From: Sasha Levin Date: Tue, 30 Oct 2018 13:15:53 +0000 (-0400) Subject: 3.18-stable patches X-Git-Tag: v4.19.1~35 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=618190b84f867067c85c9b572950298e8bdb6dd5;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches Signed-off-by: Sasha Levin --- diff --git a/queue-3.18/ahci_xgene-fix-the-dma-state-machine-lockup-for-the-.patch b/queue-3.18/ahci_xgene-fix-the-dma-state-machine-lockup-for-the-.patch new file mode 100644 index 00000000000..aa7444278d5 --- /dev/null +++ b/queue-3.18/ahci_xgene-fix-the-dma-state-machine-lockup-for-the-.patch @@ -0,0 +1,54 @@ +From 22f9b5224fa9a159495a4f2e4588f22c46105cc0 Mon Sep 17 00:00:00 2001 +From: Suman Tripathi +Date: Mon, 29 Dec 2014 08:52:47 +0530 +Subject: ahci_xgene: Fix the DMA state machine lockup for the ATA_CMD_PACKET + PIO mode command. + +[ Upstream commit 1102407bb714dcebb43f385335bcb72f6b8843bc ] + +This patch addresses the issue with ATA_CMD_PACKET pio mode +command for enumeration and device detection with ATAPI devices. +The X-Gene AHCI controller has an errata in which it cannot clear +the BSY bit after the PIO setup FIS. The dma state machine enters +CMFatalErrorUpdate state and locks up. + +Signed-off-by: Suman Tripathi +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + drivers/ata/ahci_xgene.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c +index 0ffd3c930bed..d33216155827 100644 +--- a/drivers/ata/ahci_xgene.c ++++ b/drivers/ata/ahci_xgene.c +@@ -125,10 +125,11 @@ static int xgene_ahci_restart_engine(struct ata_port *ap) + * xgene_ahci_qc_issue - Issue commands to the device + * @qc: Command to issue + * +- * Due to Hardware errata for IDENTIFY DEVICE command, the controller cannot +- * clear the BSY bit after receiving the PIO setup FIS. This results in the dma +- * state machine goes into the CMFatalErrorUpdate state and locks up. By +- * restarting the dma engine, it removes the controller out of lock up state. ++ * Due to Hardware errata for IDENTIFY DEVICE command and PACKET ++ * command of ATAPI protocol set, the controller cannot clear the BSY bit ++ * after receiving the PIO setup FIS. This results in the DMA state machine ++ * going into the CMFatalErrorUpdate state and locks up. By restarting the ++ * DMA engine, it removes the controller out of lock up state. + */ + static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc) + { +@@ -137,7 +138,8 @@ static unsigned int xgene_ahci_qc_issue(struct ata_queued_cmd *qc) + struct xgene_ahci_context *ctx = hpriv->plat_data; + int rc = 0; + +- if (unlikely(ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA)) ++ if (unlikely((ctx->last_cmd[ap->port_no] == ATA_CMD_ID_ATA) || ++ (ctx->last_cmd[ap->port_no] == ATA_CMD_PACKET))) + xgene_ahci_restart_engine(ap); + + rc = ahci_qc_issue(qc); +-- +2.17.1 + diff --git a/queue-3.18/alsa-hda-add-headset-mic-support-for-acer-aspire-v5-.patch b/queue-3.18/alsa-hda-add-headset-mic-support-for-acer-aspire-v5-.patch new file mode 100644 index 00000000000..d3357e53f7d --- /dev/null +++ b/queue-3.18/alsa-hda-add-headset-mic-support-for-acer-aspire-v5-.patch @@ -0,0 +1,40 @@ +From 71ec529f0aa9e55f69e42052ddb68ebe1b142828 Mon Sep 17 00:00:00 2001 +From: Mateusz Sylwestrzak +Date: Sun, 19 Jul 2015 17:38:56 +0200 +Subject: ALSA: hda - Add headset mic support for Acer Aspire V5-573G + +[ Upstream commit 0420694dddeb9e269a1ab2129a0119a5cea294a4 ] + +Acer Aspire V5 with the ALC282 codec is given the wrong value for the +0x19 PIN by the laptop's BIOS. Overriding it with the correct value +adds support for the headset microphone which would not otherwise be +visible in the system. + +The fix is based on commit 7819717b1134 with a similar quirk for Acer +Aspire with the ALC269 codec. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=96201 +Cc: +Signed-off-by: Mateusz Sylwestrzak +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index fd3bbcf317ee..c32d51d51b3e 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5185,7 +5185,7 @@ static const struct hda_fixup alc269_fixups[] = { + { 0x14, 0x90170110 }, + { 0x17, 0x40000008 }, + { 0x18, 0x411111f0 }, +- { 0x19, 0x411111f0 }, ++ { 0x19, 0x01a1913c }, + { 0x1a, 0x411111f0 }, + { 0x1b, 0x411111f0 }, + { 0x1d, 0x40f89b2d }, +-- +2.17.1 + diff --git a/queue-3.18/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-.patch b/queue-3.18/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-.patch new file mode 100644 index 00000000000..7a13a24fea7 --- /dev/null +++ b/queue-3.18/alsa-usb-audio-add-a-more-accurate-volume-quirk-for-.patch @@ -0,0 +1,155 @@ +From 0aa21553471235bbc279f2945340a880e25d8923 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Sun, 13 Dec 2015 20:49:58 +0200 +Subject: ALSA: usb-audio: Add a more accurate volume quirk for AudioQuest + DragonFly + +[ Upstream commit 42e3121d90f42e57f6dbd6083dff2f57b3ec7daa ] + +AudioQuest DragonFly DAC reports a volume control range of 0..50 +(0x0000..0x0032) which in USB Audio means a range of 0 .. 