From: Greg Kroah-Hartman Date: Fri, 4 Aug 2017 20:37:41 +0000 (-0700) Subject: 4.9-stable patches X-Git-Tag: v4.12.5~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1d36c61590f2f0c3cd62d47e200208eb79bb9b00;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch drm-msm-put-back-the-vaddr-in-submit_reloc.patch drm-msm-verify-that-msm_submit_bo_flags-are-set.patch dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch dt-bindings-power-supply-update-tps65217-properties.patch ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch net-mlx4-remove-bug_on-from-icm-allocation-routine.patch net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch r8169-add-support-for-rtl8168-series-add-on-card.patch spi-dw-make-debugfs-name-unique-between-instances.patch vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch x86-mce-amd-make-the-init-code-more-robust.patch --- diff --git a/queue-4.9/arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch b/queue-4.9/arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch new file mode 100644 index 00000000000..6080e0bba77 --- /dev/null +++ b/queue-4.9/arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Roger Quadros +Date: Mon, 12 Dec 2016 11:58:05 +0200 +Subject: ARM: dts: am57xx-idk: Put USB2 port in peripheral mode + +From: Roger Quadros + + +[ Upstream commit 5acd016c88937be3667ba4e6b60f0f74455b5e80 ] + +USB2 port can be operated in dual-role mode but till we +have dual-role support in dwc3 driver let's limit this +port to peripheral mode. + +If we don't do so it defaults to host mode. USB1 port +is meant for host only operation and we don't want +both ports in host only mode. + +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/am57xx-idk-common.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/am57xx-idk-common.dtsi ++++ b/arch/arm/boot/dts/am57xx-idk-common.dtsi +@@ -294,7 +294,7 @@ + }; + + &usb2 { +- dr_mode = "otg"; ++ dr_mode = "peripheral"; + }; + + &mmc2 { diff --git a/queue-4.9/arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch b/queue-4.9/arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch new file mode 100644 index 00000000000..df4261773f6 --- /dev/null +++ b/queue-4.9/arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Pali Rohár +Date: Wed, 14 Dec 2016 22:29:44 +0100 +Subject: ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags + +From: Pali Rohár + + +[ Upstream commit 4cf48f1d7520a4d325af58eded4d8090e1b40be7 ] + +Trying to initialize eMMC slot as SDIO or SD cause failure in n900 port of +qemu. eMMC itself is not detected and is not working. + +Real Nokia N900 harware does not have this problem. As eMMC is really not +SDIO or SD based such change is harmless and will fix support for qemu. + +Signed-off-by: Pali Rohár +Acked-by: Pavel Machek +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap3-n900.dts | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -734,6 +734,8 @@ + vmmc_aux-supply = <&vsim>; + bus-width = <8>; + non-removable; ++ no-sdio; ++ no-sd; + }; + + &mmc3 { diff --git a/queue-4.9/arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch b/queue-4.9/arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch new file mode 100644 index 00000000000..b0f2b384cb8 --- /dev/null +++ b/queue-4.9/arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch @@ -0,0 +1,47 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Maninder Singh +Date: Thu, 8 Dec 2016 09:40:30 +0530 +Subject: ARM: omap2+: fixing wrong strcat for Non-NULL terminated string + +From: Maninder Singh + + +[ Upstream commit 5066d5296ff2db20625e5f46e7338872c90c649f ] + +Issue caught with static analysis tool: +"Dangerous usage of 'name' (strncpy doesn't always 0-terminate it)" + +Use strlcpy _includes_ the NUL terminator, and strlcat() which ensures +that it won't overflow the buffer. + +Reported-by: Maninder Singh +Signed-off-by: Vaneet Narang +CC: Russell King +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-omap2/omap_hwmod.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -790,14 +790,14 @@ static int _init_main_clk(struct omap_hw + int ret = 0; + char name[MOD_CLK_MAX_NAME_LEN]; + struct clk *clk; ++ static const char modck[] = "_mod_ck"; + +- /* +7 magic comes from '_mod_ck' suffix */ +- if (strlen(oh->name) + 7 > MOD_CLK_MAX_NAME_LEN) ++ if (strlen(oh->name) >= MOD_CLK_MAX_NAME_LEN - strlen(modck)) + pr_warn("%s: warning: cropping name for %s\n", __func__, + oh->name); + +- strncpy(name, oh->name, MOD_CLK_MAX_NAME_LEN - 7); +- strcat(name, "_mod_ck"); ++ strlcpy(name, oh->name, MOD_CLK_MAX_NAME_LEN - strlen(modck)); ++ strlcat(name, modck, MOD_CLK_MAX_NAME_LEN); + + clk = clk_get(NULL, name); + if (!IS_ERR(clk)) { diff --git a/queue-4.9/asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch b/queue-4.9/asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch new file mode 100644 index 00000000000..29ccd331938 --- /dev/null +++ b/queue-4.9/asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch @@ -0,0 +1,52 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Peter Ujfalusi +Date: Fri, 23 Dec 2016 11:21:10 +0200 +Subject: ASoC: tlv320aic3x: Mark the RESET register as volatile + +From: Peter Ujfalusi + + +[ Upstream commit 63c3194b82530bd71fd49db84eb7ab656b8d404a ] + +The RESET register only have one self clearing bit and it should not be +cached. If it is cached, when we sync the registers back to the chip we +will initiate a software reset as well, which is not desirable. + +Signed-off-by: Peter Ujfalusi +Reviewed-by: Jarkko Nikula +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/codecs/tlv320aic3x.