From: Greg Kroah-Hartman Date: Sat, 29 Oct 2016 13:19:56 +0000 (-0400) Subject: 4.8-stable patches X-Git-Tag: v4.4.29~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=013bc8c6e351f0ad8050513454aabc14aac6fb41;p=thirdparty%2Fkernel%2Fstable-queue.git 4.8-stable patches added patches: arm-dts-fix-realview-eb-smsc-ethernet-version.patch arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch arm-pxa-fix-gpio-double-shifts.patch arm-pxa-pxa_cplds-fix-interrupt-handling.patch clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch clk-core-force-setting-the-phase-delay-when-no-change.patch clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch clk-qoriq-fix-a-register-offset-error.patch clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch drm-vmwgfx-avoid-validating-views-on-view-destruction.patch iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch iwlwifi-mvm-call-a-different-txq_enable-function.patch iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch iwlwifi-mvm-support-bar-in-reorder-buffer.patch libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch pci-aardvark-fix-pci_remap_iospace-failure-path.patch pci-designware-fix-pci_remap_iospace-failure-path.patch pci-generic-fix-pci_remap_iospace-failure-path.patch pci-rcar-fix-pci_remap_iospace-failure-path.patch pci-tegra-fix-pci_remap_iospace-failure-path.patch pci-versatile-fix-pci_remap_iospace-failure-path.patch perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch perf-hists-browser-fix-event-group-display.patch perf-powerpc-fix-build-test-failure.patch perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch perf-ui-stdio-always-reset-output-width-for-hierarchy.patch perf-ui-tui-reset-output-width-for-hierarchy.patch pinctrl-qcom-fix-masking-of-pinmux-functions.patch powerpc-add-check_if_tm_restore_required-to-giveup_all.patch powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch powerpc-fix-usage-of-_page_ro-in-hugepage.patch powerpc-nvram-fix-an-incorrect-partition-merge.patch s390-cio-fix-accidental-interrupt-enabling-during-resume.patch s390-con3270-fix-insufficient-space-padding.patch s390-con3270-fix-use-of-uninitialised-data.patch --- diff --git a/queue-4.8/arm-dts-fix-realview-eb-smsc-ethernet-version.patch b/queue-4.8/arm-dts-fix-realview-eb-smsc-ethernet-version.patch new file mode 100644 index 00000000000..7d682cfe041 --- /dev/null +++ b/queue-4.8/arm-dts-fix-realview-eb-smsc-ethernet-version.patch @@ -0,0 +1,67 @@ +From c4ad72560df11961d3e57fb0fadfe88a9863c9ad Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 8 Sep 2016 10:48:38 +0200 +Subject: ARM: dts: fix RealView EB SMSC ethernet version + +From: Linus Walleij + +commit c4ad72560df11961d3e57fb0fadfe88a9863c9ad upstream. + +The ethernet version in the earlier RealView EB variants is +LAN91C111 and not LAN9118 according to ARM DUI 0303E +"RealView Emulation Baseboard User Guide" page 3-57. + +Make sure that this is used for the base variant of the board. + +As the DT bindings for LAN91C111 does not specify any power +supplies, these need to be deleted from the DTS file. + +Fixes: 2440d29d2ae2 ("ARM: dts: realview: support all the RealView EB board variants") +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/arm-realview-eb.dtsi | 23 +++++++---------------- + 1 file changed, 7 insertions(+), 16 deletions(-) + +--- a/arch/arm/boot/dts/arm-realview-eb.dtsi ++++ b/arch/arm/boot/dts/arm-realview-eb.dtsi +@@ -51,14 +51,6 @@ + regulator-boot-on; + }; + +- veth: fixedregulator@0 { +- compatible = "regulator-fixed"; +- regulator-name = "veth"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- regulator-boot-on; +- }; +- + xtal24mhz: xtal24mhz@24M { + #clock-cells = <0>; + compatible = "fixed-clock"; +@@ -134,16 +126,15 @@ + bank-width = <4>; + }; + +- /* SMSC 9118 ethernet with PHY and EEPROM */ ++ /* SMSC LAN91C111 ethernet with PHY and EEPROM */ + ethernet: ethernet@4e000000 { +- compatible = "smsc,lan9118", "smsc,lan9115"; ++ compatible = "smsc,lan91c111"; + reg = <0x4e000000 0x10000>; +- phy-mode = "mii"; +- reg-io-width = <4>; +- smsc,irq-active-high; +- smsc,irq-push-pull; +- vdd33a-supply = <&veth>; +- vddvario-supply = <&veth>; ++ /* ++ * This means the adapter can be accessed with 8, 16 or ++ * 32 bit reads/writes. ++ */ ++ reg-io-width = <7>; + }; + + usb: usb@4f000000 { diff --git a/queue-4.8/arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch b/queue-4.8/arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch new file mode 100644 index 00000000000..f6c23549f1d --- /dev/null +++ b/queue-4.8/arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch @@ -0,0 +1,33 @@ +From c53beb47f621e4a56f31af9f86470041655516c7 Mon Sep 17 00:00:00 2001 +From: Jon Mason +Date: Thu, 14 Jul 2016 16:14:17 -0400 +Subject: ARM: dts: NSP: Correct RAM amount for BCM958625HR board + +From: Jon Mason + +commit c53beb47f621e4a56f31af9f86470041655516c7 upstream. + +The BCM958625HR board has 2GB of RAM available. Increase the amount +from 512MB to 2GB and add the device type to the memory entry. + +Fixes: 9a4865d42fe5 ("ARM: dts: NSP: Specify RAM amount for BCM958625HR board") +Signed-off-by: Jon Mason +Signed-off-by: Florian Fainelli +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/bcm958625hr.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/bcm958625hr.dts ++++ b/arch/arm/boot/dts/bcm958625hr.dts +@@ -47,7 +47,8 @@ + }; + + memory { +- reg = <0x60000000 0x20000000>; ++ device_type = "memory"; ++ reg = <0x60000000 0x80000000>; + }; + }; + diff --git a/queue-4.8/arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch b/queue-4.8/arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch new file mode 100644 index 00000000000..24372f281d8 --- /dev/null +++ b/queue-4.8/arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch @@ -0,0 +1,41 @@ +From 0b965a13ad81fa895e534d1f50b355ff8b0b3ed3 Mon Sep 17 00:00:00 2001 +From: Javier Martinez Canillas +Date: Mon, 1 Aug 2016 12:46:56 -0400 +Subject: ARM: dts: omap3: overo: add missing unit name for lcd35 display + +From: Javier Martinez Canillas + +commit 0b965a13ad81fa895e534d1f50b355ff8b0b3ed3 upstream. + +Commit b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names +in display nodes") removed the unit names for all Overo display nodes +that didn't have a reg property. + +But the display in arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi does +have a reg property so the correct fix was to make the unit name match +the value of the reg property, instead of removing it. + +This patch fixes the following DTC warning for boards using this dtsi: + +"ocp/spi@48098000/display has a reg or ranges property, but no unit name" + +Fixes: b8d368caa8dc ("ARM: dts: omap3: overo: remove unneded unit names in display nodes") +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-common-lcd35.dtsi +@@ -119,7 +119,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&mcspi1_pins>; + +- lcd0: display { ++ lcd0: display@1 { + compatible = "lgphilips,lb035q02"; + label = "lcd35"; + diff --git a/queue-4.8/arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch b/queue-4.8/arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch new file mode 100644 index 00000000000..6f5b82ac35a --- /dev/null +++ b/queue-4.8/arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch @@ -0,0 +1,37 @@ +From 06ad11be7a9e13499ff8e55e46f09d22f9ee6fc0 Mon Sep 17 00:00:00 2001 +From: Chen-Yu Tsai +Date: Sat, 27 Aug 2016 15:59:50 +0800 +Subject: ARM: dts: sun9i: Add missing #interrupt-cells to R_PIO pinctrl device node + +From: Chen-Yu Tsai + +commit 06ad11be7a9e13499ff8e55e46f09d22f9ee6fc0 upstream. + +The R_PIO device node is missing #interrupt-cells, which causes +interrupt parsing to fail to match it as a valid interrupt controller. + +Add #interrupt-cells to it. Also remove the unnecesary #address-cells +and #size-cells. + +Fixes: 1ac56a6da9e1 ("ARM: dts: sun9i: Add A80 R_PIO pin controller device + node") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Maxime Ripard +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/sun9i-a80.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/sun9i-a80.dtsi ++++ b/arch/arm/boot/dts/sun9i-a80.dtsi +@@ -899,8 +899,7 @@ + resets = <&apbs_rst 0>; + gpio-controller; + interrupt-controller; +- #address-cells = <1>; +- #size-cells = <0>; ++ #interrupt-cells = <3>; + #gpio-cells = <3>; + + r_ir_pins: r_ir { diff --git a/queue-4.8/arm-pxa-fix-gpio-double-shifts.patch b/queue-4.8/arm-pxa-fix-gpio-double-shifts.patch new file mode 100644 index 00000000000..f3014c8801f --- /dev/null +++ b/queue-4.8/arm-pxa-fix-gpio-double-shifts.patch @@ -0,0 +1,111 @@ +From ca26475bf02ed8562b9b46f91d3e8b52ec312541 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Tue, 2 Aug 2016 00:01:32 +0200 +Subject: ARM: pxa: fix GPIO double shifts + +From: Robert Jarzmik + +commit ca26475bf02ed8562b9b46f91d3e8b52ec312541 upstream. + +The commit 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of +gpio register") from Oct 17, 2011, leads to the following static checker +warning: + arch/arm/mach-pxa/spitz_pm.c:172 spitz_charger_wakeup() + warn: double left shift '!gpio_get_value(SPITZ_GPIO_KEY_INT) + << (1 << ((SPITZ_GPIO_KEY_INT) & 31))' + +As Dan reported, the value is shifted three times : + - once by gpio_get_value(), which returns either 0 or BIT(gpio) + - once by the shift operation '<<' + - a last time by GPIO_bit(gpio) which is BIT(gpio) + +Therefore the calculation lead to a chained or operator of : + - (1 << gpio) << (1 << gpio) = (2^gpio)^gpio = 2 ^ (gpio * gpio) + +It is be sheer luck the former statement works, only because each gpio +used is strictly smaller than 6, and therefore 2^(gpio^2) never +overflows a 32 bits value, and because it is used as a boolean value to +check a gpio activation. + +As the xxx_charger_wakeup() functions are used as a true/false detection +mechanism, take that opportunity to change their prototypes from integer +return value to boolean one. + +Fixes: 9bf448c66d4b ("ARM: pxa: use generic gpio operation instead of +gpio register") +Reported-by: Dan Carpenter +Cc: Joe Perches +Signed-off-by: Robert Jarzmik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/corgi_pm.c | 13 ++++--------- + arch/arm/mach-pxa/sharpsl_pm.c | 2 +- + arch/arm/mach-pxa/sharpsl_pm.h | 2 +- + arch/arm/mach-pxa/spitz_pm.c | 9 +++------ + 4 files changed, 9 insertions(+), 17 deletions(-) + +--- a/arch/arm/mach-pxa/corgi_pm.c ++++ b/arch/arm/mach-pxa/corgi_pm.c +@@ -131,16 +131,11 @@ static int corgi_should_wakeup(unsigned + return is_resume; + } + +-static unsigned long corgi_charger_wakeup(void) ++static bool corgi_charger_wakeup(void) + { +- unsigned long ret; +- +- ret = (!gpio_get_value(CORGI_GPIO_AC_IN) << GPIO_bit(CORGI_GPIO_AC_IN)) +- | (!gpio_get_value(CORGI_GPIO_KEY_INT) +- << GPIO_bit(CORGI_GPIO_KEY_INT)) +- | (!gpio_get_value(CORGI_GPIO_WAKEUP) +- << GPIO_bit(CORGI_GPIO_WAKEUP)); +- return ret; ++ return !gpio_get_value(CORGI_GPIO_AC_IN) || ++ !gpio_get_value(CORGI_GPIO_KEY_INT) || ++ !gpio_get_value(CORGI_GPIO_WAKEUP); + } + + unsigned long corgipm_read_devdata(int type) +--- a/arch/arm/mach-pxa/sharpsl_pm.c ++++ b/arch/arm/mach-pxa/sharpsl_pm.c +@@ -744,7 +744,7 @@ static int sharpsl_off_charge_battery(vo + time = RCNR; + while (1) { + /* Check if any wakeup event had occurred */ +- if (sharpsl_pm.machinfo->charger_wakeup() != 0) ++ if (sharpsl_pm.machinfo->charger_wakeup()) + return 0; + /* Check for timeout */ + if ((RCNR - time) > SHARPSL_WAIT_CO_TIME) +--- a/arch/arm/mach-pxa/sharpsl_pm.h ++++ b/arch/arm/mach-pxa/sharpsl_pm.h +@@ -34,7 +34,7 @@ struct sharpsl_charger_machinfo { + #define SHARPSL_STATUS_LOCK 5 + #define SHARPSL_STATUS_CHRGFULL 6 + #define SHARPSL_STATUS_FATAL 7 +- unsigned long (*charger_wakeup)(void); ++ bool (*charger_wakeup)(void); + int (*should_wakeup)(unsigned int resume_on_alarm); + void (*backlight_limit)(int); + int (*backlight_get_status) (void); +--- a/arch/arm/mach-pxa/spitz_pm.c ++++ b/arch/arm/mach-pxa/spitz_pm.c +@@ -165,13 +165,10 @@ static int spitz_should_wakeup(unsigned + return is_resume; + } + +-static unsigned long spitz_charger_wakeup(void) ++static bool spitz_charger_wakeup(void) + { +- unsigned long ret; +- ret = ((!gpio_get_value(SPITZ_GPIO_KEY_INT) +- << GPIO_bit(SPITZ_GPIO_KEY_INT)) +- | gpio_get_value(SPITZ_GPIO_SYNC)); +- return ret; ++ return !gpio_get_value(SPITZ_GPIO_KEY_INT) || ++ gpio_get_value(SPITZ_GPIO_SYNC); + } + + unsigned long spitzpm_read_devdata(int type) diff --git a/queue-4.8/arm-pxa-pxa_cplds-fix-interrupt-handling.patch b/queue-4.8/arm-pxa-pxa_cplds-fix-interrupt-handling.patch new file mode 100644 index 00000000000..90261145caf --- /dev/null +++ b/queue-4.8/arm-pxa-pxa_cplds-fix-interrupt-handling.patch @@ -0,0 +1,120 @@ +From 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Sun, 4 Sep 2016 20:59:45 +0200 +Subject: ARM: pxa: pxa_cplds: fix interrupt handling + +From: Robert Jarzmik + +commit 9ba63e3cc849cdaf3b675c47cc51fe35419e5117 upstream. + +Since its initial commit, the driver is buggy for multiple interrupts +handling. The translation from the former lubbock.c file was not +complete, and might stall all interrupt handling when multiple +interrupts occur. + +This is especially true when inside the interrupt handler and if a new +interrupt comes and is not handled, leaving the output line still held, +and not creating a transition as the GPIO block behind would expect to +trigger another cplds_irq_handler() call. + +For the record, the hardware is working as follows. + +The interrupt mechanism relies on : + - one status register + - one mask register + +Let's suppose the input irq lines are called : + - i_sa1111 + - i_lan91x + - i_mmc_cd +Let's suppose the status register for each irq line is called : + - status_sa1111 + - status_lan91x + - status_mmc_cd +Let's suppose the interrupt mask for each irq line is called : + - irqen_sa1111 + - irqen_lan91x + - irqen_mmc_cd +Let's suppose the output irq line, connected to GPIO0 is called : + - o_gpio0 + +The behavior is as follows : + - o_gpio0 = not((status_sa1111 & irqen_sa1111) | + (status_lan91x & irqen_lan91x) | + (status_mmc_cd & irqen_mmc_cd)) + => this is a N-to-1 NOR gate and multiple AND gates + - irqen_* is exactly as programmed by a write to the FPGA + - status_* behavior is governed by a bi-stable D flip-flop + => on next FPGA clock : + - if i_xxx is high, status_xxx becomes 1 + - if i_xxx is low, status_xxx remains as it is + - if software sets status_xxx to 0, the D flip-flop is reset + => status_xxx becomes 0 + => on next FPGA clock cycle, if i_xxx is high, status_xxx becomes + 1 again + +Fixes: fc9e38c0f4d3 ("ARM: pxa: lubbock: use new pxa_cplds driver") +Reported-by: Russell King +Signed-off-by: Robert Jarzmik +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-pxa/pxa_cplds_irqs.