valid-area.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mark Rutland +Date: Thu, 14 Jun 2018 15:27:34 -0700 +Subject: kcov: ensure irq code sees a valid area + +From: Mark Rutland + +[ Upstream commit c9484b986ef03492357fddd50afbdd02929cfa72 ] + +Patch series "kcov: fix unexpected faults". + +These patches fix a few issues where KCOV code could trigger recursive +faults, discovered while debugging a patch enabling KCOV for arch/arm: + +* On CONFIG_PREEMPT kernels, there's a small race window where + __sanitizer_cov_trace_pc() can see a bogus kcov_area. + +* Lazy faulting of the vmalloc area can cause mutual recursion between + fault handling code and __sanitizer_cov_trace_pc(). + +* During the context switch, switching the mm can cause the kcov_area to + be transiently unmapped. + +These are prerequisites for enabling KCOV on arm, but the issues +themsevles are generic -- we just happen to avoid them by chance rather +than design on x86-64 and arm64. + +This patch (of 3): + +For kernels built with CONFIG_PREEMPT, some C code may execute before or +after the interrupt handler, while the hardirq count is zero. In these +cases, in_task() can return true. + +A task can be interrupted in the middle of a KCOV_DISABLE ioctl while it +resets the task's kcov data via kcov_task_init(). Instrumented code +executed during this period will call __sanitizer_cov_trace_pc(), and as +in_task() returns true, will inspect t->kcov_mode before trying to write +to t->kcov_area. + +In kcov_init_task() we update t->kcov_{mode,area,size} with plain stores, +which may be re-ordered, torn, etc. Thus __sanitizer_cov_trace_pc() may +see bogus values for any of these fields, and may attempt to write to +memory which is not mapped. + +Let's avoid this by using WRITE_ONCE() to set t->kcov_mode, with a +barrier() to ensure this is ordered before we clear t->kov_{area,size}. +This ensures that any code execute while kcov_init_task() is preempted +will either see valid values for t->kcov_{area,size}, or will see that +t->kcov_mode is KCOV_MODE_DISABLED, and bail out without touching +t->kcov_area. + +Link: http://lkml.kernel.org/r/20180504135535.53744-2-mark.rutland@arm.com +Signed-off-by: Mark Rutland +Acked-by: Andrey Ryabinin +Cc: Dmitry Vyukov +Cc: Ingo Molnar +Cc: Peter Zijlstra +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/kcov.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/kcov.c ++++ b/kernel/kcov.c +@@ -241,7 +241,8 @@ static void kcov_put(struct kcov *kcov) + + void kcov_task_init(struct task_struct *t) + { +- t->kcov_mode = KCOV_MODE_DISABLED; ++ WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED); ++ barrier(); + t->kcov_size = 0; + t->kcov_area = NULL; + t->kcov = NULL; diff --git a/queue-4.17/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch b/queue-4.17/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch new file mode 100644 index 00000000000..86a3501475a --- /dev/null +++ b/queue-4.17/kernel-hung_task.c-show-all-hung-tasks-before-panic.patch @@ -0,0 +1,118 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Tetsuo Handa +Date: Thu, 7 Jun 2018 17:10:34 -0700 +Subject: kernel/hung_task.c: show all hung tasks before panic + +From: Tetsuo Handa + +[ Upstream commit 401c636a0eeb0d51862fce222da1bf08e3a0ffd0 ] + +When we get a hung task it can often be valuable to see _all_ the hung +tasks on the system before calling panic(). + +Quoting from https://syzkaller.appspot.com/text?tag=CrashReport&id=5316056503549952 +---------------------------------------- +INFO: task syz-executor0:6540 blocked for more than 120 seconds. + Not tainted 4.16.0+ #13 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +syz-executor0 D23560 6540 4521 0x80000004 +Call Trace: + context_switch kernel/sched/core.c:2848 [inline] + __schedule+0x8fb/0x1ef0 kernel/sched/core.c:3490 + schedule+0xf5/0x430 kernel/sched/core.c:3549 + schedule_preempt_disabled+0x10/0x20 kernel/sched/core.c:3607 + __mutex_lock_common kernel/locking/mutex.c:833 [inline] + __mutex_lock+0xb7f/0x1810 kernel/locking/mutex.c:893 + mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 + lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 + __blkdev_driver_ioctl block/ioctl.c:303 [inline] + blkdev_ioctl+0x1759/0x1e00 block/ioctl.c:601 + ioctl_by_bdev+0xa5/0x110 fs/block_dev.c:2060 + isofs_get_last_session fs/isofs/inode.c:567 [inline] + isofs_fill_super+0x2ba9/0x3bc0 fs/isofs/inode.c:660 + mount_bdev+0x2b7/0x370 fs/super.c:1119 + isofs_mount+0x34/0x40 fs/isofs/inode.c:1560 + mount_fs+0x66/0x2d0 fs/super.c:1222 + vfs_kern_mount.part.26+0xc6/0x4a0 fs/namespace.c:1037 + vfs_kern_mount fs/namespace.c:2514 [inline] + do_new_mount fs/namespace.c:2517 [inline] + do_mount+0xea4/0x2b90 fs/namespace.c:2847 + ksys_mount+0xab/0x120 fs/namespace.c:3063 + SYSC_mount fs/namespace.c:3077 [inline] + SyS_mount+0x39/0x50 fs/namespace.c:3074 + do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 + entry_SYSCALL_64_after_hwframe+0x42/0xb7 +(...snipped...) +Showing all locks held in the system: +(...snipped...) +2 locks held by syz-executor0/6540: + #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: alloc_super fs/super.c:211 [inline] + #0: 00000000566d4c39 (&type->s_umount_key#49/1){+.+.}, at: sget_userns+0x3b2/0xe60 fs/super.c:502 /* down_write_nested(&s->s_umount, SINGLE_DEPTH_NESTING); */ + #1: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */ +(...snipped...) +3 locks held by syz-executor7/6541: + #0: 0000000043ca8836 (&lo->lo_ctl_mutex/1){+.+.}, at: lo_ioctl+0x8b/0x1b70 drivers/block/loop.c:1355 /* mutex_lock_nested(&lo->lo_ctl_mutex, 1); */ + #1: 000000007bf3d3f9 (&bdev->bd_mutex){+.+.}, at: blkdev_reread_part+0x1e/0x40 block/ioctl.c:192 + #2: 00000000566d4c39 (&type->s_umount_key#50){.+.+}, at: __get_super.part.10+0x1d3/0x280 fs/super.c:663 /* down_read(&sb->s_umount); */ +---------------------------------------- + +When reporting an AB-BA deadlock like shown above, it would be nice if +trace of PID=6541 is printed as well as trace of PID=6540 before calling +panic(). + +Showing hung tasks up to /proc/sys/kernel/hung_task_warnings could delay +calling panic() but normally there should not be so many hung tasks. + +Link: http://lkml.kernel.org/r/201804050705.BHE57833.HVFOFtSOMQJFOL@I-love.SAKURA.ne.jp +Signed-off-by: Tetsuo Handa +Acked-by: Paul E. McKenney +Acked-by: Dmitry Vyukov +Cc: Vegard Nossum +Cc: Mandeep Singh Baines +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Ingo Molnar +Signed-off-by: Andrew Morton + +Signed-off-by: Linus Torvalds + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/hung_task.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warni + + static int __read_mostly did_panic; + static bool hung_task_show_lock; ++static bool hung_task_call_panic; + + static struct task_struct *watchdog_task; + +@@ -127,10 +128,8 @@ static void check_hung_task(struct task_ + touch_nmi_watchdog(); + + if (sysctl_hung_task_panic) { +- if (hung_task_show_lock) +- debug_show_all_locks(); +- trigger_all_cpu_backtrace(); +- panic("hung_task: blocked tasks"); ++ hung_task_show_lock = true; ++ hung_task_call_panic = true; + } + } + +@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_t + rcu_read_unlock(); + if (hung_task_show_lock) + debug_show_all_locks(); ++ if (hung_task_call_panic) { ++ trigger_all_cpu_backtrace(); ++ panic("hung_task: blocked tasks"); ++ } + } + + static long hung_timeout_jiffies(unsigned long last_checked, diff --git a/queue-4.17/kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch b/queue-4.17/kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch new file mode 100644 index 00000000000..fed4774d79a --- /dev/null +++ b/queue-4.17/kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Dan Carpenter +Date: Sat, 19 May 2018 09:01:36 +0300 +Subject: KVM: x86: prevent integer overflows in KVM_MEMORY_ENCRYPT_REG_REGION + +From: Dan Carpenter + +[ Upstream commit 86bf20cb57b9570262338752c9df580328bc5632 ] + +This is a fix from reviewing the code, but it looks like it might be +able to lead to an Oops. It affects 32bit systems. + +The KVM_MEMORY_ENCRYPT_REG_REGION ioctl uses a u64 for range->addr and +range->size but the high 32 bits would be truncated away on a 32 bit +system. This is harmless but it's also harmless to prevent it. + +Then in sev_pin_memory() the "uaddr + ulen" calculation can wrap around. +The wrap around can happen on 32 bit or 64 bit systems, but I was only +able to figure out a problem for 32 bit systems. We would pick a number +which results in "npages" being zero. The sev_pin_memory() would then +return ZERO_SIZE_PTR without allocating anything. + +I made it illegal to call sev_pin_memory() with "ulen" set to zero. +Hopefully, that doesn't cause any problems. I also changed the type of +"first" and "last" to long, just for cosmetic reasons. Otherwise on a +64 bit system you're saving "uaddr >> 12" in an int and it truncates the +high 20 bits away. The math works in the current code so far as I can +see but it's just weird. + +Signed-off-by: Dan Carpenter +[Brijesh noted that the code is only reachable on X86_64.] +Reviewed-by: Brijesh Singh +Signed-off-by: Radim Krčmář +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -1768,7 +1768,10 @@ static struct page **sev_pin_memory(stru + unsigned long npages, npinned, size; + unsigned long locked, lock_limit; + struct page **pages; +- int first, last; ++ unsigned long first, last; ++ ++ if (ulen == 0 || uaddr + ulen < uaddr) ++ return NULL; + + /* Calculate number of pages. */ + first = (uaddr & PAGE_MASK) >> PAGE_SHIFT; +@@ -6947,6 +6950,9 @@ static int svm_register_enc_region(struc + if (!sev_guest(kvm)) + return -ENOTTY; + ++ if (range->addr > ULONG_MAX || range->size > ULONG_MAX) ++ return -EINVAL; ++ + region = kzalloc(sizeof(*region), GFP_KERNEL); + if (!region) + return -ENOMEM; diff --git a/queue-4.17/lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch b/queue-4.17/lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch new file mode 100644 index 00000000000..a072b7710ed --- /dev/null +++ b/queue-4.17/lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thierry Escande +Date: Thu, 14 Jun 2018 15:28:15 -0700 +Subject: lib/test_printf.c: call wait_for_random_bytes() before plain %p tests + +From: Thierry Escande + +[ Upstream commit ee410f15b1418f2f4428e79980674c979081bcb7 ] + +If the test_printf module is loaded before the crng is initialized, the +plain 'p' tests will fail because the printed address will not be hashed +and the buffer will contain '(ptrval)' instead. + +This patch adds a call to wait_for_random_bytes() before plain 'p' tests +to make sure the crng is initialized. + +Link: http://lkml.kernel.org/r/20180604113708.11554-1-thierry.escande@linaro.org +Signed-off-by: Thierry Escande +Acked-by: Tobin C. Harding +Reviewed-by: Andrew Morton +Cc: David Miller +Cc: Rasmus Villemoes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + lib/test_printf.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/lib/test_printf.c ++++ b/lib/test_printf.c +@@ -260,6 +260,13 @@ plain(void) + { + int err; + ++ /* ++ * Make sure crng is ready. Otherwise we get "(ptrval)" instead ++ * of a hashed address when printing '%p' in plain_hash() and ++ * plain_format(). ++ */ ++ wait_for_random_bytes(); ++ + err = plain_hash(); + if (err) { + pr_warn("plain 'p' does not appear to be hashed\n"); diff --git a/queue-4.17/libata-fix-command-retry-decision.patch b/queue-4.17/libata-fix-command-retry-decision.patch new file mode 100644 index 00000000000..31a0149f93f --- /dev/null +++ b/queue-4.17/libata-fix-command-retry-decision.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Damien Le Moal +Date: Wed, 9 May 2018 09:28:12 +0900 +Subject: libata: Fix command retry decision + +From: Damien Le Moal + +[ Upstream commit 804689ad2d9b66d0d3920b48cf05881049d44589 ] + +For failed commands with valid sense data (e.g. NCQ commands), +scsi_check_sense() is used in ata_analyze_tf() to determine if the +command can be retried. In such case, rely on this decision and ignore +the command error mask based decision done in ata_worth_retry(). + +This fixes useless retries of commands such as unaligned writes on zoned +disks (TYPE_ZAC). + +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-eh.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2218,12 +2218,16 @@ static void ata_eh_link_autopsy(struct a + if (qc->err_mask & ~AC_ERR_OTHER) + qc->err_mask &= ~AC_ERR_OTHER; + +- /* SENSE_VALID trumps dev/unknown error and revalidation */ ++ /* ++ * SENSE_VALID trumps dev/unknown error and revalidation. Upper ++ * layers will determine whether the command is worth retrying ++ * based on the sense data and device class/type. Otherwise, ++ * determine directly if the command is worth retrying using its ++ * error mask and flags. ++ */ + if (qc->flags & ATA_QCFLAG_SENSE_VALID) + qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER); +- +- /* determine whether the command is worth retrying */ +- if (ata_eh_worth_retry(qc)) ++ else if (ata_eh_worth_retry(qc)) + qc->flags |= ATA_QCFLAG_RETRY; + + /* accumulate error info */ diff --git a/queue-4.17/lightnvm-fix-partial-read-error-path.patch b/queue-4.17/lightnvm-fix-partial-read-error-path.patch new file mode 100644 index 00000000000..e15b0b9501f --- /dev/null +++ b/queue-4.17/lightnvm-fix-partial-read-error-path.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Igor Konopko +Date: Fri, 1 Jun 2018 16:41:09 +0200 +Subject: lightnvm: fix partial read error path + +From: Igor Konopko + +[ Upstream commit fbadca7396b97d95e2390c97506358f4f9dce7c7 ] + +When error occurs during bio_add_page on partial read path, pblk +tries to free pages twice. + +Signed-off-by: Igor Konopko +Signed-off-by: Marcin Dziegielewski +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-read.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/lightnvm/pblk-read.c ++++ b/drivers/lightnvm/pblk-read.c +@@ -219,7 +219,7 @@ static int pblk_partial_read_bio(struct + new_bio = bio_alloc(GFP_KERNEL, nr_holes); + + if (pblk_bio_add_pages(pblk, new_bio, GFP_KERNEL, nr_holes)) +- goto err; ++ goto err_add_pages; + + if (nr_holes != new_bio->bi_vcnt) { + pr_err("pblk: malformed bio\n"); +@@ -310,10 +310,10 @@ static int pblk_partial_read_bio(struct + return NVM_IO_OK; + + err: +- pr_err("pblk: failed to perform partial read\n"); +- + /* Free allocated pages in new bio */ +- pblk_bio_free_pages(pblk, bio, 0, new_bio->bi_vcnt); ++ pblk_bio_free_pages(pblk, new_bio, 0, new_bio->bi_vcnt); ++err_add_pages: ++ pr_err("pblk: failed to perform partial read\n"); + __pblk_end_io_read(pblk, rqd, false); + return NVM_IO_ERR; + } diff --git a/queue-4.17/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch b/queue-4.17/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch new file mode 100644 index 00000000000..9f1c0f44847 --- /dev/null +++ b/queue-4.17/lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Javier González" +Date: Fri, 1 Jun 2018 15:04:19 +0200 +Subject: lightnvm: pblk: warn in case of corrupted write buffer + +From: "Javier González" + +[ Upstream commit e37d07983af9068de0303054542d2652ca917f58 ] + +When cleaning up buffer entries as we wrap up, their state should be +"completed". If any of the entries is in "submitted" state, it means +that something bad has happened. Trigger a warning immediately instead of +waiting for the state flag to eventually be updated, thus hiding the +issue. + +Signed-off-by: Javier González +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-rb.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/lightnvm/pblk-rb.c ++++ b/drivers/lightnvm/pblk-rb.c +@@ -142,10 +142,9 @@ static void clean_wctx(struct pblk_w_ctx + { + int flags; + +-try: + flags = READ_ONCE(w_ctx->flags); +- if (!(flags & PBLK_SUBMITTED_ENTRY)) +- goto try; ++ WARN_ONCE(!(flags & PBLK_SUBMITTED_ENTRY), ++ "pblk: overwriting unsubmitted data\n"); + + /* Release flags on context. Protect from writes and reads */ + smp_store_release(&w_ctx->flags, PBLK_WRITABLE_ENTRY); diff --git a/queue-4.17/lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch b/queue-4.17/lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch new file mode 100644 index 00000000000..d282a421808 --- /dev/null +++ b/queue-4.17/lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Igor Konopko +Date: Fri, 1 Jun 2018 16:41:08 +0200 +Subject: lightnvm: proper error handling for pblk_bio_add_pages + +From: Igor Konopko + +[ Upstream commit f142ac0b5d18547a9614a697f86820ee35fd7bf0 ] + +Currently in case of error caused by bio_pc_add_page in +pblk_bio_add_pages two issues occur when calling from +pblk_rb_read_to_bio(). First one is in pblk_bio_free_pages, since we +are trying to free pages not allocated from our mempool. Second one +is the warn from dma_pool_free, that we are trying to free NULL +pointer dma. + +This commit fix both issues. + +Signed-off-by: Igor Konopko +Signed-off-by: Marcin Dziegielewski +Signed-off-by: Matias Bjørling +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/lightnvm/pblk-core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/lightnvm/pblk-core.c ++++ b/drivers/lightnvm/pblk-core.c +@@ -278,7 +278,9 @@ void pblk_free_rqd(struct pblk *pblk, st + return; + } + +- nvm_dev_dma_free(dev->parent, rqd->meta_list, rqd->dma_meta_list); ++ if (rqd->meta_list) ++ nvm_dev_dma_free(dev->parent, rqd->meta_list, ++ rqd->dma_meta_list); + mempool_free(rqd, pool); + } + +@@ -316,7 +318,7 @@ int pblk_bio_add_pages(struct pblk *pblk + + return 0; + err: +- pblk_bio_free_pages(pblk, bio, 0, i - 1); ++ pblk_bio_free_pages(pblk, bio, (bio->bi_vcnt - i), i); + return -1; + } + diff --git a/queue-4.17/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch b/queue-4.17/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch new file mode 100644 index 00000000000..9af015b5156 --- /dev/null +++ b/queue-4.17/md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yufen Yu +Date: Fri, 4 May 2018 18:08:10 +0800 +Subject: md: fix NULL dereference of mddev->pers in remove_and_add_spares() + +From: Yufen Yu + +[ Upstream commit c42a0e2675721e1444f56e6132a07b7b1ec169ac ] + +We met NULL pointer BUG as follow: + +[ 151.760358] BUG: unable to handle kernel NULL pointer dereference at 0000000000000060 +[ 151.761340] PGD 80000001011eb067 P4D 80000001011eb067 PUD 1011ea067 PMD 0 +[ 151.762039] Oops: 0000 [#1] SMP PTI +[ 151.762406] Modules linked in: +[ 151.762723] CPU: 2 PID: 3561 Comm: mdadm-test Kdump: loaded Not tainted 4.17.0-rc1+ #238 +[ 151.763542] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1.fc26 04/01/2014 +[ 151.764432] RIP: 0010:remove_and_add_spares.part.56+0x13c/0x3a0 +[ 151.765061] RSP: 0018:ffffc90001d7fcd8 EFLAGS: 00010246 +[ 151.765590] RAX: 0000000000000000 RBX: ffff88013601d600 RCX: 0000000000000000 +[ 151.766306] RDX: 0000000000000000 RSI: ffff88013601d600 RDI: ffff880136187000 +[ 151.767014] RBP: ffff880136187018 R08: 0000000000000003 R09: 0000000000000051 +[ 151.767728] R10: ffffc90001d7fed8 R11: 0000000000000000 R12: ffff88013601d600 +[ 151.768447] R13: ffff8801298b1300 R14: ffff880136187000 R15: 0000000000000000 +[ 151.769160] FS: 00007f2624276700(0000) GS:ffff88013ae80000(0000) knlGS:0000000000000000 +[ 151.769971] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 151.770554] CR2: 0000000000000060 CR3: 0000000111aac000 CR4: 00000000000006e0 +[ 151.771272] Call Trace: +[ 151.771542] md_ioctl+0x1df2/0x1e10 +[ 151.771906] ? __switch_to+0x129/0x440 +[ 151.772295] ? __schedule+0x244/0x850 +[ 151.772672] blkdev_ioctl+0x4bd/0x970 +[ 151.773048] block_ioctl+0x39/0x40 +[ 151.773402] do_vfs_ioctl+0xa4/0x610 +[ 151.773770] ? dput.part.23+0x87/0x100 +[ 151.774151] ksys_ioctl+0x70/0x80 +[ 151.774493] __x64_sys_ioctl+0x16/0x20 +[ 151.774877] do_syscall_64+0x5b/0x180 +[ 151.775258] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +For raid6, when two disk of the array are offline, two spare disks can +be added into the array. Before spare disks recovery completing, +system reboot and mdadm thinks it is ok to restart the degraded +array by md_ioctl(). Since disks in raid6 is not only_parity(), +raid5_run() will abort, when there is no PPL feature or not setting +'start_dirty_degraded' parameter. Therefore, mddev->pers is NULL. + +But, mddev->raid_disks has been set and it will not be cleared when +raid5_run abort. md_ioctl() can execute cmd 'HOT_REMOVE_DISK' to +remove a disk by mdadm, which will cause NULL pointer dereference +in remove_and_add_spares() finally. + +Signed-off-by: Yufen Yu +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6525,6 +6525,9 @@ static int hot_remove_disk(struct mddev + char b[BDEVNAME_SIZE]; + struct md_rdev *rdev; + ++ if (!mddev->pers) ++ return -ENODEV; ++ + rdev = find_rdev(mddev, dev); + if (!rdev) + return -ENXIO; diff --git a/queue-4.17/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch b/queue-4.17/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch new file mode 100644 index 00000000000..056bb1c679d --- /dev/null +++ b/queue-4.17/md-raid1-add-error-handling-of-read-error-from-failfast-device.patch @@ -0,0 +1,38 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Gioh Kim +Date: Wed, 2 May 2018 13:08:11 +0200 +Subject: md/raid1: add error handling of read error from FailFast device + +From: Gioh Kim + +[ Upstream commit b33d10624fdc15cdf1495f3f00481afccec76783 ] + +Current handle_read_error() function calls fix_read_error() +only if md device is RW and rdev does not include FailFast flag. +It does not handle a read error from a RW device including +FailFast flag. + +I am not sure it is intended. But I found that write IO error +sets rdev faulty. The md module should handle the read IO error and +write IO error equally. So I think read IO error should set rdev faulty. + +Signed-off-by: Gioh Kim +Reviewed-by: Jack Wang +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/raid1.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2474,6 +2474,8 @@ static void handle_read_error(struct r1c + fix_read_error(conf, r1_bio->read_disk, + r1_bio->sector, r1_bio->sectors); + unfreeze_array(conf); ++ } else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) { ++ md_error(mddev, rdev); + } else { + r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED; + } diff --git a/queue-4.17/media-arch-sh-migor-fix-tw9910-pdn-gpio.patch b/queue-4.17/media-arch-sh-migor-fix-tw9910-pdn-gpio.patch new file mode 100644 index 00000000000..084a7a30292 --- /dev/null +++ b/queue-4.17/media-arch-sh-migor-fix-tw9910-pdn-gpio.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jacopo Mondi +Date: Wed, 30 May 2018 05:13:24 -0400 +Subject: media: arch: sh: migor: Fix TW9910 PDN gpio + +From: Jacopo Mondi + +[ Upstream commit 2b787b66bcb03ec3bd97e950464e0452f459e2ca ] + +The TW9910 PDN gpio (power down) is listed as active high in the chip +manual. It turns out it is actually active low as when set to physical +level 0 it actually turns the video decoder power off. + +Without this patch applied: +tw9910 0-0045: Product ID error 1f:2 + +With this patch applied: +tw9910 0-0045: tw9910 Product ID b:0 + +Fixes: commit "186c446f4b840bd77b79d3dc951ca436cb8abe79" + +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sh/boards/mach-migor/setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/sh/boards/mach-migor/setup.c ++++ b/arch/sh/boards/mach-migor/setup.c +@@ -359,7 +359,7 @@ static struct gpiod_lookup_table ov7725_ + static struct gpiod_lookup_table tw9910_gpios = { + .dev_id = "0-0045", + .table = { +- GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("sh7722_pfc", GPIO_PTT2, "pdn", GPIO_ACTIVE_LOW), + GPIO_LOOKUP("sh7722_pfc", GPIO_PTT3, "rstb", GPIO_ACTIVE_LOW), + }, + }; diff --git a/queue-4.17/media-atomisp-compat32-fix-__user-annotations.patch b/queue-4.17/media-atomisp-compat32-fix-__user-annotations.patch new file mode 100644 index 00000000000..6c758bdbce8 --- /dev/null +++ b/queue-4.17/media-atomisp-compat32-fix-__user-annotations.patch @@ -0,0 +1,228 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Mauro Carvalho Chehab +Date: Thu, 12 Apr 2018 05:31:59 -0400 +Subject: media: atomisp: compat32: fix __user annotations + +From: Mauro Carvalho Chehab + +[ Upstream commit ad4222a0e29664666a71685a6e732923ca7c7e45 ] + +The __user annotations at the compat32 code is not right: + + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: expected void *base + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:81:18: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: expected unsigned int [usertype] *xcoords_y + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:232:23: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: expected unsigned int [usertype] *ycoords_y + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:233:23: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: expected unsigned int [usertype] *xcoords_uv + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:234:24: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: expected unsigned int [usertype] *ycoords_uv + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:235:24: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: expected unsigned int [usertype] *effective_width + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:296:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: expected unsigned int [usertype] *effective_width + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:360:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: expected struct v4l2_framebuffer *frame + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:437:19: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: expected unsigned short *calb_grp_values + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:481:29: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:701:39: warning: cast removes address space of expression + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: expected void const volatile [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:704:21: got unsigned int [usertype] *src + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: expected struct atomisp_shading_table *shading_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:737:43: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:742:44: got struct atomisp_shading_table *shading_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: expected struct atomisp_morph_table *morph_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:755:41: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:760:44: got struct atomisp_morph_table *morph_table + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: expected struct atomisp_dvs2_coefficients *dvs2_coefs + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:772:40: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:777:44: got struct atomisp_dvs2_coefficients *dvs2_coefs + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: expected struct atomisp_dvs_6axis_config *dvs_6axis_config + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:788:46: got void [noderef] * + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: warning: incorrect type in argument 1 (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: expected void [noderef] *to + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:793:44: got struct atomisp_dvs_6axis_config *dvs_6axis_config + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: warning: incorrect type in assignment (different address spaces) + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: expected struct atomisp_sensor_ae_bracketing_lut_entry *lut + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c:853:17: got void [noderef] * + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c | 49 +++++----- + 1 file changed, 26 insertions(+), 23 deletions(-) + +--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c ++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c +@@ -77,7 +77,7 @@ static int get_v4l2_framebuffer32(struct + get_user(kp->flags, &up->flags)) + return -EFAULT; + +- kp->base = compat_ptr(tmp); ++ kp->base = (void __force *)compat_ptr(tmp); + get_v4l2_pix_format((struct v4l2_pix_format *)&kp->fmt, &up->fmt); + return 0; + } +@@ -228,10 +228,10 @@ static int get_atomisp_dvs_6axis_config3 + get_user(ycoords_uv, &up->ycoords_uv)) + return -EFAULT; + +- kp->xcoords_y = compat_ptr(xcoords_y); +- kp->ycoords_y = compat_ptr(ycoords_y); +- kp->xcoords_uv = compat_ptr(xcoords_uv); +- kp->ycoords_uv = compat_ptr(ycoords_uv); ++ kp->xcoords_y = (void __force *)compat_ptr(xcoords_y); ++ kp->ycoords_y = (void __force *)compat_ptr(ycoords_y); ++ kp->xcoords_uv = (void __force *)compat_ptr(xcoords_uv); ++ kp->ycoords_uv = (void __force *)compat_ptr(ycoords_uv); + return 0; + } + +@@ -292,7 +292,7 @@ static int get_atomisp_metadata_stat32(s + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -356,7 +356,7 @@ static int get_atomisp_metadata_by_type_ + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -433,7 +433,7 @@ static int get_atomisp_overlay32(struct + get_user(kp->overlay_start_x, &up->overlay_start_y)) + return -EFAULT; + +- kp->frame = compat_ptr(frame); ++ kp->frame = (void __force *)compat_ptr(frame); + return 0; + } + +@@ -477,7 +477,7 @@ static int get_atomisp_calibration_group + get_user(calb_grp_values, &up->calb_grp_values)) + return -EFAULT; + +- kp->calb_grp_values = compat_ptr(calb_grp_values); ++ kp->calb_grp_values = (void __force *)compat_ptr(calb_grp_values); + return 0; + } + +@@ -699,8 +699,8 @@ static int get_atomisp_parameters32(stru + return -EFAULT; + + while (n >= 0) { +- compat_uptr_t *src = (compat_uptr_t *)up + n; +- uintptr_t *dst = (uintptr_t *)kp + n; ++ compat_uptr_t __user *src = ((compat_uptr_t __user *)up) + n; ++ uintptr_t *dst = ((uintptr_t *)kp) + n; + + if (get_user((*dst), src)) + return -EFAULT; +@@ -747,12 +747,12 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->shading_table = user_ptr + offset; ++ kp->shading_table = (void __force *)user_ptr + offset; + offset = sizeof(struct atomisp_shading_table); + if (!kp->shading_table) + return -EFAULT; + +- if (copy_to_user(kp->shading_table, ++ if (copy_to_user((void __user *)kp->shading_table, + &karg.shading_table, + sizeof(struct atomisp_shading_table))) + return -EFAULT; +@@ -773,13 +773,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->morph_table = user_ptr + offset; ++ kp->morph_table = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_morph_table); + if (!kp->morph_table) + return -EFAULT; + +- if (copy_to_user(kp->morph_table, &karg.morph_table, +- sizeof(struct atomisp_morph_table))) ++ if (copy_to_user((void __user *)kp->morph_table, ++ &karg.morph_table, ++ sizeof(struct atomisp_morph_table))) + return -EFAULT; + } + +@@ -798,13 +799,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->dvs2_coefs = user_ptr + offset; ++ kp->dvs2_coefs = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dis_coefficients); + if (!kp->dvs2_coefs) + return -EFAULT; + +- if (copy_to_user(kp->dvs2_coefs, &karg.dvs2_coefs, +- sizeof(struct atomisp_dis_coefficients))) ++ if (copy_to_user((void __user *)kp->dvs2_coefs, ++ &karg.dvs2_coefs, ++ sizeof(struct atomisp_dis_coefficients))) + return -EFAULT; + } + /* handle dvs 6axis configuration */ +@@ -822,13 +824,14 @@ static int get_atomisp_parameters32(stru + #endif + return -EFAULT; + +- kp->dvs_6axis_config = user_ptr + offset; ++ kp->dvs_6axis_config = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dvs_6axis_config); + if (!kp->dvs_6axis_config) + return -EFAULT; + +- if (copy_to_user(kp->dvs_6axis_config, &karg.dvs_6axis_config, +- sizeof(struct atomisp_dvs_6axis_config))) ++ if (copy_to_user((void __user *)kp->dvs_6axis_config, ++ &karg.dvs_6axis_config, ++ sizeof(struct atomisp_dvs_6axis_config))) + return -EFAULT; + } + } +@@ -887,7 +890,7 @@ static int get_atomisp_sensor_ae_bracket + get_user(lut, &up->lut)) + return -EFAULT; + +- kp->lut = compat_ptr(lut); ++ kp->lut = (void __force *)compat_ptr(lut); + return 0; + } + diff --git a/queue-4.17/media-atomisp-ov2680-don-t-declare-unused-vars.patch b/queue-4.17/media-atomisp-ov2680-don-t-declare-unused-vars.patch new file mode 100644 index 00000000000..be92f38c2b7 --- /dev/null +++ b/queue-4.17/media-atomisp-ov2680-don-t-declare-unused-vars.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mauro Carvalho Chehab +Date: Mon, 16 Apr 2018 12:37:09 -0400 +Subject: media: atomisp: ov2680: don't declare unused vars + +From: Mauro Carvalho Chehab + +[ Upstream commit e5c0680fd2c44252868fe4062558925b5506b179 ] + +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘__ov2680_set_exposure’: +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:400:10: warning: variable ‘hts’ set but not used [-Wunused-but-set-variable] + u16 vts,hts; + ^~~ +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function ‘ov2680_detect’: +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:1164:5: warning: variable ‘revision’ set but not used [-Wunused-but-set-variable] + u8 revision; + ^~~~~~~~ + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/i2c/atomisp-ov2680.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c ++++ b/drivers/staging/media/atomisp/i2c/atomisp-ov2680.c +@@ -397,14 +397,13 @@ static long __ov2680_set_exposure(struct + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov2680_device *dev = to_ov2680_sensor(sd); +- u16 vts,hts; ++ u16 vts; + int ret,exp_val; + + dev_dbg(&client->dev, + "+++++++__ov2680_set_exposure coarse_itg %d, gain %d, digitgain %d++\n", + coarse_itg, gain, digitgain); + +- hts = ov2680_res[dev->fmt_idx].pixels_per_line; + vts = ov2680_res[dev->fmt_idx].lines_per_frame; + + /* group hold */ +@@ -1185,7 +1184,8 @@ static int ov2680_detect(struct i2c_clie + OV2680_SC_CMMN_SUB_ID, &high); + revision = (u8) high & 0x0f; + +- dev_info(&client->dev, "sensor_revision id = 0x%x\n", id); ++ dev_info(&client->dev, "sensor_revision id = 0x%x, rev= %d\n", ++ id, revision); + + return 0; + } diff --git a/queue-4.17/media-cec-fix-smatch-error.patch b/queue-4.17/media-cec-fix-smatch-error.patch new file mode 100644 index 00000000000..57d9c715496 --- /dev/null +++ b/queue-4.17/media-cec-fix-smatch-error.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Hans Verkuil +Date: Sat, 7 Apr 2018 05:38:52 -0400 +Subject: media: cec: fix smatch error + +From: Hans Verkuil + +[ Upstream commit b66d448487a478c203368f2b72d7d9156a01f6be ] + +drivers/media/cec/cec-pin-error-inj.c:231 +cec_pin_error_inj_parse_line() error: uninitialized symbol 'pos'. + +The tx-add-bytes command didn't check for the presence of an argument, and +also didn't check that it was > 0. + +This should fix this error. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/cec-pin-error-inj.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/media/cec/cec-pin-error-inj.c ++++ b/drivers/media/cec/cec-pin-error-inj.c +@@ -204,16 +204,18 @@ bool cec_pin_error_inj_parse_line(struct + mode_mask = CEC_ERROR_INJ_MODE_MASK << mode_offset; + arg_idx = cec_error_inj_cmds[i].arg_idx; + +- if (mode_offset == CEC_ERROR_INJ_RX_ARB_LOST_OFFSET || +- mode_offset == CEC_ERROR_INJ_TX_ADD_BYTES_OFFSET) +- is_bit_pos = false; +- + if (mode_offset == CEC_ERROR_INJ_RX_ARB_LOST_OFFSET) { + if (has_op) + return false; + if (!has_pos) + pos = 0x0f; ++ is_bit_pos = false; ++ } else if (mode_offset == CEC_ERROR_INJ_TX_ADD_BYTES_OFFSET) { ++ if (!has_pos || !pos) ++ return false; ++ is_bit_pos = false; + } ++ + if (arg_idx >= 0 && is_bit_pos) { + if (!has_pos || pos >= 160) + return false; diff --git a/queue-4.17/media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch b/queue-4.17/media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch new file mode 100644 index 00000000000..49c1886285e --- /dev/null +++ b/queue-4.17/media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch @@ -0,0 +1,81 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mauro Carvalho Chehab +Date: Tue, 15 May 2018 15:23:16 -0400 +Subject: media: cec-pin-error-inj: avoid a false-positive Spectre detection + +From: Mauro Carvalho Chehab + +[ Upstream commit a3d71f256c8a8b5d51ea0dfd09cd85ce3a09d9e1 ] + +The current logic makes Smatch to false-detect a Spectre variant 1 +vulnerability. The problem is that it initializes an u32 indirectly +from user space input. + +After trying to write a fixup, after a while I realized that, in +practice, this shouldn't be a problem, as an u32 is initialized +from u8, but it took some time to discover it. + +So, do some code cleanup to make it clearer for both humans +and machines about the valid range for "op". + +Fix this warning: + drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() warn: potential spectre issue 'pin->error_inj_args' + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/cec/cec-pin-error-inj.c | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +--- a/drivers/media/cec/cec-pin-error-inj.c ++++ b/drivers/media/cec/cec-pin-error-inj.c +@@ -81,10 +81,9 @@ bool cec_pin_error_inj_parse_line(struct + u64 *error; + u8 *args; + bool has_op; +- u32 op; ++ u8 op; + u8 mode; + u8 pos; +- u8 v; + + p = skip_spaces(p); + token = strsep(&p, delims); +@@ -146,12 +145,18 @@ bool cec_pin_error_inj_parse_line(struct + comma = strchr(token, ','); + if (comma) + *comma++ = '\0'; +- if (!strcmp(token, "any")) +- op = CEC_ERROR_INJ_OP_ANY; +- else if (!kstrtou8(token, 0, &v)) +- op = v; +- else ++ if (!strcmp(token, "any")) { ++ has_op = false; ++ error = pin->error_inj + CEC_ERROR_INJ_OP_ANY; ++ args = pin->error_inj_args[CEC_ERROR_INJ_OP_ANY]; ++ } else if (!kstrtou8(token, 0, &op)) { ++ has_op = true; ++ error = pin->error_inj + op; ++ args = pin->error_inj_args[op]; ++ } else { + return false; ++ } ++ + mode = CEC_ERROR_INJ_MODE_ONCE; + if (comma) { + if (!strcmp(comma, "off")) +@@ -166,10 +171,6 @@ bool cec_pin_error_inj_parse_line(struct + return false; + } + +- error = pin->error_inj + op; +- args = pin->error_inj_args[op]; +- has_op = op <= 0xff; +- + token = strsep(&p, delims); + if (p) { + p = skip_spaces(p); diff --git a/queue-4.17/media-em28xx-fix-a-regression-with-hvr-950.patch b/queue-4.17/media-em28xx-fix-a-regression-with-hvr-950.patch new file mode 100644 index 00000000000..58aa04a8c8e --- /dev/null +++ b/queue-4.17/media-em28xx-fix-a-regression-with-hvr-950.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mauro Carvalho Chehab +Date: Fri, 9 Mar 2018 07:21:45 -0500 +Subject: media: em28xx: fix a regression with HVR-950 + +From: Mauro Carvalho Chehab + +[ Upstream commit 509f89652f83e834b3ef7a083e2eeac812b055f0 ] + +Commit be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner +functionality") removed the logic with sets the alternate for the DVB +device. Without setting the right alternate, the device won't be +able to submit URBs, and userspace fails with -EMSGSIZE: + + ERROR DMX_SET_PES_FILTER failed (PID = 0x2000): 90 Message too long + +Tested with Hauppauge HVR-950 model A1C0. + +Fixes: be7fd3c3a8c5 ("media: em28xx: Hauppauge DualHD second tuner functionality") + +Cc: Brad Love +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/em28xx/em28xx-dvb.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -199,6 +199,7 @@ static int em28xx_start_streaming(struct + int rc; + struct em28xx_i2c_bus *i2c_bus = dvb->adapter.priv; + struct em28xx *dev = i2c_bus->dev; ++ struct usb_device *udev = interface_to_usbdev(dev->intf); + int dvb_max_packet_size, packet_multiplier, dvb_alt; + + if (dev->dvb_xfer_bulk) { +@@ -217,6 +218,7 @@ static int em28xx_start_streaming(struct + dvb_alt = dev->dvb_alt_isoc; + } + ++ usb_set_interface(udev, dev->ifnum, dvb_alt); + rc = em28xx_set_mode(dev, EM28XX_DIGITAL_MODE); + if (rc < 0) + return rc; diff --git a/queue-4.17/media-em28xx-fix-dualhd-broken-second-tuner.patch b/queue-4.17/media-em28xx-fix-dualhd-broken-second-tuner.patch new file mode 100644 index 00000000000..6457e874108 --- /dev/null +++ b/queue-4.17/media-em28xx-fix-dualhd-broken-second-tuner.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Brad Love +Date: Wed, 2 May 2018 17:46:18 -0400 +Subject: media: em28xx: Fix DualHD broken second tuner + +From: Brad Love + +[ Upstream commit 01affb000e00cfa0a9e9954476ef50962eb8b168 ] + +The use of a hard coded i2c address breaks the creation of the +second tuner in DualHD 01595 models. The issue is compounded +by lack of any error message stating that a driver failed +initialization. Use addr, which contains the correct address +for each tuner. + +Fixes: ad32495b1513 ("media: em28xx-dvb: simplify DVB module probing logic") + +Signed-off-by: Brad Love +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/em28xx/em28xx-dvb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1392,7 +1392,7 @@ static int em28174_dvb_init_hauppauge_wi + + dvb->i2c_client_tuner = dvb_module_probe("si2157", NULL, + adapter, +- 0x60, &si2157_config); ++ addr, &si2157_config); + if (!dvb->i2c_client_tuner) { + dvb_module_release(dvb->i2c_client_demod); + return -ENODEV; diff --git a/queue-4.17/media-media-device-fix-ioctl-function-types.patch b/queue-4.17/media-media-device-fix-ioctl-function-types.patch new file mode 100644 index 00000000000..e74d6e7c2f8 --- /dev/null +++ b/queue-4.17/media-media-device-fix-ioctl-function-types.patch @@ -0,0 +1,85 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sami Tolvanen +Date: Mon, 7 May 2018 14:09:46 -0400 +Subject: media: media-device: fix ioctl function types + +From: Sami Tolvanen + +[ Upstream commit daa36370b62428cca6d48d1b2530a8419f631c8c ] + +This change fixes function types for media device ioctls to avoid +indirect call mismatches with Control-Flow Integrity checking. + +Signed-off-by: Sami Tolvanen +Acked-by: Sakari Ailus +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/media-device.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -54,9 +54,10 @@ static int media_device_close(struct fil + return 0; + } + +-static int media_device_get_info(struct media_device *dev, +- struct media_device_info *info) ++static long media_device_get_info(struct media_device *dev, void *arg) + { ++ struct media_device_info *info = arg; ++ + memset(info, 0, sizeof(*info)); + + if (dev->driver_name[0]) +@@ -93,9 +94,9 @@ static struct media_entity *find_entity( + return NULL; + } + +-static long media_device_enum_entities(struct media_device *mdev, +- struct media_entity_desc *entd) ++static long media_device_enum_entities(struct media_device *mdev, void *arg) + { ++ struct media_entity_desc *entd = arg; + struct media_entity *ent; + + ent = find_entity(mdev, entd->id); +@@ -146,9 +147,9 @@ static void media_device_kpad_to_upad(co + upad->flags = kpad->flags; + } + +-static long media_device_enum_links(struct media_device *mdev, +- struct media_links_enum *links) ++static long media_device_enum_links(struct media_device *mdev, void *arg) + { ++ struct media_links_enum *links = arg; + struct media_entity *entity; + + entity = find_entity(mdev, links->entity); +@@ -195,9 +196,9 @@ static long media_device_enum_links(stru + return 0; + } + +-static long media_device_setup_link(struct media_device *mdev, +- struct media_link_desc *linkd) ++static long media_device_setup_link(struct media_device *mdev, void *arg) + { ++ struct media_link_desc *linkd = arg; + struct media_link *link = NULL; + struct media_entity *source; + struct media_entity *sink; +@@ -225,9 +226,9 @@ static long media_device_setup_link(stru + return __media_entity_setup_link(link, linkd->flags); + } + +-static long media_device_get_topology(struct media_device *mdev, +- struct media_v2_topology *topo) ++static long media_device_get_topology(struct media_device *mdev, void *arg) + { ++ struct media_v2_topology *topo = arg; + struct media_entity *entity; + struct media_interface *intf; + struct media_pad *pad; diff --git a/queue-4.17/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch b/queue-4.17/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch new file mode 100644 index 00000000000..a7576525aef --- /dev/null +++ b/queue-4.17/media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Suman Anna +Date: Wed, 14 Mar 2018 11:41:36 -0400 +Subject: media: omap3isp: fix unbalanced dma_iommu_mapping + +From: Suman Anna + +[ Upstream commit b7e1e6859fbf60519fd82d7120cee106a6019512 ] + +The OMAP3 ISP driver manages its MMU mappings through the IOMMU-aware +ARM DMA backend. The current code creates a dma_iommu_mapping and +attaches this to the ISP device, but never detaches the mapping in +either the probe failure paths or the driver remove path resulting +in an unbalanced mapping refcount and a memory leak. Fix this properly. + +Reported-by: Pavel Machek +Signed-off-by: Suman Anna +Tested-by: Pavel Machek +Reviewed-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/omap3isp/isp.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -1945,6 +1945,7 @@ error_csi2: + + static void isp_detach_iommu(struct isp_device *isp) + { ++ arm_iommu_detach_device(isp->dev); + arm_iommu_release_mapping(isp->mapping); + isp->mapping = NULL; + } +@@ -1961,8 +1962,7 @@ static int isp_attach_iommu(struct isp_d + mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G); + if (IS_ERR(mapping)) { + dev_err(isp->dev, "failed to create ARM IOMMU mapping\n"); +- ret = PTR_ERR(mapping); +- goto error; ++ return PTR_ERR(mapping); + } + + isp->mapping = mapping; +@@ -1977,7 +1977,8 @@ static int isp_attach_iommu(struct isp_d + return 0; + + error: +- isp_detach_iommu(isp); ++ arm_iommu_release_mapping(isp->mapping); ++ isp->mapping = NULL; + return ret; + } + diff --git a/queue-4.17/media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch b/queue-4.17/media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch new file mode 100644 index 00000000000..a609a715bda --- /dev/null +++ b/queue-4.17/media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Sean Young +Date: Sun, 25 Mar 2018 11:45:40 -0400 +Subject: media: rc: mce_kbd decoder: low timeout values cause double keydowns + +From: Sean Young + +[ Upstream commit c421c62a4a08aba220ad7176ef4aa4b0ced9480a ] + +The mce keyboard repeats pressed keys every 100ms. If the IR timeout +is set to less than that, we send key up events before the repeat +arrives, so we have key up/key down for each IR repeat. + +The keyboard ends any sequence with a 0 scancode, in which case all keys +are cleared so there is no need to run the timeout timer: it only exists +for the case that the final 0 was not received. + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/ir-mce_kbd-decoder.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/media/rc/ir-mce_kbd-decoder.c ++++ b/drivers/media/rc/ir-mce_kbd-decoder.c +@@ -324,11 +324,13 @@ again: + scancode = data->body & 0xffff; + dev_dbg(&dev->dev, "keyboard data 0x%08x\n", + data->body); +- if (dev->timeout) +- delay = usecs_to_jiffies(dev->timeout / 1000); +- else +- delay = msecs_to_jiffies(100); +- mod_timer(&data->rx_timeout, jiffies + delay); ++ if (scancode) { ++ delay = nsecs_to_jiffies(dev->timeout) + ++ msecs_to_jiffies(100); ++ mod_timer(&data->rx_timeout, jiffies + delay); ++ } else { ++ del_timer(&data->rx_timeout); ++ } + /* Pass data to keyboard buffer parser */ + ir_mce_kbd_process_keyboard_data(dev, scancode); + lsc.rc_proto = RC_PROTO_MCIR2_KBD; diff --git a/queue-4.17/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch b/queue-4.17/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch new file mode 100644 index 00000000000..bce77ddf7ea --- /dev/null +++ b/queue-4.17/media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wei Yongjun +Date: Tue, 12 Jul 2016 07:21:46 -0400 +Subject: media: rcar_jpu: Add missing clk_disable_unprepare() on error in jpu_open() + +From: Wei Yongjun + +[ Upstream commit 43d0d3c52787df0221d1c52494daabd824fe84f1 ] + +Add the missing clk_disable_unprepare() before return from +jpu_open() in the software reset error handling case. + +Signed-off-by: Wei Yongjun +Acked-by: Mikhail Ulyanov +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/rcar_jpu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/media/platform/rcar_jpu.c ++++ b/drivers/media/platform/rcar_jpu.c +@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file) + /* ...issue software reset */ + ret = jpu_reset(jpu); + if (ret) +- goto device_prepare_rollback; ++ goto jpu_reset_rollback; + } + + jpu->ref_count++; +@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file) + mutex_unlock(&jpu->mutex); + return 0; + ++jpu_reset_rollback: ++ clk_disable_unprepare(jpu->clk); + device_prepare_rollback: + mutex_unlock(&jpu->mutex); + v4l_prepare_rollback: diff --git a/queue-4.17/media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch b/queue-4.17/media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch new file mode 100644 index 00000000000..42273054e16 --- /dev/null +++ b/queue-4.17/media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch @@ -0,0 +1,95 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jacopo Mondi +Date: Fri, 4 May 2018 05:32:17 -0400 +Subject: media: renesas-ceu: Set mbus_fmt on subdev operations + +From: Jacopo Mondi + +[ Upstream commit d3a67f27471d4792caf84132228def2b18617932 ] + +The renesas-ceu driver intializes the desired mbus_format at 'complete' +time, inspecting the supported subdevice ones, and tuning some +parameters to produce the requested memory format from what the sensor +can produce. Although, the initially selected mbus_format was not +provided to the subdevice during set_fmt and try_fmt operations, +providing instead a '0' mbus format code. + +As long as the sensor defaults to a compatible mbus_format when an +invalid code as '0' is provided, capture operations work correctly. If +the subdevice defaults to an unsupported format (eg. some RGB +permutations) capture does not work properly due to a mismatch on the +expected and received image format on the wire. + +Fix that by re-using the initially selected mbus_format code during +set_fmt and try_fmt subdevice operation calls. + +Tested by printing out the format selection procedure with ov7670 +sensor. + +Before this patch: +[ 0.866001] ov7670_try_fmt_internal -- Looking for mbus_code 0x0000 +[ 0.870882] ov7670_try_fmt_internal -- Try mbus_code 0x2008 +[ 0.876336] ov7670_try_fmt_internal -- Try mbus_code 0x1002 +[ 0.881387] ov7670_try_fmt_internal -- Try mbus_code 0x1008 +[ 0.886537] ov7670_try_fmt_internal -- Try mbus_code 0x3001 +[ 0.891584] ov7670_try_fmt_internal -- mbus_code defaulted to 0x2008 + +With this patch applied: +[ 0.867015] ov7670_try_fmt_internal -- Looking for mbus_code 0x2008 +[ 0.873205] ov7670_try_fmt_internal -- Try mbus_code 0x2008: match + +Signed-off-by: Jacopo Mondi +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/renesas-ceu.