From: Sasha Levin Date: Fri, 22 Nov 2019 06:51:09 +0000 (-0500) Subject: fixes for 4.9 X-Git-Tag: v5.3.13~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=00d4cf1754244da6c02c89283718e56ad81d9f1d;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/acpi-sbs-fix-rare-oops-when-removing-modules.patch b/queue-4.9/acpi-sbs-fix-rare-oops-when-removing-modules.patch new file mode 100644 index 00000000000..7ea1b128571 --- /dev/null +++ b/queue-4.9/acpi-sbs-fix-rare-oops-when-removing-modules.patch @@ -0,0 +1,66 @@ +From c1606feaee3cd88036769b27c35cf2491352e785 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 19:53:13 -0700 +Subject: ACPI / SBS: Fix rare oops when removing modules +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ronald Tschalär + +[ Upstream commit 757c968c442397f1249bb775a7c8c03842e3e0c7 ] + +There was a small race when removing the sbshc module where +smbus_alarm() had queued acpi_smbus_callback() for deferred execution +but it hadn't been run yet, so that when it did run hc had been freed +and the module unloaded, resulting in an invalid paging request. + +A similar race existed when removing the sbs module with regards to +acpi_sbs_callback() (which is called from acpi_smbus_callback()). + +We therefore need to ensure no callbacks are pending or executing before +the cleanups are done and the modules are removed. + +Signed-off-by: Ronald Tschalär +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/osl.c | 1 + + drivers/acpi/sbshc.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 416953a425109..b9fade7a3bcf4 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -1126,6 +1126,7 @@ void acpi_os_wait_events_complete(void) + flush_workqueue(kacpid_wq); + flush_workqueue(kacpi_notify_wq); + } ++EXPORT_SYMBOL(acpi_os_wait_events_complete); + + struct acpi_hp_work { + struct work_struct work; +diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c +index 7a3431018e0ab..5008ead4609a4 100644 +--- a/drivers/acpi/sbshc.c ++++ b/drivers/acpi/sbshc.c +@@ -196,6 +196,7 @@ int acpi_smbus_unregister_callback(struct acpi_smb_hc *hc) + hc->callback = NULL; + hc->context = NULL; + mutex_unlock(&hc->lock); ++ acpi_os_wait_events_complete(); + return 0; + } + +@@ -292,6 +293,7 @@ static int acpi_smbus_hc_remove(struct acpi_device *device) + + hc = acpi_driver_data(device); + acpi_ec_remove_query_handler(hc->ec, hc->query_bit); ++ acpi_os_wait_events_complete(); + kfree(hc); + device->driver_data = NULL; + return 0; +-- +2.20.1 + diff --git a/queue-4.9/acpica-never-run-_reg-on-system_memory-and-system_io.patch b/queue-4.9/acpica-never-run-_reg-on-system_memory-and-system_io.patch new file mode 100644 index 00000000000..a4ff9fdd031 --- /dev/null +++ b/queue-4.9/acpica-never-run-_reg-on-system_memory-and-system_io.patch @@ -0,0 +1,134 @@ +From c3eff07fe8c2561c2a3c354f31faf170dc7146bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 11:45:38 -0700 +Subject: ACPICA: Never run _REG on system_memory and system_IO + +From: Bob Moore + +[ Upstream commit 8b1cafdcb4b75c5027c52f1e82b47ebe727ad7ed ] + +These address spaces are defined by the ACPI spec to be +"always available", and thus _REG should never be run on them. +Provides compatibility with other ACPI implementations. + +Signed-off-by: Bob Moore +Signed-off-by: Erik Schmauss +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/acevents.h | 2 ++ + drivers/acpi/acpica/aclocal.h | 2 +- + drivers/acpi/acpica/evregion.c | 17 +++++++++++++++-- + drivers/acpi/acpica/evrgnini.c | 6 +----- + drivers/acpi/acpica/evxfregn.c | 1 - + 5 files changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/acpi/acpica/acevents.h b/drivers/acpi/acpica/acevents.h +index 92fa47c6498cd..20fd17aaa9189 100644 +--- a/drivers/acpi/acpica/acevents.h ++++ b/drivers/acpi/acpica/acevents.h +@@ -247,6 +247,8 @@ acpi_status + acpi_ev_initialize_region(union acpi_operand_object *region_obj, + u8 acpi_ns_locked); + ++u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node); ++ + /* + * evsci - SCI (System Control Interrupt) handling/dispatch + */ +diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h +index dff1207a60788..219bc576d1270 100644 +--- a/drivers/acpi/acpica/aclocal.h ++++ b/drivers/acpi/acpica/aclocal.h +@@ -428,9 +428,9 @@ struct acpi_simple_repair_info { + /* Info for running the _REG methods */ + + struct acpi_reg_walk_info { +- acpi_adr_space_type space_id; + u32 function; + u32 reg_run_count; ++ acpi_adr_space_type space_id; + }; + + /***************************************************************************** +diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c +index 4c6f795140402..9cb60fdc77e50 100644 +--- a/drivers/acpi/acpica/evregion.c ++++ b/drivers/acpi/acpica/evregion.c +@@ -677,6 +677,19 @@ acpi_ev_execute_reg_methods(struct acpi_namespace_node *node, + + ACPI_FUNCTION_TRACE(ev_execute_reg_methods); + ++ /* ++ * These address spaces do not need a call to _REG, since the ACPI ++ * specification defines them as: "must always be accessible". Since ++ * they never change state (never become unavailable), no need to ever ++ * call _REG on them. Also, a data_table is not a "real" address space, ++ * so do not call _REG. September 2018. ++ */ ++ if ((space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) || ++ (space_id == ACPI_ADR_SPACE_SYSTEM_IO) || ++ (space_id == ACPI_ADR_SPACE_DATA_TABLE)) { ++ return_VOID; ++ } ++ + info.space_id = space_id; + info.function = function; + info.reg_run_count = 0; +@@ -738,8 +751,8 @@ acpi_ev_reg_run(acpi_handle obj_handle, + } + + /* +- * We only care about regions.and objects that are allowed to have address +- * space handlers ++ * We only care about regions and objects that are allowed to have ++ * address space handlers + */ + if ((node->type != ACPI_TYPE_REGION) && (node != acpi_gbl_root_node)) { + return (AE_OK); +diff --git a/drivers/acpi/acpica/evrgnini.c b/drivers/acpi/acpica/evrgnini.c +index 75ddd160a716f..c8646c3977865 100644 +--- a/drivers/acpi/acpica/evrgnini.c ++++ b/drivers/acpi/acpica/evrgnini.c +@@ -50,9 +50,6 @@ + #define _COMPONENT ACPI_EVENTS + ACPI_MODULE_NAME("evrgnini") + +-/* Local prototypes */ +-static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node); +- + /******************************************************************************* + * + * FUNCTION: acpi_ev_system_memory_region_setup +@@ -67,7 +64,6 @@ static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node); + * DESCRIPTION: Setup a system_memory operation region + * + ******************************************************************************/ +- + acpi_status + acpi_ev_system_memory_region_setup(acpi_handle handle, + u32 function, +@@ -347,7 +343,7 @@ acpi_ev_pci_config_region_setup(acpi_handle handle, + * + ******************************************************************************/ + +-static u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node) ++u8 acpi_ev_is_pci_root_bridge(struct acpi_namespace_node *node) + { + acpi_status status; + struct acpi_pnp_device_id *hid; +diff --git a/drivers/acpi/acpica/evxfregn.c b/drivers/acpi/acpica/evxfregn.c +index d2743067126af..f87d59a05c681 100644 +--- a/drivers/acpi/acpica/evxfregn.c ++++ b/drivers/acpi/acpica/evxfregn.c +@@ -227,7 +227,6 @@ acpi_remove_address_space_handler(acpi_handle device, + */ + region_obj = + handler_obj->address_space.region_list; +- + } + + /* Remove this Handler object from the list */ +-- +2.20.1 + diff --git a/queue-4.9/alsa-hda-sigmatel-disable-automute-for-elo-vupoint.patch b/queue-4.9/alsa-hda-sigmatel-disable-automute-for-elo-vupoint.patch new file mode 100644 index 00000000000..56c18c2178e --- /dev/null +++ b/queue-4.9/alsa-hda-sigmatel-disable-automute-for-elo-vupoint.patch @@ -0,0 +1,85 @@ +From 4cb7550e0e41ea4689889c4d30f9f100742307de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 14:58:21 -0400 +Subject: ALSA: hda/sigmatel - Disable automute for Elo VuPoint + +From: Michael Pobega + +[ Upstream commit d153135e93a50cdb6f1b52e238909e9965b56056 ] + +The Elo VuPoint 15MX has two headphone jacks of which neither work by +default. Disabling automute allows ALSA to work normally with the +speakers & left headphone jack. + +Future pin configuration changes may be required in the future to get +the right headphone jack working in tandem. + +Signed-off-by: Michael Pobega +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_sigmatel.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index 0abab7926dca3..d1a6d20ace0da 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -77,6 +77,7 @@ enum { + STAC_DELL_M6_BOTH, + STAC_DELL_EQ, + STAC_ALIENWARE_M17X, ++ STAC_ELO_VUPOINT_15MX, + STAC_92HD89XX_HP_FRONT_JACK, + STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK, + STAC_92HD73XX_ASUS_MOBO, +@@ -1875,6 +1876,18 @@ static void stac92hd73xx_fixup_no_jd(struct hda_codec *codec, + codec->no_jack_detect = 1; + } + ++ ++static void stac92hd73xx_disable_automute(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct sigmatel_spec *spec = codec->spec; ++ ++ if (action != HDA_FIXUP_ACT_PRE_PROBE) ++ return; ++ ++ spec->gen.suppress_auto_mute = 1; ++} ++ + static const struct hda_fixup stac92hd73xx_fixups[] = { + [STAC_92HD73XX_REF] = { + .type = HDA_FIXUP_FUNC, +@@ -1900,6 +1913,10 @@ static const struct hda_fixup stac92hd73xx_fixups[] = { + .type = HDA_FIXUP_FUNC, + .v.func = stac92hd73xx_fixup_alienware_m17x, + }, ++ [STAC_ELO_VUPOINT_15MX] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = stac92hd73xx_disable_automute, ++ }, + [STAC_92HD73XX_INTEL] = { + .type = HDA_FIXUP_PINS, + .v.pins = intel_dg45id_pin_configs, +@@ -1938,6 +1955,7 @@ static const struct hda_model_fixup stac92hd73xx_models[] = { + { .id = STAC_DELL_M6_BOTH, .name = "dell-m6" }, + { .id = STAC_DELL_EQ, .name = "dell-eq" }, + { .id = STAC_ALIENWARE_M17X, .name = "alienware" }, ++ { .id = STAC_ELO_VUPOINT_15MX, .name = "elo-vupoint-15mx" }, + { .id = STAC_92HD73XX_ASUS_MOBO, .name = "asus-mobo" }, + {} + }; +@@ -1987,6 +2005,8 @@ static const struct snd_pci_quirk stac92hd73xx_fixup_tbl[] = { + "Alienware M17x", STAC_ALIENWARE_M17X), + SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0490, + "Alienware M17x R3", STAC_DELL_EQ), ++ SND_PCI_QUIRK(0x1059, 0x1011, ++ "ELO VuPoint 15MX", STAC_ELO_VUPOINT_15MX), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x1927, + "HP Z1 G2", STAC_92HD89XX_HP_Z1_G2_RIGHT_MIC_JACK), + SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x2b17, +-- +2.20.1 + diff --git a/queue-4.9/arm-8802-1-call-syscall_trace_exit-even-when-system-.patch b/queue-4.9/arm-8802-1-call-syscall_trace_exit-even-when-system-.patch new file mode 100644 index 00000000000..966e8d9cdf2 --- /dev/null +++ b/queue-4.9/arm-8802-1-call-syscall_trace_exit-even-when-system-.patch @@ -0,0 +1,57 @@ +From 0826b0f3d6d3b65d94d0f2440b871cb9b6bddae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 19:26:48 +0100 +Subject: ARM: 8802/1: Call syscall_trace_exit even when system call skipped + +From: Timothy E Baldwin + +[ Upstream commit f18aef742c8fbd68e280dff0a63ba0ca6ee8ad85 ] + +On at least x86 and ARM64, and as documented in the ptrace man page +a skipped system call will still cause a syscall exit ptrace stop. + +Previous to this commit 32-bit ARM did not, resulting in strace +being confused when seccomp skips system calls. + +This change also impacts programs that use ptrace to skip system calls. + +Fixes: ad75b51459ae ("ARM: 7579/1: arch/allow a scno of -1 to not cause a SIGILL") +Signed-off-by: Timothy E Baldwin +Signed-off-by: Eugene Syromyatnikov +Reviewed-by: Kees Cook +Tested-by: Kees Cook +Tested-by: Eugene Syromyatnikov +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/entry-common.S | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S +index d69adfb3d79e6..178a2a9606595 100644 +--- a/arch/arm/kernel/entry-common.S ++++ b/arch/arm/kernel/entry-common.S +@@ -263,16 +263,15 @@ __sys_trace: + cmp scno, #-1 @ skip the syscall? + bne 2b + add sp, sp, #S_OFF @ restore stack +- b ret_slow_syscall + +-__sys_trace_return: +- str r0, [sp, #S_R0 + S_OFF]! @ save returned r0 ++__sys_trace_return_nosave: ++ enable_irq_notrace + mov r0, sp + bl syscall_trace_exit + b ret_slow_syscall + +-__sys_trace_return_nosave: +- enable_irq_notrace ++__sys_trace_return: ++ str r0, [sp, #S_R0 + S_OFF]! @ save returned r0 + mov r0, sp + bl syscall_trace_exit + b ret_slow_syscall +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap5-enable-otg-role-for-dwc3-controller.patch b/queue-4.9/arm-dts-omap5-enable-otg-role-for-dwc3-controller.patch new file mode 100644 index 00000000000..6e13412c3d7 --- /dev/null +++ b/queue-4.9/arm-dts-omap5-enable-otg-role-for-dwc3-controller.patch @@ -0,0 +1,42 @@ +From 292231bb2b810cbf9923e42188cfcfe7b5cb07d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Sep 2018 17:54:00 +0200 +Subject: ARM: dts: omap5: enable OTG role for DWC3 controller + +From: H. Nikolaus Schaller + +[ Upstream commit 656c1a65ab555ee5c7cd0d6aee8ab82ca3c1795f ] + +Since SMPS10 and OTG cable detection extcon are described here, and +work to enable OTG power when an OTG cable is plugged in, we can +define OTG mode in the controller (which is disabled by default in +omap5.dtsi). + +Tested on OMAP5EVM and Pyra. + +Suggested-by: Roger Quadros +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap5-board-common.dtsi | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi +index 4caadb2532497..3e9e3d90f2b4f 100644 +--- a/arch/arm/boot/dts/omap5-board-common.dtsi ++++ b/arch/arm/boot/dts/omap5-board-common.dtsi +@@ -694,6 +694,10 @@ + vbus-supply = <&smps10_out1_reg>; + }; + ++&dwc3 { ++ dr_mode = "otg"; ++}; ++ + &mcspi1 { + + }; +-- +2.20.1 + diff --git a/queue-4.9/arm-dts-omap5-fix-dual-role-mode-on-super-speed-port.patch b/queue-4.9/arm-dts-omap5-fix-dual-role-mode-on-super-speed-port.patch new file mode 100644 index 00000000000..4312d454aa6 --- /dev/null +++ b/queue-4.9/arm-dts-omap5-fix-dual-role-mode-on-super-speed-port.patch @@ -0,0 +1,39 @@ +From af6cbd935682b9168d4831b569adb7c1ea962a82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Dec 2018 19:27:44 +0200 +Subject: ARM: dts: omap5: Fix dual-role mode on Super-Speed port + +From: Roger Quadros + +[ Upstream commit a763ecc15d0e37c3a15ff6825183061209832685 ] + +OMAP5's Super-Speed USB port has a software mailbox register +that needs to be fed with VBUS and ID events from an external +VBUS/ID comparator. + +Without this, Host role will not work correctly. + +Fixes: 656c1a65ab55 ("ARM: dts: omap5: enable OTG role for DWC3 controller") +Reported-by: H. Nikolaus Schaller +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap5-board-common.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi +index 3e9e3d90f2b4f..e412373fe7bfd 100644 +--- a/arch/arm/boot/dts/omap5-board-common.dtsi ++++ b/arch/arm/boot/dts/omap5-board-common.dtsi +@@ -695,6 +695,7 @@ + }; + + &dwc3 { ++ extcon = <&extcon_usb3>; + dr_mode = "otg"; + }; + +-- +2.20.1 + diff --git a/queue-4.9/arm64-numa-report-correct-memblock-range-for-the-dum.patch b/queue-4.9/arm64-numa-report-correct-memblock-range-for-the-dum.patch new file mode 100644 index 00000000000..c3106f24366 --- /dev/null +++ b/queue-4.9/arm64-numa-report-correct-memblock-range-for-the-dum.patch @@ -0,0 +1,39 @@ +From 9e2124f20af0105eb728c77d8594b4d902bfd041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Sep 2018 21:09:55 +0530 +Subject: arm64/numa: Report correct memblock range for the dummy node + +From: Anshuman Khandual + +[ Upstream commit 77cfe950901e5c13aca2df6437a05f39dd9a929b ] + +The dummy node ID is marked into all memory ranges on the system. So the +dummy node really extends the entire memblock.memory. Hence report correct +extent information for the dummy node using memblock range helper functions +instead of the range [0LLU, PFN_PHYS(max_pfn) - 1)]. + +Fixes: 1a2db30034 ("arm64, numa: Add NUMA support for arm64 platforms") +Acked-by: Punit Agrawal +Signed-off-by: Anshuman Khandual +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/numa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/mm/numa.c b/arch/arm64/mm/numa.c +index 4b32168cf91a0..b1e42bad69ac3 100644 +--- a/arch/arm64/mm/numa.c ++++ b/arch/arm64/mm/numa.c +@@ -424,7 +424,7 @@ static int __init dummy_numa_init(void) + if (numa_off) + pr_info("NUMA disabled\n"); /* Forced off on command line. */ + pr_info("Faking a node at [mem %#018Lx-%#018Lx]\n", +- 0LLU, PFN_PHYS(max_pfn) - 1); ++ memblock_start_of_DRAM(), memblock_end_of_DRAM() - 1); + + for_each_memblock(memory, mblk) { + ret = numa_add_memblk(0, mblk->base, mblk->base + mblk->size); +-- +2.20.1 + diff --git a/queue-4.9/ata-ahci_brcm-allow-using-driver-or-dsl-socs.patch b/queue-4.9/ata-ahci_brcm-allow-using-driver-or-dsl-socs.patch new file mode 100644 index 00000000000..de68cbd0ead --- /dev/null +++ b/queue-4.9/ata-ahci_brcm-allow-using-driver-or-dsl-socs.patch @@ -0,0 +1,36 @@ +From 4ee2131669a28199a888558288e4e0ed11cd9e23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 10:33:02 -0700 +Subject: ata: ahci_brcm: Allow using driver or DSL SoCs + +From: Florian Fainelli + +[ Upstream commit 7fb44929cb0e5cdcde143e1ca3ca57b5b8247db0 ] + +The Broadcom STB AHCI controller is the same as the one found on DSL +SoCs, so we will utilize the same driver on these systems as well. + +Signed-off-by: Florian Fainelli +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig +index 5d16fc4fa46c7..a8d4f4b5a77eb 100644 +--- a/drivers/ata/Kconfig ++++ b/drivers/ata/Kconfig +@@ -100,7 +100,8 @@ config SATA_AHCI_PLATFORM + + config AHCI_BRCM + tristate "Broadcom AHCI SATA support" +- depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_NSP ++ depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_NSP || \ ++ ARCH_BCM_63XX + help + This option enables support for the