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/sound/soc/codecs/tlv320aic3x.c ++++ b/sound/soc/codecs/tlv320aic3x.c +@@ -126,6 +126,16 @@ static const struct reg_default aic3x_re + { 108, 0x00 }, { 109, 0x00 }, + }; + ++static bool aic3x_volatile_reg(struct device *dev, unsigned int reg) ++{ ++ switch (reg) { ++ case AIC3X_RESET: ++ return true; ++ default: ++ return false; ++ } ++} ++ + static const struct regmap_config aic3x_regmap = { + .reg_bits = 8, + .val_bits = 8, +@@ -133,6 +143,9 @@ static const struct regmap_config aic3x_ + .max_register = DAC_ICC_ADJ, + .reg_defaults = aic3x_reg, + .num_reg_defaults = ARRAY_SIZE(aic3x_reg), ++ ++ .volatile_reg = aic3x_volatile_reg, ++ + .cache_type = REGCACHE_RBTREE, + }; + diff --git a/queue-4.9/drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch b/queue-4.9/drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch new file mode 100644 index 00000000000..0a39d1f9699 --- /dev/null +++ b/queue-4.9/drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch @@ -0,0 +1,61 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Jordan Crouse +Date: Tue, 20 Dec 2016 08:54:29 -0700 +Subject: drm/msm: Ensure that the hardware write pointer is valid + +From: Jordan Crouse + + +[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ] + +Currently the value written to CP_RB_WPTR is calculated on the fly as +(rb->next - rb->start). But as the code is designed rb->next is wrapped +before writing the commands so if a series of commands happened to +fit perfectly in the ringbuffer, rb->next would end up being equal to +rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR. + +The easiest way to fix this is to mask WPTR when writing it to the +hardware; it makes the hardware happy and the rest of the ringbuffer +math appears to work and there isn't any point in upsetting anything. + +Signed-off-by: Jordan Crouse +[squash in is_power_of_2() check] +Signed-off-by: Rob Clark + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 ++++++++- + drivers/gpu/drm/msm/msm_ringbuffer.c | 3 ++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -210,7 +210,14 @@ void adreno_submit(struct msm_gpu *gpu, + void adreno_flush(struct msm_gpu *gpu) + { + struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu); +- uint32_t wptr = get_wptr(gpu->rb); ++ uint32_t wptr; ++ ++ /* ++ * Mask wptr value that we calculate to fit in the HW range. This is ++ * to account for the possibility that the last command fit exactly into ++ * the ringbuffer and rb->next hasn't wrapped to zero yet ++ */ ++ wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1); + + /* ensure writes to ringbuffer have hit system memory: */ + mb(); +--- a/drivers/gpu/drm/msm/msm_ringbuffer.c ++++ b/drivers/gpu/drm/msm/msm_ringbuffer.c +@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_ne + struct msm_ringbuffer *ring; + int ret; + +- size = ALIGN(size, 4); /* size should be dword aligned */ ++ if (WARN_ON(!is_power_of_2(size))) ++ return ERR_PTR(-EINVAL); + + ring = kzalloc(sizeof(*ring), GFP_KERNEL); + if (!ring) { diff --git a/queue-4.9/drm-msm-put-back-the-vaddr-in-submit_reloc.patch b/queue-4.9/drm-msm-put-back-the-vaddr-in-submit_reloc.patch new file mode 100644 index 00000000000..b8e51ec4054 --- /dev/null +++ b/queue-4.9/drm-msm-put-back-the-vaddr-in-submit_reloc.patch @@ -0,0 +1,77 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Jordan Crouse +Date: Tue, 20 Dec 2016 08:54:30 -0700 +Subject: drm/msm: Put back the vaddr in submit_reloc() + +From: Jordan Crouse + + +[ Upstream commit 6490abc4bc35fa4f3bdb9c7e49096943c50e29ea ] + +The error cases in submit_reloc() need to put back the virtual +address of the bo before failling. Add a single failure path +for the function. + +Signed-off-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/msm_gem_submit.