From: Greg Kroah-Hartman Date: Thu, 9 Nov 2017 09:08:58 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v3.18.81~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2fee6192632037f812ad519d9eef7e75a4c8e1d3;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: adv7604-initialize-drive-strength-to-default-when-using-dt.patch apparmor-fix-undefined-reference-to-aa_g_hash_policy.patch arm-dts-imx53-qsb-common-fix-fec-pinmux-config.patch arm-dts-stih410-family-fix-wrong-parent-clock-frequency.patch arm-omap2plus_defconfig-fix-probe-errors-on-uarts-5-and-6.patch arm64-dma-mapping-only-swizzle-dma-ops-for-iommu_domain_dma.patch asoc-sunxi-add-bindings-for-sun8i-to-spdif.patch brcmfmac-setup-wiphy-bands-after-registering-it-first.patch clk-mvebu-adjust-ap806-cpu-clock-frequencies-to-production-chip.patch clk-samsung-exynos5433-add-ids-for-phyclk_mipidphy0_-clocks.patch crypto-vmx-disable-preemption-to-enable-vsx-in-aes_ctr.c.patch cxl-force-psl-data-cache-flush-during-device-shutdown.patch drm-drm_minor_register-clean-up-debugfs-on-failure.patch drm-mali-dp-fix-lx_control-register-fields-clobber.patch dt-bindings-add-lego-mindstorms-ev3-compatible-specification.patch dt-bindings-add-vendor-prefix-for-lego.patch dt-bindings-clockgen-add-compatible-string-for-ls1012a.patch edac-amd64-add-x86cpuid-sanity-check-during-init.patch edac-amd64-save-and-return-err-code-from-probe_one_instance.patch ib-ipoib-change-list_del-to-list_del_init-in-the-tx-object.patch ib-rxe-fix-reference-leaks-in-memory-key-invalidation-code.patch iio-magnetometer-mag3110-claim-direct-mode-during-raw-writes.patch iio-pressure-ms5611-claim-direct-mode-during-oversampling-changes.patch iio-proximity-sx9500-claim-direct-mode-during-raw-proximity-reads.patch iio-trigger-free-trigger-resource-correctly.patch input-mpr121-handle-multiple-bits-change-of-status-register.patch input-mpr121-set-missing-event-capability.patch iommu-arm-smmu-v3-clear-prior-settings-when-updating-stes.patch ipsec-do-not-ignore-crypto-err-in-ah4-input.patch kvm-ppc-book-3s-xics-correct-the-real-mode-icp-rejecting-counter.patch libertas-fix-improper-return-value.patch net-dsa-select-net_switchdev.patch netfilter-nft_meta-deal-with-packet_loopback-in-netdev-family.patch pci-mvebu-handle-changes-to-the-bridge-windows-while-enabled.patch phy-increase-size-of-mii_bus_id_size-and-bus_id.patch pinctrl-baytrail-fix-debugfs-offset-output.patch pm-opp-error-out-on-failing-to-add-static-opps-for-v1-bindings.patch powerpc-corenet-explicitly-disable-the-sdhc-controller-on-kmcoge4.patch rt2800usb-mark-tx-failure-on-timeout.patch s390-qeth-fix-retrieval-of-vipa-and-proxy-arp-addresses.patch s390-qeth-issue-startlan-as-first-ipa-command.patch s390-topology-make-topology-off-parameter-work.patch sched-core-add-missing-update_rq_clock-call-in-sched_move_task.patch sched-cputime-powerpc32-fix-stale-scaled-stime-on-context-switch.patch serial-sh-sci-fix-register-offsets-for-the-irda-serial-port.patch usb-hcd-initialize-hcd-flags-to-0-when-rm-hcd.patch video-fbdev-pmag-ba-fb-remove-bad-__init-annotation.patch wcn36xx-don-t-use-the-destroyed-hal_mutex.patch xen-netback-set-default-upper-limit-of-tx-rx-queues-to-8.patch --- diff --git a/queue-4.9/adv7604-initialize-drive-strength-to-default-when-using-dt.patch b/queue-4.9/adv7604-initialize-drive-strength-to-default-when-using-dt.patch new file mode 100644 index 00000000000..cecdf927be0 --- /dev/null +++ b/queue-4.9/adv7604-initialize-drive-strength-to-default-when-using-dt.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Lars-Peter Clausen +Date: Tue, 29 Nov 2016 09:23:48 -0200 +Subject: [media] adv7604: Initialize drive strength to default when using DT + +From: Lars-Peter Clausen + + +[ Upstream commit da8892d410db224d9a24104529794e6e37e0c100 ] + +The adv7604 driver platform data contains fields for configuring the drive +strength of the output pins. When probing the driver through DT these +fields are not explicitly initialized, which means they are left at 0. This +is a reserved setting for the drive strength configuration though and can +cause signal integrity issues. + +Whether these signal integrity issues are visible depends on the PCB +specifics (e.g. the higher the load capacitance for the output the more +visible the issue). But it has been observed on existing solutions at high +pixel clock rates. + +Initialize the drive strength settings to the power-on-reset value of the +device when probing through devicetree to avoid this issue. + +Fixes: 0e158be0162b ("adv7604: Add DT support") + +Signed-off-by: Lars-Peter Clausen +Reviewed-by: Laurent Pinchart +Tested-by: Niklas Söderlund +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/i2c/adv7604.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -3118,6 +3118,9 @@ static int adv76xx_parse_dt(struct adv76 + state->pdata.blank_data = 1; + state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0; + state->pdata.bus_order = ADV7604_BUS_ORDER_RGB; ++ state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH; ++ state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH; ++ state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH; + + return 0; + } diff --git a/queue-4.9/apparmor-fix-undefined-reference-to-aa_g_hash_policy.patch b/queue-4.9/apparmor-fix-undefined-reference-to-aa_g_hash_policy.patch new file mode 100644 index 00000000000..25093450955 --- /dev/null +++ b/queue-4.9/apparmor-fix-undefined-reference-to-aa_g_hash_policy.patch @@ -0,0 +1,36 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: John Johansen +Date: Mon, 16 Jan 2017 13:21:27 -0800 +Subject: apparmor: fix undefined reference to `aa_g_hash_policy' + +From: John Johansen + + +[ Upstream commit 3ccb76c5dfe0d25c1d0168d5b726d0b43d19a485 ] + +The kernel build bot turned up a bad config combination when +CONFIG_SECURITY_APPARMOR is y and CONFIG_SECURITY_APPARMOR_HASH is n, +resulting in the build error + security/built-in.o: In function `aa_unpack': + (.text+0x841e2): undefined reference to `aa_g_hash_policy' + +Signed-off-by: John Johansen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + security/apparmor/lsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/apparmor/lsm.c ++++ b/security/apparmor/lsm.c +@@ -671,9 +671,9 @@ enum profile_mode aa_g_profile_mode = AP + module_param_call(mode, param_set_mode, param_get_mode, + &aa_g_profile_mode, S_IRUSR | S_IWUSR); + +-#ifdef CONFIG_SECURITY_APPARMOR_HASH + /* whether policy verification hashing is enabled */ + bool aa_g_hash_policy = IS_ENABLED(CONFIG_SECURITY_APPARMOR_HASH_DEFAULT); ++#ifdef CONFIG_SECURITY_APPARMOR_HASH + module_param_named(hash_policy, aa_g_hash_policy, aabool, S_IRUSR | S_IWUSR); + #endif + diff --git a/queue-4.9/arm-dts-imx53-qsb-common-fix-fec-pinmux-config.patch b/queue-4.9/arm-dts-imx53-qsb-common-fix-fec-pinmux-config.patch new file mode 100644 index 00000000000..849e4923d92 --- /dev/null +++ b/queue-4.9/arm-dts-imx53-qsb-common-fix-fec-pinmux-config.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Patrick Bruenn +Date: Wed, 25 Jan 2017 06:25:48 +0100 +Subject: ARM: dts: imx53-qsb-common: fix FEC pinmux config + +From: Patrick Bruenn + + +[ Upstream commit 8b649e426336d7d4800ff9c82858328f4215ba01 ] + +The pinmux configuration in device tree was different from manual +muxing in /board/freescale/mx53loco/mx53loco.c +All pins were configured as NO_PAD_CTL(1 << 31), which was fine as the +bootloader already did the correct pinmuxing for us. +But recently u-boot is migrating to reuse device tree files from the +kernel tree, so it seems to be better to have the correct pinmuxing in +our files, too. + +Signed-off-by: Patrick Bruenn +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/imx53-qsb-common.dtsi | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/arch/arm/boot/dts/imx53-qsb-common.dtsi ++++ b/arch/arm/boot/dts/imx53-qsb-common.dtsi +@@ -215,16 +215,16 @@ + + pinctrl_fec: fecgrp { + fsl,pins = < +- MX53_PAD_FEC_MDC__FEC_MDC 0x80000000 +- MX53_PAD_FEC_MDIO__FEC_MDIO 0x80000000 +- MX53_PAD_FEC_REF_CLK__FEC_TX_CLK 0x80000000 +- MX53_PAD_FEC_RX_ER__FEC_RX_ER 0x80000000 +- MX53_PAD_FEC_CRS_DV__FEC_RX_DV 0x80000000 +- MX53_PAD_FEC_RXD1__FEC_RDATA_1 0x80000000 +- MX53_PAD_FEC_RXD0__FEC_RDATA_0 0x80000000 +- MX53_PAD_FEC_TX_EN__FEC_TX_EN 0x80000000 +- MX53_PAD_FEC_TXD1__FEC_TDATA_1 0x80000000 +- MX53_PAD_FEC_TXD0__FEC_TDATA_0 0x80000000 ++ MX53_PAD_FEC_MDC__FEC_MDC 0x4 ++ MX53_PAD_FEC_MDIO__FEC_MDIO 0x1fc ++ MX53_PAD_FEC_REF_CLK__FEC_TX_CLK 0x180 ++ MX53_PAD_FEC_RX_ER__FEC_RX_ER 0x180 ++ MX53_PAD_FEC_CRS_DV__FEC_RX_DV 0x180 ++ MX53_PAD_FEC_RXD1__FEC_RDATA_1 0x180 ++ MX53_PAD_FEC_RXD0__FEC_RDATA_0 0x180 ++ MX53_PAD_FEC_TX_EN__FEC_TX_EN 0x4 ++ MX53_PAD_FEC_TXD1__FEC_TDATA_1 0x4 ++ MX53_PAD_FEC_TXD0__FEC_TDATA_0 0x4 + >; + }; + diff --git a/queue-4.9/arm-dts-stih410-family-fix-wrong-parent-clock-frequency.patch b/queue-4.9/arm-dts-stih410-family-fix-wrong-parent-clock-frequency.patch new file mode 100644 index 00000000000..f13a03e568d --- /dev/null +++ b/queue-4.9/arm-dts-stih410-family-fix-wrong-parent-clock-frequency.patch @@ -0,0 +1,31 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Patrice Chotard +Date: Fri, 6 Jan 2017 14:30:21 +0100 +Subject: ARM: dts: STiH410-family: fix wrong parent clock frequency + +From: Patrice Chotard + + +[ Upstream commit b9ec866d223f38eb0bf2a7c836e10031ee17f7af ] + +The clock parent was lower than child clock which is not correct. +In some use case, it leads to division by zero. + +Signed-off-by: Gabriel Fernandez +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/stih410.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/stih410.dtsi ++++ b/arch/arm/boot/dts/stih410.dtsi +@@ -131,7 +131,7 @@ + <&clk_s_d2_quadfs 0>; + + assigned-clock-rates = <297000000>, +- <108000000>, ++ <297000000>, + <0>, + <400000000>, + <400000000>; diff --git a/queue-4.9/arm-omap2plus_defconfig-fix-probe-errors-on-uarts-5-and-6.patch b/queue-4.9/arm-omap2plus_defconfig-fix-probe-errors-on-uarts-5-and-6.patch new file mode 100644 index 00000000000..dea387c7f7b --- /dev/null +++ b/queue-4.9/arm-omap2plus_defconfig-fix-probe-errors-on-uarts-5-and-6.patch @@ -0,0 +1,30 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Tony Lindgren +Date: Fri, 20 Jan 2017 12:13:19 -0800 +Subject: ARM: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 + +From: Tony Lindgren + + +[ Upstream commit 4cd6a59f5c1a9b0cca0da09fbba42b9450ffc899 ] + +We have more than four uarts on some SoCs and that can cause +noise with errors while booting. + +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/configs/omap2plus_defconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/arm/configs/omap2plus_defconfig ++++ b/arch/arm/configs/omap2plus_defconfig +@@ -216,6 +216,7 @@ CONFIG_SERIO=m + CONFIG_SERIAL_8250=y + CONFIG_SERIAL_8250_CONSOLE=y + CONFIG_SERIAL_8250_NR_UARTS=32 ++CONFIG_SERIAL_8250_RUNTIME_UARTS=6 + CONFIG_SERIAL_8250_EXTENDED=y + CONFIG_SERIAL_8250_MANY_PORTS=y + CONFIG_SERIAL_8250_SHARE_IRQ=y diff --git a/queue-4.9/arm64-dma-mapping-only-swizzle-dma-ops-for-iommu_domain_dma.patch b/queue-4.9/arm64-dma-mapping-only-swizzle-dma-ops-for-iommu_domain_dma.patch new file mode 100644 index 00000000000..58c1fe7d78b --- /dev/null +++ b/queue-4.9/arm64-dma-mapping-only-swizzle-dma-ops-for-iommu_domain_dma.patch @@ -0,0 +1,56 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Will Deacon +Date: Fri, 6 Jan 2017 10:49:12 +0000 +Subject: arm64: dma-mapping: Only swizzle DMA ops for IOMMU_DOMAIN_DMA + +From: Will Deacon + + +[ Upstream commit 4a8d8a14c0d08c2437cb80c05e88f6cc1ca3fb2c ] + +The arm64 DMA-mapping implementation sets the DMA ops to the IOMMU DMA +ops if we detect that an IOMMU is present for the master and the DMA +ranges are valid. + +In the case when the IOMMU domain for the device is not of type +IOMMU_DOMAIN_DMA, then we have no business swizzling the ops, since +we're not in control of the underlying address space. This patch leaves +the DMA ops alone for masters attached to non-DMA IOMMU domains. + +Reviewed-by: Robin Murphy +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/mm/dma-mapping.