AHCI SATA3 controller found on + Broadcom SoC's. +-- +2.20.1 + diff --git a/queue-4.9/ata-ep93xx-use-proper-enums-for-directions.patch b/queue-4.9/ata-ep93xx-use-proper-enums-for-directions.patch new file mode 100644 index 00000000000..b8c9bdc8f30 --- /dev/null +++ b/queue-4.9/ata-ep93xx-use-proper-enums-for-directions.patch @@ -0,0 +1,89 @@ +From 51a2d44c07ccdf1c04dfc5d332b1d736ac3d6174 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 19:37:54 -0700 +Subject: ata: ep93xx: Use proper enums for directions + +From: Nathan Chancellor + +[ Upstream commit 6adde4a36f1b6a562a1057fbb1065007851050e7 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/ata/pata_ep93xx.c:662:36: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + drv_data->dma_rx_data.direction = DMA_FROM_DEVICE; + ~ ^~~~~~~~~~~~~~~ +drivers/ata/pata_ep93xx.c:670:36: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + drv_data->dma_tx_data.direction = DMA_TO_DEVICE; + ~ ^~~~~~~~~~~~~ +drivers/ata/pata_ep93xx.c:681:19: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + conf.direction = DMA_FROM_DEVICE; + ~ ^~~~~~~~~~~~~~~ +drivers/ata/pata_ep93xx.c:692:19: warning: implicit conversion from +enumeration type 'enum dma_data_direction' to different enumeration type +'enum dma_transfer_direction' [-Wenum-conversion] + conf.direction = DMA_TO_DEVICE; + ~ ^~~~~~~~~~~~~ + +Use the equivalent valued enums from the expected type so that Clang no +longer warns about a conversion. + +DMA_TO_DEVICE = DMA_MEM_TO_DEV = 1 +DMA_FROM_DEVICE = DMA_DEV_TO_MEM = 2 + +Acked-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Nathan Chancellor +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ep93xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c +index bd6b089c67a3a..634c814cbeda4 100644 +--- a/drivers/ata/pata_ep93xx.c ++++ b/drivers/ata/pata_ep93xx.c +@@ -659,7 +659,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) + * start of new transfer. + */ + drv_data->dma_rx_data.port = EP93XX_DMA_IDE; +- drv_data->dma_rx_data.direction = DMA_FROM_DEVICE; ++ drv_data->dma_rx_data.direction = DMA_DEV_TO_MEM; + drv_data->dma_rx_data.name = "ep93xx-pata-rx"; + drv_data->dma_rx_channel = dma_request_channel(mask, + ep93xx_pata_dma_filter, &drv_data->dma_rx_data); +@@ -667,7 +667,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) + return; + + drv_data->dma_tx_data.port = EP93XX_DMA_IDE; +- drv_data->dma_tx_data.direction = DMA_TO_DEVICE; ++ drv_data->dma_tx_data.direction = DMA_MEM_TO_DEV; + drv_data->dma_tx_data.name = "ep93xx-pata-tx"; + drv_data->dma_tx_channel = dma_request_channel(mask, + ep93xx_pata_dma_filter, &drv_data->dma_tx_data); +@@ -678,7 +678,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) + + /* Configure receive channel direction and source address */ + memset(&conf, 0, sizeof(conf)); +- conf.direction = DMA_FROM_DEVICE; ++ conf.direction = DMA_DEV_TO_MEM; + conf.src_addr = drv_data->udma_in_phys; + conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + if (dmaengine_slave_config(drv_data->dma_rx_channel, &conf)) { +@@ -689,7 +689,7 @@ static void ep93xx_pata_dma_init(struct ep93xx_pata_data *drv_data) + + /* Configure transmit channel direction and destination address */ + memset(&conf, 0, sizeof(conf)); +- conf.direction = DMA_TO_DEVICE; ++ conf.direction = DMA_MEM_TO_DEV; + conf.dst_addr = drv_data->udma_out_phys; + conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES; + if (dmaengine_slave_config(drv_data->dma_tx_channel, &conf)) { +-- +2.20.1 + diff --git a/queue-4.9/ath10k-fix-vdev-start-timeout-on-error.patch b/queue-4.9/ath10k-fix-vdev-start-timeout-on-error.patch new file mode 100644 index 00000000000..8769d5ebdff --- /dev/null +++ b/queue-4.9/ath10k-fix-vdev-start-timeout-on-error.patch @@ -0,0 +1,117 @@ +From b65ed2ce5fe0cd9552c71b43cbd2b81985a9820c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Sep 2018 19:46:20 +0300 +Subject: ath10k: fix vdev-start timeout on error + +From: Ben Greear + +[ Upstream commit 833fd34d743c728afe6d127ef7bee67e7d9199a8 ] + +The vdev-start-response message should cause the +completion to fire, even in the error case. Otherwise, +the user still gets no useful information and everything +is blocked until the timeout period. + +Add some warning text to print out the invalid status +code to aid debugging, and propagate failure code. + +Signed-off-by: Ben Greear +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/core.h | 1 + + drivers/net/wireless/ath/ath10k/mac.c | 2 +- + drivers/net/wireless/ath/ath10k/wmi.c | 19 ++++++++++++++++--- + drivers/net/wireless/ath/ath10k/wmi.h | 8 +++++++- + 4 files changed, 25 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h +index 90c0c4a7175db..414153cd57845 100644 +--- a/drivers/net/wireless/ath/ath10k/core.h ++++ b/drivers/net/wireless/ath/ath10k/core.h +@@ -811,6 +811,7 @@ struct ath10k { + + struct completion install_key_done; + ++ int last_wmi_vdev_start_status; + struct completion vdev_setup_done; + + struct workqueue_struct *workqueue; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 1588fe8110d00..2294ba311c47a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -947,7 +947,7 @@ static inline int ath10k_vdev_setup_sync(struct ath10k *ar) + if (time_left == 0) + return -ETIMEDOUT; + +- return 0; ++ return ar->last_wmi_vdev_start_status; + } + + static int ath10k_monitor_vdev_start(struct ath10k *ar, int vdev_id) +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index c208fed048554..af3bc06b4aeda 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -3103,18 +3103,31 @@ void ath10k_wmi_event_vdev_start_resp(struct ath10k *ar, struct sk_buff *skb) + { + struct wmi_vdev_start_ev_arg arg = {}; + int ret; ++ u32 status; + + ath10k_dbg(ar, ATH10K_DBG_WMI, "WMI_VDEV_START_RESP_EVENTID\n"); + ++ ar->last_wmi_vdev_start_status = 0; ++ + ret = ath10k_wmi_pull_vdev_start(ar, skb, &arg); + if (ret) { + ath10k_warn(ar, "failed to parse vdev start event: %d\n", ret); +- return; ++ ar->last_wmi_vdev_start_status = ret; ++ goto out; + } + +- if (WARN_ON(__le32_to_cpu(arg.status))) +- return; ++ status = __le32_to_cpu(arg.status); ++ if (WARN_ON_ONCE(status)) { ++ ath10k_warn(ar, "vdev-start-response reports status error: %d (%s)\n", ++ status, (status == WMI_VDEV_START_CHAN_INVALID) ? ++ "chan-invalid" : "unknown"); ++ /* Setup is done one way or another though, so we should still ++ * do the completion, so don't return here. ++ */ ++ ar->last_wmi_vdev_start_status = -EINVAL; ++ } + ++out: + complete(&ar->vdev_setup_done); + } + +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 9b8562ff66987..cce028ea9b57d 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -6248,11 +6248,17 @@ struct wmi_ch_info_ev_arg { + __le32 rx_frame_count; + }; + ++/* From 10.4 firmware, not sure all have the same values. */ ++enum wmi_vdev_start_status { ++ WMI_VDEV_START_OK = 0, ++ WMI_VDEV_START_CHAN_INVALID, ++}; ++ + struct wmi_vdev_start_ev_arg { + __le32 vdev_id; + __le32 req_id; + __le32 resp_type; /* %WMI_VDEV_RESP_ */ +- __le32 status; ++ __le32 status; /* See wmi_vdev_start_status enum above */ + }; + + struct wmi_peer_kick_ev_arg { +-- +2.20.1 + diff --git a/queue-4.9/ath9k-fix-reporting-calculated-new-fft-upper-max.patch b/queue-4.9/ath9k-fix-reporting-calculated-new-fft-upper-max.patch new file mode 100644 index 00000000000..8f73c2f0084 --- /dev/null +++ b/queue-4.9/ath9k-fix-reporting-calculated-new-fft-upper-max.patch @@ -0,0 +1,36 @@ +From 414e45d7b84bb684e6eca3701643ed178b10faff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 17:26:59 +0300 +Subject: ath9k: fix reporting calculated new FFT upper max + +From: Simon Wunderlich + +[ Upstream commit 4fb5837ac2bd46a85620b297002c704e9958f64d ] + +Since the debug print code is outside of the loop, it shouldn't use the loop +iterator anymore but instead print the found maximum index. + +Cc: Nick Kossifidis +Signed-off-by: Simon Wunderlich +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/common-spectral.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c +index eedf86b67cf51..807fbe31e9303 100644 +--- a/drivers/net/wireless/ath/ath9k/common-spectral.c ++++ b/drivers/net/wireless/ath/ath9k/common-spectral.c +@@ -411,7 +411,7 @@ ath_cmn_process_ht20_40_fft(struct ath_rx_status *rs, + + ath_dbg(common, SPECTRAL_SCAN, + "Calculated new upper max 0x%X at %i\n", +- tmp_mag, i); ++ tmp_mag, fft_sample_40.upper_max_index); + } else + for (i = dc_pos; i < SPECTRAL_HT20_40_NUM_BINS; i++) { + if (fft_sample_40.data[i] == (upper_mag >> max_exp)) +-- +2.20.1 + diff --git a/queue-4.9/backlight-lm3639-unconditionally-call-led_classdev_u.patch b/queue-4.9/backlight-lm3639-unconditionally-call-led_classdev_u.patch new file mode 100644 index 00000000000..a079519cb91 --- /dev/null +++ b/queue-4.9/backlight-lm3639-unconditionally-call-led_classdev_u.patch @@ -0,0 +1,59 @@ +From 9d8fd8f338697f535862c5e52154dcc2702fd18e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 13:21:31 -0700 +Subject: backlight: lm3639: Unconditionally call led_classdev_unregister + +From: Nathan Chancellor + +[ Upstream commit 7cea645ae9c5a54aa7904fddb2cdf250acd63a6c ] + +Clang warns that the address of a pointer will always evaluated as true +in a boolean context. + +drivers/video/backlight/lm3639_bl.c:403:14: warning: address of +'pchip->cdev_torch' will always evaluate to 'true' +[-Wpointer-bool-conversion] + if (&pchip->cdev_torch) + ~~ ~~~~~~~^~~~~~~~~~ +drivers/video/backlight/lm3639_bl.c:405:14: warning: address of +'pchip->cdev_flash' will always evaluate to 'true' +[-Wpointer-bool-conversion] + if (&pchip->cdev_flash) + ~~ ~~~~~~~^~~~~~~~~~ +2 warnings generated. + +These statements have been present since 2012, introduced by +commit 0f59858d5119 ("backlight: add new lm3639 backlight +driver"). Given that they have been called unconditionally since +then presumably without any issues, removing the always true if +statements to fix the warnings without any real world changes. + +Link: https://github.com/ClangBuiltLinux/linux/issues/119 +Signed-off-by: Nathan Chancellor +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3639_bl.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/video/backlight/lm3639_bl.c b/drivers/video/backlight/lm3639_bl.c +index cd50df5807ead..086611c7bc03c 100644 +--- a/drivers/video/backlight/lm3639_bl.c ++++ b/drivers/video/backlight/lm3639_bl.c +@@ -400,10 +400,8 @@ static int lm3639_remove(struct i2c_client *client) + + regmap_write(pchip->regmap, REG_ENABLE, 0x00); + +- if (&pchip->cdev_torch) +- led_classdev_unregister(&pchip->cdev_torch); +- if (&pchip->cdev_flash) +- led_classdev_unregister(&pchip->cdev_flash); ++ led_classdev_unregister(&pchip->cdev_torch); ++ led_classdev_unregister(&pchip->cdev_flash); + if (pchip->bled) + device_remove_file(&(pchip->bled->dev), &dev_attr_bled_mode); + return 0; +-- +2.20.1 + diff --git a/queue-4.9/bcache-recal-cached_dev_sectors-on-detach.patch b/queue-4.9/bcache-recal-cached_dev_sectors-on-detach.patch new file mode 100644 index 00000000000..54cc5f50ca5 --- /dev/null +++ b/queue-4.9/bcache-recal-cached_dev_sectors-on-detach.patch @@ -0,0 +1,38 @@ +From aa1b5906bfe61a8867fab98dd7ca25e0d10102cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 20:41:15 +0800 +Subject: bcache: recal cached_dev_sectors on detach + +From: Shenghui Wang + +[ Upstream commit 46010141da6677b81cc77f9b47f8ac62bd1cbfd3 ] + +Recal cached_dev_sectors on cached_dev detached, as recal done on +cached_dev attached. + +Update the cached_dev_sectors before bcache_device_detach called +as bcache_device_detach will set bcache_device->c to NULL. + +Signed-off-by: Shenghui Wang +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index c5bc3e5e921e4..080f9afcde8da 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -904,6 +904,7 @@ static void cached_dev_detach_finish(struct work_struct *w) + bch_write_bdev_super(dc, &cl); + closure_sync(&cl); + ++ calc_cached_dev_sectors(dc->disk.c); + bcache_device_detach(&dc->disk); + list_move(&dc->list, &uncached_devices); + +-- +2.20.1 + diff --git a/queue-4.9/brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch b/queue-4.9/brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch new file mode 100644 index 00000000000..3c2b7466332 --- /dev/null +++ b/queue-4.9/brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch @@ -0,0 +1,90 @@ +From e0ebccf1221c3ee7072d8d4c6806c61e152dd6a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 14:59:49 +0000 +Subject: brcmfmac: fix full timeout waiting for action frame on-channel tx + +From: Chung-Hsien Hsu + +[ Upstream commit fbf07000960d9c8a13fdc17c6de0230d681c7543 ] + +The driver sends an action frame down and waits for a completion signal +triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event +to continue the process. However, the action frame could be transmitted +either on the current channel or on an off channel. For the on-channel +case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when +the frame is transmitted, which make the driver always wait a full +timeout duration. This patch has the completion signal be triggered by +receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel +case. + +This change fixes WFA p2p certification 5.1.19 failure. + +Signed-off-by: Chung-Hsien Hsu +Signed-off-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + .../wireless/broadcom/brcm80211/brcmfmac/p2p.c | 17 +++++++++++++++-- + .../wireless/broadcom/brcm80211/brcmfmac/p2p.h | 2 ++ + 2 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +index c91f5ef0be7c3..aac9c97d22557 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -1462,10 +1462,12 @@ int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp, + return 0; + + if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) { +- if (e->status == BRCMF_E_STATUS_SUCCESS) ++ if (e->status == BRCMF_E_STATUS_SUCCESS) { + set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, + &p2p->status); +- else { ++ if (!p2p->wait_for_offchan_complete) ++ complete(&p2p->send_af_done); ++ } else { + set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status); + /* If there is no ack, we don't need to wait for + * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event +@@ -1516,6 +1518,17 @@ static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p, + p2p->af_sent_channel = le32_to_cpu(af_params->channel); + p2p->af_tx_sent_jiffies = jiffies; + ++ if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) && ++ p2p->af_sent_channel == ++ ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq)) ++ p2p->wait_for_offchan_complete = false; ++ else ++ p2p->wait_for_offchan_complete = true; ++ ++ brcmf_dbg(TRACE, "Waiting for %s tx completion event\n", ++ (p2p->wait_for_offchan_complete) ? ++ "off-channel" : "on-channel"); ++ + timeout = wait_for_completion_timeout(&p2p->send_af_done, + P2P_AF_MAX_WAIT_TIME); + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +index 8ce9447533ef8..fbee511489046 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h +@@ -124,6 +124,7 @@ struct afx_hdl { + * @gon_req_action: about to send go negotiation requets frame. + * @block_gon_req_tx: drop tx go negotiation requets frame. + * @p2pdev_dynamically: is p2p device if created by module param or supplicant. ++ * @wait_for_offchan_complete: wait for off-channel tx completion event. + */ + struct brcmf_p2p_info { + struct brcmf_cfg80211_info *cfg; +@@ -144,6 +145,7 @@ struct brcmf_p2p_info { + bool gon_req_action; + bool block_gon_req_tx; + bool p2pdev_dynamically; ++ bool wait_for_offchan_complete; + }; + + s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced); +-- +2.20.1 + diff --git a/queue-4.9/brcmfmac-reduce-timeout-for-action-frame-scan.patch b/queue-4.9/brcmfmac-reduce-timeout-for-action-frame-scan.patch new file mode 100644 index 00000000000..2cc67af4cf7 --- /dev/null +++ b/queue-4.9/brcmfmac-reduce-timeout-for-action-frame-scan.patch @@ -0,0 +1,77 @@ +From 8508d5d656975f774bbad1975efeddd5698e9ecd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 14:59:44 +0000 +Subject: brcmfmac: reduce timeout for action frame scan + +From: Chung-Hsien Hsu + +[ Upstream commit edb6d6885bef82d1eac432dbeca9fbf4ec349d7e ] + +Finding a common channel to send an action frame out is required for +some action types. Since a loop with several scan retry is used to find +the channel, a short wait time could be considered for each attempt. +This patch reduces the wait time from 1500 to 450 msec for each action +frame scan. + +This patch fixes the WFA p2p certification 5.1.20 failure caused by the +long action frame send time. + +Signed-off-by: Chung-Hsien Hsu +Signed-off-by: Chi-Hsien Lin +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +index f78d91b692871..c91f5ef0be7c3 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -74,7 +74,7 @@ + #define P2P_AF_MAX_WAIT_TIME msecs_to_jiffies(2000) + #define P2P_INVALID_CHANNEL -1 + #define P2P_CHANNEL_SYNC_RETRY 5 +-#define P2P_AF_FRM_SCAN_MAX_WAIT msecs_to_jiffies(1500) ++#define P2P_AF_FRM_SCAN_MAX_WAIT msecs_to_jiffies(450) + #define P2P_DEFAULT_SLEEP_TIME_VSDB 200 + + /* WiFi P2P Public Action Frame OUI Subtypes */ +@@ -1139,7 +1139,6 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p) + { + struct afx_hdl *afx_hdl = &p2p->afx_hdl; + struct brcmf_cfg80211_vif *pri_vif; +- unsigned long duration; + s32 retry; + + brcmf_dbg(TRACE, "Enter\n"); +@@ -1155,7 +1154,6 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p) + * pending action frame tx is cancelled. + */ + retry = 0; +- duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT); + while ((retry < P2P_CHANNEL_SYNC_RETRY) && + (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) { + afx_hdl->is_listen = false; +@@ -1163,7 +1161,8 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p) + retry); + /* search