From: Greg Kroah-Hartman Date: Mon, 27 Mar 2017 17:13:22 +0000 (+0200) Subject: 4.10-stable patches X-Git-Tag: v4.4.58~14 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=309a988b7d0ee6a8b851b5ceb48099929a39e569;p=thirdparty%2Fkernel%2Fstable-queue.git 4.10-stable patches added patches: ext4-lock-the-xattr-block-before-checksuming-it.patch ext4-mark-inode-dirty-after-converting-inline-directory.patch iio-adc-ti_am335x_adc-fix-fifo-overrun-recovery.patch iio-hid-sensor-trigger-change-get-poll-value-function-order-to-avoid-sensor-properties-losing-after-resume-from-s3.patch iio-magnetometer-ak8974-remove-incorrect-__exit-markups.patch iio-sw-device-fix-config-group-initialization.patch mei-don-t-wait-for-os-version-message-reply.patch mei-fix-deadlock-on-mei-reset.patch parport-fix-attempt-to-write-duplicate-procfiles.patch powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch ppdev-fix-registering-same-device-name.patch --- diff --git a/queue-4.10/ext4-lock-the-xattr-block-before-checksuming-it.patch b/queue-4.10/ext4-lock-the-xattr-block-before-checksuming-it.patch new file mode 100644 index 00000000000..dafebadd4f1 --- /dev/null +++ b/queue-4.10/ext4-lock-the-xattr-block-before-checksuming-it.patch @@ -0,0 +1,156 @@ +From dac7a4b4b1f664934e8b713f529b629f67db313c Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Sat, 25 Mar 2017 17:22:47 -0400 +Subject: ext4: lock the xattr block before checksuming it + +From: Theodore Ts'o + +commit dac7a4b4b1f664934e8b713f529b629f67db313c upstream. + +We must lock the xattr block before calculating or verifying the +checksum in order to avoid spurious checksum failures. + +https://bugzilla.kernel.org/show_bug.cgi?id=193661 + +Reported-by: Colin Ian King +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/xattr.c | 65 ++++++++++++++++++++++++++------------------------------ + 1 file changed, 31 insertions(+), 34 deletions(-) + +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -131,31 +131,26 @@ static __le32 ext4_xattr_block_csum(stru + } + + static int ext4_xattr_block_csum_verify(struct inode *inode, +- sector_t block_nr, +- struct ext4_xattr_header *hdr) ++ struct buffer_head *bh) + { +- if (ext4_has_metadata_csum(inode->i_sb) && +- (hdr->h_checksum != ext4_xattr_block_csum(inode, block_nr, hdr))) +- return 0; +- return 1; +-} +- +-static void ext4_xattr_block_csum_set(struct inode *inode, +- sector_t block_nr, +- struct ext4_xattr_header *hdr) +-{ +- if (!ext4_has_metadata_csum(inode->i_sb)) +- return; ++ struct ext4_xattr_header *hdr = BHDR(bh); ++ int ret = 1; + +- hdr->h_checksum = ext4_xattr_block_csum(inode, block_nr, hdr); ++ if (ext4_has_metadata_csum(inode->i_sb)) { ++ lock_buffer(bh); ++ ret = (hdr->h_checksum == ext4_xattr_block_csum(inode, ++ bh->b_blocknr, hdr)); ++ unlock_buffer(bh); ++ } ++ return ret; + } + +-static inline int ext4_handle_dirty_xattr_block(handle_t *handle, +- struct inode *inode, +- struct buffer_head *bh) ++static void ext4_xattr_block_csum_set(struct inode *inode, ++ struct buffer_head *bh) + { +- ext4_xattr_block_csum_set(inode, bh->b_blocknr, BHDR(bh)); +- return ext4_handle_dirty_metadata(handle, inode, bh); ++ if (ext4_has_metadata_csum(inode->i_sb)) ++ BHDR(bh)->h_checksum = ext4_xattr_block_csum(inode, ++ bh->b_blocknr, BHDR(bh)); + } + + static inline const struct xattr_handler * +@@ -233,7 +228,7 @@ ext4_xattr_check_block(struct inode *ino + if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || + BHDR(bh)->h_blocks != cpu_to_le32(1)) + return -EFSCORRUPTED; +- if (!ext4_xattr_block_csum_verify(inode, bh->b_blocknr, BHDR(bh))) ++ if (!ext4_xattr_block_csum_verify(inode, bh)) + return -EFSBADCRC; + error = ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size, + bh->b_data); +@@ -615,23 +610,22 @@ ext4_xattr_release_block(handle_t *handl + } + } + ++ ext4_xattr_block_csum_set(inode, bh); + /* + * Beware of this ugliness: Releasing of xattr block references + * from different inodes can race and so we have to protect + * from a race where someone else frees the block (and releases + * its journal_head) before we are done dirtying the buffer. In + * nojournal mode this race is harmless and we actually cannot +- * call ext4_handle_dirty_xattr_block() with locked buffer as ++ * call ext4_handle_dirty_metadata() with locked buffer as + * that function can call sync_dirty_buffer() so for that case + * we handle the dirtying after unlocking the buffer. + */ + if (ext4_handle_valid(handle)) +- error = ext4_handle_dirty_xattr_block(handle, inode, +- bh); ++ error = ext4_handle_dirty_metadata(handle, inode, bh); + unlock_buffer(bh); + if (!ext4_handle_valid(handle)) +- error = ext4_handle_dirty_xattr_block(handle, inode, +- bh); ++ error = ext4_handle_dirty_metadata(handle, inode, bh); + if (IS_SYNC(inode)) + ext4_handle_sync(handle); + dquot_free_block(inode, EXT4_C2B(EXT4_SB(inode->i_sb), 1)); +@@ -860,13 +854,14 @@ ext4_xattr_block_set(handle_t *handle, s + ext4_xattr_cache_insert(ext4_mb_cache, + bs->bh); + } ++ ext4_xattr_block_csum_set(inode, bs->bh); + unlock_buffer(bs->bh); + if (error == -EFSCORRUPTED) + goto bad_block; + if (!error) +- error = ext4_handle_dirty_xattr_block(handle, +- inode, +- bs->bh); ++ error = ext4_handle_dirty_metadata(handle, ++ inode, ++ bs->bh); + if (error) + goto cleanup; + goto inserted; +@@ -964,10 +959,11 @@ inserted: + ce->e_reusable = 0; + ea_bdebug(new_bh, "reusing; refcount now=%d", + ref); ++ ext4_xattr_block_csum_set(inode, new_bh); + unlock_buffer(new_bh); +- error = ext4_handle_dirty_xattr_block(handle, +- inode, +- new_bh); ++ error = ext4_handle_dirty_metadata(handle, ++ inode, ++ new_bh); + if (error) + goto cleanup_dquot; + } +@@ -1017,11 +1013,12 @@ getblk_failed: + goto getblk_failed; + } + memcpy(new_bh->b_data, s->base, new_bh->b_size); ++ ext4_xattr_block_csum_set(inode, new_bh); + set_buffer_uptodate(new_bh); + unlock_buffer(new_bh); + ext4_xattr_cache_insert(ext4_mb_cache, new_bh); +- error = ext4_handle_dirty_xattr_block(handle, +- inode, new_bh); ++ error = ext4_handle_dirty_metadata(handle, inode, ++ new_bh); + if (error) + goto cleanup; + } diff --git a/queue-4.10/ext4-mark-inode-dirty-after-converting-inline-directory.patch b/queue-4.10/ext4-mark-inode-dirty-after-converting-inline-directory.patch new file mode 100644 index 00000000000..f8f89bf0d75 --- /dev/null +++ b/queue-4.10/ext4-mark-inode-dirty-after-converting-inline-directory.patch @@ -0,0 +1,46 @@ +From b9cf625d6ecde0d372e23ae022feead72b4228a6 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Wed, 15 Mar 2017 14:52:02 -0400 +Subject: ext4: mark inode dirty after converting inline directory + +From: Eric Biggers + +commit b9cf625d6ecde0d372e23ae022feead72b4228a6 upstream. + +If ext4_convert_inline_data() was called on a directory with inline +data, the filesystem was left in an inconsistent state (as considered by +e2fsck) because the file size was not increased to cover the new block. +This happened because the inode was not marked dirty after i_disksize +was updated. Fix this by marking the inode dirty at the end of +ext4_finish_convert_inline_dir(). + +This bug was probably not noticed before because most users mark the +inode dirty afterwards for other reasons. But if userspace executed +FS_IOC_SET_ENCRYPTION_POLICY with invalid parameters, as exercised by +'kvm-xfstests -c adv generic/396', then the inode was never marked dirty +after updating i_disksize. + +Fixes: 3c47d54170b6a678875566b1b8d6dcf57904e49b +Signed-off-by: Eric Biggers +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/inline.