From: Greg Kroah-Hartman Date: Thu, 19 Oct 2017 13:13:50 +0000 (+0200) Subject: 4.9-stable patches X-Git-Tag: v3.18.77~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=173d5139264ae1fc51f08fa3e0ac296d892a7558;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: alsa-hda-add-geminilake-hdmi-codec-id.patch asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch btmrvl-avoid-double-disable_irq-race.patch btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch cpufreq-cppc-add-acpi_processor-dependency.patch crypto-xts-add-ecb-dependency.patch drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch drm-nouveau-gr-gf100-fix-ccache-error-logging.patch edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch f2fs-do-not-wait-for-writeback-in-write_begin.patch f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch hrtimer-catch-invalid-clockids-again.patch i2c-at91-ensure-state-is-restored-after-suspending.patch ib-hfi1-allocate-context-data-on-memory-node.patch ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch iio-adc-xilinx-fix-error-handling.patch initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch irqchip-crossbar-fix-incorrect-type-of-local-variables.patch locking-lockdep-add-nest_lock-integrity-test.patch mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch mac80211_hwsim-check-hwsim_attr_radio_name-length.patch md-linear-shutup-lockdep-warnning.patch mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch nfsd-callback-cleanup-callback-cred-on-shutdown.patch ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch qed-don-t-use-attention-ptt-for-configuring-bw.patch qed-read-queue-state-before-releasing-buffer.patch qed-reserve-doorbell-bar-space-for-present-cpus.patch qede-prevent-index-problems-in-loopback-test.patch regulator-core-resolve-supplies-before-disabling-unused-regulators.patch revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch sparc64-migrate-hvcons-irq-to-panicked-cpu.patch staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch uapi-fix-linux-rds.h-userspace-compilation-errors.patch watchdog-kempld-fix-gcc-4.3-build.patch xen-netback-use-gfp_atomic-to-allocate-hash.patch --- diff --git a/queue-4.9/alsa-hda-add-geminilake-hdmi-codec-id.patch b/queue-4.9/alsa-hda-add-geminilake-hdmi-codec-id.patch new file mode 100644 index 00000000000..46d6b3c2b77 --- /dev/null +++ b/queue-4.9/alsa-hda-add-geminilake-hdmi-codec-id.patch @@ -0,0 +1,32 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Vinod Koul +Date: Mon, 27 Feb 2017 21:19:44 +0530 +Subject: ALSA: hda: Add Geminilake HDMI codec ID + +From: Vinod Koul + + +[ Upstream commit 126cfa2f5e15ae2ca7f70be71b07e6cd8d2b44d1 ] + +Geminilake HDMI codec 0x280d is similar to previous platforms, so add it with +similar ops as previous. + +Signed-off-by: Senthilnathan Veppur +Signed-off-by: Vinod Koul +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_hdmi.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -3685,6 +3685,7 @@ HDA_CODEC_ENTRY(0x80862808, "Broadwell H + HDA_CODEC_ENTRY(0x80862809, "Skylake HDMI", patch_i915_hsw_hdmi), + HDA_CODEC_ENTRY(0x8086280a, "Broxton HDMI", patch_i915_hsw_hdmi), + HDA_CODEC_ENTRY(0x8086280b, "Kabylake HDMI", patch_i915_hsw_hdmi), ++HDA_CODEC_ENTRY(0x8086280d, "Geminilake HDMI", patch_i915_hsw_hdmi), + HDA_CODEC_ENTRY(0x80862880, "CedarTrail HDMI", patch_generic_hdmi), + HDA_CODEC_ENTRY(0x80862882, "Valleyview2 HDMI", patch_i915_byt_hdmi), + HDA_CODEC_ENTRY(0x80862883, "Braswell HDMI", patch_i915_byt_hdmi), diff --git a/queue-4.9/asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch b/queue-4.9/asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch new file mode 100644 index 00000000000..faeb2c66be1 --- /dev/null +++ b/queue-4.9/asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch @@ -0,0 +1,38 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Arnd Bergmann +Date: Tue, 21 Feb 2017 23:00:46 +0100 +Subject: ASoC: mediatek: add I2C dependency for CS42XX8 + +From: Arnd Bergmann + + +[ Upstream commit 72cedf599fcebfd6cd2550274d7855838068d28c ] + +We should not select drivers that depend on I2C when that is disabled, +as it results in a build error: + +warning: (SND_SOC_MT2701_CS42448) selects SND_SOC_CS42XX8_I2C which has unmet direct dependencies (SOUND && !M68K && !UML && SND && SND_SOC && I2C) +sound/soc/codecs/cs42xx8-i2c.c:60:1: warning: data definition has no type or storage class + module_i2c_driver(cs42xx8_i2c_driver); +sound/soc/codecs/cs42xx8-i2c.c:60:1: error: type defaults to 'int' in declaration of 'module_i2c_driver' [-Werror=implicit-int] + +Fixes: 1f458d53f76c ("ASoC: mediatek: Add mt2701-cs42448 driver and config option.") +Signed-off-by: Arnd Bergmann +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/mediatek/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/mediatek/Kconfig ++++ b/sound/soc/mediatek/Kconfig +@@ -13,7 +13,7 @@ config SND_SOC_MT2701 + + config SND_SOC_MT2701_CS42448 + tristate "ASoc Audio driver for MT2701 with CS42448 codec" +- depends on SND_SOC_MT2701 ++ depends on SND_SOC_MT2701 && I2C + select SND_SOC_CS42XX8_I2C + select SND_SOC_BT_SCO + help diff --git a/queue-4.9/btmrvl-avoid-double-disable_irq-race.patch b/queue-4.9/btmrvl-avoid-double-disable_irq-race.patch new file mode 100644 index 00000000000..17df9f5362e --- /dev/null +++ b/queue-4.9/btmrvl-avoid-double-disable_irq-race.patch @@ -0,0 +1,46 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jeffy Chen +Date: Mon, 23 Jan 2017 12:18:51 +0800 +Subject: btmrvl: avoid double-disable_irq() race + +From: Jeffy Chen + + +[ Upstream commit 9af02d86e11dc409e5c3de46e81c0a492ba58905 ] + +It's much the same as what we did for mwifiex in: +b9da4d2 mwifiex: avoid double-disable_irq() race + +"We have a race where the wakeup IRQ might be in flight while we're +calling mwifiex_disable_wake() from resume(). This can leave us +disabling the IRQ twice. + +Let's disable the IRQ and enable it in case if we have double-disabled +it." + +Signed-off-by: Jeffy Chen +Reviewed-by: Brian Norris +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/bluetooth/btmrvl_sdio.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/bluetooth/btmrvl_sdio.c ++++ b/drivers/bluetooth/btmrvl_sdio.c +@@ -1682,8 +1682,12 @@ static int btmrvl_sdio_resume(struct dev + /* Disable platform specific wakeup interrupt */ + if (card->plt_wake_cfg && card->plt_wake_cfg->irq_bt >= 0) { + disable_irq_wake(card->plt_wake_cfg->irq_bt); +- if (!card->plt_wake_cfg->wake_by_bt) +- disable_irq(card->plt_wake_cfg->irq_bt); ++ disable_irq(card->plt_wake_cfg->irq_bt); ++ if (card->plt_wake_cfg->wake_by_bt) ++ /* Undo our disable, since interrupt handler already ++ * did this. ++ */ ++ enable_irq(card->plt_wake_cfg->irq_bt); + } + + return 0; diff --git a/queue-4.9/btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch b/queue-4.9/btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch new file mode 100644 index 00000000000..4a4679c7124 --- /dev/null +++ b/queue-4.9/btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch @@ -0,0 +1,130 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Robbie Ko +Date: Thu, 5 Jan 2017 16:24:55 +0800 +Subject: Btrfs: send, fix failure to rename top level inode due to name collision + +From: Robbie Ko + + +[ Upstream commit 4dd9920d991745c4a16f53a8f615f706fbe4b3f7 ] + +Under certain situations, an incremental send operation can fail due to a +premature attempt to create a new top level inode (a direct child of the +subvolume/snapshot root) whose name collides with another inode that was +removed from the send snapshot. + +Consider the following example scenario. + +Parent snapshot: + + . (ino 256, gen 8) + |---- a1/ (ino 257, gen 9) + |---- a2/ (ino 258, gen 9) + +Send snapshot: + + . (ino 256, gen 3) + |---- a2/ (ino 257, gen 7) + +In this scenario, when receiving the incremental send stream, the btrfs +receive command fails like this (ran in verbose mode, -vv argument): + + rmdir a1 + mkfile o257-7-0 + rename o257-7-0 -> a2 + ERROR: rename o257-7-0 -> a2 failed: Is a directory + +What happens when computing the incremental send stream is: + +1) An operation to remove the directory with inode number 257 and + generation 9 is issued. + +2) An operation to create the inode with number 257 and generation 7 is + issued. This creates the inode with an orphanized name of "o257-7-0". + +3) An operation rename the new inode 257 to its final name, "a2", is + issued. This is incorrect because inode 258, which has the same name + and it's a child of the same parent (root inode 256), was not yet + processed and therefore no rmdir operation for it was yet issued. + The rename operation is issued because we fail to detect that the + name of the new inode 257 collides with inode 258, because their + parent, a subvolume/snapshot root (inode 256) has a different + generation in both snapshots. + +So fix this by ignoring the generation value of a parent directory that +matches a root inode (number 256) when we are checking if the name of the +inode currently being processed collides with the name of some other +inode that was not yet processed. + +We can achieve this scenario of different inodes with the same number but +different generation values either by mounting a filesystem with the inode +cache option (-o inode_cache) or by creating and sending snapshots across +different filesystems, like in the following example: + + $ mkfs.btrfs -f /dev/sdb + $ mount /dev/sdb /mnt + $ mkdir /mnt/a1 + $ mkdir /mnt/a2 + $ btrfs subvolume snapshot -r /mnt /mnt/snap1 + $ btrfs send /mnt/snap1 -f /tmp/1.snap + $ umount /mnt + + $ mkfs.btrfs -f /dev/sdc + $ mount /dev/sdc /mnt + $ touch /mnt/a2 + $ btrfs subvolume snapshot -r /mnt /mnt/snap2 + $ btrfs receive /mnt -f /tmp/1.snap + # Take note that once the filesystem is created, its current + # generation has value 7 so the inode from the second snapshot has + # a generation value of 7. And after receiving the first snapshot + # the filesystem is at a generation value of 10, because the call to + # create the second snapshot bumps the generation to 8 (the snapshot + # creation ioctl does a transaction commit), the receive command calls + # the snapshot creation ioctl to create the first snapshot, which bumps + # the filesystem's generation to 9, and finally when the receive + # operation finishes it calls an ioctl to transition the first snapshot + # (snap1) from RW mode to RO mode, which does another transaction commit + # and bumps the filesystem's generation to 10. + $ rm -f /tmp/1.snap + $ btrfs send /mnt/snap1 -f /tmp/1.snap + $ btrfs send -p /mnt/snap1 /mnt/snap2 -f /tmp/2.snap + $ umount /mnt + + $ mkfs.btrfs -f /dev/sdd + $ mount /dev/sdd /mnt + $ btrfs receive /mnt /tmp/1.snap + # Receive of snapshot snap2 used to fail. + $ btrfs receive /mnt /tmp/2.snap + +Signed-off-by: Robbie Ko +Reviewed-by: Filipe Manana +[Rewrote changelog to be more precise and clear] +Signed-off-by: Filipe Manana + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/send.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -1680,6 +1680,9 @@ static int is_inode_existent(struct send + { + int ret; + ++ if (ino == BTRFS_FIRST_FREE_OBJECTID) ++ return 1; ++ + ret = get_cur_inode_state(sctx, ino, gen); + if (ret < 0) + goto out; +@@ -1865,7 +1868,7 @@ static int will_overwrite_ref(struct sen + * not deleted and then re-created, if it was then we have no overwrite + * and we can just unlink this entry. + */ +- if (sctx->parent_root) { ++ if (sctx->parent_root && dir != BTRFS_FIRST_FREE_OBJECTID) { + ret = get_inode_info(sctx->parent_root, dir, NULL, &gen, NULL, + NULL, NULL, NULL); + if (ret < 0 && ret != -ENOENT) diff --git a/queue-4.9/ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch b/queue-4.9/ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch new file mode 100644 index 00000000000..a500129acc9 --- /dev/null +++ b/queue-4.9/ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jeff Layton +Date: Thu, 15 Dec 2016 08:37:57 -0500 +Subject: ceph: clean up unsafe d_parent accesses in build_dentry_path + +From: Jeff Layton + + +[ Upstream commit c6b0b656ca24ede6657abb4a2cd910fa9c1879ba ] + +While we hold a reference to the dentry when build_dentry_path is +called, we could end up racing with a rename that changes d_parent. +Handle that situation correctly, by using the rcu_read_lock to +ensure that the parent dentry and inode stick around long enough +to safely check ceph_snap and ceph_ino. + +Link: http://tracker.ceph.com/issues/18148 +Signed-off-by: Jeff Layton +Reviewed-by: Yan, Zheng +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/mds_client.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -1782,13 +1782,18 @@ static int build_dentry_path(struct dent + int *pfreepath) + { + char *path; ++ struct inode *dir; + +- if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) { +- *pino = ceph_ino(d_inode(dentry->d_parent)); ++ rcu_read_lock(); ++ dir = d_inode_rcu(dentry->d_parent); ++ if (dir && ceph_snap(dir) == CEPH_NOSNAP) { ++ *pino = ceph_ino(dir); ++ rcu_read_unlock(); + *ppath = dentry->d_name.name; + *ppathlen = dentry->d_name.len; + return 0; + } ++ rcu_read_unlock(); + path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1); + if (IS_ERR(path)) + return PTR_ERR(path); diff --git a/queue-4.9/ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch b/queue-4.9/ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch new file mode 100644 index 00000000000..4c4aff73ed9 --- /dev/null +++ b/queue-4.9/ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jeff Layton +Date: Thu, 26 Jan 2017 16:14:18 -0500 +Subject: ceph: don't update_dentry_lease unless we actually got one + +From: Jeff Layton + + +[ Upstream commit 80d025ffede88969f6adf7266fbdedfd5641148a ] + +This if block updates the dentry lease even in the case where +the MDS didn't grant one. + +Signed-off-by: Jeff Layton +Reviewed-by: Yan, Zheng +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/inode.