peer on peer's listen channel */ + schedule_work(&afx_hdl->afx_work); +- wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration); ++ wait_for_completion_timeout(&afx_hdl->act_frm_scan, ++ P2P_AF_FRM_SCAN_MAX_WAIT); + if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) || + (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, + &p2p->status))) +@@ -1176,7 +1175,7 @@ static s32 brcmf_p2p_af_searching_channel(struct brcmf_p2p_info *p2p) + afx_hdl->is_listen = true; + schedule_work(&afx_hdl->afx_work); + wait_for_completion_timeout(&afx_hdl->act_frm_scan, +- duration); ++ P2P_AF_FRM_SCAN_MAX_WAIT); + } + if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) || + (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, +-- +2.20.1 + diff --git a/queue-4.9/clk-samsung-use-clk_hw-api-for-calling-clk-framework.patch b/queue-4.9/clk-samsung-use-clk_hw-api-for-calling-clk-framework.patch new file mode 100644 index 00000000000..4820c430964 --- /dev/null +++ b/queue-4.9/clk-samsung-use-clk_hw-api-for-calling-clk-framework.patch @@ -0,0 +1,71 @@ +From 4697fcc74c9cda7752c98dc25a7f44cb06701ec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Oct 2018 13:52:10 +0200 +Subject: clk: samsung: Use clk_hw API for calling clk framework from clk + notifiers + +From: Marek Szyprowski + +[ Upstream commit 1da220e3a5d22fccda0bc8542997abc1d1741268 ] + +clk_notifier_register() documentation states, that the provided notifier +callbacks associated with the notifier must not re-enter into the clk +framework by calling any top-level clk APIs. Fix this by replacing +clk_get_rate() calls with clk_hw_get_rate(), which is safe in this +context. + +Signed-off-by: Marek Szyprowski +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +--- + drivers/clk/samsung/clk-cpu.c | 6 +++--- + drivers/clk/samsung/clk-cpu.h | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/samsung/clk-cpu.c b/drivers/clk/samsung/clk-cpu.c +index 8bf7e805fd349..1271315b0c25b 100644 +--- a/drivers/clk/samsung/clk-cpu.c ++++ b/drivers/clk/samsung/clk-cpu.c +@@ -152,7 +152,7 @@ static int exynos_cpuclk_pre_rate_change(struct clk_notifier_data *ndata, + struct exynos_cpuclk *cpuclk, void __iomem *base) + { + const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg; +- unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent); ++ unsigned long alt_prate = clk_hw_get_rate(cpuclk->alt_parent); + unsigned long alt_div = 0, alt_div_mask = DIV_MASK; + unsigned long div0, div1 = 0, mux_reg; + unsigned long flags; +@@ -280,7 +280,7 @@ static int exynos5433_cpuclk_pre_rate_change(struct clk_notifier_data *ndata, + struct exynos_cpuclk *cpuclk, void __iomem *base) + { + const struct exynos_cpuclk_cfg_data *cfg_data = cpuclk->cfg; +- unsigned long alt_prate = clk_get_rate(cpuclk->alt_parent); ++ unsigned long alt_prate = clk_hw_get_rate(cpuclk->alt_parent); + unsigned long alt_div = 0, alt_div_mask = DIV_MASK; + unsigned long div0, div1 = 0, mux_reg; + unsigned long flags; +@@ -432,7 +432,7 @@ int __init exynos_register_cpu_clock(struct samsung_clk_provider *ctx, + else + cpuclk->clk_nb.notifier_call = exynos_cpuclk_notifier_cb; + +- cpuclk->alt_parent = __clk_lookup(alt_parent); ++ cpuclk->alt_parent = __clk_get_hw(__clk_lookup(alt_parent)); + if (!cpuclk->alt_parent) { + pr_err("%s: could not lookup alternate parent %s\n", + __func__, alt_parent); +diff --git a/drivers/clk/samsung/clk-cpu.h b/drivers/clk/samsung/clk-cpu.h +index d4b6b517fe1b4..bd38c6aa38970 100644 +--- a/drivers/clk/samsung/clk-cpu.h ++++ b/drivers/clk/samsung/clk-cpu.h +@@ -49,7 +49,7 @@ struct exynos_cpuclk_cfg_data { + */ + struct exynos_cpuclk { + struct clk_hw hw; +- struct clk *alt_parent; ++ struct clk_hw *alt_parent; + void __iomem *ctrl_base; + spinlock_t *lock; + const struct exynos_cpuclk_cfg_data *cfg; +-- +2.20.1 + diff --git a/queue-4.9/cpu-smt-state-smt-is-disabled-even-with-nosmt-and-wi.patch b/queue-4.9/cpu-smt-state-smt-is-disabled-even-with-nosmt-and-wi.patch new file mode 100644 index 00000000000..70c3d77681d --- /dev/null +++ b/queue-4.9/cpu-smt-state-smt-is-disabled-even-with-nosmt-and-wi.patch @@ -0,0 +1,41 @@ +From 982ab690ae942f83d66563f683efa06467965b29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 19:22:27 +0200 +Subject: cpu/SMT: State SMT is disabled even with nosmt and without "=force" + +From: Borislav Petkov + +[ Upstream commit d0e7d14455d41163126afecd0fcce935463cc512 ] + +When booting with "nosmt=force" a message is issued into dmesg to +confirm that SMT has been force-disabled but such a message is not +issued when only "nosmt" is on the kernel command line. + +Fix that. + +Signed-off-by: Borislav Petkov +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/20181004172227.10094-1-bp@alien8.de +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/cpu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 0ed3e9deda306..c2573e858009b 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -379,6 +379,7 @@ void __init cpu_smt_disable(bool force) + pr_info("SMT: Force disabled\n"); + cpu_smt_control = CPU_SMT_FORCE_DISABLED; + } else { ++ pr_info("SMT: disabled\n"); + cpu_smt_control = CPU_SMT_DISABLED; + } + } +-- +2.20.1 + diff --git a/queue-4.9/crypto-mxs-dcp-fix-aes-issues.patch b/queue-4.9/crypto-mxs-dcp-fix-aes-issues.patch new file mode 100644 index 00000000000..5a2089ebb20 --- /dev/null +++ b/queue-4.9/crypto-mxs-dcp-fix-aes-issues.patch @@ -0,0 +1,121 @@ +From 05bbba7e0ecd1f4c03edf54b41416cba3b01f828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Oct 2018 19:01:52 +0000 +Subject: crypto: mxs-dcp - Fix AES issues + +From: Radu Solea + +[ Upstream commit fadd7a6e616b89c7f4f7bfa7b824f290bab32c3c ] + +The DCP driver does not obey cryptlen, when doing android CTS this +results in passing to hardware input stream lengths which are not +multiple of block size. + +Add a check to prevent future erroneous stream lengths from reaching the +hardware and adjust the scatterlist walking code to obey cryptlen. + +Also properly copy-out the IV for chaining. + +Signed-off-by: Radu Solea +Signed-off-by: Franck LENORMAND +Signed-off-by: Leonard Crestez +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxs-dcp.c | 33 +++++++++++++++++++++++++++++++-- + 1 file changed, 31 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 7483adf120084..b4bd34429cc14 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -225,6 +225,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + dma_addr_t dst_phys = dma_map_single(sdcp->dev, sdcp->coh->aes_out_buf, + DCP_BUF_SZ, DMA_FROM_DEVICE); + ++ if (actx->fill % AES_BLOCK_SIZE) { ++ dev_err(sdcp->dev, "Invalid block size!\n"); ++ ret = -EINVAL; ++ goto aes_done_run; ++ } ++ + /* Fill in the DMA descriptor. */ + desc->control0 = MXS_DCP_CONTROL0_DECR_SEMAPHORE | + MXS_DCP_CONTROL0_INTERRUPT | +@@ -254,6 +260,7 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, + + ret = mxs_dcp_start_dma(actx); + ++aes_done_run: + dma_unmap_single(sdcp->dev, key_phys, 2 * AES_KEYSIZE_128, + DMA_TO_DEVICE); + dma_unmap_single(sdcp->dev, src_phys, DCP_BUF_SZ, DMA_TO_DEVICE); +@@ -280,13 +287,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + + uint8_t *out_tmp, *src_buf, *dst_buf = NULL; + uint32_t dst_off = 0; ++ uint32_t last_out_len = 0; + + uint8_t *key = sdcp->coh->aes_key; + + int ret = 0; + int split = 0; +- unsigned int i, len, clen, rem = 0; ++ unsigned int i, len, clen, rem = 0, tlen = 0; + int init = 0; ++ bool limit_hit = false; + + actx->fill = 0; + +@@ -305,6 +314,11 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + for_each_sg(req->src, src, nents, i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); ++ tlen += len; ++ limit_hit = tlen > req->nbytes; ++ ++ if (limit_hit) ++ len = req->nbytes - (tlen - len); + + do { + if (actx->fill + len > out_off) +@@ -321,13 +335,15 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + * If we filled the buffer or this is the last SG, + * submit the buffer. + */ +- if (actx->fill == out_off || sg_is_last(src)) { ++ if (actx->fill == out_off || sg_is_last(src) || ++ limit_hit) { + ret = mxs_dcp_run_aes(actx, req, init); + if (ret) + return ret; + init = 0; + + out_tmp = out_buf; ++ last_out_len = actx->fill; + while (dst && actx->fill) { + if (!split) { + dst_buf = sg_virt(dst); +@@ -350,6 +366,19 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + } + } + } while (len); ++ ++ if (limit_hit) ++ break; ++ } ++ ++ /* Copy the IV for CBC for chaining */ ++ if (!rctx->ecb) { ++ if (rctx->enc) ++ memcpy(req->info, out_buf+(last_out_len-AES_BLOCK_SIZE), ++ AES_BLOCK_SIZE); ++ else ++ memcpy(req->info, in_buf+(last_out_len-AES_BLOCK_SIZE), ++ AES_BLOCK_SIZE); + } + + return ret; +-- +2.20.1 + diff --git a/queue-4.9/crypto-mxs-dcp-fix-sha-null-hashes-and-output-length.patch b/queue-4.9/crypto-mxs-dcp-fix-sha-null-hashes-and-output-length.patch new file mode 100644 index 00000000000..22a329a2f7d --- /dev/null +++ b/queue-4.9/crypto-mxs-dcp-fix-sha-null-hashes-and-output-length.patch @@ -0,0 +1,133 @@ +From a1ed57cea1ed45b0290e285313e5f77fba6f68d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Oct 2018 19:01:50 +0000 +Subject: crypto: mxs-dcp - Fix SHA null hashes and output length + +From: Radu Solea + +[ Upstream commit c709eebaf5c5faa8a0f140355f9cfe67e8f7afb1 ] + +DCP writes at least 32 bytes in the output buffer instead of hash length +as documented. Add intermediate buffer to prevent write out of bounds. + +When requested to produce null hashes DCP fails to produce valid output. +Add software workaround to bypass hardware and return valid output. + +Signed-off-by: Radu Solea +Signed-off-by: Leonard Crestez +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxs-dcp.c | 47 +++++++++++++++++++++++++++++++--------- + 1 file changed, 37 insertions(+), 10 deletions(-) + +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index decaed448ebbb..7483adf120084 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -28,9 +28,24 @@ + + #define DCP_MAX_CHANS 4 + #define DCP_BUF_SZ PAGE_SIZE ++#define DCP_SHA_PAY_SZ 64 + + #define DCP_ALIGNMENT 64 + ++/* ++ * Null hashes to align with hw behavior on imx6sl and ull ++ * these are flipped for consistency with hw output ++ */ ++const uint8_t sha1_null_hash[] = ++ "\x09\x07\xd8\xaf\x90\x18\x60\x95\xef\xbf" ++ "\x55\x32\x0d\x4b\x6b\x5e\xee\xa3\x39\xda"; ++ ++const uint8_t sha256_null_hash[] = ++ "\x55\xb8\x52\x78\x1b\x99\x95\xa4" ++ "\x4c\x93\x9b\x64\xe4\x41\xae\x27" ++ "\x24\xb9\x6f\x99\xc8\xf4\xfb\x9a" ++ "\x14\x1c\xfc\x98\x42\xc4\xb0\xe3"; ++ + /* DCP DMA descriptor. */ + struct dcp_dma_desc { + uint32_t next_cmd_addr; +@@ -48,6 +63,7 @@ struct dcp_coherent_block { + uint8_t aes_in_buf[DCP_BUF_SZ]; + uint8_t aes_out_buf[DCP_BUF_SZ]; + uint8_t sha_in_buf[DCP_BUF_SZ]; ++ uint8_t sha_out_buf[DCP_SHA_PAY_SZ]; + + uint8_t aes_key[2 * AES_KEYSIZE_128]; + +@@ -513,8 +529,6 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); + struct dcp_async_ctx *actx = crypto_ahash_ctx(tfm); + struct dcp_sha_req_ctx *rctx = ahash_request_ctx(req); +- struct hash_alg_common *halg = crypto_hash_alg_common(tfm); +- + struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; + + dma_addr_t digest_phys = 0; +@@ -536,10 +550,23 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + desc->payload = 0; + desc->status = 0; + ++ /* ++ * Align driver with hw behavior when generating null hashes ++ */ ++ if (rctx->init && rctx->fini && desc->size == 0) { ++ struct hash_alg_common *halg = crypto_hash_alg_common(tfm); ++ const uint8_t *sha_buf = ++ (actx->alg == MXS_DCP_CONTROL1_HASH_SELECT_SHA1) ? ++ sha1_null_hash : sha256_null_hash; ++ memcpy(sdcp->coh->sha_out_buf, sha_buf, halg->digestsize); ++ ret = 0; ++ goto done_run; ++ } ++ + /* Set HASH_TERM bit for last transfer block. */ + if (rctx->fini) { +- digest_phys = dma_map_single(sdcp->dev, req->result, +- halg->digestsize, DMA_FROM_DEVICE); ++ digest_phys = dma_map_single(sdcp->dev, sdcp->coh->sha_out_buf, ++ DCP_SHA_PAY_SZ, DMA_FROM_DEVICE); + desc->control0 |= MXS_DCP_CONTROL0_HASH_TERM; + desc->payload = digest_phys; + } +@@ -547,9 +574,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req) + ret = mxs_dcp_start_dma(actx); + + if (rctx->fini) +- dma_unmap_single(sdcp->dev, digest_phys, halg->digestsize, ++ dma_unmap_single(sdcp->dev, digest_phys, DCP_SHA_PAY_SZ, + DMA_FROM_DEVICE); + ++done_run: + dma_unmap_single(sdcp->dev, buf_phys, DCP_BUF_SZ, DMA_TO_DEVICE); + + return ret; +@@ -567,6 +595,7 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq) + const int nents = sg_nents(req->src); + + uint8_t *in_buf = sdcp->coh->sha_in_buf; ++ uint8_t *out_buf = sdcp->coh->sha_out_buf; + + uint8_t *src_buf; + +@@ -621,11 +650,9 @@ static int dcp_sha_req_to_buf(struct crypto_async_request *arq) + + actx->fill = 0; + +- /* For some reason, the result is flipped. */ +- for (i = 0; i < halg->digestsize / 2; i++) { +- swap(req->result[i], +- req->result[halg->digestsize - i - 1]); +- } ++ /* For some reason the result is flipped */ ++ for (i = 0; i < halg->digestsize; i++) ++ req->result[i] = out_buf[halg->digestsize - i - 1]; + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.9/cxgb4-use-proper-enum-in-cxgb4_dcb_handle_fw_update.patch b/queue-4.9/cxgb4-use-proper-enum-in-cxgb4_dcb_handle_fw_update.patch new file mode 100644 index 00000000000..e2aaefedbba --- /dev/null +++ b/queue-4.9/cxgb4-use-proper-enum-in-cxgb4_dcb_handle_fw_update.patch @@ -0,0 +1,55 @@ +From f18958c54e049a17f8a5eb57a08ea9825b9345c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 20:51:43 -0700 +Subject: cxgb4: Use proper enum in cxgb4_dcb_handle_fw_update + +From: Nathan Chancellor + +[ Upstream commit 3b0b8f0d9a259f6a428af63e7a77547325f8e081 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:303:7: warning: implicit +conversion from enumeration type 'enum cxgb4_dcb_state' to different +enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion] + ? CXGB4_DCB_STATE_FW_ALLSYNCED + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:304:7: warning: implicit +conversion from enumeration type 'enum cxgb4_dcb_state' to different +enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion] + : CXGB4_DCB_STATE_FW_INCOMPLETE); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +2 warnings generated. + +Use the equivalent value of the expected type to silence Clang while +resulting in no functional change. + +CXGB4_DCB_STATE_FW_INCOMPLETE = CXGB4_DCB_INPUT_FW_INCOMPLETE = 2 +CXGB4_DCB_STATE_FW_ALLSYNCED = CXGB4_DCB_INPUT_FW_ALLSYNCED = 3 + +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c +index 6ee2ed30626bf..306b4b3206168 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c +@@ -266,8 +266,8 @@ void cxgb4_dcb_handle_fw_update(struct adapter *adap, + enum cxgb4_dcb_state_input input = + ((pcmd->u.dcb.control.all_syncd_pkd & + FW_PORT_CMD_ALL_SYNCD_F) +- ? CXGB4_DCB_STATE_FW_ALLSYNCED +- : CXGB4_DCB_STATE_FW_INCOMPLETE); ++ ? CXGB4_DCB_INPUT_FW_ALLSYNCED ++ : CXGB4_DCB_INPUT_FW_INCOMPLETE); + + if (dcb->dcb_version != FW_PORT_DCB_VER_UNKNOWN) { + dcb_running_version = FW_PORT_CMD_DCB_VERSION_G( +-- +2.20.1 + diff --git a/queue-4.9/cxgb4-use-proper-enum-in-ieee_faux_sync.patch b/queue-4.9/cxgb4-use-proper-enum-in-ieee_faux_sync.patch new file mode 100644 index 00000000000..391f37bc265 --- /dev/null +++ b/queue-4.9/cxgb4-use-proper-enum-in-ieee_faux_sync.patch @@ -0,0 +1,50 @@ +From b7f8930b0c240f8f0ff0821b3a8e0b2ae52a4f1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 20:47:38 -0700 +Subject: cxgb4: Use proper enum in IEEE_FAUX_SYNC + +From: Nathan Chancellor + +[ Upstream commit 258b6d141878530ba1f8fc44db683822389de914 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c:390:4: warning: implicit +conversion from enumeration type 'enum cxgb4_dcb_state' to different +enumeration type 'enum cxgb4_dcb_state_input' [-Wenum-conversion] + IEEE_FAUX_SYNC(dev, dcb); + ^~~~~~~~~~~~~~~~~~~~~~~~ +drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h:70:10: note: expanded +from macro 'IEEE_FAUX_SYNC' + CXGB4_DCB_STATE_FW_ALLSYNCED); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Use the equivalent value of the expected type to silence Clang while +resulting in no functional change. + +CXGB4_DCB_STATE_FW_ALLSYNCED = CXGB4_DCB_INPUT_FW_ALLSYNCED = 3 + +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h +index ccf24d3dc9824..2c418c405c508 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.h +@@ -67,7 +67,7 @@ + do { \ + if ((__dcb)->dcb_version == FW_PORT_DCB_VER_IEEE) \ + cxgb4_dcb_state_fsm((__dev), \ +- CXGB4_DCB_STATE_FW_ALLSYNCED); \ ++ CXGB4_DCB_INPUT_FW_ALLSYNCED); \ + } while (0) + + /* States we can be in for a port's Data Center Bridging. +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-ep93xx-return-proper-enum-in-ep93xx_dma_ch.patch b/queue-4.9/dmaengine-ep93xx-return-proper-enum-in-ep93xx_dma_ch.patch new file mode 100644 index 00000000000..f5dc42694bc --- /dev/null +++ b/queue-4.9/dmaengine-ep93xx-return-proper-enum-in-ep93xx_dma_ch.patch @@ -0,0 +1,46 @@ +From db6565aa3eb9e8aa7f3993242406734cd6e0ca58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 16:40:20 -0700 +Subject: dmaengine: ep93xx: Return proper enum in ep93xx_dma_chan_direction + +From: Nathan Chancellor + +[ Upstream commit 9524d6b265f9b2b9a61fceb2ee2ce1c2a83e39ca ] + +Clang warns when implicitly converting from one enumerated type to +another. Avoid this by using the equivalent value from the expected +type. + +In file included from drivers/dma/ep93xx_dma.c:30: +./include/linux/platform_data/dma-ep93xx.h:88:10: warning: implicit +conversion from enumeration type 'enum dma_data_direction' to different +enumeration type 'enum dma_transfer_direction' [-Wenum-conversion] + return DMA_NONE; + ~~~~~~ ^~~~~~~~ +1 warning generated. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + include/linux/platform_data/dma-ep93xx.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/platform_data/dma-ep93xx.h b/include/linux/platform_data/dma-ep93xx.h +index e82c642fa53cd..5913be0793a26 100644 +--- a/include/linux/platform_data/dma-ep93xx.h ++++ b/include/linux/platform_data/dma-ep93xx.h +@@ -84,7 +84,7 @@ static inline enum dma_transfer_direction + ep93xx_dma_chan_direction(struct dma_chan *chan) + { + if (!ep93xx_dma_chan_is_m2p(chan)) +- return DMA_NONE; ++ return DMA_TRANS_NONE; + + /* even channels are for TX, odd for RX */ + return (chan->chan_id % 2 == 0) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM; +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-ioat-fix-prototype-of-ioat_enumerate_chann.patch b/queue-4.9/dmaengine-ioat-fix-prototype-of-ioat_enumerate_chann.patch new file mode 100644 index 00000000000..91fd4cba771 --- /dev/null +++ b/queue-4.9/dmaengine-ioat-fix-prototype-of-ioat_enumerate_chann.patch @@ -0,0 +1,58 @@ +From cbd2012619e93195911df64dabb51ed27b9bca13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Oct 2018 00:03:10 +0300 +Subject: dmaengine: ioat: fix prototype of ioat_enumerate_channels + +From: Rami Rosen + +[ Upstream commit f4d34aa8c887a8a2d23ef546da0efa10e3f77241 ] + +Signed-off-by: Rami Rosen +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/init.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c +index d139706f01fe8..9d936584d3310 100644 +--- a/drivers/dma/ioat/init.c ++++ b/drivers/dma/ioat/init.c +@@ -129,7 +129,7 @@ static void + ioat_init_channel(struct ioatdma_device *ioat_dma, + struct ioatdma_chan *ioat_chan, int idx); + static void ioat_intr_quirk(struct ioatdma_device *ioat_dma); +-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma); ++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma); + static int ioat3_dma_self_test(struct ioatdma_device *ioat_dma); + + static int ioat_dca_enabled = 1; +@@ -573,7 +573,7 @@ static void ioat_dma_remove(struct ioatdma_device *ioat_dma) + * ioat_enumerate_channels - find and initialize the device's channels + * @ioat_dma: the ioat dma device to be enumerated + */ +-static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) ++static void ioat_enumerate_channels(struct ioatdma_device *ioat_dma) + { + struct ioatdma_chan *ioat_chan; + struct device *dev = &ioat_dma->pdev->dev; +@@ -592,7 +592,7 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) + xfercap_log = readb(ioat_dma->reg_base + IOAT_XFERCAP_OFFSET); + xfercap_log &= 0x1f; /* bits [4:0] valid */ + if (xfercap_log == 0) +- return 0; ++ return; + dev_dbg(dev, "%s: xfercap = %d\n", __func__, 1 << xfercap_log); + + for (i = 0; i < dma->chancnt; i++) { +@@ -609,7 +609,6 @@ static int ioat_enumerate_channels(struct ioatdma_device *ioat_dma) + } + } + dma->chancnt = i; +- return i; + } + + /** +-- +2.20.1 + diff --git a/queue-4.9/dmaengine-timb_dma-use-proper-enum-in-td_prep_slave_.patch b/queue-4.9/dmaengine-timb_dma-use-proper-enum-in-td_prep_slave_.patch new file mode 100644 index 00000000000..f9fc06ecc0f --- /dev/null +++ b/queue-4.9/dmaengine-timb_dma-use-proper-enum-in-td_prep_slave_.patch @@ -0,0 +1,45 @@ +From a74a96a87e60ce4deaa59e976b7c4f401b8e2045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Sep 2018 16:20:25 -0700 +Subject: dmaengine: timb_dma: Use proper enum in td_prep_slave_sg + +From: Nathan Chancellor + +[ Upstream commit 5e621f5d538985f010035c6f3e28c22829d36db1 ] + +Clang warns when implicitly converting from one enumerated type to +another. Avoid this by using the equivalent value from the expected +type. + +drivers/dma/timb_dma.c:548:27: warning: implicit conversion from +enumeration type 'enum dma_transfer_direction' to different enumeration +type 'enum dma_data_direction' [-Wenum-conversion] + td_desc->desc_list_len, DMA_MEM_TO_DEV); + ^~~~~~~~~~~~~~ +1 warning generated. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/timb_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/timb_dma.c b/drivers/dma/timb_dma.c +index 896bafb7a5324..cf6588cc3efdc 100644 +--- a/drivers/dma/timb_dma.c ++++ b/drivers/dma/timb_dma.c +@@ -545,7 +545,7 @@ static struct dma_async_tx_descriptor *td_prep_slave_sg(struct dma_chan *chan, + } + + dma_sync_single_for_device(chan2dmadev(chan), td_desc->txd.phys, +- td_desc->desc_list_len, DMA_MEM_TO_DEV); ++ td_desc->desc_list_len, DMA_TO_DEVICE); + + return &td_desc->txd; + } +-- +2.20.1 + diff --git a/queue-4.9/f2fs-return-correct-errno-in-f2fs_gc.patch b/queue-4.9/f2fs-return-correct-errno-in-f2fs_gc.patch new file mode 100644 index 00000000000..ca3b08c0055 --- /dev/null +++ b/queue-4.9/f2fs-return-correct-errno-in-f2fs_gc.patch @@ -0,0 +1,34 @@ +From e17843381fe4ee70bbeacf85fc67c91ca560a5bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 15:25:21 -0700 +Subject: f2fs: return correct errno in f2fs_gc + +From: Jaegeuk Kim + +[ Upstream commit 61f7725aa148ee870436a29d3a24d5c00ab7e9af ] + +This fixes overriding error number in f2fs_gc. + +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/gc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index 759056e776e50..b1d62003cda62 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -985,7 +985,7 @@ int f2fs_gc(struct f2fs_sb_info *sbi, bool sync) + + put_gc_inode(&gc_list); + +- if (sync) ++ if (sync && !ret) + ret = sec_freed ? 0 : -EAGAIN; + return ret; + } +-- +2.20.1 + diff --git a/queue-4.9/fbdev-sbuslib-integer-overflow-in-sbusfb_ioctl_helpe.patch b/queue-4.9/fbdev-sbuslib-integer-overflow-in-sbusfb_ioctl_helpe.patch new file mode 100644 index 00000000000..bf41162869d --- /dev/null +++ b/queue-4.9/fbdev-sbuslib-integer-overflow-in-sbusfb_ioctl_helpe.patch @@ -0,0 +1,38 @@ +From f5645e67ca8604fe2161215a2d19aaba66db29af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 12:57:36 +0200 +Subject: fbdev: sbuslib: integer overflow in sbusfb_ioctl_helper() + +From: Dan Carpenter + +[ Upstream commit e5017716adb8aa5c01c52386c1b7470101ffe9c5 ] + +The "index + count" addition can overflow. Both come directly from the +user. This bug leads to an information leak. + +Signed-off-by: Dan Carpenter +Cc: Peter Malone +Cc: Philippe Ombredanne +Cc: Mathieu Malaterre +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sbuslib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c +index b425718925c01..52e161dbd2047 100644 +--- a/drivers/video/fbdev/sbuslib.c ++++ b/drivers/video/fbdev/sbuslib.c +@@ -170,7 +170,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + get_user(ublue, &c->blue)) + return -EFAULT; + +- if (index + count > cmap->len) ++ if (index > cmap->len || count > cmap->len - index) + return -EINVAL; + + for (i = 0; i < count; i++) { +-- +2.20.1 + diff --git a/queue-4.9/fbdev-sbuslib-use-checked-version-of-put_user.patch b/queue-4.9/fbdev-sbuslib-use-checked-version-of-put_user.patch new file mode 100644 index 00000000000..7acc74908e5 --- /dev/null +++ b/queue-4.9/fbdev-sbuslib-use-checked-version-of-put_user.patch @@ -0,0 +1,77 @@ +From b28e8634e3646b1f14b1105ea45749f87c428340 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 12:57:36 +0200 +Subject: fbdev: sbuslib: use checked version of put_user() + +From: Dan Carpenter + +[ Upstream commit d8bad911e5e55e228d59c0606ff7e6b8131ca7bf ] + +I'm not sure why the code assumes that only the first put_user() needs +an access_ok() check. I have made all the put_user() and get_user() +calls checked. + +Signed-off-by: Dan Carpenter +Cc: Philippe Ombredanne +Cc: Mathieu Malaterre +Cc: Peter Malone , +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sbuslib.c | 26 +++++++++++++------------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c +index 31c301d6be621..b425718925c01 100644 +--- a/drivers/video/fbdev/sbuslib.c ++++ b/drivers/video/fbdev/sbuslib.c +@@ -105,11 +105,11 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + struct fbtype __user *f = (struct fbtype __user *) arg; + + if (put_user(type, &f->fb_type) || +- __put_user(info->var.yres, &f->fb_height) || +- __put_user(info->var.xres, &f->fb_width) || +- __put_user(fb_depth, &f->fb_depth) || +- __put_user(0, &f->fb_cmsize) || +- __put_user(fb_size, &f->fb_cmsize)) ++ put_user(info->var.yres, &f->fb_height) || ++ put_user(info->var.xres, &f->fb_width) || ++ put_user(fb_depth, &f->fb_depth) || ++ put_user(0, &f->fb_cmsize) || ++ put_user(fb_size, &f->fb_cmsize)) + return -EFAULT; + return 0; + } +@@ -124,10 +124,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + unsigned int index, count, i; + + if (get_user(index, &c->index) || +- __get_user(count, &c->count) || +- __get_user(ured, &c->red) || +- __get_user(ugreen, &c->green) || +- __get_user(ublue, &c->blue)) ++ get_user(count, &c->count) || ++ get_user(ured, &c->red) || ++ get_user(ugreen, &c->green) || ++ get_user(ublue, &c->blue)) + return -EFAULT; + + cmap.len = 1; +@@ -164,10 +164,10 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + u8 red, green, blue; + + if (get_user(index, &c->index) || +- __get_user(count, &c->count) || +- __get_user(ured, &c->red) || +- __get_user(ugreen, &c->green) || +- __get_user(ublue, &c->blue)) ++ get_user(count, &c->count) || ++ get_user(ured, &c->red) || ++ get_user(ugreen, &c->green) || ++ get_user(ublue, &c->blue)) + return -EFAULT; + + if (index + count > cmap->len) +-- +2.20.1 + diff --git a/queue-4.9/gfs2-flush-the-gfs2-delete-workqueue-before-stopping.patch b/queue-4.9/gfs2-flush-the-gfs2-delete-workqueue-before-stopping.patch new file mode 100644 index 00000000000..1f70f23d1a2 --- /dev/null +++ b/queue-4.9/gfs2-flush-the-gfs2-delete-workqueue-before-stopping.patch @@ -0,0 +1,65 @@ +From 08c41beba2eefb82707c01966eec3b551c8da28c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 12:15:40 -0500 +Subject: GFS2: Flush the GFS2 delete workqueue before stopping the kernel + threads + +From: Tim Smith + +[ Upstream commit 1eb8d7387908022951792a46fa040ad3942b3b08 ] + +Flushing the workqueue can cause operations to happen which might +call gfs2_log_reserve(), or get stuck waiting for locks taken by such +operations. gfs2_log_reserve() can io_schedule(). If this happens, it +will never wake because the only thing which can wake it is gfs2_logd() +which was already stopped. + +This causes umount of a gfs2 filesystem to wedge permanently if, for +example, the umount immediately follows a large delete operation. + +When this occured, the following stack trace was obtained from the +umount command + +[] flush_workqueue+0x1c8/0x520 +[] gfs2_make_fs_ro+0x69/0x160 [gfs2] +[] gfs2_put_super+0xa9/0x1c0 [gfs2] +[] generic_shutdown_super+0x6f/0x100 +[] kill_block_super+0x27/0x70 +[] gfs2_kill_sb+0x71/0x80 [gfs2] +[] deactivate_locked_super+0x3b/0x70 +[] deactivate_super+0x59/0x60 +[] cleanup_mnt+0x58/0x80 +[] __cleanup_mnt+0x12/0x20 +[] task_work_run+0x7d/0xa0 +[] exit_to_usermode_loop+0x73/0x98 +[] syscall_return_slowpath+0x41/0x50 +[] int_ret_from_sys_call+0x25/0x8f +[] 0xffffffffffffffff + +Signed-off-by: Tim Smith +Signed-off-by: Mark Syms +Signed-off-by: Bob Peterson +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index e3ee387a6dfeb..37496d83661a7 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -844,10 +844,10 @@ static int gfs2_make_fs_ro(struct gfs2_sbd *sdp) + if (error && !test_bit(SDF_SHUTDOWN, &sdp->sd_flags)) + return error; + ++ flush_workqueue(gfs2_delete_workqueue); + kthread_stop(sdp->sd_quotad_process); + kthread_stop(sdp->sd_logd_process); + +- flush_workqueue(gfs2_delete_workqueue); + gfs2_quota_sync(sdp->sd_vfs, 0); + gfs2_statfs_sync(sdp->sd_vfs, 0); + +-- +2.20.1 + diff --git a/queue-4.9/gpio-syscon-fix-possible-null-ptr-usage.patch b/queue-4.9/gpio-syscon-fix-possible-null-ptr-usage.patch new file mode 100644 index 00000000000..a1f64c5c223 --- /dev/null +++ b/queue-4.9/gpio-syscon-fix-possible-null-ptr-usage.patch @@ -0,0 +1,37 @@ +From a7a1ab183ca80b81ed7f70892a88167e74ad3588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 00:52:52 +0200 +Subject: gpio: syscon: Fix possible NULL ptr usage + +From: Marek Vasut + +[ Upstream commit 70728c29465bc4bfa7a8c14304771eab77e923c7 ] + +The priv->data->set can be NULL while flags contains GPIO_SYSCON_FEAT_OUT +and chip->set is valid pointer. This happens in case the controller uses +the default GPIO setter. Always use chip->set to access the setter to avoid +possible NULL pointer dereferencing. + +Signed-off-by: Marek Vasut +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-syscon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-syscon.c b/drivers/gpio/gpio-syscon.c +index 537cec7583fca..cf88a0bfe99ea 100644 +--- a/drivers/gpio/gpio-syscon.c ++++ b/drivers/gpio/gpio-syscon.c +@@ -122,7 +122,7 @@ static int syscon_gpio_dir_out(struct gpio_chip *chip, unsigned offset, int val) + BIT(offs % SYSCON_REG_BITS)); + } + +- priv->data->set(chip, offset, val); ++ chip->set(chip, offset, val); + + return 0; + } +-- +2.20.1 + diff --git a/queue-4.9/hwmon-ina3221-fix-ina3221_config_mode-macros.patch b/queue-4.9/hwmon-ina3221-fix-ina3221_config_mode-macros.patch new file mode 100644 index 00000000000..982fdce2da6 --- /dev/null +++ b/queue-4.9/hwmon-ina3221-fix-ina3221_config_mode-macros.patch @@ -0,0 +1,43 @@ +From 4b12e77ab983c13603b7e1bc621a459474114db0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Sep 2018 14:44:06 -0700 +Subject: hwmon: (ina3221) Fix INA3221_CONFIG_MODE macros + +From: Nicolin Chen + +[ Upstream commit 791ebc9d34e9d212fc03742c31654b017d385926 ] + +The three INA3221_CONFIG_MODE macros are not correctly defined here. +The MODE3-1 bits are located at BIT 2-0 according to the datasheet. + +So this patch just fixes them by shifting all of them with a correct +offset. However, this isn't a crital bug fix as the driver does not +use any of them at this point. + +Signed-off-by: Nicolin Chen +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ina3221.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c +index e6b49500c52ae..8c9555313fc3d 100644 +--- a/drivers/hwmon/ina3221.c ++++ b/drivers/hwmon/ina3221.c +@@ -38,9 +38,9 @@ + #define INA3221_WARN3 0x0c + #define INA3221_MASK_ENABLE 0x0f + +-#define INA3221_CONFIG_MODE_SHUNT BIT(1) +-#define INA3221_CONFIG_MODE_BUS BIT(2) +-#define INA3221_CONFIG_MODE_CONTINUOUS BIT(3) ++#define INA3221_CONFIG_MODE_SHUNT BIT(0) ++#define INA3221_CONFIG_MODE_BUS BIT(1) ++#define INA3221_CONFIG_MODE_CONTINUOUS BIT(2) + + #define INA3221_RSHUNT_DEFAULT 10000 + +-- +2.20.1 + diff --git a/queue-4.9/hwmon-pwm-fan-silence-error-on-probe-deferral.patch b/queue-4.9/hwmon-pwm-fan-silence-error-on-probe-deferral.patch new file mode 100644 index 00000000000..335cbf858d9 --- /dev/null +++ b/queue-4.9/hwmon-pwm-fan-silence-error-on-probe-deferral.patch @@ -0,0 +1,41 @@ +From 9cdf343a2a121bcaed58596220de9f9acc27aaef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 12:10:47 +0200 +Subject: hwmon: (pwm-fan) Silence error on probe deferral + +From: Thierry Reding + +[ Upstream commit 9f67f7583e77fe5dc57aab3a6159c2642544eaad ] + +Probe deferrals aren't actual errors, so silence the error message in +case the PWM cannot yet be acquired. + +Signed-off-by: Thierry Reding +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pwm-fan.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c +index fb03449de2e07..aa6333620c37d 100644 +--- a/drivers/hwmon/pwm-fan.c ++++ b/drivers/hwmon/pwm-fan.c +@@ -231,8 +231,12 @@ static int pwm_fan_probe(struct platform_device *pdev) + + ctx->pwm = devm_of_pwm_get(&pdev->dev, pdev->dev.of_node, NULL); + if (IS_ERR(ctx->pwm)) { +- dev_err(&pdev->dev, "Could not get PWM\n"); +- return PTR_ERR(ctx->pwm); ++ ret = PTR_ERR(ctx->pwm); ++ ++ if (ret != -EPROBE_DEFER) ++ dev_err(&pdev->dev, "Could not get PWM: %d\n", ret); ++ ++ return ret; + } + + platform_set_drvdata(pdev, ctx); +-- +2.20.1 + diff --git a/queue-4.9/i2c-brcmstb-allow-enabling-the-driver-on-dsl-socs.patch b/queue-4.9/i2c-brcmstb-allow-enabling-the-driver-on-dsl-socs.patch new file mode 100644 index 00000000000..973845fa77a --- /dev/null +++ b/queue-4.9/i2c-brcmstb-allow-enabling-the-driver-on-dsl-socs.patch @@ -0,0 +1,44 @@ +From eefc7fb09a973553809ded81d2b7b50ef0309d50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 10:43:47 -0700 +Subject: i2c: brcmstb: Allow enabling the driver on DSL SoCs + +From: Florian Fainelli + +[ Upstream commit e1eba2ea54a2de0e4c58d87270d25706bb77b844 ] + +ARCH_BCM_63XX which is used by ARM-based DSL SoCs from Broadcom uses the +same controller, make it possible to select the STB driver and update +the Kconfig and help text a bit. + +Signed-off-by: Florian Fainelli +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/Kconfig | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index d252276feadf6..759c621a860a9 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -397,12 +397,13 @@ config I2C_BCM_KONA + If you do not need KONA I2C interface, say N. + + config I2C_BRCMSTB +- tristate "BRCM Settop I2C controller" +- depends on ARCH_BRCMSTB || BMIPS_GENERIC || COMPILE_TEST ++ tristate "BRCM Settop/DSL I2C controller" ++ depends on ARCH_BRCMSTB || BMIPS_GENERIC || ARCH_BCM_63XX || \ ++ COMPILE_TEST + default y + help + If you say yes to this option, support will be included for the +- I2C interface on the Broadcom Settop SoCs. ++ I2C interface on the Broadcom Settop/DSL SoCs. + + If you do not need I2C interface, say N. + +-- +2.20.1 + diff --git a/queue-4.9/ib-mlx4-avoid-implicit-enumerated-type-conversion.patch b/queue-4.9/ib-mlx4-avoid-implicit-enumerated-type-conversion.patch new file mode 100644 index 00000000000..f4e624fbeda --- /dev/null +++ b/queue-4.9/ib-mlx4-avoid-implicit-enumerated-type-conversion.patch @@ -0,0 +1,51 @@ +From 9b6f8bab120e515a09dd931b5a63a6b5def2fa16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Sep 2018 12:57:16 -0700 +Subject: IB/mlx4: Avoid implicit enumerated type conversion + +From: Nathan Chancellor + +[ Upstream commit b56511c15713ba6c7572e77a41f7ddba9c1053ec ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/infiniband/hw/mlx4/mad.c:1811:41: warning: implicit conversion +from enumeration type 'enum mlx4_ib_qp_flags' to different enumeration +type 'enum ib_qp_create_flags' [-Wenum-conversion] + qp_init_attr.init_attr.create_flags = MLX4_IB_SRIOV_TUNNEL_QP; + ~ ^~~~~~~~~~~~~~~~~~~~~~~ + +drivers/infiniband/hw/mlx4/mad.c:1819:41: warning: implicit conversion +from enumeration type 'enum mlx4_ib_qp_flags' to different enumeration +type 'enum ib_qp_create_flags' [-Wenum-conversion] + qp_init_attr.init_attr.create_flags = MLX4_IB_SRIOV_SQP; + ~ ^~~~~~~~~~~~~~~~~ + +The type mlx4_ib_qp_flags explicitly provides supplemental values to the +type ib_qp_create_flags. Make that clear to Clang by changing the +create_flags type to u32. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + include/rdma/ib_verbs.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 0638b8aeba34d..1d9c701b1c7b3 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -1026,7 +1026,7 @@ struct ib_qp_init_attr { + struct ib_qp_cap cap; + enum ib_sig_type sq_sig_type; + enum ib_qp_type qp_type; +- enum ib_qp_create_flags create_flags; ++ u32 create_flags; + + /* + * Only needed for special QP types, or when using the RW API. +-- +2.20.1 + diff --git a/queue-4.9/ib-mthca-fix-error-return-code-in-__mthca_init_one.patch b/queue-4.9/ib-mthca-fix-error-return-code-in-__mthca_init_one.patch new file mode 100644 index 00000000000..e25dde0362e --- /dev/null +++ b/queue-4.9/ib-mthca-fix-error-return-code-in-__mthca_init_one.patch @@ -0,0 +1,37 @@ +From 5fd25359ecd7bbf0bc5c8993b94e2852a86bac97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Sep 2018 03:55:16 +0000 +Subject: IB/mthca: Fix error return code in __mthca_init_one() + +From: Wei Yongjun + +[ Upstream commit 39f2495618c5e980d2873ea3f2d1877dd253e07a ] + +Fix to return a negative error code from the mthca_cmd_init() error +handling case instead of 0, as done elsewhere in this function. + +Fixes: 80fd8238734c ("[PATCH] IB/mthca: Encapsulate command interface init") +Signed-off-by: Wei Yongjun +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c +index ded76c101dde3..834b06aacc2bf 100644 +--- a/drivers/infiniband/hw/mthca/mthca_main.c ++++ b/drivers/infiniband/hw/mthca/mthca_main.c +@@ -989,7 +989,8 @@ static int __mthca_init_one(struct pci_dev *pdev, int hca_type) + goto err_free_dev; + } + +- if (mthca_cmd_init(mdev)) { ++ err = mthca_cmd_init(mdev); ++ if (err) { + mthca_err(mdev, "Failed to init command interface, aborting.\n"); + goto err_free_dev; + } +-- +2.20.1 + diff --git a/queue-4.9/input-silead-try-firmware-reload-after-unsuccessful-.patch b/queue-4.9/input-silead-try-firmware-reload-after-unsuccessful-.patch new file mode 100644 index 00000000000..0203d73a689 --- /dev/null +++ b/queue-4.9/input-silead-try-firmware-reload-after-unsuccessful-.patch @@ -0,0 +1,62 @@ +From ce21e5edbe4f2ba0312abbb57a1b4d1a7c5254cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Oct 2018 11:48:31 -0700 +Subject: Input: silead - try firmware reload after unsuccessful resume + +From: Julian Sax + +[ Upstream commit dde27443211062e841806feaf690674b7c3a599f ] + +A certain silead controller (Chip ID: 0x56810000) loses its firmware +after suspend, causing the resume to fail. This patch tries to load +the firmware, should a resume error occur and retries the resuming. + +Signed-off-by: Julian Sax +Acked-by: Hans de Goede +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/silead.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/input/touchscreen/silead.c b/drivers/input/touchscreen/silead.c +index f502c8488be86..867772878c0c8 100644 +--- a/drivers/input/touchscreen/silead.c ++++ b/drivers/input/touchscreen/silead.c +@@ -504,20 +504,33 @@ static int __maybe_unused silead_ts_suspend(struct device *dev) + static int __maybe_unused silead_ts_resume(struct device *dev) + { + struct i2c_client *client = to_i2c_client(dev); ++ bool second_try = false; + int error, status; + + silead_ts_set_power(client, SILEAD_POWER_ON); + ++ retry: + error = silead_ts_reset(client); + if (error) + return error; + ++ if (second_try) { ++ error = silead_ts_load_fw(client); ++ if (error) ++ return error; ++ } ++ + error = silead_ts_startup(client); + if (error) + return error; + + status = silead_ts_get_status(client); + if (status != SILEAD_STATUS_OK) { ++ if (!second_try) { ++ second_try = true; ++ dev_dbg(dev, "Reloading firmware after unsuccessful resume\n"); ++ goto retry; ++ } + dev_err(dev, "Resume error, status: 0x%02x\n", status); + return -ENODEV; + } +-- +2.20.1 + diff --git a/queue-4.9/input-st1232-set-input_prop_direct-property.patch b/queue-4.9/input-st1232-set-input_prop_direct-property.patch new file mode 100644 index 00000000000..11037c8716e --- /dev/null +++ b/queue-4.9/input-st1232-set-input_prop_direct-property.patch @@ -0,0 +1,33 @@ +From c92564caaeb6f813df23e173bde0b4a675a154f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Oct 2018 11:44:45 -0700 +Subject: Input: st1232 - set INPUT_PROP_DIRECT property + +From: Martin Kepplinger + +[ Upstream commit 20bbb312079494a406c10c90932e3c80837c9d94 ] + +This is how userspace checks for touchscreen devices most reliably. + +Signed-off-by: Martin Kepplinger +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/st1232.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/touchscreen/st1232.c b/drivers/input/touchscreen/st1232.c +index e943678ce54cd..f1c574d6be17f 100644 +--- a/drivers/input/touchscreen/st1232.c ++++ b/drivers/input/touchscreen/st1232.c +@@ -203,6 +203,7 @@ static int st1232_ts_probe(struct i2c_client *client, + input_dev->id.bustype = BUS_I2C; + input_dev->dev.parent = &client->dev; + ++ __set_bit(INPUT_PROP_DIRECT, input_dev->propbit); + __set_bit(EV_SYN, input_dev->evbit); + __set_bit(EV_KEY, input_dev->evbit); + __set_bit(EV_ABS, input_dev->evbit); +-- +2.20.1 + diff --git a/queue-4.9/iwlwifi-mvm-don-t-send-keys-when-entering-d3.patch b/queue-4.9/iwlwifi-mvm-don-t-send-keys-when-entering-d3.patch new file mode 100644 index 00000000000..165d5706be5 --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-don-t-send-keys-when-entering-d3.patch @@ -0,0 +1,42 @@ +From e27dedeca50b0056dbc1cd92b56ec2e17dfb8e01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jul 2018 14:52:06 +0300 +Subject: iwlwifi: mvm: don't send keys when entering D3 + +From: Sara Sharon + +[ Upstream commit 8c7fd6a365eb5b2647b2c01918730d0a485b9f85 ] + +In the past, we needed to program the keys when entering D3. This was +since we replaced the image. However, now that there is a single +image, this is no longer needed. Note that RSC is sent separately in +a new command. This solves issues with newer devices that support PN +offload. Since driver re-sent the keys, the PN got zeroed and the +receiver dropped the next packets, until PN caught up again. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +index 207d8ae1e1160..19052efe53f12 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c +@@ -935,8 +935,10 @@ int iwl_mvm_wowlan_config_key_params(struct iwl_mvm *mvm, + { + struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {}; + struct iwl_wowlan_tkip_params_cmd tkip_cmd = {}; ++ bool unified = fw_has_capa(&mvm->fw->ucode_capa, ++ IWL_UCODE_TLV_CAPA_CNSLDTD_D3_D0_IMG); + struct wowlan_key_data key_data = { +- .configure_keys = !d0i3, ++ .configure_keys = !d0i3 && !unified, + .use_rsc_tsc = false, + .tkip = &tkip_cmd, + .use_tkip = false, +-- +2.20.1 + diff --git a/queue-4.9/ixgbe-fix-crash-with-vfs-and-flow-director-on-interf.patch b/queue-4.9/ixgbe-fix-crash-with-vfs-and-flow-director-on-interf.patch new file mode 100644 index 00000000000..74ea8d59a28 --- /dev/null +++ b/queue-4.9/ixgbe-fix-crash-with-vfs-and-flow-director-on-interf.patch @@ -0,0 +1,56 @@ +From 6e9ea60adbe2289f106c6e3d252c5441c0fced30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Sep 2018 09:24:20 +0200 +Subject: ixgbe: Fix crash with VFs and flow director on interface flap + +From: Radoslaw Tyl + +[ Upstream commit 5d826d209164b0752c883607be4cdbbcf7cab494 ] + +This patch fix crash when we have restore flow director filters after reset +adapter. In ixgbe_fdir_filter_restore() filter->action is outside of the +rx_ring array, as it has a VF identifier in the upper 32 bits. + +Signed-off-by: Radoslaw Tyl +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index a5428b6abdac2..8ad20b7852ed7 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -4804,6 +4804,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) + struct ixgbe_hw *hw = &adapter->hw; + struct hlist_node *node2; + struct ixgbe_fdir_filter *filter; ++ u64 action; + + spin_lock(&adapter->fdir_perfect_lock); + +@@ -4812,12 +4813,17 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter) + + hlist_for_each_entry_safe(filter, node2, + &adapter->fdir_filter_list, fdir_node) { ++ action = filter->action; ++ if (action != IXGBE_FDIR_DROP_QUEUE && action != 0) ++ action = ++ (action >> ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF) - 1; ++ + ixgbe_fdir_write_perfect_filter_82599(hw, + &filter->filter, + filter->sw_idx, +- (filter->action == IXGBE_FDIR_DROP_QUEUE) ? ++ (action == IXGBE_FDIR_DROP_QUEUE) ? + IXGBE_FDIR_DROP_QUEUE : +- adapter->rx_ring[filter->action]->reg_idx); ++ adapter->rx_ring[action]->reg_idx); + } + + spin_unlock(&adapter->fdir_perfect_lock); +-- +2.20.1 + diff --git a/queue-4.9/kvm-arm-arm64-fix-stage2_flush_memslot-for-4-level-p.patch b/queue-4.9/kvm-arm-arm64-fix-stage2_flush_memslot-for-4-level-p.patch new file mode 100644 index 00000000000..c4bc19ebbc8 --- /dev/null +++ b/queue-4.9/kvm-arm-arm64-fix-stage2_flush_memslot-for-4-level-p.patch @@ -0,0 +1,41 @@ +From 39c7252913e4346cea06105a47346788f512c3dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:32:37 +0100 +Subject: kvm: arm/arm64: Fix stage2_flush_memslot for 4 level page table + +From: Suzuki K Poulose + +[ Upstream commit d2db7773ba864df6b4e19643dfc54838550d8049 ] + +So far we have only supported 3 level page table with fixed IPA of +40bits, where PUD is folded. With 4 level page tables, we need +to check if the PUD entry is valid or not. Fix stage2_flush_memslot() +to do this check, before walking down the table. + +Acked-by: Christoffer Dall +Acked-by: Marc Zyngier +Reviewed-by: Eric Auger +Signed-off-by: Suzuki K Poulose +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + arch/arm/kvm/mmu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c +index b3d268a79f057..bb0d5e21d60bd 100644 +--- a/arch/arm/kvm/mmu.c ++++ b/arch/arm/kvm/mmu.c +@@ -366,7 +366,8 @@ static void stage2_flush_memslot(struct kvm *kvm, + pgd = kvm->arch.pgd + stage2_pgd_index(addr); + do { + next = stage2_pgd_addr_end(addr, end); +- stage2_flush_puds(kvm, pgd, addr, next); ++ if (!stage2_pgd_none(*pgd)) ++ stage2_flush_puds(kvm, pgd, addr, next); + } while (pgd++, addr = next, addr != end); + } + +-- +2.20.1 + diff --git a/queue-4.9/kvm-ppc-book3s-pr-exiting-split-hack-mode-needs-to-f.patch b/queue-4.9/kvm-ppc-book3s-pr-exiting-split-hack-mode-needs-to-f.patch new file mode 100644 index 00000000000..0bdfa884ed6 --- /dev/null +++ b/queue-4.9/kvm-ppc-book3s-pr-exiting-split-hack-mode-needs-to-f.patch @@ -0,0 +1,45 @@ +From c2b32c8ebc9ba8914d5dee83d9aee46107d1ce4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Jul 2018 07:39:21 -0700 +Subject: KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup both PC + and LR + +From: Cameron Kaiser + +[ Upstream commit 1006284c5e411872333967b1970c2ca46a9e225f ] + +When an OS (currently only classic Mac OS) is running in KVM-PR and makes a +linked jump from code with split hack addressing enabled into code that does +not, LR is not correctly updated and reflects the previously munged PC. + +To fix this, this patch undoes the address munge when exiting split +hack mode so that code relying on LR being a proper address will now +execute. This does not affect OS X or other operating systems running +on KVM-PR. + +Signed-off-by: Cameron Kaiser +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/kvm/book3s.c b/arch/powerpc/kvm/book3s.c +index 73c3c127d8584..209cad89a11a5 100644 +--- a/arch/powerpc/kvm/book3s.c ++++ b/arch/powerpc/kvm/book3s.c +@@ -78,8 +78,11 @@ void kvmppc_unfixup_split_real(struct kvm_vcpu *vcpu) + { + if (vcpu->arch.hflags & BOOK3S_HFLAG_SPLIT_HACK) { + ulong pc = kvmppc_get_pc(vcpu); ++ ulong lr = kvmppc_get_lr(vcpu); + if ((pc & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS) + kvmppc_set_pc(vcpu, pc & ~SPLIT_HACK_MASK); ++ if ((lr & SPLIT_HACK_MASK) == SPLIT_HACK_OFFS) ++ kvmppc_set_lr(vcpu, lr & ~SPLIT_HACK_MASK); + vcpu->arch.hflags &= ~BOOK3S_HFLAG_SPLIT_HACK; + } + } +-- +2.20.1 + diff --git a/queue-4.9/mac80211-minstrel-fix-cck-rate-group-streams-value.patch b/queue-4.9/mac80211-minstrel-fix-cck-rate-group-streams-value.patch new file mode 100644 index 00000000000..2bdbdc4d173 --- /dev/null +++ b/queue-4.9/mac80211-minstrel-fix-cck-rate-group-streams-value.patch @@ -0,0 +1,34 @@ +From eeb0d8c9ec21e7cc092a591d8f32e10eab5080b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Oct 2018 19:35:04 +0200 +Subject: mac80211: minstrel: fix CCK rate group streams value + +From: Felix Fietkau + +[ Upstream commit 80df9be67c44cb636bbc92caeddad8caf334c53c ] + +Fixes a harmless underflow issue when CCK rates are actively being used + +Signed-off-by: Felix Fietkau +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/rc80211_minstrel_ht.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c +index 30fbabf4bcbc1..593184d14b3ef 100644 +--- a/net/mac80211/rc80211_minstrel_ht.c ++++ b/net/mac80211/rc80211_minstrel_ht.c +@@ -128,7 +128,7 @@ + + #define CCK_GROUP \ + [MINSTREL_CCK_GROUP] = { \ +- .streams = 0, \ ++ .streams = 1, \ + .flags = 0, \ + .duration = { \ + CCK_DURATION_LIST(false), \ +-- +2.20.1 + diff --git a/queue-4.9/media-cx231xx-fix-potential-sign-extension-overflow-.patch b/queue-4.9/media-cx231xx-fix-potential-sign-extension-overflow-.patch new file mode 100644 index 00000000000..e5e1f0545b3 --- /dev/null +++ b/queue-4.9/media-cx231xx-fix-potential-sign-extension-overflow-.patch @@ -0,0 +1,43 @@ +From edc35e338b2ba6d643a0c2d7bb9221e26b183e61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Oct 2018 14:01:42 -0400 +Subject: media: cx231xx: fix potential sign-extension overflow on large shift + +From: Colin Ian King + +[ Upstream commit 32ae592036d7aeaabcccb2b1715373a68639a768 ] + +Shifting the u8 value[3] by an int can lead to sign-extension +overflow. For example, if value[3] is 0xff and the shift is 24 then it +is promoted to int and then the top bit is sign-extended so that all +upper 32 bits are set. Fix this by casting value[3] to a u32 before +the shift. + +Detected by CoverityScan, CID#1016522 ("Unintended sign extension") + +Fixes: e0d3bafd0258 ("V4L/DVB (10954): Add cx231xx USB driver") + +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cx231xx/cx231xx-video.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/usb/cx231xx/cx231xx-video.c b/drivers/media/usb/cx231xx/cx231xx-video.c +index 6414188ffdfac..cd973e780da93 100644 +--- a/drivers/media/usb/cx231xx/cx231xx-video.c ++++ b/drivers/media/usb/cx231xx/cx231xx-video.c +@@ -1389,7 +1389,7 @@ int cx231xx_g_register(struct file *file, void *priv, + ret = cx231xx_read_ctrl_reg(dev, VRT_GET_REGISTER, + (u16)reg->reg, value, 4); + reg->val = value[0] | value[1] << 8 | +- value[2] << 16 | value[3] << 24; ++ value[2] << 16 | (u32)value[3] << 24; + reg->size = 4; + break; + case 1: /* AFE - read byte */ +-- +2.20.1 + diff --git a/queue-4.9/media-isif-fix-a-null-pointer-dereference-bug.patch b/queue-4.9/media-isif-fix-a-null-pointer-dereference-bug.patch new file mode 100644 index 00000000000..5bc0b45fec5 --- /dev/null +++ b/queue-4.9/media-isif-fix-a-null-pointer-dereference-bug.patch @@ -0,0 +1,49 @@ +From 090d918623cb789ce324706b4e7525f02935966a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 11:44:02 -0400 +Subject: media: isif: fix a NULL pointer dereference bug + +From: Wenwen Wang + +[ Upstream commit a26ac6c1bed951b2066cc4b2257facd919e35c0b ] + +In isif_probe(), there is a while loop to get the ISIF base address and +linearization table0 and table1 address. In the loop body, the function +platform_get_resource() is called to get the resource. If +platform_get_resource() returns NULL, the loop is terminated and the +execution goes to 'fail_nobase_res'. Suppose the loop is terminated at the +first iteration because platform_get_resource() returns NULL and the +execution goes to 'fail_nobase_res'. Given that there is another while loop +at 'fail_nobase_res' and i equals to 0, one iteration of the second while +loop will be executed. However, the second while loop does not check the +return value of platform_get_resource(). This can cause a NULL pointer +dereference bug if the return value is a NULL pointer. + +This patch avoids the above issue by adding a check in the second while +loop after the call to platform_get_resource(). + +Signed-off-by: Wenwen Wang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/davinci/isif.