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/drivers/media/platform/renesas-ceu.c ++++ b/drivers/media/platform/renesas-ceu.c +@@ -777,8 +777,15 @@ static int ceu_try_fmt(struct ceu_device + const struct ceu_fmt *ceu_fmt; + int ret; + ++ /* ++ * Set format on sensor sub device: bus format used to produce memory ++ * format is selected at initialization time. ++ */ + struct v4l2_subdev_format sd_format = { +- .which = V4L2_SUBDEV_FORMAT_TRY, ++ .which = V4L2_SUBDEV_FORMAT_TRY, ++ .format = { ++ .code = ceu_sd->mbus_fmt.mbus_code, ++ }, + }; + + switch (pix->pixelformat) { +@@ -800,10 +807,6 @@ static int ceu_try_fmt(struct ceu_device + v4l_bound_align_image(&pix->width, 2, CEU_MAX_WIDTH, 4, + &pix->height, 4, CEU_MAX_HEIGHT, 4, 0); + +- /* +- * Set format on sensor sub device: bus format used to produce memory +- * format is selected at initialization time. +- */ + v4l2_fill_mbus_format_mplane(&sd_format.format, pix); + ret = v4l2_subdev_call(v4l2_sd, pad, set_fmt, &pad_cfg, &sd_format); + if (ret) +@@ -827,8 +830,15 @@ static int ceu_set_fmt(struct ceu_device + struct v4l2_subdev *v4l2_sd = ceu_sd->v4l2_sd; + int ret; + ++ /* ++ * Set format on sensor sub device: bus format used to produce memory ++ * format is selected at initialization time. ++ */ + struct v4l2_subdev_format format = { + .which = V4L2_SUBDEV_FORMAT_ACTIVE, ++ .format = { ++ .code = ceu_sd->mbus_fmt.mbus_code, ++ }, + }; + + ret = ceu_try_fmt(ceudev, v4l2_fmt); diff --git a/queue-4.17/media-saa7164-fix-driver-name-in-debug-output.patch b/queue-4.17/media-saa7164-fix-driver-name-in-debug-output.patch new file mode 100644 index 00000000000..026a93d60ba --- /dev/null +++ b/queue-4.17/media-saa7164-fix-driver-name-in-debug-output.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Brad Love +Date: Fri, 4 May 2018 17:53:35 -0400 +Subject: media: saa7164: Fix driver name in debug output + +From: Brad Love + +[ Upstream commit 0cc4655cb57af0b7e105d075c4f83f8046efafe7 ] + +This issue was reported by a user who downloaded a corrupt saa7164 +firmware, then went looking for a valid xc5000 firmware to fix the +error displayed...but the device in question has no xc5000, thus after +much effort, the wild goose chase eventually led to a support call. + +The xc5000 has nothing to do with saa7164 (as far as I can tell), +so replace the string with saa7164 as well as give a meaningful +hint on the firmware mismatch. + +Signed-off-by: Brad Love +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/saa7164/saa7164-fw.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/pci/saa7164/saa7164-fw.c ++++ b/drivers/media/pci/saa7164/saa7164-fw.c +@@ -426,7 +426,8 @@ int saa7164_downloadfirmware(struct saa7 + __func__, fw->size); + + if (fw->size != fwlength) { +- printk(KERN_ERR "xc5000: firmware incorrect size\n"); ++ printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n", ++ fw->size, fwlength); + ret = -ENOMEM; + goto out; + } diff --git a/queue-4.17/media-si470x-fix-__be16-annotations.patch b/queue-4.17/media-si470x-fix-__be16-annotations.patch new file mode 100644 index 00000000000..77f2fb9682c --- /dev/null +++ b/queue-4.17/media-si470x-fix-__be16-annotations.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Mauro Carvalho Chehab +Date: Fri, 6 Apr 2018 07:54:51 -0400 +Subject: media: si470x: fix __be16 annotations + +From: Mauro Carvalho Chehab + +[ Upstream commit 90db5c829692a0a7845e977e45719b4699216bd4 ] + +The annotations there are wrong as warned: + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:107:35: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: warning: incorrect type in assignment (different base types) + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: expected unsigned short [unsigned] [short] + drivers/media/radio/si470x/radio-si470x-i2c.c:129:24: got restricted __be16 [usertype] + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + drivers/media/radio/si470x/radio-si470x-i2c.c:163:39: warning: cast to restricted __be16 + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/radio/si470x/radio-si470x-i2c.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -91,7 +91,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS ma + */ + int si470x_get_register(struct si470x_device *radio, int regnr) + { +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -116,7 +116,7 @@ int si470x_get_register(struct si470x_de + int si470x_set_register(struct si470x_device *radio, int regnr) + { + int i; +- u16 buf[WRITE_REG_NUM]; ++ __be16 buf[WRITE_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -146,7 +146,7 @@ int si470x_set_register(struct si470x_de + static int si470x_get_all_registers(struct si470x_device *radio) + { + int i; +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, diff --git a/queue-4.17/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch b/queue-4.17/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch new file mode 100644 index 00000000000..8ed2ac09fec --- /dev/null +++ b/queue-4.17/media-siano-get-rid-of-__le32-__le16-cast-warnings.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mauro Carvalho Chehab +Date: Fri, 20 Apr 2018 08:32:16 -0400 +Subject: media: siano: get rid of __le32/__le16 cast warnings + +From: Mauro Carvalho Chehab + +[ Upstream commit e1b7f11b37def5f3021c06e8c2b4953e099357aa ] + +Those are all false-positives that appear with smatch when building for +arm: + + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:38:36: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:47:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:67:35: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:84:44: warning: cast to restricted __le32 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:98:26: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:99:28: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + drivers/media/common/siano/smsendian.c:100:27: warning: cast to restricted __le16 + +Get rid of them by adding explicit forced casts. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/siano/smsendian.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/media/common/siano/smsendian.c ++++ b/drivers/media/common/siano/smsendian.c +@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *b + switch (msg->x_msg_header.msg_type) { + case MSG_SMS_DATA_DOWNLOAD_REQ: + { +- msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]); ++ msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0])); + break; + } + +@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *b + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *b + { + struct sms_version_res *ver = + (struct sms_version_res *) msg; +- ver->chip_model = le16_to_cpu(ver->chip_model); ++ ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model); + break; + } + +@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *b + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -95,9 +95,9 @@ void smsendian_handle_message_header(voi + #ifdef __BIG_ENDIAN + struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg; + +- phdr->msg_type = le16_to_cpu(phdr->msg_type); +- phdr->msg_length = le16_to_cpu(phdr->msg_length); +- phdr->msg_flags = le16_to_cpu(phdr->msg_flags); ++ phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type); ++ phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length); ++ phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags); + #endif /* __BIG_ENDIAN */ + } + EXPORT_SYMBOL_GPL(smsendian_handle_message_header); diff --git a/queue-4.17/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch b/queue-4.17/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch new file mode 100644 index 00000000000..6f9af5f0a83 --- /dev/null +++ b/queue-4.17/media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Colin Ian King +Date: Wed, 25 Apr 2018 11:04:21 -0400 +Subject: media: smiapp: fix timeout checking in smiapp_read_nvm + +From: Colin Ian King + +[ Upstream commit 7a2148dfda8001c983f0effd9afd8a7fa58e99c4 ] + +The current code decrements the timeout counter i and the end of +each loop i is incremented, so the check for timeout will always +be false and hence the timeout mechanism is just a dead code path. +Potentially, if the RD_READY bit is not set, we could end up in +an infinite loop. + +Fix this so the timeout starts from 1000 and decrements to zero, +if at the end of the loop i is zero we have a timeout condition. + +Detected by CoverityScan, CID#1324008 ("Logically dead code") + +Fixes: ccfc97bdb5ae ("[media] smiapp: Add driver") + +Signed-off-by: Colin Ian King +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/smiapp/smiapp-core.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp + if (rval) + goto out; + +- for (i = 0; i < 1000; i++) { ++ for (i = 1000; i > 0; i--) { + rval = smiapp_read( + sensor, + SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s); +@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp + if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY) + break; + +- if (--i == 0) { +- rval = -ETIMEDOUT; +- goto out; +- } +- ++ } ++ if (!i) { ++ rval = -ETIMEDOUT; ++ goto out; + } + + for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) { diff --git a/queue-4.17/media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch b/queue-4.17/media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch new file mode 100644 index 00000000000..f6d1fab920f --- /dev/null +++ b/queue-4.17/media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch @@ -0,0 +1,358 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mauro Carvalho Chehab +Date: Mon, 16 Apr 2018 12:37:08 -0400 +Subject: media: staging: atomisp: Comment out several unused sensor resolutions + +From: Mauro Carvalho Chehab + +[ Upstream commit db01f7ccfa6d4738e366077ce7423d1710b805f3 ] + +The register settings for several resolutions aren't used +currently. So, comment them out. + +Fix those warnings: + +In file included from drivers/staging/media/atomisp/i2c/atomisp-gc2235.c:35:0: +drivers/staging/media/atomisp/i2c/gc2235.h:340:32: warning: 'gc2235_960_640_30fps' defined but not used [-Wunused-const-variable=] + static struct gc2235_reg const gc2235_960_640_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/gc2235.h:287:32: warning: 'gc2235_1296_736_30fps' defined but not used [-Wunused-const-variable=] + static struct gc2235_reg const gc2235_1296_736_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~ +In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2722.c:35:0: +drivers/staging/media/atomisp/i2c/ov2722.h:999:32: warning: 'ov2722_720p_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2722_reg const ov2722_720p_30fps[] = { + ^~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2722.h:787:32: warning: 'ov2722_1M3_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2722_reg const ov2722_1M3_30fps[] = { + ^~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2722.h:476:32: warning: 'ov2722_VGA_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2722_reg const ov2722_VGA_30fps[] = { + ^~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2722.h:367:32: warning: 'ov2722_480P_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2722_reg const ov2722_480P_30fps[] = { + ^~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2722.h:257:32: warning: 'ov2722_QVGA_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2722_reg const ov2722_QVGA_30fps[] = { + ^~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/atomisp-ov2680.c: In function '__ov2680_set_exposure': +In file included from drivers/staging/media/atomisp/i2c/atomisp-ov2680.c:35:0: +At top level: +drivers/staging/media/atomisp/i2c/ov2680.h:736:33: warning: 'ov2680_1616x1082_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_1616x1082_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:649:33: warning: 'ov2680_1456x1096_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_1456x1096_30fps[]= { + ^~~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:606:33: warning: 'ov2680_1296x976_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_1296x976_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:563:33: warning: 'ov2680_720p_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_720p_30fps[] = { + ^~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:520:33: warning: 'ov2680_800x600_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_800x600_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:475:33: warning: 'ov2680_720x592_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_720x592_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:433:33: warning: 'ov2680_656x496_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_656x496_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:389:33: warning: 'ov2680_QVGA_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_QVGA_30fps[] = { + ^~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:346:33: warning: 'ov2680_CIF_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_CIF_30fps[] = { + ^~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov2680.h:301:33: warning: 'ov2680_QCIF_30fps' defined but not used [-Wunused-const-variable=] + static struct ov2680_reg const ov2680_QCIF_30fps[] = { + ^~~~~~~~~~~~~~~~~ +In file included from drivers/staging/media/atomisp/i2c/ov5693/atomisp-ov5693.c:36:0: +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:988:32: warning: 'ov5693_1424x1168_30fps' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_1424x1168_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:954:32: warning: 'ov5693_2592x1944_30fps' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_2592x1944_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:889:32: warning: 'ov5693_2592x1456_30fps' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_2592x1456_30fps[] = { + ^~~~~~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:862:32: warning: 'ov5693_1940x1096' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_1940x1096[] = { + ^~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:796:32: warning: 'ov5693_1636p_30fps' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_1636p_30fps[] = { + ^~~~~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:758:32: warning: 'ov5693_1296x736' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_1296x736[] = { + ^~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:730:32: warning: 'ov5693_976x556' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_976x556[] = { + ^~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:672:32: warning: 'ov5693_736x496' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_736x496[] = { + ^~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:643:32: warning: 'ov5693_192x160' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_192x160[] = { + ^~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:616:32: warning: 'ov5693_368x304' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_368x304[] = { + ^~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:587:32: warning: 'ov5693_336x256' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_336x256[] = { + ^~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:540:32: warning: 'ov5693_1296x976' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_1296x976[] = { + ^~~~~~~~~~~~~~~ +drivers/staging/media/atomisp/i2c/ov5693/ov5693.h:509:32: warning: 'ov5693_654x496' defined but not used [-Wunused-const-variable=] + static struct ov5693_reg const ov5693_654x496[] = { + ^~~~~~~~~~~~~~ + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/media/atomisp/i2c/gc2235.h | 9 ++++++++- + drivers/staging/media/atomisp/i2c/ov2680.h | 5 ++++- + drivers/staging/media/atomisp/i2c/ov2722.h | 6 ++++++ + drivers/staging/media/atomisp/i2c/ov5693/ov5693.h | 18 +++++++++++++++++- + 4 files changed, 35 insertions(+), 3 deletions(-) + +--- a/drivers/staging/media/atomisp/i2c/gc2235.h ++++ b/drivers/staging/media/atomisp/i2c/gc2235.h +@@ -33,6 +33,11 @@ + + #include "../include/linux/atomisp_platform.h" + ++/* ++ * FIXME: non-preview resolutions are currently broken ++ */ ++#define ENABLE_NON_PREVIEW 0 ++ + /* Defines for register writes and register array processing */ + #define I2C_MSG_LENGTH 0x2 + #define I2C_RETRY_COUNT 5 +@@ -284,6 +289,7 @@ static struct gc2235_reg const gc2235_in + /* + * Register settings for various resolution + */ ++#if ENABLE_NON_PREVIEW + static struct gc2235_reg const gc2235_1296_736_30fps[] = { + { GC2235_8BIT, 0x8b, 0xa0 }, + { GC2235_8BIT, 0x8c, 0x02 }, +@@ -387,6 +393,7 @@ static struct gc2235_reg const gc2235_96 + { GC2235_8BIT, 0xfe, 0x00 }, /* switch to P0 */ + { GC2235_TOK_TERM, 0, 0 } + }; ++#endif + + static struct gc2235_reg const gc2235_1600_900_30fps[] = { + { GC2235_8BIT, 0x8b, 0xa0 }, +@@ -578,7 +585,7 @@ static struct gc2235_resolution gc2235_r + * Disable non-preview configurations until the configuration selection is + * improved. + */ +-#if 0 ++#if ENABLE_NON_PREVIEW + static struct gc2235_resolution gc2235_res_still[] = { + { + .desc = "gc2235_1600_900_30fps", +--- a/drivers/staging/media/atomisp/i2c/ov2680.h ++++ b/drivers/staging/media/atomisp/i2c/ov2680.h +@@ -295,6 +295,7 @@ struct ov2680_format { + }; + + ++#if 0 /* None of the definitions below are used currently */ + /* + * 176x144 30fps VBlanking 1lane 10Bit (binning) + */ +@@ -513,7 +514,6 @@ struct ov2680_format { + {OV2680_8BIT, 0x5081, 0x41}, + {OV2680_TOK_TERM, 0, 0} + }; +- + /* + * 800x600 30fps VBlanking 1lane 10Bit (binning) + */ +@@ -685,6 +685,7 @@ struct ov2680_format { + // {OV2680_8BIT, 0x5090, 0x0c}, + {OV2680_TOK_TERM, 0, 0} + }; ++#endif + + /* + *1616x916 30fps VBlanking 1lane 10bit +@@ -734,6 +735,7 @@ struct ov2680_format { + /* + * 1612x1212 30fps VBlanking 1lane 10Bit + */ ++#if 0 + static struct ov2680_reg const ov2680_1616x1082_30fps[] = { + {OV2680_8BIT, 0x3086, 0x00}, + {OV2680_8BIT, 0x3501, 0x48}, +@@ -773,6 +775,7 @@ struct ov2680_format { + {OV2680_8BIT, 0x5081, 0x41}, + {OV2680_TOK_TERM, 0, 0} + }; ++#endif + /* + * 1616x1216 30fps VBlanking 1lane 10Bit + */ +--- a/drivers/staging/media/atomisp/i2c/ov2722.h ++++ b/drivers/staging/media/atomisp/i2c/ov2722.h +@@ -254,6 +254,7 @@ struct ov2722_write_ctrl { + /* + * Register settings for various resolution + */ ++#if 0 + static struct ov2722_reg const ov2722_QVGA_30fps[] = { + {OV2722_8BIT, 0x3718, 0x10}, + {OV2722_8BIT, 0x3702, 0x0c}, +@@ -581,6 +582,7 @@ static struct ov2722_reg const ov2722_VG + {OV2722_8BIT, 0x3509, 0x10}, + {OV2722_TOK_TERM, 0, 0}, + }; ++#endif + + static struct ov2722_reg const ov2722_1632_1092_30fps[] = { + {OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for +@@ -784,6 +786,7 @@ static struct ov2722_reg const ov2722_14 + {OV2722_8BIT, 0x3509, 0x00}, + {OV2722_TOK_TERM, 0, 0} + }; ++#if 0 + static struct ov2722_reg const ov2722_1M3_30fps[] = { + {OV2722_8BIT, 0x3718, 0x10}, + {OV2722_8BIT, 0x3702, 0x24}, +@@ -890,6 +893,7 @@ static struct ov2722_reg const ov2722_1M + {OV2722_8BIT, 0x3509, 0x10}, + {OV2722_TOK_TERM, 0, 0}, + }; ++#endif + + static struct ov2722_reg const ov2722_1080p_30fps[] = { + {OV2722_8BIT, 0x3021, 0x03}, /* For stand wait for a whole +@@ -996,6 +1000,7 @@ static struct ov2722_reg const ov2722_10 + {OV2722_TOK_TERM, 0, 0} + }; + ++#if 0 /* Currently unused */ + static struct ov2722_reg const ov2722_720p_30fps[] = { + {OV2722_8BIT, 0x3021, 0x03}, + {OV2722_8BIT, 0x3718, 0x10}, +@@ -1095,6 +1100,7 @@ static struct ov2722_reg const ov2722_72 + {OV2722_8BIT, 0x3509, 0x00}, + {OV2722_TOK_TERM, 0, 0}, + }; ++#endif + + static struct ov2722_resolution ov2722_res_preview[] = { + { +--- a/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h ++++ b/drivers/staging/media/atomisp/i2c/ov5693/ov5693.h +@@ -31,6 +31,12 @@ + + #include "../../include/linux/atomisp_platform.h" + ++/* ++ * FIXME: non-preview resolutions are currently broken ++ */ ++#define ENABLE_NON_PREVIEW 0 ++ ++ + #define OV5693_POWER_UP_RETRY_NUM 5 + + /* Defines for register writes and register array processing */ +@@ -503,6 +509,7 @@ static struct ov5693_reg const ov5693_gl + {OV5693_TOK_TERM, 0, 0} + }; + ++#if ENABLE_NON_PREVIEW + /* + * 654x496 30fps 17ms VBlanking 2lane 10Bit (Scaling) + */ +@@ -695,6 +702,7 @@ static struct ov5693_reg const ov5693_73 + {OV5693_8BIT, 0x0100, 0x01}, + {OV5693_TOK_TERM, 0, 0} + }; ++#endif + + /* + static struct ov5693_reg const ov5693_736x496[] = { +@@ -727,6 +735,7 @@ static struct ov5693_reg const ov5693_73 + /* + * 976x556 30fps 8.8ms VBlanking 2lane 10Bit (Scaling) + */ ++#if ENABLE_NON_PREVIEW + static struct ov5693_reg const ov5693_976x556[] = { + {OV5693_8BIT, 0x3501, 0x7b}, + {OV5693_8BIT, 0x3502, 0x00}, +@@ -819,6 +828,7 @@ static struct ov5693_reg const ov5693_16 + {OV5693_8BIT, 0x0100, 0x01}, + {OV5693_TOK_TERM, 0, 0} + }; ++#endif + + static struct ov5693_reg const ov5693_1616x1216_30fps[] = { + {OV5693_8BIT, 0x3501, 0x7b}, +@@ -859,6 +869,7 @@ static struct ov5693_reg const ov5693_16 + /* + * 1940x1096 30fps 8.8ms VBlanking 2lane 10bit (Scaling) + */ ++#if ENABLE_NON_PREVIEW + static struct ov5693_reg const ov5693_1940x1096[] = { + {OV5693_8BIT, 0x3501, 0x7b}, + {OV5693_8BIT, 0x3502, 0x00}, +@@ -916,6 +927,7 @@ static struct ov5693_reg const ov5693_25 + {OV5693_8BIT, 0x5002, 0x00}, + {OV5693_TOK_TERM, 0, 0} + }; ++#endif + + static struct ov5693_reg const ov5693_2576x1456_30fps[] = { + {OV5693_8BIT, 0x3501, 0x7b}, +@@ -951,6 +963,7 @@ static struct ov5693_reg const ov5693_25 + /* + * 2592x1944 30fps 0.6ms VBlanking 2lane 10Bit + */ ++#if ENABLE_NON_PREVIEW + static struct ov5693_reg const ov5693_2592x1944_30fps[] = { + {OV5693_8BIT, 0x3501, 0x7b}, + {OV5693_8BIT, 0x3502, 0x00}, +@@ -977,6 +990,7 @@ static struct ov5693_reg const ov5693_25 + {OV5693_8BIT, 0x0100, 0x01}, + {OV5693_TOK_TERM, 0, 0} + }; ++#endif + + /* + * 11:9 Full FOV Output, expected FOV Res: 2346x1920 +@@ -985,6 +999,7 @@ static struct ov5693_reg const ov5693_25 + * + * WA: Left Offset: 8, Hor scal: 64 + */ ++#if ENABLE_NON_PREVIEW + static struct ov5693_reg const ov5693_1424x1168_30fps[] = { + {OV5693_8BIT, 0x3501, 0x3b}, /* long exposure[15:8] */ + {OV5693_8BIT, 0x3502, 0x80}, /* long exposure[7:0] */ +@@ -1019,6 +1034,7 @@ static struct ov5693_reg const ov5693_14 + {OV5693_8BIT, 0x0100, 0x01}, + {OV5693_TOK_TERM, 0, 0} + }; ++#endif + + /* + * 3:2 Full FOV Output, expected FOV Res: 2560x1706 +@@ -1151,7 +1167,7 @@ static struct ov5693_resolution ov5693_r + * Disable non-preview configurations until the configuration selection is + * improved. + */ +-#if 0 ++#if ENABLE_NON_PREVIEW + struct ov5693_resolution ov5693_res_still[] = { + { + .desc = "ov5693_736x496_30fps", diff --git a/queue-4.17/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch b/queue-4.17/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch new file mode 100644 index 00000000000..3b2c75ed317 --- /dev/null +++ b/queue-4.17/media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ezequiel Garcia +Date: Fri, 18 May 2018 17:07:48 -0400 +Subject: media: tw686x: Fix incorrect vb2_mem_ops GFP flags + +From: Ezequiel Garcia + +[ Upstream commit 636757ab6c93e19e2f58d3b3af1312e34eaffbab ] + +When the driver is configured in the "memcpy" dma-mode, +it uses vb2_vmalloc_memops, which is backed by a SLAB +allocator and so shouldn't be using GFP_DMA32. + +Fix it. + +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/tw686x/tw686x-video.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/media/pci/tw686x/tw686x-video.c ++++ b/drivers/media/pci/tw686x/tw686x-video.c +@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev + vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; + vc->vidq.min_buffers_needed = 2; + vc->vidq.lock = &vc->vb_mutex; +- vc->vidq.gfp_flags = GFP_DMA32; ++ vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ? ++ GFP_DMA32 : 0; + vc->vidq.dev = &dev->pci_dev->dev; + + err = vb2_queue_init(&vc->vidq); diff --git a/queue-4.17/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch b/queue-4.17/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch new file mode 100644 index 00000000000..d86127b05de --- /dev/null +++ b/queue-4.17/media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Hans Verkuil +Date: Mon, 21 May 2018 08:43:02 -0400 +Subject: media: videobuf2-core: don't call memop 'finish' when queueing + +From: Hans Verkuil + +[ Upstream commit 90b2da89a083e1395cb322521a42397c49ae4500 ] + +When a buffer is queued or requeued in vb2_buffer_done, then don't +call the finish memop. In this case the buffer is only returned to vb2, +not to userspace. + +Calling 'finish' here will cause an unbalance when the queue is +canceled, since the core will call the same memop again. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/common/videobuf2/videobuf2-core.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -916,9 +916,12 @@ void vb2_buffer_done(struct vb2_buffer * + dprintk(4, "done processing on buffer %d, state: %d\n", + vb->index, state); + +- /* sync buffers */ +- for (plane = 0; plane < vb->num_planes; ++plane) +- call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ if (state != VB2_BUF_STATE_QUEUED && ++ state != VB2_BUF_STATE_REQUEUEING) { ++ /* sync buffers */ ++ for (plane = 0; plane < vb->num_planes; ++plane) ++ call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ } + + spin_lock_irqsave(&q->done_lock, flags); + if (state == VB2_BUF_STATE_QUEUED || diff --git a/queue-4.17/mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch b/queue-4.17/mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch new file mode 100644 index 00000000000..e7c9d9b177e --- /dev/null +++ b/queue-4.17/mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch @@ -0,0 +1,136 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Aaron Lu +Date: Thu, 7 Jun 2018 17:09:44 -0700 +Subject: mem_cgroup: make sure moving_account, move_lock_task and stat_cpu in the same cacheline + +From: Aaron Lu + +[ Upstream commit e81bf9793b1861d74953ef041b4f6c7faecc2dbd ] + +The LKP robot found a 27% will-it-scale/page_fault3 performance +regression regarding commit e27be240df53("mm: memcg: make sure +memory.events is uptodate when waking pollers"). + +What the test does is: + 1 mkstemp() a 128M file on a tmpfs; + 2 start $nr_cpu processes, each to loop the following: + 2.1 mmap() this file in shared write mode; + 2.2 write 0 to this file in a PAGE_SIZE step till the end of the file; + 2.3 unmap() this file and repeat this process. + 3 After 5 minutes, check how many loops they managed to complete, the + higher the better. + +The commit itself looks innocent enough as it merely changed some event +counting mechanism and this test didn't trigger those events at all. +Perf shows increased cycles spent on accessing root_mem_cgroup->stat_cpu +in count_memcg_event_mm()(called by handle_mm_fault()) and in +__mod_memcg_state() called by page_add_file_rmap(). So it's likely due +to the changed layout of 'struct mem_cgroup' that either make stat_cpu +falling into a constantly modifying cacheline or some hot fields stop +being in the same cacheline. + +I verified this by moving memory_events[] back to where it was: + +: --- a/include/linux/memcontrol.h +: +++ b/include/linux/memcontrol.h +: @@ -205,7 +205,6 @@ struct mem_cgroup { +: int oom_kill_disable; +: +: /* memory.events */ +: - atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS]; +: struct cgroup_file events_file; +: +: /* protect arrays of thresholds */ +: @@ -238,6 +237,7 @@ struct mem_cgroup { +: struct mem_cgroup_stat_cpu __percpu *stat_cpu; +: atomic_long_t stat[MEMCG_NR_STAT]; +: atomic_long_t events[NR_VM_EVENT_ITEMS]; +: + atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS]; +: +: unsigned long socket_pressure; + +And performance restored. + +Later investigation found that as long as the following 3 fields +moving_account, move_lock_task and stat_cpu are in the same cacheline, +performance will be good. To avoid future performance surprise by other +commits changing the layout of 'struct mem_cgroup', this patch makes +sure the 3 fields stay in the same cacheline. + +One concern of this approach is, moving_account and move_lock_task could +be modified when a process changes memory cgroup while stat_cpu is a +always read field, it might hurt to place them in the same cacheline. I +assume it is rare for a process to change memory cgroup so this should +be OK. + +Link: https://lkml.kernel.org/r/20180528114019.GF9904@yexl-desktop +Link: http://lkml.kernel.org/r/20180601071115.GA27302@intel.com +Signed-off-by: Aaron Lu +Reported-by: kernel test robot +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Tejun Heo +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/memcontrol.h | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -158,6 +158,15 @@ enum memcg_kmem_state { + KMEM_ONLINE, + }; + ++#if defined(CONFIG_SMP) ++struct memcg_padding { ++ char x[0]; ++} ____cacheline_internodealigned_in_smp; ++#define MEMCG_PADDING(name) struct memcg_padding name; ++#else ++#define MEMCG_PADDING(name) ++#endif ++ + /* + * The memory controller data structure. The memory controller controls both + * page cache and RSS per cgroup. We would eventually like to provide +@@ -205,7 +214,6 @@ struct mem_cgroup { + int oom_kill_disable; + + /* memory.events */ +- atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS]; + struct cgroup_file events_file; + + /* protect arrays of thresholds */ +@@ -225,19 +233,26 @@ struct mem_cgroup { + * mem_cgroup ? And what type of charges should we move ? + */ + unsigned long move_charge_at_immigrate; ++ /* taken only while moving_account > 0 */ ++ spinlock_t move_lock; ++ unsigned long move_lock_flags; ++ ++ MEMCG_PADDING(_pad1_); ++ + /* + * set > 0 if pages under this cgroup are moving to other cgroup. + */ + atomic_t moving_account; +- /* taken only while moving_account > 0 */ +- spinlock_t move_lock; + struct task_struct *move_lock_task; +- unsigned long move_lock_flags; + + /* memory.stat */ + struct mem_cgroup_stat_cpu __percpu *stat_cpu; ++ ++ MEMCG_PADDING(_pad2_); ++ + atomic_long_t stat[MEMCG_NR_STAT]; + atomic_long_t events[NR_VM_EVENT_ITEMS]; ++ atomic_long_t memory_events[MEMCG_NR_MEMORY_EVENTS]; + + unsigned long socket_pressure; + diff --git a/queue-4.17/memory-tegra-apply-interrupts-mask-per-soc.patch b/queue-4.17/memory-tegra-apply-interrupts-mask-per-soc.patch new file mode 100644 index 00000000000..75f84d63159 --- /dev/null +++ b/queue-4.17/memory-tegra-apply-interrupts-mask-per-soc.patch @@ -0,0 +1,161 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Dmitry Osipenko +Date: Mon, 9 Apr 2018 22:28:29 +0300 +Subject: memory: tegra: Apply interrupts mask per SoC + +From: Dmitry Osipenko + +[ Upstream commit 1c74d5c0de0c2cc29fef97a19251da2ad6f579bd ] + +Currently we are enabling handling of interrupts specific to Tegra124+ +which happen to overlap with previous generations. Let's specify +interrupts mask per SoC generation for consistency and in a preparation +of squashing of Tegra20 driver into the common one that will enable +handling of GART faults which may be undesirable by newer generations. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/tegra/mc.c | 21 +++------------------ + drivers/memory/tegra/mc.h | 9 +++++++++ + drivers/memory/tegra/tegra114.c | 2 ++ + drivers/memory/tegra/tegra124.c | 6 ++++++ + drivers/memory/tegra/tegra210.c | 3 +++ + drivers/memory/tegra/tegra30.c | 2 ++ + include/soc/tegra/mc.h | 2 ++ + 7 files changed, 27 insertions(+), 18 deletions(-) + +--- a/drivers/memory/tegra/mc.c ++++ b/drivers/memory/tegra/mc.c +@@ -20,14 +20,6 @@ + #include "mc.h" + + #define MC_INTSTATUS 0x000 +-#define MC_INT_DECERR_MTS (1 << 16) +-#define MC_INT_SECERR_SEC (1 << 13) +-#define MC_INT_DECERR_VPR (1 << 12) +-#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) +-#define MC_INT_INVALID_SMMU_PAGE (1 << 10) +-#define MC_INT_ARBITRATION_EMEM (1 << 9) +-#define MC_INT_SECURITY_VIOLATION (1 << 8) +-#define MC_INT_DECERR_EMEM (1 << 6) + + #define MC_INTMASK 0x004 + +@@ -248,13 +240,11 @@ static const char *const error_names[8] + static irqreturn_t tegra_mc_irq(int irq, void *data) + { + struct tegra_mc *mc = data; +- unsigned long status, mask; ++ unsigned long status; + unsigned int bit; + + /* mask all interrupts to avoid flooding */ +- mask = mc_readl(mc, MC_INTMASK); +- status = mc_readl(mc, MC_INTSTATUS) & mask; +- ++ status = mc_readl(mc, MC_INTSTATUS) & mc->soc->intmask; + if (!status) + return IRQ_NONE; + +@@ -349,7 +339,6 @@ static int tegra_mc_probe(struct platfor + const struct of_device_id *match; + struct resource *res; + struct tegra_mc *mc; +- u32 value; + int err; + + match = of_match_node(tegra_mc_of_match, pdev->dev.of_node); +@@ -417,11 +406,7 @@ static int tegra_mc_probe(struct platfor + + WARN(!mc->soc->client_id_mask, "Missing client ID mask for this SoC\n"); + +- value = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | +- MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | +- MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM; +- +- mc_writel(mc, value, MC_INTMASK); ++ mc_writel(mc, mc->soc->intmask, MC_INTMASK); + + return 0; + } +--- a/drivers/memory/tegra/mc.h ++++ b/drivers/memory/tegra/mc.h +@@ -14,6 +14,15 @@ + + #include + ++#define MC_INT_DECERR_MTS (1 << 16) ++#define MC_INT_SECERR_SEC (1 << 13) ++#define MC_INT_DECERR_VPR (1 << 12) ++#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) ++#define MC_INT_INVALID_SMMU_PAGE (1 << 10) ++#define MC_INT_ARBITRATION_EMEM (1 << 9) ++#define MC_INT_SECURITY_VIOLATION (1 << 8) ++#define MC_INT_DECERR_EMEM (1 << 6) ++ + static inline u32 mc_readl(struct tegra_mc *mc, unsigned long offset) + { + return readl(mc->regs + offset); +--- a/drivers/memory/tegra/tegra114.c ++++ b/drivers/memory/tegra/tegra114.c +@@ -945,4 +945,6 @@ const struct tegra_mc_soc tegra114_mc_so + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra114_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +--- a/drivers/memory/tegra/tegra124.c ++++ b/drivers/memory/tegra/tegra124.c +@@ -1035,6 +1035,9 @@ const struct tegra_mc_soc tegra124_mc_so + .smmu = &tegra124_smmu_soc, + .emem_regs = tegra124_mc_emem_regs, + .num_emem_regs = ARRAY_SIZE(tegra124_mc_emem_regs), ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_124_SOC */ + +@@ -1059,5 +1062,8 @@ const struct tegra_mc_soc tegra132_mc_so + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra132_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_132_SOC */ +--- a/drivers/memory/tegra/tegra210.c ++++ b/drivers/memory/tegra/tegra210.c +@@ -1092,4 +1092,7 @@ const struct tegra_mc_soc tegra210_mc_so + .atom_size = 64, + .client_id_mask = 0xff, + .smmu = &tegra210_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; +--- a/drivers/memory/tegra/tegra30.c ++++ b/drivers/memory/tegra/tegra30.c +@@ -967,4 +967,6 @@ const struct tegra_mc_soc tegra30_mc_soc + .atom_size = 16, + .client_id_mask = 0x7f, + .smmu = &tegra30_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +--- a/include/soc/tegra/mc.h ++++ b/include/soc/tegra/mc.h +@@ -108,6 +108,8 @@ struct tegra_mc_soc { + u8 client_id_mask; + + const struct tegra_smmu_soc *smmu; ++ ++ u32 intmask; + }; + + struct tegra_mc { diff --git a/queue-4.17/memory-tegra-do-not-handle-spurious-interrupts.patch b/queue-4.17/memory-tegra-do-not-handle-spurious-interrupts.patch new file mode 100644 index 00000000000..935ae7ff72b --- /dev/null +++ b/queue-4.17/memory-tegra-do-not-handle-spurious-interrupts.patch @@ -0,0 +1,37 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Dmitry Osipenko +Date: Mon, 9 Apr 2018 22:28:27 +0300 +Subject: memory: tegra: Do not handle spurious interrupts + +From: Dmitry Osipenko + +[ Upstream commit bf3fbdfbec947cdd04b2f2c4bce11534c8786eee ] + +The ISR reads interrupts-enable mask, but doesn't utilize it. Apply the +mask to the interrupt status and don't handle interrupts that MC driver +haven't asked for. Kernel would disable spurious MC IRQ and report the +error. This would happen only in a case of a very severe bug. + +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/tegra/mc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/memory/tegra/mc.c ++++ b/drivers/memory/tegra/mc.c +@@ -252,8 +252,11 @@ static irqreturn_t tegra_mc_irq(int irq, + unsigned int bit; + + /* mask all interrupts to avoid flooding */ +- status = mc_readl(mc, MC_INTSTATUS); + mask = mc_readl(mc, MC_INTMASK); ++ status = mc_readl(mc, MC_INTSTATUS) & mask; ++ ++ if (!status) ++ return IRQ_NONE; + + for_each_set_bit(bit, &status, 32) { + const char *error = status_names[bit] ?: "unknown"; diff --git a/queue-4.17/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch b/queue-4.17/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch new file mode 100644 index 00000000000..9a1e5bd6aeb --- /dev/null +++ b/queue-4.17/mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Vincent Palatin +Date: Wed, 18 Apr 2018 12:23:58 +0200 +Subject: mfd: cros_ec: Fail early if we cannot identify the EC + +From: Vincent Palatin + +[ Upstream commit 0dbbf25561b29ffab5ba6277429760abdf49ceff ] + +If we cannot communicate with the EC chip to detect the protocol version +and its features, it's very likely useless to continue. Else we will +commit all kind of uninformed mistakes (using the wrong protocol, the +wrong buffer size, mixing the EC with other chips). + +Signed-off-by: Vincent Palatin +Acked-by: Benson Leung +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Gwendal Grignou +Reviewed-by: Andy Shevchenko +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/cros_ec.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/mfd/cros_ec.c ++++ b/drivers/mfd/cros_ec.c +@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_devi + + mutex_init(&ec_dev->lock); + +- cros_ec_query_all(ec_dev); ++ err = cros_ec_query_all(ec_dev); ++ if (err) { ++ dev_err(dev, "Cannot identify the EC: error %d\n", err); ++ return err; ++ } + + if (ec_dev->irq) { + err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread, diff --git a/queue-4.17/microblaze-fix-simpleimage-format-generation.patch b/queue-4.17/microblaze-fix-simpleimage-format-generation.patch new file mode 100644 index 00000000000..9b57e4d4840 --- /dev/null +++ b/queue-4.17/microblaze-fix-simpleimage-format-generation.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Michal Simek +Date: Tue, 10 Apr 2018 15:05:42 +0200 +Subject: microblaze: Fix simpleImage format generation + +From: Michal Simek + +[ Upstream commit ece97f3a5fb50cf5f98886fbc63c9665f2bb199d ] + +simpleImage generation was broken for some time. This patch is fixing +steps how simpleImage.*.ub file is generated. Steps are objdump of +vmlinux and create .ub. +Also make sure that there is striped elf version with .strip suffix. + +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/microblaze/boot/Makefile | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/arch/microblaze/boot/Makefile ++++ b/arch/microblaze/boot/Makefile +@@ -22,17 +22,19 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FO + quiet_cmd_cp = CP $< $@$2 + cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) + +-quiet_cmd_strip = STRIP $@ ++quiet_cmd_strip = STRIP $< $@$2 + cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \ +- -K _fdt_start vmlinux -o $@ ++ -K _fdt_start $< -o $@$2 + + UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR) ++UIMAGE_IN = $@ ++UIMAGE_OUT = $@.ub + + $(obj)/simpleImage.%: vmlinux FORCE + $(call if_changed,cp,.unstrip) + $(call if_changed,objcopy) + $(call if_changed,uimage) +- $(call if_changed,strip) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' ++ $(call if_changed,strip,.strip) ++ @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' + + clean-files += simpleImage.*.unstrip linux.bin.ub diff --git a/queue-4.17/mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch b/queue-4.17/mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch new file mode 100644 index 00000000000..a378e957288 --- /dev/null +++ b/queue-4.17/mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ido Schimmel +Date: Wed, 2 May 2018 10:17:34 +0300 +Subject: mlxsw: spectrum_router: Return an error for non-default FIB rules + +From: Ido Schimmel + +[ Upstream commit 6290182b2b3bda119ecb243fb3d6bcc98a74344f ] + +Since commit 9776d32537d2 ("net: Move call_fib_rule_notifiers up in +fib_nl_newrule") it is possible to forbid the installation of +unsupported FIB rules. + +Have mlxsw return an error for non-default FIB rules in addition to the +existing extack message. + +Example: +# ip rule add from 198.51.100.1 table 10 +Error: mlxsw_spectrum: FIB rules not supported. + +Note that offload is only aborted when non-default FIB rules are already +installed and merely replayed during module initialization. + +Signed-off-by: Ido Schimmel +Acked-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -5882,24 +5882,24 @@ static int mlxsw_sp_router_fib_rule_even + switch (info->family) { + case AF_INET: + if (!fib4_rule_default(rule) && !rule->l3mdev) +- err = -1; ++ err = -EOPNOTSUPP; + break; + case AF_INET6: + if (!fib6_rule_default(rule) && !rule->l3mdev) +- err = -1; ++ err = -EOPNOTSUPP; + break; + case RTNL_FAMILY_IPMR: + if (!ipmr_rule_default(rule) && !rule->l3mdev) +- err = -1; ++ err = -EOPNOTSUPP; + break; + case RTNL_FAMILY_IP6MR: + if (!ip6mr_rule_default(rule) && !rule->l3mdev) +- err = -1; ++ err = -EOPNOTSUPP; + break; + } + + if (err < 0) +- NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported. Aborting offload"); ++ NL_SET_ERR_MSG_MOD(extack, "FIB rules not supported"); + + return err; + } +@@ -5926,8 +5926,8 @@ static int mlxsw_sp_router_fib_event(str + case FIB_EVENT_RULE_DEL: + err = mlxsw_sp_router_fib_rule_event(event, info, + router->mlxsw_sp); +- if (!err) +- return NOTIFY_DONE; ++ if (!err || info->extack) ++ return notifier_from_errno(err); + } + + fib_work = kzalloc(sizeof(*fib_work), GFP_ATOMIC); diff --git a/queue-4.17/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch b/queue-4.17/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch new file mode 100644 index 00000000000..0f7b134d4d4 --- /dev/null +++ b/queue-4.17/mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch @@ -0,0 +1,62 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Petr Machata +Date: Fri, 15 Jun 2018 16:23:38 +0300 +Subject: mlxsw: spectrum_switchdev: Fix port_vlan refcounting + +From: Petr Machata + +[ Upstream commit 9e25826ffc942e985b8595b2f1cf2065d3880514 ] + +Switchdev notifications for addition of SWITCHDEV_OBJ_ID_PORT_VLAN are +distributed not only on clean addition, but also when flags on an +existing VLAN are changed. mlxsw_sp_bridge_port_vlan_add() calls +mlxsw_sp_port_vlan_get() to get at the port_vlan in question, which +implicitly references the object. This then leads to discrepancies in +reference counting when the VLAN is removed. spectrum.c warns about the +problem when the module is removed: + +[13578.493090] WARNING: CPU: 0 PID: 2454 at drivers/net/ethernet/mellanox/mlxsw/spectrum.c:2973 mlxsw_sp_port_remove+0xfd/0x110 [mlxsw_spectrum] +[...] +[13578.627106] Call Trace: +[13578.629617] mlxsw_sp_fini+0x2a/0xe0 [mlxsw_spectrum] +[13578.634748] mlxsw_core_bus_device_unregister+0x3e/0x130 [mlxsw_core] +[13578.641290] mlxsw_pci_remove+0x13/0x40 [mlxsw_pci] +[13578.646238] pci_device_remove+0x31/0xb0 +[13578.650244] device_release_driver_internal+0x14f/0x220 +[13578.655562] driver_detach+0x32/0x70 +[13578.659183] bus_remove_driver+0x47/0xa0 +[13578.663134] pci_unregister_driver+0x1e/0x80 +[13578.667486] mlxsw_sp_module_exit+0xc/0x3fa [mlxsw_spectrum] +[13578.673207] __x64_sys_delete_module+0x13b/0x1e0 +[13578.677888] ? exit_to_usermode_loop+0x78/0x80 +[13578.682374] do_syscall_64+0x39/0xe0 +[13578.685976] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fix by putting the port_vlan when mlxsw_sp_port_vlan_bridge_join() +determines it's a flag-only change. + +Fixes: b3529af6bb0d ("spectrum: Reference count VLAN entries") +Signed-off-by: Petr Machata +Acked-by: Jiri Pirko +Signed-off-by: Ido Schimmel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -1013,8 +1013,10 @@ mlxsw_sp_port_vlan_bridge_join(struct ml + int err; + + /* No need to continue if only VLAN flags were changed */ +- if (mlxsw_sp_port_vlan->bridge_port) ++ if (mlxsw_sp_port_vlan->bridge_port) { ++ mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan); + return 0; ++ } + + err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port); + if (err) diff --git a/queue-4.17/mm-check-for-sigkill-inside-dup_mmap-loop.patch b/queue-4.17/mm-check-for-sigkill-inside-dup_mmap-loop.patch new file mode 100644 index 00000000000..2cd40a2986c --- /dev/null +++ b/queue-4.17/mm-check-for-sigkill-inside-dup_mmap-loop.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Tetsuo Handa +Date: Thu, 14 Jun 2018 15:26:34 -0700 +Subject: mm: check for SIGKILL inside dup_mmap() loop + +From: Tetsuo Handa + +[ Upstream commit 655c79bb40a0870adcd0871057d01de11625882b ] + +As a theoretical problem, dup_mmap() of an mm_struct with 60000+ vmas +can loop while potentially allocating memory, with mm->mmap_sem held for +write by current thread. This is bad if current thread was selected as +an OOM victim, for current thread will continue allocations using memory +reserves while OOM reaper is unable to reclaim memory. + +As an actually observable problem, it is not difficult to make OOM +reaper unable to reclaim memory if the OOM victim is blocked at +i_mmap_lock_write() in this loop. Unfortunately, since nobody can +explain whether it is safe to use killable wait there, let's check for +SIGKILL before trying to allocate memory. Even without an OOM event, +there is no point with continuing the loop from the beginning if current +thread is killed. + +I tested with debug printk(). This patch should be safe because we +already fail if security_vm_enough_memory_mm() or +kmem_cache_alloc(GFP_KERNEL) fails and exit_mmap() handles it. + + ***** Aborting dup_mmap() due to SIGKILL ***** + ***** Aborting dup_mmap() due to SIGKILL ***** + ***** Aborting dup_mmap() due to SIGKILL ***** + ***** Aborting dup_mmap() due to SIGKILL ***** + ***** Aborting exit_mmap() due to NULL mmap ***** + +[akpm@linux-foundation.org: add comment] +Link: http://lkml.kernel.org/r/201804071938.CDE04681.SOFVQJFtMHOOLF@I-love.SAKURA.ne.jp +Signed-off-by: Tetsuo Handa +Cc: Alexander Viro +Cc: Rik van Riel +Cc: Michal Hocko +Cc: Kirill A. Shutemov +Cc: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/fork.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -440,6 +440,14 @@ static __latent_entropy int dup_mmap(str + continue; + } + charge = 0; ++ /* ++ * Don't duplicate many vmas if we've been oom-killed (for ++ * example) ++ */ ++ if (fatal_signal_pending(current)) { ++ retval = -EINTR; ++ goto out; ++ } + if (mpnt->vm_flags & VM_ACCOUNT) { + unsigned long len = vma_pages(mpnt); + diff --git a/queue-4.17/mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch b/queue-4.17/mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch new file mode 100644 index 00000000000..35d711067d6 --- /dev/null +++ b/queue-4.17/mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch @@ -0,0 +1,79 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ram Pai +Date: Tue, 27 Mar 2018 02:09:26 -0700 +Subject: mm, powerpc, x86: define VM_PKEY_BITx bits if CONFIG_ARCH_HAS_PKEYS is enabled + +From: Ram Pai + +[ Upstream commit 5212213aa5a2359dd0474c9dab22b6220b591fe1 ] + +VM_PKEY_BITx are defined only if CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS +is enabled. Powerpc also needs these bits. Hence lets define the +VM_PKEY_BITx bits for any architecture that enables +CONFIG_ARCH_HAS_PKEYS. + +Reviewed-by: Dave Hansen +Signed-off-by: Ram Pai +Reviewed-by: Ingo Molnar +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/pkeys.h | 2 ++ + fs/proc/task_mmu.c | 4 ++-- + include/linux/mm.h | 9 +++++---- + 3 files changed, 9 insertions(+), 6 deletions(-) + +--- a/arch/powerpc/include/asm/pkeys.h ++++ b/arch/powerpc/include/asm/pkeys.h +@@ -26,6 +26,8 @@ extern u32 initial_allocation_mask; /* b + # define VM_PKEY_BIT2 VM_HIGH_ARCH_2 + # define VM_PKEY_BIT3 VM_HIGH_ARCH_3 + # define VM_PKEY_BIT4 VM_HIGH_ARCH_4 ++#elif !defined(VM_PKEY_BIT4) ++# define VM_PKEY_BIT4 VM_HIGH_ARCH_4 + #endif + + #define ARCH_VM_PKEY_FLAGS (VM_PKEY_BIT0 | VM_PKEY_BIT1 | VM_PKEY_BIT2 | \ +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -673,13 +673,13 @@ static void show_smap_vma_flags(struct s + [ilog2(VM_MERGEABLE)] = "mg", + [ilog2(VM_UFFD_MISSING)]= "um", + [ilog2(VM_UFFD_WP)] = "uw", +-#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS ++#ifdef CONFIG_ARCH_HAS_PKEYS + /* These come out via ProtectionKey: */ + [ilog2(VM_PKEY_BIT0)] = "", + [ilog2(VM_PKEY_BIT1)] = "", + [ilog2(VM_PKEY_BIT2)] = "", + [ilog2(VM_PKEY_BIT3)] = "", +-#endif ++#endif /* CONFIG_ARCH_HAS_PKEYS */ + }; + size_t i; + +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -228,15 +228,16 @@ extern unsigned int kobjsize(const void + #define VM_HIGH_ARCH_4 BIT(VM_HIGH_ARCH_BIT_4) + #endif /* CONFIG_ARCH_USES_HIGH_VMA_FLAGS */ + +-#if defined(CONFIG_X86) +-# define VM_PAT VM_ARCH_1 /* PAT reserves whole VMA at once (x86) */ +-#if defined (CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS) ++#ifdef CONFIG_ARCH_HAS_PKEYS + # define VM_PKEY_SHIFT VM_HIGH_ARCH_BIT_0 + # define VM_PKEY_BIT0 VM_HIGH_ARCH_0 /* A protection key is a 4-bit value */ + # define VM_PKEY_BIT1 VM_HIGH_ARCH_1 + # define VM_PKEY_BIT2 VM_HIGH_ARCH_2 + # define VM_PKEY_BIT3 VM_HIGH_ARCH_3 +-#endif ++#endif /* CONFIG_ARCH_HAS_PKEYS */ ++ ++#if defined(CONFIG_X86) ++# define VM_PAT VM_ARCH_1 /* PAT reserves whole VMA at once (x86) */ + #elif defined(CONFIG_PPC) + # define VM_SAO VM_ARCH_1 /* Strong Access Ordering (powerpc) */ + #elif defined(CONFIG_PARISC) diff --git a/queue-4.17/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch b/queue-4.17/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch new file mode 100644 index 00000000000..77feecdd15c --- /dev/null +++ b/queue-4.17/mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch @@ -0,0 +1,93 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Huang Ying +Date: Thu, 7 Jun 2018 17:07:39 -0700 +Subject: mm: /proc/pid/pagemap: hide swap entries from unprivileged users + +From: Huang Ying + +[ Upstream commit ab6ecf247a9321e3180e021a6a60164dee53ab2e ] + +In commit ab676b7d6fbf ("pagemap: do not leak physical addresses to +non-privileged userspace"), the /proc/PID/pagemap is restricted to be +readable only by CAP_SYS_ADMIN to address some security issue. + +In commit 1c90308e7a77 ("pagemap: hide physical addresses from +non-privileged users"), the restriction is relieved to make +/proc/PID/pagemap readable, but hide the physical addresses for +non-privileged users. + +But the swap entries are readable for non-privileged users too. This +has some security issues. For example, for page under migrating, the +swap entry has physical address information. So, in this patch, the +swap entries are hided for non-privileged users too. + +Link: http://lkml.kernel.org/r/20180508012745.7238-1-ying.huang@intel.com +Fixes: 1c90308e7a77 ("pagemap: hide physical addresses from non-privileged users") +Signed-off-by: "Huang, Ying" +Suggested-by: Kirill A. Shutemov +Reviewed-by: Naoya Horiguchi +Reviewed-by: Konstantin Khlebnikov +Acked-by: Michal Hocko +Cc: Konstantin Khlebnikov +Cc: Andrei Vagin +Cc: Jerome Glisse +Cc: Daniel Colascione +Cc: Zi Yan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/task_mmu.c | 26 ++++++++++++++++---------- + 1 file changed, 16 insertions(+), 10 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1259,8 +1259,9 @@ static pagemap_entry_t pte_to_pagemap_en + if (pte_swp_soft_dirty(pte)) + flags |= PM_SOFT_DIRTY; + entry = pte_to_swp_entry(pte); +- frame = swp_type(entry) | +- (swp_offset(entry) << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) ++ frame = swp_type(entry) | ++ (swp_offset(entry) << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; + if (is_migration_entry(entry)) + page = migration_entry_to_page(entry); +@@ -1311,11 +1312,14 @@ static int pagemap_pmd_range(pmd_t *pmdp + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { + swp_entry_t entry = pmd_to_swp_entry(pmd); +- unsigned long offset = swp_offset(entry); ++ unsigned long offset; + +- offset += (addr & ~PMD_MASK) >> PAGE_SHIFT; +- frame = swp_type(entry) | +- (offset << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ offset = swp_offset(entry) + ++ ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ frame = swp_type(entry) | ++ (offset << MAX_SWAPFILES_SHIFT); ++ } + flags |= PM_SWAP; + if (pmd_swp_soft_dirty(pmd)) + flags |= PM_SOFT_DIRTY; +@@ -1333,10 +1337,12 @@ static int pagemap_pmd_range(pmd_t *pmdp + err = add_to_pagemap(addr, &pme, pm); + if (err) + break; +- if (pm->show_pfn && (flags & PM_PRESENT)) +- frame++; +- else if (flags & PM_SWAP) +- frame += (1 << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ if (flags & PM_PRESENT) ++ frame++; ++ else if (flags & PM_SWAP) ++ frame += (1 << MAX_SWAPFILES_SHIFT); ++ } + } + spin_unlock(ptl); + return err; diff --git a/queue-4.17/mm-slub.c-add-__printf-verification-to-slab_err.patch b/queue-4.17/mm-slub.c-add-__printf-verification-to-slab_err.patch new file mode 100644 index 00000000000..b624895c8f6 --- /dev/null +++ b/queue-4.17/mm-slub.c-add-__printf-verification-to-slab_err.