From: Greg Kroah-Hartman Date: Mon, 6 Nov 2017 09:11:28 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v3.18.80~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=16af194e0f7977b8f7dbc0333c84aa7236b692e7;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch ath10k-fix-reading-sram-contents-for-qca4019.patch bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch bt8xx-fix-memory-leak.patch clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch crypto-ccp-set-the-aes-size-field-for-all-modes.patch cx231xx-fix-i2c-on-internal-master-3-bus.patch drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch drm-exynos-g2d-prevent-integer-overflow-in.patch drm-fsl-dcu-check-for-clk_prepare_enable-error.patch drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch ext4-do-not-use-stripe_width-if-it-is-not-set.patch ext4-fix-stripe-unaligned-allocations.patch exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch i2c-riic-correctly-finish-transfers.patch ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch mei-return-error-on-notification-request-to-a-disconnected-client.patch mfd-ab8500-sysctrl-handle-probe-deferral.patch mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch net-ena-change-driver-s-default-timeouts.patch net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch pci-msi-return-failure-when-msix_setup_entries-fails.patch perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch platform-x86-intel_mid_thermal-fix-module-autoload.patch pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch scsi-aacraid-process-error-for-response-i-o.patch scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch staging-fsl-mc-add-missing-header.patch staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch staging-lustre-ptlrpc-skip-lock-if-export-failed.patch staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch xen-manage-correct-return-value-check-on-xenbus_scanf.patch --- diff --git a/queue-4.9/asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch b/queue-4.9/asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch new file mode 100644 index 00000000000..275aa0906c0 --- /dev/null +++ b/queue-4.9/asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch @@ -0,0 +1,45 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Pierre-Louis Bossart +Date: Sat, 7 Oct 2017 22:36:56 +0000 +Subject: ASoC: Intel: boards: remove .pm_ops in all Atom/DPCM machine drivers + +From: Pierre-Louis Bossart + + +[ Upstream commit 3639ac1cd5177685a5c8abb7230096b680e1d497 ] + +This patch corrects an omission in bytcr_rt5640 and bytcr_rt5651. +All existing machine drivers shall not use .pm_ops to avoid a double +suspend, as initially implemented by 3f2dcbeaeb2b +("ASoC: Intel: Remove soc pm handling to allow platform driver handle it"). + +Reported-by: Shrirang Bagul +Signed-off-by: Pierre-Louis Bossart +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/intel/boards/bytcr_rt5640.c | 1 - + sound/soc/intel/boards/bytcr_rt5651.c | 1 - + 2 files changed, 2 deletions(-) + +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -807,7 +807,6 @@ static int snd_byt_rt5640_mc_probe(struc + static struct platform_driver snd_byt_rt5640_mc_driver = { + .driver = { + .name = "bytcr_rt5640", +- .pm = &snd_soc_pm_ops, + }, + .probe = snd_byt_rt5640_mc_probe, + }; +--- a/sound/soc/intel/boards/bytcr_rt5651.c ++++ b/sound/soc/intel/boards/bytcr_rt5651.c +@@ -317,7 +317,6 @@ static int snd_byt_rt5651_mc_probe(struc + static struct platform_driver snd_byt_rt5651_mc_driver = { + .driver = { + .name = "bytcr_rt5651", +- .pm = &snd_soc_pm_ops, + }, + .probe = snd_byt_rt5651_mc_probe, + }; diff --git a/queue-4.9/ath10k-fix-reading-sram-contents-for-qca4019.patch b/queue-4.9/ath10k-fix-reading-sram-contents-for-qca4019.patch new file mode 100644 index 00000000000..5ada08ebf80 --- /dev/null +++ b/queue-4.9/ath10k-fix-reading-sram-contents-for-qca4019.patch @@ -0,0 +1,212 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Ashok Raj Nagarajan +Date: Sat, 7 Oct 2017 22:36:52 +0000 +Subject: ath10k: fix reading sram contents for QCA4019 + +From: Ashok Raj Nagarajan + + +[ Upstream commit 7f622593cc5add77a99cd39404e8a851be9de792 ] + +With QCA4019 platform, SRAM address can be accessed directly from host but +currently, we are assuming sram addresses cannot be accessed directly and +hence we convert the addresses. + +While there, clean up growing hw checks during conversion of target CPU +address to CE address. Now we have function pointer pertaining to different +chips. + +Signed-off-by: Ashok Raj Nagarajan +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath10k/ahb.c | 23 +++++++++++++++ + drivers/net/wireless/ath/ath10k/pci.c | 51 +++++++++++++++++++++------------- + drivers/net/wireless/ath/ath10k/pci.h | 5 +++ + 3 files changed, 60 insertions(+), 19 deletions(-) + +--- a/drivers/net/wireless/ath/ath10k/ahb.c ++++ b/drivers/net/wireless/ath/ath10k/ahb.c +@@ -33,6 +33,9 @@ static const struct of_device_id ath10k_ + + MODULE_DEVICE_TABLE(of, ath10k_ahb_of_match); + ++#define QCA4019_SRAM_ADDR 0x000C0000 ++#define QCA4019_SRAM_LEN 0x00040000 /* 256 kb */ ++ + static inline struct ath10k_ahb *ath10k_ahb_priv(struct ath10k *ar) + { + return &((struct ath10k_pci *)ar->drv_priv)->ahb[0]; +@@ -699,6 +702,25 @@ out: + return ret; + } + ++static u32 ath10k_ahb_qca4019_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr) ++{ ++ u32 val = 0, region = addr & 0xfffff; ++ ++ val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS); ++ ++ if (region >= QCA4019_SRAM_ADDR && region <= ++ (QCA4019_SRAM_ADDR + QCA4019_SRAM_LEN)) { ++ /* SRAM contents for QCA4019 can be directly accessed and ++ * no conversions are required ++ */ ++ val |= region; ++ } else { ++ val |= 0x100000 | region; ++ } ++ ++ return val; ++} ++ + static const struct ath10k_hif_ops ath10k_ahb_hif_ops = { + .tx_sg = ath10k_pci_hif_tx_sg, + .diag_read = ath10k_pci_hif_diag_read, +@@ -766,6 +788,7 @@ static int ath10k_ahb_probe(struct platf + ar_pci->mem_len = ar_ahb->mem_len; + ar_pci->ar = ar; + ar_pci->bus_ops = &ath10k_ahb_bus_ops; ++ ar_pci->targ_cpu_to_ce_addr = ath10k_ahb_qca4019_targ_cpu_to_ce_addr; + + ret = ath10k_pci_setup_resource(ar); + if (ret) { +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -840,31 +840,35 @@ void ath10k_pci_rx_replenish_retry(unsig + ath10k_pci_rx_post(ar); + } + +-static u32 ath10k_pci_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr) ++static u32 ath10k_pci_qca988x_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr) + { +- u32 val = 0; ++ u32 val = 0, region = addr & 0xfffff; + +- switch (ar->hw_rev) { +- case ATH10K_HW_QCA988X: +- case ATH10K_HW_QCA9887: +- case ATH10K_HW_QCA6174: +- case ATH10K_HW_QCA9377: +- val = (ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + +- CORE_CTRL_ADDRESS) & +- 0x7ff) << 21; +- break; +- case ATH10K_HW_QCA9888: +- case ATH10K_HW_QCA99X0: +- case ATH10K_HW_QCA9984: +- case ATH10K_HW_QCA4019: +- val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS); +- break; +- } ++ val = (ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS + CORE_CTRL_ADDRESS) ++ & 0x7ff) << 21; ++ val |= 0x100000 | region; ++ return val; ++} ++ ++static u32 ath10k_pci_qca99x0_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr) ++{ ++ u32 val = 0, region = addr & 0xfffff; + +- val |= 0x100000 | (addr & 0xfffff); ++ val = ath10k_pci_read32(ar, PCIE_BAR_REG_ADDRESS); ++ val |= 0x100000 | region; + return val; + } + ++static u32 ath10k_pci_targ_cpu_to_ce_addr(struct ath10k *ar, u32 addr) ++{ ++ struct ath10k_pci *ar_pci = ath10k_pci_priv(ar); ++ ++ if (WARN_ON_ONCE(!ar_pci->targ_cpu_to_ce_addr)) ++ return -ENOTSUPP; ++ ++ return ar_pci->targ_cpu_to_ce_addr(ar, addr); ++} ++ + /* + * Diagnostic read/write access is provided for startup/config/debug usage. + * Caller must guarantee proper alignment, when applicable, and single user +@@ -3171,6 +3175,7 @@ static int ath10k_pci_probe(struct pci_d + bool pci_ps; + int (*pci_soft_reset)(struct ath10k *ar); + int (*pci_hard_reset)(struct ath10k *ar); ++ u32 (*targ_cpu_to_ce_addr)(struct ath10k *ar, u32 addr); + + switch (pci_dev->device) { + case QCA988X_2_0_DEVICE_ID: +@@ -3178,12 +3183,14 @@ static int ath10k_pci_probe(struct pci_d + pci_ps = false; + pci_soft_reset = ath10k_pci_warm_reset; + pci_hard_reset = ath10k_pci_qca988x_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr; + break; + case QCA9887_1_0_DEVICE_ID: + hw_rev = ATH10K_HW_QCA9887; + pci_ps = false; + pci_soft_reset = ath10k_pci_warm_reset; + pci_hard_reset = ath10k_pci_qca988x_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr; + break; + case QCA6164_2_1_DEVICE_ID: + case QCA6174_2_1_DEVICE_ID: +@@ -3191,30 +3198,35 @@ static int ath10k_pci_probe(struct pci_d + pci_ps = true; + pci_soft_reset = ath10k_pci_warm_reset; + pci_hard_reset = ath10k_pci_qca6174_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr; + break; + case QCA99X0_2_0_DEVICE_ID: + hw_rev = ATH10K_HW_QCA99X0; + pci_ps = false; + pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset; + pci_hard_reset = ath10k_pci_qca99x0_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr; + break; + case QCA9984_1_0_DEVICE_ID: + hw_rev = ATH10K_HW_QCA9984; + pci_ps = false; + pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset; + pci_hard_reset = ath10k_pci_qca99x0_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr; + break; + case QCA9888_2_0_DEVICE_ID: + hw_rev = ATH10K_HW_QCA9888; + pci_ps = false; + pci_soft_reset = ath10k_pci_qca99x0_soft_chip_reset; + pci_hard_reset = ath10k_pci_qca99x0_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca99x0_targ_cpu_to_ce_addr; + break; + case QCA9377_1_0_DEVICE_ID: + hw_rev = ATH10K_HW_QCA9377; + pci_ps = true; + pci_soft_reset = NULL; + pci_hard_reset = ath10k_pci_qca6174_chip_reset; ++ targ_cpu_to_ce_addr = ath10k_pci_qca988x_targ_cpu_to_ce_addr; + break; + default: + WARN_ON(1); +@@ -3241,6 +3253,7 @@ static int ath10k_pci_probe(struct pci_d + ar_pci->bus_ops = &ath10k_pci_bus_ops; + ar_pci->pci_soft_reset = pci_soft_reset; + ar_pci->pci_hard_reset = pci_hard_reset; ++ ar_pci->targ_cpu_to_ce_addr = targ_cpu_to_ce_addr; + + ar->id.vendor = pdev->vendor; + ar->id.device = pdev->device; +--- a/drivers/net/wireless/ath/ath10k/pci.h ++++ b/drivers/net/wireless/ath/ath10k/pci.h +@@ -238,6 +238,11 @@ struct ath10k_pci { + /* Chip specific pci full reset function */ + int (*pci_hard_reset)(struct ath10k *ar); + ++ /* chip specific methods for converting target CPU virtual address ++ * space to CE address space ++ */ ++ u32 (*targ_cpu_to_ce_addr)(struct ath10k *ar, u32 addr); ++ + /* Keep this entry in the last, memory for struct ath10k_ahb is + * allocated (ahb support enabled case) in the continuation of + * this struct. diff --git a/queue-4.9/bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch b/queue-4.9/bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch new file mode 100644 index 00000000000..f2a52e93f55 --- /dev/null +++ b/queue-4.9/bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch @@ -0,0 +1,48 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Deepak Khungar +Date: Sat, 7 Oct 2017 22:36:48 +0000 +Subject: bnxt_en: Added PCI IDs for BCM57452 and BCM57454 ASICs + +From: Deepak Khungar + + +[ Upstream commit 32b40798c1b40343641f04cdfd09652af70ea0e9 ] + +Signed-off-by: Deepak Khungar +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -97,6 +97,8 @@ enum board_idx { + BCM57407_NPAR, + BCM57414_NPAR, + BCM57416_NPAR, ++ BCM57452, ++ BCM57454, + NETXTREME_E_VF, + NETXTREME_C_VF, + }; +@@ -131,6 +133,8 @@ static const struct { + { "Broadcom BCM57407 NetXtreme-E Ethernet Partition" }, + { "Broadcom BCM57414 NetXtreme-E Ethernet Partition" }, + { "Broadcom BCM57416 NetXtreme-E Ethernet Partition" }, ++ { "Broadcom BCM57452 NetXtreme-E 10Gb/25Gb/40Gb/50Gb Ethernet" }, ++ { "Broadcom BCM57454 NetXtreme-E 10Gb/25Gb/40Gb/50Gb/100Gb Ethernet" }, + { "Broadcom NetXtreme-E Ethernet Virtual Function" }, + { "Broadcom NetXtreme-C Ethernet Virtual Function" }, + }; +@@ -166,6 +170,8 @@ static const struct pci_device_id bnxt_p + { PCI_VDEVICE(BROADCOM, 0x16ed), .driver_data = BCM57414_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x16ee), .driver_data = BCM57416_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x16ef), .driver_data = BCM57416_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x16f1), .driver_data = BCM57452 }, ++ { PCI_VDEVICE(BROADCOM, 0x1614), .driver_data = BCM57454 }, + #ifdef CONFIG_BNXT_SRIOV + { PCI_VDEVICE(BROADCOM, 0x16c1), .driver_data = NETXTREME_E_VF }, + { PCI_VDEVICE(BROADCOM, 0x16cb), .driver_data = NETXTREME_C_VF }, diff --git a/queue-4.9/brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch b/queue-4.9/brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch new file mode 100644 index 00000000000..d06defb5373 --- /dev/null +++ b/queue-4.9/brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch @@ -0,0 +1,59 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Rafał Miłecki +Date: Sat, 7 Oct 2017 22:36:55 +0000 +Subject: brcmfmac: check brcmf_bus_get_memdump result for error + +From: Rafał Miłecki + + +[ Upstream commit f4737a62033d7f3e0db740c449fc62119da7ab8a ] + +This method may be unsupported (see: USB bus) or may just fail (see: +SDIO bus). +While at it rework logic in brcmf_sdio_bus_get_memdump function to avoid +too many conditional code nesting levels. + +Signed-off-by: Rafał Miłecki +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c | 23 ++++++++++----- + 1 file changed, 16 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.c +@@ -32,16 +32,25 @@ static int brcmf_debug_create_memdump(st + { + void *dump; + size_t ramsize; ++ int err; + + ramsize = brcmf_bus_get_ramsize(bus); +- if (ramsize) { +- dump = vzalloc(len + ramsize); +- if (!dump) +- return -ENOMEM; +- memcpy(dump, data, len); +- brcmf_bus_get_memdump(bus, dump + len, ramsize); +- dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL); ++ if (!ramsize) ++ return -ENOTSUPP; ++ ++ dump = vzalloc(len + ramsize); ++ if (!dump) ++ return -ENOMEM; ++ ++ memcpy(dump, data, len); ++ err = brcmf_bus_get_memdump(bus, dump + len, ramsize); ++ if (err) { ++ vfree(dump); ++ return err; + } ++ ++ dev_coredumpv(bus->dev, dump, len + ramsize, GFP_KERNEL); ++ + return 0; + } + diff --git a/queue-4.9/bt8xx-fix-memory-leak.patch b/queue-4.9/bt8xx-fix-memory-leak.patch new file mode 100644 index 00000000000..333fc3e1b84 --- /dev/null +++ b/queue-4.9/bt8xx-fix-memory-leak.patch @@ -0,0 +1,32 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Sudip Mukherjee +Date: Sat, 7 Oct 2017 22:36:57 +0000 +Subject: bt8xx: fix memory leak + +From: Sudip Mukherjee + + +[ Upstream commit 6792eb0cf9310ec240b7e7c9bfa86dff4c758c68 ] + +If dvb_attach() fails then we were just printing an error message and +exiting but the memory allocated to state was not released. + +Signed-off-by: Sudip Mukherjee +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/pci/bt8xx/dvb-bt8xx.