4.20.8-stable review

PATCH In review Greg Kroah-Hartman 13 participants 380 messages Feb 11, 2019 – Feb 14, 2019 Page 1 of 3

Subsystems (11)

Networking Network drivers Stable branch Device tree bindings +7 more subsystems

lore

Share & tools

lore

Greg Kroah-Hartman

author maintainer

2019-02-11 14:15 UTC #109 lore raw

PATCH 95/352 firmware/efi: Add NULL pointer checks in efivars API functions

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ab2180a15ce54739fed381efb4cb12e78dfb1561 ]

Since commit:

ce2e6db554fa ("brcmfmac: Add support for getting nvram contents from EFI variables")

we have a device driver accessing the efivars API. Several functions in the efivars API assume __efivars is set, i.e., that they will be accessed only after efivars_register() has been called. However, the following NULL pointer access was reported calling efivar_entry_size() from the brcmfmac device driver:

  Unable to handle kernel NULL pointer dereference at virtual address 00000008
  pgd = 60bfa5f1
  [00000008] *pgd=00000000
  Internal error: Oops: 5 [#1] SMP ARM
  ...
  Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
  Workqueue: events request_firmware_work_func
  PC is at efivar_entry_size+0x28/0x90
  LR is at brcmf_fw_complete_request+0x3f8/0x8d4 [brcmfmac]
  pc : [<c0c40718>]    lr : [<bf2a3ef4>]    psr: a00d0113
  sp : ede7fe28  ip : ee983410  fp : c1787f30
  r10: 00000000  r9 : 00000000  r8 : bf2b2258
  r7 : ee983000  r6 : c1604c48  r5 : ede7fe88  r4 : edf337c0
  r3 : 00000000  r2 : 00000000  r1 : ede7fe88  r0 : c17712c8
  Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
  Control: 10c5387d  Table: ad16804a  DAC: 00000051

Disassembly showed that the local static variable __efivars is NULL, which is not entirely unexpected given that it is a non-EFI platform.

So add a NULL pointer check to efivar_entry_size(), and to related functions while at it. In efivars_register() a couple of sanity checks are added as well.

Reported-by Jon Hunter <[email protected]>

Signed-off-by Arend van Spriel <[email protected]>

Signed-off-by Ard Biesheuvel <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Bhupesh Sharma <[email protected]>

Cc Borislav Petkov <[email protected]>

Cc Dave Hansen <[email protected]>

Cc Eric Snowberg <[email protected]>

Cc Hans de Goede <[email protected]>

Cc Joe Perches <[email protected]>

Cc Julien Thierry <[email protected]>

Cc Linus Torvalds <[email protected]>

Cc Marc Zyngier <[email protected]>

Cc Matt Fleming <[email protected]>

Cc Nathan Chancellor <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Sai Praneeth Prakhya <[email protected]>

Cc Sedat Dilek <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc YiFei Zhu <[email protected]>

Cc [email protected]

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Ingo Molnar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/firmware/efi/vars.c | 99 +++++++++++++++++++++++++++++--------
 1 file changed, 78 insertions(+), 21 deletions(-)

drivers/firmware/efi/vars.c +78 ~~-21~~

index 9336ffdf6e2c..fceaafd67ec6 100644
@@ -318,7 +318,12 @@ EXPORT_SYMBOL_GPL(efivar_variable_is_removable);
 static efi_status_t
 check_var_size(u32 attributes, unsigned long size)
 {
-	const struct efivar_operations *fops = __efivars->ops;
+	const struct efivar_operations *fops;
+
+	if (!__efivars)
+		return EFI_UNSUPPORTED;
+
+	fops = __efivars->ops;
 
 	if (!fops->query_variable_store)
 		return EFI_UNSUPPORTED;

@@ -329,7 +334,12 @@ check_var_size(u32 attributes, unsigned long size)
 static efi_status_t
 check_var_size_nonblocking(u32 attributes, unsigned long size)
 {
-	const struct efivar_operations *fops = __efivars->ops;
+	const struct efivar_operations *fops;
+
+	if (!__efivars)
+		return EFI_UNSUPPORTED;
+
+	fops = __efivars->ops;
 
 	if (!fops->query_variable_store)
 		return EFI_UNSUPPORTED;

@@ -429,13 +439,18 @@ static void dup_variable_bug(efi_char16_t *str16, efi_guid_t *vendor_guid,
 int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *),
 		void *data, bool duplicates, struct list_head *head)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	unsigned long variable_name_size = 1024;
 	efi_char16_t *variable_name;
 	efi_status_t status;
 	efi_guid_t vendor_guid;
 	int err = 0;
 
+	if (!__efivars)
+		return -EFAULT;
+
+	ops = __efivars->ops;
+
 	variable_name = kzalloc(variable_name_size, GFP_KERNEL);
 	if (!variable_name) {
 		printk(KERN_ERR "efivars: Memory allocation failed.\n");

@@ -583,12 +598,14 @@ static void efivar_entry_list_del_unlock(struct efivar_entry *entry)
  */
 int __efivar_entry_delete(struct efivar_entry *entry)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
-	status = ops->set_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   0, 0, NULL);
+	if (!__efivars)
+		return -EINVAL;
+
+	status = __efivars->ops->set_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      0, 0, NULL);
 
 	return efi_status_to_err(status);
 }

@@ -607,12 +624,17 @@ EXPORT_SYMBOL_GPL(__efivar_entry_delete);
  */
 int efivar_entry_delete(struct efivar_entry *entry)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
 
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	status = ops->set_variable(entry->var.VariableName,
 				   &entry->var.VendorGuid,
 				   0, 0, NULL);

@@ -650,13 +672,19 @@ EXPORT_SYMBOL_GPL(efivar_entry_delete);
 int efivar_entry_set(struct efivar_entry *entry, u32 attributes,
 		     unsigned long size, void *data, struct list_head *head)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 	efi_char16_t *name = entry->var.VariableName;
 	efi_guid_t vendor = entry->var.VendorGuid;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
+
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	if (head && efivar_entry_find(name, vendor, head, false)) {
 		up(&efivars_lock);
 		return -EEXIST;

@@ -687,12 +715,17 @@ static int
 efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 			     u32 attributes, unsigned long size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	if (down_trylock(&efivars_lock))
 		return -EBUSY;
 
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+
 	status = check_var_size_nonblocking(attributes,
 					    size + ucs2_strsize(name, 1024));
 	if (status != EFI_SUCCESS) {

@@ -700,6 +733,7 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 		return -ENOSPC;
 	}
 
+	ops = __efivars->ops;
 	status = ops->set_variable_nonblocking(name, &vendor, attributes,
 					       size, data);

@@ -727,9 +761,13 @@ efivar_entry_set_nonblocking(efi_char16_t *name, efi_guid_t vendor,
 int efivar_entry_set_safe(efi_char16_t *name, efi_guid_t vendor, u32 attributes,
 			  bool block, unsigned long size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
+	if (!__efivars)
+		return -EINVAL;
+
+	ops = __efivars->ops;
 	if (!ops->query_variable_store)
 		return -ENOSYS;

@@ -829,13 +867,18 @@ EXPORT_SYMBOL_GPL(efivar_entry_find);
  */
 int efivar_entry_size(struct efivar_entry *entry, unsigned long *size)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_status_t status;
 
 	*size = 0;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+	ops = __efivars->ops;
 	status = ops->get_variable(entry->var.VariableName,
 				   &entry->var.VendorGuid, NULL, size, NULL);
 	up(&efivars_lock);

@@ -861,12 +904,14 @@ EXPORT_SYMBOL_GPL(efivar_entry_size);
 int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
 		       unsigned long *size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
-	status = ops->get_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   attributes, size, data);
+	if (!__efivars)
+		return -EINVAL;
+
+	status = __efivars->ops->get_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      attributes, size, data);
 
 	return efi_status_to_err(status);
 }

@@ -882,14 +927,19 @@ EXPORT_SYMBOL_GPL(__efivar_entry_get);
 int efivar_entry_get(struct efivar_entry *entry, u32 *attributes,
 		     unsigned long *size, void *data)
 {
-	const struct efivar_operations *ops = __efivars->ops;
 	efi_status_t status;
 
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
-	status = ops->get_variable(entry->var.VariableName,
-				   &entry->var.VendorGuid,
-				   attributes, size, data);
+
+	if (!__efivars) {
+		up(&efivars_lock);
+		return -EINVAL;
+	}
+
+	status = __efivars->ops->get_variable(entry->var.VariableName,
+					      &entry->var.VendorGuid,
+					      attributes, size, data);
 	up(&efivars_lock);
 
 	return efi_status_to_err(status);

@@ -921,7 +971,7 @@ EXPORT_SYMBOL_GPL(efivar_entry_get);
 int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 			      unsigned long *size, void *data, bool *set)
 {
-	const struct efivar_operations *ops = __efivars->ops;
+	const struct efivar_operations *ops;
 	efi_char16_t *name = entry->var.VariableName;
 	efi_guid_t *vendor = &entry->var.VendorGuid;
 	efi_status_t status;

@@ -940,6 +990,11 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 	if (down_interruptible(&efivars_lock))
 		return -EINTR;
 
+	if (!__efivars) {
+		err = -EINVAL;
+		goto out;
+	}
+
 	/*
 	 * Ensure that the available space hasn't shrunk below the safe level
 	 */

@@ -956,6 +1011,8 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes,
 		}
 	}
 
+	ops = __efivars->ops;
+
 	status = ops->set_variable(name, vendor, attributes, *size, data);
 	if (status != EFI_SUCCESS) {
 		err = efi_status_to_err(status);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:15 UTC #116 lore raw

PATCH 102/352 ARM: dts: aspeed: add missing memory unit-address

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8ef86955fe59f7912a40d57ae4c6d511f0187b4d ]

The base aspeed-g5.dtsi already defines a '/memory at 80000000' node, so '/memory' in the board files create a duplicate node. We're probably getting lucky that the bootloader fixes up the memory node that the kernel ends up using. Add the unit-address so it's merged with the base node.

Found with DT json-schema checks.

Cc Joel Stanley <[email protected]>

Cc Andrew Jeffery <[email protected]>

Cc devicetree at vger.kernel.org

Cc linux-arm-kernel at lists.infradead.org

Cc linux-aspeed at lists.ozlabs.org

Signed-off-by Rob Herring <[email protected]>

Signed-off-by Olof Johansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts | 2 +-
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts       | 2 +-
 arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts         | 3 +--
 arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts    | 2 +-
 4 files changed, 4 insertions(+), 5 deletions(-)

arch/arm/boot/dts/aspeed-bmc-arm-centriq2400-rep.dts +1 -1

index df1227613d48..c2ece0b91885 100644
@@ -13,7 +13,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory at 80000000 {
 		reg = <0x80000000 0x40000000>;
 	};

arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts +1 -1

index 7a291de02543..22dade6393d0 100644
@@ -13,7 +13,7 @@
 		bootargs = "earlyprintk";
 	};
 
-	memory {
+	memory at 80000000 {
 		reg = <0x80000000 0x20000000>;
 	};

arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts +1 -2

index d598b6391362..024e52a6cd0f 100644
@@ -14,7 +14,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory at 80000000 {
 		reg = <0x80000000 0x40000000>;
 	};

@@ -322,4 +322,3 @@
 &adc {
 	status = "okay";
 };
-

arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts +1 -1

index 43ed13963d35..33d704541de6 100644
@@ -17,7 +17,7 @@
 		bootargs = "console=ttyS4,115200 earlyprintk";
 	};
 
-	memory {
+	memory at 80000000 {
 		reg = <0x80000000 0x20000000>;
 	};

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:15 UTC #117 lore raw

PATCH 103/352 spi: fix spi-at91-usart.c build errors when PINCTRL is not set

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c2b142cc3939e932d4fa2210c2a5155df5736590 ]

Fix build errors when CONFIG_PINCTRL is not enabled.
The header file <linux/pinctrl/consumer.h> handles both CONFIG_PINCTRL enabled and disabled cases.

CC [M] drivers/spi/spi-at91-usart.o
../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_suspend':
../drivers/spi/spi-at91-usart.c:409:2: error: implicit declaration of function 'pinctrl_pm_select_sleep_state' [-Werror=implicit-function-declaration]
pinctrl_pm_select_sleep_state(dev);
../drivers/spi/spi-at91-usart.c: In function 'at91_usart_spi_runtime_resume':
../drivers/spi/spi-at91-usart.c:419:2: error: implicit declaration of function 'pinctrl_pm_select_default_state' [-Werror=implicit-function-declaration]
pinctrl_pm_select_default_state(dev);

Signed-off-by Randy Dunlap <[email protected]>

Cc Radu Pirea <[email protected]>

Cc Mark Brown <[email protected]>

Cc [email protected]

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/spi/spi-at91-usart.c | 1 +
 1 file changed, 1 insertion(+)

drivers/spi/spi-at91-usart.c +1 -0

index a924657642fa..08bcbd1f9aa2 100644
@@ -12,6 +12,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/of_gpio.h>
+#include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 
 #include <linux/spi/spi.h>

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:15 UTC #118 lore raw

PATCH 104/352 x86/fpu: Add might_fault() to user_insn()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6637401c35b2f327a35d27f44bda05e327f2f017 ]

Every user of user_insn() passes an user memory pointer to this macro.

Add might_fault() to user_insn() so we can spot users which are using this macro in sections where page faulting is not allowed.

[ bp: Space it out to make it more visible. ]

Signed-off-by Sebastian Andrzej Siewior <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Reviewed-by Rik van Riel <[email protected]>

Cc "H. Peter Anvin" <[email protected]>

Cc "Jason A. Donenfeld" <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Dave Hansen <[email protected]>

Cc Ingo Molnar <[email protected]>

Cc Jann Horn <[email protected]>

Cc Paolo Bonzini <[email protected]>

Cc Radim Krčmář <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc kvm ML <[email protected]>

Cc x86-ml <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 arch/x86/include/asm/fpu/internal.h | 3 +++
 1 file changed, 3 insertions(+)

arch/x86/include/asm/fpu/internal.h +3 -0

index 69dcdf195b61..fa2c93cb42a2 100644
@@ -106,6 +106,9 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu);
 #define user_insn(insn, output, input...)				\
 ({									\
 	int err;							\
+									\
+	might_fault();							\
+									\
 	asm volatile(ASM_STAC "\n"					\
 		     "1:" #insn "\n\t"					\
 		     "2: " ASM_CLAC "\n"				\

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:19 UTC #349 lore raw

PATCH 328/352 futex: Handle early deadlock return correctly

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

From: Thomas Gleixner <[email protected]>

commit 1a1fb985f2e2b85ec0d3dc2e519ee48389ec2434 upstream.

commit 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex") changed the locking rules in the futex code so that the hash bucket lock is not longer held while the waiter is enqueued into the rtmutex wait list. This made the lock and the unlock path symmetric, but unfortunately the possible early exit from __rt_mutex_proxy_start() due to a detected deadlock was not updated accordingly. That allows a concurrent unlocker to observe inconsitent state which triggers the warning in the unlock path.

futex_lock_pi() futex_unlock_pi()
lock(hb->lock)
queue(hb_waiter) lock(hb->lock)
lock(rtmutex->wait_lock)
unlock(hb->lock)

                                        // acquired hb->lock
                                        hb_waiter = futex_top_waiter()
                                        lock(rtmutex->wait_lock)
  __rt_mutex_proxy_start()
     ---> fail
          remove(rtmutex_waiter);
     ---> returns -EDEADLOCK
  unlock(rtmutex->wait_lock)
                                        // acquired wait_lock
                                        wake_futex_pi()
                                        rt_mutex_next_owner()
					  --> returns NULL
                                          --> WARN

lock(hb->lock)
unqueue(hb_waiter)

The problem is caused by the remove(rtmutex_waiter) in the failure case of __rt_mutex_proxy_start() as this lets the unlocker observe a waiter in the hash bucket but no waiter on the rtmutex, i.e. inconsistent state.

The original commit handles this correctly for the other early return cases (timeout, signal) by delaying the removal of the rtmutex waiter until the returning task reacquired the hash bucket lock.

Treat the failure case of __rt_mutex_proxy_start() in the same way and let the existing cleanup code handle the eventual handover of the rtmutex gracefully. The regular rt_mutex_proxy_start() gains the rtmutex waiter removal for the failure case, so that the other callsites are still operating correctly.

Add proper comments to the code so all these details are fully documented.

Thanks to Peter for helping with the analysis and writing the really valuable code comments.

Fixes 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex")

Reported-by Heiko Carstens <[email protected]>

Co-developed-by Peter Zijlstra <[email protected]>

Signed-off-by Peter Zijlstra <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Tested-by Heiko Carstens <[email protected]>

Cc Martin Schwidefsky <[email protected]>

Cc [email protected]

Cc Stefan Liebler <[email protected]>

Cc Sebastian Sewior <[email protected]>

Cc [email protected]

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 kernel/futex.c           |   28 ++++++++++++++++++----------
 kernel/locking/rtmutex.c |   37 ++++++++++++++++++++++++++++++++-----
 2 files changed, 50 insertions(+), 15 deletions(-)

kernel/futex.c +18 ~~-10~~

@@ -2850,35 +2850,39 @@ retry_private:
 	 * and BUG when futex_unlock_pi() interleaves with this.
 	 *
 	 * Therefore acquire wait_lock while holding hb->lock, but drop the
-	 * latter before calling rt_mutex_start_proxy_lock(). This still fully
-	 * serializes against futex_unlock_pi() as that does the exact same
-	 * lock handoff sequence.
+	 * latter before calling __rt_mutex_start_proxy_lock(). This
+	 * interleaves with futex_unlock_pi() -- which does a similar lock
+	 * handoff -- such that the latter can observe the futex_q::pi_state
+	 * before __rt_mutex_start_proxy_lock() is done.
 	 */
 	raw_spin_lock_irq(&q.pi_state->pi_mutex.wait_lock);
 	spin_unlock(q.lock_ptr);
+	/*
+	 * __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter
+	 * such that futex_unlock_pi() is guaranteed to observe the waiter when
+	 * it sees the futex_q::pi_state.
+	 */
 	ret = __rt_mutex_start_proxy_lock(&q.pi_state->pi_mutex, &rt_waiter, current);
 	raw_spin_unlock_irq(&q.pi_state->pi_mutex.wait_lock);
 
 	if (ret) {
 		if (ret == 1)
 			ret = 0;
-
-		spin_lock(q.lock_ptr);
-		goto no_block;
+		goto cleanup;
 	}
 
-
 	if (unlikely(to))
 		hrtimer_start_expires(&to->timer, HRTIMER_MODE_ABS);
 
 	ret = rt_mutex_wait_proxy_lock(&q.pi_state->pi_mutex, to, &rt_waiter);
 
+cleanup:
 	spin_lock(q.lock_ptr);
 	/*
-	 * If we failed to acquire the lock (signal/timeout), we must
+	 * If we failed to acquire the lock (deadlock/signal/timeout), we must
 	 * first acquire the hb->lock before removing the lock from the
-	 * rt_mutex waitqueue, such that we can keep the hb and rt_mutex
-	 * wait lists consistent.
+	 * rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait
+	 * lists consistent.
 	 *
 	 * In particular; it is important that futex_unlock_pi() can not
 	 * observe this inconsistency.

@@ -3002,6 +3006,10 @@ retry:
 		 * there is no point where we hold neither; and therefore
 		 * wake_futex_pi() must observe a state consistent with what we
 		 * observed.
+		 *
+		 * In particular; this forces __rt_mutex_start_proxy() to
+		 * complete such that we're guaranteed to observe the
+		 * rt_waiter. Also see the WARN in wake_futex_pi().
 		 */
 		raw_spin_lock_irq(&pi_state->pi_mutex.wait_lock);
 		spin_unlock(&hb->lock);

kernel/locking/rtmutex.c +32 -5

@@ -1726,12 +1726,33 @@ void rt_mutex_proxy_unlock(struct rt_mut
 	rt_mutex_set_owner(lock, NULL);
 }
 
+/**
+ * __rt_mutex_start_proxy_lock() - Start lock acquisition for another task
+ * @lock:		the rt_mutex to take
+ * @waiter:		the pre-initialized rt_mutex_waiter
+ * @task:		the task to prepare
+ *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: does _NOT_ remove the @waiter on failure; must either call
+ * rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this.
+ *
+ * Returns:
+ *  0 - task blocked on lock
+ *  1 - acquired the lock for task, caller should wake it up
+ * <0 - error
+ *
+ * Special API call for PI-futex support.
+ */
 int __rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 			      struct rt_mutex_waiter *waiter,
 			      struct task_struct *task)
 {
 	int ret;
 
+	lockdep_assert_held(&lock->wait_lock);
+
 	if (try_to_take_rt_mutex(lock, task, NULL))
 		return 1;

@@ -1749,9 +1770,6 @@ int __rt_mutex_start_proxy_lock(struct r
 		ret = 0;
 	}
 
-	if (unlikely(ret))
-		remove_waiter(lock, waiter);
-
 	debug_rt_mutex_print_deadlock(waiter);
 
 	return ret;

@@ -1763,12 +1781,18 @@ int __rt_mutex_start_proxy_lock(struct r
  * @waiter:		the pre-initialized rt_mutex_waiter
  * @task:		the task to prepare
  *
+ * Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock
+ * detection. It does not wait, see rt_mutex_wait_proxy_lock() for that.
+ *
+ * NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter
+ * on failure.
+ *
  * Returns:
  *  0 - task blocked on lock
  *  1 - acquired the lock for task, caller should wake it up
  * <0 - error
  *
- * Special API call for FUTEX_REQUEUE_PI support.
+ * Special API call for PI-futex support.
  */
 int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
 			      struct rt_mutex_waiter *waiter,

@@ -1778,6 +1802,8 @@ int rt_mutex_start_proxy_lock(struct rt_
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+	if (unlikely(ret))
+		remove_waiter(lock, waiter);
 	raw_spin_unlock_irq(&lock->wait_lock);
 
 	return ret;

@@ -1845,7 +1871,8 @@ int rt_mutex_wait_proxy_lock(struct rt_m
  * @lock:		the rt_mutex we were woken on
  * @waiter:		the pre-initialized rt_mutex_waiter
  *
- * Attempt to clean up after a failed rt_mutex_wait_proxy_lock().
+ * Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or
+ * rt_mutex_wait_proxy_lock().
  *
  * Unless we acquired the lock; we're still enqueued on the wait-list and can
  * in fact still be granted ownership until we're removed. Therefore we can

Greg Kroah-Hartman

author maintainer

2019-02-11 14:19 UTC #363 lore raw

PATCH 342/352 cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

From: Josh Poimboeuf <[email protected]>

commit b284909abad48b07d3071a9fc9b5692b3e64914b upstream.

With the following commit:

73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")

... the hotplug code attempted to detect when SMT was disabled by BIOS, in which case it reported SMT as permanently disabled. However, that code broke a virt hotplug scenario, where the guest is booted with only primary CPU threads, and a sibling is brought online later.

The problem is that there doesn't seem to be a way to reliably distinguish between the HW "SMT disabled by BIOS" case and the virt "sibling not yet brought online" case. So the above-mentioned commit was a bit misguided, as it permanently disabled SMT for both cases, preventing future virt sibling hotplugs.

Going back and reviewing the original problems which were attempted to be solved by that commit, when SMT was disabled in BIOS:

1) /sys/devices/system/cpu/smt/control showed "on" instead of "notsupported"; and

2) vmx_vm_init() was incorrectly showing the L1TF_MSG_SMT warning.

I'd propose that we instead consider #1 above to not actually be a problem. Because, at least in the virt case, it's possible that SMT wasn't disabled by BIOS and a sibling thread could be brought online later. So it makes sense to just always default the smt control to "on" to allow for that possibility (assuming cpuid indicates that the CPU supports SMT).

The real problem is #2, which has a simple fix: change vmx_vm_init() to query the actual current SMT state -- i.e., whether any siblings are currently online -- instead of looking at the SMT "control" sysfs value.

So fix it by:

a) reverting the original "fix" and its followup fix:

73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS") bc2d8d262cba ("cpu/hotplug: Fix SMT supported evaluation")

and

b) changing vmx_vm_init() to query the actual current SMT state -- instead of the sysfs control value -- to determine whether the L1TF warning is needed. This also requires the 'sched_smt_present' variable to exported, instead of 'cpu_smt_control'.

Fixes 73d5e2b47264 ("cpu/hotplug: detect SMT disabled by BIOS")

Reported-by Igor Mammedov <[email protected]>

Signed-off-by Josh Poimboeuf <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Cc Joe Mario <[email protected]>

Cc Jiri Kosina <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc [email protected]

Link https://lkml.kernel.org/r/e3a85d585da28cc333ecbc1e78ee9216e6da9396.1548794349.git.jpoimboe@redhat.com open here

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 arch/x86/kernel/cpu/bugs.c |    2 +-
 arch/x86/kvm/vmx.c         |    3 ++-
 include/linux/cpu.h        |    2 --
 kernel/cpu.c               |   33 ++++-----------------------------
 kernel/sched/fair.c        |    1 +
 kernel/smp.c               |    2 --
 6 files changed, 8 insertions(+), 35 deletions(-)

arch/x86/kernel/cpu/bugs.c +1 -1

@@ -69,7 +69,7 @@ void __init check_bugs(void)
 	 * identify_boot_cpu() initialized SMT support information, let the
 	 * core code know.
 	 */
-	cpu_smt_check_topology_early();
+	cpu_smt_check_topology();
 
 	if (!IS_ENABLED(CONFIG_SMP)) {
 		pr_info("CPU: ");

arch/x86/kvm/vmx.c +2 -1

@@ -28,6 +28,7 @@
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/sched.h>
+#include <linux/sched/smt.h>
 #include <linux/moduleparam.h>
 #include <linux/mod_devicetable.h>
 #include <linux/trace_events.h>

@@ -11643,7 +11644,7 @@ static int vmx_vm_init(struct kvm *kvm)
 			 * Warn upon starting the first VM in a potentially
 			 * insecure environment.
 			 */
-			if (cpu_smt_control == CPU_SMT_ENABLED)
+			if (sched_smt_active())
 				pr_warn_once(L1TF_MSG_SMT);
 			if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER)
 				pr_warn_once(L1TF_MSG_L1D);

include/linux/cpu.h +0 -2

@@ -180,12 +180,10 @@ enum cpuhp_smt_control {
 #if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT)
 extern enum cpuhp_smt_control cpu_smt_control;
 extern void cpu_smt_disable(bool force);
-extern void cpu_smt_check_topology_early(void);
 extern void cpu_smt_check_topology(void);
 #else
 # define cpu_smt_control		(CPU_SMT_ENABLED)
 static inline void cpu_smt_disable(bool force) { }
-static inline void cpu_smt_check_topology_early(void) { }
 static inline void cpu_smt_check_topology(void) { }
 #endif

kernel/cpu.c +4 ~~-29~~

@@ -376,9 +376,6 @@ void __weak arch_smt_update(void) { }
 
 #ifdef CONFIG_HOTPLUG_SMT
 enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED;
-EXPORT_SYMBOL_GPL(cpu_smt_control);
-
-static bool cpu_smt_available __read_mostly;
 
 void __init cpu_smt_disable(bool force)
 {

@@ -397,25 +394,11 @@ void __init cpu_smt_disable(bool force)
 
 /*
  * The decision whether SMT is supported can only be done after the full
- * CPU identification. Called from architecture code before non boot CPUs
- * are brought up.
- */
-void __init cpu_smt_check_topology_early(void)
-{
-	if (!topology_smt_supported())
-		cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
-}
-
-/*
- * If SMT was disabled by BIOS, detect it here, after the CPUs have been
- * brought online. This ensures the smt/l1tf sysfs entries are consistent
- * with reality. cpu_smt_available is set to true during the bringup of non
- * boot CPUs when a SMT sibling is detected. Note, this may overwrite
- * cpu_smt_control's previous setting.
+ * CPU identification. Called from architecture code.
  */
 void __init cpu_smt_check_topology(void)
 {
-	if (!cpu_smt_available)
+	if (!topology_smt_supported())
 		cpu_smt_control = CPU_SMT_NOT_SUPPORTED;
 }

@@ -428,18 +411,10 @@ early_param("nosmt", smt_cmdline_disable
 
 static inline bool cpu_smt_allowed(unsigned int cpu)
 {
-	if (topology_is_primary_thread(cpu))
+	if (cpu_smt_control == CPU_SMT_ENABLED)
 		return true;
 
-	/*
-	 * If the CPU is not a 'primary' thread and the booted_once bit is
-	 * set then the processor has SMT support. Store this information
-	 * for the late check of SMT support in cpu_smt_check_topology().
-	 */
-	if (per_cpu(cpuhp_state, cpu).booted_once)
-		cpu_smt_available = true;
-
-	if (cpu_smt_control == CPU_SMT_ENABLED)
+	if (topology_is_primary_thread(cpu))
 		return true;
 
 	/*

kernel/sched/fair.c +1 -0

@@ -5934,6 +5934,7 @@ static inline int find_idlest_cpu(struct
 
 #ifdef CONFIG_SCHED_SMT
 DEFINE_STATIC_KEY_FALSE(sched_smt_present);
+EXPORT_SYMBOL_GPL(sched_smt_present);
 
 static inline void set_idle_cores(int cpu, int val)
 {

kernel/smp.c +0 -2

@@ -584,8 +584,6 @@ void __init smp_init(void)
 		num_nodes, (num_nodes > 1 ? "s" : ""),
 		num_cpus,  (num_cpus  > 1 ? "s" : ""));
 
-	/* Final decision about SMT support */
-	cpu_smt_check_topology();
 	/* Any cleanup work */
 	smp_cpus_done(setup_max_cpus);
 }

Greg Kroah-Hartman

author maintainer

2019-02-11 14:20 UTC #1 lore raw

PATCH 1/352 drm/bufs: Fix Spectre v1 vulnerability

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a37805098900a6e73a55b3a43b7d3bcd987bb3f4 ]

idx can be indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/gpu/drm/drm_bufs.c:1420 drm_legacy_freebufs() warn: potential spectre issue 'dma->buflist' [r] (local cap)

Fix this by sanitizing idx before using it to index dma->buflist

Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by Gustavo A. R. Silva <[email protected]>

Signed-off-by Daniel Vetter <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/drm_bufs.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/gpu/drm/drm_bufs.c +3 -0

index 7412acaf3cde..d7d10cabb9bb 100644
@@ -36,6 +36,8 @@
 #include <drm/drmP.h>
 #include "drm_legacy.h"
 
+#include <linux/nospec.h>
+
 static struct drm_map_list *drm_find_matching_map(struct drm_device *dev,
 						  struct drm_local_map *map)
 {

@@ -1417,6 +1419,7 @@ int drm_legacy_freebufs(struct drm_device *dev, void *data,
 				  idx, dma->buf_count - 1);
 			return -EINVAL;
 		}
+		idx = array_index_nospec(idx, dma->buf_count);
 		buf = dma->buflist[idx];
 		if (buf->file_priv != file_priv) {
 			DRM_ERROR("Process %d freeing buffer not owned\n",

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:20 UTC #13 lore raw

PATCH 10/352 ath10k: fixup extended per sta tx statistics

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 539b44e70c5b4ad82d2c0c97a4dfb37523d891f6 ]

I had a couple concerns with this code. First, we definitely need to set the error code if the kzalloc() fails. Secondly, I was worried that if we didn't set "arsta->tx_stats" to NULL after freeing it, then it looks to me like it might lead to a use after free. I can't test that, but it's harmless to set it to NULL so I did.

Fixes a904417fc876 ("ath10k: add extended per sta tx statistics support")

Signed-off-by Dan Carpenter <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/ath/ath10k/mac.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/net/wireless/ath/ath10k/mac.c +6 -2

index 7e49342bae38..b4764fee4751 100644
@@ -6296,8 +6296,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
 			arsta->tx_stats = kzalloc(sizeof(*arsta->tx_stats),
 						  GFP_KERNEL);
-			if (!arsta->tx_stats)
+			if (!arsta->tx_stats) {
+				ret = -ENOMEM;
 				goto exit;
+			}
 		}
 
 		num_tdls_stations = ath10k_mac_tdls_vif_stations_count(hw, vif);

@@ -6385,8 +6387,10 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 			   "mac vdev %d peer delete %pM sta %pK (sta gone)\n",
 			   arvif->vdev_id, sta->addr, sta);
 
-		if (ath10k_debug_is_extd_tx_stats_enabled(ar))
+		if (ath10k_debug_is_extd_tx_stats_enabled(ar)) {
 			kfree(arsta->tx_stats);
+			arsta->tx_stats = NULL;
+		}
 
 		if (sta->tdls) {
 			ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #4 lore raw

PATCH 4/352 drm/vgem: Fix vgem_init to get drm device available.

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit d5c04dff24870ef07ce6453a3f4e1ffd9cf88d27 ]

Modify vgem_init to take platform dev as parent in drm_dev_init. This will make drm device available at "/sys/devices/platform/vgem" in x86 chromebook.

v2: rebase, address checkpatch typo and line over 80 characters

Cc Daniel Vetter <[email protected]>

Signed-off-by Deepak Sharma <[email protected]>

Reviewed-by Sean Paul <[email protected]>

Signed-off-by Emil Velikov <[email protected]>

Reviewed-by Daniel Vetter <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/vgem/vgem_drv.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

drivers/gpu/drm/vgem/vgem_drv.c +8 -8

index ec6af8b920da..f1f7ab9dcdbf 100644
@@ -471,31 +471,31 @@ static int __init vgem_init(void)
 	if (!vgem_device)
 		return -ENOMEM;
 
-	ret = drm_dev_init(&vgem_device->drm, &vgem_driver, NULL);
-	if (ret)
-		goto out_free;
-
 	vgem_device->platform =
 		platform_device_register_simple("vgem", -1, NULL, 0);
 	if (IS_ERR(vgem_device->platform)) {
 		ret = PTR_ERR(vgem_device->platform);
-		goto out_fini;
+		goto out_free;
 	}
 
 	dma_coerce_mask_and_coherent(&vgem_device->platform->dev,
 				     DMA_BIT_MASK(64));
+	ret = drm_dev_init(&vgem_device->drm, &vgem_driver,
+			   &vgem_device->platform->dev);
+	if (ret)
+		goto out_unregister;
 
 	/* Final step: expose the device/driver to userspace */
 	ret  = drm_dev_register(&vgem_device->drm, 0);
 	if (ret)
-		goto out_unregister;
+		goto out_fini;
 
 	return 0;
 
-out_unregister:
-	platform_device_unregister(vgem_device->platform);
 out_fini:
 	drm_dev_fini(&vgem_device->drm);
+out_unregister:
+	platform_device_unregister(vgem_device->platform);
 out_free:
 	kfree(vgem_device);
 	return ret;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #8 lore raw

PATCH 5/352 pinctrl: bcm2835: Use raw spinlock for RT compatibility

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 3c7b30f704b6f5e53eed6bf89cf2c8d1b38b02c0 ]

The BCM2835 pinctrl driver acquires a spinlock in its ->irq_enable, ->irq_disable and ->irq_set_type callbacks. Spinlocks become sleeping locks with CONFIG_PREEMPT_RT_FULL=y, therefore invocation of one of the callbacks in atomic context may cause a hard lockup if at least two GPIO pins in the same bank are used as interrupts. The issue doesn't occur with just a single interrupt pin per bank because the lock is never contended. I'm experiencing such lockups with GPIO 8 and 28 used as level-triggered interrupts, i.e. with ->irq_disable being invoked on reception of every IRQ.

The critical section protected by the spinlock is very small (one bitop and one RMW of an MMIO register), hence converting to a raw spinlock seems a better trade-off than converting the driver to threaded IRQ handling (which would increase latency to handle an interrupt).

Cc Mathias Duckeck <[email protected]>

Signed-off-by Lukas Wunner <[email protected]>

Acked-by Julia Cartwright <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/pinctrl/bcm/pinctrl-bcm2835.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

drivers/pinctrl/bcm/pinctrl-bcm2835.c +8 -8

index fa530913a2c8..08925d24180b 100644
@@ -90,7 +90,7 @@ struct bcm2835_pinctrl {
 	struct gpio_chip gpio_chip;
 	struct pinctrl_gpio_range gpio_range;
 
-	spinlock_t irq_lock[BCM2835_NUM_BANKS];
+	raw_spinlock_t irq_lock[BCM2835_NUM_BANKS];
 };
 
 /* pins are just named GPIO0..GPIO53 */

@@ -461,10 +461,10 @@ static void bcm2835_gpio_irq_enable(struct irq_data *data)
 	unsigned bank = GPIO_REG_OFFSET(gpio);
 	unsigned long flags;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 	set_bit(offset, &pc->enabled_irq_map[bank]);
 	bcm2835_gpio_irq_config(pc, gpio, true);
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
 
 static void bcm2835_gpio_irq_disable(struct irq_data *data)

@@ -476,12 +476,12 @@ static void bcm2835_gpio_irq_disable(struct irq_data *data)
 	unsigned bank = GPIO_REG_OFFSET(gpio);
 	unsigned long flags;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 	bcm2835_gpio_irq_config(pc, gpio, false);
 	/* Clear events that were latched prior to clearing event sources */
 	bcm2835_gpio_set_bit(pc, GPEDS0, gpio);
 	clear_bit(offset, &pc->enabled_irq_map[bank]);
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 }
 
 static int __bcm2835_gpio_irq_set_type_disabled(struct bcm2835_pinctrl *pc,

@@ -584,7 +584,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
 	unsigned long flags;
 	int ret;
 
-	spin_lock_irqsave(&pc->irq_lock[bank], flags);
+	raw_spin_lock_irqsave(&pc->irq_lock[bank], flags);
 
 	if (test_bit(offset, &pc->enabled_irq_map[bank]))
 		ret = __bcm2835_gpio_irq_set_type_enabled(pc, gpio, type);

@@ -596,7 +596,7 @@ static int bcm2835_gpio_irq_set_type(struct irq_data *data, unsigned int type)
 	else
 		irq_set_handler_locked(data, handle_level_irq);
 
-	spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
+	raw_spin_unlock_irqrestore(&pc->irq_lock[bank], flags);
 
 	return ret;
 }

@@ -1047,7 +1047,7 @@ static int bcm2835_pinctrl_probe(struct platform_device *pdev)
 		for_each_set_bit(offset, &events, 32)
 			bcm2835_gpio_wr(pc, GPEDS0 + i * 4, BIT(offset));
 
-		spin_lock_init(&pc->irq_lock[i]);
+		raw_spin_lock_init(&pc->irq_lock[i]);
 	}
 
 	err = gpiochip_add_data(&pc->gpio_chip, pc);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #9 lore raw

PATCH 6/352 clk: sunxi-ng: h6: Set video PLLs limits

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ed4433419d45bf8b58aef34c4450a27e1c8699e8 ]

Video PLL factors can be set in a way that final PLL rate is outside stable range. H6 user manual specifically says that N factor should not be below 12. While it doesn't says anything about maximum stable rate, it is clear that PLL doesn't work at 6.096 GHz (254 * 24 MHz).

Set minimum allowed PLL video rate to 288 MHz (12 * 24 MHz) and maximum to 2.4 GHz, which is maximum in BSP driver.

Signed-off-by Jernej Skrabec <[email protected]>

Signed-off-by Maxime Ripard <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/clk/sunxi-ng/ccu-sun50i-h6.c +4 -0

index 2193e1495086..19ff09f610e4 100644
@@ -120,6 +120,8 @@ static struct ccu_nm pll_video0_clk = {
 	.n		= _SUNXI_CCU_MULT_MIN(8, 8, 12),
 	.m		= _SUNXI_CCU_DIV(1, 1), /* input divider */
 	.fixed_post_div	= 4,
+	.min_rate	= 288000000,
+	.max_rate	= 2400000000UL,
 	.common		= {
 		.reg		= 0x040,
 		.features	= CCU_FEATURE_FIXED_POSTDIV,

@@ -136,6 +138,8 @@ static struct ccu_nm pll_video1_clk = {
 	.n		= _SUNXI_CCU_MULT_MIN(8, 8, 12),
 	.m		= _SUNXI_CCU_DIV(1, 1), /* input divider */
 	.fixed_post_div	= 4,
+	.min_rate	= 288000000,
+	.max_rate	= 2400000000UL,
 	.common		= {
 		.reg		= 0x048,
 		.features	= CCU_FEATURE_FIXED_POSTDIV,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #10 lore raw

PATCH 7/352 ASoC: Intel: mrfld: fix uninitialized variable access

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 1539c7f23f256120f89f8b9ec53160790bce9ed2 ]

Randconfig testing revealed a very old bug, with gcc-8:

sound/soc/intel/atom/sst/sst_loader.c: In function 'sst_load_fw':
sound/soc/intel/atom/sst/sst_loader.c:357:5: error: 'fw' may be used uninitialized in this function [-Werror=maybe-uninitialized]

  if (fw == NULL) {
     ^

sound/soc/intel/atom/sst/sst_loader.c:354:25: note: 'fw' was declared here
const struct firmware *fw;

We must check the return code of request_firmware() before we look at the pointer result that may be uninitialized when the function fails.

Fixes 9012c9544eea ("ASoC: Intel: mrfld - Add DSP load and management")

Signed-off-by Arnd Bergmann <[email protected]>

Acked-by Pierre-Louis Bossart <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 sound/soc/intel/atom/sst/sst_loader.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

sound/soc/intel/atom/sst/sst_loader.c +4 -4

index 27413ebae956..b8c456753f01 100644
@@ -354,14 +354,14 @@ static int sst_request_fw(struct intel_sst_drv *sst)
 	const struct firmware *fw;
 
 	retval = request_firmware(&fw, sst->firmware_name, sst->dev);
-	if (fw == NULL) {
-		dev_err(sst->dev, "fw is returning as null\n");
-		return -EINVAL;
-	}
 	if (retval) {
 		dev_err(sst->dev, "request fw failed %d\n", retval);
 		return retval;
 	}
+	if (fw == NULL) {
+		dev_err(sst->dev, "fw is returning as null\n");
+		return -EINVAL;
+	}
 	mutex_lock(&sst->sst_lock);
 	retval = sst_cache_and_parse_fw(sst, fw);
 	mutex_unlock(&sst->sst_lock);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #11 lore raw

PATCH 8/352 gpiolib: Fix possible use after free on label

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 18534df419041e6c1f4b41af56ee7d41f757815c ]

gpiod_request_commit() copies the pointer to the label passed as an argument only to be used later. But there's a chance the caller could immediately free the passed string(e.g., local variable). This could trigger a use after free when we use gpio label(e.g., gpiochip_unlock_as_irq(), gpiochip_is_requested()).

To be on the safe side: duplicate the string with kstrdup_const() so that if an unaware user passes an address to a stack-allocated buffer, we won't get the arbitrary label.

Also fix gpiod_set_consumer_name().

Signed-off-by Muchun Song <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpio/gpiolib.c        | 25 +++++++++++++++++++++----
 include/linux/gpio/consumer.h |  6 ++++--
 2 files changed, 25 insertions(+), 6 deletions(-)

drivers/gpio/gpiolib.c +21 -4

index 76913e23cf3a..bd44be115cdd 100644
@@ -2306,6 +2306,12 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 	unsigned long		flags;
 	unsigned		offset;
 
+	if (label) {
+		label = kstrdup_const(label, GFP_KERNEL);
+		if (!label)
+			return -ENOMEM;
+	}
+
 	spin_lock_irqsave(&gpio_lock, flags);
 
 	/* NOTE:  gpio_request() can be called in early boot,

@@ -2316,6 +2322,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 		desc_set_label(desc, label ? : "?");
 		status = 0;
 	} else {
+		kfree_const(label);
 		status = -EBUSY;
 		goto done;
 	}

@@ -2332,6 +2339,7 @@ static int gpiod_request_commit(struct gpio_desc *desc, const char *label)
 
 		if (status < 0) {
 			desc_set_label(desc, NULL);
+			kfree_const(label);
 			clear_bit(FLAG_REQUESTED, &desc->flags);
 			goto done;
 		}

@@ -2427,6 +2435,7 @@ static bool gpiod_free_commit(struct gpio_desc *desc)
 			chip->free(chip, gpio_chip_hwgpio(desc));
 			spin_lock_irqsave(&gpio_lock, flags);
 		}
+		kfree_const(desc->label);
 		desc_set_label(desc, NULL);
 		clear_bit(FLAG_ACTIVE_LOW, &desc->flags);
 		clear_bit(FLAG_REQUESTED, &desc->flags);

@@ -3382,11 +3391,19 @@ EXPORT_SYMBOL_GPL(gpiod_cansleep);
  * @desc: gpio to set the consumer name on
  * @name: the new consumer name
  */
-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
+int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
 {
-	VALIDATE_DESC_VOID(desc);
-	/* Just overwrite whatever the previous name was */
-	desc->label = name;
+	VALIDATE_DESC(desc);
+	if (name) {
+		name = kstrdup_const(name, GFP_KERNEL);
+		if (!name)
+			return -ENOMEM;
+	}
+
+	kfree_const(desc->label);
+	desc_set_label(desc, name);
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(gpiod_set_consumer_name);

include/linux/gpio/consumer.h +4 -2

index f2f887795d43..ed070512b40e 100644
@@ -162,7 +162,7 @@ int gpiod_is_active_low(const struct gpio_desc *desc);
 int gpiod_cansleep(const struct gpio_desc *desc);
 
 int gpiod_to_irq(const struct gpio_desc *desc);
-void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
+int gpiod_set_consumer_name(struct gpio_desc *desc, const char *name);
 
 /* Convert between the old gpio_ and new gpiod_ interfaces */
 struct gpio_desc *gpio_to_desc(unsigned gpio);

@@ -495,10 +495,12 @@ static inline int gpiod_to_irq(const struct gpio_desc *desc)
 	return -EINVAL;
 }
 
-static inline void gpiod_set_consumer_name(struct gpio_desc *desc, const char *name)
+static inline int gpiod_set_consumer_name(struct gpio_desc *desc,
+					  const char *name)
 {
 	/* GPIO can never have been requested */
 	WARN_ON(1);
+	return -EINVAL;
 }
 
 static inline struct gpio_desc *gpio_to_desc(unsigned gpio)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #0 lore raw

cover 4.20.8-stable review

This is the start of the stable review cycle for the 4.20.8 release. There are 352 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Wed Feb 13 14:17:03 UTC 2019. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.20.8-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.20.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 4.20.8-rc1

Trond Myklebust <[email protected]>
nfsd: Fix error return values for nfsd4_clone_file_range()

Huacai Chen <[email protected]>
cacheinfo: Keep the old value if of_property_read_u32 fails

Chris Brandt <[email protected]>
serial: sh-sci: Do not free irqs that have already been freed

Andy Shevchenko <[email protected]>
serial: 8250_pci: Make PCI class test non fatal

Greg Kroah-Hartman <[email protected]>
serial: fix race between flush_to_ldisc and tty_open

Gustavo A. R. Silva <[email protected]>
perf tests evsel-tp-sched: Fix bitwise operator

Mark Rutland <[email protected]>
perf/core: Don't WARN() for impossible ring-buffer sizes

Tony Luck <[email protected]>
x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()

Peter Zijlstra <[email protected]>
perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()

Kan Liang <[email protected]>
perf/x86/intel/uncore: Add Node ID mask

Josh Poimboeuf <[email protected]>
cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM

Peter Shier <[email protected]>
KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)

Jann Horn <[email protected]>

    kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)

Paolo Bonzini <[email protected]>
KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)

James Bottomley <[email protected]>
scsi: aic94xx: fix module loading

Vaibhav Jain <[email protected]>
scsi: cxlflash: Prevent deadlock when adapter probe fails

Damien Le Moal <[email protected]>
scsi: sd_zbc: Fix zone information messages

Johan Hovold <[email protected]>
staging: speakup: fix tty-operation NULL derefs

Paul Elder <[email protected]>
usb: gadget: musb: fix short isoc packets with inventra dma

Gustavo A. R. Silva <[email protected]>
usb: gadget: udc: net2272: Fix bitwise and boolean operations

Tejas Joglekar <[email protected]>
usb: dwc3: gadget: Handle 0 xfer length for OUT EP

Bin Liu <[email protected]>
usb: phy: am335x: fix race condition in _probe

Jernej Skrabec <[email protected]>
arm64: dts: allwinner: a64: Fix USB OTG regulator

Marc Zyngier <[email protected]>
irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID

Thomas Gleixner <[email protected]>
futex: Handle early deadlock return correctly

Leonid Iziumtsev <[email protected]>
dmaengine: imx-dma: fix wrong callback invoke

Lukas Wunner <[email protected]>
dmaengine: bcm2835: Fix abort of transactions

Lukas Wunner <[email protected]>
dmaengine: bcm2835: Fix interrupt race on RT

Vladis Dronov <[email protected]>
HID: debug: fix the ring buffer implementation

Miklos Szeredi <[email protected]>
cuse: fix ioctl

Miklos Szeredi <[email protected]>
fuse: handle zero sized retrieve correctly

Miklos Szeredi <[email protected]>
fuse: decrement NR_WRITEBACK_TEMP on the right page

Jann Horn <[email protected]>
fuse: call pipe_buf_release() under pipe lock

Jeremy Soller <[email protected]>
ALSA: hda/realtek - Headset microphone support for System76 darp5

Takashi Iwai <[email protected]>
ALSA: hda/realtek - Use a common helper for hp pin reference

Kailang Yang <[email protected]>
ALSA: hda/realtek - Fix lose hp_pins for disable auto mute

Takashi Iwai <[email protected]>
ALSA: hda - Serialize codec registrations

Udo Eberhardt <[email protected]>
ALSA: usb-audio: Add support for new T+A USB DAC

Charles Keepax <[email protected]>
ALSA: compress: Fix stop handling on compressed capture streams

Brian Foster <[email protected]>
xfs: eof trim writeback mapping as soon as it is cached

Cong Wang <[email protected]>
net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames

Guy Shattah <[email protected]>
net/mlx5e: Use the inner headers to determine tc/pedit offload limitation on decap flows

Arun Parameswaran <[email protected]>
net: dsa: b53: Fix for failure when irq is not defined in dt

Petr Machata <[email protected]>
net: cls_flower: Remove filter from mask before freeing it

Michael Chan <[email protected]>
bnxt_en: Disable interrupts when allocating CP rings or NQs.