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/arch/arm/mach-pxa/pxa_cplds_irqs.c ++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c +@@ -41,30 +41,35 @@ static irqreturn_t cplds_irq_handler(int + unsigned long pending; + unsigned int bit; + +- pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask; +- for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) +- generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit)); ++ do { ++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask; ++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ) { ++ generic_handle_irq(irq_find_mapping(fpga->irqdomain, ++ bit)); ++ } ++ } while (pending); + + return IRQ_HANDLED; + } + +-static void cplds_irq_mask_ack(struct irq_data *d) ++static void cplds_irq_mask(struct irq_data *d) + { + struct cplds *fpga = irq_data_get_irq_chip_data(d); + unsigned int cplds_irq = irqd_to_hwirq(d); +- unsigned int set, bit = BIT(cplds_irq); ++ unsigned int bit = BIT(cplds_irq); + + fpga->irq_mask &= ~bit; + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); +- set = readl(fpga->base + FPGA_IRQ_SET_CLR); +- writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR); + } + + static void cplds_irq_unmask(struct irq_data *d) + { + struct cplds *fpga = irq_data_get_irq_chip_data(d); + unsigned int cplds_irq = irqd_to_hwirq(d); +- unsigned int bit = BIT(cplds_irq); ++ unsigned int set, bit = BIT(cplds_irq); ++ ++ set = readl(fpga->base + FPGA_IRQ_SET_CLR); ++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR); + + fpga->irq_mask |= bit; + writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN); +@@ -72,7 +77,8 @@ static void cplds_irq_unmask(struct irq_ + + static struct irq_chip cplds_irq_chip = { + .name = "pxa_cplds", +- .irq_mask_ack = cplds_irq_mask_ack, ++ .irq_ack = cplds_irq_mask, ++ .irq_mask = cplds_irq_mask, + .irq_unmask = cplds_irq_unmask, + .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE, + }; diff --git a/queue-4.8/clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch b/queue-4.8/clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch new file mode 100644 index 00000000000..7d0338b830f --- /dev/null +++ b/queue-4.8/clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch @@ -0,0 +1,78 @@ +From 67615c588a059b731df9d019edc3c561d8006ec9 Mon Sep 17 00:00:00 2001 +From: Eric Anholt +Date: Wed, 1 Jun 2016 12:05:36 -0700 +Subject: clk: bcm2835: Skip PLLC clocks when deciding on a new clock parent + +From: Eric Anholt + +commit 67615c588a059b731df9d019edc3c561d8006ec9 upstream. + +If the firmware had set up a clock to source from PLLC, go along with +it. But if we're looking for a new parent, we don't want to switch it +to PLLC because the firmware will force PLLC (and thus the AXI bus +clock) to different frequencies during over-temp/under-voltage, +without notification to Linux. + +On my system, this moves the Linux-enabled HDMI state machine and DSI1 +escape clock over to plld_per from pllc_per. EMMC still ends up on +pllc_per, because the firmware had set it up to use that. + +Signed-off-by: Eric Anholt +Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks") +Acked-by: Martin Sperl +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/bcm/clk-bcm2835.c | 23 +++++++++++++++++++++++ + 1 file changed, 23 insertions(+) + +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1006,16 +1006,28 @@ static int bcm2835_clock_set_rate(struct + return 0; + } + ++static bool ++bcm2835_clk_is_pllc(struct clk_hw *hw) ++{ ++ if (!hw) ++ return false; ++ ++ return strncmp(clk_hw_get_name(hw), "pllc", 4) == 0; ++} ++ + static int bcm2835_clock_determine_rate(struct clk_hw *hw, + struct clk_rate_request *req) + { + struct bcm2835_clock *clock = bcm2835_clock_from_hw(hw); + struct clk_hw *parent, *best_parent = NULL; ++ bool current_parent_is_pllc; + unsigned long rate, best_rate = 0; + unsigned long prate, best_prate = 0; + size_t i; + u32 div; + ++ current_parent_is_pllc = bcm2835_clk_is_pllc(clk_hw_get_parent(hw)); ++ + /* + * Select parent clock that results in the closest but lower rate + */ +@@ -1023,6 +1035,17 @@ static int bcm2835_clock_determine_rate( + parent = clk_hw_get_parent_by_index(hw, i); + if (!parent) + continue; ++ ++ /* ++ * Don't choose a PLLC-derived clock as our parent ++ * unless it had been manually set that way. PLLC's ++ * frequency gets adjusted by the firmware due to ++ * over-temp or under-voltage conditions, without ++ * prior notification to our clock consumer. ++ */ ++ if (bcm2835_clk_is_pllc(parent) && !current_parent_is_pllc) ++ continue; ++ + prate = clk_hw_get_rate(parent); + div = bcm2835_clock_choose_div(hw, req->rate, prate, true); + rate = bcm2835_clock_rate_from_divisor(clock, prate, div); diff --git a/queue-4.8/clk-core-force-setting-the-phase-delay-when-no-change.patch b/queue-4.8/clk-core-force-setting-the-phase-delay-when-no-change.patch new file mode 100644 index 00000000000..0848f150558 --- /dev/null +++ b/queue-4.8/clk-core-force-setting-the-phase-delay-when-no-change.patch @@ -0,0 +1,48 @@ +From 3174b0c9a62bb3738b4a2a506b8a075d4430e353 Mon Sep 17 00:00:00 2001 +From: Jean-Francois Moine +Date: Wed, 24 Aug 2016 08:32:51 +0200 +Subject: clk: core: Force setting the phase delay when no change + +From: Jean-Francois Moine + +commit 3174b0c9a62bb3738b4a2a506b8a075d4430e353 upstream. + +This patch reverts commit 023bd7166be0 ("clk: skip unnecessary +set_phase if nothing to do"), fixing two problems: + +* in some SoCs, the hardware phase delay depends on the rate ratio of + the clock and its parent. So, changing this ratio may imply to set + new hardware values, even if the logical delay is the same. + +* when the delay was the same as previously, an error was returned. + +Signed-off-by: Jean-Francois Moine +Fixes: 023bd7166be0 ("clk: skip unnecessary set_phase if nothing to do") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -1908,10 +1908,6 @@ int clk_set_phase(struct clk *clk, int d + + clk_prepare_lock(); + +- /* bail early if nothing to do */ +- if (degrees == clk->core->phase) +- goto out; +- + trace_clk_set_phase(clk->core, degrees); + + if (clk->core->ops->set_phase) +@@ -1922,7 +1918,6 @@ int clk_set_phase(struct clk *clk, int d + if (!ret) + clk->core->phase = degrees; + +-out: + clk_prepare_unlock(); + + return ret; diff --git a/queue-4.8/clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch b/queue-4.8/clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch new file mode 100644 index 00000000000..24d569500c6 --- /dev/null +++ b/queue-4.8/clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch @@ -0,0 +1,34 @@ +From 2cf9a57811bddb6fa6b0f8d7376da164d5534813 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 12 Aug 2016 14:37:54 +0200 +Subject: clk: divider: Fix clk_divider_round_rate() to use clk_readl() + +From: Geert Uytterhoeven + +commit 2cf9a57811bddb6fa6b0f8d7376da164d5534813 upstream. + +clk-divider uses clk_readl()/clk_writel() everywhere, except in +clk_divider_round_rate(), where plain readl() is used. Change this to +clk_readl(), as it makes a difference on powerpc. + +Fixes: e6d5e7d90be92cee ("clk-divider: Fix READ_ONLY when divider > 1") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: James Hogan +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-divider.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-divider.c ++++ b/drivers/clk/clk-divider.c +@@ -352,7 +352,7 @@ static long clk_divider_round_rate(struc + + /* if read only, just return current value */ + if (divider->flags & CLK_DIVIDER_READ_ONLY) { +- bestdiv = readl(divider->reg) >> divider->shift; ++ bestdiv = clk_readl(divider->reg) >> divider->shift; + bestdiv &= div_mask(divider->width); + bestdiv = _get_div(divider->table, bestdiv, divider->flags, + divider->width); diff --git a/queue-4.8/clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch b/queue-4.8/clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch new file mode 100644 index 00000000000..c3e436786d7 --- /dev/null +++ b/queue-4.8/clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch @@ -0,0 +1,35 @@ +From ce61966c05f276294b6be04d1765ad0d827ddefd Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Thu, 25 Aug 2016 12:20:46 +0100 +Subject: clk: gcc-msm8996: Fix pcie 2 pipe register offset + +From: Srinivas Kandagatla + +commit ce61966c05f276294b6be04d1765ad0d827ddefd upstream. + +This patch corrects the register offset for pcie2 pipe clock. +Offset according to datasheet is 0x6e018 instead of 0x6e108. + +Signed-off-by: Srinivas Kandagatla +Fixes: b1e010c0730a ("clk: qcom: Add MSM8996 Global Clock Control (GCC) driver") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-msm8996.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/qcom/gcc-msm8996.c ++++ b/drivers/clk/qcom/gcc-msm8996.c +@@ -2592,9 +2592,9 @@ static struct clk_branch gcc_pcie_2_aux_ + }; + + static struct clk_branch gcc_pcie_2_pipe_clk = { +- .halt_reg = 0x6e108, ++ .halt_reg = 0x6e018, + .clkr = { +- .enable_reg = 0x6e108, ++ .enable_reg = 0x6e018, + .enable_mask = BIT(0), + .hw.init = &(struct clk_init_data){ + .name = "gcc_pcie_2_pipe_clk", diff --git a/queue-4.8/clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch b/queue-4.8/clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch new file mode 100644 index 00000000000..edbe347cb04 --- /dev/null +++ b/queue-4.8/clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch @@ -0,0 +1,43 @@ +From 6d91f2c0141330b919ae4d13395f38c341469564 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Thu, 25 Aug 2016 12:28:07 +0100 +Subject: clk: qcom: select GDSC for msm8996 gcc and mmcc + +From: Srinivas Kandagatla + +commit 6d91f2c0141330b919ae4d13395f38c341469564 upstream. + +This patch selects QCOM_GDSC Kconfig for msm8996 GCC and MMCC clock +controllers, as these provide some of the gdscs on the SOC. + +Also selecting this config will make it align with other drivers which +do the same. + +Signed-off-by: Srinivas Kandagatla +Fixes: 52111672f791 ("clk: qcom: gdsc: Add GDSCs in msm8996 GCC") +Fixes: 7e824d507909 ("clk: qcom: gdsc: Add mmcc gdscs for msm8996 family") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/clk/qcom/Kconfig ++++ b/drivers/clk/qcom/Kconfig +@@ -117,6 +117,7 @@ config MSM_MMCC_8974 + + config MSM_GCC_8996 + tristate "MSM8996 Global Clock Controller" ++ select QCOM_GDSC + depends on COMMON_CLK_QCOM + help + Support for the global clock controller on msm8996 devices. +@@ -126,6 +127,7 @@ config MSM_GCC_8996 + config MSM_MMCC_8996 + tristate "MSM8996 Multimedia Clock Controller" + select MSM_GCC_8996 ++ select QCOM_GDSC + depends on COMMON_CLK_QCOM + help + Support for the multimedia clock controller on msm8996 devices. diff --git a/queue-4.8/clk-qoriq-fix-a-register-offset-error.patch b/queue-4.8/clk-qoriq-fix-a-register-offset-error.patch new file mode 100644 index 00000000000..d3aeabe46cc --- /dev/null +++ b/queue-4.8/clk-qoriq-fix-a-register-offset-error.patch @@ -0,0 +1,38 @@ +From 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 Mon Sep 17 00:00:00 2001 +From: Tang Yuantian +Date: Mon, 15 Aug 2016 15:28:20 +0800 +Subject: clk: qoriq: fix a register offset error + +From: Tang Yuantian + +commit 8964193f6bfda5c4cf14eedb7e94892c1f1c34f0 upstream. + +The offset of Core Cluster clock control/status register +on cluster group V3 version is different from others, and +should be plus 0x70000. + +Signed-off-by: Tang Yuantian +Reviewed-by: Scott Wood +Fixes: 9e19ca2f627e ("clk: qoriq: Add ls2080a support.") