From: Sasha Levin Date: Tue, 26 Nov 2019 02:27:55 +0000 (-0500) Subject: fixes for 4.4 X-Git-Tag: v4.4.204~82 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2954eab5a7e4bf7feb60ba1c8692c8a2f3c647fe;p=thirdparty%2Fkernel%2Fstable-queue.git fixes for 4.4 Signed-off-by: Sasha Levin --- diff --git a/queue-4.4/alsa-i2c-cs8427-fix-int-to-char-conversion.patch b/queue-4.4/alsa-i2c-cs8427-fix-int-to-char-conversion.patch new file mode 100644 index 00000000000..dd47faaa63b --- /dev/null +++ b/queue-4.4/alsa-i2c-cs8427-fix-int-to-char-conversion.patch @@ -0,0 +1,45 @@ +From fbc3bad9768a0c3e1f65528993f2fecf0983c80c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Oct 2018 12:33:02 +0200 +Subject: ALSA: i2c/cs8427: Fix int to char conversion + +From: Philipp Klocke + +[ Upstream commit eb7ebfa3c1989aa8e59d5e68ab3cddd7df1bfb27 ] + +Compiling with clang yields the following warning: + +sound/i2c/cs8427.c:140:31: warning: implicit conversion from 'int' +to 'char' changes value from 160 to -96 [-Wconstant-conversion] + data[0] = CS8427_REG_AUTOINC | CS8427_REG_CORU_DATABUF; + ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~ + +Because CS8427_REG_AUTOINC is defined as 128, it is too big for a +char field. +So change data from char to unsigned char, that it can hold the value. + +This patch does not change the generated code. + +Signed-off-by: Philipp Klocke +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/i2c/cs8427.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/i2c/cs8427.c b/sound/i2c/cs8427.c +index 7e21621e492a4..7fd1b40008838 100644 +--- a/sound/i2c/cs8427.c ++++ b/sound/i2c/cs8427.c +@@ -118,7 +118,7 @@ static int snd_cs8427_send_corudata(struct snd_i2c_device *device, + struct cs8427 *chip = device->private_data; + char *hw_data = udata ? + chip->playback.hw_udata : chip->playback.hw_status; +- char data[32]; ++ unsigned char data[32]; + int err, idx; + + if (!memcmp(hw_data, ndata, count)) +-- +2.20.1 + diff --git a/queue-4.4/alsa-isight-fix-leak-of-reference-to-firewire-unit-i.patch b/queue-4.4/alsa-isight-fix-leak-of-reference-to-firewire-unit-i.patch new file mode 100644 index 00000000000..84bd1da6990 --- /dev/null +++ b/queue-4.4/alsa-isight-fix-leak-of-reference-to-firewire-unit-i.patch @@ -0,0 +1,54 @@ +From 1ff4b1cf8e27774638bb2fa5f505e32d489c84f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 14:25:22 +0900 +Subject: ALSA: isight: fix leak of reference to firewire unit in error path of + .probe callback + +From: Takashi Sakamoto + +[ Upstream commit 51e68fb0929c29e47e9074ca3e99ffd6021a1c5a ] + +In some error paths, reference count of firewire unit is not decreased. +This commit fixes the bug. + +Fixes: 5b14ec25a79b('ALSA: firewire: release reference count of firewire unit in .remove callback of bus driver') +Signed-off-by: Takashi Sakamoto +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/isight.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/firewire/isight.c b/sound/firewire/isight.c +index 48d6dca471c6b..6c8daf5b391ff 100644 +--- a/sound/firewire/isight.c ++++ b/sound/firewire/isight.c +@@ -639,7 +639,7 @@ static int isight_probe(struct fw_unit *unit, + if (!isight->audio_base) { + dev_err(&unit->device, "audio unit base not found\n"); + err = -ENXIO; +- goto err_unit; ++ goto error; + } + fw_iso_resources_init(&isight->resources, unit); + +@@ -668,12 +668,12 @@ static int isight_probe(struct fw_unit *unit, + dev_set_drvdata(&unit->device, isight); + + return 0; +- +-err_unit: +- fw_unit_put(isight->unit); +- mutex_destroy(&isight->mutex); + error: + snd_card_free(card); ++ ++ mutex_destroy(&isight->mutex); ++ fw_unit_put(isight->unit); ++ + return err; + } + +-- +2.20.1 + diff --git a/queue-4.4/amiflop-clean-up-on-errors-during-setup.patch b/queue-4.4/amiflop-clean-up-on-errors-during-setup.patch new file mode 100644 index 00000000000..014362aa4c8 --- /dev/null +++ b/queue-4.4/amiflop-clean-up-on-errors-during-setup.patch @@ -0,0 +1,150 @@ +From 19db663435827380a6dbe04cb14c3debd0f8c2f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Oct 2018 12:20:46 -0700 +Subject: amiflop: clean up on errors during setup + +From: Omar Sandoval + +[ Upstream commit 53d0f8dbde89cf6c862c7a62e00c6123e02cba41 ] + +The error handling in fd_probe_drives() doesn't clean up at all. Fix it +up in preparation for converting to blk-mq. While we're here, get rid of +the commented out amiga_floppy_remove(). + +Signed-off-by: Omar Sandoval +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/amiflop.c | 84 ++++++++++++++++++++--------------------- + 1 file changed, 40 insertions(+), 44 deletions(-) + +diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c +index 5fd50a2841682..db4354fb2a0d3 100644 +--- a/drivers/block/amiflop.c ++++ b/drivers/block/amiflop.c +@@ -1699,11 +1699,41 @@ static const struct block_device_operations floppy_fops = { + .check_events = amiga_check_events, + }; + ++static struct gendisk *fd_alloc_disk(int drive) ++{ ++ struct gendisk *disk; ++ ++ disk = alloc_disk(1); ++ if (!disk) ++ goto out; ++ ++ disk->queue = blk_init_queue(do_fd_request, &amiflop_lock); ++ if (IS_ERR(disk->queue)) { ++ disk->queue = NULL; ++ goto out_put_disk; ++ } ++ ++ unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL); ++ if (!unit[drive].trackbuf) ++ goto out_cleanup_queue; ++ ++ return disk; ++ ++out_cleanup_queue: ++ blk_cleanup_queue(disk->queue); ++ disk->queue = NULL; ++out_put_disk: ++ put_disk(disk); ++out: ++ unit[drive].type->code = FD_NODRIVE; ++ return NULL; ++} ++ + static int __init fd_probe_drives(void) + { + int drive,drives,nomem; + +- printk(KERN_INFO "FD: probing units\nfound "); ++ pr_info("FD: probing units\nfound"); + drives=0; + nomem=0; + for(drive=0;drivecode == FD_NODRIVE) + continue; +- disk = alloc_disk(1); ++ ++ disk = fd_alloc_disk(drive); + if (!disk) { +- unit[drive].type->code = FD_NODRIVE; ++ pr_cont(" no mem for fd%d", drive); ++ nomem = 1; + continue; + } + unit[drive].gendisk = disk; +- +- disk->queue = blk_init_queue(do_fd_request, &amiflop_lock); +- if (!disk->queue) { +- unit[drive].type->code = FD_NODRIVE; +- continue; +- } +- + drives++; +- if ((unit[drive].trackbuf = kmalloc(FLOPPY_MAX_SECTORS * 512, GFP_KERNEL)) == NULL) { +- printk("no mem for "); +- unit[drive].type = &drive_types[num_dr_types - 1]; /* FD_NODRIVE */ +- drives--; +- nomem = 1; +- } +- printk("fd%d ",drive); ++ ++ pr_cont(" fd%d",drive); + disk->major = FLOPPY_MAJOR; + disk->first_minor = drive; + disk->fops = &floppy_fops; +@@ -1742,11 +1762,11 @@ static int __init fd_probe_drives(void) + } + if ((drives > 0) || (nomem == 0)) { + if (drives == 0) +- printk("no drives"); +- printk("\n"); ++ pr_cont(" no drives"); ++ pr_cont("\n"); + return drives; + } +- printk("\n"); ++ pr_cont("\n"); + return -ENOMEM; + } + +@@ -1837,30 +1857,6 @@ static int __init amiga_floppy_probe(struct platform_device *pdev) + return ret; + } + +-#if 0 /* not safe to unload */ +-static int __exit amiga_floppy_remove(struct platform_device *pdev) +-{ +- int i; +- +- for( i = 0; i < FD_MAX_UNITS; i++) { +- if (unit[i].type->code != FD_NODRIVE) { +- struct request_queue *q = unit[i].gendisk->queue; +- del_gendisk(unit[i].gendisk); +- put_disk(unit[i].gendisk); +- kfree(unit[i].trackbuf); +- if (q) +- blk_cleanup_queue(q); +- } +- } +- blk_unregister_region(MKDEV(FLOPPY_MAJOR, 0), 256); +- free_irq(IRQ_AMIGA_CIAA_TB, NULL); +- free_irq(IRQ_AMIGA_DSKBLK, NULL); +- custom.dmacon = DMAF_DISK; /* disable DMA */ +- amiga_chip_free(raw_buf); +- unregister_blkdev(FLOPPY_MAJOR, "fd"); +-} +-#endif +- + static struct platform_driver amiga_floppy_driver = { + .driver = { + .name = "amiga-floppy", +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-n552vw.patch b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-n552vw.patch new file mode 100644 index 00000000000..5c224d608a4 --- /dev/null +++ b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-n552vw.patch @@ -0,0 +1,50 @@ +From 02b2dab0e63622194feceac97304d52edebbd0b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2016 16:57:32 -0400 +Subject: asus-wmi: Add quirk_no_rfkill for the Asus N552VW +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Rechi Vita + +[ Upstream commit 2d735244b798f0c8bf93ace1facfafdc1f7a4e6e ] + +The Asus N552VW has an airplane-mode indicator LED and the WMI WLAN user +bit set, so asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store +the wlan state, which has a side-effect of driving the airplane mode +indicator LED in an inverted fashion. quirk_no_rfkill prevents asus-wmi +from registering RFKill switches at all for this laptop and allows +asus-wireless to drive the LED through the ASHS ACPI device. + +Signed-off-by: João Paulo Rechi Vita +Reviewed-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 904f210327a1c..0322b1cde825d 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -333,6 +333,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_no_rfkill, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. N552VW", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "N552VW"), ++ }, ++ .driver_data = &quirk_no_rfkill, ++ }, + {}, + }; + +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-u303lb.patch b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-u303lb.patch new file mode 100644 index 00000000000..e314335bb03 --- /dev/null +++ b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-u303lb.patch @@ -0,0 +1,51 @@ +From e47686bcd3413113af0d28b4e72c02d69406564b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2016 16:57:33 -0400 +Subject: asus-wmi: Add quirk_no_rfkill for the Asus U303LB +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Rechi Vita + +[ Upstream commit 02db9ff7af18f7ace60f430cbbaa1d846b350916 ] + +The Asus U303LB has an airplane-mode indicator LED and the WMI WLAN user +bit set, so asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store +the wlan state, which has a side-effect of driving the airplane mode +indicator LED in an inverted fashion. quirk_no_rfkill prevents asus-wmi +from registering RFKill switches at all for this laptop and allows +asus-wireless to drive the LED through the ASHS ACPI device. + +Signed-off-by: João Paulo Rechi Vita +Reported-by: Mousou Yuu +Reviewed-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 0322b1cde825d..69e33c2772c11 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -342,6 +342,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_no_rfkill, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. U303LB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "U303LB"), ++ }, ++ .driver_data = &quirk_no_rfkill, ++ }, + {}, + }; + +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-z550ma.patch b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-z550ma.patch new file mode 100644 index 00000000000..4eb27011636 --- /dev/null +++ b/queue-4.4/asus-wmi-add-quirk_no_rfkill-for-the-asus-z550ma.patch @@ -0,0 +1,51 @@ +From 6de51cdfd100a9770ba949292e62c2aa62781355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2016 16:57:34 -0400 +Subject: asus-wmi: Add quirk_no_rfkill for the Asus Z550MA +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Rechi Vita + +[ Upstream commit 6b7ff2af5286a8c6bec7ff5f4df62e3506c1674e ] + +The Asus Z550MA has an airplane-mode indicator LED and the WMI WLAN user +bit set, so asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store +the wlan state, which has a side-effect of driving the airplane mode +indicator LED in an inverted fashion. quirk_no_rfkill prevents asus-wmi +from registering RFKill switches at all for this laptop and allows +asus-wireless to drive the LED through the ASHS ACPI device. + +Signed-off-by: João Paulo Rechi Vita +Reported-by: Ming Shuo Chiu +Reviewed-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 69e33c2772c11..734f95c09508f 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -351,6 +351,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_no_rfkill, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. Z550MA", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Z550MA"), ++ }, ++ .driver_data = &quirk_no_rfkill, ++ }, + {}, + }; + +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-add-quirk_no_rfkill_wapf4-for-the-asus-x456.patch b/queue-4.4/asus-wmi-add-quirk_no_rfkill_wapf4-for-the-asus-x456.patch new file mode 100644 index 00000000000..946d1857d4d --- /dev/null +++ b/queue-4.4/asus-wmi-add-quirk_no_rfkill_wapf4-for-the-asus-x456.patch @@ -0,0 +1,60 @@ +From ea3825c27ececf5235611e3f91cb4aa5ecf051c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2016 16:57:35 -0400 +Subject: asus-wmi: Add quirk_no_rfkill_wapf4 for the Asus X456UF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Rechi Vita + +[ Upstream commit a961a285b479977fa21f12f71cd62f28adaba17c ] + +The Asus X456UF has an airplane-mode indicator LED and the WMI WLAN user +bit set, so asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store +the wlan state, which has a side-effect of driving the airplane mode +indicator LED in an inverted fashion. + +quirk_no_rfkill prevents asus-wmi from registering RFKill switches at +all for this laptop and allows asus-wireless to drive the LED through +the ASHS ACPI device. This laptop already has a quirk for setting +WAPF=4, so this commit creates a new quirk, quirk_no_rfkill_wapf4, which +both disables rfkill and sets WAPF=4. + +Signed-off-by: João Paulo Rechi Vita +Reported-by: Carlo Caione +Reviewed-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 5390846fa1e64..904f210327a1c 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -82,6 +82,11 @@ static struct quirk_entry quirk_no_rfkill = { + .no_rfkill = true, + }; + ++static struct quirk_entry quirk_no_rfkill_wapf4 = { ++ .wapf = 4, ++ .no_rfkill = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -164,7 +169,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X456UF"), + }, +- .driver_data = &quirk_asus_wapf4, ++ .driver_data = &quirk_no_rfkill_wapf4, + }, + { + .callback = dmi_matched, +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-create-quirk-for-airplane_mode-led.patch b/queue-4.4/asus-wmi-create-quirk-for-airplane_mode-led.patch new file mode 100644 index 00000000000..b3e2bdcf81b --- /dev/null +++ b/queue-4.4/asus-wmi-create-quirk-for-airplane_mode-led.patch @@ -0,0 +1,118 @@ +From 723ab43ab501a887e8f709433908b12c013f109d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jun 2016 16:57:31 -0400 +Subject: asus-wmi: Create quirk for airplane_mode LED +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: João Paulo Rechi Vita + +[ Upstream commit a977e59c0c67c9d492bb16677ce66d67cae0ebd8 ] + +Some Asus laptops that have an airplane-mode indicator LED, also have +the WMI WLAN user bit set, and the following bits in their DSDT: + +Scope (_SB) +{ + (...) + Device (ATKD) + { + (...) + Method (WMNB, 3, Serialized) + { + (...) + If (LEqual (IIA0, 0x00010002)) + { + OWGD (IIA1) + Return (One) + } + } + } +} + +So when asus-wmi uses ASUS_WMI_DEVID_WLAN_LED (0x00010002) to store the +wlan state, it drives the airplane-mode indicator LED (through the call +to OWGD) in an inverted fashion: the LED is ON when airplane mode is OFF +(since wlan is ON), and vice-versa. + +This commit creates a quirk to not register a RFKill switch at all for +these laptops, to allow the asus-wireless driver to drive the airplane +mode LED correctly through the ASHS ACPI device. It also adds a match to +that quirk for the Asus X555UB, which is affected by this problem. + +Signed-off-by: João Paulo Rechi Vita +Reviewed-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ + drivers/platform/x86/asus-wmi.c | 8 +++++--- + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 19 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index a284a2b42bcd5..5390846fa1e64 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -78,6 +78,10 @@ static struct quirk_entry quirk_asus_x200ca = { + .wapf = 2, + }; + ++static struct quirk_entry quirk_no_rfkill = { ++ .no_rfkill = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -315,6 +319,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_x200ca, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X555UB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X555UB"), ++ }, ++ .driver_data = &quirk_no_rfkill, ++ }, + {}, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 7c1defaef3f58..823f85b1b4dc6 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2067,9 +2067,11 @@ static int asus_wmi_add(struct platform_device *pdev) + if (err) + goto fail_leds; + +- err = asus_wmi_rfkill_init(asus); +- if (err) +- goto fail_rfkill; ++ if (!asus->driver->quirks->no_rfkill) { ++ err = asus_wmi_rfkill_init(asus); ++ if (err) ++ goto fail_rfkill; ++ } + + /* Some Asus desktop boards export an acpi-video backlight interface, + stop this from showing up */ +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 4da4c8bafe70e..5de1df510ebd8 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -38,6 +38,7 @@ struct key_entry; + struct asus_wmi; + + struct quirk_entry { ++ bool no_rfkill; + bool hotplug_wireless; + bool scalar_panel_brightness; + bool store_backlight_power; +-- +2.20.1 + diff --git a/queue-4.4/asus-wmi-provide-access-to-als-control.patch b/queue-4.4/asus-wmi-provide-access-to-als-control.patch new file mode 100644 index 00000000000..65be498ad46 --- /dev/null +++ b/queue-4.4/asus-wmi-provide-access-to-als-control.patch @@ -0,0 +1,62 @@ +From b0d1473f2722bfebfed4e368629726b62c956fe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2016 13:35:21 +0200 +Subject: asus-wmi: provide access to ALS control + +From: Oleksij Rempel + +[ Upstream commit aca234f6378864d85514be558746c0ea6eabfa8e ] + +Asus Zenbook ux31a is providing ACPI0008 interface for ALS +(Ambient Light Sensor), which is accessible for OS => Win 7. +This sensor can be used with iio/acpi-als driver. +Since it is disabled by default, we should use asus-wmi +interface to enable it. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index a2174f01d3122..2dee91537123e 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -117,6 +117,7 @@ MODULE_LICENSE("GPL"); + #define ASUS_WMI_DEVID_LED6 0x00020016 + + /* Backlight and Brightness */ ++#define ASUS_WMI_DEVID_ALS_ENABLE 0x00050001 /* Ambient Light Sensor */ + #define ASUS_WMI_DEVID_BACKLIGHT 0x00050011 + #define ASUS_WMI_DEVID_BRIGHTNESS 0x00050012 + #define ASUS_WMI_DEVID_KBD_BACKLIGHT 0x00050021 +@@ -1759,6 +1760,7 @@ ASUS_WMI_CREATE_DEVICE_ATTR(touchpad, 0644, ASUS_WMI_DEVID_TOUCHPAD); + ASUS_WMI_CREATE_DEVICE_ATTR(camera, 0644, ASUS_WMI_DEVID_CAMERA); + ASUS_WMI_CREATE_DEVICE_ATTR(cardr, 0644, ASUS_WMI_DEVID_CARDREADER); + ASUS_WMI_CREATE_DEVICE_ATTR(lid_resume, 0644, ASUS_WMI_DEVID_LID_RESUME); ++ASUS_WMI_CREATE_DEVICE_ATTR(als_enable, 0644, ASUS_WMI_DEVID_ALS_ENABLE); + + static ssize_t store_cpufv(struct device *dev, struct device_attribute *attr, + const char *buf, size_t count) +@@ -1785,6 +1787,7 @@ static struct attribute *platform_attributes[] = { + &dev_attr_cardr.attr, + &dev_attr_touchpad.attr, + &dev_attr_lid_resume.attr, ++ &dev_attr_als_enable.attr, + NULL + }; + +@@ -1805,6 +1808,8 @@ static umode_t asus_sysfs_is_visible(struct kobject *kobj, + devid = ASUS_WMI_DEVID_TOUCHPAD; + else if (attr == &dev_attr_lid_resume.attr) + devid = ASUS_WMI_DEVID_LID_RESUME; ++ else if (attr == &dev_attr_als_enable.attr) ++ devid = ASUS_WMI_DEVID_ALS_ENABLE; + + if (devid != -1) + ok = !(asus_wmi_get_devstate_simple(asus, devid) < 0); +-- +2.20.1 + diff --git a/queue-4.4/atm-zatm-fix-empty-body-clang-warnings.patch b/queue-4.4/atm-zatm-fix-empty-body-clang-warnings.patch new file mode 100644 index 00000000000..d7aa232a0f9 --- /dev/null +++ b/queue-4.4/atm-zatm-fix-empty-body-clang-warnings.patch @@ -0,0 +1,175 @@ +From d0d4a05b28ecf58d6d7b8ef8587a02f3d4315414 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Oct 2018 11:04:19 -0700 +Subject: atm: zatm: Fix empty body Clang warnings + +From: Nathan Chancellor + +[ Upstream commit 64b9d16e2d02ca6e5dc8fcd30cfd52b0ecaaa8f4 ] + +Clang warns: + +drivers/atm/zatm.c:513:7: error: while loop has empty body +[-Werror,-Wempty-body] + zwait; + ^ +drivers/atm/zatm.c:513:7: note: put the semicolon on a separate line to +silence this warning + +Get rid of this warning by using an empty do-while loop. While we're at +it, add parentheses to make it clear that this is a function-like macro. + +Link: https://github.com/ClangBuiltLinux/linux/issues/42 +Suggested-by: Masahiro Yamada +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/zatm.c | 42 +++++++++++++++++++++--------------------- + 1 file changed, 21 insertions(+), 21 deletions(-) + +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c +index 94712e1c5cf9a..bcdde3e360522 100644 +--- a/drivers/atm/zatm.c ++++ b/drivers/atm/zatm.c +@@ -126,7 +126,7 @@ static unsigned long dummy[2] = {0,0}; + #define zin_n(r) inl(zatm_dev->base+r*4) + #define zin(r) inl(zatm_dev->base+uPD98401_##r*4) + #define zout(v,r) outl(v,zatm_dev->base+uPD98401_##r*4) +-#define zwait while (zin(CMR) & uPD98401_BUSY) ++#define zwait() do {} while (zin(CMR) & uPD98401_BUSY) + + /* RX0, RX1, TX0, TX1 */ + static const int mbx_entries[NR_MBX] = { 1024,1024,1024,1024 }; +@@ -140,7 +140,7 @@ static const int mbx_esize[NR_MBX] = { 16,16,4,4 }; /* entry size in bytes */ + + static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr) + { +- zwait; ++ zwait(); + zout(value,CER); + zout(uPD98401_IND_ACC | uPD98401_IA_BALL | + (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR); +@@ -149,10 +149,10 @@ static void zpokel(struct zatm_dev *zatm_dev,u32 value,u32 addr) + + static u32 zpeekl(struct zatm_dev *zatm_dev,u32 addr) + { +- zwait; ++ zwait(); + zout(uPD98401_IND_ACC | uPD98401_IA_BALL | uPD98401_IA_RW | + (uPD98401_IA_TGT_CM << uPD98401_IA_TGT_SHIFT) | addr,CMR); +- zwait; ++ zwait(); + return zin(CER); + } + +@@ -241,7 +241,7 @@ static void refill_pool(struct atm_dev *dev,int pool) + } + if (first) { + spin_lock_irqsave(&zatm_dev->lock, flags); +- zwait; ++ zwait(); + zout(virt_to_bus(first),CER); + zout(uPD98401_ADD_BAT | (pool << uPD98401_POOL_SHIFT) | count, + CMR); +@@ -508,9 +508,9 @@ static int open_rx_first(struct atm_vcc *vcc) + } + if (zatm_vcc->pool < 0) return -EMSGSIZE; + spin_lock_irqsave(&zatm_dev->lock, flags); +- zwait; ++ zwait(); + zout(uPD98401_OPEN_CHAN,CMR); +- zwait; ++ zwait(); + DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER)); + chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT; + spin_unlock_irqrestore(&zatm_dev->lock, flags); +@@ -571,21 +571,21 @@ static void close_rx(struct atm_vcc *vcc) + pos = vcc->vci >> 1; + shift = (1-(vcc->vci & 1)) << 4; + zpokel(zatm_dev,zpeekl(zatm_dev,pos) & ~(0xffff << shift),pos); +- zwait; ++ zwait(); + zout(uPD98401_NOP,CMR); +- zwait; ++ zwait(); + zout(uPD98401_NOP,CMR); + spin_unlock_irqrestore(&zatm_dev->lock, flags); + } + spin_lock_irqsave(&zatm_dev->lock, flags); +- zwait; ++ zwait(); + zout(uPD98401_DEACT_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan << + uPD98401_CHAN_ADDR_SHIFT),CMR); +- zwait; ++ zwait(); + udelay(10); /* why oh why ... ? */ + zout(uPD98401_CLOSE_CHAN | uPD98401_CHAN_RT | (zatm_vcc->rx_chan << + uPD98401_CHAN_ADDR_SHIFT),CMR); +- zwait; ++ zwait(); + if (!(zin(CMR) & uPD98401_CHAN_ADDR)) + printk(KERN_CRIT DEV_LABEL "(itf %d): can't close RX channel " + "%d\n",vcc->dev->number,zatm_vcc->rx_chan); +@@ -698,7 +698,7 @@ printk("NONONONOO!!!!\n"); + skb_queue_tail(&zatm_vcc->tx_queue,skb); + DPRINTK("QRP=0x%08lx\n",zpeekl(zatm_dev,zatm_vcc->tx_chan*VC_SIZE/4+ + uPD98401_TXVC_QRP)); +- zwait; ++ zwait(); + zout(uPD98401_TX_READY | (zatm_vcc->tx_chan << + uPD98401_CHAN_ADDR_SHIFT),CMR); + spin_unlock_irqrestore(&zatm_dev->lock, flags); +@@ -890,12 +890,12 @@ static void close_tx(struct atm_vcc *vcc) + } + spin_lock_irqsave(&zatm_dev->lock, flags); + #if 0 +- zwait; ++ zwait(); + zout(uPD98401_DEACT_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR); + #endif +- zwait; ++ zwait(); + zout(uPD98401_CLOSE_CHAN | (chan << uPD98401_CHAN_ADDR_SHIFT),CMR); +- zwait; ++ zwait(); + if (!