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/pci/bt8xx/dvb-bt8xx.c ++++ b/drivers/media/pci/bt8xx/dvb-bt8xx.c +@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8 + /* DST is not a frontend, attaching the ASIC */ + if (dvb_attach(dst_attach, state, &card->dvb_adapter) == NULL) { + pr_err("%s: Could not find a Twinhan DST\n", __func__); ++ kfree(state); + break; + } + /* Attach other DST peripherals if any */ diff --git a/queue-4.9/clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch b/queue-4.9/clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch new file mode 100644 index 00000000000..21be7e6f647 --- /dev/null +++ b/queue-4.9/clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch @@ -0,0 +1,55 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Stephen Boyd +Date: Sat, 7 Oct 2017 22:36:52 +0000 +Subject: clk: sunxi-ng: Check kzalloc() for errors and cleanup error path + +From: Stephen Boyd + + +[ Upstream commit 5d806f9fc8e63d7a44e0fd1ef26a7c27efae0e51 ] + +This kzalloc() could fail. Let's bail out with -ENOMEM here +instead of NULL dereferencing. That silences static checkers. We +should also cleanup on the error path even though this function +returning an error probably means the system won't boot. + +Cc: Chen-Yu Tsai +Acked-by: Maxime Ripard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/sunxi-ng/ccu_common.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/drivers/clk/sunxi-ng/ccu_common.c ++++ b/drivers/clk/sunxi-ng/ccu_common.c +@@ -70,6 +70,11 @@ int sunxi_ccu_probe(struct device_node * + goto err_clk_unreg; + + reset = kzalloc(sizeof(*reset), GFP_KERNEL); ++ if (!reset) { ++ ret = -ENOMEM; ++ goto err_alloc_reset; ++ } ++ + reset->rcdev.of_node = node; + reset->rcdev.ops = &ccu_reset_ops; + reset->rcdev.owner = THIS_MODULE; +@@ -85,6 +90,16 @@ int sunxi_ccu_probe(struct device_node * + return 0; + + err_of_clk_unreg: ++ kfree(reset); ++err_alloc_reset: ++ of_clk_del_provider(node); + err_clk_unreg: ++ while (--i >= 0) { ++ struct clk_hw *hw = desc->hw_clks->hws[i]; ++ ++ if (!hw) ++ continue; ++ clk_hw_unregister(hw); ++ } + return ret; + } diff --git a/queue-4.9/clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch b/queue-4.9/clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch new file mode 100644 index 00000000000..fc3eb0a7669 --- /dev/null +++ b/queue-4.9/clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch @@ -0,0 +1,40 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Ding Tianhong +Date: Sat, 7 Oct 2017 22:36:51 +0000 +Subject: clocksource/drivers/arm_arch_timer: Add dt binding for hisilicon-161010101 erratum + +From: Ding Tianhong + + +[ Upstream commit 729e55225b1f6225ee7a2a358d5141a3264627c4 ] + +This erratum describes a bug in logic outside the core, so MIDR can't be +used to identify its presence, and reading an SoC-specific revision +register from common arch timer code would be awkward. So, describe it +in the device tree. + +Signed-off-by: Ding Tianhong +Acked-by: Rob Herring +Signed-off-by: Mark Rutland +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/arm/arch_timer.txt | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/Documentation/devicetree/bindings/arm/arch_timer.txt ++++ b/Documentation/devicetree/bindings/arm/arch_timer.txt +@@ -31,6 +31,12 @@ to deliver its interrupts via SPIs. + This also affects writes to the tval register, due to the implicit + counter read. + ++- hisilicon,erratum-161010101 : A boolean property. Indicates the ++ presence of Hisilicon erratum 161010101, which says that reading the ++ counters is unreliable in some cases, and reads may return a value 32 ++ beyond the correct value. This also affects writes to the tval ++ registers, due to the implicit counter read. ++ + ** Optional properties: + + - arm,cpu-registers-not-fw-configured : Firmware does not initialize diff --git a/queue-4.9/cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch b/queue-4.9/cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch new file mode 100644 index 00000000000..dfca607e5b3 --- /dev/null +++ b/queue-4.9/cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: "Rafael J. Wysocki" +Date: Sat, 7 Oct 2017 22:36:46 +0000 +Subject: cpufreq: Do not clear real_cpus mask on policy init + +From: "Rafael J. Wysocki" + + +[ Upstream commit f451014692ae34e587b00de6745e16661cf734d8 ] + +If new_policy is set in cpufreq_online(), the policy object has just +been created and its real_cpus mask has been zeroed on allocation, +and the driver's ->init() callback should not touch it. + +It doesn't need to be cleared again, so don't do that. + +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/cpufreq.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1172,8 +1172,6 @@ static int cpufreq_online(unsigned int c + if (new_policy) { + /* related_cpus should at least include policy->cpus. */ + cpumask_copy(policy->related_cpus, policy->cpus); +- /* Clear mask of registered CPUs */ +- cpumask_clear(policy->real_cpus); + } + + /* diff --git a/queue-4.9/crypto-ccp-set-the-aes-size-field-for-all-modes.patch b/queue-4.9/crypto-ccp-set-the-aes-size-field-for-all-modes.patch new file mode 100644 index 00000000000..0e66fb25b48 --- /dev/null +++ b/queue-4.9/crypto-ccp-set-the-aes-size-field-for-all-modes.patch @@ -0,0 +1,62 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Gary R Hook +Date: Sat, 7 Oct 2017 22:36:46 +0000 +Subject: crypto: ccp - Set the AES size field for all modes + +From: Gary R Hook + + +[ Upstream commit f7cc02b3c3a33a10dd5bb9e5dfd22e47e09503a2 ] + +Ensure that the size field is correctly populated for +all AES modes. + +Signed-off-by: Gary R Hook +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/ccp/ccp-dev-v5.c | 3 +-- + drivers/crypto/ccp/ccp-dev.h | 1 + + drivers/crypto/ccp/ccp-ops.c | 8 ++++++++ + 3 files changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/ccp/ccp-dev-v5.c ++++ b/drivers/crypto/ccp/ccp-dev-v5.c +@@ -278,8 +278,7 @@ static int ccp5_perform_aes(struct ccp_o + CCP_AES_ENCRYPT(&function) = op->u.aes.action; + CCP_AES_MODE(&function) = op->u.aes.mode; + CCP_AES_TYPE(&function) = op->u.aes.type; +- if (op->u.aes.mode == CCP_AES_MODE_CFB) +- CCP_AES_SIZE(&function) = 0x7f; ++ CCP_AES_SIZE(&function) = op->u.aes.size; + + CCP5_CMD_FUNCTION(&desc) = function.raw; + +--- a/drivers/crypto/ccp/ccp-dev.h ++++ b/drivers/crypto/ccp/ccp-dev.h +@@ -470,6 +470,7 @@ struct ccp_aes_op { + enum ccp_aes_type type; + enum ccp_aes_mode mode; + enum ccp_aes_action action; ++ unsigned int size; + }; + + struct ccp_xts_aes_op { +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -692,6 +692,14 @@ static int ccp_run_aes_cmd(struct ccp_cm + goto e_ctx; + } + } ++ switch (aes->mode) { ++ case CCP_AES_MODE_CFB: /* CFB128 only */ ++ case CCP_AES_MODE_CTR: ++ op.u.aes.size = AES_BLOCK_SIZE * BITS_PER_BYTE - 1; ++ break; ++ default: ++ op.u.aes.size = 0; ++ } + + /* Prepare the input and output data workareas. For in-place + * operations we need to set the dma direction to BIDIRECTIONAL diff --git a/queue-4.9/cx231xx-fix-i2c-on-internal-master-3-bus.patch b/queue-4.9/cx231xx-fix-i2c-on-internal-master-3-bus.patch new file mode 100644 index 00000000000..b141e49662d --- /dev/null +++ b/queue-4.9/cx231xx-fix-i2c-on-internal-master-3-bus.patch @@ -0,0 +1,36 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Oleh Kravchenko +Date: Sat, 7 Oct 2017 22:36:52 +0000 +Subject: cx231xx: Fix I2C on Internal Master 3 Bus + +From: Oleh Kravchenko + + +[ Upstream commit 6c5da8031a3abfad259190d35f83d89568b72ee2 ] + +Internal Master 3 Bus can send and receive only 4 bytes per time. + +Signed-off-by: Oleh Kravchenko +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/cx231xx/cx231xx-core.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/media/usb/cx231xx/cx231xx-core.c ++++ b/drivers/media/usb/cx231xx/cx231xx-core.c +@@ -356,7 +356,12 @@ int cx231xx_send_vendor_cmd(struct cx231 + */ + if ((ven_req->wLength > 4) && ((ven_req->bRequest == 0x4) || + (ven_req->bRequest == 0x5) || +- (ven_req->bRequest == 0x6))) { ++ (ven_req->bRequest == 0x6) || ++ ++ /* Internal Master 3 Bus can send ++ * and receive only 4 bytes per time ++ */ ++ (ven_req->bRequest == 0x2))) { + unsend_size = 0; + pdata = ven_req->pBuff; + diff --git a/queue-4.9/drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch b/queue-4.9/drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch new file mode 100644 index 00000000000..47ff7dd3e74 --- /dev/null +++ b/queue-4.9/drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch @@ -0,0 +1,45 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Rex Zhu +Date: Sat, 7 Oct 2017 22:36:50 +0000 +Subject: drm/amdgpu: when dpm disabled, also need to stop/start vce. + +From: Rex Zhu + + +[ Upstream commit 28ed5504ab4b211a4e589e648e5ebd1e0caa7a6a ] + +Signed-off-by: Rex Zhu +Reviewed-by: Alex Deucher +Acked-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +@@ -315,6 +315,10 @@ static void amdgpu_vce_idle_work_handler + amdgpu_dpm_enable_vce(adev, false); + } else { + amdgpu_asic_set_vce_clocks(adev, 0, 0); ++ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE, ++ AMD_PG_STATE_GATE); ++ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE, ++ AMD_CG_STATE_GATE); + } + } else { + schedule_delayed_work(&adev->vce.idle_work, VCE_IDLE_TIMEOUT); +@@ -340,6 +344,11 @@ void amdgpu_vce_ring_begin_use(struct am + amdgpu_dpm_enable_vce(adev, true); + } else { + amdgpu_asic_set_vce_clocks(adev, 53300, 40000); ++ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE, ++ AMD_CG_STATE_UNGATE); ++ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE, ++ AMD_PG_STATE_UNGATE); ++ + } + } + mutex_unlock(&adev->vce.idle_mutex); diff --git a/queue-4.9/drm-exynos-g2d-prevent-integer-overflow-in.patch b/queue-4.9/drm-exynos-g2d-prevent-integer-overflow-in.patch new file mode 100644 index 00000000000..f04b5012526 --- /dev/null +++ b/queue-4.9/drm-exynos-g2d-prevent-integer-overflow-in.patch @@ -0,0 +1,67 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Joonyoung Shim +Date: Sat, 7 Oct 2017 22:37:34 +0000 +Subject: drm/exynos: g2d: prevent integer overflow in + +From: Joonyoung Shim + + +[ Upstream commit e41456bfc811f12b5dcda6f2d6849bdff68f6c0a ] + +The size computations done in the ioctl function use an integer. +If userspace submits a request with req->cmd_nr or req->cmd_buf_nr +set to INT_MAX, the integer computations overflow later, leading +to potential (kernel) memory corruption. + +Prevent this issue by enforcing a limit on the number of submitted +commands, so that we have enough headroom later for the size +computations. + +Note that this change has no impact on the currently available +users in userspace, like e.g. libdrm/exynos. + +While at it, also make a comment about the size computation more +detailed. + +Signed-off-by: Joonyoung Shim +Signed-off-by: Tobias Jakobi +Signed-off-by: Inki Dae +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/exynos/exynos_drm_g2d.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +@@ -1193,6 +1193,17 @@ int exynos_g2d_set_cmdlist_ioctl(struct + if (!node) + return -ENOMEM; + ++ /* ++ * To avoid an integer overflow for the later size computations, we ++ * enforce a maximum number of submitted commands here. This limit is ++ * sufficient for all conceivable usage cases of the G2D. ++ */ ++ if (req->cmd_nr > G2D_CMDLIST_DATA_NUM || ++ req->cmd_buf_nr > G2D_CMDLIST_DATA_NUM) { ++ dev_err(dev, "number of submitted G2D commands exceeds limit\n"); ++ return -EINVAL; ++ } ++ + node->event = NULL; + + if (req->event_type != G2D_EVENT_NOT) { +@@ -1250,7 +1261,11 @@ int exynos_g2d_set_cmdlist_ioctl(struct + cmdlist->data[cmdlist->last++] = G2D_INTEN_ACF; + } + +- /* Check size of cmdlist: last 2 is about G2D_BITBLT_START */ ++ /* ++ * Check the size of cmdlist. The 2 that is added last comes from ++ * the implicit G2D_BITBLT_START that is appended once we have ++ * checked all the submitted commands. ++ */ + size = cmdlist->last + req->cmd_nr * 2 + req->cmd_buf_nr * 2 + 2; + if (size > G2D_CMDLIST_DATA_NUM) { + dev_err(dev, "cmdlist size is too big\n"); diff --git a/queue-4.9/drm-fsl-dcu-check-for-clk_prepare_enable-error.patch b/queue-4.9/drm-fsl-dcu-check-for-clk_prepare_enable-error.patch new file mode 100644 index 00000000000..2df16545309 --- /dev/null +++ b/queue-4.9/drm-fsl-dcu-check-for-clk_prepare_enable-error.patch @@ -0,0 +1,43 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Fabio Estevam +Date: Sat, 7 Oct 2017 22:36:51 +0000 +Subject: drm/fsl-dcu: check for clk_prepare_enable() error + +From: Fabio Estevam + + +[ Upstream commit ef15d36154cc741d7ded4ae4fa0cf7987354e313 ] + +clk_prepare_enable() may fail, so we should better check its return +value. + +Also place the of_node_put() function right after clk_prepare_enable(), +in order to avoid calling of_node_put() twice in case clk_prepare_enable() +fails. + +Signed-off-by: Fabio Estevam +Signed-off-by: Stefan Agner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/fsl-dcu/fsl_tcon.