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1323,8 +1323,8 @@ retry_lookup: + ceph_dir_clear_ordered(dir); + dout("d_delete %p\n", dn); + d_delete(dn); +- } else { +- if (have_lease && d_unhashed(dn)) ++ } else if (have_lease) { ++ if (d_unhashed(dn)) + d_add(dn, NULL); + update_dentry_lease(dn, rinfo->dlease, + session, diff --git a/queue-4.9/ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch b/queue-4.9/ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch new file mode 100644 index 00000000000..30bfcd6beb3 --- /dev/null +++ b/queue-4.9/ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch @@ -0,0 +1,46 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jeff Layton +Date: Thu, 12 Jan 2017 14:42:40 -0500 +Subject: ceph: fix bogus endianness change in ceph_ioctl_set_layout + +From: Jeff Layton + + +[ Upstream commit 24c149ad6914d349d8b64749f20f3f8ea5031fe0 ] + +sparse says: + + fs/ceph/ioctl.c:100:28: warning: cast to restricted __le64 + +preferred_osd is a __s64 so we don't need to do any conversion. Also, +just remove the cast in ceph_ioctl_get_layout as it's not needed. + +Signed-off-by: Jeff Layton +Reviewed-by: Sage Weil +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/ioctl.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/ceph/ioctl.c ++++ b/fs/ceph/ioctl.c +@@ -25,7 +25,7 @@ static long ceph_ioctl_get_layout(struct + l.stripe_count = ci->i_layout.stripe_count; + l.object_size = ci->i_layout.object_size; + l.data_pool = ci->i_layout.pool_id; +- l.preferred_osd = (s32)-1; ++ l.preferred_osd = -1; + if (copy_to_user(arg, &l, sizeof(l))) + return -EFAULT; + } +@@ -97,7 +97,7 @@ static long ceph_ioctl_set_layout(struct + nl.data_pool = ci->i_layout.pool_id; + + /* this is obsolete, and always -1 */ +- nl.preferred_osd = le64_to_cpu(-1); ++ nl.preferred_osd = -1; + + err = __validate_layout(mdsc, &nl); + if (err) diff --git a/queue-4.9/cpufreq-cppc-add-acpi_processor-dependency.patch b/queue-4.9/cpufreq-cppc-add-acpi_processor-dependency.patch new file mode 100644 index 00000000000..1c09639e05e --- /dev/null +++ b/queue-4.9/cpufreq-cppc-add-acpi_processor-dependency.patch @@ -0,0 +1,35 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Arnd Bergmann +Date: Tue, 14 Feb 2017 22:19:18 +0100 +Subject: cpufreq: CPPC: add ACPI_PROCESSOR dependency + +From: Arnd Bergmann + + +[ Upstream commit a578884fa0d2768f13d37c6591a9e1ed600482d3 ] + +Without the Kconfig dependency, we can get this warning: + +warning: ACPI_CPPC_CPUFREQ selects ACPI_CPPC_LIB which has unmet direct dependencies (ACPI && ACPI_PROCESSOR) + +Fixes: 5477fb3bd1e8 (ACPI / CPPC: Add a CPUFreq driver for use with CPPC) +Signed-off-by: Arnd Bergmann +Acked-by: Viresh Kumar +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/Kconfig.arm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/cpufreq/Kconfig.arm ++++ b/drivers/cpufreq/Kconfig.arm +@@ -244,7 +244,7 @@ config ARM_PXA2xx_CPUFREQ + + config ACPI_CPPC_CPUFREQ + tristate "CPUFreq driver based on the ACPI CPPC spec" +- depends on ACPI ++ depends on ACPI_PROCESSOR + select ACPI_CPPC_LIB + default n + help diff --git a/queue-4.9/crypto-xts-add-ecb-dependency.patch b/queue-4.9/crypto-xts-add-ecb-dependency.patch new file mode 100644 index 00000000000..8b461623b5b --- /dev/null +++ b/queue-4.9/crypto-xts-add-ecb-dependency.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Milan Broz +Date: Thu, 23 Feb 2017 08:38:26 +0100 +Subject: crypto: xts - Add ECB dependency + +From: Milan Broz + + +[ Upstream commit 12cb3a1c4184f891d965d1f39f8cfcc9ef617647 ] + +Since the + commit f1c131b45410a202eb45cc55980a7a9e4e4b4f40 + crypto: xts - Convert to skcipher +the XTS mode is based on ECB, so the mode must select +ECB otherwise it can fail to initialize. + +Signed-off-by: Milan Broz +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -360,6 +360,7 @@ config CRYPTO_XTS + select CRYPTO_BLKCIPHER + select CRYPTO_MANAGER + select CRYPTO_GF128MUL ++ select CRYPTO_ECB + help + XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain, + key size 256, 384 or 512 bits. This implementation currently diff --git a/queue-4.9/drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch b/queue-4.9/drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch new file mode 100644 index 00000000000..23d03fc3e81 --- /dev/null +++ b/queue-4.9/drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch @@ -0,0 +1,40 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Nicolai Hähnle +Date: Thu, 16 Feb 2017 23:49:12 +0100 +Subject: drm/amdgpu: refuse to reserve io mem for split VRAM buffers + +From: Nicolai Hähnle + + +[ Upstream commit 4694335dad7357e9b3d7822ab13049014d74d8b0 ] + +When the fast blit path fails while attempting to move a buffer from RAM +to VRAM, we fall back to a CPU-based memcpy that cannot handle split VRAM +buffers. Instead of crashing, simply fail the buffer move. + +Ideally, we would teach TTM about split buffers so that the fallback still +works in this case, but that is quite involved. So for now, apply the +simplest possible fix. + +Fixes: 40361bb1704b ("drm/amdgpu: add VRAM manager v2") +Signed-off-by: Nicolai Hähnle +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +@@ -491,6 +491,9 @@ static int amdgpu_ttm_io_mem_reserve(str + case TTM_PL_TT: + break; + case TTM_PL_VRAM: ++ if (mem->start == AMDGPU_BO_INVALID_OFFSET) ++ return -EINVAL; ++ + mem->bus.offset = mem->start << PAGE_SHIFT; + /* check if it's visible */ + if ((mem->bus.offset + mem->bus.size) > adev->mc.visible_vram_size) diff --git a/queue-4.9/drm-nouveau-gr-gf100-fix-ccache-error-logging.patch b/queue-4.9/drm-nouveau-gr-gf100-fix-ccache-error-logging.patch new file mode 100644 index 00000000000..7f6b127f055 --- /dev/null +++ b/queue-4.9/drm-nouveau-gr-gf100-fix-ccache-error-logging.patch @@ -0,0 +1,28 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Ben Skeggs +Date: Thu, 22 Dec 2016 10:07:49 +1000 +Subject: drm/nouveau/gr/gf100-: fix ccache error logging + +From: Ben Skeggs + + +[ Upstream commit 1894054dc1b6e4395048b2c0f28832a3f4320fd3 ] + +Signed-off-by: Ben Skeggs +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/gr/gf100.c +@@ -1129,7 +1129,7 @@ gf100_gr_trap_intr(struct gf100_gr *gr) + if (trap & 0x00000008) { + u32 stat = nvkm_rd32(device, 0x408030); + +- nvkm_snprintbf(error, sizeof(error), gf100_m2mf_error, ++ nvkm_snprintbf(error, sizeof(error), gf100_ccache_error, + stat & 0x3fffffff); + nvkm_error(subdev, "CCACHE %08x [%s]\n", stat, error); + nvkm_wr32(device, 0x408030, 0xc0000000); diff --git a/queue-4.9/edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch b/queue-4.9/edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch new file mode 100644 index 00000000000..e8da673864c --- /dev/null +++ b/queue-4.9/edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch @@ -0,0 +1,77 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Yazen Ghannam +Date: Wed, 15 Feb 2017 14:56:22 -0600 +Subject: EDAC, mce_amd: Print IPID and Syndrome on a separate line + +From: Yazen Ghannam + + +[ Upstream commit 75bf2f6478cab9b0c1d7f5f674a765d1e2ad530e ] + +Currently, the IPID and Syndrome are printed on the same line as the +Address. There are cases when we can have a valid Syndrome but not a +valid Address. + +For example, the MCA_SYND register can be used to hold more detailed +error info that the hardware folks can use. It's not just DRAM ECC +syndromes. There are some error types that aren't related to memory that +may have valid syndromes, like some errors related to links in the Data +Fabric, etc. + +In these cases, the IPID and Syndrome are not printed at the same log +level as the rest of the stanza, so users won't see them on the console. + +Console: + [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b + [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2 + +Dmesg: + [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b + , Syndrome: 0x000000010b404000, IPID: 0x0001002e00000002 + [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2 + +Print the IPID first and on a new line. The IPID should always be +printed on SMCA systems. The Syndrome will then be printed with the IPID +and at the same log level when valid: + + [Hardware Error]: CPU:16 (17:1:0) MC22_STATUS[Over|CE|MiscV|-|-|-|-|SyndV|-]: 0xd82000000002080b + [Hardware Error]: IPID: 0x0001002e00000002, Syndrome: 0x000000010b404000 + [Hardware Error]: Power, Interrupts, etc. Extended Error Code: 2 + +Signed-off-by: Yazen Ghannam +Cc: linux-edac +Link: http://lkml.kernel.org/r/1487192182-2474-1-git-send-email-Yazen.Ghannam@amd.com +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/mce_amd.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/edac/mce_amd.c ++++ b/drivers/edac/mce_amd.c +@@ -981,20 +981,19 @@ int amd_decode_mce(struct notifier_block + pr_cont("]: 0x%016llx\n", m->status); + + if (m->status & MCI_STATUS_ADDRV) +- pr_emerg(HW_ERR "Error Addr: 0x%016llx", m->addr); ++ pr_emerg(HW_ERR "Error Addr: 0x%016llx\n", m->addr); + + if (boot_cpu_has(X86_FEATURE_SMCA)) { ++ pr_emerg(HW_ERR "IPID: 0x%016llx", m->ipid); ++ + if (m->status & MCI_STATUS_SYNDV) + pr_cont(", Syndrome: 0x%016llx", m->synd); + +- pr_cont(", IPID: 0x%016llx", m->ipid); +- + pr_cont("\n"); + + decode_smca_errors(m); + goto err_code; +- } else +- pr_cont("\n"); ++ } + + if (!fam_ops) + goto err_code; diff --git a/queue-4.9/f2fs-do-not-wait-for-writeback-in-write_begin.patch b/queue-4.9/f2fs-do-not-wait-for-writeback-in-write_begin.patch new file mode 100644 index 00000000000..e5daf9ad2cb --- /dev/null +++ b/queue-4.9/f2fs-do-not-wait-for-writeback-in-write_begin.patch @@ -0,0 +1,62 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jaegeuk Kim +Date: Fri, 17 Feb 2017 09:55:55 -0800 +Subject: f2fs: do not wait for writeback in write_begin + +From: Jaegeuk Kim + + +[ Upstream commit 86d54795c94532075d862aa0a79f0c981dab4bdd ] + +Otherwise we can get livelock like below. + +[79880.428136] dbench D 0 18405 18404 0x00000000 +[79880.428139] Call Trace: +[79880.428142] __schedule+0x219/0x6b0 +[79880.428144] schedule+0x36/0x80 +[79880.428147] schedule_timeout+0x243/0x2e0 +[79880.428152] ? update_sd_lb_stats+0x16b/0x5f0 +[79880.428155] ? ktime_get+0x3c/0xb0 +[79880.428157] io_schedule_timeout+0xa6/0x110 +[79880.428161] __lock_page+0xf7/0x130 +[79880.428164] ? unlock_page+0x30/0x30 +[79880.428167] pagecache_get_page+0x16b/0x250 +[79880.428171] grab_cache_page_write_begin+0x20/0x40 +[79880.428182] f2fs_write_begin+0xa2/0xdb0 [f2fs] +[79880.428192] ? f2fs_mark_inode_dirty_sync+0x16/0x30 [f2fs] +[79880.428197] ? kmem_cache_free+0x79/0x200 +[79880.428203] ? __mark_inode_dirty+0x17f/0x360 +[79880.428206] generic_perform_write+0xbb/0x190 +[79880.428213] ? file_update_time+0xa4/0xf0 +[79880.428217] __generic_file_write_iter+0x19b/0x1e0 +[79880.428226] f2fs_file_write_iter+0x9c/0x180 [f2fs] +[79880.428231] __vfs_write+0xc5/0x140 +[79880.428235] vfs_write+0xb2/0x1b0 +[79880.428238] SyS_write+0x46/0xa0 +[79880.428242] entry_SYSCALL_64_fastpath+0x1e/0xad + +Fixes: cae96a5c8ab6 ("f2fs: check io submission more precisely") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/data.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1619,7 +1619,12 @@ static int f2fs_write_begin(struct file + goto fail; + } + repeat: +- page = grab_cache_page_write_begin(mapping, index, flags); ++ /* ++ * Do not use grab_cache_page_write_begin() to avoid deadlock due to ++ * wait_for_stable_page. Will wait that below with our IO control. ++ */ ++ page = pagecache_get_page(mapping, index, ++ FGP_LOCK | FGP_WRITE | FGP_CREAT, GFP_NOFS); + if (!page) { + err = -ENOMEM; + goto fail; diff --git a/queue-4.9/f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch b/queue-4.9/f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch new file mode 100644 index 00000000000..eb022308c5e --- /dev/null +++ b/queue-4.9/f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch @@ -0,0 +1,32 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Yunlong Song +Date: Wed, 22 Feb 2017 20:50:49 +0800 +Subject: f2fs: do SSR for data when there is enough free space + +From: Yunlong Song + + +[ Upstream commit 035e97adab26c1121cedaeb9bd04cf48a8e8cf51 ] + +In allocate_segment_by_default(), need_SSR() already detected it's time to do +SSR. So, let's try to find victims for data segments more aggressively in time. + +Signed-off-by: Yunlong Song +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/f2fs/segment.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -1263,7 +1263,7 @@ static int get_ssr_segment(struct f2fs_s + struct curseg_info *curseg = CURSEG_I(sbi, type); + const struct victim_selection *v_ops = DIRTY_I(sbi)->v_ops; + +- if (IS_NODESEG(type) || !has_not_enough_free_secs(sbi, 0, 0)) ++ if (IS_NODESEG(type)) + return v_ops->get_victim(sbi, + &(curseg)->next_segno, BG_GC, type, SSR); + diff --git a/queue-4.9/hrtimer-catch-invalid-clockids-again.patch b/queue-4.9/hrtimer-catch-invalid-clockids-again.patch new file mode 100644 index 00000000000..38c70e34f32 --- /dev/null +++ b/queue-4.9/hrtimer-catch-invalid-clockids-again.patch @@ -0,0 +1,78 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Marc Zyngier +Date: Fri, 15 Jan 2016 17:41:09 +0000 +Subject: hrtimer: Catch invalid clockids again + +From: Marc Zyngier + + +[ Upstream commit 336a9cde10d641e70bac67d90ae91b3190c3edca ] + +commit 82e88ff1ea94 ("hrtimer: Revert CLOCK_MONOTONIC_RAW support") removed +unfortunately a sanity check in the hrtimer code which was part of that +MONOTONIC_RAW patch series. + +It would have caught the bogus usage of CLOCK_MONOTONIC_RAW in the wireless +code. So bring it back. + +It is way too easy to take any random clockid and feed it to the hrtimer +subsystem. At best, it gets mapped to a monotonic base, but it would be +better to just catch illegal values as early as possible. + +Detect invalid clockids, map them to CLOCK_MONOTONIC and emit a warning. + +[ tglx: Replaced the BUG by a WARN and gracefully map to CLOCK_MONOTONIC ] + +Signed-off-by: Marc Zyngier +Cc: Tomasz Nowicki +Cc: Christoffer Dall +Link: http://lkml.kernel.org/r/1452879670-16133-3-git-send-email-marc.zyngier@arm.