(zin(CMR) & uPD98401_CHAN_ADDR)) + printk(KERN_CRIT DEV_LABEL "(itf %d): can't close TX channel " + "%d\n",vcc->dev->number,chan); +@@ -925,9 +925,9 @@ static int open_tx_first(struct atm_vcc *vcc) + zatm_vcc->tx_chan = 0; + if (vcc->qos.txtp.traffic_class == ATM_NONE) return 0; + spin_lock_irqsave(&zatm_dev->lock, flags); +- zwait; ++ zwait(); + zout(uPD98401_OPEN_CHAN,CMR); +- zwait; ++ zwait(); + DPRINTK("0x%x 0x%x\n",zin(CMR),zin(CER)); + chan = (zin(CMR) & uPD98401_CHAN_ADDR) >> uPD98401_CHAN_ADDR_SHIFT; + spin_unlock_irqrestore(&zatm_dev->lock, flags); +@@ -1557,7 +1557,7 @@ static void zatm_phy_put(struct atm_dev *dev,unsigned char value, + struct zatm_dev *zatm_dev; + + zatm_dev = ZATM_DEV(dev); +- zwait; ++ zwait(); + zout(value,CER); + zout(uPD98401_IND_ACC | uPD98401_IA_B0 | + (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR); +@@ -1569,10 +1569,10 @@ static unsigned char zatm_phy_get(struct atm_dev *dev,unsigned long addr) + struct zatm_dev *zatm_dev; + + zatm_dev = ZATM_DEV(dev); +- zwait; ++ zwait(); + zout(uPD98401_IND_ACC | uPD98401_IA_B0 | uPD98401_IA_RW | + (uPD98401_IA_TGT_PHY << uPD98401_IA_TGT_SHIFT) | addr,CMR); +- zwait; ++ zwait(); + return zin(CER) & 0xff; + } + +-- +2.20.1 + diff --git a/queue-4.4/audit-print-empty-execve-args.patch b/queue-4.4/audit-print-empty-execve-args.patch new file mode 100644 index 00000000000..2a38b58bd27 --- /dev/null +++ b/queue-4.4/audit-print-empty-execve-args.patch @@ -0,0 +1,49 @@ +From dc14f3067fe24aefbe589d34bc7d51263cc2e23a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Oct 2018 16:22:57 -0400 +Subject: audit: print empty EXECVE args + +From: Richard Guy Briggs + +[ Upstream commit ea956d8be91edc702a98b7fe1f9463e7ca8c42ab ] + +Empty executable arguments were being skipped when printing out the list +of arguments in an EXECVE record, making it appear they were somehow +lost. Include empty arguments as an itemized empty string. + +Reproducer: + autrace /bin/ls "" "/etc" + ausearch --start recent -m execve -i | grep EXECVE + type=EXECVE msg=audit(10/03/2018 13:04:03.208:1391) : argc=3 a0=/bin/ls a2=/etc + +With fix: + type=EXECVE msg=audit(10/03/2018 21:51:38.290:194) : argc=3 a0=/bin/ls a1= a2=/etc + type=EXECVE msg=audit(1538617898.290:194): argc=3 a0="/bin/ls" a1="" a2="/etc" + +Passes audit-testsuite. GH issue tracker at +https://github.com/linux-audit/audit-kernel/issues/99 + +Signed-off-by: Richard Guy Briggs +[PM: cleaned up the commit metadata] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/auditsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 0fe8b337291a3..87c43c92fb7d8 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1093,7 +1093,7 @@ static void audit_log_execve_info(struct audit_context *context, + } + + /* write as much as we can to the audit log */ +- if (len_buf > 0) { ++ if (len_buf >= 0) { + /* NOTE: some magic numbers here - basically if we + * can't fit a reasonable amount of data into the + * existing audit buffer, flush it and start with +-- +2.20.1 + diff --git a/queue-4.4/brcmsmac-ap-mode-update-beacon-when-tim-changes.patch b/queue-4.4/brcmsmac-ap-mode-update-beacon-when-tim-changes.patch new file mode 100644 index 00000000000..f5d8b5b748f --- /dev/null +++ b/queue-4.4/brcmsmac-ap-mode-update-beacon-when-tim-changes.patch @@ -0,0 +1,99 @@ +From a763eefca9d654954f5f3db0efe25105c680c516 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 19:21:39 +0300 +Subject: brcmsmac: AP mode: update beacon when TIM changes + +From: Ali MJ Al-Nasrawy + +[ Upstream commit 2258ee58baa554609a3cc3996276e4276f537b6d ] + +Beacons are not updated to reflect TIM changes. This is not compliant with +power-saving client stations as the beacons do not have valid TIM and can +cause the network to stall at random occasions and to have highly variable +latencies. +Fix it by updating beacon templates on mac80211 set_tim callback. + +Addresses an issue described in: +https://marc.info/?i=20180911163534.21312d08%20()%20manjaro + +Signed-off-by: Ali MJ Al-Nasrawy +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + .../wireless/brcm80211/brcmsmac/mac80211_if.c | 26 +++++++++++++++++++ + .../net/wireless/brcm80211/brcmsmac/main.h | 1 + + 2 files changed, 27 insertions(+) + +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +index 61ae2768132a0..e3b01d804cf24 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +@@ -502,6 +502,7 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + } + + spin_lock_bh(&wl->lock); ++ wl->wlc->vif = vif; + wl->mute_tx = false; + brcms_c_mute(wl->wlc, false); + if (vif->type == NL80211_IFTYPE_STATION) +@@ -519,6 +520,11 @@ brcms_ops_add_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + static void + brcms_ops_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif) + { ++ struct brcms_info *wl = hw->priv; ++ ++ spin_lock_bh(&wl->lock); ++ wl->wlc->vif = NULL; ++ spin_unlock_bh(&wl->lock); + } + + static int brcms_ops_config(struct ieee80211_hw *hw, u32 changed) +@@ -937,6 +943,25 @@ static void brcms_ops_set_tsf(struct ieee80211_hw *hw, + spin_unlock_bh(&wl->lock); + } + ++static int brcms_ops_beacon_set_tim(struct ieee80211_hw *hw, ++ struct ieee80211_sta *sta, bool set) ++{ ++ struct brcms_info *wl = hw->priv; ++ struct sk_buff *beacon = NULL; ++ u16 tim_offset = 0; ++ ++ spin_lock_bh(&wl->lock); ++ if (wl->wlc->vif) ++ beacon = ieee80211_beacon_get_tim(hw, wl->wlc->vif, ++ &tim_offset, NULL); ++ if (beacon) ++ brcms_c_set_new_beacon(wl->wlc, beacon, tim_offset, ++ wl->wlc->vif->bss_conf.dtim_period); ++ spin_unlock_bh(&wl->lock); ++ ++ return 0; ++} ++ + static const struct ieee80211_ops brcms_ops = { + .tx = brcms_ops_tx, + .start = brcms_ops_start, +@@ -955,6 +980,7 @@ static const struct ieee80211_ops brcms_ops = { + .flush = brcms_ops_flush, + .get_tsf = brcms_ops_get_tsf, + .set_tsf = brcms_ops_set_tsf, ++ .set_tim = brcms_ops_beacon_set_tim, + }; + + void brcms_dpc(unsigned long data) +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.h b/drivers/net/wireless/brcm80211/brcmsmac/main.h +index c4d135cff04ad..9f76b880814e8 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/main.h ++++ b/drivers/net/wireless/brcm80211/brcmsmac/main.h +@@ -563,6 +563,7 @@ struct brcms_c_info { + + struct wiphy *wiphy; + struct scb pri_scb; ++ struct ieee80211_vif *vif; + + struct sk_buff *beacon; + u16 beacon_tim_offset; +-- +2.20.1 + diff --git a/queue-4.4/brcmsmac-never-log-tid-x-is-not-agg-able-by-default.patch b/queue-4.4/brcmsmac-never-log-tid-x-is-not-agg-able-by-default.patch new file mode 100644 index 00000000000..2620d877bb7 --- /dev/null +++ b/queue-4.4/brcmsmac-never-log-tid-x-is-not-agg-able-by-default.patch @@ -0,0 +1,39 @@ +From 503ab388f435979effd6318028a5a80f09d039f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Oct 2018 19:12:35 +0300 +Subject: brcmsmac: never log "tid x is not agg'able" by default + +From: Ali MJ Al-Nasrawy + +[ Upstream commit 96fca788e5788b7ea3b0050eb35a343637e0a465 ] + +This message greatly spams the log under heavy Tx of frames with BK access +class which is especially true when operating as AP. It is also not informative +as the "agg'ablity" of TIDs are set once and never change. +Fix this by logging only in debug mode. + +Signed-off-by: Ali MJ Al-Nasrawy +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +index e3b01d804cf24..a4e1eec96c60d 100644 +--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c ++++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c +@@ -846,8 +846,8 @@ brcms_ops_ampdu_action(struct ieee80211_hw *hw, + status = brcms_c_aggregatable(wl->wlc, tid); + spin_unlock_bh(&wl->lock); + if (!status) { +- brcms_err(wl->wlc->hw->d11core, +- "START: tid %d is not agg\'able\n", tid); ++ brcms_dbg_ht(wl->wlc->hw->d11core, ++ "START: tid %d is not agg\'able\n", tid); + return -EINVAL; + } + ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid); +-- +2.20.1 + diff --git a/queue-4.4/btrfs-handle-error-of-get_old_root.patch b/queue-4.4/btrfs-handle-error-of-get_old_root.patch new file mode 100644 index 00000000000..4aa85e768a7 --- /dev/null +++ b/queue-4.4/btrfs-handle-error-of-get_old_root.patch @@ -0,0 +1,43 @@ +From dddf219d434d4f661b9a3ba3aa4b144bf49e25b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Sep 2018 11:35:10 +0300 +Subject: btrfs: handle error of get_old_root + +From: Nikolay Borisov + +[ Upstream commit 315bed43fea532650933e7bba316a7601d439edf ] + +In btrfs_search_old_slot get_old_root is always used with the assumption +it cannot fail. However, this is not true in rare circumstance it can +fail and return null. This will lead to null point dereference when the +header is read. Fix this by checking the return value and properly +handling NULL by setting ret to -EIO and returning gracefully. + +Coverity-id: 1087503 +Signed-off-by: Nikolay Borisov +Reviewed-by: Lu Fengqi +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ctree.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 51a0409e1b84a..a980b33097701 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -2966,6 +2966,10 @@ int btrfs_search_old_slot(struct btrfs_root *root, struct btrfs_key *key, + + again: + b = get_old_root(root, time_seq); ++ if (!b) { ++ ret = -EIO; ++ goto done; ++ } + level = btrfs_header_level(b); + p->locks[level] = BTRFS_READ_LOCK; + +-- +2.20.1 + diff --git a/queue-4.4/ceph-fix-dentry-leak-in-ceph_readdir_prepopulate.patch b/queue-4.4/ceph-fix-dentry-leak-in-ceph_readdir_prepopulate.patch new file mode 100644 index 00000000000..61159bf5410 --- /dev/null +++ b/queue-4.4/ceph-fix-dentry-leak-in-ceph_readdir_prepopulate.patch @@ -0,0 +1,32 @@ +From 37782c50ed2cb2ff8b40c3cacd72d9b7d507db3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Sep 2018 09:10:29 +0800 +Subject: ceph: fix dentry leak in ceph_readdir_prepopulate + +From: Yan, Zheng + +[ Upstream commit c58f450bd61511d897efc2ea472c69630635b557 ] + +Signed-off-by: "Yan, Zheng" +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/inode.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index 2ad3f4ab4dcfa..0be931cf3c44c 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1515,7 +1515,6 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req, + if (IS_ERR(realdn)) { + err = PTR_ERR(realdn); + d_drop(dn); +- dn = NULL; + goto next_item; + } + dn = realdn; +-- +2.20.1 + diff --git a/queue-4.4/clk-mmp2-fix-the-clock-id-for-sdh2_clk-and-sdh3_clk.patch b/queue-4.4/clk-mmp2-fix-the-clock-id-for-sdh2_clk-and-sdh3_clk.patch new file mode 100644 index 00000000000..4cfe6ac29ac --- /dev/null +++ b/queue-4.4/clk-mmp2-fix-the-clock-id-for-sdh2_clk-and-sdh3_clk.patch @@ -0,0 +1,38 @@ +From 52b5ef397445229dcc201a95822be5b74bf6899a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Sep 2018 14:01:44 +0200 +Subject: clk: mmp2: fix the clock id for sdh2_clk and sdh3_clk + +From: Lubomir Rintel + +[ Upstream commit 4917fb90eec7c26dac1497ada3bd4a325f670fcc ] + +A typo that makes it impossible to get the correct clocks for +MMP2_CLK_SDH2 and MMP2_CLK_SDH3. + +Signed-off-by: Lubomir Rintel +Fixes: 1ec770d92a62 ("clk: mmp: add mmp2 DT support for clock driver") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mmp/clk-of-mmp2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c +index f261b1d292c74..8b45cb2caed1b 100644 +--- a/drivers/clk/mmp/clk-of-mmp2.c ++++ b/drivers/clk/mmp/clk-of-mmp2.c +@@ -227,8 +227,8 @@ static struct mmp_param_gate_clk apmu_gate_clks[] = { + /* The gate clocks has mux parent. */ + {MMP2_CLK_SDH0, "sdh0_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH0, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, + {MMP2_CLK_SDH1, "sdh1_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH1, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, +- {MMP2_CLK_SDH1, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, +- {MMP2_CLK_SDH1, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, ++ {MMP2_CLK_SDH2, "sdh2_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH2, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, ++ {MMP2_CLK_SDH3, "sdh3_clk", "sdh_mix_clk", CLK_SET_RATE_PARENT, APMU_SDH3, 0x1b, 0x1b, 0x0, 0, &sdh_lock}, + {MMP2_CLK_DISP0, "disp0_clk", "disp0_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1b, 0x1b, 0x0, 0, &disp0_lock}, + {MMP2_CLK_DISP0_SPHY, "disp0_sphy_clk", "disp0_sphy_div", CLK_SET_RATE_PARENT, APMU_DISP0, 0x1024, 0x1024, 0x0, 0, &disp0_lock}, + {MMP2_CLK_DISP1, "disp1_clk", "disp1_div", CLK_SET_RATE_PARENT, APMU_DISP1, 0x1b, 0x1b, 0x0, 0, &disp1_lock}, +-- +2.20.1 + diff --git a/queue-4.4/dlm-don-t-leak-kernel-pointer-to-userspace.patch b/queue-4.4/dlm-don-t-leak-kernel-pointer-to-userspace.patch new file mode 100644 index 00000000000..e88e61c27d4 --- /dev/null +++ b/queue-4.4/dlm-don-t-leak-kernel-pointer-to-userspace.patch @@ -0,0 +1,44 @@ +From a644b6f06dff6abd863d555af4622b6d33d1b6f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Nov 2018 14:18:22 -0600 +Subject: dlm: don't leak kernel pointer to userspace + +From: Tycho Andersen + +[ Upstream commit 9de30f3f7f4d31037cfbb7c787e1089c1944b3a7 ] + +In copy_result_to_user(), we first create a struct dlm_lock_result, which +contains a struct dlm_lksb, the last member of which is a pointer to the +lvb. Unfortunately, we copy the entire struct dlm_lksb to the result +struct, which is then copied to userspace at the end of the function, +leaking the contents of sb_lvbptr, which is a valid kernel pointer in some +cases (indeed, later in the same function the data it points to is copied +to userspace). + +It is an error to leak kernel pointers to userspace, as it undermines KASLR +protections (see e.g. 65eea8edc31 ("floppy: Do not copy a kernel pointer to +user memory in FDGETPRM ioctl") for another example of this). + +Signed-off-by: Tycho Andersen +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/user.c b/fs/dlm/user.c +index e40c440a45552..dd2b7416e40ae 100644 +--- a/fs/dlm/user.c ++++ b/fs/dlm/user.c +@@ -705,7 +705,7 @@ static int copy_result_to_user(struct dlm_user_args *ua, int compat, + result.version[0] = DLM_DEVICE_VERSION_MAJOR; + result.version[1] = DLM_DEVICE_VERSION_MINOR; + result.version[2] = DLM_DEVICE_VERSION_PATCH; +- memcpy(&result.lksb, &ua->lksb, sizeof(struct dlm_lksb)); ++ memcpy(&result.lksb, &ua->lksb, offsetof(struct dlm_lksb, sb_lvbptr)); + result.user_lksb = ua->user_lksb; + + /* FIXME: dlm1 provides for the user's bastparam/addr to not be updated +-- +2.20.1 + diff --git a/queue-4.4/dlm-fix-invalid-free.patch b/queue-4.4/dlm-fix-invalid-free.patch new file mode 100644 index 00000000000..6b876ee3712 --- /dev/null +++ b/queue-4.4/dlm-fix-invalid-free.patch @@ -0,0 +1,46 @@ +From 33ef2aa79af6af9377ae49065e45751111dbf7be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Nov 2018 14:18:20 -0600 +Subject: dlm: fix invalid free + +From: Tycho Andersen + +[ Upstream commit d968b4e240cfe39d39d80483bac8bca8716fd93c ] + +dlm_config_nodes() does not allocate nodes on failure, so we should not +free() nodes when it fails. + +Signed-off-by: Tycho Andersen +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/member.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/dlm/member.c b/fs/dlm/member.c +index 9c47f1c14a8ba..a47ae99f7bcbc 100644 +--- a/fs/dlm/member.c ++++ b/fs/dlm/member.c +@@ -683,7 +683,7 @@ int dlm_ls_start(struct dlm_ls *ls) + + error = dlm_config_nodes(ls->ls_name, &nodes, &count); + if (error < 0) +- goto fail; ++ goto fail_rv; + + spin_lock(&ls->ls_recover_lock); + +@@ -715,8 +715,9 @@ int dlm_ls_start(struct dlm_ls *ls) + return 0; + + fail: +- kfree(rv); + kfree(nodes); ++ fail_rv: ++ kfree(rv); + return error; + } + +-- +2.20.1 + diff --git a/queue-4.4/fs-hfs-extent.c-fix-array-out-of-bounds-read-of-arra.patch b/queue-4.4/fs-hfs-extent.c-fix-array-out-of-bounds-read-of-arra.patch new file mode 100644 index 00000000000..790508a6203 --- /dev/null +++ b/queue-4.4/fs-hfs-extent.c-fix-array-out-of-bounds-read-of-arra.patch @@ -0,0 +1,58 @@ +From 576c8ccf88c6df4fc024f149c4acf5b7b128e119 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:35 -0700 +Subject: fs/hfs/extent.c: fix array out of bounds read of array extent + +From: Colin Ian King + +[ Upstream commit 6c9a3f843a29d6894dfc40df338b91dbd78f0ae3 ] + +Currently extent and index i are both being incremented causing an array +out of bounds read on extent[i]. Fix this by removing the extraneous +increment of extent. + +Ernesto said: + +: This is only triggered when deleting a file with a resource fork. I +: may be wrong because the documentation isn't clear, but I don't think +: you can create those under linux. So I guess nobody was testing them. +: +: > A disk space leak, perhaps? +: +: That's what it looks like in general. hfs_free_extents() won't do +: anything if the block count doesn't add up, and the error will be +: ignored. Now, if the block count randomly does add up, we could see +: some corruption. + +Detected by CoverityScan, CID#711541 ("Out of bounds read") + +Link: http://lkml.kernel.org/r/20180831140538.31566-1-colin.king@canonical.com +Signed-off-by: Colin Ian King +Reviewed-by: Ernesto A. Fernndez +Cc: David Howells +Cc: Al Viro +Cc: Hin-Tak Leung +Cc: Vyacheslav Dubeyko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfs/extent.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c +index 16819d2a978b4..cbe4fca96378a 100644 +--- a/fs/hfs/extent.c ++++ b/fs/hfs/extent.c +@@ -304,7 +304,7 @@ int hfs_free_fork(struct super_block *sb, struct hfs_cat_file *file, int type) + return 0; + + blocks = 0; +- for (i = 0; i < 3; extent++, i++) ++ for (i = 0; i < 3; i++) + blocks += be16_to_cpu(extent[i].count); + + res = hfs_free_extents(sb, extent, blocks, blocks); +-- +2.20.1 + diff --git a/queue-4.4/fs-ocfs2-dlm-dlmdebug.c-fix-a-sleep-in-atomic-contex.patch b/queue-4.4/fs-ocfs2-dlm-dlmdebug.c-fix-a-sleep-in-atomic-contex.patch new file mode 100644 index 00000000000..d13ad403540 --- /dev/null +++ b/queue-4.4/fs-ocfs2-dlm-dlmdebug.c-fix-a-sleep-in-atomic-contex.patch @@ -0,0 +1,61 @@ +From 29a7ffc47b59e7bb866bc3ac35d6e47798c431e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 15:02:52 -0700 +Subject: fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in + dlm_print_one_mle() + +From: Jia-Ju Bai + +[ Upstream commit 999865764f5f128896402572b439269acb471022 ] + +The kernel module may sleep with holding a spinlock. + +The function call paths (from bottom to top) in Linux-4.16 are: + +[FUNC] get_zeroed_page(GFP_NOFS) +fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle +fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle +fs/ocfs2/dlm/dlmmaster.c, 255: __dlm_put_mle in dlm_put_mle +fs/ocfs2/dlm/dlmmaster.c, 254: spin_lock in dlm_put_ml + +[FUNC] get_zeroed_page(GFP_NOFS) +fs/ocfs2/dlm/dlmdebug.c, 332: get_zeroed_page in dlm_print_one_mle +fs/ocfs2/dlm/dlmmaster.c, 240: dlm_print_one_mle in __dlm_put_mle +fs/ocfs2/dlm/dlmmaster.c, 222: __dlm_put_mle in dlm_put_mle_inuse +fs/ocfs2/dlm/dlmmaster.c, 219: spin_lock in dlm_put_mle_inuse + +To fix this bug, GFP_NOFS is replaced with GFP_ATOMIC. + +This bug is found by my static analysis tool DSAC. + +Link: http://lkml.kernel.org/r/20180901112528.27025-1-baijiaju1990@gmail.com +Signed-off-by: Jia-Ju Bai +Reviewed-by: Andrew Morton +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/dlm/dlmdebug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ocfs2/dlm/dlmdebug.c b/fs/ocfs2/dlm/dlmdebug.c +index 825136070d2c1..73eaccea09b98 100644 +--- a/fs/ocfs2/dlm/dlmdebug.c ++++ b/fs/ocfs2/dlm/dlmdebug.c +@@ -329,7 +329,7 @@ void dlm_print_one_mle(struct dlm_master_list_entry *mle) + { + char *buf; + +- buf = (char *) get_zeroed_page(GFP_NOFS); ++ buf = (char *) get_zeroed_page(GFP_ATOMIC); + if (buf) { + dump_mle(mle, buf, PAGE_SIZE - 1); + free_page((unsigned long)buf); +-- +2.20.1 + diff --git a/queue-4.4/gfs2-fix-marking-bitmaps-non-full.patch b/queue-4.4/gfs2-fix-marking-bitmaps-non-full.patch new file mode 100644 index 00000000000..12d5ad84e2c --- /dev/null +++ b/queue-4.4/gfs2-fix-marking-bitmaps-non-full.patch @@ -0,0 +1,56 @@ +From 51a2ecb2cf4d46504c720ae4521c6c170a02d08e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Sep 2018 15:30:25 +0100 +Subject: gfs2: Fix marking bitmaps non-full + +From: Andreas Gruenbacher + +[ Upstream commit ec23df2b0cf3e1620f5db77972b7fb735f267eff ] + +Reservations in gfs can span multiple gfs2_bitmaps (but they won't span +multiple resource groups). When removing a reservation, we want to +clear the GBF_FULL flags of all involved gfs2_bitmaps, not just that of +the first bitmap. + +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Bob Peterson +Reviewed-by: Steven Whitehouse +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index e632006a52df6..2736e9cfc2ee9 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -645,7 +645,10 @@ static void __rs_deltree(struct gfs2_blkreserv *rs) + RB_CLEAR_NODE(&rs->rs_node); + + if (rs->rs_free) { +- struct gfs2_bitmap *bi = rbm_bi(&rs->rs_rbm); ++ u64 last_block = gfs2_rbm_to_block(&rs->rs_rbm) + ++ rs->rs_free - 1; ++ struct gfs2_rbm last_rbm = { .rgd = rs->rs_rbm.rgd, }; ++ struct gfs2_bitmap *start, *last; + + /* return reserved blocks to the rgrp */ + BUG_ON(rs->rs_rbm.rgd->rd_reserved < rs->rs_free); +@@ -656,7 +659,13 @@ static void __rs_deltree(struct gfs2_blkreserv *rs) + it will force the number to be recalculated later. */ + rgd->rd_extfail_pt += rs->rs_free; + rs->rs_free = 0; +- clear_bit(GBF_FULL, &bi->bi_flags); ++ if (gfs2_rbm_from_block(&last_rbm, last_block)) ++ return; ++ start = rbm_bi(&rs->rs_rbm); ++ last = rbm_bi(&last_rbm); ++ do ++ clear_bit(GBF_FULL, &start->bi_flags); ++ while (start++ != last); + } + } + +-- +2.20.1 + diff --git a/queue-4.4/gsmi-fix-bug-in-append_to_eventlog-sysfs-handler.patch b/queue-4.4/gsmi-fix-bug-in-append_to_eventlog-sysfs-handler.patch new file mode 100644 index 00000000000..d06b3a00224 --- /dev/null +++ b/queue-4.4/gsmi-fix-bug-in-append_to_eventlog-sysfs-handler.patch @@ -0,0 +1,78 @@ +From 3f02625964e36946ca9dda43d00ce6f9506ea5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 10:04:45 -0600 +Subject: gsmi: Fix bug in append_to_eventlog sysfs handler + +From: Duncan Laurie + +[ Upstream commit 655603de68469adaff16842ac17a5aec9c9ce89b ] + +The sysfs handler should return the number of bytes consumed, which in the +case of a successful write is the entire buffer. Also fix a bug where +param.data_len was being set to (count - (2 * sizeof(u32))) instead of just +(count - sizeof(u32)). The latter is correct because we skip over the +leading u32 which is our param.type, but we were also incorrectly +subtracting sizeof(u32) on the line where we were actually setting +param.data_len: + + param.data_len = count - sizeof(u32); + +This meant that for our example event.kernel_software_watchdog with total +length 10 bytes, param.data_len was just 2 prior to this change. + +To test, successfully append an event to the log with gsmi sysfs. +This sample event is for a "Kernel Software Watchdog" + +> xxd -g 1 event.kernel_software_watchdog +0000000: 01 00 00 00 ad de 06 00 00 00 + +> cat event.kernel_software_watchdog > /sys/firmware/gsmi/append_to_eventlog + +> mosys eventlog list | tail -1 +14 | 2012-06-25 10:14:14 | Kernl Event | Software Watchdog + +Signed-off-by: Duncan Laurie +Reviewed-by: Vadim Bendebury +Reviewed-by: Stefan Reinauer +Signed-off-by: Furquan Shaikh +Tested-by: Furquan Shaikh +Reviewed-by: Aaron Durbin +Reviewed-by: Justin TerAvest +[zwisler: updated changelog for 2nd bug fix and upstream] +Signed-off-by: Ross Zwisler +Reviewed-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/google/gsmi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c +index f1ab05ea56bbc..3c117559f102f 100644 +--- a/drivers/firmware/google/gsmi.c ++++ b/drivers/firmware/google/gsmi.c +@@ -480,11 +480,10 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj, + if (count < sizeof(u32)) + return -EINVAL; + param.type = *(u32 *)buf; +- count -= sizeof(u32); + buf += sizeof(u32); + + /* The remaining buffer is the data payload */ +- if (count > gsmi_dev.data_buf->length) ++ if ((count - sizeof(u32)) > gsmi_dev.data_buf->length) + return -EINVAL; + param.data_len = count - sizeof(u32); + +@@ -504,7 +503,7 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj, + + spin_unlock_irqrestore(&gsmi_dev.lock, flags); + +- return rc; ++ return (rc == 0) ? count : rc; + + } + +-- +2.20.1 + diff --git a/queue-4.4/hfs-fix-bug-on-bnode-parent-update.patch b/queue-4.4/hfs-fix-bug-on-bnode-parent-update.patch new file mode 100644 index 00000000000..3c7ac5ea24d --- /dev/null +++ b/queue-4.4/hfs-fix-bug-on-bnode-parent-update.patch @@ -0,0 +1,48 @@ +From e8a841bc91e5a29f9b0719b33bdc89094c65dfc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:11 -0700 +Subject: hfs: fix BUG on bnode parent update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit ef75bcc5763d130451a99825f247d301088b790b ] + +hfs_brec_update_parent() may hit BUG_ON() if the first record of both a +leaf node and its parent are changed, and if this forces the parent to +be split. It is not possible for this to happen on a valid hfs +filesystem because the index nodes have fixed length keys. + +For reasons I ignore, the hfs module does have support for a number of +hfsplus features. A corrupt btree header may report variable length +keys and trigger this BUG, so it's better to fix it. + +Link: http://lkml.kernel.org/r/cf9b02d57f806217a2b1bf5db8c3e39730d8f603.1535682463.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Reviewed-by: Andrew Morton +Cc: Christoph Hellwig +Cc: Viacheslav Dubeyko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfs/brec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c +index 2e713673df42f..85dab71bee74f 100644 +--- a/fs/hfs/brec.c ++++ b/fs/hfs/brec.c +@@ -444,6 +444,7 @@ static int hfs_brec_update_parent(struct hfs_find_data *fd) + /* restore search_key */ + hfs_bnode_read_key(node, fd->search_key, 14); + } ++ new_node = NULL; + } + + if (!rec && node->parent) +-- +2.20.1 + diff --git a/queue-4.4/hfs-fix-return-value-of-hfs_get_block.patch b/queue-4.4/hfs-fix-return-value-of-hfs_get_block.patch new file mode 100644 index 00000000000..73441e099b1 --- /dev/null +++ b/queue-4.4/hfs-fix-return-value-of-hfs_get_block.patch @@ -0,0 +1,48 @@ +From 6ef406d8c74f79292954d672bf5b26450a1cb7ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:24 -0700 +Subject: hfs: fix return value of hfs_get_block() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit 1267a07be5ebbff2d2739290f3d043ae137c15b4 ] + +Direct writes to empty inodes fail with EIO. The generic direct-io code +is in part to blame (a patch has been submitted as "direct-io: allow +direct writes to empty inodes"), but hfs is worse affected than the other +filesystems because the fallback to buffered I/O doesn't happen. + +The problem is the return value of hfs_get_block() when called with +!create. Change it to be more consistent with the other modules. + +Link: http://lkml.kernel.org/r/4538ab8c35ea37338490525f0f24cbc37227528c.1539195310.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Reviewed-by: Vyacheslav Dubeyko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfs/extent.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c +index 1bd1afefe2538..16819d2a978b4 100644 +--- a/fs/hfs/extent.c ++++ b/fs/hfs/extent.c +@@ -345,7 +345,9 @@ int hfs_get_block(struct inode *inode, sector_t block, + ablock = (u32)block / HFS_SB(sb)->fs_div; + + if (block >= HFS_I(inode)->fs_blocks) { +- if (block > HFS_I(inode)->fs_blocks || !create) ++ if (!create) ++ return 0; ++ if (block > HFS_I(inode)->fs_blocks) + return -EIO; + if (ablock >= HFS_I(inode)->alloc_blocks) { + res = hfs_extend_file(inode); +-- +2.20.1 + diff --git a/queue-4.4/hfs-prevent-btree-data-loss-on-enospc.patch b/queue-4.4/hfs-prevent-btree-data-loss-on-enospc.patch new file mode 100644 index 00000000000..a9ec912904a --- /dev/null +++ b/queue-4.4/hfs-prevent-btree-data-loss-on-enospc.patch @@ -0,0 +1,166 @@ +From bfefd03acc7112ac117cda153923e576b7529d03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:17 -0700 +Subject: hfs: prevent btree data loss on ENOSPC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit 54640c7502e5ed41fbf4eedd499e85f9acc9698f ] + +Inserting a new record in a btree may require splitting several of its +nodes. If we hit ENOSPC halfway through, the new nodes will be left +orphaned and their records will be lost. This could mean lost inodes or +extents. + +Henceforth, check the available disk space before making any changes. +This still leaves the potential problem of corruption on ENOMEM. + +There is no need to reserve space before deleting a catalog record, as we +do for hfsplus. This difference is because hfs index nodes have fixed +length keys. + +Link: http://lkml.kernel.org/r/ab5fc8a7d5ffccfd5f27b1cf2cb4ceb6c110da74.1536269131.