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -1167,10 +1167,9 @@ static int ext4_finish_convert_inline_di + set_buffer_uptodate(dir_block); + err = ext4_handle_dirty_dirent_node(handle, inode, dir_block); + if (err) +- goto out; ++ return err; + set_buffer_verified(dir_block); +-out: +- return err; ++ return ext4_mark_inode_dirty(handle, inode); + } + + static int ext4_convert_inline_data_nolock(handle_t *handle, diff --git a/queue-4.10/iio-adc-ti_am335x_adc-fix-fifo-overrun-recovery.patch b/queue-4.10/iio-adc-ti_am335x_adc-fix-fifo-overrun-recovery.patch new file mode 100644 index 00000000000..c39b7e922ea --- /dev/null +++ b/queue-4.10/iio-adc-ti_am335x_adc-fix-fifo-overrun-recovery.patch @@ -0,0 +1,69 @@ +From e83bb3e6f3efa21f4a9d883a25d0ecd9dfb431e1 Mon Sep 17 00:00:00 2001 +From: Michael Engl +Date: Tue, 3 Oct 2017 13:57:00 +0100 +Subject: iio: adc: ti_am335x_adc: fix fifo overrun recovery + +From: Michael Engl + +commit e83bb3e6f3efa21f4a9d883a25d0ecd9dfb431e1 upstream. + +The tiadc_irq_h(int irq, void *private) function is handling FIFO +overruns by clearing flags, disabling and enabling the ADC to +recover. + +If the ADC is running in continuous mode a FIFO overrun happens +regularly. If the disabling of the ADC happens concurrently with +a new conversion. It might happen that the enabling of the ADC +is ignored by the hardware. This stops the ADC permanently. No +more interrupts are triggered. + +According to the AM335x Reference Manual (SPRUH73H October 2011 - +Revised April 2013 - Chapter 12.4 and 12.5) it is necessary to +check the ADC FSM bits in REG_ADCFSM before enabling the ADC +again. Because the disabling of the ADC is done right after the +current conversion has been finished. + +To trigger this bug it is necessary to run the ADC in continuous +mode. The ADC values of all channels need to be read in an endless +loop. The bug appears within the first 6 hours (~5.4 million +handled FIFO overruns). The user space application will hang on +reading new values from the character device. + +Fixes: ca9a563805f7a ("iio: ti_am335x_adc: Add continuous sampling support") +Signed-off-by: Michael Engl +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/adc/ti_am335x_adc.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -169,7 +169,9 @@ static irqreturn_t tiadc_irq_h(int irq, + { + struct iio_dev *indio_dev = private; + struct tiadc_device *adc_dev = iio_priv(indio_dev); +- unsigned int status, config; ++ unsigned int status, config, adc_fsm; ++ unsigned short count = 0; ++ + status = tiadc_readl(adc_dev, REG_IRQSTATUS); + + /* +@@ -183,6 +185,15 @@ static irqreturn_t tiadc_irq_h(int irq, + tiadc_writel(adc_dev, REG_CTRL, config); + tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN + | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES); ++ ++ /* wait for idle state. ++ * ADC needs to finish the current conversion ++ * before disabling the module ++ */ ++ do { ++ adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM); ++ } while (adc_fsm != 0x10 && count++ < 100); ++ + tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB)); + return IRQ_HANDLED; + } else if (status & IRQENB_FIFO1THRES) { diff --git a/queue-4.10/iio-hid-sensor-trigger-change-get-poll-value-function-order-to-avoid-sensor-properties-losing-after-resume-from-s3.patch