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +--- a/arch/arm64/mm/dma-mapping.c ++++ b/arch/arm64/mm/dma-mapping.c +@@ -836,14 +836,21 @@ static bool do_iommu_attach(struct devic + * then the IOMMU core will have already configured a group for this + * device, and allocated the default domain for that group. + */ +- if (!domain || iommu_dma_init_domain(domain, dma_base, size, dev)) { +- pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA ops\n", +- dev_name(dev)); +- return false; ++ if (!domain) ++ goto out_err; ++ ++ if (domain->type == IOMMU_DOMAIN_DMA) { ++ if (iommu_dma_init_domain(domain, dma_base, size, dev)) ++ goto out_err; ++ ++ dev->archdata.dma_ops = &iommu_dma_ops; + } + +- dev->archdata.dma_ops = &iommu_dma_ops; + return true; ++out_err: ++ pr_warn("Failed to set up IOMMU for device %s; retaining platform DMA ops\n", ++ dev_name(dev)); ++ return false; + } + + static void queue_iommu_attach(struct device *dev, const struct iommu_ops *ops, diff --git a/queue-4.9/asoc-sunxi-add-bindings-for-sun8i-to-spdif.patch b/queue-4.9/asoc-sunxi-add-bindings-for-sun8i-to-spdif.patch new file mode 100644 index 00000000000..4732c978995 --- /dev/null +++ b/queue-4.9/asoc-sunxi-add-bindings-for-sun8i-to-spdif.patch @@ -0,0 +1,32 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Marcus Cooper +Date: Thu, 19 Jan 2017 20:52:57 +0100 +Subject: ASoC: sunxi: Add bindings for sun8i to SPDIF + +From: Marcus Cooper + + +[ Upstream commit cb5c978f9a56c459d5f13901efcfe44b97c4182d ] + +The H3 SoC uses the same SPDIF block as found in earlier SoCs, but the +transmit fifo is at a different address. + +Signed-off-by: Marcus Cooper +Acked-by: Maxime Ripard +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt ++++ b/Documentation/devicetree/bindings/sound/sunxi,sun4i-spdif.txt +@@ -10,6 +10,7 @@ Required properties: + - compatible : should be one of the following: + - "allwinner,sun4i-a10-spdif": for the Allwinner A10 SoC + - "allwinner,sun6i-a31-spdif": for the Allwinner A31 SoC ++ - "allwinner,sun8i-h3-spdif": for the Allwinner H3 SoC + + - reg : Offset and length of the register set for the device. + diff --git a/queue-4.9/brcmfmac-setup-wiphy-bands-after-registering-it-first.patch b/queue-4.9/brcmfmac-setup-wiphy-bands-after-registering-it-first.patch new file mode 100644 index 00000000000..59f990b8789 --- /dev/null +++ b/queue-4.9/brcmfmac-setup-wiphy-bands-after-registering-it-first.patch @@ -0,0 +1,57 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Rafał Miłecki +Date: Sat, 7 Jan 2017 21:36:05 +0100 +Subject: brcmfmac: setup wiphy bands after registering it first + +From: Rafał Miłecki + + +[ Upstream commit ab99063f873749b3c3b1e5d44038559883465e74 ] + +During bands setup we disable all channels that firmware doesn't support +in the current regulatory setup. If we do this before wiphy_register +it will result in copying set flags (including IEEE80211_CHAN_DISABLED) +to the orig_flags which is supposed to be persistent. We don't want this +as regulatory change may result in enabling some channels. We shouldn't +mess with orig_flags then (by changing them or ignoring them) so it's +better to just take care of their proper values. + +This patch cleanups code a bit (by taking orig_flags more seriously) and +allows further improvements like disabling really unavailable channels. +We will need that e.g. if some frequencies should be disabled for good +due to hardware setup (design). + +Signed-off-by: Rafał Miłecki +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6572,8 +6572,7 @@ static int brcmf_setup_wiphy(struct wiph + wiphy->bands[NL80211_BAND_5GHZ] = band; + } + } +- err = brcmf_setup_wiphybands(wiphy); +- return err; ++ return 0; + } + + static s32 brcmf_config_dongle(struct brcmf_cfg80211_info *cfg) +@@ -6938,6 +6937,12 @@ struct brcmf_cfg80211_info *brcmf_cfg802 + goto priv_out; + } + ++ err = brcmf_setup_wiphybands(wiphy); ++ if (err) { ++ brcmf_err("Setting wiphy bands failed (%d)\n", err); ++ goto wiphy_unreg_out; ++ } ++ + /* If cfg80211 didn't disable 40MHz HT CAP in wiphy_register(), + * setup 40MHz in 2GHz band and enable OBSS scanning. + */ diff --git a/queue-4.9/clk-mvebu-adjust-ap806-cpu-clock-frequencies-to-production-chip.patch b/queue-4.9/clk-mvebu-adjust-ap806-cpu-clock-frequencies-to-production-chip.patch new file mode 100644 index 00000000000..f4a77283054 --- /dev/null +++ b/queue-4.9/clk-mvebu-adjust-ap806-cpu-clock-frequencies-to-production-chip.patch @@ -0,0 +1,70 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Thomas Petazzoni +Date: Thu, 22 Dec 2016 13:08:14 +0100 +Subject: clk: mvebu: adjust AP806 CPU clock frequencies to production chip + +From: Thomas Petazzoni + + +[ Upstream commit 0c70ffc5f300e7c3a1a76ca0530860574afc890b ] + +This commit adjusts the list of possible "Sample At Reset" values that +define the CPU clock frequency of the AP806 (part of Marvell Armada +7K/8K) to the values that have been validated with the production +chip. Earlier values were preliminary. + +Signed-off-by: Thomas Petazzoni +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/mvebu/ap806-system-controller.c | 28 +++++++++++++++++++++++----- + 1 file changed, 23 insertions(+), 5 deletions(-) + +--- a/drivers/clk/mvebu/ap806-system-controller.c ++++ b/drivers/clk/mvebu/ap806-system-controller.c +@@ -55,21 +55,39 @@ static int ap806_syscon_clk_probe(struct + + freq_mode = reg & AP806_SAR_CLKFREQ_MODE_MASK; + switch (freq_mode) { +- case 0x0 ... 0x5: ++ case 0x0: ++ case 0x1: + cpuclk_freq = 2000; + break; +- case 0x6 ... 0xB: ++ case 0x6: ++ case 0x7: + cpuclk_freq = 1800; + break; +- case 0xC ... 0x11: ++ case 0x4: ++ case 0xB: ++ case 0xD: + cpuclk_freq = 1600; + break; +- case 0x12 ... 0x16: ++ case 0x1a: + cpuclk_freq = 1400; + break; +- case 0x17 ... 0x19: ++ case 0x14: ++ case 0x17: + cpuclk_freq = 1300; + break; ++ case 0x19: ++ cpuclk_freq = 1200; ++ break; ++ case 0x13: ++ case 0x1d: ++ cpuclk_freq = 1000; ++ break; ++ case 0x1c: ++ cpuclk_freq = 800; ++ break; ++ case 0x1b: ++ cpuclk_freq = 600; ++ break; + default: + dev_err(&pdev->dev, "invalid SAR value\n"); + return -EINVAL; diff --git a/queue-4.9/clk-samsung-exynos5433-add-ids-for-phyclk_mipidphy0_-clocks.patch b/queue-4.9/clk-samsung-exynos5433-add-ids-for-phyclk_mipidphy0_-clocks.patch new file mode 100644 index 00000000000..911c12fda20 --- /dev/null +++ b/queue-4.9/clk-samsung-exynos5433-add-ids-for-phyclk_mipidphy0_-clocks.patch @@ -0,0 +1,55 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Marek Szyprowski +Date: Thu, 26 Jan 2017 13:37:52 +0100 +Subject: clk: samsung: exynos5433: Add IDs for PHYCLK_MIPIDPHY0_* clocks + +From: Marek Szyprowski + + +[ Upstream commit 5ccb58968bf7f46dbd128df88f71838a5a9750b8 ] + +Add missing identifiers for phyclk_mipidphy0_bitclkdiv8_phy and +phyclk_mipidphy0_rxclkesc0_phy clocks. Access to those clocks is needed +to setup initial clock configuration for display subsystem in device tree +in order to avoid dependency on the configuration left by the bootloader. + +Signed-off-by: Marek Szyprowski +Acked-by: Krzysztof Kozlowski +Acked-by: Chanwoo Choi +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/samsung/clk-exynos5433.c | 6 ++++-- + include/dt-bindings/clock/exynos5433.h | 5 ++++- + 2 files changed, 8 insertions(+), 3 deletions(-) + +--- a/drivers/clk/samsung/clk-exynos5433.c ++++ b/drivers/clk/samsung/clk-exynos5433.c +@@ -2559,8 +2559,10 @@ static const struct samsung_fixed_rate_c + FRATE(0, "phyclk_mipidphy1_bitclkdiv8_phy", NULL, 0, 188000000), + FRATE(0, "phyclk_mipidphy1_rxclkesc0_phy", NULL, 0, 100000000), + /* PHY clocks from MIPI_DPHY0 */ +- FRATE(0, "phyclk_mipidphy0_bitclkdiv8_phy", NULL, 0, 188000000), +- FRATE(0, "phyclk_mipidphy0_rxclkesc0_phy", NULL, 0, 100000000), ++ FRATE(CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY, "phyclk_mipidphy0_bitclkdiv8_phy", ++ NULL, 0, 188000000), ++ FRATE(CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY, "phyclk_mipidphy0_rxclkesc0_phy", ++ NULL, 0, 100000000), + /* PHY clocks from HDMI_PHY */ + FRATE(CLK_PHYCLK_HDMIPHY_TMDS_CLKO_PHY, "phyclk_hdmiphy_tmds_clko_phy", + NULL, 0, 300000000), +--- a/include/dt-bindings/clock/exynos5433.h ++++ b/include/dt-bindings/clock/exynos5433.h +@@ -771,7 +771,10 @@ + + #define CLK_PCLK_DECON 113 + +-#define DISP_NR_CLK 114 ++#define CLK_PHYCLK_MIPIDPHY0_BITCLKDIV8_PHY 114 ++#define CLK_PHYCLK_MIPIDPHY0_RXCLKESC0_PHY 115 ++ ++#define DISP_NR_CLK 116 + + /* CMU_AUD */ + #define CLK_MOUT_AUD_PLL_USER 1 diff --git a/queue-4.9/crypto-vmx-disable-preemption-to-enable-vsx-in-aes_ctr.c.patch b/queue-4.9/crypto-vmx-disable-preemption-to-enable-vsx-in-aes_ctr.c.patch new file mode 100644 index 00000000000..e9c22ae0faa --- /dev/null +++ b/queue-4.9/crypto-vmx-disable-preemption-to-enable-vsx-in-aes_ctr.c.patch @@ -0,0 +1,68 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Li Zhong +Date: Fri, 20 Jan 2017 16:35:33 +0800 +Subject: crypto: vmx - disable preemption to enable vsx in aes_ctr.c + +From: Li Zhong + + +[ Upstream commit 7dede913fc2ab9c0d3bff3a49e26fa9e858b0c13 ] + +Some preemptible check warnings were reported from enable_kernel_vsx(). This +patch disables preemption in aes_ctr.c before enabling vsx, and they are now +consistent with other files in the same directory. + +Signed-off-by: Li Zhong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/vmx/aes_ctr.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/crypto/vmx/aes_ctr.c ++++ b/drivers/crypto/vmx/aes_ctr.c +@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct cryp + int ret; + struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm); + ++ preempt_disable(); + pagefault_disable(); + enable_kernel_vsx(); + ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key); + disable_kernel_vsx(); + pagefault_enable(); ++ preempt_enable(); + + ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen); + return ret; +@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_a + u8 *dst = walk->dst.virt.addr; + unsigned int nbytes = walk->nbytes; + ++ preempt_disable(); + pagefault_disable(); + enable_kernel_vsx(); + aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key); + disable_kernel_vsx(); + pagefault_enable(); ++ preempt_enable(); + + crypto_xor(keystream, src, nbytes); + memcpy(dst, keystream, nbytes); +@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkci + blkcipher_walk_init(&walk, dst, src, nbytes); + ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE); + while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) { ++ preempt_disable(); + pagefault_disable(); + enable_kernel_vsx(); + aes_p8_ctr32_encrypt_blocks(walk.src.virt.addr, +@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkci + walk.iv); + disable_kernel_vsx(); + pagefault_enable(); ++ preempt_enable(); + + /* We need to update IV mostly for last bytes/round */ + inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE; diff --git a/queue-4.9/cxl-force-psl-data-cache-flush-during-device-shutdown.patch b/queue-4.9/cxl-force-psl-data-cache-flush-during-device-shutdown.patch new file mode 100644 index 00000000000..725b1a91a2d --- /dev/null +++ b/queue-4.9/cxl-force-psl-data-cache-flush-during-device-shutdown.patch @@ -0,0 +1,37 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Vaibhav Jain +Date: Wed, 4 Jan 2017 11:48:52 +0530 +Subject: cxl: Force psl data-cache flush during device shutdown + +From: Vaibhav Jain + + +[ Upstream commit d7b1946c7925a270062b2e0718aa57b42ba619c0 ] + +This change adds a force psl data cache flush during device shutdown +callback. This should reduce a possibility of psl holding a dirty +cache line while the CAPP is being reinitialized, which may result in +a UE [load/store] machine check error. + +Signed-off-by: Vaibhav Jain +Reviewed-by: Andrew Donnellan +Acked-by: Frederic Barrat +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cxl/pci.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -1620,6 +1620,9 @@ static void cxl_pci_remove_adapter(struc + cxl_sysfs_adapter_remove(adapter); + cxl_debugfs_adapter_remove(adapter); + ++ /* Flush adapter datacache as its about to be removed */ ++ cxl_data_cache_flush(adapter); ++ + cxl_deconfigure_adapter(adapter); + + device_unregister(&adapter->dev); diff --git a/queue-4.9/drm-drm_minor_register-clean-up-debugfs-on-failure.patch b/queue-4.9/drm-drm_minor_register-clean-up-debugfs-on-failure.patch new file mode 100644 index 00000000000..dcac2ed03f4 --- /dev/null +++ b/queue-4.9/drm-drm_minor_register-clean-up-debugfs-on-failure.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Noralf Trønnes +Date: Thu, 26 Jan 2017 23:56:04 +0100 +Subject: drm: drm_minor_register(): Clean up debugfs on failure + +From: Noralf Trønnes + + +[ Upstream commit a67834f8bfa1e2f48bb27d07b9a552ba7c3af82a ] + +Call drm_debugfs_cleanup() in case drm_debugfs_init() fails to +cover for failure in the drm_driver.debugfs_init callback. + +Signed-off-by: Noralf Trønnes +Signed-off-by: Daniel Vetter +Link: http://patchwork.freedesktop.org/patch/msgid/20170126225621.12314-3-noralf@tronnes.org +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -218,7 +218,7 @@ static int drm_minor_register(struct drm + ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root); + if (ret) { + DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n"); +- return ret; ++ goto err_debugfs; + } + + ret = device_add(minor->kdev); diff --git a/queue-4.9/drm-mali-dp-fix-lx_control-register-fields-clobber.patch b/queue-4.9/drm-mali-dp-fix-lx_control-register-fields-clobber.patch new file mode 100644 index 00000000000..d2cb1b72605 --- /dev/null +++ b/queue-4.9/drm-mali-dp-fix-lx_control-register-fields-clobber.