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfs/btree.c | 41 +++++++++++++++++++++++++---------------- + fs/hfs/btree.h | 1 + + fs/hfs/catalog.c | 16 ++++++++++++++++ + fs/hfs/extent.c | 4 ++++ + 4 files changed, 46 insertions(+), 16 deletions(-) + +diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c +index 1ff5774a5382a..9e9b02f5134b0 100644 +--- a/fs/hfs/btree.c ++++ b/fs/hfs/btree.c +@@ -219,25 +219,17 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx) + return node; + } + +-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) ++/* Make sure @tree has enough space for the @rsvd_nodes */ ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes) + { +- struct hfs_bnode *node, *next_node; +- struct page **pagep; +- u32 nidx, idx; +- unsigned off; +- u16 off16; +- u16 len; +- u8 *data, byte, m; +- int i; +- +- while (!tree->free_nodes) { +- struct inode *inode = tree->inode; +- u32 count; +- int res; ++ struct inode *inode = tree->inode; ++ u32 count; ++ int res; + ++ while (tree->free_nodes < rsvd_nodes) { + res = hfs_extend_file(inode); + if (res) +- return ERR_PTR(res); ++ return res; + HFS_I(inode)->phys_size = inode->i_size = + (loff_t)HFS_I(inode)->alloc_blocks * + HFS_SB(tree->sb)->alloc_blksz; +@@ -245,9 +237,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) + tree->sb->s_blocksize_bits; + inode_set_bytes(inode, inode->i_size); + count = inode->i_size >> tree->node_size_shift; +- tree->free_nodes = count - tree->node_count; ++ tree->free_nodes += count - tree->node_count; + tree->node_count = count; + } ++ return 0; ++} ++ ++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) ++{ ++ struct hfs_bnode *node, *next_node; ++ struct page **pagep; ++ u32 nidx, idx; ++ unsigned off; ++ u16 off16; ++ u16 len; ++ u8 *data, byte, m; ++ int i, res; ++ ++ res = hfs_bmap_reserve(tree, 1); ++ if (res) ++ return ERR_PTR(res); + + nidx = 0; + node = hfs_bnode_find(tree, nidx); +diff --git a/fs/hfs/btree.h b/fs/hfs/btree.h +index f6bd266d70b55..2715f416b5a80 100644 +--- a/fs/hfs/btree.h ++++ b/fs/hfs/btree.h +@@ -81,6 +81,7 @@ struct hfs_find_data { + extern struct hfs_btree *hfs_btree_open(struct super_block *, u32, btree_keycmp); + extern void hfs_btree_close(struct hfs_btree *); + extern void hfs_btree_write(struct hfs_btree *); ++extern int hfs_bmap_reserve(struct hfs_btree *, int); + extern struct hfs_bnode * hfs_bmap_alloc(struct hfs_btree *); + extern void hfs_bmap_free(struct hfs_bnode *node); + +diff --git a/fs/hfs/catalog.c b/fs/hfs/catalog.c +index db458ee3a5467..34158c276200e 100644 +--- a/fs/hfs/catalog.c ++++ b/fs/hfs/catalog.c +@@ -97,6 +97,14 @@ int hfs_cat_create(u32 cnid, struct inode *dir, struct qstr *str, struct inode * + if (err) + return err; + ++ /* ++ * Fail early and avoid ENOSPC during the btree operations. We may ++ * have to split the root node at most once. ++ */ ++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth); ++ if (err) ++ goto err2; ++ + hfs_cat_build_key(sb, fd.search_key, cnid, NULL); + entry_size = hfs_cat_build_thread(sb, &entry, S_ISDIR(inode->i_mode) ? + HFS_CDR_THD : HFS_CDR_FTH, +@@ -294,6 +302,14 @@ int hfs_cat_move(u32 cnid, struct inode *src_dir, struct qstr *src_name, + return err; + dst_fd = src_fd; + ++ /* ++ * Fail early and avoid ENOSPC during the btree operations. We may ++ * have to split the root node at most once. ++ */ ++ err = hfs_bmap_reserve(src_fd.tree, 2 * src_fd.tree->depth); ++ if (err) ++ goto out; ++ + /* find the old dir entry and read the data */ + hfs_cat_build_key(sb, src_fd.search_key, src_dir->i_ino, src_name); + err = hfs_brec_find(&src_fd); +diff --git a/fs/hfs/extent.c b/fs/hfs/extent.c +index e33a0d36a93eb..1bd1afefe2538 100644 +--- a/fs/hfs/extent.c ++++ b/fs/hfs/extent.c +@@ -117,6 +117,10 @@ static int __hfs_ext_write_extent(struct inode *inode, struct hfs_find_data *fd) + if (HFS_I(inode)->flags & HFS_FLG_EXT_NEW) { + if (res != -ENOENT) + return res; ++ /* Fail early and avoid ENOSPC during the btree operation */ ++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1); ++ if (res) ++ return res; + hfs_brec_insert(fd, HFS_I(inode)->cached_extents, sizeof(hfs_extent_rec)); + HFS_I(inode)->flags &= ~(HFS_FLG_EXT_DIRTY|HFS_FLG_EXT_NEW); + } else { +-- +2.20.1 + diff --git a/queue-4.4/hfsplus-fix-bug-on-bnode-parent-update.patch b/queue-4.4/hfsplus-fix-bug-on-bnode-parent-update.patch new file mode 100644 index 00000000000..b9f9f377dcb --- /dev/null +++ b/queue-4.4/hfsplus-fix-bug-on-bnode-parent-update.patch @@ -0,0 +1,59 @@ +From 236acf6f58daf39da74c69f66750ea7f31c7634b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:04 -0700 +Subject: hfsplus: fix BUG on bnode parent update +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit 19a9d0f1acf75e8be8cfba19c1a34e941846fa2b ] + +Creating, renaming or deleting a file may hit BUG_ON() if the first +record of both a leaf node and its parent are changed, and if this +forces the parent to be split. This bug is triggered by xfstests +generic/027, somewhat rarely; here is a more reliable reproducer: + + truncate -s 50M fs.iso + mkfs.hfsplus fs.iso + mount fs.iso /mnt + i=1000 + while [ $i -le 2400 ]; do + touch /mnt/$i &>/dev/null + ((++i)) + done + i=2400 + while [ $i -ge 1000 ]; do + mv /mnt/$i /mnt/$(perl -e "print $i x61") &>/dev/null + ((--i)) + done + +The issue is that a newly created bnode is being put twice. Reset +new_node to NULL in hfs_brec_update_parent() before reaching goto again. + +Link: http://lkml.kernel.org/r/5ee1db09b60373a15890f6a7c835d00e76bf601d.1535682461.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfsplus/brec.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c +index 1002a0c08319b..20ce698251ad1 100644 +--- a/fs/hfsplus/brec.c ++++ b/fs/hfsplus/brec.c +@@ -447,6 +447,7 @@ static int hfs_brec_update_parent(struct hfs_find_data *fd) + /* restore search_key */ + hfs_bnode_read_key(node, fd->search_key, 14); + } ++ new_node = NULL; + } + + if (!rec && node->parent) +-- +2.20.1 + diff --git a/queue-4.4/hfsplus-fix-return-value-of-hfsplus_get_block.patch b/queue-4.4/hfsplus-fix-return-value-of-hfsplus_get_block.patch new file mode 100644 index 00000000000..9e48a845793 --- /dev/null +++ b/queue-4.4/hfsplus-fix-return-value-of-hfsplus_get_block.patch @@ -0,0 +1,48 @@ +From 437a98f5ebf4fe6b621a479d9cb40615ce5185c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:21 -0700 +Subject: hfsplus: fix return value of hfsplus_get_block() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit 839c3a6a5e1fbc8542d581911b35b2cb5cd29304 ] + +Direct writes to empty inodes fail with EIO. The generic direct-io code +is in part to blame (a patch has been submitted as "direct-io: allow +direct writes to empty inodes"), but hfsplus is worse affected than the +other filesystems because the fallback to buffered I/O doesn't happen. + +The problem is the return value of hfsplus_get_block() when called with +!create. Change it to be more consistent with the other modules. + +Link: http://lkml.kernel.org/r/2cd1301404ec7cf1e39c8f11a01a4302f1460ad6.1539195310.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Reviewed-by: Vyacheslav Dubeyko +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfsplus/extents.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c +index ce0b8f8374081..d93c051559cb8 100644 +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -236,7 +236,9 @@ int hfsplus_get_block(struct inode *inode, sector_t iblock, + ablock = iblock >> sbi->fs_shift; + + if (iblock >= hip->fs_blocks) { +- if (iblock > hip->fs_blocks || !create) ++ if (!create) ++ return 0; ++ if (iblock > hip->fs_blocks) + return -EIO; + if (ablock >= hip->alloc_blocks) { + res = hfsplus_file_extend(inode, false); +-- +2.20.1 + diff --git a/queue-4.4/hfsplus-prevent-btree-data-loss-on-enospc.patch b/queue-4.4/hfsplus-prevent-btree-data-loss-on-enospc.patch new file mode 100644 index 00000000000..3461ab30688 --- /dev/null +++ b/queue-4.4/hfsplus-prevent-btree-data-loss-on-enospc.patch @@ -0,0 +1,220 @@ +From bfccdf4c05d39289f139a2a4d18b43d83345c933 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:06:14 -0700 +Subject: hfsplus: prevent btree data loss on ENOSPC +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ernesto A. Fernández + +[ Upstream commit d92915c35bfaf763d78bf1d5ac7f183420e3bd99 ] + +Inserting or deleting a record in a btree may require splitting several of +its nodes. If we hit ENOSPC halfway through, the new nodes will be left +orphaned and their records will be lost. This could mean lost inodes, +extents or xattrs. + +Henceforth, check the available disk space before making any changes. +This still leaves the potential problem of corruption on ENOMEM. + +The patch can be tested with xfstests generic/027. + +Link: http://lkml.kernel.org/r/4596eef22fbda137b4ffa0272d92f0da15364421.1536269129.git.ernesto.mnd.fernandez@gmail.com +Signed-off-by: Ernesto A. Fernández +Cc: Christoph Hellwig +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/hfsplus/attributes.c | 10 ++++++++++ + fs/hfsplus/btree.c | 44 ++++++++++++++++++++++++++--------------- + fs/hfsplus/catalog.c | 24 ++++++++++++++++++++++ + fs/hfsplus/extents.c | 4 ++++ + fs/hfsplus/hfsplus_fs.h | 2 ++ + 5 files changed, 68 insertions(+), 16 deletions(-) + +diff --git a/fs/hfsplus/attributes.c b/fs/hfsplus/attributes.c +index e5b221de7de63..d7455ea702878 100644 +--- a/fs/hfsplus/attributes.c ++++ b/fs/hfsplus/attributes.c +@@ -216,6 +216,11 @@ int hfsplus_create_attr(struct inode *inode, + if (err) + goto failed_init_create_attr; + ++ /* Fail early and avoid ENOSPC during the btree operation */ ++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth + 1); ++ if (err) ++ goto failed_create_attr; ++ + if (name) { + err = hfsplus_attr_build_key(sb, fd.search_key, + inode->i_ino, name); +@@ -312,6 +317,11 @@ int hfsplus_delete_attr(struct inode *inode, const char *name) + if (err) + return err; + ++ /* Fail early and avoid ENOSPC during the btree operation */ ++ err = hfs_bmap_reserve(fd.tree, fd.tree->depth); ++ if (err) ++ goto out; ++ + if (name) { + err = hfsplus_attr_build_key(sb, fd.search_key, + inode->i_ino, name); +diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c +index 7adc8a327e03a..1ae3e187bc9d0 100644 +--- a/fs/hfsplus/btree.c ++++ b/fs/hfsplus/btree.c +@@ -341,26 +341,21 @@ static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx) + return node; + } + +-struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) ++/* Make sure @tree has enough space for the @rsvd_nodes */ ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes) + { +- struct hfs_bnode *node, *next_node; +- struct page **pagep; +- u32 nidx, idx; +- unsigned off; +- u16 off16; +- u16 len; +- u8 *data, byte, m; +- int i; ++ struct inode *inode = tree->inode; ++ struct hfsplus_inode_info *hip = HFSPLUS_I(inode); ++ u32 count; ++ int res; + +- while (!tree->free_nodes) { +- struct inode *inode = tree->inode; +- struct hfsplus_inode_info *hip = HFSPLUS_I(inode); +- u32 count; +- int res; ++ if (rsvd_nodes <= 0) ++ return 0; + ++ while (tree->free_nodes < rsvd_nodes) { + res = hfsplus_file_extend(inode, hfs_bnode_need_zeroout(tree)); + if (res) +- return ERR_PTR(res); ++ return res; + hip->phys_size = inode->i_size = + (loff_t)hip->alloc_blocks << + HFSPLUS_SB(tree->sb)->alloc_blksz_shift; +@@ -368,9 +363,26 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) + hip->alloc_blocks << HFSPLUS_SB(tree->sb)->fs_shift; + inode_set_bytes(inode, inode->i_size); + count = inode->i_size >> tree->node_size_shift; +- tree->free_nodes = count - tree->node_count; ++ tree->free_nodes += count - tree->node_count; + tree->node_count = count; + } ++ return 0; ++} ++ ++struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) ++{ ++ struct hfs_bnode *node, *next_node; ++ struct page **pagep; ++ u32 nidx, idx; ++ unsigned off; ++ u16 off16; ++ u16 len; ++ u8 *data, byte, m; ++ int i, res; ++ ++ res = hfs_bmap_reserve(tree, 1); ++ if (res) ++ return ERR_PTR(res); + + nidx = 0; + node = hfs_bnode_find(tree, nidx); +diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c +index 022974ab6e3cc..e35df33583c4f 100644 +--- a/fs/hfsplus/catalog.c ++++ b/fs/hfsplus/catalog.c +@@ -264,6 +264,14 @@ int hfsplus_create_cat(u32 cnid, struct inode *dir, + if (err) + return err; + ++ /* ++ * Fail early and avoid ENOSPC during the btree operations. We may ++ * have to split the root node at most once. ++ */ ++ err = hfs_bmap_reserve(fd.tree, 2 * fd.tree->depth); ++ if (err) ++ goto err2; ++ + hfsplus_cat_build_key_with_cnid(sb, fd.search_key, cnid); + entry_size = hfsplus_fill_cat_thread(sb, &entry, + S_ISDIR(inode->i_mode) ? +@@ -332,6 +340,14 @@ int hfsplus_delete_cat(u32 cnid, struct inode *dir, struct qstr *str) + if (err) + return err; + ++ /* ++ * Fail early and avoid ENOSPC during the btree operations. We may ++ * have to split the root node at most once. ++ */ ++ err = hfs_bmap_reserve(fd.tree, 2 * (int)fd.tree->depth - 2); ++ if (err) ++ goto out; ++ + if (!str) { + int len; + +@@ -429,6 +445,14 @@ int hfsplus_rename_cat(u32 cnid, + return err; + dst_fd = src_fd; + ++ /* ++ * Fail early and avoid ENOSPC during the btree operations. We may ++ * have to split the root node at most twice. ++ */ ++ err = hfs_bmap_reserve(src_fd.tree, 4 * (int)src_fd.tree->depth - 1); ++ if (err) ++ goto out; ++ + /* find the old dir entry and read the data */ + err = hfsplus_cat_build_key(sb, src_fd.search_key, + src_dir->i_ino, src_name); +diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c +index feca524ce2a5c..ce0b8f8374081 100644 +--- a/fs/hfsplus/extents.c ++++ b/fs/hfsplus/extents.c +@@ -99,6 +99,10 @@ static int __hfsplus_ext_write_extent(struct inode *inode, + if (hip->extent_state & HFSPLUS_EXT_NEW) { + if (res != -ENOENT) + return res; ++ /* Fail early and avoid ENOSPC during the btree operation */ ++ res = hfs_bmap_reserve(fd->tree, fd->tree->depth + 1); ++ if (res) ++ return res; + hfs_brec_insert(fd, hip->cached_extents, + sizeof(hfsplus_extent_rec)); + hip->extent_state &= ~(HFSPLUS_EXT_DIRTY | HFSPLUS_EXT_NEW); +diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h +index f91a1faf819e9..0ab6541493405 100644 +--- a/fs/hfsplus/hfsplus_fs.h ++++ b/fs/hfsplus/hfsplus_fs.h +@@ -310,6 +310,7 @@ static inline unsigned short hfsplus_min_io_size(struct super_block *sb) + #define hfs_btree_open hfsplus_btree_open + #define hfs_btree_close hfsplus_btree_close + #define hfs_btree_write hfsplus_btree_write ++#define hfs_bmap_reserve hfsplus_bmap_reserve + #define hfs_bmap_alloc hfsplus_bmap_alloc + #define hfs_bmap_free hfsplus_bmap_free + #define hfs_bnode_read hfsplus_bnode_read +@@ -394,6 +395,7 @@ u32 hfsplus_calc_btree_clump_size(u32 block_size, u32 node_size, u64 sectors, + struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id); + void hfs_btree_close(struct hfs_btree *tree); + int hfs_btree_write(struct hfs_btree *tree); ++int hfs_bmap_reserve(struct hfs_btree *tree, int rsvd_nodes); + struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree); + void hfs_bmap_free(struct hfs_bnode *node); + +-- +2.20.1 + diff --git a/queue-4.4/ib-hfi1-ensure-full-gen3-speed-in-a-gen4-system.patch b/queue-4.4/ib-hfi1-ensure-full-gen3-speed-in-a-gen4-system.patch new file mode 100644 index 00000000000..7db6d377232 --- /dev/null +++ b/queue-4.4/ib-hfi1-ensure-full-gen3-speed-in-a-gen4-system.patch @@ -0,0 +1,48 @@ +From 9e041b49080a158efd863757680f46b3e1339d49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Nov 2019 15:20:59 -0400 +Subject: IB/hfi1: Ensure full Gen3 speed in a Gen4 system + +From: James Erwin + +If an hfi1 card is inserted in a Gen4 systems, the driver will avoid the +gen3 speed bump and the card will operate at half speed. + +This is because the driver avoids the gen3 speed bump when the parent bus +speed isn't identical to gen3, 8.0GT/s. This is not compatible with gen4 +and newer speeds. + +Fix by relaxing the test to explicitly look for the lower capability +speeds which inherently allows for gen4 and all future speeds. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20191101192059.106248.1699.stgit@awfm-01.aw.intel.com +Cc: +Reviewed-by: Dennis Dalessandro +Reviewed-by: Kaike Wan +Signed-off-by: James Erwin +Signed-off-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/staging/rdma/hfi1/pcie.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/rdma/hfi1/pcie.c b/drivers/staging/rdma/hfi1/pcie.c +index a956044459a2b..ea4df848d8405 100644 +--- a/drivers/staging/rdma/hfi1/pcie.c ++++ b/drivers/staging/rdma/hfi1/pcie.c +@@ -389,7 +389,8 @@ int pcie_speeds(struct hfi1_devdata *dd) + /* + * bus->max_bus_speed is set from the bridge's linkcap Max Link Speed + */ +- if (dd->pcidev->bus->max_bus_speed != PCIE_SPEED_8_0GT) { ++ if (dd->pcidev->bus->max_bus_speed == PCIE_SPEED_2_5GT || ++ dd->pcidev->bus->max_bus_speed == PCIE_SPEED_5_0GT) { + dd_dev_info(dd, "Parent PCIe bridge does not support Gen3\n"); + dd->link_gen3_capable = 0; + } +-- +2.20.1 + diff --git a/queue-4.4/igb-shorten-maximum-phc-timecounter-update-interval.patch b/queue-4.4/igb-shorten-maximum-phc-timecounter-update-interval.patch new file mode 100644 index 00000000000..2d3ce8c621e --- /dev/null +++ b/queue-4.4/igb-shorten-maximum-phc-timecounter-update-interval.patch @@ -0,0 +1,56 @@ +From 4005762b47ef51cc2cc4315ac0a2098acfa2a183 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 13:13:39 +0200 +Subject: igb: shorten maximum PHC timecounter update interval + +From: Miroslav Lichvar + +[ Upstream commit 094bf4d0e9657f6ea1ee3d7e07ce3970796949ce ] + +The timecounter needs to be updated at least once per ~550 seconds in +order to avoid a 40-bit SYSTIM timestamp to be misinterpreted as an old +timestamp. + +Since commit 500462a9d ("timers: Switch to a non-cascading wheel"), +scheduling of delayed work seems to be less accurate and a requested +delay of 540 seconds may actually be longer than 550 seconds. Shorten +the delay to 480 seconds to be sure the timecounter is updated in time. + +This fixes an issue with HW timestamps on 82580/I350/I354 being off by +~1100 seconds for few seconds every ~9 minutes. + +Cc: Jacob Keller +Cc: Richard Cochran +Cc: Thomas Gleixner +Signed-off-by: Miroslav Lichvar +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_ptp.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index c44df87c38de2..5e65d8a78c3ed 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -65,9 +65,15 @@ + * + * The 40 bit 82580 SYSTIM overflows every + * 2^40 * 10^-9 / 60 = 18.3 minutes. ++ * ++ * SYSTIM is converted to real time using a timecounter. As ++ * timecounter_cyc2time() allows old timestamps, the timecounter ++ * needs to be updated at least once per half of the SYSTIM interval. ++ * Scheduling of delayed work is not very accurate, so we aim for 8 ++ * minutes to be sure the actual interval is shorter than 9.16 minutes. + */ + +-#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 9) ++#define IGB_SYSTIM_OVERFLOW_PERIOD (HZ * 60 * 8) + #define IGB_PTP_TX_TIMEOUT (HZ * 15) + #define INCPERIOD_82576 (1 << E1000_TIMINCA_16NS_SHIFT) + #define INCVALUE_82576_MASK ((1 << E1000_TIMINCA_16NS_SHIFT) - 1) +-- +2.20.1 + diff --git a/queue-4.4/kprobes-x86-ptrace.h-make-regs_get_kernel_stack_nth-.patch b/queue-4.4/kprobes-x86-ptrace.h-make-regs_get_kernel_stack_nth-.patch new file mode 100644 index 00000000000..8f03e43f79f --- /dev/null +++ b/queue-4.4/kprobes-x86-ptrace.h-make-regs_get_kernel_stack_nth-.patch @@ -0,0 +1,103 @@ +From 312f4ab52c5ed4bdd03a84a146648da320e00607 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Oct 2018 16:59:51 -0400 +Subject: kprobes, x86/ptrace.h: Make regs_get_kernel_stack_nth() not fault on + bad stack + +From: Steven Rostedt (VMware) + +[ Upstream commit c2712b858187f5bcd7b042fe4daa3ba3a12635c0 ] + +Andy had some concerns about using regs_get_kernel_stack_nth() in a new +function regs_get_kernel_argument() as if there's any error in the stack +code, it could cause a bad memory access. To be on the safe side, call +probe_kernel_read() on the stack address to be extra careful in accessing +the memory. A helper function, regs_get_kernel_stack_nth_addr(), was added +to just return the stack address (or NULL if not on the stack), that will be +used to find the address (and could be used by other functions) and read the +address with kernel_probe_read(). + +Requested-by: Andy Lutomirski +Signed-off-by: Steven Rostedt (VMware) +Reviewed-by: Joel Fernandes (Google) +Cc: Andy Lutomirski +Cc: Borislav Petkov +Cc: Josh Poimboeuf +Cc: Linus Torvalds +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/20181017165951.09119177@gandalf.local.home +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/ptrace.h | 42 +++++++++++++++++++++++++++++------ + 1 file changed, 35 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h +index 0d8e0831b1a07..3daec418c822f 100644 +--- a/arch/x86/include/asm/ptrace.h ++++ b/arch/x86/include/asm/ptrace.h +@@ -205,24 +205,52 @@ static inline int regs_within_kernel_stack(struct pt_regs *regs, + (kernel_stack_pointer(regs) & ~(THREAD_SIZE - 1))); + } + ++/** ++ * regs_get_kernel_stack_nth_addr() - get the address of the Nth entry on stack ++ * @regs: pt_regs which contains kernel stack pointer. ++ * @n: stack entry number. ++ * ++ * regs_get_kernel_stack_nth() returns the address of the @n th entry of the ++ * kernel stack which is specified by @regs. If the @n th entry is NOT in ++ * the kernel stack, this returns NULL. ++ */ ++static inline unsigned long *regs_get_kernel_stack_nth_addr(struct pt_regs *regs, unsigned int n) ++{ ++ unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs); ++ ++ addr += n; ++ if (regs_within_kernel_stack(regs, (unsigned long)addr)) ++ return addr; ++ else ++ return NULL; ++} ++ ++/* To avoid include hell, we can't include uaccess.h */ ++extern long probe_kernel_read(void *dst, const void *src, size_t size); ++ + /** + * regs_get_kernel_stack_nth() - get Nth entry of the stack + * @regs: pt_regs which contains kernel stack pointer. + * @n: stack entry number. + * + * regs_get_kernel_stack_nth() returns @n th entry of the kernel stack which +- * is specified by @regs. If the @n th entry is NOT in the kernel stack, ++ * is specified by @regs. If the @n th entry is NOT in the kernel stack + * this returns 0. + */ + static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, + unsigned int n) + { +- unsigned long *addr = (unsigned long *)kernel_stack_pointer(regs); +- addr += n; +- if (regs_within_kernel_stack(regs, (unsigned long)addr)) +- return *addr; +- else +- return 0; ++ unsigned long *addr; ++ unsigned long val; ++ long ret; ++ ++ addr = regs_get_kernel_stack_nth_addr(regs, n); ++ if (addr) { ++ ret = probe_kernel_read(&val, addr, sizeof(val)); ++ if (!ret) ++ return val; ++ } ++ return 0; + } + + #define arch_has_single_step() (1) +-- +2.20.1 + diff --git a/queue-4.4/kvm-x86-fix-invvpid-and-invept-register-operand-size.patch b/queue-4.4/kvm-x86-fix-invvpid-and-invept-register-operand-size.patch new file mode 100644 index 00000000000..55b55090350 --- /dev/null +++ b/queue-4.4/kvm-x86-fix-invvpid-and-invept-register-operand-size.patch @@ -0,0 +1,45 @@ +From 66b2684176fbe2211bfb477d9173c24b6406be1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Oct 2018 19:40:43 +0200 +Subject: KVM/x86: Fix invvpid and invept register operand size in 64-bit mode + +From: Uros Bizjak + +[ Upstream commit 5ebb272b2ea7e02911a03a893f8d922d49f9bb4a ] + +Register operand size of invvpid and invept instruction in 64-bit mode +has always 64 bits. Adjust inline function argument type to reflect +correct size. + +Signed-off-by: Uros Bizjak +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 1b3a432f6fd53..9344ac6b4f99d 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1298,7 +1298,7 @@ static int __find_msr_index(struct vcpu_vmx *vmx, u32 msr) + return -1; + } + +-static inline void __invvpid(int ext, u16 vpid, gva_t gva) ++static inline void __invvpid(unsigned long ext, u16 vpid, gva_t gva) + { + struct { + u64 vpid : 16; +@@ -1312,7 +1312,7 @@ static inline void __invvpid(int ext, u16 vpid, gva_t gva) + : : "a"(&operand), "c"(ext) : "cc", "memory"); + } + +-static inline void __invept(int ext, u64 eptp, gpa_t gpa) ++static inline void __invept(unsigned long ext, u64 eptp, gpa_t gpa) + { + struct { + u64 eptp, gpa; +-- +2.20.1 + diff --git a/queue-4.4/linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch b/queue-4.4/linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch new file mode 100644 index 00000000000..33e3305de4a --- /dev/null +++ b/queue-4.4/linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch @@ -0,0 +1,42 @@ +From dc9308a87265572bb84c9a9efcd597f3f39f9972 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:05:07 -0700 +Subject: linux/bitmap.h: fix type of nbits in bitmap_shift_right() + +From: Rasmus Villemoes + +[ Upstream commit d9873969fa8725dc6a5a21ab788c057fd8719751 ] + +Most other bitmap API, including the OOL version __bitmap_shift_right, +take unsigned nbits. This was accidentally left out from 2fbad29917c98. + +Link: http://lkml.kernel.org/r/20180818131623.8755-5-linux@rasmusvillemoes.dk +Fixes: 2fbad29917c98 ("lib: bitmap: change bitmap_shift_right to take unsigned parameters") +Signed-off-by: Rasmus Villemoes +Reported-by: Yury Norov +Reviewed-by: Andy Shevchenko +Cc: Rasmus Villemoes +Cc: Sudeep Holla +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/bitmap.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index e9d5df4315d94..714ce4a5e31fd 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -308,7 +308,7 @@ static __always_inline int bitmap_weight(const unsigned long *src, unsigned int + } + + static inline void bitmap_shift_right(unsigned long *dst, const unsigned long *src, +- unsigned int shift, int nbits) ++ unsigned int shift, unsigned int nbits) + { + if (small_const_nbits(nbits)) + *dst = (*src & BITMAP_LAST_WORD_MASK(nbits)) >> shift; +-- +2.20.1 + diff --git a/queue-4.4/linux-bitmap.h-handle-constant-zero-size-bitmaps-cor.patch b/queue-4.4/linux-bitmap.h-handle-constant-zero-size-bitmaps-cor.patch new file mode 100644 index 00000000000..1a43b3683e8 --- /dev/null +++ b/queue-4.4/linux-bitmap.h-handle-constant-zero-size-bitmaps-cor.patch @@ -0,0 +1,60 @@ +From cc53cce34a20ac4cb24f7f22e4cb06bdef7793cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Oct 2018 15:04:59 -0700 +Subject: linux/bitmap.h: handle constant zero-size bitmaps correctly + +From: Rasmus Villemoes + +[ Upstream commit 7275b097851a5e2e0dd4da039c7e96b59ac5314e ] + +The static inlines in bitmap.h do not handle a compile-time constant +nbits==0 correctly (they dereference the passed src or dst pointers, +despite only 0 words being valid to access). I had the 0-day buildbot +chew on a patch [1] that would cause build failures for such cases without +complaining, suggesting that we don't have any such users currently, at +least for the 70 .config/arch combinations that was built. Should any +turn up, make sure they use the out-of-line versions, which do handle +nbits==0 correctly. + +This is of course not the most efficient, but it's much less churn than +teaching all the static inlines an "if (zero_const_nbits())", and since we +don't have any current instances, this doesn't affect existing code at +all. + +[1] lkml.kernel.org/r/20180815085539.27485-1-linux@rasmusvillemoes.dk + +Link: http://lkml.kernel.org/r/20180818131623.8755-3-linux@rasmusvillemoes.dk +Signed-off-by: Rasmus Villemoes +Reviewed-by: Andy Shevchenko +Cc: Yury Norov +Cc: Rasmus Villemoes +Cc: Sudeep Holla +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/bitmap.