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/time/hrtimer.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -94,17 +94,15 @@ DEFINE_PER_CPU(struct hrtimer_cpu_base, + }; + + static const int hrtimer_clock_to_base_table[MAX_CLOCKS] = { ++ /* Make sure we catch unsupported clockids */ ++ [0 ... MAX_CLOCKS - 1] = HRTIMER_MAX_CLOCK_BASES, ++ + [CLOCK_REALTIME] = HRTIMER_BASE_REALTIME, + [CLOCK_MONOTONIC] = HRTIMER_BASE_MONOTONIC, + [CLOCK_BOOTTIME] = HRTIMER_BASE_BOOTTIME, + [CLOCK_TAI] = HRTIMER_BASE_TAI, + }; + +-static inline int hrtimer_clockid_to_base(clockid_t clock_id) +-{ +- return hrtimer_clock_to_base_table[clock_id]; +-} +- + /* + * Functions and macros which are different for UP/SMP systems are kept in a + * single place +@@ -1112,6 +1110,18 @@ u64 hrtimer_get_next_event(void) + } + #endif + ++static inline int hrtimer_clockid_to_base(clockid_t clock_id) ++{ ++ if (likely(clock_id < MAX_CLOCKS)) { ++ int base = hrtimer_clock_to_base_table[clock_id]; ++ ++ if (likely(base != HRTIMER_MAX_CLOCK_BASES)) ++ return base; ++ } ++ WARN(1, "Invalid clockid %d. Using MONOTONIC\n", clock_id); ++ return HRTIMER_BASE_MONOTONIC; ++} ++ + static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id, + enum hrtimer_mode mode) + { diff --git a/queue-4.9/i2c-at91-ensure-state-is-restored-after-suspending.patch b/queue-4.9/i2c-at91-ensure-state-is-restored-after-suspending.patch new file mode 100644 index 00000000000..85cee55392d --- /dev/null +++ b/queue-4.9/i2c-at91-ensure-state-is-restored-after-suspending.patch @@ -0,0 +1,41 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Alexandre Belloni +Date: Thu, 16 Feb 2017 18:27:59 +0100 +Subject: i2c: at91: ensure state is restored after suspending + +From: Alexandre Belloni + + +[ Upstream commit e3ccc921b7d8fd1fcd10a00720e09823d8078666 ] + +When going to suspend, the I2C registers may be lost because the power to +VDDcore is cut. Restore them when resuming. + +Signed-off-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-at91.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-at91.c ++++ b/drivers/i2c/busses/i2c-at91.c +@@ -1180,6 +1180,7 @@ static int at91_twi_suspend_noirq(struct + + static int at91_twi_resume_noirq(struct device *dev) + { ++ struct at91_twi_dev *twi_dev = dev_get_drvdata(dev); + int ret; + + if (!pm_runtime_status_suspended(dev)) { +@@ -1191,6 +1192,8 @@ static int at91_twi_resume_noirq(struct + pm_runtime_mark_last_busy(dev); + pm_request_autosuspend(dev); + ++ at91_init_twi_bus(twi_dev); ++ + return 0; + } + diff --git a/queue-4.9/ib-hfi1-allocate-context-data-on-memory-node.patch b/queue-4.9/ib-hfi1-allocate-context-data-on-memory-node.patch new file mode 100644 index 00000000000..796de4c7a1a --- /dev/null +++ b/queue-4.9/ib-hfi1-allocate-context-data-on-memory-node.patch @@ -0,0 +1,59 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Sebastian Sanchez +Date: Wed, 8 Feb 2017 05:26:37 -0800 +Subject: IB/hfi1: Allocate context data on memory node + +From: Sebastian Sanchez + + +[ Upstream commit b448bf9a0df6093dbadac36979a55ce4e012a677 ] + +There are some memory allocation calls in hfi1_create_ctxtdata() +that do not use the numa function parameter. This +can cause cache lines to be filled over QPI. + +Reviewed-by: Mike Marciniszyn +Signed-off-by: Sebastian Sanchez +Signed-off-by: Dennis Dalessandro +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hfi1/init.c | 17 +++++++++-------- + 1 file changed, 9 insertions(+), 8 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -297,14 +297,15 @@ struct hfi1_ctxtdata *hfi1_create_ctxtda + * The resulting value will be rounded down to the closest + * multiple of dd->rcv_entries.group_size. + */ +- rcd->egrbufs.buffers = kcalloc(rcd->egrbufs.count, +- sizeof(*rcd->egrbufs.buffers), +- GFP_KERNEL); ++ rcd->egrbufs.buffers = kzalloc_node( ++ rcd->egrbufs.count * sizeof(*rcd->egrbufs.buffers), ++ GFP_KERNEL, numa); + if (!rcd->egrbufs.buffers) + goto bail; +- rcd->egrbufs.rcvtids = kcalloc(rcd->egrbufs.count, +- sizeof(*rcd->egrbufs.rcvtids), +- GFP_KERNEL); ++ rcd->egrbufs.rcvtids = kzalloc_node( ++ rcd->egrbufs.count * ++ sizeof(*rcd->egrbufs.rcvtids), ++ GFP_KERNEL, numa); + if (!rcd->egrbufs.rcvtids) + goto bail; + rcd->egrbufs.size = eager_buffer_size; +@@ -322,8 +323,8 @@ struct hfi1_ctxtdata *hfi1_create_ctxtda + rcd->egrbufs.rcvtid_size = HFI1_MAX_EAGER_BUFFER_SIZE; + + if (ctxt < dd->first_user_ctxt) { /* N/A for PSM contexts */ +- rcd->opstats = kzalloc(sizeof(*rcd->opstats), +- GFP_KERNEL); ++ rcd->opstats = kzalloc_node(sizeof(*rcd->opstats), ++ GFP_KERNEL, numa); + if (!rcd->opstats) + goto bail; + } diff --git a/queue-4.9/ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch b/queue-4.9/ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch new file mode 100644 index 00000000000..a180d0500e6 --- /dev/null +++ b/queue-4.9/ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch @@ -0,0 +1,45 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Easwar Hariharan +Date: Wed, 8 Feb 2017 05:26:14 -0800 +Subject: IB/hfi1: Use static CTLE with Preset 6 for integrated HFIs + +From: Easwar Hariharan + + +[ Upstream commit 39e2afa8d042a53d855137d4c5a689a6f5492b39 ] + +After extended testing, it was found that the previous PCIe Gen +3 recipe, which used adaptive CTLE with Preset 4, could cause an +NMI/Surprise Link Down in about 1 in 100 to 1 in 1000 power cycles on +some platforms. New EV data combined with extensive empirical data +indicates that the new recipe should use static CTLE with Preset 6 for +all integrated silicon SKUs. + +Fixes: c3f8de0b334c ("IB/hfi1: Add static PCIe Gen3 CTLE tuning") +Reviewed-by: Dennis Dalessandro +Signed-off-by: Easwar Hariharan +Signed-off-by: Dennis Dalessandro +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/hfi1/pcie.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/hfi1/pcie.c ++++ b/drivers/infiniband/hw/hfi1/pcie.c +@@ -673,12 +673,12 @@ MODULE_PARM_DESC(pcie_retry, "Driver wil + + #define UNSET_PSET 255 + #define DEFAULT_DISCRETE_PSET 2 /* discrete HFI */ +-#define DEFAULT_MCP_PSET 4 /* MCP HFI */ ++#define DEFAULT_MCP_PSET 6 /* MCP HFI */ + static uint pcie_pset = UNSET_PSET; + module_param(pcie_pset, uint, S_IRUGO); + MODULE_PARM_DESC(pcie_pset, "PCIe Eq Pset value to use, range is 0-10"); + +-static uint pcie_ctle = 1; /* discrete on, integrated off */ ++static uint pcie_ctle = 3; /* discrete on, integrated on */ + module_param(pcie_ctle, uint, S_IRUGO); + MODULE_PARM_DESC(pcie_ctle, "PCIe static CTLE mode, bit 0 - discrete on/off, bit 1 - integrated on/off"); + diff --git a/queue-4.9/iio-adc-xilinx-fix-error-handling.patch b/queue-4.9/iio-adc-xilinx-fix-error-handling.patch new file mode 100644 index 00000000000..c1a1ee0626d --- /dev/null +++ b/queue-4.9/iio-adc-xilinx-fix-error-handling.patch @@ -0,0 +1,51 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Christophe JAILLET +Date: Tue, 21 Feb 2017 07:34:00 +0100 +Subject: iio: adc: xilinx: Fix error handling + +From: Christophe JAILLET + + +[ Upstream commit ca1c39ef76376b67303d01f94fe98bb68bb3861a ] + +Reorder error handling labels in order to match the way resources have +been allocated. + +Signed-off-by: Christophe JAILLET +Acked-by: Lars-Peter Clausen +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/adc/xilinx-xadc-core.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/adc/xilinx-xadc-core.c ++++ b/drivers/iio/adc/xilinx-xadc-core.c +@@ -1208,7 +1208,7 @@ static int xadc_probe(struct platform_de + + ret = xadc->ops->setup(pdev, indio_dev, irq); + if (ret) +- goto err_free_samplerate_trigger; ++ goto err_clk_disable_unprepare; + + ret = request_irq(irq, xadc->ops->interrupt_handler, 0, + dev_name(&pdev->dev), indio_dev); +@@ -1268,6 +1268,8 @@ static int xadc_probe(struct platform_de + + err_free_irq: + free_irq(irq, indio_dev); ++err_clk_disable_unprepare: ++ clk_disable_unprepare(xadc->clk); + err_free_samplerate_trigger: + if (xadc->ops->flags & XADC_FLAGS_BUFFERED) + iio_trigger_free(xadc->samplerate_trigger); +@@ -1277,8 +1279,6 @@ err_free_convst_trigger: + err_triggered_buffer_cleanup: + if (xadc->ops->flags & XADC_FLAGS_BUFFERED) + iio_triggered_buffer_cleanup(indio_dev); +-err_clk_disable_unprepare: +- clk_disable_unprepare(xadc->clk); + err_device_free: + kfree(indio_dev->channels); + diff --git a/queue-4.9/initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch b/queue-4.9/initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch new file mode 100644 index 00000000000..d24c633a772 --- /dev/null +++ b/queue-4.9/initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch @@ -0,0 +1,73 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Lokesh Vutla +Date: Mon, 27 Feb 2017 14:28:12 -0800 +Subject: initramfs: finish fput() before accessing any binary from initramfs + +From: Lokesh Vutla + + +[ Upstream commit 08865514805d2de8e7002fa8149c5de3e391f412 ] + +Commit 4a9d4b024a31 ("switch fput to task_work_add") implements a +schedule_work() for completing fput(), but did not guarantee calling +__fput() after unpacking initramfs. Because of this, there is a +possibility that during boot a driver can see ETXTBSY when it tries to +load a binary from initramfs as fput() is still pending on that binary. + +This patch makes sure that fput() is completed after unpacking initramfs +and removes the call to flush_delayed_fput() in kernel_init() which +happens very late after unpacking initramfs. + +Link: http://lkml.kernel.org/r/20170201140540.22051-1-lokeshvutla@ti.com +Signed-off-by: Lokesh Vutla +Reported-by: Murali Karicheri +Cc: Al Viro +Cc: Tero Kristo +Cc: Sekhar Nori +Cc: Nishanth Menon +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + init/initramfs.c | 2 ++ + init/main.c | 3 --- + 2 files changed, 2 insertions(+), 3 deletions(-) + +--- a/init/initramfs.c ++++ b/init/initramfs.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + static ssize_t __init xwrite(int fd, const char *p, size_t count) + { +@@ -647,6 +648,7 @@ static int __init populate_rootfs(void) + printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err); + free_initrd(); + #endif ++ flush_delayed_fput(); + /* + * Try loading default modules from initramfs. This gives + * us a chance to load before device_initcalls. +--- a/init/main.c ++++ b/init/main.c +@@ -70,7 +70,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -947,8 +946,6 @@ static int __ref kernel_init(void *unuse + system_state = SYSTEM_RUNNING; + numa_default_policy(); + +- flush_delayed_fput(); +- + rcu_end_inkernel_boot(); + + if (ramdisk_execute_command) { diff --git a/queue-4.9/irqchip-crossbar-fix-incorrect-type-of-local-variables.patch b/queue-4.9/irqchip-crossbar-fix-incorrect-type-of-local-variables.patch new file mode 100644 index 00000000000..196b65f064a --- /dev/null +++ b/queue-4.9/irqchip-crossbar-fix-incorrect-type-of-local-variables.patch @@ -0,0 +1,48 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Franck Demathieu +Date: Thu, 23 Feb 2017 10:48:55 +0100 +Subject: irqchip/crossbar: Fix incorrect type of local variables + +From: Franck Demathieu + + +[ Upstream commit b28ace12661fbcfd90959c1e84ff5a85113a82a1 ] + +The max and entry variables are unsigned according to the dt-bindings. +Fix following 3 sparse issues (-Wtypesign): + + drivers/irqchip/irq-crossbar.c:222:52: warning: incorrect type in argument 3 (different signedness) + drivers/irqchip/irq-crossbar.c:222:52: expected unsigned int [usertype] *out_value + drivers/irqchip/irq-crossbar.c:222:52: got int * + + drivers/irqchip/irq-crossbar.c:245:56: warning: incorrect type in argument 4 (different signedness) + drivers/irqchip/irq-crossbar.c:245:56: expected unsigned int [usertype] *out_value + drivers/irqchip/irq-crossbar.c:245:56: got int * + + drivers/irqchip/irq-crossbar.c:263:56: warning: incorrect type in argument 4 (different signedness) + drivers/irqchip/irq-crossbar.c:263:56: expected unsigned int [usertype] *out_value + drivers/irqchip/irq-crossbar.c:263:56: got int * + +Signed-off-by: Franck Demathieu +Cc: marc.zyngier@arm.com +Cc: jason@lakedaemon.net +Link: http://lkml.kernel.org/r/20170223094855.6546-1-fdemathieu@gmail.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-crossbar.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/irqchip/irq-crossbar.c ++++ b/drivers/irqchip/irq-crossbar.c +@@ -198,7 +198,8 @@ static const struct irq_domain_ops cross + + static int __init crossbar_of_init(struct device_node *node) + { +- int i, size, max = 0, reserved = 0, entry; ++ int i, size, reserved = 0; ++ u32 max = 0, entry; + const __be32 *irqsr; + int ret = -ENOMEM; + diff --git a/queue-4.9/locking-lockdep-add-nest_lock-integrity-test.patch b/queue-4.9/locking-lockdep-add-nest_lock-integrity-test.patch new file mode 100644 index 00000000000..8311eeace00 --- /dev/null +++ b/queue-4.9/locking-lockdep-add-nest_lock-integrity-test.