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Mihail Atanassov +Date: Fri, 23 Dec 2016 09:57:20 +0000 +Subject: drm: mali-dp: fix Lx_CONTROL register fields clobber + +From: Mihail Atanassov + + +[ Upstream commit c7ffa59cf03c38b91d6ef01e42c1b52fd7a4f285 ] + +When updating the rotation fields, one of the assignments zeroes out the +rest of the register fields, which include settings for chroma siting, +inverse gamma, AMBA AXI caching, and alpha blending. + +Signed-off-by: Mihail Atanassov +Signed-off-by: Liviu Dudau +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/arm/malidp_planes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/arm/malidp_planes.c ++++ b/drivers/gpu/drm/arm/malidp_planes.c +@@ -182,7 +182,8 @@ static void malidp_de_plane_update(struc + + /* setup the rotation and axis flip bits */ + if (plane->state->rotation & DRM_ROTATE_MASK) +- val = ilog2(plane->state->rotation & DRM_ROTATE_MASK) << LAYER_ROT_OFFSET; ++ val |= ilog2(plane->state->rotation & DRM_ROTATE_MASK) << ++ LAYER_ROT_OFFSET; + if (plane->state->rotation & DRM_REFLECT_X) + val |= LAYER_H_FLIP; + if (plane->state->rotation & DRM_REFLECT_Y) diff --git a/queue-4.9/dt-bindings-add-lego-mindstorms-ev3-compatible-specification.patch b/queue-4.9/dt-bindings-add-lego-mindstorms-ev3-compatible-specification.patch new file mode 100644 index 00000000000..033aa1e67ba --- /dev/null +++ b/queue-4.9/dt-bindings-add-lego-mindstorms-ev3-compatible-specification.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: David Lechner +Date: Fri, 13 Jan 2017 13:03:40 -0600 +Subject: dt-bindings: Add LEGO MINDSTORMS EV3 compatible specification + +From: David Lechner + + +[ Upstream commit 21078ab174c99885ca83a5c32db0d33b1617745e ] + +This adds the board level device tree specification for LEGO MINDSTORMS EV3 + +Acked-by: Rob Herring +Signed-off-by: David Lechner +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/arm/davinci.txt | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/Documentation/devicetree/bindings/arm/davinci.txt ++++ b/Documentation/devicetree/bindings/arm/davinci.txt +@@ -13,6 +13,10 @@ EnBW AM1808 based CMC board + Required root node properties: + - compatible = "enbw,cmc", "ti,da850; + ++LEGO MINDSTORMS EV3 (AM1808 based) ++Required root node properties: ++ - compatible = "lego,ev3", "ti,da850"; ++ + Generic DaVinci Boards + ---------------------- + diff --git a/queue-4.9/dt-bindings-add-vendor-prefix-for-lego.patch b/queue-4.9/dt-bindings-add-vendor-prefix-for-lego.patch new file mode 100644 index 00000000000..abbf898b0a9 --- /dev/null +++ b/queue-4.9/dt-bindings-add-vendor-prefix-for-lego.patch @@ -0,0 +1,31 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: David Lechner +Date: Fri, 13 Jan 2017 13:03:39 -0600 +Subject: dt-bindings: Add vendor prefix for LEGO + +From: David Lechner + + +[ Upstream commit 7dcc31e2e68a386a29070384b51683ece80982bf ] + +Add a vendor prefix for LEGO Systems A/S + +Acked-by: Rob Herring +Signed-off-by: David Lechner +Signed-off-by: Sekhar Nori +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/vendor-prefixes.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/vendor-prefixes.txt ++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt +@@ -154,6 +154,7 @@ kosagi Sutajio Ko-Usagi PTE Ltd. + kyo Kyocera Corporation + lacie LaCie + lantiq Lantiq Semiconductor ++lego LEGO Systems A/S + lenovo Lenovo Group Ltd. + lg LG Corporation + linux Linux-specific binding diff --git a/queue-4.9/dt-bindings-clockgen-add-compatible-string-for-ls1012a.patch b/queue-4.9/dt-bindings-clockgen-add-compatible-string-for-ls1012a.patch new file mode 100644 index 00000000000..13e13d90f74 --- /dev/null +++ b/queue-4.9/dt-bindings-clockgen-add-compatible-string-for-ls1012a.patch @@ -0,0 +1,30 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Harninder Rai +Date: Wed, 9 Nov 2016 23:40:53 +0530 +Subject: dt-bindings: clockgen: Add compatible string for LS1012A + +From: Harninder Rai + + +[ Upstream commit 73447f68d7b2bc1df870da88b0e21d2bc1afc025 ] + +Signed-off-by: Harninder Rai +Signed-off-by: Bhaskar Upadhaya +Acked-by: Rob Herring +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/clock/qoriq-clock.txt | 1 + + 1 file changed, 1 insertion(+) + +--- a/Documentation/devicetree/bindings/clock/qoriq-clock.txt ++++ b/Documentation/devicetree/bindings/clock/qoriq-clock.txt +@@ -31,6 +31,7 @@ Required properties: + * "fsl,t4240-clockgen" + * "fsl,b4420-clockgen" + * "fsl,b4860-clockgen" ++ * "fsl,ls1012a-clockgen" + * "fsl,ls1021a-clockgen" + Chassis-version clock strings include: + * "fsl,qoriq-clockgen-1.0": for chassis 1.0 clocks diff --git a/queue-4.9/edac-amd64-add-x86cpuid-sanity-check-during-init.patch b/queue-4.9/edac-amd64-add-x86cpuid-sanity-check-during-init.patch new file mode 100644 index 00000000000..b4e615b6821 --- /dev/null +++ b/queue-4.9/edac-amd64-add-x86cpuid-sanity-check-during-init.patch @@ -0,0 +1,60 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Yazen Ghannam +Date: Fri, 27 Jan 2017 11:24:23 -0600 +Subject: EDAC, amd64: Add x86cpuid sanity check during init + +From: Yazen Ghannam + + +[ Upstream commit 1bd9900b8301fc505f032c90ea487824cf824e99 ] + +Match one of the devices in amd64_cpuids[] before loading the module. +This is an additional sanity check against users trying to load +amd64_edac_mod on unsupported systems. + +Signed-off-by: Yazen Ghannam +Cc: linux-edac +Link: http://lkml.kernel.org/r/1485537863-2707-9-git-send-email-Yazen.Ghannam@amd.com +[ Get rid of err_ret label, make it a bit more readable this way. ] +Signed-off-by: Borislav Petkov + +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/amd64_edac.c | 6 ++++-- + drivers/edac/amd64_edac.h | 1 + + 2 files changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -2984,8 +2984,11 @@ static int __init amd64_edac_init(void) + int err = -ENODEV; + int i; + ++ if (!x86_match_cpu(amd64_cpuids)) ++ return -ENODEV; ++ + if (amd_cache_northbridges() < 0) +- goto err_ret; ++ return -ENODEV; + + opstate_init(); + +@@ -3025,7 +3028,6 @@ err_free: + kfree(ecc_stngs); + ecc_stngs = NULL; + +-err_ret: + return err; + } + +--- a/drivers/edac/amd64_edac.h ++++ b/drivers/edac/amd64_edac.h +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include "edac_core.h" + #include "mce_amd.h" diff --git a/queue-4.9/edac-amd64-save-and-return-err-code-from-probe_one_instance.patch b/queue-4.9/edac-amd64-save-and-return-err-code-from-probe_one_instance.patch new file mode 100644 index 00000000000..af86daae972 --- /dev/null +++ b/queue-4.9/edac-amd64-save-and-return-err-code-from-probe_one_instance.patch @@ -0,0 +1,45 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Yazen Ghannam +Date: Fri, 13 Jan 2017 09:52:19 -0600 +Subject: EDAC, amd64: Save and return err code from probe_one_instance() + +From: Yazen Ghannam + + +[ Upstream commit 2287c63643f0f52d9d5452b9dc4079aec0889fe8 ] + +We should save the return code from probe_one_instance() so that it can +be returned from the module init function. Otherwise, we'll be returning +the -ENOMEM from above. + +Signed-off-by: Yazen Ghannam +Cc: linux-edac +Link: http://lkml.kernel.org/r/1484322741-41884-1-git-send-email-Yazen.Ghannam@amd.com +Signed-off-by: Borislav Petkov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/edac/amd64_edac.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -3001,14 +3001,16 @@ static int __init amd64_edac_init(void) + if (!msrs) + goto err_free; + +- for (i = 0; i < amd_nb_num(); i++) +- if (probe_one_instance(i)) { ++ for (i = 0; i < amd_nb_num(); i++) { ++ err = probe_one_instance(i); ++ if (err) { + /* unwind properly */ + while (--i >= 0) + remove_one_instance(i); + + goto err_pci; + } ++ } + + setup_pci_device(); + diff --git a/queue-4.9/ib-ipoib-change-list_del-to-list_del_init-in-the-tx-object.patch b/queue-4.9/ib-ipoib-change-list_del-to-list_del_init-in-the-tx-object.patch new file mode 100644 index 00000000000..ecb7bbb8d21 --- /dev/null +++ b/queue-4.9/ib-ipoib-change-list_del-to-list_del_init-in-the-tx-object.patch @@ -0,0 +1,41 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Feras Daoud +Date: Wed, 28 Dec 2016 14:47:28 +0200 +Subject: IB/ipoib: Change list_del to list_del_init in the tx object + +From: Feras Daoud + + +[ Upstream commit 27d41d29c7f093f6f77843624fbb080c1b4a8b9c ] + +Since ipoib_cm_tx_start function and ipoib_cm_tx_reap function +belong to different work queues, they can run in parallel. +In this case if ipoib_cm_tx_reap calls list_del and release the +lock, ipoib_cm_tx_start may acquire it and call list_del_init +on the already deleted object. +Changing list_del to list_del_init in ipoib_cm_tx_reap fixes the problem. + +Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support") +Signed-off-by: Feras Daoud +Signed-off-by: Erez Shitrit +Reviewed-by: Alex Vesker +Signed-off-by: Leon Romanovsky +Reviewed-by: Yuval Shaia +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1392,7 +1392,7 @@ static void ipoib_cm_tx_reap(struct work + + while (!list_empty(&priv->cm.reap_list)) { + p = list_entry(priv->cm.reap_list.next, typeof(*p), list); +- list_del(&p->list); ++ list_del_init(&p->list); + spin_unlock_irqrestore(&priv->lock, flags); + netif_tx_unlock_bh(dev); + ipoib_cm_tx_destroy(p); diff --git a/queue-4.9/ib-rxe-fix-reference-leaks-in-memory-key-invalidation-code.patch b/queue-4.9/ib-rxe-fix-reference-leaks-in-memory-key-invalidation-code.patch new file mode 100644 index 00000000000..3f7d172005e --- /dev/null +++ b/queue-4.9/ib-rxe-fix-reference-leaks-in-memory-key-invalidation-code.patch @@ -0,0 +1,42 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Bart Van Assche +Date: Tue, 10 Jan 2017 11:15:52 -0800 +Subject: IB/rxe: Fix reference leaks in memory key invalidation code + +From: Bart Van Assche + + +[ Upstream commit ab17654476a11a1ed7d89f1104e2acdb7ed1c9ed ] + +Signed-off-by: Bart Van Assche +Reviewed-by: Leon Romanovsky +Reviewed-by: Andrew Boyer +Cc: Moni Shoua +Signed-off-by: Doug Ledford +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/sw/rxe/rxe_req.c | 1 + + drivers/infiniband/sw/rxe/rxe_resp.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -633,6 +633,7 @@ next_wqe: + goto exit; + } + rmr->state = RXE_MEM_STATE_FREE; ++ rxe_drop_ref(rmr); + wqe->state = wqe_state_done; + wqe->status = IB_WC_SUCCESS; + } else if (wqe->wr.opcode == IB_WR_REG_MR) { +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -893,6 +893,7 @@ static enum resp_states do_complete(stru + return RESPST_ERROR; + } + rmr->state = RXE_MEM_STATE_FREE; ++ rxe_drop_ref(rmr); + } + + wc->qp = &qp->ibqp; diff --git a/queue-4.9/iio-magnetometer-mag3110-claim-direct-mode-during-raw-writes.patch b/queue-4.9/iio-magnetometer-mag3110-claim-direct-mode-during-raw-writes.patch new file mode 100644 index 00000000000..e6f00c1518b --- /dev/null +++ b/queue-4.9/iio-magnetometer-mag3110-claim-direct-mode-during-raw-writes.patch @@ -0,0 +1,75 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Alison Schofield +Date: Fri, 20 Jan 2017 12:39:32 -0800 +Subject: iio: magnetometer: mag3110: claim direct mode during raw writes + +From: Alison Schofield + + +[ Upstream commit 80dea21f95a4672cce545f48dc2ca500b69a2584 ] + +Driver was checking for direct mode but not locking it. Use +claim/release helper functions to guarantee the device stays +in direct mode during raw writes. + +Signed-off-by: Alison Schofield +Acked-by: Peter Meerwald-Stadler +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/magnetometer/mag3110.c | 30 ++++++++++++++++++++---------- + 1 file changed, 20 insertions(+), 10 deletions(-) + +--- a/drivers/iio/magnetometer/mag3110.c ++++ b/drivers/iio/magnetometer/mag3110.c +@@ -222,29 +222,39 @@ static int mag3110_write_raw(struct iio_ + int val, int val2, long mask) + { + struct mag3110_data *data = iio_priv(indio_dev); +- int rate; ++ int rate, ret; + +- if (iio_buffer_enabled(indio_dev)) +- return -EBUSY; ++ ret = iio_device_claim_direct_mode(indio_dev); ++ if (ret) ++ return ret; + + switch (mask) { + case IIO_CHAN_INFO_SAMP_FREQ: + rate = mag3110_get_samp_freq_index(data, val, val2); +- if (rate < 0) +- return -EINVAL; ++ if (rate < 0) { ++ ret = -EINVAL; ++ break; ++ } + + data->ctrl_reg1 &= ~MAG3110_CTRL_DR_MASK; + data->ctrl_reg1 |= rate << MAG3110_CTRL_DR_SHIFT; +- return i2c_smbus_write_byte_data(data->client, ++ ret = i2c_smbus_write_byte_data(data->client, + MAG3110_CTRL_REG1, data->ctrl_reg1); ++ break; + case IIO_CHAN_INFO_CALIBBIAS: +- if (val < -10000 || val > 10000) +- return -EINVAL; +- return i2c_smbus_write_word_swapped(data->client, ++ if (val < -10000 || val > 10000) { ++ ret = -EINVAL; ++ break; ++ } ++ ret = i2c_smbus_write_word_swapped(data->client, + MAG3110_OFF_X + 2 * chan->scan_index, val << 1); ++ break; + default: +- return -EINVAL; ++ ret = -EINVAL; ++ break; + } ++ iio_device_release_direct_mode(indio_dev); ++ return ret; + } + + static irqreturn_t mag3110_trigger_handler(int irq, void *p) diff --git a/queue-4.9/iio-pressure-ms5611-claim-direct-mode-during-oversampling-changes.patch b/queue-4.9/iio-pressure-ms5611-claim-direct-mode-during-oversampling-changes.patch new file mode 100644 index 00000000000..a742a554cfb --- /dev/null +++ b/queue-4.9/iio-pressure-ms5611-claim-direct-mode-during-oversampling-changes.patch @@ -0,0 +1,61 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Alison Schofield +Date: Fri, 20 Jan 2017 12:22:58 -0800 +Subject: iio: pressure: ms5611: claim direct mode during oversampling changes + +From: Alison Schofield + + +[ Upstream commit 3bc1abcddb24f55b9c251e03caa4f9bd22ff748b ] + +Driver was checking for direct mode before changing oversampling +ratios, but was not locking it. Use the claim/release helper +functions to guarantee the device stays in direct mode while the +oversampling ratios are being updated. Continue to use the drivers +private state lock to protect against conflicting direct mode access +of the state data. + +Signed-off-by: Alison Schofield +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/pressure/ms5611_core.