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index 9653fdb76a427..e9d5df4315d94 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -175,8 +175,13 @@ extern int bitmap_print_to_pagebuf(bool list, char *buf, + #define BITMAP_FIRST_WORD_MASK(start) (~0UL << ((start) & (BITS_PER_LONG - 1))) + #define BITMAP_LAST_WORD_MASK(nbits) (~0UL >> (-(nbits) & (BITS_PER_LONG - 1))) + ++/* ++ * The static inlines below do not handle constant nbits==0 correctly, ++ * so make such users (should any ever turn up) call the out-of-line ++ * versions. ++ */ + #define small_const_nbits(nbits) \ +- (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG) ++ (__builtin_constant_p(nbits) && (nbits) <= BITS_PER_LONG && (nbits) > 0) + + static inline void bitmap_zero(unsigned long *dst, unsigned int nbits) + { +-- +2.20.1 + diff --git a/queue-4.4/macintosh-windfarm_smu_sat-fix-debug-output.patch b/queue-4.4/macintosh-windfarm_smu_sat-fix-debug-output.patch new file mode 100644 index 00000000000..20340ad7adb --- /dev/null +++ b/queue-4.4/macintosh-windfarm_smu_sat-fix-debug-output.patch @@ -0,0 +1,79 @@ +From beb8a8dd3aea7fbc61ff9dca988958228b18b1b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Oct 2018 11:18:49 +1100 +Subject: macintosh/windfarm_smu_sat: Fix debug output + +From: Benjamin Herrenschmidt + +[ Upstream commit fc0c8b36d379a046525eacb9c3323ca635283757 ] + +There's some antiquated debug output that's trying +to do a hand-made hexdump and turning into horrible +1-byte-per-line output these days. + +Use print_hex_dump() instead + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + drivers/macintosh/windfarm_smu_sat.c | 25 +++++++------------------ + 1 file changed, 7 insertions(+), 18 deletions(-) + +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index ad6223e883404..3d310dd60a0be 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -22,14 +22,6 @@ + + #define VERSION "1.0" + +-#define DEBUG +- +-#ifdef DEBUG +-#define DBG(args...) printk(args) +-#else +-#define DBG(args...) do { } while(0) +-#endif +- + /* If the cache is older than 800ms we'll refetch it */ + #define MAX_AGE msecs_to_jiffies(800) + +@@ -106,13 +98,10 @@ struct smu_sdbp_header *smu_sat_get_sdb_partition(unsigned int sat_id, int id, + buf[i+2] = data[3]; + buf[i+3] = data[2]; + } +-#ifdef DEBUG +- DBG(KERN_DEBUG "sat %d partition %x:", sat_id, id); +- for (i = 0; i < len; ++i) +- DBG(" %x", buf[i]); +- DBG("\n"); +-#endif + ++ printk(KERN_DEBUG "sat %d partition %x:", sat_id, id); ++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET, ++ 16, 1, buf, len, false); + if (size) + *size = len; + return (struct smu_sdbp_header *) buf; +@@ -132,13 +121,13 @@ static int wf_sat_read_cache(struct wf_sat *sat) + if (err < 0) + return err; + sat->last_read = jiffies; ++ + #ifdef LOTSA_DEBUG + { + int i; +- DBG(KERN_DEBUG "wf_sat_get: data is"); +- for (i = 0; i < 16; ++i) +- DBG(" %.2x", sat->cache[i]); +- DBG("\n"); ++ printk(KERN_DEBUG "wf_sat_get: data is"); ++ print_hex_dump(KERN_DEBUG, " ", DUMP_PREFIX_OFFSET, ++ 16, 1, sat->cache, 16, false); + } + #endif + return 0; +-- +2.20.1 + diff --git a/queue-4.4/mfd-max8997-enale-irq-wakeup-unconditionally.patch b/queue-4.4/mfd-max8997-enale-irq-wakeup-unconditionally.patch new file mode 100644 index 00000000000..f8997700f2f --- /dev/null +++ b/queue-4.4/mfd-max8997-enale-irq-wakeup-unconditionally.patch @@ -0,0 +1,66 @@ +From c9c69ea813a4695721d27a7f61acba0a5a1192e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Sep 2018 13:54:07 +0200 +Subject: mfd: max8997: Enale irq-wakeup unconditionally + +From: Marek Szyprowski + +[ Upstream commit efddff27c886e729a7f84a7205bd84d7d4af7336 ] + +IRQ wake up support for MAX8997 driver was initially configured by +respective property in pdata. However, after the driver conversion to +device-tree, setting it was left as 'todo'. Nowadays most of other PMIC MFD +drivers initialized from device-tree assume that they can be an irq wakeup +source, so enable it also for MAX8997. This fixes support for wakeup from +MAX8997 RTC alarm. + +Signed-off-by: Marek Szyprowski +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/max8997.c | 8 +------- + include/linux/mfd/max8997.h | 1 - + 2 files changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c +index 156ed6f92aa32..2d9ae7cf948f8 100644 +--- a/drivers/mfd/max8997.c ++++ b/drivers/mfd/max8997.c +@@ -156,12 +156,6 @@ static struct max8997_platform_data *max8997_i2c_parse_dt_pdata( + + pd->ono = irq_of_parse_and_map(dev->of_node, 1); + +- /* +- * ToDo: the 'wakeup' member in the platform data is more of a linux +- * specfic information. Hence, there is no binding for that yet and +- * not parsed here. +- */ +- + return pd; + } + +@@ -249,7 +243,7 @@ static int max8997_i2c_probe(struct i2c_client *i2c, + */ + + /* MAX8997 has a power button input. */ +- device_init_wakeup(max8997->dev, pdata->wakeup); ++ device_init_wakeup(max8997->dev, true); + + return ret; + +diff --git a/include/linux/mfd/max8997.h b/include/linux/mfd/max8997.h +index cf815577bd686..3ae1fe743bc34 100644 +--- a/include/linux/mfd/max8997.h ++++ b/include/linux/mfd/max8997.h +@@ -178,7 +178,6 @@ struct max8997_led_platform_data { + struct max8997_platform_data { + /* IRQ */ + int ono; +- int wakeup; + + /* ---- PMIC ---- */ + struct max8997_regulator_data *regulators; +-- +2.20.1 + diff --git a/queue-4.4/mfd-mc13xxx-core-fix-pmic-shutdown-when-reading-adc-.patch b/queue-4.4/mfd-mc13xxx-core-fix-pmic-shutdown-when-reading-adc-.patch new file mode 100644 index 00000000000..94face23209 --- /dev/null +++ b/queue-4.4/mfd-mc13xxx-core-fix-pmic-shutdown-when-reading-adc-.patch @@ -0,0 +1,60 @@ +From 4d31596c455b159e9d3e0822067eba8f8417a675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 17:02:40 -0300 +Subject: mfd: mc13xxx-core: Fix PMIC shutdown when reading ADC values + +From: Fabio Estevam + +[ Upstream commit 55143439b7b501882bea9d95a54adfe00ffc79a3 ] + +When trying to read any MC13892 ADC channel on a imx51-babbage board: + +The MC13892 PMIC shutdowns completely. + +After debugging this issue and comparing the MC13892 and MC13783 +initializations done in the vendor kernel, it was noticed that the +CHRGRAWDIV bit of the ADC0 register was not being set. + +This bit is set by default after power on, but the driver was +clearing it. + +After setting this bit it is possible to read the ADC values correctly. + +Signed-off-by: Fabio Estevam +Tested-by: Chris Healy +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/mc13xxx-core.c | 3 ++- + include/linux/mfd/mc13xxx.h | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index 8d74806b83c12..1494e7cbd593b 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -278,7 +278,8 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + if (ret) + goto out; + +- adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2; ++ adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2 | ++ MC13XXX_ADC0_CHRGRAWDIV; + adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC; + + if (channel > 7) +diff --git a/include/linux/mfd/mc13xxx.h b/include/linux/mfd/mc13xxx.h +index 638222e43e489..93011c61aafd2 100644 +--- a/include/linux/mfd/mc13xxx.h ++++ b/include/linux/mfd/mc13xxx.h +@@ -247,6 +247,7 @@ struct mc13xxx_platform_data { + #define MC13XXX_ADC0_TSMOD0 (1 << 12) + #define MC13XXX_ADC0_TSMOD1 (1 << 13) + #define MC13XXX_ADC0_TSMOD2 (1 << 14) ++#define MC13XXX_ADC0_CHRGRAWDIV (1 << 15) + #define MC13XXX_ADC0_ADINC1 (1 << 16) + #define MC13XXX_ADC0_ADINC2 (1 << 17) + +-- +2.20.1 + diff --git a/queue-4.4/misc-mic-fix-a-dma-pool-free-failure.patch b/queue-4.4/misc-mic-fix-a-dma-pool-free-failure.patch new file mode 100644 index 00000000000..9a7ba71743b --- /dev/null +++ b/queue-4.4/misc-mic-fix-a-dma-pool-free-failure.patch @@ -0,0 +1,54 @@ +From 6018887e00839f3cb760d27030d607ec7b390d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Oct 2018 18:38:28 -0500 +Subject: misc: mic: fix a DMA pool free failure + +From: Wenwen Wang + +[ Upstream commit 6b995f4eec34745f6cb20d66d5277611f0b3c3fa ] + +In _scif_prog_signal(), the boolean variable 'x100' is used to indicate +whether the MIC Coprocessor is X100. If 'x100' is true, the status +descriptor will be used to write the value to the destination. Otherwise, a +DMA pool will be allocated for this purpose. Specifically, if the DMA pool +is allocated successfully, two memory addresses will be returned. One is +for the CPU and the other is for the device to access the DMA pool. The +former is stored to the variable 'status' and the latter is stored to the +variable 'src'. After the allocation, the address in 'src' is saved to +'status->src_dma_addr', which is actually in the DMA pool, and 'src' is +then modified. + +Later on, if an error occurs, the execution flow will transfer to the label +'dma_fail', which will check 'x100' and free up the allocated DMA pool if +'x100' is false. The point here is that 'status->src_dma_addr' is used for +freeing up the DMA pool. As mentioned before, 'status->src_dma_addr' is in +the DMA pool. And thus, the device is able to modify this data. This can +potentially cause failures when freeing up the DMA pool because of the +modified device address. + +This patch avoids the above issue by using the variable 'src' (with +necessary calculation) to free up the DMA pool. + +Signed-off-by: Wenwen Wang +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mic/scif/scif_fence.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c +index 7f2c96f570667..6821d9d415854 100644 +--- a/drivers/misc/mic/scif/scif_fence.c ++++ b/drivers/misc/mic/scif/scif_fence.c +@@ -271,7 +271,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val) + dma_fail: + if (!x100) + dma_pool_free(ep->remote_dev->signal_pool, status, +- status->src_dma_addr); ++ src - offsetof(struct scif_status, val)); + alloc_fail: + return err; + } +-- +2.20.1 + diff --git a/queue-4.4/misdn-fix-type-of-switch-control-variable-in-ctrl_te.patch b/queue-4.4/misdn-fix-type-of-switch-control-variable-in-ctrl_te.patch new file mode 100644 index 00000000000..d9e4a59bd99 --- /dev/null +++ b/queue-4.4/misdn-fix-type-of-switch-control-variable-in-ctrl_te.patch @@ -0,0 +1,70 @@ +From 500f8f381da7e05e22ce1243a87919a1b6991907 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 11:00:30 -0700 +Subject: mISDN: Fix type of switch control variable in ctrl_teimanager + +From: Nathan Chancellor + +[ Upstream commit aeb5e02aca91522733eb1db595ac607d30c87767 ] + +Clang warns (trimmed for brevity): + +drivers/isdn/mISDN/tei.c:1193:7: warning: overflow converting case value +to switch condition type (2147764552 to 18446744071562348872) [-Wswitch] + case IMHOLD_L1: + ^ +drivers/isdn/mISDN/tei.c:1187:7: warning: overflow converting case value +to switch condition type (2147764550 to 18446744071562348870) [-Wswitch] + case IMCLEAR_L2: + ^ +2 warnings generated. + +The root cause is that the _IOC macro can generate really large numbers, +which don't find into type int. My research into how GCC and Clang are +handling this at a low level didn't prove fruitful and surveying the +kernel tree shows that aside from here and a few places in the scsi +subsystem, everything that uses _IOC is at least of type 'unsigned int'. +Make that change here because as nothing in this function cares about +the signedness of the variable and it removes ambiguity, which is never +good when dealing with compilers. + +While we're here, remove the unnecessary local variable ret (just return +-EINVAL and 0 directly). + +Link: https://github.com/ClangBuiltLinux/linux/issues/67 +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/mISDN/tei.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/isdn/mISDN/tei.c b/drivers/isdn/mISDN/tei.c +index 592f597d89518..8261afbbafb05 100644 +--- a/drivers/isdn/mISDN/tei.c ++++ b/drivers/isdn/mISDN/tei.c +@@ -1180,8 +1180,7 @@ static int + ctrl_teimanager(struct manager *mgr, void *arg) + { + /* currently we only have one option */ +- int *val = (int *)arg; +- int ret = 0; ++ unsigned int *val = (unsigned int *)arg; + + switch (val[0]) { + case IMCLEAR_L2: +@@ -1197,9 +1196,9 @@ ctrl_teimanager(struct manager *mgr, void *arg) + test_and_clear_bit(OPTION_L1_HOLD, &mgr->options); + break; + default: +- ret = -EINVAL; ++ return -EINVAL; + } +- return ret; ++ return 0; + } + + /* This function does create a L2 for fixed TEI in NT Mode */ +-- +2.20.1 + diff --git a/queue-4.4/mm-page-writeback.c-fix-range_cyclic-writeback-vs-wr.patch b/queue-4.4/mm-page-writeback.c-fix-range_cyclic-writeback-vs-wr.patch new file mode 100644 index 00000000000..debcfaa53e0 --- /dev/null +++ b/queue-4.4/mm-page-writeback.c-fix-range_cyclic-writeback-vs-wr.patch @@ -0,0 +1,248 @@ +From 00e9cf0aae4c5262a7d93309e3ea88b80ba54663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 15:09:45 -0700 +Subject: mm/page-writeback.c: fix range_cyclic writeback vs writepages + deadlock + +From: Dave Chinner + +[ Upstream commit 64081362e8ff4587b4554087f3cfc73d3e0a4cd7 ] + +We've recently seen a workload on XFS filesystems with a repeatable +deadlock between background writeback and a multi-process application +doing concurrent writes and fsyncs to a small range of a file. + +range_cyclic +writeback Process 1 Process 2 + +xfs_vm_writepages + write_cache_pages + writeback_index = 2 + cycled = 0 + .... + find page 2 dirty + lock Page 2 + ->writepage + page 2 writeback + page 2 clean + page 2 added to bio + no more pages + write() + locks page 1 + dirties page 1 + locks page 2 + dirties page 1 + fsync() + .... + xfs_vm_writepages + write_cache_pages + start index 0 + find page 1 towrite + lock Page 1 + ->writepage + page 1 writeback + page 1 clean + page 1 added to bio + find page 2 towrite + lock Page 2 + page 2 is writeback + + write() + locks page 1 + dirties page 1 + fsync() + .... + xfs_vm_writepages + write_cache_pages + start index 0 + + !done && !cycled + sets index to 0, restarts lookup + find page 1 dirty + find page 1 towrite + lock Page 1 + page 1 is writeback + + + lock Page 1 + + +DEADLOCK because: + + - process 1 needs page 2 writeback to complete to make + enough progress to issue IO pending for page 1 + - writeback needs page 1 writeback to complete so process 2 + can progress and unlock the page it is blocked on, then it + can issue the IO pending for page 2 + - process 2 can't make progress until process 1 issues IO + for page 1 + +The underlying cause of the problem here is that range_cyclic writeback is +processing pages in descending index order as we hold higher index pages +in a structure controlled from above write_cache_pages(). The +write_cache_pages() caller needs to be able to submit these pages for IO +before write_cache_pages restarts writeback at mapping index 0 to avoid +wcp inverting the page lock/writeback wait order. + +generic_writepages() is not susceptible to this bug as it has no private +context held across write_cache_pages() - filesystems using this +infrastructure always submit pages in ->writepage immediately and so there +is no problem with range_cyclic going back to mapping index 0. + +However: + mpage_writepages() has a private bio context, + exofs_writepages() has page_collect + fuse_writepages() has fuse_fill_wb_data + nfs_writepages() has nfs_pageio_descriptor + xfs_vm_writepages() has xfs_writepage_ctx + +All of these ->writepages implementations can hold pages under writeback +in their private structures until write_cache_pages() returns, and hence +they are all susceptible to this deadlock. + +Also worth noting is that ext4 has it's own bastardised version of +write_cache_pages() and so it /may/ have an equivalent deadlock. I looked +at the code long enough to understand that it has a similar retry loop for +range_cyclic writeback reaching the end of the file and then promptly ran +away before my eyes bled too much. I'll leave it for the ext4 developers +to determine if their code is actually has this deadlock and how to fix it +if it has. + +There's a few ways I can see avoid this deadlock. There's probably more, +but these are the first I've though of: + +1. get rid of range_cyclic altogether + +2. range_cyclic always stops at EOF, and we start again from +writeback index 0 on the next call into write_cache_pages() + +2a. wcp also returns EAGAIN to ->writepages implementations to +indicate range cyclic has hit EOF. writepages implementations can +then flush the current context and call wpc again to continue. i.e. +lift the retry into the ->writepages implementation + +3. range_cyclic uses trylock_page() rather than lock_page(), and it +skips pages it can't lock without blocking. It will already do this +for pages under writeback, so this seems like a no-brainer + +3a. all non-WB_SYNC_ALL writeback uses trylock_page() to avoid +blocking as per pages under writeback. + +I don't think #1 is an option - range_cyclic prevents frequently +dirtied lower file offset from starving background writeback of +rarely touched higher file offsets. + +#2 is simple, and I don't think it will have any impact on +performance as going back to the start of the file implies an +immediate seek. We'll have exactly the same number of seeks if we +switch writeback to another inode, and then come back to this one +later and restart from index 0. + +#2a is pretty much "status quo without the deadlock". Moving the +retry loop up into the wcp caller means we can issue IO on the +pending pages before calling wcp again, and so avoid locking or +waiting on pages in the wrong order. I'm not convinced we need to do +this given that we get the same thing from #2 on the next writeback +call from the writeback infrastructure. + +#3 is really just a band-aid - it doesn't fix the access/wait +inversion problem, just prevents it from becoming a deadlock +situation. I'd prefer we fix the inversion, not sweep it under the +carpet like this. + +#3a is really an optimisation that just so happens to include the +band-aid fix of #3. + +So it seems that the simplest way to fix this issue is to implement +solution #2 + +Link: http://lkml.kernel.org/r/20181005054526.21507-1-david@fromorbit.com +Signed-off-by: Dave Chinner +Reviewed-by: Jan Kara +Cc: Nicholas Piggin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page-writeback.c | 33 +++++++++++++++------------------ + 1 file changed, 15 insertions(+), 18 deletions(-) + +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 0bc7fa21db854..d2211e42b7792 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -2144,6 +2144,13 @@ EXPORT_SYMBOL(tag_pages_for_writeback); + * not miss some pages (e.g., because some other process has cleared TOWRITE + * tag we set). The rule we follow is that TOWRITE tag can be cleared only + * by the process clearing the DIRTY tag (and submitting the page for IO). ++ * ++ * To avoid deadlocks between range_cyclic writeback and callers that hold ++ * pages in PageWriteback to aggregate IO until write_cache_pages() returns, ++ * we do not loop back to the start of the file. Doing so causes a page ++ * lock/page writeback access order inversion - we should only ever lock ++ * multiple pages in ascending page->index order, and looping back to the start ++ * of the file violates that rule and causes deadlocks. + */ + int write_cache_pages(struct address_space *mapping, + struct writeback_control *wbc, writepage_t writepage, +@@ -2158,7 +2165,6 @@ int write_cache_pages(struct address_space *mapping, + pgoff_t index; + pgoff_t end; /* Inclusive */ + pgoff_t done_index; +- int cycled; + int range_whole = 0; + int tag; + +@@ -2166,23 +2172,17 @@ int write_cache_pages(struct address_space *mapping, + if (wbc->range_cyclic) { + writeback_index = mapping->writeback_index; /* prev offset */ + index = writeback_index; +- if (index == 0) +- cycled = 1; +- else +- cycled = 0; + end = -1; + } else { + index = wbc->range_start >> PAGE_CACHE_SHIFT; + end = wbc->range_end >> PAGE_CACHE_SHIFT; + if (wbc->range_start == 0 && wbc->range_end == LLONG_MAX) + range_whole = 1; +- cycled = 1; /* ignore range_cyclic tests */ + } + if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages) + tag = PAGECACHE_TAG_TOWRITE; + else + tag = PAGECACHE_TAG_DIRTY; +-retry: + if (wbc->sync_mode == WB_SYNC_ALL || wbc->tagged_writepages) + tag_pages_for_writeback(mapping, index, end); + done_index = index; +@@ -2290,17 +2290,14 @@ int write_cache_pages(struct address_space *mapping, + pagevec_release(&pvec); + cond_resched(); + } +- if (!cycled && !done) { +- /* +- * range_cyclic: +- * We hit the last page and there is more work to be done: wrap +- * back to the start of the file +- */ +- cycled = 1; +- index = 0; +- end = writeback_index - 1; +- goto retry; +- } ++ ++ /* ++ * If we hit the last page and there is more work to be done: wrap ++ * back the index back to the start of the file for the next ++ * time we are called. ++ */ ++ if (wbc->range_cyclic && !done) ++ done_index = 0; + if (wbc->range_cyclic || (range_whole && wbc->nr_to_write > 0)) + mapping->writeback_index = done_index; + +-- +2.20.1 + diff --git a/queue-4.4/mmc-mediatek-fix-cannot-receive-new-request-when-msd.patch b/queue-4.4/mmc-mediatek-fix-cannot-receive-new-request-when-msd.patch new file mode 100644 index 00000000000..54186d071c9 --- /dev/null +++ b/queue-4.4/mmc-mediatek-fix-cannot-receive-new-request-when-msd.patch @@ -0,0 +1,46 @@ +From 5200de48f6f5e300a2a3bbb347699e55c8c55638 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Oct 2018 15:20:47 +0800 +Subject: mmc: mediatek: fix cannot receive new request when msdc_cmd_is_ready + fail + +From: Chaotian Jing + +[ Upstream commit f38a9774ddde9d79b3487dd888edd8b8623552af ] + +when msdc_cmd_is_ready return fail, the req_timeout work has not been +inited and cancel_delayed_work() will return false, then, the request +return directly and never call mmc_request_done(). + +so need call mod_delayed_work() before msdc_cmd_is_ready() + +Signed-off-by: Chaotian Jing +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/mtk-sd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c +index 0bf0d0e9dbdba..5ef25463494f4 100644 +--- a/drivers/mmc/host/mtk-sd.c ++++ b/drivers/mmc/host/mtk-sd.c +@@ -846,6 +846,7 @@ static void msdc_start_command(struct msdc_host *host, + WARN_ON(host->cmd); + host->cmd = cmd; + ++ mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT); + if (!msdc_cmd_is_ready(host, mrq, cmd)) + return; + +@@ -857,7 +858,6 @@ static void msdc_start_command(struct msdc_host *host, + + cmd->error = 0; + rawcmd = msdc_cmd_prepare_raw_cmd(host, mrq, cmd); +- mod_delayed_work(system_wq, &host->req_timeout, DAT_TIMEOUT); + + sdr_set_bits(host->base + MSDC_INTEN, cmd_ints_mask); + writel(cmd->arg, host->base + SDC_ARG); +-- +2.20.1 + diff --git a/queue-4.4/mwifiex-fix-nl80211_tx_power_limited.patch b/queue-4.4/mwifiex-fix-nl80211_tx_power_limited.patch new file mode 100644 index 00000000000..6bf79e06385 --- /dev/null +++ b/queue-4.4/mwifiex-fix-nl80211_tx_power_limited.patch @@ -0,0 +1,117 @@ +From 0e97a62fc3813ed581cbe7b43beb36071ff86560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Feb 2019 15:59:38 +0200 +Subject: mwifiex: Fix NL80211_TX_POWER_LIMITED + +From: Adrian Bunk + +[ Upstream commit 65a576e27309120e0621f54d5c81eb9128bd56be ] + +NL80211_TX_POWER_LIMITED was treated as NL80211_TX_POWER_AUTOMATIC, +which is the opposite of what should happen and can cause nasty +regulatory problems. + +if/else converted to a switch without default to make gcc warn +on unhandled enum values. + +Signed-off-by: Adrian Bunk +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mwifiex/cfg80211.c | 13 +++++++++++-- + drivers/net/wireless/mwifiex/ioctl.h | 1 + + drivers/net/wireless/mwifiex/sta_ioctl.c | 11 +++++++---- + 3 files changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c +index 1e074eaf613d0..c6c2d3304dba7 100644 +--- a/drivers/net/wireless/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/mwifiex/cfg80211.c +@@ -365,11 +365,20 @@ mwifiex_cfg80211_set_tx_power(struct wiphy *wiphy, + struct mwifiex_power_cfg power_cfg; + int dbm = MBM_TO_DBM(mbm); + +- if (type == NL80211_TX_POWER_FIXED) { ++ switch (type) { ++ case NL80211_TX_POWER_FIXED: + power_cfg.is_power_auto = 0; ++ power_cfg.is_power_fixed = 1; + power_cfg.power_level = dbm; +- } else { ++ break; ++ case NL80211_TX_POWER_LIMITED: ++ power_cfg.is_power_auto = 0; ++ power_cfg.is_power_fixed = 0; ++ power_cfg.power_level = dbm; ++ break; ++ case NL80211_TX_POWER_AUTOMATIC: + power_cfg.is_power_auto = 1; ++ break; + } + + priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY); +diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h +index 4f0174c649461..4cb7001603968 100644 +--- a/drivers/net/wireless/mwifiex/ioctl.h ++++ b/drivers/net/wireless/mwifiex/ioctl.h +@@ -256,6 +256,7 @@ struct mwifiex_ds_encrypt_key { + + struct mwifiex_power_cfg { + u32 is_power_auto; ++ u32 is_power_fixed; + u32 power_level; + }; + +diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c +index 12eedb33db7ba..992f9feaea92e 100644 +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -666,6 +666,9 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv, + txp_cfg = (struct host_cmd_ds_txpwr_cfg *) buf; + txp_cfg->action = cpu_to_le16(HostCmd_ACT_GEN_SET); + if (!power_cfg->is_power_auto) { ++ u16 dbm_min = power_cfg->is_power_fixed ? ++ dbm : priv->min_tx_power_level; ++ + txp_cfg->mode = cpu_to_le32(1); + pg_tlv = (struct mwifiex_types_power_group *) + (buf + sizeof(struct host_cmd_ds_txpwr_cfg)); +@@ -680,7 +683,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv, + pg->last_rate_code = 0x03; + pg->modulation_class = MOD_CLASS_HR_DSSS; + pg->power_step = 0; +- pg->power_min = (s8) dbm; ++ pg->power_min = (s8) dbm_min; + pg->power_max = (s8) dbm; + pg++; + /* Power group for modulation class OFDM */ +@@ -688,7 +691,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv, + pg->last_rate_code = 0x07; + pg->modulation_class = MOD_CLASS_OFDM; + pg->power_step = 0; +- pg->power_min = (s8) dbm; ++ pg->power_min = (s8) dbm_min; + pg->power_max = (s8) dbm; + pg++; + /* Power group for modulation class HTBW20 */ +@@ -696,7 +699,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv, + pg->last_rate_code = 0x20; + pg->modulation_class = MOD_CLASS_HT; + pg->power_step = 0; +- pg->power_min = (s8) dbm; ++ pg->power_min = (s8) dbm_min; + pg->power_max = (s8) dbm; + pg->ht_bandwidth = HT_BW_20; + pg++; +@@ -705,7 +708,7 @@ int mwifiex_set_tx_power(struct mwifiex_private *priv, + pg->last_rate_code = 0x20; + pg->modulation_class = MOD_CLASS_HT; + pg->power_step = 0; +- pg->power_min = (s8) dbm; ++ pg->power_min = (s8) dbm_min; + pg->power_max = (s8) dbm; + pg->ht_bandwidth = HT_BW_40; + } +-- +2.20.1 + diff --git a/queue-4.4/net-bcmgenet-return-correct-value-ret-from-bcmgenet_.patch b/queue-4.4/net-bcmgenet-return-correct-value-ret-from-bcmgenet_.patch new file mode 100644 index 00000000000..1eeb0347539 --- /dev/null +++ b/queue-4.4/net-bcmgenet-return-correct-value-ret-from-bcmgenet_.patch @@ -0,0 +1,41 @@ +From 1b9eec1b6bc617f95bf4e55569188f965b56c35b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 02:08:43 +0000 +Subject: net: bcmgenet: return correct value 'ret' from bcmgenet_power_down + +From: YueHaibing + +[ Upstream commit 0db55093b56618088b9a1d445eb6e43b311bea33 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/net/ethernet/broadcom/genet/bcmgenet.c: In function 'bcmgenet_power_down': +drivers/net/ethernet/broadcom/genet/bcmgenet.c:1136:6: warning: + variable 'ret' set but not used [-Wunused-but-set-variable] + +bcmgenet_power_down should return 'ret' instead of 0. + +Fixes: ca8cf341903f ("net: bcmgenet: propagate errors from bcmgenet_power_down") +Signed-off-by: YueHaibing +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 04fe570275cd6..34fae5576b603 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1074,7 +1074,7 @@ static int bcmgenet_power_down(struct bcmgenet_priv *priv, + break; + } + +- return 0; ++ return ret; + } + + static void bcmgenet_power_up(struct bcmgenet_priv *priv, +-- +2.20.1 + diff --git a/queue-4.4/net-do-not-abort-bulk-send-on-bql-status.patch b/queue-4.4/net-do-not-abort-bulk-send-on-bql-status.patch new file mode 100644 index 00000000000..ee731f03155 --- /dev/null +++ b/queue-4.4/net-do-not-abort-bulk-send-on-bql-status.patch @@ -0,0 +1,51 @@ +From 61fc82d39b029b6f2238645628f7dc21f2e08c6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 08:39:13 -0700 +Subject: net: do not abort bulk send on BQL status + +From: Eric Dumazet + +[ Upstream commit fe60faa5063822f2d555f4f326c7dd72a60929bf ] + +Before calling dev_hard_start_xmit(), upper layers tried +to cook optimal skb list based on BQL budget. + +Problem is that GSO packets can end up comsuming more than +the BQL budget. + +Breaking the loop is not useful, since requeued packets +are ahead of any packets still in the qdisc. + +It is also more expensive, since next TX completion will +push these packets later, while skbs are not in cpu caches. + +It is also a behavior difference with TSO packets, that can +break the BQL limit by a large amount. + +Note that drivers should use __netdev_tx_sent_queue() +in order to have optimal xmit_more support, and avoid +useless atomic operations as shown in the following patch. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 18a5154e2f254..903c6242b4499 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2801,7 +2801,7 @@ struct sk_buff *dev_hard_start_xmit(struct sk_buff *first, struct net_device *de + } + + skb = next; +- if (netif_xmit_stopped(txq) && skb) { ++ if (netif_tx_queue_stopped(txq) && skb) { + rc = NETDEV_TX_BUSY; + break; + } +-- +2.20.1 + diff --git a/queue-4.4/net-fix-warning-in-af_unix.patch b/queue-4.4/net-fix-warning-in-af_unix.patch new file mode 100644 index 00000000000..a960f412393 --- /dev/null +++ b/queue-4.4/net-fix-warning-in-af_unix.patch @@ -0,0 +1,37 @@ +From 1a3be72a2a1ca69eaa1823add44669a286f2ca92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 14:57:26 +0900 +Subject: net: fix warning in af_unix + +From: Kyeongdon Kim + +[ Upstream commit 33c4368ee2589c165aebd8d388cbd91e9adb9688 ] + +This fixes the "'hash' may be used uninitialized in this function" + +net/unix/af_unix.c:1041:20: warning: 'hash' may be used uninitialized in this function [-Wmaybe-uninitialized] + addr->hash = hash ^ sk->sk_type; + +Signed-off-by: Kyeongdon Kim +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/unix/af_unix.