b/queue-4.10/iio-hid-sensor-trigger-change-get-poll-value-function-order-to-avoid-sensor-properties-losing-after-resume-from-s3.patch new file mode 100644 index 00000000000..d2aee784689 --- /dev/null +++ b/queue-4.10/iio-hid-sensor-trigger-change-get-poll-value-function-order-to-avoid-sensor-properties-losing-after-resume-from-s3.patch @@ -0,0 +1,52 @@ +From 3bec247474469f769af41e8c80d3a100dd97dd76 Mon Sep 17 00:00:00 2001 +From: Song Hongyan +Date: Wed, 22 Feb 2017 17:17:38 +0800 +Subject: iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3 + +From: Song Hongyan + +commit 3bec247474469f769af41e8c80d3a100dd97dd76 upstream. + +In function _hid_sensor_power_state(), when hid_sensor_read_poll_value() +is called, sensor's all properties will be updated by the value from +sensor hardware/firmware. +In some implementation, sensor hardware/firmware will do a power cycle +during S3. In this case, after resume, once hid_sensor_read_poll_value() +is called, sensor's all properties which are kept by driver during S3 +will be changed to default value. +But instead, if a set feature function is called first, sensor +hardware/firmware will be recovered to the last status. So change the +sensor_hub_set_feature() calling order to behind of set feature function +to avoid sensor properties lose. + +Signed-off-by: Song Hongyan +Acked-by: Srinivas Pandruvada +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/common/hid-sensors/hid-sensor-trigger.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struc + st->report_state.report_id, + st->report_state.index, + HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM); +- +- poll_value = hid_sensor_read_poll_value(st); + } else { + int val; + +@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struc + sensor_hub_get_feature(st->hsdev, st->power_state.report_id, + st->power_state.index, + sizeof(state_val), &state_val); +- if (state && poll_value) ++ if (state) ++ poll_value = hid_sensor_read_poll_value(st); ++ if (poll_value > 0) + msleep_interruptible(poll_value * 2); + + return 0; diff --git a/queue-4.10/iio-magnetometer-ak8974-remove-incorrect-__exit-markups.patch b/queue-4.10/iio-magnetometer-ak8974-remove-incorrect-__exit-markups.patch new file mode 100644 index 00000000000..e26396cf67b --- /dev/null +++ b/queue-4.10/iio-magnetometer-ak8974-remove-incorrect-__exit-markups.patch @@ -0,0 +1,44 @@ +From 3ff861f59f6c1f5bf2bc03d2cd36ac3f992cbc06 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Wed, 1 Mar 2017 15:37:57 -0800 +Subject: iio: magnetometer: ak8974: remove incorrect __exit markups + +From: Dmitry Torokhov + +commit 3ff861f59f6c1f5bf2bc03d2cd36ac3f992cbc06 upstream. + +Even if bus is not hot-pluggable, devices can be unbound from the +driver via sysfs, so we should not be using __exit annotations on +remove() methods. The only exception is drivers registered with +platform_driver_probe() which specifically disables sysfs bind/unbind +attributes. + +Signed-off-by: Dmitry Torokhov +Reviewed-by: Linus Walleij +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/iio/magnetometer/ak8974.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/iio/magnetometer/ak8974.c ++++ b/drivers/iio/magnetometer/ak8974.c +@@ -767,7 +767,7 @@ power_off: + return ret; + } + +-static int __exit ak8974_remove(struct i2c_client *i2c) ++static int ak8974_remove(struct i2c_client *i2c) + { + struct iio_dev *indio_dev = i2c_get_clientdata(i2c); + struct ak8974 *ak8974 = iio_priv(indio_dev); +@@ -849,7 +849,7 @@ static struct i2c_driver ak8974_driver = + .of_match_table = of_match_ptr(ak8974_of_match), + }, + .probe = ak8974_probe, +- .remove = __exit_p(ak8974_remove), ++ .remove = ak8974_remove, + .id_table = ak8974_id, + }; + module_i2c_driver(ak8974_driver); diff --git a/queue-4.10/iio-sw-device-fix-config-group-initialization.patch b/queue-4.10/iio-sw-device-fix-config-group-initialization.patch new file mode 100644 index 00000000000..cf1b908900b --- /dev/null +++ b/queue-4.10/iio-sw-device-fix-config-group-initialization.patch @@ -0,0 +1,40 @@ +From c42f8218610aa09d7d3795e5810387673c1f84b6 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Thu, 9 Mar 2017 17:20:04 +0100 +Subject: iio: sw-device: Fix config group initialization + +From: Lars-Peter Clausen + +commit c42f8218610aa09d7d3795e5810387673c1f84b6 upstream. + +Use the IS_ENABLED() helper macro to ensure that the configfs group is +initialized either when configfs is built-in or when configfs is built as a +module. Otherwise software device creation will result in undefined +behaviour when configfs is built as a module since the configfs group for +the device not properly initialized. + +Similar to commit b2f0c09664b7 ("iio: sw-trigger: Fix config group +initialization"). + +Fixes: 0f3a8c3f34f7 ("iio: Add support for creating IIO devices via configfs") +Reported-by: Miguel Robles +Signed-off-by: Lars-Peter Clausen +Acked-by: Daniel Baluta +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman + +--- + include/linux/iio/sw_device.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/iio/sw_device.h ++++ b/include/linux/iio/sw_device.h +@@ -62,7 +62,7 @@ void iio_swd_group_init_type_name(struct + const char *name, + struct config_item_type *type) + { +-#ifdef CONFIG_CONFIGFS_FS ++#if IS_ENABLED(CONFIG_CONFIGFS_FS) + config_group_init_type_name(&d->group, name, type); + #endif + } diff --git a/queue-4.10/mei-don-t-wait-for-os-version-message-reply.patch b/queue-4.10/mei-don-t-wait-for-os-version-message-reply.patch new file mode 100644 index 00000000000..6f37505be42 --- /dev/null +++ b/queue-4.10/mei-don-t-wait-for-os-version-message-reply.patch @@ -0,0 +1,64 @@ +From c6240cacdb2c3cb56a21fb3ea0c105154ab87a2a Mon Sep 17 00:00:00 2001 +From: Alexander Usyskin +Date: Sun, 5 Mar 2017 21:40:42 +0200 +Subject: mei: don't wait for os version message reply + +From: Alexander Usyskin + +commit c6240cacdb2c3cb56a21fb3ea0c105154ab87a2a upstream. + +The driver still struggles with firmwares that do not replay to the OS +version request. It is safe not waiting for the replay. First, the driver +doesn't do anything with the replay second the connection is closed +immediately, hence the packet will be just safely discarded in case it +is received and last the driver won't get stuck if the firmware won't +reply. + +Signed-off-by: Alexander Usyskin +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/bus-fixup.c | 14 ++------------ + 1 file changed, 2 insertions(+), 12 deletions(-) + +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -112,11 +112,9 @@ struct mkhi_msg { + + static int mei_osver(struct mei_cl_device *cldev) + { +- int ret; + const size_t size = sizeof(struct mkhi_msg_hdr) + + sizeof(struct mkhi_fwcaps) + + sizeof(struct mei_os_ver); +- size_t length = 8; + char buf[size]; + struct mkhi_msg *req; + struct mkhi_fwcaps *fwcaps; +@@ -137,15 +135,7 @@ static int mei_osver(struct mei_cl_devic + os_ver = (struct mei_os_ver *)fwcaps->data; + os_ver->os_type = OSTYPE_LINUX; + +- ret = __mei_cl_send(cldev->cl, buf, size, mode); +- if (ret < 0) +- return ret; +- +- ret = __mei_cl_recv(cldev->cl, buf, length, 0); +- if (ret < 0) +- return ret; +- +- return 0; ++ return __mei_cl_send(cldev->cl, buf, size, mode); + } + + static void mei_mkhi_fix(struct mei_cl_device *cldev) +@@ -160,7 +150,7 @@ static void mei_mkhi_fix(struct mei_cl_d + return; + + ret = mei_osver(cldev); +- if (ret) ++ if (ret < 0) + dev_err(&cldev->dev, "OS version command failed %d\n", ret); + + mei_cldev_disable(cldev); diff --git a/queue-4.10/mei-fix-deadlock-on-mei-reset.patch b/queue-4.10/mei-fix-deadlock-on-mei-reset.patch new file mode 100644 index 00000000000..d3425ac953f --- /dev/null +++ b/queue-4.10/mei-fix-deadlock-on-mei-reset.patch @@ -0,0 +1,62 @@ +From a733ded50b6ea846200073e7381a302df71e13b3 Mon Sep 17 00:00:00 2001 +From: Tomas Winkler +Date: Sun, 5 Mar 2017 21:40:41 +0200 +Subject: mei: fix deadlock on mei reset + +From: Tomas Winkler + +commit a733ded50b6ea846200073e7381a302df71e13b3 upstream. + +This patch fixes 'mei: synchronize irq before initiating a reset' +The patch had introduced a deadlock between irq thread and mei_reset() +as they are both holding the same device lock. + +---> device_lock: + mei_reset() + <---- interrupt thread + device_lock +---> synchornize_irq() + wait on interrupt thread == (dead lock) + +The fix is to call synchronize_irq +prior to call locked mei_reset function. + +Fixes: f302bb0de6ac (mei: synchronize irq before initiating a reset) +Signed-off-by: Tomas Winkler +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/misc/mei/init.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/misc/mei/init.c ++++ b/drivers/misc/mei/init.c +@@ -124,8 +124,6 @@ int mei_reset(struct mei_device *dev) + + mei_clear_interrupts(dev); + +- mei_synchronize_irq(dev); +- + /* we're already in reset, cancel the init timer + * if the reset was called due the hbm protocol error + * we need to call it before hw start +@@ -304,6 +302,9 @@ static void mei_reset_work(struct work_s + container_of(work, struct mei_device, reset_work); + int ret; + ++ mei_clear_interrupts(dev); ++ mei_synchronize_irq(dev); ++ + mutex_lock(&dev->device_lock); + + ret = mei_reset(dev); +@@ -328,6 +329,9 @@ void mei_stop(struct mei_device *dev) + + mei_cancel_work(dev); + ++ mei_clear_interrupts(dev); ++ mei_synchronize_irq(dev); ++ + mutex_lock(&dev->device_lock); + + dev->dev_state = MEI_DEV_POWER_DOWN; diff --git a/queue-4.10/parport-fix-attempt-to-write-duplicate-procfiles.patch b/queue-4.10/parport-fix-attempt-to-write-duplicate-procfiles.patch new file mode 100644 index 00000000000..f4f884f27d5 --- /dev/null +++ b/queue-4.10/parport-fix-attempt-to-write-duplicate-procfiles.patch @@ -0,0 +1,45 @@ +From 03270c6ac6207fc55bbf9d20d195029dca210c79 Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Mon, 6 Mar 2017 23:23:42 +0000 +Subject: parport: fix attempt to write duplicate procfiles + +From: Sudip Mukherjee + +commit 03270c6ac6207fc55bbf9d20d195029dca210c79 upstream. + +Usually every parallel port will have a single pardev registered with +it. But ppdev driver is an exception. This userspace parallel port +driver allows to create multiple parrallel port devices for a single +parallel port. And as a result we were having a nice warning like: +"sysctl table check failed: +/dev/parport/parport0/devices/ppdev0/timeslice Sysctl already exists" + +Use the same logic as used in parport_register_device() and register +the proc files only once for each parallel port. + +Fixes: 6fa45a226897 ("parport: add device-model to parport subsystem") +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1414656 +Bugzilla: https://bugs.archlinux.org/task/52322 +Tested-by: James Feeney +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/parport/share.