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/iio/pressure/ms5611_core.c ++++ b/drivers/iio/pressure/ms5611_core.c +@@ -308,6 +308,7 @@ static int ms5611_write_raw(struct iio_d + { + struct ms5611_state *st = iio_priv(indio_dev); + const struct ms5611_osr *osr = NULL; ++ int ret; + + if (mask != IIO_CHAN_INFO_OVERSAMPLING_RATIO) + return -EINVAL; +@@ -321,12 +322,11 @@ static int ms5611_write_raw(struct iio_d + if (!osr) + return -EINVAL; + +- mutex_lock(&st->lock); ++ ret = iio_device_claim_direct_mode(indio_dev); ++ if (ret) ++ return ret; + +- if (iio_buffer_enabled(indio_dev)) { +- mutex_unlock(&st->lock); +- return -EBUSY; +- } ++ mutex_lock(&st->lock); + + if (chan->type == IIO_TEMP) + st->temp_osr = osr; +@@ -334,6 +334,8 @@ static int ms5611_write_raw(struct iio_d + st->pressure_osr = osr; + + mutex_unlock(&st->lock); ++ iio_device_release_direct_mode(indio_dev); ++ + return 0; + } + diff --git a/queue-4.9/iio-proximity-sx9500-claim-direct-mode-during-raw-proximity-reads.patch b/queue-4.9/iio-proximity-sx9500-claim-direct-mode-during-raw-proximity-reads.patch new file mode 100644 index 00000000000..938f46e2d34 --- /dev/null +++ b/queue-4.9/iio-proximity-sx9500-claim-direct-mode-during-raw-proximity-reads.patch @@ -0,0 +1,47 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Alison Schofield +Date: Fri, 20 Jan 2017 14:11:30 -0800 +Subject: iio: proximity: sx9500: claim direct mode during raw proximity reads + +From: Alison Schofield + + +[ Upstream commit 6b2e7589b82ff534dd5c6d67dd83c53f13691bec ] + +Driver was checking for direct mode but not locking it. Use the +claim/release helper functions to guarantee the device stays in +direct mode during raw reads of proximity data. + +Signed-off-by: Alison Schofield +Reviewed-by: Vlad Dogaru +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/proximity/sx9500.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/iio/proximity/sx9500.c ++++ b/drivers/iio/proximity/sx9500.c +@@ -387,14 +387,18 @@ static int sx9500_read_raw(struct iio_de + int *val, int *val2, long mask) + { + struct sx9500_data *data = iio_priv(indio_dev); ++ int ret; + + switch (chan->type) { + case IIO_PROXIMITY: + switch (mask) { + case IIO_CHAN_INFO_RAW: +- if (iio_buffer_enabled(indio_dev)) +- return -EBUSY; +- return sx9500_read_proximity(data, chan, val); ++ ret = iio_device_claim_direct_mode(indio_dev); ++ if (ret) ++ return ret; ++ ret = sx9500_read_proximity(data, chan, val); ++ iio_device_release_direct_mode(indio_dev); ++ return ret; + case IIO_CHAN_INFO_SAMP_FREQ: + return sx9500_read_samp_freq(data, val, val2); + default: diff --git a/queue-4.9/iio-trigger-free-trigger-resource-correctly.patch b/queue-4.9/iio-trigger-free-trigger-resource-correctly.patch new file mode 100644 index 00000000000..8f22d2d9786 --- /dev/null +++ b/queue-4.9/iio-trigger-free-trigger-resource-correctly.patch @@ -0,0 +1,99 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Alison Schofield +Date: Thu, 19 Jan 2017 19:47:38 -0800 +Subject: iio: trigger: free trigger resource correctly + +From: Alison Schofield + + +[ Upstream commit 10e840dfb0b7fc345082dd9e5fff3c1c02e7690e ] + +These stand-alone trigger drivers were using iio_trigger_put() +where they should have been using iio_trigger_free(). The +iio_trigger_put() adds a module_put which is bad since they +never did a module_get. + +In the sysfs driver, module_get/put's are used as triggers are +added & removed. This extra module_put() occurs on an error path +in the probe routine (probably rare). + +In the bfin-timer & interrupt trigger drivers, the module resources +are not explicitly managed, so it's doing a put on something that +was never get'd. It occurs on the probe error path and on the +remove path (not so rare). + +Tested with the sysfs trigger driver. +The bfin & interrupt drivers were build tested & inspected only. + +Signed-off-by: Alison Schofield +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/trigger/iio-trig-interrupt.c | 8 ++++---- + drivers/iio/trigger/iio-trig-sysfs.c | 2 +- + drivers/staging/iio/trigger/iio-trig-bfin-timer.c | 4 ++-- + 3 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/iio/trigger/iio-trig-interrupt.c ++++ b/drivers/iio/trigger/iio-trig-interrupt.c +@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(s + trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL); + if (!trig_info) { + ret = -ENOMEM; +- goto error_put_trigger; ++ goto error_free_trigger; + } + iio_trigger_set_drvdata(trig, trig_info); + trig_info->irq = irq; +@@ -83,8 +83,8 @@ error_release_irq: + free_irq(irq, trig); + error_free_trig_info: + kfree(trig_info); +-error_put_trigger: +- iio_trigger_put(trig); ++error_free_trigger: ++ iio_trigger_free(trig); + error_ret: + return ret; + } +@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove( + iio_trigger_unregister(trig); + free_irq(trig_info->irq, trig); + kfree(trig_info); +- iio_trigger_put(trig); ++ iio_trigger_free(trig); + + return 0; + } +--- a/drivers/iio/trigger/iio-trig-sysfs.c ++++ b/drivers/iio/trigger/iio-trig-sysfs.c +@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int i + return 0; + + out2: +- iio_trigger_put(t->trig); ++ iio_trigger_free(t->trig); + free_t: + kfree(t); + out1: +--- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c ++++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c +@@ -260,7 +260,7 @@ out_free_irq: + out1: + iio_trigger_unregister(st->trig); + out: +- iio_trigger_put(st->trig); ++ iio_trigger_free(st->trig); + return ret; + } + +@@ -273,7 +273,7 @@ static int iio_bfin_tmr_trigger_remove(s + peripheral_free(st->t->pin); + free_irq(st->irq, st); + iio_trigger_unregister(st->trig); +- iio_trigger_put(st->trig); ++ iio_trigger_free(st->trig); + + return 0; + } diff --git a/queue-4.9/input-mpr121-handle-multiple-bits-change-of-status-register.patch b/queue-4.9/input-mpr121-handle-multiple-bits-change-of-status-register.patch new file mode 100644 index 00000000000..b75ecad59fd --- /dev/null +++ b/queue-4.9/input-mpr121-handle-multiple-bits-change-of-status-register.patch @@ -0,0 +1,68 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Akinobu Mita +Date: Sun, 15 Jan 2017 14:44:30 -0800 +Subject: Input: mpr121 - handle multiple bits change of status register + +From: Akinobu Mita + + +[ Upstream commit 08fea55e37f58371bffc5336a59e55d1f155955a ] + +This driver reports input events on their interrupts which are triggered +by the sensor's status register changes. But only single bit change is +reported in the interrupt handler. So if there are multiple bits are +changed at almost the same time, other press or release events are ignored. + +This fixes it by detecting all changed bits in the status register. + +Signed-off-by: Akinobu Mita +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/keyboard/mpr121_touchkey.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +--- a/drivers/input/keyboard/mpr121_touchkey.c ++++ b/drivers/input/keyboard/mpr121_touchkey.c +@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrup + struct mpr121_touchkey *mpr121 = dev_id; + struct i2c_client *client = mpr121->client; + struct input_dev *input = mpr121->input_dev; +- unsigned int key_num, key_val, pressed; ++ unsigned long bit_changed; ++ unsigned int key_num; + int reg; + + reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR); +@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrup + + reg &= TOUCH_STATUS_MASK; + /* use old press bit to figure out which bit changed */ +- key_num = ffs(reg ^ mpr121->statusbits) - 1; +- pressed = reg & (1 << key_num); ++ bit_changed = reg ^ mpr121->statusbits; + mpr121->statusbits = reg; ++ for_each_set_bit(key_num, &bit_changed, mpr121->keycount) { ++ unsigned int key_val, pressed; + +- key_val = mpr121->keycodes[key_num]; ++ pressed = reg & BIT(key_num); ++ key_val = mpr121->keycodes[key_num]; + +- input_event(input, EV_MSC, MSC_SCAN, key_num); +- input_report_key(input, key_val, pressed); +- input_sync(input); ++ input_event(input, EV_MSC, MSC_SCAN, key_num); ++ input_report_key(input, key_val, pressed); ++ ++ dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, ++ pressed ? "pressed" : "released"); + +- dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, +- pressed ? "pressed" : "released"); ++ } ++ input_sync(input); + + out: + return IRQ_HANDLED; diff --git a/queue-4.9/input-mpr121-set-missing-event-capability.patch b/queue-4.9/input-mpr121-set-missing-event-capability.patch new file mode 100644 index 00000000000..d15216da974 --- /dev/null +++ b/queue-4.9/input-mpr121-set-missing-event-capability.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Akinobu Mita +Date: Sun, 15 Jan 2017 14:44:05 -0800 +Subject: Input: mpr121 - set missing event capability + +From: Akinobu Mita + + +[ Upstream commit 9723ddc8fe0d76ce41fe0dc16afb241ec7d0a29d ] + +This driver reports misc scan input events on the sensor's status +register changes. But the event capability for them was not set in the +device initialization, so these events were ignored. + +This change adds the missing event capability. + +Signed-off-by: Akinobu Mita +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/keyboard/mpr121_touchkey.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/keyboard/mpr121_touchkey.c ++++ b/drivers/input/keyboard/mpr121_touchkey.c +@@ -236,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c + input_dev->id.bustype = BUS_I2C; + input_dev->dev.parent = &client->dev; + input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP); ++ input_set_capability(input_dev, EV_MSC, MSC_SCAN); + + input_dev->keycode = mpr121->keycodes; + input_dev->keycodesize = sizeof(mpr121->keycodes[0]); diff --git a/queue-4.9/iommu-arm-smmu-v3-clear-prior-settings-when-updating-stes.patch b/queue-4.9/iommu-arm-smmu-v3-clear-prior-settings-when-updating-stes.patch new file mode 100644 index 00000000000..90c43b48bc7 --- /dev/null +++ b/queue-4.9/iommu-arm-smmu-v3-clear-prior-settings-when-updating-stes.patch @@ -0,0 +1,48 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Nate Watterson +Date: Tue, 20 Dec 2016 23:11:48 -0500 +Subject: iommu/arm-smmu-v3: Clear prior settings when updating STEs + +From: Nate Watterson + + +[ Upstream commit 810871c57011eb3e89e6768932757f169d666cd2 ] + +To prevent corruption of the stage-1 context pointer field when +updating STEs, rebuild the entire containing dword instead of +clearing individual fields. + +Signed-off-by: Nate Watterson +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/arm-smmu-v3.