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index b1a72615fdc30..b5e2ef242efe7 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -224,6 +224,8 @@ static inline void unix_release_addr(struct unix_address *addr) + + static int unix_mkname(struct sockaddr_un *sunaddr, int len, unsigned int *hashp) + { ++ *hashp = 0; ++ + if (len <= sizeof(short) || len > sizeof(*sunaddr)) + return -EINVAL; + if (!sunaddr || sunaddr->sun_family != AF_UNIX) +-- +2.20.1 + diff --git a/queue-4.4/ntb-intel-fix-return-value-for-ndev_vec_mask.patch b/queue-4.4/ntb-intel-fix-return-value-for-ndev_vec_mask.patch new file mode 100644 index 00000000000..b7d693e8a76 --- /dev/null +++ b/queue-4.4/ntb-intel-fix-return-value-for-ndev_vec_mask.patch @@ -0,0 +1,39 @@ +From f637aaf48081f3c7c13d828547431e61e725f198 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Aug 2018 17:13:59 -0700 +Subject: ntb: intel: fix return value for ndev_vec_mask() + +From: Dave Jiang + +[ Upstream commit 7756e2b5d68c36e170a111dceea22f7365f83256 ] + +ndev_vec_mask() should be returning u64 mask value instead of int. +Otherwise the mask value returned can be incorrect for larger +vectors. + +Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers") + +Signed-off-by: Dave Jiang +Tested-by: Lucas Van +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/intel/ntb_hw_intel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ntb/hw/intel/ntb_hw_intel.c b/drivers/ntb/hw/intel/ntb_hw_intel.c +index a198f82982582..2898b39c065e3 100644 +--- a/drivers/ntb/hw/intel/ntb_hw_intel.c ++++ b/drivers/ntb/hw/intel/ntb_hw_intel.c +@@ -330,7 +330,7 @@ static inline int ndev_db_clear_mask(struct intel_ntb_dev *ndev, u64 db_bits, + return 0; + } + +-static inline int ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector) ++static inline u64 ndev_vec_mask(struct intel_ntb_dev *ndev, int db_vector) + { + u64 shift, mask; + +-- +2.20.1 + diff --git a/queue-4.4/ntb_netdev-fix-sleep-time-mismatch.patch b/queue-4.4/ntb_netdev-fix-sleep-time-mismatch.patch new file mode 100644 index 00000000000..9b8022ba9d4 --- /dev/null +++ b/queue-4.4/ntb_netdev-fix-sleep-time-mismatch.patch @@ -0,0 +1,38 @@ +From f74dd5dce2d812e39fbb893a43eed3a49ce1caf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jun 2018 16:13:12 -0400 +Subject: ntb_netdev: fix sleep time mismatch + +From: Jon Mason + +[ Upstream commit a861594b1b7ffd630f335b351c4e9f938feadb8e ] + +The tx_time should be in usecs (according to the comment above the +variable), but the setting of the timer during the rearming is done in +msecs. Change it to match the expected units. + +Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev") +Suggested-by: Gerd W. Haeussler +Signed-off-by: Jon Mason +Acked-by: Dave Jiang +Signed-off-by: Sasha Levin +--- + drivers/net/ntb_netdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c +index a9acf71568555..03009f1becddc 100644 +--- a/drivers/net/ntb_netdev.c ++++ b/drivers/net/ntb_netdev.c +@@ -236,7 +236,7 @@ static void ntb_netdev_tx_timer(unsigned long data) + struct ntb_netdev *dev = netdev_priv(ndev); + + if (ntb_transport_tx_free_entry(dev->qp) < tx_stop) { +- mod_timer(&dev->tx_timer, jiffies + msecs_to_jiffies(tx_time)); ++ mod_timer(&dev->tx_timer, jiffies + usecs_to_jiffies(tx_time)); + } else { + /* Make sure anybody stopping the queue after this sees the new + * value of ntb_transport_tx_free_entry() +-- +2.20.1 + diff --git a/queue-4.4/ocfs2-don-t-put-and-assigning-null-to-bh-allocated-o.patch b/queue-4.4/ocfs2-don-t-put-and-assigning-null-to-bh-allocated-o.patch new file mode 100644 index 00000000000..8247c1eb627 --- /dev/null +++ b/queue-4.4/ocfs2-don-t-put-and-assigning-null-to-bh-allocated-o.patch @@ -0,0 +1,216 @@ +From 3b4c4a07b792d2e64eecc811e81f01527388c28a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Nov 2018 15:48:19 -0700 +Subject: ocfs2: don't put and assigning null to bh allocated outside + +From: Changwei Ge + +[ Upstream commit cf76c78595ca87548ca5e45c862ac9e0949c4687 ] + +ocfs2_read_blocks() and ocfs2_read_blocks_sync() are both used to read +several blocks from disk. Currently, the input argument *bhs* can be +NULL or NOT. It depends on the caller's behavior. If the function +fails in reading blocks from disk, the corresponding bh will be assigned +to NULL and put. + +Obviously, above process for non-NULL input bh is not appropriate. +Because the caller doesn't even know its bhs are put and re-assigned. + +If buffer head is managed by caller, ocfs2_read_blocks and +ocfs2_read_blocks_sync() should not evaluate it to NULL. It will cause +caller accessing illegal memory, thus crash. + +Link: http://lkml.kernel.org/r/HK2PR06MB045285E0F4FBB561F9F2F9B3D5680@HK2PR06MB0452.apcprd06.prod.outlook.com +Signed-off-by: Changwei Ge +Reviewed-by: Guozhonghua +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/buffer_head_io.c | 77 ++++++++++++++++++++++++++++++--------- + 1 file changed, 59 insertions(+), 18 deletions(-) + +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c +index 9ee8bcfbf00f3..92593179f7e2b 100644 +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -98,25 +98,34 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh, + return ret; + } + ++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it ++ * will be easier to handle read failure. ++ */ + int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, + unsigned int nr, struct buffer_head *bhs[]) + { + int status = 0; + unsigned int i; + struct buffer_head *bh; ++ int new_bh = 0; + + trace_ocfs2_read_blocks_sync((unsigned long long)block, nr); + + if (!nr) + goto bail; + ++ /* Don't put buffer head and re-assign it to NULL if it is allocated ++ * outside since the caller can't be aware of this alternation! ++ */ ++ new_bh = (bhs[0] == NULL); ++ + for (i = 0 ; i < nr ; i++) { + if (bhs[i] == NULL) { + bhs[i] = sb_getblk(osb->sb, block++); + if (bhs[i] == NULL) { + status = -ENOMEM; + mlog_errno(status); +- goto bail; ++ break; + } + } + bh = bhs[i]; +@@ -151,9 +160,26 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, + submit_bh(READ, bh); + } + ++read_failure: + for (i = nr; i > 0; i--) { + bh = bhs[i - 1]; + ++ if (unlikely(status)) { ++ if (new_bh && bh) { ++ /* If middle bh fails, let previous bh ++ * finish its read and then put it to ++ * aovoid bh leak ++ */ ++ if (!buffer_jbd(bh)) ++ wait_on_buffer(bh); ++ put_bh(bh); ++ bhs[i - 1] = NULL; ++ } else if (bh && buffer_uptodate(bh)) { ++ clear_buffer_uptodate(bh); ++ } ++ continue; ++ } ++ + /* No need to wait on the buffer if it's managed by JBD. */ + if (!buffer_jbd(bh)) + wait_on_buffer(bh); +@@ -163,8 +189,7 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, + * so we can safely record this and loop back + * to cleanup the other buffers. */ + status = -EIO; +- put_bh(bh); +- bhs[i - 1] = NULL; ++ goto read_failure; + } + } + +@@ -172,6 +197,9 @@ int ocfs2_read_blocks_sync(struct ocfs2_super *osb, u64 block, + return status; + } + ++/* Caller must provide a bhs[] with all NULL or non-NULL entries, so it ++ * will be easier to handle read failure. ++ */ + int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + struct buffer_head *bhs[], int flags, + int (*validate)(struct super_block *sb, +@@ -181,6 +209,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + int i, ignore_cache = 0; + struct buffer_head *bh; + struct super_block *sb = ocfs2_metadata_cache_get_super(ci); ++ int new_bh = 0; + + trace_ocfs2_read_blocks_begin(ci, (unsigned long long)block, nr, flags); + +@@ -206,6 +235,11 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + goto bail; + } + ++ /* Don't put buffer head and re-assign it to NULL if it is allocated ++ * outside since the caller can't be aware of this alternation! ++ */ ++ new_bh = (bhs[0] == NULL); ++ + ocfs2_metadata_cache_io_lock(ci); + for (i = 0 ; i < nr ; i++) { + if (bhs[i] == NULL) { +@@ -214,7 +248,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + ocfs2_metadata_cache_io_unlock(ci); + status = -ENOMEM; + mlog_errno(status); +- goto bail; ++ /* Don't forget to put previous bh! */ ++ break; + } + } + bh = bhs[i]; +@@ -308,16 +343,27 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + } + } + +- status = 0; +- ++read_failure: + for (i = (nr - 1); i >= 0; i--) { + bh = bhs[i]; + + if (!(flags & OCFS2_BH_READAHEAD)) { +- if (status) { +- /* Clear the rest of the buffers on error */ +- put_bh(bh); +- bhs[i] = NULL; ++ if (unlikely(status)) { ++ /* Clear the buffers on error including those ++ * ever succeeded in reading ++ */ ++ if (new_bh && bh) { ++ /* If middle bh fails, let previous bh ++ * finish its read and then put it to ++ * aovoid bh leak ++ */ ++ if (!buffer_jbd(bh)) ++ wait_on_buffer(bh); ++ put_bh(bh); ++ bhs[i] = NULL; ++ } else if (bh && buffer_uptodate(bh)) { ++ clear_buffer_uptodate(bh); ++ } + continue; + } + /* We know this can't have changed as we hold the +@@ -335,9 +381,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + * uptodate. */ + status = -EIO; + clear_buffer_needs_validate(bh); +- put_bh(bh); +- bhs[i] = NULL; +- continue; ++ goto read_failure; + } + + if (buffer_needs_validate(bh)) { +@@ -347,11 +391,8 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + BUG_ON(buffer_jbd(bh)); + clear_buffer_needs_validate(bh); + status = validate(sb, bh); +- if (status) { +- put_bh(bh); +- bhs[i] = NULL; +- continue; +- } ++ if (status) ++ goto read_failure; + } + } + +-- +2.20.1 + diff --git a/queue-4.4/ocfs2-fix-clusters-leak-in-ocfs2_defrag_extent.patch b/queue-4.4/ocfs2-fix-clusters-leak-in-ocfs2_defrag_extent.patch new file mode 100644 index 00000000000..e3f4b2695a9 --- /dev/null +++ b/queue-4.4/ocfs2-fix-clusters-leak-in-ocfs2_defrag_extent.patch @@ -0,0 +1,84 @@ +From edf1bb9a29e6d45a35cff0edc137c275b2d6eedf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Nov 2018 15:48:27 -0700 +Subject: ocfs2: fix clusters leak in ocfs2_defrag_extent() + +From: Larry Chen + +[ Upstream commit 6194ae4242dec0c9d604bc05df83aa9260a899e4 ] + +ocfs2_defrag_extent() might leak allocated clusters. When the file +system has insufficient space, the number of claimed clusters might be +less than the caller wants. If that happens, the original code might +directly commit the transaction without returning clusters. + +This patch is based on code in ocfs2_add_clusters_in_btree(). + +[akpm@linux-foundation.org: include localalloc.h, reduce scope of data_ac] +Link: http://lkml.kernel.org/r/20180904041621.16874-3-lchen@suse.com +Signed-off-by: Larry Chen +Reviewed-by: Andrew Morton +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Joseph Qi +Cc: Changwei Ge +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/move_extents.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/fs/ocfs2/move_extents.c b/fs/ocfs2/move_extents.c +index c1a83c58456ef..725a870fd14fc 100644 +--- a/fs/ocfs2/move_extents.c ++++ b/fs/ocfs2/move_extents.c +@@ -25,6 +25,7 @@ + #include "ocfs2_ioctl.h" + + #include "alloc.h" ++#include "localalloc.h" + #include "aops.h" + #include "dlmglue.h" + #include "extent_map.h" +@@ -222,6 +223,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context, + struct ocfs2_refcount_tree *ref_tree = NULL; + u32 new_phys_cpos, new_len; + u64 phys_blkno = ocfs2_clusters_to_blocks(inode->i_sb, phys_cpos); ++ int need_free = 0; + + if ((ext_flags & OCFS2_EXT_REFCOUNTED) && *len) { + +@@ -315,6 +317,7 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context, + if (!partial) { + context->range->me_flags &= ~OCFS2_MOVE_EXT_FL_COMPLETE; + ret = -ENOSPC; ++ need_free = 1; + goto out_commit; + } + } +@@ -339,6 +342,20 @@ static int ocfs2_defrag_extent(struct ocfs2_move_extents_context *context, + mlog_errno(ret); + + out_commit: ++ if (need_free && context->data_ac) { ++ struct ocfs2_alloc_context *data_ac = context->data_ac; ++ ++ if (context->data_ac->ac_which == OCFS2_AC_USE_LOCAL) ++ ocfs2_free_local_alloc_bits(osb, handle, data_ac, ++ new_phys_cpos, new_len); ++ else ++ ocfs2_free_clusters(handle, ++ data_ac->ac_inode, ++ data_ac->ac_bh, ++ ocfs2_clusters_to_blocks(osb->sb, new_phys_cpos), ++ new_len); ++ } ++ + ocfs2_commit_trans(osb, handle); + + out_unlock_mutex: +-- +2.20.1 + diff --git a/queue-4.4/pci-keystone-use-quirk-to-limit-mrrs-for-k2g.patch b/queue-4.4/pci-keystone-use-quirk-to-limit-mrrs-for-k2g.patch new file mode 100644 index 00000000000..8cd7a869c33 --- /dev/null +++ b/queue-4.4/pci-keystone-use-quirk-to-limit-mrrs-for-k2g.patch @@ -0,0 +1,44 @@ +From 1580205ef3abb966e4cc8e6b30717ea41e0e4b6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Oct 2018 13:10:54 +0530 +Subject: PCI: keystone: Use quirk to limit MRRS for K2G + +From: Kishon Vijay Abraham I + +[ Upstream commit 148e340c0696369fadbbddc8f4bef801ed247d71 ] + +PCI controller in K2G also has a limitation that memory read request +size (MRRS) must not exceed 256 bytes. Use the quirk to limit MRRS +(added for K2HK, K2L and K2E) for K2G as well. + +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/host/pci-keystone.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/host/pci-keystone.c b/drivers/pci/host/pci-keystone.c +index fb682e8af74d5..bdb808ba90d2a 100644 +--- a/drivers/pci/host/pci-keystone.c ++++ b/drivers/pci/host/pci-keystone.c +@@ -42,6 +42,7 @@ + #define PCIE_RC_K2HK 0xb008 + #define PCIE_RC_K2E 0xb009 + #define PCIE_RC_K2L 0xb00a ++#define PCIE_RC_K2G 0xb00b + + #define to_keystone_pcie(x) container_of(x, struct keystone_pcie, pp) + +@@ -56,6 +57,8 @@ static void quirk_limit_mrrs(struct pci_dev *dev) + .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, }, + { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2L), + .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, }, ++ { PCI_DEVICE(PCI_VENDOR_ID_TI, PCIE_RC_K2G), ++ .class = PCI_CLASS_BRIDGE_PCI << 8, .class_mask = ~0, }, + { 0, }, + }; + +-- +2.20.1 + diff --git a/queue-4.4/pinctrl-qcom-spmi-gpio-fix-gpio-hog-related-boot-iss.patch b/queue-4.4/pinctrl-qcom-spmi-gpio-fix-gpio-hog-related-boot-iss.patch new file mode 100644 index 00000000000..161a0bf0a0e --- /dev/null +++ b/queue-4.4/pinctrl-qcom-spmi-gpio-fix-gpio-hog-related-boot-iss.patch @@ -0,0 +1,62 @@ +From 1c5bb3ad4e791105fb9fa847a833321928a927fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 20:11:47 -0400 +Subject: pinctrl: qcom: spmi-gpio: fix gpio-hog related boot issues + +From: Brian Masney + +[ Upstream commit 149a96047237574b756d872007c006acd0cc6687 ] + +When attempting to setup up a gpio hog, device probing would repeatedly +fail with -EPROBE_DEFERED errors. It was caused by a circular dependency +between the gpio and pinctrl frameworks. If the gpio-ranges property is +present in device tree, then the gpio framework will handle the gpio pin +registration and eliminate the circular dependency. + +See Christian Lamparter's commit a86caa9ba5d7 ("pinctrl: msm: fix +gpio-hog related boot issues") for a detailed commit message that +explains the issue in much more detail. The code comment in this commit +came from Christian's commit. + +Signed-off-by: Brian Masney +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-spmi-gpio.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 4ea810cafaac6..913b2604d3454 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -793,10 +793,23 @@ static int pmic_gpio_probe(struct platform_device *pdev) + goto err_chip; + } + +- ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0, npins); +- if (ret) { +- dev_err(dev, "failed to add pin range\n"); +- goto err_range; ++ /* ++ * For DeviceTree-supported systems, the gpio core checks the ++ * pinctrl's device node for the "gpio-ranges" property. ++ * If it is present, it takes care of adding the pin ranges ++ * for the driver. In this case the driver can skip ahead. ++ * ++ * In order to remain compatible with older, existing DeviceTree ++ * files which don't set the "gpio-ranges" property or systems that ++ * utilize ACPI the driver has to call gpiochip_add_pin_range(). ++ */ ++ if (!of_property_read_bool(dev->of_node, "gpio-ranges")) { ++ ret = gpiochip_add_pin_range(&state->chip, dev_name(dev), 0, 0, ++ npins); ++ if (ret) { ++ dev_err(dev, "failed to add pin range\n"); ++ goto err_range; ++ } + } + + return 0; +-- +2.20.1 + diff --git a/queue-4.4/pinctrl-zynq-use-define-directive-for-pin_config_io_.patch b/queue-4.4/pinctrl-zynq-use-define-directive-for-pin_config_io_.patch new file mode 100644 index 00000000000..7037cf54cdd --- /dev/null +++ b/queue-4.4/pinctrl-zynq-use-define-directive-for-pin_config_io_.patch @@ -0,0 +1,67 @@ +From c0da7196090397940c2100c642259df8fc32a484 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Nov 2018 01:56:40 -0700 +Subject: pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD + +From: Nathan Chancellor + +[ Upstream commit cd8a145a066a1a3beb0ae615c7cb2ee4217418d7 ] + +Clang warns when one enumerated type is implicitly converted to another: + +drivers/pinctrl/pinctrl-zynq.c:985:18: warning: implicit conversion from +enumeration type 'enum zynq_pin_config_param' to different enumeration +type 'enum pin_config_param' [-Wenum-conversion] + {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18}, + ~ ^~~~~~~~~~~~~~~~~~~~~ +drivers/pinctrl/pinctrl-zynq.c:990:16: warning: implicit conversion from +enumeration type 'enum zynq_pin_config_param' to different enumeration +type 'enum pin_config_param' [-Wenum-conversion] + = { PCONFDUMP(PIN_CONFIG_IOSTANDARD, "IO-standard", NULL, true), + ~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +./include/linux/pinctrl/pinconf-generic.h:163:11: note: expanded from +macro 'PCONFDUMP' + .param = a, .display = b, .format = c, .has_arg = d \ + ^ +2 warnings generated. + +It is expected that pinctrl drivers can extend pin_config_param because +of the gap between PIN_CONFIG_END and PIN_CONFIG_MAX so this conversion +isn't an issue. Most drivers that take advantage of this define the +PIN_CONFIG variables as constants, rather than enumerated values. Do the +same thing here so that Clang no longer warns. + +Signed-off-by: Nathan Chancellor +Acked-by: Michal Simek +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-zynq.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c +index d57b5eca7b983..ad12205dd7962 100644 +--- a/drivers/pinctrl/pinctrl-zynq.c ++++ b/drivers/pinctrl/pinctrl-zynq.c +@@ -967,15 +967,12 @@ enum zynq_io_standards { + zynq_iostd_max + }; + +-/** +- * enum zynq_pin_config_param - possible pin configuration parameters +- * @PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to ++/* ++ * PIN_CONFIG_IOSTANDARD: if the pin can select an IO standard, the argument to + * this parameter (on a custom format) tells the driver which alternative + * IO standard to use. + */ +-enum zynq_pin_config_param { +- PIN_CONFIG_IOSTANDARD = PIN_CONFIG_END + 1, +-}; ++#define PIN_CONFIG_IOSTANDARD (PIN_CONFIG_END + 1) + + static const struct pinconf_generic_params zynq_dt_params[] = { + {"io-standard", PIN_CONFIG_IOSTANDARD, zynq_iostd_lvcmos18}, +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-nb-wmi-support-als-on-the-zenbook-.patch b/queue-4.4/platform-x86-asus-nb-wmi-support-als-on-the-zenbook-.patch new file mode 100644 index 00000000000..592fd7bf12e --- /dev/null +++ b/queue-4.4/platform-x86-asus-nb-wmi-support-als-on-the-zenbook-.patch @@ -0,0 +1,63 @@ +From c628ba3848c533b905500bcdd094076007a5be36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Nov 2017 14:18:44 -0700 +Subject: platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ + +From: Kiernan Hager + +[ Upstream commit db2582afa7444a0ce6bb1ebf1431715969a10b06 ] + +This patch adds support for ALS on the Zenbook UX430UQ to the asus_nb_wmi +driver. It also renames "quirk_asus_ux330uak" to "quirk_asus_forceals" +because it is now used for more than one model of computer, and should +thus have a more general name. + +Signed-off-by: Kiernan Hager +[andy: massaged commit message, fixed indentation and commas in the code] +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index bf9e48010b98b..274ccf920af50 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -120,7 +120,7 @@ static struct quirk_entry quirk_asus_x550lb = { + .xusb2pr = 0x01D9, + }; + +-static struct quirk_entry quirk_asus_ux330uak = { ++static struct quirk_entry quirk_asus_forceals = { + .wmi_force_als_set = true, + }; + +@@ -422,7 +422,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "UX330UAK"), + }, +- .driver_data = &quirk_asus_ux330uak, ++ .driver_data = &quirk_asus_forceals, + }, + { + .callback = dmi_matched, +@@ -433,6 +433,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_x550lb, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. UX430UQ", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX430UQ"), ++ }, ++ .driver_data = &quirk_asus_forceals, ++ }, + {}, + }; + +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-add-serio_i8042-dependency.patch b/queue-4.4/platform-x86-asus-wmi-add-serio_i8042-dependency.patch new file mode 100644 index 00000000000..842f8c8fb24 --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-add-serio_i8042-dependency.patch @@ -0,0 +1,42 @@ +From ee23817a5839c17020a4920cde5508046fc40e6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2016 21:31:40 +0200 +Subject: platform/x86: asus-wmi: add SERIO_I8042 dependency + +From: Arnd Bergmann + +[ Upstream commit ea893695ec1131a5fed0523ff8094bc6e8723bbe ] + +A recent bugfix added a call to i8042_install_filter but did +not add the dependency, leading to possible link errors: + +drivers/platform/built-in.o: In function `asus_nb_wmi_quirks': +asus-nb-wmi.c:(.text+0x23af): undefined reference to `i8042_install_filter' + +This adds a dependency on SERIO_I8042||SERIO_I8042=n to indicate +that we can build the driver when the i8042 driver is disabled, +but it cannot be built-in when that is a loadable module. + +Fixes: b5643539b825 ("platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A") +Signed-off-by: Arnd Bergmann +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig +index 953974b5a9a95..6487453c68b59 100644 +--- a/drivers/platform/x86/Kconfig ++++ b/drivers/platform/x86/Kconfig +@@ -566,6 +566,7 @@ config ASUS_WMI + config ASUS_NB_WMI + tristate "Asus Notebook WMI Driver" + depends on ASUS_WMI ++ depends on SERIO_I8042 || SERIO_I8042 = n + ---help--- + This is a driver for newer Asus notebooks. It adds extra features + like wireless radio and bluetooth control, leds, hotkeys, backlight... +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-filter-buggy-scan-codes-on-asu.patch b/queue-4.4/platform-x86-asus-wmi-filter-buggy-scan-codes-on-asu.patch new file mode 100644 index 00000000000..135c39d3064 --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-filter-buggy-scan-codes-on-asu.patch @@ -0,0 +1,158 @@ +From 892cfc70de597fe3f73c84c41feb0dc2604f649c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2016 17:48:17 +0200 +Subject: platform/x86: asus-wmi: Filter buggy scan codes on ASUS Q500A + +From: Oleksij Rempel + +[ Upstream commit b5643539b82559b858b8efe3fc8343f66cf9a0b5 ] + +Some revisions of the ASUS Q500A series have a keyboard related +issue which is reproducible only after Windows with installed ASUS +tools is started. + +In this case the Linux side will have a blocked keyboard or +report incorrect or incomplete hotkey events. + +To make Linux work properly again, a complete power down +(unplug power supply and remove battery) is needed. + +Linux/atkbd after a clean start will get the following code on VOLUME_UP +key: {0xe0, 0x30, 0xe0, 0xb0}. After Windows, the same key will generate +this codes: {0xe1, 0x23, 0xe0, 0x30, 0xe0, 0xb0}. As result atkdb will +be confused by buggy codes. + +This patch is filtering this buggy code out. + +https://bugzilla.kernel.org/show_bug.cgi?id=119391 + +Signed-off-by: Oleksij Rempel +Cc: Alex Henrie +Cc: Dmitry Torokhov +Cc: Corentin Chary +Cc: acpi4asus-user@lists.sourceforge.net +Cc: platform-driver-x86@vger.kernel.org +Cc: linux-kernel@vger.kernel.org + +[dvhart: Add return after pr_warn to avoid false confirmation of filter] + +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 45 ++++++++++++++++++++++++++++++ + drivers/platform/x86/asus-wmi.h | 4 +++ + 2 files changed, 49 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 734f95c09508f..904e28d4db528 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include "asus-wmi.h" + +@@ -55,10 +56,34 @@ MODULE_PARM_DESC(wapf, "WAPF value"); + + static struct quirk_entry *quirks; + ++static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str, ++ struct serio *port) ++{ ++ static bool extended; ++ bool ret = false; ++ ++ if (str & I8042_STR_AUXDATA) ++ return false; ++ ++ if (unlikely(data == 0xe1)) { ++ extended = true; ++ ret = true; ++ } else if (unlikely(extended)) { ++ extended = false; ++ ret = true; ++ } ++ ++ return ret; ++} ++ + static struct quirk_entry quirk_asus_unknown = { + .wapf = 0, + }; + ++static struct quirk_entry quirk_asus_q500a = { ++ .i8042_filter = asus_q500a_i8042_filter, ++}; ++ + /* + * For those machines that need software to control bt/wifi status + * and can't adjust brightness through ACPI interface +@@ -94,6 +119,15 @@ static int dmi_matched(const struct dmi_system_id *dmi) + } + + static const struct dmi_system_id asus_quirks[] = { ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. Q500A", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Q500A"), ++ }, ++ .driver_data = &quirk_asus_q500a, ++ }, + { + .