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/fsl-dcu/fsl_tcon.c ++++ b/drivers/gpu/drm/fsl-dcu/fsl_tcon.c +@@ -89,9 +89,13 @@ struct fsl_tcon *fsl_tcon_init(struct de + goto err_node_put; + } + +- of_node_put(np); +- clk_prepare_enable(tcon->ipg_clk); ++ ret = clk_prepare_enable(tcon->ipg_clk); ++ if (ret) { ++ dev_err(dev, "Couldn't enable the TCON clock\n"); ++ goto err_node_put; ++ } + ++ of_node_put(np); + dev_info(dev, "Using TCON in bypass mode\n"); + + return tcon; diff --git a/queue-4.9/drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch b/queue-4.9/drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch new file mode 100644 index 00000000000..d8b8899c09b --- /dev/null +++ b/queue-4.9/drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch @@ -0,0 +1,60 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Archit Taneja +Date: Sat, 7 Oct 2017 22:36:52 +0000 +Subject: drm/msm/dsi: Set msm_dsi->encoders before initializing bridge + +From: Archit Taneja + + +[ Upstream commit 0bb70b82c2f91e4667f3c617505235efd6d77e46 ] + +The commit "drm: bridge: Link encoder and bridge in core code" updated +the drm_bridge_attach() API to also include the drm_encoder pointer +the bridge attaches to. + +The func msm_dsi_manager_bridge_init() now relies on the drm_encoder +pointer stored in msm_dsi->encoders to pass the encoder to the bridge +API. + +msm_dsi->encoders is unfortunately set after this function is called, +resulting in us passing a NULL pointer to drm_brigde_attach. This +results in an error and the DSI driver probe fails. + +Move the initialization of msm_dsi->encoders[] a bit up. Also, don't +try to set the encoder's bridge. That's now managed by the bridge +API. + +Cc: Laurent Pinchart +Reviewed-by: Laurent Pinchart +Signed-off-by: Archit Taneja +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -205,6 +205,9 @@ int msm_dsi_modeset_init(struct msm_dsi + goto fail; + } + ++ for (i = 0; i < MSM_DSI_ENCODER_NUM; i++) ++ msm_dsi->encoders[i] = encoders[i]; ++ + msm_dsi->bridge = msm_dsi_manager_bridge_init(msm_dsi->id); + if (IS_ERR(msm_dsi->bridge)) { + ret = PTR_ERR(msm_dsi->bridge); +@@ -213,11 +216,6 @@ int msm_dsi_modeset_init(struct msm_dsi + goto fail; + } + +- for (i = 0; i < MSM_DSI_ENCODER_NUM; i++) { +- encoders[i]->bridge = msm_dsi->bridge; +- msm_dsi->encoders[i] = encoders[i]; +- } +- + /* + * check if the dsi encoder output is connected to a panel or an + * external bridge. We create a connector only if we're connected to a diff --git a/queue-4.9/ext4-do-not-use-stripe_width-if-it-is-not-set.patch b/queue-4.9/ext4-do-not-use-stripe_width-if-it-is-not-set.patch new file mode 100644 index 00000000000..593192ac09a --- /dev/null +++ b/queue-4.9/ext4-do-not-use-stripe_width-if-it-is-not-set.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Jan Kara +Date: Sat, 7 Oct 2017 22:36:49 +0000 +Subject: ext4: do not use stripe_width if it is not set + +From: Jan Kara + + +[ Upstream commit 5469d7c3087ecaf760f54b447f11af6061b7c897 ] + +Avoid using stripe_width for sbi->s_stripe value if it is not actually +set. It prevents using the stride for sbi->s_stripe. + +Signed-off-by: Jan Kara +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/super.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2628,9 +2628,9 @@ static unsigned long ext4_get_stripe_siz + + if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group) + ret = sbi->s_stripe; +- else if (stripe_width <= sbi->s_blocks_per_group) ++ else if (stripe_width && stripe_width <= sbi->s_blocks_per_group) + ret = stripe_width; +- else if (stride <= sbi->s_blocks_per_group) ++ else if (stride && stride <= sbi->s_blocks_per_group) + ret = stride; + else + ret = 0; diff --git a/queue-4.9/ext4-fix-stripe-unaligned-allocations.patch b/queue-4.9/ext4-fix-stripe-unaligned-allocations.patch new file mode 100644 index 00000000000..380d981d129 --- /dev/null +++ b/queue-4.9/ext4-fix-stripe-unaligned-allocations.patch @@ -0,0 +1,58 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Jan Kara +Date: Sat, 7 Oct 2017 22:36:49 +0000 +Subject: ext4: fix stripe-unaligned allocations + +From: Jan Kara + + +[ Upstream commit d9b22cf9f5466a057f2a4f1e642b469fa9d73117 ] + +When a filesystem is created using: + + mkfs.ext4 -b 4096 -E stride=512 + +and we try to allocate 64MB extent, we will end up directly in +ext4_mb_complex_scan_group(). This is because the request is detected +as power-of-two allocation (so we start in ext4_mb_regular_allocator() +with ac_criteria == 0) however the check before +ext4_mb_simple_scan_group() refuses the direct buddy scan because the +allocation request is too large. Since cr == 0, the check whether we +should use ext4_mb_scan_aligned() fails as well and we fall back to +ext4_mb_complex_scan_group(). + +Fix the problem by checking for upper limit on power-of-two requests +directly when detecting them. + +Reported-by: Ross Zwisler +Signed-off-by: Jan Kara +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/mballoc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2136,8 +2136,10 @@ ext4_mb_regular_allocator(struct ext4_al + * We search using buddy data only if the order of the request + * is greater than equal to the sbi_s_mb_order2_reqs + * You can tune it via /sys/fs/ext4//mb_order2_req ++ * We also support searching for power-of-two requests only for ++ * requests upto maximum buddy size we have constructed. + */ +- if (i >= sbi->s_mb_order2_reqs) { ++ if (i >= sbi->s_mb_order2_reqs && i <= sb->s_blocksize_bits + 2) { + /* + * This should tell if fe_len is exactly power of 2 + */ +@@ -2207,7 +2209,7 @@ repeat: + } + + ac->ac_groups_scanned++; +- if (cr == 0 && ac->ac_2order < sb->s_blocksize_bits+2) ++ if (cr == 0) + ext4_mb_simple_scan_group(ac, &e4b); + else if (cr == 1 && sbi->s_stripe && + !(ac->ac_g_ex.fe_len % sbi->s_stripe)) diff --git a/queue-4.9/exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch b/queue-4.9/exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch new file mode 100644 index 00000000000..e31b8f4127c --- /dev/null +++ b/queue-4.9/exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch @@ -0,0 +1,56 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Arvind Yadav +Date: Sat, 7 Oct 2017 22:36:56 +0000 +Subject: exynos4-is: fimc-is: Unmap region obtained by of_iomap() + +From: Arvind Yadav + + +[ Upstream commit 4742575cde1f3cee0ea6b41af42781672315b04b ] + +Free memory mapping, if fimc_is_probe is not successful. + +Signed-off-by: Arvind Yadav +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/exynos4-is/fimc-is.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/media/platform/exynos4-is/fimc-is.c ++++ b/drivers/media/platform/exynos4-is/fimc-is.c +@@ -825,12 +825,13 @@ static int fimc_is_probe(struct platform + is->irq = irq_of_parse_and_map(dev->of_node, 0); + if (!is->irq) { + dev_err(dev, "no irq found\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err_iounmap; + } + + ret = fimc_is_get_clocks(is); + if (ret < 0) +- return ret; ++ goto err_iounmap; + + platform_set_drvdata(pdev, is); + +@@ -891,6 +892,8 @@ err_irq: + free_irq(is->irq, is); + err_clk: + fimc_is_put_clocks(is); ++err_iounmap: ++ iounmap(is->pmu_regs); + return ret; + } + +@@ -947,6 +950,7 @@ static int fimc_is_remove(struct platfor + fimc_is_unregister_subdevs(is); + vb2_dma_contig_clear_max_seg_size(dev); + fimc_is_put_clocks(is); ++ iounmap(is->pmu_regs); + fimc_is_debugfs_remove(is); + release_firmware(is->fw.f_w); + fimc_is_free_cpu_memory(is); diff --git a/queue-4.9/gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch b/queue-4.9/gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch new file mode 100644 index 00000000000..7e9b4e99ffa --- /dev/null +++ b/queue-4.9/gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch @@ -0,0 +1,34 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Axel Lin +Date: Sat, 7 Oct 2017 22:36:53 +0000 +Subject: gpio: mcp23s08: Select REGMAP/REGMAP_I2C to fix build error + +From: Axel Lin + + +[ Upstream commit e8e1a5b5679b1ae1ff03a3883b011b84e7226171 ] + +This driver now using devm_regmap_init/devm_regmap_init_i2c, so it needs +to select REGMAP/REGMAP_I2C accordingly. + +Fixes: ("3d84fdb3f0b5 gpio: mcp23s08: use regmap") +Signed-off-by: Axel Lin +Acked-By: Sebastian Reichel +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpio/Kconfig ++++ b/drivers/gpio/Kconfig +@@ -1187,6 +1187,8 @@ config GPIO_MCP23S08 + tristate "Microchip MCP23xxx I/O expander" + depends on OF_GPIO + select GPIOLIB_IRQCHIP ++ select REGMAP_I2C if I2C ++ select REGMAP if SPI_MASTER + help + SPI/I2C driver for Microchip MCP23S08/MCP23S17/MCP23008/MCP23017 + I/O expanders. diff --git a/queue-4.9/i2c-riic-correctly-finish-transfers.patch b/queue-4.9/i2c-riic-correctly-finish-transfers.patch new file mode 100644 index 00000000000..79162e59e6a --- /dev/null +++ b/queue-4.9/i2c-riic-correctly-finish-transfers.patch @@ -0,0 +1,110 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Chris Brandt +Date: Sat, 7 Oct 2017 22:36:50 +0000 +Subject: i2c: riic: correctly finish transfers + +From: Chris Brandt + + +[ Upstream commit 71ccea095ea1d4efd004dab971be6d599e06fc3f ] + +This fixes the condition where the controller has not fully completed its +final transfer and leaves the bus and controller in a undesirable state. + +At the end of the last transmitted byte, the existing driver would just +signal for a STOP condition to be transmitted then immediately signal +completion. However, the full STOP procedure might not have fully taken +place by the time the runtime PM shuts off the peripheral clock, leaving +the bus in a suspended state. + +Alternatively, the STOP condition on the bus may have completed, but when +the next transaction is requested by the upper layer, not all the +necessary register cleanup was finished from the last transfer which made +the driver return BUS BUSY when it really wasn't. + +This patch now makes all transmit and receive transactions wait for the +STOP condition to fully complete before signaling a completed transaction. +With this new method, runtime PM no longer seems to be an issue. + +Fixes: 310c18a41450 ("i2c: riic: add driver") +Signed-off-by: Chris Brandt +Reviewed-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-riic.c | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +--- a/drivers/i2c/busses/i2c-riic.c ++++ b/drivers/i2c/busses/i2c-riic.c +@@ -80,6 +80,7 @@ + #define ICIER_TEIE 0x40 + #define ICIER_RIE 0x20 + #define ICIER_NAKIE 0x10 ++#define ICIER_SPIE 0x08 + + #define ICSR2_NACKF 0x10 + +@@ -216,11 +217,10 @@ static irqreturn_t riic_tend_isr(int irq + return IRQ_NONE; + } + +- if (riic->is_last || riic->err) ++ if (riic->is_last || riic->err) { ++ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); + writeb(ICCR2_SP, riic->base + RIIC_ICCR2); +- +- writeb(0, riic->base + RIIC_ICIER); +- complete(&riic->msg_done); ++ } + + return IRQ_HANDLED; + } +@@ -240,13 +240,13 @@ static irqreturn_t riic_rdrf_isr(int irq + + if (riic->bytes_left == 1) { + /* STOP must come before we set ACKBT! */ +- if (riic->is_last) ++ if (riic->is_last) { ++ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); + writeb(ICCR2_SP, riic->base + RIIC_ICCR2); ++ } + + riic_clear_set_bit(riic, 0, ICMR3_ACKBT, RIIC_ICMR3); + +- writeb(0, riic->base + RIIC_ICIER); +- complete(&riic->msg_done); + } else { + riic_clear_set_bit(riic, ICMR3_ACKBT, 0, RIIC_ICMR3); + } +@@ -259,6 +259,21 @@ static irqreturn_t riic_rdrf_isr(int irq + return IRQ_HANDLED; + } + ++static irqreturn_t riic_stop_isr(int irq, void *data) ++{ ++ struct riic_dev *riic = data; ++ ++ /* read back registers to confirm writes have fully propagated */ ++ writeb(0, riic->base + RIIC_ICSR2); ++ readb(riic->base + RIIC_ICSR2); ++ writeb(0, riic->base + RIIC_ICIER); ++ readb(riic->base + RIIC_ICIER); ++ ++ complete(&riic->msg_done); ++ ++ return IRQ_HANDLED; ++} ++ + static u32 riic_func(struct i2c_adapter *adap) + { + return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; +@@ -326,6 +341,7 @@ static struct riic_irq_desc riic_irqs[] + { .res_num = 0, .isr = riic_tend_isr, .name = "riic-tend" }, + { .res_num = 1, .isr = riic_rdrf_isr, .name = "riic-rdrf" }, + { .res_num = 2, .isr = riic_tdre_isr, .name = "riic-tdre" }, ++ { .res_num = 3, .isr = riic_stop_isr, .name = "riic-stop" }, + { .res_num = 5, .isr = riic_tend_isr, .name = "riic-nack" }, + }; + diff --git a/queue-4.9/ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch b/queue-4.9/ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch new file mode 100644 index 00000000000..6899cb0d802 --- /dev/null +++ b/queue-4.9/ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch @@ -0,0 +1,98 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Majd Dibbiny +Date: Sat, 7 Oct 2017 22:36:47 +0000 +Subject: IB/mlx5: Assign DSCP for R-RoCE QPs Address Path + +From: Majd Dibbiny + + +[ Upstream commit ed88451e1f2d400fd6a743d0a481631cf9f97550 ] + +For Routable RoCE QPs, the DSCP should be set in the QP's +address path. + +The DSCP's value is derived from the traffic class. + +Fixes: 2811ba51b049 ("IB/mlx5: Add RoCE fields to Address Vector") +Cc: Achiad Shochat +Signed-off-by: Majd Dibbiny +Reviewed-by: Moni Shoua +Signed-off-by: Leon Romanovsky +Reviewed-by: Yuval Shaia +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx5/main.c | 21 +++++++++++++++++++++ + drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 ++ + drivers/infiniband/hw/mlx5/qp.c | 7 +++++++ + 3 files changed, 30 insertions(+) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -325,6 +325,27 @@ __be16 mlx5_get_roce_udp_sport(struct ml + return cpu_to_be16(MLX5_CAP_ROCE(dev->mdev, r_roce_min_src_udp_port)); + } + ++int mlx5_get_roce_gid_type(struct mlx5_ib_dev *dev, u8 port_num, ++ int index, enum ib_gid_type *gid_type) ++{ ++ struct ib_gid_attr attr; ++ union ib_gid gid; ++ int ret; ++ ++ ret = ib_get_cached_gid(&dev->ib_dev, port_num, index, &gid, &attr); ++ if (ret) ++ return ret; ++ ++ if (!attr.ndev) ++ return -ENODEV; ++ ++ dev_put(attr.ndev); ++ ++ *gid_type = attr.gid_type; ++ ++ return 0; ++} ++ + static int mlx5_use_mad_ifc(struct mlx5_ib_dev *dev) + { + if (MLX5_CAP_GEN(dev->mdev, port_type) == MLX5_CAP_PORT_TYPE_IB) +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -892,6 +892,8 @@ int mlx5_ib_set_vf_guid(struct ib_device + + __be16 mlx5_get_roce_udp_sport(struct mlx5_ib_dev *dev, u8 port_num, + int index); ++int mlx5_get_roce_gid_type(struct mlx5_ib_dev *dev, u8 port_num, ++ int index, enum ib_gid_type *gid_type); + + /* GSI QP helper functions */ + struct ib_qp *mlx5_ib_gsi_create_qp(struct ib_pd *pd, +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2226,6 +2226,7 @@ static int mlx5_set_path(struct mlx5_ib_ + { + enum rdma_link_layer ll = rdma_port_get_link_layer(&dev->ib_dev, port); + int err; ++ enum ib_gid_type gid_type; + + if (attr_mask & IB_QP_PKEY_INDEX) + path->pkey_index = cpu_to_be16(alt ? attr->alt_pkey_index : +@@ -2244,10 +2245,16 @@ static int mlx5_set_path(struct mlx5_ib_ + if (ll == IB_LINK_LAYER_ETHERNET) { + if (!(ah->ah_flags & IB_AH_GRH)) + return -EINVAL; ++ err = mlx5_get_roce_gid_type(dev, port, ah->grh.sgid_index, ++ &gid_type); ++ if (err) ++ return err; + memcpy(path->rmac, ah->dmac, sizeof(ah->dmac)); + path->udp_sport = mlx5_get_roce_udp_sport(dev, port, + ah->grh.sgid_index); + path->dci_cfi_prio_sl = (ah->sl & 0x7) << 4; ++ if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) ++ path->ecn_dscp = (ah->grh.traffic_class >> 2) & 0x3f; + } else { + path->fl_free_ar = (path_flags & MLX5_PATH_FLAG_FL) ? 