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1040,13 +1040,8 @@ static void arm_smmu_write_strtab_ent(st + } + } + +- /* Nuke the existing Config, as we're going to rewrite it */ +- val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT); +- +- if (ste->valid) +- val |= STRTAB_STE_0_V; +- else +- val &= ~STRTAB_STE_0_V; ++ /* Nuke the existing STE_0 value, as we're going to rewrite it */ ++ val = ste->valid ? STRTAB_STE_0_V : 0; + + if (ste->bypass) { + val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT +@@ -1081,7 +1076,6 @@ static void arm_smmu_write_strtab_ent(st + val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK + << STRTAB_STE_0_S1CTXPTR_SHIFT) | + STRTAB_STE_0_CFG_S1_TRANS; +- + } + + if (ste->s2_cfg) { diff --git a/queue-4.9/ipsec-do-not-ignore-crypto-err-in-ah4-input.patch b/queue-4.9/ipsec-do-not-ignore-crypto-err-in-ah4-input.patch new file mode 100644 index 00000000000..3e6a22b48f1 --- /dev/null +++ b/queue-4.9/ipsec-do-not-ignore-crypto-err-in-ah4-input.patch @@ -0,0 +1,41 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Gilad Ben-Yossef +Date: Mon, 16 Jan 2017 13:17:55 +0200 +Subject: IPsec: do not ignore crypto err in ah4 input + +From: Gilad Ben-Yossef + + +[ Upstream commit ebd89a2d0675f1325c2be5b7576fd8cb7e8defd0 ] + +ah4 input processing uses the asynchronous hash crypto API which +supplies an error code as part of the operation completion but +the error code was being ignored. + +Treat a crypto API error indication as a verification failure. + +While a crypto API reported error would almost certainly result +in a memcpy of the digest failing anyway and thus the security +risk seems minor, performing a memory compare on what might be +uninitialized memory is wrong. + +Signed-off-by: Gilad Ben-Yossef +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/ah4.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/ipv4/ah4.c ++++ b/net/ipv4/ah4.c +@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_ + int ihl = ip_hdrlen(skb); + int ah_hlen = (ah->hdrlen + 2) << 2; + ++ if (err) ++ goto out; ++ + work_iph = AH_SKB_CB(skb)->tmp; + auth_data = ah_tmp_auth(work_iph, ihl); + icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len); diff --git a/queue-4.9/kvm-ppc-book-3s-xics-correct-the-real-mode-icp-rejecting-counter.patch b/queue-4.9/kvm-ppc-book-3s-xics-correct-the-real-mode-icp-rejecting-counter.patch new file mode 100644 index 00000000000..82aeb98dac0 --- /dev/null +++ b/queue-4.9/kvm-ppc-book-3s-xics-correct-the-real-mode-icp-rejecting-counter.patch @@ -0,0 +1,52 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Li Zhong +Date: Fri, 11 Nov 2016 12:57:33 +0800 +Subject: KVM: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter + +From: Li Zhong + + +[ Upstream commit 37451bc95dee0e666927d6ffdda302dbbaaae6fa ] + +Some counters are added in Commit 6e0365b78273 ("KVM: PPC: Book3S HV: +Add ICP real mode counters"), to provide some performance statistics to +determine whether further optimizing is needed for real mode functions. + +The n_reject counter counts how many times ICP rejects an irq because of +priority in real mode. The redelivery of an lsi that is still asserted +after eoi doesn't fall into this category, so the increasement there is +removed. + +Also, it needs to be increased in icp_rm_deliver_irq() if it rejects +another one. + +Signed-off-by: Li Zhong +Signed-off-by: Paul Mackerras +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kvm/book3s_hv_rm_xics.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kvm/book3s_hv_rm_xics.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c +@@ -376,6 +376,7 @@ static void icp_rm_deliver_irq(struct kv + */ + if (reject && reject != XICS_IPI) { + arch_spin_unlock(&ics->lock); ++ icp->n_reject++; + new_irq = reject; + goto again; + } +@@ -707,10 +708,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcp + state = &ics->irq_state[src]; + + /* Still asserted, resend it */ +- if (state->asserted) { +- icp->n_reject++; ++ if (state->asserted) + icp_rm_deliver_irq(xics, icp, irq); +- } + + if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) { + icp->rm_action |= XICS_RM_NOTIFY_EOI; diff --git a/queue-4.9/libertas-fix-improper-return-value.patch b/queue-4.9/libertas-fix-improper-return-value.patch new file mode 100644 index 00000000000..0f9e4b9c6dd --- /dev/null +++ b/queue-4.9/libertas-fix-improper-return-value.patch @@ -0,0 +1,39 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Pan Bian +Date: Sat, 3 Dec 2016 18:27:37 +0800 +Subject: libertas: fix improper return value + +From: Pan Bian + + +[ Upstream commit 259010c509b6f28b3b851ae45238cf526f52e185 ] + +Function lbs_cmd_802_11_sleep_params() always return 0, even if the call +to lbs_cmd_with_response() fails. In this case, the parameter @sp will +keep uninitialized. Because the return value is 0, its caller (say +lbs_sleepparams_read()) will not detect the error, and will copy the +uninitialized stack memory to user sapce, resulting in stack information +leak. To avoid the bug, this patch returns variable ret (which takes +the return value of lbs_cmd_with_response()) instead of 0. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451 + +Signed-off-by: Pan Bian +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/marvell/libertas/cmd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/marvell/libertas/cmd.c ++++ b/drivers/net/wireless/marvell/libertas/cmd.c +@@ -305,7 +305,7 @@ int lbs_cmd_802_11_sleep_params(struct l + } + + lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret); +- return 0; ++ return ret; + } + + static int lbs_wait_for_ds_awake(struct lbs_private *priv) diff --git a/queue-4.9/net-dsa-select-net_switchdev.patch b/queue-4.9/net-dsa-select-net_switchdev.patch new file mode 100644 index 00000000000..867523ab219 --- /dev/null +++ b/queue-4.9/net-dsa-select-net_switchdev.patch @@ -0,0 +1,44 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Vivien Didelot +Date: Mon, 9 Jan 2017 16:49:26 -0500 +Subject: net: dsa: select NET_SWITCHDEV + +From: Vivien Didelot + + +[ Upstream commit 3a89eaa65db68bf53bf92dedc60084f810e1779a ] + +The support for DSA Ethernet switch chips depends on TCP/IP networking, +thus explicit that HAVE_NET_DSA depends on INET. + +DSA uses SWITCHDEV, thus select it instead of depending on it. + +Signed-off-by: Vivien Didelot +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Tested-by: Randy Dunlap +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/Kconfig | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/dsa/Kconfig ++++ b/net/dsa/Kconfig +@@ -1,12 +1,13 @@ + config HAVE_NET_DSA + def_bool y +- depends on NETDEVICES && !S390 ++ depends on INET && NETDEVICES && !S390 + + # Drivers must select NET_DSA and the appropriate tagging format + + config NET_DSA + tristate "Distributed Switch Architecture" +- depends on HAVE_NET_DSA && NET_SWITCHDEV ++ depends on HAVE_NET_DSA ++ select NET_SWITCHDEV + select PHYLIB + ---help--- + Say Y if you want to enable support for the hardware switches supported diff --git a/queue-4.9/netfilter-nft_meta-deal-with-packet_loopback-in-netdev-family.patch b/queue-4.9/netfilter-nft_meta-deal-with-packet_loopback-in-netdev-family.patch new file mode 100644 index 00000000000..016b84b260c --- /dev/null +++ b/queue-4.9/netfilter-nft_meta-deal-with-packet_loopback-in-netdev-family.patch @@ -0,0 +1,75 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Liping Zhang +Date: Sat, 7 Jan 2017 21:33:55 +0800 +Subject: netfilter: nft_meta: deal with PACKET_LOOPBACK in netdev family + +From: Liping Zhang + + +[ Upstream commit f169fd695b192dd7b23aff8e69d25a1bc881bbfa ] + +After adding the following nft rule, then ping 224.0.0.1: + # nft add rule netdev t c pkttype host counter + +The warning complain message will be printed out again and again: + WARNING: CPU: 0 PID: 10182 at net/netfilter/nft_meta.c:163 \ + nft_meta_get_eval+0x3fe/0x460 [nft_meta] + [...] + Call Trace: + + dump_stack+0x85/0xc2 + __warn+0xcb/0xf0 + warn_slowpath_null+0x1d/0x20 + nft_meta_get_eval+0x3fe/0x460 [nft_meta] + nft_do_chain+0xff/0x5e0 [nf_tables] + +So we should deal with PACKET_LOOPBACK in netdev family too. For ipv4, +convert it to PACKET_BROADCAST/MULTICAST according to the destination +address's type; For ipv6, convert it to PACKET_MULTICAST directly. + +Signed-off-by: Liping Zhang +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_meta.c | 28 +++++++++++++++++++++++++++- + 1 file changed, 27 insertions(+), 1 deletion(-) + +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -159,8 +159,34 @@ void nft_meta_get_eval(const struct nft_ + else + *dest = PACKET_BROADCAST; + break; ++ case NFPROTO_NETDEV: ++ switch (skb->protocol) { ++ case htons(ETH_P_IP): { ++ int noff = skb_network_offset(skb); ++ struct iphdr *iph, _iph; ++ ++ iph = skb_header_pointer(skb, noff, ++ sizeof(_iph), &_iph); ++ if (!iph) ++ goto err; ++ ++ if (ipv4_is_multicast(iph->daddr)) ++ *dest = PACKET_MULTICAST; ++ else ++ *dest = PACKET_BROADCAST; ++ ++ break; ++ } ++ case htons(ETH_P_IPV6): ++ *dest = PACKET_MULTICAST; ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ goto err; ++ } ++ break; + default: +- WARN_ON(1); ++ WARN_ON_ONCE(1); + goto err; + } + break; diff --git a/queue-4.9/pci-mvebu-handle-changes-to-the-bridge-windows-while-enabled.patch b/queue-4.9/pci-mvebu-handle-changes-to-the-bridge-windows-while-enabled.patch new file mode 100644 index 00000000000..8c5a73d0b78 --- /dev/null +++ b/queue-4.9/pci-mvebu-handle-changes-to-the-bridge-windows-while-enabled.patch @@ -0,0 +1,184 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Jason Gunthorpe +Date: Mon, 12 Dec 2016 11:30:20 -0700 +Subject: PCI: mvebu: Handle changes to the bridge windows while enabled + +From: Jason Gunthorpe + + +[ Upstream commit d9bf28e2650fe3eeefed7e34841aea07d10c6543 ] + +The PCI core will write to the bridge window config multiple times while +they are enabled. This can lead to mbus failures like this: + + mvebu_mbus: cannot add window '4:e8', conflicts with another window + mvebu-pcie mbus:pex@e0000000: Could not create MBus window at [mem 0xe0000000-0xe00fffff]: -22 + +For me this is happening during a hotplug cycle. The PCI core is not +changing the values, just writing them twice while active. + +The patch addresses the general case of any change to an active window, but +not atomically. The code is slightly refactored so io and mem can share +more of the window logic. + +Signed-off-by: Jason Gunthorpe +Signed-off-by: Bjorn Helgaas +Acked-by: Jason Cooper +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/host/pci-mvebu.c | 101 +++++++++++++++++++++++++------------------ + 1 file changed, 60 insertions(+), 41 deletions(-) + +--- a/drivers/pci/host/pci-mvebu.c ++++ b/drivers/pci/host/pci-mvebu.c +@@ -133,6 +133,12 @@ struct mvebu_pcie { + int nports; + }; + ++struct mvebu_pcie_window { ++ phys_addr_t base; ++ phys_addr_t remap; ++ size_t size; ++}; ++ + /* Structure representing one PCIe interface */ + struct mvebu_pcie_port { + char *name; +@@ -150,10 +156,8 @@ struct mvebu_pcie_port { + struct mvebu_sw_pci_bridge bridge; + struct device_node *dn; + struct mvebu_pcie *pcie; +- phys_addr_t memwin_base; +- size_t memwin_size; +- phys_addr_t iowin_base; +- size_t iowin_size; ++ struct mvebu_pcie_window memwin; ++ struct mvebu_pcie_window iowin; + u32 saved_pcie_stat; + }; + +@@ -379,23 +383,45 @@ static void mvebu_pcie_add_windows(struc + } + } + ++static void mvebu_pcie_set_window(struct mvebu_pcie_port *port, ++ unsigned int target, unsigned int attribute, ++ const struct mvebu_pcie_window *desired, ++ struct mvebu_pcie_window *cur) ++{ ++ if (desired->base == cur->base && desired->remap == cur->remap && ++ desired->size == cur->size) ++ return; ++ ++ if (cur->size != 0) { ++ mvebu_pcie_del_windows(port, cur->base, cur->size); ++ cur->size = 0; ++ cur->base = 0; ++ ++ /* ++ * If something tries to change the window while it is enabled ++ * the change will not be done atomically. That would be ++ * difficult to do in the general case. ++ */ ++ } ++ ++ if (desired->size == 0) ++ return; ++ ++ mvebu_pcie_add_windows(port, target, attribute, desired->base, ++ desired->size, desired->remap); ++ *cur = *desired; ++} ++ + static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + { +- phys_addr_t iobase; ++ struct mvebu_pcie_window desired = {}; + + /* Are the new iobase/iolimit values invalid? */ + if (port->bridge.iolimit < port->bridge.iobase || + port->bridge.iolimitupper < port->bridge.iobaseupper || + !(port->bridge.command & PCI_COMMAND_IO)) { +- +- /* If a window was configured, remove it */ +- if (port->iowin_base) { +- mvebu_pcie_del_windows(port, port->iowin_base, +- port->iowin_size); +- port->iowin_base = 0; +- port->iowin_size = 0; +- } +- ++ mvebu_pcie_set_window(port, port->io_target, port->io_attr, ++ &desired, &port->iowin); + return; + } + +@@ -412,32 +438,27 @@ static void mvebu_pcie_handle_iobase_cha + * specifications. iobase is the bus address, port->iowin_base + * is the CPU address. + */ +- iobase = ((port->bridge.iobase & 0xF0) << 8) | +- (port->bridge.iobaseupper << 16); +- port->iowin_base = port->pcie->io.start + iobase; +- port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | +- (port->bridge.iolimitupper << 16)) - +- iobase) + 1; +- +- mvebu_pcie_add_windows(port, port->io_target, port->io_attr, +- port->iowin_base, port->iowin_size, +- iobase); ++ desired.remap = ((port->bridge.iobase & 0xF0) << 8) | ++ (port->bridge.iobaseupper << 16); ++ desired.base = port->pcie->io.start + desired.remap; ++ desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | ++ (port->bridge.iolimitupper << 16)) - ++ desired.remap) + ++ 1; ++ ++ mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired, ++ &port->iowin); + } + + static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) + { ++ struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP}; ++ + /* Are the new membase/memlimit values invalid? */ + if (port->bridge.memlimit < port->bridge.membase || + !