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -290,7 +290,7 @@ static int submit_reloc(struct msm_gem_s + { + uint32_t i, last_offset = 0; + uint32_t *ptr; +- int ret; ++ int ret = 0; + + if (offset % 4) { + DRM_ERROR("non-aligned cmdstream buffer: %u\n", offset); +@@ -317,12 +317,13 @@ static int submit_reloc(struct msm_gem_s + + ret = copy_from_user(&submit_reloc, userptr, sizeof(submit_reloc)); + if (ret) +- return -EFAULT; ++ goto out; + + if (submit_reloc.submit_offset % 4) { + DRM_ERROR("non-aligned reloc offset: %u\n", + submit_reloc.submit_offset); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + /* offset in dwords: */ +@@ -331,12 +332,13 @@ static int submit_reloc(struct msm_gem_s + if ((off >= (obj->base.size / 4)) || + (off < last_offset)) { + DRM_ERROR("invalid offset %u at reloc %u\n", off, i); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + ret = submit_bo(submit, submit_reloc.reloc_idx, NULL, &iova, &valid); + if (ret) +- return ret; ++ goto out; + + if (valid) + continue; +@@ -353,9 +355,10 @@ static int submit_reloc(struct msm_gem_s + last_offset = off; + } + ++out: + msm_gem_put_vaddr_locked(&obj->base); + +- return 0; ++ return ret; + } + + static void submit_cleanup(struct msm_gem_submit *submit) diff --git a/queue-4.9/drm-msm-verify-that-msm_submit_bo_flags-are-set.patch b/queue-4.9/drm-msm-verify-that-msm_submit_bo_flags-are-set.patch new file mode 100644 index 00000000000..9c7aee3d104 --- /dev/null +++ b/queue-4.9/drm-msm-verify-that-msm_submit_bo_flags-are-set.patch @@ -0,0 +1,35 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Jordan Crouse +Date: Tue, 20 Dec 2016 08:54:31 -0700 +Subject: drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set + +From: Jordan Crouse + + +[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ] + +For every submission buffer object one of MSM_SUBMIT_BO_WRITE +and MSM_SUBMIT_BO_READ must be set (and nothing else). If we +allowed zero then the buffer object would never get queued to +be unreferenced. + +Signed-off-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/msm_gem_submit.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/msm_gem_submit.c ++++ b/drivers/gpu/drm/msm/msm_gem_submit.c +@@ -106,7 +106,8 @@ static int submit_lookup_objects(struct + pagefault_disable(); + } + +- if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { ++ if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) || ++ !(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) { + DRM_ERROR("invalid flags: %x\n", submit_bo.flags); + ret = -EINVAL; + goto out_unlock; diff --git a/queue-4.9/dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch b/queue-4.9/dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch new file mode 100644 index 00000000000..45bfbcf133b --- /dev/null +++ b/queue-4.9/dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch @@ -0,0 +1,42 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Milo Kim +Date: Fri, 9 Dec 2016 15:28:33 +0900 +Subject: dt-bindings: input: Specify the interrupt number of TPS65217 power button + +From: Milo Kim + + +[ Upstream commit 820381572fc015baa4f5744f5d4583ec0c0f1b82 ] + +Specify the power button interrupt number which is from the datasheet. + +Signed-off-by: Milo Kim +Acked-by: Rob Herring +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt ++++ b/Documentation/devicetree/bindings/input/tps65218-pwrbutton.txt +@@ -8,8 +8,9 @@ This driver provides a simple power butt + Required properties: + - compatible: should be "ti,tps65217-pwrbutton" or "ti,tps65218-pwrbutton" + +-Required properties for TPS65218: ++Required properties: + - interrupts: should be one of the following ++ - <2>: For controllers compatible with tps65217 + - <3 IRQ_TYPE_EDGE_BOTH>: For controllers compatible with tps65218 + + Examples: +@@ -17,6 +18,7 @@ Examples: + &tps { + tps65217-pwrbutton { + compatible = "ti,tps65217-pwrbutton"; ++ interrupts = <2>; + }; + }; + diff --git a/queue-4.9/dt-bindings-power-supply-update-tps65217-properties.patch b/queue-4.9/dt-bindings-power-supply-update-tps65217-properties.patch new file mode 100644 index 00000000000..72c58e8e39f --- /dev/null +++ b/queue-4.9/dt-bindings-power-supply-update-tps65217-properties.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Milo Kim +Date: Fri, 9 Dec 2016 15:28:32 +0900 +Subject: dt-bindings: power/supply: Update TPS65217 properties + +From: Milo Kim + + +[ Upstream commit 81d7358d7038dd1001547950087e5b0641732f3f ] + +Add interrupt specifiers for USB and AC charger input. Interrupt numbers +are from the datasheet. +Fix wrong property for compatible string. + +Signed-off-by: Milo Kim +Acked-by: Rob Herring +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/power/supply/tps65217_charger.txt | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/power/supply/tps65217_charger.txt ++++ b/Documentation/devicetree/bindings/power/supply/tps65217_charger.txt +@@ -2,11 +2,16 @@ TPS65217 Charger + + Required Properties: + -compatible: "ti,tps65217-charger" ++-interrupts: TPS65217 interrupt numbers for the AC and USB charger input change. ++ Should be <0> for the USB charger and <1> for the AC adapter. ++-interrupt-names: Should be "USB" and "AC" + + This node is a subnode of the tps65217 PMIC. + + Example: + + tps65217-charger { +- compatible = "ti,tps65090-charger"; ++ compatible = "ti,tps65217-charger"; ++ interrupts = <0>, <1>; ++ interrupt-names = "USB", "AC"; + }; diff --git a/queue-4.9/ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch b/queue-4.9/ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch new file mode 100644 index 00000000000..3b1c4dd7c7a --- /dev/null +++ b/queue-4.9/ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch @@ -0,0 +1,43 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Zheng Li +Date: Wed, 28 Dec 2016 23:23:46 +0800 +Subject: ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output + +From: Zheng Li + + +[ Upstream commit e4c5e13aa45c23692e4acf56f0b3533f328199b2 ] + +There is an inconsistent conditional judgement between __ip6_append_data +and ip6_finish_output functions, the variable length in __ip6_append_data +just include the length of application's payload and udp6 header, don't +include the length of ipv6 header, but in ip6_finish_output use +(skb->len > ip6_skb_dst_mtu(skb)) as judgement, and skb->len include the +length of ipv6 header. + +That causes some particular application's udp6 payloads whose length are +between (MTU - IPv6 Header) and MTU were fragmented by ip6_fragment even +though the rst->dev support UFO feature. + +Add the length of ipv6 header to length in __ip6_append_data to keep +consistent conditional judgement as ip6_finish_output for ip6 fragment. + +Signed-off-by: Zheng Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/ip6_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1376,7 +1376,7 @@ emsgsize: + */ + + cork->length += length; +- if (((length > mtu) || ++ if ((((length + fragheaderlen) > mtu) || + (skb && skb_is_gso(skb))) && + (sk->sk_protocol == IPPROTO_UDP) && + (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len && diff --git a/queue-4.9/irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch b/queue-4.9/irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch new file mode 100644 index 00000000000..663b2e24da8 --- /dev/null +++ b/queue-4.9/irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch @@ -0,0 +1,129 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: "Strashko, Grygorii" +Date: Thu, 8 Dec 2016 17:33:10 -0600 +Subject: irqchip/keystone: Fix "scheduling while atomic" on rt + +From: "Strashko, Grygorii" + + +[ Upstream commit 2f884e6e688a0deb69e6c9552e51aef8b7e3f5f1 ] + +The below call chain generates "scheduling while atomic" backtrace and +causes system crash when Keystone 2 IRQ chip driver is used with RT-kernel: + +gic_handle_irq() + |-__handle_domain_irq() + |-generic_handle_irq() + |-keystone_irq_handler() + |-regmap_read() + |-regmap_lock_spinlock() + |-rt_spin_lock() + +The reason is that Keystone driver dispatches IRQ using chained IRQ handler +and accesses I/O memory through syscon->regmap(mmio) which is implemented +as fast_io regmap and uses regular spinlocks for synchronization, but +spinlocks transformed to rt_mutexes on RT. + +Hence, convert Keystone 2 IRQ driver to use generic irq handler instead of +chained IRQ handler. This way it will be compatible with RT kernel where it +will be forced thread IRQ handler while in non-RT kernel it still will be +executed in HW IRQ context. + +Cc: Suman Anna +Signed-off-by: Grygorii Strashko +Tested-by: Suman Anna +Link: https://lkml.kernel.org/r/20161208233310.10329-1-grygorii.strashko@ti.com +Signed-off-by: Jason Cooper +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-keystone.c | 28 +++++++++++++++++++--------- + 1 file changed, 19 insertions(+), 9 deletions(-) + +--- a/drivers/irqchip/irq-keystone.c ++++ b/drivers/irqchip/irq-keystone.c +@@ -19,9 +19,9 @@ + #include + #include + #include ++#include + #include + #include +-#include + #include + #include + #include +@@ -39,6 +39,7 @@ struct keystone_irq_device { + struct irq_domain *irqd; + struct regmap *devctrl_regs; + u32 devctrl_offset; ++ raw_spinlock_t wa_lock; + }; + + static inline u32 keystone_irq_readl(struct keystone_irq_device *kirq) +@@ -83,17 +84,15 @@ static void keystone_irq_ack(struct irq_ + /* nothing to do here */ + } + +-static void keystone_irq_handler(struct irq_desc *desc) ++static irqreturn_t keystone_irq_handler(int irq, void *keystone_irq) + { +- unsigned int irq = irq_desc_get_irq(desc); +- struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc); ++ struct keystone_irq_device *kirq = keystone_irq; ++ unsigned long wa_lock_flags; + unsigned long pending; + int src, virq; + + dev_dbg(kirq->dev, "start irq %d\n", irq); + +- chained_irq_enter(irq_desc_get_chip(desc), desc); +- + pending = keystone_irq_readl(kirq); + keystone_irq_writel(kirq, pending); + +@@ -111,13 +110,15 @@ static void keystone_irq_handler(struct + if (!virq) + dev_warn(kirq->dev, "spurious irq detected hwirq %d, virq %d\n", + src, virq); ++ raw_spin_lock_irqsave(&kirq->wa_lock, wa_lock_flags); + generic_handle_irq(virq); ++ raw_spin_unlock_irqrestore(&kirq->wa_lock, ++ wa_lock_flags); + } + } + +- chained_irq_exit(irq_desc_get_chip(desc), desc); +- + dev_dbg(kirq->dev, "end irq %d\n", irq); ++ return IRQ_HANDLED; + } + + static int keystone_irq_map(struct irq_domain *h, unsigned int virq, +@@ -182,9 +183,16 @@ static int keystone_irq_probe(struct pla + return -ENODEV; + } + ++ raw_spin_lock_init(&kirq->wa_lock); ++ + platform_set_drvdata(pdev, kirq); + +- irq_set_chained_handler_and_data(kirq->irq, keystone_irq_handler, kirq); ++ ret = request_irq(kirq->irq, keystone_irq_handler, ++ 0, dev_name(dev), kirq); ++ if (ret) { ++ irq_domain_remove(kirq->irqd); ++ return ret; ++ } + + /* clear all source bits */ + keystone_irq_writel(kirq, ~0x0); +@@ -199,6 +207,8 @@ static int keystone_irq_remove(struct pl + struct keystone_irq_device *kirq = platform_get_drvdata(pdev); + int hwirq; + ++ free_irq(kirq->irq, kirq); ++ + for (hwirq = 0; hwirq < KEYSTONE_N_IRQ; hwirq++) + irq_dispose_mapping(irq_find_mapping(kirq->irqd, hwirq)); + diff --git a/queue-4.9/net-mlx4-remove-bug_on-from-icm-allocation-routine.patch b/queue-4.9/net-mlx4-remove-bug_on-from-icm-allocation-routine.patch new file mode 100644 index 00000000000..49285e1d53b --- /dev/null +++ b/queue-4.9/net-mlx4-remove-bug_on-from-icm-allocation-routine.patch @@ -0,0 +1,42 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Leon Romanovsky +Date: Thu, 29 Dec 2016 18:37:11 +0200 +Subject: net/mlx4: Remove BUG_ON from ICM allocation routine + +From: Leon Romanovsky + + +[ Upstream commit c1d5f8ff80ea84768f5fae1ca9d1abfbb5e6bbaa ] + +This patch removes BUG_ON() macro from mlx4_alloc_icm_coherent() +by checking DMA address alignment in advance and performing proper +folding in case of error. + +Fixes: 5b0bf5e25efe ("mlx4_core: Support ICM tables in coherent memory") +Reported-by: Ozgur Karatas +Signed-off-by: Leon Romanovsky +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/icm.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/icm.c ++++ b/drivers/net/ethernet/mellanox/mlx4/icm.c +@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struc + if (!buf) + return -ENOMEM; + ++ if (offset_in_page(buf)) { ++ dma_free_coherent(dev, PAGE_SIZE << order, ++ buf, sg_dma_address(mem)); ++ return -ENOMEM; ++ } ++ + sg_set_buf(mem, buf, PAGE_SIZE << order); +- BUG_ON(mem->offset); + sg_dma_len(mem) = PAGE_SIZE << order; + return 0; + } diff --git a/queue-4.9/net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch b/queue-4.9/net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch new file mode 100644 index 00000000000..605440f5ed9 --- /dev/null +++ b/queue-4.9/net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch @@ -0,0 +1,164 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Jack Morgenstein +Date: Thu, 29 Dec 2016 18:37:13 +0200 +Subject: net/mlx4_core: Fix raw qp flow steering rules under SRIOV + +From: Jack Morgenstein + + +[ Upstream commit 10b1c04e92229ebeb38ccd0dcf2b6d3ec73c0575 ] + +Demoting simple flow steering rule priority (for DPDK) was achieved by +wrapping FW commands MLX4_QP_FLOW_STEERING_ATTACH/DETACH for the PF +as well, and forcing the priority to MLX4_DOMAIN_NIC in the wrapper +function for the PF and all VFs. + +In function mlx4_ib_create_flow(), this change caused the main rule +creation for the PF to be wrapped, while it left the associated +tunnel steering rule creation unwrapped for the PF. + +This mismatch caused rule deletion failures in mlx4_ib_destroy_flow() +for the PF when the detach wrapper function did not find the associated +tunnel-steering rule (since creation of that rule for the PF did not +go through the wrapper function). + +Fix this by setting MLX4_QP_FLOW_STEERING_ATTACH/DETACH to be "native" +(so that the PF invocation does not go through the wrapper), and perform +the required priority demotion for the PF in the mlx4_ib_create_flow() +code path. + +Fixes: 48564135cba8 ("net/mlx4_core: Demote simple multicast and broadcast flow steering rules") +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/mlx4/main.c | 14 +++++++++-- + drivers/net/ethernet/mellanox/mlx4/main.c | 18 ++++++++++++++ + drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 22 ------------------ + include/linux/mlx4/device.h | 2 + + 4 files changed, 33 insertions(+), 23 deletions(-) + +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -1680,9 +1680,19 @@ static int __mlx4_ib_create_flow(struct + size += ret; + } + ++ if (mlx4_is_master(mdev->dev) && flow_type == MLX4_FS_REGULAR && ++ flow_attr->num_of_specs == 1) { ++ struct _rule_hw *rule_header = (struct _rule_hw *)(ctrl + 1); ++ enum ib_flow_spec_type header_spec = ++ ((union ib_flow_spec *)(flow_attr + 1))->type; ++ ++ if (header_spec == IB_FLOW_SPEC_ETH) ++ mlx4_handle_eth_header_mcast_prio(ctrl, rule_header); ++ } ++ + ret = mlx4_cmd_imm(mdev->dev, mailbox->dma, reg_id, size >> 2, 0, + MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A, +- MLX4_CMD_WRAPPED); ++ MLX4_CMD_NATIVE); + if (ret == -ENOMEM) + pr_err("mcg table is full. Fail to register network rule.