Toshiaki Makita <[email protected]>
virtio_net: Account for tx bytes and packets on sending xdp_frames

Dan Carpenter <[email protected]>
skge: potential memory corruption in skge_get_regs()

Greg Kroah-Hartman <[email protected]>
sctp: walk the list of asoc safely

Xin Long <[email protected]>

    sctp: check and update stream->out_curr when allocating stream_out

Eric Dumazet <[email protected]>
rxrpc: bad unlock balance in rxrpc_recvmsg

Russell King <[email protected]>
Revert "net: phy: marvell: avoid pause mode on SGMII-to-Copper for 88e151x"

Eric Dumazet <[email protected]>
rds: fix refcount bug in rds_sock_addref

Florian Fainelli <[email protected]>
net: systemport: Fix WoL with password after deep sleep

Rundong Ge <[email protected]>
net: dsa: slave: Don't propagate flag changes on down slave interfaces

Andrew Lunn <[email protected]>
net: dsa: mv88e6xxx: Fix counting of ATU violations

Dan Carpenter <[email protected]>
net: dsa: Fix NULL checking in dsa_slave_set_eee()

Marc Zyngier <[email protected]>
net: dsa: Fix lockdep false positive splat

Sebastian Andrzej Siewior <[email protected]>

    net: dp83640: expire old TX-skb

Bart Van Assche <[email protected]>
lib/test_rhashtable: Make test_insert_dup() allocate its hash table dynamically

Govindarajulu Varadarajan <[email protected]>
enic: fix checksum validation for IPv6

Eric Dumazet <[email protected]>
dccp: fool proof ccid_hc_[rt]x_parse_options()

Eduardo Valentin <[email protected]>
thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set

Chuck Lever <[email protected]>
xprtrdma: Don't wake pending tasks until disconnect is done

Du Changbin <[email protected]>
scripts/gdb: fix lx-version string output

Anders Roxell <[email protected]>
kernel/kcov.c: mark write_comp_data() as notrace

Oleg Nesterov <[email protected]>
exec: load_script: don't blindly truncate shebang string

Davidlohr Bueso <[email protected]>
fs/epoll: drop ovflist branch prediction

Liu, Chuansheng <[email protected]>
kernel/hung_task.c: force console verbose before panic

Cheng Lin <[email protected]>
proc/sysctl: fix return error for proc_doulongvec_minmax()

Tetsuo Handa <[email protected]>
kernel/hung_task.c: break RCU locks based on jiffies

Benjamin Gordon <[email protected]>
fs/proc/base.c: use ns_capable instead of capable for timerslack_ns

Dave Martin <[email protected]>
arm64/sve: ptrace: Fix SVE_PT_REGS_OFFSET definition

Aditya Pakki <[email protected]>
HID: lenovo: Add checks to fix of_led_classdev_register

Bjorn Andersson <[email protected]>
thermal: generic-adc: Fix adc to temp interpolation

Finn Thain <[email protected]>
block/swim3: Fix regression on PowerBook G3

Richard Zhu <[email protected]>
PCI: imx: Enable MSI from downstream components

Srinivas Kandagatla <[email protected]>
thermal: tsens: qcom: do not create duplicate regmap debugfs entries

Douglas Anderson <[email protected]>
kdb: Don't back trace on a cpu that didn't round up

Matthias Brugger <[email protected]>
thermal: bcm2835: enable hwmon explicitly

Finn Thain <[email protected]>
block/swim3: Fix -EBUSY error when re-opening device after unmount

Scott Wood <[email protected]>
fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()

Wenwen Wang <[email protected]>
gdrom: fix a memory leak bug

Jia-Ju Bai <[email protected]>
isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()

Minchan Kim <[email protected]>
zram: fix lockdep warning of free block handling

Waiman Long <[email protected]>
mm/page_alloc.c: don't call kasan_free_pages() at deferred mem init

Larry Chen <[email protected]>
ocfs2: improve ocfs2 Makefile

Junxiao Bi <[email protected]>
ocfs2: don't clear bh uptodate for block read

Randy Dunlap <[email protected]>
arch/sh/boards/mach-kfr2r09/setup.c: fix struct mtd_oob_ops build warning

Marc Zyngier <[email protected]>
scripts/decode_stacktrace: only strip base path when a prefix of the path

Jiri Olsa <[email protected]>
perf python: Do not force closing original perf descriptor in evlist.get_pollfd()

Ondrej Mosnacek <[email protected]>
cgroup: fix parsing empty mount option string

Sahitya Tummala <[email protected]>

    f2fs: fix sbi->extent_list corruption issue

Kangjie Lu <[email protected]>
niu: fix missing checks of niu_pci_eeprom_read

Anton Ivanov <[email protected]>
um: Avoid marking pages with "changed protection"

Sahitya Tummala <[email protected]>

    f2fs: fix use-after-free issue when accessing sbi->stat_info

Ronnie Sahlberg <[email protected]>
cifs: check ntwrk_buf_start for NULL before dereferencing it

Stefan Roese <[email protected]>
MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8

Nathan Chancellor <[email protected]>
crypto: ux500 - Use proper enum in hash_set_dma_transfer

Nathan Chancellor <[email protected]>
crypto: ux500 - Use proper enum in cryp_set_dma_transfer

Michael Ellerman <[email protected]>
seq_buf: Make seq_buf_puts() null-terminate the buffer

Kangjie Lu <[email protected]>
hwmon: (lm80) fix a missing check of bus read in lm80 probe

Kangjie Lu <[email protected]>
hwmon: (lm80) fix a missing check of the status of SMBus read

Stanislav Fomichev <[email protected]>
perf build: Don't unconditionally link the libbfd feature test to -liberty and -lz

Chris Perl <[email protected]>
NFS: nfs_compare_mount_options always compare auth flavors.

Jim Mattson <[email protected]>
kvm: Change offset in kvm_write_guest_offset_cached to unsigned

Vitaly Kuznetsov <[email protected]>
selftests: kvm: report failed stage when exit reason is unexpected

Mahesh Salgaonkar <[email protected]>
powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.

Vitaly Kuznetsov <[email protected]>
KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported

Martin Blumenstingl <[email protected]>
pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins

Martin Blumenstingl <[email protected]>
pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins

John Fastabend <[email protected]>
bpf: sk_msg, fix socket data_ready events

Christophe Leroy <[email protected]>
powerpc/mm: Fix reporting of kernel execute faults on the 8xx

John Fastabend <[email protected]>
bpf: sk_msg, zap ingress queue on psock down

Noralf Trønnes <[email protected]>
fbdev: fbcon: Fix unregister crash when more than one framebuffer

Lenny Szubowicz <[email protected]>
ACPI/APEI: Clear GHES block_status before panic()

Kai-Heng Feng <[email protected]>
igb: Fix an issue that PME is not enabled during runtime suspend

Young Xiao <[email protected]>
ice: Do not enable NAPI on q_vectors that have no rings

Konstantin Khorenko <[email protected]>
i40e: define proper net_device::neigh_priv_len

Peter Rosin <[email protected]>
fbdev: fbmem: behave better with small rotated displays and many CPUs

Guoqing Jiang <[email protected]>
md: fix raid10 hang issue caused by barrier

Alexey Khoroshilov <[email protected]>
video: clps711x-fb: release disp device node in probe()

Wenjing Liu <[email protected]>
drm/amd/display: validate extended dongle caps

Zhi Chen <[email protected]>
ath10k: fix tx_stats memory leak

Karthikeyan Periyasamy <[email protected]>
ath10k: fix kernel panic due to use after free

Nathan Chancellor <[email protected]>
drbd: Avoid Clang warning about pointless switch statment

Lars Ellenberg <[email protected]>
drbd: skip spurious timeout (ping-timeo) when failing promote

Lars Ellenberg <[email protected]>
drbd: disconnect, if the wrong UUIDs are attached on a connected peer

Roland Kammerer <[email protected]>
drbd: narrow rcu_read_lock in drbd_sync_handshake

Miroslav Lichvar <[email protected]>
mlx5: update timecounter at least twice per counter overflow

Alexey Kardashevskiy <[email protected]>
powerpc/powernv/ioda: Allocate indirect TCE levels of cached userspace addresses on demand

Naftali Goldstein <[email protected]>
iwlwifi: mvm: fix setting HE ppe FW config

Madhavan Srinivasan <[email protected]>
powerpc/perf: Fix thresholding counter data for unknown type

Jian Shen <[email protected]>
net: hns3: don't restore rules when flow director is disabled

Peng Li <[email protected]>
net: hns3: fix the descriptor index when get rss type

Jian Shen <[email protected]>
net: hns3: add max vector number check for pf

Jia-Ju Bai <[email protected]>
cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()

Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: increase fw status register read timeout

Dave Carroll <[email protected]>
scsi: smartpqi: correct volume status

Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: correct host serial num for ssa

Ido Schimmel <[email protected]>
mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG

YueHaibing <[email protected]>
xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi

Johannes Berg <[email protected]>
mac80211: fix radiotap vendor presence bitmap handling

Christophe Leroy <[email protected]>
powerpc/uaccess: fix warning/error with access_ok()

Eric Yang <[email protected]>
drm/amd/display: fix YCbCr420 blank color

Chen-Yu Tsai <[email protected]>
Bluetooth: hci_bcm: Handle deferred probing for the clock supply

Dale Zhao <[email protected]>
drm/amd/display: Wait edp HPD to high in detect_sink

Paul Hsieh <[email protected]>
drm/amd/display: Add retry to read ddc_clock pin

Huazhong Tan <[email protected]>
net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data()

Huazhong Tan <[email protected]>
net: hns3: fix error handling int the hns3_get_vector_ring_chain

Dennis Zhou <[email protected]>
percpu: convert spin_lock_irq to spin_lock_irqsave.

Arnaldo Carvalho de Melo <[email protected]>
perf tools: Cast off_t to s64 to avoid warning on bionic libc

Arnaldo Carvalho de Melo <[email protected]>
perf header: Fix up argument to ctime()

Bin Liu <[email protected]>
usb: musb: dsps: fix runtime pm for peripheral mode

Bin Liu <[email protected]>
usb: musb: dsps: fix otg state machine

Mark Rutland <[email protected]>
arm64: KVM: Skip MMIO insn after emulation

Nicholas Mc Guire <[email protected]>
livepatch: check kzalloc return values

Ilan Peer <[email protected]>
mac80211: Properly handle SKB with radiotap only

Nicholas Mc Guire <[email protected]>
pinctrl: rza1: Handle devm_kasprintf() failure cases

Doug Smythies <[email protected]>
tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file

Michael Mueller <[email protected]>
KVM: s390: unregister debug feature on failing arch init

Michael Chan <[email protected]>
bnxt_en: Disable MSIX before re-reserving NQs/CMPL rings.

Fabrizio Castro <[email protected]>

    i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E)

Arnaldo Carvalho de Melo <[email protected]>
perf probe: Fix unchecked usage of strncpy()

Ethan Lien <[email protected]>
btrfs: use tagged writepage to mitigate livelock of snapshot

Arnaldo Carvalho de Melo <[email protected]>
perf header: Fix unchecked usage of strncpy()

Arnaldo Carvalho de Melo <[email protected]>
perf dso: Fix unchecked usage of strncpy()

Adrian Hunter <[email protected]>
perf test: Fix perf_event_attr test failure

Stephane Eranian <[email protected]>
perf stat: Fix CSV mode column output for non-cgroup events

Beomho Seo <[email protected]>
tty: serial: samsung: Properly set flags in autoCTS mode

Geert Uytterhoeven <[email protected]>
serial: sh-sci: Resume PIO in sci_rx_interrupt() on DMA failure

Geert Uytterhoeven <[email protected]>
serial: sh-sci: Fix locking in sci_submit_rx()

David Sterba <[email protected]>
btrfs: reada: reorder dev-replace locks before radix tree preload

Anand Jain <[email protected]>
btrfs: harden agaist duplicate fsid on scanned devices

Fabrizio Castro <[email protected]>
usb: renesas_usbhs: add support for RZ/G2E

Linus Walleij <[email protected]>
mmc: jz4740: Get CD/WP GPIOs from descriptors

Adrian Hunter <[email protected]>
mmc: sdhci-xenon: Fix timeout checks

Adrian Hunter <[email protected]>
mmc: sdhci-omap: Fix timeout checks

Adrian Hunter <[email protected]>
mmc: sdhci-of-esdhc: Fix timeout checks

Kai-Heng Feng <[email protected]>
memstick: Prevent memstick host from getting runtime suspended during card detection

Nicholas Mc Guire <[email protected]>
mmc: meson-mx-sdio: check devm_kasprintf for failure

Michal Suchanek <[email protected]>
mmc: bcm2835: reset host on timeout

Phil Elwell <[email protected]>
mmc: bcm2835: Recover from MMC_SEND_EXT_CSD

Suraj Jitindar Singh <[email protected]>
KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines

Quentin Monnet <[email protected]>
tools: bpftool: fix -Wmissing declaration warnings

David Ahern <[email protected]>
ipv6: Fix handling of LLA with VRF and sockets bound to VRF

Chao Yu <[email protected]>
f2fs: fix to reorder set_page_dirty and wait_on_page_writeback

Jeffrey Hugo <[email protected]>
clk: qcom: Leave mmss noc on for 8998

Tom Murphy <[email protected]>
fix dma-buf/udmabuf selftest

Arnd Bergmann <[email protected]>
ARM: mmp: fix timer_init calls

Fabio Estevam <[email protected]>
ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M

Arnd Bergmann <[email protected]>
ARM: pxa: avoid section mismatch warning

Stanislav Fomichev <[email protected]>
selftests/bpf: use __bpf_constant_htons in test_prog.c

Joey Zhang <[email protected]>
switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite

Jan Kara <[email protected]>
udf: Fix BUG on corrupted inode

Nir Dotan <[email protected]>
mlxsw: spectrum_acl: Limit priority value

Icenowy Zheng <[email protected]>
phy: sun4i-usb: add support for missing USB PHY index

Geert Uytterhoeven <[email protected]>
lightnvm: Fix uninitialized return value in nvm_get_chunk_meta()

Adamski, Krzysztof (Nokia - PL/Wroclaw) <[email protected]>
i2c-axxia: check for error conditions first

Hua Su <[email protected]>
lightnvm: pblk: add lock protection to list operations

Hans Holmberg <[email protected]>
lightnvm: pblk: fix resubmission of overwritten write err lbas

Sean Paul <[email protected]>
drm/msm: dpu: Only check flush register against pending flushes

Abhinav Kumar <[email protected]>
drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver

Zhizhou Zhang <[email protected]>
tee: optee: avoid possible double list_del()

Viresh Kumar <[email protected]>

    OPP: Use opp_table->regulators to verify no regulator case

Yangtao Li <[email protected]>
cpuidle: big.LITTLE: fix refcount leak

Vadim Pasternak <[email protected]>
platform/x86: mlx-platform: Fix tachometer registers

Anson Huang <[email protected]>
clk: imx6sl: ensure MMDC CH0 handshake is bypassed

Sergei Shtylyov <[email protected]>
sata_rcar: fix deferred probing

Will Deacon <[email protected]>
iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer

Vivek Gautam <[email protected]>
iommu/arm-smmu: Add support for qcom,smmu-v2 variant

Zhen Lei <[email protected]>
iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads

Tejas Joglekar <[email protected]>
usb: dwc3: gadget: Disable CSP for stream OUT ep

Andrey Smirnov <[email protected]>
ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1

Wolfram Sang <[email protected]>
watchdog: renesas_wdt: don't set divider while watchdog is running

Dan Carpenter <[email protected]>
tracing: Have trace_stack nr_entries compare not be so subtle

Linus Walleij <[email protected]>
ARM: dts: Fix up the D-Link DIR-685 MTD partition info

Carlo Caione <[email protected]>
arm64: dts: meson: Fix IRQ trigger type for macirq

Philipp Zabel <[email protected]>
media: coda: fix H.264 deblocking filter controls

Jiong Wang <[email protected]>
mips: bpf: fix encoding bug for mm_srlv32_op

Russell King - ARM Linux <[email protected]>
ARM: dts: Fix OMAP4430 SDP Ethernet startup

Janusz Krzysztofik <[email protected]>
ARM: OMAP1: ams-delta: Fix audio permanently muted

Tomasz Figa <[email protected]>
media: v4l2-device: Link subdevices to their parent devices if available

Yu Zhao <[email protected]>
iommu/amd: Fix amd_iommu=force_isolation

Nicholas Mc Guire <[email protected]>

    pinctrl: sx150x: handle failure case of devm_kstrdup

Nicholas Mc Guire <[email protected]>
gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack

Nicholas Mc Guire <[email protected]>
gpio: mt7621: report failure of devm_kasprintf()

Andy Shevchenko <[email protected]>
usb: dwc3: trace: add missing break statement to make compiler happy

Kaike Wan <[email protected]>
IB/hfi1: Unreserve a reserved request when it is completed

Peter Rajnoha <[email protected]>
kobject: return error code if writing /sys/.../uevent fails

Alexander Duyck <[email protected]>
driver core: Move async_synchronize_full call

Oskari Lemmela <[email protected]>
arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios

Hoang Le <[email protected]>
tipc: fix node keep alive interval calculation

Alex Deucher <[email protected]>
drm/amdgpu/powerplay: fix clock stretcher limits on polaris (v2)

Nicholas Mc Guire <[email protected]>
pinctrl: nuvoton: check for devm_kasprintf() failure

Emmanuel Grumbach <[email protected]>
mac80211: fix deauth TX when we disconnect

Luca Ceresoli <[email protected]>
media: imx274: select REGMAP_I2C

Chen-Yu Tsai <[email protected]>
clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks

Chunfeng Yun <[email protected]>
usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)

Bart Van Assche <[email protected]>
timekeeping: Use proper seqcount initializer

Mathias Nyman <[email protected]>
usb: hub: delay hub autosuspend if USB3 port is still link training

Marek Szyprowski <[email protected]>
usb: dwc2: Disable power down feature on Samsung SoCs

Eric Long <[email protected]>
dmaengine: sprd: Support DMA link-list cyclic callback

Anurag Kumar Vulisha <[email protected]>
usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()

Max Filippov <[email protected]>
xtensa: xtfpga.dtsi: fix dtc warnings about SPI

Zoran Markovic <[email protected]>
smack: fix access permissions for keyring

Ville Syrjälä <[email protected]>
platform/x86: Fix config space access for intel_atomisp2_pm

Alexey Khoroshilov <[email protected]>
media: DaVinci-VPBE: fix error handling in vpbe_initialize()

Arnd Bergmann <[email protected]>
media: i2c: TDA1997x: select CONFIG_HDMI

Sebastian Andrzej Siewior <[email protected]>
x86/fpu: Add might_fault() to user_insn()

Randy Dunlap <[email protected]>
spi: fix spi-at91-usart.c build errors when PINCTRL is not set

Rob Herring <[email protected]>
ARM: dts: aspeed: add missing memory unit-address

Lubomir Rintel <[email protected]>
ARM: mmp/mmp2: dt: enable the clock

Lubomir Rintel <[email protected]>
ARM: dts: mmp2: fix TWSI2

Eric Anholt <[email protected]>
drm/v3d: Fix prime imports of buffers from other drivers.

Mark Rutland <[email protected]>
arm64: ftrace: don't adjust the LR value

Lorenzo Bianconi <[email protected]>
mt76x0: dfs: fix IBI_R11 configuration on non-radar channels

Harald Freudenberger <[email protected]>
s390/zcrypt: improve special ap message cmd handling

Arend van Spriel <[email protected]>
firmware/efi: Add NULL pointer checks in efivars API functions

Thara Gopinath <[email protected]>
thermal: Fix locking in cooling device sysfs update cur_state

Wei Wang <[email protected]>
Thermal: do not clear passive state during system sleep

Will Deacon <[email protected]>
arm64: io: Ensure value passed to __iormb() is held in a 64-bit register

Nicholas Mc Guire <[email protected]>
perf: arm_spe: handle devm_kasprintf() failure

Sean Paul <[email protected]>

    drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()

J. Bruce Fields <[email protected]>
nfsd4: fix crash on writing v4_end_grace before nfsd startup

Yangtao Li <[email protected]>
soc: bcm: brcmstb: Don't leak device tree node reference

Young Xiao <[email protected]>
sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN

YueHaibing <[email protected]>
net: aquantia: return 'err' if set MPI_DEINIT state fails

Will Deacon <[email protected]>
arm64: io: Ensure calls to delay routines are ordered against prior readX()

Simon Horman <[email protected]>

    i2c: sh_mobile: add support for r8a77990 (R-Car E3)

Tiezhu Yang <[email protected]>
f2fs: fix wrong return value of f2fs_acl_create

Sheng Yong <[email protected]>
f2fs: fix race between write_checkpoint and write_begin

Jaegeuk Kim <[email protected]>
f2fs: avoid build warn of fall_through

Yunlei He <[email protected]>
f2fs: move dir data flush to write checkpoint process

Yunlong Song <[email protected]>
f2fs: avoid GC causing encrypted file corrupted

Michael Straube <[email protected]>
staging: pi433: fix potential null dereference

Andy Shevchenko <[email protected]>
ACPI: SPCR: Consider baud rate 0 as preconfigured state

Hans Verkuil <[email protected]>

    media: adv*/tc358743/ths8200: fill in min width/height/pixelclock

Hans de Goede <[email protected]>
iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID

Martin Blumenstingl <[email protected]>
iio: adc: meson-saradc: fix internal clock names

Nicholas Mc Guire <[email protected]>
iio: adc: meson-saradc: check for devm_kasprintf failure

Mathieu Malaterre <[email protected]>
powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly

Nathan Chancellor <[email protected]>
dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll

YueHaibing <[email protected]>
ptp: Fix pass zero to ERR_PTR() in ptp_clock_register

Martin Blumenstingl <[email protected]>
clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL

Martin Blumenstingl <[email protected]>
clk: meson: meson8b: fix the width of the cpu_scale_div clock

Martin Blumenstingl <[email protected]>
clk: meson: meson8b: do not use cpu_div3 for cpu_scale_out_sel

Chen-Yu Tsai <[email protected]>
ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply

Laurent Pinchart <[email protected]>
drm: rcar-du: Fix external clock error checks

Parav Pandit <[email protected]>
RDMA/core: Sync unregistration with netlink commands

Hans Verkuil <[email protected]>
media: vivid: fill in media_device bus_info

Babu Moger <[email protected]>
x86/resctrl: Fixup the user-visible strings

Gao Xiang <[email protected]>
staging: erofs: fix race when the managed cache is enabled

Gao Xiang <[email protected]>
staging: erofs: fix the definition of DBG_BUGON

Alexey Khoroshilov <[email protected]>
media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()

Akinobu Mita <[email protected]>
media: video-i2c: avoid accessing released memory area when removing driver

Sean Young <[email protected]>
media: rc: ensure close() is called on rc_unregister_device

Yangtao Li <[email protected]>
soc/tegra: Don't leak device tree node reference

Arnd Bergmann <[email protected]>
scsi: cxgb4i: fix thermal configuration dependencies

Pu Wen <[email protected]>
perf tools: Add Hygon Dhyana support

Sami Tolvanen <[email protected]>
modpost: validate symbol names also in find_elf_symbol

Saeed Mahameed <[email protected]>
net/mlx5: EQ, Use the right place to store/read IRQ affinity hint

Stanislav Fomichev <[email protected]>
bpf: libbpf: retry map creation without the name

Yogesh Mohan Marimuthu <[email protected]>

    drm/amd/display: calculate stream->phy_pix_clk before clock mapping

Murton Liu <[email protected]>
drm/amd/display: fix gamma not being applied correctly

Nathan Chancellor <[email protected]>
ARM: OMAP2+: hwmod: Fix some section annotations

Damian Kos <[email protected]>
drm/rockchip: fix for mailbox read size

Ben Dooks <[email protected]>
usbnet: smsc95xx: fix rx packet alignment

Renato Lui Geh <[email protected]>
staging: iio: ad7780: update voltage on read

Xiang Chen <[email protected]>
scsi: hisi_sas: change the time of SAS SSP connection

Alan Brady <[email protected]>
i40e: prevent overlapping tx_timeout recover

Mitch Williams <[email protected]>
i40e: suppress bogus error message

Brian Norris <[email protected]>
platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup

Arnd Bergmann <[email protected]>
vbox: fix link error with 'gcc -Og'

Anatolij Gustschin <[email protected]>
fpga: altera-cvp: fix 'bad IO access' on x86_64

Dexuan Cui <[email protected]>
Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1

Andreas Puhm <[email protected]>
fpga: altera-cvp: Fix registration for CvP incapable devices

Matheus Tavares <[email protected]>
staging:iio:ad2s90: Make probe handle spi_setup failure

Naftali Goldstein <[email protected]>
iwlwifi: fw: do not set sgi bits for HE connection

Ioana Ciornei <[email protected]>
dpaa2-ptp: defer probe when portal allocation failed

Paul Burton <[email protected]>
MIPS: Boston: Disable EG20T prefetch

Miroslav Lichvar <[email protected]>
ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl

Andy Duan <[email protected]>
serial: fsl_lpuart: clear parity enable bit when disable parity

Boris Brezillon <[email protected]>

    drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE

Eric Biggers <[email protected]>
crypto: aes_ti - disable interrupts while accessing S-box

Julian Wiedmann <[email protected]>
s390/qeth: utilize virtual MAC for Layer2 OSD devices

David Ahern <[email protected]>
bpftool: Improve handling of ENOENT on map dumps

Frank Rowand <[email protected]>
powerpc/pseries: add of_node_put() in dlpar_detach_node()

Colin Ian King <[email protected]>
x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)

Bob Peterson <[email protected]>
dlm: Don't swamp the CPU with callbacks queued during recovery

Yi Wang <[email protected]>
clk: boston: fix possible memory leak in clk_boston_setup()

Yufen Wang <[email protected]>
ARM: 8808/1: kexec:offline panic_smp_self_stop CPU

James Smart <[email protected]>
scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event

Suganath Prabu <[email protected]>
scsi: mpt3sas: Call sas_remove_host before removing the target devices

James Smart <[email protected]>
scsi: lpfc: Correct LCB RJT handling

Lorenzo Bianconi <[email protected]>
ath9k: dynack: use authentication messages for 'late' ack

Brian Norris <[email protected]>
ath10k: assign 'n_cipher_suites' for WCN3990

Lior David <[email protected]>
wil6210: fix memory leak in wil_find_tx_bcast_2

Alexei Avshalom Lazar <[email protected]>
wil6210: fix reset flow for Talyn-mb

Nickhu <[email protected]>
nds32: Fix gcc 8.0 compiler option incompatible.

Bhawanpreet Lakha <[email protected]>
drm/amd/display: Fix potential nullptr error

Steve Longerbeam <[email protected]>
gpu: ipu-v3: image-convert: Prevent race between run and unprepare

Long Li <[email protected]>
genirq/affinity: Spread IRQs to all available NUMA nodes

Dan Carpenter <[email protected]>
ath10k: fixup extended per sta tx statistics

Jernej Skrabec <[email protected]>
drm/sun4i: Initialize registers in tcon-top driver

Muchun Song <[email protected]>
gpiolib: Fix possible use after free on label

Arnd Bergmann <[email protected]>
ASoC: Intel: mrfld: fix uninitialized variable access

Jernej Skrabec <[email protected]>
clk: sunxi-ng: h6: Set video PLLs limits

Lukas Wunner <[email protected]>
pinctrl: bcm2835: Use raw spinlock for RT compatibility

Deepak Sharma <[email protected]>
drm/vgem: Fix vgem_init to get drm device available.

Slawomir Stepien <[email protected]>

    staging: iio: adc: ad7280a: handle error from __ad7280_read32()

Eric Anholt <[email protected]>
drm/v3d: Fix a use-after-free race accessing the scheduler's fences.

Gustavo A. R. Silva <[email protected]>
drm/bufs: Fix Spectre v1 vulnerability

-------------

Diffstat:

 Makefile                                           |   4 +-
 .../boot/dts/aspeed-bmc-arm-centriq2400-rep.dts    |   2 +-
 arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts     |   2 +-
 arch/arm/boot/dts/aspeed-bmc-opp-lanyang.dts       |   3 +-
 arch/arm/boot/dts/aspeed-bmc-portwell-neptune.dts  |   2 +-
 arch/arm/boot/dts/gemini-dlink-dir-685.dts         |  16 +--
 arch/arm/boot/dts/imx51-zii-rdu1.dts               |  17 ++-
 arch/arm/boot/dts/mmp2.dtsi                        |   9 +-
 arch/arm/boot/dts/omap4-sdp.dts                    |   1 +
 arch/arm/kernel/smp.c                              |  15 +++
 arch/arm/mach-mmp/common.h                         |   2 +-
 arch/arm/mach-mmp/mmp2.c                           |   2 +-
 arch/arm/mach-mmp/pxa168.c                         |   2 +-
 arch/arm/mach-mmp/pxa910.c                         |   2 +-
 arch/arm/mach-mmp/time.c                           |  32 +++--
 arch/arm/mach-omap1/board-ams-delta.c              |   6 +-
 arch/arm/mach-omap2/omap_hwmod.c                   |   6 +-
 arch/arm/mach-pxa/cm-x300.c                        |   2 +-
 arch/arm/mach-pxa/littleton.c                      |   2 +-
 arch/arm/mach-pxa/zeus.c                           |   2 +-
 .../boot/dts/allwinner/sun50i-a64-orangepi-win.dts |   1 +
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi         |   2 +-
 arch/arm64/boot/dts/amlogic/meson-gx.dtsi          |   2 +-
 .../arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts |   1 -
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi  |   1 -
 arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts  |  20 +--
 arch/arm64/include/asm/io.h                        |  32 +++--
 arch/arm64/include/uapi/asm/ptrace.h               |   2 +-
 arch/arm64/kernel/entry-ftrace.S                   |   1 -
 arch/mips/boot/dts/img/boston.dts                  |   6 +
 arch/mips/include/asm/mach-jz4740/jz4740_mmc.h     |   2 -
 arch/mips/include/uapi/asm/inst.h                  |   2 +-
 arch/mips/jz4740/board-qi_lb60.c                   |  12 +-
 arch/mips/ralink/Kconfig                           |   1 +
 arch/nds32/mm/Makefile                             |   6 +-
 arch/powerpc/include/asm/fadump.h                  |   2 +-
 arch/powerpc/include/asm/uaccess.h                 |   2 +-
 arch/powerpc/kernel/fadump.c                       |  10 +-
 arch/powerpc/kernel/vmlinux.lds.S                  |   4 +
 arch/powerpc/kvm/powerpc.c                         |   5 +-
 arch/powerpc/mm/fault.c                            |   4 +-
 arch/powerpc/perf/isa207-common.c                  |   7 +-
 arch/powerpc/platforms/powernv/pci-ioda-tce.c      |   2 +-
 arch/powerpc/platforms/pseries/dlpar.c             |   2 +
 arch/powerpc/platforms/pseries/hotplug-memory.c    |   7 +-
 arch/s390/include/uapi/asm/zcrypt.h                |   4 +-
 arch/s390/kvm/kvm-s390.c                           |  17 ++-
 arch/sh/boards/mach-kfr2r09/setup.c                |   1 -
 arch/um/include/asm/pgtable.h                      |   9 +-
 arch/x86/events/intel/core.c                       |  16 ++-
 arch/x86/events/intel/uncore_snbep.c               |   4 +-
 arch/x86/include/asm/fpu/internal.h                |   3 +
 arch/x86/kernel/cpu/bugs.c                         |   2 +-
 arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c        |  22 ++--
 arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c        |  34 +++---
 arch/x86/kernel/cpu/intel_rdt_rdtgroup.c           |  36 +++---
 arch/x86/kernel/cpu/mcheck/mce.c                   |   1 +
 arch/x86/kvm/svm.c                                 |   7 ++
 arch/x86/kvm/vmx.c                                 |   4 +-
 arch/x86/kvm/x86.c                                 |   7 ++
 arch/x86/pci/broadcom_bus.c                        |   4 +-
 arch/xtensa/boot/dts/xtfpga.dtsi                   |   2 +-
 crypto/Kconfig                                     |   3 +-
 crypto/aes_ti.c                                    |  18 +++
 drivers/acpi/apei/ghes.c                           |   2 +
 drivers/acpi/spcr.c                                |  11 ++
 drivers/ata/sata_rcar.c                            |   4 +-
 drivers/base/bus.c                                 |  12 +-
 drivers/base/cacheinfo.c                           |   6 +-
 drivers/base/core.c                                |   8 +-
 drivers/base/dd.c                                  |   6 +-
 drivers/block/drbd/drbd_nl.c                       |  15 +--
 drivers/block/drbd/drbd_receiver.c                 |  13 +-
 drivers/block/sunvdc.c                             |   5 +
 drivers/block/swim3.c                              |  13 +-
 drivers/block/zram/zram_drv.c                      |  38 +++---
 drivers/block/zram/zram_drv.h                      |   2 +-
 drivers/bluetooth/hci_bcm.c                        |   4 +
 drivers/cdrom/gdrom.c                              |   1 +
 drivers/clk/imgtec/clk-boston.c                    |  11 +-
 drivers/clk/imx/clk-imx6sl.c                       |   6 +
 drivers/clk/meson/meson8b.c                        |  16 ++-
 drivers/clk/qcom/gcc-msm8998.c                     |   6 +
 drivers/clk/sunxi-ng/ccu-sun50i-h6.c               |   4 +
 drivers/clk/sunxi-ng/ccu-sun8i-a33.c               |   6 +-
 drivers/cpuidle/cpuidle-big_little.c               |   7 +-
 drivers/crypto/ux500/cryp/cryp_core.c              |   4 +-
 drivers/crypto/ux500/hash/hash_core.c              |   2 +-
 drivers/dma/bcm2835-dma.c                          |  70 ++++-------
 drivers/dma/imx-dma.c                              |   8 +-
 drivers/dma/sprd-dma.c                             |  25 ++--
 drivers/dma/xilinx/zynqmp_dma.c                    |   2 +-
 drivers/firmware/efi/vars.c                        |  99 +++++++++++----
 drivers/fpga/altera-cvp.c                          |  15 ++-
 drivers/gpio/gpio-mt7621.c                         |  10 +-
 drivers/gpio/gpiolib.c                             |  25 +++-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |   6 +
 drivers/gpu/drm/amd/display/dc/core/dc_link.c      |  26 +++-
 drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c   |   3 +-
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c  |   2 +
 .../amd/display/dc/dce110/dce110_hw_sequencer.c    |  11 +-
 .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c  |  12 +-
 .../drm/amd/powerplay/smumgr/polaris10_smumgr.c    |  17 ++-
 drivers/gpu/drm/drm_atomic_helper.c                |   8 +-
 drivers/gpu/drm/drm_bufs.c                         |   3 +
 .../gpu/drm/msm/disp/dpu1/dpu_encoder_phys_vid.c   |   2 +-
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c         |   8 +-
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c             |  14 ++-
 drivers/gpu/drm/rockchip/cdn-dp-reg.c              |   2 +-
 drivers/gpu/drm/sun4i/sun8i_tcon_top.c             |   7 ++
 drivers/gpu/drm/v3d/v3d_bo.c                       |   1 +
 drivers/gpu/drm/v3d/v3d_drv.h                      |   5 +
 drivers/gpu/drm/v3d/v3d_gem.c                      |   8 +-
 drivers/gpu/drm/vc4/vc4_plane.c                    |  12 +-
 drivers/gpu/drm/vgem/vgem_drv.c                    |  16 +--
 drivers/gpu/ipu-v3/ipu-image-convert.c             |  10 +-
 drivers/hid/hid-debug.c                            | 120 ++++++++----------
 drivers/hid/hid-lenovo.c                           |  10 +-
 drivers/hwmon/lm80.c                               |  26 ++--
 drivers/i2c/busses/i2c-axxia.c                     |  32 ++---
 drivers/i2c/busses/i2c-sh_mobile.c                 |   2 +
 drivers/iio/accel/kxcjk-1013.c                     |   1 +
 drivers/iio/adc/meson_saradc.c                     |  14 ++-
 drivers/infiniband/core/core_priv.h                |   1 +
 drivers/infiniband/core/device.c                   |  26 +++-
 drivers/infiniband/core/nldev.c                    |  20 +--
 drivers/infiniband/hw/hfi1/rc.c                    |   2 +
 drivers/iommu/amd_iommu.c                          |   9 +-
 drivers/iommu/arm-smmu-v3.c                        |  14 ++-
 drivers/iommu/arm-smmu.c                           |   3 +
 drivers/irqchip/irq-gic-v3-its.c                   |  32 ++++-
 drivers/isdn/hisax/hfc_pci.c                       |   2 +
 drivers/lightnvm/core.c                            |   2 +-
 drivers/lightnvm/pblk-core.c                       |  13 +-
 drivers/lightnvm/pblk-write.c                      |   8 +-
 drivers/md/raid10.c                                |   4 +
 drivers/media/i2c/Kconfig                          |   2 +
 drivers/media/i2c/ad9389b.c                        |   2 +-
 drivers/media/i2c/adv7511.c                        |   2 +-
 drivers/media/i2c/adv7604.c                        |   4 +-
 drivers/media/i2c/adv7842.c                        |   4 +-
 drivers/media/i2c/tc358743.c                       |   2 +-
 drivers/media/i2c/ths8200.c                        |   2 +-
 drivers/media/i2c/video-i2c.c                      |  11 +-
 drivers/media/platform/coda/coda-bit.c             |  19 ++-
 drivers/media/platform/coda/coda-common.c          |  15 ++-
 drivers/media/platform/coda/coda.h                 |   6 +-
 drivers/media/platform/coda/coda_regs.h            |   2 +-
 drivers/media/platform/davinci/vpbe.c              |   7 +-
 .../media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c  |  10 +-
 drivers/media/platform/vivid/vivid-core.c          |   2 +
 drivers/media/rc/rc-main.c                         |   2 +
 drivers/media/v4l2-core/v4l2-device.c              |   1 +
 drivers/memstick/core/memstick.c                   |   3 +
 drivers/mmc/host/bcm2835.c                         |  12 ++
 drivers/mmc/host/jz4740_mmc.c                      |  20 +--
 drivers/mmc/host/meson-mx-sdio.c                   |   6 +
 drivers/mmc/host/sdhci-of-esdhc.c                  |  16 ++-
 drivers/mmc/host/sdhci-omap.c                      |  16 ++-
 drivers/mmc/host/sdhci-xenon-phy.c                 |  10 +-
 drivers/mmc/host/sdhci-xenon.c                     |  10 +-
 drivers/net/dsa/b53/b53_srab.c                     |   3 -
 drivers/net/dsa/mv88e6xxx/global1_atu.c            |  21 ++--
 .../aquantia/atlantic/hw_atl/hw_atl_utils.c        |   2 +
 drivers/net/ethernet/broadcom/bcmsysport.c         |  25 ++--
 drivers/net/ethernet/broadcom/bcmsysport.h         |   2 +
 drivers/net/ethernet/broadcom/bnxt/bnxt.c          |  27 +++--
 drivers/net/ethernet/cisco/enic/enic_main.c        |   3 +-
 drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c   |   5 +-
 drivers/net/ethernet/freescale/fman/fman_memac.c   |   2 +-
 drivers/net/ethernet/freescale/fman/fman_tgec.c    |   2 +-
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c    |  30 +++--
 .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c    |   4 +
 drivers/net/ethernet/intel/i40e/i40e.h             |   1 +
 drivers/net/ethernet/intel/i40e/i40e_main.c        |   8 ++
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c |   3 +-
 drivers/net/ethernet/intel/ice/ice_main.c          |  16 ++-
 drivers/net/ethernet/intel/igb/igb_main.c          |   8 +-
 drivers/net/ethernet/marvell/skge.c                |   6 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_main.c  |   2 +-
 drivers/net/ethernet/mellanox/mlx5/core/en_rx.c    |  13 ++
 drivers/net/ethernet/mellanox/mlx5/core/en_tc.c    |   9 +-
 .../net/ethernet/mellanox/mlx5/core/lib/clock.c    |   4 +-
 drivers/net/ethernet/mellanox/mlx5/core/main.c     |  14 ++-
 drivers/net/ethernet/mellanox/mlxsw/spectrum.c     |  23 ++++
 .../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c    |   5 +-
 .../ethernet/mellanox/mlxsw/spectrum_switchdev.c   |  27 +----
 drivers/net/ethernet/sun/niu.c                     |  10 +-
 drivers/net/phy/dp83640.c                          |  13 +-
 drivers/net/phy/marvell.c                          |  12 --
 drivers/net/usb/smsc95xx.c                         |   1 +
 drivers/net/virtio_net.c                           |  20 ++-
 drivers/net/wireless/ath/ath10k/core.c             |   1 +
 drivers/net/wireless/ath/ath10k/mac.c              |  28 +++--
 drivers/net/wireless/ath/ath9k/dynack.c            |   3 +-
 drivers/net/wireless/ath/wil6210/main.c            |  11 +-
 drivers/net/wireless/ath/wil6210/txrx.c            |   2 +
 drivers/net/wireless/intel/iwlwifi/fw/api/mac.h    |   2 +-
 drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c  |   8 +-
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c     |   4 +
 .../net/wireless/mediatek/mt76/mt76x2/pci_dfs.c    |   8 +-
 drivers/net/wireless/st/cw1200/scan.c              |  13 +-
 drivers/nvme/host/lightnvm.c                       |   3 +-
 drivers/opp/core.c                                 |  11 +-
 drivers/pci/controller/dwc/pci-imx6.c              |  10 ++
 drivers/pci/switch/switchtec.c                     |   3 +
 drivers/perf/arm_spe_pmu.c                         |   5 +
 drivers/phy/allwinner/phy-sun4i-usb.c              |   7 ++
 drivers/pinctrl/bcm/pinctrl-bcm2835.c              |  16 +--
 drivers/pinctrl/meson/pinctrl-meson8.c             |   3 +
 drivers/pinctrl/meson/pinctrl-meson8b.c            |  13 +-
 drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c          |   3 +
 drivers/pinctrl/pinctrl-rza1.c                     |   5 +
 drivers/pinctrl/pinctrl-sx150x.c                   |  11 +-
 drivers/platform/chrome/cros_ec_proto.c            |  18 ++-
 drivers/platform/x86/intel_atomisp2_pm.c           |  68 ++++++++---
 drivers/platform/x86/mlx-platform.c                |  12 +-
 drivers/ptp/ptp_chardev.c                          |   5 +-
 drivers/ptp/ptp_clock.c                            |   5 +-
 drivers/s390/crypto/zcrypt_error.h                 |   2 +
 drivers/s390/net/qeth_core.h                       |   1 -
 drivers/s390/net/qeth_core_main.c                  |  12 +-
 drivers/s390/net/qeth_core_mpc.h                   |  25 ++--
 drivers/s390/net/qeth_l2_main.c                    |  10 +-
 drivers/scsi/aic94xx/aic94xx_init.c                |   8 +-
 drivers/scsi/cxgbi/cxgb4i/Kconfig                  |   4 +-
 drivers/scsi/cxlflash/main.c                       |   2 +
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c             |   2 +-
 drivers/scsi/lpfc/lpfc_els.c                       |  52 ++++----
 drivers/scsi/lpfc/lpfc_nportdisc.c                 |   5 +
 drivers/scsi/mpt3sas/mpt3sas_scsih.c               |   2 +-
 drivers/scsi/mpt3sas/mpt3sas_transport.c           |   7 +-
 drivers/scsi/sd_zbc.c                              |  12 +-
 drivers/scsi/smartpqi/smartpqi_init.c              |   6 +
 drivers/scsi/smartpqi/smartpqi_sis.c               |   2 +-
 drivers/soc/bcm/brcmstb/common.c                   |   6 +-
 drivers/soc/tegra/common.c                         |   6 +-
 drivers/spi/spi-at91-usart.c                       |   1 +
 drivers/staging/erofs/internal.h                   |   3 +-
 drivers/staging/erofs/utils.c                      | 134 +++++++++++++++------
 drivers/staging/iio/adc/ad7280a.c                  |  17 ++-
 drivers/staging/iio/adc/ad7780.c                   |   6 +-
 drivers/staging/iio/resolver/ad2s90.c              |   7 +-
 drivers/staging/pi433/pi433_if.c                   |   4 +
 drivers/staging/speakup/spk_ttyio.c                |   6 +-
 drivers/tee/optee/supp.c                           |  13 +-
 drivers/thermal/broadcom/bcm2835_thermal.c         |  11 ++
 drivers/thermal/qcom/tsens-common.c                |  12 +-
 drivers/thermal/thermal-generic-adc.c              |  12 +-
 drivers/thermal/thermal_core.c                     |  12 +-
 drivers/thermal/thermal_hwmon.h                    |   4 +-
 drivers/thermal/thermal_sysfs.c                    |  11 +-
 drivers/tty/serial/8250/8250_pci.c                 |   9 +-
 drivers/tty/serial/fsl_lpuart.c                    |   4 +
 drivers/tty/serial/samsung.c                       |   3 +
 drivers/tty/serial/serial_core.c                   |   6 +
 drivers/tty/serial/sh-sci.c                        |  32 +++--
 drivers/usb/core/hub.c                             |  10 ++
 drivers/usb/dwc2/params.c                          |  10 +-
 drivers/usb/dwc3/gadget.c                          |  16 ++-
 drivers/usb/dwc3/trace.h                           |   2 +
 drivers/usb/gadget/udc/net2272.c                   |   2 +-
 drivers/usb/mtu3/mtu3_core.c                       |   4 +-
 drivers/usb/mtu3/mtu3_gadget_ep0.c                 |   8 +-
 drivers/usb/musb/musb_dsps.c                       |  21 +++-
 drivers/usb/musb/musb_gadget.c                     |  13 +-
 drivers/usb/musb/musbhsdma.c                       |  21 ++--
 drivers/usb/phy/phy-am335x.c                       |   5 +-
 drivers/usb/renesas_usbhs/common.c                 |   4 +
 drivers/video/fbdev/clps711x-fb.c                  |   5 +-
 drivers/video/fbdev/core/fbcon.c                   |   2 +-
 drivers/video/fbdev/core/fbmem.c                   |   8 +-
 drivers/virt/vboxguest/vboxguest_core.c            |   2 +-
 drivers/watchdog/renesas_wdt.c                     |   9 +-
 fs/binfmt_script.c                                 |  10 +-
 fs/btrfs/btrfs_inode.h                             |   1 +
 fs/btrfs/ctree.h                                   |   2 +-
 fs/btrfs/extent_io.c                               |  17 ++-
 fs/btrfs/inode.c                                   |  11 +-
 fs/btrfs/ioctl.c                                   |   2 +-
 fs/btrfs/reada.c                                   |  12 +-
 fs/btrfs/volumes.c                                 |  29 +++++
 fs/cifs/readdir.c                                  |   9 +-
 fs/dlm/ast.c                                       |  10 ++
 fs/eventpoll.c                                     |   2 +-
 fs/f2fs/acl.c                                      |  14 ++-
 fs/f2fs/checkpoint.c                               |   7 +-
 fs/f2fs/data.c                                     |  12 +-
 fs/f2fs/f2fs.h                                     |  12 +-
 fs/f2fs/file.c                                     |   3 +
 fs/f2fs/gc.c                                       |  15 ++-
 fs/f2fs/node.c                                     |   5 +-
 fs/f2fs/segment.c                                  |   3 +-
 fs/f2fs/shrinker.c                                 |   2 +-
 fs/f2fs/super.c                                    |  27 +++--
 fs/fuse/dev.c                                      |   4 +-
 fs/fuse/file.c                                     |   2 +-
 fs/fuse/inode.c                                    |   2 +-
 fs/nfs/super.c                                     |   3 +-
 fs/nfsd/nfsctl.c                                   |   2 +
 fs/nfsd/vfs.c                                      |   6 +-
 fs/ocfs2/Makefile                                  |   2 +-
 fs/ocfs2/buffer_head_io.c                          |   2 -
 fs/ocfs2/dlm/Makefile                              |   2 +-
 fs/ocfs2/dlmfs/Makefile                            |   2 +-
 fs/proc/base.c                                     |  12 +-
 fs/udf/inode.c                                     |   6 +
 fs/xfs/xfs_aops.c                                  |   2 +
 include/linux/cpu.h                                |   2 -
 include/linux/genl_magic_struct.h                  |   5 +-
 include/linux/gpio/consumer.h                      |   6 +-
 include/linux/hid-debug.h                          |   9 +-
 include/linux/kvm_host.h                           |   3 +-
 include/linux/mlx5/driver.h                        |   2 +-
 include/linux/skmsg.h                              |   8 ++
 include/rdma/ib_verbs.h                            |   8 +-
 include/sound/compress_driver.h                    |   6 +-
 include/sound/hda_codec.h                          |   1 +
 kernel/cgroup/cgroup.c                             |   2 +-
 kernel/cpu.c                                       |  33 +----
 kernel/debug/debug_core.c                          |   4 +
 kernel/debug/kdb/kdb_bt.c                          |  11 +-
 kernel/debug/kdb/kdb_debugger.c                    |   7 --
 kernel/events/ring_buffer.c                        |   3 +
 kernel/futex.c                                     |  28 +++--
 kernel/hung_task.c                                 |  20 ++-
 kernel/irq/affinity.c                              |   5 +-
 kernel/kcov.c                                      |   2 +-
 kernel/locking/rtmutex.c                           |  37 +++++-
 kernel/module.c                                    |   6 +-
 kernel/sched/fair.c                                |   1 +
 kernel/smp.c                                       |   2 -
 kernel/sysctl.c                                    |   2 +
 kernel/time/timekeeping.c                          |   4 +-
 kernel/trace/trace_stack.c                         |   2 +-
 lib/seq_buf.c                                      |   6 +-
 lib/test_rhashtable.c                              |  23 ++--
 mm/page_alloc.c                                    |  37 ++++--
 mm/percpu-km.c                                     |   5 +-
 net/core/skmsg.c                                   |   7 +-
 net/dccp/ccid.h                                    |   4 +-
 net/dsa/master.c                                   |   4 +
 net/dsa/slave.c                                    |  17 +--
 net/ipv4/tcp_bpf.c                                 |   2 +-
 net/ipv6/tcp_ipv6.c                                |   3 +-
 net/ipv6/xfrm6_tunnel.c                            |   3 +
 net/mac80211/rx.c                                  |  31 +++--
 net/mac80211/util.c                                |  49 +++++---
 net/rds/bind.c                                     |   6 +-
 net/rxrpc/recvmsg.c                                |   3 +-
 net/sched/cls_flower.c                             |   6 +-
 net/sctp/socket.c                                  |   4 +-
 net/sctp/stream.c                                  |  20 +++
 net/sunrpc/xprtrdma/backchannel.c                  |  13 +-
 net/sunrpc/xprtrdma/svc_rdma_backchannel.c         |   8 +-
 net/sunrpc/xprtrdma/transport.c                    |  17 +--
 net/sunrpc/xprtrdma/verbs.c                        |   1 -
 net/sunrpc/xprtrdma/xprt_rdma.h                    |   1 +
 net/tipc/node.c                                    |   6 +
 samples/livepatch/livepatch-shadow-fix1.c          |   5 +
 samples/livepatch/livepatch-shadow-mod.c           |   4 +
 scripts/decode_stacktrace.sh                       |   2 +-
 scripts/gdb/linux/proc.py                          |   2 +-
 scripts/mod/modpost.c                              |  50 ++++----
 security/smack/smack_lsm.c                         |  12 +-
 sound/pci/hda/hda_bind.c                           |   3 +-
 sound/pci/hda/hda_intel.c                          |   2 +
 sound/pci/hda/patch_realtek.c                      |  62 +++++-----
 sound/soc/fsl/Kconfig                              |   2 +-
 sound/soc/intel/atom/sst/sst_loader.c              |   8 +-
 sound/soc/sunxi/sun50i-codec-analog.c              |   2 +
 sound/usb/quirks.c                                 |   1 +
 tools/bpf/bpftool/common.c                         |   4 +-
 tools/bpf/bpftool/json_writer.c                    |   6 +-
 tools/bpf/bpftool/map.c                            |  18 ++-
 tools/bpf/bpftool/prog.c                           |   4 +-
 tools/bpf/bpftool/xlated_dumper.c                  |   7 +-
 tools/build/Makefile.feature                       |   4 +-
 tools/build/feature/Makefile                       |  10 +-
 tools/hv/hv_kvp_daemon.c                           |  15 ++-
 tools/lib/bpf/bpf.c                                |  11 +-
 tools/perf/Makefile.config                         |  44 +++----
 tools/perf/arch/x86/util/kvm-stat.c                |   2 +-
 tools/perf/tests/attr.py                           |   2 +-
 tools/perf/tests/evsel-tp-sched.c                  |   2 +-
 tools/perf/util/dso.c                              |   2 +-
 tools/perf/util/header.c                           |   6 +-
 tools/perf/util/probe-file.c                       |   2 +-
 tools/perf/util/python.c                           |   3 +-
 tools/perf/util/s390-cpumsf.c                      |   2 +-
 tools/perf/util/stat-display.c                     |  16 ++-
 .../x86/intel_pstate_tracer/intel_pstate_tracer.py |   4 +-
 tools/testing/selftests/Makefile                   |   1 +
 tools/testing/selftests/bpf/test_progs.c           |   8 +-
 tools/testing/selftests/drivers/dma-buf/Makefile   |   2 +
 tools/testing/selftests/drivers/dma-buf/udmabuf.c  |  11 +-
 tools/testing/selftests/kvm/x86_64/evmcs_test.c    |   4 +-
 tools/testing/selftests/kvm/x86_64/state_test.c    |   4 +-
 virt/kvm/arm/mmio.c                                |  11 +-
 virt/kvm/kvm_main.c                                |   6 +-
 400 files changed, 2627 insertions(+), 1313 deletions(-)

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #15 lore raw

PATCH 12/352 gpu: ipu-v3: image-convert: Prevent race between run and unprepare

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 819bec35c8c9706185498c9222bd244e0781ad35 ]

Prevent possible race by parallel threads between ipu_image_convert_run() and ipu_image_convert_unprepare(). This involves setting ctx->aborting to true unconditionally so that no new job runs can be queued during unprepare, and holding the ctx->aborting flag until the context is freed.