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Peter Zijlstra +Date: Wed, 1 Mar 2017 16:23:30 +0100 +Subject: locking/lockdep: Add nest_lock integrity test + +From: Peter Zijlstra + + +[ Upstream commit 7fb4a2cea6b18dab56d609530d077f168169ed6b ] + +Boqun reported that hlock->references can overflow. Add a debug test +for that to generate a clear error when this happens. + +Without this, lockdep is likely to report a mysterious failure on +unlock. + +Reported-by: Boqun Feng +Signed-off-by: Peter Zijlstra (Intel) +Cc: Andrew Morton +Cc: Chris Wilson +Cc: Linus Torvalds +Cc: Nicolai Hähnle +Cc: Paul E. McKenney +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3260,10 +3260,17 @@ static int __lock_acquire(struct lockdep + if (depth) { + hlock = curr->held_locks + depth - 1; + if (hlock->class_idx == class_idx && nest_lock) { +- if (hlock->references) ++ if (hlock->references) { ++ /* ++ * Check: unsigned int references:12, overflow. ++ */ ++ if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1)) ++ return 0; ++ + hlock->references++; +- else ++ } else { + hlock->references = 2; ++ } + + return 1; + } diff --git a/queue-4.9/mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch b/queue-4.9/mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch new file mode 100644 index 00000000000..efe5236e2b8 --- /dev/null +++ b/queue-4.9/mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch @@ -0,0 +1,48 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Emmanuel Grumbach +Date: Mon, 20 Feb 2017 14:24:36 +0100 +Subject: mac80211: fix power saving clients handling in iwlwifi + +From: Emmanuel Grumbach + + +[ Upstream commit d98937f4ea713d21e0fcc345919f86c877dd8d6f ] + +iwlwifi now supports RSS and can't let mac80211 track the +PS state based on the Rx frames since they can come out of +order. iwlwifi is now advertising AP_LINK_PS, and uses +explicit notifications to teach mac80211 about the PS state +of the stations and the PS poll / uAPSD trigger frames +coming our way from the peers. + +Because of that, the TIM stopped being maintained in +mac80211. I tried to fix this in commit c68df2e7be0c +("mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE") +but that was later reverted by Felix in commit 6c18a6b4e799 +("Revert "mac80211: allow using AP_LINK_PS with mac80211-generated TIM IE") +since it broke drivers that do not implement set_tim. + +Since none of the drivers that set AP_LINK_PS have the +set_tim() handler set besides iwlwifi, I can bail out in +__sta_info_recalc_tim if AP_LINK_PS AND .set_tim is not +implemented. + +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/sta_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -688,7 +688,7 @@ static void __sta_info_recalc_tim(struct + } + + /* No need to do anything if the driver does all */ +- if (ieee80211_hw_check(&local->hw, AP_LINK_PS)) ++ if (ieee80211_hw_check(&local->hw, AP_LINK_PS) && !local->ops->set_tim) + return; + + if (sta->dead) diff --git a/queue-4.9/mac80211_hwsim-check-hwsim_attr_radio_name-length.patch b/queue-4.9/mac80211_hwsim-check-hwsim_attr_radio_name-length.patch new file mode 100644 index 00000000000..7b244e06a8f --- /dev/null +++ b/queue-4.9/mac80211_hwsim-check-hwsim_attr_radio_name-length.patch @@ -0,0 +1,95 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Johannes Berg +Date: Mon, 27 Feb 2017 17:15:28 +0100 +Subject: mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length + +From: Johannes Berg + + +[ Upstream commit ff4dd73dd2b4806419f8ff65cbce11d5019548d0 ] + +Unfortunately, the nla policy was defined to have HWSIM_ATTR_RADIO_NAME +as an NLA_STRING, rather than NLA_NUL_STRING, so we can't use it as a +NUL-terminated string in the kernel. + +Rather than break the API, kasprintf() the string to a new buffer to +guarantee NUL termination. + +Reported-by: Andrew Zaborowski +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 28 +++++++++++++++++++++------- + 1 file changed, 21 insertions(+), 7 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3046,6 +3046,7 @@ static int hwsim_register_received_nl(st + static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + { + struct hwsim_new_radio_params param = { 0 }; ++ const char *hwname = NULL; + + param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG]; + param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE]; +@@ -3059,8 +3060,14 @@ static int hwsim_new_radio_nl(struct sk_ + if (info->attrs[HWSIM_ATTR_NO_VIF]) + param.no_vif = true; + +- if (info->attrs[HWSIM_ATTR_RADIO_NAME]) +- param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]); ++ if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { ++ hwname = kasprintf(GFP_KERNEL, "%.*s", ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ if (!hwname) ++ return -ENOMEM; ++ param.hwname = hwname; ++ } + + if (info->attrs[HWSIM_ATTR_USE_CHANCTX]) + param.use_chanctx = true; +@@ -3088,11 +3095,15 @@ static int hwsim_del_radio_nl(struct sk_ + s64 idx = -1; + const char *hwname = NULL; + +- if (info->attrs[HWSIM_ATTR_RADIO_ID]) ++ if (info->attrs[HWSIM_ATTR_RADIO_ID]) { + idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]); +- else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) +- hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]); +- else ++ } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { ++ hwname = kasprintf(GFP_KERNEL, "%.*s", ++ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), ++ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); ++ if (!hwname) ++ return -ENOMEM; ++ } else + return -EINVAL; + + spin_lock_bh(&hwsim_radio_lock); +@@ -3101,7 +3112,8 @@ static int hwsim_del_radio_nl(struct sk_ + if (data->idx != idx) + continue; + } else { +- if (strcmp(hwname, wiphy_name(data->hw->wiphy))) ++ if (!hwname || ++ strcmp(hwname, wiphy_name(data->hw->wiphy))) + continue; + } + +@@ -3112,10 +3124,12 @@ static int hwsim_del_radio_nl(struct sk_ + spin_unlock_bh(&hwsim_radio_lock); + mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), + info); ++ kfree(hwname); + return 0; + } + spin_unlock_bh(&hwsim_radio_lock); + ++ kfree(hwname); + return -ENODEV; + } + diff --git a/queue-4.9/md-linear-shutup-lockdep-warnning.patch b/queue-4.9/md-linear-shutup-lockdep-warnning.patch new file mode 100644 index 00000000000..a67b736a68b --- /dev/null +++ b/queue-4.9/md-linear-shutup-lockdep-warnning.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Shaohua Li +Date: Tue, 21 Feb 2017 11:57:01 -0800 +Subject: md/linear: shutup lockdep warnning + +From: Shaohua Li + + +[ Upstream commit d939cdfde34f50b95254b375f498447c82190b3e ] + +Commit 03a9e24(md linear: fix a race between linear_add() and +linear_congested()) introduces the warnning. + +Acked-by: Coly Li +Signed-off-by: Shaohua Li +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/linear.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/linear.c ++++ b/drivers/md/linear.c +@@ -223,7 +223,8 @@ static int linear_add(struct mddev *mdde + * oldconf until no one uses it anymore. + */ + mddev_suspend(mddev); +- oldconf = rcu_dereference(mddev->private); ++ oldconf = rcu_dereference_protected(mddev->private, ++ lockdep_is_held(&mddev->reconfig_mutex)); + mddev->raid_disks++; + WARN_ONCE(mddev->raid_disks != newconf->raid_disks, + "copied raid_disks doesn't match mddev->raid_disks"); diff --git a/queue-4.9/mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch b/queue-4.9/mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch new file mode 100644 index 00000000000..9210b3f9119 --- /dev/null +++ b/queue-4.9/mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch @@ -0,0 +1,130 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Yasuaki Ishimatsu +Date: Wed, 22 Feb 2017 15:45:13 -0800 +Subject: mm/memory_hotplug: set magic number to page->freelist instead of page->lru.next + +From: Yasuaki Ishimatsu + + +[ Upstream commit ddffe98d166f4a93d996d5aa628fd745311fc1e7 ] + +To identify that pages of page table are allocated from bootmem +allocator, magic number sets to page->lru.next. + +But page->lru list is initialized in reserve_bootmem_region(). So when +calling free_pagetable(), the function cannot find the magic number of +pages. And free_pagetable() frees the pages by free_reserved_page() not +put_page_bootmem(). + +But if the pages are allocated from bootmem allocator and used as page +table, the pages have private flag. So before freeing the pages, we +should clear the private flag by put_page_bootmem(). + +Before applying the commit 7bfec6f47bb0 ("mm, page_alloc: check multiple +page fields with a single branch"), we could find the following visible +issue: + + BUG: Bad page state in process kworker/u1024:1 + page:ffffea103cfd8040 count:0 mapcount:0 mappi + flags: 0x6fffff80000800(private) + page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set + bad because of flags: 0x800(private) + + Call Trace: + [...] dump_stack+0x63/0x87 + [...] bad_page+0x114/0x130 + [...] free_pages_prepare+0x299/0x2d0 + [...] free_hot_cold_page+0x31/0x150 + [...] __free_pages+0x25/0x30 + [...] free_pagetable+0x6f/0xb4 + [...] remove_pagetable+0x379/0x7ff + [...] vmemmap_free+0x10/0x20 + [...] sparse_remove_one_section+0x149/0x180 + [...] __remove_pages+0x2e9/0x4f0 + [...] arch_remove_memory+0x63/0xc0 + [...] remove_memory+0x8c/0xc0 + [...] acpi_memory_device_remove+0x79/0xa5 + [...] acpi_bus_trim+0x5a/0x8d + [...] acpi_bus_trim+0x38/0x8d + [...] acpi_device_hotplug+0x1b7/0x418 + [...] acpi_hotplug_work_fn+0x1e/0x29 + [...] process_one_work+0x152/0x400 + [...] worker_thread+0x125/0x4b0 + [...] kthread+0xd8/0xf0 + [...] ret_from_fork+0x22/0x40 + +And the issue still silently occurs. + +Until freeing the pages of page table allocated from bootmem allocator, +the page->freelist is never used. So the patch sets magic number to +page->freelist instead of page->lru.next. + +[isimatu.yasuaki@jp.fujitsu.com: fix merge issue] + Link: http://lkml.kernel.org/r/722b1cc4-93ac-dd8b-2be2-7a7e313b3b0b@gmail.com +Link: http://lkml.kernel.org/r/2c29bd9f-5b67-02d0-18a3-8828e78bbb6f@gmail.com +Signed-off-by: Yasuaki Ishimatsu +Cc: Thomas Gleixner +Cc: Ingo Molnar +Cc: H. Peter Anvin +Cc: Dave Hansen +Cc: Vlastimil Babka +Cc: Mel Gorman +Cc: Xishi Qiu +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/mm/init_64.c | 2 +- + mm/memory_hotplug.c | 5 +++-- + mm/sparse.c | 2 +- + 3 files changed, 5 insertions(+), 4 deletions(-) + +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -689,7 +689,7 @@ static void __meminit free_pagetable(str + if (PageReserved(page)) { + __ClearPageReserved(page); + +- magic = (unsigned long)page->lru.next; ++ magic = (unsigned long)page->freelist; + if (magic == SECTION_INFO || magic == MIX_SECTION_INFO) { + while (nr_pages--) + put_page_bootmem(page++); +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -179,7 +179,7 @@ static void release_memory_resource(stru + void get_page_bootmem(unsigned long info, struct page *page, + unsigned long type) + { +- page->lru.next = (struct list_head *) type; ++ page->freelist = (void *)type; + SetPagePrivate(page); + set_page_private(page, info); + page_ref_inc(page); +@@ -189,11 +189,12 @@ void put_page_bootmem(struct page *page) + { + unsigned long type; + +- type = (unsigned long) page->lru.next; ++ type = (unsigned long) page->freelist; + BUG_ON(type < MEMORY_HOTPLUG_MIN_BOOTMEM_TYPE || + type > MEMORY_HOTPLUG_MAX_BOOTMEM_TYPE); + + if (page_ref_dec_return(page) == 1) { ++ page->freelist = NULL; + ClearPagePrivate(page); + set_page_private(page, 0); + INIT_LIST_HEAD(&page->lru); +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -662,7 +662,7 @@ static void free_map_bootmem(struct page + >> PAGE_SHIFT; + + for (i = 0; i < nr_pages; i++, page++) { +- magic = (unsigned long) page->lru.next; ++ magic = (unsigned long) page->freelist; + + BUG_ON(magic == NODE_INFO); + diff --git a/queue-4.9/net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch b/queue-4.9/net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch new file mode 100644 index 00000000000..a7b61b0ccb2 --- /dev/null +++ b/queue-4.9/net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch @@ -0,0 +1,42 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Majd Dibbiny +Date: Thu, 23 Feb 2017 12:02:43 +0200 +Subject: net/mlx4_core: Fix VF overwrite of module param which disables DMFS on new probed PFs + +From: Majd Dibbiny + + +[ Upstream commit 95f1ba9a24af9769f6e20dfe9a77c863f253f311 ] + +In the VF driver, module parameter mlx4_log_num_mgm_entry_size was +mistakenly overwritten -- and in a manner which overrode the +device-managed flow steering option encoded in the parameter. + +log_num_mgm_entry_size is a global module parameter which +affects all ConnectX-3 PFs installed on that host. +If a VF changes log_num_mgm_entry_size, this will affect all PFs +which are probed subsequent to the change (by disabling DMFS for +those PFs). + +Fixes: 3c439b5586e9 ("mlx4_core: Allow choosing flow steering mode") +Signed-off-by: Majd Dibbiny +Reviewed-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/main.