(port->bridge.command & PCI_COMMAND_MEMORY)) { +- +- /* If a window was configured, remove it */ +- if (port->memwin_base) { +- mvebu_pcie_del_windows(port, port->memwin_base, +- port->memwin_size); +- port->memwin_base = 0; +- port->memwin_size = 0; +- } +- ++ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, ++ &desired, &port->memwin); + return; + } + +@@ -447,14 +468,12 @@ static void mvebu_pcie_handle_membase_ch + * window to setup, according to the PCI-to-PCI bridge + * specifications. + */ +- port->memwin_base = ((port->bridge.membase & 0xFFF0) << 16); +- port->memwin_size = +- (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - +- port->memwin_base + 1; +- +- mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr, +- port->memwin_base, port->memwin_size, +- MVEBU_MBUS_NO_REMAP); ++ desired.base = ((port->bridge.membase & 0xFFF0) << 16); ++ desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - ++ desired.base + 1; ++ ++ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired, ++ &port->memwin); + } + + /* diff --git a/queue-4.9/phy-increase-size-of-mii_bus_id_size-and-bus_id.patch b/queue-4.9/phy-increase-size-of-mii_bus_id_size-and-bus_id.patch new file mode 100644 index 00000000000..a16169e64ba --- /dev/null +++ b/queue-4.9/phy-increase-size-of-mii_bus_id_size-and-bus_id.patch @@ -0,0 +1,49 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Volodymyr Bendiuga +Date: Thu, 19 Jan 2017 17:05:04 +0100 +Subject: phy: increase size of MII_BUS_ID_SIZE and bus_id + +From: Volodymyr Bendiuga + + +[ Upstream commit 4567d686f5c6d955e57a3afa1741944c1e7f4033 ] + +Some bus names are pretty long and do not fit into +17 chars. Increase therefore MII_BUS_ID_SIZE and +phy_fixup.bus_id to larger number. Now mii_bus.id +can host larger name. + +Signed-off-by: Volodymyr Bendiuga +Signed-off-by: Magnus Öberg +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/phy.h | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -142,11 +142,7 @@ static inline const char *phy_modes(phy_ + /* Used when trying to connect to a specific phy (mii bus id:phy device id) */ + #define PHY_ID_FMT "%s:%02x" + +-/* +- * Need to be a little smaller than phydev->dev.bus_id to leave room +- * for the ":%02x" +- */ +-#define MII_BUS_ID_SIZE (20 - 3) ++#define MII_BUS_ID_SIZE 61 + + /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit + IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */ +@@ -602,7 +598,7 @@ struct phy_driver { + /* A Structure for boards to register fixups with the PHY Lib */ + struct phy_fixup { + struct list_head list; +- char bus_id[20]; ++ char bus_id[MII_BUS_ID_SIZE + 3]; + u32 phy_uid; + u32 phy_uid_mask; + int (*run)(struct phy_device *phydev); diff --git a/queue-4.9/pinctrl-baytrail-fix-debugfs-offset-output.patch b/queue-4.9/pinctrl-baytrail-fix-debugfs-offset-output.patch new file mode 100644 index 00000000000..e4f2eba8d02 --- /dev/null +++ b/queue-4.9/pinctrl-baytrail-fix-debugfs-offset-output.patch @@ -0,0 +1,33 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Alexander Stein +Date: Thu, 26 Jan 2017 14:17:54 +0100 +Subject: pinctrl: baytrail: Fix debugfs offset output + +From: Alexander Stein + + +[ Upstream commit 3655a1ca6bd8e7300f2bb196208d5139aa6b2eda ] + +Apparently each GPIO pad's register are 16 bytes, so multiply the pad_map +by that. The same is done in byt_gpio_reg the only other place where +pad_map is used. + +Signed-off-by: Alexander Stein +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -1466,7 +1466,7 @@ static void byt_gpio_dbg_show(struct seq + val & BYT_INPUT_EN ? " " : "in", + val & BYT_OUTPUT_EN ? " " : "out", + val & BYT_LEVEL ? "hi" : "lo", +- comm->pad_map[i], comm->pad_map[i] * 32, ++ comm->pad_map[i], comm->pad_map[i] * 16, + conf0 & 0x7, + conf0 & BYT_TRIG_NEG ? " fall" : " ", + conf0 & BYT_TRIG_POS ? " rise" : " ", diff --git a/queue-4.9/pm-opp-error-out-on-failing-to-add-static-opps-for-v1-bindings.patch b/queue-4.9/pm-opp-error-out-on-failing-to-add-static-opps-for-v1-bindings.patch new file mode 100644 index 00000000000..fd296069cc0 --- /dev/null +++ b/queue-4.9/pm-opp-error-out-on-failing-to-add-static-opps-for-v1-bindings.patch @@ -0,0 +1,50 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Viresh Kumar +Date: Mon, 2 Jan 2017 14:40:58 +0530 +Subject: PM / OPP: Error out on failing to add static OPPs for v1 bindings + +From: Viresh Kumar + + +[ Upstream commit 04a86a84c42ca18f37ab446127dc619b41dd3b23 ] + +The code adding static OPPs for V2 bindings already does so. Make the V1 +bindings specific code behave the same. + +Signed-off-by: Viresh Kumar +Reviewed-by: Stephen Boyd +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/power/opp/of.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +--- a/drivers/base/power/opp/of.c ++++ b/drivers/base/power/opp/of.c +@@ -386,7 +386,7 @@ static int _of_add_opp_table_v1(struct d + { + const struct property *prop; + const __be32 *val; +- int nr; ++ int nr, ret; + + prop = of_find_property(dev->of_node, "operating-points", NULL); + if (!prop) +@@ -409,9 +409,13 @@ static int _of_add_opp_table_v1(struct d + unsigned long freq = be32_to_cpup(val++) * 1000; + unsigned long volt = be32_to_cpup(val++); + +- if (_opp_add_v1(dev, freq, volt, false)) +- dev_warn(dev, "%s: Failed to add OPP %ld\n", +- __func__, freq); ++ ret = _opp_add_v1(dev, freq, volt, false); ++ if (ret) { ++ dev_err(dev, "%s: Failed to add OPP %ld (%d)\n", ++ __func__, freq, ret); ++ dev_pm_opp_of_remove_table(dev); ++ return ret; ++ } + nr -= 2; + } + diff --git a/queue-4.9/powerpc-corenet-explicitly-disable-the-sdhc-controller-on-kmcoge4.patch b/queue-4.9/powerpc-corenet-explicitly-disable-the-sdhc-controller-on-kmcoge4.patch new file mode 100644 index 00000000000..89e51a07e73 --- /dev/null +++ b/queue-4.9/powerpc-corenet-explicitly-disable-the-sdhc-controller-on-kmcoge4.patch @@ -0,0 +1,34 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Valentin Longchamp +Date: Thu, 15 Dec 2016 14:22:26 +0100 +Subject: powerpc/corenet: explicitly disable the SDHC controller on kmcoge4 + +From: Valentin Longchamp + + +[ Upstream commit a674c7d470bb47e82f4eb1fa944eadeac2f6bbaf ] + +It is not implemented on the kmcoge4 hardware and if not disabled it +leads to error messages with the corenet32_smp_defconfig. + +Signed-off-by: Valentin Longchamp +Signed-off-by: Scott Wood +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/boot/dts/fsl/kmcoge4.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts ++++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts +@@ -83,6 +83,10 @@ + }; + }; + ++ sdhc@114000 { ++ status = "disabled"; ++ }; ++ + i2c@119000 { + status = "disabled"; + }; diff --git a/queue-4.9/rt2800usb-mark-tx-failure-on-timeout.patch b/queue-4.9/rt2800usb-mark-tx-failure-on-timeout.patch new file mode 100644 index 00000000000..ac92fa6cbe1 --- /dev/null +++ b/queue-4.9/rt2800usb-mark-tx-failure-on-timeout.patch @@ -0,0 +1,36 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Stanislaw Gruszka +Date: Fri, 6 Jan 2017 14:05:16 +0100 +Subject: rt2800usb: mark tx failure on timeout + +From: Stanislaw Gruszka + + +[ Upstream commit 1701221696764b6861d0ee66850812a8900b9b9b ] + +If we do not get TX status in reasonable time, we most likely fail to +send frame hence mark it as so. + +Signed-off-by: Stanislaw Gruszka +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ralink/rt2x00/rt2800usb.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/net/wireless/ralink/rt2x00/rt2800usb.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2800usb.c +@@ -646,10 +646,9 @@ static void rt2800usb_txdone_nostatus(st + !test_bit(ENTRY_DATA_STATUS_PENDING, &entry->flags)) + break; + +- if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags)) ++ if (test_bit(ENTRY_DATA_IO_FAILED, &entry->flags) || ++ rt2800usb_entry_txstatus_timeout(entry)) + rt2x00lib_txdone_noinfo(entry, TXDONE_FAILURE); +- else if (rt2800usb_entry_txstatus_timeout(entry)) +- rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN); + else + break; + } diff --git a/queue-4.9/s390-qeth-fix-retrieval-of-vipa-and-proxy-arp-addresses.patch b/queue-4.9/s390-qeth-fix-retrieval-of-vipa-and-proxy-arp-addresses.patch new file mode 100644 index 00000000000..b38b6f54307 --- /dev/null +++ b/queue-4.9/s390-qeth-fix-retrieval-of-vipa-and-proxy-arp-addresses.patch @@ -0,0 +1,115 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Ursula Braun +Date: Thu, 12 Jan 2017 15:48:43 +0100 +Subject: s390/qeth: fix retrieval of vipa and proxy-arp addresses + +From: Ursula Braun + + +[ Upstream commit e48b9eaaa29a0a7d5da2df136b07eefa0180d584 ] + +qeth devices in layer3 mode need a separate handling of vipa and proxy-arp +addresses. vipa and proxy-arp addresses processed by qeth can be read from +userspace. Introduced with commit 5f78e29ceebf ("qeth: optimize IP handling +in rx_mode callback") the retrieval of vipa and proxy-arp addresses is +broken, if more than one vipa or proxy-arp address are set. + +The qeth code used local variable "int i" for 2 different purposes. This +patch now spends 2 separate local variables of type "int". +While touching these functions hash_for_each_safe() is converted to +hash_for_each(), since there is no removal of hash entries. + +Signed-off-by: Ursula Braun +Reviewed-by: Julian Wiedmann +Reference-ID: RQM 3524 +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/net/qeth_l3_sys.c | 30 ++++++++++++++++-------------- + 1 file changed, 16 insertions(+), 14 deletions(-) + +--- a/drivers/s390/net/qeth_l3_sys.c ++++ b/drivers/s390/net/qeth_l3_sys.c +@@ -692,15 +692,15 @@ static ssize_t qeth_l3_dev_vipa_add_show + enum qeth_prot_versions proto) + { + struct qeth_ipaddr *ipaddr; +- struct hlist_node *tmp; + char addr_str[40]; ++ int str_len = 0; + int entry_len; /* length of 1 entry string, differs between v4 and v6 */ +- int i = 0; ++ int i; + + entry_len = (proto == QETH_PROT_IPV4)? 12 : 40; + entry_len += 2; /* \n + terminator */ + spin_lock_bh(&card->ip_lock); +- hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) { ++ hash_for_each(card->ip_htable, i, ipaddr, hnode) { + if (ipaddr->proto != proto) + continue; + if (ipaddr->type != QETH_IP_TYPE_VIPA) +@@ -708,16 +708,17 @@ static ssize_t qeth_l3_dev_vipa_add_show + /* String must not be longer than PAGE_SIZE. So we check if + * string length gets near PAGE_SIZE. Then we can savely display + * the next IPv6 address (worst case, compared to IPv4) */ +- if ((PAGE_SIZE - i) <= entry_len) ++ if ((PAGE_SIZE - str_len) <= entry_len) + break; + qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u, + addr_str); +- i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str); ++ str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n", ++ addr_str); + } + spin_unlock_bh(&card->ip_lock); +- i += snprintf(buf + i, PAGE_SIZE - i, "\n"); ++ str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n"); + +- return i; ++ return str_len; + } + + static ssize_t qeth_l3_dev_vipa_add4_show(struct device *dev, +@@ -854,15 +855,15 @@ static ssize_t qeth_l3_dev_rxip_add_show + enum qeth_prot_versions proto) + { + struct qeth_ipaddr *ipaddr; +- struct hlist_node *tmp; + char addr_str[40]; ++ int str_len = 0; + int entry_len; /* length of 1 entry string, differs between v4 and v6 */ +- int i = 0; ++ int i; + + entry_len = (proto == QETH_PROT_IPV4)? 