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-qoriq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/clk/clk-qoriq.c ++++ b/drivers/clk/clk-qoriq.c +@@ -766,7 +766,11 @@ static struct clk * __init create_one_cm + if (!hwc) + return NULL; + +- hwc->reg = cg->regs + 0x20 * idx; ++ if (cg->info.flags & CG_VER3) ++ hwc->reg = cg->regs + 0x70000 + 0x20 * idx; ++ else ++ hwc->reg = cg->regs + 0x20 * idx; ++ + hwc->info = cg->info.cmux_groups[cg->info.cmux_to_group[idx]]; + + /* diff --git a/queue-4.8/clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch b/queue-4.8/clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch new file mode 100644 index 00000000000..ef53fc0d25b --- /dev/null +++ b/queue-4.8/clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch @@ -0,0 +1,60 @@ +From f155d15b64e36b45ca89e3521fe0c1ccad5e5ff0 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Mon, 15 Aug 2016 14:32:23 -0700 +Subject: clk: Return errors from clk providers in __of_clk_get_from_provider() + +From: Stephen Boyd + +commit f155d15b64e36b45ca89e3521fe0c1ccad5e5ff0 upstream. + +Before commit 0861e5b8cf80 (clk: Add clk_hw OF clk providers, +2016-02-05) __of_clk_get_from_provider() would return an error +pointer of the provider's choosing if there was a provider +registered and EPROBE_DEFER otherwise. After that commit, it +would return EPROBE_DEFER regardless of whether or not the +provider returned an error. This is odd and can lead to behavior +where clk consumers keep probe deferring when they should be +seeing some other error. + +Let's restore the previous behavior where we only return +EPROBE_DEFER when there isn't a provider in our of_clk_providers +list. Otherwise, return the error from the last provider we find +that matches the node. + +Reported-by: Masahiro Yamada +Fixes: 0861e5b8cf80 ("clk: Add clk_hw OF clk providers") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3186,7 +3186,7 @@ struct clk *__of_clk_get_from_provider(s + { + struct of_clk_provider *provider; + struct clk *clk = ERR_PTR(-EPROBE_DEFER); +- struct clk_hw *hw = ERR_PTR(-EPROBE_DEFER); ++ struct clk_hw *hw; + + if (!clkspec) + return ERR_PTR(-EINVAL); +@@ -3194,12 +3194,13 @@ struct clk *__of_clk_get_from_provider(s + /* Check if we have such a provider in our array */ + mutex_lock(&of_clk_mutex); + list_for_each_entry(provider, &of_clk_providers, link) { +- if (provider->node == clkspec->np) ++ if (provider->node == clkspec->np) { + hw = __of_clk_get_hw_from_provider(provider, clkspec); +- if (!IS_ERR(hw)) { + clk = __clk_create_clk(hw, dev_id, con_id); ++ } + +- if (!IS_ERR(clk) && !__clk_get(clk)) { ++ if (!IS_ERR(clk)) { ++ if (!__clk_get(clk)) { + __clk_free_clk(clk); + clk = ERR_PTR(-ENOENT); + } diff --git a/queue-4.8/drm-vmwgfx-avoid-validating-views-on-view-destruction.patch b/queue-4.8/drm-vmwgfx-avoid-validating-views-on-view-destruction.patch new file mode 100644 index 00000000000..927603fdbe6 --- /dev/null +++ b/queue-4.8/drm-vmwgfx-avoid-validating-views-on-view-destruction.patch @@ -0,0 +1,192 @@ +From a19440304db2d97aed5cee9bfa5017c98d2348bf Mon Sep 17 00:00:00 2001 +From: Thomas Hellstrom +Date: Mon, 10 Oct 2016 11:06:45 -0700 +Subject: drm/vmwgfx: Avoid validating views on view destruction + +From: Thomas Hellstrom + +commit a19440304db2d97aed5cee9bfa5017c98d2348bf upstream. + +When a view destruction command was present in the command stream, the +view was validated to avoid a device error. That caused excessive and +unnecessary validations of views, surfaces and mobs on view destruction. + +Replace this with a new relocation type that patches the view +destruction command to a NOP if the view is not present in the device +after the execbuf validation sequence. + +Also add checks for the member size of the vmw_res_relocation struct. + +Fixes sporadic command submission errors on google-earth exit. + +Reported-by: Brian Paul +Signed-off-by: Thomas Hellstrom +Reviewed-by: Brian Paul +Reviewed-by: Sinclair Yeh +Signed-off-by: Sinclair Yeh +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 70 ++++++++++++++++++++++++++------ + 1 file changed, 57 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -34,6 +34,24 @@ + + #define VMW_RES_HT_ORDER 12 + ++ /** ++ * enum vmw_resource_relocation_type - Relocation type for resources ++ * ++ * @vmw_res_rel_normal: Traditional relocation. The resource id in the ++ * command stream is replaced with the actual id after validation. ++ * @vmw_res_rel_nop: NOP relocation. The command is unconditionally replaced ++ * with a NOP. ++ * @vmw_res_rel_cond_nop: Conditional NOP relocation. If the resource id ++ * after validation is -1, the command is replaced with a NOP. Otherwise no ++ * action. ++ */ ++enum vmw_resource_relocation_type { ++ vmw_res_rel_normal, ++ vmw_res_rel_nop, ++ vmw_res_rel_cond_nop, ++ vmw_res_rel_max ++}; ++ + /** + * struct vmw_resource_relocation - Relocation info for resources + * +@@ -41,11 +59,13 @@ + * @res: Non-ref-counted pointer to the resource. + * @offset: Offset of 4 byte entries into the command buffer where the + * id that needs fixup is located. ++ * @rel_type: Type of relocation. + */ + struct vmw_resource_relocation { + struct list_head head; + const struct vmw_resource *res; +- unsigned long offset; ++ u32 offset:29; ++ enum vmw_resource_relocation_type rel_type:3; + }; + + /** +@@ -410,10 +430,13 @@ static int vmw_resource_context_res_add( + * @res: The resource. + * @offset: Offset into the command buffer currently being parsed where the + * id that needs fixup is located. Granularity is 4 bytes. ++ * @rel_type: Relocation type. + */ + static int vmw_resource_relocation_add(struct list_head *list, + const struct vmw_resource *res, +- unsigned long offset) ++ unsigned long offset, ++ enum vmw_resource_relocation_type ++ rel_type) + { + struct vmw_resource_relocation *rel; + +@@ -425,6 +448,7 @@ static int vmw_resource_relocation_add(s + + rel->res = res; + rel->offset = offset; ++ rel->rel_type = rel_type; + list_add_tail(&rel->head, list); + + return 0; +@@ -459,11 +483,23 @@ static void vmw_resource_relocations_app + { + struct vmw_resource_relocation *rel; + ++ /* Validate the struct vmw_resource_relocation member size */ ++ BUILD_BUG_ON(SVGA_CB_MAX_SIZE >= (1 << 29)); ++ BUILD_BUG_ON(vmw_res_rel_max >= (1 << 3)); ++ + list_for_each_entry(rel, list, head) { +- if (likely(rel->res != NULL)) ++ switch (rel->rel_type) { ++ case vmw_res_rel_normal: + cb[rel->offset] = rel->res->id; +- else ++ break; ++ case vmw_res_rel_nop: + cb[rel->offset] = SVGA_3D_CMD_NOP; ++ break; ++ default: ++ if (rel->res->id == -1) ++ cb[rel->offset] = SVGA_3D_CMD_NOP; ++ break; ++ } + } + } + +@@ -655,7 +691,8 @@ static int vmw_cmd_res_reloc_add(struct + *p_val = NULL; + ret = vmw_resource_relocation_add(&sw_context->res_relocations, + res, +- id_loc - sw_context->buf_start); ++ id_loc - sw_context->buf_start, ++ vmw_res_rel_normal); + if (unlikely(ret != 0)) + return ret; + +@@ -721,7 +758,8 @@ vmw_cmd_res_check(struct vmw_private *de + + return vmw_resource_relocation_add + (&sw_context->res_relocations, res, +- id_loc - sw_context->buf_start); ++ id_loc - sw_context->buf_start, ++ vmw_res_rel_normal); + } + + ret = vmw_user_resource_lookup_handle(dev_priv, +@@ -2144,7 +2182,8 @@ static int vmw_cmd_shader_define(struct + + return vmw_resource_relocation_add(&sw_context->res_relocations, + NULL, &cmd->header.id - +- sw_context->buf_start); ++ sw_context->buf_start, ++ vmw_res_rel_nop); + + return 0; + } +@@ -2189,7 +2228,8 @@ static int vmw_cmd_shader_destroy(struct + + return vmw_resource_relocation_add(&sw_context->res_relocations, + NULL, &cmd->header.id - +- sw_context->buf_start); ++ sw_context->buf_start, ++ vmw_res_rel_nop); + + return 0; + } +@@ -2848,8 +2888,7 @@ static int vmw_cmd_dx_cid_check(struct v + * @header: Pointer to the command header in the command stream. + * + * Check that the view exists, and if it was not created using this +- * command batch, make sure it's validated (present in the device) so that +- * the remove command will not confuse the device. ++ * command batch, conditionally make this command a NOP. + */ + static int vmw_cmd_dx_view_remove(struct vmw_private *dev_priv, + struct vmw_sw_context *sw_context, +@@ -2877,10 +2916,15 @@ static int vmw_cmd_dx_view_remove(struct + return ret; + + /* +- * Add view to the validate list iff it was not created using this +- * command batch. ++ * If the view wasn't created during this command batch, it might ++ * have been removed due to a context swapout, so add a ++ * relocation to conditionally make this command a NOP to avoid ++ * device errors. + */ +- return vmw_view_res_val_add(sw_context, view); ++ return vmw_resource_relocation_add(&sw_context->res_relocations, ++ view, ++ &cmd->header.id - sw_context->buf_start, ++ vmw_res_rel_cond_nop); + } + + /** diff --git a/queue-4.8/iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch b/queue-4.8/iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch new file mode 100644 index 00000000000..04ab465341f --- /dev/null +++ b/queue-4.8/iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch @@ -0,0 +1,47 @@ +From a6c934b364948cd4de5bd9ab055bb65206ec70f3 Mon Sep 17 00:00:00 2001 +From: Haim Dreyfuss +Date: Tue, 2 Aug 2016 15:28:23 +0300 +Subject: iwlwifi: check for valid ethernet address provided by OEM + +From: Haim Dreyfuss + +commit a6c934b364948cd4de5bd9ab055bb65206ec70f3 upstream. + +In 9000 family products we added an option to let the OEM fuse the +mac address via registers. If these registers are zeroed we use the OTP +address instead. Make sure that the address provided by the OEM is valid +and, if not, fall back to the OTP address as well. + +Fixes: commit 17c867bfe89b ("iwlwifi: add support for getting HW address from CSR") +Signed-off-by: Haim Dreyfuss +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +@@ -564,11 +564,16 @@ static void iwl_set_hw_address_from_csr( + __le32 mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_STRAP)); + __le32 mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_STRAP)); + +- /* If OEM did not fuse address - get it from OTP */ +- if (!mac_addr0 && !mac_addr1) { +- mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP)); +- mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP)); +- } ++ iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr); ++ /* ++ * If the OEM fused a valid address, use it instead of the one in the ++ * OTP ++ */ ++ if (is_valid_ether_addr(data->hw_addr)) ++ return; ++ ++ mac_addr0 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR0_OTP)); ++ mac_addr1 = cpu_to_le32(iwl_read32(trans, CSR_MAC_ADDR1_OTP)); + + iwl_flip_hw_address(mac_addr0, mac_addr1, data->hw_addr); + } diff --git a/queue-4.8/iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch b/queue-4.8/iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch new file mode 100644 index 00000000000..da1903de202 --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch @@ -0,0 +1,38 @@ +From 75cfe338b8a6fadaa28879a969047554701a7589 Mon Sep 17 00:00:00 2001 +From: Luca Coelho +Date: Wed, 14 Sep 2016 11:54:36 +0300 +Subject: iwlwifi: mvm: bail out if CTDP start operation fails + +From: Luca Coelho + +commit 75cfe338b8a6fadaa28879a969047554701a7589 upstream. + +We were assigning the return value of iwl_mvm_ctdp_command() to a +variable, but never checking it. If this command fails, we should not +allow the interface up process to proceed, since it is potentially +dangerous to ignore thermal management requirements. + +Fixes: commit 5c89e7bc557e ("iwlwifi: mvm: add registration to cooling device") +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1214,9 +1214,12 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + } + + /* TODO: read the budget from BIOS / Platform NVM */ +- if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0) ++ if (iwl_mvm_is_ctdp_supported(mvm) && mvm->cooling_dev.cur_state > 0) { + ret = iwl_mvm_ctdp_command(mvm, CTDP_CMD_OPERATION_START, + mvm->cooling_dev.cur_state); ++ if (ret) ++ goto error; ++ } + #else + /* Initialize tx backoffs to the minimal possible */ + iwl_mvm_tt_tx_backoff(mvm, 0); diff --git a/queue-4.8/iwlwifi-mvm-call-a-different-txq_enable-function.patch b/queue-4.8/iwlwifi-mvm-call-a-different-txq_enable-function.patch new file mode 100644 index 00000000000..ac6e54b14b4 --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-call-a-different-txq_enable-function.patch @@ -0,0 +1,42 @@ +From ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Thu, 30 Jun 2016 16:14:02 +0300 +Subject: iwlwifi: mvm: call a different txq_enable function + +From: Sara Sharon + +commit ca3b9c6b6d4db9a8ba5fc8b95664e75468c59f9f upstream. + +Since the SCD_QUEUE_CFG command was introduced the driver +calls iwl_trans_txq_enable_cfg() with a NULL for scd_cfg +parameter. +This makes the transport avoid writing to the SCD pointers, +since it can cause races with firmware, which is also accessing +the registers. +The transport only updates the write pointer in that case. +Fix a wrong call to iwl_trans_txq_enable() which caused a +scd_cfg parameter to be sent to transport, resulting with an +access to SCD registers. + +Fixes: 58f2cc57dc6a ("iwlwifi: mvm: support dqa-mode scd queue redirection") +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -576,9 +576,7 @@ static int iwl_mvm_scd_queue_redirect(st + ret); + + /* Make sure the SCD wrptr is correctly set before reconfiguring */ +- iwl_trans_txq_enable(mvm->trans, queue, iwl_mvm_ac_to_tx_fifo[ac], +- cmd.sta_id, tid, LINK_QUAL_AGG_FRAME_LIMIT_DEF, +- ssn, wdg_timeout); ++ iwl_trans_txq_enable_cfg(mvm->trans, queue, ssn, NULL, wdg_timeout); + + /* TODO: Work-around SCD bug when moving back by multiples of 0x40 */ + diff --git a/queue-4.8/iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch b/queue-4.8/iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch new file mode 100644 index 00000000000..0d4ec2b6d3d --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch @@ -0,0 +1,34 @@ +From 341d7eb8223bdd48bdf75729487a2de5e01623b3 Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Thu, 18 Aug 2016 20:14:38 +0300 +Subject: iwlwifi: mvm: disable P2P queue on mac context release + +From: Sara Sharon + +commit 341d7eb8223bdd48bdf75729487a2de5e01623b3 upstream. + +AP queue is properly released, but P2P queue isn't. + +Fixes: commit 4c965139a3cd ("iwlwifi: mvm: support p2p device frames tx on dqa queue #2") +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -539,6 +539,11 @@ void iwl_mvm_mac_ctxt_release(struct iwl + iwl_mvm_disable_txq(mvm, IWL_MVM_OFFCHANNEL_QUEUE, + IWL_MVM_OFFCHANNEL_QUEUE, + IWL_MAX_TID_COUNT, 0); ++ else ++ iwl_mvm_disable_txq(mvm, ++ IWL_MVM_DQA_P2P_DEVICE_QUEUE, ++ vif->hw_queue[0], IWL_MAX_TID_COUNT, ++ 0); + + break; + case NL80211_IFTYPE_AP: diff --git a/queue-4.8/iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch b/queue-4.8/iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch new file mode 100644 index 00000000000..d7aa5459362 --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch @@ -0,0 +1,44 @@ +From 7585c354637bb003ce612dd22f5047c015545ef4 Mon Sep 17 00:00:00 2001 +From: Liad Kaufman +Date: Thu, 7 Jul 2016 11:00:26 +0300 +Subject: iwlwifi: mvm: fix pending frames tracking on tx resp + +From: Liad Kaufman + +commit 7585c354637bb003ce612dd22f5047c015545ef4 upstream. + +In iwl_mvm_rx_tx_cmd_single(), when checking if a given TID is +aggregated, the driver doesn't check whether or not the queue +itself can be aggregated. For example, a management queue might +be marked as aggregated if TID 0 is aggregated on a (different) +data queue. + +Make sure that mgmt frames are sent with TID IWL_TID_NON_QOS, +and in this way make sure no mixups of this sort happen. + +Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") +Signed-off-by: Liad Kaufman +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -903,9 +903,13 @@ static int iwl_mvm_tx_mpdu(struct iwl_mv + tid = IWL_MAX_TID_COUNT; + } + +- if (iwl_mvm_is_dqa_supported(mvm)) ++ if (iwl_mvm_is_dqa_supported(mvm)) { + txq_id = mvmsta->tid_data[tid].txq_id; + ++ if (ieee80211_is_mgmt(fc)) ++ tx_cmd->tid_tspec = IWL_TID_NON_QOS; ++ } ++ + /* Copy MAC header from skb into command buffer */ + memcpy(tx_cmd->hdr, hdr, hdrlen); + diff --git a/queue-4.8/iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch b/queue-4.8/iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch new file mode 100644 index 00000000000..807980fd5ce --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch @@ -0,0 +1,60 @@ +From a0315dea9091d1ebc1534f6129b3fc9942b8ca99 Mon Sep 17 00:00:00 2001 +From: Liad Kaufman +Date: Thu, 7 Jul 2016 13:25:59 +0300 +Subject: iwlwifi: mvm: free reserved queue on STA removal + +From: Liad Kaufman + +commit a0315dea9091d1ebc1534f6129b3fc9942b8ca99 upstream. + +When a STA is removed in DQA mode, if no traffic went through +its reserved queue, the txq continues to be marked as +reserved and no STA can use it. + +Make sure that in such a case the reserved queue is marked +as free when the STA is removed. + +Fixes: commit 24afba7690e4 ("iwlwifi: mvm: support bss dynamic alloc/dealloc of queues") +Signed-off-by: Liad Kaufman +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1268,9 +1268,31 @@ int iwl_mvm_rm_sta(struct iwl_mvm *mvm, + ret = iwl_mvm_drain_sta(mvm, mvm_sta, false); + + /* If DQA is supported - the queues can be disabled now */ +- if (iwl_mvm_is_dqa_supported(mvm)) ++ if (iwl_mvm_is_dqa_supported(mvm)) { ++ u8 reserved_txq = mvm_sta->reserved_queue; ++ enum iwl_mvm_queue_status *status; ++ + iwl_mvm_disable_sta_queues(mvm, vif, mvm_sta); + ++ /* ++ * If no traffic has gone through the reserved TXQ - it ++ * is still marked as IWL_MVM_QUEUE_RESERVED, and ++ * should be manually marked as free again ++ */ ++ spin_lock_bh(&mvm->queue_info_lock); ++ status = &mvm->queue_info[reserved_txq].status; ++ if (WARN((*status != IWL_MVM_QUEUE_RESERVED) && ++ (*status != IWL_MVM_QUEUE_FREE), ++ "sta_id %d reserved txq %d status %d", ++ mvm_sta->sta_id, reserved_txq, *status)) { ++ spin_unlock_bh(&mvm->queue_info_lock); ++ return -EINVAL; ++ } ++ ++ *status = IWL_MVM_QUEUE_FREE; ++ spin_unlock_bh(&mvm->queue_info_lock); ++ } ++ + if (vif->type == NL80211_IFTYPE_STATION && + mvmvif->ap_sta_id == mvm_sta->sta_id) { + /* if associated - we can't remove the AP STA now */ diff --git a/queue-4.8/iwlwifi-mvm-support-bar-in-reorder-buffer.patch b/queue-4.8/iwlwifi-mvm-support-bar-in-reorder-buffer.patch new file mode 100644 index 00000000000..6a41fdf97bd --- /dev/null +++ b/queue-4.8/iwlwifi-mvm-support-bar-in-reorder-buffer.patch @@ -0,0 +1,51 @@ +From 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 Mon Sep 17 00:00:00 2001 +From: Sara Sharon +Date: Mon, 8 Aug 2016 13:07:01 +0300 +Subject: iwlwifi: mvm: support BAR in reorder buffer + +From: Sara Sharon + +commit 9a73a7d24d51eaf9e43c771c53cf7b594e5b5334 upstream. + +On default queue we will not receive frame release notification, +but the BAR itself. +Upon receiving the BAR driver should look at the NSSN and adjust +window accordingly. + +Fixes: b915c10174fb ("iwlwifi: mvm: add reorder buffer per queue") +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -598,9 +598,10 @@ static bool iwl_mvm_reorder(struct iwl_m + + mvm_sta = iwl_mvm_sta_from_mac80211(sta); + +- /* not a data packet */ +- if (!ieee80211_is_data_qos(hdr->frame_control) || +- is_multicast_ether_addr(hdr->addr1)) ++ /* not a data packet or a bar */ ++ if (!ieee80211_is_back_req(hdr->frame_control) && ++ (!ieee80211_is_data_qos(hdr->frame_control) || ++ is_multicast_ether_addr(hdr->addr1))) + return false; + + if (unlikely(!ieee80211_is_data_present(hdr->frame_control))) +@@ -624,6 +625,11 @@ static bool iwl_mvm_reorder(struct iwl_m + + spin_lock_bh(&buffer->lock); + ++ if (ieee80211_is_back_req(hdr->frame_control)) { ++ iwl_mvm_release_frames(mvm, sta, napi, buffer, nssn); ++ goto drop; ++ } ++ + /* + * If there was a significant jump in the nssn - adjust. + * If the SN is smaller than the NSSN it might need to first go into diff --git a/queue-4.8/libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch b/queue-4.8/libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch new file mode 100644 index 00000000000..3670829f529 --- /dev/null +++ b/queue-4.8/libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch @@ -0,0 +1,165 @@ +From e046114af5fcafe8d6d3f0b6ccb99804bad34bfb Mon Sep 17 00:00:00 2001 +From: Vishal Verma +Date: Fri, 30 Sep 2016 17:19:31 -0600 +Subject: libnvdimm: clear the internal poison_list when clearing badblocks + +From: Vishal Verma + +commit e046114af5fcafe8d6d3f0b6ccb99804bad34bfb upstream. + +nvdimm_clear_poison cleared the user-visible badblocks, and sent +commands to the NVDIMM to clear the areas marked as 'poison', but it +neglected to clear the same areas from the internal poison_list which is +used to marshal ARS results before sorting them by namespace. As a +result, once on-demand ARS functionality was added: + +37b137f nfit, libnvdimm: allow an ARS scrub to be triggered on demand + +A scrub triggered from either sysfs or an MCE was found to be adding +stale entries that had been cleared from gendisk->badblocks, but were +still present in nvdimm_bus->poison_list. Additionally, the stale entries +could be triggered into producing stale disk->badblocks by simply disabling +and re-enabling the namespace or region. + +This adds the missing step of clearing poison_list entries when clearing +poison, so that it is always in sync with badblocks. + +Fixes: 37b137f ("nfit, libnvdimm: allow an ARS scrub to be triggered on demand") +Signed-off-by: Vishal Verma +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvdimm/bus.c | 2 + + drivers/nvdimm/core.c | 73 +++++++++++++++++++++++++++++++++++++++++++--- + include/linux/libnvdimm.h | 2 + + 3 files changed, 73 insertions(+), 4 deletions(-) + +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -217,6 +217,8 @@ long nvdimm_clear_poison(struct device * + return rc; + if (cmd_rc < 0) + return cmd_rc; ++ ++ nvdimm_clear_from_poison_list(nvdimm_bus, phys, len); + return clear_err.cleared; + } + EXPORT_SYMBOL_GPL(nvdimm_clear_poison); +--- a/drivers/nvdimm/core.c ++++ b/drivers/nvdimm/core.c +@@ -547,11 +547,12 @@ void nvdimm_badblocks_populate(struct nd + } + EXPORT_SYMBOL_GPL(nvdimm_badblocks_populate); + +-static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length) ++static int add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length, ++ gfp_t flags) + { + struct nd_poison *pl; + +- pl = kzalloc(sizeof(*pl), GFP_KERNEL); ++ pl = kzalloc(sizeof(*pl), flags); + if (!pl) + return -ENOMEM; + +@@ -567,7 +568,7 @@ static int bus_add_poison(struct nvdimm_ + struct nd_poison *pl; + + if (list_empty(&nvdimm_bus->poison_list)) +- return add_poison(nvdimm_bus, addr, length); ++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL); + + /* + * There is a chance this is a duplicate, check for those first. +@@ -587,7 +588,7 @@ static int bus_add_poison(struct nvdimm_ + * as any overlapping ranges will get resolved when the list is consumed + * and converted to badblocks + */ +- return add_poison(nvdimm_bus, addr, length); ++ return add_poison(nvdimm_bus, addr, length, GFP_KERNEL); + } + + int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length) +@@ -602,6 +603,70 @@ int nvdimm_bus_add_poison(struct nvdimm_ + } + EXPORT_SYMBOL_GPL(nvdimm_bus_add_poison); + ++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus, ++ phys_addr_t start, unsigned int len) ++{ ++ struct list_head *poison_list = &nvdimm_bus->poison_list; ++ u64 clr_end = start + len - 1; ++ struct nd_poison *pl, *next; ++ ++ nvdimm_bus_lock(&nvdimm_bus->dev); ++ WARN_ON_ONCE(list_empty(poison_list)); ++ ++ /* ++ * [start, clr_end] is the poison interval being cleared. ++ * [pl->start, pl_end] is the poison_list entry we're comparing ++ * the above interval against. The poison list entry may need ++ * to be modified (update either start or length), deleted, or ++ * split into two based on the overlap characteristics ++ */ ++ ++ list_for_each_entry_safe(pl, next, poison_list, list) { ++ u64 pl_end = pl->start + pl->length - 1; ++ ++ /* Skip intervals with no intersection */ ++ if (pl_end < start) ++ continue; ++ if (pl->start > clr_end) ++ continue; ++ /* Delete completely overlapped poison entries */ ++ if ((pl->start >= start) && (pl_end <= clr_end)) { ++ list_del(&pl->list); ++ kfree(pl); ++ continue; ++ } ++ /* Adjust start point of partially cleared entries */ ++ if ((start <= pl->start) && (clr_end > pl->start)) { ++ pl->length -= clr_end - pl->start + 1; ++ pl->start = clr_end + 1; ++ continue; ++ } ++ /* Adjust pl->length for partial clearing at the tail end */ ++ if ((pl->start < start) && (pl_end <= clr_end)) { ++ /* pl->start remains the same */ ++ pl->length = start - pl->start; ++ continue; ++ } ++ /* ++ * If clearing in the middle of an entry, we split it into ++ * two by modifying the current entry to represent one half of ++ * the split, and adding a new entry for the second half. ++ */ ++ if ((pl->start < start) && (pl_end > clr_end)) { ++ u64 new_start = clr_end + 1; ++ u64 new_len = pl_end - new_start + 1; ++ ++ /* Add new entry covering the right half */ ++ add_poison(nvdimm_bus, new_start, new_len, GFP_NOIO); ++ /* Adjust this entry to cover the left half */ ++ pl->length = start - pl->start; ++ continue; ++ } ++ } ++ nvdimm_bus_unlock(&nvdimm_bus->dev); ++} ++EXPORT_SYMBOL_GPL(nvdimm_clear_from_poison_list); ++ + #ifdef CONFIG_BLK_DEV_INTEGRITY + int nd_integrity_init(struct gendisk *disk, unsigned long meta_size) + { +--- a/include/linux/libnvdimm.h ++++ b/include/linux/libnvdimm.h +@@ -129,6 +129,8 @@ static inline struct nd_blk_region_desc + } + + int nvdimm_bus_add_poison(struct nvdimm_bus *nvdimm_bus, u64 addr, u64 length); ++void nvdimm_clear_from_poison_list(struct nvdimm_bus *nvdimm_bus, ++ phys_addr_t start, unsigned int len); + struct nvdimm_bus *nvdimm_bus_register(struct device *parent, + struct nvdimm_bus_descriptor *nfit_desc); + void nvdimm_bus_unregister(struct nvdimm_bus *nvdimm_bus); diff --git a/queue-4.8/mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch b/queue-4.8/mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch new file mode 100644 index 00000000000..fb43ff87bef --- /dev/null +++ b/queue-4.8/mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch @@ -0,0 +1,37 @@ +From 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f Mon Sep 17 00:00:00 2001 +From: Johannes Thumshirn +Date: Wed, 3 Aug 2016 15:00:18 +0200 +Subject: mpt3sas: Don't spam logs if logging level is 0 + +From: Johannes Thumshirn + +commit 0d667f72b2a20bbac72bec0ab11467fc70bb0f1f upstream. + +In _scsih_io_done() we test if the ioc->logging_level does _not_ have +the MPT_DEBUG_REPLY bit set and if it hasn't we print the debug +messages. This unfortunately is the wrong way around. + +Note, the actual bug is older than af0094115 but this commit removed the +CONFIG_SCSI_MPT3SAS_LOGGING Kconfig option which hid the bug. + +Fixes: af0094115 'mpt2sas, mpt3sas: Remove SCSI_MPTXSAS_LOGGING entry from Kconfig' +Signed-off-by: Johannes Thumshirn +Acked-by: Chaitra P B +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -4701,7 +4701,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *i + le16_to_cpu(mpi_reply->DevHandle)); + mpt3sas_trigger_scsi(ioc, data.skey, data.asc, data.ascq); + +- if (!