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -841,8 +841,6 @@ static int mlx4_slave_cap(struct mlx4_de + return -ENOSYS; + } + +- mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz; +- + dev->caps.hca_core_clock = hca_param.hca_core_clock; + + memset(&dev_cap, 0, sizeof(dev_cap)); diff --git a/queue-4.9/net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch b/queue-4.9/net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch new file mode 100644 index 00000000000..b2ed566d22d --- /dev/null +++ b/queue-4.9/net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch @@ -0,0 +1,98 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Eric Dumazet +Date: Thu, 23 Feb 2017 15:22:43 -0800 +Subject: net/mlx4_en: fix overflow in mlx4_en_init_timestamp() + +From: Eric Dumazet + + +[ Upstream commit 47d3a07528ecbbccf53bc4390d70b4e3d1c04fcf ] + +The cited commit makes a great job of finding optimal shift/multiplier +values assuming a 10 seconds wrap around, but forgot to change the +overflow_period computation. + +It overflows in cyclecounter_cyc2ns(), and the final result is 804 ms, +which is silly. + +Lets simply use 5 seconds, no need to recompute this, given how it is +supposed to work. + +Later, we will use a timer instead of a work queue, since the new RX +allocation schem will no longer need mlx4_en_recover_from_oom() and the +service_task firing every 250 ms. + +Fixes: 31c128b66e5b ("net/mlx4_en: Choose time-stamping shift value according to HW frequency") +Signed-off-by: Eric Dumazet +Cc: Tariq Toukan +Cc: Eugenia Emantayev +Reviewed-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/en_clock.c | 18 ++++++++---------- + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 - + 2 files changed, 8 insertions(+), 11 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c +@@ -88,10 +88,17 @@ void mlx4_en_remove_timestamp(struct mlx + } + } + ++#define MLX4_EN_WRAP_AROUND_SEC 10UL ++/* By scheduling the overflow check every 5 seconds, we have a reasonably ++ * good chance we wont miss a wrap around. ++ * TOTO: Use a timer instead of a work queue to increase the guarantee. ++ */ ++#define MLX4_EN_OVERFLOW_PERIOD (MLX4_EN_WRAP_AROUND_SEC * HZ / 2) ++ + void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev) + { + bool timeout = time_is_before_jiffies(mdev->last_overflow_check + +- mdev->overflow_period); ++ MLX4_EN_OVERFLOW_PERIOD); + unsigned long flags; + + if (timeout) { +@@ -236,7 +243,6 @@ static const struct ptp_clock_info mlx4_ + .enable = mlx4_en_phc_enable, + }; + +-#define MLX4_EN_WRAP_AROUND_SEC 10ULL + + /* This function calculates the max shift that enables the user range + * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register. +@@ -261,7 +267,6 @@ void mlx4_en_init_timestamp(struct mlx4_ + { + struct mlx4_dev *dev = mdev->dev; + unsigned long flags; +- u64 ns, zero = 0; + + /* mlx4_en_init_timestamp is called for each netdev. + * mdev->ptp_clock is common for all ports, skip initialization if +@@ -285,13 +290,6 @@ void mlx4_en_init_timestamp(struct mlx4_ + ktime_to_ns(ktime_get_real())); + write_unlock_irqrestore(&mdev->clock_lock, flags); + +- /* Calculate period in seconds to call the overflow watchdog - to make +- * sure counter is checked at least once every wrap around. +- */ +- ns = cyclecounter_cyc2ns(&mdev->cycles, mdev->cycles.mask, zero, &zero); +- do_div(ns, NSEC_PER_SEC / 2 / HZ); +- mdev->overflow_period = ns; +- + /* Configure the PHC */ + mdev->ptp_clock_info = mlx4_en_ptp_clock_info; + snprintf(mdev->ptp_clock_info.name, 16, "mlx4 ptp"); +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -419,7 +419,6 @@ struct mlx4_en_dev { + struct cyclecounter cycles; + struct timecounter clock; + unsigned long last_overflow_check; +- unsigned long overflow_period; + struct ptp_clock *ptp_clock; + struct ptp_clock_info ptp_clock_info; + struct notifier_block nb; diff --git a/queue-4.9/net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch b/queue-4.9/net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch new file mode 100644 index 00000000000..c014c1f14cf --- /dev/null +++ b/queue-4.9/net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch @@ -0,0 +1,51 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Thomas Petazzoni +Date: Tue, 21 Feb 2017 11:28:05 +0100 +Subject: net: mvpp2: release reference to txq_cpu[] entry after unmapping + +From: Thomas Petazzoni + + +[ Upstream commit 36fb7435b6ac4d288a2d4deea8934f9456ab46b6 ] + +The mvpp2_txq_bufs_free() function is called upon TX completion to DMA +unmap TX buffers, and free the corresponding SKBs. It gets the +references to the SKB to free and the DMA buffer to unmap from a per-CPU +txq_pcpu data structure. + +However, the code currently increments the pointer to the next entry +before doing the DMA unmap and freeing the SKB. It does not cause any +visible problem because for a given SKB the TX completion is guaranteed +to take place on the CPU where the TX was started. However, it is much +more logical to increment the pointer to the next entry once the current +entry has been completely unmapped/released. + +Signed-off-by: Thomas Petazzoni +Acked-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/mvpp2.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/marvell/mvpp2.c ++++ b/drivers/net/ethernet/marvell/mvpp2.c +@@ -4413,13 +4413,12 @@ static void mvpp2_txq_bufs_free(struct m + struct mvpp2_txq_pcpu_buf *tx_buf = + txq_pcpu->buffs + txq_pcpu->txq_get_index; + +- mvpp2_txq_inc_get(txq_pcpu); +- + dma_unmap_single(port->dev->dev.parent, tx_buf->phys, + tx_buf->size, DMA_TO_DEVICE); +- if (!tx_buf->skb) +- continue; +- dev_kfree_skb_any(tx_buf->skb); ++ if (tx_buf->skb) ++ dev_kfree_skb_any(tx_buf->skb); ++ ++ mvpp2_txq_inc_get(txq_pcpu); + } + } + diff --git a/queue-4.9/netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch b/queue-4.9/netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch new file mode 100644 index 00000000000..c96b3da4070 --- /dev/null +++ b/queue-4.9/netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch @@ -0,0 +1,46 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Jarno Rajahalme +Date: Thu, 23 Feb 2017 17:08:54 -0800 +Subject: netfilter: nf_ct_expect: Change __nf_ct_expect_check() return value. + +From: Jarno Rajahalme + + +[ Upstream commit 4b86c459c7bee3acaf92f0e2b4c6ac803eaa1a58 ] + +Commit 4dee62b1b9b4 ("netfilter: nf_ct_expect: nf_ct_expect_insert() +returns void") inadvertently changed the successful return value of +nf_ct_expect_related_report() from 0 to 1 due to +__nf_ct_expect_check() returning 1 on success. Prevent this +regression in the future by changing the return value of +__nf_ct_expect_check() to 0 on success. + +Signed-off-by: Jarno Rajahalme +Acked-by: Joe Stringer +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nf_conntrack_expect.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nf_conntrack_expect.c ++++ b/net/netfilter/nf_conntrack_expect.c +@@ -411,7 +411,7 @@ static inline int __nf_ct_expect_check(s + struct net *net = nf_ct_exp_net(expect); + struct hlist_node *next; + unsigned int h; +- int ret = 1; ++ int ret = 0; + + if (!master_help) { + ret = -ESHUTDOWN; +@@ -461,7 +461,7 @@ int nf_ct_expect_related_report(struct n + + spin_lock_bh(&nf_conntrack_expect_lock); + ret = __nf_ct_expect_check(expect); +- if (ret <= 0) ++ if (ret < 0) + goto out; + + ret = nf_ct_expect_insert(expect); diff --git a/queue-4.9/nfsd-callback-cleanup-callback-cred-on-shutdown.patch b/queue-4.9/nfsd-callback-cleanup-callback-cred-on-shutdown.patch new file mode 100644 index 00000000000..601082b95f6 --- /dev/null +++ b/queue-4.9/nfsd-callback-cleanup-callback-cred-on-shutdown.patch @@ -0,0 +1,89 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Kinglong Mee +Date: Sun, 5 Feb 2017 09:57:07 +0800 +Subject: nfsd/callback: Cleanup callback cred on shutdown + +From: Kinglong Mee + + +[ Upstream commit f7d1ddbe7648af7460d23688c8c131342eb43b3a ] + +The rpccred gotten from rpc_lookup_machine_cred() should be put when +state is shutdown. + +Signed-off-by: Kinglong Mee +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4callback.c | 8 ++++++++ + fs/nfsd/nfs4state.c | 10 ++++++---- + fs/nfsd/state.h | 1 + + 3 files changed, 15 insertions(+), 4 deletions(-) + +--- a/fs/nfsd/nfs4callback.c ++++ b/fs/nfsd/nfs4callback.c +@@ -753,6 +753,14 @@ int set_callback_cred(void) + return 0; + } + ++void cleanup_callback_cred(void) ++{ ++ if (callback_cred) { ++ put_rpccred(callback_cred); ++ callback_cred = NULL; ++ } ++} ++ + static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc_clnt *client, struct nfsd4_session *ses) + { + if (clp->cl_minorversion == 0) { +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -7012,23 +7012,24 @@ nfs4_state_start(void) + + ret = set_callback_cred(); + if (ret) +- return -ENOMEM; ++ return ret; ++ + laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4"); + if (laundry_wq == NULL) { + ret = -ENOMEM; +- goto out_recovery; ++ goto out_cleanup_cred; + } + ret = nfsd4_create_callback_queue(); + if (ret) + goto out_free_laundry; + + set_max_delegations(); +- + return 0; + + out_free_laundry: + destroy_workqueue(laundry_wq); +-out_recovery: ++out_cleanup_cred: ++ cleanup_callback_cred(); + return ret; + } + +@@ -7086,6 +7087,7 @@ nfs4_state_shutdown(void) + { + destroy_workqueue(laundry_wq); + nfsd4_destroy_callback_queue(); ++ cleanup_callback_cred(); + } + + static void +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -615,6 +615,7 @@ extern struct nfs4_client_reclaim *nfsd4 + extern __be32 nfs4_check_open_reclaim(clientid_t *clid, + struct nfsd4_compound_state *cstate, struct nfsd_net *nn); + extern int set_callback_cred(void); ++extern void cleanup_callback_cred(void); + extern void nfsd4_probe_callback(struct nfs4_client *clp); + extern void nfsd4_probe_callback_sync(struct nfs4_client *clp); + extern void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *); diff --git a/queue-4.9/ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch b/queue-4.9/ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch new file mode 100644 index 00000000000..ef026da7fc1 --- /dev/null +++ b/queue-4.9/ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch @@ -0,0 +1,283 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Eric Ren +Date: Wed, 22 Feb 2017 15:40:41 -0800 +Subject: ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock + +From: Eric Ren + + +[ Upstream commit 439a36b8ef38657f765b80b775e2885338d72451 ] + +We are in the situation that we have to avoid recursive cluster locking, +but there is no way to check if a cluster lock has been taken by a precess +already. + +Mostly, we can avoid recursive locking by writing code carefully. +However, we found that it's very hard to handle the routines that are +invoked directly by vfs code. For instance: + + const struct inode_operations ocfs2_file_iops = { + .permission = ocfs2_permission, + .get_acl = ocfs2_iop_get_acl, + .set_acl = ocfs2_iop_set_acl, + }; + +Both ocfs2_permission() and ocfs2_iop_get_acl() call ocfs2_inode_lock(PR): + + do_sys_open + may_open + inode_permission + ocfs2_permission + ocfs2_inode_lock() <=== first time + generic_permission + get_acl + ocfs2_iop_get_acl + ocfs2_inode_lock() <=== recursive one + +A deadlock will occur if a remote EX request comes in between two of +ocfs2_inode_lock(). Briefly describe how the deadlock is formed: + +On one hand, OCFS2_LOCK_BLOCKED flag of this lockres is set in +BAST(ocfs2_generic_handle_bast) when downconvert is started on behalf of +the remote EX lock request. Another hand, the recursive cluster lock +(the second one) will be blocked in in __ocfs2_cluster_lock() because of +OCFS2_LOCK_BLOCKED. But, the downconvert never complete, why? because +there is no chance for the first cluster lock on this node to be +unlocked - we block ourselves in the code path. + +The idea to fix this issue is mostly taken from gfs2 code. + +1. introduce a new field: struct ocfs2_lock_res.l_holders, to keep track + of the processes' pid who has taken the cluster lock of this lock + resource; + +2. introduce a new flag for ocfs2_inode_lock_full: + OCFS2_META_LOCK_GETBH; it means just getting back disk inode bh for + us if we've got cluster lock. + +3. export a helper: ocfs2_is_locked_by_me() is used to check if we have + got the cluster lock in the upper code path. + +The tracking logic should be used by some of the ocfs2 vfs's callbacks, +to solve the recursive locking issue cuased by the fact that vfs +routines can call into each other. + +The performance penalty of processing the holder list should only be +seen at a few cases where the tracking logic is used, such as get/set +acl. + +You may ask what if the first time we got a PR lock, and the second time +we want a EX lock? fortunately, this case never happens in the real +world, as far as I can see, including permission check, +(get|set)_(acl|attr), and the gfs2 code also do so. + +[sfr@canb.auug.org.au remove some inlines] +Link: http://lkml.kernel.org/r/20170117100948.11657-2-zren@suse.com +Signed-off-by: Eric Ren +Reviewed-by: Junxiao Bi +Reviewed-by: Joseph Qi +Cc: Stephen Rothwell +Cc: Mark Fasheh +Cc: Joel Becker +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/dlmglue.c | 105 +++++++++++++++++++++++++++++++++++++++++++++++++++-- + fs/ocfs2/dlmglue.h | 18 +++++++++ + fs/ocfs2/ocfs2.h | 1 + 3 files changed, 121 insertions(+), 3 deletions(-) + +--- a/fs/ocfs2/dlmglue.c ++++ b/fs/ocfs2/dlmglue.c +@@ -532,6 +532,7 @@ void ocfs2_lock_res_init_once(struct ocf + init_waitqueue_head(&res->l_event); + INIT_LIST_HEAD(&res->l_blocked_list); + INIT_LIST_HEAD(&res->l_mask_waiters); ++ INIT_LIST_HEAD(&res->l_holders); + } + + void ocfs2_inode_lock_res_init(struct ocfs2_lock_res *res, +@@ -749,6 +750,50 @@ void ocfs2_lock_res_free(struct ocfs2_lo + res->l_flags = 0UL; + } + ++/* ++ * Keep a list of processes who have interest in a lockres. ++ * Note: this is now only uesed for check recursive cluster locking. ++ */ ++static inline void ocfs2_add_holder(struct ocfs2_lock_res *lockres, ++ struct ocfs2_lock_holder *oh) ++{ ++ INIT_LIST_HEAD(&oh->oh_list); ++ oh->oh_owner_pid = get_pid(task_pid(current)); ++ ++ spin_lock(&lockres->l_lock); ++ list_add_tail(&oh->oh_list, &lockres->l_holders); ++ spin_unlock(&lockres->l_lock); ++} ++ ++static inline void ocfs2_remove_holder(struct ocfs2_lock_res *lockres, ++ struct ocfs2_lock_holder *oh) ++{ ++ spin_lock(&lockres->l_lock); ++ list_del(&oh->oh_list); ++ spin_unlock(&lockres->l_lock); ++ ++ put_pid(oh->oh_owner_pid); ++} ++ ++static inline int ocfs2_is_locked_by_me(struct ocfs2_lock_res *lockres) ++{ ++ struct ocfs2_lock_holder *oh; ++ struct pid *pid; ++ ++ /* look in the list of holders for one with the current task as owner */ ++ spin_lock(&lockres->l_lock); ++ pid = task_pid(current); ++ list_for_each_entry(oh, &lockres->l_holders, oh_list) { ++ if (oh->oh_owner_pid == pid) { ++ spin_unlock(&lockres->l_lock); ++ return 1; ++ } ++ } ++ spin_unlock(&lockres->l_lock); ++ ++ return 0; ++} ++ + static inline void ocfs2_inc_holders(struct ocfs2_lock_res *lockres, + int level) + { +@@ -2333,8 +2378,9 @@ int ocfs2_inode_lock_full_nested(struct + goto getbh; + } + +- if (ocfs2_mount_local(osb)) +- goto local; ++ if ((arg_flags & OCFS2_META_LOCK_GETBH) || ++ ocfs2_mount_local(osb)) ++ goto update; + + if (!(arg_flags & OCFS2_META_LOCK_RECOVERY)) + ocfs2_wait_for_recovery(osb); +@@ -2363,7 +2409,7 @@ int ocfs2_inode_lock_full_nested(struct + if (!