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 7 Jun 2018 17:05:17 -0700 +Subject: mm/slub.c: add __printf verification to slab_err() + +From: Mathieu Malaterre + +[ Upstream commit a38965bf941b7c2af50de09c96bc5f03e136caef ] + +__printf is useful to verify format and arguments. Remove the following +warning (with W=1): + + mm/slub.c:721:2: warning: function might be possible candidate for `gnu_printf' format attribute [-Wsuggest-attribute=format] + +Link: http://lkml.kernel.org/r/20180505200706.19986-1-malat@debian.org +Signed-off-by: Mathieu Malaterre +Reviewed-by: Andrew Morton +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: David Rientjes +Cc: Joonsoo Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/slub.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -711,7 +711,7 @@ void object_err(struct kmem_cache *s, st + print_trailer(s, page, object); + } + +-static void slab_err(struct kmem_cache *s, struct page *page, ++static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, + const char *fmt, ...) + { + va_list args; diff --git a/queue-4.17/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch b/queue-4.17/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch new file mode 100644 index 00000000000..4b94d6065fc --- /dev/null +++ b/queue-4.17/mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch @@ -0,0 +1,64 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chintan Pandya +Date: Thu, 7 Jun 2018 17:06:50 -0700 +Subject: mm: vmalloc: avoid racy handling of debugobjects in vunmap + +From: Chintan Pandya + +[ Upstream commit f3c01d2f3ade6790db67f80fef60df84424f8964 ] + +Currently, __vunmap flow is, + 1) Release the VM area + 2) Free the debug objects corresponding to that vm area. + +This leave some race window open. + 1) Release the VM area + 1.5) Some other client gets the same vm area + 1.6) This client allocates new debug objects on the same + vm area + 2) Free the debug objects corresponding to this vm area. + +Here, we actually free 'other' client's debug objects. + +Fix this by freeing the debug objects first and then releasing the VM +area. + +Link: http://lkml.kernel.org/r/1523961828-9485-2-git-send-email-cpandya@codeaurora.org +Signed-off-by: Chintan Pandya +Reviewed-by: Andrew Morton +Cc: Ard Biesheuvel +Cc: Byungchul Park +Cc: Catalin Marinas +Cc: Florian Fainelli +Cc: Johannes Weiner +Cc: Laura Abbott +Cc: Vlastimil Babka +Cc: Wei Yang +Cc: Yisheng Xie +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/vmalloc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, i + addr)) + return; + +- area = remove_vm_area(addr); ++ area = find_vmap_area((unsigned long)addr)->vm; + if (unlikely(!area)) { + WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n", + addr); +@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, i + debug_check_no_locks_freed(addr, get_vm_area_size(area)); + debug_check_no_obj_freed(addr, get_vm_area_size(area)); + ++ remove_vm_area(addr); + if (deallocate_pages) { + int i; + diff --git a/queue-4.17/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch b/queue-4.17/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch new file mode 100644 index 00000000000..97c3db7bf12 --- /dev/null +++ b/queue-4.17/mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Shawn Lin +Date: Mon, 26 Mar 2018 17:26:25 +0800 +Subject: mmc: dw_mmc: update actual clock for mmc debugfs + +From: Shawn Lin + +[ Upstream commit ff178981bd5fd1667f373098740cb1c6d6efa1ba ] + +Respect the actual clock for mmc debugfs to help better debug +the hardware. + +mmc_host mmc0: Bus speed (slot 0) = 135475200Hz (slot req 150000000Hz, +actual 135475200HZ div = 0) + +cat /sys/kernel/debug/mmc0/ios +clock: 150000000 Hz +actual clock: 135475200 Hz +vdd: 21 (3.3 ~ 3.4 V) +bus mode: 2 (push-pull) +chip select: 0 (don't care) +power mode: 2 (on) +bus width: 3 (8 bits) +timing spec: 9 (mmc HS200) +signal voltage: 0 (1.80 V) +driver type: 0 (driver type B) + +Cc: Xiao Yao +Cc: Ziyuan +Signed-off-by: Shawn Lin +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/dw_mmc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -1231,6 +1231,8 @@ static void dw_mci_setup_bus(struct dw_m + if (host->state == STATE_WAITING_CMD11_DONE) + sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH; + ++ slot->mmc->actual_clock = 0; ++ + if (!clock) { + mci_writel(host, CLKENA, 0); + mci_send_cmd(slot, sdmmc_cmd_bits, 0); +@@ -1289,6 +1291,8 @@ static void dw_mci_setup_bus(struct dw_m + + /* keep the last clock value that was requested from core */ + slot->__clk_old = clock; ++ slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) : ++ host->bus_hz; + } + + host->current_speed = clock; diff --git a/queue-4.17/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch b/queue-4.17/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch new file mode 100644 index 00000000000..b47c58a2c61 --- /dev/null +++ b/queue-4.17/mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch @@ -0,0 +1,65 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Tobin C. Harding" +Date: Mon, 26 Mar 2018 17:33:14 +1100 +Subject: mmc: pwrseq: Use kmalloc_array instead of stack VLA + +From: "Tobin C. Harding" + +[ Upstream commit 486e6661367b40f927aadbed73237693396cbf94 ] + +The use of stack Variable Length Arrays needs to be avoided, as they +can be a vector for stack exhaustion, which can be both a runtime bug +(kernel Oops) or a security flaw (overwriting memory beyond the +stack). Also, in general, as code evolves it is easy to lose track of +how big a VLA can get. Thus, we can end up having runtime failures +that are hard to debug. As part of the directive[1] to remove all VLAs +from the kernel, and build with -Wvla. + +Currently driver is using a VLA declared using the number of descriptors. This +array is used to store integer values and is later used as an argument to +`gpiod_set_array_value_cansleep()` This can be avoided by using +`kmalloc_array()` to allocate memory for the array of integer values. Memory is +free'd before return from function. + +>From the code it appears that it is safe to sleep so we can use GFP_KERNEL +(based _cansleep() suffix of function `gpiod_set_array_value_cansleep()`. + +It can be expected that this patch will result in a small increase in overhead +due to the use of `kmalloc_array()` + +[1] https://lkml.org/lkml/2018/3/7/621 + +Signed-off-by: Tobin C. Harding +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/pwrseq_simple.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/core/pwrseq_simple.c ++++ b/drivers/mmc/core/pwrseq_simple.c +@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_ + struct gpio_descs *reset_gpios = pwrseq->reset_gpios; + + if (!IS_ERR(reset_gpios)) { +- int i; +- int values[reset_gpios->ndescs]; ++ int i, *values; ++ int nvalues = reset_gpios->ndescs; + +- for (i = 0; i < reset_gpios->ndescs; i++) ++ values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL); ++ if (!values) ++ return; ++ ++ for (i = 0; i < nvalues; i++) + values[i] = value; + +- gpiod_set_array_value_cansleep( +- reset_gpios->ndescs, reset_gpios->desc, values); ++ gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values); ++ kfree(values); + } + } + diff --git a/queue-4.17/mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch b/queue-4.17/mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch new file mode 100644 index 00000000000..1ebd957bd0e --- /dev/null +++ b/queue-4.17/mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kishon Vijay Abraham I +Date: Fri, 27 Apr 2018 17:17:10 +0530 +Subject: mmc: sdhci-omap: Fix when capabilities are obtained from SDHCI_CAPABILITIES reg + +From: Kishon Vijay Abraham I + +[ Upstream commit 0ec4ee3c9b9755b28fd2e89b2ceaae6f15403368 ] + +sdhci_omap_config_iodelay_pinctrl_state() requires caps and caps2 to be +initialized (speed mode capabilities like UHS/HS200) before it is +invoked. While mmc_of_parse() initializes caps/caps2 if capabilities is +populated in device tree, it will remain uninitialized for capabilities +obtained from SDHCI_CAPABILITIES register. +Fix sdhci_omap_config_iodelay_pinctrl_state() to be used even while +getting the capabilities from SDHCI_CAPABILITIES register by invoking +sdhci_setup_host() before sdhci_omap_config_iodelay_pinctrl_state(). + +Signed-off-by: Kishon Vijay Abraham I +Acked-by: Tony Lindgren +Acked-by: Adrian Hunter +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/sdhci-omap.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/drivers/mmc/host/sdhci-omap.c ++++ b/drivers/mmc/host/sdhci-omap.c +@@ -916,10 +916,6 @@ static int sdhci_omap_probe(struct platf + goto err_put_sync; + } + +- ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host); +- if (ret) +- goto err_put_sync; +- + host->mmc_host_ops.get_ro = mmc_gpio_get_ro; + host->mmc_host_ops.start_signal_voltage_switch = + sdhci_omap_start_signal_voltage_switch; +@@ -930,12 +926,23 @@ static int sdhci_omap_probe(struct platf + sdhci_read_caps(host); + host->caps |= SDHCI_CAN_DO_ADMA2; + +- ret = sdhci_add_host(host); ++ ret = sdhci_setup_host(host); + if (ret) + goto err_put_sync; + ++ ret = sdhci_omap_config_iodelay_pinctrl_state(omap_host); ++ if (ret) ++ goto err_cleanup_host; ++ ++ ret = __sdhci_add_host(host); ++ if (ret) ++ goto err_cleanup_host; ++ + return 0; + ++err_cleanup_host: ++ sdhci_cleanup_host(host); ++ + err_put_sync: + pm_runtime_put_sync(dev); + diff --git a/queue-4.17/mt76-add-rcu-locking-around-tx-scheduling.patch b/queue-4.17/mt76-add-rcu-locking-around-tx-scheduling.patch new file mode 100644 index 00000000000..92764f7bbe8 --- /dev/null +++ b/queue-4.17/mt76-add-rcu-locking-around-tx-scheduling.patch @@ -0,0 +1,73 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Felix Fietkau +Date: Wed, 25 Apr 2018 11:11:23 +0200 +Subject: mt76: add rcu locking around tx scheduling + +From: Felix Fietkau + +[ Upstream commit 1d868b70e06a2319fdda46cc46ec7c6762557543 ] + +Fixes a reported lockdep error in mac80211: + +[ 179.867321] ============================= +[ 179.871510] WARNING: suspicious RCU usage +[ 179.875528] 4.14.32 #0 Not tainted +[ 179.878924] ----------------------------- +[ 179.882981] backports-2017-11-01/net/mac80211/tx.c:594 suspicious rcu_dereference_check() usage! +[ 179.891785] +[ 179.891785] other info that might help us debug this: +[ 179.891785] +[ 179.899824] +[ 179.899824] rcu_scheduler_active = 2, debug_locks = 1 +[ 179.906343] 2 locks held by ksoftirqd/0/7: +[ 179.910479] #0: (&(&q->lock)->rlock){+.-.}, at: [<86b207a4>] mt76_dma_tx_cleanup+0x64/0x354 [mt76] +[ 179.919734] #1: (&(&fq->lock)->rlock){+.-.}, at: [<87238410>] ieee80211_tx_dequeue+0x54/0xc3c [mac80211] +[ 179.929890] +[ 179.929890] stack backtrace: +[ 179.934257] CPU: 0 PID: 7 Comm: ksoftirqd/0 Not tainted 4.14.32 #0 +[ 179.940421] Stack : 00000000 00000000 00000000 00000000 80e0fce2 00000036 00000000 00000000 +[ 179.948864] 87c3d24c 80696377 8061039c 00000000 00000007 00000001 87c5db78 6534689d +[ 179.957306] 00000000 00000000 80e10000 87c5da74 00000001 0000015a 00000007 00000000 +[ 179.965748] 00000000 806a0000 000e4171 00000000 00000000 00000000 ffffffff 00000001 +[ 179.974189] 806c0000 8692b240 86b000d0 87316fe4 00000001 802c9a68 00000000 80700000 +[ 179.982632] ... +[ 179.985104] Call Trace: +[ 179.987582] [<80010a48>] show_stack+0x58/0x100 +[ 179.992040] [<804c2c58>] dump_stack+0xe8/0x170 +[ 179.996868] [<87234a04>] ieee80211_tx_h_select_key+0xa8/0x5b8 [mac80211] +[ 180.004299] [<87238d44>] ieee80211_tx_dequeue+0x988/0xc3c [mac80211] +[ 180.011048] [<86b230dc>] mt76_txq_schedule+0x110/0x3a4 [mt76] +[ 180.016821] [<86b209d0>] mt76_dma_tx_cleanup+0x290/0x354 [mt76] +[ 180.022777] [<86be2e60>] mt7603_tx_tasklet+0x40/0x6c [mt7603e] +[ 180.028637] [<80037058>] tasklet_action+0x110/0x1ec +[ 180.033532] [<804e1dac>] __do_softirq+0x164/0x35c +[ 180.038235] [<80037174>] run_ksoftirqd+0x40/0x84 +[ 180.042870] [<800580c8>] smpboot_thread_fn+0x1a8/0x1d8 +[ 180.048023] [<800542e8>] kthread+0x130/0x144 +[ 180.052297] [<8000b1f8>] ret_from_kernel_thread+0x14/0x1c + +Signed-off-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/tx.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/mediatek/mt76/tx.c ++++ b/drivers/net/wireless/mediatek/mt76/tx.c +@@ -422,12 +422,14 @@ void mt76_txq_schedule(struct mt76_dev * + { + int len; + ++ rcu_read_lock(); + do { + if (hwq->swq_queued >= 4 || list_empty(&hwq->swq)) + break; + + len = mt76_txq_schedule_list(dev, hwq); + } while (len > 0); ++ rcu_read_unlock(); + } + EXPORT_SYMBOL_GPL(mt76_txq_schedule); + diff --git a/queue-4.17/mt76x2-apply-coverage-class-on-slot-time-too.patch b/queue-4.17/mt76x2-apply-coverage-class-on-slot-time-too.patch new file mode 100644 index 00000000000..59ac73752cf --- /dev/null +++ b/queue-4.17/mt76x2-apply-coverage-class-on-slot-time-too.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Lorenzo Bianconi +Date: Tue, 15 May 2018 12:08:14 +0200 +Subject: mt76x2: apply coverage class on slot time too + +From: Lorenzo Bianconi + +[ Upstream commit 0d45d3fe42efc76b6c4f5a62f8d110c7a2e6f83f ] + +According to 802.11-2007 17.3.8.6 (slot time), the slot time should +be increased by 3 us * coverage class. Taking into account coverage +class in slot time configuration allows to increase by an order of +magnitude the throughput on a 4Km link in a noisy environment + +Tested-by: Luca Bisti +Tested-by: Gaetano Catalli +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt76x2_init.c | 3 +++ + drivers/net/wireless/mediatek/mt76/mt76x2_main.c | 3 +-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt76x2_init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_init.c +@@ -482,7 +482,10 @@ void mt76x2_set_tx_ackto(struct mt76x2_d + { + u8 ackto, sifs, slottime = dev->slottime; + ++ /* As defined by IEEE 802.11-2007 17.3.8.6 */ + slottime += 3 * dev->coverage_class; ++ mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG, ++ MT_BKOFF_SLOT_CFG_SLOTTIME, slottime); + + sifs = mt76_get_field(dev, MT_XIFS_TIME_CFG, + MT_XIFS_TIME_CFG_OFDM_SIFS); +--- a/drivers/net/wireless/mediatek/mt76/mt76x2_main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_main.c +@@ -247,8 +247,7 @@ mt76x2_bss_info_changed(struct ieee80211 + int slottime = info->use_short_slot ? 9 : 20; + + dev->slottime = slottime; +- mt76_rmw_field(dev, MT_BKOFF_SLOT_CFG, +- MT_BKOFF_SLOT_CFG_SLOTTIME, slottime); ++ mt76x2_set_tx_ackto(dev); + } + + mutex_unlock(&dev->mutex); diff --git a/queue-4.17/mt76x2-fix-avg_rssi-estimation.patch b/queue-4.17/mt76x2-fix-avg_rssi-estimation.patch new file mode 100644 index 00000000000..0c5246756bf --- /dev/null +++ b/queue-4.17/mt76x2-fix-avg_rssi-estimation.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Lorenzo Bianconi +Date: Wed, 2 May 2018 11:46:36 +0200 +Subject: mt76x2: fix avg_rssi estimation + +From: Lorenzo Bianconi + +[ Upstream commit c990affd5abce1f338ac52539e092dad04647fb6 ] + +Add leftover filter coefficients in IIR rssi estimation + +Fixes: 7bc04215a66b ("mt76: add driver code for MT76x2e") +Signed-off-by: Lorenzo Bianconi +Acked-by: Felix Fietkau +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mediatek/mt76/mt76x2_phy.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76x2_phy.c +@@ -492,8 +492,10 @@ mt76x2_phy_update_channel_gain(struct mt + u8 gain_delta; + int low_gain; + +- dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 + (rssi0 << 8); +- dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 + (rssi1 << 8); ++ dev->cal.avg_rssi[0] = (dev->cal.avg_rssi[0] * 15) / 16 + ++ (rssi0 << 8) / 16; ++ dev->cal.avg_rssi[1] = (dev->cal.avg_rssi[1] * 15) / 16 + ++ (rssi1 << 8) / 16; + dev->cal.avg_rssi_all = (dev->cal.avg_rssi[0] + + dev->cal.avg_rssi[1]) / 512; + diff --git a/queue-4.17/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch b/queue-4.17/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch new file mode 100644 index 00000000000..4d075a3e43b --- /dev/null +++ b/queue-4.17/mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jane Wan +Date: Tue, 8 May 2018 14:19:53 -0700 +Subject: mtd: rawnand: fsl_ifc: fix FSL NAND driver to read all ONFI parameter pages + +From: Jane Wan + +[ Upstream commit a75bbe71a27875fdc61cde1af6d799037cef6bed ] + +Per ONFI specification (Rev. 4.0), if the CRC of the first parameter page +read is not valid, the host should read redundant parameter page copies. +Fix FSL NAND driver to read the two redundant copies which are mandatory +in the specification. + +Signed-off-by: Jane Wan +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/fsl_ifc_nand.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c +@@ -342,9 +342,16 @@ static void fsl_ifc_cmdfunc(struct mtd_i + + case NAND_CMD_READID: + case NAND_CMD_PARAM: { ++ /* ++ * For READID, read 8 bytes that are currently used. ++ * For PARAM, read all 3 copies of 256-bytes pages. ++ */ ++ int len = 8; + int timing = IFC_FIR_OP_RB; +- if (command == NAND_CMD_PARAM) ++ if (command == NAND_CMD_PARAM) { + timing = IFC_FIR_OP_RBCD; ++ len = 256 * 3; ++ } + + ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | + (IFC_FIR_OP_UA << IFC_NAND_FIR0_OP1_SHIFT) | +@@ -354,12 +361,8 @@ static void fsl_ifc_cmdfunc(struct mtd_i + &ifc->ifc_nand.nand_fcr0); + ifc_out32(column, &ifc->ifc_nand.row3); + +- /* +- * although currently it's 8 bytes for READID, we always read +- * the maximum 256 bytes(for PARAM) +- */ +- ifc_out32(256, &ifc->ifc_nand.nand_fbcr); +- ifc_nand_ctrl->read_bytes = 256; ++ ifc_out32(len, &ifc->ifc_nand.nand_fbcr); ++ ifc_nand_ctrl->read_bytes = len; + + set_addr(mtd, 0, 0, 0); + fsl_ifc_run_command(mtd); diff --git a/queue-4.17/mwifiex-correct-histogram-data-with-appropriate-index.patch b/queue-4.17/mwifiex-correct-histogram-data-with-appropriate-index.patch new file mode 100644 index 00000000000..58a2e3c0a02 --- /dev/null +++ b/queue-4.17/mwifiex-correct-histogram-data-with-appropriate-index.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Xinming Hu +Date: Fri, 18 May 2018 15:38:54 +0800 +Subject: mwifiex: correct histogram data with appropriate index + +From: Xinming Hu + +[ Upstream commit 30bfce0b63fa68c14ae1613eb9d259fa18644074 ] + +Correct snr/nr/rssi data index to avoid possible buffer underflow. + +Signed-off-by: Xinming Hu +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/util.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifie + s8 nflr) + { + struct mwifiex_histogram_data *phist_data = priv->hist_data; ++ s8 nf = -nflr; ++ s8 rssi = snr - nflr; + + atomic_inc(&phist_data->num_samples); + atomic_inc(&phist_data->rx_rate[rx_rate]); +- atomic_inc(&phist_data->snr[snr]); +- atomic_inc(&phist_data->noise_flr[128 + nflr]); +- atomic_inc(&phist_data->sig_str[nflr - snr]); ++ atomic_inc(&phist_data->snr[snr + 128]); ++ atomic_inc(&phist_data->noise_flr[nf + 128]); ++ atomic_inc(&phist_data->sig_str[rssi + 128]); + } + + /* function to reset histogram data during init/reset */ diff --git a/queue-4.17/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch b/queue-4.17/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch new file mode 100644 index 00000000000..99f26ef0951 --- /dev/null +++ b/queue-4.17/mwifiex-handle-race-during-mwifiex_usb_disconnect.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Ganapathi Bhat +Date: Thu, 24 May 2018 19:18:27 +0530 +Subject: mwifiex: handle race during mwifiex_usb_disconnect + +From: Ganapathi Bhat + +[ Upstream commit b817047ae70c0bd67b677b65d0d69d72cd6e9728 ] + +Race condition is observed during rmmod of mwifiex_usb: + +1. The rmmod thread will call mwifiex_usb_disconnect(), download + SHUTDOWN command and do wait_event_interruptible_timeout(), + waiting for response. + +2. The main thread will handle the response and will do a + wake_up_interruptible(), unblocking rmmod thread. + +3. On getting unblocked, rmmod thread will make rx_cmd.urb = NULL in + mwifiex_usb_free(). + +4. The main thread will try to resubmit rx_cmd.urb in + mwifiex_usb_submit_rx_urb(), which is NULL. + +To fix, wait for main thread to complete before calling +mwifiex_usb_free(). + +Signed-off-by: Ganapathi Bhat +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struc + MWIFIEX_FUNC_SHUTDOWN); + } + ++ if (adapter->workqueue) ++ flush_workqueue(adapter->workqueue); ++ + mwifiex_usb_free(card); + + mwifiex_dbg(adapter, FATAL, diff --git a/queue-4.17/net-dsa-qca8k-add-support-for-qca8334-switch.patch b/queue-4.17/net-dsa-qca8k-add-support-for-qca8334-switch.patch new file mode 100644 index 00000000000..fe01dae35e3 --- /dev/null +++ b/queue-4.17/net-dsa-qca8k-add-support-for-qca8334-switch.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Michal Vokáč" +Date: Wed, 23 May 2018 08:20:19 +0200 +Subject: net: dsa: qca8k: Add support for QCA8334 switch + +From: "Michal Vokáč" + +[ Upstream commit 64cf81675a1f64c1b311e4611dd3b6a961607612 ] + +Add support for the four-port variant of the Qualcomm QCA833x switch. + +Signed-off-by: Michal Vokáč +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/qca8k.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -933,6 +933,7 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops, + qca8k_suspend, qca8k_resume); + + static const struct of_device_id qca8k_of_match[] = { ++ { .compatible = "qca,qca8334" }, + { .compatible = "qca,qca8337" }, + { /* sentinel */ }, + }; diff --git a/queue-4.17/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch b/queue-4.17/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch new file mode 100644 index 00000000000..1216517a640 --- /dev/null +++ b/queue-4.17/net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Grygorii Strashko +Date: Tue, 15 May 2018 18:37:25 -0500 +Subject: net: ethernet: ti: cpsw-phy-sel: check bus_find_device() ret value + +From: Grygorii Strashko + +[ Upstream commit c6213eb1aee308e67377fd1890d84f7284caf531 ] + +This fixes klockworks warnings: Pointer 'dev' returned from call to +function 'bus_find_device' at line 179 may be NULL and will be dereferenced +at line 181. + + cpsw-phy-sel.c:179: 'dev' is assigned the return value from function 'bus_find_device'. + bus.c:342: 'bus_find_device' explicitly returns a NULL value. + cpsw-phy-sel.c:181: 'dev' is dereferenced by passing argument 1 to function 'dev_get_drvdata'. + device.h:1024: 'dev' is passed to function 'dev_get_drvdata'. + device.h:1026: 'dev' is explicitly dereferenced. + +Signed-off-by: Grygorii Strashko +[nsekhar@ti.com: add an error message, fix return path] +Signed-off-by: Sekhar Nori +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/ti/cpsw-phy-sel.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c ++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c +@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, ph + } + + dev = bus_find_device(&platform_bus_type, NULL, node, match); +- of_node_put(node); ++ if (!dev) { ++ dev_err(dev, "unable to find platform device for %pOF\n", node); ++ goto out; ++ } ++ + priv = dev_get_drvdata(dev); + + priv->cpsw_phy_sel(priv, phy_mode, slave); + + put_device(dev); ++out: ++ of_node_put(node); + } + EXPORT_SYMBOL_GPL(cpsw_phy_sel); + diff --git a/queue-4.17/net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch b/queue-4.17/net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch new file mode 100644 index 00000000000..cd6dcb7d167 --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yunsheng Lin +Date: Sat, 19 May 2018 16:53:23 +0100 +Subject: net: hns3: Fix for CMDQ and Misc. interrupt init order problem + +From: Yunsheng Lin + +[ Upstream commit eddf04626d1d6d0bcd01ac6a287e49f5ddb90a26 ] + +When vf module is loading, the cmd queue initialization should +happen before misc interrupt initialization, otherwise the misc +interrupt handle will cause using uninitialized cmd queue problem. +There is also the same issue when vf module is unloading. + +This patch fixes it by adjusting the location of some function. + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 16 +++++++------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1631,6 +1631,10 @@ static int hclgevf_init_hdev(struct hclg + + hclgevf_state_init(hdev); + ++ ret = hclgevf_cmd_init(hdev); ++ if (ret) ++ goto err_cmd_init; ++ + ret = hclgevf_misc_irq_init(hdev); + if (ret) { + dev_err(&pdev->dev, "failed(%d) to init Misc IRQ(vector0)\n", +@@ -1638,10 +1642,6 @@ static int hclgevf_init_hdev(struct hclg + goto err_misc_irq_init; + } + +- ret = hclgevf_cmd_init(hdev); +- if (ret) +- goto err_cmd_init; +- + ret = hclgevf_configure(hdev); + if (ret) { + dev_err(&pdev->dev, "failed(%d) to fetch configuration\n", ret); +@@ -1689,10 +1689,10 @@ static int hclgevf_init_hdev(struct hclg + return 0; + + err_config: +- hclgevf_cmd_uninit(hdev); +-err_cmd_init: + hclgevf_misc_irq_uninit(hdev); + err_misc_irq_init: ++ hclgevf_cmd_uninit(hdev); ++err_cmd_init: + hclgevf_state_uninit(hdev); + hclgevf_uninit_msi(hdev); + err_irq_init: +@@ -1702,9 +1702,9 @@ err_irq_init: + + static void hclgevf_uninit_hdev(struct hclgevf_dev *hdev) + { +- hclgevf_cmd_uninit(hdev); +- hclgevf_misc_irq_uninit(hdev); + hclgevf_state_uninit(hdev); ++ hclgevf_misc_irq_uninit(hdev); ++ hclgevf_cmd_uninit(hdev); + hclgevf_uninit_msi(hdev); + hclgevf_pci_uninit(hdev); + } diff --git a/queue-4.17/net-hns3-fix-for-fiber-link-up-problem.patch b/queue-4.17/net-hns3-fix-for-fiber-link-up-problem.patch new file mode 100644 index 00000000000..5c3a6400dfb --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-fiber-link-up-problem.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yunsheng Lin +Date: Tue, 15 May 2018 19:20:12 +0100 +Subject: net: hns3: Fix for fiber link up problem + +From: Yunsheng Lin + +[ Upstream commit be8d8cdb8ebf3afd841c109dd035fd789a0c7d53 ] + +When hclge_ae_start is called, hdev->hw.mac.link may be set +to one after up/down multi-times, which does not correspond to +the link state of netdev when the netdev is up. + +This fixes it by setting hdev->hw.mac.link to zero when +hclge_ae_start is called. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3783,6 +3783,7 @@ static int hclge_ae_start(struct hnae3_h + hclge_cfg_mac_mode(hdev, true); + clear_bit(HCLGE_STATE_DOWN, &hdev->state); + mod_timer(&hdev->service_timer, jiffies + HZ); ++ hdev->hw.mac.link = 0; + + /* reset tqp stats */ + hclge_reset_tqp_stats(handle); +@@ -3819,7 +3820,6 @@ static void hclge_ae_stop(struct hnae3_h + + /* reset tqp stats */ + hclge_reset_tqp_stats(handle); +- hclge_update_link_status(hdev); + } + + static int hclge_get_mac_vlan_cmd_status(struct hclge_vport *vport, diff --git a/queue-4.17/net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch b/queue-4.17/net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch new file mode 100644 index 00000000000..c8becb00d62 --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch @@ -0,0 +1,104 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Xi Wang +Date: Sat, 19 May 2018 16:53:19 +0100 +Subject: net: hns3: Fix for hns3 module is loaded multiple times problem + +From: Xi Wang + +[ Upstream commit 3c7624d8fc0b893b644b945ab904c629ebc9611e ] + +If the hns3 driver has been built into kernel and then loaded with +the same driver which built as KLM, it may trigger an error like +below: + +[ 20.009555] hns3: Hisilicon Ethernet Network Driver for Hip08 Family - version +[ 20.016789] hns3: Copyright (c) 2017 Huawei Corporation. +[ 20.022100] Error: Driver 'hns3' is already registered, aborting... +[ 23.517397] Unable to handle kernel NULL pointer dereference at virtual address 00000000 +... +[ 23.691583] Process insmod (pid: 1982, stack limit = 0x00000000cd5f21cb) +[ 23.698270] Call trace: +[ 23.700705] __list_del_entry_valid+0x2c/0xd8 +[ 23.705049] hnae3_unregister_client+0x68/0xa8 +[ 23.709487] hns3_init_module+0x98/0x1000 [hns3] +[ 23.714093] do_one_initcall+0x5c/0x170 +[ 23.717918] do_init_module+0x64/0x1f4 +[ 23.721654] load_module+0x1d14/0x24b0 +[ 23.725390] SyS_init_module+0x158/0x208 +[ 23.729300] el0_svc_naked+0x30/0x34 + +This patch fixes it by adding module version info. + +Fixes: 38caee9d3ee8 ("net: hns3: Add support of the HNAE3 framework") +Signed-off-by: Xi Wang +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 1 + + drivers/net/ethernet/hisilicon/hns3/hnae3.h | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 1 + + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 ++ + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- + 6 files changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.c +@@ -283,3 +283,4 @@ EXPORT_SYMBOL(hnae3_unregister_ae_dev); + MODULE_AUTHOR("Huawei Tech. Co., Ltd."); + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("HNAE3(Hisilicon Network Acceleration Engine) Framework"); ++MODULE_VERSION(HNAE3_MOD_VERSION); +--- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h +@@ -36,6 +36,8 @@ + #include + #include + ++#define HNAE3_MOD_VERSION "1.0" ++ + /* Device IDs */ + #define HNAE3_DEV_ID_GE 0xA220 + #define HNAE3_DEV_ID_25GE 0xA221 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3631,3 +3631,4 @@ MODULE_DESCRIPTION("HNS3: Hisilicon Ethe + MODULE_AUTHOR("Huawei Tech. Co., Ltd."); + MODULE_LICENSE("GPL"); + MODULE_ALIAS("pci:hns-nic"); ++MODULE_VERSION(HNS3_MOD_VERSION); +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +@@ -14,6 +14,8 @@ + + #include "hnae3.h" + ++#define HNS3_MOD_VERSION "1.0" ++ + extern const char hns3_driver_version[]; + + enum hns3_nic_state { +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +@@ -15,7 +15,7 @@ + #include "hclge_cmd.h" + #include "hnae3.h" + +-#define HCLGE_MOD_VERSION "v1.0" ++#define HCLGE_MOD_VERSION "1.0" + #define HCLGE_DRIVER_NAME "hclge" + + #define HCLGE_INVALID_VPORT 0xffff +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h +@@ -9,7 +9,7 @@ + #include "hclgevf_cmd.h" + #include "hnae3.h" + +-#define HCLGEVF_MOD_VERSION "v1.0" ++#define HCLGEVF_MOD_VERSION "1.0" + #define HCLGEVF_DRIVER_NAME "hclgevf" + + #define HCLGEVF_ROCEE_VECTOR_NUM 0 diff --git a/queue-4.17/net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch b/queue-4.17/net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch new file mode 100644 index 00000000000..3bacf9338a7 --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yunsheng Lin +Date: Fri, 1 Jun 2018 17:52:07 +0100 +Subject: net: hns3: Fix for phy not link up problem after resetting + +From: Yunsheng Lin + +[ Upstream commit 9617f66867b09b326cc932416be2431c5b91c8d8 ] + +When resetting, phy_state_machine may be accessing the phy through +firmware if the phy is not stopped or disconnected, which will +cause firemware timeout problem because the firmware is busy +processing the reset request. + +This patch fixes it by disabling the phy when resetting. + +Fixes: b940aeae0ed6 ("net: hns3: never send command queue message to IMP when reset") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3787,9 +3787,6 @@ static int hclge_ae_start(struct hnae3_h + /* reset tqp stats */ + hclge_reset_tqp_stats(handle); + +- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) +- return 0; +- + ret = hclge_mac_start_phy(hdev); + if (ret) + return ret; +@@ -3806,8 +3803,10 @@ static void hclge_ae_stop(struct hnae3_h + del_timer_sync(&hdev->service_timer); + cancel_work_sync(&hdev->service_task); + +- if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) ++ if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) { ++ hclge_mac_stop_phy(hdev); + return; ++ } + + for (i = 0; i < vport->alloc_tqps; i++) + hclge_tqp_enable(hdev, i, 0, false); diff --git a/queue-4.17/net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch b/queue-4.17/net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch new file mode 100644 index 00000000000..9f8d7e59b6d --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Yunsheng Lin +Date: Fri, 1 Jun 2018 17:52:05 +0100 +Subject: net: hns3: Fix for service_task not running problem after resetting + +From: Yunsheng Lin + +[ Upstream commit f5be79673fc4c925708c99ec37d77e0a2c3cd30b ] + +When hclge_ae_stop is called during resetting, it will cancel the +service_task by calling cancel_work_sync, which may cause the +service_task to exit without clearing HCLGE_STATE_SERVICE_SCHED +bit. If this happens, the service_task will never run again. + +This patch fixes this problem by clearing it after calling +cancel_work_sync in hclge_ae_stop. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Yunsheng Lin +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1 + + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3802,6 +3802,7 @@ static void hclge_ae_stop(struct hnae3_h + + del_timer_sync(&hdev->service_timer); + cancel_work_sync(&hdev->service_task); ++ clear_bit(HCLGE_STATE_SERVICE_SCHED, &hdev->state); + + if (test_bit(HCLGE_STATE_RST_HANDLING, &hdev->state)) { + hclge_mac_stop_phy(hdev); +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1323,6 +1323,7 @@ static void hclgevf_ae_stop(struct hnae3 + hclgevf_reset_tqp_stats(handle); + del_timer_sync(&hdev->service_timer); + cancel_work_sync(&hdev->service_task); ++ clear_bit(HCLGEVF_STATE_SERVICE_SCHED, &hdev->state); + hclgevf_update_link_status(hdev, 0); + } + diff --git a/queue-4.17/net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch b/queue-4.17/net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch new file mode 100644 index 00000000000..83957a8f106 --- /dev/null +++ b/queue-4.17/net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Xi Wang +Date: Wed, 6 Jun 2018 14:07:51 +0100 +Subject: net: hns3: Fix for VF mailbox cannot receiving PF response + +From: Xi Wang + +[ Upstream commit 1819e40908ee76c7219287224c22c772556c927e ] + +When the VF frequently switches the CMDQ interrupt, if the CMDQ_SRC is not +cleared, the VF will not receive the new PF response after the interrupt +is re-enabled, the corresponding log is as follows: + +[ 317.482222] hns3 0000:00:03.0: VF could not get mbx resp(=0) from PF +in 500 tries +[ 317.483137] hns3 0000:00:03.0: VF request to get tqp info from PF +failed -5 + +This patch fixes this problem by clearing CMDQ_SRC before enabling +interrupt and syncing pending IRQ handlers after disabling interrupt. + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Xi Wang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1441,6 +1441,8 @@ static int hclgevf_misc_irq_init(struct + return ret; + } + ++ hclgevf_clear_event_cause(hdev, 0); ++ + /* enable misc. vector(vector 0) */ + hclgevf_enable_vector(&hdev->misc_vector, true); + +@@ -1451,6 +1453,7 @@ static void hclgevf_misc_irq_uninit(stru + { + /* disable misc vector(vector 0) */ + hclgevf_enable_vector(&hdev->misc_vector, false); ++ synchronize_irq(hdev->misc_vector.vector_irq); + free_irq(hdev->misc_vector.vector_irq, hdev); + hclgevf_free_vector(hdev, 0); + } diff --git a/queue-4.17/net-hns3-fix-the-missing-client-list-node-initialization.patch b/queue-4.17/net-hns3-fix-the-missing-client-list-node-initialization.patch new file mode 100644 index 00000000000..47f5c6c42b8 --- /dev/null +++ b/queue-4.17/net-hns3-fix-the-missing-client-list-node-initialization.patch @@ -0,0 +1,34 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Xi Wang +Date: Sat, 19 May 2018 16:53:18 +0100 +Subject: net: hns3: Fix the missing client list node initialization + +From: Xi Wang + +[ Upstream commit 13562d1f5e2fbe2cf33b23a00abca3f71264c4ac ] + +This patch fixes the missing initialization of the client list node +in the hnae3_register_client() function. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Xi Wang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -3602,6 +3602,8 @@ static int __init hns3_init_module(void) + + client.ops = &client_ops; + ++ INIT_LIST_HEAD(&client.node); ++ + ret = hnae3_register_client(&client); + if (ret) + return ret; diff --git a/queue-4.17/net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch b/queue-4.17/net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch new file mode 100644 index 00000000000..424a3958300 --- /dev/null +++ b/queue-4.17/net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Lijun Ou +Date: Fri, 25 May 2018 19:43:07 +0100 +Subject: net: hns3: Fixes initalization of RoCE handle and makes it conditional + +From: Lijun Ou + +[ Upstream commit 544a7bcd5cc74734003cf7f12502b26cebfed19f ] + +When register a RoCE client with hnae3vf device, it needs to judge +the device whether support RoCE vf function. Otherwise, it will +lead to calltrace when RoCE is not support vf function and remove +roce device. + +The calltrace as follows: +[ 93.156614] Unable to handle kernel NULL pointer dereference at virtual address 00000015 + +[ 93.278784] Call trace: +[ 93.278788] hnae3_match_n_instantiate+0x24/0xd8 [hnae3] +[ 93.278790] hnae3_register_client+0xcc/0x150 [hnae3] +[ 93.278801] hns_roce_hw_v2_init+0x18/0x1000 [hns_roce_hw_v2] +[ 93.278805] do_one_initcall+0x58/0x160 +[ 93.278807] do_init_module+0x64/0x1d8 +[ 93.278809] load_module+0x135c/0x15c8 +[ 93.278811] SyS_finit_module+0x100/0x118 +[ 93.278816] __sys_trace_return+0x0/0x4 +[ 93.278827] Code: aa0003f5 12001c56 aa1e03e0 d503201f (b9402660) + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Reported-by: Xinwei Kong +Reported-by: Zhou Wang +Signed-off-by: Lijun Ou +Signed-off-by: Zhou Wang +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -1493,10 +1493,12 @@ static int hclgevf_init_instance(struct + return ret; + break; + case HNAE3_CLIENT_ROCE: +- hdev->roce_client = client; +- hdev->roce.client = client; ++ if (hnae3_dev_roce_supported(hdev)) { ++ hdev->roce_client = client; ++ hdev->roce.client = client; ++ } + +- if (hdev->roce_client && hnae3_dev_roce_supported(hdev)) { ++ if (hdev->roce_client && hdev->nic_client) { + ret = hclgevf_init_roce_base_info(hdev); + if (ret) + return ret; diff --git a/queue-4.17/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch b/queue-4.17/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch new file mode 100644 index 00000000000..d9312c46b3e --- /dev/null +++ b/queue-4.17/net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Fuyun Liang +Date: Fri, 25 May 2018 19:43:02 +0100 +Subject: net: hns3: Fixes the init of the VALID BD info in the descriptor + +From: Fuyun Liang + +[ Upstream commit 7d0b130cbbfa4651cc1ab9268a2956c1b9d82ff9 ] + +RX Buffer Descriptor contains a VALID bit which indicates if the BD +is valid and has some data. This field is set by HNS3 hardware to +intimate the driver of some valid data present in the BD. nd should +be reset by the driver when BD is being used again. In the existing +code this bit was not being (re-)initialized properly and hence was +causing problems. + +Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") +Signed-off-by: Fuyun Liang +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1836,6 +1836,7 @@ static void hns3_replace_buffer(struct h + hns3_unmap_buffer(ring, &ring->desc_cb[i]); + ring->desc_cb[i] = *res_cb; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) +@@ -1843,6 +1844,7 @@ static void hns3_reuse_buffer(struct hns + ring->desc_cb[i].reuse_flag = 0; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma + + ring->desc_cb[i].page_offset); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes, diff --git a/queue-4.17/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch b/queue-4.17/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch new file mode 100644 index 00000000000..6600d3d6b5c --- /dev/null +++ b/queue-4.17/net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Huazhong Tan +Date: Tue, 1 May 2018 19:55:59 +0100 +Subject: net: hns3: Fixes the out of bounds access in hclge_map_tqp + +From: Huazhong Tan + +[ Upstream commit 38e62046d4c95272e2fb001d2d72baf48fa090e9 ] + +This patch fixes the handling of the check when number of vports +are detected to be more than available TPQs. Current handling causes +an out of bounds access in hclge_map_tqp(). + +Fixes: 7df7dad633e2 ("net: hns3: Refactor the mapping of tqp to vport") +Signed-off-by: Huazhong Tan +Signed-off-by: Peng Li +Signed-off-by: Salil Mehta +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -1459,8 +1459,11 @@ static int hclge_alloc_vport(struct hclg + /* We need to alloc a vport for main NIC of PF */ + num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1; + +- if (hdev->num_tqps < num_vport) +- num_vport = hdev->num_tqps; ++ if (hdev->num_tqps < num_vport) { ++ dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)", ++ hdev->num_tqps, num_vport); ++ return -EINVAL; ++ } + + /* Alloc the same number of TQPs for every vport */ + tqp_per_vport = hdev->num_tqps / num_vport; diff --git a/queue-4.17/net-mvpp2-add-missing-vlan-tag-detection.patch b/queue-4.17/net-mvpp2-add-missing-vlan-tag-detection.patch new file mode 100644 index 00000000000..ab00eb6b503 --- /dev/null +++ b/queue-4.17/net-mvpp2-add-missing-vlan-tag-detection.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Maxime Chevallier +Date: Fri, 18 May 2018 09:33:39 +0200 +Subject: net: mvpp2: Add missing VLAN tag detection + +From: Maxime Chevallier + +[ Upstream commit 62c8a069b510d905039abd4097434f190a316941 ] + +Marvell PPv2 Header Parser sets some bits in the 'result_info' field in +each lookup iteration, to identify different packet attributes such as +DSA / VLAN tag, protocol infos, etc. This is used in further +classification stages in the controller. + +It's the DSA tag detection entry that is in charge of detecting when there +is a single VLAN tag. + +This commits adds the missing update of the result_info in this case. + +Signed-off-by: Maxime Chevallier +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -2109,6 +2109,9 @@ static void mvpp2_prs_dsa_tag_set(struct + mvpp2_prs_sram_ai_update(&pe, 0, + MVPP2_PRS_SRAM_AI_MASK); + ++ /* Set result info bits to 'single vlan' */ ++ mvpp2_prs_sram_ri_update(&pe, MVPP2_PRS_RI_VLAN_SINGLE, ++ MVPP2_PRS_RI_VLAN_MASK); + /* If packet is tagged continue check vid filtering */ + mvpp2_prs_sram_next_lu_set(&pe, MVPP2_PRS_LU_VID); + } else { diff --git a/queue-4.17/net-phy-phylink-release-link-gpio.patch b/queue-4.17/net-phy-phylink-release-link-gpio.patch new file mode 100644 index 00000000000..606a4814329 --- /dev/null +++ b/queue-4.17/net-phy-phylink-release-link-gpio.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Florian Fainelli +Date: Thu, 10 May 2018 13:17:30 -0700 +Subject: net: phy: phylink: Release link GPIO + +From: Florian Fainelli + +[ Upstream commit daab3349ad1a69663ccad278ed71d55974d104b4 ] + +We are not releasing the link GPIO descriptor with gpiod_put() which results in +subsequent probing to get -EBUSY when calling fwnode_get_named_gpiod(). Fix this +by doing the release in phylink_destroy(). + +Fixes: 9525ae83959b ("phylink: add phylink infrastructure") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/phylink.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -612,6 +612,8 @@ void phylink_destroy(struct phylink *pl) + { + if (pl->sfp_bus) + sfp_unregister_upstream(pl->sfp_bus); ++ if (!IS_ERR(pl->link_gpio)) ++ gpiod_put(pl->link_gpio); + + cancel_work_sync(&pl->resolve); + kfree(pl); diff --git a/queue-4.17/net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch b/queue-4.17/net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch new file mode 100644 index 00000000000..79716e29007 --- /dev/null +++ b/queue-4.17/net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch @@ -0,0 +1,42 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Antoine Tenart +Date: Fri, 4 May 2018 17:21:03 +0200 +Subject: net: phy: sfp: handle cases where neither BR, min nor BR, max is given + +From: Antoine Tenart + +[ Upstream commit 2b999ba899059eed00a03d029894a62486e7e2bc ] + +When computing the bitrate using values read from an SFP module EEPROM, +we use the nominal BR plus BR,min and BR,max to determine the +boundaries. But in some cases BR,min and BR,max aren't provided, which +led the SFP code to end up having the nominal value for both the minimum +and maximum bitrate values. When using a passive cable, the nominal +value should be used as the maximum one, and there is no minimum one +so we should use 0. + +Signed-off-by: Antoine Tenart +Acked-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/sfp-bus.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/net/phy/sfp-bus.c ++++ b/drivers/net/phy/sfp-bus.c +@@ -132,6 +132,13 @@ void sfp_parse_support(struct sfp_bus *b + br_max = br_nom + br_nom * id->ext.br_min / 100; + br_min = br_nom - br_nom * id->ext.br_min / 100; + } ++ ++ /* When using passive cables, in case neither BR,min nor BR,max ++ * are specified, set br_min to 0 as the nominal value is then ++ * used as the maximum. ++ */ ++ if (br_min == br_max && id->base.sfp_ct_passive) ++ br_min = 0; + } + + /* Set ethtool support from the compliance fields. */ diff --git a/queue-4.17/net-socionext-reset-hardware-in-ndo_stop.patch b/queue-4.17/net-socionext-reset-hardware-in-ndo_stop.patch new file mode 100644 index 00000000000..9d0e2b7c51a --- /dev/null +++ b/queue-4.17/net-socionext-reset-hardware-in-ndo_stop.patch @@ -0,0 +1,100 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Masahisa KOJIMA +Date: Mon, 16 Apr 2018 13:09:59 +0530 +Subject: net: socionext: reset hardware in ndo_stop + +From: Masahisa KOJIMA + +[ Upstream commit 9a00b697ce31e38c670a3042cf9f1e9cf28dabb5 ] + +When the interface is down, head/tail of the descriptor +ring address is set to 0 in netsec_netdev_stop(). +But netsec hardware still keeps the previous descriptor +ring address, so there is inconsistency between driver +and hardware after interface is up at a later time. +To address this inconsistency, add netsec_reset_hardware() +when the interface is down. + +In addition, to minimize the reset process, +add flag to decide whether driver loads the netsec microcode. +Even if driver resets the netsec hardware, netsec microcode +keeps resident on RAM, so it is ok we only load the microcode +at initialization. + +This patch is critical for installation over network. + +Signed-off-by: Masahisa KOJIMA +Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") +Signed-off-by: Jassi Brar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/socionext/netsec.c | 23 +++++++++++++++-------- + 1 file changed, 15 insertions(+), 8 deletions(-) + +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -1057,7 +1057,8 @@ static int netsec_netdev_load_microcode( + return 0; + } + +-static int netsec_reset_hardware(struct netsec_priv *priv) ++static int netsec_reset_hardware(struct netsec_priv *priv, ++ bool load_ucode) + { + u32 value; + int err; +@@ -1102,11 +1103,14 @@ static int netsec_reset_hardware(struct + netsec_write(priv, NETSEC_REG_NRM_RX_CONFIG, + 1 << NETSEC_REG_DESC_ENDIAN); + +- err = netsec_netdev_load_microcode(priv); +- if (err) { +- netif_err(priv, probe, priv->ndev, +- "%s: failed to load microcode (%d)\n", __func__, err); +- return err; ++ if (load_ucode) { ++ err = netsec_netdev_load_microcode(priv); ++ if (err) { ++ netif_err(priv, probe, priv->ndev, ++ "%s: failed to load microcode (%d)\n", ++ __func__, err); ++ return err; ++ } + } + + /* start DMA engines */ +@@ -1328,6 +1332,7 @@ err1: + + static int netsec_netdev_stop(struct net_device *ndev) + { ++ int ret; + struct netsec_priv *priv = netdev_priv(ndev); + + netif_stop_queue(priv->ndev); +@@ -1343,12 +1348,14 @@ static int netsec_netdev_stop(struct net + netsec_uninit_pkt_dring(priv, NETSEC_RING_TX); + netsec_uninit_pkt_dring(priv, NETSEC_RING_RX); + ++ ret = netsec_reset_hardware(priv, false); ++ + phy_stop(ndev->phydev); + phy_disconnect(ndev->phydev); + + pm_runtime_put_sync(priv->dev); + +- return 0; ++ return ret; + } + + static int netsec_netdev_init(struct net_device *ndev) +@@ -1364,7 +1371,7 @@ static int netsec_netdev_init(struct net + if (ret) + goto err1; + +- ret = netsec_reset_hardware(priv); ++ ret = netsec_reset_hardware(priv, true); + if (ret) + goto err2; + diff --git a/queue-4.17/netfilter-ipset-forbid-family-for-hash-mac-sets.patch b/queue-4.17/netfilter-ipset-forbid-family-for-hash-mac-sets.patch new file mode 100644 index 00000000000..0b87b651220 --- /dev/null +++ b/queue-4.17/netfilter-ipset-forbid-family-for-hash-mac-sets.