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/davinci/isif.c b/drivers/media/platform/davinci/isif.c +index 99faea2e84c6b..78e37cf3470f2 100644 +--- a/drivers/media/platform/davinci/isif.c ++++ b/drivers/media/platform/davinci/isif.c +@@ -1106,7 +1106,8 @@ static int isif_probe(struct platform_device *pdev) + + while (i >= 0) { + res = platform_get_resource(pdev, IORESOURCE_MEM, i); +- release_mem_region(res->start, resource_size(res)); ++ if (res) ++ release_mem_region(res->start, resource_size(res)); + i--; + } + vpfe_unregister_ccdc_device(&isif_hw_dev); +-- +2.20.1 + diff --git a/queue-4.9/media-pxa_camera-fix-check-for-pdev-dev.of_node.patch b/queue-4.9/media-pxa_camera-fix-check-for-pdev-dev.of_node.patch new file mode 100644 index 00000000000..97aa516d609 --- /dev/null +++ b/queue-4.9/media-pxa_camera-fix-check-for-pdev-dev.of_node.patch @@ -0,0 +1,48 @@ +From f8b238656b277e75e7d5fb443ad3d71bb2afd18d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Sep 2018 06:00:45 -0400 +Subject: media: pxa_camera: Fix check for pdev->dev.of_node + +From: Nathan Chancellor + +[ Upstream commit 44d7f1a77d8c84f8e42789b5475b74ae0e6d4758 ] + +Clang warns that the address of a pointer will always evaluated as true +in a boolean context. + +drivers/media/platform/pxa_camera.c:2400:17: warning: address of +'pdev->dev.of_node' will always evaluate to 'true' +[-Wpointer-bool-conversion] + if (&pdev->dev.of_node && !pcdev->pdata) { + ~~~~~~~~~~^~~~~~~ ~~ +1 warning generated. + +Judging from the rest of the kernel, it seems like this was an error and +just the value of of_node should be checked rather than the address. + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/pxa_camera.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/pxa_camera.c b/drivers/media/platform/pxa_camera.c +index 390d708c807a0..3fab9f776afa7 100644 +--- a/drivers/media/platform/pxa_camera.c ++++ b/drivers/media/platform/pxa_camera.c +@@ -2334,7 +2334,7 @@ static int pxa_camera_probe(struct platform_device *pdev) + pcdev->res = res; + + pcdev->pdata = pdev->dev.platform_data; +- if (&pdev->dev.of_node && !pcdev->pdata) { ++ if (pdev->dev.of_node && !pcdev->pdata) { + err = pxa_camera_pdata_from_dt(&pdev->dev, pcdev, &pcdev->asd); + } else { + pcdev->platform_flags = pcdev->pdata->flags; +-- +2.20.1 + diff --git a/queue-4.9/mei-samples-fix-a-signedness-bug-in-amt_host_if_call.patch b/queue-4.9/mei-samples-fix-a-signedness-bug-in-amt_host_if_call.patch new file mode 100644 index 00000000000..fa84e822548 --- /dev/null +++ b/queue-4.9/mei-samples-fix-a-signedness-bug-in-amt_host_if_call.patch @@ -0,0 +1,34 @@ +From d71694e55732c13d09095891f24855330275aca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 19:44:41 +0300 +Subject: mei: samples: fix a signedness bug in amt_host_if_call() + +From: Dan Carpenter + +[ Upstream commit 185647813cac080453cb73a2e034a8821049f2a7 ] + +"out_buf_sz" needs to be signed for the error handling to work. + +Signed-off-by: Dan Carpenter +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + samples/mei/mei-amt-version.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c +index bb9988914a563..32234481ad7db 100644 +--- a/samples/mei/mei-amt-version.c ++++ b/samples/mei/mei-amt-version.c +@@ -370,7 +370,7 @@ static uint32_t amt_host_if_call(struct amt_host_if *acmd, + unsigned int expected_sz) + { + uint32_t in_buf_sz; +- uint32_t out_buf_sz; ++ ssize_t out_buf_sz; + ssize_t written; + uint32_t status; + struct amt_host_if_resp_header *msg_hdr; +-- +2.20.1 + diff --git a/queue-4.9/mfd-ti_am335x_tscadc-keep-adc-interface-on-if-child-.patch b/queue-4.9/mfd-ti_am335x_tscadc-keep-adc-interface-on-if-child-.patch new file mode 100644 index 00000000000..23c2e6acdc5 --- /dev/null +++ b/queue-4.9/mfd-ti_am335x_tscadc-keep-adc-interface-on-if-child-.patch @@ -0,0 +1,53 @@ +From 8e1a67aea7ebd93ebccd5e0d02cb6473aa0ce717 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 Jun 2018 16:03:16 +0530 +Subject: mfd: ti_am335x_tscadc: Keep ADC interface on if child is wakeup + capable + +From: Vignesh R + +[ Upstream commit c974ac771479327b5424f60d58845e31daddadea ] + +If a child device like touchscreen is wakeup capable, then keep ADC +interface on, so that a touching resistive screen will generate wakeup +event to the system. + +Signed-off-by: Vignesh R +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ti_am335x_tscadc.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index 60286adbd6a1c..e56f0844b98de 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -295,11 +295,24 @@ static int ti_tscadc_remove(struct platform_device *pdev) + return 0; + } + ++static int __maybe_unused ti_tscadc_can_wakeup(struct device *dev, void *data) ++{ ++ return device_may_wakeup(dev); ++} ++ + static int __maybe_unused tscadc_suspend(struct device *dev) + { + struct ti_tscadc_dev *tscadc = dev_get_drvdata(dev); + + regmap_write(tscadc->regmap, REG_SE, 0x00); ++ if (device_for_each_child(dev, NULL, ti_tscadc_can_wakeup)) { ++ u32 ctrl; ++ ++ regmap_read(tscadc->regmap, REG_CTRL, &ctrl); ++ ctrl &= ~(CNTRLREG_POWERDOWN); ++ ctrl |= CNTRLREG_TSCSSENB; ++ regmap_write(tscadc->regmap, REG_CTRL, ctrl); ++ } + pm_runtime_put_sync(dev); + + return 0; +-- +2.20.1 + diff --git a/queue-4.9/misc-cxl-fix-possible-null-pointer-dereference.patch b/queue-4.9/misc-cxl-fix-possible-null-pointer-dereference.patch new file mode 100644 index 00000000000..43d6acff44e --- /dev/null +++ b/queue-4.9/misc-cxl-fix-possible-null-pointer-dereference.patch @@ -0,0 +1,37 @@ +From 661b12118f7a4e8cf720e8cda91aad8138546c5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 13:02:53 +0800 +Subject: misc: cxl: Fix possible null pointer dereference + +From: zhong jiang + +[ Upstream commit 3dac3583bf1a61db6aaf31dfd752c677a4400afd ] + +It is not safe to dereference an object before a null test. It is +not needed and just remove them. Ftrace can be used instead. + +Signed-off-by: zhong jiang +Acked-by: Andrew Donnellan +Acked-by: Frederic Barrat +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/guest.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c +index 3e102cd6ed914..d08509cd978a4 100644 +--- a/drivers/misc/cxl/guest.c ++++ b/drivers/misc/cxl/guest.c +@@ -1026,8 +1026,6 @@ int cxl_guest_init_afu(struct cxl *adapter, int slice, struct device_node *afu_n + + void cxl_guest_remove_afu(struct cxl_afu *afu) + { +- pr_devel("in %s - AFU(%d)\n", __func__, afu->slice); +- + if (!afu) + return; + +-- +2.20.1 + diff --git a/queue-4.9/mtd-physmap_of-release-resources-on-error.patch b/queue-4.9/mtd-physmap_of-release-resources-on-error.patch new file mode 100644 index 00000000000..678a314a281 --- /dev/null +++ b/queue-4.9/mtd-physmap_of-release-resources-on-error.patch @@ -0,0 +1,88 @@ +From d51235d5cf0ec33bf48ca0b7f448b2c0895773cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 15:34:45 +0200 +Subject: mtd: physmap_of: Release resources on error + +From: Ricardo Ribalda Delgado + +[ Upstream commit ef0de747f7ad179c7698a5b0e28db05f18ecbf57 ] + +During probe, if there was an error the memory region and the memory +map were not properly released.This can lead a system unusable if +deferred probe is in use. + +Replace mem_request and map with devm_ioremap_resource + +Signed-off-by: Ricardo Ribalda Delgado +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/maps/physmap_of.c | 27 +++++---------------------- + 1 file changed, 5 insertions(+), 22 deletions(-) + +diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c +index 3fad35942895c..7a716bed11580 100644 +--- a/drivers/mtd/maps/physmap_of.c ++++ b/drivers/mtd/maps/physmap_of.c +@@ -29,7 +29,6 @@ + struct of_flash_list { + struct mtd_info *mtd; + struct map_info map; +- struct resource *res; + }; + + struct of_flash { +@@ -54,18 +53,10 @@ static int of_flash_remove(struct platform_device *dev) + mtd_concat_destroy(info->cmtd); + } + +- for (i = 0; i < info->list_size; i++) { ++ for (i = 0; i < info->list_size; i++) + if (info->list[i].mtd) + map_destroy(info->list[i].mtd); + +- if (info->list[i].map.virt) +- iounmap(info->list[i].map.virt); +- +- if (info->list[i].res) { +- release_resource(info->list[i].res); +- kfree(info->list[i].res); +- } +- } + return 0; + } + +@@ -223,10 +214,11 @@ static int of_flash_probe(struct platform_device *dev) + + err = -EBUSY; + res_size = resource_size(&res); +- info->list[i].res = request_mem_region(res.start, res_size, +- dev_name(&dev->dev)); +- if (!info->list[i].res) ++ info->list[i].map.virt = devm_ioremap_resource(&dev->dev, &res); ++ if (IS_ERR(info->list[i].map.virt)) { ++ err = PTR_ERR(info->list[i].map.virt); + goto err_out; ++ } + + err = -ENXIO; + width = of_get_property(dp, "bank-width", NULL); +@@ -247,15 +239,6 @@ static int of_flash_probe(struct platform_device *dev) + return err; + } + +- err = -ENOMEM; +- info->list[i].map.virt = ioremap(info->list[i].map.phys, +- info->list[i].map.size); +- if (!info->list[i].map.virt) { +- dev_err(&dev->dev, "Failed to ioremap() flash" +- " region\n"); +- goto err_out; +- } +- + simple_map_init(&info->list[i].map); + + /* +-- +2.20.1 + diff --git a/queue-4.9/mtd-rawnand-sh_flctl-use-proper-enum-for-flctl_dma_f.patch b/queue-4.9/mtd-rawnand-sh_flctl-use-proper-enum-for-flctl_dma_f.patch new file mode 100644 index 00000000000..058732929b3 --- /dev/null +++ b/queue-4.9/mtd-rawnand-sh_flctl-use-proper-enum-for-flctl_dma_f.patch @@ -0,0 +1,62 @@ +From b884904a707cea8b27d0163c6604e66e8f700fb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 16:30:25 -0700 +Subject: mtd: rawnand: sh_flctl: Use proper enum for flctl_dma_fifo0_transfer + +From: Nathan Chancellor + +[ Upstream commit e2bfa4ca23d9b5a7bdfcf21319fad9b59e38a05c ] + +Clang warns when one enumerated type is converted implicitly to another: + +drivers/mtd/nand/raw/sh_flctl.c:483:46: warning: implicit conversion +from enumeration type 'enum dma_transfer_direction' to different +enumeration type 'enum dma_data_direction' [-Wenum-conversion] + flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0) + ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~ +drivers/mtd/nand/raw/sh_flctl.c:542:46: warning: implicit conversion +from enumeration type 'enum dma_transfer_direction' to different +enumeration type 'enum dma_data_direction' [-Wenum-conversion] + flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0) + ~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~ +2 warnings generated. + +Use the proper enums from dma_data_direction to satisfy Clang. + +DMA_MEM_TO_DEV = DMA_TO_DEVICE = 1 +DMA_DEV_TO_MEM = DMA_FROM_DEVICE = 2 + +Reported-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Miquel Raynal +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/sh_flctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c +index 442ce619b3b6d..d6c013f93b8c0 100644 +--- a/drivers/mtd/nand/sh_flctl.c ++++ b/drivers/mtd/nand/sh_flctl.c +@@ -480,7 +480,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset) + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_rx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_DEV_TO_MEM) > 0) ++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) + goto convert; /* DMA success */ + + /* do polling transfer */ +@@ -539,7 +539,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen, + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_tx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_MEM_TO_DEV) > 0) ++ flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) + return; /* DMA success */ + + /* do polling transfer */ +-- +2.20.1 + diff --git a/queue-4.9/net-ovs-fix-return-type-of-ndo_start_xmit-function.patch b/queue-4.9/net-ovs-fix-return-type-of-ndo_start_xmit-function.patch new file mode 100644 index 00000000000..e5fd4cad80f --- /dev/null +++ b/queue-4.9/net-ovs-fix-return-type-of-ndo_start_xmit-function.patch @@ -0,0 +1,49 @@ +From 942857c12fc4d6e4793ca685af0208b9817209b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:15:38 +0800 +Subject: net: ovs: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit eddf11e18dff0e8671e06ce54e64cfc843303ab9 ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/openvswitch/vport-internal_dev.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c +index e7da29021b38b..c233924825801 100644 +--- a/net/openvswitch/vport-internal_dev.c ++++ b/net/openvswitch/vport-internal_dev.c +@@ -44,7 +44,8 @@ static struct internal_dev *internal_dev_priv(struct net_device *netdev) + } + + /* Called with rcu_read_lock_bh. */ +-static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev) ++static netdev_tx_t ++internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev) + { + int len, err; + +@@ -63,7 +64,7 @@ static int internal_dev_xmit(struct sk_buff *skb, struct net_device *netdev) + } else { + netdev->stats.tx_errors++; + } +- return 0; ++ return NETDEV_TX_OK; + } + + static int internal_dev_open(struct net_device *netdev) +-- +2.20.1 + diff --git a/queue-4.9/net-xen-netback-fix-return-type-of-ndo_start_xmit-fu.patch b/queue-4.9/net-xen-netback-fix-return-type-of-ndo_start_xmit-fu.patch new file mode 100644 index 00000000000..0bbb4505756 --- /dev/null +++ b/queue-4.9/net-xen-netback-fix-return-type-of-ndo_start_xmit-fu.patch @@ -0,0 +1,41 @@ +From 4162f732cc6e8d55a137e63d783bfabe73c60f96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:18:14 +0800 +Subject: net: xen-netback: fix return type of ndo_start_xmit function + +From: YueHaibing + +[ Upstream commit a9ca7f17c6d240e269a24cbcd76abf9a940309dd ] + +The method ndo_start_xmit() is defined as returning an 'netdev_tx_t', +which is a typedef for an enum type, so make sure the implementation in +this driver has returns 'netdev_tx_t' value, and change the function +return type to netdev_tx_t. + +Found by coccinelle. + +Signed-off-by: YueHaibing +Acked-by: Wei Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/xen-netback/interface.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c +index e1f47b6ea3b76..46008f2845502 100644 +--- a/drivers/net/xen-netback/interface.c ++++ b/drivers/net/xen-netback/interface.c +@@ -171,7 +171,8 @@ static u16 xenvif_select_queue(struct net_device *dev, struct sk_buff *skb, + return vif->hash.mapping[skb_get_hash_raw(skb) % size]; + } + +-static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static netdev_tx_t ++xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct xenvif *vif = netdev_priv(dev); + struct xenvif_queue *queue = NULL; +-- +2.20.1 + diff --git a/queue-4.9/nfsv4.x-fix-lock-recovery-during-delegation-recall.patch b/queue-4.9/nfsv4.x-fix-lock-recovery-during-delegation-recall.patch new file mode 100644 index 00000000000..fc326c3fb6f --- /dev/null +++ b/queue-4.9/nfsv4.x-fix-lock-recovery-during-delegation-recall.patch @@ -0,0 +1,57 @@ +From 7305514d337a705b5bff4d8bd80bf5536d4bd187 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Oct 2018 14:45:00 -0400 +Subject: NFSv4.x: fix lock recovery during delegation recall + +From: Olga Kornievskaia + +[ Upstream commit 44f411c353bf6d98d5a34f8f1b8605d43b2e50b8 ] + +Running "./nfstest_delegation --runtest recall26" uncovers that +client doesn't recover the lock when we have an appending open, +where the initial open got a write delegation. + +Instead of checking for the passed in open context against +the file lock's open context. Check that the state is the same. + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/delegation.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c +index 46afd7cdcc378..9a8830a0f31f9 100644 +--- a/fs/nfs/delegation.c ++++ b/fs/nfs/delegation.c +@@ -101,7 +101,7 @@ int nfs4_check_delegation(struct inode *inode, fmode_t flags) + return nfs4_do_check_delegation(inode, flags, false); + } + +-static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid) ++static int nfs_delegation_claim_locks(struct nfs4_state *state, const nfs4_stateid *stateid) + { + struct inode *inode = state->inode; + struct file_lock *fl; +@@ -116,7 +116,7 @@ static int nfs_delegation_claim_locks(struct nfs_open_context *ctx, struct nfs4_ + spin_lock(&flctx->flc_lock); + restart: + list_for_each_entry(fl, list, fl_list) { +- if (nfs_file_open_context(fl->fl_file) != ctx) ++ if (nfs_file_open_context(fl->fl_file)->state != state) + continue; + spin_unlock(&flctx->flc_lock); + status = nfs4_lock_delegation_recall(fl, state, stateid); +@@ -163,7 +163,7 @@ static int nfs_delegation_claim_opens(struct inode *inode, + seq = raw_seqcount_begin(&sp->so_reclaim_seqcount); + err = nfs4_open_delegation_recall(ctx, state, stateid, type); + if (!err) +- err = nfs_delegation_claim_locks(ctx, state, stateid); ++ err = nfs_delegation_claim_locks(state, stateid); + if (!err && read_seqcount_retry(&sp->so_reclaim_seqcount, seq)) + err = -EAGAIN; + mutex_unlock(&sp->so_delegreturn_mutex); +-- +2.20.1 + diff --git a/queue-4.9/nl80211-fix-a-get_key-reply-attribute.patch b/queue-4.9/nl80211-fix-a-get_key-reply-attribute.patch new file mode 100644 index 00000000000..a4a0c832d55 --- /dev/null +++ b/queue-4.9/nl80211-fix-a-get_key-reply-attribute.patch @@ -0,0 +1,36 @@ +From 6c2a855a118561232dae38afee8e6607a915d5b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Sep 2018 18:10:22 +0200 +Subject: nl80211: Fix a GET_KEY reply attribute + +From: Andrew Zaborowski + +[ Upstream commit efdfce7270de85a8706d1ea051bef3a7486809ff ] + +Use the NL80211_KEY_IDX attribute inside the NL80211_ATTR_KEY in +NL80211_CMD_GET_KEY responses to comply with nl80211_key_policy. +This is unlikely to affect existing userspace. + +Signed-off-by: Andrew Zaborowski +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 060bc0cc82526..bb19be78aed70 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3058,7 +3058,7 @@ static void get_key_callback(void *c, struct key_params *params) + params->cipher))) + goto nla_put_failure; + +- if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx)) ++ if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) + goto nla_put_failure; + + nla_nest_end(cookie->msg, key); +-- +2.20.1 + diff --git a/queue-4.9/orangefs-rate-limit-the-client-not-running-info-mess.patch b/queue-4.9/orangefs-rate-limit-the-client-not-running-info-mess.patch new file mode 100644 index 00000000000..8d94e4e8ed6 --- /dev/null +++ b/queue-4.9/orangefs-rate-limit-the-client-not-running-info-mess.patch @@ -0,0 +1,40 @@ +From a37c7e0f12185944a5db3022c6b0bcd81ac212d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Sep 