(ioc->logging_level & MPT_DEBUG_REPLY) && ++ if ((ioc->logging_level & MPT_DEBUG_REPLY) && + ((scmd->sense_buffer[2] == UNIT_ATTENTION) || + (scmd->sense_buffer[2] == MEDIUM_ERROR) || + (scmd->sense_buffer[2] == HARDWARE_ERROR))) diff --git a/queue-4.8/pci-aardvark-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-aardvark-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..07dffe5a94b --- /dev/null +++ b/queue-4.8/pci-aardvark-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,81 @@ +From db047f8a931275e50563dd79c3d62d977074959a Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:41 +0100 +Subject: PCI: aardvark: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit db047f8a931275e50563dd79c3d62d977074959a upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridge's memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI aardvark host bridge driver does not remove the PCI IO resource +from the host bridge resource windows if the pci_remap_iospace() call +fails; this is an actual bug in that the PCI host bridge would consider the +PCI IO resource valid (and possibly assign it to downstream devices) even +if the kernel was not able to map the PCI host bridge memory address +driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() +failures). + +Fix the PCI host bridge driver pci_remap_iospace() failure path, by +destroying the PCI host bridge PCI IO resources retrieved through firmware +when the pci_remap_iospace() function call fails, therefore preventing the +kernel from adding the respective PCI IO resource to the list of PCI host +bridge valid resources, fixing the issue. + +Fixes: 8c39d710363c ("PCI: aardvark: Add Aardvark PCI host controller driver") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Thomas Petazzoni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-aardvark.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -848,7 +848,7 @@ static int advk_pcie_parse_request_of_pc + int err, res_valid = 0; + struct device *dev = &pcie->pdev->dev; + struct device_node *np = dev->of_node; +- struct resource_entry *win; ++ struct resource_entry *win, *tmp; + resource_size_t iobase; + + INIT_LIST_HEAD(&pcie->resources); +@@ -862,7 +862,7 @@ static int advk_pcie_parse_request_of_pc + if (err) + goto out_release_res; + +- resource_list_for_each_entry(win, &pcie->resources) { ++ resource_list_for_each_entry_safe(win, tmp, &pcie->resources) { + struct resource *res = win->res; + + switch (resource_type(res)) { +@@ -874,9 +874,11 @@ static int advk_pcie_parse_request_of_pc + lower_32_bits(res->start), + OB_PCIE_IO); + err = pci_remap_iospace(res, iobase); +- if (err) ++ if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); ++ resource_list_destroy_entry(win); ++ } + break; + case IORESOURCE_MEM: + advk_pcie_set_ob_win(pcie, 0, diff --git a/queue-4.8/pci-designware-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-designware-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..1fbdf0e4bab --- /dev/null +++ b/queue-4.8/pci-designware-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,89 @@ +From bcd7b7186fcba434e7486648de85cf93a56c845c Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:42 +0100 +Subject: PCI: designware: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit bcd7b7186fcba434e7486648de85cf93a56c845c upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridges memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI designware host bridge driver does not remove the PCI IO resource +from the host bridge resource windows if the pci_remap_iospace() call +fails; this is an actual bug in that the PCI host bridge would consider the +PCI IO resource valid (and possibly assign it to downstream devices) even +if the kernel was not able to map the PCI host bridge memory address +driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() +failures). + +Fix the PCI host bridge driver pci_remap_iospace() failure path, by +destroying the PCI host bridge PCI IO resources retrieved through firmware +when the pci_remap_iospace() function call fails, therefore preventing the +kernel from adding the respective PCI IO resource to the list of PCI host +bridge valid resources, fixing the issue. + +Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Jingoo Han +CC: Pratyush Anand +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-designware.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +--- a/drivers/pci/host/pcie-designware.c ++++ b/drivers/pci/host/pcie-designware.c +@@ -436,7 +436,7 @@ int dw_pcie_host_init(struct pcie_port * + struct resource *cfg_res; + int i, ret; + LIST_HEAD(res); +- struct resource_entry *win; ++ struct resource_entry *win, *tmp; + + cfg_res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "config"); + if (cfg_res) { +@@ -457,17 +457,20 @@ int dw_pcie_host_init(struct pcie_port * + goto error; + + /* Get the I/O and memory ranges from DT */ +- resource_list_for_each_entry(win, &res) { ++ resource_list_for_each_entry_safe(win, tmp, &res) { + switch (resource_type(win->res)) { + case IORESOURCE_IO: +- pp->io = win->res; +- pp->io->name = "I/O"; +- pp->io_size = resource_size(pp->io); +- pp->io_bus_addr = pp->io->start - win->offset; +- ret = pci_remap_iospace(pp->io, pp->io_base); +- if (ret) ++ ret = pci_remap_iospace(win->res, pp->io_base); ++ if (ret) { + dev_warn(pp->dev, "error %d: failed to map resource %pR\n", +- ret, pp->io); ++ ret, win->res); ++ resource_list_destroy_entry(win); ++ } else { ++ pp->io = win->res; ++ pp->io->name = "I/O"; ++ pp->io_size = resource_size(pp->io); ++ pp->io_bus_addr = pp->io->start - win->offset; ++ } + break; + case IORESOURCE_MEM: + pp->mem = win->res; diff --git a/queue-4.8/pci-generic-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-generic-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..3e6bb6e794a --- /dev/null +++ b/queue-4.8/pci-generic-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,78 @@ +From 43281ede019ede33fd0c40a14a86b304a51e4555 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:45 +0100 +Subject: PCI: generic: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit 43281ede019ede33fd0c40a14a86b304a51e4555 upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridges memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI common host bridge driver does not remove the PCI IO resource from +the host bridge resource windows if the pci_remap_iospace() call fails; +this is an actual bug in that the PCI host bridge would consider the PCI IO +resource valid (and possibly assign it to downstream devices) even if the +kernel was not able to map the PCI host bridge memory address driving IO +cycle to the CPU virtual address space (ie pci_remap_iospace() failures). + +Fix the PCI host bridge driver pci_remap_iospace() failure path, by +destroying the PCI host bridge PCI IO resources retrieved through firmware +when the pci_remap_iospace() function call fails, therefore preventing the +kernel from adding the respective PCI IO resource to the list of PCI host +bridge valid resources, fixing the issue. + +Fixes: 4e64dbe226e7 ("PCI: generic: Expose pci_host_common_probe() for use by other drivers") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Acked-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-host-common.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pci-host-common.c ++++ b/drivers/pci/host/pci-host-common.c +@@ -29,7 +29,7 @@ static int gen_pci_parse_request_of_pci_ + int err, res_valid = 0; + struct device_node *np = dev->of_node; + resource_size_t iobase; +- struct resource_entry *win; ++ struct resource_entry *win, *tmp; + + err = of_pci_get_host_bridge_resources(np, 0, 0xff, resources, &iobase); + if (err) +@@ -39,15 +39,17 @@ static int gen_pci_parse_request_of_pci_ + if (err) + return err; + +- resource_list_for_each_entry(win, resources) { ++ resource_list_for_each_entry_safe(win, tmp, resources) { + struct resource *res = win->res; + + switch (resource_type(res)) { + case IORESOURCE_IO: + err = pci_remap_iospace(res, iobase); +- if (err) ++ if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); ++ resource_list_destroy_entry(win); ++ } + break; + case IORESOURCE_MEM: + res_valid |= !(res->flags & IORESOURCE_PREFETCH); diff --git a/queue-4.8/pci-rcar-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-rcar-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..f8024a00dc9 --- /dev/null +++ b/queue-4.8/pci-rcar-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,79 @@ +From 5e8c873270cc618e3326eb6a47437b517ef85c52 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:44 +0100 +Subject: PCI: rcar: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit 5e8c873270cc618e3326eb6a47437b517ef85c52 upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridges memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI rcar host bridge driver does not remove the PCI IO resource from +the host bridge resource windows if the pci_remap_iospace() call fails; +this is an actual bug in that the PCI host bridge would consider the PCI IO +resource valid (and possibly assign it to downstream devices) even if the +kernel was not able to map the PCI host bridge memory address driving IO +cycle to the CPU virtual address space (ie pci_remap_iospace() failures). + +Fix the PCI host bridge driver pci_remap_iospace() failure path, by +destroying the PCI host bridge PCI IO resources retrieved through firmware +when the pci_remap_iospace() function call fails, therefore preventing the +kernel from adding the respective PCI IO resource to the list of PCI host +bridge valid resources, fixing the issue. + +Fixes: 5d2917d469fa ("PCI: rcar: Convert to DT resource parsing API") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Phil Edworthy +CC: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pcie-rcar.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pcie-rcar.c ++++ b/drivers/pci/host/pcie-rcar.c +@@ -945,7 +945,7 @@ static int rcar_pcie_parse_request_of_pc + struct device *dev = pci->dev; + struct device_node *np = dev->of_node; + resource_size_t iobase; +- struct resource_entry *win; ++ struct resource_entry *win, *tmp; + + err = of_pci_get_host_bridge_resources(np, 0, 0xff, &pci->resources, &iobase); + if (err) +@@ -955,14 +955,17 @@ static int rcar_pcie_parse_request_of_pc + if (err) + goto out_release_res; + +- resource_list_for_each_entry(win, &pci->resources) { ++ resource_list_for_each_entry_safe(win, tmp, &pci->resources) { + struct resource *res = win->res; + + if (resource_type(res) == IORESOURCE_IO) { + err = pci_remap_iospace(res, iobase); +- if (err) ++ if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); ++ ++ resource_list_destroy_entry(win); ++ } + } + } + diff --git a/queue-4.8/pci-tegra-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-tegra-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..629c6d76edc --- /dev/null +++ b/queue-4.8/pci-tegra-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,70 @@ +From 13f392ebc37e31568fae72a73ee378ae22a9740f Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:46 +0100 +Subject: PCI: tegra: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit 13f392ebc37e31568fae72a73ee378ae22a9740f upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridges memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI tegra host bridge driver adds the PCI IO resource retrieved from +firmware to the host bridge resource windows even if the +pci_remap_iospace() call fails; this is an actual bug in that the PCI host +bridge would consider the PCI IO resource valid (and possibly assign it to +downstream devices) even if the kernel was not able to map the PCI host +bridge memory address driving IO cycle to the CPU virtual address space (ie +pci_remap_iospace() failures). + +Add the PCI host bridge driver pci_remap_iospace() failure path and do not +add the corresponding PCI host bridge PCI IO resources retrieved through +firmware when the pci_remap_iospace() function call fails, fixing the +issue. + +Fixes: e6e9f471f5fe ("PCI: tegra: Use generic pci_remap_iospace() rather than ARM32-specific one") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Thierry Reding +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-tegra.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/pci/host/pci-tegra.c ++++ b/drivers/pci/host/pci-tegra.c +@@ -621,7 +621,11 @@ static int tegra_pcie_setup(int nr, stru + if (err < 0) + return err; + +- pci_add_resource_offset(&sys->resources, &pcie->pio, sys->io_offset); ++ err = pci_remap_iospace(&pcie->pio, pcie->io.start); ++ if (!err) ++ pci_add_resource_offset(&sys->resources, &pcie->pio, ++ sys->io_offset); ++ + pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset); + pci_add_resource_offset(&sys->resources, &pcie->prefetch, + sys->mem_offset); +@@ -631,7 +635,6 @@ static int tegra_pcie_setup(int nr, stru + if (err < 0) + return err; + +- pci_remap_iospace(&pcie->pio, pcie->io.start); + return 1; + } + diff --git a/queue-4.8/pci-versatile-fix-pci_remap_iospace-failure-path.patch b/queue-4.8/pci-versatile-fix-pci_remap_iospace-failure-path.patch new file mode 100644 index 00000000000..795dd617253 --- /dev/null +++ b/queue-4.8/pci-versatile-fix-pci_remap_iospace-failure-path.patch @@ -0,0 +1,79 @@ +From 53f4f7ee28076a36e427274d7d5c33b23dfc6221 Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Mon, 15 Aug 2016 17:50:43 +0100 +Subject: PCI: versatile: Fix pci_remap_iospace() failure path + +From: Lorenzo Pieralisi + +commit 53f4f7ee28076a36e427274d7d5c33b23dfc6221 upstream. + +On ARM/ARM64 architectures, PCI IO ports are emulated through memory mapped +IO, by reserving a chunk of virtual address space starting at PCI_IOBASE +and by mapping the PCI host bridges memory address space driving PCI IO +cycles to it. + +PCI host bridge drivers that enable downstream PCI IO cycles map the host +bridge memory address responding to PCI IO cycles to the fixed virtual +address space through the pci_remap_iospace() API. + +This means that if the pci_remap_iospace() function fails, the +corresponding host bridge PCI IO resource must be considered invalid, in +that there is no way for the kernel to actually drive PCI IO transactions +if the memory addresses responding to PCI IO cycles cannot be mapped into +the CPU virtual address space. + +The PCI versatile host bridge driver does not remove the PCI IO resource +from the host bridge resource windows if the pci_remap_iospace() call +fails; this is an actual bug in that the PCI host bridge would consider the +PCI IO resource valid (and possibly assign it to downstream devices) even +if the kernel was not able to map the PCI host bridge memory address +driving IO cycle to the CPU virtual address space (ie pci_remap_iospace() +failures). + +Fix the PCI host bridge driver pci_remap_iospace() failure path, by +destroying the PCI host bridge PCI IO resources retrieved through firmware +when the pci_remap_iospace() function call fails, therefore preventing the +kernel from adding the respective PCI IO resource to the list of PCI host +bridge valid resources, fixing the issue. + +Fixes: b7e78170efd4 ("PCI: versatile: Add DT-based ARM Versatile PB PCIe host driver") +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Rob Herring +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pci/host/pci-versatile.