0x80 : 0; + path->fl_free_ar |= diff --git a/queue-4.9/iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch b/queue-4.9/iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch new file mode 100644 index 00000000000..07b9bc8b537 --- /dev/null +++ b/queue-4.9/iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch @@ -0,0 +1,46 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Emmanuel Grumbach +Date: Sat, 7 Oct 2017 22:36:51 +0000 +Subject: iwlwifi: mvm: use the PROBE_RESP_QUEUE to send deauth to unknown station + +From: Emmanuel Grumbach + + +[ Upstream commit d45cb20e123c5d7d6cd56301bc98f0bfd725cd77 ] + +When we send a deauth to a station we don't know about, we +need to use the PROBE_RESP queue. This can happen when we +send a deauth to a station that is not associated to us. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -499,15 +499,17 @@ static int iwl_mvm_get_ctrl_vif_queue(st + switch (info->control.vif->type) { + case NL80211_IFTYPE_AP: + /* +- * handle legacy hostapd as well, where station may be added +- * only after assoc. ++ * Handle legacy hostapd as well, where station may be added ++ * only after assoc. Take care of the case where we send a ++ * deauth to a station that we don't have. + */ +- if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc)) ++ if (ieee80211_is_probe_resp(fc) || ieee80211_is_auth(fc) || ++ ieee80211_is_deauth(fc)) + return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE; + if (info->hw_queue == info->control.vif->cab_queue) + return info->hw_queue; + +- WARN_ON_ONCE(1); ++ WARN_ONCE(1, "fc=0x%02x", le16_to_cpu(fc)); + return IWL_MVM_DQA_AP_PROBE_RESP_QUEUE; + case NL80211_IFTYPE_P2P_DEVICE: + if (ieee80211_is_mgmt(fc)) diff --git a/queue-4.9/mei-return-error-on-notification-request-to-a-disconnected-client.patch b/queue-4.9/mei-return-error-on-notification-request-to-a-disconnected-client.patch new file mode 100644 index 00000000000..fefcd82a35a --- /dev/null +++ b/queue-4.9/mei-return-error-on-notification-request-to-a-disconnected-client.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Alexander Usyskin +Date: Sat, 7 Oct 2017 22:36:56 +0000 +Subject: mei: return error on notification request to a disconnected client + +From: Alexander Usyskin + + +[ Upstream commit 7c47d2ca0feca767479329da23523ed798acb854 ] + +Request for a notification from a disconnected client will be ignored +silently by the FW but the caller should know that the operation hasn't +succeeded. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/mei/client.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/mei/client.c ++++ b/drivers/misc/mei/client.c +@@ -1320,6 +1320,9 @@ int mei_cl_notify_request(struct mei_cl + return -EOPNOTSUPP; + } + ++ if (!mei_cl_is_connected(cl)) ++ return -ENODEV; ++ + rets = pm_runtime_get(dev->dev); + if (rets < 0 && rets != -EINPROGRESS) { + pm_runtime_put_noidle(dev->dev); diff --git a/queue-4.9/mfd-ab8500-sysctrl-handle-probe-deferral.patch b/queue-4.9/mfd-ab8500-sysctrl-handle-probe-deferral.patch new file mode 100644 index 00000000000..9a61b5acba2 --- /dev/null +++ b/queue-4.9/mfd-ab8500-sysctrl-handle-probe-deferral.patch @@ -0,0 +1,74 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Linus Walleij +Date: Sat, 7 Oct 2017 22:36:48 +0000 +Subject: mfd: ab8500-sysctrl: Handle probe deferral + +From: Linus Walleij + + +[ Upstream commit 7e9c40c63933a643908d686bd89dfc2315e8c70a ] + +In the current boot, clients making use of the AB8500 sysctrl +may be probed before the ab8500-sysctrl driver. This gives them +-EINVAL, but should rather give -EPROBE_DEFER. + +Before this, the abx500 clock driver didn't probe properly, +and as a result the codec driver in turn using the clocks did +not probe properly. After this patch, everything probes +properly. + +Also add OF compatible-string probing. This driver is all +device tree, so let's just make a drive-by-fix of that as +well. + +Signed-off-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/ab8500-sysctrl.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +--- a/drivers/mfd/ab8500-sysctrl.c ++++ b/drivers/mfd/ab8500-sysctrl.c +@@ -98,7 +98,7 @@ int ab8500_sysctrl_read(u16 reg, u8 *val + u8 bank; + + if (sysctrl_dev == NULL) +- return -EINVAL; ++ return -EPROBE_DEFER; + + bank = (reg >> 8); + if (!valid_bank(bank)) +@@ -114,11 +114,13 @@ int ab8500_sysctrl_write(u16 reg, u8 mas + u8 bank; + + if (sysctrl_dev == NULL) +- return -EINVAL; ++ return -EPROBE_DEFER; + + bank = (reg >> 8); +- if (!valid_bank(bank)) ++ if (!valid_bank(bank)) { ++ pr_err("invalid bank\n"); + return -EINVAL; ++ } + + return abx500_mask_and_set_register_interruptible(sysctrl_dev, bank, + (u8)(reg & 0xFF), mask, value); +@@ -145,9 +147,15 @@ static int ab8500_sysctrl_remove(struct + return 0; + } + ++static const struct of_device_id ab8500_sysctrl_match[] = { ++ { .compatible = "stericsson,ab8500-sysctrl", }, ++ {} ++}; ++ + static struct platform_driver ab8500_sysctrl_driver = { + .driver = { + .name = "ab8500-sysctrl", ++ .of_match_table = ab8500_sysctrl_match, + }, + .probe = ab8500_sysctrl_probe, + .remove = ab8500_sysctrl_remove, diff --git a/queue-4.9/mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch b/queue-4.9/mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch new file mode 100644 index 00000000000..c260e77fbe5 --- /dev/null +++ b/queue-4.9/mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch @@ -0,0 +1,49 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Hans de Goede +Date: Sat, 7 Oct 2017 22:36:48 +0000 +Subject: mfd: axp20x: Fix axp288 PEK_DBR and PEK_DBF irqs being swapped + +From: Hans de Goede + + +[ Upstream commit 1af468ebe45591651ec3bafc2e9ddc6fdef70ae0 ] + +The R in PEK_DBR stands for rising, so it should be mapped to +AXP288_IRQ_POKP where the last P stands for positive edge. + +Likewise PEK_DBF should be mapped to the falling edge, aka the +_N_egative edge, so it should be mapped to AXP288_IRQ_POKN. + +This fixes the inverted powerbutton status reporting by the +axp20x-pek driver. + +Signed-off-by: Hans de Goede +Acked-by: Chen-Yu Tsai +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/axp20x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/mfd/axp20x.c ++++ b/drivers/mfd/axp20x.c +@@ -205,14 +205,14 @@ static struct resource axp22x_pek_resour + static struct resource axp288_power_button_resources[] = { + { + .name = "PEK_DBR", +- .start = AXP288_IRQ_POKN, +- .end = AXP288_IRQ_POKN, ++ .start = AXP288_IRQ_POKP, ++ .end = AXP288_IRQ_POKP, + .flags = IORESOURCE_IRQ, + }, + { + .name = "PEK_DBF", +- .start = AXP288_IRQ_POKP, +- .end = AXP288_IRQ_POKP, ++ .start = AXP288_IRQ_POKN, ++ .end = AXP288_IRQ_POKN, + .flags = IORESOURCE_IRQ, + }, + }; diff --git a/queue-4.9/mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch b/queue-4.9/mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch new file mode 100644 index 00000000000..53810ba7415 --- /dev/null +++ b/queue-4.9/mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch @@ -0,0 +1,39 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Arnd Bergmann +Date: Sat, 7 Oct 2017 22:36:47 +0000 +Subject: mmc: s3cmci: include linux/interrupt.h for tasklet_struct + +From: Arnd Bergmann + + +[ Upstream commit e1c6ec26b853e9062f0b3daaf695c546d0702953 ] + +I got this new build error on today's linux-next + +drivers/mmc/host/s3cmci.h:69:24: error: field 'pio_tasklet' has incomplete type + struct tasklet_struct pio_tasklet; +drivers/mmc/host/s3cmci.c: In function 's3cmci_enable_irq': +drivers/mmc/host/s3cmci.c:390:4: error: implicit declaration of function 'enable_irq';did you mean 'enable_imask'? [-Werror=implicit-function-declaration] + +While I haven't found out why this happened now and not earlier, the +solution is obvious, we should include the header that defines +the structure. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/host/s3cmci.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mmc/host/s3cmci.c ++++ b/drivers/mmc/host/s3cmci.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include + diff --git a/queue-4.9/mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch b/queue-4.9/mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch new file mode 100644 index 00000000000..6bcafbddd97 --- /dev/null +++ b/queue-4.9/mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch @@ -0,0 +1,33 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Boris Brezillon +Date: Sat, 7 Oct 2017 22:36:52 +0000 +Subject: mtd: nand: sunxi: Fix the non-polling case in sunxi_nfc_wait_events() + +From: Boris Brezillon + + +[ Upstream commit 19649e2c16fbc94b664f7074ec4fa9f15292fdce ] + +wait_for_completion_timeout() returns 0 if a timeout occurred, 1 +otherwise. Fix the sunxi_nfc_wait_events() accordingly. + +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/sunxi_nand.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/mtd/nand/sunxi_nand.c ++++ b/drivers/mtd/nand/sunxi_nand.c +@@ -320,6 +320,10 @@ static int sunxi_nfc_wait_events(struct + + ret = wait_for_completion_timeout(&nfc->complete, + msecs_to_jiffies(timeout_ms)); ++ if (!ret) ++ ret = -ETIMEDOUT; ++ else ++ ret = 0; + + writel(0, nfc->regs + NFC_REG_INT); + } else { diff --git a/queue-4.9/net-ena-change-driver-s-default-timeouts.patch b/queue-4.9/net-ena-change-driver-s-default-timeouts.patch new file mode 100644 index 00000000000..10f74725496 --- /dev/null +++ b/queue-4.9/net-ena-change-driver-s-default-timeouts.patch @@ -0,0 +1,58 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Netanel Belgazal +Date: Sat, 7 Oct 2017 22:36:50 +0000 +Subject: net/ena: change driver's default timeouts + +From: Netanel Belgazal + + +[ Upstream commit 7102a18ac3f323805e3cd8f3dc64907644608c1e ] + +The timeouts were too agressive and sometimes cause false alarms. + +Signed-off-by: Netanel Belgazal +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/amazon/ena/ena_com.c | 4 ++-- + drivers/net/ethernet/amazon/ena/ena_netdev.h | 6 +++--- + 2 files changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -36,9 +36,9 @@ + /*****************************************************************************/ + + /* Timeout in micro-sec */ +-#define ADMIN_CMD_TIMEOUT_US (1000000) ++#define ADMIN_CMD_TIMEOUT_US (3000000) + +-#define ENA_ASYNC_QUEUE_DEPTH 4 ++#define ENA_ASYNC_QUEUE_DEPTH 16 + #define ENA_ADMIN_QUEUE_DEPTH 32 + + #define MIN_ENA_VER (((ENA_COMMON_SPEC_VERSION_MAJOR) << \ +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.h ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.h +@@ -100,7 +100,7 @@ + /* Number of queues to check for missing queues per timer service */ + #define ENA_MONITORED_TX_QUEUES 4 + /* Max timeout packets before device reset */ +-#define MAX_NUM_OF_TIMEOUTED_PACKETS 32 ++#define MAX_NUM_OF_TIMEOUTED_PACKETS 128 + + #define ENA_TX_RING_IDX_NEXT(idx, ring_size) (((idx) + 1) & ((ring_size) - 1)) + +@@ -116,9 +116,9 @@ + #define ENA_IO_IRQ_IDX(q) (ENA_IO_IRQ_FIRST_IDX + (q)) + + /* ENA device should send keep alive msg every 1 sec. +- * We wait for 3 sec just to be on the safe side. ++ * We wait for 6 sec just to be on the safe side. + */ +-#define ENA_DEVICE_KALIVE_TIMEOUT (3 * HZ) ++#define ENA_DEVICE_KALIVE_TIMEOUT (6 * HZ) + + #define ENA_MMIO_DISABLE_REG_READ BIT(0) + diff --git a/queue-4.9/net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch b/queue-4.9/net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch new file mode 100644 index 00000000000..18b8823b9cf --- /dev/null +++ b/queue-4.9/net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch @@ -0,0 +1,36 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Russell King +Date: Sat, 7 Oct 2017 22:36:49 +0000 +Subject: net: mvneta: fix build errors when linux/phy*.h is removed from net/dsa.h + +From: Russell King + + +[ Upstream commit 9303ab2b3402b60f6c39abfdbfa4ce00fce8bee4 ] + +drivers/net/ethernet/marvell/mvneta.c:2694:26: error: storage size of 'status' isn't known +drivers/net/ethernet/marvell/mvneta.c:2695:26: error: storage size of 'changed' isn't known +drivers/net/ethernet/marvell/mvneta.c:2695:9: error: variable 'changed' has initializer but incomplete type +drivers/net/ethernet/marvell/mvneta.c:2709:2: error: implicit declaration of function 'fixed_phy_update_state' [-Werror=implicit-function-declaration] + +Add linux/phy_fixed.h to mvneta.c + +Signed-off-by: Russell King +Acked-by: Thomas Petazzoni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvneta.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + #include diff --git a/queue-4.9/net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch b/queue-4.9/net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch new file mode 100644 index 00000000000..db7229ee40c --- /dev/null +++ b/queue-4.9/net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch @@ -0,0 +1,93 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Lukasz Majewski +Date: Sat, 7 Oct 2017 22:36:51 +0000 +Subject: net: phy: dp83867: Recover from "port mirroring" N/A MODE4 + +From: Lukasz Majewski + + +[ Upstream commit ac6e058b75be71208e98a5808453aae9a17be480 ] + +The DP83867 when not properly bootstrapped - especially with LED_0 pin - +can enter N/A MODE4 for "port mirroring" feature. + +To provide normal operation of the PHY, one needs not only to explicitly +disable the port mirroring feature, but as well stop some IC internal +testing (which disables RGMII communication). + +To do that the STRAP_STS1 (0x006E) register must be read and RESERVED bit +11 examined. When it is set, the another RESERVED bit (11) at PHYCR +(0x0010) register must be clear to disable testing mode and enable RGMII +communication. + +Thorough explanation of the problem can be found at following e2e thread: +"DP83867IR: Problem with RESERVED bits in PHY Control Register (PHYCR) - +Linux driver" + +https://e2e.ti.com/support/interface/ethernet/f/903/p/571313/2096954#2096954 + +Signed-off-by: Lukasz Majewski +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/phy/dp83867.