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/parport/share.c ++++ b/drivers/parport/share.c +@@ -939,8 +939,10 @@ parport_register_dev_model(struct parpor + * pardevice fields. -arca + */ + port->ops->init_state(par_dev, par_dev->state); +- port->proc_device = par_dev; +- parport_device_proc_register(par_dev); ++ if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) { ++ port->proc_device = par_dev; ++ parport_device_proc_register(par_dev); ++ } + + return par_dev; + diff --git a/queue-4.10/powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch b/queue-4.10/powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch new file mode 100644 index 00000000000..d8808fd79b5 --- /dev/null +++ b/queue-4.10/powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch @@ -0,0 +1,58 @@ +From 6d98ce0be541d4a3cfbb52cd75072c0339ebb500 Mon Sep 17 00:00:00 2001 +From: Nicholas Piggin +Date: Fri, 17 Mar 2017 15:13:20 +1000 +Subject: powerpc/64s: Fix idle wakeup potential to clobber registers + +From: Nicholas Piggin + +commit 6d98ce0be541d4a3cfbb52cd75072c0339ebb500 upstream. + +We concluded there may be a window where the idle wakeup code could get +to pnv_wakeup_tb_loss() (which clobbers non-volatile GPRs), but the +hardware may set SRR1[46:47] to 01b (no state loss) which would result +in the wakeup code failing to restore non-volatile GPRs. + +I was not able to trigger this condition with trivial tests on real +hardware or simulator, but the ISA (at least 2.07) seems to allow for +it, and Gautham says that it can happen if there is an exception pending +when the sleep/winkle instruction is executed. + +Fixes: 1706567117ba ("powerpc/kvm: make hypervisor state restore a function") +Signed-off-by: Nicholas Piggin +Acked-by: Gautham R. Shenoy +Signed-off-by: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/idle_book3s.S | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/arch/powerpc/kernel/idle_book3s.S ++++ b/arch/powerpc/kernel/idle_book3s.S +@@ -439,9 +439,23 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + _GLOBAL(pnv_wakeup_tb_loss) + ld r1,PACAR1(r13) + /* +- * Before entering any idle state, the NVGPRs are saved in the stack +- * and they are restored before switching to the process context. Hence +- * until they are restored, they are free to be used. ++ * Before entering any idle state, the NVGPRs are saved in the stack. ++ * If there was a state loss, or PACA_NAPSTATELOST was set, then the ++ * NVGPRs are restored. If we are here, it is likely that state is lost, ++ * but not guaranteed -- neither ISA207 nor ISA300 tests to reach ++ * here are the same as the test to restore NVGPRS: ++ * PACA_THREAD_IDLE_STATE test for ISA207, PSSCR test for ISA300, ++ * and SRR1 test for restoring NVGPRs. ++ * ++ * We are about to clobber NVGPRs now, so set NAPSTATELOST to ++ * guarantee they will always be restored. This might be tightened ++ * with careful reading of specs (particularly for ISA300) but this ++ * is already a slow wakeup path and it's simpler to be safe. ++ */ ++ li r0,1 ++ stb r0,PACA_NAPSTATELOST(r13) ++ ++ /* + * + * Save SRR1 and LR in NVGPRs as they might be clobbered in + * opal_call() (called in CHECK_HMI_INTERRUPT). SRR1 is required diff --git a/queue-4.10/ppdev-fix-registering-same-device-name.patch b/queue-4.10/ppdev-fix-registering-same-device-name.patch new file mode 100644 index 00000000000..639eb4919a3 --- /dev/null +++ b/queue-4.10/ppdev-fix-registering-same-device-name.patch @@ -0,0 +1,93 @@ +From 9a69645dde1188723d80745c1bc6ee9af2cbe2a7 Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Mon, 6 Mar 2017 23:23:43 +0000 +Subject: ppdev: fix registering same device name + +From: Sudip Mukherjee + +commit 9a69645dde1188723d80745c1bc6ee9af2cbe2a7 upstream. + +Usually every parallel port will have a single pardev registered with +it. But ppdev driver is an