Note that the "normal" ipu_image_convert_abort() case (e.g. not during context unprepare) should clear the ctx->aborting flag after aborting any active run and clearing the context's pending queue. This is because it should be possible to continue to use the conversion context and queue more runs after an abort.

Signed-off-by Steve Longerbeam <[email protected]>

Tested-by Philipp Zabel <[email protected]>

Signed-off-by Philipp Zabel <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/ipu-v3/ipu-image-convert.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

drivers/gpu/ipu-v3/ipu-image-convert.c +7 -3

index f4081962784c..91653adc41cc 100644
@@ -1524,7 +1524,7 @@ unlock:
 EXPORT_SYMBOL_GPL(ipu_image_convert_queue);
 
 /* Abort any active or pending conversions for this context */
-void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+static void __ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 {
 	struct ipu_image_convert_chan *chan = ctx->chan;
 	struct ipu_image_convert_priv *priv = chan->priv;

@@ -1551,7 +1551,7 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 
 	need_abort = (run_count || active_run);
 
-	ctx->aborting = need_abort;
+	ctx->aborting = true;
 
 	spin_unlock_irqrestore(&chan->irqlock, flags);

@@ -1572,7 +1572,11 @@ void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
 		dev_warn(priv->ipu->dev, "%s: timeout\n", __func__);
 		force_abort(ctx);
 	}
+}
 
+void ipu_image_convert_abort(struct ipu_image_convert_ctx *ctx)
+{
+	__ipu_image_convert_abort(ctx);
 	ctx->aborting = false;
 }
 EXPORT_SYMBOL_GPL(ipu_image_convert_abort);

@@ -1586,7 +1590,7 @@ void ipu_image_convert_unprepare(struct ipu_image_convert_ctx *ctx)
 	bool put_res;
 
 	/* make sure no runs are hanging around */
-	ipu_image_convert_abort(ctx);
+	__ipu_image_convert_abort(ctx);
 
 	dev_dbg(priv->ipu->dev, "%s: task %u: removing ctx %p\n", __func__,
 		chan->ic_task, ctx);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #29 lore raw

PATCH 22/352 ARM: 8808/1: kexec:offline panic_smp_self_stop CPU

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 82c08c3e7f171aa7f579b231d0abbc1d62e91974 ]

In case panic() and panic() called at the same time on different CPUS. For example:
CPU 0:
panic()

     __crash_kexec
       machine_crash_shutdown
         crash_smp_send_stop
       machine_kexec
         BUG_ON(num_online_cpus() > 1);

CPU 1:
panic()
local_irq_disable
panic_smp_self_stop

If CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop(), kdump fails. CPU1 can't receive the ipi irq, CPU1 will be always online. To fix this problem, this patch split out the panic_smp_self_stop() and add set_cpu_online(smp_processor_id(), false).

Signed-off-by Yufen Wang <[email protected]>

Signed-off-by Russell King <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/kernel/smp.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

arch/arm/kernel/smp.c +15 -0

index 12a6172263c0..3bf82232b1be 100644
@@ -724,6 +724,21 @@ void smp_send_stop(void)
 		pr_warn("SMP: failed to stop secondary CPUs\n");
 }
 
+/* In case panic() and panic() called at the same time on CPU1 and CPU2,
+ * and CPU 1 calls panic_smp_self_stop() before crash_smp_send_stop()
+ * CPU1 can't receive the ipi irqs from CPU2, CPU1 will be always online,
+ * kdump fails. So split out the panic_smp_self_stop() and add
+ * set_cpu_online(smp_processor_id(), false).
+ */
+void panic_smp_self_stop(void)
+{
+	pr_debug("CPU %u will stop doing anything useful since another CPU has paniced\n",
+	         smp_processor_id());
+	set_cpu_online(smp_processor_id(), false);
+	while (1)
+		cpu_relax();
+}
+
 /*
  * not supported here
  */

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #31 lore raw

PATCH 24/352 dlm: Dont swamp the CPU with callbacks queued during recovery

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 216f0efd19b9cc32207934fd1b87a45f2c4c593e ]

Before this patch, recovery would cause all callbacks to be delayed, put on a queue, and afterward they were all queued to the callback work queue. This patch does the same thing, but occasionally takes a break after 25 of them so it won't swamp the CPU at the expense of other RT processes like corosync.

Signed-off-by Bob Peterson <[email protected]>

Signed-off-by David Teigland <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/dlm/ast.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

fs/dlm/ast.c +10 -0

index 562fa8c3edff..47ee66d70109 100644
@@ -292,6 +292,8 @@ void dlm_callback_suspend(struct dlm_ls *ls)
 		flush_workqueue(ls->ls_callback_wq);
 }
 
+#define MAX_CB_QUEUE 25
+
 void dlm_callback_resume(struct dlm_ls *ls)
 {
 	struct dlm_lkb *lkb, *safe;

@@ -302,15 +304,23 @@ void dlm_callback_resume(struct dlm_ls *ls)
 	if (!ls->ls_callback_wq)
 		return;
 
+more:
 	mutex_lock(&ls->ls_cb_mutex);
 	list_for_each_entry_safe(lkb, safe, &ls->ls_cb_delay, lkb_cb_list) {
 		list_del_init(&lkb->lkb_cb_list);
 		queue_work(ls->ls_callback_wq, &lkb->lkb_cb_work);
 		count++;
+		if (count == MAX_CB_QUEUE)
+			break;
 	}
 	mutex_unlock(&ls->ls_cb_mutex);
 
 	if (count)
 		log_rinfo(ls, "dlm_callback_resume %d", count);
+	if (count == MAX_CB_QUEUE) {
+		count = 0;
+		cond_resched();
+		goto more;
+	}
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #32 lore raw

PATCH 25/352 x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 53bb565fc5439f2c8c57a786feea5946804aa3e9 ]

In the expression "word1 << 16", word1 starts as u16, but is promoted to a signed int, then sign-extended to resource_size_t, which is probably not what was intended. Cast to resource_size_t to avoid the sign extension.

This fixes an identical issue as fixed by commit 0b2d70764bb3 ("x86/PCI:
Fix Broadcom CNB20LE unintended sign extension") back in 2014.

Detected by CoverityScan, CID#138749, 138750 ("Unintended sign extension")

Fixes 3f6ea84a3035 ("PCI: read memory ranges out of Broadcom CNB20LE host bridge")

Signed-off-by Colin Ian King <[email protected]>

Signed-off-by Bjorn Helgaas <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/x86/pci/broadcom_bus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

arch/x86/pci/broadcom_bus.c +2 -2

index 526536c81ddc..ca1e8e6dccc8 100644
@@ -50,8 +50,8 @@ static void __init cnb20le_res(u8 bus, u8 slot, u8 func)
 	word1 = read_pci_config_16(bus, slot, func, 0xc0);
 	word2 = read_pci_config_16(bus, slot, func, 0xc2);
 	if (word1 != word2) {
-		res.start = (word1 << 16) | 0x0000;
-		res.end   = (word2 << 16) | 0xffff;
+		res.start = ((resource_size_t) word1 << 16) | 0x0000;
+		res.end   = ((resource_size_t) word2 << 16) | 0xffff;
 		res.flags = IORESOURCE_MEM;
 		update_res(info, res.start, res.end, res.flags, 0);
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #33 lore raw

PATCH 26/352 powerpc/pseries: add of_node_put() in dlpar_detach_node()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5b3f5c408d8cc59b87e47f1ab9803dbd006e4a91 ]

The previous commit, "of: overlay: add missing of_node_get() in __of_attach_node_sysfs" added a missing of_node_get() to __of_attach_node_sysfs(). This results in a refcount imbalance for nodes attached with dlpar_attach_node(). The calling sequence from dlpar_attach_node() to __of_attach_node_sysfs() is:

dlpar_attach_node()

      of_attach_node()
         __of_attach_node_sysfs()

For more detailed description of the node refcount, see commit 68baf692c435 ("powerpc/pseries: Fix of_node_put() underflow during DLPAR remove").

Tested-by Alan Tull <[email protected]>

Acked-by Michael Ellerman <[email protected]>

Signed-off-by Frank Rowand <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/powerpc/platforms/pseries/dlpar.c | 2 ++
 1 file changed, 2 insertions(+)

arch/powerpc/platforms/pseries/dlpar.c +2 -0

index 7625546caefd..17958043e7f7 100644
@@ -270,6 +270,8 @@ int dlpar_detach_node(struct device_node *dn)
 	if (rc)
 		return rc;
 
+	of_node_put(dn);
+
 	return 0;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #34 lore raw

PATCH 27/352 bpftool: Improve handling of ENOENT on map dumps

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit bf598a8f0f771302d4ecb0ef0003c54732221597 ]

bpftool output is not user friendly when dumping a map with only a few populated entries:

    $ bpftool map
    1: devmap  name tx_devmap  flags 0x0
            key 4B  value 4B  max_entries 64  memlock 4096B
    2: array  name tx_idxmap  flags 0x0
            key 4B  value 4B  max_entries 64  memlock 4096B

    $ bpftool map dump id 1
    key:
    00 00 00 00
    value:
    No such file or directory
    key:
    01 00 00 00
    value:
    No such file or directory
    key:
    02 00 00 00
    value:
    No such file or directory
    key: 03 00 00 00  value: 03 00 00 00

Handle ENOENT by keeping the line format sane and dumping "<no entry>" for the value

    $ bpftool map dump id 1
    key: 00 00 00 00  value: <no entry>
    key: 01 00 00 00  value: <no entry>
    key: 02 00 00 00  value: <no entry>
    key: 03 00 00 00  value: 03 00 00 00
    ...

Signed-off-by David Ahern <[email protected]>

Acked-by Jakub Kicinski <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/bpf/bpftool/map.c | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

tools/bpf/bpftool/map.c +14 -4

index 7bf38f0e152e..9988d5c126b6 100644
@@ -383,7 +383,10 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 		printf(single_line ? "  " : "\n");
 
 		printf("value:%c", break_names ? '\n' : ' ');
-		fprint_hex(stdout, value, info->value_size, " ");
+		if (value)
+			fprint_hex(stdout, value, info->value_size, " ");
+		else
+			printf("<no entry>");
 
 		printf("\n");
 	} else {

@@ -398,8 +401,11 @@ static void print_entry_plain(struct bpf_map_info *info, unsigned char *key,
 		for (i = 0; i < n; i++) {
 			printf("value (CPU %02d):%c",
 			       i, info->value_size > 16 ? '\n' : ' ');
-			fprint_hex(stdout, value + i * step,
-				   info->value_size, " ");
+			if (value)
+				fprint_hex(stdout, value + i * step,
+					   info->value_size, " ");
+			else
+				printf("<no entry>");
 			printf("\n");
 		}
 	}

@@ -731,7 +737,11 @@ static int dump_map_elem(int fd, void *key, void *value,
 		jsonw_string_field(json_wtr, "error", strerror(lookup_errno));
 		jsonw_end_object(json_wtr);
 	} else {
-		print_entry_error(map_info, key, strerror(lookup_errno));
+		if (errno == ENOENT)
+			print_entry_plain(map_info, key, NULL);
+		else
+			print_entry_error(map_info, key,
+					  strerror(lookup_errno));
 	}
 
 	return 0;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #35 lore raw

PATCH 28/352 s390/qeth: utilize virtual MAC for Layer2 OSD devices

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b144b99fff69a5bc0d34c8e168bedb88c68ca23d ]

By default, READ MAC on a Layer2 OSD device returns the adapter's burnt-in MAC address. Given the default scenario of many virtual devices on the same adapter, qeth can't make any use of this address and therefore skips the READ MAC call for this device type.

But in some configurations, the READ MAC command for a Layer2 OSD device actually returns a pre-provisioned, virtual MAC address. So enable the READ MAC code to detect this situation, and let the L2 subdriver call READ MAC for OSD devices.

This also removes the QETH_LAYER2_MAC_READ flag, which protects L2 devices against calling READ MAC multiple times. Instead protect the whole call to qeth_l2_request_initial_mac().

Signed-off-by Julian Wiedmann <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/s390/net/qeth_core.h      |  1 -
 drivers/s390/net/qeth_core_main.c | 12 +++++++-----
 drivers/s390/net/qeth_core_mpc.h  | 25 +++++++++++++++----------
 drivers/s390/net/qeth_l2_main.c   | 10 ++++------
 4 files changed, 26 insertions(+), 22 deletions(-)

drivers/s390/net/qeth_core.h +0 -1

index 04e294d1d16d..99af1a0a3314 100644
@@ -665,7 +665,6 @@ struct qeth_card_blkt {
 
 #define QETH_BROADCAST_WITH_ECHO    0x01
 #define QETH_BROADCAST_WITHOUT_ECHO 0x02
-#define QETH_LAYER2_MAC_READ	    0x01
 #define QETH_LAYER2_MAC_REGISTERED  0x02
 struct qeth_card_info {
 	unsigned short unit_addr2;

drivers/s390/net/qeth_core_main.c +7 -5

index 254065271867..0c9a5250dd93 100644
@@ -4235,16 +4235,18 @@ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
 		struct qeth_reply *reply, unsigned long data)
 {
 	struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+	struct qeth_ipacmd_setadpparms *adp_cmd;
 
 	QETH_CARD_TEXT(card, 4, "chgmaccb");
 	if (qeth_setadpparms_inspect_rc(cmd))
 		return 0;
 
-	if (IS_LAYER3(card) || !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
-		ether_addr_copy(card->dev->dev_addr,
-				cmd->data.setadapterparms.data.change_addr.addr);
-		card->info.mac_bits |= QETH_LAYER2_MAC_READ;
-	}
+	adp_cmd = &cmd->data.setadapterparms;
+	if (IS_LAYER2(card) && IS_OSD(card) && !IS_VM_NIC(card) &&
+	    !(adp_cmd->hdr.flags & QETH_SETADP_FLAGS_VIRTUAL_MAC))
+		return 0;
+
+	ether_addr_copy(card->dev->dev_addr, adp_cmd->data.change_addr.addr);
 	return 0;
 }

drivers/s390/net/qeth_core_mpc.h +15 ~~-10~~

index 3e54be201b27..10cc487c16d6 100644
@@ -80,7 +80,9 @@ enum qeth_card_types {
 };
 
 #define IS_IQD(card)	((card)->info.type == QETH_CARD_TYPE_IQD)
+#define IS_OSD(card)	((card)->info.type == QETH_CARD_TYPE_OSD)
 #define IS_OSN(card)	((card)->info.type == QETH_CARD_TYPE_OSN)
+#define IS_VM_NIC(card)	((card)->info.guestlan)
 
 #define QETH_MPC_DIFINFO_LEN_INDICATES_LINK_TYPE 0x18
 /* only the first two bytes are looked at in qeth_get_cardname_short */

@@ -529,17 +531,20 @@ struct qeth_query_switch_attributes {
 	__u8  reserved3[8];
 };
 
+#define QETH_SETADP_FLAGS_VIRTUAL_MAC	0x80	/* for CHANGE_ADDR_READ_MAC */
+
 struct qeth_ipacmd_setadpparms_hdr {
-	__u32 supp_hw_cmds;
-	__u32 reserved1;
-	__u16 cmdlength;
-	__u16 reserved2;
-	__u32 command_code;
-	__u16 return_code;
-	__u8  used_total;
-	__u8  seq_no;
-	__u32 reserved3;
-} __attribute__ ((packed));
+	u32 supp_hw_cmds;
+	u32 reserved1;
+	u16 cmdlength;
+	u16 reserved2;
+	u32 command_code;
+	u16 return_code;
+	u8 used_total;
+	u8 seq_no;
+	u8 flags;
+	u8 reserved3[3];
+};
 
 struct qeth_ipacmd_setadpparms {
 	struct qeth_ipacmd_setadpparms_hdr hdr;

drivers/s390/net/qeth_l2_main.c +4 -6

index 2914a1a69f83..8d3601891c62 100644
@@ -461,12 +461,9 @@ static int qeth_l2_request_initial_mac(struct qeth_card *card)
 		/* fall back to alternative mechanism: */
 	}
 
-	if (card->info.type == QETH_CARD_TYPE_IQD ||
-	    card->info.type == QETH_CARD_TYPE_OSM ||
-	    card->info.type == QETH_CARD_TYPE_OSX ||
-	    card->info.guestlan) {
+	if (!IS_OSN(card)) {
 		rc = qeth_setadpparms_change_macaddr(card);
-		if (!rc)
+		if (!rc && is_valid_ether_addr(card->dev->dev_addr))
 			goto out;
 		QETH_DBF_MESSAGE(2, "READ_MAC Assist failed on device %x: %#x\n",
 				 CARD_DEVID(card), rc);

@@ -917,7 +914,8 @@ static int qeth_l2_setup_netdev(struct qeth_card *card, bool carrier_ok)
 				       PAGE_SIZE * (QDIO_MAX_ELEMENTS_PER_BUFFER - 1));
 	}
 
-	qeth_l2_request_initial_mac(card);
+	if (!is_valid_ether_addr(card->dev->dev_addr))
+		qeth_l2_request_initial_mac(card);
 	netif_napi_add(card->dev, &card->napi, qeth_poll, QETH_NAPI_WEIGHT);
 	rc = register_netdev(card->dev);
 	if (!rc && carrier_ok)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #36 lore raw

PATCH 29/352 crypto: aes_ti - disable interrupts while accessing S-box

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0a6a40c2a8c184a2fb467efacfb1cd338d719e0b ]

In the "aes-fixed-time" AES implementation, disable interrupts while accessing the S-box, in order to make cache-timing attacks more difficult. Previously it was possible for the CPU to be interrupted while the S-box was loaded into L1 cache, potentially evicting the cachelines and causing later table lookups to be time-variant.

In tests I did on x86 and ARM, this doesn't affect performance significantly. Responsiveness is potentially a concern, but interrupts are only disabled for a single AES block.

Note that even after this change, the implementation still isn't necessarily guaranteed to be constant-time; see
https://cr.yp.to/antiforgery/cachetiming-20050414.pdf for a discussion of the many difficulties involved in writing truly constant-time AES software. But it's valuable to make such attacks more difficult.

Reviewed-by Ard Biesheuvel <[email protected]>

Signed-off-by Eric Biggers <[email protected]>

Signed-off-by Herbert Xu <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 crypto/Kconfig  |  3 ++-
 crypto/aes_ti.c | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

crypto/Kconfig +2 -1

index 05c91eb10ca1..4f24acac3d48 100644
@@ -1006,7 +1006,8 @@ config CRYPTO_AES_TI
 	  8 for decryption), this implementation only uses just two S-boxes of
 	  256 bytes each, and attempts to eliminate data dependent latencies by
 	  prefetching the entire table into the cache at the start of each
-	  block.
+	  block. Interrupts are also disabled to avoid races where cachelines
+	  are evicted when the CPU is interrupted to do something else.
 
 config CRYPTO_AES_586
 	tristate "AES cipher algorithms (i586)"

crypto/aes_ti.c +18 -0

index 03023b2290e8..1ff9785b30f5 100644
@@ -269,6 +269,7 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	const u32 *rkp = ctx->key_enc + 4;
 	int rounds = 6 + ctx->key_length / 4;
 	u32 st0[4], st1[4];
+	unsigned long flags;
 	int round;
 
 	st0[0] = ctx->key_enc[0] ^ get_unaligned_le32(in);

@@ -276,6 +277,12 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	st0[2] = ctx->key_enc[2] ^ get_unaligned_le32(in + 8);
 	st0[3] = ctx->key_enc[3] ^ get_unaligned_le32(in + 12);
 
+	/*
+	 * Temporarily disable interrupts to avoid races where cachelines are
+	 * evicted when the CPU is interrupted to do something else.
+	 */
+	local_irq_save(flags);
+
 	st0[0] ^= __aesti_sbox[ 0] ^ __aesti_sbox[128];
 	st0[1] ^= __aesti_sbox[32] ^ __aesti_sbox[160];
 	st0[2] ^= __aesti_sbox[64] ^ __aesti_sbox[192];

@@ -300,6 +307,8 @@ static void aesti_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	put_unaligned_le32(subshift(st1, 1) ^ rkp[5], out + 4);
 	put_unaligned_le32(subshift(st1, 2) ^ rkp[6], out + 8);
 	put_unaligned_le32(subshift(st1, 3) ^ rkp[7], out + 12);
+
+	local_irq_restore(flags);
 }
 
 static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -308,6 +317,7 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	const u32 *rkp = ctx->key_dec + 4;
 	int rounds = 6 + ctx->key_length / 4;
 	u32 st0[4], st1[4];
+	unsigned long flags;
 	int round;
 
 	st0[0] = ctx->key_dec[0] ^ get_unaligned_le32(in);

@@ -315,6 +325,12 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	st0[2] = ctx->key_dec[2] ^ get_unaligned_le32(in + 8);
 	st0[3] = ctx->key_dec[3] ^ get_unaligned_le32(in + 12);
 
+	/*
+	 * Temporarily disable interrupts to avoid races where cachelines are
+	 * evicted when the CPU is interrupted to do something else.
+	 */
+	local_irq_save(flags);
+
 	st0[0] ^= __aesti_inv_sbox[ 0] ^ __aesti_inv_sbox[128];
 	st0[1] ^= __aesti_inv_sbox[32] ^ __aesti_inv_sbox[160];
 	st0[2] ^= __aesti_inv_sbox[64] ^ __aesti_inv_sbox[192];

@@ -339,6 +355,8 @@ static void aesti_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 	put_unaligned_le32(inv_subshift(st1, 1) ^ rkp[5], out + 4);
 	put_unaligned_le32(inv_subshift(st1, 2) ^ rkp[6], out + 8);
 	put_unaligned_le32(inv_subshift(st1, 3) ^ rkp[7], out + 12);
+
+	local_irq_restore(flags);
 }
 
 static struct crypto_alg aes_alg = {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:21 UTC #16 lore raw

PATCH 13/352 drm/amd/display: Fix potential nullptr error

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f7129112c2a30331f3045a42026fad82e6cb72b ]

[Why]
Fix surface/plane potential nullptr

[How]
add null check

Signed-off-by Bhawanpreet Lakha <[email protected]>

Reviewed-by Aric Cyr <[email protected]>

Acked-by Leo Li <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++++
 1 file changed, 6 insertions(+)

drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +6 -0

index 3118ae0e7a87..315a245aedc2 100644
@@ -5333,6 +5333,12 @@ enum surface_update_type dm_determine_update_type_for_commit(struct dc *dc, stru
 	struct dc_stream_update stream_update;
 	enum surface_update_type update_type = UPDATE_TYPE_FAST;
 
+	if (!updates || !surface) {
+		DRM_ERROR("Plane or surface update failed to allocate");
+		/* Set type to FULL to avoid crashing in DC*/
+		update_type = UPDATE_TYPE_FULL;
+		goto ret;
+	}
 
 	for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
 		new_dm_crtc_state = to_dm_crtc_state(new_crtc_state);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #37 lore raw

PATCH 30/352 drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0560054da5673b25d56bea6c57c8d069673af73b ]

For the YUV conversion to work properly, ->x_scaling[1] should never be set to VC4_SCALING_NONE, but vc4_get_scaling_mode() might return VC4_SCALING_NONE if the horizontal scaling ratio exactly matches the horizontal subsampling factor. Add a test to turn VC4_SCALING_NONE into VC4_SCALING_PPF when that happens.

The old ->x_scaling[0] adjustment is dropped as I couldn't find any mention to this constraint in the spec and it's proven to be unnecessary (I tested various multi-planar YUV formats with scaling disabled, and all of them worked fine without this adjustment).

Fixes fc04023fafec ("drm/vc4: Add support for YUV planes.")

Signed-off-by Boris Brezillon <[email protected]>

Reviewed-by Eric Anholt <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/vc4/vc4_plane.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

drivers/gpu/drm/vc4/vc4_plane.c +7 -5

index ae6254b0b1ae..ed8b0fc170ee 100644
@@ -314,12 +314,14 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
 			vc4_get_scaling_mode(vc4_state->src_h[1],
 					     vc4_state->crtc_h);
 
-		/* YUV conversion requires that horizontal scaling be enabled,
-		 * even on a plane that's otherwise 1:1. Looks like only PPF
-		 * works in that case, so let's pick that one.
+		/* YUV conversion requires that horizontal scaling be enabled
+		 * on the UV plane even if vc4_get_scaling_mode() returned
+		 * VC4_SCALING_NONE (which can happen when the down-scaling
+		 * ratio is 0.5). Let's force it to VC4_SCALING_PPF in this
+		 * case.
 		 */
-		if (vc4_state->is_unity)
-			vc4_state->x_scaling[0] = VC4_SCALING_PPF;
+		if (vc4_state->x_scaling[1] == VC4_SCALING_NONE)
+			vc4_state->x_scaling[1] = VC4_SCALING_PPF;
 	} else {
 		vc4_state->is_yuv = false;
 		vc4_state->x_scaling[1] = VC4_SCALING_NONE;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #38 lore raw

PATCH 31/352 serial: fsl_lpuart: clear parity enable bit when disable parity

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 397bd9211fe014b347ca8f95a8f4e1017bac1aeb ]

Current driver only enable parity enable bit and never clear it when user set the termios. The fix clear the parity enable bit when PARENB flag is not set in termios->c_cflag.

Cc Lukas Wunner <[email protected]>

Signed-off-by Andy Duan <[email protected]>

Reviewed-by Fabio Estevam <[email protected]>

Acked-by Uwe Kleine-König <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/tty/serial/fsl_lpuart.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/tty/serial/fsl_lpuart.c +4 -0

index 00c220e4f43c..086642ea4b26 100644
@@ -1479,6 +1479,8 @@ lpuart_set_termios(struct uart_port *port, struct ktermios *termios,
 			else
 				cr1 &= ~UARTCR1_PT;
 		}
+	} else {
+		cr1 &= ~UARTCR1_PE;
 	}
 
 	/* ask the core to calculate the divisor */

@@ -1690,6 +1692,8 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 			else
 				ctrl &= ~UARTCTRL_PT;
 		}
+	} else {
+		ctrl &= ~UARTCTRL_PE;
 	}
 
 	/* ask the core to calculate the divisor */

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #39 lore raw

PATCH 32/352 ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 83d0bdc7390b890905634186baaa294475cd6a06 ]

If a gettime64 call fails, return the error and avoid copying data back to user.

Cc Richard Cochran <[email protected]>

Cc Jacob Keller <[email protected]>

Signed-off-by Miroslav Lichvar <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/ptp/ptp_chardev.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/ptp/ptp_chardev.c +4 -1

index 2012551d93e0..796eeffdf93b 100644
@@ -228,7 +228,9 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
 			pct->sec = ts.tv_sec;
 			pct->nsec = ts.tv_nsec;
 			pct++;
-			ptp->info->gettime64(ptp->info, &ts);
+			err = ptp->info->gettime64(ptp->info, &ts);
+			if (err)
+				goto out;
 			pct->sec = ts.tv_sec;
 			pct->nsec = ts.tv_nsec;
 			pct++;

@@ -281,6 +283,7 @@ long ptp_ioctl(struct posix_clock *pc, unsigned int cmd, unsigned long arg)
 		break;
 	}
 
+out:
 	kfree(sysoff);
 	return err;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #40 lore raw

PATCH 33/352 MIPS: Boston: Disable EG20T prefetch

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5ec17af7ead09701e23d2065e16db6ce4e137289 ]

The Intel EG20T Platform Controller Hub used on the MIPS Boston development board supports prefetching memory to optimize DMA transfers. Unfortunately for unknown reasons this doesn't work well with some MIPS CPUs such as the P6600, particularly when using an I/O Coherence Unit (IOCU) to provide cache-coherent DMA. In these systems it is common for DMA data to be lost, resulting in broken access to EG20T devices such as the MMC or SATA controllers.

Support for a DT property to configure the prefetching was added a while back by commit 549ce8f134bd ("misc: pch_phub: Read prefetch value from device tree if passed") but we never added the DT snippet to make use of it. Add that now in order to disable the prefetching & fix DMA on the affected systems.

Signed-off-by Paul Burton <[email protected]>

Patchwork: https://patchwork.linux-mips.org/patch/21068/

Cc [email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 arch/mips/boot/dts/img/boston.dts | 6 ++++++
 1 file changed, 6 insertions(+)

arch/mips/boot/dts/img/boston.dts +6 -0

index 65af3f6ba81c..84328afa3a55 100644
@@ -141,6 +141,12 @@
 				#size-cells = <2>;
 				#interrupt-cells = <1>;
 
+				eg20t_phub@2,0,0 {
+					compatible = "pci8086,8801";
+					reg = <0x00020000 0 0 0 0>;
+					intel,eg20t-prefetch = <0>;
+				};
+
 				eg20t_mac@2,0,1 {
 					compatible = "pci8086,8802";
 					reg = <0x00020100 0 0 0 0>;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #41 lore raw

PATCH 34/352 dpaa2-ptp: defer probe when portal allocation failed

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5500598abbfb5b46201b9768bd9ea873a5eeaece ]

The fsl_mc_portal_allocate can fail when the requested MC portals are not yet probed by the fsl_mc_allocator. In this situation, the driver should defer the probe.

Signed-off-by Ioana Ciornei <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/net/ethernet/freescale/dpaa2/dpaa2-ptp.c +4 -1

index 84b942b1eccc..9b150db3b510 100644
@@ -140,7 +140,10 @@ static int dpaa2_ptp_probe(struct fsl_mc_device *mc_dev)
 
 	err = fsl_mc_portal_allocate(mc_dev, 0, &mc_dev->mc_io);
 	if (err) {
-		dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
+		if (err == -ENXIO)
+			err = -EPROBE_DEFER;
+		else
+			dev_err(dev, "fsl_mc_portal_allocate err %d\n", err);
 		goto err_exit;
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #42 lore raw

PATCH 35/352 iwlwifi: fw: do not set sgi bits for HE connection

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5c2dbebb446539eb9640bf59a02756d6e7f1fc53 ]

If the association supports HE, HT/VHT rates will never be used for Tx and therefore there's no need to set the sgi-per-channel-width-support bits, so don't set them in this case.

Fixes 110b32f065f3 ("iwlwifi: mvm: rs: add basic implementation of the new RS API handlers")

Signed-off-by Naftali Goldstein <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c +4 -0

index 7a98e1a1dc40..dabbc04853ac 100644
@@ -98,8 +98,12 @@ static u8 rs_fw_sgi_cw_support(struct ieee80211_sta *sta)
 {
 	struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+	struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
 	u8 supp = 0;
 
+	if (he_cap && he_cap->has_he)
+		return 0;
+
 	if (ht_cap->cap & IEEE80211_HT_CAP_SGI_20)
 		supp |= BIT(IWL_TLC_MNG_CH_WIDTH_20MHZ);
 	if (ht_cap->cap & IEEE80211_HT_CAP_SGI_40)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #43 lore raw

PATCH 36/352 staging:iio:ad2s90: Make probe handle spi_setup failure

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b3a3eafeef769c6982e15f83631dcbf8d1794efb ]

Previously, ad2s90_probe ignored the return code from spi_setup, not handling its possible failure. This patch makes ad2s90_probe check if the code is an error code and, if so, do the following:

- Call dev_err with an appropriate error message.
- Return the spi_setup's error code.

Note: The 'return ret' statement could be out of the 'if' block, but this whole block will be moved up in the function in the patch:
'staging:iio:ad2s90: Move device registration to the end of probe'.

Signed-off-by Matheus Tavares <[email protected]>

Signed-off-by Jonathan Cameron <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/staging/iio/resolver/ad2s90.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

drivers/staging/iio/resolver/ad2s90.c +6 -1

index 59586947a936..51cda9151412 100644
@@ -85,7 +85,12 @@ static int ad2s90_probe(struct spi_device *spi)
 	/* need 600ns between CS and the first falling edge of SCLK */
 	spi->max_speed_hz = 830000;
 	spi->mode = SPI_MODE_3;
-	spi_setup(spi);
+	ret = spi_setup(spi);
+
+	if (ret < 0) {
+		dev_err(&spi->dev, "spi_setup failed!\n");
+		return ret;
+	}
 
 	return 0;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #44 lore raw

PATCH 37/352 fpga: altera-cvp: Fix registration for CvP incapable devices

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 68f60538daa4bc3da5d0764d46f391916fba20fd ]

The probe function needs to verify the CvP enable bit in order to properly determine if FPGA Manager functionality can be safely enabled.

Fixes 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")

Signed-off-by Andreas Puhm <[email protected]>

Signed-off-by Anatolij Gustschin <[email protected]>

Reviewed-by Moritz Fischer <[email protected]>

Acked-by Alan Tull <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/fpga/altera-cvp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

drivers/fpga/altera-cvp.c +9 -0

index d9fa7d4bf11f..36d79b039c57 100644
@@ -403,6 +403,7 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 	struct altera_cvp_conf *conf;
 	struct fpga_manager *mgr;
 	u16 cmd, val;
+	u32 regval;
 	int ret;
 
 	/*

@@ -416,6 +417,14 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 		return -ENODEV;
 	}
 
+	pci_read_config_dword(pdev, VSE_CVP_STATUS, &regval);
+	if (!(regval & VSE_CVP_STATUS_CVP_EN)) {
+		dev_err(&pdev->dev,
+			"CVP is disabled for this device: CVP_STATUS Reg 0x%x\n",
+			regval);
+		return -ENODEV;
+	}
+
 	conf = devm_kzalloc(&pdev->dev, sizeof(*conf), GFP_KERNEL);
 	if (!conf)
 		return -ENOMEM;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #45 lore raw

PATCH 38/352 Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4fcba7802c3e15a6e56e255871d6c72f829b9dd8 ]

The patch fixes:

hv_kvp_daemon.c: In function 'kvp_set_ip_info':
hv_kvp_daemon.c:1305:2: note: 'snprintf' output between 41 and 4136 bytes into a destination of size 4096

The "(unsigned int)str_len" is to avoid:

hv_kvp_daemon.c:1309:30: warning: comparison of integer expressions of different signedness: 'int' and 'long unsigned int' [-Wsign-compare]

Signed-off-by Dexuan Cui <[email protected]>

Cc K. Y. Srinivasan <[email protected]>

Cc Haiyang Zhang <[email protected]>

Cc Stephen Hemminger <[email protected]>

Signed-off-by K. Y. Srinivasan <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/hv/hv_kvp_daemon.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

tools/hv/hv_kvp_daemon.c +13 -2

index bbb2a8ef367c..d7e06fe0270e 100644
@@ -1178,6 +1178,7 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
 	FILE *file;
 	char cmd[PATH_MAX];
 	char *mac_addr;
+	int str_len;
 
 	/*
 	 * Set the configuration for the specified interface with

@@ -1301,8 +1302,18 @@ static int kvp_set_ip_info(char *if_name, struct hv_kvp_ipaddr_value *new_val)
 	 * invoke the external script to do its magic.
 	 */
 
-	snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
-		 "hv_set_ifconfig", if_file);
+	str_len = snprintf(cmd, sizeof(cmd), KVP_SCRIPTS_PATH "%s %s",
+			   "hv_set_ifconfig", if_file);
+	/*
+	 * This is a little overcautious, but it's necessary to suppress some
+	 * false warnings from gcc 8.0.1.
+	 */
+	if (str_len <= 0 || (unsigned int)str_len >= sizeof(cmd)) {
+		syslog(LOG_ERR, "Cmd '%s' (len=%d) may be too long",
+		       cmd, str_len);
+		return HV_E_FAIL;
+	}
+
 	if (system(cmd)) {
 		syslog(LOG_ERR, "Failed to execute cmd '%s'; error: %d %s",
 				cmd, errno, strerror(errno));

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #46 lore raw

PATCH 39/352 fpga: altera-cvp: fix bad IO access on x86_64

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 187fade88ca0ff2df9d360ca751d948d73db7095 ]

If mapping the CvP BAR fails, we still can configure the FPGA via PCI config space access. In this case the iomap pointer is NULL. On x86_64, passing NULL address to pci_iounmap() generates "Bad IO access at port 0x0" output with stack call trace. Fix it.

Signed-off-by Anatolij Gustschin <[email protected]>

Acked-by Alan Tull <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/fpga/altera-cvp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

drivers/fpga/altera-cvp.c +4 -2

index 36d79b039c57..35c3aa5792e2 100644
@@ -478,7 +478,8 @@ static int altera_cvp_probe(struct pci_dev *pdev,
 	return 0;
 
 err_unmap:
-	pci_iounmap(pdev, conf->map);
+	if (conf->map)
+		pci_iounmap(pdev, conf->map);
 	pci_release_region(pdev, CVP_BAR);
 err_disable:
 	cmd &= ~PCI_COMMAND_MEMORY;

@@ -493,7 +494,8 @@ static void altera_cvp_remove(struct pci_dev *pdev)
 	u16 cmd;
 
 	fpga_mgr_unregister(mgr);
-	pci_iounmap(pdev, conf->map);
+	if (conf->map)
+		pci_iounmap(pdev, conf->map);
 	pci_release_region(pdev, CVP_BAR);
 	pci_read_config_word(pdev, PCI_COMMAND, &cmd);
 	cmd &= ~PCI_COMMAND_MEMORY;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #49 lore raw

PATCH 42/352 i40e: suppress bogus error message

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 7cd8eb0861981ad212ce4242a1870c4b5831ceff ]

The i40e driver complains about unprivileged VFs trying to configure promiscuous mode each time a VF reset occurs. This isn't the fault of the poor VF driver - the PF driver itself is making the request.

To fix this, skip the privilege check if the request is to disable all promiscuous activity. This gets rid of the bogus message, but doesn't affect privilege checks, since we really only care if the unprivileged VF is trying to enable promiscuous mode.

Signed-off-by Mitch Williams <[email protected]>

Tested-by Andrew Bowers <[email protected]>

Signed-off-by Jeff Kirsher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +2 -1

index ac5698ed0b11..c41e8ada23d1 100644
@@ -1112,7 +1112,8 @@ static i40e_status i40e_config_vf_promiscuous_mode(struct i40e_vf *vf,
 	if (!i40e_vc_isvalid_vsi_id(vf, vsi_id) || !vsi)
 		return I40E_ERR_PARAM;
 
-	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps)) {
+	if (!test_bit(I40E_VIRTCHNL_VF_CAP_PRIVILEGE, &vf->vf_caps) &&
+	    (allmulti || alluni)) {
 		dev_err(&pf->pdev->dev,
 			"Unprivileged VF %d is attempting to configure promiscuous mode\n",
 			vf->vf_id);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #18 lore raw

PATCH 15/352 wil6210: fix reset flow for Talyn-mb

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit d083b2e2b7db5cca1791643d036e6597af27f49b ]

With current reset flow, Talyn sometimes get stuck causing PCIe enumeration to fail. Fix this by removing some reset flow operations that are not relevant for Talyn.
Setting bit 15 in RGF_HP_CTRL is WBE specific and is not in use for all wil6210 devices.
For Sparrow, BIT_HPAL_PERST_FROM_PAD and BIT_CAR_PERST_RST were set as a WA an HW issue.

Signed-off-by Alexei Avshalom Lazar <[email protected]>

Signed-off-by Maya Erez <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/ath/wil6210/main.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

drivers/net/wireless/ath/wil6210/main.c +7 -4

index 398900a1c29e..c54b008996ee 100644
@@ -998,10 +998,13 @@ static int wil_target_reset(struct wil6210_priv *wil, int no_flash)
 
 	wil_dbg_misc(wil, "Resetting \"%s\"...\n", wil->hw_name);
 
-	/* Clear MAC link up */
-	wil_s(wil, RGF_HP_CTRL, BIT(15));
-	wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_HPAL_PERST_FROM_PAD);
-	wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
+	if (wil->hw_version < HW_VER_TALYN) {
+		/* Clear MAC link up */
+		wil_s(wil, RGF_HP_CTRL, BIT(15));
+		wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0,
+		      BIT_HPAL_PERST_FROM_PAD);
+		wil_s(wil, RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT_CAR_PERST_RST);
+	}
 
 	wil_halt_cpu(wil);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #20 lore raw

PATCH 17/352 ath10k: assign n_cipher_suites for WCN3990

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 2bd345cd2bfc0bd44528896313c0b45f087bdf67 ]

Commit 2ea9f12cefe4 ("ath10k: add new cipher suite support") added a new n_cipher_suites HW param with a fallback value and a warning log. Commit 03a72288c546 ("ath10k: wmi: add hw params entry for wcn3990") later added WCN3990 HW entries, but it missed the n_cipher_suites.

Rather than seeing this warning every boot

ath10k_snoc 18800000.wifi: invalid hw_params.n_cipher_suites 0

let's provide the appropriate value.

Cc Rakesh Pillai <[email protected]>

Cc Govind Singh <[email protected]>

Signed-off-by Brian Norris <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/ath/ath10k/core.c | 1 +
 1 file changed, 1 insertion(+)

drivers/net/wireless/ath/ath10k/core.c +1 -0

index d210b0ed59be..59fdda67f89f 100644
@@ -561,6 +561,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = {
 		.hw_ops = &wcn3990_ops,
 		.decap_align_bytes = 1,
 		.num_peers = TARGET_HL_10_TLV_NUM_PEERS,
+		.n_cipher_suites = 8,
 		.ast_skid_limit = TARGET_HL_10_TLV_AST_SKID_LIMIT,
 		.num_wds_entries = TARGET_HL_10_TLV_NUM_WDS_ENTRIES,
 		.target_64bit = true,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #21 lore raw

PATCH 18/352 ath9k: dynack: use authentication messages for late ack

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 3831a2a0010c72e3956020cbf1057a1701a2e469 ]

In order to properly support dynack in ad-hoc mode running wpa_supplicant, take into account authentication frames for 'late ack' detection. This patch has been tested on devices mounted on offshore high-voltage stations connected through ~24Km link

Reported-by Koen Vandeputte <[email protected]>

Tested-by Koen Vandeputte <[email protected]>

Signed-off-by Lorenzo Bianconi <[email protected]>

Signed-off-by Kalle Valo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/ath/ath9k/dynack.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/net/wireless/ath/ath9k/dynack.c +2 -1

index 7334c9b09e82..cc0dc966c512 100644
@@ -187,7 +187,8 @@ void ath_dynack_sample_tx_ts(struct ath_hw *ah, struct sk_buff *skb,
 	/* late ACK */
 	if (ts->ts_status & ATH9K_TXERR_XRETRY) {
 		if (ieee80211_is_assoc_req(hdr->frame_control) ||
-		    ieee80211_is_assoc_resp(hdr->frame_control)) {
+		    ieee80211_is_assoc_resp(hdr->frame_control) ||
+		    ieee80211_is_auth(hdr->frame_control)) {
 			ath_dbg(common, DYNACK, "late ack\n");
 			ath9k_hw_setslottime(ah, (LATEACK_TO - 3) / 2);
 			ath9k_hw_set_ack_timeout(ah, LATEACK_TO);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #26 lore raw

PATCH 19/352 scsi: lpfc: Correct LCB RJT handling

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b114d9009d386276bfc3352289fc235781ae3353 ]

When LCB's are rejected, if beaconing was already in progress, the Reason Code Explanation was not being set. Should have been set to command in progress.

Signed-off-by Dick Kennedy <[email protected]>

Signed-off-by James Smart <[email protected]>

Reviewed-by Hannes Reinecke <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/scsi/lpfc/lpfc_els.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/scsi/lpfc/lpfc_els.c +3 -0

index f1c1faa74b46..96e2f542734a 100644
@@ -5701,6 +5701,9 @@ error:
 	stat = (struct ls_rjt *)(pcmd + sizeof(uint32_t));
 	stat->un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC;
 
+	if (shdr_add_status == ADD_STATUS_OPERATION_ALREADY_ACTIVE)
+		stat->un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS;
+
 	elsiocb->iocb_cmpl = lpfc_cmpl_els_rsp;
 	phba->fc_stat.elsXmitLSRJT++;
 	rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:22 UTC #14 lore raw

PATCH 11/352 genirq/affinity: Spread IRQs to all available NUMA nodes

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b82592199032bf7c778f861b936287e37ebc9f62 ]

If the number of NUMA nodes exceeds the number of MSI/MSI-X interrupts which are allocated for a device, the interrupt affinity spreading code fails to spread them across all nodes.

The reason is, that the spreading code starts from node 0 and continues up to the number of interrupts requested for allocation. This leaves the nodes past the last interrupt unused.

This results in interrupt concentration on the first nodes which violates the assumption of the block layer that all nodes are covered evenly. As a consequence the NUMA nodes above the number of interrupts are all assigned to hardware queue 0 and therefore NUMA node 0, which results in bad performance and has CPU hotplug implications, because queue 0 gets shut down when the last CPU of node 0 is offlined.