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Florent Fourcot +Date: Mon, 4 Jun 2018 16:51:19 +0200 +Subject: netfilter: ipset: forbid family for hash:mac sets + +From: Florent Fourcot + +[ Upstream commit cbdebe481a14b42c45aa9f4ceb5ff19b55de2c57 ] + +Userspace `ipset` command forbids family option for hash:mac type: + +ipset create test hash:mac family inet4 +ipset v6.30: Unknown argument: `family' + +However, this check is not done in kernel itself. When someone use +external netlink applications (pyroute2 python library for example), one +can create hash:mac with invalid family and inconsistant results from +userspace (`ipset` command cannot read set content anymore). + +This patch enforce the logic in kernel, and forbids insertion of +hash:mac with a family set. + +Since IP_SET_PROTO_UNDEF is defined only for hash:mac, this patch has no +impact on other hash:* sets + +Signed-off-by: Florent Fourcot +Signed-off-by: Victorien Molle +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/ipset/ip_set_hash_gen.h | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -1234,7 +1234,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net * + pr_debug("Create set %s with family %s\n", + set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6"); + +-#ifndef IP_SET_PROTO_UNDEF ++#ifdef IP_SET_PROTO_UNDEF ++ if (set->family != NFPROTO_UNSPEC) ++ return -IPSET_ERR_INVALID_FAMILY; ++#else + if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6)) + return -IPSET_ERR_INVALID_FAMILY; + #endif diff --git a/queue-4.17/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch b/queue-4.17/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch new file mode 100644 index 00000000000..7ee277ceee9 --- /dev/null +++ b/queue-4.17/netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jozsef Kadlecsik +Date: Thu, 31 May 2018 18:45:21 +0200 +Subject: netfilter: ipset: List timing out entries with "timeout 1" instead of zero + +From: Jozsef Kadlecsik + +[ Upstream commit bd975e691486ba52790ba23cc9b4fecab7bc0d31 ] + +When listing sets with timeout support, there's a probability that +just timing out entries with "0" timeout value is listed/saved. +However when restoring the saved list, the zero timeout value means +permanent elelements. + +The new behaviour is that timing out entries are listed with "timeout 1" +instead of zero. + +Fixes netfilter bugzilla #1258. + +Signed-off-by: Jozsef Kadlecsik +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/netfilter/ipset/ip_set_timeout.h | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/include/linux/netfilter/ipset/ip_set_timeout.h ++++ b/include/linux/netfilter/ipset/ip_set_timeout.h +@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeou + static inline u32 + ip_set_timeout_get(const unsigned long *timeout) + { +- return *timeout == IPSET_ELEM_PERMANENT ? 0 : +- jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ u32 t; ++ ++ if (*timeout == IPSET_ELEM_PERMANENT) ++ return 0; ++ ++ t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ /* Zero value in userspace means no timeout */ ++ return t == 0 ? 1 : t; + } + + #endif /* __KERNEL__ */ diff --git a/queue-4.17/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch b/queue-4.17/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch new file mode 100644 index 00000000000..44fb63d1ce3 --- /dev/null +++ b/queue-4.17/netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch @@ -0,0 +1,142 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexey Kodanev +Date: Thu, 31 May 2018 19:53:33 +0300 +Subject: netfilter: nf_tables: check msg_type before nft_trans_set(trans) + +From: Alexey Kodanev + +[ Upstream commit 9c7f96fd77b0dbe1fe7ed1f9c462c45dc48a1076 ] + +The patch moves the "trans->msg_type == NFT_MSG_NEWSET" check before +using nft_trans_set(trans). Otherwise we can get out of bounds read. + +For example, KASAN reported the one when running 0001_cache_handling_0 nft +test. In this case "trans->msg_type" was NFT_MSG_NEWTABLE: + +[75517.177808] BUG: KASAN: slab-out-of-bounds in nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75517.279094] Read of size 8 at addr ffff881bdb643fc8 by task nft/7356 +... +[75517.375605] CPU: 26 PID: 7356 Comm: nft Tainted: G E 4.17.0-rc7.1.x86_64 #1 +[75517.489587] Hardware name: Oracle Corporation SUN SERVER X4-2 +[75517.618129] Call Trace: +[75517.648821] dump_stack+0xd1/0x13b +[75517.691040] ? show_regs_print_info+0x5/0x5 +[75517.742519] ? kmsg_dump_rewind_nolock+0xf5/0xf5 +[75517.799300] ? lock_acquire+0x143/0x310 +[75517.846738] print_address_description+0x85/0x3a0 +[75517.904547] kasan_report+0x18d/0x4b0 +[75517.949892] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.019153] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.088420] ? nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.157689] nft_set_lookup_global+0x22f/0x270 [nf_tables] +[75518.224869] nf_tables_newsetelem+0x1a5/0x5d0 [nf_tables] +[75518.291024] ? nft_add_set_elem+0x2280/0x2280 [nf_tables] +[75518.357154] ? nla_parse+0x1a5/0x300 +[75518.401455] ? kasan_kmalloc+0xa6/0xd0 +[75518.447842] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] +[75518.507743] ? nfnetlink_rcv+0x7a5/0x1bdf [nfnetlink] +[75518.569745] ? nfnl_err_reset+0x3c0/0x3c0 [nfnetlink] +[75518.631711] ? lock_acquire+0x143/0x310 +[75518.679133] ? netlink_deliver_tap+0x9b/0x1070 +[75518.733840] ? kasan_unpoison_shadow+0x31/0x40 +[75518.788542] netlink_unicast+0x45d/0x680 +[75518.837111] ? __isolate_free_page+0x890/0x890 +[75518.891913] ? netlink_attachskb+0x6b0/0x6b0 +[75518.944542] netlink_sendmsg+0x6fa/0xd30 +[75518.993107] ? netlink_unicast+0x680/0x680 +[75519.043758] ? netlink_unicast+0x680/0x680 +[75519.094402] sock_sendmsg+0xd9/0x160 +[75519.138810] ___sys_sendmsg+0x64d/0x980 +[75519.186234] ? copy_msghdr_from_user+0x350/0x350 +[75519.243118] ? lock_downgrade+0x650/0x650 +[75519.292738] ? do_raw_spin_unlock+0x5d/0x250 +[75519.345456] ? _raw_spin_unlock+0x24/0x30 +[75519.395065] ? __handle_mm_fault+0xbde/0x3410 +[75519.448830] ? sock_setsockopt+0x3d2/0x1940 +[75519.500516] ? __lock_acquire.isra.25+0xdc/0x19d0 +[75519.558448] ? lock_downgrade+0x650/0x650 +[75519.608057] ? __audit_syscall_entry+0x317/0x720 +[75519.664960] ? __fget_light+0x58/0x250 +[75519.711325] ? __sys_sendmsg+0xde/0x170 +[75519.758850] __sys_sendmsg+0xde/0x170 +[75519.804193] ? __ia32_sys_shutdown+0x90/0x90 +[75519.856725] ? syscall_trace_enter+0x897/0x10e0 +[75519.912354] ? trace_event_raw_event_sys_enter+0x920/0x920 +[75519.979432] ? __audit_syscall_entry+0x720/0x720 +[75520.036118] do_syscall_64+0xa3/0x3d0 +[75520.081248] ? prepare_exit_to_usermode+0x47/0x1d0 +[75520.139904] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[75520.201680] RIP: 0033:0x7fc153320ba0 +[75520.245772] RSP: 002b:00007ffe294c3638 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +[75520.337708] RAX: ffffffffffffffda RBX: 00007ffe294c4820 RCX: 00007fc153320ba0 +[75520.424547] RDX: 0000000000000000 RSI: 00007ffe294c46b0 RDI: 0000000000000003 +[75520.511386] RBP: 00007ffe294c47b0 R08: 0000000000000004 R09: 0000000002114090 +[75520.598225] R10: 00007ffe294c30a0 R11: 0000000000000246 R12: 00007ffe294c3660 +[75520.684961] R13: 0000000000000001 R14: 00007ffe294c3650 R15: 0000000000000001 + +[75520.790946] Allocated by task 7356: +[75520.833994] kasan_kmalloc+0xa6/0xd0 +[75520.878088] __kmalloc+0x189/0x450 +[75520.920107] nft_trans_alloc_gfp+0x20/0x190 [nf_tables] +[75520.983961] nf_tables_newtable+0xcd0/0x1bd0 [nf_tables] +[75521.048857] nfnetlink_rcv+0xc43/0x1bdf [nfnetlink] +[75521.108655] netlink_unicast+0x45d/0x680 +[75521.157013] netlink_sendmsg+0x6fa/0xd30 +[75521.205271] sock_sendmsg+0xd9/0x160 +[75521.249365] ___sys_sendmsg+0x64d/0x980 +[75521.296686] __sys_sendmsg+0xde/0x170 +[75521.341822] do_syscall_64+0xa3/0x3d0 +[75521.386957] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[75521.467867] Freed by task 23454: +[75521.507804] __kasan_slab_free+0x132/0x180 +[75521.558137] kfree+0x14d/0x4d0 +[75521.596005] free_rt_sched_group+0x153/0x280 +[75521.648410] sched_autogroup_create_attach+0x19a/0x520 +[75521.711330] ksys_setsid+0x2ba/0x400 +[75521.755529] __ia32_sys_setsid+0xa/0x10 +[75521.802850] do_syscall_64+0xa3/0x3d0 +[75521.848090] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[75521.929000] The buggy address belongs to the object at ffff881bdb643f80 + which belongs to the cache kmalloc-96 of size 96 +[75522.079797] The buggy address is located 72 bytes inside of + 96-byte region [ffff881bdb643f80, ffff881bdb643fe0) +[75522.221234] The buggy address belongs to the page: +[75522.280100] page:ffffea006f6d90c0 count:1 mapcount:0 mapping:0000000000000000 index:0x0 +[75522.377443] flags: 0x2fffff80000100(slab) +[75522.426956] raw: 002fffff80000100 0000000000000000 0000000000000000 0000000180200020 +[75522.521275] raw: ffffea006e6fafc0 0000000c0000000c ffff881bf180f400 0000000000000000 +[75522.615601] page dumped because: kasan: bad access detected + +Fixes: 37a9cc525525 ("netfilter: nf_tables: add generation mask to sets") +Signed-off-by: Alexey Kodanev +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_tables_api.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2728,12 +2728,13 @@ static struct nft_set *nf_tables_set_loo + u32 id = ntohl(nla_get_be32(nla)); + + list_for_each_entry(trans, &net->nft.commit_list, list) { +- struct nft_set *set = nft_trans_set(trans); ++ if (trans->msg_type == NFT_MSG_NEWSET) { ++ struct nft_set *set = nft_trans_set(trans); + +- if (trans->msg_type == NFT_MSG_NEWSET && +- id == nft_trans_set_id(trans) && +- nft_active_genmask(set, genmask)) +- return set; ++ if (id == nft_trans_set_id(trans) && ++ nft_active_genmask(set, genmask)) ++ return set; ++ } + } + return ERR_PTR(-ENOENT); + } diff --git a/queue-4.17/nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch b/queue-4.17/nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch new file mode 100644 index 00000000000..7f4e617e4b2 --- /dev/null +++ b/queue-4.17/nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Trond Myklebust +Date: Tue, 29 May 2018 11:15:49 -0400 +Subject: NFS: Fix up nfs_post_op_update_inode() to force ctime updates + +From: Trond Myklebust + +[ Upstream commit d554168f87a55b35b7c59921a0dc45b6ba17d08d ] + +We do not want to ignore ctime updates that originate from functions +such as link(). + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1629,7 +1629,8 @@ int nfs_post_op_update_inode(struct inod + nfs_fattr_set_barrier(fattr); + status = nfs_post_op_update_inode_locked(inode, fattr, + NFS_INO_INVALID_CHANGE +- | NFS_INO_INVALID_CTIME); ++ | NFS_INO_INVALID_CTIME ++ | NFS_INO_REVAL_FORCED); + spin_unlock(&inode->i_lock); + + return status; diff --git a/queue-4.17/nfsd-fix-error-handling-in-nfs4_set_delegation.patch b/queue-4.17/nfsd-fix-error-handling-in-nfs4_set_delegation.patch new file mode 100644 index 00000000000..c177c89e104 --- /dev/null +++ b/queue-4.17/nfsd-fix-error-handling-in-nfs4_set_delegation.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Andrew Elble +Date: Wed, 18 Apr 2018 17:04:37 -0400 +Subject: nfsd: fix error handling in nfs4_set_delegation() + +From: Andrew Elble + +[ Upstream commit 692ad280bff3e81721ab138b9455948ab5289acf ] + +I noticed a memory corruption crash in nfsd in +4.17-rc1. This patch corrects the issue. + +Fix to return error if the delegation couldn't be hashed or there was +a recall in progress. Use the existing error path instead of +destroy_delegation() for readability. + +Signed-off-by: Andrew Elble +Fixes: 353601e7d323c ("nfsd: create a separate lease for each delegation") +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4state.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4378,8 +4378,11 @@ nfs4_set_delegation(struct nfs4_client * + spin_unlock(&state_lock); + + if (status) +- destroy_unhashed_deleg(dp); ++ goto out_unlock; ++ + return dp; ++out_unlock: ++ vfs_setlease(fp->fi_deleg_file, F_UNLCK, NULL, (void **)&dp); + out_clnt_odstate: + put_clnt_odstate(dp->dl_clnt_odstate); + out_stid: diff --git a/queue-4.17/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch b/queue-4.17/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch new file mode 100644 index 00000000000..f0e6f4a9aaf --- /dev/null +++ b/queue-4.17/nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch @@ -0,0 +1,108 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Scott Mayhew +Date: Fri, 8 Jun 2018 16:31:46 -0400 +Subject: nfsd: fix potential use-after-free in nfsd4_decode_getdeviceinfo + +From: Scott Mayhew + +[ Upstream commit 3171822fdcdd6e6d536047c425af6dc7a92dc585 ] + +When running a fuzz tester against a KASAN-enabled kernel, the following +splat periodically occurs. + +The problem occurs when the test sends a GETDEVICEINFO request with a +malformed xdr array (size but no data) for gdia_notify_types and the +array size is > 0x3fffffff, which results in an overflow in the value of +nbytes which is passed to read_buf(). + +If the array size is 0x40000000, 0x80000000, or 0xc0000000, then after +the overflow occurs, the value of nbytes 0, and when that happens the +pointer returned by read_buf() points to the end of the xdr data (i.e. +argp->end) when really it should be returning NULL. + +Fix this by returning NFS4ERR_BAD_XDR if the array size is > 1000 (this +value is arbitrary, but it's the same threshold used by +nfsd4_decode_bitmap()... in could really be any value >= 1 since it's +expected to get at most a single bitmap in gdia_notify_types). + +[ 119.256854] ================================================================== +[ 119.257611] BUG: KASAN: use-after-free in nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.258422] Read of size 4 at addr ffff880113ada000 by task nfsd/538 + +[ 119.259146] CPU: 0 PID: 538 Comm: nfsd Not tainted 4.17.0+ #1 +[ 119.259662] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-1.fc25 04/01/2014 +[ 119.261202] Call Trace: +[ 119.262265] dump_stack+0x71/0xab +[ 119.263371] print_address_description+0x6a/0x270 +[ 119.264609] kasan_report+0x258/0x380 +[ 119.265854] ? nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.267291] nfsd4_decode_getdeviceinfo+0x5a4/0x5b0 [nfsd] +[ 119.268549] ? nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd] +[ 119.269873] ? nfsd4_decode_sequence+0x490/0x490 [nfsd] +[ 119.271095] nfs4svc_decode_compoundargs+0xa5b/0x13c0 [nfsd] +[ 119.272393] ? nfsd4_release_compoundargs+0x1b0/0x1b0 [nfsd] +[ 119.273658] nfsd_dispatch+0x183/0x850 [nfsd] +[ 119.274918] svc_process+0x161c/0x31a0 [sunrpc] +[ 119.276172] ? svc_printk+0x190/0x190 [sunrpc] +[ 119.277386] ? svc_xprt_release+0x451/0x680 [sunrpc] +[ 119.278622] nfsd+0x2b9/0x430 [nfsd] +[ 119.279771] ? nfsd_destroy+0x1c0/0x1c0 [nfsd] +[ 119.281157] kthread+0x2db/0x390 +[ 119.282347] ? kthread_create_worker_on_cpu+0xc0/0xc0 +[ 119.283756] ret_from_fork+0x35/0x40 + +[ 119.286041] Allocated by task 436: +[ 119.287525] kasan_kmalloc+0xa0/0xd0 +[ 119.288685] kmem_cache_alloc+0xe9/0x1f0 +[ 119.289900] get_empty_filp+0x7b/0x410 +[ 119.291037] path_openat+0xca/0x4220 +[ 119.292242] do_filp_open+0x182/0x280 +[ 119.293411] do_sys_open+0x216/0x360 +[ 119.294555] do_syscall_64+0xa0/0x2f0 +[ 119.295721] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +[ 119.298068] Freed by task 436: +[ 119.299271] __kasan_slab_free+0x130/0x180 +[ 119.300557] kmem_cache_free+0x78/0x210 +[ 119.301823] rcu_process_callbacks+0x35b/0xbd0 +[ 119.303162] __do_softirq+0x192/0x5ea + +[ 119.305443] The buggy address belongs to the object at ffff880113ada000 + which belongs to the cache filp of size 256 +[ 119.308556] The buggy address is located 0 bytes inside of + 256-byte region [ffff880113ada000, ffff880113ada100) +[ 119.311376] The buggy address belongs to the page: +[ 119.312728] page:ffffea00044eb680 count:1 mapcount:0 mapping:0000000000000000 index:0xffff880113ada780 +[ 119.314428] flags: 0x17ffe000000100(slab) +[ 119.315740] raw: 0017ffe000000100 0000000000000000 ffff880113ada780 00000001000c0001 +[ 119.317379] raw: ffffea0004553c60 ffffea00045c11e0 ffff88011b167e00 0000000000000000 +[ 119.319050] page dumped because: kasan: bad access detected + +[ 119.321652] Memory state around the buggy address: +[ 119.322993] ffff880113ad9f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 119.324515] ffff880113ad9f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 +[ 119.326087] >ffff880113ada000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 119.327547] ^ +[ 119.328730] ffff880113ada080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 119.330218] ffff880113ada100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb +[ 119.331740] ================================================================== + +Signed-off-by: Scott Mayhew +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4xdr.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1585,6 +1585,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_ + gdev->gd_maxcount = be32_to_cpup(p++); + num = be32_to_cpup(p++); + if (num) { ++ if (num > 1000) ++ goto xdr_error; + READ_BUF(4 * num); + gdev->gd_notify_types = be32_to_cpup(p++); + for (i = 1; i < num; i++) { diff --git a/queue-4.17/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch b/queue-4.17/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch new file mode 100644 index 00000000000..d71d73aa55b --- /dev/null +++ b/queue-4.17/nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Trond Myklebust +Date: Sat, 9 Jun 2018 19:10:31 -0400 +Subject: NFSv4.1: Fix the client behaviour on NFS4ERR_SEQ_FALSE_RETRY + +From: Trond Myklebust + +[ Upstream commit f9312a541050007ec59eb0106273a0a10718cd83 ] + +If the server returns NFS4ERR_SEQ_FALSE_RETRY or NFS4ERR_RETRY_UNCACHED_REP, +then it thinks we're trying to replay an existing request. If so, then +let's just bump the sequence ID and retry the operation. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -746,6 +746,13 @@ static int nfs41_sequence_process(struct + slot->slot_nr, + slot->seq_nr); + goto out_retry; ++ case -NFS4ERR_RETRY_UNCACHED_REP: ++ case -NFS4ERR_SEQ_FALSE_RETRY: ++ /* ++ * The server thinks we tried to replay a request. ++ * Retry the call after bumping the sequence ID. ++ */ ++ goto retry_new_seq; + case -NFS4ERR_BADSLOT: + /* + * The slot id we used was probably retired. Try again +@@ -770,10 +777,6 @@ static int nfs41_sequence_process(struct + goto retry_nowait; + } + goto session_recover; +- case -NFS4ERR_SEQ_FALSE_RETRY: +- if (interrupted) +- goto retry_new_seq; +- goto session_recover; + default: + /* Just update the slot sequence no. */ + slot->seq_done = 1; diff --git a/queue-4.17/nvme-lightnvm-add-granby-support.patch b/queue-4.17/nvme-lightnvm-add-granby-support.patch new file mode 100644 index 00000000000..5f1cd8e7a11 --- /dev/null +++ b/queue-4.17/nvme-lightnvm-add-granby-support.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wei Xu +Date: Thu, 26 Apr 2018 14:59:19 -0600 +Subject: nvme: lightnvm: add granby support + +From: Wei Xu + +[ Upstream commit ea48e877994f086af481427bac110aa63686c3ce ] + +Add a new lightnvm quirk to identify CNEX’s Granby controller. + +Signed-off-by: Wei Xu +Reviewed-by: Javier González +Reviewed-by: Matias Bjørling +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2731,6 +2731,8 @@ static const struct pci_device_id nvme_i + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, ++ { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */ ++ .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, diff --git a/queue-4.17/nvme-pci-fix-aer-reset-handling.patch b/queue-4.17/nvme-pci-fix-aer-reset-handling.patch new file mode 100644 index 00000000000..9cd4d4d0730 --- /dev/null +++ b/queue-4.17/nvme-pci-fix-aer-reset-handling.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Keith Busch +Date: Thu, 24 May 2018 16:16:04 -0600 +Subject: nvme-pci: Fix AER reset handling + +From: Keith Busch + +[ Upstream commit 72cd4cc28e234ed7189ee508ed65ab60c80a97c8 ] + +The nvme timeout handling doesn't do anything if the pci channel is +offline, which is the case when recovering from PCI error event, so it +was a bad idea to sync the controller reset in this state. This patch +flushes the reset work in the error_resume callback instead when the +channel is back to online. This keeps AER handling serialized and +can recover from timeouts. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=199757 +Fixes: cc1d5e749a2e ("nvme/pci: Sync controller reset for AER slot_reset") +Reported-by: Alex Gagniuc +Tested-by: Alex Gagniuc +Signed-off-by: Keith Busch +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 14 +++++--------- + 1 file changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2679,19 +2679,15 @@ static pci_ers_result_t nvme_slot_reset( + + dev_info(dev->ctrl.device, "restart after slot reset\n"); + pci_restore_state(pdev); +- nvme_reset_ctrl_sync(&dev->ctrl); +- +- switch (dev->ctrl.state) { +- case NVME_CTRL_LIVE: +- case NVME_CTRL_ADMIN_ONLY: +- return PCI_ERS_RESULT_RECOVERED; +- default: +- return PCI_ERS_RESULT_DISCONNECT; +- } ++ nvme_reset_ctrl(&dev->ctrl); ++ return PCI_ERS_RESULT_RECOVERED; + } + + static void nvme_error_resume(struct pci_dev *pdev) + { ++ struct nvme_dev *dev = pci_get_drvdata(pdev); ++ ++ flush_work(&dev->ctrl.reset_work); + pci_cleanup_aer_uncorrect_error_status(pdev); + } + diff --git a/queue-4.17/nvme-rdma-stop-admin-queue-before-freeing-it.patch b/queue-4.17/nvme-rdma-stop-admin-queue-before-freeing-it.patch new file mode 100644 index 00000000000..6f790e42844 --- /dev/null +++ b/queue-4.17/nvme-rdma-stop-admin-queue-before-freeing-it.patch @@ -0,0 +1,68 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jianchao Wang +Date: Thu, 24 May 2018 09:27:38 +0800 +Subject: nvme-rdma: stop admin queue before freeing it + +From: Jianchao Wang + +[ Upstream commit 2e050f00a0f0e07467050cb4afae0234941e5bf3 ] + +For any failure after nvme_rdma_start_queue in +nvme_rdma_configure_admin_queue, the admin queue will be freed with the +NVME_RDMA_Q_LIVE flag still set. Once nvme_rdma_stop_queue is invoked, +that will cause a use-after-free. +BUG: KASAN: use-after-free in rdma_disconnect+0x1f/0xe0 [rdma_cm] + +To fix it, call nvme_rdma_stop_queue for all the failed cases after +nvme_rdma_start_queue. + +Signed-off-by: Jianchao Wang +Suggested-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -778,7 +778,7 @@ static int nvme_rdma_configure_admin_que + if (error) { + dev_err(ctrl->ctrl.device, + "prop_get NVME_REG_CAP failed\n"); +- goto out_cleanup_queue; ++ goto out_stop_queue; + } + + ctrl->ctrl.sqsize = +@@ -786,23 +786,25 @@ static int nvme_rdma_configure_admin_que + + error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + ctrl->ctrl.max_hw_sectors = + (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9); + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev, + &ctrl->async_event_sqe, sizeof(struct nvme_command), + DMA_TO_DEVICE); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + return 0; + ++out_stop_queue: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->ctrl.admin_q); diff --git a/queue-4.17/nvmem-properly-handle-returned-value-nvmem_reg_read.patch b/queue-4.17/nvmem-properly-handle-returned-value-nvmem_reg_read.patch new file mode 100644 index 00000000000..9fa7d1b77a0 --- /dev/null +++ b/queue-4.17/nvmem-properly-handle-returned-value-nvmem_reg_read.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Fri, 11 May 2018 12:07:03 +0100 +Subject: nvmem: properly handle returned value nvmem_reg_read + +From: Mathieu Malaterre + +[ Upstream commit 50808bfcc14b854775a9f1d0abe3dac2babcf5c3 ] + +Function nvmem_reg_read can return a non zero value indicating an error. +This returned value must be read and error propagated to +nvmem_cell_prepare_write_buffer. Silence the following gcc warning (W=1): + +drivers/nvmem/core.c:1093:9: warning: variable 'rc' set but + not used [-Wunused-but-set-variable] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Srinivas Kandagatla +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvmem/core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -1107,6 +1107,8 @@ static void *nvmem_cell_prepare_write_bu + + /* setup the first byte with lsb bits from nvmem */ + rc = nvmem_reg_read(nvmem, cell->offset, &v, 1); ++ if (rc) ++ goto err; + *b++ |= GENMASK(bit_offset - 1, 0) & v; + + /* setup rest of the byte if any */ +@@ -1125,11 +1127,16 @@ static void *nvmem_cell_prepare_write_bu + /* setup the last byte with msb bits from nvmem */ + rc = nvmem_reg_read(nvmem, + cell->offset + cell->bytes - 1, &v, 1); ++ if (rc) ++ goto err; + *p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v; + + } + + return buf; ++err: ++ kfree(buf); ++ return ERR_PTR(rc); + } + + /** diff --git a/queue-4.17/pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch b/queue-4.17/pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch new file mode 100644 index 00000000000..c7f6ba7e837 --- /dev/null +++ b/queue-4.17/pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch @@ -0,0 +1,45 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Bjorn Helgaas +Date: Tue, 17 Apr 2018 11:25:51 -0500 +Subject: PCI/ASPM: Disable ASPM L1.2 Substate if we don't have LTR + +From: Bjorn Helgaas + +[ Upstream commit 9ab105deb60fa76d66cae5548819b4e8703d2056 ] + +When in the ASPM L1.0 state (but not the PCI-PM L1.0 state), the most +recent LTR value and the LTR_L1.2_THRESHOLD determines whether the link +enters the L1.2 substate. + +If we don't have LTR enabled, prevent the use of ASPM L1.2. + +PCI-PM L1.2 may still be used because it doesn't depend on +LTR_L1.2_THRESHOLD (see PCIe r4.0, sec 5.5.1). + +Tested-by: Srinath Mannam +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pcie/aspm.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -400,6 +400,15 @@ static void pcie_get_aspm_reg(struct pci + info->l1ss_cap = 0; + return; + } ++ ++ /* ++ * If we don't have LTR for the entire path from the Root Complex ++ * to this device, we can't use ASPM L1.2 because it relies on the ++ * LTR_L1.2_THRESHOLD. See PCIe r4.0, secs 5.5.4, 6.18. ++ */ ++ if (!pdev->ltr_path) ++ info->l1ss_cap &= ~PCI_L1SS_CAP_ASPM_L1_2; ++ + pci_read_config_dword(pdev, info->l1ss_cap_ptr + PCI_L1SS_CTL1, + &info->l1ss_ctl1); + pci_read_config_dword(pdev, info->l1ss_cap_ptr + PCI_L1SS_CTL2, diff --git a/queue-4.17/pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch b/queue-4.17/pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch new file mode 100644 index 00000000000..4c67becddae --- /dev/null +++ b/queue-4.17/pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch @@ -0,0 +1,56 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Oza Pawandeep +Date: Wed, 16 May 2018 15:59:35 -0500 +Subject: PCI/DPC: Clear interrupt status in interrupt handler top half + +From: Oza Pawandeep + +[ Upstream commit 56abbf8ad73c89d0a4c3c84b1449ceaaabd1b8c7 ] + +The generic IRQ handling code ensures that an interrupt handler runs with +its interrupt masked or disabled. If the interrupt is level-triggered, the +interrupt handler must tell its device to stop asserting the interrupt +before returning. If it doesn't, we will immediately take the interrupt +again when the handler returns and the generic code unmasks the interrupt. + +The driver doesn't know whether its interrupt is edge- or level-triggered, +so it must clear its interrupt source directly in its interrupt handler. + +Previously we cleared the DPC interrupt status in the bottom half, i.e., in +deferred work, which can cause an interrupt storm if the DPC interrupt +happens to be level-triggered, e.g., if we're using INTx instead of MSI. + +Clear the DPC interrupt status bit in the interrupt handler, not in the +deferred work. + +Signed-off-by: Oza Pawandeep +[bhelgaas: changelog] +Signed-off-by: Bjorn Helgaas +Reviewed-by: Keith Busch +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pcie/dpc.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/pci/pcie/dpc.c ++++ b/drivers/pci/pcie/dpc.c +@@ -113,7 +113,7 @@ static void dpc_work(struct work_struct + } + + pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS, +- PCI_EXP_DPC_STATUS_TRIGGER | PCI_EXP_DPC_STATUS_INTERRUPT); ++ PCI_EXP_DPC_STATUS_TRIGGER); + + pci_read_config_word(pdev, cap + PCI_EXP_DPC_CTL, &ctl); + pci_write_config_word(pdev, cap + PCI_EXP_DPC_CTL, +@@ -223,6 +223,9 @@ static irqreturn_t dpc_irq(int irq, void + if (dpc->rp_extensions && reason == 3 && ext_reason == 0) + dpc_process_rp_pio_error(dpc); + ++ pci_write_config_word(pdev, cap + PCI_EXP_DPC_STATUS, ++ PCI_EXP_DPC_STATUS_INTERRUPT); ++ + schedule_work(&dpc->work); + + return IRQ_HANDLED; diff --git a/queue-4.17/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch b/queue-4.17/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch new file mode 100644 index 00000000000..1ba34485c05 --- /dev/null +++ b/queue-4.17/pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jan Kiszka +Date: Tue, 15 May 2018 11:07:01 +0200 +Subject: PCI: Fix devm_pci_alloc_host_bridge() memory leak + +From: Jan Kiszka + +[ Upstream commit 3bbce531788719749520f28052cabdef16af6b16 ] + +Fix a memory leak by freeing the PCI resource list in +devm_pci_release_host_bridge_dev(). + +Fixes: 5c3f18cce083 ("PCI: Add devm_pci_alloc_host_bridge() interface") +Signed-off-by: Jan Kiszka +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/probe.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -526,12 +526,14 @@ static void devm_pci_release_host_bridge + + if (bridge->release_fn) + bridge->release_fn(bridge); ++ ++ pci_free_resource_list(&bridge->windows); + } + + static void pci_release_host_bridge_dev(struct device *dev) + { + devm_pci_release_host_bridge_dev(dev); +- pci_free_host_bridge(to_pci_host_bridge(dev)); ++ kfree(to_pci_host_bridge(dev)); + } + + struct pci_host_bridge *pci_alloc_host_bridge(size_t priv) diff --git a/queue-4.17/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch b/queue-4.17/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch new file mode 100644 index 00000000000..1aaa7912a62 --- /dev/null +++ b/queue-4.17/pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mika Westerberg +Date: Wed, 23 May 2018 17:19:22 -0500 +Subject: PCI: pciehp: Request control of native hotplug only if supported + +From: Mika Westerberg + +[ Upstream commit 408fec36a1ab3d14273c2116b449ef1e9be3cb8b ] + +Currently we request control of native PCIe hotplug unconditionally. +Native PCIe hotplug events are handled by the pciehp driver, and if it is +not enabled those events will be lost. + +Request control of native PCIe hotplug only if the pciehp driver is +enabled, so we will actually handle native PCIe hotplug events. + +Suggested-by: Bjorn Helgaas +Signed-off-by: Mika Westerberg +Signed-off-by: Bjorn Helgaas +Reviewed-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/pci_root.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -472,9 +472,11 @@ static void negotiate_os_control(struct + } + + control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL +- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL + | OSC_PCI_EXPRESS_PME_CONTROL; + ++ if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) ++ control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL; ++ + if (pci_aer_available()) { + if (aer_acpi_firmware_first()) + dev_info(&device->dev, diff --git a/queue-4.17/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch b/queue-4.17/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch new file mode 100644 index 00000000000..3a8c7ae8dbe --- /dev/null +++ b/queue-4.17/pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Christoph Hellwig +Date: Fri, 18 May 2018 18:56:24 +0200 +Subject: PCI: Prevent sysfs disable of device while driver is attached + +From: Christoph Hellwig + +[ Upstream commit 6f5cdfa802733dcb561bf664cc89d203f2fd958f ] + +Manipulating the enable_cnt behind the back of the driver will wreak +complete havoc with the kernel state, so disallow it. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Bjorn Helgaas +Reviewed-by: Johannes Thumshirn +Acked-by: Keith Busch +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/pci-sysfs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -288,13 +288,16 @@ static ssize_t enable_store(struct devic + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- if (!val) { +- if (pci_is_enabled(pdev)) +- pci_disable_device(pdev); +- else +- result = -EIO; +- } else ++ device_lock(dev); ++ if (dev->driver) ++ result = -EBUSY; ++ else if (val) + result = pci_enable_device(pdev); ++ else if (pci_is_enabled(pdev)) ++ pci_disable_device(pdev); ++ else ++ result = -EIO; ++ device_unlock(dev); + + return result < 0 ? result : count; + } diff --git a/queue-4.17/perf-fix-invalid-bit-in-diagnostic-entry.patch b/queue-4.17/perf-fix-invalid-bit-in-diagnostic-entry.patch new file mode 100644 index 00000000000..cf5893f5d94 --- /dev/null +++ b/queue-4.17/perf-fix-invalid-bit-in-diagnostic-entry.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thomas Richter +Date: Tue, 8 May 2018 07:53:39 +0200 +Subject: perf: fix invalid bit in diagnostic entry + +From: Thomas Richter + +[ Upstream commit 3c0a83b14ea71fef5ccc93a3bd2de5f892be3194 ] + +The s390 CPU measurement facility sampling mode supports basic entries +and diagnostic entries. Each entry has a valid bit to indicate the +status of the entry as valid or invalid. + +This bit is bit 31 in the diagnostic entry, but the bit mask definition +refers to bit 30. + +Fix this by making the reserved field one bit larger. + +Fixes: 7e75fc3ff4cf ("s390/cpum_sf: Add raw data sampling to support the diagnostic-sampling function") +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/cpu_mf.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/s390/include/asm/cpu_mf.h ++++ b/arch/s390/include/asm/cpu_mf.h +@@ -113,7 +113,7 @@ struct hws_basic_entry { + + struct hws_diag_entry { + unsigned int def:16; /* 0-15 Data Entry Format */ +- unsigned int R:14; /* 16-19 and 20-30 reserved */ ++ unsigned int R:15; /* 16-19 and 20-30 reserved */ + unsigned int I:1; /* 31 entry valid or invalid */ + u8 data[]; /* Machine-dependent sample data */ + } __packed; diff --git a/queue-4.17/perf-tools-fix-pmu-events-parsing-rule.patch b/queue-4.17/perf-tools-fix-pmu-events-parsing-rule.patch new file mode 100644 index 00000000000..c79a7005f73 --- /dev/null +++ b/queue-4.17/perf-tools-fix-pmu-events-parsing-rule.patch @@ -0,0 +1,82 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jiri Olsa +Date: Tue, 5 Jun 2018 14:14:16 +0200 +Subject: perf tools: Fix pmu events parsing rule + +From: Jiri Olsa + +[ Upstream commit ceac7b79df7bd67ef9aaf464b0179a2686aff4ee ] + +Currently all the event parsing fails end up +in the event_pmu rule, and display misleading +help like: + + $ perf stat -e inst kill + event syntax error: 'inst' + \___ Cannot find PMU `inst'. Missing kernel support? + ... + +The reason is that the event_pmu is too strong +and match also single string. Changing it to +force the '/' separators to be part of the rule, +and getting the proper error now: + + $ perf stat -e inst kill + event syntax error: 'inst' + \___ parser error + Run 'perf list' for a list of valid events + ... + +Suggested-by: Adrian Hunter +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: David Ahern +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/20180605121416.31645-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/parse-events.y | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -73,6 +73,7 @@ static void inc_group_count(struct list_ + %type value_sym + %type event_config + %type opt_event_config ++%type opt_pmu_config + %type event_term + %type event_pmu + %type event_legacy_symbol +@@ -224,7 +225,7 @@ event_def: event_pmu | + event_bpf_file + + event_pmu: +-PE_NAME opt_event_config ++PE_NAME opt_pmu_config + { + struct list_head *list, *orig_terms, *terms; + +@@ -495,6 +496,17 @@ opt_event_config: + { + $$ = NULL; + } ++ ++opt_pmu_config: ++'/' event_config '/' ++{ ++ $$ = $2; ++} ++| ++'/' '/' ++{ ++ $$ = NULL; ++} + + start_terms: event_config + { diff --git a/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch b/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch new file mode 100644 index 00000000000..24dad2529cf --- /dev/null +++ b/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kan Liang +Date: Thu, 3 May 2018 11:25:07 -0700 +Subject: perf/x86/intel/uncore: Correct fixed counter index check for NHM + +From: Kan Liang + +[ Upstream commit d71f11c076c420c4e2fceb4faefa144e055e0935 ] + +For Nehalem and Westmere, there is only one fixed counter for W-Box. +There is no index which is bigger than UNCORE_PMC_IDX_FIXED. +It is not correct to use >= to check fixed counter. +The code quality issue will bring problem when new counter index is +introduced. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: acme@kernel.org +Cc: eranian@google.com +Link: http://lkml.kernel.org/r/1525371913-10597-2-git-send-email-kan.liang@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore_nhmex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/uncore_nhmex.c ++++ b/arch/x86/events/intel/uncore_nhmex.c +@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_even + { + struct hw_perf_event *hwc = &event->hw; + +- if (hwc->idx >= UNCORE_PMC_IDX_FIXED) ++ if (hwc->idx == UNCORE_PMC_IDX_FIXED) + wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0); + else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0) + wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22); diff --git a/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch b/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch new file mode 100644 index 00000000000..ad48a5a4c59 --- /dev/null +++ b/queue-4.17/perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Kan Liang +Date: Thu, 3 May 2018 11:25:08 -0700 +Subject: perf/x86/intel/uncore: Correct fixed counter index check in generic code + +From: Kan Liang + +[ Upstream commit 4749f8196452eeb73cf2086a6a9705bae479d33d ] + +There is no index which is bigger than UNCORE_PMC_IDX_FIXED. The only +exception is client IMC uncore, which has been specially handled. +For generic code, it is not correct to use >= to check fixed counter. +The code quality issue will bring problem when a new counter index is +introduced. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Thomas Gleixner +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: acme@kernel.org +Cc: eranian@google.com +Link: http://lkml.kernel.org/r/1525371913-10597-3-git-send-email-kan.liang@intel.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct int + u64 prev_count, new_count, delta; + int shift; + +- if (event->hw.idx >= UNCORE_PMC_IDX_FIXED) ++ if (event->hw.idx == UNCORE_PMC_IDX_FIXED) + shift = 64 - uncore_fixed_ctr_bits(box); + else + shift = 64 - uncore_perf_ctr_bits(box); diff --git a/queue-4.17/pinctrl-at91-pio4-add-missing-of_node_put.patch b/queue-4.17/pinctrl-at91-pio4-add-missing-of_node_put.patch new file mode 100644 index 00000000000..359b2e8afc4 --- /dev/null +++ b/queue-4.17/pinctrl-at91-pio4-add-missing-of_node_put.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Julia Lawall +Date: Wed, 23 May 2018 21:07:12 +0200 +Subject: pinctrl: at91-pio4: add missing of_node_put + +From: Julia Lawall + +[ Upstream commit 21816364715f508c10da1e087e352bc1e326614f ] + +The device node iterators perform an of_node_get on each iteration, so a +jump out of the loop requires an of_node_put. + +The semantic patch that fixes this problem is as follows +(http://coccinelle.lip6.fr): + +// +@@ +expression root,e; +local idexpression child; +iterator name for_each_child_of_node; +@@ + + for_each_child_of_node(root, child) { + ... when != of_node_put(child) + when != e = child ++ of_node_put(child); +? break; + ... +} +... when != child +// + +Signed-off-by: Julia Lawall +Acked-by: Ludovic Desroches +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-at91-pio4.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(str + for_each_child_of_node(np_config, np) { + ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map, + &reserved_maps, num_maps); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(np); + break; ++ } + } + } + diff --git a/queue-4.17/pinctrl-msm-fix-gpio-hog-related-boot-issues.patch b/queue-4.17/pinctrl-msm-fix-gpio-hog-related-boot-issues.patch new file mode 100644 index 00000000000..2c63b568f56 --- /dev/null +++ b/queue-4.17/pinctrl-msm-fix-gpio-hog-related-boot-issues.patch @@ -0,0 +1,100 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Christian Lamparter +Date: Mon, 21 May 2018 22:57:37 +0200 +Subject: pinctrl: msm: fix gpio-hog related boot issues + +From: Christian Lamparter + +[ Upstream commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 ] + +Sven Eckelmann reported an issue with the current IPQ4019 pinctrl. +Setting up any gpio-hog in the device-tree for his device would +"kill the bootup completely": + +| [ 0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe +| [ 0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe +| [ 1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517 +| [ 1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register +| [ 1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip +| [ 1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe +| [ 1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri + +This was also verified on a RT-AC58U (IPQ4018) which would +no longer boot, if a gpio-hog was specified. (Tried forcing +the USB LED PIN (GPIO0) to high.). + +The problem is that Pinctrl+GPIO registration is currently +peformed in the following order in pinctrl-msm.c: + 1. pinctrl_register() + 2. gpiochip_add() + 3. gpiochip_add_pin_range() + +The actual error code -517 == -EPROBE_DEFER is coming from +pinctrl_get_device_gpio_range(), which is called through: + gpiochip_add + of_gpiochip_add + of_gpiochip_scan_gpios + gpiod_hog + gpiochip_request_own_desc + __gpiod_request + chip->request + gpiochip_generic_request + pinctrl_gpio_request + pinctrl_get_device_gpio_range + +pinctrl_get_device_gpio_range() is unable to find any valid +pin ranges, since nothing has been added to the pinctrldev_list yet. +so the range can't be found, and the operation fails with -EPROBE_DEFER. + +This patch fixes the issue by adding the "gpio-ranges" property to +the pinctrl device node of all upstream Qcom SoC. The pin ranges are +then added by the gpio core. + +In order to remain compatible with older, existing DTs (and ACPI) +a check for the "gpio-ranges" property has been added to +msm_gpio_init(). This prevents the driver of adding the same entry +to the pinctrldev_list twice. + +Reported-by: Sven Eckelmann +Tested-by: Sven Eckelmann [ipq4019] +Reviewed-by: Bjorn Andersson +Signed-off-by: Christian Lamparter +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 23 ++++++++++++++++++----- + 1 file changed, 18 insertions(+), 5 deletions(-) + +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -890,11 +890,24 @@ static int msm_gpio_init(struct msm_pinc + return ret; + } + +- ret = gpiochip_add_pin_range(&pctrl->chip, dev_name(pctrl->dev), 0, 0, chip->ngpio); +- if (ret) { +- dev_err(pctrl->dev, "Failed to add pin range\n"); +- gpiochip_remove(&pctrl->chip); +- return ret; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(pctrl->dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&pctrl->chip, ++ dev_name(pctrl->dev), 0, 0, chip->ngpio); ++ if (ret) { ++ dev_err(pctrl->dev, "Failed to add pin range\n"); ++ gpiochip_remove(&pctrl->chip); ++ return ret; ++ } + } + + ret = gpiochip_irqchip_add(chip, diff --git a/queue-4.17/platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch b/queue-4.17/platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch new file mode 100644 index 00000000000..5f4c88b2eaa --- /dev/null +++ b/queue-4.17/platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mario Limonciello +Date: Tue, 17 Apr 2018 14:45:56 -0500 +Subject: platform/x86: dell-smbios: Match on www.dell.com in OEM strings too + +From: Mario Limonciello + +[ Upstream commit b004b21cc664ca00782508514dade43e29eebf94 ] + +Sergey reported that some much older Dell systems don't support +the OEM string "Dell System" but instead supported www.dell.com +in OEM strings. + +Match both of these to indicate that this driver is running on +a Dell system. + +Reported-by: Sergey Kubushyn +Tested-by: Sergey Kubushyn +Signed-off-by: Mario Limonciello +[dvhart: Simplify DMI logic and eliminate unnecessary variables] +Signed-off-by: Darren Hart (VMware) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/dell-smbios-base.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/platform/x86/dell-smbios-base.c ++++ b/drivers/platform/x86/dell-smbios-base.c +@@ -555,11 +555,10 @@ static void free_group(struct platform_d + + static int __init dell_smbios_init(void) + { +- const struct dmi_device *valid; + int ret, wmi, smm; + +- valid = dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL); +- if (!valid) { ++ if (!dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "Dell System", NULL) && ++ !dmi_find_device(DMI_DEV_TYPE_OEM_STRING, "www.dell.com", NULL)) { + pr_err("Unable to run on non-Dell system\n"); + return -ENODEV; + } diff --git a/queue-4.17/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch b/queue-4.17/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch new file mode 100644 index 00000000000..0b174251df0 --- /dev/null +++ b/queue-4.17/pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sebastian Andrzej Siewior +Date: Fri, 25 May 2018 11:46:48 +0200 +Subject: PM / wakeup: Make s2idle_lock a RAW_SPINLOCK + +From: Sebastian Andrzej Siewior + +[ Upstream commit 62fc00a6611a0014c85763f9def1fc07c15d1302 ] + +The `s2idle_lock' is acquired during suspend while interrupts are +disabled even on RT. The lock is acquired for short sections only. +Make it a RAW lock which avoids "sleeping while atomic" warnings on RT. + +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/power/suspend.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops + static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head); + + enum s2idle_states __read_mostly s2idle_state; +-static DEFINE_SPINLOCK(s2idle_lock); ++static DEFINE_RAW_SPINLOCK(s2idle_lock); + + void s2idle_set_ops(const struct platform_s2idle_ops *ops) + { +@@ -78,12 +78,12 @@ static void s2idle_enter(void) + { + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + if (pm_wakeup_pending()) + goto out; + + s2idle_state = S2IDLE_STATE_ENTER; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + get_online_cpus(); + cpuidle_resume(); +@@ -97,11 +97,11 @@ static void s2idle_enter(void) + cpuidle_pause(); + put_online_cpus(); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + + out: + s2idle_state = S2IDLE_STATE_NONE; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false); + } +@@ -156,12 +156,12 @@ void s2idle_wake(void) + { + unsigned long flags; + +- spin_lock_irqsave(&s2idle_lock, flags); ++ raw_spin_lock_irqsave(&s2idle_lock, flags); + if (s2idle_state > S2IDLE_STATE_NONE) { + s2idle_state = S2IDLE_STATE_WAKE; + wake_up(&s2idle_wait_head); + } +- spin_unlock_irqrestore(&s2idle_lock, flags); ++ raw_spin_unlock_irqrestore(&s2idle_lock, flags); + } + EXPORT_SYMBOL_GPL(s2idle_wake); + diff --git a/queue-4.17/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch b/queue-4.17/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch new file mode 100644 index 00000000000..33d9609dd40 --- /dev/null +++ b/queue-4.17/pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Trond Myklebust +Date: Tue, 22 May 2018 11:17:16 -0400 +Subject: pnfs: Don't release the sequence slot until we've processed layoutget on open + +From: Trond Myklebust + +[ Upstream commit ae55e59da0e401893b3c52b575fc18a00623d0a1 ] + +If the server recalls the layout that was just handed out, we risk hitting +a race as described in RFC5661 Section 2.10.6.3 unless we ensure that we +release the sequence slot after processing the LAYOUTGET operation that +was sent as part of the OPEN compound. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/nfs4proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2807,7 +2807,7 @@ static int _nfs4_open_and_get_state(stru + if (ret != 0) + goto out; + +- state = nfs4_opendata_to_nfs4_state(opendata); ++ state = _nfs4_opendata_to_nfs4_state(opendata); + ret = PTR_ERR(state); + if (IS_ERR(state)) + goto out; +@@ -2843,6 +2843,7 @@ static int _nfs4_open_and_get_state(stru + nfs4_schedule_stateid_recovery(server, state); + } + out: ++ nfs4_sequence_free_slot(&opendata->o_res.seq_res); + return ret; + } + diff --git a/queue-4.17/powerpc-32-add-a-missing-include-header.patch b/queue-4.17/powerpc-32-add-a-missing-include-header.patch new file mode 100644 index 00000000000..f0608af26f3 --- /dev/null +++ b/queue-4.17/powerpc-32-add-a-missing-include-header.