exception. This userspace parallel port +driver allows to create multiple parrallel port devices for a single +parallel port. And as a result we were having a big warning like: +"sysfs: cannot create duplicate filename '/devices/parport0/ppdev0.0'". +And with that many parallel port printers stopped working. + +We have been using the minor number as the id field while registering +a parralel port device with a parralel port. But when there are +multiple parrallel port device for one single parallel port, they all +tried to register with the same name like 'pardev0.0' and everything +started failing. +Use an incremented index as the id instead of the minor number. + +Fixes: 8b7d3a9d903e ("ppdev: use new parport device model") +Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1414656 +Bugzilla: https://bugs.archlinux.org/task/52322 +Tested-by: James Feeney +Signed-off-by: Sudip Mukherjee +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/char/ppdev.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/char/ppdev.c ++++ b/drivers/char/ppdev.c +@@ -84,11 +84,14 @@ struct pp_struct { + struct ieee1284_info state; + struct ieee1284_info saved_state; + long default_inactivity; ++ int index; + }; + + /* should we use PARDEVICE_MAX here? */ + static struct device *devices[PARPORT_MAX]; + ++static DEFINE_IDA(ida_index); ++ + /* pp_struct.flags bitfields */ + #define PP_CLAIMED (1<<0) + #define PP_EXCL (1<<1) +@@ -290,7 +293,7 @@ static int register_device(int minor, st + struct pardevice *pdev = NULL; + char *name; + struct pardev_cb ppdev_cb; +- int rc = 0; ++ int rc = 0, index; + + name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor); + if (name == NULL) +@@ -303,20 +306,23 @@ static int register_device(int minor, st + goto err; + } + ++ index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL); + memset(&ppdev_cb, 0, sizeof(ppdev_cb)); + ppdev_cb.irq_func = pp_irq; + ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0; + ppdev_cb.private = pp; +- pdev = parport_register_dev_model(port, name, &ppdev_cb, minor); ++ pdev = parport_register_dev_model(port, name, &ppdev_cb, index); + parport_put_port(port); + + if (!pdev) { + pr_warn("%s: failed to register device!\n", name); + rc = -ENXIO; ++ ida_simple_remove(&ida_index, index); + goto err; + } + + pp->pdev = pdev; ++ pp->index = index; + dev_dbg(&pdev->dev, "registered pardevice\n"); + err: + kfree(name); +@@ -755,6 +761,7 @@ static int pp_release(struct inode *inod + + if (pp->pdev) { + parport_unregister_device(pp->pdev); ++ ida_simple_remove(&ida_index, pp->index); + pp->pdev = NULL; + pr_debug(CHRDEV "%x: unregistered pardevice\n", minor); + } diff --git a/queue-4.10/series b/queue-4.10/series index 9f47770f485..140be47ba53 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -56,3 +56,14 @@ uwb-hwa-rc-fix-null-deref-at-probe.patch mmc-ushc-fix-null-deref-at-probe.patch nl80211-fix-dumpit-error-path-rtnl-deadlocks.patch mmc-core-fix-access-to-hs400-es-devices.patch +iio-adc-ti_am335x_adc-fix-fifo-overrun-recovery.patch +iio-sw-device-fix-config-group-initialization.patch +iio-hid-sensor-trigger-change-get-poll-value-function-order-to-avoid-sensor-properties-losing-after-resume-from-s3.patch +iio-magnetometer-ak8974-remove-incorrect-__exit-markups.patch +mei-fix-deadlock-on-mei-reset.patch +mei-don-t-wait-for-os-version-message-reply.patch +parport-fix-attempt-to-write-duplicate-procfiles.patch +ppdev-fix-registering-same-device-name.patch +ext4-mark-inode-dirty-after-converting-inline-directory.patch +ext4-lock-the-xattr-block-before-checksuming-it.patch +powerpc-64s-fix-idle-wakeup-potential-to-clobber-registers.patch