2018 15:54:01 +0100 +Subject: orangefs: rate limit the client not running info message + +From: Colin Ian King + +[ Upstream commit 2978d873471005577e7b68a528b4f256a529b030 ] + +Currently accessing various /sys/fs/orangefs files will spam the +kernel log with the following info message when the client is not +running: + +[ 491.489284] sysfs_service_op_show: Client not running :-5: + +Rate limit this info message to make it less spammy. + +Signed-off-by: Colin Ian King +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/orangefs-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/orangefs/orangefs-sysfs.c b/fs/orangefs/orangefs-sysfs.c +index a799546a67f77..f6172c3f83ba0 100644 +--- a/fs/orangefs/orangefs-sysfs.c ++++ b/fs/orangefs/orangefs-sysfs.c +@@ -315,7 +315,7 @@ static ssize_t sysfs_service_op_show(struct kobject *kobj, + /* Can't do a service_operation if the client is not running... */ + rc = is_daemon_in_service(); + if (rc) { +- pr_info("%s: Client not running :%d:\n", ++ pr_info_ratelimited("%s: Client not running :%d:\n", + __func__, + is_daemon_in_service()); + goto out; +-- +2.20.1 + diff --git a/queue-4.9/powerpc-pseries-fix-dtl-buffer-registration.patch b/queue-4.9/powerpc-pseries-fix-dtl-buffer-registration.patch new file mode 100644 index 00000000000..c7605c58c27 --- /dev/null +++ b/queue-4.9/powerpc-pseries-fix-dtl-buffer-registration.patch @@ -0,0 +1,44 @@ +From 1aed3a4779d7dd5b242fe8201f50cde64d0260af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 13:40:57 +0530 +Subject: powerpc/pseries: Fix DTL buffer registration + +From: Naveen N. Rao + +[ Upstream commit db787af1b8a6b4be428ee2ea7d409dafcaa4a43c ] + +When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set, we register the DTL +buffer for a cpu when the associated file under powerpc/dtl in debugfs +is opened. When doing so, we need to set the size of the buffer being +registered in the second u32 word of the buffer. This needs to be in big +endian, but we are not doing the conversion resulting in the below error +showing up in dmesg: + + dtl_start: DTL registration for cpu 0 (hw 0) failed with -4 + +Fix this in the obvious manner. + +Fixes: 7c105b63bd98 ("powerpc: Add CONFIG_CPU_LITTLE_ENDIAN kernel config option.") +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/dtl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c +index 39049e4884fbd..37de83c5ef172 100644 +--- a/arch/powerpc/platforms/pseries/dtl.c ++++ b/arch/powerpc/platforms/pseries/dtl.c +@@ -150,7 +150,7 @@ static int dtl_start(struct dtl *dtl) + + /* Register our dtl buffer with the hypervisor. The HV expects the + * buffer size to be passed in the second word of the buffer */ +- ((u32 *)dtl->buf)[1] = DISPATCH_LOG_BYTES; ++ ((u32 *)dtl->buf)[1] = cpu_to_be32(DISPATCH_LOG_BYTES); + + hwcpu = get_hard_smp_processor_id(dtl->cpu); + addr = __pa(dtl->buf); +-- +2.20.1 + diff --git a/queue-4.9/powerpc-pseries-fix-how-we-iterate-over-the-dtl-entr.patch b/queue-4.9/powerpc-pseries-fix-how-we-iterate-over-the-dtl-entr.patch new file mode 100644 index 00000000000..9025a5df5cb --- /dev/null +++ b/queue-4.9/powerpc-pseries-fix-how-we-iterate-over-the-dtl-entr.patch @@ -0,0 +1,40 @@ +From 504c743a1f1a8cc360af545ccdf7df9e3c5d74db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 13:40:58 +0530 +Subject: powerpc/pseries: Fix how we iterate over the DTL entries + +From: Naveen N. Rao + +[ Upstream commit 9258227e9dd1da8feddb07ad9702845546a581c9 ] + +When CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set, we look up dtl_idx in +the lppaca to determine the number of entries in the buffer. Since +lppaca is in big endian, we need to do an endian conversion before using +this in our calculation to determine the number of entries in the +buffer. Without this, we do not iterate over the existing entries in the +DTL buffer properly. + +Fixes: 7c105b63bd98 ("powerpc: Add CONFIG_CPU_LITTLE_ENDIAN kernel config option.") +Signed-off-by: Naveen N. Rao +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/dtl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/dtl.c b/arch/powerpc/platforms/pseries/dtl.c +index 37de83c5ef172..7a4d172c93765 100644 +--- a/arch/powerpc/platforms/pseries/dtl.c ++++ b/arch/powerpc/platforms/pseries/dtl.c +@@ -185,7 +185,7 @@ static void dtl_stop(struct dtl *dtl) + + static u64 dtl_current_index(struct dtl *dtl) + { +- return lppaca_of(dtl->cpu).dtl_idx; ++ return be64_to_cpu(lppaca_of(dtl->cpu).dtl_idx); + } + #endif /* CONFIG_VIRT_CPU_ACCOUNTING_NATIVE */ + +-- +2.20.1 + diff --git a/queue-4.9/printk-give-error-on-attempt-to-set-log-buffer-lengt.patch b/queue-4.9/printk-give-error-on-attempt-to-set-log-buffer-lengt.patch new file mode 100644 index 00000000000..018f9ebfddd --- /dev/null +++ b/queue-4.9/printk-give-error-on-attempt-to-set-log-buffer-lengt.patch @@ -0,0 +1,89 @@ +From fb8beb87b5a6a0c2d3f2bd75624f9302a7998059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 00:45:53 +0800 +Subject: printk: Give error on attempt to set log buffer length to over 2G + +From: He Zhe + +[ Upstream commit e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e ] + +The current printk() is ready to handle log buffer size up to 2G. +Give an explicit error for users who want to use larger log buffer. + +Also fix printk formatting to show the 2G as a positive number. + +Link: http://lkml.kernel.org/r/20181008135916.gg4kkmoki5bgtco5@pathway.suse.cz +Cc: rostedt@goodmis.org +Cc: linux-kernel@vger.kernel.org +Suggested-by: Sergey Senozhatsky +Signed-off-by: He Zhe +Reviewed-by: Sergey Senozhatsky +[pmladek: Fixed to the really safe limit 2GB.] +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/printk/printk.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 6607d77afe55a..a0339c458c140 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -383,6 +383,7 @@ static u32 clear_idx; + /* record buffer */ + #define LOG_ALIGN __alignof__(struct printk_log) + #define __LOG_BUF_LEN (1 << CONFIG_LOG_BUF_SHIFT) ++#define LOG_BUF_LEN_MAX (u32)(1 << 31) + static char __log_buf[__LOG_BUF_LEN] __aligned(LOG_ALIGN); + static char *log_buf = __log_buf; + static u32 log_buf_len = __LOG_BUF_LEN; +@@ -983,18 +984,23 @@ void log_buf_kexec_setup(void) + static unsigned long __initdata new_log_buf_len; + + /* we practice scaling the ring buffer by powers of 2 */ +-static void __init log_buf_len_update(unsigned size) ++static void __init log_buf_len_update(u64 size) + { ++ if (size > (u64)LOG_BUF_LEN_MAX) { ++ size = (u64)LOG_BUF_LEN_MAX; ++ pr_err("log_buf over 2G is not supported.\n"); ++ } ++ + if (size) + size = roundup_pow_of_two(size); + if (size > log_buf_len) +- new_log_buf_len = size; ++ new_log_buf_len = (unsigned long)size; + } + + /* save requested log_buf_len since it's too early to process it */ + static int __init log_buf_len_setup(char *str) + { +- unsigned int size; ++ u64 size; + + if (!str) + return -EINVAL; +@@ -1064,7 +1070,7 @@ void __init setup_log_buf(int early) + } + + if (unlikely(!new_log_buf)) { +- pr_err("log_buf_len: %ld bytes not available\n", ++ pr_err("log_buf_len: %lu bytes not available\n", + new_log_buf_len); + return; + } +@@ -1077,8 +1083,8 @@ void __init setup_log_buf(int early) + memcpy(log_buf, __log_buf, __LOG_BUF_LEN); + raw_spin_unlock_irqrestore(&logbuf_lock, flags); + +- pr_info("log_buf_len: %d bytes\n", log_buf_len); +- pr_info("early log buf free: %d(%d%%)\n", ++ pr_info("log_buf_len: %u bytes\n", log_buf_len); ++ pr_info("early log buf free: %u(%u%%)\n", + free, (free * 100) / __LOG_BUF_LEN); + } + +-- +2.20.1 + diff --git a/queue-4.9/proc-vmcore-fix-i386-build-error-of-missing-copy_old.patch b/queue-4.9/proc-vmcore-fix-i386-build-error-of-missing-copy_old.patch new file mode 100644 index 00000000000..379f569d896 --- /dev/null +++ b/queue-4.9/proc-vmcore-fix-i386-build-error-of-missing-copy_old.patch @@ -0,0 +1,50 @@ +From a7ca08af3dab4a329a52ca2ca172ce8e4d85cb5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 10:05:20 +0200 +Subject: proc/vmcore: Fix i386 build error of missing + copy_oldmem_page_encrypted() + +From: Borislav Petkov + +[ Upstream commit cf089611f4c446285046fcd426d90c18f37d2905 ] + +Lianbo reported a build error with a particular 32-bit config, see Link +below for details. + +Provide a weak copy_oldmem_page_encrypted() function which architectures +can override, in the same manner other functionality in that file is +supplied. + +Reported-by: Lianbo Jiang +Signed-off-by: Borislav Petkov +CC: x86@kernel.org +Link: http://lkml.kernel.org/r/710b9d95-2f70-eadf-c4a1-c3dc80ee4ebb@redhat.com +Signed-off-by: Sasha Levin +--- + fs/proc/vmcore.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c +index 8ab782d8b33dd..93d13f4010c14 100644 +--- a/fs/proc/vmcore.c ++++ b/fs/proc/vmcore.c +@@ -164,6 +164,16 @@ int __weak remap_oldmem_pfn_range(struct vm_area_struct *vma, + return remap_pfn_range(vma, from, pfn, size, prot); + } + ++/* ++ * Architectures which support memory encryption override this. ++ */ ++ssize_t __weak ++copy_oldmem_page_encrypted(unsigned long pfn, char *buf, size_t csize, ++ unsigned long offset, int userbuf) ++{ ++ return copy_oldmem_page(pfn, buf, csize, offset, userbuf); ++} ++ + /* + * Copy to either kernel or user space + */ +-- +2.20.1 + diff --git a/queue-4.9/reset-fix-potential-use-after-free-in-__of_reset_con.patch b/queue-4.9/reset-fix-potential-use-after-free-in-__of_reset_con.patch new file mode 100644 index 00000000000..5c6d8b84fb8 --- /dev/null +++ b/queue-4.9/reset-fix-potential-use-after-free-in-__of_reset_con.patch @@ -0,0 +1,69 @@ +From 8e0c96b04f9bf245fd7ae5b8e9228f7bcd5ce4ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Oct 2018 13:14:35 +0200 +Subject: reset: Fix potential use-after-free in __of_reset_control_get() + +From: Geert Uytterhoeven + +[ Upstream commit b790c8ea5593d6dc3580adfad8e117eeb56af874 ] + +Calling of_node_put() decreases the reference count of a device tree +object, and may free some data. + +However, the of_phandle_args structure embedding it is passed to +reset_controller_dev.of_xlate() after that, so it may still be accessed. + +Move the call to of_node_put() down to fix this. + +Signed-off-by: Geert Uytterhoeven +[p.zabel@pengutronix.de: moved of_node_put after mutex_unlock] +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/core.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 188205a552613..d0ebca301afc9 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -324,28 +324,29 @@ struct reset_control *__of_reset_control_get(struct device_node *node, + break; + } + } +- of_node_put(args.np); + + if (!rcdev) { +- mutex_unlock(&reset_list_mutex); +- return ERR_PTR(-EPROBE_DEFER); ++ rstc = ERR_PTR(-EPROBE_DEFER); ++ goto out; + } + + if (WARN_ON(args.args_count != rcdev->of_reset_n_cells)) { +- mutex_unlock(&reset_list_mutex); +- return ERR_PTR(-EINVAL); ++ rstc = ERR_PTR(-EINVAL); ++ goto out; + } + + rstc_id = rcdev->of_xlate(rcdev, &args); + if (rstc_id < 0) { +- mutex_unlock(&reset_list_mutex); +- return ERR_PTR(rstc_id); ++ rstc = ERR_PTR(rstc_id); ++ goto out; + } + + /* reset_list_mutex also protects the rcdev's reset_control list */ + rstc = __reset_control_get_internal(rcdev, rstc_id, shared); + ++out: + mutex_unlock(&reset_list_mutex); ++ of_node_put(args.np); + + return rstc; + } +-- +2.20.1 + diff --git a/queue-4.9/s390-kasan-avoid-vdso-instrumentation.patch b/queue-4.9/s390-kasan-avoid-vdso-instrumentation.patch new file mode 100644 index 00000000000..035f3a5e8f3 --- /dev/null +++ b/queue-4.9/s390-kasan-avoid-vdso-instrumentation.patch @@ -0,0 +1,56 @@ +From dba774115241f0d2beb5e8a7115653a66991c7be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Nov 2017 13:02:36 +0100 +Subject: s390/kasan: avoid vdso instrumentation + +From: Vasily Gorbik + +[ Upstream commit 348498458505e202df41b6b9a78da448d39298b7 ] + +vdso is mapped into user space processes, which won't have kasan +shodow mapped. + +Reviewed-by: Martin Schwidefsky +Signed-off-by: Vasily Gorbik +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/vdso32/Makefile | 3 ++- + arch/s390/kernel/vdso64/Makefile | 3 ++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/vdso32/Makefile b/arch/s390/kernel/vdso32/Makefile +index ca7c3c34f94ba..2bb3a255e51a4 100644 +--- a/arch/s390/kernel/vdso32/Makefile ++++ b/arch/s390/kernel/vdso32/Makefile +@@ -24,9 +24,10 @@ obj-y += vdso32_wrapper.o + extra-y += vdso32.lds + CPPFLAGS_vdso32.lds += -P -C -U$(ARCH) + +-# Disable gcov profiling and ubsan for VDSO code ++# Disable gcov profiling, ubsan and kasan for VDSO code + GCOV_PROFILE := n + UBSAN_SANITIZE := n ++KASAN_SANITIZE := n + + # Force dependency (incbin is bad) + $(obj)/vdso32_wrapper.o : $(obj)/vdso32.so +diff --git a/arch/s390/kernel/vdso64/Makefile b/arch/s390/kernel/vdso64/Makefile +index 84af2b6b64c42..76c56b5382be9 100644 +--- a/arch/s390/kernel/vdso64/Makefile ++++ b/arch/s390/kernel/vdso64/Makefile +@@ -24,9 +24,10 @@ obj-y += vdso64_wrapper.o + extra-y += vdso64.lds + CPPFLAGS_vdso64.lds += -P -C -U$(ARCH) + +-# Disable gcov profiling and ubsan for VDSO code ++# Disable gcov profiling, ubsan and kasan for VDSO code + GCOV_PROFILE := n + UBSAN_SANITIZE := n ++KASAN_SANITIZE := n + + # Force dependency (incbin is bad) + $(obj)/vdso64_wrapper.o : $(obj)/vdso64.so +-- +2.20.1 + diff --git a/queue-4.9/series b/queue-4.9/series index b3e75e716e0..6c3dad9c61c 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -152,3 +152,70 @@ uprobes-x86-prohibit-probing-on-mov-ss-instruction.patch fbdev-ditch-fb_edid_add_monspecs.patch block-introduce-blk_rq_is_passthrough.patch libata-have-ata_scsi_rw_xlat-fail-invalid-passthrough-requests.patch +net-ovs-fix-return-type-of-ndo_start_xmit-function.patch +net-xen-netback-fix-return-type-of-ndo_start_xmit-fu.patch +arm-dts-omap5-enable-otg-role-for-dwc3-controller.patch +f2fs-return-correct-errno-in-f2fs_gc.patch +sunrpc-fix-priority-queue-fairness.patch +kvm-arm-arm64-fix-stage2_flush_memslot-for-4-level-p.patch +arm64-numa-report-correct-memblock-range-for-the-dum.patch +ath10k-fix-vdev-start-timeout-on-error.patch +ata-ahci_brcm-allow-using-driver-or-dsl-socs.patch +ath9k-fix-reporting-calculated-new-fft-upper-max.patch +usb-gadget-udc-fotg210-udc-fix-a-sleep-in-atomic-con.patch +nl80211-fix-a-get_key-reply-attribute.patch +dmaengine-ep93xx-return-proper-enum-in-ep93xx_dma_ch.patch +dmaengine-timb_dma-use-proper-enum-in-td_prep_slave_.patch +mei-samples-fix-a-signedness-bug-in-amt_host_if_call.patch +cxgb4-use-proper-enum-in-cxgb4_dcb_handle_fw_update.patch +cxgb4-use-proper-enum-in-ieee_faux_sync.patch +powerpc-pseries-fix-dtl-buffer-registration.patch +powerpc-pseries-fix-how-we-iterate-over-the-dtl-entr.patch +mtd-rawnand-sh_flctl-use-proper-enum-for-flctl_dma_f.patch +ixgbe-fix-crash-with-vfs-and-flow-director-on-interf.patch +ib-mthca-fix-error-return-code-in-__mthca_init_one.patch +ib-mlx4-avoid-implicit-enumerated-type-conversion.patch +acpica-never-run-_reg-on-system_memory-and-system_io.patch +ata-ep93xx-use-proper-enums-for-directions.patch +media-pxa_camera-fix-check-for-pdev-dev.of_node.patch +alsa-hda-sigmatel-disable-automute-for-elo-vupoint.patch +kvm-ppc-book3s-pr-exiting-split-hack-mode-needs-to-f.patch +usb-serial-cypress_m8-fix-interrupt-out-transfer-len.patch +mtd-physmap_of-release-resources-on-error.patch +cpu-smt-state-smt-is-disabled-even-with-nosmt-and-wi.patch +brcmfmac-reduce-timeout-for-action-frame-scan.patch +brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch +clk-samsung-use-clk_hw-api-for-calling-clk-framework.patch +i2c-brcmstb-allow-enabling-the-driver-on-dsl-socs.patch +nfsv4.x-fix-lock-recovery-during-delegation-recall.patch +dmaengine-ioat-fix-prototype-of-ioat_enumerate_chann.patch +input-st1232-set-input_prop_direct-property.patch +input-silead-try-firmware-reload-after-unsuccessful-.patch +x86-olpc-fix-build-error-with-config_mfd_cs5535-m.patch +crypto-mxs-dcp-fix-sha-null-hashes-and-output-length.patch +crypto-mxs-dcp-fix-aes-issues.patch +acpi-sbs-fix-rare-oops-when-removing-modules.patch +iwlwifi-mvm-don-t-send-keys-when-entering-d3.patch +fbdev-sbuslib-use-checked-version-of-put_user.patch +fbdev-sbuslib-integer-overflow-in-sbusfb_ioctl_helpe.patch +reset-fix-potential-use-after-free-in-__of_reset_con.patch +bcache-recal-cached_dev_sectors-on-detach.patch +s390-kasan-avoid-vdso-instrumentation.patch +proc-vmcore-fix-i386-build-error-of-missing-copy_old.patch +backlight-lm3639-unconditionally-call-led_classdev_u.patch +mfd-ti_am335x_tscadc-keep-adc-interface-on-if-child-.patch +printk-give-error-on-attempt-to-set-log-buffer-lengt.patch +media-isif-fix-a-null-pointer-dereference-bug.patch +gfs2-flush-the-gfs2-delete-workqueue-before-stopping.patch +media-cx231xx-fix-potential-sign-extension-overflow-.patch +x86-kexec-correct-kexec_backup_src_end-off-by-one-er.patch +gpio-syscon-fix-possible-null-ptr-usage.patch +spi-spidev-fix-of-tree-warning-logic.patch +arm-8802-1-call-syscall_trace_exit-even-when-system-.patch +orangefs-rate-limit-the-client-not-running-info-mess.patch +hwmon-pwm-fan-silence-error-on-probe-deferral.patch +hwmon-ina3221-fix-ina3221_config_mode-macros.patch +misc-cxl-fix-possible-null-pointer-dereference.patch +mac80211-minstrel-fix-cck-rate-group-streams-value.patch +spi-rockchip-initialize-dma_slave_config-properly.patch +arm-dts-omap5-fix-dual-role-mode-on-super-speed-port.patch diff --git a/queue-4.9/spi-rockchip-initialize-dma_slave_config-properly.patch b/queue-4.9/spi-rockchip-initialize-dma_slave_config-properly.patch new file mode 100644 index 00000000000..193eac81e61 --- /dev/null +++ b/queue-4.9/spi-rockchip-initialize-dma_slave_config-properly.patch @@ -0,0 +1,38 @@ +From a03a881d81a301587730c2c447b2b3d389ae47c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Oct 2018 11:00:32 +0200 +Subject: spi: rockchip: initialize dma_slave_config properly + +From: Huibin Hong + +[ Upstream commit dd8fd2cbc73f8650f651da71fc61a6e4f30c1566 ] + +The rxconf and txconf structs are allocated on the +stack, so make sure we zero them before filling out +the relevant fields. + +Signed-off-by: Huibin Hong +Signed-off-by: Emil Renner Berthing +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-rockchip.