Go over all NUMA nodes and assign them round-robin to all requested interrupts to solve this.

[ tglx: Massaged changelog ]

Signed-off-by Long Li <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Reviewed-by Ming Lei <[email protected]>

Cc Michael Kelley <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 kernel/irq/affinity.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

kernel/irq/affinity.c +2 -3

index f4f29b9d90ee..e12cdf637c71 100644
@@ -117,12 +117,11 @@ static int irq_build_affinity_masks(const struct irq_affinity *affd,
 	 */
 	if (numvecs <= nodes) {
 		for_each_node_mask(n, nodemsk) {
-			cpumask_copy(masks + curvec, node_to_cpumask[n]);
-			if (++done == numvecs)
-				break;
+			cpumask_or(masks + curvec, masks + curvec, node_to_cpumask[n]);
 			if (++curvec == last_affv)
 				curvec = affd->pre_vectors;
 		}
+		done = numvecs;
 		goto out;
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #27 lore raw

PATCH 20/352 scsi: mpt3sas: Call sas_remove_host before removing the target devices

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit dc730212e8a378763cb182b889f90c8101331332 ]

Call sas_remove_host() before removing the target devices in the driver's .remove() callback function(i.e. during driver unload time). So that driver can provide a way to allow SYNC CACHE, START STOP unit commands etc. (which are issued from SML) to the target drives during driver unload time.

Once sas_remove_host() is called before removing the target drives then driver can just clean up the resources allocated for target devices and no need to call sas_port_delete_phy(), sas_port_delete() API's as these API's internally called from sas_remove_host().

Signed-off-by Suganath Prabu <[email protected]>

Reviewed-by Bjorn Helgaas <[email protected]>

Reviewed-by Andy Shevchenko <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/scsi/mpt3sas/mpt3sas_scsih.c     | 2 +-
 drivers/scsi/mpt3sas/mpt3sas_transport.c | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

drivers/scsi/mpt3sas/mpt3sas_scsih.c +1 -1

index 03c52847ed07..adac18ba84d4 100644
@@ -9641,6 +9641,7 @@ static void scsih_remove(struct pci_dev *pdev)
 
 	/* release all the volumes */
 	_scsih_ir_shutdown(ioc);
+	sas_remove_host(shost);
 	list_for_each_entry_safe(raid_device, next, &ioc->raid_device_list,
 	    list) {
 		if (raid_device->starget) {

@@ -9682,7 +9683,6 @@ static void scsih_remove(struct pci_dev *pdev)
 		ioc->sas_hba.num_phys = 0;
 	}
 
-	sas_remove_host(shost);
 	mpt3sas_base_detach(ioc);
 	spin_lock(&gioc_lock);
 	list_del(&ioc->list);

drivers/scsi/mpt3sas/mpt3sas_transport.c +5 -2

index 6a8a3c09b4b1..8338b4db0e31 100644
@@ -821,10 +821,13 @@ mpt3sas_transport_port_remove(struct MPT3SAS_ADAPTER *ioc, u64 sas_address,
 			    mpt3sas_port->remote_identify.sas_address,
 			    mpt3sas_phy->phy_id);
 		mpt3sas_phy->phy_belongs_to_port = 0;
-		sas_port_delete_phy(mpt3sas_port->port, mpt3sas_phy->phy);
+		if (!ioc->remove_host)
+			sas_port_delete_phy(mpt3sas_port->port,
+						mpt3sas_phy->phy);
 		list_del(&mpt3sas_phy->port_siblings);
 	}
-	sas_port_delete(mpt3sas_port->port);
+	if (!ioc->remove_host)
+		sas_port_delete(mpt3sas_port->port);
 	kfree(mpt3sas_port);
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #51 lore raw

PATCH 44/352 scsi: hisi_sas: change the time of SAS SSP connection

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 15bc43f31a074076f114e0b87931e3b220b7bff1 ]

Currently the time of SAS SSP connection is 1ms, which means the link connection will fail if no IO response after this period.

For some disks handling large IO (such as 512k), 1ms is not enough, so change it to 5ms.

Signed-off-by Xiang Chen <[email protected]>

Signed-off-by John Garry <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -1

index a369450a1fa7..c3e0be90e19f 100644
@@ -494,7 +494,7 @@ static void init_reg_v3_hw(struct hisi_hba *hisi_hba)
 		hisi_sas_phy_write32(hisi_hba, i, PHYCTRL_OOB_RESTART_MSK, 0x1);
 		hisi_sas_phy_write32(hisi_hba, i, STP_LINK_TIMER, 0x7f7a120);
 		hisi_sas_phy_write32(hisi_hba, i, CON_CFG_DRIVER, 0x2a0a01);
-
+		hisi_sas_phy_write32(hisi_hba, i, SAS_SSP_CON_TIMER_CFG, 0x32);
 		/* used for 12G negotiate */
 		hisi_sas_phy_write32(hisi_hba, i, COARSETUNE_TIME, 0x1e);
 		hisi_sas_phy_write32(hisi_hba, i, AIP_LIMIT, 0x2ffff);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #60 lore raw

PATCH 53/352 modpost: validate symbol names also in find_elf_symbol

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5818c683a619c534c113e1f66d24f636defc29bc ]

If an ARM mapping symbol shares an address with a valid symbol, find_elf_symbol can currently return the mapping symbol instead, as the symbol is not validated. This can result in confusing warnings:

WARNING: vmlinux.o(.text+0x18f4028): Section mismatch in reference from the function set_reset_devices() to the variable .init.text:$x.0

This change adds a call to is_valid_name to find_elf_symbol, similarly to how it's already used in find_elf_symbol2.

Signed-off-by Sami Tolvanen <[email protected]>

Signed-off-by Masahiro Yamada <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 scripts/mod/modpost.c | 50 ++++++++++++++++++++++---------------------
 1 file changed, 26 insertions(+), 24 deletions(-)

scripts/mod/modpost.c +26 ~~-24~~

index 5a5b3780456f..5a77efd39b3f 100644
@@ -1204,6 +1204,30 @@ static int secref_whitelist(const struct sectioncheck *mismatch,
 	return 1;
 }
 
+static inline int is_arm_mapping_symbol(const char *str)
+{
+	return str[0] == '$' && strchr("axtd", str[1])
+	       && (str[2] == '\0' || str[2] == '.');
+}
+
+/*
+ * If there's no name there, ignore it; likewise, ignore it if it's
+ * one of the magic symbols emitted used by current ARM tools.
+ *
+ * Otherwise if find_symbols_between() returns those symbols, they'll
+ * fail the whitelist tests and cause lots of false alarms ... fixable
+ * only by merging __exit and __init sections into __text, bloating
+ * the kernel (which is especially evil on embedded platforms).
+ */
+static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
+{
+	const char *name = elf->strtab + sym->st_name;
+
+	if (!name || !strlen(name))
+		return 0;
+	return !is_arm_mapping_symbol(name);
+}
+
 /**
  * Find symbol based on relocation record info.
  * In some cases the symbol supplied is a valid symbol so

@@ -1229,6 +1253,8 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
 			continue;
 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
 			continue;
+		if (!is_valid_name(elf, sym))
+			continue;
 		if (sym->st_value == addr)
 			return sym;
 		/* Find a symbol nearby - addr are maybe negative */

@@ -1247,30 +1273,6 @@ static Elf_Sym *find_elf_symbol(struct elf_info *elf, Elf64_Sword addr,
 		return NULL;
 }
 
-static inline int is_arm_mapping_symbol(const char *str)
-{
-	return str[0] == '$' && strchr("axtd", str[1])
-	       && (str[2] == '\0' || str[2] == '.');
-}
-
-/*
- * If there's no name there, ignore it; likewise, ignore it if it's
- * one of the magic symbols emitted used by current ARM tools.
- *
- * Otherwise if find_symbols_between() returns those symbols, they'll
- * fail the whitelist tests and cause lots of false alarms ... fixable
- * only by merging __exit and __init sections into __text, bloating
- * the kernel (which is especially evil on embedded platforms).
- */
-static inline int is_valid_name(struct elf_info *elf, Elf_Sym *sym)
-{
-	const char *name = elf->strtab + sym->st_name;
-
-	if (!name || !strlen(name))
-		return 0;
-	return !is_arm_mapping_symbol(name);
-}
-
 /*
  * Find symbols before or equal addr and after addr - in the section sec.
  * If we find two symbols with equal offset prefer one with a valid name.

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #61 lore raw

PATCH 54/352 perf tools: Add Hygon Dhyana support

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4787eff3fa88f62fede6ed7afa06477ae6bf984d ]

The tool perf is useful for the performance analysis on the Hygon Dhyana platform. But right now there is no Hygon support for it to analyze the KVM guest os data. So add Hygon Dhyana support to it by checking vendor string to share the code path of AMD.

Signed-off-by Pu Wen <[email protected]>

Acked-by Borislav Petkov <[email protected]>

Cc Alexander Shishkin <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Namhyung Kim <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Thomas Gleixner <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/arch/x86/util/kvm-stat.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/arch/x86/util/kvm-stat.c +1 -1

index b32409a0e546..081353d7b095 100644
@@ -156,7 +156,7 @@ int cpu_isa_init(struct perf_kvm_stat *kvm, const char *cpuid)
 	if (strstr(cpuid, "Intel")) {
 		kvm->exit_reasons = vmx_exit_reasons;
 		kvm->exit_reasons_isa = "VMX";
-	} else if (strstr(cpuid, "AMD")) {
+	} else if (strstr(cpuid, "AMD") || strstr(cpuid, "Hygon")) {
 		kvm->exit_reasons = svm_exit_reasons;
 		kvm->exit_reasons_isa = "SVM";
 	} else

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #62 lore raw

PATCH 55/352 scsi: cxgb4i: fix thermal configuration dependencies

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8d0bb86e2cf6c96d88c3de56a2a29329872c454d ]

I fixed a bug by adding a dependency in the network driver, but that fix caused a related bug in the SCSI driver:

WARNING: unmet direct dependencies detected for CHELSIO_T4
Depends on [m]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_CHELSIO [=y] && PCI [=y] && (IPV6 [=y] || IPV6 [=y]=n) && (THERMAL [=m] || !THERMAL [=m]) Selected by [y]:
- SCSI_CXGB4_ISCSI [=y] && SCSI_LOWLEVEL [=y] && SCSI [=y] && PCI [=y] && INET [=y] && (IPV6 [=y] || IPV6 [=y]=n)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function `cxgb4_thermal_init':
cxgb4_thermal.c:(.text+0x158): undefined reference to thermal_zone_device_register' drivers/net/ethernet/chelsio/cxgb4/cxgb4_thermal.o: In function cxgb4_thermal_remove':
cxgb4_thermal.c:(.text+0x1d8): undefined reference to `thermal_zone_device_unregister'
/git/arm-soc/Makefile:1042: recipe for target 'vmlinux' failed

The same dependency needs to be propagated here to make it work correctly with CONFIG_THERMAL=m and SCSI_CXGB4_ISCSI=y. That change by itself causes another problem with a circular dependency, as we use 'select NETDEVICES'. This is something we really should not do anyway, as a driver symbol should never select another major subsystem, so let's turn that into a 'depends on'. I don't see any downsides of that, as NETDEVICES is only disabled in rather obscure cases that are not relevant to the users of cxgb4i.

Fixes e70a57fa59bb ("cxgb4: fix thermal configuration dependencies")

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Martin K. Petersen <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/scsi/cxgbi/cxgb4i/Kconfig | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/scsi/cxgbi/cxgb4i/Kconfig +2 -2

index 594f593c8821..f36b76e8e12c 100644
@@ -1,8 +1,8 @@
 config SCSI_CXGB4_ISCSI
 	tristate "Chelsio T4 iSCSI support"
 	depends on PCI && INET && (IPV6 || IPV6=n)
-	select NETDEVICES
-	select ETHERNET
+	depends on THERMAL || !THERMAL
+	depends on ETHERNET
 	select NET_VENDOR_CHELSIO
 	select CHELSIO_T4
 	select CHELSIO_LIB

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #63 lore raw

PATCH 56/352 soc/tegra: Dont leak device tree node reference

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 9eb40fa2cd2d1f6829e7b49bb22692f754b9cfe0 ]

of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. soc_is_tegra() doesn't do that, so fix it.

Signed-off-by Yangtao Li <[email protected]>

Acked-by Jon Hunter <[email protected]>

[treding: slightly rewrite to avoid inline comparison]

Signed-off-by Thierry Reding <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/soc/tegra/common.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/soc/tegra/common.c +5 -1

index cd8f41351add..7bfb154d6fa5 100644
@@ -22,11 +22,15 @@ static const struct of_device_id tegra_machine_match[] = {
 
 bool soc_is_tegra(void)
 {
+	const struct of_device_id *match;
 	struct device_node *root;
 
 	root = of_find_node_by_path("/");
 	if (!root)
 		return false;
 
-	return of_match_node(tegra_machine_match, root) != NULL;
+	match = of_match_node(tegra_machine_match, root);
+	of_node_put(root);
+
+	return match != NULL;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #65 lore raw

PATCH 58/352 media: video-i2c: avoid accessing released memory area when removing driver

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c764da98a600a4b068d25c77164f092f159cecec ]

The video device release() callback for video-i2c driver frees the whole struct video_i2c_data. If there is no user left for the video device when video_unregister_device() is called, the release callback is executed.

However, in video_i2c_remove() some fields (v4l2_dev, lock, and queue_lock) in struct video_i2c_data are still accessed after video_unregister_device() is called.

This fixes the use after free by moving the code from video_i2c_remove() to the release() callback.

Fixes 5cebaac60974 ("media: video-i2c: add video-i2c driver")

Reviewed-by Matt Ranostay <[email protected]>

Signed-off-by Akinobu Mita <[email protected]>

Acked-by Sakari Ailus <[email protected]>

Signed-off-by Hans Verkuil <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/i2c/video-i2c.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

drivers/media/i2c/video-i2c.c +6 -5

index 4d49af86c15e..ec0758dca2fc 100644
@@ -510,7 +510,12 @@ static const struct v4l2_ioctl_ops video_i2c_ioctl_ops = {
 
 static void video_i2c_release(struct video_device *vdev)
 {
-	kfree(video_get_drvdata(vdev));
+	struct video_i2c_data *data = video_get_drvdata(vdev);
+
+	v4l2_device_unregister(&data->v4l2_dev);
+	mutex_destroy(&data->lock);
+	mutex_destroy(&data->queue_lock);
+	kfree(data);
 }
 
 static int video_i2c_probe(struct i2c_client *client,

@@ -608,10 +613,6 @@ static int video_i2c_remove(struct i2c_client *client)
 	struct video_i2c_data *data = i2c_get_clientdata(client);
 
 	video_unregister_device(&data->vdev);
-	v4l2_device_unregister(&data->v4l2_dev);
-
-	mutex_destroy(&data->lock);
-	mutex_destroy(&data->queue_lock);
 
 	return 0;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #66 lore raw

PATCH 59/352 media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8ea0f2ba0fa3f91ea1b8d823a54b042026ada6b3 ]

of_parse_phandle() returns the device node with refcount incremented. There are two nodes that are used temporary in mtk_vcodec_init_enc_pm(), but their refcounts are not decremented.

The patch adds one of_node_put() and fixes returning error codes.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by Alexey Khoroshilov <[email protected]>

Signed-off-by Hans Verkuil <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c +6 -4

index 3e73e9db781f..7c025045ea90 100644
@@ -41,25 +41,27 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev)
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 0);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -1;
+		return -ENODEV;
 	}
 	pdev = of_find_device_by_node(node);
+	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -1;
+		return -ENODEV;
 	}
 	pm->larbvenc = &pdev->dev;
 
 	node = of_parse_phandle(dev->of_node, "mediatek,larb", 1);
 	if (!node) {
 		mtk_v4l2_err("no mediatek,larb found");
-		return -1;
+		return -ENODEV;
 	}
 
 	pdev = of_find_device_by_node(node);
+	of_node_put(node);
 	if (!pdev) {
 		mtk_v4l2_err("no mediatek,larb device found");
-		return -1;
+		return -ENODEV;
 	}
 
 	pm->larbvenclt = &pdev->dev;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #67 lore raw

PATCH 60/352 staging: erofs: fix the definition of DBG_BUGON

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit eef168789866514e5d4316f030131c9fe65b643f ]

It's better not to positively BUG_ON the kernel, however developers need a way to locate issues as soon as possible.

DBG_BUGON is introduced and it could only crash when EROFS_FS_DEBUG (EROFS developping feature) is on. It is helpful for developers to find and solve bugs quickly by eng builds.

Previously, DBG_BUGON is defined as ((void)0) if EROFS_FS_DEBUG is off, but some unused variable warnings as follows could occur:

drivers/staging/erofs/unzip_vle.c: In function `init_alway:':
drivers/staging/erofs/unzip_vle.c:61:33: warning: unused variable `work' [-Wunused-variable]
struct z_erofs_vle_work *const work =

                                 ^~~~

Fix it to #define DBG_BUGON(x) ((void)(x)).

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Gao Xiang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/staging/erofs/internal.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/staging/erofs/internal.h +1 -1

index 57575c7f5635..048fb034b5aa 100644
@@ -39,7 +39,7 @@
 #define debugln(x, ...)         ((void)0)
 
 #define dbg_might_sleep()       ((void)0)
-#define DBG_BUGON(...)          ((void)0)
+#define DBG_BUGON(x)            ((void)(x))
 #endif
 
 enum {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #68 lore raw

PATCH 61/352 staging: erofs: fix race when the managed cache is enabled

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 51232df5e4b268936beccde5248f312a316800be ]

When the managed cache is enabled, the last reference count of a workgroup must be used for its workstation.

Otherwise, it could lead to incorrect (un)freezes in the reclaim path, and it would be harmful.

A typical race as follows:

Thread 1 (In the reclaim path) Thread 2
workgroup_freeze(grp, 1) refcnt = 1
...

workgroup_unfreeze(grp, 1)                              refcnt = 1
                                workgroup_get(grp)      refcnt = 2 (x)
workgroup_put(grp)                                      refcnt = 1 (x)

...unexpected behaviors

* grp is detached but still used, which violates cache-managed freeze constraint.

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Gao Xiang <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/staging/erofs/internal.h |   1 +
 drivers/staging/erofs/utils.c    | 134 ++++++++++++++++++++++---------
 2 files changed, 96 insertions(+), 39 deletions(-)

drivers/staging/erofs/internal.h +1 -0

index 048fb034b5aa..3ac4599bbe01 100644
@@ -250,6 +250,7 @@ repeat:
 }
 
 #define __erofs_workgroup_get(grp)	atomic_inc(&(grp)->refcount)
+#define __erofs_workgroup_put(grp)	atomic_dec(&(grp)->refcount)
 
 extern int erofs_workgroup_put(struct erofs_workgroup *grp);

drivers/staging/erofs/utils.c +95 ~~-39~~

168 lines not on this page · raw message

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #69 lore raw

PATCH 62/352 x86/resctrl: Fixup the user-visible strings

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 723f1a0dd8e26a7523ba068204bee11c95ded38d ]

Fix the messages in rdt_last_cmd_printf() and rdt_last_cmd_puts() to make them more meaningful and consistent.

[ bp: s/cpu/CPU/; s/mem\W/memory ]

Signed-off-by Babu Moger <[email protected]>

Signed-off-by Borislav Petkov <[email protected]>

Cc Andrew Morton <[email protected]>

Cc Andy Lutomirski <[email protected]>

Cc Arnd Bergmann <[email protected]>

Cc Brijesh Singh <[email protected]>

Cc "Chang S. Bae" <[email protected]>

Cc David Miller <[email protected]>

Cc David Woodhouse <[email protected]>

Cc Dmitry Safonov <[email protected]>

Cc Fenghua Yu <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Cc "H. Peter Anvin" <[email protected]>

Cc Ingo Molnar <[email protected]>

Cc Jann Horn <[email protected]>

Cc Joerg Roedel <[email protected]>

Cc Jonathan Corbet <[email protected]>

Cc Josh Poimboeuf <[email protected]>

Cc Kate Stewart <[email protected]>

Cc "Kirill A. Shutemov" <[email protected]>

Cc <[email protected]>

Cc Mauro Carvalho Chehab <[email protected]>

Cc Paolo Bonzini <[email protected]>

Cc Peter Zijlstra <[email protected]>

Cc Philippe Ombredanne <[email protected]>

Cc Pu Wen <[email protected]>

Cc <[email protected]>

Cc "Rafael J. Wysocki" <[email protected]>

Cc Reinette Chatre <[email protected]>

Cc Rian Hunter <[email protected]>

Cc Sherry Hurwitz <[email protected]>

Cc Suravee Suthikulpanit <[email protected]>

Cc Thomas Gleixner <[email protected]>

Cc Thomas Lendacky <[email protected]>

Cc Tony Luck <[email protected]>

Cc Vitaly Kuznetsov <[email protected]>

Cc <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c | 22 ++++++-------
 arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c | 34 +++++++++----------
 arch/x86/kernel/cpu/intel_rdt_rdtgroup.c    | 36 ++++++++++-----------
 3 files changed, 46 insertions(+), 46 deletions(-)

arch/x86/kernel/cpu/intel_rdt_ctrlmondata.c +11 ~~-11~~

index c8b72aff55e0..6e76ada71211 100644
@@ -71,7 +71,7 @@ int parse_bw(struct rdt_parse_data *data, struct rdt_resource *r,
 	unsigned long bw_val;
 
 	if (d->have_new_ctrl) {
-		rdt_last_cmd_printf("duplicate domain %d\n", d->id);
+		rdt_last_cmd_printf("Duplicate domain %d\n", d->id);
 		return -EINVAL;
 	}

@@ -97,12 +97,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r)
 
 	ret = kstrtoul(buf, 16, &val);
 	if (ret) {
-		rdt_last_cmd_printf("non-hex character in mask %s\n", buf);
+		rdt_last_cmd_printf("Non-hex character in the mask %s\n", buf);
 		return false;
 	}
 
 	if (val == 0 || val > r->default_ctrl) {
-		rdt_last_cmd_puts("mask out of range\n");
+		rdt_last_cmd_puts("Mask out of range\n");
 		return false;
 	}

@@ -110,12 +110,12 @@ static bool cbm_validate(char *buf, u32 *data, struct rdt_resource *r)
 	zero_bit = find_next_zero_bit(&val, cbm_len, first_bit);
 
 	if (find_next_bit(&val, cbm_len, zero_bit) < cbm_len) {
-		rdt_last_cmd_printf("mask %lx has non-consecutive 1-bits\n", val);
+		rdt_last_cmd_printf("The mask %lx has non-consecutive 1-bits\n", val);
 		return false;
 	}
 
 	if ((zero_bit - first_bit) < r->cache.min_cbm_bits) {
-		rdt_last_cmd_printf("Need at least %d bits in mask\n",
+		rdt_last_cmd_printf("Need at least %d bits in the mask\n",
 				    r->cache.min_cbm_bits);
 		return false;
 	}

@@ -135,7 +135,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	u32 cbm_val;
 
 	if (d->have_new_ctrl) {
-		rdt_last_cmd_printf("duplicate domain %d\n", d->id);
+		rdt_last_cmd_printf("Duplicate domain %d\n", d->id);
 		return -EINVAL;
 	}

@@ -145,7 +145,7 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	 */
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP &&
 	    rdtgroup_pseudo_locked_in_hierarchy(d)) {
-		rdt_last_cmd_printf("pseudo-locked region in hierarchy\n");
+		rdt_last_cmd_printf("Pseudo-locked region in hierarchy\n");
 		return -EINVAL;
 	}

@@ -164,14 +164,14 @@ int parse_cbm(struct rdt_parse_data *data, struct rdt_resource *r,
 	 * either is exclusive.
 	 */
 	if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, true)) {
-		rdt_last_cmd_printf("overlaps with exclusive group\n");
+		rdt_last_cmd_printf("Overlaps with exclusive group\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_cbm_overlaps(r, d, cbm_val, rdtgrp->closid, false)) {
 		if (rdtgrp->mode == RDT_MODE_EXCLUSIVE ||
 		    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
-			rdt_last_cmd_printf("overlaps with other group\n");
+			rdt_last_cmd_printf("0verlaps with other group\n");
 			return -EINVAL;
 		}
 	}

@@ -293,7 +293,7 @@ static int rdtgroup_parse_resource(char *resname, char *tok,
 		if (!strcmp(resname, r->name) && rdtgrp->closid < r->num_closid)
 			return parse_line(tok, r, rdtgrp);
 	}
-	rdt_last_cmd_printf("unknown/unsupported resource name '%s'\n", resname);
+	rdt_last_cmd_printf("Unknown or unsupported resource name '%s'\n", resname);
 	return -EINVAL;
 }

@@ -326,7 +326,7 @@ ssize_t rdtgroup_schemata_write(struct kernfs_open_file *of,
 	 */
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("resource group is pseudo-locked\n");
+		rdt_last_cmd_puts("Resource group is pseudo-locked\n");
 		goto out;
 	}

arch/x86/kernel/cpu/intel_rdt_pseudo_lock.c +17 ~~-17~~

index 815b4e92522c..cde746d64600 100644
@@ -213,7 +213,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr)
 	for_each_cpu(cpu, &plr->d->cpu_mask) {
 		pm_req = kzalloc(sizeof(*pm_req), GFP_KERNEL);
 		if (!pm_req) {
-			rdt_last_cmd_puts("fail allocating mem for PM QoS\n");
+			rdt_last_cmd_puts("Failure to allocate memory for PM QoS\n");
 			ret = -ENOMEM;
 			goto out_err;
 		}

@@ -222,7 +222,7 @@ static int pseudo_lock_cstates_constrain(struct pseudo_lock_region *plr)
 					     DEV_PM_QOS_RESUME_LATENCY,
 					     30);
 		if (ret < 0) {
-			rdt_last_cmd_printf("fail to add latency req cpu%d\n",
+			rdt_last_cmd_printf("Failed to add latency req CPU%d\n",
 					    cpu);
 			kfree(pm_req);
 			ret = -1;

@@ -289,7 +289,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr)
 	plr->cpu = cpumask_first(&plr->d->cpu_mask);
 
 	if (!cpu_online(plr->cpu)) {
-		rdt_last_cmd_printf("cpu %u associated with cache not online\n",
+		rdt_last_cmd_printf("CPU %u associated with cache not online\n",
 				    plr->cpu);
 		ret = -ENODEV;
 		goto out_region;

@@ -307,7 +307,7 @@ static int pseudo_lock_region_init(struct pseudo_lock_region *plr)
 	}
 
 	ret = -1;
-	rdt_last_cmd_puts("unable to determine cache line size\n");
+	rdt_last_cmd_puts("Unable to determine cache line size\n");
 out_region:
 	pseudo_lock_region_clear(plr);
 	return ret;

@@ -361,14 +361,14 @@ static int pseudo_lock_region_alloc(struct pseudo_lock_region *plr)
 	 * KMALLOC_MAX_SIZE.
 	 */
 	if (plr->size > KMALLOC_MAX_SIZE) {
-		rdt_last_cmd_puts("requested region exceeds maximum size\n");
+		rdt_last_cmd_puts("Requested region exceeds maximum size\n");
 		ret = -E2BIG;
 		goto out_region;
 	}
 
 	plr->kmem = kzalloc(plr->size, GFP_KERNEL);
 	if (!plr->kmem) {
-		rdt_last_cmd_puts("unable to allocate memory\n");
+		rdt_last_cmd_puts("Unable to allocate memory\n");
 		ret = -ENOMEM;
 		goto out_region;
 	}

@@ -665,7 +665,7 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	 * default closid associated with it.
 	 */
 	if (rdtgrp == &rdtgroup_default) {
-		rdt_last_cmd_puts("cannot pseudo-lock default group\n");
+		rdt_last_cmd_puts("Cannot pseudo-lock default group\n");
 		return -EINVAL;
 	}

@@ -707,17 +707,17 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	 */
 	prefetch_disable_bits = get_prefetch_disable_bits();
 	if (prefetch_disable_bits == 0) {
-		rdt_last_cmd_puts("pseudo-locking not supported\n");
+		rdt_last_cmd_puts("Pseudo-locking not supported\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_monitor_in_progress(rdtgrp)) {
-		rdt_last_cmd_puts("monitoring in progress\n");
+		rdt_last_cmd_puts("Monitoring in progress\n");
 		return -EINVAL;
 	}
 
 	if (rdtgroup_tasks_assigned(rdtgrp)) {
-		rdt_last_cmd_puts("tasks assigned to resource group\n");
+		rdt_last_cmd_puts("Tasks assigned to resource group\n");
 		return -EINVAL;
 	}

@@ -727,13 +727,13 @@ int rdtgroup_locksetup_enter(struct rdtgroup *rdtgrp)
 	}
 
 	if (rdtgroup_locksetup_user_restrict(rdtgrp)) {
-		rdt_last_cmd_puts("unable to modify resctrl permissions\n");
+		rdt_last_cmd_puts("Unable to modify resctrl permissions\n");
 		return -EIO;
 	}
 
 	ret = pseudo_lock_init(rdtgrp);
 	if (ret) {
-		rdt_last_cmd_puts("unable to init pseudo-lock region\n");
+		rdt_last_cmd_puts("Unable to init pseudo-lock region\n");
 		goto out_release;
 	}

@@ -770,7 +770,7 @@ int rdtgroup_locksetup_exit(struct rdtgroup *rdtgrp)
 	if (rdt_mon_capable) {
 		ret = alloc_rmid();
 		if (ret < 0) {
-			rdt_last_cmd_puts("out of RMIDs\n");
+			rdt_last_cmd_puts("Out of RMIDs\n");
 			return ret;
 		}
 		rdtgrp->mon.rmid = ret;

@@ -1304,7 +1304,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 					"pseudo_lock/%u", plr->cpu);
 	if (IS_ERR(thread)) {
 		ret = PTR_ERR(thread);
-		rdt_last_cmd_printf("locking thread returned error %d\n", ret);
+		rdt_last_cmd_printf("Locking thread returned error %d\n", ret);
 		goto out_cstates;
 	}

@@ -1322,13 +1322,13 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 		 * the cleared, but not freed, plr struct resulting in an
 		 * empty pseudo-locking loop.
 		 */
-		rdt_last_cmd_puts("locking thread interrupted\n");
+		rdt_last_cmd_puts("Locking thread interrupted\n");
 		goto out_cstates;
 	}
 
 	ret = pseudo_lock_minor_get(&new_minor);
 	if (ret < 0) {
-		rdt_last_cmd_puts("unable to obtain a new minor number\n");
+		rdt_last_cmd_puts("Unable to obtain a new minor number\n");
 		goto out_cstates;
 	}

@@ -1360,7 +1360,7 @@ int rdtgroup_pseudo_lock_create(struct rdtgroup *rdtgrp)
 
 	if (IS_ERR(dev)) {
 		ret = PTR_ERR(dev);
-		rdt_last_cmd_printf("failed to create character device: %d\n",
+		rdt_last_cmd_printf("Failed to create character device: %d\n",
 				    ret);
 		goto out_debugfs;
 	}

arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +18 ~~-18~~

index 951c61367688..17b63a4748bf 100644
@@ -345,7 +345,7 @@ static int cpus_mon_write(struct rdtgroup *rdtgrp, cpumask_var_t newmask,
 	/* Check whether cpus belong to parent ctrl group */
 	cpumask_andnot(tmpmask, newmask, &prgrp->cpu_mask);
 	if (cpumask_weight(tmpmask)) {
-		rdt_last_cmd_puts("can only add CPUs to mongroup that belong to parent\n");
+		rdt_last_cmd_puts("Can only add CPUs to mongroup that belong to parent\n");
 		return -EINVAL;
 	}

@@ -470,14 +470,14 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 	rdt_last_cmd_clear();
 	if (!rdtgrp) {
 		ret = -ENOENT;
-		rdt_last_cmd_puts("directory was removed\n");
+		rdt_last_cmd_puts("Directory was removed\n");
 		goto unlock;
 	}
 
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
 	    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto unlock;
 	}

@@ -487,7 +487,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 		ret = cpumask_parse(buf, newmask);
 
 	if (ret) {
-		rdt_last_cmd_puts("bad cpu list/mask\n");
+		rdt_last_cmd_puts("Bad CPU list/mask\n");
 		goto unlock;
 	}

@@ -495,7 +495,7 @@ static ssize_t rdtgroup_cpus_write(struct kernfs_open_file *of,
 	cpumask_andnot(tmpmask, newmask, cpu_online_mask);
 	if (cpumask_weight(tmpmask)) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("can only assign online cpus\n");
+		rdt_last_cmd_puts("Can only assign online CPUs\n");
 		goto unlock;
 	}

@@ -574,7 +574,7 @@ static int __rdtgroup_move_task(struct task_struct *tsk,
 		 */
 		atomic_dec(&rdtgrp->waitcount);
 		kfree(callback);
-		rdt_last_cmd_puts("task exited\n");
+		rdt_last_cmd_puts("Task exited\n");
 	} else {
 		/*
 		 * For ctrl_mon groups move both closid and rmid.

@@ -692,7 +692,7 @@ static ssize_t rdtgroup_tasks_write(struct kernfs_open_file *of,
 	if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED ||
 	    rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto unlock;
 	}

@@ -1158,14 +1158,14 @@ static bool rdtgroup_mode_test_exclusive(struct rdtgroup *rdtgrp)
 		list_for_each_entry(d, &r->domains, list) {
 			if (rdtgroup_cbm_overlaps(r, d, d->ctrl_val[closid],
 						  rdtgrp->closid, false)) {
-				rdt_last_cmd_puts("schemata overlaps\n");
+				rdt_last_cmd_puts("Schemata overlaps\n");
 				return false;
 			}
 		}
 	}
 
 	if (!has_cache) {
-		rdt_last_cmd_puts("cannot be exclusive without CAT/CDP\n");
+		rdt_last_cmd_puts("Cannot be exclusive without CAT/CDP\n");
 		return false;
 	}

@@ -1206,7 +1206,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of,
 		goto out;
 
 	if (mode == RDT_MODE_PSEUDO_LOCKED) {
-		rdt_last_cmd_printf("cannot change pseudo-locked group\n");
+		rdt_last_cmd_printf("Cannot change pseudo-locked group\n");
 		ret = -EINVAL;
 		goto out;
 	}

@@ -1235,7 +1235,7 @@ static ssize_t rdtgroup_mode_write(struct kernfs_open_file *of,
 			goto out;
 		rdtgrp->mode = RDT_MODE_PSEUDO_LOCKSETUP;
 	} else {
-		rdt_last_cmd_printf("unknown/unsupported mode\n");
+		rdt_last_cmd_printf("Unknown orunsupported mode\n");
 		ret = -EINVAL;
 	}

@@ -2540,7 +2540,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
 			tmp_cbm = d->new_ctrl;
 			if (bitmap_weight(&tmp_cbm, r->cache.cbm_len) <
 			    r->cache.min_cbm_bits) {
-				rdt_last_cmd_printf("no space on %s:%d\n",
+				rdt_last_cmd_printf("No space on %s:%d\n",
 						    r->name, d->id);
 				return -ENOSPC;
 			}

@@ -2557,7 +2557,7 @@ static int rdtgroup_init_alloc(struct rdtgroup *rdtgrp)
 			continue;
 		ret = update_domains(r, rdtgrp->closid);
 		if (ret < 0) {
-			rdt_last_cmd_puts("failed to initialize allocations\n");
+			rdt_last_cmd_puts("Failed to initialize allocations\n");
 			return ret;
 		}
 		rdtgrp->mode = RDT_MODE_SHAREABLE;

@@ -2580,7 +2580,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	rdt_last_cmd_clear();
 	if (!prdtgrp) {
 		ret = -ENODEV;
-		rdt_last_cmd_puts("directory was removed\n");
+		rdt_last_cmd_puts("Directory was removed\n");
 		goto out_unlock;
 	}

@@ -2588,7 +2588,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	    (prdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP ||
 	     prdtgrp->mode == RDT_MODE_PSEUDO_LOCKED)) {
 		ret = -EINVAL;
-		rdt_last_cmd_puts("pseudo-locking in progress\n");
+		rdt_last_cmd_puts("Pseudo-locking in progress\n");
 		goto out_unlock;
 	}

@@ -2596,7 +2596,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	rdtgrp = kzalloc(sizeof(*rdtgrp), GFP_KERNEL);
 	if (!rdtgrp) {
 		ret = -ENOSPC;
-		rdt_last_cmd_puts("kernel out of memory\n");
+		rdt_last_cmd_puts("Kernel out of memory\n");
 		goto out_unlock;
 	}
 	*r = rdtgrp;

@@ -2637,7 +2637,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
 	if (rdt_mon_capable) {
 		ret = alloc_rmid();
 		if (ret < 0) {
-			rdt_last_cmd_puts("out of RMIDs\n");
+			rdt_last_cmd_puts("Out of RMIDs\n");
 			goto out_destroy;
 		}
 		rdtgrp->mon.rmid = ret;

@@ -2725,7 +2725,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,
 	kn = rdtgrp->kn;
 	ret = closid_alloc();
 	if (ret < 0) {
-		rdt_last_cmd_puts("out of CLOSIDs\n");
+		rdt_last_cmd_puts("Out of CLOSIDs\n");
 		goto out_common_fail;
 	}
 	closid = ret;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #71 lore raw

PATCH 64/352 RDMA/core: Sync unregistration with netlink commands

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 01b671170d7f82b959dad6d5dbb44d7a915e647d ]

When the rdma device is getting removed, get resource info can race with device removal, as below:

      CPU-0                                  CPU-1
    --------                               --------
    rdma_nl_rcv_msg()
       nldev_res_get_cq_dumpit()
          mutex_lock(device_lock);
          get device reference
          mutex_unlock(device_lock);        [..]
                                            ib_unregister_device()
                                            /* Valid reference to
                                             * device->dev exists.
                                             */
                                             ib_dealloc_device()

          [..]
          provider->fill_res_entry();

Even though device object is not freed, fill_res_entry() can get called on device which doesn't have a driver anymore. Kernel core device reference count is not sufficient, as this only keeps the structure valid, and doesn't guarantee the driver is still loaded.

Similar race can occur with device renaming and device removal, where device_rename() tries to rename a unregistered device. While this is fine for devices of a class which are not net namespace aware, but it is incorrect for net namespace aware class coming in subsequent series. If a class is net namespace aware, then the below [1] call trace is observed in above situation.

Therefore, to avoid the race, keep a reference count and let device unregistration wait until all netlink users drop the reference.

[1] Call trace:
kernfs: ns required in 'infiniband' for 'mlx5_0'

WARNING: CPU: 18 PID: 44270 at fs/kernfs/dir.c:842 kernfs_find_ns+0x104/0x120
libahci i2c_core mlxfw libata dca [last unloaded: devlink]
RIP: 0010:kernfs_find_ns+0x104/0x120
Call Trace:
kernfs_find_and_get_ns+0x2e/0x50
sysfs_rename_link_ns+0x40/0xb0
device_rename+0xb2/0xf0
ib_device_rename+0xb3/0x100 [ib_core]
nldev_set_doit+0x165/0x190 [ib_core]
rdma_nl_rcv_msg+0x249/0x250 [ib_core]
? netlink_deliver_tap+0x8f/0x3e0
rdma_nl_rcv+0xd6/0x120 [ib_core]
netlink_unicast+0x17c/0x230
netlink_sendmsg+0x2f0/0x3e0
sock_sendmsg+0x30/0x40
__sys_sendto+0xdc/0x160

Fixes da5c85078215 ("RDMA/nldev: add driver-specific resource tracking")

Signed-off-by Parav Pandit <[email protected]>

Signed-off-by Leon Romanovsky <[email protected]>

Signed-off-by Jason Gunthorpe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/infiniband/core/core_priv.h |  1 +
 drivers/infiniband/core/device.c    | 26 ++++++++++++++++++++++----
 drivers/infiniband/core/nldev.c     | 20 ++++++++++----------
 include/rdma/ib_verbs.h             |  8 +++++++-
 4 files changed, 40 insertions(+), 15 deletions(-)

drivers/infiniband/core/core_priv.h +1 -0

index bb9007a0cca7..d97d39a7537c 100644
@@ -296,6 +296,7 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map,
 #endif
 
 struct ib_device *ib_device_get_by_index(u32 ifindex);
+void ib_device_put(struct ib_device *device);
 /* RDMA device netlink */
 void nldev_init(void);
 void nldev_exit(void);

drivers/infiniband/core/device.c +22 -4

index 87eb4f2cdd7d..0027b0d79b09 100644
@@ -145,7 +145,8 @@ static struct ib_device *__ib_device_get_by_index(u32 index)
 }
 
 /*
- * Caller is responsible to return refrerence count by calling put_device()
+ * Caller must perform ib_device_put() to return the device reference count
+ * when ib_device_get_by_index() returns valid device pointer.
  */
 struct ib_device *ib_device_get_by_index(u32 index)
 {

@@ -153,13 +154,21 @@ struct ib_device *ib_device_get_by_index(u32 index)
 
 	down_read(&lists_rwsem);
 	device = __ib_device_get_by_index(index);
-	if (device)
-		get_device(&device->dev);
-
+	if (device) {
+		/* Do not return a device if unregistration has started. */
+		if (!refcount_inc_not_zero(&device->refcount))
+			device = NULL;
+	}
 	up_read(&lists_rwsem);
 	return device;
 }
 
+void ib_device_put(struct ib_device *device)
+{
+	if (refcount_dec_and_test(&device->refcount))
+		complete(&device->unreg_completion);
+}
+
 static struct ib_device *__ib_device_get_by_name(const char *name)
 {
 	struct ib_device *device;

@@ -293,6 +302,8 @@ struct ib_device *ib_alloc_device(size_t size)
 	rwlock_init(&device->client_data_lock);
 	INIT_LIST_HEAD(&device->client_data_list);
 	INIT_LIST_HEAD(&device->port_list);
+	refcount_set(&device->refcount, 1);
+	init_completion(&device->unreg_completion);
 
 	return device;
 }

@@ -641,6 +652,13 @@ void ib_unregister_device(struct ib_device *device)
 	struct ib_client_data *context, *tmp;
 	unsigned long flags;
 
+	/*
+	 * Wait for all netlink command callers to finish working on the
+	 * device.
+	 */
+	ib_device_put(device);
+	wait_for_completion(&device->unreg_completion);
+
 	mutex_lock(&device_mutex);
 
 	down_write(&lists_rwsem);

drivers/infiniband/core/nldev.c +10 ~~-10~~

index ff6468e7fe79..77a0f1e1576f 100644
@@ -632,13 +632,13 @@ static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 
 	nlmsg_end(msg, nlh);
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }

@@ -668,7 +668,7 @@ static int nldev_set_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		err = ib_device_rename(device, name);
 	}
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }

@@ -752,14 +752,14 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto err_free;
 
 	nlmsg_end(msg, nlh);
-	put_device(&device->dev);
+	ib_device_put(device);
 
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return err;
 }

@@ -816,7 +816,7 @@ static int nldev_port_get_dumpit(struct sk_buff *skb,
 	}
 
 out:
-	put_device(&device->dev);
+	ib_device_put(device);
 	cb->args[0] = idx;
 	return skb->len;
 }

@@ -855,13 +855,13 @@ static int nldev_res_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
 		goto err_free;
 
 	nlmsg_end(msg, nlh);
-	put_device(&device->dev);
+	ib_device_put(device);
 	return rdma_nl_unicast(msg, NETLINK_CB(skb).portid);
 
 err_free:
 	nlmsg_free(msg);
 err:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return ret;
 }

@@ -1054,7 +1054,7 @@ next:		idx++;
 	if (!filled)
 		goto err;
 
-	put_device(&device->dev);
+	ib_device_put(device);
 	return skb->len;
 
 res_err:

@@ -1065,7 +1065,7 @@ err:
 	nlmsg_cancel(skb, nlh);
 
 err_index:
-	put_device(&device->dev);
+	ib_device_put(device);
 	return ret;
 }

include/rdma/ib_verbs.h +7 -1

index 9c0c2132a2d6..64626b32107b 100644
@@ -56,7 +56,7 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/netdevice.h>
-
+#include <linux/refcount.h>
 #include <linux/if_link.h>
 #include <linux/atomic.h>
 #include <linux/mmu_notifier.h>

@@ -2605,6 +2605,12 @@ struct ib_device {
 
 	const struct uverbs_object_tree_def *const *driver_specs;
 	enum rdma_driver_id		driver_id;
+	/*
+	 * Provides synchronization between device unregistration and netlink
+	 * commands on a device. To be used only by core.
+	 */
+	refcount_t refcount;
+	struct completion unreg_completion;
 };
 
 struct ib_client {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #72 lore raw

PATCH 65/352 drm: rcar-du: Fix external clock error checks

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 63a298f22a6183b5b7536a203596c6570dfcfe8e ]

The rcar-du driver supports probe deferral for external clocks, but implements it badly by checking the wrong pointer due to a bad copy and paste. Fix it.

While at it, reject invalid clocks outright for DU channels that have a display PLL, as the external clock is mandatory in that case. This avoids a WARN_ON() at runtime.

Fixes 1b30dbde8596 ("drm: rcar-du: Add support for external pixel clock")

Reported-by Kuninori Morimoto <[email protected]>

Signed-off-by Laurent Pinchart <[email protected]>

Reviewed-by Kieran Bingham <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/rcar-du/rcar_du_crtc.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

drivers/gpu/drm/rcar-du/rcar_du_crtc.c +9 -5

index 17741843cf51..40a9afe818a8 100644
@@ -226,9 +226,6 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
 		 * system clock, and have no internal clock divider.
 		 */
 
-		if (WARN_ON(!rcrtc->extclock))
-			return;
-
 		/*
 		 * The H3 ES1.x exhibits dot clock duty cycle stability issues.
 		 * We can work around them by configuring the DPLL to twice the

@@ -1113,9 +1110,16 @@ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int swindex,
 	clk = devm_clk_get(rcdu->dev, clk_name);
 	if (!IS_ERR(clk)) {
 		rcrtc->extclock = clk;
-	} else if (PTR_ERR(rcrtc->clock) == -EPROBE_DEFER) {
-		dev_info(rcdu->dev, "can't get external clock %u\n", hwindex);
+	} else if (PTR_ERR(clk) == -EPROBE_DEFER) {
 		return -EPROBE_DEFER;
+	} else if (rcdu->info->dpll_mask & BIT(hwindex)) {
+		/*
+		 * DU channels that have a display PLL can't use the internal
+		 * system clock and thus require an external clock.
+		 */
+		ret = PTR_ERR(clk);
+		dev_err(rcdu->dev, "can't get dclkin.%u: %d\n", hwindex, ret);
+		return ret;
 	}
 
 	init_waitqueue_head(&rcrtc->flip_wait);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #73 lore raw

PATCH 66/352 ASoC: sunxi: sun50i-codec-analog: Add support for cpvdd regulator supply

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ca0412a05756cd0b94751ca4d54fe6522f00b1f4 ]

On the Allwinner A64 SoCs, the audio codec has a built-in headphone amplifier. This amplifier has a power supply separate from the rest of the analog audio circuitry, labeled cpvdd.

This patch adds a DAPM widget for this supply, and ties it to the headphone amp widget.

Signed-off-by Chen-Yu Tsai <[email protected]>

Acked-by Maxime Ripard <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 sound/soc/sunxi/sun50i-codec-analog.c | 2 ++
 1 file changed, 2 insertions(+)

sound/soc/sunxi/sun50i-codec-analog.c +2 -0

index 8f5f999df631..df1fed0aa001 100644
@@ -274,6 +274,7 @@ static const struct snd_soc_dapm_widget sun50i_a64_codec_widgets[] = {
 	 * stream widgets at the card level.
 	 */
 
+	SND_SOC_DAPM_REGULATOR_SUPPLY("hpvcc", 0, 0),
 	SND_SOC_DAPM_MUX("Headphone Source Playback Route",
 			 SND_SOC_NOPM, 0, 0, sun50i_codec_hp_src),
 	SND_SOC_DAPM_OUT_DRV("Headphone Amp", SUN50I_ADDA_HP_CTRL,

@@ -361,6 +362,7 @@ static const struct snd_soc_dapm_route sun50i_a64_codec_routes[] = {
 	{ "Headphone Source Playback Route", "Mixer", "Left Mixer" },
 	{ "Headphone Source Playback Route", "Mixer", "Right Mixer" },
 	{ "Headphone Amp", NULL, "Headphone Source Playback Route" },
+	{ "Headphone Amp", NULL, "hpvcc" },
 	{ "HP", NULL, "Headphone Amp" },
 
 	/* Microphone Routes */

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:23 UTC #79 lore raw

PATCH 68/352 clk: meson: meson8b: fix the width of the cpu_scale_div clock

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a8662eadd1032018f31e37deda811790b2326662 ]

According to the public S805 datasheet HHI_SYS_CPU_CLK_CNTL1[29:20] is the register for the CPU scale_div clock. This matches the code in Amlogic's 3.10 GPL kernel sources:
N = (aml_read_reg32(P_HHI_SYS_CPU_CLK_CNTL1) >> 20) & 0x3FF;

This means that the divider register is 10 bit wide instead of 9 bits. So far this is not a problem since all u-boot versions I have seen are not using the cpu_scale_div clock at all (instead they are configuring the CPU clock to run off cpu_in_sel directly).

The fixes tag points to the latest rework of the CPU clocks. However, even before the rework it was wrong. Commit 7a29a869434e8b ("clk: meson:
Add support for Meson clock controller") defines MESON_N_WIDTH as 9 (in drivers/clk/meson/clk-cpu.c). But since the old clk-cpu implementation this only carries the fixes tag for the CPU clock rewordk.