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 22 Mar 2018 21:20:03 +0100 +Subject: powerpc/32: Add a missing include header + +From: Mathieu Malaterre + +[ Upstream commit c89ca593220931c150cffda24b4d4ccf82f13fc8 ] + +The header file was missing from the includes. Fix the +following warning, treated as error with W=1: + + arch/powerpc/kernel/pci_32.c:286:6: error: no previous prototype for ‘sys_pciconfig_iobase’ [-Werror=missing-prototypes] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/pci_32.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/pci_32.c ++++ b/arch/powerpc/kernel/pci_32.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-4.17/powerpc-64s-add-barrier_nospec.patch b/queue-4.17/powerpc-64s-add-barrier_nospec.patch new file mode 100644 index 00000000000..ba62d95c076 --- /dev/null +++ b/queue-4.17/powerpc-64s-add-barrier_nospec.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Michal Suchanek +Date: Tue, 24 Apr 2018 14:15:54 +1000 +Subject: powerpc/64s: Add barrier_nospec + +From: Michal Suchanek + +[ Upstream commit a6b3964ad71a61bb7c61d80a60bea7d42187b2eb ] + +A no-op form of ori (or immediate of 0 into r31 and the result stored +in r31) has been re-tasked as a speculation barrier. The instruction +only acts as a barrier on newer machines with appropriate firmware +support. On older CPUs it remains a harmless no-op. + +Implement barrier_nospec using this instruction. + +mpe: The semantics of the instruction are believed to be that it +prevents execution of subsequent instructions until preceding branches +have been fully resolved and are no longer executing speculatively. +There is no further documentation available at this time. + +Signed-off-by: Michal Suchanek +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/barrier.h | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -76,6 +76,21 @@ do { \ + ___p1; \ + }) + ++#ifdef CONFIG_PPC_BOOK3S_64 ++/* ++ * Prevent execution of subsequent instructions until preceding branches have ++ * been fully resolved and are no longer executing speculatively. ++ */ ++#define barrier_nospec_asm ori 31,31,0 ++ ++// This also acts as a compiler barrier due to the memory clobber. ++#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory") ++ ++#else /* !CONFIG_PPC_BOOK3S_64 */ ++#define barrier_nospec_asm ++#define barrier_nospec() ++#endif ++ + #include + + #endif /* _ASM_POWERPC_BARRIER_H */ diff --git a/queue-4.17/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch b/queue-4.17/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch new file mode 100644 index 00000000000..12136fde8b0 --- /dev/null +++ b/queue-4.17/powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Nicholas Piggin +Date: Wed, 30 May 2018 20:31:22 +1000 +Subject: powerpc/64s: Fix compiler store ordering to SLB shadow area + +From: Nicholas Piggin + +[ Upstream commit 926bc2f100c24d4842b3064b5af44ae964c1d81c ] + +The stores to update the SLB shadow area must be made as they appear +in the C code, so that the hypervisor does not see an entry with +mismatched vsid and esid. Use WRITE_ONCE for this. + +GCC has been observed to elide the first store to esid in the update, +which means that if the hypervisor interrupts the guest after storing +to vsid, it could see an entry with old esid and new vsid, which may +possibly result in memory corruption. + +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/slb.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -63,14 +63,14 @@ static inline void slb_shadow_update(uns + * updating it. No write barriers are needed here, provided + * we only update the current CPU's SLB shadow buffer. + */ +- p->save_area[index].esid = 0; +- p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags)); +- p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index)); ++ WRITE_ONCE(p->save_area[index].esid, 0); ++ WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags))); ++ WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index))); + } + + static inline void slb_shadow_clear(enum slb_index index) + { +- get_slb_shadow()->save_area[index].esid = 0; ++ WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0); + } + + static inline void create_shadowed_slbe(unsigned long ea, int ssize, diff --git a/queue-4.17/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch b/queue-4.17/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch new file mode 100644 index 00000000000..a46784ba1ac --- /dev/null +++ b/queue-4.17/powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Christophe Leroy +Date: Thu, 24 May 2018 11:02:06 +0000 +Subject: powerpc/8xx: fix invalid register expression in head_8xx.S + +From: Christophe Leroy + +[ Upstream commit e4ccb1dae6bdef228d729c076c38161ef6e7ca34 ] + +New binutils generate the following warning + + AS arch/powerpc/kernel/head_8xx.o +arch/powerpc/kernel/head_8xx.S: Assembler messages: +arch/powerpc/kernel/head_8xx.S:916: Warning: invalid register expression + +This patch fixes it. + +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/head_8xx.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -913,7 +913,7 @@ start_here: + tovirt(r6,r6) + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l +- stw r5, 0xf0(r0) /* Must match your Abatron config file */ ++ stw r5, 0xf0(0) /* Must match your Abatron config file */ + tophys(r5,r5) + stw r6, 0(r5) + diff --git a/queue-4.17/powerpc-add-__printf-verification-to-prom_printf.patch b/queue-4.17/powerpc-add-__printf-verification-to-prom_printf.patch new file mode 100644 index 00000000000..6df130c1729 --- /dev/null +++ b/queue-4.17/powerpc-add-__printf-verification-to-prom_printf.patch @@ -0,0 +1,369 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Fri, 6 Apr 2018 22:12:19 +0200 +Subject: powerpc: Add __printf verification to prom_printf + +From: Mathieu Malaterre + +[ Upstream commit eae5f709a4d738c52b6ab636981755d76349ea9e ] + +__printf is useful to verify format and arguments. Fix arg mismatch +reported by gcc, remove the following warnings (with W=1): + + arch/powerpc/kernel/prom_init.c:1467:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1471:31: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1504:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1505:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1506:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1507:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1508:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1509:33: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:1975:39: error: format ‘%lu’ expects argument of type ‘long unsigned int’, but argument 2 has type ‘unsigned int’ + arch/powerpc/kernel/prom_init.c:1986:27: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2567:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2567:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2569:38: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 2 has type ‘long unsigned int’ + arch/powerpc/kernel/prom_init.c:2569:46: error: format ‘%x’ expects argument of type ‘unsigned int’, but argument 3 has type ‘long unsigned int’ + +The patch also include arg mismatch fix for case with #define DEBUG_PROM +(warning not listed here). + +This patch fix also the following warnings revealed by checkpatch: + + WARNING: Prefer using '"%s...", __func__' to using 'alloc_up', this function's name, in a string + #101: FILE: arch/powerpc/kernel/prom_init.c:1235: + + prom_debug("alloc_up(%lx, %lx)\n", size, align); + +and + + WARNING: Prefer using '"%s...", __func__' to using 'alloc_down', this function's name, in a string + #138: FILE: arch/powerpc/kernel/prom_init.c:1278: + + prom_debug("alloc_down(%lx, %lx, %s)\n", size, align, + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/prom_init.c | 114 ++++++++++++++++++++-------------------- + 1 file changed, 58 insertions(+), 56 deletions(-) + +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -334,6 +334,7 @@ static void __init prom_print_dec(unsign + call_prom("write", 3, 1, prom.stdout, buf+i, size); + } + ++__printf(1, 2) + static void __init prom_printf(const char *format, ...) + { + const char *p, *q, *s; +@@ -1160,7 +1161,7 @@ static void __init prom_send_capabilitie + */ + + cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads()); +- prom_printf("Max number of cores passed to firmware: %lu (NR_CPUS = %lu)\n", ++ prom_printf("Max number of cores passed to firmware: %u (NR_CPUS = %d)\n", + cores, NR_CPUS); + + ibm_architecture_vec.vec5.max_cpus = cpu_to_be32(cores); +@@ -1242,7 +1243,7 @@ static unsigned long __init alloc_up(uns + + if (align) + base = _ALIGN_UP(base, align); +- prom_debug("alloc_up(%x, %x)\n", size, align); ++ prom_debug("%s(%lx, %lx)\n", __func__, size, align); + if (ram_top == 0) + prom_panic("alloc_up() called with mem not initialized\n"); + +@@ -1253,7 +1254,7 @@ static unsigned long __init alloc_up(uns + + for(; (base + size) <= alloc_top; + base = _ALIGN_UP(base + 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1265,12 +1266,12 @@ static unsigned long __init alloc_up(uns + return 0; + alloc_bottom = addr + size; + +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1285,7 +1286,7 @@ static unsigned long __init alloc_down(u + { + unsigned long base, addr = 0; + +- prom_debug("alloc_down(%x, %x, %s)\n", size, align, ++ prom_debug("%s(%lx, %lx, %s)\n", __func__, size, align, + highmem ? "(high)" : "(low)"); + if (ram_top == 0) + prom_panic("alloc_down() called with mem not initialized\n"); +@@ -1313,7 +1314,7 @@ static unsigned long __init alloc_down(u + base = _ALIGN_DOWN(alloc_top - size, align); + for (; base > alloc_bottom; + base = _ALIGN_DOWN(base - 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1324,12 +1325,12 @@ static unsigned long __init alloc_down(u + alloc_top = addr; + + bail: +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1455,7 +1456,7 @@ static void __init prom_init_mem(void) + + if (size == 0) + continue; +- prom_debug(" %x %x\n", base, size); ++ prom_debug(" %lx %lx\n", base, size); + if (base == 0 && (of_platform & PLATFORM_LPAR)) + rmo_top = size; + if ((base + size) > ram_top) +@@ -1475,12 +1476,12 @@ static void __init prom_init_mem(void) + + if (prom_memory_limit) { + if (prom_memory_limit <= alloc_bottom) { +- prom_printf("Ignoring mem=%x <= alloc_bottom.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx <= alloc_bottom.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else if (prom_memory_limit >= ram_top) { +- prom_printf("Ignoring mem=%x >= ram_top.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx >= ram_top.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else { + ram_top = prom_memory_limit; +@@ -1512,12 +1513,13 @@ static void __init prom_init_mem(void) + alloc_bottom = PAGE_ALIGN(prom_initrd_end); + + prom_printf("memory layout at init:\n"); +- prom_printf(" memory_limit : %x (16 MB aligned)\n", prom_memory_limit); +- prom_printf(" alloc_bottom : %x\n", alloc_bottom); +- prom_printf(" alloc_top : %x\n", alloc_top); +- prom_printf(" alloc_top_hi : %x\n", alloc_top_high); +- prom_printf(" rmo_top : %x\n", rmo_top); +- prom_printf(" ram_top : %x\n", ram_top); ++ prom_printf(" memory_limit : %lx (16 MB aligned)\n", ++ prom_memory_limit); ++ prom_printf(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_printf(" alloc_top : %lx\n", alloc_top); ++ prom_printf(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_printf(" rmo_top : %lx\n", rmo_top); ++ prom_printf(" ram_top : %lx\n", ram_top); + } + + static void __init prom_close_stdin(void) +@@ -1578,7 +1580,7 @@ static void __init prom_instantiate_opal + return; + } + +- prom_printf("instantiating opal at 0x%x...", base); ++ prom_printf("instantiating opal at 0x%llx...", base); + + if (call_prom_ret("call-method", 4, 3, rets, + ADDR("load-opal-runtime"), +@@ -1594,10 +1596,10 @@ static void __init prom_instantiate_opal + + reserve_mem(base, size); + +- prom_debug("opal base = 0x%x\n", base); +- prom_debug("opal align = 0x%x\n", align); +- prom_debug("opal entry = 0x%x\n", entry); +- prom_debug("opal size = 0x%x\n", (long)size); ++ prom_debug("opal base = 0x%llx\n", base); ++ prom_debug("opal align = 0x%llx\n", align); ++ prom_debug("opal entry = 0x%llx\n", entry); ++ prom_debug("opal size = 0x%llx\n", size); + + prom_setprop(opal_node, "/ibm,opal", "opal-base-address", + &base, sizeof(base)); +@@ -1674,7 +1676,7 @@ static void __init prom_instantiate_rtas + + prom_debug("rtas base = 0x%x\n", base); + prom_debug("rtas entry = 0x%x\n", entry); +- prom_debug("rtas size = 0x%x\n", (long)size); ++ prom_debug("rtas size = 0x%x\n", size); + + prom_debug("prom_instantiate_rtas: end...\n"); + } +@@ -1732,7 +1734,7 @@ static void __init prom_instantiate_sml( + if (base == 0) + prom_panic("Could not allocate memory for sml\n"); + +- prom_printf("instantiating sml at 0x%x...", base); ++ prom_printf("instantiating sml at 0x%llx...", base); + + memset((void *)base, 0, size); + +@@ -1751,8 +1753,8 @@ static void __init prom_instantiate_sml( + prom_setprop(ibmvtpm_node, "/vdevice/vtpm", "linux,sml-size", + &size, sizeof(size)); + +- prom_debug("sml base = 0x%x\n", base); +- prom_debug("sml size = 0x%x\n", (long)size); ++ prom_debug("sml base = 0x%llx\n", base); ++ prom_debug("sml size = 0x%x\n", size); + + prom_debug("prom_instantiate_sml: end...\n"); + } +@@ -1845,7 +1847,7 @@ static void __init prom_initialize_tce_t + + prom_debug("TCE table: %s\n", path); + prom_debug("\tnode = 0x%x\n", node); +- prom_debug("\tbase = 0x%x\n", base); ++ prom_debug("\tbase = 0x%llx\n", base); + prom_debug("\tsize = 0x%x\n", minsize); + + /* Initialize the table to have a one-to-one mapping +@@ -1932,12 +1934,12 @@ static void __init prom_hold_cpus(void) + } + + prom_debug("prom_hold_cpus: start...\n"); +- prom_debug(" 1) spinloop = 0x%x\n", (unsigned long)spinloop); +- prom_debug(" 1) *spinloop = 0x%x\n", *spinloop); +- prom_debug(" 1) acknowledge = 0x%x\n", ++ prom_debug(" 1) spinloop = 0x%lx\n", (unsigned long)spinloop); ++ prom_debug(" 1) *spinloop = 0x%lx\n", *spinloop); ++ prom_debug(" 1) acknowledge = 0x%lx\n", + (unsigned long)acknowledge); +- prom_debug(" 1) *acknowledge = 0x%x\n", *acknowledge); +- prom_debug(" 1) secondary_hold = 0x%x\n", secondary_hold); ++ prom_debug(" 1) *acknowledge = 0x%lx\n", *acknowledge); ++ prom_debug(" 1) secondary_hold = 0x%lx\n", secondary_hold); + + /* Set the common spinloop variable, so all of the secondary cpus + * will block when they are awakened from their OF spinloop. +@@ -1965,7 +1967,7 @@ static void __init prom_hold_cpus(void) + prom_getprop(node, "reg", ®, sizeof(reg)); + cpu_no = be32_to_cpu(reg); + +- prom_debug("cpu hw idx = %lu\n", cpu_no); ++ prom_debug("cpu hw idx = %u\n", cpu_no); + + /* Init the acknowledge var which will be reset by + * the secondary cpu when it awakens from its OF +@@ -1975,7 +1977,7 @@ static void __init prom_hold_cpus(void) + + if (cpu_no != prom.cpu) { + /* Primary Thread of non-boot cpu or any thread */ +- prom_printf("starting cpu hw idx %lu... ", cpu_no); ++ prom_printf("starting cpu hw idx %u... ", cpu_no); + call_prom("start-cpu", 3, 0, node, + secondary_hold, cpu_no); + +@@ -1986,11 +1988,11 @@ static void __init prom_hold_cpus(void) + if (*acknowledge == cpu_no) + prom_printf("done\n"); + else +- prom_printf("failed: %x\n", *acknowledge); ++ prom_printf("failed: %lx\n", *acknowledge); + } + #ifdef CONFIG_SMP + else +- prom_printf("boot cpu hw idx %lu\n", cpu_no); ++ prom_printf("boot cpu hw idx %u\n", cpu_no); + #endif /* CONFIG_SMP */ + } + +@@ -2268,7 +2270,7 @@ static void __init *make_room(unsigned l + while ((*mem_start + needed) > *mem_end) { + unsigned long room, chunk; + +- prom_debug("Chunk exhausted, claiming more at %x...\n", ++ prom_debug("Chunk exhausted, claiming more at %lx...\n", + alloc_bottom); + room = alloc_top - alloc_bottom; + if (room > DEVTREE_CHUNK_SIZE) +@@ -2494,7 +2496,7 @@ static void __init flatten_device_tree(v + room = alloc_top - alloc_bottom - 0x4000; + if (room > DEVTREE_CHUNK_SIZE) + room = DEVTREE_CHUNK_SIZE; +- prom_debug("starting device tree allocs at %x\n", alloc_bottom); ++ prom_debug("starting device tree allocs at %lx\n", alloc_bottom); + + /* Now try to claim that */ + mem_start = (unsigned long)alloc_up(room, PAGE_SIZE); +@@ -2557,7 +2559,7 @@ static void __init flatten_device_tree(v + int i; + prom_printf("reserved memory map:\n"); + for (i = 0; i < mem_reserve_cnt; i++) +- prom_printf(" %x - %x\n", ++ prom_printf(" %llx - %llx\n", + be64_to_cpu(mem_reserve_map[i].base), + be64_to_cpu(mem_reserve_map[i].size)); + } +@@ -2567,9 +2569,9 @@ static void __init flatten_device_tree(v + */ + mem_reserve_cnt = MEM_RESERVE_MAP_SIZE; + +- prom_printf("Device tree strings 0x%x -> 0x%x\n", ++ prom_printf("Device tree strings 0x%lx -> 0x%lx\n", + dt_string_start, dt_string_end); +- prom_printf("Device tree struct 0x%x -> 0x%x\n", ++ prom_printf("Device tree struct 0x%lx -> 0x%lx\n", + dt_struct_start, dt_struct_end); + } + +@@ -3001,7 +3003,7 @@ static void __init prom_find_boot_cpu(vo + prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval)); + prom.cpu = be32_to_cpu(rval); + +- prom_debug("Booting CPU hw index = %lu\n", prom.cpu); ++ prom_debug("Booting CPU hw index = %d\n", prom.cpu); + } + + static void __init prom_check_initrd(unsigned long r3, unsigned long r4) +@@ -3023,8 +3025,8 @@ static void __init prom_check_initrd(uns + reserve_mem(prom_initrd_start, + prom_initrd_end - prom_initrd_start); + +- prom_debug("initrd_start=0x%x\n", prom_initrd_start); +- prom_debug("initrd_end=0x%x\n", prom_initrd_end); ++ prom_debug("initrd_start=0x%lx\n", prom_initrd_start); ++ prom_debug("initrd_end=0x%lx\n", prom_initrd_end); + } + #endif /* CONFIG_BLK_DEV_INITRD */ + } +@@ -3277,7 +3279,7 @@ unsigned long __init prom_init(unsigned + /* Don't print anything after quiesce under OPAL, it crashes OFW */ + if (of_platform != PLATFORM_OPAL) { + prom_printf("Booting Linux via __start() @ 0x%lx ...\n", kbase); +- prom_debug("->dt_header_start=0x%x\n", hdr); ++ prom_debug("->dt_header_start=0x%lx\n", hdr); + } + + #ifdef CONFIG_PPC32 diff --git a/queue-4.17/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch b/queue-4.17/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch new file mode 100644 index 00000000000..2639d0db14e --- /dev/null +++ b/queue-4.17/powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch @@ -0,0 +1,57 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Thu, 22 Mar 2018 21:19:56 +0100 +Subject: powerpc/chrp/time: Make some functions static, add missing header include + +From: Mathieu Malaterre + +[ Upstream commit b87a358b4a1421abd544c0b554b1b7159b2b36c0 ] + +Add a missing include . + +These functions can all be static, make it so. Fix warnings treated as +errors with W=1: + + arch/powerpc/platforms/chrp/time.c:41:13: error: no previous prototype for ‘chrp_time_init’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:66:5: error: no previous prototype for ‘chrp_cmos_clock_read’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:74:6: error: no previous prototype for ‘chrp_cmos_clock_write’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:86:5: error: no previous prototype for ‘chrp_set_rtc_time’ [-Werror=missing-prototypes] + arch/powerpc/platforms/chrp/time.c:130:6: error: no previous prototype for ‘chrp_get_rtc_time’ [-Werror=missing-prototypes] + +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/chrp/time.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/arch/powerpc/platforms/chrp/time.c ++++ b/arch/powerpc/platforms/chrp/time.c +@@ -28,6 +28,8 @@ + #include + #include + ++#include ++ + extern spinlock_t rtc_lock; + + #define NVRAM_AS0 0x74 +@@ -63,7 +65,7 @@ long __init chrp_time_init(void) + return 0; + } + +-int chrp_cmos_clock_read(int addr) ++static int chrp_cmos_clock_read(int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); +@@ -71,7 +73,7 @@ int chrp_cmos_clock_read(int addr) + return (inb(nvram_data)); + } + +-void chrp_cmos_clock_write(unsigned long val, int addr) ++static void chrp_cmos_clock_write(unsigned long val, int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); diff --git a/queue-4.17/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch b/queue-4.17/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch new file mode 100644 index 00000000000..c524721881e --- /dev/null +++ b/queue-4.17/powerpc-eeh-fix-use-after-release-of-eeh-driver.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sam Bobroff +Date: Fri, 25 May 2018 13:11:30 +1000 +Subject: powerpc/eeh: Fix use-after-release of EEH driver + +From: Sam Bobroff + +[ Upstream commit 46d4be41b987a6b2d25a2ebdd94cafb44e21d6c5 ] + +Correct two cases where eeh_pcid_get() is used to reference the driver's +module but the reference is dropped before the driver pointer is used. + +In eeh_rmv_device() also refactor a little so that only two calls to +eeh_pcid_put() are needed, rather than three and the reference isn't +taken at all if it wasn't needed. + +Signed-off-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/eeh_driver.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -458,9 +458,11 @@ static void *eeh_add_virt_device(void *d + + driver = eeh_pcid_get(dev); + if (driver) { +- eeh_pcid_put(dev); +- if (driver->err_handler) ++ if (driver->err_handler) { ++ eeh_pcid_put(dev); + return NULL; ++ } ++ eeh_pcid_put(dev); + } + + #ifdef CONFIG_PCI_IOV +@@ -497,17 +499,19 @@ static void *eeh_rmv_device(void *data, + if (eeh_dev_removed(edev)) + return NULL; + +- driver = eeh_pcid_get(dev); +- if (driver) { +- eeh_pcid_put(dev); +- if (removed && +- eeh_pe_passed(edev->pe)) +- return NULL; +- if (removed && +- driver->err_handler && +- driver->err_handler->error_detected && +- driver->err_handler->slot_reset) ++ if (removed) { ++ if (eeh_pe_passed(edev->pe)) + return NULL; ++ driver = eeh_pcid_get(dev); ++ if (driver) { ++ if (driver->err_handler && ++ driver->err_handler->error_detected && ++ driver->err_handler->slot_reset) { ++ eeh_pcid_put(dev); ++ return NULL; ++ } ++ eeh_pcid_put(dev); ++ } + } + + /* Remove it from PCI subsystem */ diff --git a/queue-4.17/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch b/queue-4.17/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch new file mode 100644 index 00000000000..bdcd1cbc7f1 --- /dev/null +++ b/queue-4.17/powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch @@ -0,0 +1,56 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Jonathan Neuschäfer" +Date: Thu, 10 May 2018 23:59:19 +0200 +Subject: powerpc/embedded6xx/hlwd-pic: Prevent interrupts from being handled by Starlet + +From: "Jonathan Neuschäfer" + +[ Upstream commit 9dcb3df4281876731e4e8bff7940514d72375154 ] + +The interrupt controller inside the Wii's Hollywood chip is connected to +two masters, the "Broadway" PowerPC and the "Starlet" ARM926, each with +their own interrupt status and mask registers. + +When booting the Wii with mini[1], interrupts from the SD card +controller (IRQ 7) are handled by the ARM, because mini provides SD +access over IPC. Linux however can't currently use or disable this IPC +service, so both sides try to handle IRQ 7 without coordination. + +Let's instead make sure that all interrupts that are unmasked on the PPC +side are masked on the ARM side; this will also make sure that Linux can +properly talk to the SD card controller (and potentially other devices). + +If access to a device through IPC is desired in the future, interrupts +from that device should not be handled by Linux directly. + +[1]: https://github.com/lewurm/mini + +Signed-off-by: Jonathan Neuschäfer +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/embedded6xx/hlwd-pic.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -35,6 +35,8 @@ + */ + #define HW_BROADWAY_ICR 0x00 + #define HW_BROADWAY_IMR 0x04 ++#define HW_STARLET_ICR 0x08 ++#define HW_STARLET_IMR 0x0c + + + /* +@@ -74,6 +76,9 @@ static void hlwd_pic_unmask(struct irq_d + void __iomem *io_base = irq_data_get_irq_chip_data(d); + + setbits32(io_base + HW_BROADWAY_IMR, 1 << irq); ++ ++ /* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */ ++ clrbits32(io_base + HW_STARLET_IMR, 1 << irq); + } + + diff --git a/queue-4.17/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch b/queue-4.17/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch new file mode 100644 index 00000000000..330f00c37a0 --- /dev/null +++ b/queue-4.17/powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch @@ -0,0 +1,87 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Christophe Leroy +Date: Fri, 18 May 2018 15:01:16 +0200 +Subject: powerpc/lib: Adjust .balign inside string functions for PPC32 + +From: Christophe Leroy + +[ Upstream commit 1128bb7813a896bd608fb622eee3c26aaf33b473 ] + +commit 87a156fb18fe1 ("Align hot loops of some string functions") +degraded the performance of string functions by adding useless +nops + +A simple benchmark on an 8xx calling 100000x a memchr() that +matches the first byte runs in 41668 TB ticks before this patch +and in 35986 TB ticks after this patch. So this gives an +improvement of approx 10% + +Another benchmark doing the same with a memchr() matching the 128th +byte runs in 1011365 TB ticks before this patch and 1005682 TB ticks +after this patch, so regardless on the number of loops, removing +those useless nops improves the test by 5683 TB ticks. + +Fixes: 87a156fb18fe1 ("Align hot loops of some string functions") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/include/asm/cache.h | 3 +++ + arch/powerpc/lib/string.S | 7 ++++--- + 2 files changed, 7 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/include/asm/cache.h ++++ b/arch/powerpc/include/asm/cache.h +@@ -9,11 +9,14 @@ + #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX) + #define L1_CACHE_SHIFT 4 + #define MAX_COPY_PREFETCH 1 ++#define IFETCH_ALIGN_SHIFT 2 + #elif defined(CONFIG_PPC_E500MC) + #define L1_CACHE_SHIFT 6 + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 + #elif defined(CONFIG_PPC32) + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 /* 603 fetches 2 insn at a time */ + #if defined(CONFIG_PPC_47x) + #define L1_CACHE_SHIFT 7 + #else +--- a/arch/powerpc/lib/string.S ++++ b/arch/powerpc/lib/string.S +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + .text + +@@ -23,7 +24,7 @@ _GLOBAL(strncpy) + mtctr r5 + addi r6,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r4) + cmpwi 0,r0,0 + stbu r0,1(r6) +@@ -43,7 +44,7 @@ _GLOBAL(strncmp) + mtctr r5 + addi r5,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r3,1(r5) + cmpwi 1,r3,0 + lbzu r0,1(r4) +@@ -77,7 +78,7 @@ _GLOBAL(memchr) + beq- 2f + mtctr r5 + addi r3,r3,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r3) + cmpw 0,r0,r4 + bdnzf 2,1b diff --git a/queue-4.17/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch b/queue-4.17/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch new file mode 100644 index 00000000000..bf436a61905 --- /dev/null +++ b/queue-4.17/powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Wed, 4 Apr 2018 22:13:05 +0200 +Subject: powerpc/powermac: Add missing prototype for note_bootable_part() + +From: Mathieu Malaterre + +[ Upstream commit f72cf3f1d49f2c35d6cb682af2e8c93550f264e4 ] + +Add a missing prototype for function `note_bootable_part` to silence a +warning treated as error with W=1: + + arch/powerpc/platforms/powermac/setup.c:361:12: error: no previous prototype for ‘note_bootable_part’ [-Werror=missing-prototypes] + +Suggested-by: Christophe Leroy +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/powermac/setup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/platforms/powermac/setup.c ++++ b/arch/powerpc/platforms/powermac/setup.c +@@ -352,6 +352,7 @@ static int pmac_late_init(void) + } + machine_late_initcall(powermac, pmac_late_init); + ++void note_bootable_part(dev_t dev, int part, int goodness); + /* + * This is __ref because we check for "initializing" before + * touching any of the __init sensitive things and "initializing" diff --git a/queue-4.17/powerpc-powermac-mark-variable-x-as-unused.patch b/queue-4.17/powerpc-powermac-mark-variable-x-as-unused.patch new file mode 100644 index 00000000000..f4a47c9db6b --- /dev/null +++ b/queue-4.17/powerpc-powermac-mark-variable-x-as-unused.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Mathieu Malaterre +Date: Wed, 4 Apr 2018 22:07:46 +0200 +Subject: powerpc/powermac: Mark variable x as unused + +From: Mathieu Malaterre + +[ Upstream commit 5a4b475cf8511da721f20ba432c244061db7139f ] + +Since the value of x is never intended to be read, declare it with gcc +attribute as unused. Fix warning treated as error with W=1: + + arch/powerpc/platforms/powermac/bootx_init.c:471:21: error: variable ‘x’ set but not used [-Werror=unused-but-set-variable] + +Suggested-by: Christophe Leroy +Signed-off-by: Mathieu Malaterre +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/platforms/powermac/bootx_init.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/platforms/powermac/bootx_init.c ++++ b/arch/powerpc/platforms/powermac/bootx_init.c +@@ -468,7 +468,7 @@ void __init bootx_init(unsigned long r3, + boot_infos_t *bi = (boot_infos_t *) r4; + unsigned long hdr; + unsigned long space; +- unsigned long ptr, x; ++ unsigned long ptr; + char *model; + unsigned long offset = reloc_offset(); + +@@ -562,6 +562,8 @@ void __init bootx_init(unsigned long r3, + * MMU switched OFF, so this should not be useful anymore. + */ + if (bi->version < 4) { ++ unsigned long x __maybe_unused; ++ + bootx_printf("Touching pages...\n"); + + /* diff --git a/queue-4.17/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch b/queue-4.17/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch new file mode 100644 index 00000000000..a36510b1664 --- /dev/null +++ b/queue-4.17/printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sergey Senozhatsky +Date: Wed, 30 May 2018 16:03:50 +0900 +Subject: printk: drop in_nmi check from printk_safe_flush_on_panic() + +From: Sergey Senozhatsky + +[ Upstream commit 554755be08fba31c74f66b82a485e5513205af84 ] + +Drop the in_nmi() check from printk_safe_flush_on_panic() +and attempt to re-init (IOW unlock) locked logbuf spinlock +from panic CPU regardless of its context. + +Otherwise, theoretically, we can deadlock on logbuf trying to flush +per-CPU buffers: + + a) Panic CPU is running in non-NMI context + b) Panic CPU sends out shutdown IPI via reboot vector + c) Panic CPU fails to stop all remote CPUs + d) Panic CPU sends out shutdown IPI via NMI vector + One of the CPUs that we bring down via NMI vector can hold + logbuf spin lock (theoretically). + +Link: http://lkml.kernel.org/r/20180530070350.10131-1-sergey.senozhatsky@gmail.com +To: Steven Rostedt +Cc: Peter Zijlstra +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/printk/printk_safe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/printk/printk_safe.c ++++ b/kernel/printk/printk_safe.c +@@ -281,7 +281,7 @@ void printk_safe_flush_on_panic(void) + * Make sure that we could access the main ring buffer. + * Do not risk a double release when more CPUs are up. + */ +- if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) { ++ if (raw_spin_is_locked(&logbuf_lock)) { + if (num_online_cpus() > 1) + return; + diff --git a/queue-4.17/qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch b/queue-4.17/qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch new file mode 100644 index 00000000000..82b8e6ad7b9 --- /dev/null +++ b/queue-4.17/qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch @@ -0,0 +1,92 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sergey Matyukevich +Date: Tue, 29 May 2018 15:00:05 +0300 +Subject: qtnfmac: fix invalid STA state on EAPOL failure + +From: Sergey Matyukevich + +[ Upstream commit 480daa9cb62c14bbd1b87a01cd9bc10cc56dbf32 ] + +Driver switches vif sta_state into QTNF_STA_CONNECTING when cfg80211 +core initiates connect procedure. Further this state is changed either +to QTNF_STA_CONNECTED or to QTNF_STA_DISCONNECTED by BSS_JOIN and +BSS_LEAVE events from firmware. However it is possible that no such +events will be sent by firmware, e.g. if EAPOL timed out. + +In this case vif sta_mode will remain in QTNF_STA_CONNECTING state and +all subsequent connection attempts will fail with -EBUSY error code. +Fix this by perfroming STA state transition from QTNF_STA_CONNECTING +to QTNF_STA_DISCONNECTED in cfg80211 disconnect callback. +No need to rely upon firmware events in this case. + +Signed-off-by: Sergey Matyukevich +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/quantenna/qtnfmac/cfg80211.c | 21 ++++++++++++++------- + drivers/net/wireless/quantenna/qtnfmac/event.c | 8 +++----- + 2 files changed, 17 insertions(+), 12 deletions(-) + +--- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c +@@ -651,28 +651,35 @@ qtnf_disconnect(struct wiphy *wiphy, str + { + struct qtnf_wmac *mac = wiphy_priv(wiphy); + struct qtnf_vif *vif; +- int ret; ++ int ret = 0; + + vif = qtnf_mac_get_base_vif(mac); + if (!vif) { + pr_err("MAC%u: primary VIF is not configured\n", mac->macid); +- return -EFAULT; ++ ret = -EFAULT; ++ goto out; + } + +- if (vif->wdev.iftype != NL80211_IFTYPE_STATION) +- return -EOPNOTSUPP; ++ if (vif->wdev.iftype != NL80211_IFTYPE_STATION) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } + + if (vif->sta_state == QTNF_STA_DISCONNECTED) +- return 0; ++ goto out; + + ret = qtnf_cmd_send_disconnect(vif, reason_code); + if (ret) { + pr_err("VIF%u.%u: failed to disconnect\n", mac->macid, + vif->vifid); +- return ret; ++ goto out; + } + +- return 0; ++out: ++ if (vif->sta_state == QTNF_STA_CONNECTING) ++ vif->sta_state = QTNF_STA_DISCONNECTED; ++ ++ return ret; + } + + static int +--- a/drivers/net/wireless/quantenna/qtnfmac/event.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/event.c +@@ -198,11 +198,9 @@ qtnf_event_handle_bss_leave(struct qtnf_ + return -EPROTO; + } + +- if (vif->sta_state != QTNF_STA_CONNECTED) { +- pr_err("VIF%u.%u: BSS_LEAVE event when STA is not connected\n", +- vif->mac->macid, vif->vifid); +- return -EPROTO; +- } ++ if (vif->sta_state != QTNF_STA_CONNECTED) ++ pr_warn("VIF%u.%u: BSS_LEAVE event when STA is not connected\n", ++ vif->mac->macid, vif->vifid); + + pr_debug("VIF%u.%u: disconnected\n", vif->mac->macid, vif->vifid); + diff --git a/queue-4.17/qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch b/queue-4.17/qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch new file mode 100644 index 00000000000..4b289fe9685 --- /dev/null +++ b/queue-4.17/qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch @@ -0,0 +1,36 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Gustavo A. R. Silva" +Date: Thu, 5 Apr 2018 10:49:49 -0500 +Subject: qtnfmac: pearl: pcie: fix memory leak in qtnf_fw_work_handler + +From: "Gustavo A. R. Silva" + +[ Upstream commit 3763770044640caeb1101cdea40697cc0814403c ] + +In case memory resources for fw were succesfully allocated, release +them before jumping to fw_load_fail. + +Addresses-Coverity-ID: 1466092 ("Resource leak") +Fixes: c3b2f7ca4186 ("qtnfmac: implement asynchronous firmware loading") +Signed-off-by: Gustavo A. R. Silva +Reviewed-by: Sergey Matyukevich +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/pearl/pcie.c +@@ -1185,6 +1185,10 @@ static void qtnf_fw_work_handler(struct + if (qtnf_poll_state(&priv->bda->bda_ep_state, QTN_EP_FW_LOADRDY, + QTN_FW_DL_TIMEOUT_MS)) { + pr_err("card is not ready\n"); ++ ++ if (!flashboot) ++ release_firmware(fw); ++ + goto fw_load_fail; + } + diff --git a/queue-4.17/rdma-mad-convert-bug_ons-to-error-flows.patch b/queue-4.17/rdma-mad-convert-bug_ons-to-error-flows.patch new file mode 100644 index 00000000000..77718060277 --- /dev/null +++ b/queue-4.17/rdma-mad-convert-bug_ons-to-error-flows.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Leon Romanovsky +Date: Tue, 29 May 2018 14:56:19 +0300 +Subject: RDMA/mad: Convert BUG_ONs to error flows + +From: Leon Romanovsky + +[ Upstream commit 2468b82d69e3a53d024f28d79ba0fdb8bf43dfbf ] + +Let's perform checks in-place instead of BUG_ONs. + +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/core/mad.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -1557,7 +1557,8 @@ static int add_oui_reg_req(struct ib_mad + mad_reg_req->oui, 3)) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(!*method); ++ if (!*method) ++ goto error3; + goto check_in_use; + } + } +@@ -1567,10 +1568,12 @@ static int add_oui_reg_req(struct ib_mad + vclass]->oui[i])) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(*method); + /* Allocate method table for this OUI */ +- if ((ret = allocate_method_table(method))) +- goto error3; ++ if (!*method) { ++ ret = allocate_method_table(method); ++ if (ret) ++ goto error3; ++ } + memcpy((*vendor_table)->vendor_class[vclass]->oui[i], + mad_reg_req->oui, 3); + goto check_in_use; diff --git a/queue-4.17/regulator-add-dummy-function-of_find_regulator_by_node.patch b/queue-4.17/regulator-add-dummy-function-of_find_regulator_by_node.patch new file mode 100644 index 00000000000..5c0aa3d0d3e --- /dev/null +++ b/queue-4.17/regulator-add-dummy-function-of_find_regulator_by_node.patch @@ -0,0 +1,78 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Changbin Du +Date: Wed, 2 May 2018 21:44:57 +0800 +Subject: regulator: add dummy function of_find_regulator_by_node + +From: Changbin Du + +[ Upstream commit 08813e0ec1cb48e53c86a24d88d26b26878e7b6e ] + +If device tree is not enabled, of_find_regulator_by_node() should have +a dummy function since the function call is still there. + +This is to fix build error after CONFIG_NO_AUTO_INLINE is introduced. +If this option is enabled, GCC will not auto-inline functions that are +not explicitly marked as inline. + +In this case (no CONFIG_OF), the copmiler will report error in function +regulator_dev_lookup(). + +W/O NO_AUTO_INLINE, function of_get_regulator() is auto-inlined and then +the call to of_find_regulator_by_node() is optimized out since +of_get_regulator() always return NULL. + +W/ NO_AUTO_INLINE, the return value of of_get_regulator() is a variable +so the call to of_find_regulator_by_node() cannot be optimized out. So +we need a stub of_find_regulator_by_node(). + +static struct regulator_dev *regulator_dev_lookup(struct device *dev, + const char *supply) +{ + struct regulator_dev *r = NULL; + struct device_node *node; + struct regulator_map *map; + const char *devname = NULL; + + regulator_supply_alias(&dev, &supply); + + /* first do a dt based lookup */ + if (dev && dev->of_node) { + node = of_get_regulator(dev, supply); + if (node) { + r = of_find_regulator_by_node(node); + if (r) + return r; + ... + +Signed-off-by: Changbin Du +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/internal.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/regulator/internal.h ++++ b/drivers/regulator/internal.h +@@ -56,14 +56,19 @@ static inline struct regulator_dev *dev_ + return container_of(dev, struct regulator_dev, dev); + } + +-struct regulator_dev *of_find_regulator_by_node(struct device_node *np); +- + #ifdef CONFIG_OF ++struct regulator_dev *of_find_regulator_by_node(struct device_node *np); + struct regulator_init_data *regulator_of_get_init_data(struct device *dev, + const struct regulator_desc *desc, + struct regulator_config *config, + struct device_node **node); + #else ++static inline struct regulator_dev * ++of_find_regulator_by_node(struct device_node *np) ++{ ++ return NULL; ++} ++ + static inline struct regulator_init_data * + regulator_of_get_init_data(struct device *dev, + const struct regulator_desc *desc, diff --git a/queue-4.17/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch b/queue-4.17/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch new file mode 100644 index 00000000000..de2d651ec78 --- /dev/null +++ b/queue-4.17/regulator-don-t-return-or-expect-errno-from-of_map_mode.patch @@ -0,0 +1,109 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Douglas Anderson +Date: Wed, 18 Apr 2018 08:54:18 -0700 +Subject: regulator: Don't return or expect -errno from of_map_mode() + +From: Douglas Anderson + +[ Upstream commit 02f3703934a42417021405ef336fe45add13c3d1 ] + +In of_get_regulation_constraints() we were taking the result of +of_map_mode() (an unsigned int) and assigning it to an int. We were +then checking whether this value was -EINVAL. Some implementers of +of_map_mode() were returning -EINVAL (even though the return type of +their function needed to be unsigned int) because they needed to +signal an error back to of_get_regulation_constraints(). + +In general in the regulator framework the mode is always referred to +as an unsigned int. While we could fix this to be a signed int (the +highest value we store in there right now is 0x8), it's actually +pretty clean to just define the regulator mode 0x0 (the lack of any +bits set) as an invalid mode. Let's do that. + +Fixes: 5e5e3a42c653 ("regulator: of: Add support for parsing initial and suspend modes") +Suggested-by: Javier Martinez Canillas +Signed-off-by: Douglas Anderson +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/cpcap-regulator.c | 2 +- + drivers/regulator/of_regulator.c | 13 +++++++------ + drivers/regulator/twl-regulator.c | 2 +- + include/linux/regulator/consumer.h | 1 + + 4 files changed, 10 insertions(+), 8 deletions(-) + +--- a/drivers/regulator/cpcap-regulator.c ++++ b/drivers/regulator/cpcap-regulator.c +@@ -222,7 +222,7 @@ static unsigned int cpcap_map_mode(unsig + case CPCAP_BIT_AUDIO_LOW_PWR: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -31,6 +31,7 @@ static void of_get_regulation_constraint + struct regulation_constraints *constraints = &(*init_data)->constraints; + struct regulator_state *suspend_state; + struct device_node *suspend_np; ++ unsigned int mode; + int ret, i; + u32 pval; + +@@ -124,11 +125,11 @@ static void of_get_regulation_constraint + + if (!of_property_read_u32(np, "regulator-initial-mode", &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", np->name, pval); + else +- constraints->initial_mode = ret; ++ constraints->initial_mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +@@ -163,12 +164,12 @@ static void of_get_regulation_constraint + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", + np->name, pval); + else +- suspend_state->mode = ret; ++ suspend_state->mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +--- a/drivers/regulator/twl-regulator.c ++++ b/drivers/regulator/twl-regulator.c +@@ -274,7 +274,7 @@ static inline unsigned int twl4030reg_ma + case RES_STATE_SLEEP: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -80,6 +80,7 @@ struct regmap; + * These modes can be OR'ed together to make up a mask of valid register modes. + */ + ++#define REGULATOR_MODE_INVALID 0x0 + #define REGULATOR_MODE_FAST 0x1 + #define REGULATOR_MODE_NORMAL 0x2 + #define REGULATOR_MODE_IDLE 0x4 diff --git a/queue-4.17/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch b/queue-4.17/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch new file mode 100644 index 00000000000..5ec509f9053 --- /dev/null +++ b/queue-4.17/regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Anson Huang +Date: Thu, 17 May 2018 15:27:22 +0800 +Subject: regulator: pfuze100: add .is_enable() for pfuze100_swb_regulator_ops + +From: Anson Huang + +[ Upstream commit 0b01fd3d40fe6402e5fa3b491ef23109feb1aaa5 ] + +If is_enabled() is not defined, regulator core will assume +this regulator is already enabled, then it can NOT be really +enabled after disabled. + +Based on Li Jun's patch from the NXP kernel tree. + +Signed-off-by: Anson Huang +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/pfuze100-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze1 + static const struct regulator_ops pfuze100_swb_regulator_ops = { + .enable = regulator_enable_regmap, + .disable = regulator_disable_regmap, ++ .is_enabled = regulator_is_enabled_regmap, + .list_voltage = regulator_list_voltage_table, + .map_voltage = regulator_map_voltage_ascend, + .set_voltage_sel = regulator_set_voltage_sel_regmap, diff --git a/queue-4.17/rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch b/queue-4.17/rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch new file mode 100644 index 00000000000..d2532aa09a9 --- /dev/null +++ b/queue-4.17/rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sanjay Kumar Konduri +Date: Fri, 11 May 2018 20:27:51 +0530 +Subject: rsi: Add null check for virtual interfaces in wowlan config + +From: Sanjay Kumar Konduri + +[ Upstream commit 54b5172087aeae61150835c91e68f084a9644f1c ] + +When the "poweroff" command is executed after wowlan enabled, we have +observed a system crash. In the system "poweroff" sequence, network-manager +is sent to inactive state by cleaning up the network interfaces, using +rsi_mac80211_remove_interface() and when driver tries to access those +network interfaces in rsi_wowlan_config() which was invoked by SDIO +shutdown, results in a crash. Added a NULL check before accessing the +network interfaces in rsi_wowlan_config(). + +Signed-off-by: Sanjay Kumar Konduri +Signed-off-by: Siva Rebbagondla +Signed-off-by: Sushant Kumar Mishra +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_mac80211.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c ++++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c +@@ -1788,10 +1788,15 @@ int rsi_config_wowlan(struct rsi_hw *ada + struct rsi_common *common = adapter->priv; + u16 triggers = 0; + u16 rx_filter_word = 0; +- struct ieee80211_bss_conf *bss = &adapter->vifs[0]->bss_conf; ++ struct ieee80211_bss_conf *bss = NULL; + + rsi_dbg(INFO_ZONE, "Config WoWLAN to device\n"); + ++ if (!adapter->vifs[0]) ++ return -EINVAL; ++ ++ bss = &adapter->vifs[0]->bss_conf; ++ + if (WARN_ON(!wowlan)) { + rsi_dbg(ERR_ZONE, "WoW triggers not enabled\n"); + return -EINVAL; diff --git a/queue-4.17/rsi-fix-invalid-vdd-warning-in-mmc.patch b/queue-4.17/rsi-fix-invalid-vdd-warning-in-mmc.patch new file mode 100644 index 00000000000..aa55b59c596 --- /dev/null +++ b/queue-4.17/rsi-fix-invalid-vdd-warning-in-mmc.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Siva Rebbagondla +Date: Wed, 11 Apr 2018 12:13:32 +0530 +Subject: rsi: Fix 'invalid vdd' warning in mmc + +From: Siva Rebbagondla + +[ Upstream commit 78e450719c702784e42af6da912d3692fd3da0cb ] + +While performing cleanup, driver is messing with card->ocr +value by not masking rocr against ocr_avail. Below panic +is observed with some of the SDIO host controllers due to +this. Issue is resolved by reverting incorrect modifications +to vdd. + +[ 927.423821] mmc1: Invalid vdd 0x1f +[ 927.423925] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x + mac80211 cfg80211 btrsi rfcomm bluetooth ecdh_generic +[ 927.424073] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000-caracalla #1 +[ 927.424075] Hardware name: Dell Inc. Edge Gateway 3003/ , BIOS 01.00.06 01/22/2018 +[ 927.424082] RIP: 0010:sdhci_set_power_noreg+0xdd/0x190[sdhci] +[ 927.424085] RSP: 0018:ffffac3fc064b930 EFLAGS: 00010282 +[ 927.424107] Call Trace: +[ 927.424118] sdhci_set_power+0x5a/0x60 [sdhci] +[ 927.424125] sdhci_set_ios+0x360/0x3b0 [sdhci] +[ 927.424133] mmc_set_initial_state+0x92/0x120 +[ 927.424137] mmc_power_up.part.34+0x33/0x1d0 +[ 927.424141] mmc_power_up+0x17/0x20 +[ 927.424147] mmc_sdio_runtime_resume+0x2d/0x50 +[ 927.424151] mmc_runtime_resume+0x17/0x20 +[ 927.424156] __rpm_callback+0xc4/0x200 +[ 927.424161] ? idr_alloc_cyclic+0x57/0xd0 +[ 927.424165] ? mmc_runtime_suspend+0x20/0x20 +[ 927.424169] rpm_callback+0x24/0x80 +[ 927.424172] ? mmc_runtime_suspend+0x20/0x20 +[ 927.424176] rpm_resume+0x4b3/0x6c0 +[ 927.424181] __pm_runtime_resume+0x4e/0x80 +[ 927.424188] driver_probe_device+0x41/0x490 +[ 927.424192] __driver_attach+0xdf/0xf0 +[ 927.424196] ? driver_probe_device+0x490/0x490 +[ 927.424201] bus_for_each_dev+0x6c/0xc0 +[ 927.424205] driver_attach+0x1e/0x20 +[ 927.424209] bus_add_driver+0x1f4/0x270 +[ 927.424217] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.424221] driver_register+0x60/0xe0 +[ 927.424227] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.424231] sdio_register_driver+0x20/0x30 +[ 927.424237] rsi_module_init+0x16/0x40 [rsi_sdio] + +Signed-off-by: Siva Rebbagondla +Signed-off-by: Amitkumar Karwar +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -170,7 +170,6 @@ static void rsi_reset_card(struct sdio_f + int err; + struct mmc_card *card = pfunction->card; + struct mmc_host *host = card->host; +- s32 bit = (fls(host->ocr_avail) - 1); + u8 cmd52_resp; + u32 clock, resp, i; + u16 rca; +@@ -190,7 +189,6 @@ static void rsi_reset_card(struct sdio_f + msleep(20); + + /* Initialize the SDIO card */ +- host->ios.vdd = bit; + host->ios.chip_select = MMC_CS_DONTCARE; + host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN; + host->ios.power_mode = MMC_POWER_UP; diff --git a/queue-4.17/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch b/queue-4.17/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch new file mode 100644 index 00000000000..8f43b3e5932 --- /dev/null +++ b/queue-4.17/rsi-fix-nommu_map_sg-overflow-kernel-panic.patch @@ -0,0 +1,209 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Siva Rebbagondla +Date: Wed, 11 Apr 2018 12:13:31 +0530 +Subject: rsi: fix nommu_map_sg overflow kernel panic + +From: Siva Rebbagondla + +[ Upstream commit f700546682a62a87a9615121a37ee7452dab4b76 ] + +Following overflow kernel panic is observed on some platforms while +loading the driver. It is fixed if dynamically allocated memory is +passed to SDIO instead of static one + +[ 927.513963] nommu_map_sg: overflow 17d54064ba7c+20 of device mask ffffffff +[ 927.517712] Modules linked in: rsi_sdio(+) cmac bnep arc4 rsi_91x mac80211 cfg80211 + btrsi rfcomm bluetooth ecdh_generic snd_soc_sst_bytcr_rt5660 +[ 927.517861] CPU: 0 PID: 1624 Comm: insmod Tainted: G W 4.15.0-1000 #1 +[ 927.517870] RIP: 0010:sdhci_send_command+0x5f0/0xa90 [sdhci] +[ 927.517873] RSP: 0000:ffffac3fc064b6d8 EFLAGS: 00010086 +[ 927.517895] Call Trace: +[ 927.517908] ? __schedule+0x3cd/0x890 +[ 927.517915] ? mod_timer+0x17b/0x3c0 +[ 927.517922] sdhci_request+0x7c/0xf0 [sdhci] +[ 927.517928] __mmc_start_request+0x5a/0x170 +[ 927.517932] mmc_start_request+0x74/0x90 +[ 927.517936] mmc_wait_for_req+0x87/0xe0 +[ 927.517940] mmc_io_rw_extended+0x2fd/0x330 +[ 927.517946] ? mmc_wait_data_done+0x30/0x30 +[ 927.517951] sdio_io_rw_ext_helper+0x160/0x210 +[ 927.517956] sdio_writesb+0x1d/0x20 +[ 927.517966] rsi_sdio_write_register_multiple+0x68/0x110 [rsi_sdio] +[ 927.517976] rsi_hal_device_init+0x357/0x910 [rsi_91x] +[ 927.517983] ? rsi_hal_device_init+0x357/0x910 [rsi_91x] +[ 927.517990] rsi_probe+0x2c6/0x450 [rsi_sdio] +[ 927.517995] sdio_bus_probe+0xfc/0x110 +[ 927.518000] driver_probe_device+0x2b3/0x490 +[ 927.518005] __driver_attach+0xdf/0xf0 +[ 927.518008] ? driver_probe_device+0x490/0x490 +[ 927.518014] bus_for_each_dev+0x6c/0xc0 +[ 927.518018] driver_attach+0x1e/0x20 +[ 927.518021] bus_add_driver+0x1f4/0x270 +[ 927.518028] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.518031] driver_register+0x60/0xe0 +[ 927.518038] ? rsi_sdio_ack_intr+0x50/0x50 [rsi_sdio] +[ 927.518041] sdio_register_driver+0x20/0x30 +[ 927.518047] rsi_module_init+0x16/0x40 [rsi_sdio] + +Signed-off-by: Siva Rebbagondla +Signed-off-by: Amitkumar Karwar +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/rsi/rsi_91x_hal.c | 35 +++++++++++++++++++------------- + drivers/net/wireless/rsi/rsi_91x_sdio.c | 21 ++++++++++++------- + drivers/net/wireless/rsi/rsi_sdio.h | 2 - + 3 files changed, 36 insertions(+), 22 deletions(-) + +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -616,28 +616,32 @@ static int bl_write_header(struct rsi_hw + u32 content_size) + { + struct rsi_host_intf_ops *hif_ops = adapter->host_intf_ops; +- struct bl_header bl_hdr; ++ struct bl_header *bl_hdr; + u32 write_addr, write_len; + int status; + +- bl_hdr.flags = 0; +- bl_hdr.image_no = cpu_to_le32(adapter->priv->coex_mode); +- bl_hdr.check_sum = cpu_to_le32( +- *(u32 *)&flash_content[CHECK_SUM_OFFSET]); +- bl_hdr.flash_start_address = cpu_to_le32( +- *(u32 *)&flash_content[ADDR_OFFSET]); +- bl_hdr.flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); ++ bl_hdr = kzalloc(sizeof(*bl_hdr), GFP_KERNEL); ++ if (!bl_hdr) ++ return -ENOMEM; ++ ++ bl_hdr->flags = 0; ++ bl_hdr->image_no = cpu_to_le32(adapter->priv->coex_mode); ++ bl_hdr->check_sum = ++ cpu_to_le32(*(u32 *)&flash_content[CHECK_SUM_OFFSET]); ++ bl_hdr->flash_start_address = ++ cpu_to_le32(*(u32 *)&flash_content[ADDR_OFFSET]); ++ bl_hdr->flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); + write_len = sizeof(struct bl_header); + + if (adapter->rsi_host_intf == RSI_HOST_INTF_USB) { + write_addr = PING_BUFFER_ADDRESS; + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } else { + write_addr = PING_BUFFER_ADDRESS >> 16; +@@ -646,20 +650,23 @@ static int bl_write_header(struct rsi_hw + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return status; ++ goto fail; + } + write_addr = RSI_SD_REQUEST_MASTER | + (PING_BUFFER_ADDRESS & 0xFFFF); + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } +- return 0; ++ status = 0; ++fail: ++ kfree(bl_hdr); ++ return status; + } + + static u32 read_flash_capacity(struct rsi_hw *adapter) +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -1040,17 +1040,21 @@ static void ulp_read_write(struct rsi_hw + /*This function resets and re-initializes the chip.