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -33,6 +33,7 @@ + + /* Extended Registers */ + #define DP83867_RGMIICTL 0x0032 ++#define DP83867_STRAP_STS1 0x006E + #define DP83867_RGMIIDCTL 0x0086 + + #define DP83867_SW_RESET BIT(15) +@@ -56,9 +57,13 @@ + #define DP83867_RGMII_TX_CLK_DELAY_EN BIT(1) + #define DP83867_RGMII_RX_CLK_DELAY_EN BIT(0) + ++/* STRAP_STS1 bits */ ++#define DP83867_STRAP_STS1_RESERVED BIT(11) ++ + /* PHY CTRL bits */ + #define DP83867_PHYCR_FIFO_DEPTH_SHIFT 14 + #define DP83867_PHYCR_FIFO_DEPTH_MASK (3 << 14) ++#define DP83867_PHYCR_RESERVED_MASK BIT(11) + + /* RGMIIDCTL bits */ + #define DP83867_RGMII_TX_CLK_DELAY_SHIFT 4 +@@ -141,7 +146,7 @@ static int dp83867_of_init(struct phy_de + static int dp83867_config_init(struct phy_device *phydev) + { + struct dp83867_private *dp83867; +- int ret, val; ++ int ret, val, bs; + u16 delay; + + if (!phydev->priv) { +@@ -164,6 +169,22 @@ static int dp83867_config_init(struct ph + return val; + val &= ~DP83867_PHYCR_FIFO_DEPTH_MASK; + val |= (dp83867->fifo_depth << DP83867_PHYCR_FIFO_DEPTH_SHIFT); ++ ++ /* The code below checks if "port mirroring" N/A MODE4 has been ++ * enabled during power on bootstrap. ++ * ++ * Such N/A mode enabled by mistake can put PHY IC in some ++ * internal testing mode and disable RGMII transmission. ++ * ++ * In this particular case one needs to check STRAP_STS1 ++ * register's bit 11 (marked as RESERVED). ++ */ ++ ++ bs = phy_read_mmd_indirect(phydev, DP83867_STRAP_STS1, ++ DP83867_DEVADDR); ++ if (bs & DP83867_STRAP_STS1_RESERVED) ++ val &= ~DP83867_PHYCR_RESERVED_MASK; ++ + ret = phy_write(phydev, MII_DP83867_PHYCTRL, val); + if (ret) + return ret; diff --git a/queue-4.9/pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch b/queue-4.9/pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch new file mode 100644 index 00000000000..f3004c5dcb1 --- /dev/null +++ b/queue-4.9/pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch @@ -0,0 +1,43 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Bjorn Helgaas +Date: Sat, 7 Oct 2017 22:37:34 +0000 +Subject: PCI: Avoid possible deadlock on pci_lock and p->pi_lock + +From: Bjorn Helgaas + + +[ Upstream commit cdcb33f9824429a926b971bf041a6cec238f91ff ] + +pci_lock is an IRQ-safe spinlock that protects all accesses to PCI +configuration space (see PCI_OP_READ() and PCI_OP_WRITE() in pci/access.c). + +The pci_cfg_access_unlock() path acquires pci_lock, then p->pi_lock (inside +wake_up_all()). According to lockdep, there is a possible path involving +snbep_uncore_pci_read_counter() that could acquire them in the reverse +order: acquiring p->pi_lock, then pci_lock, which could result in a +deadlock. Lockdep details are in the bugzilla below. + +Avoid the possible deadlock by dropping pci_lock before waking up any +config access waiters. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=192901 +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/access.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -672,8 +672,9 @@ void pci_cfg_access_unlock(struct pci_de + WARN_ON(!dev->block_cfg_access); + + dev->block_cfg_access = 0; +- wake_up_all(&pci_cfg_wait); + raw_spin_unlock_irqrestore(&pci_lock, flags); ++ ++ wake_up_all(&pci_cfg_wait); + } + EXPORT_SYMBOL_GPL(pci_cfg_access_unlock); + diff --git a/queue-4.9/pci-msi-return-failure-when-msix_setup_entries-fails.patch b/queue-4.9/pci-msi-return-failure-when-msix_setup_entries-fails.patch new file mode 100644 index 00000000000..50ee3542959 --- /dev/null +++ b/queue-4.9/pci-msi-return-failure-when-msix_setup_entries-fails.patch @@ -0,0 +1,35 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Christophe JAILLET +Date: Sat, 7 Oct 2017 22:36:49 +0000 +Subject: PCI/MSI: Return failure when msix_setup_entries() fails + +From: Christophe JAILLET + + +[ Upstream commit 3adfb572f2978a980b250a9e1a56f84f3a031001 ] + +If alloc_msi_entry() fails, we free resources and set ret = -ENOMEM. + +However, msix_setup_entries() returns 0 unconditionally. Return the error +code instead. + +Fixes: e75eafb9b039 ("genirq/msi: Switch to new irq spreading infrastructure") +Signed-off-by: Christophe JAILLET +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/msi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pci/msi.c ++++ b/drivers/pci/msi.c +@@ -730,7 +730,7 @@ static int msix_setup_entries(struct pci + ret = 0; + out: + kfree(masks); +- return 0; ++ return ret; + } + + static void msix_program_entries(struct pci_dev *dev, diff --git a/queue-4.9/perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch b/queue-4.9/perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch new file mode 100644 index 00000000000..d273b69b389 --- /dev/null +++ b/queue-4.9/perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch @@ -0,0 +1,38 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Taeung Song +Date: Sat, 7 Oct 2017 22:36:50 +0000 +Subject: perf tools: Only increase index if perf_evsel__new_idx() succeeds + +From: Taeung Song + + +[ Upstream commit 75fc5ae5cc53fff71041ecadeb3354a2b4c9fe42 ] + +Signed-off-by: Taeung Song +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Wang Nan +Link: http://lkml.kernel.org/r/1485952447-7013-2-git-send-email-treeze.taeung@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/parse-events.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -309,10 +309,11 @@ __add_event(struct list_head *list, int + + event_attr_init(attr); + +- evsel = perf_evsel__new_idx(attr, (*idx)++); ++ evsel = perf_evsel__new_idx(attr, *idx); + if (!evsel) + return NULL; + ++ (*idx)++; + evsel->cpus = cpu_map__get(cpus); + evsel->own_cpus = cpu_map__get(cpus); + diff --git a/queue-4.9/platform-x86-intel_mid_thermal-fix-module-autoload.patch b/queue-4.9/platform-x86-intel_mid_thermal-fix-module-autoload.patch new file mode 100644 index 00000000000..7c1303c6fb1 --- /dev/null +++ b/queue-4.9/platform-x86-intel_mid_thermal-fix-module-autoload.patch @@ -0,0 +1,44 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Javier Martinez Canillas +Date: Sat, 7 Oct 2017 22:36:54 +0000 +Subject: platform/x86: intel_mid_thermal: Fix module autoload + +From: Javier Martinez Canillas + + +[ Upstream commit a93151a72061e944a4915458b1b1d6d505c03bbf ] + +If the driver is built as a module, autoload won't work because the module +alias information is not filled. So user-space can't match the registered +device with the corresponding module. + +Export the module alias information using the MODULE_DEVICE_TABLE() macro. + +Before this patch: + +$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias +$ + +After this patch: + +$ modinfo drivers/platform/x86/intel_mid_thermal.ko | grep alias +alias: platform:msic_thermal + +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/platform/x86/intel_mid_thermal.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/platform/x86/intel_mid_thermal.c ++++ b/drivers/platform/x86/intel_mid_thermal.c +@@ -550,6 +550,7 @@ static const struct platform_device_id t + { "msic_thermal", 1 }, + { } + }; ++MODULE_DEVICE_TABLE(platform, therm_id_table); + + static struct platform_driver mid_thermal_driver = { + .driver = { diff --git a/queue-4.9/pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch b/queue-4.9/pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch new file mode 100644 index 00000000000..1eab822fe28 --- /dev/null +++ b/queue-4.9/pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch @@ -0,0 +1,65 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Grygorii Strashko +Date: Sat, 7 Oct 2017 22:36:47 +0000 +Subject: PM / wakeirq: report a wakeup_event on dedicated wekup irq + +From: Grygorii Strashko + + +[ Upstream commit 09bb6e93956ae5175b96905b723ec879c3ca0765 ] + +There are two reasons for reporting wakeup event when dedicated wakeup +IRQ is triggered: + +- wakeup events accounting, so proper statistical data will be + displayed in sysfs and debugfs; + +- there are small window when System is entering suspend during which + dedicated wakeup IRQ can be lost: + +dpm_suspend_noirq() + |- device_wakeup_arm_wake_irqs() + |- dev_pm_arm_wake_irq(X) + |- IRQ is enabled and marked as wakeup source +[1]... + |- suspend_device_irqs() + |- suspend_device_irq(X) + |- irqd_set(X, IRQD_WAKEUP_ARMED); + |- wakup IRQ armed + +The wakeup IRQ can be lost if it's triggered at point [1] +and not armed yet. + +Hence, fix above cases by adding simple pm_wakeup_event() call in +handle_threaded_wake_irq(). + +Fixes: 4990d4fe327b (PM / Wakeirq: Add automated device wake IRQ handling) +Signed-off-by: Grygorii Strashko +Tested-by: Keerthy +[ tony@atomide.com: added missing return to avoid warnings ] +Tested-by: Tony Lindgren +Signed-off-by: Tony Lindgren +Signed-off-by: Rafael J. Wysocki + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/wakeirq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -141,6 +141,13 @@ static irqreturn_t handle_threaded_wake_ + struct wake_irq *wirq = _wirq; + int res; + ++ /* Maybe abort suspend? */ ++ if (irqd_is_wakeup_set(irq_get_irq_data(irq))) { ++ pm_wakeup_event(wirq->dev, 0); ++ ++ return IRQ_HANDLED; ++ } ++ + /* We don't want RPM_ASYNC or RPM_NOWAIT here */ + res = pm_runtime_resume(wirq->dev); + if (res < 0) diff --git a/queue-4.9/powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch b/queue-4.9/powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch new file mode 100644 index 00000000000..e083c813331 --- /dev/null +++ b/queue-4.9/powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch @@ -0,0 +1,99 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Paul Mackerras +Date: Mon, 30 Jan 2017 21:21:34 +1100 +Subject: powerpc/64: Don't try to use radix MMU under a hypervisor + +From: Paul Mackerras + + +[ Upstream commit 18569c1f134e1c5c88228f043c09678ae6052b7c ] + +Currently, if the kernel is running on a POWER9 processor under a +hypervisor, it will try to use the radix MMU even though it doesn't have +the necessary code to use radix under a hypervisor (it doesn't negotiate +use of radix, and it doesn't do the H_REGISTER_PROC_TBL hcall). The +result is that the guest kernel will crash when it tries to turn on the +MMU. + +This fixes it by looking for the /chosen/ibm,architecture-vec-5 +property, and if it exists, clears the radix MMU feature bit, before we +decide whether to initialize for radix or HPT. This property is created +by the hypervisor as a result of the guest calling the +ibm,client-architecture-support method to indicate its capabilities, so +it will indicate whether the hypervisor agreed to us using radix. + +Systems without a hypervisor may have this property also (for example, +skiboot creates it), so we check the HV bit in the MSR to see whether we +are running as a guest or not. If we are in hypervisor mode, then we can +do whatever we like including using the radix MMU. + +The reason for using this property is that in future, when we have +support for using radix under a hypervisor, we will need to check this +property to see whether the hypervisor agreed to us using radix. + +Fixes: 2bfd65e45e87 ("powerpc/mm/radix: Add radix callbacks for early init routines") +Cc: stable@vger.kernel.org # v4.7+ +Signed-off-by: Paul Mackerras +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/mm/init_64.c | 33 +++++++++++++++++++++++++++++++++ + 1 file changed, 33 insertions(+) + +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -42,6 +42,8 @@ + #include + #include + #include ++#include ++#include + + #include + #include +@@ -421,6 +423,28 @@ static int __init parse_disable_radix(ch + } + early_param("disable_radix", parse_disable_radix); + ++/* ++ * If we're running under a hypervisor, we currently can't do radix ++ * since we don't have the code to do the H_REGISTER_PROC_TBL hcall. ++ * We tell that we're running under a hypervisor by looking for the ++ * /chosen/ibm,architecture-vec-5 property. ++ */ ++static void early_check_vec5(void) ++{ ++ unsigned long root, chosen; ++ int size; ++ const u8 *vec5; ++ ++ root = of_get_flat_dt_root(); ++ chosen = of_get_flat_dt_subnode_by_name(root, "chosen"); ++ if (chosen == -FDT_ERR_NOTFOUND) ++ return; ++ vec5 = of_get_flat_dt_prop(chosen, "ibm,architecture-vec-5", &size); ++ if (!vec5) ++ return; ++ cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX; ++} ++ + void __init mmu_early_init_devtree(void) + { + /* Disable radix mode based on kernel command line. */ +@@ -428,6 +452,15 @@ void __init mmu_early_init_devtree(void) + if (disable_radix || !(mfmsr() & MSR_HV)) + cur_cpu_spec->mmu_features &= ~MMU_FTR_TYPE_RADIX; + ++ /* ++ * Check /chosen/ibm,architecture-vec-5 if running as a guest. ++ * When running bare-metal, we can use radix if we like ++ * even though the ibm,architecture-vec-5 property created by ++ * skiboot doesn't have the necessary bits set. ++ */ ++ if (early_radix_enabled() && !(mfmsr() & MSR_HV)) ++ early_check_vec5(); ++ + if (early_radix_enabled()) + radix__early_init_devtree(); + else diff --git a/queue-4.9/s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch b/queue-4.9/s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch new file mode 100644 index 00000000000..fa4a8c3366b --- /dev/null +++ b/queue-4.9/s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch @@ -0,0 +1,45 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Harald Freudenberger +Date: Sat, 7 Oct 2017 22:36:57 +0000 +Subject: s390/crypto: Extend key length check for AES-XTS in fips mode. + +From: Harald Freudenberger + + +[ Upstream commit a4f2779ecf2f42b0997fedef6fd20a931c40a3e3 ] + +In fips mode only xts keys with 128 bit or 125 bit are allowed. +This fix extends the xts_aes_set_key function to check for these +valid key lengths in fips mode. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/crypto/aes_s390.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +--- a/arch/s390/crypto/aes_s390.c ++++ b/arch/s390/crypto/aes_s390.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -501,6 +502,12 @@ static int xts_aes_set_key(struct crypto + if (err) + return err; + ++ /* In fips mode only 128 bit or 256 bit keys are valid */ ++ if (fips_enabled && key_len != 32 && key_len != 64) { ++ tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; ++ return -EINVAL; ++ } ++ + /* Pick the correct function code based on the key length */ + fc = (key_len == 32) ? CPACF_KM_XTS_128 : + (key_len == 64) ? CPACF_KM_XTS_256 : 0; diff --git a/queue-4.9/s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch b/queue-4.9/s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch new file mode 100644 index 00000000000..6c7c3f88eb6 --- /dev/null +++ b/queue-4.9/s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch @@ -0,0 +1,37 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Stefan Haberland +Date: Sat, 7 Oct 2017 22:36:56 +0000 +Subject: s390/dasd: check for device error pointer within state change interrupts + +From: Stefan Haberland + + +[ Upstream commit 2202134e48a3b50320aeb9e3dd1186833e9d7e66 ] + +Check if the device pointer is valid. Just a sanity check since we already +are in the int handler of the device. + +Signed-off-by: Stefan Haberland +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/block/dasd.