(arg_flags & OCFS2_META_LOCK_RECOVERY)) + ocfs2_wait_for_recovery(osb); + +-local: ++update: + /* + * We only see this flag if we're being called from + * ocfs2_read_locked_inode(). It means we're locking an inode +@@ -2497,6 +2543,59 @@ void ocfs2_inode_unlock(struct inode *in + ocfs2_cluster_unlock(OCFS2_SB(inode->i_sb), lockres, level); + } + ++/* ++ * This _tracker variantes are introduced to deal with the recursive cluster ++ * locking issue. The idea is to keep track of a lock holder on the stack of ++ * the current process. If there's a lock holder on the stack, we know the ++ * task context is already protected by cluster locking. Currently, they're ++ * used in some VFS entry routines. ++ * ++ * return < 0 on error, return == 0 if there's no lock holder on the stack ++ * before this call, return == 1 if this call would be a recursive locking. ++ */ ++int ocfs2_inode_lock_tracker(struct inode *inode, ++ struct buffer_head **ret_bh, ++ int ex, ++ struct ocfs2_lock_holder *oh) ++{ ++ int status; ++ int arg_flags = 0, has_locked; ++ struct ocfs2_lock_res *lockres; ++ ++ lockres = &OCFS2_I(inode)->ip_inode_lockres; ++ has_locked = ocfs2_is_locked_by_me(lockres); ++ /* Just get buffer head if the cluster lock has been taken */ ++ if (has_locked) ++ arg_flags = OCFS2_META_LOCK_GETBH; ++ ++ if (likely(!has_locked || ret_bh)) { ++ status = ocfs2_inode_lock_full(inode, ret_bh, ex, arg_flags); ++ if (status < 0) { ++ if (status != -ENOENT) ++ mlog_errno(status); ++ return status; ++ } ++ } ++ if (!has_locked) ++ ocfs2_add_holder(lockres, oh); ++ ++ return has_locked; ++} ++ ++void ocfs2_inode_unlock_tracker(struct inode *inode, ++ int ex, ++ struct ocfs2_lock_holder *oh, ++ int had_lock) ++{ ++ struct ocfs2_lock_res *lockres; ++ ++ lockres = &OCFS2_I(inode)->ip_inode_lockres; ++ if (!had_lock) { ++ ocfs2_remove_holder(lockres, oh); ++ ocfs2_inode_unlock(inode, ex); ++ } ++} ++ + int ocfs2_orphan_scan_lock(struct ocfs2_super *osb, u32 *seqno) + { + struct ocfs2_lock_res *lockres; +--- a/fs/ocfs2/dlmglue.h ++++ b/fs/ocfs2/dlmglue.h +@@ -70,6 +70,11 @@ struct ocfs2_orphan_scan_lvb { + __be32 lvb_os_seqno; + }; + ++struct ocfs2_lock_holder { ++ struct list_head oh_list; ++ struct pid *oh_owner_pid; ++}; ++ + /* ocfs2_inode_lock_full() 'arg_flags' flags */ + /* don't wait on recovery. */ + #define OCFS2_META_LOCK_RECOVERY (0x01) +@@ -77,6 +82,8 @@ struct ocfs2_orphan_scan_lvb { + #define OCFS2_META_LOCK_NOQUEUE (0x02) + /* don't block waiting for the downconvert thread, instead return -EAGAIN */ + #define OCFS2_LOCK_NONBLOCK (0x04) ++/* just get back disk inode bh if we've got cluster lock. */ ++#define OCFS2_META_LOCK_GETBH (0x08) + + /* Locking subclasses of inode cluster lock */ + enum { +@@ -170,4 +177,15 @@ void ocfs2_put_dlm_debug(struct ocfs2_dl + + /* To set the locking protocol on module initialization */ + void ocfs2_set_locking_protocol(void); ++ ++/* The _tracker pair is used to avoid cluster recursive locking */ ++int ocfs2_inode_lock_tracker(struct inode *inode, ++ struct buffer_head **ret_bh, ++ int ex, ++ struct ocfs2_lock_holder *oh); ++void ocfs2_inode_unlock_tracker(struct inode *inode, ++ int ex, ++ struct ocfs2_lock_holder *oh, ++ int had_lock); ++ + #endif /* DLMGLUE_H */ +--- a/fs/ocfs2/ocfs2.h ++++ b/fs/ocfs2/ocfs2.h +@@ -172,6 +172,7 @@ struct ocfs2_lock_res { + + struct list_head l_blocked_list; + struct list_head l_mask_waiters; ++ struct list_head l_holders; + + unsigned long l_flags; + char l_name[OCFS2_LOCK_ID_MAX_LEN]; diff --git a/queue-4.9/powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch b/queue-4.9/powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch new file mode 100644 index 00000000000..167b1ff3c46 --- /dev/null +++ b/queue-4.9/powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch @@ -0,0 +1,47 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Madhavan Srinivasan +Date: Sun, 12 Feb 2017 22:33:15 +0530 +Subject: powerpc/perf: Add restrictions to PMC5 in power9 DD1 + +From: Madhavan Srinivasan + + +[ Upstream commit 8d911904f3ce412b20874a9c95f82009dcbb007c ] + +PMC5 on POWER9 DD1 may not provide right counts in all +sampling scenarios, hence use PM_INST_DISP event instead +in PMC2 or PMC3 in preference. + +Signed-off-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/perf/isa207-common.h | 4 ++++ + arch/powerpc/perf/power9-pmu.c | 2 +- + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/arch/powerpc/perf/isa207-common.h ++++ b/arch/powerpc/perf/isa207-common.h +@@ -201,6 +201,10 @@ + CNST_PMC_VAL(1) | CNST_PMC_VAL(2) | CNST_PMC_VAL(3) | \ + CNST_PMC_VAL(4) | CNST_PMC_VAL(5) | CNST_PMC_VAL(6) | CNST_NC_VAL + ++/* ++ * Lets restrict use of PMC5 for instruction counting. ++ */ ++#define P9_DD1_TEST_ADDER (ISA207_TEST_ADDER | CNST_PMC_VAL(5)) + + /* Bits in MMCR1 for PowerISA v2.07 */ + #define MMCR1_UNIT_SHIFT(pmc) (60 - (4 * ((pmc) - 1))) +--- a/arch/powerpc/perf/power9-pmu.c ++++ b/arch/powerpc/perf/power9-pmu.c +@@ -295,7 +295,7 @@ static struct power_pmu power9_pmu = { + .name = "POWER9", + .n_counter = MAX_PMU_COUNTERS, + .add_fields = ISA207_ADD_FIELDS, +- .test_adder = ISA207_TEST_ADDER, ++ .test_adder = P9_DD1_TEST_ADDER, + .compute_mmcr = isa207_compute_mmcr, + .config_bhrb = power9_config_bhrb, + .bhrb_filter_map = power9_bhrb_filter_map, diff --git a/queue-4.9/qed-don-t-use-attention-ptt-for-configuring-bw.patch b/queue-4.9/qed-don-t-use-attention-ptt-for-configuring-bw.patch new file mode 100644 index 00000000000..1e7514cc23b --- /dev/null +++ b/queue-4.9/qed-don-t-use-attention-ptt-for-configuring-bw.patch @@ -0,0 +1,74 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: "Mintz, Yuval" +Date: Mon, 27 Feb 2017 11:06:33 +0200 +Subject: qed: Don't use attention PTT for configuring BW + +From: "Mintz, Yuval" + + +[ Upstream commit 6f437d431930ff86e4a971d29321951faadb97c7 ] + +Commit 653d2ffd6405 ("qed*: Fix link indication race") introduced another +race - one of the inner functions called from the link-change flow is +explicitly using the slowpath context dedicated PTT instead of gaining +that PTT from the caller. Since this flow can now be called from +a different context as well, we're in risk of the PTT breaking. + +Fixes: 653d2ffd6405 ("qed*: Fix link indication race") +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed.h | 4 +++- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 6 +++--- + drivers/net/ethernet/qlogic/qed/qed_mcp.c | 3 ++- + 3 files changed, 8 insertions(+), 5 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed.h ++++ b/drivers/net/ethernet/qlogic/qed/qed.h +@@ -642,7 +642,9 @@ static inline u8 qed_concrete_to_sw_fid( + #define OOO_LB_TC 9 + + int qed_configure_vport_wfq(struct qed_dev *cdev, u16 vp_id, u32 rate); +-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate); ++void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, ++ struct qed_ptt *p_ptt, ++ u32 min_pf_rate); + + void qed_clean_wfq_db(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt); + #define QED_LEADING_HWFN(dev) (&dev->hwfns[0]) +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -2732,7 +2732,8 @@ int qed_configure_vport_wfq(struct qed_d + } + + /* API to configure WFQ from mcp link change */ +-void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, u32 min_pf_rate) ++void qed_configure_vp_wfq_on_link_change(struct qed_dev *cdev, ++ struct qed_ptt *p_ptt, u32 min_pf_rate) + { + int i; + +@@ -2746,8 +2747,7 @@ void qed_configure_vp_wfq_on_link_change + for_each_hwfn(cdev, i) { + struct qed_hwfn *p_hwfn = &cdev->hwfns[i]; + +- __qed_configure_vp_wfq_on_link_change(p_hwfn, +- p_hwfn->p_dpc_ptt, ++ __qed_configure_vp_wfq_on_link_change(p_hwfn, p_ptt, + min_pf_rate); + } + } +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -628,7 +628,8 @@ static void qed_mcp_handle_link_change(s + + /* Min bandwidth configuration */ + __qed_configure_pf_min_bandwidth(p_hwfn, p_ptt, p_link, min_bw); +- qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_link->min_pf_rate); ++ qed_configure_vp_wfq_on_link_change(p_hwfn->cdev, p_ptt, ++ p_link->min_pf_rate); + + p_link->an = !!(status & LINK_STATUS_AUTO_NEGOTIATE_ENABLED); + p_link->an_complete = !!(status & diff --git a/queue-4.9/qed-read-queue-state-before-releasing-buffer.patch b/queue-4.9/qed-read-queue-state-before-releasing-buffer.patch new file mode 100644 index 00000000000..77817970e21 --- /dev/null +++ b/queue-4.9/qed-read-queue-state-before-releasing-buffer.patch @@ -0,0 +1,60 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Ram Amrani +Date: Mon, 20 Feb 2017 22:43:31 +0200 +Subject: qed: Read queue state before releasing buffer + +From: Ram Amrani + + +[ Upstream commit c5212b943d4b52a7d9e0d9f747e7ad59c50d31f1 ] + +Currently the state is read only after the buffers are relesed. + +Signed-off-by: Ram Amrani +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_roce.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c +@@ -1766,13 +1766,13 @@ static int qed_roce_query_qp(struct qed_ + if (rc) + goto err_resp; + +- dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_resp_ramrod_res), +- p_resp_ramrod_res, resp_ramrod_res_phys); +- + out_params->rq_psn = le32_to_cpu(p_resp_ramrod_res->psn); + rq_err_state = GET_FIELD(le32_to_cpu(p_resp_ramrod_res->err_flag), + ROCE_QUERY_QP_RESP_OUTPUT_PARAMS_ERROR_FLG); + ++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_resp_ramrod_res), ++ p_resp_ramrod_res, resp_ramrod_res_phys); ++ + if (!(qp->req_offloaded)) { + /* Don't send query qp for the requester */ + out_params->sq_psn = qp->sq_psn; +@@ -1813,9 +1813,6 @@ static int qed_roce_query_qp(struct qed_ + if (rc) + goto err_req; + +- dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_req_ramrod_res), +- p_req_ramrod_res, req_ramrod_res_phys); +- + out_params->sq_psn = le32_to_cpu(p_req_ramrod_res->psn); + sq_err_state = GET_FIELD(le32_to_cpu(p_req_ramrod_res->flags), + ROCE_QUERY_QP_REQ_OUTPUT_PARAMS_ERR_FLG); +@@ -1823,6 +1820,9 @@ static int qed_roce_query_qp(struct qed_ + GET_FIELD(le32_to_cpu(p_req_ramrod_res->flags), + ROCE_QUERY_QP_REQ_OUTPUT_PARAMS_SQ_DRAINING_FLG); + ++ dma_free_coherent(&p_hwfn->cdev->pdev->dev, sizeof(*p_req_ramrod_res), ++ p_req_ramrod_res, req_ramrod_res_phys); ++ + out_params->draining = false; + + if (rq_err_state) diff --git a/queue-4.9/qed-reserve-doorbell-bar-space-for-present-cpus.patch b/queue-4.9/qed-reserve-doorbell-bar-space-for-present-cpus.patch new file mode 100644 index 00000000000..29cb0faebe6 --- /dev/null +++ b/queue-4.9/qed-reserve-doorbell-bar-space-for-present-cpus.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Ram Amrani +Date: Mon, 20 Feb 2017 22:43:33 +0200 +Subject: qed: Reserve doorbell BAR space for present CPUs + +From: Ram Amrani + + +[ Upstream commit c2dedf8773e873474535bd4a158609b9eda5403d ] + +Reserving doorbell BAR space according to the currently active CPUs +may result in a bug if disabled CPUs are later enabled but no +doorbell space was reserved for them. + +Signed-off-by: Ram Amrani +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qed/qed_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -877,7 +877,7 @@ qed_hw_init_pf_doorbell_bar(struct qed_h + /* Either EDPM is mandatory, or we are attempting to allocate a + * WID per CPU. + */ +- n_cpus = num_active_cpus(); ++ n_cpus = num_present_cpus(); + rc = qed_hw_init_dpi_size(p_hwfn, p_ptt, pwm_regsize, n_cpus); + } + diff --git a/queue-4.9/qede-prevent-index-problems-in-loopback-test.patch b/queue-4.9/qede-prevent-index-problems-in-loopback-test.patch new file mode 100644 index 00000000000..d85fd499d2e --- /dev/null +++ b/queue-4.9/qede-prevent-index-problems-in-loopback-test.patch @@ -0,0 +1,51 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Sudarsana Reddy Kalluru +Date: Mon, 20 Feb 2017 22:43:37 +0200 +Subject: qede: Prevent index problems in loopback test + +From: Sudarsana Reddy Kalluru + + +[ Upstream commit afe981d664aeeebc8d1bcbd7d2070b5432edaecb ] + +Driver currently utilizes the same loop variable in two +nested loops. + +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Yuval Mintz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qede/qede_ethtool.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qede/qede_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_ethtool.c +@@ -1221,7 +1221,7 @@ static int qede_selftest_receive_traffic + struct qede_rx_queue *rxq = NULL; + struct sw_rx_data *sw_rx_data; + union eth_rx_cqe *cqe; +- int i, rc = 0; ++ int i, iter, rc = 0; + u8 *data_ptr; + + for_each_queue(i) { +@@ -1240,7 +1240,7 @@ static int qede_selftest_receive_traffic + * enabled. This is because the queue 0 is configured as the default + * queue and that the loopback traffic is not IP. + */ +- for (i = 0; i < QEDE_SELFTEST_POLL_COUNT; i++) { ++ for (iter = 0; iter < QEDE_SELFTEST_POLL_COUNT; iter++) { + if (!qede_has_rx_work(rxq)) { + usleep_range(100, 200); + continue; +@@ -1287,7 +1287,7 @@ static int qede_selftest_receive_traffic + qed_chain_recycle_consumed(&rxq->rx_comp_ring); + } + +- if (i == QEDE_SELFTEST_POLL_COUNT) { ++ if (iter == QEDE_SELFTEST_POLL_COUNT) { + DP_NOTICE(edev, "Failed to receive the traffic\n"); + return -1; + } diff --git a/queue-4.9/regulator-core-resolve-supplies-before-disabling-unused-regulators.patch b/queue-4.9/regulator-core-resolve-supplies-before-disabling-unused-regulators.patch new file mode 100644 index 00000000000..c7c17c8c14b --- /dev/null +++ b/queue-4.9/regulator-core-resolve-supplies-before-disabling-unused-regulators.patch @@ -0,0 +1,59 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Javier Martinez Canillas +Date: Thu, 16 Feb 2017 14:30:02 -0300 +Subject: regulator: core: Resolve supplies before disabling unused regulators + +From: Javier Martinez Canillas + + +[ Upstream commit 3827b64dba27ebadb4faf51f2c91143e01ba1f6d ] + +After commit 66d228a2bf03 ("regulator: core: Don't use regulators as +supplies until the parent is bound"), input supplies aren't resolved +if the input supplies parent device has not been bound. This prevent +regulators to hold an invalid reference if its supply parent device +driver probe is deferred. + +But this causes issues on some boards where a PMIC's regulator use as +input supply a regulator from another PMIC whose driver is registered +after the driver for the former. + +In this case the regulators for the first PMIC will fail to resolve +input supplies on regulators registration (since the other PMIC wasn't +probed yet). And when the core attempts to resolve again latter when +the other PMIC registers its own regulators, it will fail again since +the parent device isn't bound yet. + +This will cause some parent supplies to never be resolved and wrongly +be disabled on boot due taking them as unused. + +To solve this problem, also attempt to resolve the pending regulators +input supplies before disabling the unused regulators. + +Signed-off-by: Javier Martinez Canillas +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/regulator/core.