Fixes 251b6fd38bcb9c ("clk: meson: rework meson8b cpu clock")

Signed-off-by Martin Blumenstingl <[email protected]>

Signed-off-by Neil Armstrong <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/clk/meson/meson8b.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/clk/meson/meson8b.c +1 -1

index 328fcf50d9e8..9160a3b2e668 100644
@@ -599,7 +599,7 @@ static struct clk_regmap meson8b_cpu_scale_div = {
 	.data = &(struct clk_regmap_div_data){
 		.offset =  HHI_SYS_CPU_CLK_CNTL1,
 		.shift = 20,
-		.width = 9,
+		.width = 10,
 		.table = cpu_scale_table,
 		.flags = CLK_DIVIDER_ALLOW_ZERO,
 	},

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #80 lore raw

PATCH 69/352 clk: meson: meson8b: mark the CPU clock as CLK_IS_CRITICAL

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0dad1ec65bc30a549aba38d34a727309bbf41bc8 ]

We don't want the common clock framework to disable the "cpu_clk" if it's not used by any device. The cpufreq-dt driver does not enable the CPU clocks. However, even if it would we would still want the CPU clock to be enabled at all times because the CPU clock is also required even if we disable CPU frequency scaling on a specific board.

The reason why we want the CPU clock to be enabled is a clock further up in the tree:
Since commit 6f888e7bc7bd58 ("clk: meson: clk-pll: add enable bit") the sys_pll can be disabled. However, since the CPU clock is derived from sys_pll we don't want sys_pll to get disabled. The common clock framework takes care of that for us by enabling all parent clocks of our CPU clock when we mark the CPU clock with CLK_IS_CRITICAL.

Until now this is not a problem yet because all clocks in the CPU clock's tree (including sys_pll) are read-only. However, once we allow modifications to the clocks in that tree we will need this.

Signed-off-by Martin Blumenstingl <[email protected]>

Acked-by Jerome Brunet <[email protected]>

Signed-off-by Neil Armstrong <[email protected]>

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/clk/meson/meson8b.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/clk/meson/meson8b.c +2 -1

index 9160a3b2e668..a3a826419c16 100644
@@ -650,7 +650,8 @@ static struct clk_regmap meson8b_cpu_clk = {
 						  "cpu_scale_out_sel" },
 		.num_parents = 2,
 		.flags = (CLK_SET_RATE_PARENT |
-			  CLK_SET_RATE_NO_REPARENT),
+			  CLK_SET_RATE_NO_REPARENT |
+			  CLK_IS_CRITICAL),
 	},
 };

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #81 lore raw

PATCH 70/352 ptp: Fix pass zero to ERR_PTR() in ptp_clock_register

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit aea0a897af9e44c258e8ab9296fad417f1bc063a ]

Fix smatch warning:

drivers/ptp/ptp_clock.c:298 ptp_clock_register() warn:
passing zero to 'ERR_PTR'

'err' should be set while device_create_with_groups and pps_register_source fails

Fixes 85a66e550195 ("ptp: create "pins" together with the rest of attributes")

Signed-off-by YueHaibing <[email protected]>

Acked-by Richard Cochran <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/ptp/ptp_clock.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

drivers/ptp/ptp_clock.c +4 -1

index 5419a89d300e..9b8aa6718ee7 100644
@@ -249,8 +249,10 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
 	ptp->dev = device_create_with_groups(ptp_class, parent, ptp->devid,
 					     ptp, ptp->pin_attr_groups,
 					     "ptp%d", ptp->index);
-	if (IS_ERR(ptp->dev))
+	if (IS_ERR(ptp->dev)) {
+		err = PTR_ERR(ptp->dev);
 		goto no_device;
+	}
 
 	/* Register a new PPS source. */
 	if (info->pps) {

@@ -261,6 +263,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info,
 		pps.owner = info->owner;
 		ptp->pps_source = pps_register_source(&pps, PTP_PPS_DEFAULTS);
 		if (!ptp->pps_source) {
+			err = -EINVAL;
 			pr_err("failed to register pps source\n");
 			goto no_pps;
 		}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #83 lore raw

PATCH 72/352 powerpc/32: Add .data..Lubsan_data*/.data..Lubsan_type* sections explicitly

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit beba24ac59133cb36ecd03f9af9ccb11971ee20e ]

When both CONFIG_LD_DEAD_CODE_DATA_ELIMINATION=y and CONFIG_UBSAN=y are set, link step typically produce numberous warnings about orphan section:

+ powerpc-linux-gnu-ld -EB -m elf32ppc -Bstatic --orphan-handling=warn --build-id --gc-sections -X -o .tmp_vmlinux1 -T ./arch/powerpc/kernel/vmlinux.lds --who le-archive built-in.a --no-whole-archive --start-group lib/lib.a --end-group
powerpc-linux-gnu-ld: warning: orphan section .data..Lubsan_data393' from init/main.o' being placed in section `.data..Lubsan_data393'.
powerpc-linux-gnu-ld: warning: orphan section .data..Lubsan_data394' from init/main.o' being placed in section `.data..Lubsan_data394'.
...
powerpc-linux-gnu-ld: warning: orphan section .data..Lubsan_type11' from init/main.o' being placed in section `.data..Lubsan_type11'.
powerpc-linux-gnu-ld: warning: orphan section .data..Lubsan_type12' from init/main.o' being placed in section `.data..Lubsan_type12'.
...

This commit remove those warnings produced at W=1.

Link https://www.mail-archive.com/[email protected]/msg135407.html

Signed-off-by Mathieu Malaterre <[email protected]>

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/powerpc/kernel/vmlinux.lds.S | 4 ++++
 1 file changed, 4 insertions(+)

arch/powerpc/kernel/vmlinux.lds.S +4 -0

index 434581bcd5b4..1148c3c60c3b 100644
@@ -308,6 +308,10 @@ SECTIONS
 #ifdef CONFIG_PPC32
 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
 		DATA_DATA
+#ifdef CONFIG_UBSAN
+		*(.data..Lubsan_data*)
+		*(.data..Lubsan_type*)
+#endif
 		*(.data.rel*)
 		*(SDATA_MAIN)
 		*(.sdata2)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #53 lore raw

PATCH 46/352 usbnet: smsc95xx: fix rx packet alignment

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 810eeb1f41a9a272eedc94ca18c072e75678ede4 ]

The smsc95xx driver already takes into account the NET_IP_ALIGN parameter when setting up the receive packet data, which means we do not need to worry about aligning the packets in the usbnet driver.

Adding the EVENT_NO_IP_ALIGN means that the IPv4 header is now passed to the ip_rcv() routine with the start on an aligned address.

Tested on Raspberry Pi B3.

Signed-off-by Ben Dooks <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/usb/smsc95xx.c | 1 +
 1 file changed, 1 insertion(+)

drivers/net/usb/smsc95xx.c +1 -0

index f2d01cb6f958..6e971628bb50 100644
@@ -1295,6 +1295,7 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 		dev->net->features |= NETIF_F_RXCSUM;
 
 	dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
+	set_bit(EVENT_NO_IP_ALIGN, &dev->flags);
 
 	smsc95xx_init_mac_address(dev);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #85 lore raw

PATCH 74/352 iio: adc: meson-saradc: fix internal clock names

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 50314f98b0ac468218e7c9af8c99f215a35436df ]

Before this patch we are registering the internal clocks (for example on Meson8b, where the SAR ADC IP block implements the divider and gate clocks) with the following names:
- /soc/cbus@c1100000/adc@8680#adc_div
- /soc/cbus@c1100000/adc@8680#adc_en

This is bad because the common clock framework uses the clock to create a directory in <debugfs>/clk. With such name, the directory creation (silently) fails and the debugfs entry ends up being created at the debugfs root.

With this change, the new clock names are:
- c1108680.adc#adc_div
- c1108680.adc#adc_en

This matches the clock naming scheme used in the PWM, Ethernet and MMC drivers. It also fixes the problem with debugfs.
The idea is shamelessly taken from commit b96e9eb62841c5 ("pwm: meson:
Fix mux clock names").

Fixes 3921db46a8c5bc ("iio: Convert to using %pOF instead of full_name")

Signed-off-by Martin Blumenstingl <[email protected]>

Signed-off-by Jonathan Cameron <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/iio/adc/meson_saradc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/iio/adc/meson_saradc.c +4 -4

index 672a5dee4a9d..ba4b42429a2a 100644
@@ -587,8 +587,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 	struct clk_init_data init;
 	const char *clk_parents[1];
 
-	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_div",
-				   indio_dev->dev.of_node);
+	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_div",
+				   dev_name(indio_dev->dev.parent));
 	if (!init.name)
 		return -ENOMEM;

@@ -609,8 +609,8 @@ static int meson_sar_adc_clk_init(struct iio_dev *indio_dev,
 	if (WARN_ON(IS_ERR(priv->adc_div_clk)))
 		return PTR_ERR(priv->adc_div_clk);
 
-	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%pOF#adc_en",
-				   indio_dev->dev.of_node);
+	init.name = devm_kasprintf(&indio_dev->dev, GFP_KERNEL, "%s#adc_en",
+				   dev_name(indio_dev->dev.parent));
 	if (!init.name)
 		return -ENOMEM;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #54 lore raw

PATCH 47/352 drm/rockchip: fix for mailbox read size

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit fa68d4f8476bea4cdf441062b614b41bb85ef1da ]

Some of the functions (like cdn_dp_dpcd_read, cdn_dp_get_edid_block) allow to read 64KiB, but the cdn_dp_mailbox_read_receive, that is used by them, can read only up to 255 bytes at once. Normally, it's not a big issue as DPCD or EDID reads won't (hopefully) exceed that value.
The real issue here is the revocation list read during the HDCP authentication process. (problematic use case:
https://chromium.googlesource.com/chromiumos/third_party/kernel/+/chromeos-4.4/drivers/gpu/drm/rockchip/cdn-dp-reg.c#1152)
The list can reach 127*5+4 bytes (num devs * 5 bytes per ID/Bksv + 4 bytes of an additional info).
In other words - CTSes with HDCP Repeater won't pass without this fix. Oh, and the driver will most likely stop working (best case scenario).

Signed-off-by Damian Kos <[email protected]>

Signed-off-by Heiko Stuebner <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/gpu/drm/rockchip/cdn-dp-reg.c +1 -1

index 3105965fc260..5a485489a1e2 100644
@@ -147,7 +147,7 @@ static int cdn_dp_mailbox_validate_receive(struct cdn_dp_device *dp,
 }
 
 static int cdn_dp_mailbox_read_receive(struct cdn_dp_device *dp,
-				       u8 *buff, u8 buff_size)
+				       u8 *buff, u16 buff_size)
 {
 	u32 i;
 	int ret;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #55 lore raw

PATCH 48/352 ARM: OMAP2+: hwmod: Fix some section annotations

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c10b26abeb53cabc1e6271a167d3f3d396ce0218 ]

When building the kernel with Clang, the following section mismatch warnings appears:

WARNING: vmlinux.o(.text+0x2d398): Section mismatch in reference from the function _setup() to the function .init.text:_setup_iclk_autoidle() The function _setup() references
the function __init _setup_iclk_autoidle().
This is often because _setup lacks a __init
annotation or the annotation of _setup_iclk_autoidle is wrong.

WARNING: vmlinux.o(.text+0x2d3a0): Section mismatch in reference from the function _setup() to the function .init.text:_setup_reset() The function _setup() references
the function __init _setup_reset().
This is often because _setup lacks a __init
annotation or the annotation of _setup_reset is wrong.

WARNING: vmlinux.o(.text+0x2d408): Section mismatch in reference from the function _setup() to the function .init.text:_setup_postsetup() The function _setup() references
the function __init _setup_postsetup().
This is often because _setup lacks a __init
annotation or the annotation of _setup_postsetup is wrong.

_setup is used in omap_hwmod_allocate_module, which isn't marked __init and looks like it shouldn't be, meaning to fix these warnings, those functions must be moved out of the init section, which this patch does.

Signed-off-by Nathan Chancellor <[email protected]>

Signed-off-by Tony Lindgren <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/mach-omap2/omap_hwmod.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

arch/arm/mach-omap2/omap_hwmod.c +3 -3

index 083dcd9942ce..921c9aaee63f 100644
@@ -2413,7 +2413,7 @@ static int __init _init(struct omap_hwmod *oh, void *data)
  * a stub; implementing this properly requires iclk autoidle usecounting in
  * the clock code.   No return value.
  */
-static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
+static void _setup_iclk_autoidle(struct omap_hwmod *oh)
 {
 	struct omap_hwmod_ocp_if *os;

@@ -2444,7 +2444,7 @@ static void __init _setup_iclk_autoidle(struct omap_hwmod *oh)
  * reset.  Returns 0 upon success or a negative error code upon
  * failure.
  */
-static int __init _setup_reset(struct omap_hwmod *oh)
+static int _setup_reset(struct omap_hwmod *oh)
 {
 	int r;

@@ -2505,7 +2505,7 @@ static int __init _setup_reset(struct omap_hwmod *oh)
  *
  * No return value.
  */
-static void __init _setup_postsetup(struct omap_hwmod *oh)
+static void _setup_postsetup(struct omap_hwmod *oh)
 {
 	u8 postsetup_state;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #57 lore raw

PATCH 50/352 drm/amd/display: calculate stream->phy_pix_clk before clock mapping

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 08e1c28dd521c7b08d1b0af0bae9fb22ccc012a4 ]

[why]
phy_pix_clk is one of the variable used to check if one PLL can be shared with displays having common mode set configuration. As of now phy_pix_clock varialbe is calculated in function dc_validate_stream(). dc_validate_stream() function is called after clocks are assigned for the new display. Due to this during hotplug, when PLL sharing conditions are checked for new display phy_pix_clk variable will be 0 and for displays that are already enabled phy_pix_clk will have some value. Hence PLL will not be shared and if the display hardware doesn't have any more PLL to assign, mode set will fail due to resource unavailability.

[how]
Instead of only calculating the phy_pix_clk variable after the PLL is assigned for new display, this patch calculates phy_pix_clk also during the before assigning the PLL for new display.

Signed-off-by Yogesh Mohan Marimuthu <[email protected]>

Reviewed-by Harry Wentland <[email protected]>

Acked-by Bhawanpreet Lakha <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpu/drm/amd/display/dc/core/dc_resource.c +2 -0

index b6fe29b9fb65..8bd8f34b979c 100644
@@ -2002,6 +2002,8 @@ enum dc_status resource_map_pool_resources(
 		}
 	*/
 
+	calculate_phy_pix_clks(stream);
+
 	/* acquire new resources */
 	pipe_idx = acquire_first_free_pipe(&context->res_ctx, pool, stream);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #58 lore raw

PATCH 51/352 bpf: libbpf: retry map creation without the name

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 23499442c319412aa8e54e7a939e2eb531bdd77d ]

Since commit 88cda1c9da02 ("bpf: libbpf: Provide basic API support to specify BPF obj name"), libbpf unconditionally sets bpf_attr->name for maps. Pre v4.14 kernels don't know about map names and return an error about unexpected non-zero data. Retry sys_bpf without a map name to cover older kernels.

v2 changes:
* check for errno == EINVAL as suggested by Daniel Borkmann

Signed-off-by Stanislav Fomichev <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/lib/bpf/bpf.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

tools/lib/bpf/bpf.c +10 -1

index 03f9bcc4ef50..961e1b9fc592 100644
@@ -69,6 +69,7 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
 {
 	__u32 name_len = create_attr->name ? strlen(create_attr->name) : 0;
 	union bpf_attr attr;
+	int ret;
 
 	memset(&attr, '\0', sizeof(attr));

@@ -86,7 +87,15 @@ int bpf_create_map_xattr(const struct bpf_create_map_attr *create_attr)
 	attr.map_ifindex = create_attr->map_ifindex;
 	attr.inner_map_fd = create_attr->inner_map_fd;
 
-	return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	ret = sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	if (ret < 0 && errno == EINVAL && create_attr->name) {
+		/* Retry the same syscall, but without the name.
+		 * Pre v4.14 kernels don't support map names.
+		 */
+		memset(attr.map_name, 0, sizeof(attr.map_name));
+		return sys_bpf(BPF_MAP_CREATE, &attr, sizeof(attr));
+	}
+	return ret;
 }
 
 int bpf_create_map_node(enum bpf_map_type map_type, const char *name,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #88 lore raw

PATCH 77/352 ACPI: SPCR: Consider baud rate 0 as preconfigured state

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b413b1abeb21b4a152c0bf8d1379efa30759b6e3 ]

Since SPCR 1.04 [1] the baud rate of 0 means a preconfigured state of UART. Assume firmware or bootloader configures console correctly.

[1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/serports/serial-port-console-redirection-table

Signed-off-by Andy Shevchenko <[email protected]>

Reviewed-by Prarit Bhargava <[email protected]>

Signed-off-by Rafael J. Wysocki <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/acpi/spcr.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

drivers/acpi/spcr.c +11 -0

index 9d52743080a4..c336784d0bcb 100644
@@ -148,6 +148,13 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
 	}
 
 	switch (table->baud_rate) {
+	case 0:
+		/*
+		 * SPCR 1.04 defines 0 as a preconfigured state of UART.
+		 * Assume firmware or bootloader configures console correctly.
+		 */
+		baud_rate = 0;
+		break;
 	case 3:
 		baud_rate = 9600;
 		break;

@@ -196,6 +203,10 @@ int __init acpi_parse_spcr(bool enable_earlycon, bool enable_console)
 		 * UART so don't attempt to change to the baud rate state
 		 * in the table because driver cannot calculate the dividers
 		 */
+		baud_rate = 0;
+	}
+
+	if (!baud_rate) {
 		snprintf(opts, sizeof(opts), "%s,%s,0x%llx", uart, iotype,
 			 table->serial_port.address);
 	} else {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #100 lore raw

PATCH 86/352 net: aquantia: return err if set MPI_DEINIT state fails

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4e3c7c00bba0636b97eb23d582c20b0f5d95ce20 ]

Fixes gcc '-Wunused-but-set-variable' warning:

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c:260:7:
warning: variable 'err' set but not used [-Wunused-but-set-variable]

'err' should be returned while set MPI_DEINIT state fails in hw_atl_utils_soft_reset.

Fixes cce96d1883da ("net: aquantia: Regression on reset with 1.x firmware")

Signed-off-by YueHaibing <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c +2 -0

index 7def1cb8ab9d..22cbf8dc6fa9 100644
@@ -263,6 +263,8 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
 		AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
 				HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
 			       10, 1000U);
+		if (err)
+			return err;
 	}
 
 	if (self->rbl_enabled)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #102 lore raw

PATCH 88/352 soc: bcm: brcmstb: Dont leak device tree node reference

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 1861a7f07e02292830a1ca256328d370deefea30 ]

of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. soc_is_brcmstb() doesn't do that, so fix it.

[treding: slightly rewrite to avoid inline comparison]

Fixes d52fad262041 ("soc: add stubs for brcmstb SoC's")

Signed-off-by Yangtao Li <[email protected]>

Signed-off-by Florian Fainelli <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/soc/bcm/brcmstb/common.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/soc/bcm/brcmstb/common.c +5 -1

index 14185451901d..bf9123f727e8 100644
@@ -31,13 +31,17 @@ static const struct of_device_id brcmstb_machine_match[] = {
 
 bool soc_is_brcmstb(void)
 {
+	const struct of_device_id *match;
 	struct device_node *root;
 
 	root = of_find_node_by_path("/");
 	if (!root)
 		return false;
 
-	return of_match_node(brcmstb_machine_match, root) != NULL;
+	match = of_match_node(brcmstb_machine_match, root);
+	of_node_put(root);
+
+	return match != NULL;
 }
 
 u32 brcmstb_get_family_id(void)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #104 lore raw

PATCH 90/352 drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit aa394b0dd68cb00c483e151dcd84713d4d517ed1 ]

drm_atomic_helper_commit_duplicated_state() sets state->acquire_ctx to the context given in the argument and leaves it in state after it quits. The lifetime of state and context are not guaranteed to be the same, so we shouldn't leave that pointer hanging around. This patch resets the context to NULL to avoid any oopses.

Changes in v2:
- Added to the set

Reviewed-by Daniel Vetter <[email protected]>

Signed-off-by Sean Paul <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/drm_atomic_helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/gpu/drm/drm_atomic_helper.c +6 -2

index b4e292a56046..df86c2ebfc12 100644
@@ -3212,7 +3212,7 @@ EXPORT_SYMBOL(drm_atomic_helper_suspend);
 int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
 					      struct drm_modeset_acquire_ctx *ctx)
 {
-	int i;
+	int i, ret;
 	struct drm_plane *plane;
 	struct drm_plane_state *new_plane_state;
 	struct drm_connector *connector;

@@ -3231,7 +3231,11 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state,
 	for_each_new_connector_in_state(state, connector, new_conn_state, i)
 		state->connectors[i].old_state = connector->state;
 
-	return drm_atomic_commit(state);
+	ret = drm_atomic_commit(state);
+
+	state->acquire_ctx = NULL;
+
+	return ret;
 }
 EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:24 UTC #105 lore raw

PATCH 91/352 perf: arm_spe: handle devm_kasprintf() failure

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 754a58db6a556e6e5f5e32f3e84e7d67b5bf9c8e ]

devm_kasprintf() may return NULL on failure of internal allocation thus the assignment to 'name' is not safe if unchecked. If NULL is passed in for name then perf_pmu_register() would not fail but rather silently jump to skip_type which is not the intent here. As perf_pmu_register() may also return -ENOMEM returning -ENOMEM in the (unlikely) failure case of devm_kasprintf() should be fine here as well.

Acked-by Mark Rutland <[email protected]>

Fixes d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension")

Signed-off-by Nicholas Mc Guire <[email protected]>

[will: reworded error message]

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/perf/arm_spe_pmu.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/perf/arm_spe_pmu.c +5 -0

index 54ec278d2fc4..e1a77b2de78a 100644
@@ -927,6 +927,11 @@ static int arm_spe_pmu_perf_init(struct arm_spe_pmu *spe_pmu)
 
 	idx = atomic_inc_return(&pmu_idx);
 	name = devm_kasprintf(dev, GFP_KERNEL, "%s_%d", PMUNAME, idx);
+	if (!name) {
+		dev_err(dev, "failed to allocate name for pmu %d\n", idx);
+		return -ENOMEM;
+	}
+
 	return perf_pmu_register(&spe_pmu->pmu, name, -1);
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #106 lore raw

PATCH 92/352 arm64: io: Ensure value passed to __iormb() is held in a 64-bit register

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 1b57ec8c75279b873639eb44a215479236f93481 ]

As of commit 6460d3201471 ("arm64: io: Ensure calls to delay routines are ordered against prior readX()"), MMIO reads smaller than 64 bits fail to compile under clang because we end up mixing 32-bit and 64-bit register operands for the same data processing instruction:

./include/asm-generic/io.h:695:9: warning: value size does not match register size specified by the constraint and modifier [-Wasm-operand-widths]

        return readb(addr);
               ^
./arch/arm64/include/asm/io.h:147:58: note: expanded from macro 'readb'
                                                                       ^
./include/asm-generic/io.h:695:9: note: use constraint modifier "w"
./arch/arm64/include/asm/io.h:147:50: note: expanded from macro 'readb'
                                                               ^
./arch/arm64/include/asm/io.h:118:24: note: expanded from macro '__iormb'
        asm volatile("eor       %0, %1, %1\n"                           \
                                    ^

Fix the build by casting the macro argument to 'unsigned long' when used as an input to the inline asm.

Reported-by Nick Desaulniers <[email protected]>

Reported-by Nathan Chancellor <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm64/include/asm/io.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/arm64/include/asm/io.h +2 -1

index d42d00d8d5b6..ee723835c1f4 100644
@@ -117,7 +117,8 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 	 */								\
 	asm volatile("eor	%0, %1, %1\n"				\
 		     "cbnz	%0, ."					\
-		     : "=r" (tmp) : "r" (v) : "memory");		\
+		     : "=r" (tmp) : "r" ((unsigned long)(v))		\
+		     : "memory");					\
 })
 
 #define __iowmb()		wmb()

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #108 lore raw

PATCH 94/352 thermal: Fix locking in cooling device sysfs update cur_state

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 68000a0d983f539c95ebe5dccd4f29535c7ac0af ]

Sysfs interface to update cooling device cur_state does not currently holding cooling device lock sometimes leading to stale values in cur_state if getting updated simultanelously from user space and thermal framework. Adding the proper locking code fixes this issue.

Signed-off-by Thara Gopinath <[email protected]>

Signed-off-by Zhang Rui <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/thermal/thermal_sysfs.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

drivers/thermal/thermal_sysfs.c +7 -4

index 2241ceae7d7f..aa99edb4dff7 100644
@@ -712,11 +712,14 @@ cur_state_store(struct device *dev, struct device_attribute *attr,
 	if ((long)state < 0)
 		return -EINVAL;
 
+	mutex_lock(&cdev->lock);
+
 	result = cdev->ops->set_cur_state(cdev, state);
-	if (result)
-		return result;
-	thermal_cooling_device_stats_update(cdev, state);
-	return count;
+	if (!result)
+		thermal_cooling_device_stats_update(cdev, state);
+
+	mutex_unlock(&cdev->lock);
+	return result ? result : count;
 }
 
 static struct device_attribute

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #110 lore raw

PATCH 96/352 s390/zcrypt: improve special ap message cmd handling

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit be534791011100d204602e2e0496e9e6ce8edf63 ]

There exist very few ap messages which need to have the 'special' flag enabled. This flag tells the firmware layer to do some pre- and maybe postprocessing. However, it may happen that this special flag is enabled but the firmware is unable to deal with this kind of message and thus returns with reply code 0x41. For example older firmware may not know the newest messages triggered by the zcrypt device driver and thus react with reject and the named reply code. Unfortunately this reply code is not known to the zcrypt error routines and thus default behavior is to switch the ap queue offline.

This patch now makes the ap error routine aware of the reply code and so userspace is informed about the bad processing result but the queue is not switched to offline state any more.

Signed-off-by Harald Freudenberger <[email protected]>

Signed-off-by Martin Schwidefsky <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/s390/include/uapi/asm/zcrypt.h | 4 ++--
 drivers/s390/crypto/zcrypt_error.h  | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

arch/s390/include/uapi/asm/zcrypt.h +2 -2

index 42c81a95e97b..494c34c50716 100644
@@ -150,8 +150,8 @@ struct ica_xcRB {
  * @cprb_len:		CPRB header length [0x0020]
  * @cprb_ver_id:	CPRB version id.   [0x04]
  * @pad_000:		Alignment pad bytes
- * @flags:		Admin cmd [0x80] or functional cmd [0x00]
- * @func_id:		Function id / subtype [0x5434]
+ * @flags:		Admin bit [0x80], Special bit [0x20]
+ * @func_id:		Function id / subtype [0x5434] "T4"
  * @source_id:		Source id [originator id]
  * @target_id:		Target id [usage/ctrl domain id]
  * @ret_code:		Return code

drivers/s390/crypto/zcrypt_error.h +2 -0

index 240b27f3f5f6..f34ee41cbed8 100644
@@ -51,6 +51,7 @@ struct error_hdr {
 #define REP82_ERROR_FORMAT_FIELD	    0x29
 #define REP82_ERROR_INVALID_COMMAND	    0x30
 #define REP82_ERROR_MALFORMED_MSG	    0x40
+#define REP82_ERROR_INVALID_SPECIAL_CMD	    0x41
 #define REP82_ERROR_INVALID_DOMAIN_PRECHECK 0x42
 #define REP82_ERROR_RESERVED_FIELDO	    0x50 /* old value	*/
 #define REP82_ERROR_WORD_ALIGNMENT	    0x60

@@ -89,6 +90,7 @@ static inline int convert_error(struct zcrypt_queue *zq,
 	case REP88_ERROR_MESSAGE_MALFORMD:
 	case REP82_ERROR_INVALID_DOMAIN_PRECHECK:
 	case REP82_ERROR_INVALID_DOMAIN_PENDING:
+	case REP82_ERROR_INVALID_SPECIAL_CMD:
 	//   REP88_ERROR_INVALID_KEY		// '82' CEX2A
 	//   REP88_ERROR_OPERAND		// '84' CEX2A
 	//   REP88_ERROR_OPERAND_EVEN_MOD	// '85' CEX2A

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #89 lore raw

PATCH 78/352 staging: pi433: fix potential null dereference

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 64c4c4ca6c129a4191e8e1e91b2d5d9b8d08c518 ]

Add a test for successful call to cdev_alloc() to avoid potential null dereference. Issue reported by smatch.

Signed-off-by Michael Straube <[email protected]>

Fixes 874bcba65f9a ("staging: pi433: New driver")

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/staging/pi433/pi433_if.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/staging/pi433/pi433_if.c +4 -0

index c85a805a1243..a497ec197872 100644
@@ -1255,6 +1255,10 @@ static int pi433_probe(struct spi_device *spi)
 
 	/* create cdev */
 	device->cdev = cdev_alloc();
+	if (!device->cdev) {
+		dev_dbg(device->dev, "allocation of cdev failed");
+		goto cdev_failed;
+	}
 	device->cdev->owner = THIS_MODULE;
 	cdev_init(device->cdev, &pi433_fops);
 	retval = cdev_add(device->cdev, device->devt, 1);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #111 lore raw

PATCH 97/352 mt76x0: dfs: fix IBI_R11 configuration on non-radar channels

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6bf4a8e902aad7df55d7f2b10b850cfa3f880996 ]

Fix IBI_R11 configuration on non-radar channels for mt76x0e driver. This patch improve system stability under heavy load. Moreover use IBI_R11 name and remove magic numbers for 0x212c register

Fixes 0c3b3abc9251 ("mt76x0: pci: add DFS support")

Signed-off-by Lorenzo Bianconi <[email protected]>

Signed-off-by Felix Fietkau <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/net/wireless/mediatek/mt76/mt76x2/pci_dfs.c +6 -2

index b56febae8945..764528c9f48a 100644
@@ -800,7 +800,7 @@ static void mt76x2_dfs_set_bbp_params(struct mt76x02_dev *dev)
 
 	/* enable detection*/
 	mt76_wr(dev, MT_BBP(DFS, 0), MT_DFS_CH_EN << 16);
-	mt76_wr(dev, 0x212c, 0x0c350001);
+	mt76_wr(dev, MT_BBP(IBI, 11), 0x0c350001);
 }
 
 void mt76x2_dfs_adjust_agc(struct mt76x02_dev *dev)

@@ -843,7 +843,11 @@ void mt76x2_dfs_init_params(struct mt76x02_dev *dev)
 		mt76_wr(dev, MT_BBP(DFS, 0), 0);
 		/* clear detector status */
 		mt76_wr(dev, MT_BBP(DFS, 1), 0xf);
-		mt76_wr(dev, 0x212c, 0);
+		if (mt76_chip(&dev->mt76) == 0x7610 ||
+		    mt76_chip(&dev->mt76) == 0x7630)
+			mt76_wr(dev, MT_BBP(IBI, 11), 0xfde8081);
+		else
+			mt76_wr(dev, MT_BBP(IBI, 11), 0);
 
 		mt76x02_irq_disable(dev, MT_INT_GPTIMER);
 		mt76_rmw_field(dev, MT_INT_TIMER_EN,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #114 lore raw

PATCH 100/352 ARM: dts: mmp2: fix TWSI2

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 1147e05ac9fc2ef86a3691e7ca5c2db7602d81dd ]

Marvell keeps their MMP2 datasheet secret, but there are good clues that TWSI2 is not on 0xd4025000 on that platform, not does it use IRQ 58. In fact, the IRQ 58 on MMP2 seems to be a signal processor:

arch/arm/mach-mmp/irqs.h:#define IRQ_MMP2_MSP 58

I'm taking a somewhat educated guess that is probably a copy & paste error from PXA168 or PXA910 and that the real controller in fact hides at address 0xd4031000 and uses an interrupt line multiplexed via IRQ 17.

I'm also copying some properties from TWSI1 that were missing or incorrect.

Tested on a OLPC XO 1.75 machine, where the RTC is on TWSI2.

Signed-off-by Lubomir Rintel <[email protected]>

Tested-by Pavel Machek <[email protected]>

Signed-off-by Olof Johansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/boot/dts/mmp2.dtsi | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

arch/arm/boot/dts/mmp2.dtsi +6 -3

index 766bbb8495b6..47e5b63339d1 100644
@@ -220,12 +220,15 @@
 				status = "disabled";
 			};
 
-			twsi2: i2c@d4025000 {
+			twsi2: i2c@d4031000 {
 				compatible = "mrvl,mmp-twsi";
-				reg = <0xd4025000 0x1000>;
-				interrupts = <58>;
+				reg = <0xd4031000 0x1000>;
+				interrupt-parent = <&intcmux17>;
+				interrupts = <0>;
 				clocks = <&soc_clocks MMP2_CLK_TWSI1>;
 				resets = <&soc_clocks MMP2_CLK_TWSI1>;
+				#address-cells = <1>;
+				#size-cells = <0>;
 				status = "disabled";
 			};

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #115 lore raw

PATCH 101/352 ARM: mmp/mmp2: dt: enable the clock

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit f36797ee43802b367e59f0f9a9805304a4ff0c98 ]

The device-tree booted MMP2 needs to enable the timer clock, otherwise it would stop ticking when the boot finishes.

It can also use the clock rate from the clk, the non-DT boards need to keep using the hardcoded rates.

Signed-off-by Lubomir Rintel <[email protected]>

Acked-by Pavel Machek <[email protected]>

Signed-off-by Olof Johansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/mach-mmp/common.h |  2 +-
 arch/arm/mach-mmp/mmp2.c   |  2 +-
 arch/arm/mach-mmp/pxa168.c |  2 +-
 arch/arm/mach-mmp/time.c   | 32 ++++++++++++++++++++------------
 4 files changed, 23 insertions(+), 15 deletions(-)

arch/arm/mach-mmp/common.h +1 -1

index 7e284d9c429f..5ac2851ef5d3 100644
@@ -2,7 +2,7 @@
 #include <linux/reboot.h>
 #define ARRAY_AND_SIZE(x)	(x), ARRAY_SIZE(x)
 
-extern void timer_init(int irq);
+extern void timer_init(int irq, unsigned long rate);
 
 extern void __init mmp_map_io(void);
 extern void mmp_restart(enum reboot_mode, const char *);

arch/arm/mach-mmp/mmp2.c +1 -1

index afba5460cdaf..fb3e7e32c882 100644
@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void)
 	clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1);
 	__raw_writel(clk_rst, APBC_TIMERS);
 
-	timer_init(IRQ_MMP2_TIMER1);
+	timer_init(IRQ_MMP2_TIMER1, 6500000);
 }
 
 /* on-chip devices */

arch/arm/mach-mmp/pxa168.c +1 -1

index 0f5f16fb8c66..77a358165a56 100644
@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void)
 	/* 3.25MHz, bus/functional clock enabled, release reset */
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA168_TIMER1);
+	timer_init(IRQ_PXA168_TIMER1, 6500000);
 }
 
 void pxa168_clear_keypad_wakeup(void)

arch/arm/mach-mmp/time.c +20 ~~-12~~

index 96ad1db0b04b..eab0fd8a7343 100644
@@ -22,6 +22,7 @@
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
 #include <linux/clockchips.h>
+#include <linux/clk.h>
 
 #include <linux/io.h>
 #include <linux/irq.h>

@@ -38,12 +39,6 @@
 #include "cputype.h"
 #include "clock.h"
 
-#ifdef CONFIG_CPU_MMP2
-#define MMP_CLOCK_FREQ		6500000
-#else
-#define MMP_CLOCK_FREQ		3250000
-#endif
-
 #define TIMERS_VIRT_BASE	TIMERS1_VIRT_BASE
 
 #define MAX_DELTA		(0xfffffffe)

@@ -189,19 +184,18 @@ static struct irqaction timer_irq = {
 	.dev_id		= &ckevt,
 };
 
-void __init timer_init(int irq)
+void __init timer_init(int irq, unsigned long rate)
 {
 	timer_config();
 
-	sched_clock_register(mmp_read_sched_clock, 32, MMP_CLOCK_FREQ);
+	sched_clock_register(mmp_read_sched_clock, 32, rate);
 
 	ckevt.cpumask = cpumask_of(0);
 
 	setup_irq(irq, &timer_irq);
 
-	clocksource_register_hz(&cksrc, MMP_CLOCK_FREQ);
-	clockevents_config_and_register(&ckevt, MMP_CLOCK_FREQ,
-					MIN_DELTA, MAX_DELTA);
+	clocksource_register_hz(&cksrc, rate);
+	clockevents_config_and_register(&ckevt, rate, MIN_DELTA, MAX_DELTA);
 }
 
 #ifdef CONFIG_OF

@@ -213,7 +207,9 @@ static const struct of_device_id mmp_timer_dt_ids[] = {
 void __init mmp_dt_init_timer(void)
 {
 	struct device_node *np;
+	struct clk *clk;
 	int irq, ret;
+	unsigned long rate;
 
 	np = of_find_matching_node(NULL, mmp_timer_dt_ids);
 	if (!np) {

@@ -221,6 +217,18 @@ void __init mmp_dt_init_timer(void)
 		goto out;
 	}
 
+	clk = of_clk_get(np, 0);
+	if (!IS_ERR(clk)) {
+		ret = clk_prepare_enable(clk);
+		if (ret)
+			goto out;
+		rate = clk_get_rate(clk) / 2;
+	} else if (cpu_is_pj4()) {
+		rate = 6500000;
+	} else {
+		rate = 3250000;
+	}
+
 	irq = irq_of_parse_and_map(np, 0);
 	if (!irq) {
 		ret = -EINVAL;

@@ -231,7 +239,7 @@ void __init mmp_dt_init_timer(void)
 		ret = -ENOMEM;
 		goto out;
 	}
-	timer_init(irq);
+	timer_init(irq, rate);
 	return;
 out:
 	pr_err("Failed to get timer from device tree with error:%d\n", ret);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #119 lore raw

PATCH 105/352 media: i2c: TDA1997x: select CONFIG_HDMI

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 79e89e36dc8a47ef965a35b484d737a5227feed1 ]

Without CONFIG_HDMI, we get a link error for this driver:

drivers/media/i2c/tda1997x.o: In function `tda1997x_parse_infoframe':
tda1997x.c:(.text+0x2195): undefined reference to hdmi_infoframe_unpack' tda1997x.c:(.text+0x21b6): undefined reference to hdmi_infoframe_log' drivers/media/i2c/tda1997x.o: In function `tda1997x_log_infoframe':
tda1997x.c:(.text.unlikely+0x13d3): undefined reference to hdmi_infoframe_unpack' tda1997x.c:(.text.unlikely+0x1426): undefined reference to hdmi_infoframe_log'

All other drivers in this directory that use HDMI select CONFIG_HDMI, so do the same here:

Fixes 9ac0038db9a7 ("media: i2c: Add TDA1997x HDMI receiver driver")

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Hans Verkuil <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/i2c/Kconfig | 1 +
 1 file changed, 1 insertion(+)

drivers/media/i2c/Kconfig +1 -0

index 704af210e270..f4714bd6fef0 100644
@@ -61,6 +61,7 @@ config VIDEO_TDA1997X
 	depends on VIDEO_V4L2 && I2C && VIDEO_V4L2_SUBDEV_API
 	depends on SND_SOC
 	select SND_PCM
+	select HDMI
 	---help---
 	  V4L2 subdevice driver for the NXP TDA1997x HDMI receivers.

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #90 lore raw

PATCH 79/352 f2fs: avoid GC causing encrypted file corrupted

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 9bf1a3f73927492c8be127b642197125e9d52be8 ]

The encrypted file may be corrupted by GC in following case:

Time 1: | segment 1 blkaddr = A | GC -> | segment 2 blkaddr = B | Encrypted block 1 is moved from blkaddr A of segment 1 to blkaddr B of segment 2,

Time 2: | segment 1 blkaddr = B | GC -> | segment 3 blkaddr = C |

Before page 1 is written back and if segment 2 become a victim, then page 1 is moved from blkaddr B of segment 2 to blkaddr Cof segment 3, during the GC process of Time 2, f2fs should wait for page 1 written back before reading it, or move_data_block will read a garbage block from blkaddr B since page is not written back to blkaddr B yet.

Commit 6aa58d8a ("f2fs: readahead encrypted block during GC") introduce ra_data_block to read encrypted block, but it forgets to add f2fs_wait_on_page_writeback to avoid racing between GC and flush.

Signed-off-by Yunlong Song <[email protected]>

Reviewed-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/f2fs/gc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

fs/f2fs/gc.c +10 -0

index a07241fb8537..c96e7c6354ef 100644
@@ -658,6 +658,14 @@ got_it:
 	fio.page = page;
 	fio.new_blkaddr = fio.old_blkaddr = dn.data_blkaddr;
 
+	/*
+	 * don't cache encrypted data into meta inode until previous dirty
+	 * data were writebacked to avoid racing between GC and flush.
+	 */
+	f2fs_wait_on_page_writeback(page, DATA, true);
+
+	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
 	fio.encrypted_page = f2fs_pagecache_get_page(META_MAPPING(sbi),
 					dn.data_blkaddr,
 					FGP_LOCK | FGP_CREAT, GFP_NOFS);

@@ -745,6 +753,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
 	 */
 	f2fs_wait_on_page_writeback(page, DATA, true);
 
+	f2fs_wait_on_block_writeback(inode, dn.data_blkaddr);
+
 	err = f2fs_get_node_info(fio.sbi, dn.nid, &ni);
 	if (err)
 		goto put_out;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:25 UTC #92 lore raw

PATCH 81/352 f2fs: avoid build warn of fall_through

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit f5d5510e7389fa264337fb524346bac9eb93adc8 ]

After merging the f2fs tree, today's linux-next build
(x86_64_allmodconfig) produced this warning:

In file included from fs/f2fs/dir.c:11:
fs/f2fs/f2fs.h: In function '__mark_inode_dirty_flag':
fs/f2fs/f2fs.h:2388:6: warning: this statement may fall through [-Wimplicit-fallthrough=]

    if (set)
       ^

fs/f2fs/f2fs.h:2390:2: note: here
case FI_DATA_EXIST:
^~~~

Exposed by my use of -Wimplicit-fallthrough

Reported-by Stephen Rothwell <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/f2fs/f2fs.h | 1 +
 1 file changed, 1 insertion(+)

fs/f2fs/f2fs.h +1 -0

index 1e031971a466..ebad864c031c 100644
@@ -2370,6 +2370,7 @@ static inline void __mark_inode_dirty_flag(struct inode *inode,
 	case FI_NEW_INODE:
 		if (set)
 			return;
+		/* fall through */
 	case FI_DATA_EXIST:
 	case FI_INLINE_DOTS:
 	case FI_PIN_FILE:

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #98 lore raw

PATCH 84/352 i2c: sh_mobile: add support for r8a77990 (R-Car E3)

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 5eb316e636eb298c204f5b368526d4480b63c0ba ]

Add support for the IIC code for the r8a77990 (R-Car E3).

It is not considered compatible with existing fallback bindings due to the documented absence of automatic transmission registers.

These registers are currently not used by the driver and thus the provides the same behaviour for "renesas,iic-r8a77990" and "renesas,rcar-gen3-iic". The point of declaring incompatibility is to allow for automatic transmission register support to be added to "renesas,iic-r8a77990" and "renesas,rcar-gen3-iic" in future.

Signed-off-by Simon Horman <[email protected]>

Reviewed-by Geert Uytterhoeven <[email protected]>

Signed-off-by Wolfram Sang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/i2c/busses/i2c-sh_mobile.c | 1 +
 1 file changed, 1 insertion(+)

drivers/i2c/busses/i2c-sh_mobile.c +1 -0

index a7a7a9c3bc7c..28db6b59c4ca 100644
@@ -808,6 +808,7 @@ static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
 	{ .compatible = "renesas,rcar-gen2-iic", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7795", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,rcar-gen3-iic", .data = &fast_clock_dt_config },
+	{ .compatible = "renesas,iic-r8a77990", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-sh73a0", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,rmobile-iic", .data = &default_dt_config },
 	{},

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #99 lore raw

PATCH 85/352 arm64: io: Ensure calls to delay routines are ordered against prior readX()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6460d32014717686d3b7963595950ba2c6d1bb5e ]

A relatively standard idiom for ensuring that a pair of MMIO writes to a device arrive at that device with a specified minimum delay between them is as follows:

	writel_relaxed(42, dev_base + CTL1);
	readl(dev_base + CTL1);
	udelay(10);
	writel_relaxed(42, dev_base + CTL2);

the intention being that the read-back from the device will push the prior write to CTL1, and the udelay will hold up the write to CTL1 until at least 10us have elapsed.

Unfortunately, on arm64 where the underlying delay loop is implemented as a read of the architected counter, the CPU does not guarantee ordering from the readl() to the delay loop and therefore the delay loop could in theory be speculated and not provide the desired interval between the two writes.

Fix this in a similar manner to PowerPC by introducing a dummy control dependency on the output of readX() which, combined with the ISB in the read of the architected counter, guarantees that a subsequent delay loop can not be executed until the readX() has returned its result.

Cc Benjamin Herrenschmidt <[email protected]>

Cc Arnd Bergmann <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm64/include/asm/io.h | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

arch/arm64/include/asm/io.h +23 -8

index 9f8b915af3a7..d42d00d8d5b6 100644
@@ -104,7 +104,22 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
 }
 
 /* IO barriers */
-#define __iormb()		rmb()
+#define __iormb(v)							\
+({									\
+	unsigned long tmp;						\
+									\
+	rmb();								\
+									\
+	/*								\
+	 * Create a dummy control dependency from the IO read to any	\
+	 * later instructions. This ensures that a subsequent call to	\
+	 * udelay() will be ordered due to the ISB in get_cycles().	\
+	 */								\
+	asm volatile("eor	%0, %1, %1\n"				\
+		     "cbnz	%0, ."					\
+		     : "=r" (tmp) : "r" (v) : "memory");		\
+})
+
 #define __iowmb()		wmb()
 
 #define mmiowb()		do { } while (0)

@@ -129,10 +144,10 @@ static inline u64 __raw_readq(const volatile void __iomem *addr)
  * following Normal memory access. Writes are ordered relative to any prior
  * Normal memory access.
  */
-#define readb(c)		({ u8  __v = readb_relaxed(c); __iormb(); __v; })
-#define readw(c)		({ u16 __v = readw_relaxed(c); __iormb(); __v; })
-#define readl(c)		({ u32 __v = readl_relaxed(c); __iormb(); __v; })
-#define readq(c)		({ u64 __v = readq_relaxed(c); __iormb(); __v; })
+#define readb(c)		({ u8  __v = readb_relaxed(c); __iormb(__v); __v; })
+#define readw(c)		({ u16 __v = readw_relaxed(c); __iormb(__v); __v; })
+#define readl(c)		({ u32 __v = readl_relaxed(c); __iormb(__v); __v; })
+#define readq(c)		({ u64 __v = readq_relaxed(c); __iormb(__v); __v; })
 
 #define writeb(v,c)		({ __iowmb(); writeb_relaxed((v),(c)); })
 #define writew(v,c)		({ __iowmb(); writew_relaxed((v),(c)); })

@@ -183,9 +198,9 @@ extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size);
 /*
  * io{read,write}{16,32,64}be() macros
  */
-#define ioread16be(p)		({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(); __v; })
-#define ioread32be(p)		({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(); __v; })
-#define ioread64be(p)		({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(); __v; })
+#define ioread16be(p)		({ __u16 __v = be16_to_cpu((__force __be16)__raw_readw(p)); __iormb(__v); __v; })
+#define ioread32be(p)		({ __u32 __v = be32_to_cpu((__force __be32)__raw_readl(p)); __iormb(__v); __v; })
+#define ioread64be(p)		({ __u64 __v = be64_to_cpu((__force __be64)__raw_readq(p)); __iormb(__v); __v; })
 
 #define iowrite16be(v,p)	({ __iowmb(); __raw_writew((__force __u16)cpu_to_be16(v), p); })
 #define iowrite32be(v,p)	({ __iowmb(); __raw_writel((__force __u32)cpu_to_be32(v), p); })

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #87 lore raw

PATCH 76/352 media: adv*/tc358743/ths8200: fill in min width/height/pixelclock

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 2912289a518077ddb8214e05336700148e97e235 ]

The v4l2_dv_timings_cap struct is used to do sanity checks when setting and enumerating DV timings, ensuring that only valid timings as per the HW capabilities are allowed.

However, many drivers just filled in 0 for the minimum width, height or pixelclock frequency. This can cause timings with e.g. 0 as width and height to be accepted, which will in turn lead to a potential division by zero.

Fill in proper values are minimum boundaries. 640x350 was chosen since it is the smallest resolution in v4l2-dv-timings.h. Same for 13 MHz as the lowest pixelclock frequency (it's slightly below the minimum of 13.5 MHz in the v4l2-dv-timings.h header).