\n"); + else if (ret == -ENXIO) +@@ -1699,7 +1709,7 @@ static int __mlx4_ib_destroy_flow(struct + int err; + err = mlx4_cmd(dev, reg_id, 0, 0, + MLX4_QP_FLOW_STEERING_DETACH, MLX4_CMD_TIME_CLASS_A, +- MLX4_CMD_WRAPPED); ++ MLX4_CMD_NATIVE); + if (err) + pr_err("Fail to detach network rule. registration id = 0x%llx\n", + reg_id); +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -782,6 +783,23 @@ int mlx4_is_slave_active(struct mlx4_dev + } + EXPORT_SYMBOL(mlx4_is_slave_active); + ++void mlx4_handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl, ++ struct _rule_hw *eth_header) ++{ ++ if (is_multicast_ether_addr(eth_header->eth.dst_mac) || ++ is_broadcast_ether_addr(eth_header->eth.dst_mac)) { ++ struct mlx4_net_trans_rule_hw_eth *eth = ++ (struct mlx4_net_trans_rule_hw_eth *)eth_header; ++ struct _rule_hw *next_rule = (struct _rule_hw *)(eth + 1); ++ bool last_rule = next_rule->size == 0 && next_rule->id == 0 && ++ next_rule->rsvd == 0; ++ ++ if (last_rule) ++ ctrl->prio = cpu_to_be16(MLX4_DOMAIN_NIC); ++ } ++} ++EXPORT_SYMBOL(mlx4_handle_eth_header_mcast_prio); ++ + static void slave_adjust_steering_mode(struct mlx4_dev *dev, + struct mlx4_dev_cap *dev_cap, + struct mlx4_init_hca_param *hca_param) +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -4165,22 +4165,6 @@ static int validate_eth_header_mac(int s + return 0; + } + +-static void handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl, +- struct _rule_hw *eth_header) +-{ +- if (is_multicast_ether_addr(eth_header->eth.dst_mac) || +- is_broadcast_ether_addr(eth_header->eth.dst_mac)) { +- struct mlx4_net_trans_rule_hw_eth *eth = +- (struct mlx4_net_trans_rule_hw_eth *)eth_header; +- struct _rule_hw *next_rule = (struct _rule_hw *)(eth + 1); +- bool last_rule = next_rule->size == 0 && next_rule->id == 0 && +- next_rule->rsvd == 0; +- +- if (last_rule) +- ctrl->prio = cpu_to_be16(MLX4_DOMAIN_NIC); +- } +-} +- + /* + * In case of missing eth header, append eth header with a MAC address + * assigned to the VF. +@@ -4364,10 +4348,7 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper + header_id = map_hw_to_sw_id(be16_to_cpu(rule_header->id)); + + if (header_id == MLX4_NET_TRANS_RULE_ID_ETH) +- handle_eth_header_mcast_prio(ctrl, rule_header); +- +- if (slave == dev->caps.function) +- goto execute; ++ mlx4_handle_eth_header_mcast_prio(ctrl, rule_header); + + switch (header_id) { + case MLX4_NET_TRANS_RULE_ID_ETH: +@@ -4395,7 +4376,6 @@ int mlx4_QP_FLOW_STEERING_ATTACH_wrapper + goto err_put_qp; + } + +-execute: + err = mlx4_cmd_imm(dev, inbox->dma, &vhcr->out_param, + vhcr->in_modifier, 0, + MLX4_QP_FLOW_STEERING_ATTACH, MLX4_CMD_TIME_CLASS_A, +--- a/include/linux/mlx4/device.h ++++ b/include/linux/mlx4/device.h +@@ -1384,6 +1384,8 @@ int set_phv_bit(struct mlx4_dev *dev, u8 + int get_phv_bit(struct mlx4_dev *dev, u8 port, int *phv); + int mlx4_get_is_vlan_offload_disabled(struct mlx4_dev *dev, u8 port, + bool *vlan_offload_disabled); ++void mlx4_handle_eth_header_mcast_prio(struct mlx4_net_trans_rule_hw_ctrl *ctrl, ++ struct _rule_hw *eth_header); + int mlx4_find_cached_mac(struct mlx4_dev *dev, u8 port, u64 mac, int *idx); + int mlx4_find_cached_vlan(struct mlx4_dev *dev, u8 port, u16 vid, int *idx); + int mlx4_register_vlan(struct mlx4_dev *dev, u8 port, u16 vlan, int *index); diff --git a/queue-4.9/net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch b/queue-4.9/net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch new file mode 100644 index 00000000000..6280a63c0c5 --- /dev/null +++ b/queue-4.9/net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch @@ -0,0 +1,65 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Jack Morgenstein +Date: Thu, 29 Dec 2016 18:37:09 +0200 +Subject: net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach + +From: Jack Morgenstein + + +[ Upstream commit 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 ] + +mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering +rule (which results in freeing the rule structure), and then +references a field in this struct (the qp number) when releasing the +busy-status on the rule's qp. + +Since this memory was freed, it could reallocated and changed. +Therefore, the qp number in the struct may be incorrect, +so that we are releasing the incorrect qp. This leaves the rule's qp +in the busy state (and could possibly release an incorrect qp as well). + +Fix this by saving the qp number in a local variable, for use after +removing the steering rule. + +Fixes: 2c473ae7e582 ("net/mlx4_core: Disallow releasing VF QPs which have steering rules") +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -4474,6 +4474,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper + struct res_qp *rqp; + struct