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/pci/host/pci-versatile.c ++++ b/drivers/pci/host/pci-versatile.c +@@ -74,7 +74,7 @@ static int versatile_pci_parse_request_o + int err, mem = 1, res_valid = 0; + struct device_node *np = dev->of_node; + resource_size_t iobase; +- struct resource_entry *win; ++ struct resource_entry *win, *tmp; + + err = of_pci_get_host_bridge_resources(np, 0, 0xff, res, &iobase); + if (err) +@@ -84,15 +84,17 @@ static int versatile_pci_parse_request_o + if (err) + goto out_release_res; + +- resource_list_for_each_entry(win, res) { ++ resource_list_for_each_entry_safe(win, tmp, res) { + struct resource *res = win->res; + + switch (resource_type(res)) { + case IORESOURCE_IO: + err = pci_remap_iospace(res, iobase); +- if (err) ++ if (err) { + dev_warn(dev, "error %d: failed to map resource %pR\n", + err, res); ++ resource_list_destroy_entry(win); ++ } + break; + case IORESOURCE_MEM: + res_valid |= !(res->flags & IORESOURCE_PREFETCH); diff --git a/queue-4.8/perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch b/queue-4.8/perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch new file mode 100644 index 00000000000..773876d7834 --- /dev/null +++ b/queue-4.8/perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch @@ -0,0 +1,42 @@ +From f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc Mon Sep 17 00:00:00 2001 +From: Wang Nan +Date: Wed, 28 Sep 2016 03:58:46 +0000 +Subject: perf data: Fix building in 32 bit platform with libbabeltrace + +From: Wang Nan + +commit f2c8852e6e990fcab0d9e68de9d86e5fbea0b5dc upstream. + +On ARM32 building it report following error when we build with +libbabeltrace: + + util/data-convert-bt.c: In function 'add_bpf_output_values': + util/data-convert-bt.c:440:3: error: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'unsigned int' [-Werror=format] + cc1: all warnings being treated as errors + +Fix it by changing %lu to %zu. + +Signed-off-by: Wang Nan +Cc: Jiri Olsa +Cc: Zefan Li +Cc: pi3orama@163.com +Fixes: 6122d57e9f7c ("perf data: Support converting data from bpf_perf_event_output()") +Link: http://lkml.kernel.org/r/1475035126-146587-1-git-send-email-wangnan0@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/data-convert-bt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/util/data-convert-bt.c ++++ b/tools/perf/util/data-convert-bt.c +@@ -437,7 +437,7 @@ add_bpf_output_values(struct bt_ctf_even + int ret; + + if (nr_elements * sizeof(u32) != raw_size) +- pr_warning("Incorrect raw_size (%u) in bpf output event, skip %lu bytes\n", ++ pr_warning("Incorrect raw_size (%u) in bpf output event, skip %zu bytes\n", + raw_size, nr_elements * sizeof(u32) - raw_size); + + len_type = bt_ctf_event_class_get_field_by_name(event_class, "raw_len"); diff --git a/queue-4.8/perf-hists-browser-fix-event-group-display.patch b/queue-4.8/perf-hists-browser-fix-event-group-display.patch new file mode 100644 index 00000000000..a3485a7a477 --- /dev/null +++ b/queue-4.8/perf-hists-browser-fix-event-group-display.patch @@ -0,0 +1,49 @@ +From d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Mon, 12 Sep 2016 15:19:52 +0900 +Subject: perf hists browser: Fix event group display + +From: Namhyung Kim + +commit d9ea48bc4e7cc297ca1073fa3f90ed80d964b7b4 upstream. + +Milian reported that the event group on TUI shows duplicated overhead. +This was due to a bug on calculating hpp->buf position. The +hpp_advance() was called from __hpp__slsmg_color_printf() on TUI but +it's already called from the hpp__call_print_fn macro in __hpp__fmt(). +The end result is that the print function returns number of bytes it +printed but the buffer advanced twice of the length. + +This is generally not a problem since it doesn't need to access the +buffer again. But with event group, overhead needs to be printed +multiple times and hist_entry__snprintf_alignment() tries to fill the +space with buffer after it printed. So it (brokenly) showed the last +overhead again. + +The bug was there from the beginning, but I think it's only revealed +when the alignment function was added. + +Reported-by: Milian Wolff +Signed-off-by: Namhyung Kim +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Peter Zijlstra +Fixes: 89fee7094323 ("perf hists: Do column alignment on the format iterator") +Link: http://lkml.kernel.org/r/20160912061958.16656-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/ui/browsers/hists.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -1091,7 +1091,6 @@ static int __hpp__slsmg_color_printf(str + ret = scnprintf(hpp->buf, hpp->size, fmt, len, percent); + ui_browser__printf(arg->b, "%s", hpp->buf); + +- advance_hpp(hpp, ret); + return ret; + } + diff --git a/queue-4.8/perf-powerpc-fix-build-test-failure.patch b/queue-4.8/perf-powerpc-fix-build-test-failure.patch new file mode 100644 index 00000000000..bfa1e8e0f59 --- /dev/null +++ b/queue-4.8/perf-powerpc-fix-build-test-failure.patch @@ -0,0 +1,59 @@ +From 25b8592e912f085ce2ff736a2927584ddeab238c Mon Sep 17 00:00:00 2001 +From: Ravi Bangoria +Date: Wed, 31 Aug 2016 13:33:11 +0530 +Subject: perf powerpc: Fix build-test failure + +From: Ravi Bangoria + +commit 25b8592e912f085ce2ff736a2927584ddeab238c upstream. + +'make -C tools/perf build-test' is failing with below log for poewrpc. + + In file included from /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf.h:15:0, + from util/cpumap.h:8, + from util/env.c:1: + /tmp/tmp.3eEwmGlYaF/perf-4.8.0-rc4/tools/perf/perf-sys.h:23:56: + fatal error: ../../arch/powerpc/include/uapi/asm/unistd.h: No such file or directory + compilation terminated. + +I bisected it and found it's failing from commit ad430729ae00 ("Remove: +kernel unistd*h files from perf's MANIFEST, not used"). + +Header file '../../arch/powerpc/include/uapi/asm/unistd.h' is included +only for powerpc in tools/perf/perf-sys.h. + +By looking closly at commit history, I found little weird thing: + +Commit f2d9cae9ea9e ("perf powerpc: Use uapi/unistd.h to fix build +error") replaced 'asm/unistd.h' with 'uapi/asm/unistd.h' + +Commit d2709c7ce4c5 ("perf: Make perf build for x86 with UAPI +disintegration applied") removes all arch specific 'uapi/asm/unistd.h' +for all archs and adds generic . + +Commit f0b9abfb0446 ("Merge branch 'linus' into perf/core") again +includes 'uapi/asm/unistd.h' for powerpc. Don't know how exactly this +happened as this change is not part of commit also. + +Signed-off-by: Ravi Bangoria +Cc: Alexander Shishkin +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1472630591-5089-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com +Fixes: ad430729ae00 ("Remove: kernel unistd*h files from perf's MANIFEST, not used") +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/perf-sys.h | 1 - + 1 file changed, 1 deletion(-) + +--- a/tools/perf/perf-sys.h ++++ b/tools/perf/perf-sys.h +@@ -20,7 +20,6 @@ + #endif + + #ifdef __powerpc__ +-#include "../../arch/powerpc/include/uapi/asm/unistd.h" + #define CPUINFO_PROC {"cpu"} + #endif + diff --git a/queue-4.8/perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch b/queue-4.8/perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch new file mode 100644 index 00000000000..8fc9871ee59 --- /dev/null +++ b/queue-4.8/perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch @@ -0,0 +1,54 @@ +From c97b40e4d15f13a36cd037d598e45cbe9e1e5757 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 1 Sep 2016 10:56:06 -0300 +Subject: perf symbols: Check symbol_conf.allow_aliases for kallsyms loading too + +From: Arnaldo Carvalho de Melo + +commit c97b40e4d15f13a36cd037d598e45cbe9e1e5757 upstream. + +We can allow aliases to be kept, but we were checking this just when +loading vmlinux files, be consistent, do it for any symbol table loading +code that calls symbol__fixup_duplicate() by making this function check +.allow_aliases instead. + +Cc: Adrian Hunter +Cc: David Ahern +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Cc: Wang Nan +Fixes: 680d926a8cb0 ("perf symbols: Allow symbol alias when loading map for symbol name") +Link: http://lkml.kernel.org/n/tip-z0avp0s6cfjckc4xj3pdfjdz@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/symbol-elf.c | 3 +-- + tools/perf/util/symbol.c | 3 +++ + 2 files changed, 4 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1113,8 +1113,7 @@ new_symbol: + * For misannotated, zeroed, ASM function sizes. + */ + if (nr > 0) { +- if (!symbol_conf.allow_aliases) +- symbols__fixup_duplicate(&dso->symbols[map->type]); ++ symbols__fixup_duplicate(&dso->symbols[map->type]); + symbols__fixup_end(&dso->symbols[map->type]); + if (kmap) { + /* +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -152,6 +152,9 @@ void symbols__fixup_duplicate(struct rb_ + struct rb_node *nd; + struct symbol *curr, *next; + ++ if (symbol_conf.allow_aliases) ++ return; ++ + nd = rb_first(symbols); + + while (nd) { diff --git a/queue-4.8/perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch b/queue-4.8/perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch new file mode 100644 index 00000000000..9d12f980fab --- /dev/null +++ b/queue-4.8/perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch @@ -0,0 +1,61 @@ +From 432746f8e0b6a82ba832b771afe31abd51af6752 Mon Sep 17 00:00:00 2001 +From: Arnaldo Carvalho de Melo +Date: Thu, 1 Sep 2016 11:00:23 -0300 +Subject: perf symbols: Fixup symbol sizes before picking best ones + +From: Arnaldo Carvalho de Melo + +commit 432746f8e0b6a82ba832b771afe31abd51af6752 upstream. + +When we call symbol__fixup_duplicate() we use algorithms to pick the +"best" symbols for cases where there are various functions/aliases to an +address, and those check zero size symbols, which, before calling +symbol__fixup_end() are _all_ symbols in a just parsed kallsyms file. + +So first fixup the end, then fixup the duplicates. + +Found while trying to figure out why 'perf test vmlinux' failed, see the +output of 'perf test -v vmlinux' to see cases where the symbols picked +as best for vmlinux don't match the ones picked for kallsyms. + +Cc: Anton Blanchard +Cc: Adrian Hunter +Cc: David Ahern +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Cc: Wang Nan +Fixes: 694bf407b061 ("perf symbols: Add some heuristics for choosing the best duplicate symbol") +Link: http://lkml.kernel.org/n/tip-rxqvdgr0mqjdxee0kf8i2ufn@git.kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/util/symbol-elf.c | 2 +- + tools/perf/util/symbol.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/tools/perf/util/symbol-elf.c ++++ b/tools/perf/util/symbol-elf.c +@@ -1113,8 +1113,8 @@ new_symbol: + * For misannotated, zeroed, ASM function sizes. + */ + if (nr > 0) { +- symbols__fixup_duplicate(&dso->symbols[map->type]); + symbols__fixup_end(&dso->symbols[map->type]); ++ symbols__fixup_duplicate(&dso->symbols[map->type]); + if (kmap) { + /* + * We need to fixup this here too because we create new +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -1237,8 +1237,8 @@ int __dso__load_kallsyms(struct dso *dso + if (kallsyms__delta(map, filename, &delta)) + return -1; + +- symbols__fixup_duplicate(&dso->symbols[map->type]); + symbols__fixup_end(&dso->symbols[map->type]); ++ symbols__fixup_duplicate(&dso->symbols[map->type]); + + if (dso->kernel == DSO_TYPE_GUEST_KERNEL) + dso->symtab_type = DSO_BINARY_TYPE__GUEST_KALLSYMS; diff --git a/queue-4.8/perf-ui-stdio-always-reset-output-width-for-hierarchy.patch b/queue-4.8/perf-ui-stdio-always-reset-output-width-for-hierarchy.patch new file mode 100644 index 00000000000..b0c8061f797 --- /dev/null +++ b/queue-4.8/perf-ui-stdio-always-reset-output-width-for-hierarchy.patch @@ -0,0 +1,79 @@ +From 9a6ad25b5a2026ba1399abc879ec623957867e79 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Tue, 13 Sep 2016 16:45:49 +0900 +Subject: perf ui/stdio: Always reset output width for hierarchy + +From: Namhyung Kim + +commit 9a6ad25b5a2026ba1399abc879ec623957867e79 upstream. + +When the --hierarchy option is used, each entry has its own hpp_list to +show the result. But it is not updating the width of each column for +perf-top. The perf-report command has no problem since it resets it +during header display. + + $ sudo perf top --hierarchy --stdio + + PerfTop: 160 irqs/sec kernel:38.8% exact: 100.0% + [4000Hz cycles:pp], (all, 12 CPUs) + ---------------------------------------------------------------------- + + 52.32% perf + 24.74% [.] __symbols__insert + 5.62% [.] rb_next + 5.14% [.] dso__load_sym + +Move the code into hists__fprintf() so that it can be called always. +Also it'd be better to put similar code together. + +Signed-off-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Peter Zijlstra +Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode") +Link: http://lkml.kernel.org/r/20160913074552.13284-5-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/ui/stdio/hist.