Signed-off-by Hans Verkuil <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/i2c/ad9389b.c  | 2 +-
 drivers/media/i2c/adv7511.c  | 2 +-
 drivers/media/i2c/adv7604.c  | 4 ++--
 drivers/media/i2c/adv7842.c  | 4 ++--
 drivers/media/i2c/tc358743.c | 2 +-
 drivers/media/i2c/ths8200.c  | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

drivers/media/i2c/ad9389b.c +1 -1

index 5b008b0002c0..aa8b04cfed0f 100644
@@ -578,7 +578,7 @@ static const struct v4l2_dv_timings_cap ad9389b_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |

drivers/media/i2c/adv7511.c +1 -1

index f3899cc84e27..88349b5053cc 100644
@@ -130,7 +130,7 @@ static const struct v4l2_dv_timings_cap adv7511_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, ADV7511_MAX_WIDTH, 0, ADV7511_MAX_HEIGHT,
+	V4L2_INIT_BT_TIMINGS(640, ADV7511_MAX_WIDTH, 350, ADV7511_MAX_HEIGHT,
 		ADV7511_MIN_PIXELCLOCK, ADV7511_MAX_PIXELCLOCK,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,

drivers/media/i2c/adv7604.c +2 -2

index 9eb7c70a7712..ff28f5692986 100644
@@ -766,7 +766,7 @@ static const struct v4l2_dv_timings_cap adv7604_timings_cap_analog = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |

@@ -777,7 +777,7 @@ static const struct v4l2_dv_timings_cap adv76xx_timings_cap_digital = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |

drivers/media/i2c/adv7842.c +2 -2

index 4721d49dcf0f..5305c3ad80e6 100644
@@ -663,7 +663,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_analog = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 170000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 170000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |

@@ -674,7 +674,7 @@ static const struct v4l2_dv_timings_cap adv7842_timings_cap_digital = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1200, 25000000, 225000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 25000000, 225000000,
 		V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 		V4L2_DV_BT_CAP_PROGRESSIVE | V4L2_DV_BT_CAP_REDUCED_BLANKING |

drivers/media/i2c/tc358743.c +1 -1

index 41d470d9ca94..00dc930e049f 100644
@@ -59,7 +59,7 @@ static const struct v4l2_dv_timings_cap tc358743_timings_cap = {
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
 	/* Pixel clock from REF_01 p. 20. Min/max height/width are unknown */
-	V4L2_INIT_BT_TIMINGS(1, 10000, 1, 10000, 0, 165000000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1200, 13000000, 165000000,
 			V4L2_DV_BT_STD_CEA861 | V4L2_DV_BT_STD_DMT |
 			V4L2_DV_BT_STD_GTF | V4L2_DV_BT_STD_CVT,
 			V4L2_DV_BT_CAP_PROGRESSIVE |

drivers/media/i2c/ths8200.c +1 -1

index 498ad2368cbc..f5ee28058ea2 100644
@@ -49,7 +49,7 @@ static const struct v4l2_dv_timings_cap ths8200_timings_cap = {
 	.type = V4L2_DV_BT_656_1120,
 	/* keep this initialization for compatibility with GCC < 4.4.6 */
 	.reserved = { 0 },
-	V4L2_INIT_BT_TIMINGS(0, 1920, 0, 1080, 25000000, 148500000,
+	V4L2_INIT_BT_TIMINGS(640, 1920, 350, 1080, 25000000, 148500000,
 		V4L2_DV_BT_STD_CEA861, V4L2_DV_BT_CAP_PROGRESSIVE)
 };

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #124 lore raw

PATCH 110/352 usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b7a4fbe2300a8965ea760c7e871507b84aea17f6 ]

Availability of TRB's is calculated using dwc3_calc_trbs_left(), which determines total available TRB's based on the HWO bit set in a TRB.

In the present code, __dwc3_prepare_one_trb() is called with a TRB which needs to be prepared for transfer. This __dwc3_prepare_one_trb() calls dwc3_calc_trbs_left() to determine total available TRBs and set IOC bit if the total available TRBs are zero. Since the present working TRB (which is passed as an argument to __dwc3_prepare_one_trb() ) doesn't yet have the HWO bit set before calling dwc3_calc_trbs_left(), there are chances that dwc3_calc_trbs_left() wrongly calculates this present working TRB as free(since the HWO bit is not yet set) and returns the total available TRBs as greater than zero (including the present working TRB). This could be a problem.

This patch corrects the above mentioned problem in __dwc3_prepare_one_trb() by increementing the dep->trb_enqueue at the last (after preparing the TRB) instead of increementing at the start and setting the IOC bit only if the total available TRBs returned by dwc3_calc_trbs_left() is 1 . Since we are increementing the dep->trb_enqueue at the last, the present working TRB is also considered as available by dwc3_calc_trbs_left() and non zero value is returned . So, according to the modified logic, when the total available TRBs is equal to 1 that means the total available TRBs in the pool are 0.

Signed-off-by Anurag Kumar Vulisha <[email protected]>

Reviewed-by Thinh Nguyen <[email protected]>

Tested-by Tejas Joglekar <[email protected]>

Signed-off-by Felipe Balbi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/dwc3/gadget.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/usb/dwc3/gadget.c +3 -3

index 2a4ea9a1b1e3..88f69d823be5 100644
@@ -921,8 +921,6 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 	struct usb_gadget	*gadget = &dwc->gadget;
 	enum usb_device_speed	speed = gadget->speed;
 
-	dwc3_ep_inc_enq(dep);
-
 	trb->size = DWC3_TRB_SIZE_LENGTH(length);
 	trb->bpl = lower_32_bits(dma);
 	trb->bph = upper_32_bits(dma);

@@ -1001,7 +999,7 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 	}
 
 	if ((!no_interrupt && !chain) ||
-			(dwc3_calc_trbs_left(dep) == 0))
+			(dwc3_calc_trbs_left(dep) == 1))
 		trb->ctrl |= DWC3_TRB_CTRL_IOC;
 
 	if (chain)

@@ -1012,6 +1010,8 @@ static void __dwc3_prepare_one_trb(struct dwc3_ep *dep, struct dwc3_trb *trb,
 
 	trb->ctrl |= DWC3_TRB_CTRL_HWO;
 
+	dwc3_ep_inc_enq(dep);
+
 	trace_dwc3_prepare_trb(dep, trb);
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #133 lore raw

PATCH 119/352 pinctrl: nuvoton: check for devm_kasprintf() failure

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4be1eaf322f07bb9694618fd2763a3a1f0a3dd25 ]

devm_kasprintf() may return NULL on failure of internal allocation thus the assignment to .label is not safe if not checked. On error npcm7xx_gpio_of() returns negative values so -ENOMEM in the (unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by Nicholas Mc Guire <[email protected]>

Fixes 3b588e43ee5c ("pinctrl: nuvoton: add NPCM7xx pinctrl and GPIO driver")

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +3 -0

index 7ad50d9268aa..3bda620d18bb 100644
@@ -1932,6 +1932,9 @@ static int npcm7xx_gpio_of(struct npcm7xx_pinctrl *pctrl)
 			pctrl->gpio_bank[id].gc.label =
 				devm_kasprintf(pctrl->dev, GFP_KERNEL, "%pOF",
 					       np);
+			if (pctrl->gpio_bank[id].gc.label == NULL)
+				return -ENOMEM;
+
 			pctrl->gpio_bank[id].gc.dbg_show = npcmgpio_dbg_show;
 			pctrl->gpio_bank[id].direction_input =
 				pctrl->gpio_bank[id].gc.direction_input;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #136 lore raw

PATCH 122/352 arm64: dts: rockchip: fix rk3399-rockpro64 regulator gpios

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 690e16bada6029694740d5501025faf483d14339 ]

Rockpro64 is not able boot if GPIO1_C1 pin is pulled high before loading linux kernel.

In rockpro64 GPIO1_C1 pin is connected vdd_cpu_b regulator VSEL pin. Pin should be pulled down in normal operation and pulled high in suspend.

PMIC LDO_REG2 is connected to touch panel connector. Rename regulator and set it to correct voltage.

PCIe power is controller by GPIO1_D0.

Schematics can be downloaded from:
http://files.pine64.org/doc/rockpro64/rockpro64_v21-SCH.pdf

Signed-off-by Oskari Lemmela <[email protected]>

Acked-by Akash Gajjar <[email protected]>

Signed-off-by Heiko Stuebner <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 .../boot/dts/rockchip/rk3399-rockpro64.dts    | 20 +++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

arch/arm64/boot/dts/rockchip/rk3399-rockpro64.dts +12 -8

index 1d35f5406b5e..5bd4d69914bd 100644
@@ -97,7 +97,7 @@
 	vcc3v3_pcie: vcc3v3-pcie-regulator {
 		compatible = "regulator-fixed";
 		enable-active-high;
-		gpio = <&gpio1 RK_PC1 GPIO_ACTIVE_HIGH>;
+		gpio = <&gpio1 RK_PD0 GPIO_ACTIVE_HIGH>;
 		pinctrl-names = "default";
 		pinctrl-0 = <&pcie_pwr_en>;
 		regulator-name = "vcc3v3_pcie";

@@ -293,12 +293,12 @@
 				};
 			};
 
-			vcc2v8_dvp: LDO_REG2 {
-				regulator-name = "vcc2v8_dvp";
+			vcc3v0_touch: LDO_REG2 {
+				regulator-name = "vcc3v0_touch";
 				regulator-always-on;
 				regulator-boot-on;
-				regulator-min-microvolt = <2800000>;
-				regulator-max-microvolt = <2800000>;
+				regulator-min-microvolt = <3000000>;
+				regulator-max-microvolt = <3000000>;
 				regulator-state-mem {
 					regulator-off-in-suspend;
 				};

@@ -397,7 +397,9 @@
 	vdd_cpu_b: regulator@40 {
 		compatible = "silergy,syr827";
 		reg = <0x40>;
-		fcs,suspend-voltage-selector = <0>;
+		fcs,suspend-voltage-selector = <1>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&vsel1_gpio>;
 		regulator-name = "vdd_cpu_b";
 		regulator-min-microvolt = <712500>;
 		regulator-max-microvolt = <1500000>;

@@ -415,6 +417,8 @@
 		compatible = "silergy,syr828";
 		reg = <0x41>;
 		fcs,suspend-voltage-selector = <1>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&vsel2_gpio>;
 		regulator-name = "vdd_gpu";
 		regulator-min-microvolt = <712500>;
 		regulator-max-microvolt = <1500000>;

@@ -519,7 +523,7 @@
 
 	pcie {
 		pcie_pwr_en: pcie-pwr-en {
-			rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_none>;
+			rockchip,pins = <1 RK_PD0 RK_FUNC_GPIO &pcfg_pull_none>;
 		};
 	};

@@ -529,7 +533,7 @@
 		};
 
 		vsel1_gpio: vsel1-gpio {
-			rockchip,pins = <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_down>;
+			rockchip,pins = <1 RK_PC1 RK_FUNC_GPIO &pcfg_pull_down>;
 		};
 
 		vsel2_gpio: vsel2-gpio {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #137 lore raw

PATCH 123/352 driver core: Move async_synchronize_full call

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c37d721c68ad88925ba0e72f6e14acb829a8c6bb ]

Move the async_synchronize_full call out of __device_release_driver and into driver_detach.

The idea behind this is that the async_synchronize_full call will only guarantee that any existing async operations are flushed. This doesn't do anything to guarantee that a hotplug event that may occur while we are doing the release of the driver will not be asynchronously scheduled.

By moving this into the driver_detach path we can avoid potential deadlocks as we aren't holding the device lock at this point and we should not have the driver we want to flush loaded so the flush will take care of any asynchronous events the driver we are detaching might have scheduled.

Fixes 765230b5f084 ("driver-core: add asynchronous probing support for drivers")

Reviewed-by Bart Van Assche <[email protected]>

Reviewed-by Dan Williams <[email protected]>

Signed-off-by Alexander Duyck <[email protected]>

Reviewed-by Luis Chamberlain <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/base/dd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/base/dd.c +3 -3

index dbba123e058d..9d6604b50d75 100644
@@ -928,9 +928,6 @@ static void __device_release_driver(struct device *dev, struct device *parent)
 
 	drv = dev->driver;
 	if (drv) {
-		if (driver_allows_async_probing(drv))
-			async_synchronize_full();
-
 		while (device_links_busy(dev)) {
 			device_unlock(dev);
 			if (parent && dev->bus->need_parent_lock)

@@ -1036,6 +1033,9 @@ void driver_detach(struct device_driver *drv)
 	struct device_private *dev_prv;
 	struct device *dev;
 
+	if (driver_allows_async_probing(drv))
+		async_synchronize_full();
+
 	for (;;) {
 		spin_lock(&drv->p->klist_devices.k_lock);
 		if (list_empty(&drv->p->klist_devices.k_list)) {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #140 lore raw

PATCH 126/352 usb: dwc3: trace: add missing break statement to make compiler happy

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 54d48183d21e03f780053d7129312049cb5dd591 ]

The missed break statement in the outer switch makes the code fall through always and thus always same value will be printed.

Besides that, compiler warns about missed fall through marker:

drivers/usb/dwc3/./trace.h: In function ‘trace_raw_output_dwc3_log_trb’:
drivers/usb/dwc3/./trace.h:246:4: warning: this statement may fall through [-Wimplicit-fallthrough=]

    switch (pcm) {
    ^~~~~~

Add the missing break statement to work correctly without compilation warnings.

Fixes fa8d965d736b ("usb: dwc3: trace: pretty print high-bandwidth transfers too")

Cc Felipe Balbi <[email protected]>

Signed-off-by Andy Shevchenko <[email protected]>

Signed-off-by Felipe Balbi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/dwc3/trace.h | 2 ++
 1 file changed, 2 insertions(+)

drivers/usb/dwc3/trace.h +2 -0

index f22714cce070..f27c5cbe285c 100644
@@ -251,9 +251,11 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
 				s = "2x ";
 				break;
 			case 3:
+			default:
 				s = "3x ";
 				break;
 			}
+			break;
 		default:
 			s = "";
 		} s; }),

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #141 lore raw

PATCH 127/352 gpio: mt7621: report failure of devm_kasprintf()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 59d646c775d6ae688ee90fda9f2a4270c47b7490 ]

kasprintf() may return NULL on failure of internal allocation thus the assigned label is not safe if not explicitly checked. On error mediatek_gpio_bank_probe() returns negative values so -ENOMEM in the (unlikely) failure case should be fine here.

Fixes 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621")

Signed-off-by Nicholas Mc Guire <[email protected]>

Reviewed-by Bartosz Golaszewski <[email protected]>

Acked-by Sean Wang <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpio/gpio-mt7621.c | 2 ++
 1 file changed, 2 insertions(+)

drivers/gpio/gpio-mt7621.c +2 -0

index d72af6f6cdbd..1ec95bc18f5b 100644
@@ -244,6 +244,8 @@ mediatek_gpio_bank_probe(struct device *dev,
 	rg->chip.of_xlate = mediatek_gpio_xlate;
 	rg->chip.label = devm_kasprintf(dev, GFP_KERNEL, "%s-bank%d",
 					dev_name(dev), bank);
+	if (!rg->chip.label)
+		return -ENOMEM;
 
 	ret = devm_gpiochip_add_data(dev, &rg->chip, mtk);
 	if (ret < 0) {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #142 lore raw

PATCH 128/352 gpio: mt7621: pass mediatek_gpio_bank_probe() failure up the stack

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a109c2dbb571b10bb9969285b646f57309c98251 ]

The error cases of mediatek_gpio_bank_probe() would go unnoticed (except for the dev_err() messages). The probe function should return an error if one of the banks failed to initialize properly indicated by not returning non-0.

Fixes 4ba9c3afda41 ("gpio: mt7621: Add a driver for MT7621")

Signed-off-by Nicholas Mc Guire <[email protected]>

Acked-by Sean Wang <[email protected]>

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpio/gpio-mt7621.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

drivers/gpio/gpio-mt7621.c +6 -2

index 1ec95bc18f5b..00e954f22bc9 100644
@@ -297,6 +297,7 @@ mediatek_gpio_probe(struct platform_device *pdev)
 	struct device_node *np = dev->of_node;
 	struct mtk *mtk;
 	int i;
+	int ret;
 
 	mtk = devm_kzalloc(dev, sizeof(*mtk), GFP_KERNEL);
 	if (!mtk)

@@ -311,8 +312,11 @@ mediatek_gpio_probe(struct platform_device *pdev)
 	platform_set_drvdata(pdev, mtk);
 	mediatek_gpio_irq_chip.name = dev_name(dev);
 
-	for (i = 0; i < MTK_BANK_CNT; i++)
-		mediatek_gpio_bank_probe(dev, np, i);
+	for (i = 0; i < MTK_BANK_CNT; i++) {
+		ret = mediatek_gpio_bank_probe(dev, np, i);
+		if (ret)
+			return ret;
+	}
 
 	return 0;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #143 lore raw

PATCH 129/352 pinctrl: sx150x: handle failure case of devm_kstrdup

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a9d9f6b83f1bb05da849b3540e6d1f70ef1c2343 ]

devm_kstrdup() may return NULL if internal allocation failed. Thus using label, name is unsafe without checking. Therefor in the unlikely case of allocation failure, sx150x_probe() simply returns -ENOMEM.

Signed-off-by Nicholas Mc Guire <[email protected]>

Fixes 9e80f9064e73 ("pinctrl: Add SX150X GPIO Extender Pinctrl Driver")

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/pinctrl/pinctrl-sx150x.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

drivers/pinctrl/pinctrl-sx150x.c +8 -3

index cbf58a10113d..4d87d75b9c6e 100644
@@ -1166,7 +1166,6 @@ static int sx150x_probe(struct i2c_client *client,
 	}
 
 	/* Register GPIO controller */
-	pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
 	pctl->gpio.base = -1;
 	pctl->gpio.ngpio = pctl->data->npins;
 	pctl->gpio.get_direction = sx150x_gpio_get_direction;

@@ -1180,6 +1179,10 @@ static int sx150x_probe(struct i2c_client *client,
 	pctl->gpio.of_node = dev->of_node;
 #endif
 	pctl->gpio.can_sleep = true;
+	pctl->gpio.label = devm_kstrdup(dev, client->name, GFP_KERNEL);
+	if (!pctl->gpio.label)
+		return -ENOMEM;
+
 	/*
 	 * Setting multiple pins is not safe when all pins are not
 	 * handled by the same regmap register. The oscio pin (present

@@ -1200,13 +1203,15 @@ static int sx150x_probe(struct i2c_client *client,
 
 	/* Add Interrupt support if an irq is specified */
 	if (client->irq > 0) {
-		pctl->irq_chip.name = devm_kstrdup(dev, client->name,
-						   GFP_KERNEL);
 		pctl->irq_chip.irq_mask = sx150x_irq_mask;
 		pctl->irq_chip.irq_unmask = sx150x_irq_unmask;
 		pctl->irq_chip.irq_set_type = sx150x_irq_set_type;
 		pctl->irq_chip.irq_bus_lock = sx150x_irq_bus_lock;
 		pctl->irq_chip.irq_bus_sync_unlock = sx150x_irq_bus_sync_unlock;
+		pctl->irq_chip.name = devm_kstrdup(dev, client->name,
+						   GFP_KERNEL);
+		if (!pctl->irq_chip.name)
+			return -ENOMEM;
 
 		pctl->irq.masked = ~0;
 		pctl->irq.sense = 0;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #144 lore raw

PATCH 130/352 iommu/amd: Fix amd_iommu=force_isolation

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c12b08ebbe16f0d3a96a116d86709b04c1ee8e74 ]

The parameter is still there but it's ignored. We need to check its value before deciding to go into passthrough mode for AMD IOMMU v2 capable device.

We occasionally use this parameter to force v2 capable device into translation mode to debug memory corruption that we suspect is caused by DMA writes.

To address the following comment from Joerg Roedel on the first version, v2 capability of device is completely ignored.

Quoted 2 lines

This breaks the iommu_v2 use-case, as it needs a direct mapping for the devices that support it.

And from Documentation/admin-guide/kernel-parameters.txt:
This option does not override iommu=pt

Fixes aafd8ba0ca74 ("iommu/amd: Implement add_device and remove_device")

Signed-off-by Yu Zhao <[email protected]>

Signed-off-by Joerg Roedel <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/iommu/amd_iommu.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

drivers/iommu/amd_iommu.c +8 -1

index 1167ff0416cf..325f3bad118b 100644
@@ -438,7 +438,14 @@ static int iommu_init_device(struct device *dev)
 
 	dev_data->alias = get_alias(dev);
 
-	if (dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
+	/*
+	 * By default we use passthrough mode for IOMMUv2 capable device.
+	 * But if amd_iommu=force_isolation is set (e.g. to debug DMA to
+	 * invalid address), we ignore the capability for the device so
+	 * it'll be forced to go into translation mode.
+	 */
+	if ((iommu_pass_through || !amd_iommu_force_isolation) &&
+	    dev_is_pci(dev) && pci_iommuv2_capable(to_pci_dev(dev))) {
 		struct amd_iommu *iommu;
 
 		iommu = amd_iommu_rlookup_table[dev_data->devid];

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:26 UTC #145 lore raw

PATCH 131/352 media: v4l2-device: Link subdevices to their parent devices if available

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ee494cf377e142f65f202fadf0d859f8e12119fb ]

Currently v4l2_device_register_subdev_nodes() does not initialize the dev_parent field of the video_device structs it creates for subdevices being registered. This leads to __video_register_device() falling back to the parent device of associated v4l2_device struct, which often does not match the physical device the subdevice is registered for.

Due to the problem above, the links between real devices and v4l-subdev nodes cannot be obtained from sysfs, which might be confusing for the userspace trying to identify the hardware.

Fix this by initializing the dev_parent field of the video_device struct with the value of dev field of the v4l2_subdev struct. In case of subdevices without a parent struct device, the field will be NULL and the old behavior will be preserved by the semantics of __video_register_device().

Signed-off-by Tomasz Figa <[email protected]>

Acked-by Sakari Ailus <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/v4l2-core/v4l2-device.c | 1 +
 1 file changed, 1 insertion(+)

drivers/media/v4l2-core/v4l2-device.c +1 -0

index df0ac38c4050..e0ddb9a52bd1 100644
@@ -247,6 +247,7 @@ int v4l2_device_register_subdev_nodes(struct v4l2_device *v4l2_dev)
 
 		video_set_drvdata(vdev, sd);
 		strscpy(vdev->name, sd->name, sizeof(vdev->name));
+		vdev->dev_parent = sd->dev;
 		vdev->v4l2_dev = v4l2_dev;
 		vdev->fops = &v4l2_subdev_fops;
 		vdev->release = v4l2_device_release_subdev_node;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #146 lore raw

PATCH 132/352 ARM: OMAP1: ams-delta: Fix audio permanently muted

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 2afdb4c41d7876e430b9bc6e2d7e2fe28609fd6a ]

Since commit 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused GPIOs"), on-board audio has appeared muted. Believed to be unused GPIO pin "hookflash1", apparently set high regardless of the corresponding bit of "latch2" port attempted to be set low during .init_machine(), has been identified as the reason.

According to Amstrad E3 wiki, the purpose of the pin hasn't been clearly identified. Original Amstrad software used to produce a high pulse on it when the phone was taken off hook or recall was pressed. With the current finding, we can assume the pin provides a kind of audio mute function.

Proper resolution of the issue should be done in two steps:
- resolution of an issue with the pin state not reflecting the value the corresponding bit of the port was attempted to be initialized with,
- extension of on-board audio driver with a new control.

For now, rename the pin to "audio_mute" to reflect its function and, as a quick fix, hogg it as output low so on-board audio can produce audible sound again.

Fixes 1137ceee76ba ("ARM: OMAP1: ams-delta: Don't request unused GPIOs")

Signed-off-by Janusz Krzysztofik <[email protected]>

Signed-off-by Tony Lindgren <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/mach-omap1/board-ams-delta.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

arch/arm/mach-omap1/board-ams-delta.c +4 -2

index 17886744dbe6..55bf73710a59 100644
@@ -247,8 +247,8 @@ static struct platform_device latch2_gpio_device = {
 #define LATCH2_PIN_SCARD_CMDVCC		11
 #define LATCH2_PIN_MODEM_NRESET		12
 #define LATCH2_PIN_MODEM_CODEC		13
-#define LATCH2_PIN_HOOKFLASH1		14
-#define LATCH2_PIN_HOOKFLASH2		15
+#define LATCH2_PIN_AUDIO_MUTE		14
+#define LATCH2_PIN_HOOKFLASH		15
 
 static struct regulator_consumer_supply modem_nreset_consumers[] = {
 	REGULATOR_SUPPLY("RESET#", "serial8250.1"),

@@ -588,6 +588,8 @@ static int gpiochip_match_by_label(struct gpio_chip *chip, void *data)
 static struct gpiod_hog ams_delta_gpio_hogs[] = {
 	GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_KEYBRD_DATAOUT, "keybrd_dataout",
 		 GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW),
+	GPIO_HOG(LATCH2_LABEL, LATCH2_PIN_AUDIO_MUTE, "audio_mute",
+		 GPIO_ACTIVE_HIGH, GPIOD_OUT_LOW),
 	{},
 };

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #147 lore raw

PATCH 133/352 ARM: dts: Fix OMAP4430 SDP Ethernet startup

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 84fb6c7feb1494ebb7d1ec8b95cfb7ada0264465 ]

It was noticed that unbinding and rebinding the KSZ8851 ethernet resulted in the driver reporting "failed to read device ID" at probe. Probing the reset line with a 'scope while repeatedly attempting to bind the driver in a shell loop revealed that the KSZ8851 RSTN pin is constantly held at zero, meaning the device is held in reset, and does not respond on the SPI bus.

Experimentation with the startup delay on the regulator set to 50ms shows that the reset is positively released after 20ms.

Schematics for this board are not available, and the traces are buried in the inner layers of the board which makes tracing where the RSTN pin extremely difficult. We can only guess that the RSTN pin is wired to a reset generator chip driven off the ethernet supply, which fits the observed behaviour.

Include this delay in the regulator startup delay - effectively treating the reset as a "supply stable" indicator.

This can not be modelled as a delay in the KSZ8851 driver since the reset generation is board specific - if the RSTN pin had been wired to a GPIO, reset could be released earlier via the already provided support in the KSZ8851 driver.

This also got confirmed by Peter Ujfalusi <[email protected]> based on Blaze schematics that should be very close to SDP4430:

TPS22902YFPR is used as the regulator switch (gpio48 controlled):
Convert arm boot_lock to raw The VOUT is routed to TPS3808G01DBV. (SCH Note: Threshold set at 90%. Vsense: 0.405V).

According to the TPS3808 data sheet the RESET delay time when Ct is open (this is the case in the schema): MIN/TYP/MAX: 12/20/28 ms.

Signed-off-by Russell King <[email protected]>

Reviewed-by Peter Ujfalusi <[email protected]>

[[email protected]: updated with notes from schematics from Peter]

Signed-off-by Tony Lindgren <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/boot/dts/omap4-sdp.dts | 1 +
 1 file changed, 1 insertion(+)

arch/arm/boot/dts/omap4-sdp.dts +1 -0

index 490726b52216..9dc7ec7655cb 100644
@@ -33,6 +33,7 @@
 		gpio = <&gpio2 16 GPIO_ACTIVE_HIGH>;  /* gpio line 48 */
 		enable-active-high;
 		regulator-boot-on;
+		startup-delay-us = <25000>;
 	};
 
 	vbat: fixedregulator-vbat {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #150 lore raw

PATCH 136/352 arm64: dts: meson: Fix IRQ trigger type for macirq

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8b3e6f8999f8d704fccce225b9455b3fa639d1c9 ]

A long running stress test on a custom board shipping an AXG SoCs and a Realtek RTL8211F PHY revealed that after a few hours the connection speed would drop drastically, from ~1000Mbps to ~3Mbps. At the same time the 'macirq' (eth0) IRQ would stop being triggered at all and as consequence the GMAC IRQs never ACKed.

After a painful investigation the problem seemed to be due to a wrong defined IRQ type for the GMAC IRQ that should be LEVEL_HIGH instead of EDGE_RISING.

The change in the macirq IRQ type also solved another long standing issue affecting this SoC/PHY where EEE was causing the network connection to die after stressing it with iperf3 (even though much sooner). It's now possible to remove the 'eee-broken-1000t' quirk as well.

Fixes feb3cbea0946 ("ARM64: dts: meson-gxbb-odroidc2: fix GbE tx link breakage")

Fixes 6d28d577510f ("ARM64: dts: meson-axg: fix ethernet stability issue")

Reviewed-by Jerome Brunet <[email protected]>

Tested-by Jerome Brunet <[email protected]>

Acked-by Neil Armstrong <[email protected]>

Signed-off-by Carlo Caione <[email protected]>

Signed-off-by Kevin Hilman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm64/boot/dts/amlogic/meson-axg.dtsi          | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gx.dtsi           | 2 +-
 arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 1 -
 arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi   | 1 -
 4 files changed, 2 insertions(+), 4 deletions(-)

arch/arm64/boot/dts/amlogic/meson-axg.dtsi +1 -1

index df017dbd2e57..b1a42e99cb67 100644
@@ -143,7 +143,7 @@
 			compatible = "amlogic,meson-axg-dwmac", "snps,dwmac";
 			reg = <0x0 0xff3f0000 0x0 0x10000
 			       0x0 0xff634540 0x0 0x8>;
-			interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "macirq";
 			clocks = <&clkc CLKID_ETH>,
 				 <&clkc CLKID_FCLK_DIV2>,

arch/arm64/boot/dts/amlogic/meson-gx.dtsi +1 -1

index f1e5cdbade5e..58e6bcaac1d8 100644
@@ -462,7 +462,7 @@
 			compatible = "amlogic,meson-gx-dwmac", "amlogic,meson-gxbb-dwmac", "snps,dwmac";
 			reg = <0x0 0xc9410000 0x0 0x10000
 			       0x0 0xc8834540 0x0 0x4>;
-			interrupts = <GIC_SPI 8 IRQ_TYPE_EDGE_RISING>;
+			interrupts = <GIC_SPI 8 IRQ_TYPE_LEVEL_HIGH>;
 			interrupt-names = "macirq";
 			status = "disabled";
 		};

arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +0 -1

index 54954b314a45..f8d1cedbe600 100644
@@ -143,7 +143,6 @@
 			interrupt-parent = <&gpio_intc>;
 			/* MAC_INTR on GPIOZ_15 */
 			interrupts = <29 IRQ_TYPE_LEVEL_LOW>;
-			eee-broken-1000t;
 		};
 	};
 };

arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +0 -1

index 70325b273bd2..ec09bb5792b7 100644
@@ -142,7 +142,6 @@
 		eth_phy0: ethernet-phy@0 {
 			/* Realtek RTL8211F (0x001cc916) */
 			reg = <0>;
-			eee-broken-1000t;
 		};
 	};
 };

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #152 lore raw

PATCH 138/352 tracing: Have trace_stack nr_entries compare not be so subtle

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ca16b0fbb05242f18da9d810c07d3882ffed831c ]

Dan Carpenter reviewed the trace_stack.c code and figured he found an off by one bug.

"From reviewing the code, it seems possible for
stack_trace_max.nr_entries to be set to .max_entries and in that case we would be reading one element beyond the end of the stack_dump_trace[] array. If it's not set to .max_entries then the bug doesn't affect runtime."

Although it looks to be the case, it is not. Because we have:

static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =

	 { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };

 struct stack_trace stack_trace_max = {
	.max_entries		= STACK_TRACE_ENTRIES - 1,
	.entries		= &stack_dump_trace[0],

};

And:

	stack_trace_max.nr_entries = x;
	for (; x < i; x++)
		stack_dump_trace[x] = ULONG_MAX;

Even if nr_entries equals max_entries, indexing with it into the stack_dump_trace[] array will not overflow the array. But if it is the case, the second part of the conditional that tests stack_dump_trace[nr_entries] to ULONG_MAX will always be true.

By applying Dan's patch, it removes the subtle aspect of it and makes the if conditional slightly more efficient.

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Dan Carpenter <[email protected]>

Signed-off-by Steven Rostedt (VMware) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 kernel/trace/trace_stack.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

kernel/trace/trace_stack.c +1 -1

index 2b0d1ee3241c..e2a153fc1afc 100644
@@ -286,7 +286,7 @@ __next(struct seq_file *m, loff_t *pos)
 {
 	long n = *pos - 1;
 
-	if (n > stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
+	if (n >= stack_trace_max.nr_entries || stack_dump_trace[n] == ULONG_MAX)
 		return NULL;
 
 	m->private = (void *)n;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #151 lore raw

PATCH 137/352 ARM: dts: Fix up the D-Link DIR-685 MTD partition info

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 738a05e673435afb986b53da43befd83ad87ec3b ]

The vendor firmware was analyzed to get the right idea about this flash layout. /proc/mtd contains:

dev: size erasesize name
mtd0: 01e7ff40 00020000 "rootfs"
mtd1: 01f40000 00020000 "upgrade"
mtd2: 00040000 00020000 "rgdb"
mtd3: 00020000 00020000 "nvram"
mtd4: 00040000 00020000 "RedBoot"
mtd5: 00020000 00020000 "LangPack"
mtd6: 02000000 00020000 "flash"

Here "flash" is obviously the whole device and we know "rootfs" is a bogus hack to point to a squashfs rootfs inside of the main "upgrade partition". We know "RedBoot" is the first 0x40000 of the flash and the "upgrade" partition follows from 0x40000 to 0x1f8000. So we have mtd0, 1, 4 and 6 covered.

Remains:
mtd2: 00040000 00020000 "rgdb"
mtd3: 00020000 00020000 "nvram"
mtd5: 00020000 00020000 "LangPack"

Inspecting the flash at 0x1f8000 and 0x1fa000 reveals each of these starting with "RGCFG1" so we assume 0x1f8000-1fbfff is "rgdb" of 0x40000.

Signed-off-by Linus Walleij <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/boot/dts/gemini-dlink-dir-685.dts | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

arch/arm/boot/dts/gemini-dlink-dir-685.dts +6 ~~-10~~

index 6f258b50eb44..502a361d1fe9 100644
@@ -274,20 +274,16 @@
 				read-only;
 			};
 			/*
-			 * Between the boot loader and the rootfs is the kernel
-			 * in a custom Storlink format flashed from the boot
-			 * menu. The rootfs is in squashfs format.
+			 * This firmware image contains the kernel catenated
+			 * with the squashfs root filesystem. For some reason
+			 * this is called "upgrade" on the vendor system.
 			 */
-			partition@1800c0 {
-				label = "rootfs";
-				reg = <0x001800c0 0x01dbff40>;
-				read-only;
-			};
-			partition@1f40000 {
+			partition@40000 {
 				label = "upgrade";
-				reg = <0x01f40000 0x00040000>;
+				reg = <0x00040000 0x01f40000>;
 				read-only;
 			};
+			/* RGDB, Residental Gateway Database? */
 			partition@1f80000 {
 				label = "rgdb";
 				reg = <0x01f80000 0x00040000>;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #126 lore raw

PATCH 112/352 usb: dwc2: Disable power down feature on Samsung SoCs

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 35a6054132286a4ab92b536595093b82e6bdfcbc ]

Power down feature of DWC2 module integrated in Samsung SoCs doesn't work properly or needs some additional handling in PHY or SoC glue layer, so disable it for now. Without disabling power down, DWC2 causes random memory trashes and fails enumeration if there is no USB link to host on driver probe.

Fixes 03ea6d6e9e1ff1 ("usb: dwc2: Enable power down")

Acked-by Minas Harutyunyan <[email protected]>

Signed-off-by Marek Szyprowski <[email protected]>

Signed-off-by Felipe Balbi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/dwc2/params.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

drivers/usb/dwc2/params.c +9 -1

index 38c813b1d203..24ff5f21cb25 100644
@@ -71,6 +71,13 @@ static void dwc2_set_his_params(struct dwc2_hsotg *hsotg)
 	p->power_down = false;
 }
 
+static void dwc2_set_s3c6400_params(struct dwc2_hsotg *hsotg)
+{
+	struct dwc2_core_params *p = &hsotg->params;
+
+	p->power_down = 0;
+}
+
 static void dwc2_set_rk_params(struct dwc2_hsotg *hsotg)
 {
 	struct dwc2_core_params *p = &hsotg->params;

@@ -152,7 +159,8 @@ const struct of_device_id dwc2_of_match_table[] = {
 	{ .compatible = "lantiq,arx100-usb", .data = dwc2_set_ltq_params },
 	{ .compatible = "lantiq,xrx200-usb", .data = dwc2_set_ltq_params },
 	{ .compatible = "snps,dwc2" },
-	{ .compatible = "samsung,s3c6400-hsotg" },
+	{ .compatible = "samsung,s3c6400-hsotg",
+	  .data = dwc2_set_s3c6400_params },
 	{ .compatible = "amlogic,meson8-usb",
 	  .data = dwc2_set_amlogic_params },
 	{ .compatible = "amlogic,meson8b-usb",

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #155 lore raw

PATCH 139/352 watchdog: renesas_wdt: dont set divider while watchdog is running

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit e990e12741877e9bfac402ca468f4007a75f6e2a ]

The datasheet says we must stop the timer before changing the clock divider. This can happen when the restart handler is called while the watchdog is running.

Signed-off-by Wolfram Sang <[email protected]>

Reviewed-by Fabrizio Castro <[email protected]>

Reviewed-by Guenter Roeck <[email protected]>

Signed-off-by Guenter Roeck <[email protected]>

Signed-off-by Wim Van Sebroeck <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/watchdog/renesas_wdt.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

drivers/watchdog/renesas_wdt.c +7 -2

index 0d74c3e48979..55c9eb6c6e51 100644
@@ -74,12 +74,17 @@ static int rwdt_init_timeout(struct watchdog_device *wdev)
 static int rwdt_start(struct watchdog_device *wdev)
 {
 	struct rwdt_priv *priv = watchdog_get_drvdata(wdev);
+	u8 val;
 
 	pm_runtime_get_sync(wdev->parent);
 
-	rwdt_write(priv, 0, RWTCSRB);
-	rwdt_write(priv, priv->cks, RWTCSRA);
+	/* Stop the timer before we modify any register */
+	val = readb_relaxed(priv->base + RWTCSRA) & ~RWTCSRA_TME;
+	rwdt_write(priv, val, RWTCSRA);
+
 	rwdt_init_timeout(wdev);
+	rwdt_write(priv, priv->cks, RWTCSRA);
+	rwdt_write(priv, 0, RWTCSRB);
 
 	while (readb_relaxed(priv->base + RWTCSRA) & RWTCSRA_WRFLG)
 		cpu_relax();

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #156 lore raw

PATCH 140/352 ARM: dts: imx51-zii-rdu1: Do not specify "power-gpio" for hpa1

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 79da07dec740a42c70963ebacbd2bf8866af9e20 ]

TPA6130A2 SD pin on RDU1 is not really controlled by SoC and instead is only meant to notify the system that audio was "muted" by external actors. To accommodate that, drop "power-gpio" property of hpa1 node as well as specify a name for that GPIO so that userspace can access it.

Signed-off-by Andrey Smirnov <[email protected]>

Signed-off-by Fabio Estevam <[email protected]>

Tested-by Chris Healy <[email protected]>

Signed-off-by Shawn Guo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/boot/dts/imx51-zii-rdu1.dts | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

arch/arm/boot/dts/imx51-zii-rdu1.dts +13 -4

index 69d753cac89a..44985f61c0ba 100644
@@ -477,6 +477,15 @@
 };
 
 &gpio1 {
+	gpio-line-names = "", "", "", "",
+			  "", "", "", "",
+			  "", "hp-amp-shutdown-b", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "",
+			  "", "", "", "";
+
 	unused-sd3-wp-gpio {
 		/*
 		 * See pinctrl_esdhc1 below for more details on this

@@ -495,9 +504,6 @@
 	hpa1: amp@60 {
 		compatible = "ti,tpa6130a2";
 		reg = <0x60>;
-		pinctrl-names = "default";
-		pinctrl-0 = <&pinctrl_ampgpio>;
-		power-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
 		Vdd-supply = <&reg_3p3v>;
 	};

@@ -671,7 +677,10 @@
 };
 
 &iomuxc {
-	pinctrl_ampgpio: ampgpiogrp {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_hog>;
+
+	pinctrl_hog: hoggrp {
 		fsl,pins = <
 			MX51_PAD_GPIO1_9__GPIO1_9		0x5e
 		>;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #127 lore raw

PATCH 113/352 usb: hub: delay hub autosuspend if USB3 port is still link training

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit e86108940e541febf35813402ff29fa6f4a9ac0b ]

When initializing a hub we want to give a USB3 port in link training the same debounce delay time before autosuspening the hub as already trained, connected enabled ports.

USB3 ports won't reach the enabled state with "current connect status" and "connect status change" bits set until the USB3 link training finishes.

Catching the port in link training (polling) and adding the debounce delay prevents unnecessary failed attempts to autosuspend the hub.

Signed-off-by Mathias Nyman <[email protected]>

Acked-by Alan Stern <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/core/hub.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

drivers/usb/core/hub.c +10 -0

index f76b2e0aba9d..1d1e61e980f3 100644
@@ -1112,6 +1112,16 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 						   USB_PORT_FEAT_ENABLE);
 		}
 
+		/*
+		 * Add debounce if USB3 link is in polling/link training state.
+		 * Link will automatically transition to Enabled state after
+		 * link training completes.
+		 */
+		if (hub_is_superspeed(hdev) &&
+		    ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+						USB_SS_PORT_LS_POLLING))
+			need_debounce_delay = true;
+
 		/* Clear status-change flags; we'll debounce later */
 		if (portchange & USB_PORT_STAT_C_CONNECTION) {
 			need_debounce_delay = true;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #128 lore raw

PATCH 114/352 timekeeping: Use proper seqcount initializer

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ce10a5b3954f2514af726beb78ed8d7350c5e41c ]

tk_core.seq is initialized open coded, but that misses to initialize the lockdep map when lockdep is enabled. Lockdep splats involving tk_core seq consequently lack a name and are hard to read.

Use the proper initializer which takes care of the lockdep map initialization.

[ tglx: Massaged changelog ]

Signed-off-by Bart Van Assche <[email protected]>

Signed-off-by Thomas Gleixner <[email protected]>

Cc [email protected]

Link https://lkml.kernel.org/r/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 kernel/time/timekeeping.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

kernel/time/timekeeping.c +3 -1

index 2d110c948805..6c9493495538 100644
@@ -50,7 +50,9 @@ enum timekeeping_adv_mode {
 static struct {
 	seqcount_t		seq;
 	struct timekeeper	timekeeper;
-} tk_core ____cacheline_aligned;
+} tk_core ____cacheline_aligned = {
+	.seq = SEQCNT_ZERO(tk_core.seq),
+};
 
 static DEFINE_RAW_SPINLOCK(timekeeper_lock);
 static struct timekeeper shadow_timekeeper;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #129 lore raw

PATCH 115/352 usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a0678e2eed41e81004308693ac84ea95614b0920 ]

Fix the issue: device doesn't accept LGO_U1/U2:
1. set SW_U1/U2_ACCEPT_ENABLE to eanble controller to accept LGO_U1/U2

    by default;
2. enable/disable controller to initiate requests for transition into
    U1/U2 by SW_U1/U2_REQUEST_ENABLE instead of SW_U1/U2_ACCEPT_ENABLE;

Signed-off-by Chunfeng Yun <[email protected]>

Signed-off-by Felipe Balbi <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/mtu3/mtu3_core.c       | 4 +++-
 drivers/usb/mtu3/mtu3_gadget_ep0.c | 8 ++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

drivers/usb/mtu3/mtu3_core.c +3 -1

index ae70b9bfd797..860693520132 100644
@@ -578,8 +578,10 @@ static void mtu3_regs_init(struct mtu3 *mtu)
 	if (mtu->is_u3_ip) {
 		/* disable LGO_U1/U2 by default */
 		mtu3_clrbits(mbase, U3D_LINK_POWER_CONTROL,
-				SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE |
 				SW_U1_REQUEST_ENABLE | SW_U2_REQUEST_ENABLE);
+		/* enable accept LGO_U1/U2 link command from host */
+		mtu3_setbits(mbase, U3D_LINK_POWER_CONTROL,
+				SW_U1_ACCEPT_ENABLE | SW_U2_ACCEPT_ENABLE);
 		/* device responses to u3_exit from host automatically */
 		mtu3_clrbits(mbase, U3D_LTSSM_CTRL, SOFT_U3_EXIT_EN);
 		/* automatically build U2 link when U3 detect fail */

drivers/usb/mtu3/mtu3_gadget_ep0.c +4 -4

index 25216e79cd6e..3c464d8ae023 100644
@@ -336,9 +336,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
 
 		lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
 		if (set)
-			lpc |= SW_U1_ACCEPT_ENABLE;
+			lpc |= SW_U1_REQUEST_ENABLE;
 		else
-			lpc &= ~SW_U1_ACCEPT_ENABLE;
+			lpc &= ~SW_U1_REQUEST_ENABLE;
 		mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
 
 		mtu->u1_enable = !!set;

@@ -351,9 +351,9 @@ static int ep0_handle_feature_dev(struct mtu3 *mtu,
 
 		lpc = mtu3_readl(mbase, U3D_LINK_POWER_CONTROL);
 		if (set)
-			lpc |= SW_U2_ACCEPT_ENABLE;
+			lpc |= SW_U2_REQUEST_ENABLE;
 		else
-			lpc &= ~SW_U2_ACCEPT_ENABLE;
+			lpc &= ~SW_U2_REQUEST_ENABLE;
 		mtu3_writel(mbase, U3D_LINK_POWER_CONTROL, lpc);
 
 		mtu->u2_enable = !!set;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #130 lore raw

PATCH 116/352 clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6e6da2039c82271dd873b9ad2b902a692a7dd554 ]

All the audio interfaces on Allwinner SoCs need to change their module clocks during operation, to switch between support for 44.1 kHz and 48 kHz family sample rates. The clock rate for the module clocks is governed by their upstream audio PLL. The module clocks themselves only have a gate, and sometimes a divider or mux. Thus any rate changes need to be propagated upstream.

Set the CLK_SET_RATE_PARENT flag for all audio module clocks to achieve this.

Signed-off-by Chen-Yu Tsai <[email protected]>

Signed-off-by Maxime Ripard <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/clk/sunxi-ng/ccu-sun8i-a33.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

drivers/clk/sunxi-ng/ccu-sun8i-a33.c +3 -3

index 13eb5b23c5e7..c40d572a7602 100644
@@ -366,10 +366,10 @@ static SUNXI_CCU_MP_WITH_MUX_GATE(spi1_clk, "spi1", mod0_default_parents, 0x0a4,
 static const char * const i2s_parents[] = { "pll-audio-8x", "pll-audio-4x",
 					    "pll-audio-2x", "pll-audio" };
 static SUNXI_CCU_MUX_WITH_GATE(i2s0_clk, "i2s0", i2s_parents,
-			       0x0b0, 16, 2, BIT(31), 0);
+			       0x0b0, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
 
 static SUNXI_CCU_MUX_WITH_GATE(i2s1_clk, "i2s1", i2s_parents,
-			       0x0b4, 16, 2, BIT(31), 0);
+			       0x0b4, 16, 2, BIT(31), CLK_SET_RATE_PARENT);
 
 /* TODO: the parent for most of the USB clocks is not known */
 static SUNXI_CCU_GATE(usb_phy0_clk,	"usb-phy0",	"osc24M",

@@ -446,7 +446,7 @@ static SUNXI_CCU_M_WITH_GATE(ve_clk, "ve", "pll-ve",
 static SUNXI_CCU_GATE(ac_dig_clk,	"ac-dig",	"pll-audio",
 		      0x140, BIT(31), CLK_SET_RATE_PARENT);
 static SUNXI_CCU_GATE(ac_dig_4x_clk,	"ac-dig-4x",	"pll-audio-4x",
-		      0x140, BIT(30), 0);
+		      0x140, BIT(30), CLK_SET_RATE_PARENT);
 static SUNXI_CCU_GATE(avs_clk,		"avs",		"osc24M",
 		      0x144, BIT(31), 0);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #131 lore raw

PATCH 117/352 media: imx274: select REGMAP_I2C

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f9d7225c70dd9d3f406b79e60f8dbd2cd5ae743 ]

The imx274 driver uses regmap and the build will fail without it.

Fixes:

drivers/media/i2c/imx274.c:142:21: error: variable ‘imx274_regmap_config’ has initializer but incomplete type

   static const struct regmap_config imx274_regmap_config = {
                       ^~~~~~~~~~~~~
  drivers/media/i2c/imx274.c:1869:19: error: implicit declaration of function ‘devm_regmap_init_i2c’ [-Werror=implicit-function-declaration]
    imx274->regmap = devm_regmap_init_i2c(client, &imx274_regmap_config);
                     ^~~~~~~~~~~~~~~~~~~~

and others.

Signed-off-by Luca Ceresoli <[email protected]>

Signed-off-by Sakari Ailus <[email protected]>

Signed-off-by Mauro Carvalho Chehab <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/media/i2c/Kconfig | 1 +
 1 file changed, 1 insertion(+)

drivers/media/i2c/Kconfig +1 -0

index f4714bd6fef0..421e2fd2481d 100644
@@ -611,6 +611,7 @@ config VIDEO_IMX274
 	tristate "Sony IMX274 sensor support"
 	depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
 	depends on MEDIA_CAMERA_SUPPORT
+	select REGMAP_I2C
 	---help---
 	  This is a V4L2 sensor driver for the Sony IMX274
 	  CMOS image sensor.

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #132 lore raw

PATCH 118/352 mac80211: fix deauth TX when we disconnect

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit f6c7f03f69f7422bc237bc79599e152d390b74e0 ]

The iTXQs stop/wake queue mechanism involves a whole bunch of locks and this is probably why the call to ieee80211_wake_txqs is deferred to a tasklet when called from __ieee80211_wake_queue.

Another advantage of that is that ieee80211_wake_txqs might call the wake_tx_queue() callback and then the driver may call mac80211 which will call it back in the same context.

The bug I saw is that when we send a deauth frame as a station we do:

flush(drop=1)
tx deauth
flush(drop=0)

While we flush we stop the queues and wake them up immediately after we finished flushing. The problem here is that the tasklet that de-facto enables the queue may not have run until we send the deauth. Then the deauth frame is sent to the driver (which is surprising by itself), but the driver won't get anything useful from ieee80211_tx_dequeue because the queue is stopped (or more precisely because vif->txqs_stopped[0] is true).
Then the deauth is not sent. Later on, the tasklet will run, but that'll be too late. We'll already have removed all the vif etc...