12 : 40; + entry_len += 2; /* \n + terminator */ + spin_lock_bh(&card->ip_lock); +- hash_for_each_safe(card->ip_htable, i, tmp, ipaddr, hnode) { ++ hash_for_each(card->ip_htable, i, ipaddr, hnode) { + if (ipaddr->proto != proto) + continue; + if (ipaddr->type != QETH_IP_TYPE_RXIP) +@@ -870,16 +871,17 @@ static ssize_t qeth_l3_dev_rxip_add_show + /* String must not be longer than PAGE_SIZE. So we check if + * string length gets near PAGE_SIZE. Then we can savely display + * the next IPv6 address (worst case, compared to IPv4) */ +- if ((PAGE_SIZE - i) <= entry_len) ++ if ((PAGE_SIZE - str_len) <= entry_len) + break; + qeth_l3_ipaddr_to_string(proto, (const u8 *)&ipaddr->u, + addr_str); +- i += snprintf(buf + i, PAGE_SIZE - i, "%s\n", addr_str); ++ str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "%s\n", ++ addr_str); + } + spin_unlock_bh(&card->ip_lock); +- i += snprintf(buf + i, PAGE_SIZE - i, "\n"); ++ str_len += snprintf(buf + str_len, PAGE_SIZE - str_len, "\n"); + +- return i; ++ return str_len; + } + + static ssize_t qeth_l3_dev_rxip_add4_show(struct device *dev, diff --git a/queue-4.9/s390-qeth-issue-startlan-as-first-ipa-command.patch b/queue-4.9/s390-qeth-issue-startlan-as-first-ipa-command.patch new file mode 100644 index 00000000000..397925a6103 --- /dev/null +++ b/queue-4.9/s390-qeth-issue-startlan-as-first-ipa-command.patch @@ -0,0 +1,145 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Julian Wiedmann +Date: Thu, 12 Jan 2017 15:48:42 +0100 +Subject: s390/qeth: issue STARTLAN as first IPA command + +From: Julian Wiedmann + + +[ Upstream commit 1034051045d125579ab1e8fcd5a724eeb0e70149 ] + +STARTLAN needs to be the first IPA command after MPC initialization +completes. +So move the qeth_send_startlan() call from the layer disciplines +into the core path, right after the MPC handshake. +While at it, replace the magic LAN OFFLINE return code +with the existing enum. + +Signed-off-by: Julian Wiedmann +Reviewed-by: Thomas Richter +Reviewed-by: Ursula Braun +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/s390/net/qeth_core.h | 1 - + drivers/s390/net/qeth_core_main.c | 21 +++++++++++++++++---- + drivers/s390/net/qeth_l2_main.c | 15 --------------- + drivers/s390/net/qeth_l3_main.c | 15 --------------- + 4 files changed, 17 insertions(+), 35 deletions(-) + +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -921,7 +921,6 @@ void qeth_clear_thread_running_bit(struc + int qeth_core_hardsetup_card(struct qeth_card *); + void qeth_print_status_message(struct qeth_card *); + int qeth_init_qdio_queues(struct qeth_card *); +-int qeth_send_startlan(struct qeth_card *); + int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *, + int (*reply_cb) + (struct qeth_card *, struct qeth_reply *, unsigned long), +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2944,7 +2944,7 @@ int qeth_send_ipa_cmd(struct qeth_card * + } + EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd); + +-int qeth_send_startlan(struct qeth_card *card) ++static int qeth_send_startlan(struct qeth_card *card) + { + int rc; + struct qeth_cmd_buffer *iob; +@@ -2957,7 +2957,6 @@ int qeth_send_startlan(struct qeth_card + rc = qeth_send_ipa_cmd(card, iob, NULL, NULL); + return rc; + } +-EXPORT_SYMBOL_GPL(qeth_send_startlan); + + static int qeth_default_setadapterparms_cb(struct qeth_card *card, + struct qeth_reply *reply, unsigned long data) +@@ -5091,6 +5090,20 @@ retriable: + goto out; + } + ++ rc = qeth_send_startlan(card); ++ if (rc) { ++ QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); ++ if (rc == IPA_RC_LAN_OFFLINE) { ++ dev_warn(&card->gdev->dev, ++ "The LAN is offline\n"); ++ card->lan_online = 0; ++ } else { ++ rc = -ENODEV; ++ goto out; ++ } ++ } else ++ card->lan_online = 1; ++ + card->options.ipa4.supported_funcs = 0; + card->options.ipa6.supported_funcs = 0; + card->options.adp.supported_funcs = 0; +@@ -5102,14 +5115,14 @@ retriable: + if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) { + rc = qeth_query_setadapterparms(card); + if (rc < 0) { +- QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); ++ QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); + goto out; + } + } + if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) { + rc = qeth_query_setdiagass(card); + if (rc < 0) { +- QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); ++ QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc); + goto out; + } + } +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -1204,21 +1204,6 @@ static int __qeth_l2_set_online(struct c + /* softsetup */ + QETH_DBF_TEXT(SETUP, 2, "softsetp"); + +- rc = qeth_send_startlan(card); +- if (rc) { +- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); +- if (rc == 0xe080) { +- dev_warn(&card->gdev->dev, +- "The LAN is offline\n"); +- card->lan_online = 0; +- goto contin; +- } +- rc = -ENODEV; +- goto out_remove; +- } else +- card->lan_online = 1; +- +-contin: + if ((card->info.type == QETH_CARD_TYPE_OSD) || + (card->info.type == QETH_CARD_TYPE_OSX)) { + rc = qeth_l2_start_ipassists(card); +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3230,21 +3230,6 @@ static int __qeth_l3_set_online(struct c + /* softsetup */ + QETH_DBF_TEXT(SETUP, 2, "softsetp"); + +- rc = qeth_send_startlan(card); +- if (rc) { +- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); +- if (rc == 0xe080) { +- dev_warn(&card->gdev->dev, +- "The LAN is offline\n"); +- card->lan_online = 0; +- goto contin; +- } +- rc = -ENODEV; +- goto out_remove; +- } else +- card->lan_online = 1; +- +-contin: + rc = qeth_l3_setadapter_parms(card); + if (rc) + QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc); diff --git a/queue-4.9/s390-topology-make-topology-off-parameter-work.patch b/queue-4.9/s390-topology-make-topology-off-parameter-work.patch new file mode 100644 index 00000000000..0d68c71eff8 --- /dev/null +++ b/queue-4.9/s390-topology-make-topology-off-parameter-work.patch @@ -0,0 +1,94 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Heiko Carstens +Date: Thu, 29 Dec 2016 13:52:52 +0100 +Subject: s390/topology: make "topology=off" parameter work + +From: Heiko Carstens + + +[ Upstream commit 68cc795d1933285705ced6d841ef66c00ce98cbe ] + +The "topology=off" kernel parameter is supposed to prevent the kernel +to use hardware topology information to generate scheduling domains +etc. +For an unknown reason I implemented this in a very odd way back then: +instead of simply clearing the MACHINE_HAS_TOPOLOGY flag within the +lowcore I added a second variable which indicated that topology +information should not be used. This is more than suboptimal since it +partially doesn't work. For the fake NUMA case topology information +is still considered and scheduling domains will be created based on +this. +To fix this and to simplify the code get rid of the extra variable and +implement the "topology=off" case like it is done for other features. + +Signed-off-by: Heiko Carstens +Signed-off-by: Martin Schwidefsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/early.c | 12 ++++++++++++ + arch/s390/kernel/topology.c | 11 ++--------- + 2 files changed, 14 insertions(+), 9 deletions(-) + +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -363,6 +363,18 @@ static inline void save_vector_registers + #endif + } + ++static int __init topology_setup(char *str) ++{ ++ bool enabled; ++ int rc; ++ ++ rc = kstrtobool(str, &enabled); ++ if (!rc && !enabled) ++ S390_lowcore.machine_flags &= ~MACHINE_HAS_TOPOLOGY; ++ return rc; ++} ++early_param("topology", topology_setup); ++ + static int __init disable_vector_extension(char *str) + { + S390_lowcore.machine_flags &= ~MACHINE_FLAG_VX; +--- a/arch/s390/kernel/topology.c ++++ b/arch/s390/kernel/topology.c +@@ -37,7 +37,6 @@ static void set_topology_timer(void); + static void topology_work_fn(struct work_struct *work); + static struct sysinfo_15_1_x *tl_info; + +-static bool topology_enabled = true; + static DECLARE_WORK(topology_work, topology_work_fn); + + /* +@@ -56,7 +55,7 @@ static cpumask_t cpu_group_map(struct ma + cpumask_t mask; + + cpumask_copy(&mask, cpumask_of(cpu)); +- if (!topology_enabled || !MACHINE_HAS_TOPOLOGY) ++ if (!MACHINE_HAS_TOPOLOGY) + return mask; + for (; info; info = info->next) { + if (cpumask_test_cpu(cpu, &info->mask)) +@@ -71,7 +70,7 @@ static cpumask_t cpu_thread_map(unsigned + int i; + + cpumask_copy(&mask, cpumask_of(cpu)); +- if (!topology_enabled || !MACHINE_HAS_TOPOLOGY) ++ if (!MACHINE_HAS_TOPOLOGY) + return mask; + cpu -= cpu % (smp_cpu_mtid + 1); + for (i = 0; i <= smp_cpu_mtid; i++) +@@ -413,12 +412,6 @@ static const struct cpumask *cpu_drawer_ + return &per_cpu(cpu_topology, cpu).drawer_mask; + } + +-static int __init early_parse_topology(char *p) +-{ +- return kstrtobool(p, &topology_enabled); +-} +-early_param("topology", early_parse_topology); +- + static struct sched_domain_topology_level s390_topology[] = { + { cpu_thread_mask, cpu_smt_flags, SD_INIT_NAME(SMT) }, + { cpu_coregroup_mask, cpu_core_flags, SD_INIT_NAME(MC) }, diff --git a/queue-4.9/sched-core-add-missing-update_rq_clock-call-in-sched_move_task.patch b/queue-4.9/sched-core-add-missing-update_rq_clock-call-in-sched_move_task.patch new file mode 100644 index 00000000000..58bc53bb7cb --- /dev/null +++ b/queue-4.9/sched-core-add-missing-update_rq_clock-call-in-sched_move_task.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Peter Zijlstra +Date: Mon, 23 Jan 2017 16:05:55 +0100 +Subject: sched/core: Add missing update_rq_clock() call in sched_move_task() + +From: Peter Zijlstra + + +[ Upstream commit 1b1d62254df0fe42a711eb71948f915918987790 ] + +Bug was noticed via this warning: + + WARNING: CPU: 6 PID: 1 at kernel/sched/sched.h:804 detach_task_cfs_rq+0x8e8/0xb80 + rq->clock_update_flags < RQCF_ACT_SKIP + Modules linked in: + CPU: 6 PID: 1 Comm: systemd Not tainted 4.10.0-rc5-00140-g0874170baf55-dirty #1 + Hardware name: Supermicro SYS-4048B-TRFT/X10QBi, BIOS 1.0 04/11/2014 + Call Trace: + dump_stack+0x4d/0x65 + __warn+0xcb/0xf0 + warn_slowpath_fmt+0x5f/0x80 + detach_task_cfs_rq+0x8e8/0xb80 + ? allocate_cgrp_cset_links+0x59/0x80 + task_change_group_fair+0x27/0x150 + sched_change_group+0x48/0xf0 + sched_move_task+0x53/0x150 + cpu_cgroup_attach+0x36/0x70 + cgroup_taskset_migrate+0x175/0x300 + cgroup_migrate+0xab/0xd0 + cgroup_attach_task+0xf0/0x190 + __cgroup_procs_write+0x1ed/0x2f0 + cgroup_procs_write+0x14/0x20 + cgroup_file_write+0x3f/0x100 + kernfs_fop_write+0x104/0x180 + __vfs_write+0x37/0x140 + vfs_write+0xb8/0x1b0 + SyS_write+0x55/0xc0 + do_syscall_64+0x61/0x170 + entry_SYSCALL64_slow_path+0x25/0x25 + +Reported-by: Ingo Molnar +Reported-by: Borislav Petkov +Signed-off-by: Peter Zijlstra (Intel) +Cc: Linus Torvalds +Cc: Mike Galbraith +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + kernel/sched/core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7961,6 +7961,7 @@ void sched_move_task(struct task_struct + struct rq *rq; + + rq = task_rq_lock(tsk, &rf); ++ update_rq_clock(rq); + + running = task_current(rq, tsk); + queued = task_on_rq_queued(tsk); diff --git a/queue-4.9/sched-cputime-powerpc32-fix-stale-scaled-stime-on-context-switch.patch b/queue-4.9/sched-cputime-powerpc32-fix-stale-scaled-stime-on-context-switch.patch new file mode 100644 index 00000000000..b5ffa1edb8d --- /dev/null +++ b/queue-4.9/sched-cputime-powerpc32-fix-stale-scaled-stime-on-context-switch.patch @@ -0,0 +1,58 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Frederic Weisbecker +Date: Thu, 5 Jan 2017 18:11:41 +0100 +Subject: sched/cputime, powerpc32: Fix stale scaled stime on context switch + +From: Frederic Weisbecker + + +[ Upstream commit 90d08ba2b9b4be4aeca6a5b5a4b09fbcde30194d ] + +On context switch with powerpc32, the cputime is accumulated in the +thread_info struct. So the switching-in task must move forward its +start time snapshot to the current time in order to later compute the +delta spent in system mode. + +This is what we do for the normal cputime by initializing the starttime +field to the value of the previous task's starttime which got freshly +updated. + +But we are missing the update of the scaled cputime start time. As a +result we may be accounting too much scaled cputime later. + +Fix this by initializing the scaled cputime the same way we do for +normal cputime. + +Signed-off-by: Frederic Weisbecker +Acked-by: Thomas Gleixner +Cc: Benjamin Herrenschmidt +Cc: Christian Borntraeger +Cc: Fenghua Yu +Cc: Heiko Carstens +Cc: Linus Torvalds +Cc: Martin Schwidefsky +Cc: Michael Ellerman +Cc: Paul Mackerras +Cc: Peter Zijlstra +Cc: Rik van Riel +Cc: Stanislaw Gruszka +Cc: Tony Luck +Cc: Wanpeng Li +Link: http://lkml.kernel.org/r/1483636310-6557-2-git-send-email-fweisbec@gmail.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/powerpc/kernel/time.