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4507,6 +4507,16 @@ static int __init regulator_init_complet + if (of_have_populated_dt()) + has_full_constraints = true; + ++ /* ++ * Regulators may had failed to resolve their input supplies ++ * when were registered, either because the input supply was ++ * not registered yet or because its parent device was not ++ * bound yet. So attempt to resolve the input supplies for ++ * pending regulators before trying to disable unused ones. ++ */ ++ class_for_each_device(®ulator_class, NULL, NULL, ++ regulator_register_resolve_supply); ++ + /* If we have a full configuration then disable any regulators + * we have permission to change the status for and which are + * not in use or always_on. This is effectively the default diff --git a/queue-4.9/revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch b/queue-4.9/revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch new file mode 100644 index 00000000000..f99d8a8f659 --- /dev/null +++ b/queue-4.9/revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch @@ -0,0 +1,35 @@ +From 42fbb07e2e3a338154ee747bf28dc688bc599b81 Mon Sep 17 00:00:00 2001 +From: Greg Kroah-Hartman +Date: Thu, 19 Oct 2017 14:55:29 +0200 +Subject: [PATCH] Revert "bsg-lib: don't free job in bsg_prepare_job" + +This reverts commit eb4375e1969c48d454998b2a284c2e6a5dc9eb68 which was +commit f507b54dccfd8000c517d740bc45f20c74532d18 upstream. + +Ben reports: + That function doesn't exist here (it was introduced in 4.13). + Instead, this backport has modified bsg_create_job(), creating a + leak. Please revert this on the 3.18, 4.4 and 4.9 stable + branches. + +So I'm dropping it from here. + +Reported-by: Ben Hutchings +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Jens Axboe +Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org +--- + block/bsg-lib.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/block/bsg-lib.c ++++ b/block/bsg-lib.c +@@ -147,6 +147,7 @@ static int bsg_create_job(struct device + failjob_rls_rqst_payload: + kfree(job->request_payload.sg_list); + failjob_rls_job: ++ kfree(job); + return -ENOMEM; + } + diff --git a/queue-4.9/sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch b/queue-4.9/sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch new file mode 100644 index 00000000000..2b055661db4 --- /dev/null +++ b/queue-4.9/sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Wanpeng Li +Date: Tue, 21 Feb 2017 23:52:55 -0800 +Subject: sched/fair: Update rq clock before changing a task's CPU affinity + +From: Wanpeng Li + + +[ Upstream commit a499c3ead88ccf147fc50689e85a530ad923ce36 ] + +This is triggered during boot when CONFIG_SCHED_DEBUG is enabled: + + ------------[ cut here ]------------ + WARNING: CPU: 6 PID: 81 at kernel/sched/sched.h:812 set_next_entity+0x11d/0x380 + rq->clock_update_flags < RQCF_ACT_SKIP + CPU: 6 PID: 81 Comm: torture_shuffle Not tainted 4.10.0+ #1 + Hardware name: LENOVO ThinkCentre M8500t-N000/SHARKBAY, BIOS FBKTC1AUS 02/16/2016 + Call Trace: + dump_stack+0x85/0xc2 + __warn+0xcb/0xf0 + warn_slowpath_fmt+0x5f/0x80 + set_next_entity+0x11d/0x380 + set_curr_task_fair+0x2b/0x60 + do_set_cpus_allowed+0x139/0x180 + __set_cpus_allowed_ptr+0x113/0x260 + set_cpus_allowed_ptr+0x10/0x20 + torture_shuffle+0xfd/0x180 + kthread+0x10f/0x150 + ? torture_shutdown_init+0x60/0x60 + ? kthread_create_on_node+0x60/0x60 + ret_from_fork+0x31/0x40 + ---[ end trace dd94d92344cea9c6 ]--- + +The task is running && !queued, so there is no rq clock update before calling +set_curr_task(). + +This patch fixes it by updating rq clock after holding rq->lock/pi_lock +just as what other dequeue + put_prev + enqueue + set_curr story does. + +Signed-off-by: Wanpeng Li +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Matt Fleming +Cc: Linus Torvalds +Cc: Mike Galbraith +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/1487749975-5994-1-git-send-email-wanpeng.li@hotmail.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1141,6 +1141,7 @@ static int __set_cpus_allowed_ptr(struct + int ret = 0; + + rq = task_rq_lock(p, &rf); ++ update_rq_clock(rq); + + if (p->flags & PF_KTHREAD) { + /* diff --git a/queue-4.9/scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch b/queue-4.9/scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch new file mode 100644 index 00000000000..902e0287929 --- /dev/null +++ b/queue-4.9/scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Dan Carpenter +Date: Tue, 21 Feb 2017 21:46:37 +0300 +Subject: scsi: scsi_dh_emc: return success in clariion_std_inquiry() + +From: Dan Carpenter + + +[ Upstream commit 4d7d39a18b8b81511f0b893b7d2203790bf8a58b ] + +We accidentally return an uninitialized variable on success. + +Fixes: b6ff1b14cdf4 ("[SCSI] scsi_dh: Update EMC handler") +Signed-off-by: Dan Carpenter +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/device_handler/scsi_dh_emc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/device_handler/scsi_dh_emc.c ++++ b/drivers/scsi/device_handler/scsi_dh_emc.c +@@ -461,7 +461,7 @@ static int clariion_prep_fn(struct scsi_ + static int clariion_std_inquiry(struct scsi_device *sdev, + struct clariion_dh_data *csdev) + { +- int err; ++ int err = SCSI_DH_OK; + char *sp_model; + + err = send_inquiry_cmd(sdev, 0, csdev); diff --git a/queue-4.9/series b/queue-4.9/series index 93e74ee1202..f88cbebcd86 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1 +1,50 @@ mips-fix-minimum-alignment-requirement-of-irq-stack.patch +revert-bsg-lib-don-t-free-job-in-bsg_prepare_job.patch +xen-netback-use-gfp_atomic-to-allocate-hash.patch +locking-lockdep-add-nest_lock-integrity-test.patch +watchdog-kempld-fix-gcc-4.3-build.patch +irqchip-crossbar-fix-incorrect-type-of-local-variables.patch +initramfs-finish-fput-before-accessing-any-binary-from-initramfs.patch +mac80211_hwsim-check-hwsim_attr_radio_name-length.patch +alsa-hda-add-geminilake-hdmi-codec-id.patch +qed-don-t-use-attention-ptt-for-configuring-bw.patch +mac80211-fix-power-saving-clients-handling-in-iwlwifi.patch +net-mlx4_en-fix-overflow-in-mlx4_en_init_timestamp.patch +staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch +netfilter-nf_ct_expect-change-__nf_ct_expect_check-return-value.patch +iio-adc-xilinx-fix-error-handling.patch +f2fs-do-ssr-for-data-when-there-is-enough-free-space.patch +sched-fair-update-rq-clock-before-changing-a-task-s-cpu-affinity.patch +btrfs-send-fix-failure-to-rename-top-level-inode-due-to-name-collision.patch +f2fs-do-not-wait-for-writeback-in-write_begin.patch +md-linear-shutup-lockdep-warnning.patch +sparc64-migrate-hvcons-irq-to-panicked-cpu.patch +net-mlx4_core-fix-vf-overwrite-of-module-param-which-disables-dmfs-on-new-probed-pfs.patch +crypto-xts-add-ecb-dependency.patch +mm-memory_hotplug-set-magic-number-to-page-freelist-instead-of-page-lru.next.patch +ocfs2-dlmglue-prepare-tracking-logic-to-avoid-recursive-cluster-lock.patch +slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch +scsi-scsi_dh_emc-return-success-in-clariion_std_inquiry.patch +asoc-mediatek-add-i2c-dependency-for-cs42xx8.patch +drm-amdgpu-refuse-to-reserve-io-mem-for-split-vram-buffers.patch +net-mvpp2-release-reference-to-txq_cpu-entry-after-unmapping.patch +qede-prevent-index-problems-in-loopback-test.patch +qed-reserve-doorbell-bar-space-for-present-cpus.patch +qed-read-queue-state-before-releasing-buffer.patch +i2c-at91-ensure-state-is-restored-after-suspending.patch +ceph-don-t-update_dentry_lease-unless-we-actually-got-one.patch +ceph-fix-bogus-endianness-change-in-ceph_ioctl_set_layout.patch +ceph-clean-up-unsafe-d_parent-accesses-in-build_dentry_path.patch +uapi-fix-linux-rds.h-userspace-compilation-errors.patch +uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch +ib-hfi1-use-static-ctle-with-preset-6-for-integrated-hfis.patch +ib-hfi1-allocate-context-data-on-memory-node.patch +target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch +hrtimer-catch-invalid-clockids-again.patch +nfsd-callback-cleanup-callback-cred-on-shutdown.patch +powerpc-perf-add-restrictions-to-pmc5-in-power9-dd1.patch +drm-nouveau-gr-gf100-fix-ccache-error-logging.patch +regulator-core-resolve-supplies-before-disabling-unused-regulators.patch +btmrvl-avoid-double-disable_irq-race.patch +edac-mce_amd-print-ipid-and-syndrome-on-a-separate-line.patch +cpufreq-cppc-add-acpi_processor-dependency.patch diff --git a/queue-4.9/slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch b/queue-4.9/slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch new file mode 100644 index 00000000000..87704e4be5e --- /dev/null +++ b/queue-4.9/slub-do-not-merge-cache-if-slub_debug-contains-a-never-merge-flag.patch @@ -0,0 +1,57 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Grygorii Maistrenko +Date: Wed, 22 Feb 2017 15:40:59 -0800 +Subject: slub: do not merge cache if slub_debug contains a never-merge flag + +From: Grygorii Maistrenko + + +[ Upstream commit c6e28895a4372992961888ffaadc9efc643b5bfe ] + +In case CONFIG_SLUB_DEBUG_ON=n, find_mergeable() gets debug features from +commandline but never checks if there are features from the +SLAB_NEVER_MERGE set. + +As a result selected by slub_debug caches are always mergeable if they +have been created without a custom constructor set or without one of the +SLAB_* debug features on. + +This moves the SLAB_NEVER_MERGE check below the flags update from +commandline to make sure it won't merge the slab cache if one of the debug +features is on. + +Link: http://lkml.kernel.org/r/20170101124451.GA4740@lp-laptop-d +Signed-off-by: Grygorii Maistrenko +Reviewed-by: Pekka Enberg +Acked-by: David Rientjes +Acked-by: Christoph Lameter +Cc: Joonsoo Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + mm/slab_common.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -255,7 +255,7 @@ struct kmem_cache *find_mergeable(size_t + { + struct kmem_cache *s; + +- if (slab_nomerge || (flags & SLAB_NEVER_MERGE)) ++ if (slab_nomerge) + return NULL; + + if (ctor) +@@ -266,6 +266,9 @@ struct kmem_cache *find_mergeable(size_t + size = ALIGN(size, align); + flags = kmem_cache_flags(size, flags, name, NULL); + ++ if (flags & SLAB_NEVER_MERGE) ++ return NULL; ++ + list_for_each_entry_reverse(s, &slab_caches, list) { + if (slab_unmergeable(s)) + continue; diff --git a/queue-4.9/sparc64-migrate-hvcons-irq-to-panicked-cpu.patch b/queue-4.9/sparc64-migrate-hvcons-irq-to-panicked-cpu.patch new file mode 100644 index 00000000000..befa7300c16 --- /dev/null +++ b/queue-4.9/sparc64-migrate-hvcons-irq-to-panicked-cpu.patch @@ -0,0 +1,70 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Vijay Kumar +Date: Wed, 1 Feb 2017 11:34:38 -0800 +Subject: sparc64: Migrate hvcons irq to panicked cpu + +From: Vijay Kumar + + +[ Upstream commit 7dd4fcf5b70694dc961eb6b954673e4fc9730dbd ] + +On panic, all other CPUs are stopped except the one which had +hit panic. To keep console alive, we need to migrate hvcons irq +to panicked CPU. + +Signed-off-by: Vijay Kumar +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sparc/include/asm/setup.h | 5 ++++- + arch/sparc/kernel/smp_64.c | 6 +++++- + drivers/tty/serial/sunhv.c | 6 ++++++ + 3 files changed, 15 insertions(+), 2 deletions(-) + +--- a/arch/sparc/include/asm/setup.h ++++ b/arch/sparc/include/asm/setup.h +@@ -59,8 +59,11 @@ extern atomic_t dcpage_flushes; + extern atomic_t dcpage_flushes_xcall; + + extern int sysctl_tsb_ratio; +-#endif + ++#ifdef CONFIG_SERIAL_SUNHV ++void sunhv_migrate_hvcons_irq(int cpu); ++#endif ++#endif + void sun_do_break(void); + extern int stop_a_enabled; + extern int scons_pwroff; +--- a/arch/sparc/kernel/smp_64.c ++++ b/arch/sparc/kernel/smp_64.c +@@ -1465,8 +1465,12 @@ void smp_send_stop(void) + int cpu; + + if (tlb_type == hypervisor) { ++ int this_cpu = smp_processor_id(); ++#ifdef CONFIG_SERIAL_SUNHV ++ sunhv_migrate_hvcons_irq(this_cpu); ++#endif + for_each_online_cpu(cpu) { +- if (cpu == smp_processor_id()) ++ if (cpu == this_cpu) + continue; + #ifdef CONFIG_SUN_LDOMS + if (ldom_domaining_enabled) { +--- a/drivers/tty/serial/sunhv.c ++++ b/drivers/tty/serial/sunhv.c +@@ -398,6 +398,12 @@ static struct uart_driver sunhv_reg = { + + static struct uart_port *sunhv_port; + ++void sunhv_migrate_hvcons_irq(int cpu) ++{ ++ /* Migrate hvcons irq to param cpu */ ++ irq_force_affinity(sunhv_port->irq, cpumask_of(cpu)); ++} ++ + /* Copy 's' into the con_write_page, decoding "\n" into + * "\r\n" along the way. We have to return two lengths + * because the caller needs to know how much to advance diff --git a/queue-4.9/staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch b/queue-4.9/staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch new file mode 100644 index 00000000000..6a419cf3dc6 --- /dev/null +++ b/queue-4.9/staging-vchiq_2835_arm-make-cache-line-size-a-required-dt-property.patch @@ -0,0 +1,50 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Michael Zoran +Date: Sat, 18 Feb 2017 03:22:01 -0800 +Subject: staging: vchiq_2835_arm: Make cache-line-size a required DT property + +From: Michael Zoran + + +[ Upstream commit 6cf1bf636a067eb308cb3a8322b9d6b1844a075d ] + +The original github source allowed for the cache-line-size property +to be missing. Since recent firmwares also require this