Fix this by calling ieee80211_wake_txqs synchronously if we are not waking up the queues from the driver (we check the reason to determine that). This makes the code really convoluted because we may call ieee80211_wake_txqs from __ieee80211_wake_queue. The latter assumes that queue_stop_reason_lock has been taken by the caller and ieee80211_wake_txqs may release the lock to send the frames.

Signed-off-by Emmanuel Grumbach <[email protected]>

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 net/mac80211/util.c | 49 ++++++++++++++++++++++++++++++++-------------
 1 file changed, 35 insertions(+), 14 deletions(-)

net/mac80211/util.c +35 ~~-14~~

index bec424316ea4..dddfff7cf44f 100644
@@ -299,16 +299,16 @@ out:
 	spin_unlock_bh(&fq->lock);
 }
 
-void ieee80211_wake_txqs(unsigned long data)
+static void
+__releases(&local->queue_stop_reason_lock)
+__acquires(&local->queue_stop_reason_lock)
+_ieee80211_wake_txqs(struct ieee80211_local *local, unsigned long *flags)
 {
-	struct ieee80211_local *local = (struct ieee80211_local *)data;
 	struct ieee80211_sub_if_data *sdata;
 	int n_acs = IEEE80211_NUM_ACS;
-	unsigned long flags;
 	int i;
 
 	rcu_read_lock();
-	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
 	if (local->hw.queues < IEEE80211_NUM_ACS)
 		n_acs = 1;

@@ -317,7 +317,7 @@ void ieee80211_wake_txqs(unsigned long data)
 		if (local->queue_stop_reasons[i])
 			continue;
 
-		spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+		spin_unlock_irqrestore(&local->queue_stop_reason_lock, *flags);
 		list_for_each_entry_rcu(sdata, &local->interfaces, list) {
 			int ac;

@@ -329,13 +329,22 @@ void ieee80211_wake_txqs(unsigned long data)
 					__ieee80211_wake_txqs(sdata, ac);
 			}
 		}
-		spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+		spin_lock_irqsave(&local->queue_stop_reason_lock, *flags);
 	}
 
-	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 	rcu_read_unlock();
 }
 
+void ieee80211_wake_txqs(unsigned long data)
+{
+	struct ieee80211_local *local = (struct ieee80211_local *)data;
+	unsigned long flags;
+
+	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
+	_ieee80211_wake_txqs(local, &flags);
+	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
+}
+
 void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 {
 	struct ieee80211_sub_if_data *sdata;

@@ -371,7 +380,8 @@ void ieee80211_propagate_queue_wake(struct ieee80211_local *local, int queue)
 
 static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 				   enum queue_stop_reason reason,
-				   bool refcounted)
+				   bool refcounted,
+				   unsigned long *flags)
 {
 	struct ieee80211_local *local = hw_to_local(hw);

@@ -405,8 +415,19 @@ static void __ieee80211_wake_queue(struct ieee80211_hw *hw, int queue,
 	} else
 		tasklet_schedule(&local->tx_pending_tasklet);
 
-	if (local->ops->wake_tx_queue)
-		tasklet_schedule(&local->wake_txqs_tasklet);
+	/*
+	 * Calling _ieee80211_wake_txqs here can be a problem because it may
+	 * release queue_stop_reason_lock which has been taken by
+	 * __ieee80211_wake_queue's caller. It is certainly not very nice to
+	 * release someone's lock, but it is fine because all the callers of
+	 * __ieee80211_wake_queue call it right before releasing the lock.
+	 */
+	if (local->ops->wake_tx_queue) {
+		if (reason == IEEE80211_QUEUE_STOP_REASON_DRIVER)
+			tasklet_schedule(&local->wake_txqs_tasklet);
+		else
+			_ieee80211_wake_txqs(local, flags);
+	}
 }
 
 void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,

@@ -417,7 +438,7 @@ void ieee80211_wake_queue_by_reason(struct ieee80211_hw *hw, int queue,
 	unsigned long flags;
 
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-	__ieee80211_wake_queue(hw, queue, reason, refcounted);
+	__ieee80211_wake_queue(hw, queue, reason, refcounted, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }

@@ -514,7 +535,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local,
 			       false);
 	__skb_queue_tail(&local->pending[queue], skb);
 	__ieee80211_wake_queue(hw, queue, IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-			       false);
+			       false, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }

@@ -547,7 +568,7 @@ void ieee80211_add_pending_skbs(struct ieee80211_local *local,
 	for (i = 0; i < hw->queues; i++)
 		__ieee80211_wake_queue(hw, i,
 			IEEE80211_QUEUE_STOP_REASON_SKB_ADD,
-			false);
+			false, &flags);
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }

@@ -605,7 +626,7 @@ void ieee80211_wake_queues_by_reason(struct ieee80211_hw *hw,
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
 
 	for_each_set_bit(i, &queues, hw->queues)
-		__ieee80211_wake_queue(hw, i, reason, refcounted);
+		__ieee80211_wake_queue(hw, i, reason, refcounted, &flags);
 
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:27 UTC #159 lore raw

PATCH 143/352 iommu/arm-smmu: Add support for qcom,smmu-v2 variant

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 89cddc563743cb1e0068867ac97013b2a5bf86aa ]

qcom,smmu-v2 is an arm,smmu-v2 implementation with specific clock and power requirements.
On msm8996, multiple cores, viz. mdss, video, etc. use this smmu. On sdm845, this smmu is used with gpu.
Add bindings for the same.

Signed-off-by Vivek Gautam <[email protected]>

Reviewed-by Rob Herring <[email protected]>

Reviewed-by Tomasz Figa <[email protected]>

Tested-by Srinivas Kandagatla <[email protected]>

Reviewed-by Robin Murphy <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/iommu/arm-smmu.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/iommu/arm-smmu.c +3 -0

index 5a28ae892504..e23aa7f6c4ad 100644
@@ -119,6 +119,7 @@ enum arm_smmu_implementation {
 	GENERIC_SMMU,
 	ARM_MMU500,
 	CAVIUM_SMMUV2,
+	QCOM_SMMUV2,
 };
 
 struct arm_smmu_s2cr {

@@ -1954,6 +1955,7 @@ ARM_SMMU_MATCH_DATA(smmu_generic_v2, ARM_SMMU_V2, GENERIC_SMMU);
 ARM_SMMU_MATCH_DATA(arm_mmu401, ARM_SMMU_V1_64K, GENERIC_SMMU);
 ARM_SMMU_MATCH_DATA(arm_mmu500, ARM_SMMU_V2, ARM_MMU500);
 ARM_SMMU_MATCH_DATA(cavium_smmuv2, ARM_SMMU_V2, CAVIUM_SMMUV2);
+ARM_SMMU_MATCH_DATA(qcom_smmuv2, ARM_SMMU_V2, QCOM_SMMUV2);
 
 static const struct of_device_id arm_smmu_of_match[] = {
 	{ .compatible = "arm,smmu-v1", .data = &smmu_generic_v1 },

@@ -1962,6 +1964,7 @@ static const struct of_device_id arm_smmu_of_match[] = {
 	{ .compatible = "arm,mmu-401", .data = &arm_mmu401 },
 	{ .compatible = "arm,mmu-500", .data = &arm_mmu500 },
 	{ .compatible = "cavium,smmu-v2", .data = &cavium_smmuv2 },
+	{ .compatible = "qcom,smmu-v2", .data = &qcom_smmuv2 },
 	{ },
 };
 MODULE_DEVICE_TABLE(of, arm_smmu_of_match);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #169 lore raw

PATCH 153/352 lightnvm: pblk: fix resubmission of overwritten write err lbas

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c12fa401ac8c94a74aff68bb5736b3f1dc695fa8 ]

Make sure we only look up valid lba addresses on the resubmission path.

If an lba is invalidated in the write buffer, that sector will be submitted to disk (as it is already mapped to a ppa), and that write might fail, resulting in a crash when trying to look up the lba in the mapping table (as the lba is marked as invalid).

Signed-off-by Hans Holmberg <[email protected]>

Reviewed-by Javier González <[email protected]>

Signed-off-by Matias Bjørling <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/lightnvm/pblk-write.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

drivers/lightnvm/pblk-write.c +5 -3

index fa8726493b39..3ddd16f47106 100644
@@ -148,9 +148,11 @@ static void pblk_prepare_resubmit(struct pblk *pblk, unsigned int sentry,
 		w_ctx = &entry->w_ctx;
 
 		/* Check if the lba has been overwritten */
-		ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
-		if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
-			w_ctx->lba = ADDR_EMPTY;
+		if (w_ctx->lba != ADDR_EMPTY) {
+			ppa_l2p = pblk_trans_map_get(pblk, w_ctx->lba);
+			if (!pblk_ppa_comp(ppa_l2p, entry->cacheline))
+				w_ctx->lba = ADDR_EMPTY;
+		}
 
 		/* Mark up the entry as submittable again */
 		flags = READ_ONCE(w_ctx->flags);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #172 lore raw

PATCH 156/352 lightnvm: Fix uninitialized return value in nvm_get_chunk_meta()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 55e58c5e78aad9d3246f57e7718cf5ee7adde9e3 ]

With gcc 4.1:

drivers/lightnvm/core.c: In function ‘nvm_get_bb_meta’:
drivers/lightnvm/core.c:977: warning: ‘ret’ may be used uninitialized in this function

and

drivers/nvme/host/lightnvm.c: In function ‘nvme_nvm_get_chk_meta’:
drivers/nvme/host/lightnvm.c:580: warning: ‘ret’ may be used uninitialized in this function

Indeed, if (for the former) the number of channels or LUNs is zero, or (for both) the passed number of chunks is zero, ret will be returned uninitialized.

Fix this by preinitializing ret to zero.

Fixes aff3fb18f957de93 ("lightnvm: move bad block and chunk state logic to core")

Fixes a294c199455187d1 ("lightnvm: implement get log report chunk helpers")

Signed-off-by Geert Uytterhoeven <[email protected]>

Signed-off-by Matias Bjørling <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/lightnvm/core.c      | 2 +-
 drivers/nvme/host/lightnvm.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

drivers/lightnvm/core.c +1 -1

index efb976a863d2..73ab3cf26868 100644
@@ -974,7 +974,7 @@ static int nvm_get_bb_meta(struct nvm_dev *dev, sector_t slba,
 	struct ppa_addr ppa;
 	u8 *blks;
 	int ch, lun, nr_blks;
-	int ret;
+	int ret = 0;
 
 	ppa.ppa = slba;
 	ppa = dev_to_generic_addr(dev, ppa);

drivers/nvme/host/lightnvm.c +2 -1

index a4f3b263cd6c..d64805dc8efb 100644
@@ -577,7 +577,8 @@ static int nvme_nvm_get_chk_meta(struct nvm_dev *ndev,
 	struct ppa_addr ppa;
 	size_t left = nchks * sizeof(struct nvme_nvm_chk_meta);
 	size_t log_pos, offset, len;
-	int ret, i, max_len;
+	int i, max_len;
+	int ret = 0;
 
 	/*
 	 * limit requests to maximum 256K to avoid issuing arbitrary large

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #171 lore raw

PATCH 155/352 i2c-axxia: check for error conditions first

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 4f5c85fe3a60ace555d09898166af372547f97fc ]

It was observed that when using seqentional mode contrary to the documentation, the SS bit (which is supposed to only be set if automatic/sequence command completed normally), is sometimes set together with NA (NAK in address phase) causing transfer to falsely be considered successful.

My assumption is that this does not happen during manual mode since the controller is stopping its work the moment it sets NA/ND bit in status register. This is not the case in Automatic/Sequentional mode where it is still working to send STOP condition and the actual status we get depends on the time when the ISR is run.

This patch changes the order of checking status bits in ISR - error conditions are checked first and only if none of them occurred, the transfer may be considered successful. This is required to introduce using of sequentional mode in next patch.

Signed-off-by Krzysztof Adamski <[email protected]>

Reviewed-by Alexander Sverdlin <[email protected]>

Signed-off-by Wolfram Sang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/i2c/busses/i2c-axxia.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

drivers/i2c/busses/i2c-axxia.c +16 ~~-16~~

index 51d34959709b..fb5bac079e83 100644
@@ -296,22 +296,7 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
 			i2c_int_disable(idev, MST_STATUS_TFL);
 	}
 
-	if (status & MST_STATUS_SCC) {
-		/* Stop completed */
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		complete(&idev->msg_complete);
-	} else if (status & MST_STATUS_SNS) {
-		/* Transfer done */
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
-			axxia_i2c_empty_rx_fifo(idev);
-		complete(&idev->msg_complete);
-	} else if (status & MST_STATUS_TSS) {
-		/* Transfer timeout */
-		idev->msg_err = -ETIMEDOUT;
-		i2c_int_disable(idev, ~MST_STATUS_TSS);
-		complete(&idev->msg_complete);
-	} else if (unlikely(status & MST_STATUS_ERR)) {
+	if (unlikely(status & MST_STATUS_ERR)) {
 		/* Transfer error */
 		i2c_int_disable(idev, ~0);
 		if (status & MST_STATUS_AL)

@@ -328,6 +313,21 @@ static irqreturn_t axxia_i2c_isr(int irq, void *_dev)
 			readl(idev->base + MST_TX_BYTES_XFRD),
 			readl(idev->base + MST_TX_XFER));
 		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_SCC) {
+		/* Stop completed */
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_SNS) {
+		/* Transfer done */
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		if (i2c_m_rd(idev->msg) && idev->msg_xfrd < idev->msg->len)
+			axxia_i2c_empty_rx_fifo(idev);
+		complete(&idev->msg_complete);
+	} else if (status & MST_STATUS_TSS) {
+		/* Transfer timeout */
+		idev->msg_err = -ETIMEDOUT;
+		i2c_int_disable(idev, ~MST_STATUS_TSS);
+		complete(&idev->msg_complete);
 	}
 
 out:

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #174 lore raw

PATCH 158/352 mlxsw: spectrum_acl: Limit priority value

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit d7263ab35be25505ab57ebecd93cbc5dba8be717 ]

In Spectrum-2, higher priority value wins and priority valid values are in the range of {1,cap_kvd_size-1}. mlxsw_sp_acl_tcam_priority_get converts from lower-bound priorities alike tc flower to Spectrum-2 HW range. Up until now tc flower did not provide priority 0 or reached the maximal value, however multicast routing does provide priority 0.

Therefore, Change mlxsw_sp_acl_tcam_priority_get to verify priority is in the correct range. Make sure priority is never set to zero and never exceeds the maximal allowed value.

Signed-off-by Nir Dotan <[email protected]>

Reviewed-by Jiri Pirko <[email protected]>

Signed-off-by Ido Schimmel <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +3 -2

index e171513bb32a..30931a2c025b 100644
@@ -95,8 +95,9 @@ int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
 	if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, KVD_SIZE))
 		return -EIO;
 
-	max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE);
-	if (rulei->priority > max_priority)
+	/* Priority range is 1..cap_kvd_size-1. */
+	max_priority = MLXSW_CORE_RES_GET(mlxsw_sp->core, KVD_SIZE) - 1;
+	if (rulei->priority >= max_priority)
 		return -EINVAL;
 
 	/* Unlike in TC, in HW, higher number means higher priority. */

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #175 lore raw

PATCH 159/352 udf: Fix BUG on corrupted inode

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit d288d95842f1503414b7eebce3773bac3390457e ]

When inode is corrupted so that extent type is invalid, some functions (such as udf_truncate_extents()) will just BUG. Check that extent type is valid when loading the inode to memory.

Reported-by Anatoly Trosinenko <[email protected]>

Signed-off-by Jan Kara <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/udf/inode.c | 6 ++++++
 1 file changed, 6 insertions(+)

fs/udf/inode.c +6 -0

index 5df554a9f9c9..ae796e10f68b 100644
@@ -1357,6 +1357,12 @@ reread:
 
 	iinfo->i_alloc_type = le16_to_cpu(fe->icbTag.flags) &
 							ICBTAG_FLAG_AD_MASK;
+	if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_SHORT &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_LONG &&
+	    iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
+		ret = -EIO;
+		goto out;
+	}
 	iinfo->i_unique = 0;
 	iinfo->i_lenEAttr = 0;
 	iinfo->i_lenExtents = 0;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #176 lore raw

PATCH 160/352 switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit e4a7dca5de625018b29417ecc39dc5037d9a5a36 ]

In the ioctl_event_ctl() SWITCHTEC_IOCTL_EVENT_IDX_ALL case, we call event_ctl() several times with the same "ctl" struct. Each call clobbers ctl.flags, which leads to the problem that we may not actually enable or disable all events as the user requested.

Preserve the event flag value with a temporary variable.

Fixes 52eabba5bcdb ("switchtec: Add IOCTLs to the Switchtec driver")

Signed-off-by Joey Zhang <[email protected]>

Signed-off-by Wesley Sheng <[email protected]>

[bhelgaas: changelog]

Signed-off-by Bjorn Helgaas <[email protected]>

Reviewed-by Logan Gunthorpe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/pci/switch/switchtec.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/pci/switch/switchtec.c +3 -0

index 54a8b30dda38..37d0c15c9eeb 100644
@@ -800,6 +800,7 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
 {
 	int ret;
 	int nr_idxs;
+	unsigned int event_flags;
 	struct switchtec_ioctl_event_ctl ctl;
 
 	if (copy_from_user(&ctl, uctl, sizeof(ctl)))

@@ -821,7 +822,9 @@ static int ioctl_event_ctl(struct switchtec_dev *stdev,
 		else
 			return -EINVAL;
 
+		event_flags = ctl.flags;
 		for (ctl.index = 0; ctl.index < nr_idxs; ctl.index++) {
+			ctl.flags = event_flags;
 			ret = event_ctl(stdev, &ctl);
 			if (ret < 0)
 				return ret;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #160 lore raw

PATCH 144/352 iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a868e8530441286342f90c1fd9c5f24de3aa2880 ]

After removing an entry from a queue (e.g. reading an event in arm_smmu_evtq_thread()) it is necessary to advance the MMIO consumer pointer to free the queue slot back to the SMMU. A memory barrier is required here so that all reads targetting the queue entry have completed before the consumer pointer is updated.

The implementation of queue_inc_cons() relies on a writel() to complete the previous reads, but this is incorrect because writel() is only guaranteed to complete prior writes. This patch replaces the call to writel() with an mb(); writel_relaxed() sequence, which gives us the read->write ordering which we require.

Cc Robin Murphy <[email protected]>

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/iommu/arm-smmu-v3.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

drivers/iommu/arm-smmu-v3.c +7 -1

index 62ef4afc9ee5..11f528e727a1 100644
@@ -679,7 +679,13 @@ static void queue_inc_cons(struct arm_smmu_queue *q)
 	u32 cons = (Q_WRP(q, q->cons) | Q_IDX(q, q->cons)) + 1;
 
 	q->cons = Q_OVF(q, q->cons) | Q_WRP(q, cons) | Q_IDX(q, cons);
-	writel(q->cons, q->cons_reg);
+
+	/*
+	 * Ensure that all CPU accesses (reads and writes) to the queue
+	 * are complete before we update the cons pointer.
+	 */
+	mb();
+	writel_relaxed(q->cons, q->cons_reg);
 }
 
 static int queue_sync_prod(struct arm_smmu_queue *q)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #179 lore raw

PATCH 163/352 ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit add6883619a9e3bf9658eaff1a547354131bbcd9 ]

eukrea-tlv320.c machine driver runs on non-DT platforms and include <asm/mach-types.h> header file in order to be able to use some machine_is_eukrea_xxx() macros.

Building it for ARM64 causes the following build error:

sound/soc/fsl/eukrea-tlv320.c:28:10: fatal error: asm/mach-types.h: No such file or directory

Avoid this error by not allowing to build the SND_SOC_EUKREA_TLV320 driver when ARM64 is selected.

This is needed in preparation for the i.MX8M support.

Reported-by kbuild test robot <[email protected]>

Signed-off-by Fabio Estevam <[email protected]>

Acked-by Shawn Guo <[email protected]>

Signed-off-by Mark Brown <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 sound/soc/fsl/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

sound/soc/fsl/Kconfig +1 -1

index 6ec19fb4a934..2e75b5bc5f1d 100644
@@ -221,7 +221,7 @@ config SND_SOC_PHYCORE_AC97
 
 config SND_SOC_EUKREA_TLV320
 	tristate "Eukrea TLV320"
-	depends on ARCH_MXC && I2C
+	depends on ARCH_MXC && !ARM64 && I2C
 	select SND_SOC_TLV320AIC23_I2C
 	select SND_SOC_IMX_AUDMUX
 	select SND_SOC_IMX_SSI

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #180 lore raw

PATCH 164/352 ARM: mmp: fix timer_init calls

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 12d3a30db4a3b3df5fbadf5974b9cf50544a9950 ]

The change to passing the timer frequency as a function argument was a good idea, but caused a build failure for one user that was missed in the update:

arch/arm/mach-mmp/time.c: In function 'mmp_dt_init_timer':
arch/arm/mach-mmp/time.c:242:2: error: implicit declaration of function 'timer_init'; did you mean 'hrtimer_init'? [-Werror=implicit-function-declaration]

Change that as well to fix the build error, and rename the function to put it into a proper namespace and make it clearer what is actually going on.

I saw that the high 6500000 HZ frequency was previously only set with CONFIG_MMP2, but is now also used with MMP (pxa910), so I'm changing that back here. Please make sure that the frequencies are all correct now.

Fixes f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")

Signed-off-by Arnd Bergmann <[email protected]>

Signed-off-by Olof Johansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/arm/mach-mmp/common.h | 2 +-
 arch/arm/mach-mmp/mmp2.c   | 2 +-
 arch/arm/mach-mmp/pxa168.c | 2 +-
 arch/arm/mach-mmp/pxa910.c | 2 +-
 arch/arm/mach-mmp/time.c   | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

arch/arm/mach-mmp/common.h +1 -1

index 5ac2851ef5d3..483b8b6d3005 100644
@@ -2,7 +2,7 @@
 #include <linux/reboot.h>
 #define ARRAY_AND_SIZE(x)	(x), ARRAY_SIZE(x)
 
-extern void timer_init(int irq, unsigned long rate);
+extern void mmp_timer_init(int irq, unsigned long rate);
 
 extern void __init mmp_map_io(void);
 extern void mmp_restart(enum reboot_mode, const char *);

arch/arm/mach-mmp/mmp2.c +1 -1

index fb3e7e32c882..726c1a642dea 100644
@@ -134,7 +134,7 @@ void __init mmp2_timer_init(void)
 	clk_rst = APBC_APBCLK | APBC_FNCLK | APBC_FNCLKSEL(1);
 	__raw_writel(clk_rst, APBC_TIMERS);
 
-	timer_init(IRQ_MMP2_TIMER1, 6500000);
+	mmp_timer_init(IRQ_MMP2_TIMER1, 6500000);
 }
 
 /* on-chip devices */

arch/arm/mach-mmp/pxa168.c +1 -1

index 77a358165a56..cdcf65ace3f9 100644
@@ -79,7 +79,7 @@ void __init pxa168_timer_init(void)
 	/* 3.25MHz, bus/functional clock enabled, release reset */
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA168_TIMER1, 6500000);
+	mmp_timer_init(IRQ_PXA168_TIMER1, 3250000);
 }
 
 void pxa168_clear_keypad_wakeup(void)

arch/arm/mach-mmp/pxa910.c +1 -1

index 1ccbba9ac495..d30a7d12bc98 100644
@@ -116,7 +116,7 @@ void __init pxa910_timer_init(void)
 	__raw_writel(APBC_APBCLK | APBC_RST, APBC_TIMERS);
 	__raw_writel(TIMER_CLK_RST, APBC_TIMERS);
 
-	timer_init(IRQ_PXA910_AP1_TIMER1);
+	mmp_timer_init(IRQ_PXA910_AP1_TIMER1, 3250000);
 }
 
 /* on-chip devices */

arch/arm/mach-mmp/time.c +2 -2

index eab0fd8a7343..f9c295154b94 100644
@@ -184,7 +184,7 @@ static struct irqaction timer_irq = {
 	.dev_id		= &ckevt,
 };
 
-void __init timer_init(int irq, unsigned long rate)
+void __init mmp_timer_init(int irq, unsigned long rate)
 {
 	timer_config();

@@ -239,7 +239,7 @@ void __init mmp_dt_init_timer(void)
 		ret = -ENOMEM;
 		goto out;
 	}
-	timer_init(irq, rate);
+	mmp_timer_init(irq, rate);
 	return;
 out:
 	pr_err("Failed to get timer from device tree with error:%d\n", ret);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #181 lore raw

PATCH 165/352 fix dma-buf/udmabuf selftest

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6edf2e3710f4ef2555ad7a2681dbeb4a69092b2d ]

This patch fixes the udmabuf selftest. Currently the selftest is broken. I fixed the selftest by setting the F_SEAL_SHRINK seal on the memfd file descriptor which is required by udmabuf and added the test to the selftest Makefile.

Signed-off-by Tom Murphy <[email protected]>

Reviewed-by Gerd Hoffmann <[email protected]>

Signed-off-by Shuah Khan <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/testing/selftests/Makefile                  |  1 +
 tools/testing/selftests/drivers/dma-buf/Makefile  |  2 ++
 tools/testing/selftests/drivers/dma-buf/udmabuf.c | 11 +++++++++--
 3 files changed, 12 insertions(+), 2 deletions(-)

tools/testing/selftests/Makefile +1 -0

index f0017c831e57..a43a07a09a98 100644
@@ -6,6 +6,7 @@ TARGETS += capabilities
 TARGETS += cgroup
 TARGETS += cpufreq
 TARGETS += cpu-hotplug
+TARGETS += drivers/dma-buf
 TARGETS += efivarfs
 TARGETS += exec
 TARGETS += filesystems

tools/testing/selftests/drivers/dma-buf/Makefile +2 -0

index 4154c3d7aa58..f22c3f7cf612 100644
@@ -2,4 +2,6 @@ CFLAGS += -I../../../../../usr/include/
 
 TEST_GEN_PROGS := udmabuf
 
+top_srcdir ?=../../../../..
+
 include ../../lib.mk

tools/testing/selftests/drivers/dma-buf/udmabuf.c +9 -2

index 376b1d6730bd..4de902ea14d8 100644
@@ -4,7 +4,7 @@
 #include <unistd.h>
 #include <string.h>
 #include <errno.h>
-#include <fcntl.h>
+#include <linux/fcntl.h>
 #include <malloc.h>
 
 #include <sys/ioctl.h>

@@ -33,12 +33,19 @@ int main(int argc, char *argv[])
 		exit(77);
 	}
 
-	memfd = memfd_create("udmabuf-test", MFD_CLOEXEC);
+	memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
 	if (memfd < 0) {
 		printf("%s: [skip,no-memfd]\n", TEST_PREFIX);
 		exit(77);
 	}
 
+	ret = fcntl(memfd, F_ADD_SEALS, F_SEAL_SHRINK);
+	if (ret < 0) {
+		printf("%s: [skip,fcntl-add-seals]\n", TEST_PREFIX);
+		exit(77);
+	}
+
+
 	size = getpagesize() * NUM_PAGES;
 	ret = ftruncate(memfd, size);
 	if (ret == -1) {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #183 lore raw

PATCH 167/352 f2fs: fix to reorder set_page_dirty and wait_on_page_writeback

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8d64d365aed355b2e2465d19ba61df02462fff4d ]

This patch reorders flow from

- update page
- set_page_dirty
- wait_on_page_writeback

- wait_on_page_writeback
- update page
- set_page_dirty

The reason is:
- set_page_dirty will increase reference of dirty page, the reference should be cleared before wait_on_page_writeback to keep its consistency.
- some devices need stable page during page writebacking, so we should not change page's data.

Signed-off-by Chao Yu <[email protected]>

Signed-off-by Jaegeuk Kim <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/f2fs/checkpoint.c | 7 ++++---
 fs/f2fs/gc.c         | 5 +++--
 fs/f2fs/node.c       | 5 +++--
 fs/f2fs/segment.c    | 3 ++-
 4 files changed, 12 insertions(+), 8 deletions(-)

fs/f2fs/checkpoint.c +4 -3

index 9c28ea439e0b..e5719fcac47d 100644
@@ -1290,11 +1290,12 @@ static void commit_checkpoint(struct f2fs_sb_info *sbi,
 	struct page *page = f2fs_grab_meta_page(sbi, blk_addr);
 	int err;
 
-	memcpy(page_address(page), src, PAGE_SIZE);
-	set_page_dirty(page);
-
 	f2fs_wait_on_page_writeback(page, META, true);
 	f2fs_bug_on(sbi, PageWriteback(page));
+
+	memcpy(page_address(page), src, PAGE_SIZE);
+
+	set_page_dirty(page);
 	if (unlikely(!clear_page_dirty_for_io(page)))
 		f2fs_bug_on(sbi, 1);

fs/f2fs/gc.c +3 -2

index c96e7c6354ef..74f72dccab57 100644
@@ -812,8 +812,8 @@ static int move_data_block(struct inode *inode, block_t bidx,
 	}
 
 write_page:
-	set_page_dirty(fio.encrypted_page);
 	f2fs_wait_on_page_writeback(fio.encrypted_page, DATA, true);
+	set_page_dirty(fio.encrypted_page);
 	if (clear_page_dirty_for_io(fio.encrypted_page))
 		dec_page_count(fio.sbi, F2FS_DIRTY_META);

@@ -907,8 +907,9 @@ static int move_data_page(struct inode *inode, block_t bidx, int gc_type,
 		bool is_dirty = PageDirty(page);
 
 retry:
-		set_page_dirty(page);
 		f2fs_wait_on_page_writeback(page, DATA, true);
+
+		set_page_dirty(page);
 		if (clear_page_dirty_for_io(page)) {
 			inode_dec_dirty_pages(inode);
 			f2fs_remove_dirty_inode(inode);

fs/f2fs/node.c +3 -2

index 88be946dedd4..33fb3f8aeafa 100644
@@ -1598,10 +1598,11 @@ int f2fs_move_node_page(struct page *node_page, int gc_type)
 			.for_reclaim = 0,
 		};
 
-		set_page_dirty(node_page);
 		f2fs_wait_on_page_writeback(node_page, NODE, true);
-
 		f2fs_bug_on(F2FS_P_SB(node_page), PageWriteback(node_page));
+
+		set_page_dirty(node_page);
+
 		if (!clear_page_dirty_for_io(node_page)) {
 			err = -EAGAIN;
 			goto out_page;

fs/f2fs/segment.c +2 -1

index 6edcf8391dd3..8f3578c5230e 100644
@@ -387,8 +387,9 @@ static int __f2fs_commit_inmem_pages(struct inode *inode)
 		if (page->mapping == inode->i_mapping) {
 			trace_f2fs_commit_inmem_page(page, INMEM);
 
-			set_page_dirty(page);
 			f2fs_wait_on_page_writeback(page, DATA, true);
+
+			set_page_dirty(page);
 			if (clear_page_dirty_for_io(page)) {
 				inode_dec_dirty_pages(inode);
 				f2fs_remove_dirty_inode(inode);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #185 lore raw

PATCH 169/352 tools: bpftool: fix -Wmissing declaration warnings

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c101189bc9680675a2686bafe908015a07a0da51 ]

Help compiler check arguments for several utility functions used to print items to the console by adding the "printf" attribute when declaring those functions.

Also, declare as "static" two functions that are only used in prog.c.

All of them discovered by compiling bpftool with -Wmissing-format-attribute -Wmissing-declarations.

Signed-off-by Quentin Monnet <[email protected]>

Reviewed-by Jakub Kicinski <[email protected]>

Signed-off-by Daniel Borkmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/bpf/bpftool/common.c        | 4 ++--
 tools/bpf/bpftool/json_writer.c   | 6 ++++--
 tools/bpf/bpftool/prog.c          | 4 ++--
 tools/bpf/bpftool/xlated_dumper.c | 7 ++++---
 4 files changed, 12 insertions(+), 9 deletions(-)

tools/bpf/bpftool/common.c +2 -2

index 70fd48d79f61..05d715e6b128 100644
@@ -58,7 +58,7 @@
 #define BPF_FS_MAGIC		0xcafe4a11
 #endif
 
-void p_err(const char *fmt, ...)
+void __printf(1, 2) p_err(const char *fmt, ...)
 {
 	va_list ap;

@@ -76,7 +76,7 @@ void p_err(const char *fmt, ...)
 	va_end(ap);
 }
 
-void p_info(const char *fmt, ...)
+void __printf(1, 2) p_info(const char *fmt, ...)
 {
 	va_list ap;

tools/bpf/bpftool/json_writer.c +4 -2

index c6eef76322ae..4e4149421d07 100644
@@ -19,6 +19,7 @@
 #include <malloc.h>
 #include <inttypes.h>
 #include <stdint.h>
+#include <linux/compiler.h>
 
 #include "json_writer.h"

@@ -156,7 +157,8 @@ void jsonw_name(json_writer_t *self, const char *name)
 		putc(' ', self->out);
 }
 
-void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
+void __printf(2, 0)
+jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
 {
 	jsonw_eor(self);
 	putc('"', self->out);

@@ -164,7 +166,7 @@ void jsonw_vprintf_enquote(json_writer_t *self, const char *fmt, va_list ap)
 	putc('"', self->out);
 }
 
-void jsonw_printf(json_writer_t *self, const char *fmt, ...)
+void __printf(2, 3) jsonw_printf(json_writer_t *self, const char *fmt, ...)
 {
 	va_list ap;

tools/bpf/bpftool/prog.c +2 -2

index ccee180dfb76..69b01a6158bd 100644
@@ -84,7 +84,7 @@ static const char * const attach_type_strings[] = {
 	[__MAX_BPF_ATTACH_TYPE] = NULL,
 };
 
-enum bpf_attach_type parse_attach_type(const char *str)
+static enum bpf_attach_type parse_attach_type(const char *str)
 {
 	enum bpf_attach_type type;

@@ -713,7 +713,7 @@ struct map_replace {
 	char *name;
 };
 
-int map_replace_compar(const void *p1, const void *p2)
+static int map_replace_compar(const void *p1, const void *p2)
 {
 	const struct map_replace *a = p1, *b = p2;

tools/bpf/bpftool/xlated_dumper.c +4 -3

index 3284759df98a..98083e4dc0f9 100644
@@ -114,7 +114,7 @@ struct kernel_sym *kernel_syms_search(struct dump_data *dd,
 		       sizeof(*dd->sym_mapping), kernel_syms_cmp) : NULL;
 }
 
-static void print_insn(void *private_data, const char *fmt, ...)
+static void __printf(2, 3) print_insn(void *private_data, const char *fmt, ...)
 {
 	va_list args;

@@ -123,7 +123,7 @@ static void print_insn(void *private_data, const char *fmt, ...)
 	va_end(args);
 }
 
-static void
+static void __printf(2, 3)
 print_insn_for_graph(void *private_data, const char *fmt, ...)
 {
 	char buf[64], *p;

@@ -154,7 +154,8 @@ print_insn_for_graph(void *private_data, const char *fmt, ...)
 	printf("%s", buf);
 }
 
-static void print_insn_json(void *private_data, const char *fmt, ...)
+static void __printf(2, 3)
+print_insn_json(void *private_data, const char *fmt, ...)
 {
 	unsigned int l = strlen(fmt);
 	char chomped_fmt[l];

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:28 UTC #186 lore raw

PATCH 170/352 KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 693ac10a88a2219bde553b2e8460dbec97e594e6 ]

The kvm capability KVM_CAP_SPAPR_TCE_VFIO is used to indicate the availability of in kernel tce acceleration for vfio. However it is currently the case that this is only available on a powernv machine, not for a pseries machine.

Thus make this capability dependent on having the cpu feature CPU_FTR_HVMODE.

[[email protected] - fixed compilation for Book E.]

Signed-off-by Suraj Jitindar Singh <[email protected]>

Signed-off-by Paul Mackerras <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 arch/powerpc/kvm/powerpc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

arch/powerpc/kvm/powerpc.c +4 -1

index 2869a299c4ed..75e2e471442f 100644
@@ -543,8 +543,11 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
 #ifdef CONFIG_PPC_BOOK3S_64
 	case KVM_CAP_SPAPR_TCE:
 	case KVM_CAP_SPAPR_TCE_64:
-		/* fallthrough */
+		r = 1;
+		break;
 	case KVM_CAP_SPAPR_TCE_VFIO:
+		r = !!cpu_has_feature(CPU_FTR_HVMODE);
+		break;
 	case KVM_CAP_PPC_RTAS:
 	case KVM_CAP_PPC_FIXUP_HCALL:
 	case KVM_CAP_PPC_ENABLE_HCALL:

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #161 lore raw

PATCH 145/352 sata_rcar: fix deferred probing

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 9f83cfdb1ace3ef268ecc6fda50058d2ec37d603 ]

The driver overrides the error codes returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe permanently instead of the deferred probing. Switch to propagating the error code upstream, still checking/overriding IRQ0 as libata regards it as "no IRQ" (thus polling) anyway...

Fixes 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq")

Reviewed-by Simon Horman <[email protected]>

Reviewed-by Geert Uytterhoeven <[email protected]>

Signed-off-by Sergei Shtylyov <[email protected]>

Signed-off-by Jens Axboe <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/ata/sata_rcar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/ata/sata_rcar.c +3 -1

index 4b1ff5bc256a..59b2317acea9 100644
@@ -891,7 +891,9 @@ static int sata_rcar_probe(struct platform_device *pdev)
 	int ret = 0;
 
 	irq = platform_get_irq(pdev, 0);
-	if (irq <= 0)
+	if (irq < 0)
+		return irq;
+	if (!irq)
 		return -EINVAL;
 
 	priv = devm_kzalloc(dev, sizeof(struct sata_rcar_priv), GFP_KERNEL);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #188 lore raw

PATCH 172/352 mmc: bcm2835: reset host on timeout

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit f6000a4eb34e6462bc0dd39809c1bb99f9633269 ]

The bcm2835 mmc host tends to lock up for unknown reason so reset it on timeout. The upper mmc block layer tries retransimitting with single blocks which tends to work out after a long wait.

This is better than giving up and leaving the machine broken for no obvious reason.

Fixes 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.")

Signed-off-by Michal Suchanek <[email protected]>

Signed-off-by Stefan Wahren <[email protected]>

Acked-by Eric Anholt <[email protected]>

Signed-off-by Ulf Hansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/mmc/host/bcm2835.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/mmc/host/bcm2835.c +3 -0

index abf1f3c8b0c3..5301302fb531 100644
@@ -286,6 +286,7 @@ static void bcm2835_reset(struct mmc_host *mmc)
 
 	if (host->dma_chan)
 		dmaengine_terminate_sync(host->dma_chan);
+	host->dma_chan = NULL;
 	bcm2835_reset_internal(host);
 }

@@ -846,6 +847,8 @@ static void bcm2835_timeout(struct work_struct *work)
 		dev_err(dev, "timeout waiting for hardware interrupt.\n");
 		bcm2835_dumpregs(host);
 
+		bcm2835_reset(host->mmc);
+
 		if (host->data) {
 			host->data->error = -ETIMEDOUT;
 			bcm2835_finish_data(host);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #190 lore raw

PATCH 174/352 memstick: Prevent memstick host from getting runtime suspended during card detection

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit e03e303edf1c63e6dd455ccd568c74e93ef3ba8c ]

We can use MEMSTICK_POWER_{ON,OFF} along with pm_runtime_{get,put} helpers to let memstick host support runtime pm.

The rpm count may go down to zero before the memstick host powers on, so the host can be runtime suspended.

So before doing card detection, increment the rpm count to avoid the host gets runtime suspended. Balance the rpm count after card detection is done.

Signed-off-by Kai-Heng Feng <[email protected]>

Tested-by Oleksandr Natalenko <[email protected]>

Signed-off-by Ulf Hansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/memstick/core/memstick.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/memstick/core/memstick.c +3 -0

index 76382c858c35..1246d69ba187 100644
@@ -18,6 +18,7 @@
 #include <linux/delay.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/pm_runtime.h>
 
 #define DRIVER_NAME "memstick"

@@ -436,6 +437,7 @@ static void memstick_check(struct work_struct *work)
 	struct memstick_dev *card;
 
 	dev_dbg(&host->dev, "memstick_check started\n");
+	pm_runtime_get_noresume(host->dev.parent);
 	mutex_lock(&host->lock);
 	if (!host->card) {
 		if (memstick_power_on(host))

@@ -479,6 +481,7 @@ out_power_off:
 		host->set_param(host, MEMSTICK_POWER, MEMSTICK_POWER_OFF);
 
 	mutex_unlock(&host->lock);
+	pm_runtime_put(host->dev.parent);
 	dev_dbg(&host->dev, "memstick_check finished\n");
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #189 lore raw

PATCH 173/352 mmc: meson-mx-sdio: check devm_kasprintf for failure

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit b0d06f1cb0e2079a3c64fb6e27c19d9a55c723a1 ]

devm_kasprintf() may return NULL on failure of internal allocation thus the assignments to init.name are not safe if not checked. On error meson_mx_mmc_register_clks() returns negative values so -ENOMEM in the (unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by Nicholas Mc Guire <[email protected]>

Fixes ed80a13bb4c4 ("mmc: meson-mx-sdio: Add a driver for the Amlogic Meson8 and Meson8b SoCs")

Acked-by Martin Blumenstingl <[email protected]>

Signed-off-by Ulf Hansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/mmc/host/meson-mx-sdio.c | 6 ++++++
 1 file changed, 6 insertions(+)

drivers/mmc/host/meson-mx-sdio.c +6 -0

index abe253c262a2..ec980bda071c 100644
@@ -596,6 +596,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
 	init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
 				   "%s#fixed_factor",
 				   dev_name(host->controller_dev));
+	if (!init.name)
+		return -ENOMEM;
+
 	init.ops = &clk_fixed_factor_ops;
 	init.flags = 0;
 	init.parent_names = &clk_fixed_factor_parent;

@@ -612,6 +615,9 @@ static int meson_mx_mmc_register_clks(struct meson_mx_mmc_host *host)
 	clk_div_parent = __clk_get_name(host->fixed_factor_clk);
 	init.name = devm_kasprintf(host->controller_dev, GFP_KERNEL,
 				   "%s#div", dev_name(host->controller_dev));
+	if (!init.name)
+		return -ENOMEM;
+
 	init.ops = &clk_divider_ops;
 	init.flags = CLK_SET_RATE_PARENT;
 	init.parent_names = &clk_div_parent;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #162 lore raw

PATCH 146/352 clk: imx6sl: ensure MMDC CH0 handshake is bypassed

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0efcc2c0fd2001a83240a8c3d71f67770484917e ]

Same as other i.MX6 SoCs, ensure unused MMDC channel's handshake is bypassed, this is to make sure no request signal will be generated when periphe_clk_sel is changed or SRC warm reset is triggered.

Signed-off-by Anson Huang <[email protected]>

Signed-off-by Stephen Boyd <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/clk/imx/clk-imx6sl.c | 6 ++++++
 1 file changed, 6 insertions(+)

drivers/clk/imx/clk-imx6sl.c +6 -0

index 6fcfbbd907a5..e13d8814cfa4 100644
@@ -17,6 +17,8 @@
 
 #include "clk.h"
 
+#define CCDR				0x4
+#define BM_CCM_CCDR_MMDC_CH0_MASK	(1 << 17)
 #define CCSR			0xc
 #define BM_CCSR_PLL1_SW_CLK_SEL	(1 << 2)
 #define CACRR			0x10

@@ -411,6 +413,10 @@ static void __init imx6sl_clocks_init(struct device_node *ccm_node)
 	clks[IMX6SL_CLK_USDHC3]       = imx_clk_gate2("usdhc3",       "usdhc3_podf",       base + 0x80, 6);
 	clks[IMX6SL_CLK_USDHC4]       = imx_clk_gate2("usdhc4",       "usdhc4_podf",       base + 0x80, 8);
 
+	/* Ensure the MMDC CH0 handshake is bypassed */
+	writel_relaxed(readl_relaxed(base + CCDR) |
+		BM_CCM_CCDR_MMDC_CH0_MASK, base + CCDR);
+
 	imx_check_clocks(clks, ARRAY_SIZE(clks));
 
 	clk_data.clks = clks;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #163 lore raw

PATCH 147/352 platform/x86: mlx-platform: Fix tachometer registers

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit edd45cba5ed7f53974475ddc9a1453c2c87b3328 ]

Shift by one the registers for tachometers (7 - 12).

This fix is relevant for the same new systems MQMB7, MSN37, MSN34, which are about to be released to the customers.
At the moment, none of them is at customers sites. The customers will not suffer from this change.
This fix is necessary, because register used before for tachometer 7 has been than reserved for the second PWM for newer systems, which are not supported yet in mlx-platform driver. So registers of tachometers 7-12 have been shifted by one.

Fixes 0378123c5800 ("platform/x86: mlx-platform: Add mlxreg-fan platform driver activation")

Signed-off-by Vadim Pasternak <[email protected]>

Signed-off-by Darren Hart (VMware) <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/platform/x86/mlx-platform.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

drivers/platform/x86/mlx-platform.c +6 -6

index c2c3a1a19879..14f88bfabd5d 100644
@@ -83,12 +83,12 @@
 #define MLXPLAT_CPLD_LPC_REG_TACHO4_OFFSET	0xe7
 #define MLXPLAT_CPLD_LPC_REG_TACHO5_OFFSET	0xe8
 #define MLXPLAT_CPLD_LPC_REG_TACHO6_OFFSET	0xe9
-#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET	0xea
-#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET	0xeb
-#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET	0xec
-#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET	0xed
-#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET	0xee
-#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET	0xef
+#define MLXPLAT_CPLD_LPC_REG_TACHO7_OFFSET	0xeb
+#define MLXPLAT_CPLD_LPC_REG_TACHO8_OFFSET	0xec
+#define MLXPLAT_CPLD_LPC_REG_TACHO9_OFFSET	0xed
+#define MLXPLAT_CPLD_LPC_REG_TACHO10_OFFSET	0xee
+#define MLXPLAT_CPLD_LPC_REG_TACHO11_OFFSET	0xef
+#define MLXPLAT_CPLD_LPC_REG_TACHO12_OFFSET	0xf0
 #define MLXPLAT_CPLD_LPC_IO_RANGE		0x100
 #define MLXPLAT_CPLD_LPC_I2C_CH1_OFF		0xdb
 #define MLXPLAT_CPLD_LPC_I2C_CH2_OFF		0xda

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #164 lore raw

PATCH 148/352 cpuidle: big.LITTLE: fix refcount leak

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 9456823c842f346c74265fcd98d008d87a7eb6f5 ]

of_find_node_by_path() acquires a reference to the node returned by it and that reference needs to be dropped by its caller. bl_idle_init() doesn't do that, so fix it.

Signed-off-by Yangtao Li <[email protected]>

Acked-by Daniel Lezcano <[email protected]>

Signed-off-by Rafael J. Wysocki <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/cpuidle/cpuidle-big_little.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

drivers/cpuidle/cpuidle-big_little.c +6 -1

index db2ede565f1a..b44476a1b7ad 100644
@@ -167,6 +167,7 @@ static int __init bl_idle_init(void)
 {
 	int ret;
 	struct device_node *root = of_find_node_by_path("/");
+	const struct of_device_id *match_id;
 
 	if (!root)
 		return -ENODEV;

@@ -174,7 +175,11 @@ static int __init bl_idle_init(void)
 	/*
 	 * Initialize the driver just for a compliant set of machines
 	 */
-	if (!of_match_node(compatible_machine_match, root))
+	match_id = of_match_node(compatible_machine_match, root);
+
+	of_node_put(root);
+
+	if (!match_id)
 		return -ENODEV;
 
 	if (!mcpm_is_available())

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #165 lore raw

PATCH 149/352 OPP: Use opp_table->regulators to verify no regulator case

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 90e3577b5feb42bac1269e16bb3d2bdd8f6df40f ]

The value of opp_table->regulator_count is not very consistent right now and it may end up being 0 while we do have a "opp-microvolt" property in the OPP table. It was kept that way as we used to check if any regulators are set with the OPP core for a device or not using value of regulator_count.

Lets use opp_table->regulators for that purpose as the meaning of regulator_count is going to change in the later patches.

Reported-by Quentin Perret <[email protected]>

Signed-off-by Viresh Kumar <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/opp/core.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

drivers/opp/core.c +7 -4

index 9280f51f1ce6..82baed4b80d4 100644
@@ -196,12 +196,12 @@ unsigned long dev_pm_opp_get_max_volt_latency(struct device *dev)
 	if (IS_ERR(opp_table))
 		return 0;
 
-	count = opp_table->regulator_count;
-
 	/* Regulator may not be required for the device */
-	if (!count)
+	if (!opp_table->regulators)
 		goto put_opp_table;
 
+	count = opp_table->regulator_count;
+
 	uV = kmalloc_array(count, sizeof(*uV), GFP_KERNEL);
 	if (!uV)
 		goto put_opp_table;

@@ -1102,6 +1102,9 @@ static bool _opp_supported_by_regulators(struct dev_pm_opp *opp,
 	struct regulator *reg;
 	int i;
 
+	if (!opp_table->regulators)
+		return true;
+
 	for (i = 0; i < opp_table->regulator_count; i++) {
 		reg = opp_table->regulators[i];

@@ -1386,7 +1389,7 @@ static int _allocate_set_opp_data(struct opp_table *opp_table)
 	struct dev_pm_set_opp_data *data;
 	int len, count = opp_table->regulator_count;
 
-	if (WARN_ON(!count))
+	if (WARN_ON(!opp_table->regulators))
 		return -EINVAL;
 
 	/* space for set_opp_data */

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #167 lore raw

PATCH 151/352 drm/msm/dsi: fix dsi clock names in DSI 10nm PLL driver

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit c1866d44d149a1ea5c303632114fb6aa08cfd263 ]

Fix the dsi clock names in the DSI 10nm PLL driver to match the names in the dispcc driver as those are according to the clock plan of the chipset.