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +--- a/tools/perf/ui/stdio/hist.c ++++ b/tools/perf/ui/stdio/hist.c +@@ -628,14 +628,6 @@ hists__fprintf_hierarchy_headers(struct + struct perf_hpp *hpp, + FILE *fp) + { +- struct perf_hpp_list_node *fmt_node; +- struct perf_hpp_fmt *fmt; +- +- list_for_each_entry(fmt_node, &hists->hpp_formats, list) { +- perf_hpp_list__for_each_format(&fmt_node->hpp, fmt) +- perf_hpp__reset_width(fmt, hists); +- } +- + return print_hierarchy_header(hists, hpp, symbol_conf.field_sep, fp); + } + +@@ -714,6 +706,7 @@ size_t hists__fprintf(struct hists *hist + bool use_callchain) + { + struct perf_hpp_fmt *fmt; ++ struct perf_hpp_list_node *node; + struct rb_node *nd; + size_t ret = 0; + const char *sep = symbol_conf.field_sep; +@@ -726,6 +719,11 @@ size_t hists__fprintf(struct hists *hist + + hists__for_each_format(hists, fmt) + perf_hpp__reset_width(fmt, hists); ++ /* hierarchy entries have their own hpp list */ ++ list_for_each_entry(node, &hists->hpp_formats, list) { ++ perf_hpp_list__for_each_format(&node->hpp, fmt) ++ perf_hpp__reset_width(fmt, hists); ++ } + + if (symbol_conf.col_width_list_str) + perf_hpp__set_user_width(symbol_conf.col_width_list_str); diff --git a/queue-4.8/perf-ui-tui-reset-output-width-for-hierarchy.patch b/queue-4.8/perf-ui-tui-reset-output-width-for-hierarchy.patch new file mode 100644 index 00000000000..bb9f5e3a098 --- /dev/null +++ b/queue-4.8/perf-ui-tui-reset-output-width-for-hierarchy.patch @@ -0,0 +1,110 @@ +From 5ff3e7a224d40f9dd73625b91377787034a8b35e Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Tue, 20 Sep 2016 14:30:23 +0900 +Subject: perf ui/tui: Reset output width for hierarchy +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Namhyung Kim + +commit 5ff3e7a224d40f9dd73625b91377787034a8b35e upstream. + +When --hierarchy option is used, each entry has its own hpp_list to show +the result. But it missed to update width of each column. + +Before: + + - 46.29% 48.12% netctl-auto + + 31.44% 29.25% [kernel.vmlinux] + + 8.52% 11.55% libc-2.22.so + + 5.19% 6.91% bash + + 10.75% 11.83% wpa_cli + + 8.25% 2.23% swapper + + 6.45% 5.40% tr + + 4.81% 8.09% awk + + 4.15% 2.85% firefox + + 3.86% 2.53% sh + +After: + + - 46.29% 48.12% netctl-auto + + 31.44% 29.25% [kernel.vmlinux] + + 8.52% 11.55% libc-2.22.so + + 5.19% 6.91% bash + + 10.75% 11.83% wpa_cli + + 8.25% 2.23% swapper + + 6.45% 5.40% tr + + 4.81% 8.09% awk + + 4.15% 2.85% firefox + + 3.86% 2.53% sh + +Committer note: + +Full testing instructions: + +1) Record with an event group: + + $ perf record -e '{cycles,instructions}' make -j4 + +2) Use report in hierarchy mode, to get a few expanded trees on + the same screen, use --percent-limit: + + $ perf report --hierarchy --percent-limit 0.5 + +Samples: 103K of event 'anon group { cycles:u, instructions:u }', +Event count (approx.): 57317631725 + Overhead Command / Shared Object / Symbol ◆ +- 58.89% 55.12% cc1 ▒ + - 50.26% 48.10% cc1 ▒ + 3.61% 5.13% [.] _cpp_lex_token ▒ + 2.58% 0.78% [.] ht_lookup_with_hash ▒ + 1.31% 1.30% [.] ggc_internal_alloc ▒ + 1.08% 2.25% [.] get_combined_adhoc_loc ▒ + 1.01% 1.95% [.] ira_init ▒ + 0.96% 1.78% [.] linemap_position_for_column ▒ + 0.65% 1.01% [.] cpp_get_token_with_location ▒ + - 7.52% 6.58% libc-2.23.so ▒ + 1.70% 1.78% [.] _int_malloc ▒ + 0.69% 0.75% [.] _int_free ▒ + 0.67% 0.42% [.] malloc_consolidate ▒ + - 0.58% 0.42% ld-2.23.so ▒ + no entry >= 0.50% ▒ + - 0.52% 0.03% [kernel.vmlinux] ▒ + no entry >= 0.50% ▒ + +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Andi Kleen +Cc: Peter Zijlstra +Fixes: 1b2dbbf41a0f ("perf hists: Use own hpp_list for hierarchy mode") +Link: http://lkml.kernel.org/r/20160920053025.13989-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman + +--- + tools/perf/ui/browsers/hists.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -2045,6 +2045,7 @@ void hist_browser__init(struct hist_brow + struct hists *hists) + { + struct perf_hpp_fmt *fmt; ++ struct perf_hpp_list_node *node; + + browser->hists = hists; + browser->b.refresh = hist_browser__refresh; +@@ -2057,6 +2058,11 @@ void hist_browser__init(struct hist_brow + perf_hpp__reset_width(fmt, hists); + ++browser->b.columns; + } ++ /* hierarchy entries have their own hpp list */ ++ list_for_each_entry(node, &hists->hpp_formats, list) { ++ perf_hpp_list__for_each_format(&node->hpp, fmt) ++ perf_hpp__reset_width(fmt, hists); ++ } + } + + struct hist_browser *hist_browser__new(struct hists *hists) diff --git a/queue-4.8/pinctrl-qcom-fix-masking-of-pinmux-functions.patch b/queue-4.8/pinctrl-qcom-fix-masking-of-pinmux-functions.patch new file mode 100644 index 00000000000..c9f01ab6ece --- /dev/null +++ b/queue-4.8/pinctrl-qcom-fix-masking-of-pinmux-functions.patch @@ -0,0 +1,34 @@ +From 6bcf3f63394b9c4f133e4499349d786d7f531473 Mon Sep 17 00:00:00 2001 +From: John Crispin +Date: Mon, 12 Sep 2016 11:36:55 +0200 +Subject: pinctrl: qcom: fix masking of pinmux functions + +From: John Crispin + +commit 6bcf3f63394b9c4f133e4499349d786d7f531473 upstream. + +The following commit introduced a regression by not properly masking the +calculated value. + +Fixes: 47a01ee9a6c3 ("pinctrl: qcom: Clear all function selection bits") +Signed-off-by: John Crispin +Reviewed-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -156,7 +156,7 @@ static int msm_pinmux_set_mux(struct pin + spin_lock_irqsave(&pctrl->lock, flags); + + val = readl(pctrl->regs + g->ctl_reg); +- val &= mask; ++ val &= ~mask; + val |= i << g->mux_bit; + writel(val, pctrl->regs + g->ctl_reg); + diff --git a/queue-4.8/powerpc-add-check_if_tm_restore_required-to-giveup_all.patch b/queue-4.8/powerpc-add-check_if_tm_restore_required-to-giveup_all.patch new file mode 100644 index 00000000000..e9139e2aaea --- /dev/null +++ b/queue-4.8/powerpc-add-check_if_tm_restore_required-to-giveup_all.patch @@ -0,0 +1,52 @@ +From b0f16b46988fde02a1e32078f66a3059d7e53bfc Mon Sep 17 00:00:00 2001 +From: Cyril Bur +Date: Fri, 23 Sep 2016 16:18:09 +1000 +Subject: powerpc: Add check_if_tm_restore_required() to giveup_all() + +From: Cyril Bur + +commit b0f16b46988fde02a1e32078f66a3059d7e53bfc upstream. + +giveup_all() causes FPU/VMX/VSX facilities to be disabled in a threads +MSR. If the thread performing the giveup was transactional, the kernel +must record which facilities were in use before the giveup as the +thread must have these facilities re-enabled on return to userspace. + +>From process.c: + /* + * This is called if we are on the way out to userspace and the + * TIF_RESTORE_TM flag is set. It checks if we need to reload + * FP and/or vector state and does so if necessary. + * If userspace is inside a transaction (whether active or + * suspended) and FP/VMX/VSX instructions have ever been enabled + * inside that transaction, then we have to keep them enabled + * and keep the FP/VMX/VSX state loaded while ever the transaction + * continues. The reason is that if we didn't, and subsequently + * got a FP/VMX/VSX unavailable interrupt inside a transaction, + * we don't know whether it's the same transaction, and thus we + * don't know which of the checkpointed state and the transactional + * state to use. + */ + +Calling check_if_tm_restore_required() will set TIF_RESTORE_TM and +save the MSR if needed. + +Fixes: c208505 ("powerpc: create giveup_all()") +Signed-off-by: Cyril Bur +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/process.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -445,6 +445,7 @@ void giveup_all(struct task_struct *tsk) + return; + + msr_check_and_set(msr_all_available); ++ check_if_tm_restore_required(tsk); + + #ifdef CONFIG_PPC_FPU + if (usermsr & MSR_FP) diff --git a/queue-4.8/powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch b/queue-4.8/powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch new file mode 100644 index 00000000000..be93698476d --- /dev/null +++ b/queue-4.8/powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch @@ -0,0 +1,99 @@ +From dc16b553c949e81f37555777dc7bab66d78285a7 Mon Sep 17 00:00:00 2001 +From: Cyril Bur +Date: Fri, 23 Sep 2016 16:18:08 +1000 +Subject: powerpc: Always restore FPU/VEC/VSX if hardware transactional memory in use + +From: Cyril Bur + +commit dc16b553c949e81f37555777dc7bab66d78285a7 upstream. + +Comment from arch/powerpc/kernel/process.c:967: + If userspace is inside a transaction (whether active or + suspended) and FP/VMX/VSX instructions have ever been enabled + inside that transaction, then we have to keep them enabled + and keep the FP/VMX/VSX state loaded while ever the transaction + continues. The reason is that if we didn't, and subsequently + got a FP/VMX/VSX unavailable interrupt inside a transaction, + we don't know whether it's the same transaction, and thus we + don't know which of the checkpointed state and the ransactional + state to use. + +restore_math() restore_fp() and restore_altivec() currently may not +restore the registers. It doesn't appear that this is more serious +than a performance penalty. If the math registers aren't restored the +userspace thread will still be run with the facility disabled. +Userspace will not be able to read invalid values. On the first access +it will take an facility unavailable exception and the kernel will +detected an active transaction, at which point it will abort the +transaction. There is the possibility for a pathological case +preventing any progress by transactions, however, transactions +are never guaranteed to make progress. + +Fixes: 70fe3d9 ("powerpc: Restore FPU/VEC/VSX if previously used") +Signed-off-by: Cyril Bur +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/process.c | 21 ++++++++++++++++++--- + 1 file changed, 18 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -88,7 +88,13 @@ static void check_if_tm_restore_required + set_thread_flag(TIF_RESTORE_TM); + } + } ++ ++static inline bool msr_tm_active(unsigned long msr) ++{ ++ return MSR_TM_ACTIVE(msr); ++} + #else ++static inline bool msr_tm_active(unsigned long msr) { return false; } + static inline void check_if_tm_restore_required(struct task_struct *tsk) { } + #endif /* CONFIG_PPC_TRANSACTIONAL_MEM */ + +@@ -208,7 +214,7 @@ void enable_kernel_fp(void) + EXPORT_SYMBOL(enable_kernel_fp); + + static int restore_fp(struct task_struct *tsk) { +- if (tsk->thread.load_fp) { ++ if (tsk->thread.load_fp || msr_tm_active(tsk->thread.regs->msr)) { + load_fp_state(¤t->thread.fp_state); + current->thread.load_fp++; + return 1; +@@ -278,7 +284,8 @@ EXPORT_SYMBOL_GPL(flush_altivec_to_threa + + static int restore_altivec(struct task_struct *tsk) + { +- if (cpu_has_feature(CPU_FTR_ALTIVEC) && tsk->thread.load_vec) { ++ if (cpu_has_feature(CPU_FTR_ALTIVEC) && ++ (tsk->thread.load_vec || msr_tm_active(tsk->thread.regs->msr))) { + load_vr_state(&tsk->thread.vr_state); + tsk->thread.used_vr = 1; + tsk->thread.load_vec++; +@@ -464,7 +471,8 @@ void restore_math(struct pt_regs *regs) + { + unsigned long msr; + +- if (!current->thread.load_fp && !loadvec(current->thread)) ++ if (!msr_tm_active(regs->msr) && ++ !current->thread.load_fp && !loadvec(current->thread)) + return; + + msr = regs->msr; +@@ -983,6 +991,13 @@ void restore_tm_state(struct pt_regs *re + msr_diff = current->thread.ckpt_regs.msr & ~regs->msr; + msr_diff &= MSR_FP | MSR_VEC | MSR_VSX; + ++ /* Ensure that restore_math() will restore */ ++ if (msr_diff & MSR_FP) ++ current->thread.load_fp = 1; ++#ifdef CONFIG_ALIVEC ++ if (cpu_has_feature(CPU_FTR_ALTIVEC) && msr_diff & MSR_VEC) ++ current->thread.load_vec = 1; ++#endif + restore_math(regs); + + regs->msr |= msr_diff; diff --git a/queue-4.8/powerpc-fix-usage-of-_page_ro-in-hugepage.patch b/queue-4.8/powerpc-fix-usage-of-_page_ro-in-hugepage.patch new file mode 100644 index 00000000000..5262ba791a3 --- /dev/null +++ b/queue-4.8/powerpc-fix-usage-of-_page_ro-in-hugepage.patch @@ -0,0 +1,56 @@ +From 6b8cb66a6a7cc182b47da6a0a1d4e5da324c0695 Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 19 Sep 2016 12:58:54 +0200 +Subject: powerpc: Fix usage of _PAGE_RO in hugepage + +From: Christophe Leroy + +commit 6b8cb66a6a7cc182b47da6a0a1d4e5da324c0695 upstream. + +On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined +as 0 and _PAGE_RO has to be set when a page is not writable + +_PAGE_RO is defined by default in pte-common.h, however BOOK3S/64 +doesn't include that file so _PAGE_RO has to be defined explicitly +in book3s/64/pgtable.h + +Fixes: a7b9f671f2d14 ("powerpc32: adds handling of _PAGE_RO") +Signed-off-by: Christophe Leroy +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/include/asm/book3s/64/pgtable.h | 2 ++ + arch/powerpc/mm/hugetlbpage.c | 7 +++++++ + 2 files changed, 9 insertions(+) + +--- a/arch/powerpc/include/asm/book3s/64/pgtable.h ++++ b/arch/powerpc/include/asm/book3s/64/pgtable.h +@@ -6,6 +6,8 @@ + */ + #define _PAGE_BIT_SWAP_TYPE 0 + ++#define _PAGE_RO 0 ++ + #define _PAGE_EXEC 0x00001 /* execute permission */ + #define _PAGE_WRITE 0x00002 /* write access allowed */ + #define _PAGE_READ 0x00004 /* read access allowed */ +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -1019,8 +1019,15 @@ int gup_hugepte(pte_t *ptep, unsigned lo + + pte = READ_ONCE(*ptep); + mask = _PAGE_PRESENT | _PAGE_READ; ++ ++ /* ++ * On some CPUs like the 8xx, _PAGE_RW hence _PAGE_WRITE is defined ++ * as 0 and _PAGE_RO has to be set when a page is not writable ++ */ + if (write) + mask |= _PAGE_WRITE; ++ else ++ mask |= _PAGE_RO; + + if ((pte_val(pte) & mask) != mask) + return 0; diff --git a/queue-4.8/powerpc-nvram-fix-an-incorrect-partition-merge.patch b/queue-4.8/powerpc-nvram-fix-an-incorrect-partition-merge.patch new file mode 100644 index 00000000000..3c2479f0f1e --- /dev/null +++ b/queue-4.8/powerpc-nvram-fix-an-incorrect-partition-merge.patch @@ -0,0 +1,47 @@ +From 11b7e154b132232535befe51c55db048069c8461 Mon Sep 17 00:00:00 2001 +From: Pan Xinhui +Date: Thu, 10 Dec 2015 15:30:02 +0800 +Subject: powerpc/nvram: Fix an incorrect partition merge + +From: Pan Xinhui + +commit 11b7e154b132232535befe51c55db048069c8461 upstream. + +When we merge two contiguous partitions whose signatures are marked +NVRAM_SIG_FREE, We need update prev's length and checksum, then write it +to nvram, not cur's. So lets fix this mistake now. + +Also use memset instead of strncpy to set the partition's name. It's +more readable if we want to fill up with duplicate chars . + +Fixes: fa2b4e54d41f ("powerpc/nvram: Improve partition removal") +Signed-off-by: Pan Xinhui +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/nvram_64.