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -1704,8 +1704,11 @@ void dasd_int_handler(struct ccw_device + /* check for for attention message */ + if (scsw_dstat(&irb->scsw) & DEV_STAT_ATTENTION) { + device = dasd_device_from_cdev_locked(cdev); +- device->discipline->check_attention(device, irb->esw.esw1.lpum); +- dasd_put_device(device); ++ if (!IS_ERR(device)) { ++ device->discipline->check_attention(device, ++ irb->esw.esw1.lpum); ++ dasd_put_device(device); ++ } + } + + if (!cqr) diff --git a/queue-4.9/s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch b/queue-4.9/s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch new file mode 100644 index 00000000000..0087b6250b1 --- /dev/null +++ b/queue-4.9/s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch @@ -0,0 +1,129 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Harald Freudenberger +Date: Sat, 7 Oct 2017 22:36:57 +0000 +Subject: s390/prng: Adjust generation of entropy to produce real 256 bits. + +From: Harald Freudenberger + + +[ Upstream commit d34b1acb78af41b8b8d5c60972b6555ea19f7564 ] + +The generate_entropy function used a sha256 for compacting +together 256 bits of entropy into 32 bytes hash. However, it +is questionable if a sha256 can really be used here, as +potential collisions may reduce the max entropy fitting into +a 32 byte hash value. So this batch introduces the use of +sha512 instead and the required buffer adjustments for the +calling functions. + +Further more the working buffer for the generate_entropy +function has been widened from one page to two pages. So now +1024 stckf invocations are used to gather 256 bits of +entropy. This has been done to be on the save side if the +jitters of stckf values isn't as good as supposed. + +Signed-off-by: Harald Freudenberger +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/crypto/prng.c | 40 ++++++++++++++++++++++++---------------- + 1 file changed, 24 insertions(+), 16 deletions(-) + +--- a/arch/s390/crypto/prng.c ++++ b/arch/s390/crypto/prng.c +@@ -110,22 +110,30 @@ static const u8 initial_parm_block[32] _ + + /*** helper functions ***/ + ++/* ++ * generate_entropy: ++ * This algorithm produces 64 bytes of entropy data based on 1024 ++ * individual stckf() invocations assuming that each stckf() value ++ * contributes 0.25 bits of entropy. So the caller gets 256 bit ++ * entropy per 64 byte or 4 bits entropy per byte. ++ */ + static int generate_entropy(u8 *ebuf, size_t nbytes) + { + int n, ret = 0; +- u8 *pg, *h, hash[32]; ++ u8 *pg, *h, hash[64]; + +- pg = (u8 *) __get_free_page(GFP_KERNEL); ++ /* allocate 2 pages */ ++ pg = (u8 *) __get_free_pages(GFP_KERNEL, 1); + if (!pg) { + prng_errorflag = PRNG_GEN_ENTROPY_FAILED; + return -ENOMEM; + } + + while (nbytes) { +- /* fill page with urandom bytes */ +- get_random_bytes(pg, PAGE_SIZE); +- /* exor page with stckf values */ +- for (n = 0; n < PAGE_SIZE / sizeof(u64); n++) { ++ /* fill pages with urandom bytes */ ++ get_random_bytes(pg, 2*PAGE_SIZE); ++ /* exor pages with 1024 stckf values */ ++ for (n = 0; n < 2 * PAGE_SIZE / sizeof(u64); n++) { + u64 *p = ((u64 *)pg) + n; + *p ^= get_tod_clock_fast(); + } +@@ -134,8 +142,8 @@ static int generate_entropy(u8 *ebuf, si + h = hash; + else + h = ebuf; +- /* generate sha256 from this page */ +- cpacf_kimd(CPACF_KIMD_SHA_256, h, pg, PAGE_SIZE); ++ /* hash over the filled pages */ ++ cpacf_kimd(CPACF_KIMD_SHA_512, h, pg, 2*PAGE_SIZE); + if (n < sizeof(hash)) + memcpy(ebuf, hash, n); + ret += n; +@@ -143,7 +151,7 @@ static int generate_entropy(u8 *ebuf, si + nbytes -= n; + } + +- free_page((unsigned long)pg); ++ free_pages((unsigned long)pg, 1); + return ret; + } + +@@ -334,7 +342,7 @@ static int __init prng_sha512_selftest(v + static int __init prng_sha512_instantiate(void) + { + int ret, datalen; +- u8 seed[64]; ++ u8 seed[64 + 32 + 16]; + + pr_debug("prng runs in SHA-512 mode " + "with chunksize=%d and reseed_limit=%u\n", +@@ -357,12 +365,12 @@ static int __init prng_sha512_instantiat + if (ret) + goto outfree; + +- /* generate initial seed bytestring, first 48 bytes of entropy */ +- ret = generate_entropy(seed, 48); +- if (ret != 48) ++ /* generate initial seed bytestring, with 256 + 128 bits entropy */ ++ ret = generate_entropy(seed, 64 + 32); ++ if (ret != 64 + 32) + goto outfree; + /* followed by 16 bytes of unique nonce */ +- get_tod_clock_ext(seed + 48); ++ get_tod_clock_ext(seed + 64 + 32); + + /* initial seed of the ppno drng */ + cpacf_ppno(CPACF_PPNO_SHA512_DRNG_SEED, +@@ -395,9 +403,9 @@ static void prng_sha512_deinstantiate(vo + static int prng_sha512_reseed(void) + { + int ret; +- u8 seed[32]; ++ u8 seed[64]; + +- /* generate 32 bytes of fresh entropy */ ++ /* fetch 256 bits of fresh entropy */ + ret = generate_entropy(seed, sizeof(seed)); + if (ret != sizeof(seed)) + return ret; diff --git a/queue-4.9/scsi-aacraid-process-error-for-response-i-o.patch b/queue-4.9/scsi-aacraid-process-error-for-response-i-o.patch new file mode 100644 index 00000000000..519181fa0e2 --- /dev/null +++ b/queue-4.9/scsi-aacraid-process-error-for-response-i-o.patch @@ -0,0 +1,353 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Raghava Aditya Renukunta +Date: Sat, 7 Oct 2017 22:36:53 +0000 +Subject: scsi: aacraid: Process Error for response I/O + +From: Raghava Aditya Renukunta + + +[ Upstream commit 4ec57fb4edaec523f0f78a0449a3b063749ac58b ] + +Make sure that the driver processes error conditions even in the fast +response path for response from the adapter. + +Signed-off-by: Raghava Aditya Renukunta +Signed-off-by: Dave Carroll +Reviewed-by: Johannes Thumshirn +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/aacraid/aachba.c | 291 +++++++++++++++++++++--------------------- + 1 file changed, 152 insertions(+), 139 deletions(-) + +--- a/drivers/scsi/aacraid/aachba.c ++++ b/drivers/scsi/aacraid/aachba.c +@@ -2954,16 +2954,11 @@ static void aac_srb_callback(void *conte + return; + + BUG_ON(fibptr == NULL); +- dev = fibptr->dev; +- +- scsi_dma_unmap(scsicmd); + +- /* expose physical device if expose_physicald flag is on */ +- if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01) +- && expose_physicals > 0) +- aac_expose_phy_device(scsicmd); ++ dev = fibptr->dev; + + srbreply = (struct aac_srb_reply *) fib_data(fibptr); ++ + scsicmd->sense_buffer[0] = '\0'; /* Initialize sense valid flag to false */ + + if (fibptr->flags & FIB_CONTEXT_FLAG_FASTRESP) { +@@ -2976,158 +2971,176 @@ static void aac_srb_callback(void *conte + */ + scsi_set_resid(scsicmd, scsi_bufflen(scsicmd) + - le32_to_cpu(srbreply->data_xfer_length)); +- /* +- * First check the fib status +- */ ++ } + +- if (le32_to_cpu(srbreply->status) != ST_OK) { +- int len; + +- printk(KERN_WARNING "aac_srb_callback: srb failed, status = %d\n", le32_to_cpu(srbreply->status)); +- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), +- SCSI_SENSE_BUFFERSIZE); +- scsicmd->result = DID_ERROR << 16 +- | COMMAND_COMPLETE << 8 +- | SAM_STAT_CHECK_CONDITION; +- memcpy(scsicmd->sense_buffer, +- srbreply->sense_data, len); +- } ++ scsi_dma_unmap(scsicmd); + +- /* +- * Next check the srb status +- */ +- switch ((le32_to_cpu(srbreply->srb_status))&0x3f) { +- case SRB_STATUS_ERROR_RECOVERY: +- case SRB_STATUS_PENDING: +- case SRB_STATUS_SUCCESS: +- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; +- break; +- case SRB_STATUS_DATA_OVERRUN: +- switch (scsicmd->cmnd[0]) { +- case READ_6: +- case WRITE_6: +- case READ_10: +- case WRITE_10: +- case READ_12: +- case WRITE_12: +- case READ_16: +- case WRITE_16: +- if (le32_to_cpu(srbreply->data_xfer_length) +- < scsicmd->underflow) +- printk(KERN_WARNING"aacraid: SCSI CMD underflow\n"); +- else +- printk(KERN_WARNING"aacraid: SCSI CMD Data Overrun\n"); +- scsicmd->result = DID_ERROR << 16 +- | COMMAND_COMPLETE << 8; +- break; +- case INQUIRY: { +- scsicmd->result = DID_OK << 16 +- | COMMAND_COMPLETE << 8; +- break; +- } +- default: +- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; +- break; +- } +- break; +- case SRB_STATUS_ABORTED: +- scsicmd->result = DID_ABORT << 16 | ABORT << 8; +- break; +- case SRB_STATUS_ABORT_FAILED: +- /* +- * Not sure about this one - but assuming the +- * hba was trying to abort for some reason +- */ +- scsicmd->result = DID_ERROR << 16 | ABORT << 8; +- break; +- case SRB_STATUS_PARITY_ERROR: +- scsicmd->result = DID_PARITY << 16 +- | MSG_PARITY_ERROR << 8; +- break; +- case SRB_STATUS_NO_DEVICE: +- case SRB_STATUS_INVALID_PATH_ID: +- case SRB_STATUS_INVALID_TARGET_ID: +- case SRB_STATUS_INVALID_LUN: +- case SRB_STATUS_SELECTION_TIMEOUT: +- scsicmd->result = DID_NO_CONNECT << 16 +- | COMMAND_COMPLETE << 8; +- break; ++ /* expose physical device if expose_physicald flag is on */ ++ if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01) ++ && expose_physicals > 0) ++ aac_expose_phy_device(scsicmd); + +- case SRB_STATUS_COMMAND_TIMEOUT: +- case SRB_STATUS_TIMEOUT: +- scsicmd->result = DID_TIME_OUT << 16 +- | COMMAND_COMPLETE << 8; +- break; ++ /* ++ * First check the fib status ++ */ + +- case SRB_STATUS_BUSY: +- scsicmd->result = DID_BUS_BUSY << 16 +- | COMMAND_COMPLETE << 8; +- break; ++ if (le32_to_cpu(srbreply->status) != ST_OK) { ++ int len; + +- case SRB_STATUS_BUS_RESET: +- scsicmd->result = DID_RESET << 16 +- | COMMAND_COMPLETE << 8; +- break; ++ pr_warn("aac_srb_callback: srb failed, status = %d\n", ++ le32_to_cpu(srbreply->status)); ++ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), ++ SCSI_SENSE_BUFFERSIZE); ++ scsicmd->result = DID_ERROR << 16 ++ | COMMAND_COMPLETE << 8 ++ | SAM_STAT_CHECK_CONDITION; ++ memcpy(scsicmd->sense_buffer, ++ srbreply->sense_data, len); ++ } + +- case SRB_STATUS_MESSAGE_REJECTED: ++ /* ++ * Next check the srb status ++ */ ++ switch ((le32_to_cpu(srbreply->srb_status))&0x3f) { ++ case SRB_STATUS_ERROR_RECOVERY: ++ case SRB_STATUS_PENDING: ++ case SRB_STATUS_SUCCESS: ++ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; ++ break; ++ case SRB_STATUS_DATA_OVERRUN: ++ switch (scsicmd->cmnd[0]) { ++ case READ_6: ++ case WRITE_6: ++ case READ_10: ++ case WRITE_10: ++ case READ_12: ++ case WRITE_12: ++ case READ_16: ++ case WRITE_16: ++ if (le32_to_cpu(srbreply->data_xfer_length) ++ < scsicmd->underflow) ++ pr_warn("aacraid: SCSI CMD underflow\n"); ++ else ++ pr_warn("aacraid: SCSI CMD Data Overrun\n"); + scsicmd->result = DID_ERROR << 16 +- | MESSAGE_REJECT << 8; ++ | COMMAND_COMPLETE << 8; ++ break; ++ case INQUIRY: ++ scsicmd->result = DID_OK << 16 ++ | COMMAND_COMPLETE << 8; + break; +- case SRB_STATUS_REQUEST_FLUSHED: +- case SRB_STATUS_ERROR: +- case SRB_STATUS_INVALID_REQUEST: +- case SRB_STATUS_REQUEST_SENSE_FAILED: +- case SRB_STATUS_NO_HBA: +- case SRB_STATUS_UNEXPECTED_BUS_FREE: +- case SRB_STATUS_PHASE_SEQUENCE_FAILURE: +- case SRB_STATUS_BAD_SRB_BLOCK_LENGTH: +- case SRB_STATUS_DELAYED_RETRY: +- case SRB_STATUS_BAD_FUNCTION: +- case SRB_STATUS_NOT_STARTED: +- case SRB_STATUS_NOT_IN_USE: +- case SRB_STATUS_FORCE_ABORT: +- case SRB_STATUS_DOMAIN_VALIDATION_FAIL: + default: ++ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; ++ break; ++ } ++ break; ++ case SRB_STATUS_ABORTED: ++ scsicmd->result = DID_ABORT << 16 | ABORT << 8; ++ break; ++ case SRB_STATUS_ABORT_FAILED: ++ /* ++ * Not sure about this one - but assuming the ++ * hba was trying to abort for some reason ++ */ ++ scsicmd->result = DID_ERROR << 16 | ABORT << 8; ++ break; ++ case SRB_STATUS_PARITY_ERROR: ++ scsicmd->result = DID_PARITY << 16 ++ | MSG_PARITY_ERROR << 8; ++ break; ++ case SRB_STATUS_NO_DEVICE: ++ case SRB_STATUS_INVALID_PATH_ID: ++ case SRB_STATUS_INVALID_TARGET_ID: ++ case SRB_STATUS_INVALID_LUN: ++ case SRB_STATUS_SELECTION_TIMEOUT: ++ scsicmd->result = DID_NO_CONNECT << 16 ++ | COMMAND_COMPLETE << 8; ++ break; ++ ++ case SRB_STATUS_COMMAND_TIMEOUT: ++ case SRB_STATUS_TIMEOUT: ++ scsicmd->result = DID_TIME_OUT << 16 ++ | COMMAND_COMPLETE << 8; ++ break; ++ ++ case SRB_STATUS_BUSY: ++ scsicmd->result = DID_BUS_BUSY << 16 ++ | COMMAND_COMPLETE << 8; ++ break; ++ ++ case SRB_STATUS_BUS_RESET: ++ scsicmd->result = DID_RESET << 16 ++ | COMMAND_COMPLETE << 8; ++ break; ++ ++ case SRB_STATUS_MESSAGE_REJECTED: ++ scsicmd->result = DID_ERROR << 16 ++ | MESSAGE_REJECT << 8; ++ break; ++ case SRB_STATUS_REQUEST_FLUSHED: ++ case SRB_STATUS_ERROR: ++ case SRB_STATUS_INVALID_REQUEST: ++ case SRB_STATUS_REQUEST_SENSE_FAILED: ++ case SRB_STATUS_NO_HBA: ++ case SRB_STATUS_UNEXPECTED_BUS_FREE: ++ case SRB_STATUS_PHASE_SEQUENCE_FAILURE: ++ case SRB_STATUS_BAD_SRB_BLOCK_LENGTH: ++ case SRB_STATUS_DELAYED_RETRY: ++ case SRB_STATUS_BAD_FUNCTION: ++ case SRB_STATUS_NOT_STARTED: ++ case SRB_STATUS_NOT_IN_USE: ++ case SRB_STATUS_FORCE_ABORT: ++ case SRB_STATUS_DOMAIN_VALIDATION_FAIL: ++ default: + #ifdef AAC_DETAILED_STATUS_INFO +- printk(KERN_INFO "aacraid: SRB ERROR(%u) %s scsi cmd 0x%x - scsi status 0x%x\n", +- le32_to_cpu(srbreply->srb_status) & 0x3F, +- aac_get_status_string( +- le32_to_cpu(srbreply->srb_status) & 0x3F), +- scsicmd->cmnd[0], +- le32_to_cpu(srbreply->scsi_status)); ++ pr_info("aacraid: SRB ERROR(%u) %s scsi cmd 0x%x -scsi status 0x%x\n", ++ le32_to_cpu(srbreply->srb_status) & 0x3F, ++ aac_get_status_string( ++ le32_to_cpu(srbreply->srb_status) & 0x3F), ++ scsicmd->cmnd[0], ++ le32_to_cpu(srbreply->scsi_status)); + #endif +- if ((scsicmd->cmnd[0] == ATA_12) +- || (scsicmd->cmnd[0] == ATA_16)) { +- if (scsicmd->cmnd[2] & (0x01 << 5)) { +- scsicmd->result = DID_OK << 16 +- | COMMAND_COMPLETE << 8; +- break; +- } else { +- scsicmd->result = DID_ERROR << 16 +- | COMMAND_COMPLETE << 8; +- break; +- } ++ /* ++ * When the CC bit is SET by the host in ATA pass thru CDB, ++ * driver is supposed to return DID_OK ++ * ++ * When the CC bit is RESET by the host, driver should ++ * return DID_ERROR ++ */ ++ if ((scsicmd->cmnd[0] == ATA_12) ++ || (scsicmd->cmnd[0] == ATA_16)) { ++ ++ if (scsicmd->cmnd[2] & (0x01 << 5)) { ++ scsicmd->result = DID_OK << 16 ++ | COMMAND_COMPLETE << 8; ++ break; + } else { + scsicmd->result = DID_ERROR << 16 + | COMMAND_COMPLETE << 8; +- break; ++ break; + } ++ } else { ++ scsicmd->result = DID_ERROR << 16 ++ | COMMAND_COMPLETE << 8; ++ break; + } +- if (le32_to_cpu(srbreply->scsi_status) +- == SAM_STAT_CHECK_CONDITION) { +- int len; +- +- scsicmd->result |= SAM_STAT_CHECK_CONDITION; +- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), +- SCSI_SENSE_BUFFERSIZE); ++ } ++ if (le32_to_cpu(srbreply->scsi_status) ++ == SAM_STAT_CHECK_CONDITION) { ++ int len; ++ ++ scsicmd->result |= SAM_STAT_CHECK_CONDITION; ++ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), ++ SCSI_SENSE_BUFFERSIZE); + #ifdef AAC_DETAILED_STATUS_INFO +- printk(KERN_WARNING "aac_srb_callback: check condition, status = %d len=%d\n", +- le32_to_cpu(srbreply->status), len); ++ pr_warn("aac_srb_callback: check condition, status = %d len=%d\n", ++ le32_to_cpu(srbreply->status), len); + #endif +- memcpy(scsicmd->sense_buffer, +- srbreply->sense_data, len); +- } ++ memcpy(scsicmd->sense_buffer, ++ srbreply->sense_data, len); + } ++ + /* + * OR in the scsi status (already shifted up a bit) + */ diff --git