res_fs_rule *rrule; + u64 mirr_reg_id; ++ int qpn; + + if (dev->caps.steering_mode != + MLX4_STEERING_MODE_DEVICE_MANAGED) +@@ -4490,10 +4491,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper + } + mirr_reg_id = rrule->mirr_rule_id; + kfree(rrule->mirr_mbox); ++ qpn = rrule->qpn; + + /* Release the rule form busy state before removal */ + put_res(dev, slave, vhcr->in_param, RES_FS_RULE); +- err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp); ++ err = get_res(dev, slave, qpn, RES_QP, &rqp); + if (err) + return err; + +@@ -4518,7 +4520,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper + if (!err) + atomic_dec(&rqp->ref_count); + out: +- put_res(dev, slave, rrule->qpn, RES_QP); ++ put_res(dev, slave, qpn, RES_QP); + return err; + } + diff --git a/queue-4.9/net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch b/queue-4.9/net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch new file mode 100644 index 00000000000..93e4d040c49 --- /dev/null +++ b/queue-4.9/net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch @@ -0,0 +1,71 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Or Gerlitz +Date: Wed, 28 Dec 2016 14:58:31 +0200 +Subject: net/mlx5: Disable RoCE on the e-switch management port under switchdev mode + +From: Or Gerlitz + + +[ Upstream commit 9da34cd34e85aacc55af8774b81b1f23e86014f9 ] + +Under the switchdev/offloads mode, packets that don't match any +e-switch steering rule are sent towards the e-switch management +port. We use a NIC HW steering rule set per vport (uplink and VFs) +to make them be received into the host OS through the respective +vport representor netdevice. + +Currnetly such missed RoCE packets will not get to this NIC steering +rule, and hence VF RoCE will not work over the slow path of the offloads +mode. This is b/c these packets will be matched by a steering rule added +by the firmware that serves RoCE traffic set on the PF NIC vport which +is also the e-switch management port under SRIOV. + +Disabling RoCE on the e-switch management vport when we are in the offloads +mode, will signal to the firmware to remove their RoCE rule, and then the +missed RoCE packets will be matched by the representor NIC steering rule +as any other missed packets. + +To achieve that, we disable RoCE on the PF vport. We do that by removing +(hot-unplugging) the IB device instance associated with the PF. This is +also required by our current model where the PF serves as the uplink +representor and hence only SW switching (TC, bridge, OVS) applications +and slow path vport mlx5e net-device should be running over that vport. + +Fixes: c930a3ad7453 ('net/mlx5e: Add devlink based SRIOV mode changes') +Signed-off-by: Or Gerlitz +Reviewed-by: Hadar Hen Zion +Signed-off-by: Saeed Mahameed +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -672,6 +672,12 @@ int esw_offloads_init(struct mlx5_eswitc + if (err) + goto err_reps; + } ++ ++ /* disable PF RoCE so missed packets don't go through RoCE steering */ ++ mlx5_dev_list_lock(); ++ mlx5_remove_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB); ++ mlx5_dev_list_unlock(); ++ + return 0; + + err_reps: +@@ -695,6 +701,11 @@ static int esw_offloads_stop(struct mlx5 + { + int err, err1, num_vfs = esw->dev->priv.sriov.num_vfs; + ++ /* enable back PF RoCE */ ++ mlx5_dev_list_lock(); ++ mlx5_add_dev_by_protocol(esw->dev, MLX5_INTERFACE_PROTOCOL_IB); ++ mlx5_dev_list_unlock(); ++ + mlx5_eswitch_disable_sriov(esw); + err = mlx5_eswitch_enable_sriov(esw, num_vfs, SRIOV_LEGACY); + if (err) { diff --git a/queue-4.9/r8169-add-support-for-rtl8168-series-add-on-card.patch b/queue-4.9/r8169-add-support-for-rtl8168-series-add-on-card.patch new file mode 100644 index 00000000000..822ecd6cc06 --- /dev/null +++ b/queue-4.9/r8169-add-support-for-rtl8168-series-add-on-card.patch @@ -0,0 +1,30 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Chun-Hao Lin +Date: Tue, 27 Dec 2016 16:29:43 +0800 +Subject: r8169: add support for RTL8168 series add-on card. + +From: Chun-Hao Lin + + +[ Upstream commit 610c908773d30907c950ca3b2ee8ac4b2813537b ] + +This chip is the same as RTL8168, but its device id is 0x8161. + +Signed-off-by: Chun-Hao Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/realtek/r8169.