Changes in v2:
- Update the clock diagram with the new clock name

Reviewed-by Sean Paul <[email protected]>

Signed-off-by Abhinav Kumar <[email protected]>

Signed-off-by Sean Paul <[email protected]>

Signed-off-by Rob Clark <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +4 -4

index 41bec570c518..31205625c734 100644
@@ -17,7 +17,7 @@
  *                              |                |
  *                              |                |
  *                 +---------+  |  +----------+  |  +----+
- *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0pllbyte
+ *  dsi0vco_clk ---| out_div |--o--| divl_3_0 |--o--| /8 |-- dsi0_phy_pll_out_byteclk
  *                 +---------+  |  +----------+  |  +----+
  *                              |                |
  *                              |                |         dsi0_pll_by_2_bit_clk

@@ -25,7 +25,7 @@
  *                              |                |  +----+  |  |\  dsi0_pclk_mux
  *                              |                |--| /2 |--o--| \   |
  *                              |                |  +----+     |  \  |  +---------+
- *                              |                --------------|  |--o--| div_7_4 |-- dsi0pll
+ *                              |                --------------|  |--o--| div_7_4 |-- dsi0_phy_pll_out_dsiclk
  *                              |------------------------------|  /     +---------+
  *                              |          +-----+             | /
  *                              -----------| /4? |--o----------|/

@@ -690,7 +690,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
 
 	hws[num++] = hw;
 
-	snprintf(clk_name, 32, "dsi%dpllbyte", pll_10nm->id);
+	snprintf(clk_name, 32, "dsi%d_phy_pll_out_byteclk", pll_10nm->id);
 	snprintf(parent, 32, "dsi%d_pll_bit_clk", pll_10nm->id);
 
 	/* DSI Byte clock = VCO_CLK / OUT_DIV / BIT_DIV / 8 */

@@ -739,7 +739,7 @@ static int pll_10nm_register(struct dsi_pll_10nm *pll_10nm)
 
 	hws[num++] = hw;
 
-	snprintf(clk_name, 32, "dsi%dpll", pll_10nm->id);
+	snprintf(clk_name, 32, "dsi%d_phy_pll_out_dsiclk", pll_10nm->id);
 	snprintf(parent, 32, "dsi%d_pclk_mux", pll_10nm->id);
 
 	/* PIX CLK DIV : DIV_CTRL_7_4*/

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #158 lore raw

PATCH 142/352 iommu/arm-smmu-v3: Avoid memory corruption from Hisilicon MSI payloads

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 84a9a75774961612d0c7dd34a1777e8f98a65abd ]

The GITS_TRANSLATER MMIO doorbell register in the ITS hardware is architected to be 4 bytes in size, yet on hi1620 and earlier, Hisilicon have allocated the adjacent 4 bytes to carry some IMPDEF sideband information which results in an 8-byte MSI payload being delivered when signalling an interrupt:

MSIAddr:

	 |----4bytes----|----4bytes----|
	 |    MSIData   |    IMPDEF    |

This poses no problem for the ITS hardware because the adjacent 4 bytes are reserved in the memory map. However, when delivering MSIs to memory, as we do in the SMMUv3 driver for signalling the completion of a SYNC command, the extended payload will corrupt the 4 bytes adjacent to the "sync_count" member in struct arm_smmu_device. Fortunately, the current layout allocates these bytes to padding, but this is fragile and we should make this explicit.

Reviewed-by Robin Murphy <[email protected]>

Signed-off-by Zhen Lei <[email protected]>

[will: Rewrote commit message and comment]

Signed-off-by Will Deacon <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/iommu/arm-smmu-v3.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

drivers/iommu/arm-smmu-v3.c +5 -1

index 71eda422c926..62ef4afc9ee5 100644
@@ -576,7 +576,11 @@ struct arm_smmu_device {
 
 	struct arm_smmu_strtab_cfg	strtab_cfg;
 
-	u32				sync_count;
+	/* Hi16xx adds an extra 32 bits of goodness to its MSI payload */
+	union {
+		u32			sync_count;
+		u64			padding;
+	};
 
 	/* IOMMU core code handle */
 	struct iommu_device		iommu;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #202 lore raw

PATCH 186/352 perf test: Fix perf_event_attr test failure

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 741dad88dde296999da30332157ca47f0543747d ]

Fix inconsistent use of tabs and spaces error:

  # perf test 16 -v
  16: Setup struct perf_event_attr                          :
  --- start ---
  test child forked, pid 20224
    File "/usr/libexec/perf-core/tests/attr.py", line 119
      log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
                                                                 ^
  TabError: inconsistent use of tabs and spaces in indentation
  test child finished with -1
  ---- end ----
  Setup struct perf_event_attr: FAILED!

Signed-off-by Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Link http://lkml.kernel.org/r/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/tests/attr.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/tests/attr.py +1 -1

index ff9b60b99f52..44090a9a19f3 100644
@@ -116,7 +116,7 @@ class Event(dict):
             if not self.has_key(t) or not other.has_key(t):
                 continue
             if not data_equal(self[t], other[t]):
-		log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
+                log.warning("expected %s=%s, got %s" % (t, self[t], other[t]))
 
 # Test file description needs to have following sections:
 # [config]

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #204 lore raw

PATCH 188/352 perf header: Fix unchecked usage of strncpy()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 7572588085a13d5db02bf159542189f52fdb507e ]

The strncpy() function may leave the destination string buffer unterminated, better use strlcpy() that we have a __weak fallback implementation for systems without it.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

util/header.c: In function 'perf_event__synthesize_event_update_unit':
util/header.c:3586:2: error: 'strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Werror=stringop-truncation]

    strncpy(ev->data, evsel->unit, size);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  util/header.c:3579:16: note: length computed here
    size_t size = strlen(evsel->unit);
                  ^~~~~~~~~~~~~~~~~~~

Cc Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Namhyung Kim <[email protected]>

Fixes a6e5281780d1 ("perf tools: Add event_update event unit type")

Link https://lkml.kernel.org/n/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/util/header.c +1 -1

index 4fd45be95a43..13a2251a37c5 100644
@@ -3544,7 +3544,7 @@ perf_event__synthesize_event_update_unit(struct perf_tool *tool,
 	if (ev == NULL)
 		return -ENOMEM;
 
-	strncpy(ev->data, evsel->unit, size);
+	strlcpy(ev->data, evsel->unit, size + 1);
 	err = process(tool, (union perf_event *)ev, NULL, NULL);
 	free(ev);
 	return err;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #203 lore raw

PATCH 187/352 perf dso: Fix unchecked usage of strncpy()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit fca5085c15255bbde203b7322c15f07ebb12f63e ]

The strncpy() function may leave the destination string buffer unterminated, better use strlcpy() that we have a __weak fallback implementation for systems without it.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

In function 'decompress_kmodule',
inlined from 'dso__decompress_kmodule_fd' at util/dso.c:305:9:
util/dso.c:298:3: error: 'strncpy' destination unchanged after copying no bytes [-Werror=stringop-truncation]

     strncpy(pathname, tmpbuf, len);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    CC       /tmp/build/perf/util/values.o
    CC       /tmp/build/perf/util/debug.o

cc1: all warnings being treated as errors

Cc Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Namhyung Kim <[email protected]>

Fixes c9a8a6131fb6 ("perf tools: Move the temp file processing into decompress_kmodule")

Link https://lkml.kernel.org/n/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/util/dso.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/util/dso.c +1 -1

index bbed90e5d9bb..cee717a3794f 100644
@@ -295,7 +295,7 @@ static int decompress_kmodule(struct dso *dso, const char *name,
 		unlink(tmpbuf);
 
 	if (pathname && (fd >= 0))
-		strncpy(pathname, tmpbuf, len);
+		strlcpy(pathname, tmpbuf, len);
 
 	return fd;
 }

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #205 lore raw

PATCH 189/352 btrfs: use tagged writepage to mitigate livelock of snapshot

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 3cd24c698004d2f7668e0eb9fc1f096f533c791b ]

Snapshot is expected to be fast. But if there are writers steadily creating dirty pages in our subvolume, the snapshot may take a very long time to complete. To fix the problem, we use tagged writepage for snapshot flusher as we do in the generic write_cache_pages(), so we can omit pages dirtied after the snapshot command.

This does not change the semantics regarding which data get to the snapshot, if there are pages being dirtied during the snapshotting operation. There's a sync called before snapshot is taken in old/new case, any IO in flight just after that may be in the snapshot but this depends on other system effects that might still sync the IO.

We do a simple snapshot speed test on a Intel D-1531 box:

fio --ioengine=libaio --iodepth=32 --bs=4k --rw=write --size=64G --direct=0 --thread=1 --numjobs=1 --time_based --runtime=120 --filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5; time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio

original: 1m58sec
patched:  6.54sec

This is the best case for this patch since for a sequential write case, we omit nearly all pages dirtied after the snapshot command.

For a multi writers, random write test:

fio --ioengine=libaio --iodepth=32 --bs=4k --rw=randwrite --size=64G --direct=0 --thread=1 --numjobs=4 --time_based --runtime=120 --filename=/mnt/sub/testfile --name=job1 --group_reporting & sleep 5; time btrfs sub snap -r /mnt/sub /mnt/snap; killall fio

original: 15.83sec
patched:  10.35sec

The improvement is smaller compared to the sequential write case, since we omit only half of the pages dirtied after snapshot command.

Reviewed-by Nikolay Borisov <[email protected]>

Signed-off-by Ethan Lien <[email protected]>

Reviewed-by David Sterba <[email protected]>

Signed-off-by David Sterba <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/btrfs/btrfs_inode.h |  1 +
 fs/btrfs/ctree.h       |  2 +-
 fs/btrfs/extent_io.c   | 17 +++++++++++++++--
 fs/btrfs/inode.c       | 11 +++++++----
 fs/btrfs/ioctl.c       |  2 +-
 5 files changed, 25 insertions(+), 8 deletions(-)

fs/btrfs/btrfs_inode.h +1 -0

index a0e230b31a88..20288b49718f 100644
@@ -29,6 +29,7 @@ enum {
 	BTRFS_INODE_IN_DELALLOC_LIST,
 	BTRFS_INODE_READDIO_NEED_LOCK,
 	BTRFS_INODE_HAS_PROPS,
+	BTRFS_INODE_SNAPSHOT_FLUSH,
 };
 
 /* in memory btrfs inode */

fs/btrfs/ctree.h +1 -1

index 68f322f600a0..131e90aad941 100644
@@ -3141,7 +3141,7 @@ int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
 			       struct inode *inode, u64 new_size,
 			       u32 min_type);
 
-int btrfs_start_delalloc_inodes(struct btrfs_root *root);
+int btrfs_start_delalloc_snapshot(struct btrfs_root *root);
 int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr);
 int btrfs_set_extent_delalloc(struct inode *inode, u64 start, u64 end,
 			      unsigned int extra_bits,

fs/btrfs/extent_io.c +15 -2

index d228f706ff3e..c8e886caacd7 100644
@@ -3934,12 +3934,25 @@ static int extent_write_cache_pages(struct address_space *mapping,
 			range_whole = 1;
 		scanned = 1;
 	}
-	if (wbc->sync_mode == WB_SYNC_ALL)
+
+	/*
+	 * We do the tagged writepage as long as the snapshot flush bit is set
+	 * and we are the first one who do the filemap_flush() on this inode.
+	 *
+	 * The nr_to_write == LONG_MAX is needed to make sure other flushers do
+	 * not race in and drop the bit.
+	 */
+	if (range_whole && wbc->nr_to_write == LONG_MAX &&
+	    test_and_clear_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
+			       &BTRFS_I(inode)->runtime_flags))
+		wbc->tagged_writepages = 1;
+
+	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag = PAGECACHE_TAG_TOWRITE;
 	else
 		tag = PAGECACHE_TAG_DIRTY;
 retry:
-	if (wbc->sync_mode == WB_SYNC_ALL)
+	if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages)
 		tag_pages_for_writeback(mapping, index, end);
 	done_index = index;
 	while (!done && !nr_to_write_done && (index <= end) &&

fs/btrfs/inode.c +7 -4

index 561bffcb56a0..965a64bde6fd 100644
@@ -9988,7 +9988,7 @@ static struct btrfs_delalloc_work *btrfs_alloc_delalloc_work(struct inode *inode
  * some fairly slow code that needs optimization. This walks the list
  * of all the inodes with pending delalloc and forces them to disk.
  */
-static int start_delalloc_inodes(struct btrfs_root *root, int nr)
+static int start_delalloc_inodes(struct btrfs_root *root, int nr, bool snapshot)
 {
 	struct btrfs_inode *binode;
 	struct inode *inode;

@@ -10016,6 +10016,9 @@ static int start_delalloc_inodes(struct btrfs_root *root, int nr)
 		}
 		spin_unlock(&root->delalloc_lock);
 
+		if (snapshot)
+			set_bit(BTRFS_INODE_SNAPSHOT_FLUSH,
+				&binode->runtime_flags);
 		work = btrfs_alloc_delalloc_work(inode);
 		if (!work) {
 			iput(inode);

@@ -10049,7 +10052,7 @@ out:
 	return ret;
 }
 
-int btrfs_start_delalloc_inodes(struct btrfs_root *root)
+int btrfs_start_delalloc_snapshot(struct btrfs_root *root)
 {
 	struct btrfs_fs_info *fs_info = root->fs_info;
 	int ret;

@@ -10057,7 +10060,7 @@ int btrfs_start_delalloc_inodes(struct btrfs_root *root)
 	if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state))
 		return -EROFS;
 
-	ret = start_delalloc_inodes(root, -1);
+	ret = start_delalloc_inodes(root, -1, true);
 	if (ret > 0)
 		ret = 0;
 	return ret;

@@ -10086,7 +10089,7 @@ int btrfs_start_delalloc_roots(struct btrfs_fs_info *fs_info, int nr)
 			       &fs_info->delalloc_roots);
 		spin_unlock(&fs_info->delalloc_root_lock);
 
-		ret = start_delalloc_inodes(root, nr);
+		ret = start_delalloc_inodes(root, nr, false);
 		btrfs_put_fs_root(root);
 		if (ret < 0)
 			goto out;

fs/btrfs/ioctl.c +1 -1

index 802a628e9f7d..87f4f0f65dbb 100644
@@ -777,7 +777,7 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir,
 	wait_event(root->subv_writers->wait,
 		   percpu_counter_sum(&root->subv_writers->counter) == 0);
 
-	ret = btrfs_start_delalloc_inodes(root);
+	ret = btrfs_start_delalloc_snapshot(root);
 	if (ret)
 		goto dec_and_free;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:29 UTC #206 lore raw

PATCH 190/352 perf probe: Fix unchecked usage of strncpy()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit bef0b8970f27da5ca223e522a174d03e2587761d ]

The strncpy() function may leave the destination string buffer unterminated, better use strlcpy() that we have a __weak fallback implementation for systems without it.

In this case the 'target' buffer is coming from a list of build-ids that are expected to have a len of at most (SBUILD_ID_SIZE - 1) chars, so probably we're safe, but since we're using strncpy() here, use strlcpy() instead to provide the intended safety checking without the using the problematic strncpy() function.

This fixes this warning on an Alpine Linux Edge system with gcc 8.2:

util/probe-file.c: In function 'probe_cache__open.isra.5':
util/probe-file.c:427:3: error: 'strncpy' specified bound 41 equals destination size [-Werror=stringop-truncation]

     strncpy(sbuildid, target, SBUILD_ID_SIZE);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

cc1: all warnings being treated as errors

Cc Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Masami Hiramatsu <[email protected]>

Cc Namhyung Kim <[email protected]>

Fixes 1f3736c9c833 ("perf probe: Show all cached probes")

Link https://lkml.kernel.org/n/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/util/probe-file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/util/probe-file.c +1 -1

index aac7817d9e14..0b1195cad0e5 100644
@@ -424,7 +424,7 @@ static int probe_cache__open(struct probe_cache *pcache, const char *target,
 
 	if (target && build_id_cache__cached(target)) {
 		/* This is a cached buildid */
-		strncpy(sbuildid, target, SBUILD_ID_SIZE);
+		strlcpy(sbuildid, target, SBUILD_ID_SIZE);
 		dir_name = build_id_cache__linkname(sbuildid, NULL, 0);
 		goto found;
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #207 lore raw

PATCH 191/352 i2c: sh_mobile: Add support for r8a774c0 (RZ/G2E)

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 51243b73455f2d12cb82abffa7bc9028aec656e0 ]

Similarly to R-Car E3, RZ/G2E doesn't come with automatic transmission registers, as such it is not considered compatible with the existing fallback bindings.

Add SoC specific binding compatibility to allow for later support for automatic transmission.

Signed-off-by Fabrizio Castro <[email protected]>

Reviewed-by Geert Uytterhoeven <[email protected]>

Reviewed-by Simon Horman <[email protected]>

Signed-off-by Wolfram Sang <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/i2c/busses/i2c-sh_mobile.c | 1 +
 1 file changed, 1 insertion(+)

drivers/i2c/busses/i2c-sh_mobile.c +1 -0

index 28db6b59c4ca..a64f2ff3cb49 100644
@@ -800,6 +800,7 @@ static const struct sh_mobile_dt_config r8a7740_dt_config = {
 static const struct of_device_id sh_mobile_i2c_dt_ids[] = {
 	{ .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config },
+	{ .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config },
 	{ .compatible = "renesas,iic-r8a7791", .data = &fast_clock_dt_config },
 	{ .compatible = "renesas,iic-r8a7792", .data = &fast_clock_dt_config },

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #212 lore raw

PATCH 194/352 tools/power/x86/intel_pstate_tracer: Fix non root execution for post processing a trace file

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 663546903c835fe46308b1b1e53d32d1f2b33da9 ]

This script is supposed to be allowed to run with regular user privileges if a previously captured trace is being post processed.

Commit fbe313884d7d (tools/power/x86/intel_pstate_tracer: Free the trace buffer memory) introduced a bug that breaks that option.

Commit 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional setting of trace buffer memory allocation) moved the code but kept the bug.

This patch fixes the issue.

Fixes 35459105deb2 (tools/power/x86/intel_pstate_tracer: Add optional ...)

Signed-off-by Doug Smythies <[email protected]>

Signed-off-by Rafael J. Wysocki <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py +2 -2

index 84e2b648e622..2fa3c5757bcb 100755
@@ -585,9 +585,9 @@ current_max_cpu = 0
 
 read_trace_data(filename)
 
-clear_trace_file()
-# Free the memory
 if interval:
+    clear_trace_file()
+    # Free the memory
     free_trace_buffer()
 
 if graph_data_present == False:

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #213 lore raw

PATCH 195/352 pinctrl: rza1: Handle devm_kasprintf() failure cases

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit db221412cd2014506642967155698825ad80f6b6 ]

devm_kasprintf() may return NULL on failure of internal allocation thus the assignments are not safe if not checked. On error rza1_pinctrl_register() respectively rza1_parse_gpiochip() return negative values so -ENOMEM in the (unlikely) failure case of devm_kasprintf() should be fine here.

Signed-off-by Nicholas Mc Guire <[email protected]>

Fixes 5a49b644b307 ("pinctrl: Renesas RZ/A1 pin and gpio controller")

Signed-off-by Geert Uytterhoeven <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/pinctrl/pinctrl-rza1.c | 5 +++++
 1 file changed, 5 insertions(+)

drivers/pinctrl/pinctrl-rza1.c +5 -0

index 14eb576c04a2..9cfe9d0520ac 100644
@@ -1225,6 +1225,9 @@ static int rza1_parse_gpiochip(struct rza1_pinctrl *rza1_pctl,
 	chip->base	= -1;
 	chip->label	= devm_kasprintf(rza1_pctl->dev, GFP_KERNEL, "%pOFn",
 					 np);
+	if (!chip->label)
+		return -ENOMEM;
+
 	chip->ngpio	= of_args.args[2];
 	chip->of_node	= np;
 	chip->parent	= rza1_pctl->dev;

@@ -1326,6 +1329,8 @@ static int rza1_pinctrl_register(struct rza1_pinctrl *rza1_pctl)
 		pins[i].number = i;
 		pins[i].name = devm_kasprintf(rza1_pctl->dev, GFP_KERNEL,
 					      "P%u-%u", port, pin);
+		if (!pins[i].name)
+			return -ENOMEM;
 
 		if (i % RZA1_PINS_PER_PORT == 0) {
 			/*

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #194 lore raw

PATCH 178/352 mmc: jz4740: Get CD/WP GPIOs from descriptors

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0c901c0566fb4edc2631c3786e5085a037be91f8 ]

Modifty the JZ4740 driver to retrieve card detect and write protect GPIO pins from GPIO descriptors instead of hard-coded global numbers. Augment the only board file using this in the process and cut down on passed in platform data.

Preserve the code setting the caps2 flags for CD and WP as active low or high since the slot GPIO code currently ignores the gpiolib polarity inversion semantice and uses the raw accessors to read the GPIO lines, but set the right polarity flags in the descriptor table for jz4740.

Cc Paul Cercueil <[email protected]>

Cc [email protected]

Signed-off-by Linus Walleij <[email protected]>

Acked-by Paul Burton <[email protected]>

Signed-off-by Ulf Hansson <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 .../mips/include/asm/mach-jz4740/jz4740_mmc.h |  2 --
 arch/mips/jz4740/board-qi_lb60.c              | 12 ++++++++---
 drivers/mmc/host/jz4740_mmc.c                 | 20 +++++++++----------
 3 files changed, 19 insertions(+), 15 deletions(-)

arch/mips/include/asm/mach-jz4740/jz4740_mmc.h +0 -2

index e9cc62cfac99..ff50aeb1a933 100644
@@ -4,8 +4,6 @@
 
 struct jz4740_mmc_platform_data {
 	int gpio_power;
-	int gpio_card_detect;
-	int gpio_read_only;
 	unsigned card_detect_active_low:1;
 	unsigned read_only_active_low:1;
 	unsigned power_active_low:1;

arch/mips/jz4740/board-qi_lb60.c +9 -3

index af0c8ace0141..705593d40d12 100644
@@ -43,7 +43,6 @@
 #include "clock.h"
 
 /* GPIOs */
-#define QI_LB60_GPIO_SD_CD		JZ_GPIO_PORTD(0)
 #define QI_LB60_GPIO_SD_VCC_EN_N	JZ_GPIO_PORTD(2)
 
 #define QI_LB60_GPIO_KEYOUT(x)		(JZ_GPIO_PORTC(10) + (x))

@@ -386,12 +385,18 @@ static struct platform_device qi_lb60_gpio_keys = {
 };
 
 static struct jz4740_mmc_platform_data qi_lb60_mmc_pdata = {
-	.gpio_card_detect	= QI_LB60_GPIO_SD_CD,
-	.gpio_read_only		= -1,
 	.gpio_power		= QI_LB60_GPIO_SD_VCC_EN_N,
 	.power_active_low	= 1,
 };
 
+static struct gpiod_lookup_table qi_lb60_mmc_gpio_table = {
+	.dev_id = "jz4740-mmc.0",
+	.table = {
+		GPIO_LOOKUP("GPIOD", 0, "cd", GPIO_ACTIVE_HIGH),
+		{ },
+	},
+};
+
 /* beeper */
 static struct pwm_lookup qi_lb60_pwm_lookup[] = {
 	PWM_LOOKUP("jz4740-pwm", 4, "pwm-beeper", NULL, 0,

@@ -500,6 +505,7 @@ static int __init qi_lb60_init_platform_devices(void)
 	gpiod_add_lookup_table(&qi_lb60_audio_gpio_table);
 	gpiod_add_lookup_table(&qi_lb60_nand_gpio_table);
 	gpiod_add_lookup_table(&qi_lb60_spigpio_gpio_table);
+	gpiod_add_lookup_table(&qi_lb60_mmc_gpio_table);
 
 	spi_register_board_info(qi_lb60_spi_board_info,
 				ARRAY_SIZE(qi_lb60_spi_board_info));

drivers/mmc/host/jz4740_mmc.c +10 ~~-10~~

index 0c1efd5100b7..44ea452add8e 100644
@@ -983,17 +983,17 @@ static int jz4740_mmc_request_gpios(struct mmc_host *mmc,
 	if (!pdata->read_only_active_low)
 		mmc->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 
-	if (gpio_is_valid(pdata->gpio_card_detect)) {
-		ret = mmc_gpio_request_cd(mmc, pdata->gpio_card_detect, 0);
-		if (ret)
-			return ret;
-	}
+	/*
+	 * Get optional card detect and write protect GPIOs,
+	 * only back out on probe deferral.
+	 */
+	ret = mmc_gpiod_request_cd(mmc, "cd", 0, false, 0, NULL);
+	if (ret == -EPROBE_DEFER)
+		return ret;
 
-	if (gpio_is_valid(pdata->gpio_read_only)) {
-		ret = mmc_gpio_request_ro(mmc, pdata->gpio_read_only);
-		if (ret)
-			return ret;
-	}
+	ret = mmc_gpiod_request_ro(mmc, "wp", 0, false, 0, NULL);
+	if (ret == -EPROBE_DEFER)
+		return ret;
 
 	return jz4740_mmc_request_gpio(&pdev->dev, pdata->gpio_power,
 			"MMC read only", true, pdata->power_active_low);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #214 lore raw

PATCH 196/352 mac80211: Properly handle SKB with radiotap only

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 8020919a9b99d6c990dc6a50e8215e291fbbe5a6 ]

The monitor interface Rx handling of SKBs that contain only radiotap information was buggy as it tried to access the SKB assuming it contains a frame.

To fix this, check the RX_FLAG_NO_PSDU flag in the Rx status (indicting that the SKB contains only radiotap information), and do not perform data path specific processing when the flag is set.

Signed-off-by Ilan Peer <[email protected]>

Signed-off-by Luca Coelho <[email protected]>

Signed-off-by Johannes Berg <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 net/mac80211/rx.c | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

net/mac80211/rx.c +17 -9

index 428f7ad5f9b5..77d996a60f12 100644
@@ -753,6 +753,7 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 	struct ieee80211_sub_if_data *monitor_sdata =
 		rcu_dereference(local->monitor_sdata);
 	bool only_monitor = false;
+	unsigned int min_head_len;
 
 	if (status->flag & RX_FLAG_RADIOTAP_HE)
 		rtap_space += sizeof(struct ieee80211_radiotap_he);

@@ -766,6 +767,8 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 		rtap_space += sizeof(*rtap) + rtap->len + rtap->pad;
 	}
 
+	min_head_len = rtap_space;
+
 	/*
 	 * First, we may need to make a copy of the skb because
 	 *  (1) we need to modify it for radiotap (if not present), and

@@ -775,18 +778,23 @@ ieee80211_rx_monitor(struct ieee80211_local *local, struct sk_buff *origskb,
 	 * the SKB because it has a bad FCS/PLCP checksum.
 	 */
 
-	if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
-		if (unlikely(origskb->len <= FCS_LEN)) {
-			/* driver bug */
-			WARN_ON(1);
-			dev_kfree_skb(origskb);
-			return NULL;
+	if (!(status->flag & RX_FLAG_NO_PSDU)) {
+		if (ieee80211_hw_check(&local->hw, RX_INCLUDES_FCS)) {
+			if (unlikely(origskb->len <= FCS_LEN + rtap_space)) {
+				/* driver bug */
+				WARN_ON(1);
+				dev_kfree_skb(origskb);
+				return NULL;
+			}
+			present_fcs_len = FCS_LEN;
 		}
-		present_fcs_len = FCS_LEN;
+
+		/* also consider the hdr->frame_control */
+		min_head_len += 2;
 	}
 
-	/* ensure hdr->frame_control and vendor radiotap data are in skb head */
-	if (!pskb_may_pull(origskb, 2 + rtap_space)) {
+	/* ensure that the expected data elements are in skb head */
+	if (!pskb_may_pull(origskb, min_head_len)) {
 		dev_kfree_skb(origskb);
 		return NULL;
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #217 lore raw

PATCH 199/352 usb: musb: dsps: fix otg state machine

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6010abf2c2c0e382d7e8ee44bd11f343aae90cce ]

Due to lack of ID pin interrupt event on AM335x devices, the musb dsps driver uses polling to detect usb device attach for dual-role port.

But in the case if a micro-A cable adapter is attached without a USB device attached to the cable, the musb state machine gets stuck in a_wait_vrise state waiting for the MUSB_CONNECT interrupt which won't happen due to the usb device is not attached. The state is stuck in a_wait_vrise even after the micro-A cable is detached, which could cause VBUS retention if then the dual-role port is attached to a host port.

To fix the problem, make a_wait_vrise as a transient state, then move the state to either a_wait_bcon for host port or a_idle state for dual-role port, if no usb device is attached to the port.

Signed-off-by Bin Liu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/musb/musb_dsps.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

drivers/usb/musb/musb_dsps.c +7 -2

index 23a0df79ef21..1e6d78b1334e 100644
@@ -227,8 +227,13 @@ static int dsps_check_status(struct musb *musb, void *unused)
 
 	switch (musb->xceiv->otg->state) {
 	case OTG_STATE_A_WAIT_VRISE:
-		dsps_mod_timer_optional(glue);
-		break;
+		if (musb->port_mode == MUSB_HOST) {
+			musb->xceiv->otg->state = OTG_STATE_A_WAIT_BCON;
+			dsps_mod_timer_optional(glue);
+			break;
+		}
+		/* fall through */
+
 	case OTG_STATE_A_WAIT_BCON:
 		/* keep VBUS on for host-only mode */
 		if (musb->port_mode == MUSB_HOST) {

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #218 lore raw

PATCH 200/352 usb: musb: dsps: fix runtime pm for peripheral mode

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 54578ee883e34d2d1c518d48f1c1e2dd3f387188 ]

Since the runtime PM support was added in musb, dsps relies on the timer calling otg_timer() to activate the usb subsystem. However the driver doesn't enable the timer for peripheral port, then the peripheral port is unable to be enumerated by a host if the other usb port is disabled or in peripheral mode too.

So let's start the timer for peripheral port too.

Fixes ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")

Acked-by Tony Lindgren <[email protected]>

Signed-off-by Bin Liu <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/musb/musb_dsps.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

drivers/usb/musb/musb_dsps.c +9 -3

index 1e6d78b1334e..403eb97915f8 100644
@@ -181,9 +181,11 @@ static void dsps_musb_enable(struct musb *musb)
 
 	musb_writel(reg_base, wrp->epintr_set, epmask);
 	musb_writel(reg_base, wrp->coreintr_set, coremask);
-	/* start polling for ID change in dual-role idle mode */
-	if (musb->xceiv->otg->state == OTG_STATE_B_IDLE &&
-			musb->port_mode == MUSB_OTG)
+	/*
+	 * start polling for runtime PM active and idle,
+	 * and for ID change in dual-role idle mode.
+	 */
+	if (musb->xceiv->otg->state == OTG_STATE_B_IDLE)
 		dsps_mod_timer(glue, -1);
 }

@@ -254,6 +256,10 @@ static int dsps_check_status(struct musb *musb, void *unused)
 				musb->xceiv->otg->state = OTG_STATE_A_IDLE;
 				MUSB_HST_MODE(musb);
 			}
+
+			if (musb->port_mode == MUSB_PERIPHERAL)
+				skip_session = 1;
+
 			if (!(devctl & MUSB_DEVCTL_SESSION) && !skip_session)
 				musb_writeb(mregs, MUSB_DEVCTL,
 					    MUSB_DEVCTL_SESSION);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #219 lore raw

PATCH 201/352 perf header: Fix up argument to ctime()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0afcf29bab35d3785204cd9bd51693b231ad7181 ]

Reducing this noise when cross building to the Android NDK:

util/header.c: In function 'perf_header__fprintf_info':
util/header.c:2710:45: warning: pointer targets in passing argument 1 of 'ctime' differ in signedness [-Wpointer-sign]

    fprintf(fp, "# captured on    : %s", ctime(&st.st_ctime));
                                               ^
  In file included from util/../perf.h:5:0,
                   from util/evlist.h:11,
                   from util/header.c:22:
  /opt/android-ndk-r15c/platforms/android-26/arch-arm/usr/include/time.h:81:14: note: expected 'const time_t *' but argument is of type 'long unsigned int *'
   extern char* ctime(const time_t*) __LIBC_ABI_PUBLIC__;
                ^

Cc Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Namhyung Kim <[email protected]>

Link https://lkml.kernel.org/n/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/util/header.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

tools/perf/util/header.c +3 -1

index 13a2251a37c5..05f40bb51a88 100644
@@ -2659,6 +2659,7 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
 	struct perf_header *header = &session->header;
 	int fd = perf_data__fd(session->data);
 	struct stat st;
+	time_t stctime;
 	int ret, bit;
 
 	hd.fp = fp;

@@ -2668,7 +2669,8 @@ int perf_header__fprintf_info(struct perf_session *session, FILE *fp, bool full)
 	if (ret == -1)
 		return -1;
 
-	fprintf(fp, "# captured on    : %s", ctime(&st.st_ctime));
+	stctime = st.st_ctime;
+	fprintf(fp, "# captured on    : %s", ctime(&stctime));
 
 	fprintf(fp, "# header version : %u\n", header->version);
 	fprintf(fp, "# data offset    : %" PRIu64 "\n", header->data_offset);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #220 lore raw

PATCH 202/352 perf tools: Cast off_t to s64 to avoid warning on bionic libc

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 866053bb644f754d1a93aaa9db9998fecf7a8978 ]

To avoid this warning:

CC /tmp/build/perf/util/s390-cpumsf.o
util/s390-cpumsf.c: In function 's390_cpumsf_samples':
util/s390-cpumsf.c:508:3: warning: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'off_t' [-Wformat=]
pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n",
^

Now the various Android cross toolchains used in the perf tools container test builds are all clean and we can remove this:

export EXTRA_MAKE_ARGS="WERROR=0"

Cc Adrian Hunter <[email protected]>

Cc Jiri Olsa <[email protected]>

Cc Namhyung Kim <[email protected]>

Cc Thomas Richter <[email protected]>

Link https://lkml.kernel.org/n/[email protected] open here

Signed-off-by Arnaldo Carvalho de Melo <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 tools/perf/util/s390-cpumsf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

tools/perf/util/s390-cpumsf.c +1 -1

index a2eeebbfb25f..68b2570304ec 100644
@@ -506,7 +506,7 @@ static int s390_cpumsf_samples(struct s390_cpumsf_queue *sfq, u64 *ts)
 	aux_ts = get_trailer_time(buf);
 	if (!aux_ts) {
 		pr_err("[%#08" PRIx64 "] Invalid AUX trailer entry TOD clock base\n",
-		       sfq->buffer->data_offset);
+		       (s64)sfq->buffer->data_offset);
 		aux_ts = ~0ULL;
 		goto out;
 	}

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #221 lore raw

PATCH 203/352 percpu: convert spin_lock_irq to spin_lock_irqsave.

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 6ab7d47bcbf0144a8cb81536c2cead4cde18acfe ]

Quoted 1 line

From Michael Cree:

"Bisection lead to commit b38d08f3181c ("percpu: restructure
locking") as being the cause of lockups at initial boot on the kernel built for generic Alpha.

On a suggestion by Tejun Heo that:

So, the only thing I can think of is that it's calling spin_unlock_irq() while irq handling isn't set up yet. Can you please try the followings?

1. Convert all spin_[un]lock_irq() to spin_lock_irqsave/unlock_irqrestore()."

Fixes b38d08f3181c ("percpu: restructure locking")

Reported-and-tested-by Michael Cree <[email protected]>

Acked-by Tejun Heo <[email protected]>

Signed-off-by Dennis Zhou <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 mm/percpu-km.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

mm/percpu-km.c +3 -2

index 38de70ab1a0d..0f643dc2dc65 100644
@@ -50,6 +50,7 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 	const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT;
 	struct pcpu_chunk *chunk;
 	struct page *pages;
+	unsigned long flags;
 	int i;
 
 	chunk = pcpu_alloc_chunk(gfp);

@@ -68,9 +69,9 @@ static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp)
 	chunk->data = pages;
 	chunk->base_addr = page_address(pages) - pcpu_group_offsets[0];
 
-	spin_lock_irq(&pcpu_lock);
+	spin_lock_irqsave(&pcpu_lock, flags);
 	pcpu_chunk_populated(chunk, 0, nr_pages, false);
-	spin_unlock_irq(&pcpu_lock);
+	spin_unlock_irqrestore(&pcpu_lock, flags);
 
 	pcpu_stats_chunk_alloc();
 	trace_percpu_create_chunk(chunk->base_addr);

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #223 lore raw

PATCH 205/352 net: hns3: fix incomplete uninitialization of IRQ in the hns3_nic_uninit_vector_data()

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit ae6017a71115ebc4e5c1a3f0f451319ab3f5c447 ]

In the hns3_nic_uninit_vector_data(), the procedure of uninitializing the tqp_vector's IRQ has not set affinity_notify to NULL and changes its init flag. This patch fixes it. And for simplificaton, local variable tqp_vector is used instead of priv->tqp_vector[i].

Fixes 424eb834a9be ("net: hns3: Unified HNS3 {VF|PF} Ethernet Driver for hip08 SoC")

Signed-off-by Huazhong Tan <[email protected]>

Signed-off-by Peng Li <[email protected]>

Signed-off-by David S. Miller <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +6 -6

index 4aea3f57586e..85d534a24f2c 100644
@@ -2971,12 +2971,12 @@ static int hns3_nic_uninit_vector_data(struct hns3_nic_priv *priv)
 
 		hns3_free_vector_ring_chain(tqp_vector, &vector_ring_chain);
 
-		if (priv->tqp_vector[i].irq_init_flag == HNS3_VECTOR_INITED) {
-			(void)irq_set_affinity_hint(
-				priv->tqp_vector[i].vector_irq,
-						    NULL);
-			free_irq(priv->tqp_vector[i].vector_irq,
-				 &priv->tqp_vector[i]);
+		if (tqp_vector->irq_init_flag == HNS3_VECTOR_INITED) {
+			irq_set_affinity_notifier(tqp_vector->vector_irq,
+						  NULL);
+			irq_set_affinity_hint(tqp_vector->vector_irq, NULL);
+			free_irq(tqp_vector->vector_irq, tqp_vector);
+			tqp_vector->irq_init_flag = HNS3_VECTOR_NOT_INITED;
 		}
 
 		priv->ring_data[i].ring->irq_init_flag = HNS3_VECTOR_NOT_INITED;

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #195 lore raw

PATCH 179/352 usb: renesas_usbhs: add support for RZ/G2E

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 1d6e81a288e28d8d0e38e0501a324216f79bba35 ]

HS-USB found in RZ/G2E (a.k.a. r8a774c0) is very similar to the one found in R-Car E3 (a.k.a. r8a77990), as it needs to release the PLL reset by the UGCTRL register like R-Car E3, therefore add r8a774c0 support in a similar fashion to what was done for the r8a77990.

Signed-off-by Fabrizio Castro <[email protected]>

Reviewed-by Simon Horman <[email protected]>

Acked-by Yoshihiro Shimoda <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/usb/renesas_usbhs/common.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/usb/renesas_usbhs/common.c +4 -0

index a3e1290d682d..1de333be9353 100644
@@ -539,6 +539,10 @@ static int usbhsc_drvcllbck_notify_hotplug(struct platform_device *pdev)
  *		platform functions
  */
 static const struct of_device_id usbhs_of_match[] = {
+	{
+		.compatible = "renesas,usbhs-r8a774c0",
+		.data = (void *)USBHS_TYPE_RCAR_GEN3_WITH_PLL,
+	},
 	{
 		.compatible = "renesas,usbhs-r8a7790",
 		.data = (void *)USBHS_TYPE_RCAR_GEN2,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #225 lore raw

PATCH 207/352 drm/amd/display: Wait edp HPD to high in detect_sink

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 0a6414e75d231ee1bb7ffb2f5eb246b682a884cd ]

[Why]
In 99% user case, edp will be post by vbios.
In 1% / current case: Lenovo don't light up edp panel in vbios post stage, vbios won't be lit up. Thus in dal when we init DCN 10 hw, we power up edp, then we start detect_sink, but internal time is too short, when we detect it, HPD is still low, so we don't detect the edp, and edp shows black.

[How]
When we init hw, we wait edp HPD to high after power up edp.

Signed-off-by Dale Zhao <[email protected]>

Reviewed-by Eric Yang <[email protected]>

Acked-by Leo Li <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/gpu/drm/amd/display/dc/core/dc_link.c | 3 +++
 1 file changed, 3 insertions(+)

drivers/gpu/drm/amd/display/dc/core/dc_link.c +3 -0

index ef1b350a45e0..8b69913b6943 100644
@@ -208,6 +208,9 @@ bool dc_link_detect_sink(struct dc_link *link, enum dc_connection_type *type)
 		return true;
 	}
 
+	if (link->connector_signal == SIGNAL_TYPE_EDP)
+		link->dc->hwss.edp_wait_for_hpd_ready(link, true);
+
 	/* todo: may need to lock gpio access */
 	hpd_pin = get_hpd_gpio(link->ctx->dc_bios, link->link_id, link->ctx->gpio_service);
 	if (hpd_pin == NULL)

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #226 lore raw

PATCH 208/352 Bluetooth: hci_bcm: Handle deferred probing for the clock supply

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 28ac03b9ac3f784c2f048a910c8d0a7a87483b66 ]

On some systems that actually have the bluetooth controller wired up with an extra clock signal, it's possible the bluetooth controller probes before the clock provider. clk_get would return a defer probe error, which was not handled by this driver.

Handle this properly, so that these systems can work reliably.

Tested-by Ondrej Jirman <[email protected]>

Signed-off-by Chen-Yu Tsai <[email protected]>

Signed-off-by Marcel Holtmann <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/bluetooth/hci_bcm.c | 4 ++++
 1 file changed, 4 insertions(+)

drivers/bluetooth/hci_bcm.c +4 -0

index ddbd8c6a0ceb..800132369134 100644
@@ -907,6 +907,10 @@ static int bcm_get_resources(struct bcm_device *dev)
 
 	dev->clk = devm_clk_get(dev->dev, NULL);
 
+	/* Handle deferred probing */
+	if (dev->clk == ERR_PTR(-EPROBE_DEFER))
+		return PTR_ERR(dev->clk);
+
 	dev->device_wakeup = devm_gpiod_get_optional(dev->dev, "device-wakeup",
 						     GPIOD_OUT_LOW);
 	if (IS_ERR(dev->device_wakeup))

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:30 UTC #227 lore raw

PATCH 209/352 drm/amd/display: fix YCbCr420 blank color

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit 12750d1647f118496f1da727146f255f5e44d500 ]

[Why]
YCbCr420 packing format uses two chanels for luma, and 1 channel for both chroma component. Our previous implementation did not account for this and results in every other pixel having very high luma value, showing greyish color instead of black.

YCbCr444 = <Y1, Cb1, Cr1>; <Y2, Cb2, Cr2> .....
YCbCr420 = <Y1, Y2, Cb1>; <Y3, Y4, Cr1> .....

[How]
Program the second channel with the black color value for luma as well.

Signed-off-by Eric Yang <[email protected]>

Reviewed-by Hugo Hu <[email protected]>

Acked-by Leo Li <[email protected]>

Signed-off-by Alex Deucher <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 .../drm/amd/display/dc/dce110/dce110_hw_sequencer.c   | 11 ++++++++++-
 .../gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c |  9 +++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c +10 -1

index a6bcb90e8419..4443a916a0fb 100644
@@ -1268,10 +1268,19 @@ static void program_scaler(const struct dc *dc,
 		pipe_ctx->plane_res.scl_data.lb_params.depth,
 		&pipe_ctx->stream->bit_depth_params);
 
-	if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color)
+	if (pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color) {
+		/*
+		 * The way 420 is packed, 2 channels carry Y component, 1 channel
+		 * alternate between Cb and Cr, so both channels need the pixel
+		 * value for Y
+		 */
+		if (pipe_ctx->stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
+			color.color_r_cr = color.color_g_y;
+
 		pipe_ctx->stream_res.tg->funcs->set_overscan_blank_color(
 				pipe_ctx->stream_res.tg,
 				&color);
+	}
 
 	pipe_ctx->plane_res.xfm->funcs->transform_set_scaler(pipe_ctx->plane_res.xfm,
 		&pipe_ctx->plane_res.scl_data);

drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +9 -0

index 32e4c653b1b4..220ba828748d 100644
@@ -2165,6 +2165,15 @@ static void dcn10_blank_pixel_data(
 	color_space = stream->output_color_space;
 	color_space_to_black_color(dc, color_space, &black_color);
 
+	/*
+	 * The way 420 is packed, 2 channels carry Y component, 1 channel
+	 * alternate between Cb and Cr, so both channels need the pixel
+	 * value for Y
+	 */
+	if (stream->timing.pixel_encoding == PIXEL_ENCODING_YCBCR420)
+		black_color.color_r_cr = black_color.color_g_y;
+
+
 	if (stream_res->tg->funcs->set_blank_color)
 		stream_res->tg->funcs->set_blank_color(
 				stream_res->tg,

Signature · 1 line

2.19.1

Greg Kroah-Hartman

author maintainer

2019-02-11 14:31 UTC #196 lore raw

PATCH 180/352 btrfs: harden agaist duplicate fsid on scanned devices

In reply to Greg Kroah-Hartman

4.20-stable review patch. If anyone has any objections, please let me know.

------------------

[ Upstream commit a9261d4125c97ce8624e9941b75dee1b43ad5df9 ]

It's not that impossible to imagine that a device OR a btrfs image is copied just by using the dd or the cp command. Which in case both the copies of the btrfs will have the same fsid. If on the system with automount enabled, the copied FS gets scanned.

We have a known bug in btrfs, that we let the device path be changed after the device has been mounted. So using this loop hole the new copied device would appears as if its mounted immediately after it's been copied.

For example:

Initially.. /dev/mmcblk0p4 is mounted as /

  $ lsblk
  NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
  mmcblk0     179:0    0 29.2G  0 disk
  |-mmcblk0p4 179:4    0    4G  0 part /
  |-mmcblk0p2 179:2    0  500M  0 part /boot
  |-mmcblk0p3 179:3    0  256M  0 part [SWAP]
  `-mmcblk0p1 179:1    0  256M  0 part /boot/efi

  $ btrfs fi show
     Label: none  uuid: 07892354-ddaa-4443-90ea-f76a06accaba
     Total devices 1 FS bytes used 1.40GiB
     devid    1 size 4.00GiB used 3.00GiB path /dev/mmcblk0p4

Copy mmcblk0 to sda

  $ dd if=/dev/mmcblk0 of=/dev/sda

And immediately after the copy completes the change in the device superblock is notified which the automount scans using btrfs device scan and the new device sda becomes the mounted root device.

  $ lsblk
  NAME        MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
  sda           8:0    1 14.9G  0 disk
  |-sda4        8:4    1    4G  0 part /
  |-sda2        8:2    1  500M  0 part
  |-sda3        8:3    1  256M  0 part
  `-sda1        8:1    1  256M  0 part
  mmcblk0     179:0    0 29.2G  0 disk
  |-mmcblk0p4 179:4    0    4G  0 part
  |-mmcblk0p2 179:2    0  500M  0 part /boot
  |-mmcblk0p3 179:3    0  256M  0 part [SWAP]
  `-mmcblk0p1 179:1    0  256M  0 part /boot/efi

  $ btrfs fi show /
    Label: none  uuid: 07892354-ddaa-4443-90ea-f76a06accaba
    Total devices 1 FS bytes used 1.40GiB
    devid    1 size 4.00GiB used 3.00GiB path /dev/sda4

The bug is quite nasty that you can't either unmount /dev/sda4 or /dev/mmcblk0p4. And the problem does not get solved until you take sda out of the system on to another system to change its fsid using the 'btrfstune -u' command.

Signed-off-by Anand Jain <[email protected]>

Reviewed-by David Sterba <[email protected]>

Signed-off-by David Sterba <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 fs/btrfs/volumes.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

fs/btrfs/volumes.c +29 -0

index ea5fa9df9405..6f09f6032db3 100644
@@ -850,6 +850,35 @@ static noinline struct btrfs_device *device_list_add(const char *path,
 			return ERR_PTR(-EEXIST);
 		}
 
+		/*
+		 * We are going to replace the device path for a given devid,
+		 * make sure it's the same device if the device is mounted
+		 */
+		if (device->bdev) {
+			struct block_device *path_bdev;
+
+			path_bdev = lookup_bdev(path);
+			if (IS_ERR(path_bdev)) {
+				mutex_unlock(&fs_devices->device_list_mutex);
+				return ERR_CAST(path_bdev);
+			}
+
+			if (device->bdev != path_bdev) {
+				bdput(path_bdev);
+				mutex_unlock(&fs_devices->device_list_mutex);
+				btrfs_warn_in_rcu(device->fs_info,
+			"duplicate device fsid:devid for %pU:%llu old:%s new:%s",
+					disk_super->fsid, devid,
+					rcu_str_deref(device->name), path);
+				return ERR_PTR(-EEXIST);
+			}
+			bdput(path_bdev);
+			btrfs_info_in_rcu(device->fs_info,
+				"device fsid %pU devid %llu moved old:%s new:%s",
+				disk_super->fsid, devid,
+				rcu_str_deref(device->name), path);
+		}
+
 		name = rcu_string_strdup(path, GFP_NOFS);
 		if (!name) {
 			mutex_unlock(&fs_devices->device_list_mutex);

Signature · 1 line

2.19.1