property, +it makes sense to always require it in the driver as well. + +If the cache-line-size property is missing, then the driver probe +should fail as no dev since the kernel and dt may be out of sync. +The fix is to add a check for the return value of of_property_read_u32. + +Changes V2: + 1. Add error message if cache-line-size is missing. + 2. Simple check for non-zero return value from + of_property_read_u32. + +Signed-off-by: Michael Zoran +Acked-by: Stefan Wahren +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c +@@ -106,8 +106,14 @@ int vchiq_platform_init(struct platform_ + + g_virt_to_bus_offset = virt_to_dma(dev, (void *)0); + +- (void)of_property_read_u32(dev->of_node, "cache-line-size", ++ err = of_property_read_u32(dev->of_node, "cache-line-size", + &g_cache_line_size); ++ ++ if (err) { ++ dev_err(dev, "Missing cache-line-size property\n"); ++ return -ENODEV; ++ } ++ + g_fragments_size = 2 * g_cache_line_size; + + /* Allocate space for the channels in coherent memory */ diff --git a/queue-4.9/target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch b/queue-4.9/target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch new file mode 100644 index 00000000000..07940809358 --- /dev/null +++ b/queue-4.9/target-iscsi-fix-unsolicited-data-seq_end_offset-calculation.patch @@ -0,0 +1,62 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Varun Prakash +Date: Fri, 20 Jan 2017 16:44:33 +0530 +Subject: target/iscsi: Fix unsolicited data seq_end_offset calculation + +From: Varun Prakash + + +[ Upstream commit 4d65491c269729a1e3b375c45e73213f49103d33 ] + +In case of unsolicited data for the first sequence +seq_end_offset must be set to minimum of total data length +and FirstBurstLength, so do not add cmd->write_data_done +to the min of total data length and FirstBurstLength. + +This patch avoids that with ImmediateData=Yes, InitialR2T=No, +MaxXmitDataSegmentLength < FirstBurstLength that a WRITE command +with IO size above FirstBurstLength triggers sequence error +messages, for example + +Set following parameters on target (linux-4.8.12) +ImmediateData = Yes +InitialR2T = No +MaxXmitDataSegmentLength = 8k +FirstBurstLength = 64k + +Log in from Open iSCSI initiator and execute +dd if=/dev/zero of=/dev/sdb bs=128k count=1 oflag=direct + +Error messages on target +Command ITT: 0x00000035 with Offset: 65536, Length: 8192 outside +of Sequence 73728:131072 while DataSequenceInOrder=Yes. +Command ITT: 0x00000035, received DataSN: 0x00000001 higher than +expected 0x00000000. +Unable to perform within-command recovery while ERL=0. + +Signed-off-by: Varun Prakash +[ bvanassche: Use min() instead of open-coding it / edited patch description ] +Signed-off-by: Bart Van Assche +Signed-off-by: Nicholas Bellinger + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/target/iscsi/iscsi_target_erl0.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/target/iscsi/iscsi_target_erl0.c ++++ b/drivers/target/iscsi/iscsi_target_erl0.c +@@ -44,10 +44,8 @@ void iscsit_set_dataout_sequence_values( + */ + if (cmd->unsolicited_data) { + cmd->seq_start_offset = cmd->write_data_done; +- cmd->seq_end_offset = (cmd->write_data_done + +- ((cmd->se_cmd.data_length > +- conn->sess->sess_ops->FirstBurstLength) ? +- conn->sess->sess_ops->FirstBurstLength : cmd->se_cmd.data_length)); ++ cmd->seq_end_offset = min(cmd->se_cmd.data_length, ++ conn->sess->sess_ops->FirstBurstLength); + return; + } + diff --git a/queue-4.9/uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch b/queue-4.9/uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch new file mode 100644 index 00000000000..7dfdf8a5f62 --- /dev/null +++ b/queue-4.9/uapi-fix-linux-mroute6.h-userspace-compilation-errors.patch @@ -0,0 +1,44 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: "Dmitry V. Levin" +Date: Thu, 16 Feb 2017 18:04:29 +0300 +Subject: uapi: fix linux/mroute6.h userspace compilation errors + +From: "Dmitry V. Levin" + + +[ Upstream commit 72aa107df6a275cf03359934ca5799a2be7a1bf7 ] + +Include to fix the following linux/mroute6.h userspace +compilation errors: + +/usr/include/linux/mroute6.h:80:22: error: field 'mf6cc_origin' has incomplete type + struct sockaddr_in6 mf6cc_origin; /* Origin of mcast */ +/usr/include/linux/mroute6.h:81:22: error: field 'mf6cc_mcastgrp' has incomplete type + struct sockaddr_in6 mf6cc_mcastgrp; /* Group in question */ +/usr/include/linux/mroute6.h:91:22: error: field 'src' has incomplete type + struct sockaddr_in6 src; +/usr/include/linux/mroute6.h:92:22: error: field 'grp' has incomplete type + struct sockaddr_in6 grp; +/usr/include/linux/mroute6.h:132:18: error: field 'im6_src' has incomplete type + struct in6_addr im6_src, im6_dst; +/usr/include/linux/mroute6.h:132:27: error: field 'im6_dst' has incomplete type + struct in6_addr im6_src, im6_dst; + +Signed-off-by: Dmitry V. Levin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/mroute6.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/uapi/linux/mroute6.h ++++ b/include/uapi/linux/mroute6.h +@@ -4,6 +4,7 @@ + #include + #include + #include ++#include /* For struct sockaddr_in6. */ + + /* + * Based on the MROUTING 3.5 defines primarily to keep diff --git a/queue-4.9/uapi-fix-linux-rds.h-userspace-compilation-errors.patch b/queue-4.9/uapi-fix-linux-rds.h-userspace-compilation-errors.patch new file mode 100644 index 00000000000..9a3561df65c --- /dev/null +++ b/queue-4.9/uapi-fix-linux-rds.h-userspace-compilation-errors.patch @@ -0,0 +1,143 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: "Dmitry V. Levin" +Date: Thu, 16 Feb 2017 18:05:45 +0300 +Subject: uapi: fix linux/rds.h userspace compilation errors + +From: "Dmitry V. Levin" + + +[ Upstream commit feb0869d90e51ce8b6fd8a46588465b1b5a26d09 ] + +Consistently use types from linux/types.h to fix the following +linux/rds.h userspace compilation errors: + +/usr/include/linux/rds.h:106:2: error: unknown type name 'uint8_t' + uint8_t name[32]; +/usr/include/linux/rds.h:107:2: error: unknown type name 'uint64_t' + uint64_t value; +/usr/include/linux/rds.h:117:2: error: unknown type name 'uint64_t' + uint64_t next_tx_seq; +/usr/include/linux/rds.h:118:2: error: unknown type name 'uint64_t' + uint64_t next_rx_seq; +/usr/include/linux/rds.h:121:2: error: unknown type name 'uint8_t' + uint8_t transport[TRANSNAMSIZ]; /* null term ascii */ +/usr/include/linux/rds.h:122:2: error: unknown type name 'uint8_t' + uint8_t flags; +/usr/include/linux/rds.h:129:2: error: unknown type name 'uint64_t' + uint64_t seq; +/usr/include/linux/rds.h:130:2: error: unknown type name 'uint32_t' + uint32_t len; +/usr/include/linux/rds.h:135:2: error: unknown type name 'uint8_t' + uint8_t flags; +/usr/include/linux/rds.h:139:2: error: unknown type name 'uint32_t' + uint32_t sndbuf; +/usr/include/linux/rds.h:144:2: error: unknown type name 'uint32_t' + uint32_t rcvbuf; +/usr/include/linux/rds.h:145:2: error: unknown type name 'uint64_t' + uint64_t inum; +/usr/include/linux/rds.h:153:2: error: unknown type name 'uint64_t' + uint64_t hdr_rem; +/usr/include/linux/rds.h:154:2: error: unknown type name 'uint64_t' + uint64_t data_rem; +/usr/include/linux/rds.h:155:2: error: unknown type name 'uint32_t' + uint32_t last_sent_nxt; +/usr/include/linux/rds.h:156:2: error: unknown type name 'uint32_t' + uint32_t last_expected_una; +/usr/include/linux/rds.h:157:2: error: unknown type name 'uint32_t' + uint32_t last_seen_una; +/usr/include/linux/rds.h:164:2: error: unknown type name 'uint8_t' + uint8_t src_gid[RDS_IB_GID_LEN]; +/usr/include/linux/rds.h:165:2: error: unknown type name 'uint8_t' + uint8_t dst_gid[RDS_IB_GID_LEN]; +/usr/include/linux/rds.h:167:2: error: unknown type name 'uint32_t' + uint32_t max_send_wr; +/usr/include/linux/rds.h:168:2: error: unknown type name 'uint32_t' + uint32_t max_recv_wr; +/usr/include/linux/rds.h:169:2: error: unknown type name 'uint32_t' + uint32_t max_send_sge; +/usr/include/linux/rds.h:170:2: error: unknown type name 'uint32_t' + uint32_t rdma_mr_max; +/usr/include/linux/rds.h:171:2: error: unknown type name 'uint32_t' + uint32_t rdma_mr_size; +/usr/include/linux/rds.h:212:9: error: unknown type name 'uint64_t' + typedef uint64_t rds_rdma_cookie_t; +/usr/include/linux/rds.h:215:2: error: unknown type name 'uint64_t' + uint64_t addr; +/usr/include/linux/rds.h:216:2: error: unknown type name 'uint64_t' + uint64_t bytes; +/usr/include/linux/rds.h:221:2: error: unknown type name 'uint64_t' + uint64_t cookie_addr; +/usr/include/linux/rds.h:222:2: error: unknown type name 'uint64_t' + uint64_t flags; +/usr/include/linux/rds.h:228:2: error: unknown type name 'uint64_t' + uint64_t cookie_addr; +/usr/include/linux/rds.h:229:2: error: unknown type name 'uint64_t' + uint64_t flags; +/usr/include/linux/rds.h:234:2: error: unknown type name 'uint64_t' + uint64_t flags; +/usr/include/linux/rds.h:240:2: error: unknown type name 'uint64_t' + uint64_t local_vec_addr; +/usr/include/linux/rds.h:241:2: error: unknown type name 'uint64_t' + uint64_t nr_local; +/usr/include/linux/rds.h:242:2: error: unknown type name 'uint64_t' + uint64_t flags; +/usr/include/linux/rds.h:243:2: error: unknown type name 'uint64_t' + uint64_t user_token; +/usr/include/linux/rds.h:248:2: error: unknown type name 'uint64_t' + uint64_t local_addr; +/usr/include/linux/rds.h:249:2: error: unknown type name 'uint64_t' + uint64_t remote_addr; +/usr/include/linux/rds.h:252:4: error: unknown type name 'uint64_t' + uint64_t compare; +/usr/include/linux/rds.h:253:4: error: unknown type name 'uint64_t' + uint64_t swap; +/usr/include/linux/rds.h:256:4: error: unknown type name 'uint64_t' + uint64_t add; +/usr/include/linux/rds.h:259:4: error: unknown type name 'uint64_t' + uint64_t compare; +/usr/include/linux/rds.h:260:4: error: unknown type name 'uint64_t' + uint64_t swap; +/usr/include/linux/rds.h:261:4: error: unknown type name 'uint64_t' + uint64_t compare_mask; +/usr/include/linux/rds.h:262:4: error: unknown type name 'uint64_t' + uint64_t swap_mask; +/usr/include/linux/rds.h:265:4: error: unknown type name 'uint64_t' + uint64_t add; +/usr/include/linux/rds.h:266:4: error: unknown type name 'uint64_t' + uint64_t nocarry_mask; +/usr/include/linux/rds.h:269:2: error: unknown type name 'uint64_t' + uint64_t flags; +/usr/include/linux/rds.h:270:2: error: unknown type name 'uint64_t' + uint64_t user_token; +/usr/include/linux/rds.h:274:2: error: unknown type name 'uint64_t' + uint64_t user_token; +/usr/include/linux/rds.h:275:2: error: unknown type name 'int32_t' + int32_t status; + +Signed-off-by: Dmitry V. Levin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/uapi/linux/rds.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/uapi/linux/rds.h ++++ b/include/uapi/linux/rds.h +@@ -35,6 +35,7 @@ + #define _LINUX_RDS_H + + #include ++#include /* For __kernel_sockaddr_storage. */ + + #define RDS_IB_ABI_VERSION 0x301 + +@@ -223,7 +224,7 @@ struct rds_get_mr_args { + }; + + struct rds_get_mr_for_dest_args { +- struct sockaddr_storage dest_addr; ++ struct __kernel_sockaddr_storage dest_addr; + struct rds_iovec vec; + uint64_t cookie_addr; + uint64_t flags; diff --git a/queue-4.9/watchdog-kempld-fix-gcc-4.3-build.patch b/queue-4.9/watchdog-kempld-fix-gcc-4.3-build.patch new file mode 100644 index 00000000000..81f9a2170be --- /dev/null +++ b/queue-4.9/watchdog-kempld-fix-gcc-4.3-build.patch @@ -0,0 +1,53 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Arnd Bergmann +Date: Wed, 1 Mar 2017 10:15:29 +0100 +Subject: watchdog: kempld: fix gcc-4.3 build + +From: Arnd Bergmann + + +[ Upstream commit 3736d4eb6af37492aeded7fec0072dedd959c842 ] + +gcc-4.3 can't decide whether the constant value in +kempld_prescaler[PRESCALER_21] is built-time constant or +not, and gets confused by the logic in do_div(): + +drivers/watchdog/kempld_wdt.o: In function `kempld_wdt_set_stage_timeout': +kempld_wdt.c:(.text.kempld_wdt_set_stage_timeout+0x130): undefined reference to `__aeabi_uldivmod' + +This adds a call to ACCESS_ONCE() to force it to not consider +it to be constant, and leaves the more efficient normal case +in place for modern compilers, using an #ifdef to annotate +why we do this hack. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/watchdog/kempld_wdt.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/watchdog/kempld_wdt.c ++++ b/drivers/watchdog/kempld_wdt.c +@@ -140,12 +140,19 @@ static int kempld_wdt_set_stage_timeout( + unsigned int timeout) + { + struct kempld_device_data *pld = wdt_data->pld; +- u32 prescaler = kempld_prescaler[PRESCALER_21]; ++ u32 prescaler; + u64 stage_timeout64; + u32 stage_timeout; + u32 remainder; + u8 stage_cfg; + ++#if GCC_VERSION < 40400 ++ /* work around a bug compiling do_div() */ ++ prescaler = READ_ONCE(kempld_prescaler[PRESCALER_21]); ++#else ++ prescaler = kempld_prescaler[PRESCALER_21]; ++#endif ++ + if (!stage) + return -EINVAL; + diff --git a/queue-4.9/xen-netback-use-gfp_atomic-to-allocate-hash.patch b/queue-4.9/xen-netback-use-gfp_atomic-to-allocate-hash.patch new file mode 100644 index 00000000000..387eb9af3f2 --- /dev/null +++ b/queue-4.9/xen-netback-use-gfp_atomic-to-allocate-hash.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Oct 19 15:04:02 CEST 2017 +From: Anoob Soman +Date: Thu, 2 Mar 2017 10:50:20 +0000 +Subject: xen-netback: Use GFP_ATOMIC to allocate hash + +From: Anoob Soman + + +[ Upstream commit 9f674e48c13dcbc31ac903433727837795b81efe ] + +Allocation of new_hash, inside xenvif_new_hash(), always happen +in softirq context, so use GFP_ATOMIC instead of GFP_KERNEL for new +hash allocation. + +Signed-off-by: Anoob Soman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/hash.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/xen-netback/hash.c ++++ b/drivers/net/xen-netback/hash.c +@@ -39,7 +39,7 @@ static void xenvif_add_hash(struct xenvi + unsigned long flags; + bool found; + +- new = kmalloc(sizeof(*entry), GFP_KERNEL); ++ new = kmalloc(sizeof(*entry), GFP_ATOMIC); + if (!new) + return; +