*/ + static void rsi_reset_chip(struct rsi_hw *adapter) + { +- __le32 data; ++ u8 *data; + u8 sdio_interrupt_status = 0; + u8 request = 1; + int ret; + ++ data = kzalloc(sizeof(u32), GFP_KERNEL); ++ if (!data) ++ return; ++ + rsi_dbg(INFO_ZONE, "Writing disable to wakeup register\n"); + ret = rsi_sdio_write_register(adapter, 0, SDIO_WAKEUP_REG, &request); + if (ret < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to write SDIO wakeup register\n", __func__); +- return; ++ goto err; + } + msleep(20); + ret = rsi_sdio_read_register(adapter, RSI_FN1_INT_REGISTER, +@@ -1058,7 +1062,7 @@ static void rsi_reset_chip(struct rsi_hw + if (ret < 0) { + rsi_dbg(ERR_ZONE, "%s: Failed to Read Intr Status Register\n", + __func__); +- return; ++ goto err; + } + rsi_dbg(INFO_ZONE, "%s: Intr Status Register value = %d\n", + __func__, sdio_interrupt_status); +@@ -1068,17 +1072,17 @@ static void rsi_reset_chip(struct rsi_hw + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return; ++ goto err; + } + +- data = TA_HOLD_THREAD_VALUE; ++ put_unaligned_le32(TA_HOLD_THREAD_VALUE, data); + if (rsi_sdio_write_register_multiple(adapter, TA_HOLD_THREAD_REG | + RSI_SD_REQUEST_MASTER, +- (u8 *)&data, 4)) { ++ data, 4)) { + rsi_dbg(ERR_ZONE, + "%s: Unable to hold Thread-Arch processor threads\n", + __func__); +- return; ++ goto err; + } + + /* This msleep will ensure Thread-Arch processor to go to hold +@@ -1099,6 +1103,9 @@ static void rsi_reset_chip(struct rsi_hw + * read write operations to complete for chip reset. + */ + msleep(500); ++err: ++ kfree(data); ++ return; + } + + /** +--- a/drivers/net/wireless/rsi/rsi_sdio.h ++++ b/drivers/net/wireless/rsi/rsi_sdio.h +@@ -87,7 +87,7 @@ enum sdio_interrupt_type { + #define TA_SOFT_RST_CLR 0 + #define TA_SOFT_RST_SET BIT(0) + #define TA_PC_ZERO 0 +-#define TA_HOLD_THREAD_VALUE cpu_to_le32(0xF) ++#define TA_HOLD_THREAD_VALUE 0xF + #define TA_RELEASE_THREAD_VALUE cpu_to_le32(0xF) + #define TA_BASE_ADDR 0x2200 + #define MISC_CFG_BASE_ADDR 0x4105 diff --git a/queue-4.17/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch b/queue-4.17/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch new file mode 100644 index 00000000000..b4e2ec0ea57 --- /dev/null +++ b/queue-4.17/rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexandre Belloni +Date: Tue, 5 Jun 2018 23:09:14 +0200 +Subject: rtc: ensure rtc_set_alarm fails when alarms are not supported + +From: Alexandre Belloni + +[ Upstream commit abfdff44bc38e9e2ef7929f633fb8462632299d4 ] + +When using RTC_ALM_SET or RTC_WKALM_SET with rtc_wkalrm.enabled not set, +rtc_timer_enqueue() is not called and rtc_set_alarm() may succeed but the +subsequent RTC_AIE_ON ioctl will fail. RTC_ALM_READ would also fail in that +case. + +Ensure rtc_set_alarm() fails when alarms are not supported to avoid letting +programs think the alarms are working for a particular RTC when they are +not. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/interface.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -441,6 +441,11 @@ int rtc_set_alarm(struct rtc_device *rtc + { + int err; + ++ if (!rtc->ops) ++ return -ENODEV; ++ else if (!rtc->ops->set_alarm) ++ return -EINVAL; ++ + err = rtc_valid_tm(&alarm->time); + if (err != 0) + return err; diff --git a/queue-4.17/rtc-tps6586x-fix-possible-race-condition.patch b/queue-4.17/rtc-tps6586x-fix-possible-race-condition.patch new file mode 100644 index 00000000000..d3faaa718db --- /dev/null +++ b/queue-4.17/rtc-tps6586x-fix-possible-race-condition.patch @@ -0,0 +1,77 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:48:17 +0200 +Subject: rtc: tps6586x: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit 63d22063073b0ab46d1e06fe633fb5de8f5c58e1 ] + +The probe function is not allowed to fail after the RTC is registered +because the following may happen: + +CPU0: CPU1: +sys_load_module() + do_init_module() + do_one_initcall() + cmos_do_probe() + rtc_device_register() + __register_chrdev() + cdev->owner = struct module* + open("/dev/rtc0") + rtc_device_unregister() + module_put() + free_module() + module_free(mod->module_core) + /* struct module *module is now + freed */ + chrdev_open() + spin_lock(cdev_lock) + cdev_get() + try_module_get() + module_is_live() + /* dereferences already + freed struct module* */ + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-tps6586x.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/rtc/rtc-tps6586x.c ++++ b/drivers/rtc/rtc-tps6586x.c +@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct pla + device_init_wakeup(&pdev->dev, 1); + + platform_set_drvdata(pdev, rtc); +- rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev), +- &tps6586x_rtc_ops, THIS_MODULE); ++ rtc->rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc->rtc)) { + ret = PTR_ERR(rtc->rtc); +- dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret); + goto fail_rtc_register; + } + ++ rtc->rtc->ops = &tps6586x_rtc_ops; ++ + ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL, + tps6586x_rtc_irq, + IRQF_ONESHOT, +@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct pla + goto fail_rtc_register; + } + disable_irq(rtc->irq); ++ ++ ret = rtc_register_device(rtc->rtc); ++ if (ret) { ++ dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ goto fail_rtc_register; ++ } ++ + return 0; + + fail_rtc_register: diff --git a/queue-4.17/rtc-tps65910-fix-possible-race-condition.patch b/queue-4.17/rtc-tps65910-fix-possible-race-condition.patch new file mode 100644 index 00000000000..7133371f5dd --- /dev/null +++ b/queue-4.17/rtc-tps65910-fix-possible-race-condition.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:26:21 +0200 +Subject: rtc: tps65910: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit e6000a438e534ee0afd9e83b67f4e23a26dd1067 ] + +The IRQ is requested before the struct rtc is allocated and registered, but +this struct is used in the IRQ handler. This may lead to a NULL pointer +dereference. + +Switch to devm_rtc_allocate_device/rtc_register_device to allocate the rtc +before requesting the IRQ. + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-tps65910.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/rtc/rtc-tps65910.c ++++ b/drivers/rtc/rtc-tps65910.c +@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct pla + if (!tps_rtc) + return -ENOMEM; + ++ tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(tps_rtc->rtc)) ++ return PTR_ERR(tps_rtc->rtc); ++ + /* Clear pending interrupts */ + ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg); + if (ret < 0) +@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct pla + tps_rtc->irq = irq; + device_set_wakeup_capable(&pdev->dev, 1); + +- tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name, +- &tps65910_rtc_ops, THIS_MODULE); +- if (IS_ERR(tps_rtc->rtc)) { +- ret = PTR_ERR(tps_rtc->rtc); ++ tps_rtc->rtc->ops = &tps65910_rtc_ops; ++ ++ ret = rtc_register_device(tps_rtc->rtc); ++ if (ret) { + dev_err(&pdev->dev, "RTC device register: err %d\n", ret); + return ret; + } diff --git a/queue-4.17/rtc-vr41xx-fix-possible-race-condition.patch b/queue-4.17/rtc-vr41xx-fix-possible-race-condition.patch new file mode 100644 index 00000000000..c91b9c08b7b --- /dev/null +++ b/queue-4.17/rtc-vr41xx-fix-possible-race-condition.patch @@ -0,0 +1,72 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexandre Belloni +Date: Thu, 17 May 2018 22:47:05 +0200 +Subject: rtc: vr41xx: fix possible race condition + +From: Alexandre Belloni + +[ Upstream commit 9a99247c9c1d1c95c6e8153d013979aac6111c6e ] + +The probe function is not allowed to fail after the RTC is registered +because the following may happen: + +CPU0: CPU1: +sys_load_module() + do_init_module() + do_one_initcall() + cmos_do_probe() + rtc_device_register() + __register_chrdev() + cdev->owner = struct module* + open("/dev/rtc0") + rtc_device_unregister() + module_put() + free_module() + module_free(mod->module_core) + /* struct module *module is now + freed */ + chrdev_open() + spin_lock(cdev_lock) + cdev_get() + try_module_get() + module_is_live() + /* dereferences already + freed struct module* */ + +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rtc/rtc-vr41xx.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-vr41xx.c ++++ b/drivers/rtc/rtc-vr41xx.c +@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_dev + goto err_rtc1_iounmap; + } + +- rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops, +- THIS_MODULE); ++ rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc)) { + retval = PTR_ERR(rtc); + goto err_iounmap_all; + } + ++ rtc->ops = &vr41xx_rtc_ops; ++ + rtc->max_user_freq = MAX_PERIODIC_RATE; + + spin_lock_irq(&rtc_lock); +@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_dev + + dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n"); + ++ retval = rtc_register_device(rtc); ++ if (retval) ++ goto err_iounmap_all; ++ + return 0; + + err_iounmap_all: diff --git a/queue-4.17/rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch b/queue-4.17/rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch new file mode 100644 index 00000000000..412241f1347 --- /dev/null +++ b/queue-4.17/rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: David Howells +Date: Wed, 6 Jun 2018 14:59:14 +0100 +Subject: rxrpc: Fix terminal retransmission connection ID to include the channel + +From: David Howells + +[ Upstream commit fb1967a69f756073362b8f19347f863f227320ad ] + +When retransmitting the final ACK or ABORT packet for a call, the cid field +in the packet header is set to the connection's cid, but this is incorrect +as it also needs to include the channel number on that connection that the +call was made on. + +Fix this by OR'ing in the channel number. + +Note that this fixes the bug that: + + commit 1a025028d400b23477341aa7ec2ce55f8b39b554 + rxrpc: Fix handling of call quietly cancelled out on server + +works around. I'm not intending to revert that as it will help protect +against problems that might occur on the server. + +Fixes: 3136ef49a14c ("rxrpc: Delay terminal ACK transmission on a client call") +Signed-off-by: David Howells +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/rxrpc/conn_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -70,7 +70,7 @@ static void rxrpc_conn_retransmit_call(s + iov[2].iov_len = sizeof(ack_info); + + pkt.whdr.epoch = htonl(conn->proto.epoch); +- pkt.whdr.cid = htonl(conn->proto.cid); ++ pkt.whdr.cid = htonl(conn->proto.cid | channel); + pkt.whdr.callNumber = htonl(call_id); + pkt.whdr.seq = 0; + pkt.whdr.type = chan->last_type; diff --git a/queue-4.17/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch b/queue-4.17/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch new file mode 100644 index 00000000000..3e5de801d54 --- /dev/null +++ b/queue-4.17/s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch @@ -0,0 +1,41 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thomas Richter +Date: Tue, 8 May 2018 10:18:39 +0200 +Subject: s390/cpum_sf: Add data entry sizes to sampling trailer entry + +From: Thomas Richter + +[ Upstream commit 77715b7ddb446bd39a06f3376e85f4bb95b29bb8 ] + +The CPU Measurement sampling facility creates a trailer entry for each +Sample-Data-Block of stored samples. The trailer entry contains the sizes +(in bytes) of the stored sampling types: + - basic-sampling data entry size + - diagnostic-sampling data entry size +Both sizes are 2 bytes long. + +This patch changes the trailer entry definition to reflect this. + +Fixes: fcc77f507333 ("s390/cpum_sf: Atomically reset trailer entry fields of sample-data-blocks") +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/cpu_mf.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/arch/s390/include/asm/cpu_mf.h ++++ b/arch/s390/include/asm/cpu_mf.h +@@ -129,7 +129,9 @@ struct hws_trailer_entry { + unsigned int f:1; /* 0 - Block Full Indicator */ + unsigned int a:1; /* 1 - Alert request control */ + unsigned int t:1; /* 2 - Timestamp format */ +- unsigned long long:61; /* 3 - 63: Reserved */ ++ unsigned int :29; /* 3 - 31: Reserved */ ++ unsigned int bsdes:16; /* 32-47: size of basic SDE */ ++ unsigned int dsdes:16; /* 48-63: size of diagnostic SDE */ + }; + unsigned long long flags; /* 0 - 63: All indicators */ + }; diff --git a/queue-4.17/sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch b/queue-4.17/sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch new file mode 100644 index 00000000000..b73d15f8444 --- /dev/null +++ b/queue-4.17/sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch @@ -0,0 +1,90 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Patrick Bellasi +Date: Thu, 24 May 2018 15:10:22 +0100 +Subject: sched/cpufreq: Modify aggregate utilization to always include blocked FAIR utilization + +From: Patrick Bellasi + +[ Upstream commit 8ecf04e11283a28ca88b8b8049ac93c3a99fcd2c ] + +Since the refactoring introduced by: + + commit 8f111bc357aa ("cpufreq/schedutil: Rewrite CPUFREQ_RT support") + +we aggregate FAIR utilization only if this class has runnable tasks. + +This was mainly due to avoid the risk to stay on an high frequency just +because of the blocked utilization of a CPU not being properly decayed +while the CPU was idle. + +However, since: + + commit 31e77c93e432 ("sched/fair: Update blocked load when newly idle") + +the FAIR blocked utilization is properly decayed also for IDLE CPUs. + +This allows us to use the FAIR blocked utilization as a safe mechanism +to gracefully reduce the frequency only if no FAIR tasks show up on a +CPU for a reasonable period of time. + +Moreover, we also reduce the frequency drops of CPUs running periodic +tasks which, depending on the task periodicity and the time required +for a frequency switch, was increasing the chances to introduce some +undesirable performance variations. + +Reported-by: Vincent Guittot +Tested-by: Vincent Guittot +Signed-off-by: Patrick Bellasi +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Thomas Gleixner +Acked-by: Viresh Kumar +Acked-by: Vincent Guittot +Cc: Dietmar Eggemann +Cc: Joel Fernandes +Cc: Juri Lelli +Cc: Linus Torvalds +Cc: Morten Rasmussen +Cc: Peter Zijlstra +Cc: Rafael J . Wysocki +Cc: Steve Muckle +Link: http://lkml.kernel.org/r/20180524141023.13765-2-patrick.bellasi@arm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/cpufreq_schedutil.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -183,22 +183,21 @@ static void sugov_get_util(struct sugov_ + static unsigned long sugov_aggregate_util(struct sugov_cpu *sg_cpu) + { + struct rq *rq = cpu_rq(sg_cpu->cpu); +- unsigned long util; + +- if (rq->rt.rt_nr_running) { +- util = sg_cpu->max; +- } else { +- util = sg_cpu->util_dl; +- if (rq->cfs.h_nr_running) +- util += sg_cpu->util_cfs; +- } ++ if (rq->rt.rt_nr_running) ++ return sg_cpu->max; + + /* ++ * Utilization required by DEADLINE must always be granted while, for ++ * FAIR, we use blocked utilization of IDLE CPUs as a mechanism to ++ * gracefully reduce the frequency when no tasks show up for longer ++ * periods of time. ++ * + * Ideally we would like to set util_dl as min/guaranteed freq and + * util_cfs + util_dl as requested freq. However, cpufreq is not yet + * ready for such an interface. So, we only do the latter for now. + */ +- return min(util, sg_cpu->max); ++ return min(sg_cpu->max, (sg_cpu->util_dl + sg_cpu->util_cfs)); + } + + static void sugov_set_iowait_boost(struct sugov_cpu *sg_cpu, u64 time, unsigned int flags) diff --git a/queue-4.17/scsi-3w-9xxx-fix-a-missing-check-bug.patch b/queue-4.17/scsi-3w-9xxx-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..05bf44bb403 --- /dev/null +++ b/queue-4.17/scsi-3w-9xxx-fix-a-missing-check-bug.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wenwen Wang +Date: Mon, 7 May 2018 19:46:43 -0500 +Subject: scsi: 3w-9xxx: fix a missing-check bug + +From: Wenwen Wang + +[ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ] + +In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from +the userspace pointer 'argp' and saved to the kernel object +'driver_command'. Then a security check is performed on the data buffer +size indicated by 'driver_command', which is +'driver_command.buffer_length'. If the security check is passed, the +entire ioctl command is copied again from the 'argp' pointer and saved +to the kernel object 'tw_ioctl'. Then, various operations are performed +on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer +resides in userspace, a malicious userspace process can race to change +the buffer size between the two copies. This way, the user can bypass +the security check and inject invalid data buffer size. This can cause +potential security issues in the following execution. + +This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o +avoid the above issues. + +Signed-off-by: Wenwen Wang +Acked-by: Adam Radford +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/3w-9xxx.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -882,6 +882,11 @@ static int twa_chrdev_open(struct inode + unsigned int minor_number; + int retval = TW_IOCTL_ERROR_OS_ENODEV; + ++ if (!capable(CAP_SYS_ADMIN)) { ++ retval = -EACCES; ++ goto out; ++ } ++ + minor_number = iminor(inode); + if (minor_number >= twa_device_extension_count) + goto out; diff --git a/queue-4.17/scsi-3w-xxxx-fix-a-missing-check-bug.patch b/queue-4.17/scsi-3w-xxxx-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..bf7da3eed6c --- /dev/null +++ b/queue-4.17/scsi-3w-xxxx-fix-a-missing-check-bug.patch @@ -0,0 +1,47 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wenwen Wang +Date: Mon, 7 May 2018 19:54:01 -0500 +Subject: scsi: 3w-xxxx: fix a missing-check bug + +From: Wenwen Wang + +[ Upstream commit 9899e4d3523faaef17c67141aa80ff2088f17871 ] + +In tw_chrdev_ioctl(), the length of the data buffer is firstly copied +from the userspace pointer 'argp' and saved to the kernel object +'data_buffer_length'. Then a security check is performed on it to make +sure that the length is not more than 'TW_MAX_IOCTL_SECTORS * +512'. Otherwise, an error code -EINVAL is returned. If the security +check is passed, the entire ioctl command is copied again from the +'argp' pointer and saved to the kernel object 'tw_ioctl'. Then, various +operations are performed on 'tw_ioctl' according to the 'cmd'. Given +that the 'argp' pointer resides in userspace, a malicious userspace +process can race to change the buffer length between the two +copies. This way, the user can bypass the security check and inject +invalid data buffer length. This can cause potential security issues in +the following execution. + +This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to +avoid the above issues. + +Signed-off-by: Wenwen Wang +Acked-by: Adam Radford +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/3w-xxxx.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode * + + dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n"); + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + minor_number = iminor(inode); + if (minor_number >= tw_device_extension_count) + return -ENODEV; diff --git a/queue-4.17/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch b/queue-4.17/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch new file mode 100644 index 00000000000..dc755782d54 --- /dev/null +++ b/queue-4.17/scsi-cxlflash-avoid-clobbering-context-control-register-value.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: "Matthew R. Ochs" +Date: Mon, 26 Mar 2018 11:30:22 -0500 +Subject: scsi: cxlflash: Avoid clobbering context control register value + +From: "Matthew R. Ochs" + +[ Upstream commit 465891fe9237b02f8d0fd26448f733fae7236f4a ] + +The SISLite specification originally defined the context control register with +a single field of bits to represent the LISN and also stipulated that the +register reset value be 0. The cxlflash driver took advantage of this when +programming the LISN for the master contexts via an unconditional write - no +other bits were preserved. + +When unmap support was added, SISLite was updated to define bit 0 of the +context control register as a way for the AFU to notify the context owner that +unmap operations were supported. Thus the assumptions under which the register +is setup changed and the existing unconditional write is clobbering the unmap +state for master contexts. This is presently not an issue due to the order in +which the context control register is programmed in relation to the unmap bit +being queried but should be addressed to avoid a future regression in the +event this code is moved elsewhere. + +To remedy this issue, preserve the bits when programming the LISN field in the +context control register. Since the LISN will now be programmed using a read +value, assert that the initial state of the LISN field is as described in +SISLite (0). + +Signed-off-by: Matthew R. Ochs +Signed-off-by: Uma Krishnan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/cxlflash/main.c | 5 ++++- + drivers/scsi/cxlflash/sislite.h | 1 + + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/cxlflash/main.c ++++ b/drivers/scsi/cxlflash/main.c +@@ -1303,7 +1303,10 @@ static void afu_err_intr_init(struct afu + for (i = 0; i < afu->num_hwqs; i++) { + hwq = get_hwq(afu, i); + +- writeq_be(SISL_MSI_SYNC_ERROR, &hwq->host_map->ctx_ctrl); ++ reg = readq_be(&hwq->host_map->ctx_ctrl); ++ WARN_ON((reg & SISL_CTX_CTRL_LISN_MASK) != 0); ++ reg |= SISL_MSI_SYNC_ERROR; ++ writeq_be(reg, &hwq->host_map->ctx_ctrl); + writeq_be(SISL_ISTATUS_MASK, &hwq->host_map->intr_mask); + } + } +--- a/drivers/scsi/cxlflash/sislite.h ++++ b/drivers/scsi/cxlflash/sislite.h +@@ -284,6 +284,7 @@ struct sisl_host_map { + __be64 cmd_room; + __be64 ctx_ctrl; /* least significant byte or b56:63 is LISN# */ + #define SISL_CTX_CTRL_UNMAP_SECTOR 0x8000000000000000ULL /* b0 */ ++#define SISL_CTX_CTRL_LISN_MASK (0xFFULL) + __be64 mbox_w; /* restricted use */ + __be64 sq_start; /* Submission Queue (R/W): write sequence and */ + __be64 sq_end; /* inclusion semantics are the same as RRQ */ diff --git a/queue-4.17/scsi-cxlflash-synchronize-reset-and-remove-ops.patch b/queue-4.17/scsi-cxlflash-synchronize-reset-and-remove-ops.patch new file mode 100644 index 00000000000..b8ecfbd9a5a --- /dev/null +++ b/queue-4.17/scsi-cxlflash-synchronize-reset-and-remove-ops.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Uma Krishnan +Date: Mon, 26 Mar 2018 11:35:27 -0500 +Subject: scsi: cxlflash: Synchronize reset and remove ops + +From: Uma Krishnan + +[ Upstream commit a3feb6ef50def7c91244d7bd15a3625b7b49b81f ] + +The following Oops can be encountered if a device removal or system shutdown +is initiated while an EEH recovery is in process: + +[c000000ff2f479c0] c008000015256f18 cxlflash_pci_slot_reset+0xa0/0x100 + [cxlflash] +[c000000ff2f47a30] c00800000dae22e0 cxl_pci_slot_reset+0x168/0x290 [cxl] +[c000000ff2f47ae0] c00000000003ef1c eeh_report_reset+0xec/0x170 +[c000000ff2f47b20] c00000000003d0b8 eeh_pe_dev_traverse+0x98/0x170 +[c000000ff2f47bb0] c00000000003f80c eeh_handle_normal_event+0x56c/0x580 +[c000000ff2f47c60] c00000000003fba4 eeh_handle_event+0x2a4/0x338 +[c000000ff2f47d10] c0000000000400b8 eeh_event_handler+0x1f8/0x200 +[c000000ff2f47dc0] c00000000013da48 kthread+0x1a8/0x1b0 +[c000000ff2f47e30] c00000000000b528 ret_from_kernel_thread+0x5c/0xb4 + +The remove handler frees AFU memory while the EEH recovery is in progress, +leading to a race condition. This can result in a crash if the recovery thread +tries to access this memory. + +To resolve this issue, the cxlflash remove handler will evaluate the device +state and yield to any active reset or probing threads. + +Signed-off-by: Uma Krishnan +Acked-by: Matthew R. Ochs +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/cxlflash/main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/cxlflash/main.c ++++ b/drivers/scsi/cxlflash/main.c +@@ -946,9 +946,9 @@ static void cxlflash_remove(struct pci_d + return; + } + +- /* If a Task Management Function is active, wait for it to complete +- * before continuing with remove. +- */ ++ /* Yield to running recovery threads before continuing with remove */ ++ wait_event(cfg->reset_waitq, cfg->state != STATE_RESET && ++ cfg->state != STATE_PROBING); + spin_lock_irqsave(&cfg->tmf_slock, lock_flags); + if (cfg->tmf_active) + wait_event_interruptible_lock_irq(cfg->tmf_waitq, diff --git a/queue-4.17/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch b/queue-4.17/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch new file mode 100644 index 00000000000..82342757fc3 --- /dev/null +++ b/queue-4.17/scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch @@ -0,0 +1,61 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Xiang Chen +Date: Wed, 2 May 2018 23:56:31 +0800 +Subject: scsi: hisi_sas: config ATA de-reset as an constrained command for v3 hw + +From: Xiang Chen + +[ Upstream commit 9413532788df7470297dd0475995c5dc5b07f362 ] + +As a unconstrained command, a command can be sent to SATA disk even if +SATA disk status is BUSY, ERR or DRQ. + +If an ATA reset assert is successful but ATA reset de-assert fails, then +it will retry the reset de-assert. If reset de- assert retry is +successful, we think it is okay to probe the device but actually it +still has Err status. + +Apparently we need to retry the ATA reset assertion and de- assertion +instead for this mentioned scenario. + +As such, we config ATA reset assert as a constrained command, if ATA +reset de-assert fails, then ATA reset de-assert retry will also +fail. Then we will retry the proper process of ATA reset assert and +de-assert again. + +Signed-off-by: Xiang Chen +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -348,10 +348,11 @@ struct hisi_sas_err_record_v3 { + #define DIR_TO_DEVICE 2 + #define DIR_RESERVED 3 + +-#define CMD_IS_UNCONSTRAINT(cmd) \ +- ((cmd == ATA_CMD_READ_LOG_EXT) || \ +- (cmd == ATA_CMD_READ_LOG_DMA_EXT) || \ +- (cmd == ATA_CMD_DEV_RESET)) ++#define FIS_CMD_IS_UNCONSTRAINED(fis) \ ++ ((fis.command == ATA_CMD_READ_LOG_EXT) || \ ++ (fis.command == ATA_CMD_READ_LOG_DMA_EXT) || \ ++ ((fis.command == ATA_CMD_DEV_RESET) && \ ++ ((fis.control & ATA_SRST) != 0))) + + static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off) + { +@@ -1046,7 +1047,7 @@ static int prep_ata_v3_hw(struct hisi_hb + << CMD_HDR_FRAME_TYPE_OFF; + dw1 |= sas_dev->device_id << CMD_HDR_DEV_ID_OFF; + +- if (CMD_IS_UNCONSTRAINT(task->ata_task.fis.command)) ++ if (FIS_CMD_IS_UNCONSTRAINED(task->ata_task.fis)) + dw1 |= 1 << CMD_HDR_UNCON_CMD_OFF; + + hdr->dw1 = cpu_to_le32(dw1); diff --git a/queue-4.17/scsi-megaraid-silence-a-static-checker-bug.patch b/queue-4.17/scsi-megaraid-silence-a-static-checker-bug.patch new file mode 100644 index 00000000000..42a754adba9 --- /dev/null +++ b/queue-4.17/scsi-megaraid-silence-a-static-checker-bug.patch @@ -0,0 +1,33 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Dan Carpenter +Date: Thu, 3 May 2018 13:54:32 +0300 +Subject: scsi: megaraid: silence a static checker bug + +From: Dan Carpenter + +[ Upstream commit 27e833dabab74ee665e487e291c9afc6d71effba ] + +If we had more than 32 megaraid cards then it would cause memory +corruption. That's not likely, of course, but it's handy to enforce it +and make the static checker happy. + +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -4199,6 +4199,9 @@ megaraid_probe_one(struct pci_dev *pdev, + int irq, i, j; + int error = -ENODEV; + ++ if (hba_count >= MAX_CONTROLLERS) ++ goto out; ++ + if (pci_enable_device(pdev)) + goto out; + pci_set_master(pdev); diff --git a/queue-4.17/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch b/queue-4.17/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch new file mode 100644 index 00000000000..33b38dd8f38 --- /dev/null +++ b/queue-4.17/scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Shivasharan S +Date: Fri, 6 Apr 2018 02:02:11 -0700 +Subject: scsi: megaraid_sas: Increase timeout by 1 sec for non-RAID fastpath IOs + +From: Shivasharan S + +[ Upstream commit 3239b8cd28fd849a2023483257d35d68c5876c74 ] + +Hardware could time out Fastpath IOs one second earlier than the timeout +provided by the host. + +For non-RAID devices, driver provides timeout value based on OS provided +timeout value. Under certain scenarios, if the OS provides a timeout +value of 1 second, due to above behavior hardware will timeout +immediately. + +Increase timeout value for non-RAID fastpath IOs by 1 second. + +Signed-off-by: Shivasharan S +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -2981,6 +2981,9 @@ megasas_build_syspd_fusion(struct megasa + pRAID_Context->timeout_value = cpu_to_le16(os_timeout_value); + pRAID_Context->virtual_disk_tgt_id = cpu_to_le16(device_id); + } else { ++ if (os_timeout_value) ++ os_timeout_value++; ++ + /* system pd Fast Path */ + io_request->Function = MPI2_FUNCTION_SCSI_IO_REQUEST; + timeout_limit = (scmd->device->type == TYPE_DISK) ? diff --git a/queue-4.17/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch b/queue-4.17/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch new file mode 100644 index 00000000000..d9476f3b0ad --- /dev/null +++ b/queue-4.17/scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Chad Dupuis +Date: Wed, 25 Apr 2018 06:09:02 -0700 +Subject: scsi: qedf: Set the UNLOADING flag when removing a vport + +From: Chad Dupuis + +[ Upstream commit 4f4616ceebaf045c59e8a6aa01f08826d18d5c63 ] + +Similar to what we do when we remove a PCI function, set the +QEDF_UNLOADING flag to prevent any requests from being queued while a +vport is being deleted. This prevents any requests from getting stuck +in limbo when the vport is unloaded or deleted. + +Fixes the crash: + +PID: 106676 TASK: ffff9a436aa90000 CPU: 12 COMMAND: "multipathd" + #0 [ffff9a43567d3550] machine_kexec+522 at ffffffffaca60b2a + #1 [ffff9a43567d35b0] __crash_kexec+114 at ffffffffacb13512 + #2 [ffff9a43567d3680] crash_kexec+48 at ffffffffacb13600 + #3 [ffff9a43567d3698] oops_end+168 at ffffffffad117768 + #4 [ffff9a43567d36c0] no_context+645 at ffffffffad106f52 + #5 [ffff9a43567d3710] __bad_area_nosemaphore+116 at ffffffffad106fe9 + #6 [ffff9a43567d3760] bad_area+70 at ffffffffad107379 + #7 [ffff9a43567d3788] __do_page_fault+1247 at ffffffffad11a8cf + #8 [ffff9a43567d37f0] do_page_fault+53 at ffffffffad11a915 + #9 [ffff9a43567d3820] page_fault+40 at ffffffffad116768 + [exception RIP: qedf_init_task+61] + RIP: ffffffffc0e13c2d RSP: ffff9a43567d38d0 RFLAGS: 00010046 + RAX: 0000000000000000 RBX: ffffbe920472c738 RCX: ffff9a434fa0e3e8 + RDX: ffff9a434f695280 RSI: ffffbe920472c738 RDI: ffff9a43aa359c80 + RBP: ffff9a43567d3950 R8: 0000000000000c15 R9: ffff9a3fb09b9880 + R10: ffff9a434fa0e3e8 R11: ffff9a43567d35ce R12: 0000000000000000 + R13: ffff9a434f695280 R14: ffff9a43aa359c80 R15: ffff9a3fb9e005c0 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + +Signed-off-by: Chad Dupuis +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/qedf/qedf_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1647,6 +1647,15 @@ static int qedf_vport_destroy(struct fc_ + struct Scsi_Host *shost = vport_to_shost(vport); + struct fc_lport *n_port = shost_priv(shost); + struct fc_lport *vn_port = vport->dd_data; ++ struct qedf_ctx *qedf = lport_priv(vn_port); ++ ++ if (!qedf) { ++ QEDF_ERR(NULL, "qedf is NULL.\n"); ++ goto out; ++ } ++ ++ /* Set unloading bit on vport qedf_ctx to prevent more I/O */ ++ set_bit(QEDF_UNLOADING, &qedf->flags); + + mutex_lock(&n_port->lp_mutex); + list_del(&vn_port->list); +@@ -1673,6 +1682,7 @@ static int qedf_vport_destroy(struct fc_ + if (vn_port->host) + scsi_host_put(vn_port->host); + ++out: + return 0; + } + diff --git a/queue-4.17/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch b/queue-4.17/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch new file mode 100644 index 00000000000..cb0f4748774 --- /dev/null +++ b/queue-4.17/scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch @@ -0,0 +1,46 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Xose Vazquez Perez +Date: Sat, 7 Apr 2018 00:47:23 +0200 +Subject: scsi: scsi_dh: replace too broad "TP9" string with the exact models + +From: Xose Vazquez Perez + +[ Upstream commit 37b37d2609cb0ac267280ef27350b962d16d272e ] + +SGI/TP9100 is not an RDAC array: + ^^^ +https://git.opensvc.com/gitweb.cgi?p=multipath-tools/.git;a=blob;f=libmultipath/hwtable.c;h=88b4700beb1d8940008020fbe4c3cd97d62f4a56;hb=HEAD#l235 + +This partially reverts commit 35204772ea03 ("[SCSI] scsi_dh_rdac : +Consolidate rdac strings together") + +[mkp: fixed up the new entries to align with rest of struct] + +Cc: NetApp RDAC team +Cc: Hannes Reinecke +Cc: James E.J. Bottomley +Cc: Martin K. Petersen +Cc: SCSI ML +Cc: DM ML +Signed-off-by: Xose Vazquez Perez +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/scsi_dh.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -58,7 +58,10 @@ static const struct scsi_dh_blist scsi_d + {"IBM", "3526", "rdac", }, + {"IBM", "3542", "rdac", }, + {"IBM", "3552", "rdac", }, +- {"SGI", "TP9", "rdac", }, ++ {"SGI", "TP9300", "rdac", }, ++ {"SGI", "TP9400", "rdac", }, ++ {"SGI", "TP9500", "rdac", }, ++ {"SGI", "TP9700", "rdac", }, + {"SGI", "IS", "rdac", }, + {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, diff --git a/queue-4.17/scsi-ufs-fix-exception-event-handling.patch b/queue-4.17/scsi-ufs-fix-exception-event-handling.patch new file mode 100644 index 00000000000..746e64b124d --- /dev/null +++ b/queue-4.17/scsi-ufs-fix-exception-event-handling.patch @@ -0,0 +1,51 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Maya Erez +Date: Thu, 3 May 2018 16:37:16 +0530 +Subject: scsi: ufs: fix exception event handling + +From: Maya Erez + +[ Upstream commit 2e3611e9546c2ed4def152a51dfd34e8dddae7a5 ] + +The device can set the exception event bit in one of the response UPIU, +for example to notify the need for urgent BKOPs operation. In such a +case, the host driver calls ufshcd_exception_event_handler to handle +this notification. When trying to check the exception event status (for +finding the cause for the exception event), the device may be busy with +additional SCSI commands handling and may not respond within the 100ms +timeout. + +To prevent that, we need to block SCSI commands during handling of +exception events and allow retransmissions of the query requests, in +case of timeout. + +Signed-off-by: Subhash Jadavani +Signed-off-by: Maya Erez +Signed-off-by: Can Guo +Signed-off-by: Asutosh Das +Reviewed-by: Subhash Jadavani +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4969,6 +4969,7 @@ static void ufshcd_exception_event_handl + hba = container_of(work, struct ufs_hba, eeh_work); + + pm_runtime_get_sync(hba->dev); ++ scsi_block_requests(hba->host); + err = ufshcd_get_ee_status(hba, &status); + if (err) { + dev_err(hba->dev, "%s: failed to get exception status %d\n", +@@ -4982,6 +4983,7 @@ static void ufshcd_exception_event_handl + ufshcd_bkops_exception_event_handler(hba); + + out: ++ scsi_unblock_requests(hba->host); + pm_runtime_put_sync(hba->dev); + return; + } diff --git a/queue-4.17/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch b/queue-4.17/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch new file mode 100644 index 00000000000..df289a30772 --- /dev/null +++ b/queue-4.17/scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch @@ -0,0 +1,70 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Subhash Jadavani +Date: Thu, 3 May 2018 16:37:17 +0530 +Subject: scsi: ufs: ufshcd: fix possible unclocked register access + +From: Subhash Jadavani + +[ Upstream commit b334456ec2021b1addc19806990115e69ec4ac32 ] + +Vendor specific setup_clocks ops may depend on clocks managed by ufshcd +driver so if the vendor specific setup_clocks callback is called when +the required clocks are turned off, it results into unclocked register +access. + +This change make sure that required clocks are enabled before vendor +specific setup_clocks callback is called. + +Signed-off-by: Subhash Jadavani +Signed-off-by: Venkat Gopalakrishnan +Signed-off-by: Can Guo +Signed-off-by: Asutosh Das +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/ufs/ufshcd.c | 26 ++++++++++++++++++++------ + 1 file changed, 20 insertions(+), 6 deletions(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6799,9 +6799,16 @@ static int __ufshcd_setup_clocks(struct + if (list_empty(head)) + goto out; + +- ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * before disabling the clocks managed here. ++ */ ++ if (!on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); ++ if (ret) ++ return ret; ++ } + + list_for_each_entry(clki, head, list) { + if (!IS_ERR_OR_NULL(clki->clk)) { +@@ -6825,9 +6832,16 @@ static int __ufshcd_setup_clocks(struct + } + } + +- ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * after enabling the clocks managed here. ++ */ ++ if (on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); ++ if (ret) ++ return ret; ++ } + + out: + if (ret) { diff --git a/queue-4.17/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch b/queue-4.17/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch new file mode 100644 index 00000000000..06b91d4ed99 --- /dev/null +++ b/queue-4.17/scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Jens Remus +Date: Thu, 17 May 2018 19:15:05 +0200 +Subject: scsi: zfcp: assert that the ERP lock is held when tracing a recovery trigger + +From: Jens Remus + +[ Upstream commit 9e156c54ace310ce7fb1cd960e62416947f3d47c ] + +Otherwise iterating with list_for_each() over the adapter->erp_ready_head +and adapter->erp_running_head lists can lead to an infinite loop. See commit +"zfcp: fix infinite iteration on erp_ready_head list". + +The run-time check is only performed for debug kernels which have the kernel +lock validator enabled. Following is an example of the warning that is +reported, if the ERP lock is not held when calling zfcp_dbf_rec_trig(): + +WARNING: CPU: 0 PID: 604 at drivers/s390/scsi/zfcp_dbf.c:288 zfcp_dbf_rec_trig+0x172/0x188 +Modules linked in: ... +CPU: 0 PID: 604 Comm: kworker/u128:3 Not tainted 4.16.0-... #1 +Hardware name: IBM 2964 N96 702 (z/VM 6.4.0) +Workqueue: zfcp_q_0.0.1906 zfcp_scsi_rport_work +Krnl PSW : 00000000330fdbf9 00000000367e9728 (zfcp_dbf_rec_trig+0x172/0x188) + R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 +Krnl GPRS: 00000000c57a5d99 3288200000000000 0000000000000000 000000006cc82740 + 00000000009d09d6 0000000000000000 00000000000000ff 0000000000000000 + 0000000000000000 0000000000e1b5fe 000000006de01d38 0000000076130958 + 000000006cc82548 000000006de01a98 00000000009d09d6 000000006a6d3c80 +Krnl Code: 00000000009d0ad2: eb7ff0b80004 lmg %r7,%r15,184(%r15) + 00000000009d0ad8: c0f4000d7dd0 brcl 15,b80678 + #00000000009d0ade: a7f40001 brc 15,9d0ae0 + >00000000009d0ae2: a7f4ff7d brc 15,9d09dc + 00000000009d0ae6: e340f0f00004 lg %r4,240(%r15) + 00000000009d0aec: eb7ff0b80004 lmg %r7,%r15,184(%r15) + 00000000009d0af2: 07f4 bcr 15,%r4 + 00000000009d0af4: 0707 bcr 0,%r7 +Call Trace: +([<00000000009d09d6>] zfcp_dbf_rec_trig+0x66/0x188) + [<00000000009dd740>] zfcp_scsi_rport_work+0x98/0x190 + [<0000000000169b34>] process_one_work+0x3d4/0x6f8 + [<000000000016a08a>] worker_thread+0x232/0x418 + [<000000000017219e>] kthread+0x166/0x178 + [<0000000000b815ea>] kernel_thread_starter+0x6/0xc + [<0000000000b815e4>] kernel_thread_starter+0x0/0xc +2 locks held by kworker/u128:3/604: + #0: ((wq_completion)name){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8 + #1: ((work_completion)(&port->rport_work)){+.+.}, at: [<0000000082af1024>] process_one_work+0x1dc/0x6f8 +Last Breaking-Event-Address: + [<00000000009d0ade>] zfcp_dbf_rec_trig+0x16e/0x188 +---[ end trace b2f4020572e2c124 ]--- + +Suggested-by: Steffen Maier +Signed-off-by: Jens Remus +Reviewed-by: Benjamin Block +Reviewed-by: Steffen Maier +Signed-off-by: Steffen Maier +Signed-off-by: Martin K. Petersen + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/scsi/zfcp_dbf.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct + struct list_head *entry; + unsigned long flags; + ++ lockdep_assert_held(&adapter->erp_lock); ++ + if (unlikely(!debug_level_enabled(dbf->rec, level))) + return; + diff --git a/queue-4.17/selftests-filesystems-devpts_pts-included-wrong-header.patch b/queue-4.17/selftests-filesystems-devpts_pts-included-wrong-header.patch new file mode 100644 index 00000000000..2968f343701 --- /dev/null +++ b/queue-4.17/selftests-filesystems-devpts_pts-included-wrong-header.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Anders Roxell +Date: Wed, 18 Apr 2018 09:52:55 +0200 +Subject: selftests/filesystems: devpts_pts included wrong header + +From: Anders Roxell + +[ Upstream commit dd4b16b4f9b1b7d9f4a185cb8222e42f3a5daf00 ] + +We were picking up the wrong header should use asm/ioctls.h form the kernel +and not the header from the system (sys/ioctl.h). In the current code we +added the correct include and we added the kernel headers path to the CFLAGS. + +Fixes: ce290a19609d ("selftests: add devpts selftests") +Signed-off-by: Anders Roxell +Acked-by: Christian Brauner +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/filesystems/Makefile | 1 + + tools/testing/selftests/filesystems/devpts_pts.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/filesystems/Makefile ++++ b/tools/testing/selftests/filesystems/Makefile +@@ -1,5 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + ++CFLAGS += -I../../../../usr/include/ + TEST_GEN_PROGS := devpts_pts + TEST_GEN_PROGS_EXTENDED := dnotify_test + +--- a/tools/testing/selftests/filesystems/devpts_pts.c ++++ b/tools/testing/selftests/filesystems/devpts_pts.c +@@ -8,7 +8,7 @@ + #include + #include + #include +-#include ++#include + #include + #include + #include "../kselftest.h" diff --git a/queue-4.17/selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..67af73a02b8 --- /dev/null +++ b/queue-4.17/selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,66 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Thu, 3 May 2018 16:21:20 -0600 +Subject: selftests: filesystems: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 7357dcf2ef2811156fdf223a9a27f73528934e1f ] + +When devpts_pts test is skipped because of unmet dependencies and/or +unsupported configuration, it exits with error which is treated as +a fail by the Kselftest framework. This leads to false negative +result even when the test could not be run. + +In another case, it returns pass for a skipped test reporting a false +postive. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Change it to use ksft_exit_skip() when test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Acked-by: Christian Brauner +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/filesystems/devpts_pts.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/tools/testing/selftests/filesystems/devpts_pts.c ++++ b/tools/testing/selftests/filesystems/devpts_pts.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include "../kselftest.h" + + static bool terminal_dup2(int duplicate, int original) + { +@@ -125,10 +126,12 @@ static int do_tiocgptpeer(char *ptmx, ch + if (errno == EINVAL) { + fprintf(stderr, "TIOCGPTPEER is not supported. " + "Skipping test.\n"); +- fret = EXIT_SUCCESS; ++ fret = KSFT_SKIP; ++ } else { ++ fprintf(stderr, ++ "Failed to perform TIOCGPTPEER ioctl\n"); ++ fret = EXIT_FAILURE; + } +- +- fprintf(stderr, "Failed to perform TIOCGPTPEER ioctl\n"); + goto do_cleanup; + } + +@@ -281,7 +284,7 @@ int main(int argc, char *argv[]) + if (!isatty(STDIN_FILENO)) { + fprintf(stderr, "Standard input file desciptor is not attached " + "to a terminal. Skipping test\n"); +- exit(EXIT_FAILURE); ++ exit(KSFT_SKIP); + } + + ret = unshare(CLONE_NEWNS); diff --git a/queue-4.17/selftests-intel_pstate-improve-test-minor-fixes.patch b/queue-4.17/selftests-intel_pstate-improve-test-minor-fixes.patch new file mode 100644 index 00000000000..391cf1085c5 --- /dev/null +++ b/queue-4.17/selftests-intel_pstate-improve-test-minor-fixes.patch @@ -0,0 +1,91 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Daniel Díaz" +Date: Tue, 10 Apr 2018 17:11:15 -0500 +Subject: selftests/intel_pstate: Improve test, minor fixes + +From: "Daniel Díaz" + +[ Upstream commit e9d33f149f52981fd856a0b16aa8ebda89b02e34 ] + +A few changes improve the overall usability of the test: +* fix a hard-coded maximum frequency (3300), +* don't adjust the CPU frequency if only evaluating results, +* fix a comparison for multiple frequencies. + +A symptom of that last issue looked like this: + ./run.sh: line 107: [: too many arguments + ./run.sh: line 110: 3099 + 3099 + 3100-3100: syntax error in expression (error token is \"3099 + 3100-3100\") + +Because a check will count how many differente frequencies +there are among the CPUs of the system, and after they are +tallied another read is performed, which might produce +different results. + +Signed-off-by: Daniel Díaz +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/intel_pstate/run.sh | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +--- a/tools/testing/selftests/intel_pstate/run.sh ++++ b/tools/testing/selftests/intel_pstate/run.sh +@@ -48,11 +48,12 @@ function run_test () { + + echo "sleeping for 5 seconds" + sleep 5 +- num_freqs=$(cat /proc/cpuinfo | grep MHz | sort -u | wc -l) +- if [ $num_freqs -le 2 ]; then +- cat /proc/cpuinfo | grep MHz | sort -u | tail -1 > /tmp/result.$1 ++ grep MHz /proc/cpuinfo | sort -u > /tmp/result.freqs ++ num_freqs=$(wc -l /tmp/result.freqs | awk ' { print $1 } ') ++ if [ $num_freqs -ge 2 ]; then ++ tail -n 1 /tmp/result.freqs > /tmp/result.$1 + else +- cat /proc/cpuinfo | grep MHz | sort -u > /tmp/result.$1 ++ cp /tmp/result.freqs /tmp/result.$1 + fi + ./msr 0 >> /tmp/result.$1 + +@@ -82,21 +83,20 @@ _max_freq=$(cpupower frequency-info -l | + max_freq=$(($_max_freq / 1000)) + + +-for freq in `seq $max_freq -100 $min_freq` ++[ $EVALUATE_ONLY -eq 0 ] && for freq in `seq $max_freq -100 $min_freq` + do + echo "Setting maximum frequency to $freq" + cpupower frequency-set -g powersave --max=${freq}MHz >& /dev/null +- [ $EVALUATE_ONLY -eq 0 ] && run_test $freq ++ run_test $freq + done + +-echo "==============================================================================" ++[ $EVALUATE_ONLY -eq 0 ] && cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null + ++echo "==============================================================================" + echo "The marketing frequency of the cpu is $mkt_freq MHz" + echo "The maximum frequency of the cpu is $max_freq MHz" + echo "The minimum frequency of the cpu is $min_freq MHz" + +-cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null +- + # make a pretty table + echo "Target Actual Difference MSR(0x199) max_perf_pct" + for freq in `seq $max_freq -100 $min_freq` +@@ -104,10 +104,6 @@ do + result_freq=$(cat /tmp/result.${freq} | grep "cpu MHz" | awk ' { print $4 } ' | awk -F "." ' { print $1 } ') + msr=$(cat /tmp/result.${freq} | grep "msr" | awk ' { print $3 } ') + max_perf_pct=$(cat /tmp/result.