a/queue-4.9/scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch b/queue-4.9/scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch new file mode 100644 index 00000000000..240cd0c60ad --- /dev/null +++ b/queue-4.9/scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch @@ -0,0 +1,65 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Shivasharan S +Date: Sat, 7 Oct 2017 22:36:47 +0000 +Subject: scsi: megaraid_sas: Do not set fp_possible if TM capable for non-RW syspdIO, change fp_possible to bool + +From: Shivasharan S + + +[ Upstream commit 1d6dbd1752fb4347a4a5db06c8f5cd35dd1919f4 ] + +FIX - firmware wants non-RW SYS PD IOs to avoid FastPath for better +tracking and other functionalities if the device is task management +capable. + +Signed-off-by: Kashyap Desai +Signed-off-by: Shivasharan S +Reviewed-by: Hannes Reinecke +Reviewed-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -1960,7 +1960,8 @@ static void megasas_build_ld_nonrw_fusio + */ + static void + megasas_build_syspd_fusion(struct megasas_instance *instance, +- struct scsi_cmnd *scmd, struct megasas_cmd_fusion *cmd, u8 fp_possible) ++ struct scsi_cmnd *scmd, struct megasas_cmd_fusion *cmd, ++ bool fp_possible) + { + u32 device_id; + struct MPI2_RAID_SCSI_IO_REQUEST *io_request; +@@ -2064,6 +2065,8 @@ megasas_build_io_fusion(struct megasas_i + u16 sge_count; + u8 cmd_type; + struct MPI2_RAID_SCSI_IO_REQUEST *io_request = cmd->io_request; ++ struct MR_PRIV_DEVICE *mr_device_priv_data; ++ mr_device_priv_data = scp->device->hostdata; + + /* Zero out some fields so they don't get reused */ + memset(io_request->LUN, 0x0, 8); +@@ -2092,12 +2095,14 @@ megasas_build_io_fusion(struct megasas_i + megasas_build_ld_nonrw_fusion(instance, scp, cmd); + break; + case READ_WRITE_SYSPDIO: ++ megasas_build_syspd_fusion(instance, scp, cmd, true); ++ break; + case NON_READ_WRITE_SYSPDIO: +- if (instance->secure_jbod_support && +- (cmd_type == NON_READ_WRITE_SYSPDIO)) +- megasas_build_syspd_fusion(instance, scp, cmd, 0); ++ if (instance->secure_jbod_support || ++ mr_device_priv_data->is_tm_capable) ++ megasas_build_syspd_fusion(instance, scp, cmd, false); + else +- megasas_build_syspd_fusion(instance, scp, cmd, 1); ++ megasas_build_syspd_fusion(instance, scp, cmd, true); + break; + default: + break; diff --git a/queue-4.9/series b/queue-4.9/series index 83f184d7896..998aea4ff89 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -15,3 +15,53 @@ drm-msm-fix-potential-buffer-overflow-issue.patch drm-msm-fix-an-integer-overflow-test.patch tracing-samples-fix-creation-and-deletion-of-simple_thread_fn-creation.patch fix-tracing-sample-code-warning.patch +cpufreq-do-not-clear-real_cpus-mask-on-policy-init.patch +crypto-ccp-set-the-aes-size-field-for-all-modes.patch +staging-fsl-mc-add-missing-header.patch +ib-mlx5-assign-dscp-for-r-roce-qps-address-path.patch +pm-wakeirq-report-a-wakeup_event-on-dedicated-wekup-irq.patch +scsi-megaraid_sas-do-not-set-fp_possible-if-tm-capable-for-non-rw-syspdio-change-fp_possible-to-bool.patch +mmc-s3cmci-include-linux-interrupt.h-for-tasklet_struct.patch +mfd-ab8500-sysctrl-handle-probe-deferral.patch +mfd-axp20x-fix-axp288-pek_dbr-and-pek_dbf-irqs-being-swapped.patch +bnxt_en-added-pci-ids-for-bcm57452-and-bcm57454-asics.patch +staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch +pci-msi-return-failure-when-msix_setup_entries-fails.patch +net-mvneta-fix-build-errors-when-linux-phy-.h-is-removed-from-net-dsa.h.patch +ext4-fix-stripe-unaligned-allocations.patch +ext4-do-not-use-stripe_width-if-it-is-not-set.patch +net-ena-change-driver-s-default-timeouts.patch +i2c-riic-correctly-finish-transfers.patch +drm-amdgpu-when-dpm-disabled-also-need-to-stop-start-vce.patch +perf-tools-only-increase-index-if-perf_evsel__new_idx-succeeds.patch +iwlwifi-mvm-use-the-probe_resp_queue-to-send-deauth-to-unknown-station.patch +drm-fsl-dcu-check-for-clk_prepare_enable-error.patch +clocksource-drivers-arm_arch_timer-add-dt-binding-for-hisilicon-161010101-erratum.patch +net-phy-dp83867-recover-from-port-mirroring-n-a-mode4.patch +cx231xx-fix-i2c-on-internal-master-3-bus.patch +ath10k-fix-reading-sram-contents-for-qca4019.patch +clk-sunxi-ng-check-kzalloc-for-errors-and-cleanup-error-path.patch +drm-msm-dsi-set-msm_dsi-encoders-before-initializing-bridge.patch +mtd-nand-sunxi-fix-the-non-polling-case-in-sunxi_nfc_wait_events.patch +gpio-mcp23s08-select-regmap-regmap_i2c-to-fix-build-error.patch +xen-manage-correct-return-value-check-on-xenbus_scanf.patch +scsi-aacraid-process-error-for-response-i-o.patch +platform-x86-intel_mid_thermal-fix-module-autoload.patch +staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch +staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch +staging-lustre-ptlrpc-skip-lock-if-export-failed.patch +staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch +brcmfmac-check-brcmf_bus_get_memdump-result-for-error.patch +vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch +asoc-intel-boards-remove-.pm_ops-in-all-atom-dpcm-machine-drivers.patch +exynos4-is-fimc-is-unmap-region-obtained-by-of_iomap.patch +mei-return-error-on-notification-request-to-a-disconnected-client.patch +s390-dasd-check-for-device-error-pointer-within-state-change-interrupts.patch +s390-prng-adjust-generation-of-entropy-to-produce-real-256-bits.patch +s390-crypto-extend-key-length-check-for-aes-xts-in-fips-mode.patch +bt8xx-fix-memory-leak.patch +drm-exynos-g2d-prevent-integer-overflow-in.patch +pci-avoid-possible-deadlock-on-pci_lock-and-p-pi_lock.patch +powerpc-64-don-t-try-to-use-radix-mmu-under-a-hypervisor.patch +xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch +staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch diff --git a/queue-4.9/staging-fsl-mc-add-missing-header.patch b/queue-4.9/staging-fsl-mc-add-missing-header.patch new file mode 100644 index 00000000000..1543c09c41a --- /dev/null +++ b/queue-4.9/staging-fsl-mc-add-missing-header.patch @@ -0,0 +1,49 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Bogdan Purcareata +Date: Sat, 7 Oct 2017 22:36:46 +0000 +Subject: staging: fsl-mc: Add missing header + +From: Bogdan Purcareata + + +[ Upstream commit 07e9ef146071adf316312b3dd4abfe41c9a45a7d ] + +Compiling the fsl-mc bus driver will yield a couple of static analysis +errors: +warning: symbol 'fsl_mc_msi_domain_alloc_irqs' was not declared +warning: symbol 'fsl_mc_msi_domain_free_irqs' was not declared. +warning: symbol 'its_fsl_mc_msi_init' was not declared. +warning: symbol 'its_fsl_mc_msi_cleanup' was not declared. + +Since these are properly declared, but the header is not included, add +it in the source files. This way the symbol is properly exported. + +Signed-off-by: Bogdan Purcareata +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/fsl-mc/bus/fsl-mc-msi.c | 1 + + drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/staging/fsl-mc/bus/fsl-mc-msi.c ++++ b/drivers/staging/fsl-mc/bus/fsl-mc-msi.c +@@ -17,6 +17,7 @@ + #include + #include + #include "../include/mc-bus.h" ++#include "fsl-mc-private.h" + + /* + * Generate a unique ID identifying the interrupt (only used within the MSI +--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c ++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c +@@ -17,6 +17,7 @@ + #include + #include + #include "../include/mc-bus.h" ++#include "fsl-mc-private.h" + + static struct irq_chip its_msi_irq_chip = { + .name = "fsl-mc-bus-msi", diff --git a/queue-4.9/staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch b/queue-4.9/staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch new file mode 100644 index 00000000000..658f437b3d4 --- /dev/null +++ b/queue-4.9/staging-lustre-hsm-stack-overrun-in-hai_dump_data_field.patch @@ -0,0 +1,75 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: frank zago +Date: Sat, 7 Oct 2017 22:36:54 +0000 +Subject: staging: lustre: hsm: stack overrun in hai_dump_data_field + +From: frank zago + + +[ Upstream commit 22aadb91c0a0055935109c175f5446abfb130702 ] + +The function hai_dump_data_field will do a stack buffer +overrun when cat'ing /sys/fs/lustre/.../hsm/actions if an action has +some data in it. + +hai_dump_data_field uses snprintf. But there is no check for +truncation, and the value returned by snprintf is used as-is. The +coordinator code calls hai_dump_data_field with 12 bytes in the +buffer. The 6th byte of data is printed incompletely to make room for +the terminating NUL. However snprintf still returns 2, so when +hai_dump_data_field writes the final NUL, it does it outside the +reserved buffer, in the 13th byte of the buffer. This stack buffer +overrun hangs my VM. + +Fix by checking that there is enough room for the next 2 characters +plus the NUL terminator. Don't print half bytes. Change the format to +02X instead of .2X, which makes more sense. + +Signed-off-by: frank zago +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8171 +Reviewed-on: http://review.whamcloud.com/20338 +Reviewed-by: John L. Hammond +Reviewed-by: Jean-Baptiste Riaux +Reviewed-by: Oleg Drokin +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/include/lustre/lustre_user.h | 18 +++++-------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h ++++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h +@@ -1213,23 +1213,21 @@ struct hsm_action_item { + * \retval buffer + */ + static inline char *hai_dump_data_field(struct hsm_action_item *hai, +- char *buffer, int len) ++ char *buffer, size_t len) + { +- int i, sz, data_len; ++ int i, data_len; + char *ptr; + + ptr = buffer; +- sz = len; + data_len = hai->hai_len - sizeof(*hai); +- for (i = 0 ; (i < data_len) && (sz > 0) ; i++) { +- int cnt; +- +- cnt = snprintf(ptr, sz, "%.2X", +- (unsigned char)hai->hai_data[i]); +- ptr += cnt; +- sz -= cnt; ++ for (i = 0; (i < data_len) && (len > 2); i++) { ++ snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]); ++ ptr += 2; ++ len -= 2; + } ++ + *ptr = '\0'; ++ + return buffer; + } + diff --git a/queue-4.9/staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch b/queue-4.9/staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch new file mode 100644 index 00000000000..5c8e9c83c32 --- /dev/null +++ b/queue-4.9/staging-lustre-llite-don-t-invoke-direct_io-for-the-eof-case.patch @@ -0,0 +1,41 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Yang Sheng +Date: Sat, 7 Oct 2017 22:36:54 +0000 +Subject: staging: lustre: llite: don't invoke direct_IO for the EOF case + +From: Yang Sheng + + +[ Upstream commit 77759771fb95420d23876cb104ab65c022613325 ] + +The function generic_file_read_iter() does not check EOF +before invoke direct_IO callback. So we have to check it +ourselves. + +Signed-off-by: Yang Sheng +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-8969 +Reviewed-on: https://review.whamcloud.com/24552 +Reviewed-by: Bob Glossman +Reviewed-by: Bobi Jam +Reviewed-by: Oleg Drokin +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/llite/rw26.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/staging/lustre/lustre/llite/rw26.c ++++ b/drivers/staging/lustre/lustre/llite/rw26.c +@@ -354,6 +354,10 @@ static ssize_t ll_direct_IO_26(struct ki + if (!lli->lli_has_smd) + return -EBADF; + ++ /* Check EOF by ourselves */ ++ if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode)) ++ return 0; ++ + /* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */ + if ((file_offset & ~PAGE_MASK) || (count & ~PAGE_MASK)) + return -EINVAL; diff --git a/queue-4.9/staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch b/queue-4.9/staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch new file mode 100644 index 00000000000..c264b022d72 --- /dev/null +++ b/queue-4.9/staging-lustre-lmv-error-not-handled-for-lmv_find_target.patch @@ -0,0 +1,108 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Ulka Vaze +Date: Sat, 7 Oct 2017 22:36:55 +0000 +Subject: staging: lustre: lmv: Error not handled for lmv_find_target + +From: Ulka Vaze + + +[ Upstream commit 30af99db7ab3483f5ce83ccb890533c9378c2ced ] + +This issue is found by smatch; has been reported as- +Unchecked usage of potential ERR_PTR result in lmv_hsm_req_count +and lmv_hsm_req_build. Added ERR_PTR in both functions and also +return value check added. + +Signed-off-by: Ulka Vaze +Signed-off-by: Aditya Pandit +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-6523 +Reviewed-on: http://review.whamcloud.com/14918 +Reviewed-by: Dmitry Eremin +Reviewed-by: Andreas Dilger +Reviewed-by: Oleg Drokin +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/lmv/lmv_obd.c | 25 ++++++++++++++++++------- + 1 file changed, 18 insertions(+), 7 deletions(-) + +--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c ++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c +@@ -744,16 +744,18 @@ static int lmv_hsm_req_count(struct lmv_ + /* count how many requests must be sent to the given target */ + for (i = 0; i < hur->hur_request.hr_itemcount; i++) { + curr_tgt = lmv_find_target(lmv, &hur->hur_user_item[i].hui_fid); ++ if (IS_ERR(curr_tgt)) ++ return PTR_ERR(curr_tgt); + if (obd_uuid_equals(&curr_tgt->ltd_uuid, &tgt_mds->ltd_uuid)) + nr++; + } + return nr; + } + +-static void lmv_hsm_req_build(struct lmv_obd *lmv, +- struct hsm_user_request *hur_in, +- const struct lmv_tgt_desc *tgt_mds, +- struct hsm_user_request *hur_out) ++static int lmv_hsm_req_build(struct lmv_obd *lmv, ++ struct hsm_user_request *hur_in, ++ const struct lmv_tgt_desc *tgt_mds, ++ struct hsm_user_request *hur_out) + { + int i, nr_out; + struct lmv_tgt_desc *curr_tgt; +@@ -764,6 +766,8 @@ static void lmv_hsm_req_build(struct lmv + for (i = 0; i < hur_in->hur_request.hr_itemcount; i++) { + curr_tgt = lmv_find_target(lmv, + &hur_in->hur_user_item[i].hui_fid); ++ if (IS_ERR(curr_tgt)) ++ return PTR_ERR(curr_tgt); + if (obd_uuid_equals(&curr_tgt->ltd_uuid, &tgt_mds->ltd_uuid)) { + hur_out->hur_user_item[nr_out] = + hur_in->hur_user_item[i]; +@@ -773,6 +777,8 @@ static void lmv_hsm_req_build(struct lmv + hur_out->hur_request.hr_itemcount = nr_out; + memcpy(hur_data(hur_out), hur_data(hur_in), + hur_in->hur_request.hr_data_len); ++ ++ return 0; + } + + static int lmv_hsm_ct_unregister(struct lmv_obd *lmv, unsigned int cmd, int len, +@@ -1052,15 +1058,17 @@ static int lmv_iocontrol(unsigned int cm + } else { + /* split fid list to their respective MDS */ + for (i = 0; i < count; i++) { +- unsigned int nr, reqlen; +- int rc1; + struct hsm_user_request *req; ++ size_t reqlen; ++ int nr, rc1; + + tgt = lmv->tgts[i]; + if (!tgt || !tgt->ltd_exp) + continue; + + nr = lmv_hsm_req_count(lmv, hur, tgt); ++ if (nr < 0) ++ return nr; + if (nr == 0) /* nothing for this MDS */ + continue; + +@@ -1072,10 +1080,13 @@ static int lmv_iocontrol(unsigned int cm + if (!req) + return -ENOMEM; + +- lmv_hsm_req_build(lmv, hur, tgt, req); ++ rc1 = lmv_hsm_req_build(lmv, hur, tgt, req); ++ if (rc1 < 0) ++ goto hsm_req_err; + + rc1 = obd_iocontrol(cmd, tgt->ltd_exp, reqlen, + req, uarg); ++hsm_req_err: + if (rc1 != 0 && rc == 0) + rc = rc1; + kvfree(req); diff --git a/queue-4.9/staging-lustre-ptlrpc-skip-lock-if-export-failed.patch b/queue-4.9/staging-lustre-ptlrpc-skip-lock-if-export-failed.patch new file mode 100644 index 00000000000..1148aca2385 --- /dev/null +++ b/queue-4.9/staging-lustre-ptlrpc-skip-lock-if-export-failed.patch @@ -0,0 +1,86 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Alexander Boyko +Date: Sat, 7 Oct 2017 22:36:54 +0000 +Subject: staging: lustre: ptlrpc: skip lock if export failed + +From: Alexander Boyko + + +[ Upstream commit 4c43c27ddc461d8473cedd70f2549614641dfbc7 ] + +This patch resolves IO vs eviction race. +After eviction failed export stayed at stale list, +a client had IO processing and reconnected during it. +A client sent brw rpc with last lock cookie and new connection. +The lock with failed export was found and assert was happened. + (ost_handler.c:1812:ost_prolong_lock_one()) + ASSERTION( lock->l_export == opd->opd_exp ) failed: + + 1. Skip the lock at ldlm_handle2lock if lock export failed. + 2. Validation of lock for IO was added at hpreq_check(). The lock + searching is based on granted interval tree. If server doesn`t + have a valid lock, it reply to client with ESTALE. + +Signed-off-by: Alexander Boyko +Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-7702 +Seagate-bug-id: MRP-2787 +Reviewed-on: http://review.whamcloud.com/18120 +Reviewed-by: Fan Yong +Reviewed-by: Vitaly Fertman +Reviewed-by: Oleg Drokin +Signed-off-by: James Simmons +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/lustre/lustre/ldlm/ldlm_lock.c | 7 +++++++ + drivers/staging/lustre/lustre/ptlrpc/service.c | 21 ++++++++------------- + 2 files changed, 15 insertions(+), 13 deletions(-) + +--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c ++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c +@@ -546,6 +546,13 @@ struct ldlm_lock *__ldlm_handle2lock(con + if (!lock) + return NULL; + ++ if (lock->l_export && lock->l_export->exp_failed) { ++ CDEBUG(D_INFO, "lock export failed: lock %p, exp %p\n", ++ lock, lock->l_export); ++ LDLM_LOCK_PUT(lock); ++ return NULL; ++ } ++ + /* It's unlikely but possible that someone marked the lock as + * destroyed after we did handle2object on it + */ +--- a/drivers/staging/lustre/lustre/ptlrpc/service.c ++++ b/drivers/staging/lustre/lustre/ptlrpc/service.c +@@ -1264,20 +1264,15 @@ static int ptlrpc_server_hpreq_init(stru + */ + if (req->rq_ops->hpreq_check) { + rc = req->rq_ops->hpreq_check(req); +- /** +- * XXX: Out of all current +- * ptlrpc_hpreq_ops::hpreq_check(), only +- * ldlm_cancel_hpreq_check() can return an error code; +- * other functions assert in similar places, which seems +- * odd. What also does not seem right is that handlers +- * for those RPCs do not assert on the same checks, but +- * rather handle the error cases. e.g. see +- * ost_rw_hpreq_check(), and ost_brw_read(), +- * ost_brw_write(). ++ if (rc == -ESTALE) { ++ req->rq_status = rc; ++ ptlrpc_error(req); ++ } ++ /** can only return error, ++ * 0 for normal request, ++ * or 1 for high priority request + */ +- if (rc < 0) +- return rc; +- LASSERT(rc == 0 || rc == 1); ++ LASSERT(rc <= 1); + } + + spin_lock_bh(&req->rq_export->exp_rpc_lock); diff --git a/queue-4.9/staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch b/queue-4.9/staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch new file mode 100644 index 00000000000..e5cae93ecf8 --- /dev/null +++ b/queue-4.9/staging-r8712u-fix-sparse-warning-in-rtl871x_xmit.c.patch @@ -0,0 +1,58 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Larry Finger +Date: Fri, 10 Feb 2017 21:30:27 -0600 +Subject: staging: r8712u: Fix Sparse warning in rtl871x_xmit.c + +From: Larry Finger + + +[ Upstream commit 07222e535831b916221dd2a48a3047ec7e45dc72 ] + +Sparse reports the following: + CHECK drivers/staging/rtl8712/rtl871x_xmit.c +drivers/staging/rtl8712/rtl871x_xmit.c:350:44: warning: restricted __le32 degrades to integer +drivers/staging/rtl8712/rtl871x_xmit.c:491:23: warning: incorrect type in initializer (different base types) +drivers/staging/rtl8712/rtl871x_xmit.c:491:23: expected unsigned short [usertype] *fctrl +drivers/staging/rtl8712/rtl871x_xmit.c:491:23: got restricted __le16 * +drivers/staging/rtl8712/rtl871x_xmit.c:580:36: warning: incorrect type in assignment (different base types) +drivers/staging/rtl8712/rtl871x_xmit.c:580:36: expected unsigned short [unsigned] [short] [usertype] +drivers/staging/rtl8712/rtl871x_xmit.c:580:36: got restricted __be16 [usertype] + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8712/rtl871x_xmit.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/staging/rtl8712/rtl871x_xmit.c ++++ b/drivers/staging/rtl8712/rtl871x_xmit.c +@@ -344,7 +344,8 @@ sint r8712_update_attrib(struct _adapter + * some settings above. + */ + if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) +- pattrib->priority = (txdesc.txdw1 >> QSEL_SHT) & 0x1f; ++ pattrib->priority = ++ (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f; + return _SUCCESS; + } + +@@ -485,7 +486,7 @@ static sint make_wlanhdr(struct _adapter + struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr; + struct mlme_priv *pmlmepriv = &padapter->mlmepriv; + struct qos_priv *pqospriv = &pmlmepriv->qospriv; +- u16 *fctrl = &pwlanhdr->frame_ctl; ++ __le16 *fctrl = &pwlanhdr->frame_ctl; + + memset(hdr, 0, WLANHDR_OFFSET); + SetFrameSubType(fctrl, pattrib->subtype); +@@ -574,7 +575,7 @@ static sint r8712_put_snap(u8 *data, u16 + snap->oui[0] = oui[0]; + snap->oui[1] = oui[1]; + snap->oui[2] = oui[2]; +- *(u16 *)(data + SNAP_SIZE) = htons(h_proto); ++ *(__be16 *)(data + SNAP_SIZE) = htons(h_proto); + return SNAP_SIZE + sizeof(u16); + } + diff --git a/queue-4.9/staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch b/queue-4.9/staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch new file mode 100644 index 00000000000..d9021ff8916 --- /dev/null +++ b/queue-4.9/staging-rtl8712u-fix-endian-settings-for-structs-describing-network-packets.patch @@ -0,0 +1,184 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Larry Finger +Date: Sat, 7 Oct 2017 22:36:48 +0000 +Subject: staging: rtl8712u: Fix endian settings for structs describing network packets + +From: Larry Finger + + +[ Upstream commit 221c46d28957bd6e2158abc2179ce4a8c9ce07d3 ] + +The headers describing a number of network packets do not have the +correct endian settings for several types of data. + +Signed-off-by: Larry Finger +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8712/ieee80211.h | 84 ++++++++++++++++++------------------ + 1 file changed, 42 insertions(+), 42 deletions(-) + +--- a/drivers/staging/rtl8712/ieee80211.h ++++ b/drivers/staging/rtl8712/ieee80211.h +@@ -138,51 +138,51 @@ struct ieee_ibss_seq { + }; + + struct ieee80211_hdr { +- u16 frame_ctl; +- u16 duration_id; ++ __le16 frame_ctl; ++ __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; +- u16 seq_ctl; ++ __le16 seq_ctl; + u8 addr4[ETH_ALEN]; +-} __packed; ++} __packed __aligned(2); + + struct ieee80211_hdr_3addr { +- u16 frame_ctl; +- u16 duration_id; ++ __le16 frame_ctl; ++ __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; +- u16 seq_ctl; +-} __packed; ++ __le16 seq_ctl; ++} __packed __aligned(2); + + struct ieee80211_hdr_qos { +- u16 frame_ctl; +- u16 duration_id; ++ __le16 frame_ctl; ++ __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; +- u16 seq_ctl; ++ __le16 seq_ctl; + u8 addr4[ETH_ALEN]; +- u16 qc; +-} __packed; ++ __le16 qc; ++} __packed __aligned(2); + + struct ieee80211_hdr_3addr_qos { +- u16 frame_ctl; +- u16 duration_id; ++ __le16 frame_ctl; ++ __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; +- u16 seq_ctl; +- u16 qc; ++ __le16 seq_ctl; ++ __le16 qc; + } __packed; + + struct eapol { + u8 snap[6]; +- u16 ethertype; ++ __be16 ethertype; + u8 version; + u8 type; +- u16 length; ++ __le16 length; + } __packed; + + enum eap_type { +@@ -514,13 +514,13 @@ struct ieee80211_security { + */ + + struct ieee80211_header_data { +- u16 frame_ctl; +- u16 duration_id; ++ __le16 frame_ctl; ++ __le16 duration_id; + u8 addr1[6]; + u8 addr2[6]; + u8 addr3[6]; +- u16 seq_ctrl; +-}; ++ __le16 seq_ctrl; ++} __packed __aligned(2); + + #define BEACON_PROBE_SSID_ID_POSITION 12 + +@@ -552,18 +552,18 @@ struct ieee80211_info_element { + /* + * These are the data types that can make up management packets + * +- u16 auth_algorithm; +- u16 auth_sequence; +- u16 beacon_interval; +- u16 capability; ++ __le16 auth_algorithm; ++ __le16 auth_sequence; ++ __le16 beacon_interval; ++ __le16 capability; + u8 current_ap[ETH_ALEN]; +- u16 listen_interval; ++ __le16 listen_interval; + struct { + u16 association_id:14, reserved:2; + } __packed; +- u32 time_stamp[2]; +- u16 reason; +- u16 status; ++ __le32 time_stamp[2]; ++ __le16 reason; ++ __le16 status; + */ + + #define IEEE80211_DEFAULT_TX_ESSID "Penguin" +@@ -571,16 +571,16 @@ struct ieee80211_info_element { + + struct ieee80211_authentication { + struct ieee80211_header_data header; +- u16 algorithm; +- u16 transaction; +- u16 status; ++ __le16 algorithm; ++ __le16 transaction; ++ __le16 status; + } __packed; + + struct ieee80211_probe_response { + struct ieee80211_header_data header; +- u32 time_stamp[2]; +- u16 beacon_interval; +- u16 capability; ++ __le32 time_stamp[2]; ++ __le16 beacon_interval; ++ __le16 capability; + struct ieee80211_info_element info_element; + } __packed; + +@@ -590,16 +590,16 @@ struct ieee80211_probe_request { + + struct ieee80211_assoc_request_frame { + struct ieee80211_hdr_3addr header; +- u16 capability; +- u16 listen_interval; ++ __le16 capability; ++ __le16 listen_interval; + struct ieee80211_info_element_hdr info_element; + } __packed; + + struct ieee80211_assoc_response_frame { + struct ieee80211_hdr_3addr header; +- u16 capability; +- u16 status; +- u16 aid; ++ __le16 capability; ++ __le16 status; ++ __le16 aid; + } __packed; + + struct ieee80211_txb { diff --git a/queue-4.9/vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch b/queue-4.9/vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch new file mode 100644 index 00000000000..14bc3e1692d --- /dev/null +++ b/queue-4.9/vfs-open-with-o_creat-should-not-create-inodes-with-unknown-ids.patch @@ -0,0 +1,42 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Seth Forshee +Date: Sat, 7 Oct 2017 22:36:55 +0000 +Subject: vfs: open() with O_CREAT should not create inodes with unknown ids + +From: Seth Forshee + + +[ Upstream commit 1328c727004d432bbdfba0ffa02a166df04c7305 ] + +may_create() rejects creation of inodes with ids which lack a +mapping into s_user_ns. However for O_CREAT may_o_create() is +is used instead. Add a similar check there. + +Fixes: 036d523641c6 ("vfs: Don't create inodes with a uid or gid unknown to the vfs") +Signed-off-by: Seth Forshee +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/namei.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2971,10 +2971,16 @@ static inline int open_to_namei_flags(in + + static int may_o_create(const struct path *dir, struct dentry *dentry, umode_t mode) + { ++ struct user_namespace *s_user_ns; + int error = security_path_mknod(dir, dentry, mode, 0); + if (error) + return error; + ++ s_user_ns = dir->dentry->d_sb->s_user_ns; ++ if (!kuid_has_mapping(s_user_ns, current_fsuid()) || ++ !kgid_has_mapping(s_user_ns, current_fsgid())) ++ return -EOVERFLOW; ++ + error = inode_permission(dir->dentry->d_inode, MAY_WRITE | MAY_EXEC); + if (error) + return error; diff --git a/queue-4.9/xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch b/queue-4.9/xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch new file mode 100644 index 00000000000..786a2529da5 --- /dev/null +++ b/queue-4.9/xen-don-t-print-error-message-in-case-of-missing-xenstore-entry.patch @@ -0,0 +1,45 @@ +From foo@baz Mon Nov 6 10:07:36 CET 2017 +From: Juergen Gross +Date: Tue, 30 May 2017 20:52:26 +0200 +Subject: xen: don't print error message in case of missing Xenstore entry + +From: Juergen Gross + + +[ Upstream commit 4e93b6481c87ea5afde944a32b4908357ec58992 ] + +When registering for the Xenstore watch of the node control/sysrq the +handler will be called at once. Don't issue an error message if the +Xenstore node isn't there, as it will be created only when an event +is being triggered. + +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Signed-off-by: Juergen Gross +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -277,8 +277,16 @@ static void sysrq_handler(struct xenbus_ + err = xenbus_transaction_start(&xbt); + if (err) + return; +- if (xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key) < 0) { +- pr_err("Unable to read sysrq code in control/sysrq\n"); ++ err = xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key); ++ if (err < 0) { ++ /* ++ * The Xenstore watch fires directly after registering it and ++ * after a suspend/resume cycle. So ENOENT is no error but ++ * might happen in those cases. ++ */ ++ if (err != -ENOENT) ++ pr_err("Error %d reading sysrq code in control/sysrq\n", ++ err); + xenbus_transaction_end(xbt, 1); + return; + } diff --git a/queue-4.9/xen-manage-correct-return-value-check-on-xenbus_scanf.patch b/queue-4.9/xen-manage-correct-return-value-check-on-xenbus_scanf.patch new file mode 100644 index 00000000000..f216e4e28cb --- /dev/null +++ b/queue-4.9/xen-manage-correct-return-value-check-on-xenbus_scanf.patch @@ -0,0 +1,33 @@ +From foo@baz Mon Nov 6 10:07:35 CET 2017 +From: Jan Beulich +Date: Sat, 7 Oct 2017 22:36:53 +0000 +Subject: xen/manage: correct return value check on xenbus_scanf() + +From: Jan Beulich + + +[ Upstream commit 4fed1b125eb6252bde478665fc05d4819f774fa8 ] + +A negative return value indicates an error; in fact the function at +present won't ever return zero. + +Signed-off-by: Jan Beulich +Reviewed-by: Juergen Gross +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/manage.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/xen/manage.c ++++ b/drivers/xen/manage.c +@@ -277,7 +277,7 @@ static void sysrq_handler(struct xenbus_ + err = xenbus_transaction_start(&xbt); + if (err) + return; +- if (!xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key)) { ++ if (xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key) < 0) { + pr_err("Unable to read sysrq code in control/sysrq\n"); + xenbus_transaction_end(xbt, 1); + return;