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/nvram_64.c ++++ b/arch/powerpc/kernel/nvram_64.c +@@ -956,7 +956,7 @@ int __init nvram_remove_partition(const + + /* Make partition a free partition */ + part->header.signature = NVRAM_SIG_FREE; +- strncpy(part->header.name, "wwwwwwwwwwww", 12); ++ memset(part->header.name, 'w', 12); + part->header.checksum = nvram_checksum(&part->header); + rc = nvram_write_header(part); + if (rc <= 0) { +@@ -974,8 +974,8 @@ int __init nvram_remove_partition(const + } + if (prev) { + prev->header.length += part->header.length; +- prev->header.checksum = nvram_checksum(&part->header); +- rc = nvram_write_header(part); ++ prev->header.checksum = nvram_checksum(&prev->header); ++ rc = nvram_write_header(prev); + if (rc <= 0) { + printk(KERN_ERR "nvram_remove_partition: nvram_write failed (%d)\n", rc); + return rc; diff --git a/queue-4.8/s390-cio-fix-accidental-interrupt-enabling-during-resume.patch b/queue-4.8/s390-cio-fix-accidental-interrupt-enabling-during-resume.patch new file mode 100644 index 00000000000..b20ffedcf48 --- /dev/null +++ b/queue-4.8/s390-cio-fix-accidental-interrupt-enabling-during-resume.patch @@ -0,0 +1,127 @@ +From d53c51f26145657aa7c55fa396f93677e613548d Mon Sep 17 00:00:00 2001 +From: Sebastian Ott +Date: Wed, 28 Sep 2016 13:36:19 +0200 +Subject: s390/cio: fix accidental interrupt enabling during resume + +From: Sebastian Ott + +commit d53c51f26145657aa7c55fa396f93677e613548d upstream. + +Since commit 9f3d6d7 chsc_get_channel_measurement_chars is called with +interrupts disabled during resume from hibernate. Since this function +used spin_unlock_irq, interrupts have been enabled accidentally. Fix +this by using the irqsave variant. + +Since we can't guarantee the IRQ-enablement state for all (future/ +external) callers, change the locking in related functions to prevent +similar bugs in the future. + +Fixes: 9f3d6d7 ("s390/cio: update measurement characteristics") +Signed-off-by: Sebastian Ott +Reviewed-by: Peter Oberparleiter +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/cio/chsc.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +--- a/drivers/s390/cio/chsc.c ++++ b/drivers/s390/cio/chsc.c +@@ -95,12 +95,13 @@ struct chsc_ssd_area { + int chsc_get_ssd_info(struct subchannel_id schid, struct chsc_ssd_info *ssd) + { + struct chsc_ssd_area *ssd_area; ++ unsigned long flags; + int ccode; + int ret; + int i; + int mask; + +- spin_lock_irq(&chsc_page_lock); ++ spin_lock_irqsave(&chsc_page_lock, flags); + memset(chsc_page, 0, PAGE_SIZE); + ssd_area = chsc_page; + ssd_area->request.length = 0x0010; +@@ -144,7 +145,7 @@ int chsc_get_ssd_info(struct subchannel_ + ssd->fla[i] = ssd_area->fla[i]; + } + out: +- spin_unlock_irq(&chsc_page_lock); ++ spin_unlock_irqrestore(&chsc_page_lock, flags); + return ret; + } + +@@ -832,9 +833,10 @@ int __chsc_do_secm(struct channel_subsys + u32 fmt : 4; + u32 : 16; + } __attribute__ ((packed)) *secm_area; ++ unsigned long flags; + int ret, ccode; + +- spin_lock_irq(&chsc_page_lock); ++ spin_lock_irqsave(&chsc_page_lock, flags); + memset(chsc_page, 0, PAGE_SIZE); + secm_area = chsc_page; + secm_area->request.length = 0x0050; +@@ -864,7 +866,7 @@ int __chsc_do_secm(struct channel_subsys + CIO_CRW_EVENT(2, "chsc: secm failed (rc=%04x)\n", + secm_area->response.code); + out: +- spin_unlock_irq(&chsc_page_lock); ++ spin_unlock_irqrestore(&chsc_page_lock, flags); + return ret; + } + +@@ -992,6 +994,7 @@ chsc_initialize_cmg_chars(struct channel + + int chsc_get_channel_measurement_chars(struct channel_path *chp) + { ++ unsigned long flags; + int ccode, ret; + + struct { +@@ -1021,7 +1024,7 @@ int chsc_get_channel_measurement_chars(s + if (!css_chsc_characteristics.scmc || !css_chsc_characteristics.secm) + return -EINVAL; + +- spin_lock_irq(&chsc_page_lock); ++ spin_lock_irqsave(&chsc_page_lock, flags); + memset(chsc_page, 0, PAGE_SIZE); + scmc_area = chsc_page; + scmc_area->request.length = 0x0010; +@@ -1053,7 +1056,7 @@ int chsc_get_channel_measurement_chars(s + chsc_initialize_cmg_chars(chp, scmc_area->cmcv, + (struct cmg_chars *) &scmc_area->data); + out: +- spin_unlock_irq(&chsc_page_lock); ++ spin_unlock_irqrestore(&chsc_page_lock, flags); + return ret; + } + +@@ -1134,6 +1137,7 @@ struct css_chsc_char css_chsc_characteri + int __init + chsc_determine_css_characteristics(void) + { ++ unsigned long flags; + int result; + struct { + struct chsc_header request; +@@ -1146,7 +1150,7 @@ chsc_determine_css_characteristics(void) + u32 chsc_char[508]; + } __attribute__ ((packed)) *scsc_area; + +- spin_lock_irq(&chsc_page_lock); ++ spin_lock_irqsave(&chsc_page_lock, flags); + memset(chsc_page, 0, PAGE_SIZE); + scsc_area = chsc_page; + scsc_area->request.length = 0x0010; +@@ -1168,7 +1172,7 @@ chsc_determine_css_characteristics(void) + CIO_CRW_EVENT(2, "chsc: scsc failed (rc=%04x)\n", + scsc_area->response.code); + exit: +- spin_unlock_irq(&chsc_page_lock); ++ spin_unlock_irqrestore(&chsc_page_lock, flags); + return result; + } + diff --git a/queue-4.8/s390-con3270-fix-insufficient-space-padding.patch b/queue-4.8/s390-con3270-fix-insufficient-space-padding.patch new file mode 100644 index 00000000000..9235898f1c5 --- /dev/null +++ b/queue-4.8/s390-con3270-fix-insufficient-space-padding.patch @@ -0,0 +1,61 @@ +From 6cd997db911f28f2510b771691270c52b63ed2e6 Mon Sep 17 00:00:00 2001 +From: Sascha Silbe +Date: Tue, 20 Sep 2016 19:09:07 +0200 +Subject: s390/con3270: fix insufficient space padding + +From: Sascha Silbe + +commit 6cd997db911f28f2510b771691270c52b63ed2e6 upstream. + +con3270 contains an optimisation that reduces the amount of data to be +transmitted to the 3270 terminal by putting a Repeat to Address (RA) +order into the data stream. The RA order itself takes up space, so +con3270 only uses it if there's enough space left in the line +buffer. Otherwise it just pads out the line manually. + +For lines that were _just_ short enough that the RA order still fit in +the line buffer, the line was instead padded with an insufficient +amount of spaces. This was caused by examining the size of the +allocated line buffer rather than the length of the string to be +displayed. + +For con3270_cline_end(), we just compare against the line length. For +con3270_update_string() however that isn't available anymore, so we +check whether the Repeat to Address order is present. + +Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git) +Tested-by: Jing Liu +Tested-by: Yang Chen +Signed-off-by: Sascha Silbe +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/char/con3270.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/s390/char/con3270.c ++++ b/drivers/s390/char/con3270.c +@@ -124,7 +124,12 @@ con3270_create_status(struct con3270 *cp + static void + con3270_update_string(struct con3270 *cp, struct string *s, int nr) + { +- if (s->len >= cp->view.cols - 5) ++ if (s->len < 4) { ++ /* This indicates a bug, but printing a warning would ++ * cause a deadlock. */ ++ return; ++ } ++ if (s->string[s->len - 4] != TO_RA) + return; + raw3270_buffer_address(cp->view.dev, s->string + s->len - 3, + cp->view.cols * (nr + 1)); +@@ -460,7 +465,7 @@ con3270_cline_end(struct con3270 *cp) + cp->cline->len + 4 : cp->view.cols; + s = con3270_alloc_string(cp, size); + memcpy(s->string, cp->cline->string, cp->cline->len); +- if (s->len < cp->view.cols - 5) { ++ if (cp->cline->len < cp->view.cols - 5) { + s->string[s->len - 4] = TO_RA; + s->string[s->len - 1] = 0; + } else { diff --git a/queue-4.8/s390-con3270-fix-use-of-uninitialised-data.patch b/queue-4.8/s390-con3270-fix-use-of-uninitialised-data.patch new file mode 100644 index 00000000000..f8d987b21b7 --- /dev/null +++ b/queue-4.8/s390-con3270-fix-use-of-uninitialised-data.patch @@ -0,0 +1,48 @@ +From c14f2aac7aa147861793eed9f41f91dd530f0be1 Mon Sep 17 00:00:00 2001 +From: Sascha Silbe +Date: Thu, 11 Aug 2016 21:34:54 +0200 +Subject: s390/con3270: fix use of uninitialised data + +From: Sascha Silbe + +commit c14f2aac7aa147861793eed9f41f91dd530f0be1 upstream. + +con3270 contains an optimisation that reduces the amount of data to be +transmitted to the 3270 terminal by putting a Repeat to Address (RA) +order into the data stream. The RA order itself takes up space, so +con3270 only uses it if there's enough space left in the line +buffer. Otherwise it just pads out the line manually. + +For lines too long to include the RA order, one byte was left +uninitialised. This was caused by an off-by-one bug in the loop that +pads out the line. Since the buffer is allocated from a common pool, +the single byte left uninitialised contained some previous buffer +content. Usually this was just a space or some character (which can +result in clutter but is otherwise harmless). Sometimes, however, it +was a Repeat to Address order, messing up the entire screen layout and +causing the display to send the entire buffer content on every +keystroke. + +Fixes: f51320a5 ("[PATCH] s390: new 3270 driver.") (tglx/history.git) +Reported-by: Liu Jing +Tested-by: Jing Liu +Tested-by: Yang Chen +Signed-off-by: Sascha Silbe +Signed-off-by: Martin Schwidefsky +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/s390/char/con3270.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/s390/char/con3270.c ++++ b/drivers/s390/char/con3270.c +@@ -464,7 +464,7 @@ con3270_cline_end(struct con3270 *cp) + s->string[s->len - 4] = TO_RA; + s->string[s->len - 1] = 0; + } else { +- while (--size > cp->cline->len) ++ while (--size >= cp->cline->len) + s->string[size] = cp->view.ascebc[' ']; + } + /* Replace cline with allocated line s and reset cline. */ diff --git a/queue-4.8/series b/queue-4.8/series index 37b66c595e7..e636594a27b 100644 --- a/queue-4.8/series +++ b/queue-4.8/series @@ -79,3 +79,47 @@ power-bq24257-fix-use-of-uninitialized-pointer-bq-charger.patch dmaengine-ipu-remove-bogus-no_irq-reference.patch mm-hugetlb-check-for-reserved-hugepages-during-memory-offline.patch mm-hugetlb-improve-locking-in-dissolve_free_huge_pages.patch +drm-vmwgfx-avoid-validating-views-on-view-destruction.patch +s390-cio-fix-accidental-interrupt-enabling-during-resume.patch +s390-con3270-fix-use-of-uninitialised-data.patch +s390-con3270-fix-insufficient-space-padding.patch +clk-bcm2835-skip-pllc-clocks-when-deciding-on-a-new-clock-parent.patch +clk-gcc-msm8996-fix-pcie-2-pipe-register-offset.patch +clk-qcom-select-gdsc-for-msm8996-gcc-and-mmcc.patch +clk-qoriq-fix-a-register-offset-error.patch +clk-return-errors-from-clk-providers-in-__of_clk_get_from_provider.patch +clk-core-force-setting-the-phase-delay-when-no-change.patch +clk-divider-fix-clk_divider_round_rate-to-use-clk_readl.patch +perf-data-fix-building-in-32-bit-platform-with-libbabeltrace.patch +perf-hists-browser-fix-event-group-display.patch +perf-powerpc-fix-build-test-failure.patch +perf-ui-tui-reset-output-width-for-hierarchy.patch +perf-ui-stdio-always-reset-output-width-for-hierarchy.patch +perf-symbols-check-symbol_conf.allow_aliases-for-kallsyms-loading-too.patch +perf-symbols-fixup-symbol-sizes-before-picking-best-ones.patch +iwlwifi-check-for-valid-ethernet-address-provided-by-oem.patch +iwlwifi-mvm-fix-pending-frames-tracking-on-tx-resp.patch +iwlwifi-mvm-call-a-different-txq_enable-function.patch +iwlwifi-mvm-free-reserved-queue-on-sta-removal.patch +iwlwifi-mvm-support-bar-in-reorder-buffer.patch +iwlwifi-mvm-disable-p2p-queue-on-mac-context-release.patch +iwlwifi-mvm-bail-out-if-ctdp-start-operation-fails.patch +arm-dts-sun9i-add-missing-interrupt-cells-to-r_pio-pinctrl-device-node.patch +pinctrl-qcom-fix-masking-of-pinmux-functions.patch +mpt3sas-don-t-spam-logs-if-logging-level-is-0.patch +powerpc-always-restore-fpu-vec-vsx-if-hardware-transactional-memory-in-use.patch +powerpc-add-check_if_tm_restore_required-to-giveup_all.patch +powerpc-nvram-fix-an-incorrect-partition-merge.patch +powerpc-fix-usage-of-_page_ro-in-hugepage.patch +arm-pxa-pxa_cplds-fix-interrupt-handling.patch +arm-pxa-fix-gpio-double-shifts.patch +arm-dts-nsp-correct-ram-amount-for-bcm958625hr-board.patch +arm-dts-fix-realview-eb-smsc-ethernet-version.patch +arm-dts-omap3-overo-add-missing-unit-name-for-lcd35-display.patch +pci-rcar-fix-pci_remap_iospace-failure-path.patch +pci-aardvark-fix-pci_remap_iospace-failure-path.patch +pci-generic-fix-pci_remap_iospace-failure-path.patch +pci-versatile-fix-pci_remap_iospace-failure-path.patch +pci-designware-fix-pci_remap_iospace-failure-path.patch +pci-tegra-fix-pci_remap_iospace-failure-path.patch +libnvdimm-clear-the-internal-poison_list-when-clearing-badblocks.patch