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -326,6 +326,7 @@ enum cfg_version { + static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, diff --git a/queue-4.9/series b/queue-4.9/series index 90ac94942e4..05ea493e5e0 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -43,3 +43,22 @@ pstore-correctly-initialize-spinlock-and-flags.patch pstore-use-dynamic-spinlock-initializer.patch net-skb_needs_check-accepts-checksum_none-for-tx.patch device-dax-fix-sysfs-duplicate-warnings.patch +x86-mce-amd-make-the-init-code-more-robust.patch +r8169-add-support-for-rtl8168-series-add-on-card.patch +arm-omap2-fixing-wrong-strcat-for-non-null-terminated-string.patch +dt-bindings-power-supply-update-tps65217-properties.patch +dt-bindings-input-specify-the-interrupt-number-of-tps65217-power-button.patch +arm-dts-am57xx-idk-put-usb2-port-in-peripheral-mode.patch +arm-dts-n900-mark-emmc-slot-with-no-sdio-and-no-sd-flags.patch +net-mlx5-disable-roce-on-the-e-switch-management-port-under-switchdev-mode.patch +ipv6-should-use-consistent-conditional-judgement-for-ip6-fragment-between-__ip6_append_data-and-ip6_finish_output.patch +net-mlx4_core-use-after-free-causes-a-resource-leak-in-flow-steering-detach.patch +net-mlx4-remove-bug_on-from-icm-allocation-routine.patch +net-mlx4_core-fix-raw-qp-flow-steering-rules-under-sriov.patch +drm-msm-ensure-that-the-hardware-write-pointer-is-valid.patch +drm-msm-put-back-the-vaddr-in-submit_reloc.patch +drm-msm-verify-that-msm_submit_bo_flags-are-set.patch +vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch +irqchip-keystone-fix-scheduling-while-atomic-on-rt.patch +asoc-tlv320aic3x-mark-the-reset-register-as-volatile.patch +spi-dw-make-debugfs-name-unique-between-instances.patch diff --git a/queue-4.9/spi-dw-make-debugfs-name-unique-between-instances.patch b/queue-4.9/spi-dw-make-debugfs-name-unique-between-instances.patch new file mode 100644 index 00000000000..a89ffd90217 --- /dev/null +++ b/queue-4.9/spi-dw-make-debugfs-name-unique-between-instances.patch @@ -0,0 +1,36 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Phil Reid +Date: Thu, 22 Dec 2016 17:18:12 +0800 +Subject: spi: dw: Make debugfs name unique between instances + +From: Phil Reid + + +[ Upstream commit 13288bdf4adbaa6bd1267f10044c1bc25d90ce7f ] + +Some system have multiple dw devices. Currently the driver uses a +fixed name for the debugfs dir. Append dev name to the debugfs dir +name to make it unique. + +Signed-off-by: Phil Reid +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-dw.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/spi/spi-dw.c ++++ b/drivers/spi/spi-dw.c +@@ -107,7 +107,10 @@ static const struct file_operations dw_s + + static int dw_spi_debugfs_init(struct dw_spi *dws) + { +- dws->debugfs = debugfs_create_dir("dw_spi", NULL); ++ char name[128]; ++ ++ snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev)); ++ dws->debugfs = debugfs_create_dir(name, NULL); + if (!dws->debugfs) + return -ENOMEM; + diff --git a/queue-4.9/vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch b/queue-4.9/vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch new file mode 100644 index 00000000000..ad6394edbe4 --- /dev/null +++ b/queue-4.9/vfio-pci-use-32-bit-comparisons-for-register-address-for-gcc-4.5.patch @@ -0,0 +1,41 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Arnd Bergmann +Date: Fri, 30 Dec 2016 08:13:47 -0700 +Subject: vfio-pci: use 32-bit comparisons for register address for gcc-4.5 + +From: Arnd Bergmann + + +[ Upstream commit 45e869714489431625c569d21fc952428d761476 ] + +Using ancient compilers (gcc-4.5 or older) on ARM, we get a link +failure with the vfio-pci driver: + +ERROR: "__aeabi_lcmp" [drivers/vfio/pci/vfio-pci.ko] undefined! + +The reason is that the compiler tries to do a comparison of +a 64-bit range. This changes it to convert to a 32-bit number +explicitly first, as newer compilers do for themselves. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vfio/pci/vfio_pci_rdwr.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/vfio/pci/vfio_pci_rdwr.c ++++ b/drivers/vfio/pci/vfio_pci_rdwr.c +@@ -193,7 +193,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_ + if (!vdev->has_vga) + return -EINVAL; + +- switch (pos) { ++ if (pos > 0xbfffful) ++ return -EINVAL; ++ ++ switch ((u32)pos) { + case 0xa0000 ... 0xbffff: + count = min(count, (size_t)(0xc0000 - pos)); + iomem = ioremap_nocache(0xa0000, 0xbffff - 0xa0000 + 1); diff --git a/queue-4.9/x86-mce-amd-make-the-init-code-more-robust.patch b/queue-4.9/x86-mce-amd-make-the-init-code-more-robust.patch new file mode 100644 index 00000000000..98e7419cb58 --- /dev/null +++ b/queue-4.9/x86-mce-amd-make-the-init-code-more-robust.patch @@ -0,0 +1,37 @@ +From foo@baz Fri Aug 4 13:32:40 PDT 2017 +From: Thomas Gleixner +Date: Mon, 26 Dec 2016 22:58:20 +0100 +Subject: x86/mce/AMD: Make the init code more robust + +From: Thomas Gleixner + + +[ Upstream commit 0dad3a3014a0b9e72521ff44f17e0054f43dcdea ] + +If mce_device_init() fails then the mce device pointer is NULL and the +AMD mce code happily dereferences it. + +Add a sanity check. + +Reported-by: Markus Trippelsdorf +Reported-by: Boris Ostrovsky +Signed-off-by: Thomas Gleixner +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/mcheck/mce_amd.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -955,6 +955,9 @@ static int threshold_create_bank(unsigne + const char *name = get_name(bank, NULL); + int err = 0; + ++ if (!dev) ++ return -ENODEV; ++ + if (is_shared_bank(bank)) { + nb = node_to_amd_nb(amd_get_nb_id(cpu)); +