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. U32U", +@@ -365,6 +399,8 @@ static const struct dmi_system_id asus_quirks[] = { + + static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + { ++ int ret; ++ + quirks = &quirk_asus_unknown; + dmi_check_system(asus_quirks); + +@@ -376,6 +412,15 @@ static void asus_nb_wmi_quirks(struct asus_wmi_driver *driver) + quirks->wapf = wapf; + else + wapf = quirks->wapf; ++ ++ if (quirks->i8042_filter) { ++ ret = i8042_install_filter(quirks->i8042_filter); ++ if (ret) { ++ pr_warn("Unable to install key filter\n"); ++ return; ++ } ++ pr_info("Using i8042 filter function for receiving events\n"); ++ } + } + + static const struct key_entry asus_nb_wmi_keymap[] = { +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 5de1df510ebd8..dd2e6cc0f3d48 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -28,6 +28,7 @@ + #define _ASUS_WMI_H_ + + #include ++#include + + #define ASUS_WMI_KEY_IGNORE (-1) + #define ASUS_WMI_BRN_DOWN 0x20 +@@ -51,6 +52,9 @@ struct quirk_entry { + * and let the ACPI interrupt to send out the key event. + */ + int no_display_toggle; ++ ++ bool (*i8042_filter)(unsigned char data, unsigned char str, ++ struct serio *serio); + }; + + struct asus_wmi_driver { +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-fix-asus-ux303ub-brightness-is.patch b/queue-4.4/platform-x86-asus-wmi-fix-asus-ux303ub-brightness-is.patch new file mode 100644 index 00000000000..be0f81df56c --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-fix-asus-ux303ub-brightness-is.patch @@ -0,0 +1,83 @@ +From 0ea9d3d84d752ce826547c1e6cd42b326ed2eb3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Aug 2016 16:12:06 +0800 +Subject: platform/x86: asus-wmi: fix asus ux303ub brightness issue + +From: zino lin + +[ Upstream commit 999d4376c62828b260fbb59d5ab6bc28918ca448 ] + +acpi_video0 doesn't work, asus-wmi brightness interface doesn't work, too. +So, we use native brightness interface to handle the brightness adjustion, +and add quirk_asus_ux303ub. + +Signed-off-by: zino lin +Acked-by: Corentin Chary +Signed-off-by: Darren Hart +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ + drivers/platform/x86/asus-wmi.c | 3 +++ + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 17 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 904e28d4db528..a619cbe4e852f 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -112,6 +112,10 @@ static struct quirk_entry quirk_no_rfkill_wapf4 = { + .no_rfkill = true, + }; + ++static struct quirk_entry quirk_asus_ux303ub = { ++ .wmi_backlight_native = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -394,6 +398,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_no_rfkill, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. UX303UB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX303UB"), ++ }, ++ .driver_data = &quirk_asus_ux303ub, ++ }, + {}, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 823f85b1b4dc6..de131cf4d2e4d 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2082,6 +2082,9 @@ static int asus_wmi_add(struct platform_device *pdev) + if (asus->driver->quirks->wmi_backlight_power) + acpi_video_set_dmi_backlight_type(acpi_backlight_vendor); + ++ if (asus->driver->quirks->wmi_backlight_native) ++ acpi_video_set_dmi_backlight_type(acpi_backlight_native); ++ + if (acpi_video_get_backlight_type() == acpi_backlight_vendor) { + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index dd2e6cc0f3d48..0e19014e9f542 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -44,6 +44,7 @@ struct quirk_entry { + bool scalar_panel_brightness; + bool store_backlight_power; + bool wmi_backlight_power; ++ bool wmi_backlight_native; + int wapf; + /* + * For machines with AMD graphic chips, it will send out WMI event +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch b/queue-4.4/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch new file mode 100644 index 00000000000..aca6fbf80ec --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch @@ -0,0 +1,115 @@ +From d7563256b2ccd32d8eb044f470500e9924172425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jun 2019 09:02:02 +0200 +Subject: platform/x86: asus-wmi: Only Tell EC the OS will handle display + hotkeys from asus_nb_wmi +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 401fee8195d401b2b94dee57383f627050724d5b ] + +Commit 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will +handle the display off hotkey") causes the backlight to be permanently off +on various EeePC laptop models using the eeepc-wmi driver (Asus EeePC +1015BX, Asus EeePC 1025C). + +The asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL) call added +by that commit is made conditional in this commit and only enabled in +the quirk_entry structs in the asus-nb-wmi driver fixing the broken +display / backlight on various EeePC laptop models. + +Cc: João Paulo Rechi Vita +Fixes: 78f3ac76d9e5 ("platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey") +Signed-off-by: Hans de Goede +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 8 ++++++++ + drivers/platform/x86/asus-wmi.c | 2 +- + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 274ccf920af50..cccf250cd1e33 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -78,10 +78,12 @@ static bool asus_q500a_i8042_filter(unsigned char data, unsigned char str, + + static struct quirk_entry quirk_asus_unknown = { + .wapf = 0, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_q500a = { + .i8042_filter = asus_q500a_i8042_filter, ++ .wmi_backlight_set_devstate = true, + }; + + /* +@@ -92,15 +94,18 @@ static struct quirk_entry quirk_asus_q500a = { + static struct quirk_entry quirk_asus_x55u = { + .wapf = 4, + .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, + .no_display_toggle = true, + }; + + static struct quirk_entry quirk_asus_wapf4 = { + .wapf = 4, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x200ca = { + .wapf = 2, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_no_rfkill = { +@@ -114,13 +119,16 @@ static struct quirk_entry quirk_no_rfkill_wapf4 = { + + static struct quirk_entry quirk_asus_ux303ub = { + .wmi_backlight_native = true, ++ .wmi_backlight_set_devstate = true, + }; + + static struct quirk_entry quirk_asus_x550lb = { ++ .wmi_backlight_set_devstate = true, + .xusb2pr = 0x01D9, + }; + + static struct quirk_entry quirk_asus_forceals = { ++ .wmi_backlight_set_devstate = true, + .wmi_force_als_set = true, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index c06cdc5522b48..63b5b6838e8bf 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -2135,7 +2135,7 @@ static int asus_wmi_add(struct platform_device *pdev) + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) + goto fail_backlight; +- } else ++ } else if (asus->driver->quirks->wmi_backlight_set_devstate) + err = asus_wmi_set_devstate(ASUS_WMI_DEVID_BACKLIGHT, 2, NULL); + + status = wmi_install_notify_handler(asus->driver->event_guid, +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 5db052d1de1e1..53bab79780e22 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -45,6 +45,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_power; + bool wmi_backlight_native; ++ bool wmi_backlight_set_devstate; + bool wmi_force_als_set; + int wapf; + /* +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-set-specified-xusb2pr-value-fo.patch b/queue-4.4/platform-x86-asus-wmi-set-specified-xusb2pr-value-fo.patch new file mode 100644 index 00000000000..ee4937f5741 --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-set-specified-xusb2pr-value-fo.patch @@ -0,0 +1,182 @@ +From d8a8facaa2c6c7b9ffb409116088f2eb5ae7f602 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Apr 2017 19:32:36 +0000 +Subject: platform/x86: asus-wmi: Set specified XUSB2PR value for X550LB + +From: Kai-Chuan Hsieh + +[ Upstream commit 8023eff10e7b0327898f17f0b553d2e45c71cef3 ] + +The bluetooth adapter Atheros AR3012 can't be enumerated +and make the bluetooth function broken. + +T: Bus=02 Lev=01 Prnt=01 Port=05 Cnt=02 Dev#= 5 Spd=12 MxCh= 0 +D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 +P: Vendor=13d3 ProdID=3362 Rev=00.02 +S: Manufacturer=Atheros Communications +S: Product=Bluetooth USB Host Controller +S: SerialNumber=Alaska Day 2006 +C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA +I: If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb +I: If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb + +The error is: + + usb 2-6: device not accepting address 7, error -62 + usb usb2-port6: unable to enumerate USB device + +It is caused by adapter's connected port is mapped to xHC +controller, but the xHCI is not supported by the usb device. + +The output of 'sudo lspci -nnxxx -s 00:14.0': + + 00:14.0 USB controller [0c03]: Intel Corporation 8 Series USB xHCI HC [8086:9c31] (rev 04) + 00: 86 80 31 9c 06 04 90 02 04 30 03 0c 00 00 00 00 + 10: 04 00 a0 f7 00 00 00 00 00 00 00 00 00 00 00 00 + 20: 00 00 00 00 00 00 00 00 00 00 00 00 43 10 1f 20 + 30: 00 00 00 00 70 00 00 00 00 00 00 00 0b 01 00 00 + 40: fd 01 36 80 89 c6 0f 80 00 00 00 00 00 00 00 00 + 50: 5f 2e ce 0f 00 00 00 00 00 00 00 00 00 00 00 00 + 60: 30 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + 70: 01 80 c2 c1 08 00 00 00 00 00 00 00 00 00 00 00 + 80: 05 00 87 00 0c a0 e0 fe 00 00 00 00 a1 41 00 00 + 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + a0: 00 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 + b0: 0f 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 + c0: 03 c0 30 00 00 00 00 00 03 0c 00 00 00 00 00 00 + d0: f9 01 00 00 f9 01 00 00 0f 00 00 00 0f 00 00 00 + e0: 00 08 00 00 00 00 00 00 00 00 00 00 d8 d8 00 00 + f0: 00 00 00 00 00 00 00 00 b1 0f 04 08 00 00 00 00 + +By referencing Intel Platform Controller Hub(PCH) datasheet, +the xHC USB 2.0 Port Routing(XUSB2PR) at offset 0xD0-0xD3h +decides the setting of mapping the port to EHCI controller or +xHC controller. And the port mapped to xHC will enable xHCI +during bus resume. + +The setting of disabling bluetooth adapter's connected port is +0x000001D9. The value can be obtained by few times 1 bit flip +operation. The suited configuration should have the 'lsusb -t' +result with bluetooth using ehci: + +/: Bus 03.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/4p, 5000M +/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/9p, 480M + |__ Port 5: Dev 2, If 0, Class=Video, Driver=uvcvideo, 480M + |__ Port 5: Dev 2, If 1, Class=Video, Driver=uvcvideo, 480M +/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=ehci-pci/2p, 480M + |__ Port 1: Dev 2, If 0, Class=Hub, Driver=hub/8p, 480M + |__ Port 6: Dev 3, If 0, Class=Wireless, Driver=btusb, 12M + |__ Port 6: Dev 3, If 1, Class=Wireless, Driver=btusb, 12M + +Signed-off-by: Kai-Chuan Hsieh +Acked-by: Corentin Chary +Reviewed-by: Andy Shevchenko +[andy: resolve merge conflict in asus-wmi.h] +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ + drivers/platform/x86/asus-wmi.c | 29 +++++++++++++++++++++++++++++ + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 43 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index a619cbe4e852f..7f7d6ca864771 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -116,6 +116,10 @@ static struct quirk_entry quirk_asus_ux303ub = { + .wmi_backlight_native = true, + }; + ++static struct quirk_entry quirk_asus_x550lb = { ++ .xusb2pr = 0x01D9, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -407,6 +411,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_ux303ub, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. X550LB", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X550LB"), ++ }, ++ .driver_data = &quirk_asus_x550lb, ++ }, + {}, + }; + +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index de131cf4d2e4d..a2174f01d3122 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -158,6 +158,9 @@ MODULE_LICENSE("GPL"); + #define ASUS_FAN_CTRL_MANUAL 1 + #define ASUS_FAN_CTRL_AUTO 2 + ++#define USB_INTEL_XUSB2PR 0xD0 ++#define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31 ++ + struct bios_args { + u32 arg0; + u32 arg1; +@@ -1082,6 +1085,29 @@ static int asus_wmi_rfkill_init(struct asus_wmi *asus) + return result; + } + ++static void asus_wmi_set_xusb2pr(struct asus_wmi *asus) ++{ ++ struct pci_dev *xhci_pdev; ++ u32 orig_ports_available; ++ u32 ports_available = asus->driver->quirks->xusb2pr; ++ ++ xhci_pdev = pci_get_device(PCI_VENDOR_ID_INTEL, ++ PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI, ++ NULL); ++ ++ if (!xhci_pdev) ++ return; ++ ++ pci_read_config_dword(xhci_pdev, USB_INTEL_XUSB2PR, ++ &orig_ports_available); ++ ++ pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR, ++ cpu_to_le32(ports_available)); ++ ++ pr_info("set USB_INTEL_XUSB2PR old: 0x%04x, new: 0x%04x\n", ++ orig_ports_available, ports_available); ++} ++ + /* + * Hwmon device + */ +@@ -2085,6 +2111,9 @@ static int asus_wmi_add(struct platform_device *pdev) + if (asus->driver->quirks->wmi_backlight_native) + acpi_video_set_dmi_backlight_type(acpi_backlight_native); + ++ if (asus->driver->quirks->xusb2pr) ++ asus_wmi_set_xusb2pr(asus); ++ + if (acpi_video_get_backlight_type() == acpi_backlight_vendor) { + err = asus_wmi_backlight_init(asus); + if (err && err != -ENODEV) +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index 0e19014e9f542..fdff626c3b51b 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -53,6 +53,7 @@ struct quirk_entry { + * and let the ACPI interrupt to send out the key event. + */ + int no_display_toggle; ++ u32 xusb2pr; + + bool (*i8042_filter)(unsigned char data, unsigned char str, + struct serio *serio); +-- +2.20.1 + diff --git a/queue-4.4/platform-x86-asus-wmi-try-to-set-als-by-default.patch b/queue-4.4/platform-x86-asus-wmi-try-to-set-als-by-default.patch new file mode 100644 index 00000000000..769f9d22e16 --- /dev/null +++ b/queue-4.4/platform-x86-asus-wmi-try-to-set-als-by-default.patch @@ -0,0 +1,152 @@ +From 03512d837d8a17920bb37f6256fbbba261d9c504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Apr 2017 16:19:49 +0200 +Subject: platform/x86: asus-wmi: try to set als by default + +From: Oleksij Rempel + +[ Upstream commit e9b615186805e2c18a0ac76aca62c1543ecfdbb8 ] + +some laptops, for example ASUS UX330UAK, have brocken als_get function +but working als_set funktion. In this case, ALS will stay turned off. + + Method (WMNB, 3, Serialized) + { + ... + If (Local0 == 0x53545344) + { + ... + If (IIA0 == 0x00050001) + { + If (!ALSP) + { + Return (0x02) + } + + Local0 = (GALS & 0x10) <<<---- bug, + should be: (GALS () & 0x10) + If (Local0) + { + Return (0x00050001) + } + Else + { + Return (0x00050000) + } + } + + ..... + If (Local0 == 0x53564544) + { + ... + If (IIA0 == 0x00050001) + { + Return (ALSC (IIA1)) + } + + ...... + Method (GALS, 0, NotSerialized) + { + Local0 = Zero + Local0 |= 0x20 + If (ALAE) + { + Local0 |= 0x10 + } + + Local1 = 0x0A + Local1 <<= 0x08 + Local0 |= Local1 + Return (Local0) + } + +Since it works without problems on Windows I assume ASUS WMI driver for Win +never trying to get ALS state, and instead it is setting it by default to ON. + +This patch will do the same. Turn ALS on by default. + +Signed-off-by: Oleksij Rempel +Signed-off-by: Andy Shevchenko +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 13 +++++++++++++ + drivers/platform/x86/asus-wmi.c | 12 ++++++++++++ + drivers/platform/x86/asus-wmi.h | 1 + + 3 files changed, 26 insertions(+) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 7f7d6ca864771..bf9e48010b98b 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -120,6 +120,10 @@ static struct quirk_entry quirk_asus_x550lb = { + .xusb2pr = 0x01D9, + }; + ++static struct quirk_entry quirk_asus_ux330uak = { ++ .wmi_force_als_set = true, ++}; ++ + static int dmi_matched(const struct dmi_system_id *dmi) + { + quirks = dmi->driver_data; +@@ -411,6 +415,15 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_ux303ub, + }, ++ { ++ .callback = dmi_matched, ++ .ident = "ASUSTeK COMPUTER INC. UX330UAK", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "UX330UAK"), ++ }, ++ .driver_data = &quirk_asus_ux330uak, ++ }, + { + .callback = dmi_matched, + .ident = "ASUSTeK COMPUTER INC. X550LB", +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 2dee91537123e..c06cdc5522b48 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -1109,6 +1109,15 @@ static void asus_wmi_set_xusb2pr(struct asus_wmi *asus) + orig_ports_available, ports_available); + } + ++/* ++ * Some devices dont support or have borcken get_als method ++ * but still support set method. ++ */ ++static void asus_wmi_set_als(void) ++{ ++ asus_wmi_set_devstate(ASUS_WMI_DEVID_ALS_ENABLE, 1, NULL); ++} ++ + /* + * Hwmon device + */ +@@ -2104,6 +2113,9 @@ static int asus_wmi_add(struct platform_device *pdev) + goto fail_rfkill; + } + ++ if (asus->driver->quirks->wmi_force_als_set) ++ asus_wmi_set_als(); ++ + /* Some Asus desktop boards export an acpi-video backlight interface, + stop this from showing up */ + chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); +diff --git a/drivers/platform/x86/asus-wmi.h b/drivers/platform/x86/asus-wmi.h +index fdff626c3b51b..5db052d1de1e1 100644 +--- a/drivers/platform/x86/asus-wmi.h ++++ b/drivers/platform/x86/asus-wmi.h +@@ -45,6 +45,7 @@ struct quirk_entry { + bool store_backlight_power; + bool wmi_backlight_power; + bool wmi_backlight_native; ++ bool wmi_force_als_set; + int wapf; + /* + * For machines with AMD graphic chips, it will send out WMI event +-- +2.20.1 + diff --git a/queue-4.4/powerpc-eeh-fix-use-of-eeh_pe_keep-on-wrong-field.patch b/queue-4.4/powerpc-eeh-fix-use-of-eeh_pe_keep-on-wrong-field.patch new file mode 100644 index 00000000000..fd41a8b554a --- /dev/null +++ b/queue-4.4/powerpc-eeh-fix-use-of-eeh_pe_keep-on-wrong-field.patch @@ -0,0 +1,44 @@ +From 46fb3611d5781819aca7331861ba23734475a695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Sep 2018 11:23:22 +1000 +Subject: powerpc/eeh: Fix use of EEH_PE_KEEP on wrong field + +From: Sam Bobroff + +[ Upstream commit 473af09b56dc4be68e4af33220ceca6be67aa60d ] + +eeh_add_to_parent_pe() sometimes removes the EEH_PE_KEEP flag, but it +incorrectly removes it from pe->type, instead of pe->state. + +However, rather than clearing it from the correct field, remove it. +Inspection of the code shows that it can't ever have had any effect +(even if it had been cleared from the correct field), because the +field is never tested after it is cleared by the statement in +question. + +The clear statement was added by commit 807a827d4e74 ("powerpc/eeh: +Keep PE during hotplug"), but it didn't explain why it was necessary. + +Signed-off-by: Sam Bobroff +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/eeh_pe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c +index 304f07cfa2622..4d4c32d0e6cee 100644 +--- a/arch/powerpc/kernel/eeh_pe.c ++++ b/arch/powerpc/kernel/eeh_pe.c +@@ -367,7 +367,7 @@ int eeh_add_to_parent_pe(struct eeh_dev *edev) + while (parent) { + if (!(parent->type & EEH_PE_INVALID)) + break; +- parent->type &= ~(EEH_PE_INVALID | EEH_PE_KEEP); ++ parent->type &= ~EEH_PE_INVALID; + parent = parent->parent; + } + +-- +2.20.1 + diff --git a/queue-4.4/powerpc-fix-signedness-bug-in-update_flash_db.patch b/queue-4.4/powerpc-fix-signedness-bug-in-update_flash_db.patch new file mode 100644 index 00000000000..36477e29f19 --- /dev/null +++ b/queue-4.4/powerpc-fix-signedness-bug-in-update_flash_db.patch @@ -0,0 +1,40 @@ +From aab38016a6b03e02d147a0583096601fd1e6117f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Oct 2018 19:44:58 +0300 +Subject: powerpc: Fix signedness bug in update_flash_db() + +From: Dan Carpenter + +[ Upstream commit 014704e6f54189a203cc14c7c0bb411b940241bc ] + +The "count < sizeof(struct os_area_db)" comparison is type promoted to +size_t so negative values of "count" are treated as very high values +and we accidentally return success instead of a negative error code. + +This doesn't really change runtime much but it fixes a static checker +warning. + +Signed-off-by: Dan Carpenter +Acked-by: Geoff Levand +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/ps3/os-area.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/platforms/ps3/os-area.c b/arch/powerpc/platforms/ps3/os-area.c +index 3db53e8aff927..9b2ef76578f06 100644 +--- a/arch/powerpc/platforms/ps3/os-area.c ++++ b/arch/powerpc/platforms/ps3/os-area.c +@@ -664,7 +664,7 @@ static int update_flash_db(void) + db_set_64(db, &os_area_db_id_rtc_diff, saved_params.rtc_diff); + + count = os_area_flash_write(db, sizeof(struct os_area_db), pos); +- if (count < sizeof(struct os_area_db)) { ++ if (count < 0 || count < sizeof(struct os_area_db)) { + pr_debug("%s: os_area_flash_write failed %zd\n", __func__, + count); + error = count < 0 ? count : -EIO; +-- +2.20.1 + diff --git a/queue-4.4/printk-fix-integer-overflow-in-setup_log_buf.patch b/queue-4.4/printk-fix-integer-overflow-in-setup_log_buf.patch new file mode 100644 index 00000000000..43dc48b7be5 --- /dev/null +++ b/queue-4.4/printk-fix-integer-overflow-in-setup_log_buf.patch @@ -0,0 +1,61 @@ +From 49a3ad014fcba0a15f662677cdc68ebd3b2e0a6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Oct 2018 20:33:08 +0900 +Subject: printk: fix integer overflow in setup_log_buf() + +From: Sergey Senozhatsky + +[ Upstream commit d2130e82e9454304e9b91ba9da551b5989af8c27 ] + +The way we calculate logbuf free space percentage overflows signed +integer: + + int free; + + free = __LOG_BUF_LEN - log_next_idx; + pr_info("early log buf free: %u(%u%%)\n", + free, (free * 100) / __LOG_BUF_LEN); + +We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is +called during early init, logbuf is mostly empty, so + + __LOG_BUF_LEN - log_next_idx + +is close to 1<<25. Thus when we multiply it by 100, we overflow signed +integer value range: 100 is 2^6 + 2^5 + 2^2. + +Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G +boot param: + +[ 0.075317] log_buf_len: -2147483648 bytes +[ 0.075319] early log buf free: 33549896(-28%) + +Make "free" unsigned integer and use appropriate printk() specifier. + +Link: http://lkml.kernel.org/r/20181010113308.9337-1-sergey.senozhatsky@gmail.com +To: Steven Rostedt +Cc: linux-kernel@vger.kernel.org +Cc: Sergey Senozhatsky +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Petr Mladek +Signed-off-by: Sasha Levin +--- + kernel/printk/printk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 699c18c9d7633..e53a976ca28ea 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -937,7 +937,7 @@ void __init setup_log_buf(int early) + { + unsigned long flags; + char *new_log_buf; +- int free; ++ unsigned int free; + + if (log_buf != __log_buf) + return; +-- +2.20.1 + diff --git a/queue-4.4/qlcnic-fix-a-return-in-qlcnic_dcb_get_capability.patch b/queue-4.4/qlcnic-fix-a-return-in-qlcnic_dcb_get_capability.patch new file mode 100644 index 00000000000..47a101b3745 --- /dev/null +++ b/queue-4.4/qlcnic-fix-a-return-in-qlcnic_dcb_get_capability.patch @@ -0,0 +1,40 @@ +From 5affc334e28f8bec1eca7f946c4d9e3516b7f9b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 23:11:11 +0300 +Subject: qlcnic: fix a return in qlcnic_dcb_get_capability() + +From: Dan Carpenter + +[ Upstream commit c94f026fb742b2d3199422751dbc4f6fc0e753d8 ] + +These functions are supposed to return one on failure and zero on +success. Returning a zero here could cause uninitialized variable +bugs in several of the callers. For example: + + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:1660 get_iscsi_dcb_priority() + error: uninitialized symbol 'caps'. + +Fixes: 48365e485275 ("qlcnic: dcb: Add support for CEE Netlink interface.") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +index a72bcddf160ac..178e7236eeb51 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +@@ -883,7 +883,7 @@ static u8 qlcnic_dcb_get_capability(struct net_device *netdev, int capid, + struct qlcnic_adapter *adapter = netdev_priv(netdev); + + if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state)) +- return 0; ++ return 1; + + switch (capid) { + case DCB_CAP_ATTR_PG: +-- +2.20.1 + diff --git a/queue-4.4/rtc-s35390a-change-buf-s-type-to-u8-in-s35390a_init.patch b/queue-4.4/rtc-s35390a-change-buf-s-type-to-u8-in-s35390a_init.patch new file mode 100644 index 00000000000..0c49fbf2b9c --- /dev/null +++ b/queue-4.4/rtc-s35390a-change-buf-s-type-to-u8-in-s35390a_init.patch @@ -0,0 +1,44 @@ +From 6923ad8cd308715896b366acbe7d32ac6134b8eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 13:43:45 -0700 +Subject: rtc: s35390a: Change buf's type to u8 in s35390a_init + +From: Nathan Chancellor + +[ Upstream commit ef0f02fd69a02b50e468a4ddbe33e3d81671e248 ] + +Clang warns: + +drivers/rtc/rtc-s35390a.c:124:27: warning: implicit conversion from +'int' to 'char' changes value from 192 to -64 [-Wconstant-conversion] + buf = S35390A_FLAG_RESET | S35390A_FLAG_24H; + ~ ~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~ +1 warning generated. + +Update buf to be an unsigned 8-bit integer, which matches the buf member +in struct i2c_msg. + +https://github.com/ClangBuiltLinux/linux/issues/145 +Signed-off-by: Nathan Chancellor +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-s35390a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c +index 00662dd28d66a..9a931efd50d36 100644 +--- a/drivers/rtc/rtc-s35390a.c ++++ b/drivers/rtc/rtc-s35390a.c +@@ -106,7 +106,7 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len) + */ + static int s35390a_reset(struct s35390a *s35390a, char *status1) + { +- char buf; ++ u8 buf; + int ret; + unsigned initcount = 0; + +-- +2.20.1 + diff --git a/queue-4.4/rtl8xxxu-fix-missing-break-in-switch.patch b/queue-4.4/rtl8xxxu-fix-missing-break-in-switch.patch new file mode 100644 index 00000000000..fe8a8bb891e --- /dev/null +++ b/queue-4.4/rtl8xxxu-fix-missing-break-in-switch.patch @@ -0,0 +1,35 @@ +From 2559c84aa2a9b820317ce883040dd409fb69d8e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Oct 2018 13:51:03 +0200 +Subject: rtl8xxxu: Fix missing break in switch + +From: Gustavo A. R. Silva + +[ Upstream commit 307b00c5e695857ca92fc6a4b8ab6c48f988a1b1 ] + +Add missing break statement in order to prevent the code from falling +through to the default case. + +Fixes: 26f1fad29ad9 ("New driver: rtl8xxxu (mac80211)") +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +index 7d820c3953754..52def14d55d33 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c +@@ -5331,6 +5331,7 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, + break; + case WLAN_CIPHER_SUITE_TKIP: + key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC; ++ break; + default: + return -EOPNOTSUPP; + } +-- +2.20.1 + diff --git a/queue-4.4/rtlwifi-rtl8192de-fix-misleading-reg_mcufwdl-informa.patch b/queue-4.4/rtlwifi-rtl8192de-fix-misleading-reg_mcufwdl-informa.patch new file mode 100644 index 00000000000..32468daea86 --- /dev/null +++ b/queue-4.4/rtlwifi-rtl8192de-fix-misleading-reg_mcufwdl-informa.patch @@ -0,0 +1,40 @@ +From b2800a6e0105aba4233e2d17b0c8cb730c88fd55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Nov 2018 19:25:30 +0800 +Subject: rtlwifi: rtl8192de: Fix misleading REG_MCUFWDL information + +From: Shaokun Zhang + +[ Upstream commit 7d129adff3afbd3a449bc3593f2064ac546d58d3 ] + +RT_TRACE shows REG_MCUFWDL value as a decimal value with a '0x' +prefix, which is somewhat misleading. + +Fix it to print hexadecimal, as was intended. + +Cc: Ping-Ke Shih +Cc: Kalle Valo +Signed-off-by: Shaokun Zhang +Acked-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c +index 62ef8209718f1..5bf3712a4d49d 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/fw.c +@@ -234,7 +234,7 @@ static int _rtl92d_fw_init(struct ieee80211_hw *hw) + rtl_read_byte(rtlpriv, FW_MAC1_READY)); + } + RT_TRACE(rtlpriv, COMP_FW, DBG_DMESG, +- "Polling FW ready fail!! REG_MCUFWDL:0x%08ul\n", ++ "Polling FW ready fail!! REG_MCUFWDL:0x%08x\n", + rtl_read_dword(rtlpriv, REG_MCUFWDL)); + return -1; + } +-- +2.20.1 + diff --git a/queue-4.4/s390-perf-return-error-when-debug_register-fails.patch b/queue-4.4/s390-perf-return-error-when-debug_register-fails.patch new file mode 100644 index 00000000000..825cb71c208 --- /dev/null +++ b/queue-4.4/s390-perf-return-error-when-debug_register-fails.patch @@ -0,0 +1,56 @@ +From be76f6b79bb236fd3c2fb4d7ba8f34dbb16a89fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Oct 2018 14:39:29 +0100 +Subject: s390/perf: Return error when debug_register fails + +From: Thomas Richter + +[ Upstream commit ec0c0bb489727de0d4dca6a00be6970ab8a3b30a ] + +Return an error when the function debug_register() fails allocating +the debug handle. +Also remove the registered debug handle when the initialization fails +later on. + +Signed-off-by: Thomas Richter +Reviewed-by: Hendrik Brueckner +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/perf_cpum_sf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index b79d51459cf25..874762a51c546 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -1616,14 +1616,17 @@ static int __init init_cpum_sampling_pmu(void) + } + + sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80); +- if (!sfdbg) ++ if (!sfdbg) { + pr_err("Registering for s390dbf failed\n"); ++ return -ENOMEM; ++ } + debug_register_view(sfdbg, &debug_sprintf_view); + + err = register_external_irq(EXT_IRQ_MEASURE_ALERT, + cpumf_measurement_alert); + if (err) { + pr_cpumsf_err(RS_INIT_FAILURE_ALRT); ++ debug_unregister(sfdbg); + goto out; + } + +@@ -1632,6 +1635,7 @@ static int __init init_cpum_sampling_pmu(void) + pr_cpumsf_err(RS_INIT_FAILURE_PERF); + unregister_external_irq(EXT_IRQ_MEASURE_ALERT, + cpumf_measurement_alert); ++ debug_unregister(sfdbg); + goto out; + } + perf_cpu_notifier(cpumf_pmu_notifier); +-- +2.20.1 + diff --git a/queue-4.4/sched-fair-don-t-increase-sd-balance_interval-on-new.patch b/queue-4.4/sched-fair-don-t-increase-sd-balance_interval-on-new.patch new file mode 100644 index 00000000000..1d5df15eed2 --- /dev/null +++ b/queue-4.4/sched-fair-don-t-increase-sd-balance_interval-on-new.patch @@ -0,0 +1,77 @@ +From fb09db8e099eeaecc0f96377a96f2c6b4b9a887e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 16:12:07 +0100 +Subject: sched/fair: Don't increase sd->balance_interval on newidle balance + +From: Valentin Schneider + +[ Upstream commit 3f130a37c442d5c4d66531b240ebe9abfef426b5 ] + +When load_balance() fails to move some load because of task affinity, +we end up increasing sd->balance_interval to delay the next periodic +balance in the hopes that next time we look, that annoying pinned +task(s) will be gone. + +However, idle_balance() pays no attention to sd->balance_interval, yet +it will still lead to an increase in balance_interval in case of +pinned tasks. + +If we're going through several newidle balances (e.g. we have a +periodic task), this can lead to a huge increase of the +balance_interval in a very small amount of time. + +To prevent that, don't increase the balance interval when going +through a newidle balance. + +This is a similar approach to what is done in commit 58b26c4c0257 +("sched: Increment cache_nice_tries only on periodic lb"), where we +disregard newidle balance and rely on periodic balance for more stable +results. + +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Cc: Dietmar.Eggemann@arm.com +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: patrick.bellasi@arm.com +Cc: vincent.guittot@linaro.org +Link: http://lkml.kernel.org/r/1537974727-30788-2-git-send-email-valentin.schneider@arm.