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c +index 0f89c2169c244..3a94f465e8e05 100644 +--- a/drivers/spi/spi-rockchip.c ++++ b/drivers/spi/spi-rockchip.c +@@ -443,6 +443,9 @@ static int rockchip_spi_prepare_dma(struct rockchip_spi *rs) + struct dma_slave_config rxconf, txconf; + struct dma_async_tx_descriptor *rxdesc, *txdesc; + ++ memset(&rxconf, 0, sizeof(rxconf)); ++ memset(&txconf, 0, sizeof(txconf)); ++ + spin_lock_irqsave(&rs->lock, flags); + rs->state &= ~RXBUSY; + rs->state &= ~TXBUSY; +-- +2.20.1 + diff --git a/queue-4.9/spi-spidev-fix-of-tree-warning-logic.patch b/queue-4.9/spi-spidev-fix-of-tree-warning-logic.patch new file mode 100644 index 00000000000..8345ae48e62 --- /dev/null +++ b/queue-4.9/spi-spidev-fix-of-tree-warning-logic.patch @@ -0,0 +1,55 @@ +From 2a449703eaeb2a387d6d6a7fcdb5dd2ffa1b7cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Sep 2018 19:18:34 +0000 +Subject: spi: spidev: Fix OF tree warning logic +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Trent Piepho + +[ Upstream commit 605b3bec73cbd74b4ac937b580cd0b47d1300484 ] + +spidev will make a big fuss if a device tree node binds a device by +using "spidev" as the node's compatible property. + +However, the logic for this isn't looking for "spidev" in the +compatible, but rather checking that the device is NOT compatible with +spidev's list of devices. + +This causes a false positive if a device not named "rohm,dh2228fv", etc. +binds to spidev, even if a means other than putting "spidev" in the +device tree was used. E.g., the sysfs driver_override attribute. + +Signed-off-by: Trent Piepho +Reviewed-by: Jan Kundrát +Tested-by: Jan Kundrát +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 2e05046f866bd..f4ea286b0121e 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -751,11 +751,9 @@ static int spidev_probe(struct spi_device *spi) + * compatible string, it is a Linux implementation thing + * rather than a description of the hardware. + */ +- if (spi->dev.of_node && !of_match_device(spidev_dt_ids, &spi->dev)) { +- dev_err(&spi->dev, "buggy DT: spidev listed directly in DT\n"); +- WARN_ON(spi->dev.of_node && +- !of_match_device(spidev_dt_ids, &spi->dev)); +- } ++ WARN(spi->dev.of_node && ++ of_device_is_compatible(spi->dev.of_node, "spidev"), ++ "%pOF: buggy DT: spidev listed directly in DT\n", spi->dev.of_node); + + spidev_probe_acpi(spi); + +-- +2.20.1 + diff --git a/queue-4.9/sunrpc-fix-priority-queue-fairness.patch b/queue-4.9/sunrpc-fix-priority-queue-fairness.patch new file mode 100644 index 00000000000..296b7ce720c --- /dev/null +++ b/queue-4.9/sunrpc-fix-priority-queue-fairness.patch @@ -0,0 +1,226 @@ +From 18464a11d46c534d83100c888db8ee5892f9f4ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Sep 2018 22:09:48 -0400 +Subject: SUNRPC: Fix priority queue fairness + +From: Trond Myklebust + +[ Upstream commit f42f7c283078ce3c1e8368b140e270755b1ae313 ] + +Fix up the priority queue to not batch by owner, but by queue, so that +we allow '1 << priority' elements to be dequeued before switching to +the next priority queue. +The owner field is still used to wake up requests in round robin order +by owner to avoid single processes hogging the RPC layer by loading the +queues. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/sched.h | 2 - + net/sunrpc/sched.c | 109 +++++++++++++++++------------------ + 2 files changed, 54 insertions(+), 57 deletions(-) + +diff --git a/include/linux/sunrpc/sched.h b/include/linux/sunrpc/sched.h +index 7ba040c797ec4..da2791b5fe879 100644 +--- a/include/linux/sunrpc/sched.h ++++ b/include/linux/sunrpc/sched.h +@@ -185,7 +185,6 @@ struct rpc_timer { + struct rpc_wait_queue { + spinlock_t lock; + struct list_head tasks[RPC_NR_PRIORITY]; /* task queue for each priority level */ +- pid_t owner; /* process id of last task serviced */ + unsigned char maxpriority; /* maximum priority (0 if queue is not a priority queue) */ + unsigned char priority; /* current priority */ + unsigned char nr; /* # tasks remaining for cookie */ +@@ -201,7 +200,6 @@ struct rpc_wait_queue { + * from a single cookie. The aim is to improve + * performance of NFS operations such as read/write. + */ +-#define RPC_BATCH_COUNT 16 + #define RPC_IS_PRIORITY(q) ((q)->maxpriority > 0) + + /* +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 600eacce653ae..0ef65822fdd34 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -99,64 +99,78 @@ __rpc_add_timer(struct rpc_wait_queue *queue, struct rpc_task *task) + list_add(&task->u.tk_wait.timer_list, &queue->timer_list.list); + } + +-static void rpc_rotate_queue_owner(struct rpc_wait_queue *queue) +-{ +- struct list_head *q = &queue->tasks[queue->priority]; +- struct rpc_task *task; +- +- if (!list_empty(q)) { +- task = list_first_entry(q, struct rpc_task, u.tk_wait.list); +- if (task->tk_owner == queue->owner) +- list_move_tail(&task->u.tk_wait.list, q); +- } +-} +- + static void rpc_set_waitqueue_priority(struct rpc_wait_queue *queue, int priority) + { + if (queue->priority != priority) { +- /* Fairness: rotate the list when changing priority */ +- rpc_rotate_queue_owner(queue); + queue->priority = priority; ++ queue->nr = 1U << priority; + } + } + +-static void rpc_set_waitqueue_owner(struct rpc_wait_queue *queue, pid_t pid) +-{ +- queue->owner = pid; +- queue->nr = RPC_BATCH_COUNT; +-} +- + static void rpc_reset_waitqueue_priority(struct rpc_wait_queue *queue) + { + rpc_set_waitqueue_priority(queue, queue->maxpriority); +- rpc_set_waitqueue_owner(queue, 0); + } + + /* +- * Add new request to a priority queue. ++ * Add a request to a queue list + */ +-static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue, +- struct rpc_task *task, +- unsigned char queue_priority) ++static void ++__rpc_list_enqueue_task(struct list_head *q, struct rpc_task *task) + { +- struct list_head *q; + struct rpc_task *t; + +- INIT_LIST_HEAD(&task->u.tk_wait.links); +- if (unlikely(queue_priority > queue->maxpriority)) +- queue_priority = queue->maxpriority; +- if (queue_priority > queue->priority) +- rpc_set_waitqueue_priority(queue, queue_priority); +- q = &queue->tasks[queue_priority]; + list_for_each_entry(t, q, u.tk_wait.list) { + if (t->tk_owner == task->tk_owner) { +- list_add_tail(&task->u.tk_wait.list, &t->u.tk_wait.links); ++ list_add_tail(&task->u.tk_wait.links, ++ &t->u.tk_wait.links); ++ /* Cache the queue head in task->u.tk_wait.list */ ++ task->u.tk_wait.list.next = q; ++ task->u.tk_wait.list.prev = NULL; + return; + } + } ++ INIT_LIST_HEAD(&task->u.tk_wait.links); + list_add_tail(&task->u.tk_wait.list, q); + } + ++/* ++ * Remove request from a queue list ++ */ ++static void ++__rpc_list_dequeue_task(struct rpc_task *task) ++{ ++ struct list_head *q; ++ struct rpc_task *t; ++ ++ if (task->u.tk_wait.list.prev == NULL) { ++ list_del(&task->u.tk_wait.links); ++ return; ++ } ++ if (!list_empty(&task->u.tk_wait.links)) { ++ t = list_first_entry(&task->u.tk_wait.links, ++ struct rpc_task, ++ u.tk_wait.links); ++ /* Assume __rpc_list_enqueue_task() cached the queue head */ ++ q = t->u.tk_wait.list.next; ++ list_add_tail(&t->u.tk_wait.list, q); ++ list_del(&task->u.tk_wait.links); ++ } ++ list_del(&task->u.tk_wait.list); ++} ++ ++/* ++ * Add new request to a priority queue. ++ */ ++static void __rpc_add_wait_queue_priority(struct rpc_wait_queue *queue, ++ struct rpc_task *task, ++ unsigned char queue_priority) ++{ ++ if (unlikely(queue_priority > queue->maxpriority)) ++ queue_priority = queue->maxpriority; ++ __rpc_list_enqueue_task(&queue->tasks[queue_priority], task); ++} ++ + /* + * Add new request to wait queue. + * +@@ -194,13 +208,7 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue, + */ + static void __rpc_remove_wait_queue_priority(struct rpc_task *task) + { +- struct rpc_task *t; +- +- if (!list_empty(&task->u.tk_wait.links)) { +- t = list_entry(task->u.tk_wait.links.next, struct rpc_task, u.tk_wait.list); +- list_move(&t->u.tk_wait.list, &task->u.tk_wait.list); +- list_splice_init(&task->u.tk_wait.links, &t->u.tk_wait.links); +- } ++ __rpc_list_dequeue_task(task); + } + + /* +@@ -212,7 +220,8 @@ static void __rpc_remove_wait_queue(struct rpc_wait_queue *queue, struct rpc_tas + __rpc_disable_timer(queue, task); + if (RPC_IS_PRIORITY(queue)) + __rpc_remove_wait_queue_priority(task); +- list_del(&task->u.tk_wait.list); ++ else ++ list_del(&task->u.tk_wait.list); + queue->qlen--; + dprintk("RPC: %5u removed from queue %p \"%s\"\n", + task->tk_pid, queue, rpc_qname(queue)); +@@ -481,17 +490,9 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q + * Service a batch of tasks from a single owner. + */ + q = &queue->tasks[queue->priority]; +- if (!list_empty(q)) { +- task = list_entry(q->next, struct rpc_task, u.tk_wait.list); +- if (queue->owner == task->tk_owner) { +- if (--queue->nr) +- goto out; +- list_move_tail(&task->u.tk_wait.list, q); +- } +- /* +- * Check if we need to switch queues. +- */ +- goto new_owner; ++ if (!list_empty(q) && --queue->nr) { ++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list); ++ goto out; + } + + /* +@@ -503,7 +504,7 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q + else + q = q - 1; + if (!list_empty(q)) { +- task = list_entry(q->next, struct rpc_task, u.tk_wait.list); ++ task = list_first_entry(q, struct rpc_task, u.tk_wait.list); + goto new_queue; + } + } while (q != &queue->tasks[queue->priority]); +@@ -513,8 +514,6 @@ static struct rpc_task *__rpc_find_next_queued_priority(struct rpc_wait_queue *q + + new_queue: + rpc_set_waitqueue_priority(queue, (unsigned int)(q - &queue->tasks[0])); +-new_owner: +- rpc_set_waitqueue_owner(queue, task->tk_owner); + out: + return task; + } +-- +2.20.1 + diff --git a/queue-4.9/usb-gadget-udc-fotg210-udc-fix-a-sleep-in-atomic-con.patch b/queue-4.9/usb-gadget-udc-fotg210-udc-fix-a-sleep-in-atomic-con.patch new file mode 100644 index 00000000000..c05e157025f --- /dev/null +++ b/queue-4.9/usb-gadget-udc-fotg210-udc-fix-a-sleep-in-atomic-con.patch @@ -0,0 +1,50 @@ +From 3a59c692c7e6e06474a2b6725f7999cda8c1041e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Sep 2018 11:04:40 +0800 +Subject: usb: gadget: udc: fotg210-udc: Fix a sleep-in-atomic-context bug in + fotg210_get_status() + +From: Jia-Ju Bai + +[ Upstream commit 2337a77c1cc86bc4e504ecf3799f947659c86026 ] + +The driver may sleep in an interrupt handler. +The function call path (from bottom to top) in Linux-4.17 is: + +[FUNC] fotg210_ep_queue(GFP_KERNEL) +drivers/usb/gadget/udc/fotg210-udc.c, 744: + fotg210_ep_queue in fotg210_get_status +drivers/usb/gadget/udc/fotg210-udc.c, 768: + fotg210_get_status in fotg210_setup_packet +drivers/usb/gadget/udc/fotg210-udc.c, 949: + fotg210_setup_packet in fotg210_irq (interrupt handler) + +To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC. +If possible, spin_unlock() and spin_lock() around fotg210_ep_queue() +can be also removed. + +This bug is found by my static analysis tool DSAC. + +Signed-off-by: Jia-Ju Bai +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/fotg210-udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/fotg210-udc.c +index 95df2b3bb6a1a..76e991557116a 100644 +--- a/drivers/usb/gadget/udc/fotg210-udc.c ++++ b/drivers/usb/gadget/udc/fotg210-udc.c +@@ -744,7 +744,7 @@ static void fotg210_get_status(struct fotg210_udc *fotg210, + fotg210->ep0_req->length = 2; + + spin_unlock(&fotg210->lock); +- fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_KERNEL); ++ fotg210_ep_queue(fotg210->gadget.ep0, fotg210->ep0_req, GFP_ATOMIC); + spin_lock(&fotg210->lock); + } + +-- +2.20.1 + diff --git a/queue-4.9/usb-serial-cypress_m8-fix-interrupt-out-transfer-len.patch b/queue-4.9/usb-serial-cypress_m8-fix-interrupt-out-transfer-len.patch new file mode 100644 index 00000000000..ab05955674b --- /dev/null +++ b/queue-4.9/usb-serial-cypress_m8-fix-interrupt-out-transfer-len.patch @@ -0,0 +1,38 @@ +From daa6034c8aad2f22d7e1ff7936fa25e0d6ec6293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Sep 2018 18:03:11 +0200 +Subject: USB: serial: cypress_m8: fix interrupt-out transfer length + +From: Johan Hovold + +[ Upstream commit 56445eef55cb5904096fed7a73cf87b755dfffc7 ] + +Fix interrupt-out transfer length which was being set to the +transfer-buffer length rather than the size of the outgoing packet. + +Note that no slab data was leaked as the whole transfer buffer is always +cleared before each transfer. + +Fixes: 9aa8dae7b1fa ("cypress_m8: use usb_fill_int_urb where appropriate") +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/cypress_m8.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c +index bbeeb2bd55a83..2c915be1db4ce 100644 +--- a/drivers/usb/serial/cypress_m8.c ++++ b/drivers/usb/serial/cypress_m8.c +@@ -773,7 +773,7 @@ static void cypress_send(struct usb_serial_port *port) + + usb_fill_int_urb(port->interrupt_out_urb, port->serial->dev, + usb_sndintpipe(port->serial->dev, port->interrupt_out_endpointAddress), +- port->interrupt_out_buffer, port->interrupt_out_size, ++ port->interrupt_out_buffer, actual_size, + cypress_write_int_callback, port, priv->write_urb_interval); + result = usb_submit_urb(port->interrupt_out_urb, GFP_ATOMIC); + if (result) { +-- +2.20.1 + diff --git a/queue-4.9/x86-kexec-correct-kexec_backup_src_end-off-by-one-er.patch b/queue-4.9/x86-kexec-correct-kexec_backup_src_end-off-by-one-er.patch new file mode 100644 index 00000000000..692a72d8cf3 --- /dev/null +++ b/queue-4.9/x86-kexec-correct-kexec_backup_src_end-off-by-one-er.patch @@ -0,0 +1,67 @@ +From be0a4f25663b97787260034be6f80ef82926f5ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 09:21:55 -0500 +Subject: x86/kexec: Correct KEXEC_BACKUP_SRC_END off-by-one error + +From: Bjorn Helgaas + +[ Upstream commit 51fbf14f2528a8c6401290e37f1c893a2412f1d3 ] + +The only use of KEXEC_BACKUP_SRC_END is as an argument to +walk_system_ram_res(): + + int crash_load_segments(struct kimage *image) + { + ... + walk_system_ram_res(KEXEC_BACKUP_SRC_START, KEXEC_BACKUP_SRC_END, + image, determine_backup_region); + +walk_system_ram_res() expects "start, end" arguments that are inclusive, +i.e., the range to be walked includes both the start and end addresses. + +KEXEC_BACKUP_SRC_END was previously defined as (640 * 1024UL), which is the +first address *past* the desired 0-640KB range. + +Define KEXEC_BACKUP_SRC_END as (640 * 1024UL - 1) so the KEXEC_BACKUP_SRC +region is [0-0x9ffff], not [0-0xa0000]. + +Fixes: dd5f726076cc ("kexec: support for kexec on panic using new system call") +Signed-off-by: Bjorn Helgaas +Signed-off-by: Borislav Petkov +CC: "H. Peter Anvin" +CC: Andrew Morton +CC: Brijesh Singh +CC: Greg Kroah-Hartman +CC: Ingo Molnar +CC: Lianbo Jiang +CC: Takashi Iwai +CC: Thomas Gleixner +CC: Tom Lendacky +CC: Vivek Goyal +CC: baiyaowei@cmss.chinamobile.com +CC: bhe@redhat.com +CC: dan.j.williams@intel.com +CC: dyoung@redhat.com +CC: kexec@lists.infradead.org +Link: http://lkml.kernel.org/r/153805811578.1157.6948388946904655969.stgit@bhelgaas-glaptop.roam.corp.google.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/kexec.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h +index 282630e4c6ea4..1624a7ffa95d8 100644 +--- a/arch/x86/include/asm/kexec.h ++++ b/arch/x86/include/asm/kexec.h +@@ -66,7 +66,7 @@ struct kimage; + + /* Memory to backup during crash kdump */ + #define KEXEC_BACKUP_SRC_START (0UL) +-#define KEXEC_BACKUP_SRC_END (640 * 1024UL) /* 640K */ ++#define KEXEC_BACKUP_SRC_END (640 * 1024UL - 1) /* 640K */ + + /* + * CPU does not save ss and sp on stack if execution is already +-- +2.20.1 + diff --git a/queue-4.9/x86-olpc-fix-build-error-with-config_mfd_cs5535-m.patch b/queue-4.9/x86-olpc-fix-build-error-with-config_mfd_cs5535-m.patch new file mode 100644 index 00000000000..9ee97e9c693 --- /dev/null +++ b/queue-4.9/x86-olpc-fix-build-error-with-config_mfd_cs5535-m.patch @@ -0,0 +1,47 @@ +From 53be31f1bbc73a083338aa954c57da97ef850984 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Oct 2018 15:13:07 +0200 +Subject: x86/olpc: Fix build error with CONFIG_MFD_CS5535=m + +From: Borislav Petkov + +[ Upstream commit fa112cf1e8bc693d5a666b1c479a2859c8b6e0f1 ] + +When building a 32-bit config which has the above MFD item as module +but OLPC_XO1_PM is enabled =y - which is bool, btw - the kernel fails +building with: + + ld: arch/x86/platform/olpc/olpc-xo1-pm.o: in function `xo1_pm_remove': + /home/boris/kernel/linux/arch/x86/platform/olpc/olpc-xo1-pm.c:159: undefined reference to `mfd_cell_disable' + ld: arch/x86/platform/olpc/olpc-xo1-pm.o: in function `xo1_pm_probe': + /home/boris/kernel/linux/arch/x86/platform/olpc/olpc-xo1-pm.c:133: undefined reference to `mfd_cell_enable' + make: *** [Makefile:1030: vmlinux] Error 1 + +Force MFD_CS5535 to y if OLPC_XO1_PM is enabled. + +Signed-off-by: Borislav Petkov +Cc: Lubomir Rintel +Cc: x86@kernel.org +Link: http://lkml.kernel.org/r/20181005131750.GA5366@zn.tnic +Signed-off-by: Sasha Levin +--- + arch/x86/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 1067f7668c4ee..80636caee07cc 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -2614,8 +2614,7 @@ config OLPC + + config OLPC_XO1_PM + bool "OLPC XO-1 Power Management" +- depends on OLPC && MFD_CS5535 && PM_SLEEP +- select MFD_CORE ++ depends on OLPC && MFD_CS5535=y && PM_SLEEP + ---help--- + Add support for poweroff and suspend of the OLPC XO-1 laptop. + +-- +2.20.1 +