${freq} | grep "max_perf_pct" | awk ' { print $2 } ' ) +- if [ $result_freq -eq $freq ]; then +- echo " $freq $result_freq 0 $msr $(($max_perf_pct*3300))" +- else +- echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" +- fi ++ echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" + done + exit 0 diff --git a/queue-4.17/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..09846d4528b --- /dev/null +++ b/queue-4.17/selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,43 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Thu, 3 May 2018 17:09:40 -0600 +Subject: selftests: intel_pstate: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit 5c30a038fb8ec8cdff011e6b5d5d51eb415381d4 ] + +When intel_pstate test is skipped because of unmet dependencies and/or +unsupported configuration, it returns 0 which is treated as a pass +by the Kselftest framework. This leads to false positive result even +when the test could not be run. + +Change it to return kselftest skip code when a test gets skipped to +clearly report that the test could not be run. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/intel_pstate/run.sh | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/tools/testing/selftests/intel_pstate/run.sh ++++ b/tools/testing/selftests/intel_pstate/run.sh +@@ -30,9 +30,12 @@ + + EVALUATE_ONLY=0 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then + echo "$0 # Skipped: Test can only run on x86 architectures." +- exit 0 ++ exit $ksft_skip + fi + + max_cpus=$(($(nproc)-1)) diff --git a/queue-4.17/selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..5ca341f7c7c --- /dev/null +++ b/queue-4.17/selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,75 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Thu, 3 May 2018 19:53:03 -0600 +Subject: selftests: kvm: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit ab0e9c4b91ca902b1cae593b3dec9c4c7a724f9f ] + +When kvm test is skipped because of unmet dependencies and/or unsupported +configuration, it exits with error which is treated as a fail by the +Kselftest framework. This leads to false negative result even when the test +could not be run. + +Change it to return kselftest skip code when a test gets skipped to clearly +report that the test could not be run. + +Change it to use ksft_exit_skip() when the test is skipped. In addition, +refine test_assert() message to include strerror() string and add explicit +check for EACCES to cleary identify when test doesn't run when access is +denied to resources required e.g: open /dev/kvm failed, rc: -1 errno: 13 + +Signed-off-by: Shuah Khan (Samsung OSG) +Acked-by: Paolo Bonzini +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/kvm/lib/assert.c | 9 +++++++-- + tools/testing/selftests/kvm/vmx_tsc_adjust_test.c | 2 ++ + 2 files changed, 9 insertions(+), 2 deletions(-) + +--- a/tools/testing/selftests/kvm/lib/assert.c ++++ b/tools/testing/selftests/kvm/lib/assert.c +@@ -13,6 +13,8 @@ + #include + #include + ++#include "../../kselftest.h" ++ + /* Dumps the current stack trace to stderr. */ + static void __attribute__((noinline)) test_dump_stack(void); + static void test_dump_stack(void) +@@ -70,8 +72,9 @@ test_assert(bool exp, const char *exp_st + + fprintf(stderr, "==== Test Assertion Failure ====\n" + " %s:%u: %s\n" +- " pid=%d tid=%d\n", +- file, line, exp_str, getpid(), gettid()); ++ " pid=%d tid=%d - %s\n", ++ file, line, exp_str, getpid(), gettid(), ++ strerror(errno)); + test_dump_stack(); + if (fmt) { + fputs(" ", stderr); +@@ -80,6 +83,8 @@ test_assert(bool exp, const char *exp_st + } + va_end(ap); + ++ if (errno == EACCES) ++ ksft_exit_skip("Access denied - Exiting.\n"); + exit(254); + } + +--- a/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c ++++ b/tools/testing/selftests/kvm/vmx_tsc_adjust_test.c +@@ -28,6 +28,8 @@ + #include + #include + ++#include "../kselftest.h" ++ + #ifndef MSR_IA32_TSC_ADJUST + #define MSR_IA32_TSC_ADJUST 0x3b + #endif diff --git a/queue-4.17/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch b/queue-4.17/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch new file mode 100644 index 00000000000..70bc4f0c835 --- /dev/null +++ b/queue-4.17/selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch @@ -0,0 +1,74 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Fri, 4 May 2018 13:33:37 -0600 +Subject: selftests: memfd: return Kselftest Skip code for skipped tests + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit b27f0259e8cea74c627327c063742a83613dd460 ] + +When memfd test is skipped because of unmet dependencies and/or unsupported +configuration, it returns non-zero value which is treated as a fail by the +Kselftest framework. This leads to false negative result even when the test +could not be run. + +Change it to return kselftest skip code when a test gets skipped to clearly +report that the test could not be run. + +Added an explicit check for root user at the start of memfd hugetlbfs test +and return skip code if a non-root user attempts to run it. + +In addition, return skip code when not enough huge pages are available to +run the test. + +Kselftest framework SKIP code is 4 and the framework prints appropriate +messages to indicate that the test is skipped. + +Signed-off-by: Shuah Khan (Samsung OSG) +Reviewed-by: Mike Kravetz +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/memfd/run_tests.sh | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/tools/testing/selftests/memfd/run_tests.sh ++++ b/tools/testing/selftests/memfd/run_tests.sh +@@ -1,6 +1,9 @@ + #!/bin/bash + # please run as root + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + # + # Normal tests requiring no special resources + # +@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $ + nr_hugepgs=`cat /proc/sys/vm/nr_hugepages` + hpages_needed=`expr $hpages_test - $freepgs` + ++ if [ $UID != 0 ]; then ++ echo "Please run memfd with hugetlbfs test as root" ++ exit $ksft_skip ++ fi ++ + echo 3 > /proc/sys/vm/drop_caches + echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages +- if [ $? -ne 0 ]; then +- echo "Please run this test as root" +- exit 1 +- fi + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then + freepgs=$size +@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then + fi + printf "Not enough huge pages available (%d < %d)\n" \ + $freepgs $needpgs +- exit 1 ++ exit $ksft_skip + fi + + # diff --git a/queue-4.17/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch b/queue-4.17/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch new file mode 100644 index 00000000000..956338b0273 --- /dev/null +++ b/queue-4.17/serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Douglas Anderson +Date: Fri, 23 Mar 2018 10:58:31 -0700 +Subject: serial: core: Make sure compiler barfs for 16-byte earlycon names + +From: Douglas Anderson + +[ Upstream commit c1c734cb1f54b062f7e67ffc9656d82f5b412b9c ] + +As part of bringup I ended up wanting to call an earlycon driver by a +name that was exactly 16-bytes big, specifically "qcom_geni_serial". + +Unfortunately, when I tried this I found that things compiled just +fine. They just didn't work. + +Specifically the compiler felt perfectly justified in initting the +".name" field of "struct earlycon_id" with the full 16-bytes and just +skipping the '\0'. Needless to say, that behavior didn't seem ideal, +but I guess someone must have allowed it for a reason. + +One way to fix this is to shorten the name field to 15 bytes and then +add an extra byte after that nobody touches. This should always be +initted to 0 and we're golden. + +There are, of course, other ways to fix this too. We could audit all +the users of the "name" field and make them stop at both null +termination or at 16 bytes. We could also just make the name field +much bigger so that we're not likely to run into this. ...but both +seem like we'll just hit the bug again. + +Signed-off-by: Douglas Anderson +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/serial_core.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -348,7 +348,8 @@ struct earlycon_device { + }; + + struct earlycon_id { +- char name[16]; ++ char name[15]; ++ char name_term; /* In case compiler didn't '\0' term name */ + char compatible[128]; + int (*setup)(struct earlycon_device *, const char *options); + }; diff --git a/queue-4.17/series b/queue-4.17/series index 8296a65a4c7..19550942515 100644 --- a/queue-4.17/series +++ b/queue-4.17/series @@ -12,3 +12,288 @@ tracing-kprobes-fix-trace_probe-flags-on-enable_trace_kprobe-failure.patch tracing-quiet-gcc-warning-about-maybe-unused-link-variable.patch arm64-fix-vmemmap-build_bug_on-triggering-on-vmemmap-setups.patch drm-i915-glk-add-quirk-for-glk-nuc-hdmi-port-issues.patch +mlxsw-spectrum_switchdev-fix-port_vlan-refcounting.patch +lib-test_printf.c-call-wait_for_random_bytes-before-plain-p-tests.patch +kcov-ensure-irq-code-sees-a-valid-area.patch +mm-check-for-sigkill-inside-dup_mmap-loop.patch +drm-amd-powerplay-set-higher-sclk-mclk-frequency-than-dpm7-in-od-v2.patch +xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch +hv_netvsc-fix-network-namespace-issues-with-vf-support.patch +skip-layoutreturn-if-layout-is-invalid.patch +ixgbe-fix-setting-of-tc-configuration-for-macvlan-case.patch +alsa-emu10k1-add-error-handling-for-snd_ctl_add.patch +alsa-fm801-add-error-handling-for-snd_ctl_add.patch +nfsv4.1-fix-the-client-behaviour-on-nfs4err_seq_false_retry.patch +nfsd-fix-error-handling-in-nfs4_set_delegation.patch +nfsd-fix-potential-use-after-free-in-nfsd4_decode_getdeviceinfo.patch +vfio-platform-fix-reset-module-leak-in-error-path.patch +vfio-mdev-check-globally-for-duplicate-devices.patch +vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch +kernel-hung_task.c-show-all-hung-tasks-before-panic.patch +mem_cgroup-make-sure-moving_account-move_lock_task-and-stat_cpu-in-the-same-cacheline.patch +mm-proc-pid-pagemap-hide-swap-entries-from-unprivileged-users.patch +mm-vmalloc-avoid-racy-handling-of-debugobjects-in-vunmap.patch +mm-slub.c-add-__printf-verification-to-slab_err.patch +rtc-ensure-rtc_set_alarm-fails-when-alarms-are-not-supported.patch +rxrpc-fix-terminal-retransmission-connection-id-to-include-the-channel.patch +net-hns3-fix-for-vf-mailbox-cannot-receiving-pf-response.patch +perf-tools-fix-pmu-events-parsing-rule.patch +netfilter-ipset-forbid-family-for-hash-mac-sets.patch +netfilter-ipset-list-timing-out-entries-with-timeout-1-instead-of-zero.patch +irqchip-ls-scfg-msi-map-msis-in-the-iommu.patch +watchdog-da9063-fix-updating-timeout-value.patch +media-arch-sh-migor-fix-tw9910-pdn-gpio.patch +printk-drop-in_nmi-check-from-printk_safe_flush_on_panic.patch +bpf-arm32-fix-inconsistent-naming-about-emit_a32_lsr_-r64-i64.patch +ceph-fix-alignment-of-rasize.patch +ceph-fix-use-after-free-in-ceph_statfs.patch +e1000e-ignore-tsyncrxctl-when-getting-i219-clock-attributes.patch +infiniband-fix-a-possible-use-after-free-bug.patch +powerpc-lib-adjust-.balign-inside-string-functions-for-ppc32.patch +powerpc-64s-add-barrier_nospec.patch +powerpc-eeh-fix-use-after-release-of-eeh-driver.patch +hvc_opal-don-t-set-tb_ticks_per_usec-in-udbg_init_opal_common.patch +powerpc-64s-fix-compiler-store-ordering-to-slb-shadow-area.patch +clk-si544-properly-round-requested-frequency-to-nearest-match.patch +clk-ingenic-jz4770-modify-c1clk-clock-to-disable-cpu-clock-stop-on-idle.patch +net-hns3-fix-for-phy-not-link-up-problem-after-resetting.patch +net-hns3-fix-for-service_task-not-running-problem-after-resetting.patch +rdma-mad-convert-bug_ons-to-error-flows.patch +lightnvm-fix-partial-read-error-path.patch +lightnvm-proper-error-handling-for-pblk_bio_add_pages.patch +lightnvm-pblk-warn-in-case-of-corrupted-write-buffer.patch +netfilter-nf_tables-check-msg_type-before-nft_trans_set-trans.patch +pnfs-don-t-release-the-sequence-slot-until-we-ve-processed-layoutget-on-open.patch +nfs-fix-up-nfs_post_op_update_inode-to-force-ctime-updates.patch +disable-loading-f2fs-module-on-page_size-4kb.patch +f2fs-fix-error-path-of-move_data_page.patch +f2fs-don-t-drop-dentry-pages-after-fs-shutdown.patch +f2fs-fix-to-don-t-trigger-writeback-during-recovery.patch +f2fs-fix-to-wait-page-writeback-during-revoking-atomic-write.patch +f2fs-fix-deadlock-in-shutdown-ioctl.patch +f2fs-fix-missing-clear-fi_no_prealloc-in-some-error-case.patch +f2fs-fix-to-detect-failure-of-dquot_initialize.patch +f2fs-fix-race-in-between-gc-and-atomic-open.patch +block-bfq-remove-wrong-lock-in-bfq_requests_merged.patch +usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch +usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch +perf-x86-intel-uncore-correct-fixed-counter-index-check-in-generic-code.patch +perf-x86-intel-uncore-correct-fixed-counter-index-check-for-nhm.patch +selftests-intel_pstate-improve-test-minor-fixes.patch +selftests-memfd-return-kselftest-skip-code-for-skipped-tests.patch +selftests-kvm-return-kselftest-skip-code-for-skipped-tests.patch +selftests-intel_pstate-return-kselftest-skip-code-for-skipped-tests.patch +selftests-filesystems-return-kselftest-skip-code-for-skipped-tests.patch +selftests-filesystems-devpts_pts-included-wrong-header.patch +qtnfmac-fix-invalid-sta-state-on-eapol-failure.patch +pci-fix-devm_pci_alloc_host_bridge-memory-leak.patch +btrfs-balance-dirty-metadata-pages-in-btrfs_finish_ordered_io.patch +iwlwifi-pcie-fix-race-in-rx-buffer-allocator.patch +iwlwifi-mvm-open-ba-session-only-when-sta-is-authorized.patch +bluetooth-hci_qca-fix-sleep-inside-atomic-section-warning.patch +drm-amd-display-do-not-program-interrupt-status-on-disabled-crtc.patch +drivers-bus-arm-cci-fix-build-warnings.patch +bluetooth-btusb-add-a-new-realtek-8723de-id-2ff8-b011.patch +asoc-dpcm-fix-be-dai-not-hw_free-and-shutdown.patch +mfd-cros_ec-fail-early-if-we-cannot-identify-the-ec.patch +mwifiex-handle-race-during-mwifiex_usb_disconnect.patch +wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch +net-hns3-fixes-initalization-of-roce-handle-and-makes-it-conditional.patch +net-hns3-fixes-the-init-of-the-valid-bd-info-in-the-descriptor.patch +media-tw686x-fix-incorrect-vb2_mem_ops-gfp-flags.patch +media-cec-pin-error-inj-avoid-a-false-positive-spectre-detection.patch +media-videobuf2-core-don-t-call-memop-finish-when-queueing.patch +btrfs-don-t-return-ino-to-ino-cache-if-inode-item-removal-fails.patch +btrfs-don-t-bug_on-in-btrfs_truncate_inode_items.patch +btrfs-add-barriers-to-btrfs_sync_log-before-log_commit_wait-wakeups.patch +btrfs-qgroup-finish-rescan-when-hit-the-last-leaf-of-extent-tree.patch +x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch +pm-wakeup-make-s2idle_lock-a-raw_spinlock.patch +pci-prevent-sysfs-disable-of-device-while-driver-is-attached.patch +soc-qcom-qmi-fix-a-buffer-sizing-bug.patch +soc-qcom-smem-fix-qcom_smem_set_global_partition.patch +soc-qcom-smem-byte-swap-values-properly.patch +nvme-rdma-stop-admin-queue-before-freeing-it.patch +nvme-pci-fix-aer-reset-handling.patch +ath-add-regulatory-mapping-for-fcc3_etsic.patch +ath-add-regulatory-mapping-for-etsi8_world.patch +ath-add-regulatory-mapping-for-apl13_world.patch +ath-add-regulatory-mapping-for-apl2_fcca.patch +ath-add-regulatory-mapping-for-uganda.patch +ath-add-regulatory-mapping-for-tanzania.patch +ath-add-regulatory-mapping-for-serbia.patch +ath-add-regulatory-mapping-for-bermuda.patch +ath-add-regulatory-mapping-for-bahamas.patch +sched-cpufreq-modify-aggregate-utilization-to-always-include-blocked-fair-utilization.patch +powerpc-32-add-a-missing-include-header.patch +powerpc-chrp-time-make-some-functions-static-add-missing-header-include.patch +powerpc-powermac-add-missing-prototype-for-note_bootable_part.patch +powerpc-powermac-mark-variable-x-as-unused.patch +powerpc-add-__printf-verification-to-prom_printf.patch +kvm-x86-prevent-integer-overflows-in-kvm_memory_encrypt_reg_region.patch +spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch +powerpc-8xx-fix-invalid-register-expression-in-head_8xx.s.patch +pinctrl-at91-pio4-add-missing-of_node_put.patch +pinctrl-msm-fix-gpio-hog-related-boot-issues.patch +bpf-fix-multi-function-jited-dump-obtained-via-syscall.patch +bpf-powerpc64-pad-function-address-loads-with-nops.patch +pci-pciehp-request-control-of-native-hotplug-only-if-supported.patch +net-dsa-qca8k-add-support-for-qca8334-switch.patch +mwifiex-correct-histogram-data-with-appropriate-index.patch +mt76x2-apply-coverage-class-on-slot-time-too.patch +ima-based-on-policy-verify-firmware-signatures-pre-allocated-buffer.patch +watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch +drivers-perf-arm-ccn-don-t-log-to-dmesg-in-event_init.patch +spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch +net-hns3-fix-for-cmdq-and-misc.-interrupt-init-order-problem.patch +net-hns3-fix-the-missing-client-list-node-initialization.patch +net-hns3-fix-for-hns3-module-is-loaded-multiple-times-problem.patch +fscrypt-use-unbound-workqueue-for-decryption.patch +net-mvpp2-add-missing-vlan-tag-detection.patch +scsi-ufs-ufshcd-fix-possible-unclocked-register-access.patch +scsi-ufs-fix-exception-event-handling.patch +scsi-zfcp-assert-that-the-erp-lock-is-held-when-tracing-a-recovery-trigger.patch +drm-nouveau-remove-fence-wait-code-from-deferred-client-work-handler.patch +drm-nouveau-gem-lookup-vmas-for-buffers-referenced-by-pushbuf-ioctl.patch +drm-nouveau-fifo-gk104-poll-for-runlist-update-completion.patch +bluetooth-btusb-add-id-for-liteon-04ca-301a.patch +rtc-tps6586x-fix-possible-race-condition.patch +rtc-vr41xx-fix-possible-race-condition.patch +rtc-tps65910-fix-possible-race-condition.patch +alsa-emu10k1-rate-limit-error-messages-about-page-errors.patch +regulator-pfuze100-add-.is_enable-for-pfuze100_swb_regulator_ops.patch +md-raid1-add-error-handling-of-read-error-from-failfast-device.patch +md-fix-null-dereference-of-mddev-pers-in-remove_and_add_spares.patch +ixgbevf-fix-mac-address-changes-through-ixgbevf_set_mac.patch +gpu-host1x-acquire-a-reference-to-the-iova-cache.patch +media-smiapp-fix-timeout-checking-in-smiapp_read_nvm.patch +pci-dpc-clear-interrupt-status-in-interrupt-handler-top-half.patch +clocksource-move-inline-keyword-to-the-beginning-of-function-declarations.patch +net-ethernet-ti-cpsw-phy-sel-check-bus_find_device-ret-value.patch +alsa-usb-audio-apply-rate-limit-to-warning-messages-in-urb-complete-callback.patch +net-hns3-fix-for-fiber-link-up-problem.patch +media-atomisp-ov2680-don-t-declare-unused-vars.patch +media-staging-atomisp-comment-out-several-unused-sensor-resolutions.patch +arm64-cmpwait-clear-event-register-before-arming-exclusive-monitor.patch +hid-hid-plantronics-re-resend-update-to-map-button-for-ptt-products.patch +arm64-dts-renesas-salvator-common-use-audio-graph-card-for-sound.patch +clk-davinci-psc-da830-fix-usb0-48mhz-phy-clock-registration.patch +drm-amd-display-remove-need-of-modeset-flag-for-overlay-planes-v2.patch +drm-radeon-fix-mode_valid-s-return-type.patch +drm-amdgpu-remove-vram-from-shared-bo-domains.patch +drm-amd-display-fix-dim-display-on-dce11.patch +ib-fix-rdma_rxe-and-infiniband_rdmavt-dependencies-for-dma_virt_ops.patch +powerpc-embedded6xx-hlwd-pic-prevent-interrupts-from-being-handled-by-starlet.patch +hid-i2c-hid-check-if-device-is-there-before-really-probing.patch +edac-altera-fix-arm64-build-warning.patch +rsi-add-null-check-for-virtual-interfaces-in-wowlan-config.patch +arm-dts-stih410-fix-complain-about-irq_type_none-usage.patch +arm-dts-stih407-pinctrl-fix-complain-about-irq_type_none-usage.patch +arm-dts-emev2-add-missing-interrupt-affinity-to-pmu-node.patch +arm-dts-sh73a0-add-missing-interrupt-affinity-to-pmu-node.patch +nvmem-properly-handle-returned-value-nvmem_reg_read.patch +arm-dts-imx53-fix-ldb-of-graph-warning.patch +i40e-free-the-skb-after-clearing-the-bitlock.patch +tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch +dma-iommu-fix-compilation-when-config_iommu_dma.patch +tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch +net-phy-phylink-release-link-gpio.patch +media-rcar_jpu-add-missing-clk_disable_unprepare-on-error-in-jpu_open.patch +libata-fix-command-retry-decision.patch +acpi-lpss-only-call-pwm_add_table-for-bay-trail-pwm-if-pmic-hrv-is-2.patch +media-media-device-fix-ioctl-function-types.patch +media-saa7164-fix-driver-name-in-debug-output.patch +media-renesas-ceu-set-mbus_fmt-on-subdev-operations.patch +media-em28xx-fix-dualhd-broken-second-tuner.patch +drm-tilcdc-fix-setting-clock-divider-for-omap-l138.patch +mtd-rawnand-fsl_ifc-fix-fsl-nand-driver-to-read-all-onfi-parameter-pages.patch +brcmfmac-add-support-for-bcm43364-wireless-chipset.patch +s390-cpum_sf-add-data-entry-sizes-to-sampling-trailer-entry.patch +perf-fix-invalid-bit-in-diagnostic-entry.patch +net-phy-sfp-handle-cases-where-neither-br-min-nor-br-max-is-given.patch +bnxt_en-check-unsupported-speeds-in-bnxt_update_link-on-pf-only.patch +bnxt_en-always-forward-vf-mac-address-to-the-pf.patch +mm-powerpc-x86-define-vm_pkey_bitx-bits-if-config_arch_has_pkeys-is-enabled.patch +staging-most-cdev-fix-chrdev_region-leak.patch +scsi-3w-9xxx-fix-a-missing-check-bug.patch +scsi-3w-xxxx-fix-a-missing-check-bug.patch +scsi-megaraid-silence-a-static-checker-bug.patch +scsi-hisi_sas-config-ata-de-reset-as-an-constrained-command-for-v3-hw.patch +soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch +scsi-qedf-set-the-unloading-flag-when-removing-a-vport.patch +dma-direct-try-reallocation-with-gfp_dma32-if-possible.patch +staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch +staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch +thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch +regulator-add-dummy-function-of_find_regulator_by_node.patch +bpf-fix-references-to-free_bpf_prog_info-in-comments.patch +f2fs-avoid-fsync-failure-caused-by-eagain-in-writepage.patch +media-em28xx-fix-a-regression-with-hvr-950.patch +media-siano-get-rid-of-__le32-__le16-cast-warnings.patch +mt76x2-fix-avg_rssi-estimation.patch +drm-atomic-handling-the-case-when-setting-old-crtc-for-plane.patch +mmc-sdhci-omap-fix-when-capabilities-are-obtained-from-sdhci_capabilities-reg.patch +f2fs-check-cap_resource-only-for-data-blocks.patch +mlxsw-spectrum_router-return-an-error-for-non-default-fib-rules.patch +alsa-hda-ca0132-fix-build-failure-when-a-local-macro-is-defined.patch +mmc-dw_mmc-update-actual-clock-for-mmc-debugfs.patch +mmc-pwrseq-use-kmalloc_array-instead-of-stack-vla.patch +dt-bindings-pinctrl-meson-add-support-for-the-meson8m2-soc.patch +spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch +net-hns3-fixes-the-out-of-bounds-access-in-hclge_map_tqp.patch +dt-bindings-net-meson-dwmac-new-compatible-name-for-axg-soc.patch +fasync-fix-deadlock-between-task-context-and-interrupt-context-kill_fasync.patch +i40e-add-advertising-10g-lr-mode.patch +i40e-avoid-overflow-in-i40e_ptp_adjfreq.patch +mt76-add-rcu-locking-around-tx-scheduling.patch +backlight-pwm_bl-don-t-use-gpiof_-with-gpiod_get_direction.patch +stop_machine-use-raw-spinlocks.patch +delayacct-use-raw_spinlocks.patch +ath10k-fix-kernel-panic-while-reading-tpc_stats.patch +memory-tegra-do-not-handle-spurious-interrupts.patch +memory-tegra-apply-interrupts-mask-per-soc.patch +nvme-lightnvm-add-granby-support.patch +asoc-fsl_ssi-use-u32-variable-type-when-using-regmap_read.patch +arm64-defconfig-enable-rockchip-io-domain-driver.patch +asoc-compress-only-call-free-for-components-which-have-been-opened.patch +igb-fix-queue-selection-on-mac-filters-on-i210.patch +qtnfmac-pearl-pcie-fix-memory-leak-in-qtnf_fw_work_handler.patch +drm-gma500-fix-psb_intel_lvds_mode_valid-s-return-type.patch +ipconfig-correctly-initialise-ic_nameservers.patch +rsi-fix-invalid-vdd-warning-in-mmc.patch +rsi-fix-nommu_map_sg-overflow-kernel-panic.patch +audit-allow-not-equal-op-for-audit-by-executable.patch +drm-rockchip-analogix_dp-do-not-call-analogix-code-before-bind.patch +platform-x86-dell-smbios-match-on-www.dell.com-in-oem-strings-too.patch +staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch +staging-lustre-llite-correct-removexattr-detection.patch +staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch +staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch +serial-core-make-sure-compiler-barfs-for-16-byte-earlycon-names.patch +soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch +microblaze-fix-simpleimage-format-generation.patch +usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch +crypto-authencesn-don-t-leak-pointers-to-authenc-keys.patch +crypto-authenc-don-t-leak-pointers-to-authenc-keys.patch +y2038-ipc-use-ktime_get_real_seconds-consistently.patch +media-rc-mce_kbd-decoder-low-timeout-values-cause-double-keydowns.patch +media-omap3isp-fix-unbalanced-dma_iommu_mapping.patch +regulator-don-t-return-or-expect-errno-from-of_map_mode.patch +ath10k-search-all-ies-for-variant-before-falling-back.patch +drm-stm-ltdc-fix-warning-in-ltdc_crtc_update_clut.patch +scsi-scsi_dh-replace-too-broad-tp9-string-with-the-exact-models.patch +scsi-megaraid_sas-increase-timeout-by-1-sec-for-non-raid-fastpath-ios.patch +scsi-cxlflash-synchronize-reset-and-remove-ops.patch +scsi-cxlflash-avoid-clobbering-context-control-register-value.patch +pci-aspm-disable-aspm-l1.2-substate-if-we-don-t-have-ltr.patch +media-atomisp-compat32-fix-__user-annotations.patch +media-cec-fix-smatch-error.patch +media-si470x-fix-__be16-annotations.patch +net-socionext-reset-hardware-in-ndo_stop.patch +asoc-topology-fix-bclk-and-fsync-inversion-in-set_link_hw_format.patch +asoc-topology-add-missing-clock-gating-parameter-when-parsing-hw_configs.patch +arm-dts-imx6qdl-wandboard-let-the-codec-control-mclk-pinctrl.patch +drm-add-dp-psr2-sink-enable-bit.patch +drm-atomic-helper-drop-plane-fb-references-only-for-drm_atomic_helper_shutdown.patch +drm-dp-mst-fix-off-by-one-typo-when-dump-payload-table.patch +drm-amdgpu-avoid-reclaim-while-holding-locks-taken-in-mmu-notifier.patch diff --git a/queue-4.17/skip-layoutreturn-if-layout-is-invalid.patch b/queue-4.17/skip-layoutreturn-if-layout-is-invalid.patch new file mode 100644 index 00000000000..fed6d8b7d86 --- /dev/null +++ b/queue-4.17/skip-layoutreturn-if-layout-is-invalid.patch @@ -0,0 +1,56 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Olga Kornievskaia +Date: Mon, 11 Jun 2018 15:32:06 -0400 +Subject: skip LAYOUTRETURN if layout is invalid + +From: Olga Kornievskaia + +[ Upstream commit 93b7f7ad2018d2037559b1d0892417864c78b371 ] + +Currently, when IO to DS fails, client returns the layout and +retries against the MDS. However, then on umounting (inode eviction) +it returns the layout again. + +This is because pnfs_return_layout() was changed in +commit d78471d32bb6 ("pnfs/blocklayout: set PNFS_LAYOUTRETURN_ON_ERROR") +to always set NFS_LAYOUT_RETURN_REQUESTED so even if we returned +the layout, it will be returned again. Instead, let's also check +if we have already marked the layout invalid. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1144,7 +1144,7 @@ _pnfs_return_layout(struct inode *ino) + LIST_HEAD(tmp_list); + nfs4_stateid stateid; + int status = 0; +- bool send; ++ bool send, valid_layout; + + dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino); + +@@ -1165,6 +1165,7 @@ _pnfs_return_layout(struct inode *ino) + goto out_put_layout_hdr; + spin_lock(&ino->i_lock); + } ++ valid_layout = pnfs_layout_is_valid(lo); + pnfs_clear_layoutcommit(ino, &tmp_list); + pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0); + +@@ -1178,7 +1179,8 @@ _pnfs_return_layout(struct inode *ino) + } + + /* Don't send a LAYOUTRETURN if list was initially empty */ +- if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) { ++ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) || ++ !valid_layout) { + spin_unlock(&ino->i_lock); + dprintk("NFS: %s no layout segments to return\n", __func__); + goto out_put_layout_hdr; diff --git a/queue-4.17/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch b/queue-4.17/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch new file mode 100644 index 00000000000..aa5c13d0f32 --- /dev/null +++ b/queue-4.17/soc-imx-gpcv2-do-not-pass-static-memory-as-platform-data.patch @@ -0,0 +1,78 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Andrey Smirnov +Date: Tue, 10 Apr 2018 11:32:09 -0700 +Subject: soc: imx: gpcv2: Do not pass static memory as platform data + +From: Andrey Smirnov + +[ Upstream commit 050f810e238f268670f14a8f8b793ba2dbf2e92f ] + +Platform device core assumes the ownership of dev.platform_data as +well as that it is dynamically allocated and it will try to kfree it +as a part of platform_device_release(). Change the code to use +platform_device_add_data() n instead of a pointer to a static memory +to avoid causing a BUG() when calling platform_device_put(). + +The problem can be reproduced by artificially enabling the error path +of platform_device_add() call (around line 357). + +Note that this change also allows us to constify imx7_pgc_domains, +since we no longer need to be able to modify it. + +Cc: Stefan Agner +Cc: Lucas Stach +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Andrey Smirnov +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/imx/gpcv2.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -155,7 +155,7 @@ static int imx7_gpc_pu_pgc_sw_pdn_req(st + return imx7_gpc_pu_pgc_sw_pxx_req(genpd, false); + } + +-static struct imx7_pgc_domain imx7_pgc_domains[] = { ++static const struct imx7_pgc_domain imx7_pgc_domains[] = { + [IMX7_POWER_DOMAIN_MIPI_PHY] = { + .genpd = { + .name = "mipi-phy", +@@ -321,11 +321,6 @@ static int imx_gpcv2_probe(struct platfo + continue; + } + +- domain = &imx7_pgc_domains[domain_index]; +- domain->regmap = regmap; +- domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; +- domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; +- + pd_pdev = platform_device_alloc("imx7-pgc-domain", + domain_index); + if (!pd_pdev) { +@@ -334,7 +329,20 @@ static int imx_gpcv2_probe(struct platfo + return -ENOMEM; + } + +- pd_pdev->dev.platform_data = domain; ++ ret = platform_device_add_data(pd_pdev, ++ &imx7_pgc_domains[domain_index], ++ sizeof(imx7_pgc_domains[domain_index])); ++ if (ret) { ++ platform_device_put(pd_pdev); ++ of_node_put(np); ++ return ret; ++ } ++ ++ domain = pd_pdev->dev.platform_data; ++ domain->regmap = regmap; ++ domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; ++ domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; ++ + pd_pdev->dev.parent = dev; + pd_pdev->dev.of_node = np; + diff --git a/queue-4.17/soc-qcom-qmi-fix-a-buffer-sizing-bug.patch b/queue-4.17/soc-qcom-qmi-fix-a-buffer-sizing-bug.patch new file mode 100644 index 00000000000..0fd38f04b87 --- /dev/null +++ b/queue-4.17/soc-qcom-qmi-fix-a-buffer-sizing-bug.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alex Elder +Date: Fri, 27 Apr 2018 09:08:17 -0500 +Subject: soc: qcom: qmi: fix a buffer sizing bug + +From: Alex Elder + +[ Upstream commit 7df5ff258bd27900d516fea88da10d05602bf8c7 ] + +In qmi_handle_init(), a buffer is allocated for to hold messages +received through the handle's socket. Any "normal" messages +(expected by the caller) will have a header prepended, so the +buffer size is adjusted to accomodate that. + +The buffer must also be of sufficient size to receive control +messages, so the size is increased if necessary to ensure these +will fit. + +Unfortunately the calculation is done wrong, making it possible +for the calculated buffer size to be too small to hold a "normal" +message. Specifically, if: + + recv_buf_size > sizeof(struct qrtr_ctrl_pkt) - sizeof(struct qmi_header) + AND + recv_buf_size < sizeof(struct qrtr_ctrl_pkt) + +the current logic will use sizeof(struct qrtr_ctrl_pkt) as the +receive buffer size, which is not enough to hold the maximum +"normal" message plus its header. Currently this problem occurs +for (13 < recv_buf_size < 20). + +This patch corrects this. + +Signed-off-by: Alex Elder +Reviewed-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/qmi_interface.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/soc/qcom/qmi_interface.c ++++ b/drivers/soc/qcom/qmi_interface.c +@@ -639,10 +639,11 @@ int qmi_handle_init(struct qmi_handle *q + if (ops) + qmi->ops = *ops; + ++ /* Make room for the header */ ++ recv_buf_size += sizeof(struct qmi_header); ++ /* Must also be sufficient to hold a control packet */ + if (recv_buf_size < sizeof(struct qrtr_ctrl_pkt)) + recv_buf_size = sizeof(struct qrtr_ctrl_pkt); +- else +- recv_buf_size += sizeof(struct qmi_header); + + qmi->recv_buf_size = recv_buf_size; + qmi->recv_buf = kzalloc(recv_buf_size, GFP_KERNEL); diff --git a/queue-4.17/soc-qcom-smem-byte-swap-values-properly.patch b/queue-4.17/soc-qcom-smem-byte-swap-values-properly.patch new file mode 100644 index 00000000000..ce17737bdc6 --- /dev/null +++ b/queue-4.17/soc-qcom-smem-byte-swap-values-properly.patch @@ -0,0 +1,68 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alex Elder +Date: Tue, 10 Apr 2018 17:25:39 -0500 +Subject: soc: qcom: smem: byte swap values properly + +From: Alex Elder + +[ Upstream commit 04a512fea333369cc0b550f3b90df0d638e34d00 ] + +Two places report an error when a partition header is found to +not contain the right canary value. The error messages do not +properly byte swap the host ids. Fix this, and adjust the format +specificier to match the 16-bit unsigned data type. + +Move the error handling for a bad canary value to the end of +qcom_smem_alloc_private(). This avoids some long lines, and +reduces the distraction of handling this unexpected problem. + +Signed-off-by: Alex Elder +Reviewed-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/smem.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +--- a/drivers/soc/qcom/smem.c ++++ b/drivers/soc/qcom/smem.c +@@ -362,13 +362,8 @@ static int qcom_smem_alloc_private(struc + cached = phdr_to_last_cached_entry(phdr); + + while (hdr < end) { +- if (hdr->canary != SMEM_PRIVATE_CANARY) { +- dev_err(smem->dev, +- "Found invalid canary in hosts %d:%d partition\n", +- phdr->host0, phdr->host1); +- return -EINVAL; +- } +- ++ if (hdr->canary != SMEM_PRIVATE_CANARY) ++ goto bad_canary; + if (le16_to_cpu(hdr->item) == item) + return -EEXIST; + +@@ -397,6 +392,11 @@ static int qcom_smem_alloc_private(struc + le32_add_cpu(&phdr->offset_free_uncached, alloc_size); + + return 0; ++bad_canary: ++ dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n", ++ le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1)); ++ ++ return -EINVAL; + } + + static int qcom_smem_alloc_global(struct qcom_smem *smem, +@@ -560,8 +560,8 @@ static void *qcom_smem_get_private(struc + return ERR_PTR(-ENOENT); + + invalid_canary: +- dev_err(smem->dev, "Found invalid canary in hosts %d:%d partition\n", +- phdr->host0, phdr->host1); ++ dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n", ++ le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1)); + + return ERR_PTR(-EINVAL); + } diff --git a/queue-4.17/soc-qcom-smem-fix-qcom_smem_set_global_partition.patch b/queue-4.17/soc-qcom-smem-fix-qcom_smem_set_global_partition.patch new file mode 100644 index 00000000000..876de229ee7 --- /dev/null +++ b/queue-4.17/soc-qcom-smem-fix-qcom_smem_set_global_partition.patch @@ -0,0 +1,59 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alex Elder +Date: Tue, 10 Apr 2018 17:25:41 -0500 +Subject: soc: qcom: smem: fix qcom_smem_set_global_partition() + +From: Alex Elder + +[ Upstream commit 8fa1a21409da6abfe890f66532f9fcd8d2c25a3d ] + +If there is at least one entry in the partition table, but no global +entry, the qcom_smem_set_global_partition() should return an error +just like it does if there are no partition table entries. + +It turns out the function still returns an error in this case, but +it waits to do so until it has mistakenly treated the last entry in +the table as if it were the global entry found. + +Fix the function to return immediately if no global entry is found +in the table. + +Signed-off-by: Alex Elder +Reviewed-by: Bjorn Andersson +Signed-off-by: Andy Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/qcom/smem.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/soc/qcom/smem.c ++++ b/drivers/soc/qcom/smem.c +@@ -695,9 +695,10 @@ static u32 qcom_smem_get_item_count(stru + static int qcom_smem_set_global_partition(struct qcom_smem *smem) + { + struct smem_partition_header *header; +- struct smem_ptable_entry *entry = NULL; ++ struct smem_ptable_entry *entry; + struct smem_ptable *ptable; + u32 host0, host1, size; ++ bool found = false; + int i; + + ptable = qcom_smem_get_ptable(smem); +@@ -709,11 +710,13 @@ static int qcom_smem_set_global_partitio + host0 = le16_to_cpu(entry->host0); + host1 = le16_to_cpu(entry->host1); + +- if (host0 == SMEM_GLOBAL_HOST && host0 == host1) ++ if (host0 == SMEM_GLOBAL_HOST && host0 == host1) { ++ found = true; + break; ++ } + } + +- if (!entry) { ++ if (!found) { + dev_err(smem->dev, "Missing entry for global partition\n"); + return -EINVAL; + } diff --git a/queue-4.17/soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch b/queue-4.17/soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch new file mode 100644 index 00000000000..ed67b060103 --- /dev/null +++ b/queue-4.17/soc-tegra-pmc-don-t-allocate-struct-tegra_powergate-on-stack.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Viresh Kumar +Date: Thu, 3 May 2018 13:56:17 +0530 +Subject: soc/tegra: pmc: Don't allocate struct tegra_powergate on stack + +From: Viresh Kumar + +[ Upstream commit 495ac33a3b82f85ed4fbdd9b826c1d2fbc8e9b68 ] + +With a later commit an instance of the struct device will be added to +struct genpd and with that the size of the struct tegra_powergate will +be over 1024 bytes. That generates following warning: + +drivers/soc/tegra/pmc.c:579:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=] + +Avoid such warnings by allocating the structure dynamically. + +Signed-off-by: Viresh Kumar +Acked-by: Thierry Reding +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/tegra/pmc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/soc/tegra/pmc.c ++++ b/drivers/soc/tegra/pmc.c +@@ -559,22 +559,28 @@ EXPORT_SYMBOL(tegra_powergate_remove_cla + int tegra_powergate_sequence_power_up(unsigned int id, struct clk *clk, + struct reset_control *rst) + { +- struct tegra_powergate pg; ++ struct tegra_powergate *pg; + int err; + + if (!tegra_powergate_is_available(id)) + return -EINVAL; + +- pg.id = id; +- pg.clks = &clk; +- pg.num_clks = 1; +- pg.reset = rst; +- pg.pmc = pmc; ++ pg = kzalloc(sizeof(*pg), GFP_KERNEL); ++ if (!pg) ++ return -ENOMEM; + +- err = tegra_powergate_power_up(&pg, false); ++ pg->id = id; ++ pg->clks = &clk; ++ pg->num_clks = 1; ++ pg->reset = rst; ++ pg->pmc = pmc; ++ ++ err = tegra_powergate_power_up(pg, false); + if (err) + pr_err("failed to turn on partition %d: %d\n", id, err); + ++ kfree(pg); ++ + return err; + } + EXPORT_SYMBOL(tegra_powergate_sequence_power_up); diff --git a/queue-4.17/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch b/queue-4.17/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch new file mode 100644 index 00000000000..11a3b05521a --- /dev/null +++ b/queue-4.17/spi-add-missing-pm_runtime_put_noidle-after-failed-get.patch @@ -0,0 +1,31 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Tony Lindgren +Date: Fri, 18 May 2018 10:30:07 -0700 +Subject: spi: Add missing pm_runtime_put_noidle() after failed get + +From: Tony Lindgren + +[ Upstream commit 7e48e23a1f4a50f93ac1073f1326e0a73829b631 ] + +If pm_runtime_get_sync() fails we should call pm_runtime_put_noidle(). +This is probably not a critical fix as we should only hit this when +things are broken elsewhere. + +Signed-off-by: Tony Lindgren +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct s + if (!was_busy && ctlr->auto_runtime_pm) { + ret = pm_runtime_get_sync(ctlr->dev.parent); + if (ret < 0) { ++ pm_runtime_put_noidle(ctlr->dev.parent); + dev_err(&ctlr->dev, "Failed to power device: %d\n", + ret); + mutex_unlock(&ctlr->io_mutex); diff --git a/queue-4.17/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch b/queue-4.17/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch new file mode 100644 index 00000000000..8f161ffcb21 --- /dev/null +++ b/queue-4.17/spi-meson-spicc-fix-error-handling-in-meson_spicc_probe.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alexey Khoroshilov +Date: Sun, 29 Apr 2018 01:46:23 +0300 +Subject: spi: meson-spicc: Fix error handling in meson_spicc_probe() + +From: Alexey Khoroshilov + +[ Upstream commit ded5fa4e8bac25612caab8f0822691308a28a552 ] + +If devm_spi_register_master() fails in meson_spicc_probe(), +spicc->core is left undisabled. The patch fixes that. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Alexey Khoroshilov +Reviewed-by: Neil Armstrong +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-meson-spicc.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -574,10 +574,15 @@ static int meson_spicc_probe(struct plat + master->max_speed_hz = rate >> 2; + + ret = devm_spi_register_master(&pdev->dev, master); +- if (!ret) +- return 0; ++ if (ret) { ++ dev_err(&pdev->dev, "spi master registration failed\n"); ++ goto out_clk; ++ } + +- dev_err(&pdev->dev, "spi master registration failed\n"); ++ return 0; ++ ++out_clk: ++ clk_disable_unprepare(spicc->core); + + out_master: + spi_master_put(master); diff --git a/queue-4.17/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch b/queue-4.17/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch new file mode 100644 index 00000000000..1f041b2bb12 --- /dev/null +++ b/queue-4.17/spi-sh-msiof-fix-setting-sirmdr1.syncac-to-match-sitmdr1.syncac.patch @@ -0,0 +1,49 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Geert Uytterhoeven +Date: Wed, 23 May 2018 11:02:04 +0200 +Subject: spi: sh-msiof: Fix setting SIRMDR1.SYNCAC to match SITMDR1.SYNCAC + +From: Geert Uytterhoeven + +[ Upstream commit 0921e11e1e12802ae0a3c19cb02e33354ca51967 ] + +According to section 59.2.4 MSIOF Receive Mode Register 1 (SIRMDR1) in +the R-Car Gen3 datasheet Rev.1.00, the value of the SIRMDR1.SYNCAC bit +must match the value of the SITMDR1.SYNCAC bit. However, +sh_msiof_spi_setup() changes only the latter. + +Fix this by updating the SIRMDR1 register like the SITMDR1 register, +taking into account register bits that exist in SITMDR1 only. + +Reported-by: Renesas BSP team via Yoshihiro Shimoda +Fixes: 7ff0b53c4051145d ("spi: sh-msiof: Avoid writing to registers from spi_master.setup()") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Simon Horman +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-sh-msiof.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -564,14 +564,16 @@ static int sh_msiof_spi_setup(struct spi + + /* Configure native chip select mode/polarity early */ + clr = MDR1_SYNCMD_MASK; +- set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI; ++ set = MDR1_SYNCMD_SPI; + if (spi->mode & SPI_CS_HIGH) + clr |= BIT(MDR1_SYNCAC_SHIFT); + else + set |= BIT(MDR1_SYNCAC_SHIFT); + pm_runtime_get_sync(&p->pdev->dev); + tmp = sh_msiof_read(p, TMDR1) & ~clr; +- sh_msiof_write(p, TMDR1, tmp | set); ++ sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON); ++ tmp = sh_msiof_read(p, RMDR1) & ~clr; ++ sh_msiof_write(p, RMDR1, tmp | set); + pm_runtime_put(&p->pdev->dev); + p->native_cs_high = spi->mode & SPI_CS_HIGH; + p->native_cs_inited = true; diff --git a/queue-4.17/staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch b/queue-4.17/staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch new file mode 100644 index 00000000000..b57aba9a599 --- /dev/null +++ b/queue-4.17/staging-ks7010-fix-error-handling-in-ks7010_upload_firmware.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Sergio Paracuellos +Date: Tue, 3 Apr 2018 17:13:00 +0200 +Subject: staging: ks7010: fix error handling in ks7010_upload_firmware + +From: Sergio Paracuellos + +[ Upstream commit 6e043704fb99e3e1d7a1bb02030e49c093cdd943 ] + +This commit checks missing error code check when checking +if the firmware is running reading General Communication +Register A (GCR_A). + +It also set ret to EBUSY if firmware is running before +copying it. + +Signed-off-by: Sergio Paracuellos +Reviewed-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/ks7010/ks7010_sdio.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/staging/ks7010/ks7010_sdio.c ++++ b/drivers/staging/ks7010/ks7010_sdio.c +@@ -657,8 +657,11 @@ static int ks7010_upload_firmware(struct + + /* Firmware running ? */ + ret = ks7010_sdio_readb(priv, GCR_A, &byte); ++ if (ret) ++ goto release_host_and_free; + if (byte == GCR_A_RUN) { + netdev_dbg(priv->net_dev, "MAC firmware running ...\n"); ++ ret = -EBUSY; + goto release_host_and_free; + } + diff --git a/queue-4.17/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch b/queue-4.17/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch new file mode 100644 index 00000000000..bf9fa30a43d --- /dev/null +++ b/queue-4.17/staging-lustre-ldlm-free-resource-when-ldlm_lock_create-fails.patch @@ -0,0 +1,44 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: NeilBrown +Date: Thu, 29 Mar 2018 15:26:48 +1100 +Subject: staging: lustre: ldlm: free resource when ldlm_lock_create() fails. + +From: NeilBrown + +[ Upstream commit d8caf662b4aeeb2ac83ac0b22e40db88e9360c77 ] + +ldlm_lock_create() gets a resource, but don't put it on +all failure paths. It should. + +Signed-off-by: NeilBrown +Reviewed-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/ldlm/ldlm_lock.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c ++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c +@@ -1565,8 +1565,10 @@ struct ldlm_lock *ldlm_lock_create(struc + return ERR_CAST(res); + + lock = ldlm_lock_new(res); +- if (!lock) ++ if (!lock) { ++ ldlm_resource_putref(res); + return ERR_PTR(-ENOMEM); ++ } + + lock->l_req_mode = mode; + lock->l_ast_data = data; +@@ -1609,6 +1611,8 @@ out: + return ERR_PTR(rc); + } + ++ ++ + /** + * Enqueue (request) a lock. + * On the client this is called from ldlm_cli_enqueue_fini diff --git a/queue-4.17/staging-lustre-llite-correct-removexattr-detection.patch b/queue-4.17/staging-lustre-llite-correct-removexattr-detection.patch new file mode 100644 index 00000000000..a9642d41932 --- /dev/null +++ b/queue-4.17/staging-lustre-llite-correct-removexattr-detection.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: James Simmons +Date: Mon, 16 Apr 2018 00:15:10 -0400 +Subject: staging: lustre: llite: correct removexattr detection + +From: James Simmons + +[ Upstream commit 1b60f6dfa38403ff7c4d0b4b7ecdb810f9789a2a ] + +In ll_xattr_set_common() detect the removexattr() case correctly by +testing for a NULL value as well as XATTR_REPLACE. + +Signed-off-by: John L. Hammond +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10787 +Reviewed-on: https://review.whamcloud.com/ +Reviewed-by: Dmitry Eremin +Reviewed-by: James Simmons +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/llite/xattr.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/staging/lustre/lustre/llite/xattr.c ++++ b/drivers/staging/lustre/lustre/llite/xattr.c +@@ -94,7 +94,11 @@ ll_xattr_set_common(const struct xattr_h + __u64 valid; + int rc; + +- if (flags == XATTR_REPLACE) { ++ /* When setxattr() is called with a size of 0 the value is ++ * unconditionally replaced by "". When removexattr() is ++ * called we get a NULL value and XATTR_REPLACE for flags. ++ */ ++ if (!value && flags == XATTR_REPLACE) { + ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_REMOVEXATTR, 1); + valid = OBD_MD_FLXATTRRM; + } else { diff --git a/queue-4.17/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch b/queue-4.17/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch new file mode 100644 index 00000000000..34183240d67 --- /dev/null +++ b/queue-4.17/staging-lustre-o2iblnd-fix-fastreg-map-unmap-for-mlx5.patch @@ -0,0 +1,80 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Doug Oucharek +Date: Tue, 1 May 2018 23:49:18 -0400 +Subject: staging: lustre: o2iblnd: Fix FastReg map/unmap for MLX5 + +From: Doug Oucharek + +[ Upstream commit 24d4b7c8de007cff9c7d83c06ae76099fdcce008 ] + +The FastReg support in ko2iblnd was not unmapping pool items +causing the items to leak. In addition, the mapping code +is not growing the pool like we do with FMR. + +This patch makes sure we are unmapping FastReg pool elements +when we are done with them. It also makes sure the pool +will grow when we depleat the pool. + +Signed-off-by: Doug Oucharek +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9472 +Reviewed-on: https://review.whamcloud.com/27015 +Reviewed-by: Andrew Perepechko +Reviewed-by: Dmitry Eremin +Reviewed-by: James Simmons +Reviewed-by: Oleg Drokin +Signed-off-by: Doug Oucharek +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c | 2 +- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 12 ++++-------- + 2 files changed, 5 insertions(+), 9 deletions(-) + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +@@ -1702,7 +1702,7 @@ int kiblnd_fmr_pool_map(struct kib_fmr_p + return 0; + } + spin_unlock(&fps->fps_lock); +- rc = -EBUSY; ++ rc = -EAGAIN; + } + + spin_lock(&fps->fps_lock); +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -48,7 +48,7 @@ static int kiblnd_init_rdma(struct kib_c + __u64 dstcookie); + static void kiblnd_queue_tx_locked(struct kib_tx *tx, struct kib_conn *conn); + static void kiblnd_queue_tx(struct kib_tx *tx, struct kib_conn *conn); +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx); ++static void kiblnd_unmap_tx(struct kib_tx *tx); + static void kiblnd_check_sends_locked(struct kib_conn *conn); + + static void +@@ -66,7 +66,7 @@ kiblnd_tx_done(struct lnet_ni *ni, struc + LASSERT(!tx->tx_waiting); /* mustn't be awaiting peer response */ + LASSERT(tx->tx_pool); + +- kiblnd_unmap_tx(ni, tx); ++ kiblnd_unmap_tx(tx); + + /* tx may have up to 2 lnet msgs to finalise */ + lntmsg[0] = tx->tx_lntmsg[0]; tx->tx_lntmsg[0] = NULL; +@@ -591,13 +591,9 @@ kiblnd_fmr_map_tx(struct kib_net *net, s + return 0; + } + +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx) ++static void kiblnd_unmap_tx(struct kib_tx *tx) + { +- struct kib_net *net = ni->ni_data; +- +- LASSERT(net); +- +- if (net->ibn_fmr_ps) ++ if (tx->fmr.fmr_pfmr || tx->fmr.fmr_frd) + kiblnd_fmr_pool_unmap(&tx->fmr, tx->tx_status); + + if (tx->tx_nfrags) { diff --git a/queue-4.17/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch b/queue-4.17/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch new file mode 100644 index 00000000000..0578125e6f3 --- /dev/null +++ b/queue-4.17/staging-lustre-o2iblnd-fix-race-at-kiblnd_connect_peer.patch @@ -0,0 +1,63 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Doug Oucahrek +Date: Tue, 1 May 2018 22:22:19 -0700 +Subject: staging: lustre: o2iblnd: fix race at kiblnd_connect_peer + +From: Doug Oucahrek + +[ Upstream commit cf04968efe341b9b1c30a527e5dd61b2af9c43d2 ] + +cmid will be destroyed at OFED if kiblnd_cm_callback return error. +if error happen before the end of kiblnd_connect_peer, it will touch +destroyed cmid and fail as +(o2iblnd_cb.c:1315:kiblnd_connect_peer()) + ASSERTION( cmid->device != ((void *)0) ) failed: + +Signed-off-by: Alexander Boyko +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-10015 +Reviewed-by: Alexey Lyashkov +Reviewed-by: Doug Oucharek +Reviewed-by: John L. Hammond +Signed-off-by: Doug Oucharek +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c | 18 +++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -1290,11 +1290,6 @@ kiblnd_connect_peer(struct kib_peer *pee + goto failed2; + } + +- LASSERT(cmid->device); +- CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n", +- libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname, +- &dev->ibd_ifip, cmid->device->name); +- + return; + + failed2: +@@ -2996,8 +2991,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cm + } else { + rc = rdma_resolve_route( + cmid, *kiblnd_tunables.kib_timeout * 1000); +- if (!rc) ++ if (!rc) { ++ struct kib_net *net = peer->ibp_ni->ni_data; ++ struct kib_dev *dev = net->ibn_dev; ++ ++ CDEBUG(D_NET, "%s: connection bound to "\ ++ "%s:%pI4h:%s\n", ++ libcfs_nid2str(peer->ibp_nid), ++ dev->ibd_ifname, ++ &dev->ibd_ifip, cmid->device->name); ++ + return 0; ++ } ++ + /* Can't initiate route resolution */ + CERROR("Can't resolve route for %s: %d\n", + libcfs_nid2str(peer->ibp_nid), rc); diff --git a/queue-4.17/staging-most-cdev-fix-chrdev_region-leak.patch b/queue-4.17/staging-most-cdev-fix-chrdev_region-leak.patch new file mode 100644 index 00000000000..85c26b5d173 --- /dev/null +++ b/queue-4.17/staging-most-cdev-fix-chrdev_region-leak.