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index cd2fb8384fbe3..d012681fb1abd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -7334,13 +7334,22 @@ static int load_balance(int this_cpu, struct rq *this_rq, + sd->nr_balance_failed = 0; + + out_one_pinned: ++ ld_moved = 0; ++ ++ /* ++ * idle_balance() disregards balance intervals, so we could repeatedly ++ * reach this code, which would lead to balance_interval skyrocketting ++ * in a short amount of time. Skip the balance_interval increase logic ++ * to avoid that. ++ */ ++ if (env.idle == CPU_NEWLY_IDLE) ++ goto out; ++ + /* tune up the balancing interval */ + if (((env.flags & LBF_ALL_PINNED) && + sd->balance_interval < MAX_PINNED_INTERVAL) || + (sd->balance_interval < sd->max_interval)) + sd->balance_interval *= 2; +- +- ld_moved = 0; + out: + return ld_moved; + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-sg_update_list.patch b/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-sg_update_list.patch new file mode 100644 index 00000000000..21d6e935e67 --- /dev/null +++ b/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-sg_update_list.patch @@ -0,0 +1,38 @@ +From 281d91522c341a8ef864c06134f8d324c86db0f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Oct 2018 16:17:15 +0200 +Subject: scsi: dc395x: fix DMA API usage in sg_update_list + +From: Christoph Hellwig + +[ Upstream commit 6c404a68bf83b4135a8a9aa1c388ebdf98e8ba7f ] + +We need to transfer device ownership to the CPU before we can manipulate +the mapped data. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/dc395x.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c +index 9da0ac360848f..830b2d2dcf206 100644 +--- a/drivers/scsi/dc395x.c ++++ b/drivers/scsi/dc395x.c +@@ -1972,6 +1972,11 @@ static void sg_update_list(struct ScsiReqBlk *srb, u32 left) + xferred -= psge->length; + } else { + /* Partial SG entry done */ ++ pci_dma_sync_single_for_cpu(srb->dcb-> ++ acb->dev, ++ srb->sg_bus_addr, ++ SEGMENTX_LEN, ++ PCI_DMA_TODEVICE); + psge->length -= xferred; + psge->address += xferred; + srb->sg_index = idx; +-- +2.20.1 + diff --git a/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-srb_done.patch b/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-srb_done.patch new file mode 100644 index 00000000000..4dc2f529948 --- /dev/null +++ b/queue-4.4/scsi-dc395x-fix-dma-api-usage-in-srb_done.patch @@ -0,0 +1,55 @@ +From 5f267c2fad57d59e0a27e27a17d46486419c777d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Oct 2018 16:17:14 +0200 +Subject: scsi: dc395x: fix dma API usage in srb_done + +From: Christoph Hellwig + +[ Upstream commit 3a5bd7021184dec2946f2a4d7a8943f8a5713e52 ] + +We can't just transfer ownership to the CPU and then unmap, as this will +break with swiotlb. + +Instead unmap the command and sense buffer a little earlier in the I/O +completion handler and get rid of the pci_dma_sync_sg_for_cpu call +entirely. + +Signed-off-by: Christoph Hellwig +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/dc395x.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c +index 5ee7f44cf869b..9da0ac360848f 100644 +--- a/drivers/scsi/dc395x.c ++++ b/drivers/scsi/dc395x.c +@@ -3450,14 +3450,12 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb, + } + } + +- if (dir != PCI_DMA_NONE && scsi_sg_count(cmd)) +- pci_dma_sync_sg_for_cpu(acb->dev, scsi_sglist(cmd), +- scsi_sg_count(cmd), dir); +- + ckc_only = 0; + /* Check Error Conditions */ + ckc_e: + ++ pci_unmap_srb(acb, srb); ++ + if (cmd->cmnd[0] == INQUIRY) { + unsigned char *base = NULL; + struct ScsiInqData *ptr; +@@ -3511,7 +3509,6 @@ static void srb_done(struct AdapterCtlBlk *acb, struct DeviceCtlBlk *dcb, + cmd, cmd->result); + srb_free_insert(acb, srb); + } +- pci_unmap_srb(acb, srb); + + cmd->scsi_done(cmd); + waiting_process_next(acb); +-- +2.20.1 + diff --git a/queue-4.4/scsi-ips-fix-missing-break-in-switch.patch b/queue-4.4/scsi-ips-fix-missing-break-in-switch.patch new file mode 100644 index 00000000000..437e3837f1d --- /dev/null +++ b/queue-4.4/scsi-ips-fix-missing-break-in-switch.patch @@ -0,0 +1,36 @@ +From a6dfcd54acc8402b3248af7ee5fa36afb9f5c98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 11:12:23 +0200 +Subject: scsi: ips: fix missing break in switch + +From: Gustavo A. R. Silva + +[ Upstream commit 5d25ff7a544889bc4b749fda31778d6a18dddbcb ] + +Add missing break statement in order to prevent the code from falling +through to case TEST_UNIT_READY. + +Addresses-Coverity-ID: 1357338 ("Missing break in switch") +Suggested-by: Martin K. Petersen +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ips.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ips.c b/drivers/scsi/ips.c +index 02cb76fd44208..6bbf2945a3e00 100644 +--- a/drivers/scsi/ips.c ++++ b/drivers/scsi/ips.c +@@ -3500,6 +3500,7 @@ ips_send_cmd(ips_ha_t * ha, ips_scb_t * scb) + + case START_STOP: + scb->scsi_cmd->result = DID_OK << 16; ++ break; + + case TEST_UNIT_READY: + case INQUIRY: +-- +2.20.1 + diff --git a/queue-4.4/scsi-isci-change-sci_controller_start_task-s-return-.patch b/queue-4.4/scsi-isci-change-sci_controller_start_task-s-return-.patch new file mode 100644 index 00000000000..211401e4a88 --- /dev/null +++ b/queue-4.4/scsi-isci-change-sci_controller_start_task-s-return-.patch @@ -0,0 +1,107 @@ +From 29625621ac874919bbc1a44c43ffc7122fdc6730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:12:00 -0700 +Subject: scsi: isci: Change sci_controller_start_task's return type to + sci_status + +From: Nathan Chancellor + +[ Upstream commit 362b5da3dfceada6e74ecdd7af3991bbe42c0c0f ] + +Clang warns when an enumerated type is implicitly converted to another. + +drivers/scsi/isci/request.c:3476:13: warning: implicit conversion from +enumeration type 'enum sci_task_status' to different enumeration type +'enum sci_status' [-Wenum-conversion] + status = sci_controller_start_task(ihost, + ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/scsi/isci/host.c:2744:10: warning: implicit conversion from +enumeration type 'enum sci_status' to different enumeration type 'enum +sci_task_status' [-Wenum-conversion] + return SCI_SUCCESS; + ~~~~~~ ^~~~~~~~~~~ +drivers/scsi/isci/host.c:2753:9: warning: implicit conversion from +enumeration type 'enum sci_status' to different enumeration type 'enum +sci_task_status' [-Wenum-conversion] + return status; + ~~~~~~ ^~~~~~ + +Avoid all of these implicit conversion by just making +sci_controller_start_task use sci_status. This silences +Clang and has no functional change since sci_task_status +has all of its values mapped to something in sci_status. + +Link: https://github.com/ClangBuiltLinux/linux/issues/153 +Signed-off-by: Nathan Chancellor +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/isci/host.c | 8 ++++---- + drivers/scsi/isci/host.h | 2 +- + drivers/scsi/isci/task.c | 4 ++-- + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/isci/host.c b/drivers/scsi/isci/host.c +index 609dafd661d14..da4583a2fa23e 100644 +--- a/drivers/scsi/isci/host.c ++++ b/drivers/scsi/isci/host.c +@@ -2717,9 +2717,9 @@ enum sci_status sci_controller_continue_io(struct isci_request *ireq) + * the task management request. + * @task_request: the handle to the task request object to start. + */ +-enum sci_task_status sci_controller_start_task(struct isci_host *ihost, +- struct isci_remote_device *idev, +- struct isci_request *ireq) ++enum sci_status sci_controller_start_task(struct isci_host *ihost, ++ struct isci_remote_device *idev, ++ struct isci_request *ireq) + { + enum sci_status status; + +@@ -2728,7 +2728,7 @@ enum sci_task_status sci_controller_start_task(struct isci_host *ihost, + "%s: SCIC Controller starting task from invalid " + "state\n", + __func__); +- return SCI_TASK_FAILURE_INVALID_STATE; ++ return SCI_FAILURE_INVALID_STATE; + } + + status = sci_remote_device_start_task(ihost, idev, ireq); +diff --git a/drivers/scsi/isci/host.h b/drivers/scsi/isci/host.h +index 22a9bb1abae14..15dc6e0d8deb0 100644 +--- a/drivers/scsi/isci/host.h ++++ b/drivers/scsi/isci/host.h +@@ -490,7 +490,7 @@ enum sci_status sci_controller_start_io( + struct isci_remote_device *idev, + struct isci_request *ireq); + +-enum sci_task_status sci_controller_start_task( ++enum sci_status sci_controller_start_task( + struct isci_host *ihost, + struct isci_remote_device *idev, + struct isci_request *ireq); +diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c +index 6dcaed0c1fc8c..fb6eba331ac6e 100644 +--- a/drivers/scsi/isci/task.c ++++ b/drivers/scsi/isci/task.c +@@ -258,7 +258,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost, + struct isci_tmf *tmf, unsigned long timeout_ms) + { + DECLARE_COMPLETION_ONSTACK(completion); +- enum sci_task_status status = SCI_TASK_FAILURE; ++ enum sci_status status = SCI_FAILURE; + struct isci_request *ireq; + int ret = TMF_RESP_FUNC_FAILED; + unsigned long flags; +@@ -301,7 +301,7 @@ static int isci_task_execute_tmf(struct isci_host *ihost, + /* start the TMF io. */ + status = sci_controller_start_task(ihost, idev, ireq); + +- if (status != SCI_TASK_SUCCESS) { ++ if (status != SCI_SUCCESS) { + dev_dbg(&ihost->pdev->dev, + "%s: start_io failed - status = 0x%x, request = %p\n", + __func__, +-- +2.20.1 + diff --git a/queue-4.4/scsi-isci-use-proper-enumerated-type-in-atapi_d2h_re.patch b/queue-4.4/scsi-isci-use-proper-enumerated-type-in-atapi_d2h_re.patch new file mode 100644 index 00000000000..ec1e61ec2a5 --- /dev/null +++ b/queue-4.4/scsi-isci-use-proper-enumerated-type-in-atapi_d2h_re.patch @@ -0,0 +1,55 @@ +From 2993130b3d0e8bf4b1d9e339bb21d2b182f49e44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Sep 2018 17:11:50 -0700 +Subject: scsi: isci: Use proper enumerated type in atapi_d2h_reg_frame_handler + +From: Nathan Chancellor + +[ Upstream commit e9e9a103528c7e199ead6e5374c9c52cf16b5802 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/scsi/isci/request.c:1629:13: warning: implicit conversion from +enumeration type 'enum sci_io_status' to different enumeration type +'enum sci_status' [-Wenum-conversion] + status = SCI_IO_FAILURE_RESPONSE_VALID; + ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/scsi/isci/request.c:1631:12: warning: implicit conversion from +enumeration type 'enum sci_io_status' to different enumeration type +'enum sci_status' [-Wenum-conversion] + status = SCI_IO_FAILURE_RESPONSE_VALID; + ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +status is of type sci_status but SCI_IO_FAILURE_RESPONSE_VALID is of +type sci_io_status. Use SCI_FAILURE_IO_RESPONSE_VALID, which is from +sci_status and has SCI_IO_FAILURE_RESPONSE_VALID's exact value since +that is what SCI_IO_FAILURE_RESPONSE_VALID is mapped to in the isci.h +file. + +Link: https://github.com/ClangBuiltLinux/linux/issues/153 +Signed-off-by: Nathan Chancellor +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/isci/request.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c +index cfd0084f1cd2b..224c9c60834cd 100644 +--- a/drivers/scsi/isci/request.c ++++ b/drivers/scsi/isci/request.c +@@ -1626,9 +1626,9 @@ static enum sci_status atapi_d2h_reg_frame_handler(struct isci_request *ireq, + + if (status == SCI_SUCCESS) { + if (ireq->stp.rsp.status & ATA_ERR) +- status = SCI_IO_FAILURE_RESPONSE_VALID; ++ status = SCI_FAILURE_IO_RESPONSE_VALID; + } else { +- status = SCI_IO_FAILURE_RESPONSE_VALID; ++ status = SCI_FAILURE_IO_RESPONSE_VALID; + } + + if (status != SCI_SUCCESS) { +-- +2.20.1 + diff --git a/queue-4.4/scsi-iscsi_tcp-explicitly-cast-param-in-iscsi_sw_tcp.patch b/queue-4.4/scsi-iscsi_tcp-explicitly-cast-param-in-iscsi_sw_tcp.patch new file mode 100644 index 00000000000..375d6d65b1c --- /dev/null +++ b/queue-4.4/scsi-iscsi_tcp-explicitly-cast-param-in-iscsi_sw_tcp.patch @@ -0,0 +1,48 @@ +From f9108144fbe73658d905ad4e81b85c735bc770eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Oct 2018 18:06:15 -0700 +Subject: scsi: iscsi_tcp: Explicitly cast param in iscsi_sw_tcp_host_get_param + +From: Nathan Chancellor + +[ Upstream commit 20054597f169090109fc3f0dfa1a48583f4178a4 ] + +Clang warns when one enumerated type is implicitly converted to another. + +drivers/scsi/iscsi_tcp.c:803:15: warning: implicit conversion from +enumeration type 'enum iscsi_host_param' to different enumeration type +'enum iscsi_param' [-Wenum-conversion] + &addr, param, buf); + ^~~~~ +1 warning generated. + +iscsi_conn_get_addr_param handles ISCSI_HOST_PARAM_IPADDRESS just fine +so add an explicit cast to iscsi_param to make it clear to Clang that +this is expected behavior. + +Link: https://github.com/ClangBuiltLinux/linux/issues/153 +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/iscsi_tcp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 0b8af186e7078..fccb8991bd5b7 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -788,7 +788,8 @@ static int iscsi_sw_tcp_host_get_param(struct Scsi_Host *shost, + return rc; + + return iscsi_conn_get_addr_param((struct sockaddr_storage *) +- &addr, param, buf); ++ &addr, ++ (enum iscsi_param)param, buf); + default: + return iscsi_host_get_param(shost, param, buf); + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-lpfc-fcoe-fix-link-down-issue-after-1000-link-b.patch b/queue-4.4/scsi-lpfc-fcoe-fix-link-down-issue-after-1000-link-b.patch new file mode 100644 index 00000000000..26625ae9ccf --- /dev/null +++ b/queue-4.4/scsi-lpfc-fcoe-fix-link-down-issue-after-1000-link-b.patch @@ -0,0 +1,132 @@ +From d71fb701350c8968e2ed5fd7d42ab60ef6d5631d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Oct 2018 13:41:06 -0700 +Subject: scsi: lpfc: fcoe: Fix link down issue after 1000+ link bounces + +From: James Smart + +[ Upstream commit 036cad1f1ac9ce03e2db94b8460f98eaf1e1ee4c ] + +On FCoE adapters, when running link bounce test in a loop, initiator +failed to login with switch switch and required driver reload to +recover. Switch reached a point where all subsequent FLOGIs would be +LS_RJT'd. Further testing showed the condition to be related to not +performing FCF discovery between FLOGI's. + +Fix by monitoring FLOGI failures and once a repeated error is seen +repeat FCF discovery. + +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 2 ++ + drivers/scsi/lpfc/lpfc_hbadisc.c | 20 ++++++++++++++++++++ + drivers/scsi/lpfc/lpfc_init.c | 2 +- + drivers/scsi/lpfc/lpfc_sli.c | 11 ++--------- + drivers/scsi/lpfc/lpfc_sli4.h | 1 + + 5 files changed, 26 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 82a690924f5eb..7ca8c2522c928 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1124,6 +1124,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + phba->fcf.fcf_flag &= ~FCF_DISCOVERY; + phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO); + spin_unlock_irq(&phba->hbalock); ++ phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } + if (!rc) { +@@ -1138,6 +1139,7 @@ lpfc_cmpl_els_flogi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + phba->fcf.fcf_flag &= ~FCF_DISCOVERY; + phba->hba_flag &= ~(FCF_RR_INPROG | HBA_DEVLOSS_TMO); + spin_unlock_irq(&phba->hbalock); ++ phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } + } +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index a67950908db17..d50db2004d21e 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -1966,6 +1966,26 @@ int lpfc_sli4_fcf_rr_next_proc(struct lpfc_vport *vport, uint16_t fcf_index) + "failover and change port state:x%x/x%x\n", + phba->pport->port_state, LPFC_VPORT_UNKNOWN); + phba->pport->port_state = LPFC_VPORT_UNKNOWN; ++ ++ if (!phba->fcf.fcf_redisc_attempted) { ++ lpfc_unregister_fcf(phba); ++ ++ rc = lpfc_sli4_redisc_fcf_table(phba); ++ if (!rc) { ++ lpfc_printf_log(phba, KERN_INFO, LOG_FIP, ++ "3195 Rediscover FCF table\n"); ++ phba->fcf.fcf_redisc_attempted = 1; ++ lpfc_sli4_clear_fcf_rr_bmask(phba); ++ } else { ++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP, ++ "3196 Rediscover FCF table " ++ "failed. Status:x%x\n", rc); ++ } ++ } else { ++ lpfc_printf_log(phba, KERN_WARNING, LOG_FIP, ++ "3197 Already rediscover FCF table " ++ "attempted. No more retry\n"); ++ } + goto stop_flogi_current_fcf; + } else { + lpfc_printf_log(phba, KERN_INFO, LOG_FIP | LOG_ELS, +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 60c21093f8656..7e06fd6127ccb 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -4376,7 +4376,7 @@ lpfc_sli4_async_fip_evt(struct lpfc_hba *phba, + break; + } + /* If fast FCF failover rescan event is pending, do nothing */ +- if (phba->fcf.fcf_flag & FCF_REDISC_EVT) { ++ if (phba->fcf.fcf_flag & (FCF_REDISC_EVT | FCF_REDISC_PEND)) { + spin_unlock_irq(&phba->hbalock); + break; + } +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index ad4f16ab7f7a2..523a1058078a5 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -16350,15 +16350,8 @@ lpfc_sli4_fcf_rr_next_index_get(struct lpfc_hba *phba) + goto initial_priority; + lpfc_printf_log(phba, KERN_WARNING, LOG_FIP, + "2844 No roundrobin failover FCF available\n"); +- if (next_fcf_index >= LPFC_SLI4_FCF_TBL_INDX_MAX) +- return LPFC_FCOE_FCF_NEXT_NONE; +- else { +- lpfc_printf_log(phba, KERN_WARNING, LOG_FIP, +- "3063 Only FCF available idx %d, flag %x\n", +- next_fcf_index, +- phba->fcf.fcf_pri[next_fcf_index].fcf_rec.flag); +- return next_fcf_index; +- } ++ ++ return LPFC_FCOE_FCF_NEXT_NONE; + } + + if (next_fcf_index < LPFC_SLI4_FCF_TBL_INDX_MAX && +diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h +index 1e916e16ce989..0ecf92c8a2882 100644 +--- a/drivers/scsi/lpfc/lpfc_sli4.h ++++ b/drivers/scsi/lpfc/lpfc_sli4.h +@@ -237,6 +237,7 @@ struct lpfc_fcf { + #define FCF_REDISC_EVT 0x100 /* FCF rediscovery event to worker thread */ + #define FCF_REDISC_FOV 0x200 /* Post FCF rediscovery fast failover */ + #define FCF_REDISC_PROG (FCF_REDISC_PEND | FCF_REDISC_EVT) ++ uint16_t fcf_redisc_attempted; + uint32_t addr_mode; + uint32_t eligible_fcf_cnt; + struct lpfc_fcf_rec current_rec; +-- +2.20.1 + diff --git a/queue-4.4/scsi-megaraid_sas-fix-msleep-granularity.patch b/queue-4.4/scsi-megaraid_sas-fix-msleep-granularity.patch new file mode 100644 index 00000000000..c9e21c61ee7 --- /dev/null +++ b/queue-4.4/scsi-megaraid_sas-fix-msleep-granularity.patch @@ -0,0 +1,46 @@ +From d2d003bec1424845a2dcbf074f1269d970ab1646 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 23:37:41 -0700 +Subject: scsi: megaraid_sas: Fix msleep granularity + +From: Shivasharan S + +[ Upstream commit 9155cf30a3c4ef97e225d6daddf9bd4b173267e8 ] + +In megasas_transition_to_ready() driver waits 180seconds for controller to +change FW state. Here we are calling msleep(1) in a loop for this. As +explained in timers-howto.txt, msleep(1) will actually sleep longer than +1ms. If a faulty controller is connected, we will end up waiting for much +more than 180 seconds causing unnecessary delays during load. + +Change the granularity of msleep() call from 1ms to 1000ms. + +Signed-off-by: Shivasharan S +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 5e0bac8de6381..7be968f60b590 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -3585,12 +3585,12 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr) + /* + * The cur_state should not last for more than max_wait secs + */ +- for (i = 0; i < (max_wait * 1000); i++) { ++ for (i = 0; i < max_wait; i++) { + curr_abs_state = instance->instancet-> + read_fw_status_reg(instance->reg_set); + + if (abs_state == curr_abs_state) { +- msleep(1); ++ msleep(1000); + } else + break; + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-mpt3sas-fix-driver-modifying-persistent-data-in.patch b/queue-4.4/scsi-mpt3sas-fix-driver-modifying-persistent-data-in.patch new file mode 100644 index 00000000000..a085ee6bcf4 --- /dev/null +++ b/queue-4.4/scsi-mpt3sas-fix-driver-modifying-persistent-data-in.patch @@ -0,0 +1,44 @@ +From 37b40711369a0b5b77bebd718cf4564bae3326a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 18:53:38 +0530 +Subject: scsi: mpt3sas: Fix driver modifying persistent data in Manufacturing + page11 + +From: Suganath Prabu + +[ Upstream commit 97f35194093362a63b33caba2485521ddabe2c95 ] + +Currently driver is modifying both current & NVRAM/persistent data in +Manufacturing page11. Driver should change only current copy of +Manufacturing page11. It should not modify the persistent data. + +So removed the section of code where driver is modifying the persistent +data of Manufacturing page11. + +Signed-off-by: Suganath Prabu +Reviewed-by: Bjorn Helgaas +Reviewed-by: Andy Shevchenko +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_config.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_config.c b/drivers/scsi/mpt3sas/mpt3sas_config.c +index a6914ec99cc04..56dc0e3be2ba2 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_config.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_config.c +@@ -677,10 +677,6 @@ mpt3sas_config_set_manufacturing_pg11(struct MPT3SAS_ADAPTER *ioc, + r = _config_request(ioc, &mpi_request, mpi_reply, + MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page, + sizeof(*config_page)); +- mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_WRITE_NVRAM; +- r = _config_request(ioc, &mpi_request, mpi_reply, +- MPT3_CONFIG_PAGE_DEFAULT_TIMEOUT, config_page, +- sizeof(*config_page)); + out: + return r; + } +-- +2.20.1 + diff --git a/queue-4.4/scsi-mpt3sas-fix-sync-cache-command-failure-during-d.patch b/queue-4.4/scsi-mpt3sas-fix-sync-cache-command-failure-during-d.patch new file mode 100644 index 00000000000..48c3ed336ca --- /dev/null +++ b/queue-4.4/scsi-mpt3sas-fix-sync-cache-command-failure-during-d.patch @@ -0,0 +1,87 @@ +From 30c6b3cc47e41602584d8980a42dff25e2b73ccd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Oct 2018 18:53:36 +0530 +Subject: scsi: mpt3sas: Fix Sync cache command failure during driver unload + +From: Suganath Prabu + +[ Upstream commit 9029a72500b95578a35877a43473b82cb0386c53 ] + +This is to fix SYNC CACHE and START STOP command failures with +DID_NO_CONNECT during driver unload. + +In driver's IO submission patch (i.e. in driver's .queuecommand()) driver +won't allow any SCSI commands to the IOC when ioc->remove_host flag is set +and hence SYNC CACHE commands which are issued to the target drives (where +write cache is enabled) during driver unload time is failed with +DID_NO_CONNECT status. + +Now modified the driver to allow SYNC CACHE and START STOP commands to IOC, +even when remove_host flag is set. + +Signed-off-by: Suganath Prabu +Reviewed-by: Bjorn Helgaas +Reviewed-by: Andy Shevchenko +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 36 +++++++++++++++++++++++++++- + 1 file changed, 35 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 7d67a68bcc624..8735e4257028a 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -3254,6 +3254,40 @@ _scsih_tm_tr_complete(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, + return _scsih_check_for_pending_tm(ioc, smid); + } + ++/** _scsih_allow_scmd_to_device - check whether scmd needs to ++ * issue to IOC or not. ++ * @ioc: per adapter object ++ * @scmd: pointer to scsi command object ++ * ++ * Returns true if scmd can be issued to IOC otherwise returns false. ++ */ ++inline bool _scsih_allow_scmd_to_device(struct MPT3SAS_ADAPTER *ioc, ++ struct scsi_cmnd *scmd) ++{ ++ ++ if (ioc->pci_error_recovery) ++ return false; ++ ++ if (ioc->hba_mpi_version_belonged == MPI2_VERSION) { ++ if (ioc->remove_host) ++ return false; ++ ++ return true; ++ } ++ ++ if (ioc->remove_host) { ++ ++ switch (scmd->cmnd[0]) { ++ case SYNCHRONIZE_CACHE: ++ case START_STOP: ++ return true; ++ default: ++ return false; ++ } ++ } ++ ++ return true; ++} + + /** + * _scsih_sas_control_complete - completion routine +@@ -3880,7 +3914,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + return 0; + } + +- if (ioc->pci_error_recovery || ioc->remove_host) { ++ if (!