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -407,6 +407,7 @@ void arch_vtime_task_switch(struct task_ + struct cpu_accounting_data *acct = get_accounting(current); + + acct->starttime = get_accounting(prev)->starttime; ++ acct->startspurr = get_accounting(prev)->startspurr; + acct->system_time = 0; + acct->user_time = 0; + } diff --git a/queue-4.9/serial-sh-sci-fix-register-offsets-for-the-irda-serial-port.patch b/queue-4.9/serial-sh-sci-fix-register-offsets-for-the-irda-serial-port.patch new file mode 100644 index 00000000000..eaecc06e383 --- /dev/null +++ b/queue-4.9/serial-sh-sci-fix-register-offsets-for-the-irda-serial-port.patch @@ -0,0 +1,64 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Laurent Pinchart +Date: Wed, 11 Jan 2017 16:43:32 +0200 +Subject: serial: sh-sci: Fix register offsets for the IRDA serial port + +From: Laurent Pinchart + + +[ Upstream commit a752ba18af8285e3eeda572f40dddaebff0c3621 ] + +Even though most of its registers are 8-bit wide, the IRDA has two +16-bit registers that make it a 16-bit peripheral and not a 8-bit +peripheral with addresses shifted by one. Fix the registers offset in +the driver and the platform data regshift value. + +Signed-off-by: Laurent Pinchart +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/sh/kernel/cpu/sh3/setup-sh770x.c | 1 - + drivers/tty/serial/sh-sci.c | 17 ++++++++--------- + 2 files changed, 8 insertions(+), 10 deletions(-) + +--- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c ++++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c +@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platfo + .scscr = SCSCR_TE | SCSCR_RE, + .type = PORT_IRDA, + .ops = &sh770x_sci_port_ops, +- .regshift = 1, + }; + + static struct resource scif2_resources[] = { +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -193,18 +193,17 @@ static const struct plat_sci_reg sci_reg + }, + + /* +- * Common definitions for legacy IrDA ports, dependent on +- * regshift value. ++ * Common definitions for legacy IrDA ports. + */ + [SCIx_IRDA_REGTYPE] = { + [SCSMR] = { 0x00, 8 }, +- [SCBRR] = { 0x01, 8 }, +- [SCSCR] = { 0x02, 8 }, +- [SCxTDR] = { 0x03, 8 }, +- [SCxSR] = { 0x04, 8 }, +- [SCxRDR] = { 0x05, 8 }, +- [SCFCR] = { 0x06, 8 }, +- [SCFDR] = { 0x07, 16 }, ++ [SCBRR] = { 0x02, 8 }, ++ [SCSCR] = { 0x04, 8 }, ++ [SCxTDR] = { 0x06, 8 }, ++ [SCxSR] = { 0x08, 16 }, ++ [SCxRDR] = { 0x0a, 8 }, ++ [SCFCR] = { 0x0c, 8 }, ++ [SCFDR] = { 0x0e, 16 }, + [SCTFDR] = sci_reg_invalid, + [SCRFDR] = sci_reg_invalid, + [SCSPTR] = sci_reg_invalid, diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..542f744b8fc --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,49 @@ +adv7604-initialize-drive-strength-to-default-when-using-dt.patch +video-fbdev-pmag-ba-fb-remove-bad-__init-annotation.patch +pci-mvebu-handle-changes-to-the-bridge-windows-while-enabled.patch +sched-core-add-missing-update_rq_clock-call-in-sched_move_task.patch +xen-netback-set-default-upper-limit-of-tx-rx-queues-to-8.patch +arm-dts-imx53-qsb-common-fix-fec-pinmux-config.patch +dt-bindings-clockgen-add-compatible-string-for-ls1012a.patch +edac-amd64-add-x86cpuid-sanity-check-during-init.patch +pm-opp-error-out-on-failing-to-add-static-opps-for-v1-bindings.patch +clk-samsung-exynos5433-add-ids-for-phyclk_mipidphy0_-clocks.patch +drm-drm_minor_register-clean-up-debugfs-on-failure.patch +kvm-ppc-book-3s-xics-correct-the-real-mode-icp-rejecting-counter.patch +iommu-arm-smmu-v3-clear-prior-settings-when-updating-stes.patch +pinctrl-baytrail-fix-debugfs-offset-output.patch +powerpc-corenet-explicitly-disable-the-sdhc-controller-on-kmcoge4.patch +cxl-force-psl-data-cache-flush-during-device-shutdown.patch +arm-omap2plus_defconfig-fix-probe-errors-on-uarts-5-and-6.patch +arm64-dma-mapping-only-swizzle-dma-ops-for-iommu_domain_dma.patch +crypto-vmx-disable-preemption-to-enable-vsx-in-aes_ctr.c.patch +drm-mali-dp-fix-lx_control-register-fields-clobber.patch +iio-trigger-free-trigger-resource-correctly.patch +iio-pressure-ms5611-claim-direct-mode-during-oversampling-changes.patch +iio-magnetometer-mag3110-claim-direct-mode-during-raw-writes.patch +iio-proximity-sx9500-claim-direct-mode-during-raw-proximity-reads.patch +asoc-sunxi-add-bindings-for-sun8i-to-spdif.patch +dt-bindings-add-lego-mindstorms-ev3-compatible-specification.patch +dt-bindings-add-vendor-prefix-for-lego.patch +phy-increase-size-of-mii_bus_id_size-and-bus_id.patch +serial-sh-sci-fix-register-offsets-for-the-irda-serial-port.patch +libertas-fix-improper-return-value.patch +usb-hcd-initialize-hcd-flags-to-0-when-rm-hcd.patch +netfilter-nft_meta-deal-with-packet_loopback-in-netdev-family.patch +brcmfmac-setup-wiphy-bands-after-registering-it-first.patch +rt2800usb-mark-tx-failure-on-timeout.patch +apparmor-fix-undefined-reference-to-aa_g_hash_policy.patch +ipsec-do-not-ignore-crypto-err-in-ah4-input.patch +edac-amd64-save-and-return-err-code-from-probe_one_instance.patch +s390-topology-make-topology-off-parameter-work.patch +input-mpr121-handle-multiple-bits-change-of-status-register.patch +input-mpr121-set-missing-event-capability.patch +sched-cputime-powerpc32-fix-stale-scaled-stime-on-context-switch.patch +ib-ipoib-change-list_del-to-list_del_init-in-the-tx-object.patch +arm-dts-stih410-family-fix-wrong-parent-clock-frequency.patch +s390-qeth-fix-retrieval-of-vipa-and-proxy-arp-addresses.patch +s390-qeth-issue-startlan-as-first-ipa-command.patch +wcn36xx-don-t-use-the-destroyed-hal_mutex.patch +ib-rxe-fix-reference-leaks-in-memory-key-invalidation-code.patch +clk-mvebu-adjust-ap806-cpu-clock-frequencies-to-production-chip.patch +net-dsa-select-net_switchdev.patch diff --git a/queue-4.9/usb-hcd-initialize-hcd-flags-to-0-when-rm-hcd.patch b/queue-4.9/usb-hcd-initialize-hcd-flags-to-0-when-rm-hcd.patch new file mode 100644 index 00000000000..556cb5d41ab --- /dev/null +++ b/queue-4.9/usb-hcd-initialize-hcd-flags-to-0-when-rm-hcd.patch @@ -0,0 +1,74 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: William wu +Date: Fri, 13 Jan 2017 11:04:22 +0800 +Subject: usb: hcd: initialize hcd->flags to 0 when rm hcd + +From: William wu + + +[ Upstream commit 76b8db0d480e8045e1a1902fc9ab143b3b9ef115 ] + +On some platforms(e.g. rk3399 board), we can call hcd_add/remove +consecutively without calling usb_put_hcd/usb_create_hcd in between, +so hcd->flags can be stale. + +If the HC dies due to whatever reason then without this patch we get +the below error on next hcd_add. + +[173.296154] xhci-hcd xhci-hcd.2.auto: HC died; cleaning up +[173.296209] xhci-hcd xhci-hcd.2.auto: xHCI Host Controller +[173.296762] xhci-hcd xhci-hcd.2.auto: new USB bus registered, assigned bus number 6 +[173.296931] usb usb6: We don't know the algorithms for LPM for this host, disabling LPM. +[173.297179] usb usb6: New USB device found, idVendor=1d6b, idProduct=0003 +[173.297203] usb usb6: New USB device strings: Mfr=3, Product=2, SerialNumber=1 +[173.297222] usb usb6: Product: xHCI Host Controller +[173.297240] usb usb6: Manufacturer: Linux 4.4.21 xhci-hcd +[173.297257] usb usb6: SerialNumber: xhci-hcd.2.auto +[173.298680] hub 6-0:1.0: USB hub found +[173.298749] hub 6-0:1.0: 1 port detected +[173.299382] rockchip-dwc3 usb@fe800000: USB HOST connected +[173.395418] hub 5-0:1.0: activate --> -19 +[173.603447] irq 228: nobody cared (try booting with the "irqpoll" option) +[173.603493] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.21 #9 +[173.603513] Hardware name: Google Kevin (DT) +[173.603531] Call trace: +[173.603568] [] dump_backtrace+0x0/0x160 +[173.603596] [] show_stack+0x20/0x28 +[173.603623] [] dump_stack+0x90/0xb0 +[173.603650] [] __report_bad_irq+0x48/0xe8 +[173.603674] [] note_interrupt+0x1e8/0x28c +[173.603698] [] handle_irq_event_percpu+0x1d4/0x25c +[173.603722] [] handle_irq_event+0x4c/0x7c +[173.603748] [] handle_fasteoi_irq+0xb4/0x124 +[173.603777] [] generic_handle_irq+0x30/0x44 +[173.603804] [] __handle_domain_irq+0x90/0xbc +[173.603827] [] gic_handle_irq+0xcc/0x188 +... +[173.604500] [] el1_irq+0x80/0xf8 +[173.604530] [] cpu_startup_entry+0x38/0x3cc +[173.604558] [] rest_init+0x8c/0x94 +[173.604585] [] start_kernel+0x3d0/0x3fc +[173.604607] [<0000000000b16000>] 0xb16000 +[173.604622] handlers: +[173.604648] [] usb_hcd_irq +[173.604673] Disabling IRQ #228 + +Signed-off-by: William wu +Acked-by: Roger Quadros +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/core/hcd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -3023,6 +3023,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) + } + + usb_put_invalidate_rhdev(hcd); ++ hcd->flags = 0; + } + EXPORT_SYMBOL_GPL(usb_remove_hcd); + diff --git a/queue-4.9/video-fbdev-pmag-ba-fb-remove-bad-__init-annotation.patch b/queue-4.9/video-fbdev-pmag-ba-fb-remove-bad-__init-annotation.patch new file mode 100644 index 00000000000..58a2dae2a00 --- /dev/null +++ b/queue-4.9/video-fbdev-pmag-ba-fb-remove-bad-__init-annotation.patch @@ -0,0 +1,41 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: "Maciej W. Rozycki" +Date: Mon, 30 Jan 2017 17:39:48 +0100 +Subject: video: fbdev: pmag-ba-fb: Remove bad `__init' annotation + +From: "Maciej W. Rozycki" + + +[ Upstream commit 879e5a0df626f39cbb3c61bb90373e56d67012c4 ] + +Fix: + +WARNING: drivers/video/fbdev/pmag-ba-fb.o(.text+0x308): Section mismatch in reference from the function pmagbafb_probe() to the function .init.text:pmagbafb_erase_cursor() +The function pmagbafb_probe() +references the function __init pmagbafb_erase_cursor(). +This is often because pmagbafb_probe lacks a __init +annotation or the annotation of pmagbafb_erase_cursor is wrong. + +-- a fallout from a missed update from commit 9625b51350cc ("VIDEO: +PMAG-BA: Fix section mismatch") and then commit 48c68c4f1b54 ("Drivers: +video: remove __dev* attributes.") + +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bartlomiej Zolnierkiewicz +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/pmag-ba-fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/fbdev/pmag-ba-fb.c ++++ b/drivers/video/fbdev/pmag-ba-fb.c +@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = { + /* + * Turn the hardware cursor off. + */ +-static void __init pmagbafb_erase_cursor(struct fb_info *info) ++static void pmagbafb_erase_cursor(struct fb_info *info) + { + struct pmagbafb_par *par = info->par; + diff --git a/queue-4.9/wcn36xx-don-t-use-the-destroyed-hal_mutex.patch b/queue-4.9/wcn36xx-don-t-use-the-destroyed-hal_mutex.patch new file mode 100644 index 00000000000..7ccb713acf1 --- /dev/null +++ b/queue-4.9/wcn36xx-don-t-use-the-destroyed-hal_mutex.patch @@ -0,0 +1,38 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Bjorn Andersson +Date: Wed, 11 Jan 2017 16:32:21 +0200 +Subject: wcn36xx: Don't use the destroyed hal_mutex + +From: Bjorn Andersson + + +[ Upstream commit d53628882255481b710641dd0118fbd80af6e983 ] + +ieee80211_unregister_hw() might invoke operations to stop the interface, +that uses the hal_mutex. So don't destroy it until after we're done +using it. + +Signed-off-by: Bjorn Andersson +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/wcn36xx/main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -1165,11 +1165,12 @@ static int wcn36xx_remove(struct platfor + wcn36xx_dbg(WCN36XX_DBG_MAC, "platform remove\n"); + + release_firmware(wcn->nv); +- mutex_destroy(&wcn->hal_mutex); + + ieee80211_unregister_hw(hw); + iounmap(wcn->dxe_base); + iounmap(wcn->ccu_base); ++ ++ mutex_destroy(&wcn->hal_mutex); + ieee80211_free_hw(hw); + + return 0; diff --git a/queue-4.9/xen-netback-set-default-upper-limit-of-tx-rx-queues-to-8.patch b/queue-4.9/xen-netback-set-default-upper-limit-of-tx-rx-queues-to-8.patch new file mode 100644 index 00000000000..edae2a154ea --- /dev/null +++ b/queue-4.9/xen-netback-set-default-upper-limit-of-tx-rx-queues-to-8.patch @@ -0,0 +1,52 @@ +From foo@baz Thu Nov 9 09:48:01 CET 2017 +From: Juergen Gross +Date: Tue, 10 Jan 2017 14:32:52 +0100 +Subject: xen/netback: set default upper limit of tx/rx queues to 8 + +From: Juergen Gross + + +[ Upstream commit 56dd5af9bc23d0d5d23bb207c477715b4c2216c5 ] + +The default for the maximum number of tx/rx queues of one interface is +the number of cpus of the system today. As each queue pair reserves 512 +grant pages this default consumes a ridiculous number of grants for +large guests. + +Limit the queue number to 8 as default. This value can be modified +via a module parameter if required. + +Signed-off-by: Juergen Gross +Reviewed-by: Boris Ostrovsky +Signed-off-by: Boris Ostrovsky +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/xen-netback/netback.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/xen-netback/netback.c ++++ b/drivers/net/xen-netback/netback.c +@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uin + unsigned int rx_stall_timeout_msecs = 60000; + module_param(rx_stall_timeout_msecs, uint, 0444); + ++#define MAX_QUEUES_DEFAULT 8 + unsigned int xenvif_max_queues; + module_param_named(max_queues, xenvif_max_queues, uint, 0644); + MODULE_PARM_DESC(max_queues, +@@ -1626,11 +1627,12 @@ static int __init netback_init(void) + if (!xen_domain()) + return -ENODEV; + +- /* Allow as many queues as there are CPUs if user has not ++ /* Allow as many queues as there are CPUs but max. 8 if user has not + * specified a value. + */ + if (xenvif_max_queues == 0) +- xenvif_max_queues = num_online_cpus(); ++ xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT, ++ num_online_cpus()); + + if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) { + pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n",