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Christian Gromm +Date: Tue, 8 May 2018 11:45:06 +0200 +Subject: staging: most: cdev: fix chrdev_region leak + +From: Christian Gromm + +[ Upstream commit aba258b73101670c06b1dd700e500ed0a3fa0e8e ] + +The function unregister_chrdev_region is called with a different counter +as the alloc_chrdev_region. To fix this, this patch introduces the +constant CHRDEV_REGION_SIZE that is used in both functions. + +Signed-off-by: Christian Gromm +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/most/cdev/cdev.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/staging/most/cdev/cdev.c ++++ b/drivers/staging/most/cdev/cdev.c +@@ -18,6 +18,8 @@ + #include + #include "most/core.h" + ++#define CHRDEV_REGION_SIZE 50 ++ + static struct cdev_component { + dev_t devno; + struct ida minor_id; +@@ -513,7 +515,7 @@ static int __init mod_init(void) + spin_lock_init(&ch_list_lock); + ida_init(&comp.minor_id); + +- err = alloc_chrdev_region(&comp.devno, 0, 50, "cdev"); ++ err = alloc_chrdev_region(&comp.devno, 0, CHRDEV_REGION_SIZE, "cdev"); + if (err < 0) + goto dest_ida; + comp.major = MAJOR(comp.devno); +@@ -523,7 +525,7 @@ static int __init mod_init(void) + return 0; + + free_cdev: +- unregister_chrdev_region(comp.devno, 1); ++ unregister_chrdev_region(comp.devno, CHRDEV_REGION_SIZE); + dest_ida: + ida_destroy(&comp.minor_id); + class_destroy(comp.class); diff --git a/queue-4.17/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch b/queue-4.17/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch new file mode 100644 index 00000000000..a76705915f9 --- /dev/null +++ b/queue-4.17/staging-vchiq_core-fix-missing-semaphore-release-in-error-case.patch @@ -0,0 +1,32 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Stefan Wahren +Date: Sat, 31 Mar 2018 22:09:37 +0200 +Subject: staging: vchiq_core: Fix missing semaphore release in error case + +From: Stefan Wahren + +[ Upstream commit 8113b89fc615cfb531df0334fb3a091cf6a45ce0 ] + +The bail out branch in case of a invalid tx_pos missed a semaphore +release. Dan Carpenter found this with a static checker. + +Fixes: d1eab9dec610 ("staging: vchiq_core: Bail out in case of invalid tx_pos") +Reported-by: Dan Carpenter +Signed-off-by: Stefan Wahren +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -601,6 +601,7 @@ reserve_space(VCHIQ_STATE_T *state, size + } + + if (tx_pos == (state->slot_queue_available * VCHIQ_SLOT_SIZE)) { ++ up(&state->slot_available_event); + pr_warn("%s: invalid tx_pos: %d\n", __func__, tx_pos); + return NULL; + } diff --git a/queue-4.17/stop_machine-use-raw-spinlocks.patch b/queue-4.17/stop_machine-use-raw-spinlocks.patch new file mode 100644 index 00000000000..38c721ecc74 --- /dev/null +++ b/queue-4.17/stop_machine-use-raw-spinlocks.patch @@ -0,0 +1,109 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Thomas Gleixner +Date: Mon, 23 Apr 2018 21:16:35 +0200 +Subject: stop_machine: Use raw spinlocks + +From: Thomas Gleixner + +[ Upstream commit de5b55c1d4e30740009864eb35ce4ed856aac01d ] + +Use raw-locks in stop_machine() to allow locking in irq-off and +preempt-disabled regions on -RT. This also documents the possible locking +context in general. + +[bigeasy: update patch description.] +Signed-off-by: Thomas Gleixner +Signed-off-by: Sebastian Andrzej Siewior +Link: https://lkml.kernel.org/r/20180423191635.6014-1-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/stop_machine.c | 24 ++++++++++++------------ + 1 file changed, 12 insertions(+), 12 deletions(-) + +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -37,7 +37,7 @@ struct cpu_stop_done { + struct cpu_stopper { + struct task_struct *thread; + +- spinlock_t lock; ++ raw_spinlock_t lock; + bool enabled; /* is this stopper enabled? */ + struct list_head works; /* list of pending works */ + +@@ -81,13 +81,13 @@ static bool cpu_stop_queue_work(unsigned + unsigned long flags; + bool enabled; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + enabled = stopper->enabled; + if (enabled) + __cpu_stop_queue_work(stopper, work, &wakeq); + else if (work->done) + cpu_stop_signal_done(work->done); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + + wake_up_q(&wakeq); + +@@ -237,8 +237,8 @@ static int cpu_stop_queue_two_works(int + DEFINE_WAKE_Q(wakeq); + int err; + retry: +- spin_lock_irq(&stopper1->lock); +- spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); ++ raw_spin_lock_irq(&stopper1->lock); ++ raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); + + err = -ENOENT; + if (!stopper1->enabled || !stopper2->enabled) +@@ -261,8 +261,8 @@ retry: + __cpu_stop_queue_work(stopper1, work1, &wakeq); + __cpu_stop_queue_work(stopper2, work2, &wakeq); + unlock: +- spin_unlock(&stopper2->lock); +- spin_unlock_irq(&stopper1->lock); ++ raw_spin_unlock(&stopper2->lock); ++ raw_spin_unlock_irq(&stopper1->lock); + + if (unlikely(err == -EDEADLK)) { + while (stop_cpus_in_progress) +@@ -461,9 +461,9 @@ static int cpu_stop_should_run(unsigned + unsigned long flags; + int run; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + run = !list_empty(&stopper->works); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + return run; + } + +@@ -474,13 +474,13 @@ static void cpu_stopper_thread(unsigned + + repeat: + work = NULL; +- spin_lock_irq(&stopper->lock); ++ raw_spin_lock_irq(&stopper->lock); + if (!list_empty(&stopper->works)) { + work = list_first_entry(&stopper->works, + struct cpu_stop_work, list); + list_del_init(&work->list); + } +- spin_unlock_irq(&stopper->lock); ++ raw_spin_unlock_irq(&stopper->lock); + + if (work) { + cpu_stop_fn_t fn = work->fn; +@@ -554,7 +554,7 @@ static int __init cpu_stop_init(void) + for_each_possible_cpu(cpu) { + struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu); + +- spin_lock_init(&stopper->lock); ++ raw_spin_lock_init(&stopper->lock); + INIT_LIST_HEAD(&stopper->works); + } + diff --git a/queue-4.17/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch b/queue-4.17/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch new file mode 100644 index 00000000000..b73b74cd317 --- /dev/null +++ b/queue-4.17/thermal-exynos-fix-setting-rising_threshold-for-exynos5433.patch @@ -0,0 +1,30 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Bartlomiej Zolnierkiewicz +Date: Thu, 26 Apr 2018 13:51:16 +0200 +Subject: thermal: exynos: fix setting rising_threshold for Exynos5433 + +From: Bartlomiej Zolnierkiewicz + +[ Upstream commit 8bfc218d0ebbabcba8ed2b8ec1831e0cf1f71629 ] + +Add missing clearing of the previous value when setting rising +temperature threshold. + +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/thermal/samsung/exynos_tmu.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(str + threshold_code = temp_to_code(data, temp); + + rising_threshold = readl(data->base + rising_reg_offset); ++ rising_threshold &= ~(0xff << j * 8); + rising_threshold |= (threshold_code << j * 8); + writel(rising_threshold, data->base + rising_reg_offset); + diff --git a/queue-4.17/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch b/queue-4.17/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch new file mode 100644 index 00000000000..888d41274af --- /dev/null +++ b/queue-4.17/tick-prefer-a-lower-rating-device-only-if-it-s-cpu-local-device.patch @@ -0,0 +1,40 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Sudeep Holla +Date: Wed, 9 May 2018 17:02:08 +0100 +Subject: tick: Prefer a lower rating device only if it's CPU local device + +From: Sudeep Holla + +[ Upstream commit 1332a90558013ae4242e3dd7934bdcdeafb06c0d ] + +Checking the equality of cpumask for both new and old tick device doesn't +ensure that it's CPU local device. This will cause issue if a low rating +clockevent tick device is registered first followed by the registration +of higher rating clockevent tick device. + +In such case, clockevents_released list will never get emptied as both +the devices get selected as preferred one and we will loop forever in +clockevents_notify_released. + +Signed-off-by: Sudeep Holla +Signed-off-by: Thomas Gleixner +Cc: Frederic Weisbecker +Link: https://lkml.kernel.org/r/1525881728-4858-1-git-send-email-sudeep.holla@arm.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/tick-common.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -277,7 +277,8 @@ static bool tick_check_preferred(struct + */ + return !curdev || + newdev->rating > curdev->rating || +- !cpumask_equal(curdev->cpumask, newdev->cpumask); ++ (!cpumask_equal(curdev->cpumask, newdev->cpumask) && ++ !tick_check_percpu(curdev, newdev, smp_processor_id())); + } + + /* diff --git a/queue-4.17/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch b/queue-4.17/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch new file mode 100644 index 00000000000..71bad333d18 --- /dev/null +++ b/queue-4.17/tty-fix-data-race-in-tty_insert_flip_string_fixed_flag.patch @@ -0,0 +1,96 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: DaeRyong Jeong +Date: Tue, 1 May 2018 00:27:04 +0900 +Subject: tty: Fix data race in tty_insert_flip_string_fixed_flag + +From: DaeRyong Jeong + +[ Upstream commit b6da31b2c07c46f2dcad1d86caa835227a16d9ff ] + +Unlike normal serials, in pty layer, there is no guarantee that multiple +threads don't insert input characters at the same time. If it is happened, +tty_insert_flip_string_fixed_flag can be executed concurrently. This can +lead slab out-of-bounds write in tty_insert_flip_string_fixed_flag. + +Call sequences are as follows. +CPU0 CPU1 +n_tty_ioctl_helper n_tty_ioctl_helper +__start_tty tty_send_xchar +tty_wakeup pty_write +n_hdlc_tty_wakeup tty_insert_flip_string +n_hdlc_send_frames tty_insert_flip_string_fixed_flag +pty_write +tty_insert_flip_string +tty_insert_flip_string_fixed_flag + +To fix the race, acquire port->lock in pty_write() before it inserts input +characters to tty buffer. It prevents multiple threads from inserting +input characters concurrently. + +The crash log is as follows: +BUG: KASAN: slab-out-of-bounds in tty_insert_flip_string_fixed_flag+0xb5/ +0x130 drivers/tty/tty_buffer.c:316 at addr ffff880114fcc121 +Write of size 1792 by task syz-executor0/30017 +CPU: 1 PID: 30017 Comm: syz-executor0 Not tainted 4.8.0 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), +BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014 + 0000000000000000 ffff88011638f888 ffffffff81694cc3 ffff88007d802140 + ffff880114fcb300 ffff880114fcc300 ffff880114fcb300 ffff88011638f8b0 + ffffffff8130075c ffff88011638f940 ffff88007d802140 ffff880194fcc121 +Call Trace: + __dump_stack lib/dump_stack.c:15 [inline] + dump_stack+0xb3/0x110 lib/dump_stack.c:51 + kasan_object_err+0x1c/0x70 mm/kasan/report.c:156 + print_address_description mm/kasan/report.c:194 [inline] + kasan_report_error+0x1f7/0x4e0 mm/kasan/report.c:283 + kasan_report+0x36/0x40 mm/kasan/report.c:303 + check_memory_region_inline mm/kasan/kasan.c:292 [inline] + check_memory_region+0x13e/0x1a0 mm/kasan/kasan.c:299 + memcpy+0x37/0x50 mm/kasan/kasan.c:335 + tty_insert_flip_string_fixed_flag+0xb5/0x130 drivers/tty/tty_buffer.c:316 + tty_insert_flip_string include/linux/tty_flip.h:35 [inline] + pty_write+0x7f/0xc0 drivers/tty/pty.c:115 + n_hdlc_send_frames+0x1d4/0x3b0 drivers/tty/n_hdlc.c:419 + n_hdlc_tty_wakeup+0x73/0xa0 drivers/tty/n_hdlc.c:496 + tty_wakeup+0x92/0xb0 drivers/tty/tty_io.c:601 + __start_tty.part.26+0x66/0x70 drivers/tty/tty_io.c:1018 + __start_tty+0x34/0x40 drivers/tty/tty_io.c:1013 + n_tty_ioctl_helper+0x146/0x1e0 drivers/tty/tty_ioctl.c:1138 + n_hdlc_tty_ioctl+0xb3/0x2b0 drivers/tty/n_hdlc.c:794 + tty_ioctl+0xa85/0x16d0 drivers/tty/tty_io.c:2992 + vfs_ioctl fs/ioctl.c:43 [inline] + do_vfs_ioctl+0x13e/0xba0 fs/ioctl.c:679 + SYSC_ioctl fs/ioctl.c:694 [inline] + SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 + entry_SYSCALL_64_fastpath+0x1f/0xbd + +Signed-off-by: DaeRyong Jeong +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/pty.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -110,16 +110,19 @@ static void pty_unthrottle(struct tty_st + static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) + { + struct tty_struct *to = tty->link; ++ unsigned long flags; + + if (tty->stopped) + return 0; + + if (c > 0) { ++ spin_lock_irqsave(&to->port->lock, flags); + /* Stuff the data into the input queue of the other end */ + c = tty_insert_flip_string(to->port, buf, c); + /* And shovel */ + if (c) + tty_flip_buffer_push(to->port); ++ spin_unlock_irqrestore(&to->port->lock, flags); + } + return c; + } diff --git a/queue-4.17/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch b/queue-4.17/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch new file mode 100644 index 00000000000..532a8fa4907 --- /dev/null +++ b/queue-4.17/usb-hub-don-t-wait-for-connect-state-at-resume-for-powered-off-ports.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Dominik Bozek +Date: Fri, 13 Apr 2018 10:42:31 -0700 +Subject: usb: hub: Don't wait for connect state at resume for powered-off ports + +From: Dominik Bozek + +[ Upstream commit 5d111f5190848d6fb1c414dc57797efea3526a2f ] + +wait_for_connected() wait till a port change status to +USB_PORT_STAT_CONNECTION, but this is not possible if +the port is unpowered. The loop will only exit at timeout. + +Such case take place if an over-current incident happen +while system is in S3. Then during resume wait_for_connected() +will wait 2s, which may be noticeable by the user. + +Signed-off-by: Dominik Bozek +Signed-off-by: Kuppuswamy Sathyanarayanan +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hub.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3380,6 +3380,10 @@ static int wait_for_connected(struct usb + while (delay_ms < 2000) { + if (status || *portstatus & USB_PORT_STAT_CONNECTION) + break; ++ if (!port_is_power_on(hub, *portstatus)) { ++ status = -ENODEV; ++ break; ++ } + msleep(20); + delay_ms += 20; + status = hub_port_status(hub, *port1, portstatus, portchange); diff --git a/queue-4.17/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch b/queue-4.17/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch new file mode 100644 index 00000000000..9e824b2888e --- /dev/null +++ b/queue-4.17/usbip-dynamically-allocate-idev-by-nports-found-in-sysfs.patch @@ -0,0 +1,120 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Michael Grzeschik +Date: Fri, 25 May 2018 16:23:46 +0200 +Subject: usbip: dynamically allocate idev by nports found in sysfs + +From: Michael Grzeschik + +[ Upstream commit de19ca6fd72c7dd45ad82403e7b3fe9c74ef6767 ] + +As the amount of available ports varies by the kernels build +configuration. To remove the limitation of the fixed 128 ports +we allocate the amount of idevs by using the number we get +from the kernel. + +Signed-off-by: Michael Grzeschik +Acked-by: Shuah Khan (Samsung OSG) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/libsrc/vhci_driver.c | 32 +++++++++++++++++++------------- + tools/usb/usbip/libsrc/vhci_driver.h | 3 +-- + 2 files changed, 20 insertions(+), 15 deletions(-) + +--- a/tools/usb/usbip/libsrc/vhci_driver.c ++++ b/tools/usb/usbip/libsrc/vhci_driver.c +@@ -135,11 +135,11 @@ static int refresh_imported_device_list( + return 0; + } + +-static int get_nports(void) ++static int get_nports(struct udev_device *hc_device) + { + const char *attr_nports; + +- attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports"); ++ attr_nports = udev_device_get_sysattr_value(hc_device, "nports"); + if (!attr_nports) { + err("udev_device_get_sysattr_value nports failed"); + return -1; +@@ -242,35 +242,41 @@ static int read_record(int rhport, char + + int usbip_vhci_driver_open(void) + { ++ int nports; ++ struct udev_device *hc_device; ++ + udev_context = udev_new(); + if (!udev_context) { + err("udev_new failed"); + return -1; + } + +- vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver)); +- + /* will be freed in usbip_driver_close() */ +- vhci_driver->hc_device = ++ hc_device = + udev_device_new_from_subsystem_sysname(udev_context, + USBIP_VHCI_BUS_TYPE, + USBIP_VHCI_DEVICE_NAME); +- if (!vhci_driver->hc_device) { ++ if (!hc_device) { + err("udev_device_new_from_subsystem_sysname failed"); + goto err; + } + +- vhci_driver->nports = get_nports(); +- dbg("available ports: %d", vhci_driver->nports); +- +- if (vhci_driver->nports <= 0) { ++ nports = get_nports(hc_device); ++ if (nports <= 0) { + err("no available ports"); + goto err; +- } else if (vhci_driver->nports > MAXNPORT) { +- err("port number exceeds %d", MAXNPORT); ++ } ++ dbg("available ports: %d", nports); ++ ++ vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) + ++ nports * sizeof(struct usbip_imported_device)); ++ if (!vhci_driver) { ++ err("vhci_driver allocation failed"); + goto err; + } + ++ vhci_driver->nports = nports; ++ vhci_driver->hc_device = hc_device; + vhci_driver->ncontrollers = get_ncontrollers(); + dbg("available controllers: %d", vhci_driver->ncontrollers); + +@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void) + return 0; + + err: +- udev_device_unref(vhci_driver->hc_device); ++ udev_device_unref(hc_device); + + if (vhci_driver) + free(vhci_driver); +--- a/tools/usb/usbip/libsrc/vhci_driver.h ++++ b/tools/usb/usbip/libsrc/vhci_driver.h +@@ -13,7 +13,6 @@ + + #define USBIP_VHCI_BUS_TYPE "platform" + #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0" +-#define MAXNPORT 128 + + enum hub_speed { + HUB_SPEED_HIGH = 0, +@@ -41,7 +40,7 @@ struct usbip_vhci_driver { + + int ncontrollers; + int nports; +- struct usbip_imported_device idev[MAXNPORT]; ++ struct usbip_imported_device idev[]; + }; + + diff --git a/queue-4.17/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch b/queue-4.17/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch new file mode 100644 index 00000000000..a23651c36ea --- /dev/null +++ b/queue-4.17/usbip-usbip_detach-fix-memory-udev-context-and-udev-leak.patch @@ -0,0 +1,48 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: "Shuah Khan (Samsung OSG)" +Date: Tue, 29 May 2018 16:13:03 -0600 +Subject: usbip: usbip_detach: Fix memory, udev context and udev leak + +From: "Shuah Khan (Samsung OSG)" + +[ Upstream commit d179f99a651685b19333360e6558110da2fe9bd7 ] + +detach_port() fails to call usbip_vhci_driver_close() from its error +path after usbip_vhci_detach_device() returns failure, leaking memory +allocated in usbip_vhci_driver_open() and holding udev_context and udev +references. Fix it to call usbip_vhci_driver_close(). + +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/usb/usbip/src/usbip_detach.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/tools/usb/usbip/src/usbip_detach.c ++++ b/tools/usb/usbip/src/usbip_detach.c +@@ -43,7 +43,7 @@ void usbip_detach_usage(void) + + static int detach_port(char *port) + { +- int ret; ++ int ret = 0; + uint8_t portnum; + char path[PATH_MAX+1]; + +@@ -73,9 +73,12 @@ static int detach_port(char *port) + } + + ret = usbip_vhci_detach_device(portnum); +- if (ret < 0) +- return -1; ++ if (ret < 0) { ++ ret = -1; ++ goto call_driver_close; ++ } + ++call_driver_close: + usbip_vhci_driver_close(); + + return ret; diff --git a/queue-4.17/vfio-mdev-check-globally-for-duplicate-devices.patch b/queue-4.17/vfio-mdev-check-globally-for-duplicate-devices.patch new file mode 100644 index 00000000000..75951ec4da7 --- /dev/null +++ b/queue-4.17/vfio-mdev-check-globally-for-duplicate-devices.patch @@ -0,0 +1,284 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alex Williamson +Date: Tue, 15 May 2018 13:53:55 -0600 +Subject: vfio/mdev: Check globally for duplicate devices + +From: Alex Williamson + +[ Upstream commit 002fe996f67f4f46d8917b14cfb6e4313c20685a ] + +When we create an mdev device, we check for duplicates against the +parent device and return -EEXIST if found, but the mdev device +namespace is global since we'll link all devices from the bus. We do +catch this later in sysfs_do_create_link_sd() to return -EEXIST, but +with it comes a kernel warning and stack trace for trying to create +duplicate sysfs links, which makes it an undesirable response. + +Therefore we should really be looking for duplicates across all mdev +parent devices, or as implemented here, against our mdev device list. +Using mdev_list to prevent duplicates means that we can remove +mdev_parent.lock, but in order not to serialize mdev device creation +and removal globally, we add mdev_device.active which allows UUIDs to +be reserved such that we can drop the mdev_list_lock before the mdev +device is fully in place. + +Two behavioral notes; first, mdev_parent.lock had the side-effect of +serializing mdev create and remove ops per parent device. This was +an implementation detail, not an intentional guarantee provided to +the mdev vendor drivers. Vendor drivers can trivially provide this +serialization internally if necessary. Second, review comments note +the new -EAGAIN behavior when the device, and in particular the remove +attribute, becomes visible in sysfs. If a remove is triggered prior +to completion of mdev_device_create() the user will see a -EAGAIN +error. While the errno is different, receiving an error during this +period is not, the previous implementation returned -ENODEV for the +same condition. Furthermore, the consistency to the user is improved +in the case where mdev_device_remove_ops() returns error. Previously +concurrent calls to mdev_device_remove() could see the device +disappear with -ENODEV and return in the case of error. Now a user +would see -EAGAIN while the device is in this transitory state. + +Reviewed-by: Kirti Wankhede +Reviewed-by: Cornelia Huck +Acked-by: Halil Pasic +Acked-by: Zhenyu Wang +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/vfio-mediated-device.txt | 5 + + drivers/vfio/mdev/mdev_core.c | 102 +++++++++++---------------------- + drivers/vfio/mdev/mdev_private.h | 2 + 3 files changed, 42 insertions(+), 67 deletions(-) + +--- a/Documentation/vfio-mediated-device.txt ++++ b/Documentation/vfio-mediated-device.txt +@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops str + * create: allocate basic resources in a driver for a mediated device + * remove: free resources in a driver when a mediated device is destroyed + ++(Note that mdev-core provides no implicit serialization of create/remove ++callbacks per mdev parent device, per mdev type, or any other categorization. ++Vendor drivers are expected to be fully asynchronous in this respect or ++provide their own internal resource protection.) ++ + The callbacks in the mdev_parent_ops structure are as follows: + + * open: open callback of mediated device +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -66,34 +66,6 @@ uuid_le mdev_uuid(struct mdev_device *md + } + EXPORT_SYMBOL(mdev_uuid); + +-static int _find_mdev_device(struct device *dev, void *data) +-{ +- struct mdev_device *mdev; +- +- if (!dev_is_mdev(dev)) +- return 0; +- +- mdev = to_mdev_device(dev); +- +- if (uuid_le_cmp(mdev->uuid, *(uuid_le *)data) == 0) +- return 1; +- +- return 0; +-} +- +-static bool mdev_device_exist(struct mdev_parent *parent, uuid_le uuid) +-{ +- struct device *dev; +- +- dev = device_find_child(parent->dev, &uuid, _find_mdev_device); +- if (dev) { +- put_device(dev); +- return true; +- } +- +- return false; +-} +- + /* Should be called holding parent_list_lock */ + static struct mdev_parent *__find_parent_device(struct device *dev) + { +@@ -221,7 +193,6 @@ int mdev_register_device(struct device * + } + + kref_init(&parent->ref); +- mutex_init(&parent->lock); + + parent->dev = dev; + parent->ops = ops; +@@ -297,6 +268,10 @@ static void mdev_device_release(struct d + { + struct mdev_device *mdev = to_mdev_device(dev); + ++ mutex_lock(&mdev_list_lock); ++ list_del(&mdev->next); ++ mutex_unlock(&mdev_list_lock); ++ + dev_dbg(&mdev->dev, "MDEV: destroying\n"); + kfree(mdev); + } +@@ -304,7 +279,7 @@ static void mdev_device_release(struct d + int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid) + { + int ret; +- struct mdev_device *mdev; ++ struct mdev_device *mdev, *tmp; + struct mdev_parent *parent; + struct mdev_type *type = to_mdev_type(kobj); + +@@ -312,21 +287,28 @@ int mdev_device_create(struct kobject *k + if (!parent) + return -EINVAL; + +- mutex_lock(&parent->lock); ++ mutex_lock(&mdev_list_lock); + + /* Check for duplicate */ +- if (mdev_device_exist(parent, uuid)) { +- ret = -EEXIST; +- goto create_err; ++ list_for_each_entry(tmp, &mdev_list, next) { ++ if (!uuid_le_cmp(tmp->uuid, uuid)) { ++ mutex_unlock(&mdev_list_lock); ++ ret = -EEXIST; ++ goto mdev_fail; ++ } + } + + mdev = kzalloc(sizeof(*mdev), GFP_KERNEL); + if (!mdev) { ++ mutex_unlock(&mdev_list_lock); + ret = -ENOMEM; +- goto create_err; ++ goto mdev_fail; + } + + memcpy(&mdev->uuid, &uuid, sizeof(uuid_le)); ++ list_add(&mdev->next, &mdev_list); ++ mutex_unlock(&mdev_list_lock); ++ + mdev->parent = parent; + kref_init(&mdev->ref); + +@@ -338,35 +320,28 @@ int mdev_device_create(struct kobject *k + ret = device_register(&mdev->dev); + if (ret) { + put_device(&mdev->dev); +- goto create_err; ++ goto mdev_fail; + } + + ret = mdev_device_create_ops(kobj, mdev); + if (ret) +- goto create_failed; ++ goto create_fail; + + ret = mdev_create_sysfs_files(&mdev->dev, type); + if (ret) { + mdev_device_remove_ops(mdev, true); +- goto create_failed; ++ goto create_fail; + } + + mdev->type_kobj = kobj; ++ mdev->active = true; + dev_dbg(&mdev->dev, "MDEV: created\n"); + +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- +- return ret; ++ return 0; + +-create_failed: ++create_fail: + device_unregister(&mdev->dev); +- +-create_err: +- mutex_unlock(&parent->lock); ++mdev_fail: + mdev_put_parent(parent); + return ret; + } +@@ -377,44 +352,39 @@ int mdev_device_remove(struct device *de + struct mdev_parent *parent; + struct mdev_type *type; + int ret; +- bool found = false; + + mdev = to_mdev_device(dev); + + mutex_lock(&mdev_list_lock); + list_for_each_entry(tmp, &mdev_list, next) { +- if (tmp == mdev) { +- found = true; ++ if (tmp == mdev) + break; +- } + } + +- if (found) +- list_del(&mdev->next); ++ if (tmp != mdev) { ++ mutex_unlock(&mdev_list_lock); ++ return -ENODEV; ++ } + +- mutex_unlock(&mdev_list_lock); ++ if (!mdev->active) { ++ mutex_unlock(&mdev_list_lock); ++ return -EAGAIN; ++ } + +- if (!found) +- return -ENODEV; ++ mdev->active = false; ++ mutex_unlock(&mdev_list_lock); + + type = to_mdev_type(mdev->type_kobj); + parent = mdev->parent; +- mutex_lock(&parent->lock); + + ret = mdev_device_remove_ops(mdev, force_remove); + if (ret) { +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- ++ mdev->active = true; + return ret; + } + + mdev_remove_sysfs_files(dev, type); + device_unregister(dev); +- mutex_unlock(&parent->lock); + mdev_put_parent(parent); + + return 0; +--- a/drivers/vfio/mdev/mdev_private.h ++++ b/drivers/vfio/mdev/mdev_private.h +@@ -20,7 +20,6 @@ struct mdev_parent { + struct device *dev; + const struct mdev_parent_ops *ops; + struct kref ref; +- struct mutex lock; + struct list_head next; + struct kset *mdev_types_kset; + struct list_head type_list; +@@ -34,6 +33,7 @@ struct mdev_device { + struct kref ref; + struct list_head next; + struct kobject *type_kobj; ++ bool active; + }; + + #define to_mdev_device(dev) container_of(dev, struct mdev_device, dev) diff --git a/queue-4.17/vfio-platform-fix-reset-module-leak-in-error-path.patch b/queue-4.17/vfio-platform-fix-reset-module-leak-in-error-path.patch new file mode 100644 index 00000000000..41f35d9c415 --- /dev/null +++ b/queue-4.17/vfio-platform-fix-reset-module-leak-in-error-path.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Geert Uytterhoeven +Date: Wed, 11 Apr 2018 11:15:48 +0200 +Subject: vfio: platform: Fix reset module leak in error path + +From: Geert Uytterhoeven + +[ Upstream commit 28a68387888997e8a7fa57940ea5d55f2e16b594 ] + +If the IOMMU group setup fails, the reset module is not released. + +Fixes: b5add544d677d363 ("vfio, platform: make reset driver a requirement by default") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Eric Auger +Reviewed-by: Simon Horman +Acked-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/platform/vfio_platform_common.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vf + group = vfio_iommu_group_get(dev); + if (!group) { + pr_err("VFIO: No IOMMU group for device %s\n", vdev->name); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_reset; + } + + ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev); +- if (ret) { +- vfio_iommu_group_put(group, dev); +- return ret; +- } ++ if (ret) ++ goto put_iommu; + + mutex_init(&vdev->igate); + + return 0; ++ ++put_iommu: ++ vfio_iommu_group_put(group, dev); ++put_reset: ++ vfio_platform_put_reset(vdev); ++ return ret; + } + EXPORT_SYMBOL_GPL(vfio_platform_probe_common); + diff --git a/queue-4.17/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch b/queue-4.17/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch new file mode 100644 index 00000000000..ca4e05bb6ec --- /dev/null +++ b/queue-4.17/vfio-type1-fix-task-tracking-for-qemu-vcpu-hotplug.patch @@ -0,0 +1,241 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Alex Williamson +Date: Fri, 11 May 2018 09:05:02 -0600 +Subject: vfio/type1: Fix task tracking for QEMU vCPU hotplug + +From: Alex Williamson + +[ Upstream commit 48d8476b41eed63567dd2f0ad125c895b9ac648a ] + +MAP_DMA ioctls might be called from various threads within a process, +for example when using QEMU, the vCPU threads are often generating +these calls and we therefore take a reference to that vCPU task. +However, QEMU also supports vCPU hotplug on some machines and the task +that called MAP_DMA may have exited by the time UNMAP_DMA is called, +resulting in the mm_struct pointer being NULL and thus a failure to +match against the existing mapping. + +To resolve this, we instead take a reference to the thread +group_leader, which has the same mm_struct and resource limits, but +is less likely exit, at least in the QEMU case. A difficulty here is +guaranteeing that the capabilities of the group_leader match that of +the calling thread, which we resolve by tracking CAP_IPC_LOCK at the +time of calling rather than at an indeterminate time in the future. +Potentially this also results in better efficiency as this is now +recorded once per MAP_DMA ioctl. + +Reported-by: Xu Yandong +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/vfio_iommu_type1.c | 73 +++++++++++++++++++++++++--------------- + 1 file changed, 47 insertions(+), 26 deletions(-) + +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -83,6 +83,7 @@ struct vfio_dma { + size_t size; /* Map size (bytes) */ + int prot; /* IOMMU_READ/WRITE */ + bool iommu_mapped; ++ bool lock_cap; /* capable(CAP_IPC_LOCK) */ + struct task_struct *task; + struct rb_root pfn_list; /* Ex-user pinned pfn list */ + }; +@@ -253,29 +254,25 @@ static int vfio_iova_put_vfio_pfn(struct + return ret; + } + +-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap) ++static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + { + struct mm_struct *mm; +- bool is_current; + int ret; + + if (!npage) + return 0; + +- is_current = (task->mm == current->mm); +- +- mm = is_current ? task->mm : get_task_mm(task); ++ mm = async ? get_task_mm(dma->task) : dma->task->mm; + if (!mm) + return -ESRCH; /* process exited */ + + ret = down_write_killable(&mm->mmap_sem); + if (!ret) { + if (npage > 0) { +- if (lock_cap ? !*lock_cap : +- !has_capability(task, CAP_IPC_LOCK)) { ++ if (!dma->lock_cap) { + unsigned long limit; + +- limit = task_rlimit(task, ++ limit = task_rlimit(dma->task, + RLIMIT_MEMLOCK) >> PAGE_SHIFT; + + if (mm->locked_vm + npage > limit) +@@ -289,7 +286,7 @@ static int vfio_lock_acct(struct task_st + up_write(&mm->mmap_sem); + } + +- if (!is_current) ++ if (async) + mmput(mm); + + return ret; +@@ -398,7 +395,7 @@ static int vaddr_get_pfn(struct mm_struc + */ + static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + long npage, unsigned long *pfn_base, +- bool lock_cap, unsigned long limit) ++ unsigned long limit) + { + unsigned long pfn = 0; + long ret, pinned = 0, lock_acct = 0; +@@ -421,7 +418,7 @@ static long vfio_pin_pages_remote(struct + * pages are already counted against the user. + */ + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && current->mm->locked_vm + 1 > limit) { ++ if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) { + put_pfn(*pfn_base, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__, + limit << PAGE_SHIFT); +@@ -447,7 +444,7 @@ static long vfio_pin_pages_remote(struct + } + + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && ++ if (!dma->lock_cap && + current->mm->locked_vm + lock_acct + 1 > limit) { + put_pfn(pfn, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", +@@ -460,7 +457,7 @@ static long vfio_pin_pages_remote(struct + } + + out: +- ret = vfio_lock_acct(current, lock_acct, &lock_cap); ++ ret = vfio_lock_acct(dma, lock_acct, false); + + unpin_out: + if (ret) { +@@ -491,7 +488,7 @@ static long vfio_unpin_pages_remote(stru + } + + if (do_accounting) +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + + return unlocked; + } +@@ -508,7 +505,7 @@ static int vfio_pin_page_external(struct + + ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base); + if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { +- ret = vfio_lock_acct(dma->task, 1, NULL); ++ ret = vfio_lock_acct(dma, 1, true); + if (ret) { + put_pfn(*pfn_base, dma->prot); + if (ret == -ENOMEM) +@@ -535,7 +532,7 @@ static int vfio_unpin_page_external(stru + unlocked = vfio_iova_put_vfio_pfn(dma, vpfn); + + if (do_accounting) +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + + return unlocked; + } +@@ -827,7 +824,7 @@ static long vfio_unmap_unpin(struct vfio + unlocked += vfio_sync_unpin(dma, domain, &unmapped_region_list); + + if (do_accounting) { +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + return 0; + } + return unlocked; +@@ -1042,14 +1039,12 @@ static int vfio_pin_map_dma(struct vfio_ + size_t size = map_size; + long npage; + unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret = 0; + + while (size) { + /* Pin a contiguous chunk of memory */ + npage = vfio_pin_pages_remote(dma, vaddr + dma->size, +- size >> PAGE_SHIFT, &pfn, +- lock_cap, limit); ++ size >> PAGE_SHIFT, &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1124,8 +1119,36 @@ static int vfio_dma_do_map(struct vfio_i + dma->iova = iova; + dma->vaddr = vaddr; + dma->prot = prot; +- get_task_struct(current); +- dma->task = current; ++ ++ /* ++ * We need to be able to both add to a task's locked memory and test ++ * against the locked memory limit and we need to be able to do both ++ * outside of this call path as pinning can be asynchronous via the ++ * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a ++ * task_struct and VM locked pages requires an mm_struct, however ++ * holding an indefinite mm reference is not recommended, therefore we ++ * only hold a reference to a task. We could hold a reference to ++ * current, however QEMU uses this call path through vCPU threads, ++ * which can be killed resulting in a NULL mm and failure in the unmap ++ * path when called via a different thread. Avoid this problem by ++ * using the group_leader as threads within the same group require ++ * both CLONE_THREAD and CLONE_VM and will therefore use the same ++ * mm_struct. ++ * ++ * Previously we also used the task for testing CAP_IPC_LOCK at the ++ * time of pinning and accounting, however has_capability() makes use ++ * of real_cred, a copy-on-write field, so we can't guarantee that it ++ * matches group_leader, or in fact that it might not change by the ++ * time it's evaluated. If a process were to call MAP_DMA with ++ * CAP_IPC_LOCK but later drop it, it doesn't make sense that they ++ * possibly see different results for an iommu_mapped vfio_dma vs ++ * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the ++ * time of calling MAP_DMA. ++ */ ++ get_task_struct(current->group_leader); ++ dma->task = current->group_leader; ++ dma->lock_cap = capable(CAP_IPC_LOCK); ++ + dma->pfn_list = RB_ROOT; + + /* Insert zero-sized and grow as we map chunks of it */ +@@ -1160,7 +1183,6 @@ static int vfio_iommu_replay(struct vfio + struct vfio_domain *d; + struct rb_node *n; + unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret; + + /* Arbitrarily pick the first domain in the list for lookups */ +@@ -1207,8 +1229,7 @@ static int vfio_iommu_replay(struct vfio + + npage = vfio_pin_pages_remote(dma, vaddr, + n >> PAGE_SHIFT, +- &pfn, lock_cap, +- limit); ++ &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1485,7 +1506,7 @@ static void vfio_iommu_unmap_unpin_reacc + if (!is_invalid_reserved_pfn(vpfn->pfn)) + locked++; + } +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + } + } + diff --git a/queue-4.17/watchdog-da9063-fix-updating-timeout-value.patch b/queue-4.17/watchdog-da9063-fix-updating-timeout-value.patch new file mode 100644 index 00000000000..a3bb2c924f5 --- /dev/null +++ b/queue-4.17/watchdog-da9063-fix-updating-timeout-value.patch @@ -0,0 +1,58 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Marco Felsch +Date: Mon, 28 May 2018 08:45:45 +0200 +Subject: watchdog: da9063: Fix updating timeout value + +From: Marco Felsch + +[ Upstream commit 44ee54aabfdb3b35866ed909bde3ab01e9679385 ] + +The DA9063 watchdog has only one register field to store the timeout value +and to enable the watchdog. The watchdog gets enabled if the value is +not zero. There is no issue if the watchdog is already running but it +leads into problems if the watchdog is disabled. + +If the watchdog is disabled and only the timeout value should be prepared +the watchdog gets enabled too. Add a check to get the current watchdog +state and update the watchdog timeout value on hw-side only if the +watchdog is already active. + +Fixes: 5e9c16e37608 ("watchdog: Add DA9063 PMIC watchdog driver.") +Signed-off-by: Marco Felsch +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/watchdog/da9063_wdt.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +--- a/drivers/watchdog/da9063_wdt.c ++++ b/drivers/watchdog/da9063_wdt.c +@@ -99,10 +99,23 @@ static int da9063_wdt_set_timeout(struct + { + struct da9063 *da9063 = watchdog_get_drvdata(wdd); + unsigned int selector; +- int ret; ++ int ret = 0; + + selector = da9063_wdt_timeout_to_sel(timeout); +- ret = _da9063_wdt_set_timeout(da9063, selector); ++ ++ /* ++ * There are two cases when a set_timeout() will be called: ++ * 1. The watchdog is off and someone wants to set the timeout for the ++ * further use. ++ * 2. The watchdog is already running and a new timeout value should be ++ * set. ++ * ++ * The watchdog can't store a timeout value not equal zero without ++ * enabling the watchdog, so the timeout must be buffered by the driver. ++ */ ++ if (watchdog_active(wdd)) ++ ret = _da9063_wdt_set_timeout(da9063, selector); ++ + if (ret) + dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n", + ret); diff --git a/queue-4.17/watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch b/queue-4.17/watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch new file mode 100644 index 00000000000..d7c036631b1 --- /dev/null +++ b/queue-4.17/watchdog-renesas-wdt-add-support-for-the-r8a77965-wdt.patch @@ -0,0 +1,35 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Wolfram Sang +Date: Mon, 7 May 2018 14:29:42 +0200 +Subject: watchdog: renesas-wdt: Add support for the R8A77965 WDT + +From: Wolfram Sang + +[ Upstream commit b1eb8fedc01499132ced4b2a44b3ab3855c4e681 ] + +Document support for the Watchdog Timer (WDT) Controller in the Renesas +R-Car M3-N (R8A77965) SoC. No driver update is needed. + +Signed-off-by: Takeshi Kihara +[wsa: rebased to v4.17-rc3] +Signed-off-by: Wolfram Sang +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Guenter Roeck +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/watchdog/renesas-wdt.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt ++++ b/Documentation/devicetree/bindings/watchdog/renesas-wdt.txt +@@ -7,6 +7,7 @@ Required properties: + - "renesas,r7s72100-wdt" (RZ/A1) + - "renesas,r8a7795-wdt" (R-Car H3) + - "renesas,r8a7796-wdt" (R-Car M3-W) ++ - "renesas,r8a77965-wdt" (R-Car M3-N) + - "renesas,r8a77970-wdt" (R-Car V3M) + - "renesas,r8a77995-wdt" (R-Car D3) + diff --git a/queue-4.17/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch b/queue-4.17/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch new file mode 100644 index 00000000000..1517215315c --- /dev/null +++ b/queue-4.17/wlcore-sdio-check-for-valid-platform-device-data-before-suspend.patch @@ -0,0 +1,39 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Eyal Reizer +Date: Mon, 28 May 2018 11:36:42 +0300 +Subject: wlcore: sdio: check for valid platform device data before suspend + +From: Eyal Reizer + +[ Upstream commit 6e91d48371e79862ea2c05867aaebe4afe55a865 ] + +the wl pointer can be null In case only wlcore_sdio is probed while +no WiLink module is successfully probed, as in the case of mounting a +wl12xx module while using a device tree file configured with wl18xx +related settings. +In this case the system was crashing in wl1271_suspend() as platform +device data is not set. +Make sure wl the pointer is valid before using it. + +Signed-off-by: Eyal Reizer +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ti/wlcore/sdio.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/ti/wlcore/sdio.c ++++ b/drivers/net/wireless/ti/wlcore/sdio.c +@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device + mmc_pm_flag_t sdio_flags; + int ret = 0; + ++ if (!wl) { ++ dev_err(dev, "no wilink module was probed\n"); ++ goto out; ++ } ++ + dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n", + wl->wow_enabled); + diff --git a/queue-4.17/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch b/queue-4.17/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch new file mode 100644 index 00000000000..fc3d14e7e5d --- /dev/null +++ b/queue-4.17/x86-microcode-make-the-late-update-update_lock-a-raw-lock-for-rt.patch @@ -0,0 +1,50 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Scott Wood +Date: Thu, 24 May 2018 10:44:20 -0500 +Subject: x86/microcode: Make the late update update_lock a raw lock for RT + +From: Scott Wood + +[ Upstream commit ff987fcf011d20c53b3a613edf6e2055ea48e26e ] + +__reload_late() is called from stop_machine context and thus cannot +acquire a non-raw spinlock on PREEMPT_RT. + +Signed-off-by: Scott Wood +Signed-off-by: Borislav Petkov +Signed-off-by: Thomas Gleixner +Acked-by: Thomas Gleixner +Cc: Ashok Raj +Cc: Clark Williams +Cc: Pei Zhang +Cc: x86-ml +Link: http://lkml.kernel.org/r/20180524154420.24455-1-swood@redhat.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex); + /* + * Serialize late loading so that CPUs get updated one-by-one. + */ +-static DEFINE_SPINLOCK(update_lock); ++static DEFINE_RAW_SPINLOCK(update_lock); + + struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; + +@@ -560,9 +560,9 @@ static int __reload_late(void *info) + if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) + return -1; + +- spin_lock(&update_lock); ++ raw_spin_lock(&update_lock); + apply_microcode_local(&err); +- spin_unlock(&update_lock); ++ raw_spin_unlock(&update_lock); + + /* siblings return UCODE_OK because their engine got updated already */ + if (err > UCODE_NFOUND) { diff --git a/queue-4.17/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch b/queue-4.17/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch new file mode 100644 index 00000000000..80eb792ed5f --- /dev/null +++ b/queue-4.17/xen-netfront-raise-max-number-of-slots-in-xennet_get_responses.patch @@ -0,0 +1,55 @@ +From foo@baz Sat Jul 28 10:14:30 CEST 2018 +From: Juergen Gross +Date: Tue, 12 Jun 2018 08:57:53 +0200 +Subject: xen/netfront: raise max number of slots in xennet_get_responses() + +From: Juergen Gross + +[ Upstream commit 57f230ab04d2910a06d17d988f1c4d7586a59113 ] + +The max number of slots used in xennet_get_responses() is set to +MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD). + +In old kernel-xen MAX_SKB_FRAGS was 18, while nowadays it is 17. This +difference is resulting in frequent messages "too many slots" and a +reduced network throughput for some workloads (factor 10 below that of +a kernel-xen based guest). + +Replacing MAX_SKB_FRAGS by XEN_NETIF_NR_SLOTS_MIN for calculation of +the max number of slots to use solves that problem (tests showed no +more messages "too many slots" and throughput was as high as with the +kernel-xen based guest system). + +Replace MAX_SKB_FRAGS-2 by XEN_NETIF_NR_SLOTS_MIN-1 in +netfront_tx_slot_available() for making it clearer what is really being +tested without actually modifying the tested value. + +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netfront.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -239,7 +239,7 @@ static void rx_refill_timeout(struct tim + static int netfront_tx_slot_available(struct netfront_queue *queue) + { + return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) < +- (NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2); ++ (NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1); + } + + static void xennet_maybe_wake_tx(struct netfront_queue *queue) +@@ -790,7 +790,7 @@ static int xennet_get_responses(struct n + RING_IDX cons = queue->rx.rsp_cons; + struct sk_buff *skb = xennet_get_rx_skb(queue, cons); + grant_ref_t ref = xennet_get_rx_ref(queue, cons); +- int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD); ++ int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD); + int slots = 1; + int err = 0; + unsigned long ret; diff --git a/queue-4.17/y2038-ipc-use-ktime_get_real_seconds-consistently.patch b/queue-4.17/y2038-ipc-use-ktime_get_real_seconds-consistently.patch new file mode 100644 index 00000000000..dbac9bd3c85 --- /dev/null +++ b/queue-4.17/y2038-ipc-use-ktime_get_real_seconds-consistently.patch @@ -0,0 +1,76 @@ +From foo@baz Sat Jul 28 10:14:31 CEST 2018 +From: Arnd Bergmann +Date: Thu, 12 Apr 2018 15:19:44 +0200 +Subject: y2038: ipc: Use ktime_get_real_seconds consistently + +From: Arnd Bergmann + +[ Upstream commit 2a70b7879b84d471fd0e440f027bba310e0c1fb7 ] + +In some places, we still used get_seconds() instead of +ktime_get_real_seconds(), and I'm changing the remaining ones now to +all use ktime_get_real_seconds() so we use the full available range for +timestamps instead of overflowing the 'unsigned long' return value in +year 2106 on 32-bit kernels. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + ipc/msg.c | 6 +++--- + ipc/sem.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/ipc/msg.c ++++ b/ipc/msg.c +@@ -758,7 +758,7 @@ static inline int pipelined_send(struct + WRITE_ONCE(msr->r_msg, ERR_PTR(-E2BIG)); + } else { + ipc_update_pid(&msq->q_lrpid, task_pid(msr->r_tsk)); +- msq->q_rtime = get_seconds(); ++ msq->q_rtime = ktime_get_real_seconds(); + + wake_q_add(wake_q, msr->r_tsk); + WRITE_ONCE(msr->r_msg, msg); +@@ -859,7 +859,7 @@ static long do_msgsnd(int msqid, long mt + } + + ipc_update_pid(&msq->q_lspid, task_tgid(current)); +- msq->q_stime = get_seconds(); ++ msq->q_stime = ktime_get_real_seconds(); + + if (!pipelined_send(msq, msg, &wake_q)) { + /* no one is waiting for this message, enqueue it */ +@@ -1087,7 +1087,7 @@ static long do_msgrcv(int msqid, void __ + + list_del(&msg->m_list); + msq->q_qnum--; +- msq->q_rtime = get_seconds(); ++ msq->q_rtime = ktime_get_real_seconds(); + ipc_update_pid(&msq->q_lrpid, task_tgid(current)); + msq->q_cbytes -= msg->m_ts; + atomic_sub(msg->m_ts, &ns->msg_bytes); +--- a/ipc/sem.c ++++ b/ipc/sem.c +@@ -104,7 +104,7 @@ struct sem { + /* that alter the semaphore */ + struct list_head pending_const; /* pending single-sop operations */ + /* that do not alter the semaphore*/ +- time_t sem_otime; /* candidate for sem_otime */ ++ time64_t sem_otime; /* candidate for sem_otime */ + } ____cacheline_aligned_in_smp; + + /* One sem_array data structure for each set of semaphores in the system. */ +@@ -984,10 +984,10 @@ again: + static void set_semotime(struct sem_array *sma, struct sembuf *sops) + { + if (sops == NULL) { +- sma->sems[0].sem_otime = get_seconds(); ++ sma->sems[0].sem_otime = ktime_get_real_seconds(); + } else { + sma->sems[sops[0].sem_num].sem_otime = +- get_seconds(); ++ ktime_get_real_seconds(); + } + } + -- 2.47.3