(_scsih_allow_scmd_to_device(ioc, scmd))) { + scmd->result = DID_NO_CONNECT << 16; + scmd->scsi_done(scmd); + return 0; +-- +2.20.1 + diff --git a/queue-4.4/selftests-ftrace-fix-to-test-kprobe-comm-arg-only-if.patch b/queue-4.4/selftests-ftrace-fix-to-test-kprobe-comm-arg-only-if.patch new file mode 100644 index 00000000000..0dd3af64401 --- /dev/null +++ b/queue-4.4/selftests-ftrace-fix-to-test-kprobe-comm-arg-only-if.patch @@ -0,0 +1,40 @@ +From 6f47e716848ec4c2253b19e6735e8c06c034ca0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Aug 2018 23:16:13 +0900 +Subject: selftests/ftrace: Fix to test kprobe $comm arg only if available + +From: Masami Hiramatsu + +[ Upstream commit 2452c96e617a0ff6fb2692e55217a3fa57a7322c ] + +Test $comm in kprobe-event argument syntax testcase +only if it is supported on the kernel because +$comm has been introduced 4.8 kernel. +So on older stable kernel, it should be skipped. + +Signed-off-by: Masami Hiramatsu +Signed-off-by: Shuah Khan (Samsung OSG) +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc +index 231bcd2c4eb59..1e7ac6f3362ff 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc +@@ -71,8 +71,11 @@ test_badarg "\$stackp" "\$stack0+10" "\$stack1-10" + echo "r ${PROBEFUNC} \$retval" > kprobe_events + ! echo "p ${PROBEFUNC} \$retval" > kprobe_events + ++# $comm was introduced in 4.8, older kernels reject it. ++if grep -A1 "fetcharg:" README | grep -q '\$comm' ; then + : "Comm access" + test_goodarg "\$comm" ++fi + + : "Indirect memory access" + test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \ +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index 8bd6ac28ce1..cacadc47080 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -4,3 +4,95 @@ net-sched-act_pedit-fix-warn-in-the-traffic-path.patch net-rtnetlink-prevent-underflows-in-do_setvfinfo.patch revert-fs-ocfs2-fix-possible-null-pointer-dereferences-in-ocfs2_xa_prepare_entry.patch mm-ksm.c-don-t-warn-if-page-is-still-mapped-in-remove_stable_node.patch +asus-wmi-create-quirk-for-airplane_mode-led.patch +asus-wmi-add-quirk_no_rfkill_wapf4-for-the-asus-x456.patch +asus-wmi-add-quirk_no_rfkill-for-the-asus-n552vw.patch +asus-wmi-add-quirk_no_rfkill-for-the-asus-u303lb.patch +asus-wmi-add-quirk_no_rfkill-for-the-asus-z550ma.patch +platform-x86-asus-wmi-filter-buggy-scan-codes-on-asu.patch +platform-x86-asus-wmi-fix-asus-ux303ub-brightness-is.patch +platform-x86-asus-wmi-set-specified-xusb2pr-value-fo.patch +asus-wmi-provide-access-to-als-control.patch +platform-x86-asus-wmi-try-to-set-als-by-default.patch +platform-x86-asus-nb-wmi-support-als-on-the-zenbook-.patch +platform-x86-asus-wmi-only-tell-ec-the-os-will-handl.patch +platform-x86-asus-wmi-add-serio_i8042-dependency.patch +mwifiex-fix-nl80211_tx_power_limited.patch +alsa-isight-fix-leak-of-reference-to-firewire-unit-i.patch +printk-fix-integer-overflow-in-setup_log_buf.patch +gfs2-fix-marking-bitmaps-non-full.patch +synclink_gt-fix-compat_ioctl.patch +powerpc-fix-signedness-bug-in-update_flash_db.patch +powerpc-eeh-fix-use-of-eeh_pe_keep-on-wrong-field.patch +brcmsmac-ap-mode-update-beacon-when-tim-changes.patch +spi-sh-msiof-fix-deferred-probing.patch +mmc-mediatek-fix-cannot-receive-new-request-when-msd.patch +btrfs-handle-error-of-get_old_root.patch +gsmi-fix-bug-in-append_to_eventlog-sysfs-handler.patch +misc-mic-fix-a-dma-pool-free-failure.patch +amiflop-clean-up-on-errors-during-setup.patch +scsi-ips-fix-missing-break-in-switch.patch +kvm-x86-fix-invvpid-and-invept-register-operand-size.patch +scsi-isci-use-proper-enumerated-type-in-atapi_d2h_re.patch +scsi-isci-change-sci_controller_start_task-s-return-.patch +scsi-iscsi_tcp-explicitly-cast-param-in-iscsi_sw_tcp.patch +clk-mmp2-fix-the-clock-id-for-sdh2_clk-and-sdh3_clk.patch +scsi-dc395x-fix-dma-api-usage-in-srb_done.patch +scsi-dc395x-fix-dma-api-usage-in-sg_update_list.patch +net-fix-warning-in-af_unix.patch +kprobes-x86-ptrace.h-make-regs_get_kernel_stack_nth-.patch +alsa-i2c-cs8427-fix-int-to-char-conversion.patch +macintosh-windfarm_smu_sat-fix-debug-output.patch +usb-misc-appledisplay-fix-backlight-update_status-re.patch +sunrpc-fix-a-compile-warning-for-cmpxchg64.patch +atm-zatm-fix-empty-body-clang-warnings.patch +s390-perf-return-error-when-debug_register-fails.patch +spi-omap2-mcspi-set-fifo-dma-trigger-level-to-word-l.patch +sparc-fix-parport-build-warnings.patch +ceph-fix-dentry-leak-in-ceph_readdir_prepopulate.patch +rtc-s35390a-change-buf-s-type-to-u8-in-s35390a_init.patch +misdn-fix-type-of-switch-control-variable-in-ctrl_te.patch +qlcnic-fix-a-return-in-qlcnic_dcb_get_capability.patch +mfd-mc13xxx-core-fix-pmic-shutdown-when-reading-adc-.patch +mfd-max8997-enale-irq-wakeup-unconditionally.patch +selftests-ftrace-fix-to-test-kprobe-comm-arg-only-if.patch +thermal-rcar_thermal-prevent-hardware-access-during-.patch +sparc64-rework-xchg-definition-to-avoid-warnings.patch +fs-ocfs2-dlm-dlmdebug.c-fix-a-sleep-in-atomic-contex.patch +mm-page-writeback.c-fix-range_cyclic-writeback-vs-wr.patch +um-make-line-tty-semantics-use-true-write-irq.patch +linux-bitmap.h-handle-constant-zero-size-bitmaps-cor.patch +linux-bitmap.h-fix-type-of-nbits-in-bitmap_shift_rig.patch +hfsplus-fix-bug-on-bnode-parent-update.patch +hfs-fix-bug-on-bnode-parent-update.patch +hfsplus-prevent-btree-data-loss-on-enospc.patch +hfs-prevent-btree-data-loss-on-enospc.patch +hfsplus-fix-return-value-of-hfsplus_get_block.patch +hfs-fix-return-value-of-hfs_get_block.patch +fs-hfs-extent.c-fix-array-out-of-bounds-read-of-arra.patch +igb-shorten-maximum-phc-timecounter-update-interval.patch +ntb_netdev-fix-sleep-time-mismatch.patch +ntb-intel-fix-return-value-for-ndev_vec_mask.patch +ocfs2-don-t-put-and-assigning-null-to-bh-allocated-o.patch +ocfs2-fix-clusters-leak-in-ocfs2_defrag_extent.patch +net-do-not-abort-bulk-send-on-bql-status.patch +sched-fair-don-t-increase-sd-balance_interval-on-new.patch +audit-print-empty-execve-args.patch +wlcore-fix-the-return-value-in-case-of-error-in-wlco.patch +rtl8xxxu-fix-missing-break-in-switch.patch +brcmsmac-never-log-tid-x-is-not-agg-able-by-default.patch +wireless-airo-potential-buffer-overflow-in-sprintf.patch +rtlwifi-rtl8192de-fix-misleading-reg_mcufwdl-informa.patch +scsi-mpt3sas-fix-sync-cache-command-failure-during-d.patch +scsi-mpt3sas-fix-driver-modifying-persistent-data-in.patch +scsi-megaraid_sas-fix-msleep-granularity.patch +scsi-lpfc-fcoe-fix-link-down-issue-after-1000-link-b.patch +dlm-fix-invalid-free.patch +dlm-don-t-leak-kernel-pointer-to-userspace.patch +net-bcmgenet-return-correct-value-ret-from-bcmgenet_.patch +sock-reset-dst-when-changing-sk_mark-via-setsockopt.patch +pinctrl-qcom-spmi-gpio-fix-gpio-hog-related-boot-iss.patch +pinctrl-zynq-use-define-directive-for-pin_config_io_.patch +pci-keystone-use-quirk-to-limit-mrrs-for-k2g.patch +spi-omap2-mcspi-fix-dma-and-fifo-event-trigger-size-.patch +ib-hfi1-ensure-full-gen3-speed-in-a-gen4-system.patch diff --git a/queue-4.4/sock-reset-dst-when-changing-sk_mark-via-setsockopt.patch b/queue-4.4/sock-reset-dst-when-changing-sk_mark-via-setsockopt.patch new file mode 100644 index 00000000000..d1c5e2a9d4b --- /dev/null +++ b/queue-4.4/sock-reset-dst-when-changing-sk_mark-via-setsockopt.patch @@ -0,0 +1,46 @@ +From 81fe0408661a01ae1b4953243dd3d07e5dbd58ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Nov 2018 08:13:35 -0600 +Subject: sock: Reset dst when changing sk_mark via setsockopt + +From: David Barmann + +[ Upstream commit 50254256f382c56bde87d970f3d0d02fdb76ec70 ] + +When setting the SO_MARK socket option, if the mark changes, the dst +needs to be reset so that a new route lookup is performed. + +This fixes the case where an application wants to change routing by +setting a new sk_mark. If this is done after some packets have already +been sent, the dst is cached and has no effect. + +Signed-off-by: David Barmann +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/sock.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 8aa4a5f895723..92d5f6232ec76 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -951,10 +951,12 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + clear_bit(SOCK_PASSSEC, &sock->flags); + break; + case SO_MARK: +- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) ++ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { + ret = -EPERM; +- else ++ } else if (val != sk->sk_mark) { + sk->sk_mark = val; ++ sk_dst_reset(sk); ++ } + break; + + case SO_RXQ_OVFL: +-- +2.20.1 + diff --git a/queue-4.4/sparc-fix-parport-build-warnings.patch b/queue-4.4/sparc-fix-parport-build-warnings.patch new file mode 100644 index 00000000000..2b0c9adb9bf --- /dev/null +++ b/queue-4.4/sparc-fix-parport-build-warnings.patch @@ -0,0 +1,50 @@ +From 208777b0e2615a8a7ef7a3ead8f7f665396550da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Oct 2018 10:52:52 -0700 +Subject: sparc: Fix parport build warnings. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David S. Miller + +[ Upstream commit 46b8306480fb424abd525acc1763da1c63a27d8a ] + +If PARPORT_PC_FIFO is not enabled, do not provide the dma lock +macros and lock definition. Otherwise: + +./arch/sparc/include/asm/parport.h:24:24: warning: ‘dma_spin_lock’ defined but not used [-Wunused-variable] + static DEFINE_SPINLOCK(dma_spin_lock); + ^~~~~~~~~~~~~ +./include/linux/spinlock_types.h:81:39: note: in definition of macro ‘DEFINE_SPINLOCK’ + #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/parport.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/sparc/include/asm/parport.h b/arch/sparc/include/asm/parport.h +index f005ccac91cc9..e87c0f81b700e 100644 +--- a/arch/sparc/include/asm/parport.h ++++ b/arch/sparc/include/asm/parport.h +@@ -20,6 +20,7 @@ + */ + #define HAS_DMA + ++#ifdef CONFIG_PARPORT_PC_FIFO + static DEFINE_SPINLOCK(dma_spin_lock); + + #define claim_dma_lock() \ +@@ -30,6 +31,7 @@ static DEFINE_SPINLOCK(dma_spin_lock); + + #define release_dma_lock(__flags) \ + spin_unlock_irqrestore(&dma_spin_lock, __flags); ++#endif + + static struct sparc_ebus_info { + struct ebus_dma_info info; +-- +2.20.1 + diff --git a/queue-4.4/sparc64-rework-xchg-definition-to-avoid-warnings.patch b/queue-4.4/sparc64-rework-xchg-definition-to-avoid-warnings.patch new file mode 100644 index 00000000000..6b681633cbb --- /dev/null +++ b/queue-4.4/sparc64-rework-xchg-definition-to-avoid-warnings.patch @@ -0,0 +1,51 @@ +From 8999d6d727f311967b9fdf3889c9cc7d3ee9e354 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Oct 2018 15:39:49 -0700 +Subject: sparc64: Rework xchg() definition to avoid warnings. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: David S. Miller + +[ Upstream commit 6c2fc9cddc1ffdef8ada1dc8404e5affae849953 ] + +Such as: + +fs/ocfs2/file.c: In function ‘ocfs2_file_write_iter’: +./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value] + #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) + +and + +drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c: In function ‘ixgbevf_xdp_setup’: +./arch/sparc/include/asm/cmpxchg_64.h:55:22: warning: value computed is not used [-Wunused-value] + #define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) + +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/sparc/include/asm/cmpxchg_64.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/sparc/include/asm/cmpxchg_64.h b/arch/sparc/include/asm/cmpxchg_64.h +index faa2f61058c27..92f0a46ace78e 100644 +--- a/arch/sparc/include/asm/cmpxchg_64.h ++++ b/arch/sparc/include/asm/cmpxchg_64.h +@@ -40,7 +40,12 @@ static inline unsigned long xchg64(__volatile__ unsigned long *m, unsigned long + return val; + } + +-#define xchg(ptr,x) ((__typeof__(*(ptr)))__xchg((unsigned long)(x),(ptr),sizeof(*(ptr)))) ++#define xchg(ptr,x) \ ++({ __typeof__(*(ptr)) __ret; \ ++ __ret = (__typeof__(*(ptr))) \ ++ __xchg((unsigned long)(x), (ptr), sizeof(*(ptr))); \ ++ __ret; \ ++}) + + void __xchg_called_with_bad_pointer(void); + +-- +2.20.1 + diff --git a/queue-4.4/spi-omap2-mcspi-fix-dma-and-fifo-event-trigger-size-.patch b/queue-4.4/spi-omap2-mcspi-fix-dma-and-fifo-event-trigger-size-.patch new file mode 100644 index 00000000000..d76e43b8876 --- /dev/null +++ b/queue-4.4/spi-omap2-mcspi-fix-dma-and-fifo-event-trigger-size-.patch @@ -0,0 +1,49 @@ +From 28876faf7263f727353718dafcfb84ba8e739163 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jan 2019 12:28:32 +0530 +Subject: spi: omap2-mcspi: Fix DMA and FIFO event trigger size mismatch + +From: Vignesh R + +[ Upstream commit baf8b9f8d260c55a86405f70a384c29cda888476 ] + +Commit b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length") +broke SPI transfers where bits_per_word != 8. This is because of +mimsatch between McSPI FIFO level event trigger size (SPI word length) and +DMA request size(word length * maxburst). This leads to data +corruption, lockup and errors like: + + spi1.0: EOW timed out + +Fix this by setting DMA maxburst size to 1 so that +McSPI FIFO level event trigger size matches DMA request size. + +Fixes: b682cffa3ac6 ("spi: omap2-mcspi: Set FIFO DMA trigger level to word length") +Cc: stable@vger.kernel.org +Reported-by: David Lechner +Tested-by: David Lechner +Signed-off-by: Vignesh R +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 2e35fc735ba6a..79fa237f76c42 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -593,8 +593,8 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer) + cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0; + cfg.src_addr_width = width; + cfg.dst_addr_width = width; +- cfg.src_maxburst = es; +- cfg.dst_maxburst = es; ++ cfg.src_maxburst = 1; ++ cfg.dst_maxburst = 1; + + rx = xfer->rx_buf; + tx = xfer->tx_buf; +-- +2.20.1 + diff --git a/queue-4.4/spi-omap2-mcspi-set-fifo-dma-trigger-level-to-word-l.patch b/queue-4.4/spi-omap2-mcspi-set-fifo-dma-trigger-level-to-word-l.patch new file mode 100644 index 00000000000..8084cd378b3 --- /dev/null +++ b/queue-4.4/spi-omap2-mcspi-set-fifo-dma-trigger-level-to-word-l.patch @@ -0,0 +1,112 @@ +From fb623e4b34fa183509028cf72ae4a22ce2c544e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Oct 2018 12:08:28 +0530 +Subject: spi: omap2-mcspi: Set FIFO DMA trigger level to word length + +From: Vignesh R + +[ Upstream commit b682cffa3ac6d9d9e16e9b413c45caee3b391fab ] + +McSPI has 32 byte FIFO in Transmit-Receive mode. Current code tries to +configuration FIFO watermark level for DMA trigger to be GCD of transfer +length and max FIFO size which would mean trigger level may be set to 32 +for transmit-receive mode if length is aligned. This does not work in +case of SPI slave mode where FIFO always needs to have data ready +whenever master starts the clock. With DMA trigger size of 32 there will +be a small window during slave TX where DMA is still putting data into +FIFO but master would have started clock for next byte, resulting in +shifting out of stale data. Similarly, on Slave RX side there may be RX +FIFO overflow +Fix this by setting FIFO watermark for DMA trigger to word +length. This means DMA is triggered as soon as FIFO has space for word +length bytes and DMA would make sure FIFO is almost always full +therefore improving FIFO occupancy in both master and slave mode. + +Signed-off-by: Vignesh R +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 83b53cd956aa1..2e35fc735ba6a 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -301,7 +301,7 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi, + struct omap2_mcspi_cs *cs = spi->controller_state; + struct omap2_mcspi *mcspi; + unsigned int wcnt; +- int max_fifo_depth, fifo_depth, bytes_per_word; ++ int max_fifo_depth, bytes_per_word; + u32 chconf, xferlevel; + + mcspi = spi_master_get_devdata(master); +@@ -317,10 +317,6 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi, + else + max_fifo_depth = OMAP2_MCSPI_MAX_FIFODEPTH; + +- fifo_depth = gcd(t->len, max_fifo_depth); +- if (fifo_depth < 2 || fifo_depth % bytes_per_word != 0) +- goto disable_fifo; +- + wcnt = t->len / bytes_per_word; + if (wcnt > OMAP2_MCSPI_MAX_FIFOWCNT) + goto disable_fifo; +@@ -328,16 +324,17 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi, + xferlevel = wcnt << 16; + if (t->rx_buf != NULL) { + chconf |= OMAP2_MCSPI_CHCONF_FFER; +- xferlevel |= (fifo_depth - 1) << 8; ++ xferlevel |= (bytes_per_word - 1) << 8; + } ++ + if (t->tx_buf != NULL) { + chconf |= OMAP2_MCSPI_CHCONF_FFET; +- xferlevel |= fifo_depth - 1; ++ xferlevel |= bytes_per_word - 1; + } + + mcspi_write_reg(master, OMAP2_MCSPI_XFERLEVEL, xferlevel); + mcspi_write_chconf0(spi, chconf); +- mcspi->fifo_depth = fifo_depth; ++ mcspi->fifo_depth = max_fifo_depth; + + return; + } +@@ -569,7 +566,6 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer) + struct dma_slave_config cfg; + enum dma_slave_buswidth width; + unsigned es; +- u32 burst; + void __iomem *chstat_reg; + void __iomem *irqstat_reg; + int wait_res; +@@ -591,22 +587,14 @@ omap2_mcspi_txrx_dma(struct spi_device *spi, struct spi_transfer *xfer) + } + + count = xfer->len; +- burst = 1; +- +- if (mcspi->fifo_depth > 0) { +- if (count > mcspi->fifo_depth) +- burst = mcspi->fifo_depth / es; +- else +- burst = count / es; +- } + + memset(&cfg, 0, sizeof(cfg)); + cfg.src_addr = cs->phys + OMAP2_MCSPI_RX0; + cfg.dst_addr = cs->phys + OMAP2_MCSPI_TX0; + cfg.src_addr_width = width; + cfg.dst_addr_width = width; +- cfg.src_maxburst = burst; +- cfg.dst_maxburst = burst; ++ cfg.src_maxburst = es; ++ cfg.dst_maxburst = es; + + rx = xfer->rx_buf; + tx = xfer->tx_buf; +-- +2.20.1 + diff --git a/queue-4.4/spi-sh-msiof-fix-deferred-probing.patch b/queue-4.4/spi-sh-msiof-fix-deferred-probing.patch new file mode 100644 index 00000000000..50fcdeea61a --- /dev/null +++ b/queue-4.4/spi-sh-msiof-fix-deferred-probing.patch @@ -0,0 +1,41 @@ +From 340f3835388d05e52b2c22a75e2ba3909cfcc14f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 22:48:22 +0300 +Subject: spi: sh-msiof: fix deferred probing + +From: Sergei Shtylyov + +[ Upstream commit f34c6e6257aa477cdfe7e9bbbecd3c5648ecda69 ] + +Since commit 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +platform_get_irq() can return -EPROBE_DEFER. However, the driver overrides +an error returned by that function with -ENOENT which breaks the deferred +probing. Propagate upstream an error code returned by platform_get_irq() +and remove the bogus "platform" from the error message, while at it... + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergei Shtylyov +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sh-msiof.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 03b566848da63..b4f136d04a2b1 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -1198,8 +1198,8 @@ static int sh_msiof_spi_probe(struct platform_device *pdev) + + i = platform_get_irq(pdev, 0); + if (i < 0) { +- dev_err(&pdev->dev, "cannot get platform IRQ\n"); +- ret = -ENOENT; ++ dev_err(&pdev->dev, "cannot get IRQ\n"); ++ ret = i; + goto err1; + } + +-- +2.20.1 + diff --git a/queue-4.4/sunrpc-fix-a-compile-warning-for-cmpxchg64.patch b/queue-4.4/sunrpc-fix-a-compile-warning-for-cmpxchg64.patch new file mode 100644 index 00000000000..9eb27b4f5ae --- /dev/null +++ b/queue-4.4/sunrpc-fix-a-compile-warning-for-cmpxchg64.patch @@ -0,0 +1,30 @@ +From e56143fe59605bcf0d7c9f38acb0ba084f88b458 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Oct 2018 17:03:56 -0400 +Subject: SUNRPC: Fix a compile warning for cmpxchg64() + +From: Trond Myklebust + +[ Upstream commit e732f4485a150492b286f3efc06f9b34dd6b9995 ] + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/gss_krb5_seal.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/auth_gss/gss_krb5_seal.c b/net/sunrpc/auth_gss/gss_krb5_seal.c +index 1d74d653e6c05..ad0dcb69395d7 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_seal.c ++++ b/net/sunrpc/auth_gss/gss_krb5_seal.c +@@ -63,6 +63,7 @@ + #include + #include + #include ++#include + + #if IS_ENABLED(CONFIG_SUNRPC_DEBUG) + # define RPCDBG_FACILITY RPCDBG_AUTH +-- +2.20.1 + diff --git a/queue-4.4/synclink_gt-fix-compat_ioctl.patch b/queue-4.4/synclink_gt-fix-compat_ioctl.patch new file mode 100644 index 00000000000..abd99a5523b --- /dev/null +++ b/queue-4.4/synclink_gt-fix-compat_ioctl.patch @@ -0,0 +1,62 @@ +From 237305dd04521bc7510cd58455bb75ee57534fd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Sep 2018 20:57:18 -0400 +Subject: synclink_gt(): fix compat_ioctl() + +From: Al Viro + +[ Upstream commit 27230e51349fde075598c1b59d15e1ff802f3f6e ] + +compat_ptr() for pointer-taking ones... + +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + drivers/tty/synclink_gt.c | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/drivers/tty/synclink_gt.c b/drivers/tty/synclink_gt.c +index 6fc39fbfc2755..b5145e8bdf0a2 100644 +--- a/drivers/tty/synclink_gt.c ++++ b/drivers/tty/synclink_gt.c +@@ -1192,14 +1192,13 @@ static long slgt_compat_ioctl(struct tty_struct *tty, + unsigned int cmd, unsigned long arg) + { + struct slgt_info *info = tty->driver_data; +- int rc = -ENOIOCTLCMD; ++ int rc; + + if (sanity_check(info, tty->name, "compat_ioctl")) + return -ENODEV; + DBGINFO(("%s compat_ioctl() cmd=%08X\n", info->device_name, cmd)); + + switch (cmd) { +- + case MGSL_IOCSPARAMS32: + rc = set_params32(info, compat_ptr(arg)); + break; +@@ -1219,18 +1218,11 @@ static long slgt_compat_ioctl(struct tty_struct *tty, + case MGSL_IOCWAITGPIO: + case MGSL_IOCGXSYNC: + case MGSL_IOCGXCTRL: +- case MGSL_IOCSTXIDLE: +- case MGSL_IOCTXENABLE: +- case MGSL_IOCRXENABLE: +- case MGSL_IOCTXABORT: +- case TIOCMIWAIT: +- case MGSL_IOCSIF: +- case MGSL_IOCSXSYNC: +- case MGSL_IOCSXCTRL: +- rc = ioctl(tty, cmd, arg); ++ rc = ioctl(tty, cmd, (unsigned long)compat_ptr(arg)); + break; ++ default: ++ rc = ioctl(tty, cmd, arg); + } +- + DBGINFO(("%s compat_ioctl() cmd=%08X rc=%d\n", info->device_name, cmd, rc)); + return rc; + } +-- +2.20.1 + diff --git a/queue-4.4/thermal-rcar_thermal-prevent-hardware-access-during-.patch b/queue-4.4/thermal-rcar_thermal-prevent-hardware-access-during-.patch new file mode 100644 index 00000000000..f9de6228093 --- /dev/null +++ b/queue-4.4/thermal-rcar_thermal-prevent-hardware-access-during-.patch @@ -0,0 +1,49 @@ +From df9d9c287fc9b5d852582f63a6f81f0ca17ff06f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Oct 2018 09:20:15 +0200 +Subject: thermal: rcar_thermal: Prevent hardware access during system suspend +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 3a31386217628ffe2491695be2db933c25dde785 ] + +On r8a7791/koelsch, sometimes the following message is printed during +system suspend: + + rcar_thermal e61f0000.thermal: thermal sensor was broken + +This happens if the workqueue runs while the device is already +suspended. Fix this by using the freezable system workqueue instead, +cfr. commit 51e20d0e3a60cf46 ("thermal: Prevent polling from happening +during system suspend"). + +Fixes: e0a5172e9eec7f0d ("thermal: rcar: add interrupt support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Signed-off-by: Eduardo Valentin +Signed-off-by: Sasha Levin +--- + drivers/thermal/rcar_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c +index 13d01edc7a043..487c5cd7516c0 100644 +--- a/drivers/thermal/rcar_thermal.c ++++ b/drivers/thermal/rcar_thermal.c +@@ -350,8 +350,8 @@ static irqreturn_t rcar_thermal_irq(int irq, void *data) + rcar_thermal_for_each_priv(priv, common) { + if (rcar_thermal_had_changed(priv, status)) { + rcar_thermal_irq_disable(priv); +- schedule_delayed_work(&priv->work, +- msecs_to_jiffies(300)); ++ queue_delayed_work(system_freezable_wq, &priv->work, ++ msecs_to_jiffies(300)); + } + } + +-- +2.20.1 + diff --git a/queue-4.4/um-make-line-tty-semantics-use-true-write-irq.patch b/queue-4.4/um-make-line-tty-semantics-use-true-write-irq.patch new file mode 100644 index 00000000000..0b224e0ffe1 --- /dev/null +++ b/queue-4.4/um-make-line-tty-semantics-use-true-write-irq.patch @@ -0,0 +1,41 @@ +From d3e7d0ae25b5612fdae51d2fbf18bc0f7423e71c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Sep 2018 08:47:13 +0100 +Subject: um: Make line/tty semantics use true write IRQ + +From: Anton Ivanov + +[ Upstream commit 917e2fd2c53eb3c4162f5397555cbd394390d4bc ] + +This fixes a long standing bug where large amounts of output +could freeze the tty (most commonly seen on stdio console). +While the bug has always been there it became more pronounced +after moving to the new interrupt controller. + +The line semantics are now changed to have true IRQ write +semantics which should further improve the tty/line subsystem +stability and performance + +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/line.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c +index 62087028a9ce1..d2ad45c101137 100644 +--- a/arch/um/drivers/line.c ++++ b/arch/um/drivers/line.c +@@ -260,7 +260,7 @@ static irqreturn_t line_write_interrupt(int irq, void *data) + if (err == 0) { + spin_unlock(&line->lock); + return IRQ_NONE; +- } else if (err < 0) { ++ } else if ((err < 0) && (err != -EAGAIN)) { + line->head = line->buffer; + line->tail = line->buffer; + } +-- +2.20.1 + diff --git a/queue-4.4/usb-misc-appledisplay-fix-backlight-update_status-re.patch b/queue-4.4/usb-misc-appledisplay-fix-backlight-update_status-re.patch new file mode 100644 index 00000000000..b183a32bb42 --- /dev/null +++ b/queue-4.4/usb-misc-appledisplay-fix-backlight-update_status-re.patch @@ -0,0 +1,50 @@ +From a7539b7d34063b7c1d7afc54ada58d2343712dcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 14:20:08 +0200 +Subject: USB: misc: appledisplay: fix backlight update_status return code + +From: Mattias Jacobsson <2pi@mok.nu> + +[ Upstream commit 090158555ff8d194a98616034100b16697dd80d0 ] + +Upon success the update_status handler returns a positive number +corresponding to the number of bytes transferred by usb_control_msg. +However the return code of the update_status handler should indicate if +an error occurred(negative) or how many bytes of the user's input to sysfs +that was consumed. Return code zero indicates all bytes were consumed. + +The bug can for example result in the update_status handler being called +twice, the second time with only the "unconsumed" part of the user's input +to sysfs. Effectively setting an incorrect brightness. + +Change the update_status handler to return zero for all successful +transactions and forward usb_control_msg's error code upon failure. + +Signed-off-by: Mattias Jacobsson <2pi@mok.nu> +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/misc/appledisplay.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c +index 993f4da065c3a..dabd1077d03c4 100644 +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -161,8 +161,11 @@ static int appledisplay_bl_update_status(struct backlight_device *bd) + pdata->msgdata, 2, + ACD_USB_TIMEOUT); + mutex_unlock(&pdata->sysfslock); +- +- return retval; ++ ++ if (retval < 0) ++ return retval; ++ else ++ return 0; + } + + static int appledisplay_bl_get_brightness(struct backlight_device *bd) +-- +2.20.1 + diff --git a/queue-4.4/wireless-airo-potential-buffer-overflow-in-sprintf.patch b/queue-4.4/wireless-airo-potential-buffer-overflow-in-sprintf.patch new file mode 100644 index 00000000000..ad592700e38 --- /dev/null +++ b/queue-4.4/wireless-airo-potential-buffer-overflow-in-sprintf.patch @@ -0,0 +1,40 @@ +From ddee1c435ed0a043cdc41cb6423daba905c6558a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Oct 2018 11:33:34 +0300 +Subject: wireless: airo: potential buffer overflow in sprintf() + +From: Dan Carpenter + +[ Upstream commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac ] + +It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes +of the ssid, but we accidentally use "%*s" (width) instead of "%.*s" +(precision) so if the ssid doesn't have a NUL terminator this could lead +to an overflow. + +Static analysis. Not tested. + +Fixes: e174961ca1a0 ("net: convert print_mac to %pM") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/airo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c +index 17c40f06f13e5..82d24f2b9c190 100644 +--- a/drivers/net/wireless/airo.c ++++ b/drivers/net/wireless/airo.c +@@ -5484,7 +5484,7 @@ static int proc_BSSList_open( struct inode *inode, struct file *file ) { + we have to add a spin lock... */ + rc = readBSSListRid(ai, doLoseSync, &BSSList_rid); + while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) { +- ptr += sprintf(ptr, "%pM %*s rssi = %d", ++ ptr += sprintf(ptr, "%pM %.*s rssi = %d", + BSSList_rid.bssid, + (int)BSSList_rid.ssidLen, + BSSList_rid.ssid, +-- +2.20.1 + diff --git a/queue-4.4/wlcore-fix-the-return-value-in-case-of-error-in-wlco.patch b/queue-4.4/wlcore-fix-the-return-value-in-case-of-error-in-wlco.patch new file mode 100644 index 00000000000..1dcf0426f8e --- /dev/null +++ b/queue-4.4/wlcore-fix-the-return-value-in-case-of-error-in-wlco.patch @@ -0,0 +1,41 @@ +From 9622d24fc41599ce93defcc9e0734de8b2c69ad4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Oct 2018 09:39:40 +0200 +Subject: wlcore: Fix the return value in case of error in + 'wlcore_vendor_cmd_smart_config_start()' + +From: Christophe JAILLET + +[ Upstream commit 3419348a97bcc256238101129d69b600ceb5cc70 ] + +We return 0 unconditionally at the end of +'wlcore_vendor_cmd_smart_config_start()'. +However, 'ret' is set to some error codes in several error handling paths +and we already return some error codes at the beginning of the function. + +Return 'ret' instead to propagate the error code. + +Fixes: 80ff8063e87c ("wlcore: handle smart config vendor commands") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ti/wlcore/vendor_cmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ti/wlcore/vendor_cmd.c b/drivers/net/wireless/ti/wlcore/vendor_cmd.c +index fd4e9ba176c9b..332a3a5c1c900 100644 +--- a/drivers/net/wireless/ti/wlcore/vendor_cmd.c ++++ b/drivers/net/wireless/ti/wlcore/vendor_cmd.c +@@ -66,7 +66,7 @@ wlcore_vendor_cmd_smart_config_start(struct wiphy *wiphy, + out: + mutex_unlock(&wl->mutex); + +- return 0; ++ return ret; + } + + static int +-- +2.20.1 +