0.2dB, which +is obviously incorrect and would cause software using the dB information +in e.g. volume sliders to have a massive volume difference in 100..102% +range. + +Commit 2d1cb7f658fb ("ALSA: usb-audio: add dB range mapping for some +devices") added a dB range mapping for it with range 0..50 dB. + +However, the actual volume mapping seems to be neither linear volume nor +linear dB scale, but instead quite close to the cubic mapping e.g. +alsamixer uses, with a range of approx. -53...0 dB. + +Replace the previous quirk with a custom dB mapping based on some basic +output measurements, using a 10-item range TLV (which will still fit in +alsa-lib MAX_TLV_RANGE_SIZE). + +Tested on AudioQuest DragonFly HW v1.2. The quirk is only applied if the +range is 0..50, so if this gets fixed/changed in later HW revisions it +will no longer be applied. + +v2: incorporated Takashi Iwai's suggestion for the quirk application +method + +Signed-off-by: Anssi Hannula +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer.c | 2 ++ + sound/usb/mixer_maps.c | 12 ------------ + sound/usb/mixer_quirks.c | 37 +++++++++++++++++++++++++++++++++++++ + sound/usb/mixer_quirks.h | 4 ++++ + 4 files changed, 43 insertions(+), 12 deletions(-) + +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 8d90cc5faf88..44812e4a4890 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -1347,6 +1347,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc, + } + } + ++ snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl); ++ + range = (cval->max - cval->min) / cval->res; + /* + * Are there devices with volume range more than 255? I use a bit more +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 2f075cd27344..f0f526ca86e5 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -343,13 +343,6 @@ static struct usbmix_name_map bose_companion5_map[] = { + { 0 } /* terminator */ + }; + +-/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */ +-static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000}; +-static struct usbmix_name_map dragonfly_1_2_map[] = { +- { 7, NULL, .dB = &dragonfly_1_2_dB }, +- { 0 } /* terminator */ +-}; +- + /* + * Dell usb dock with ALC4020 codec had a firmware problem where it got + * screwed up when zero volume is passed; just skip it as a workaround +@@ -478,11 +471,6 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = { + .id = USB_ID(0x05a7, 0x1020), + .map = bose_companion5_map, + }, +- { +- /* Dragonfly DAC 1.2 */ +- .id = USB_ID(0x21b4, 0x0081), +- .map = dragonfly_1_2_map, +- }, + { 0 } /* terminator */ + }; + +diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c +index 524366f9d32d..05df7a75a2ea 100644 +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + + #include "usbaudio.h" + #include "mixer.h" +@@ -1711,3 +1712,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer, + } + } + ++static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer, ++ struct snd_kcontrol *kctl) ++{ ++ /* Approximation using 10 ranges based on output measurement on hw v1.2. ++ * This seems close to the cubic mapping e.g. alsamixer uses. */ ++ static const DECLARE_TLV_DB_RANGE(scale, ++ 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970), ++ 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160), ++ 6, 7, TLV_DB_MINMAX_ITEM(-3884, -3710), ++ 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560), ++ 15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324), ++ 17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031), ++ 20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393), ++ 27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032), ++ 32, 40, TLV_DB_MINMAX_ITEM(-968, -490), ++ 41, 50, TLV_DB_MINMAX_ITEM(-441, 0), ++ ); ++ ++ usb_audio_info(mixer->chip, "applying DragonFly dB scale quirk\n"); ++ kctl->tlv.p = scale; ++ kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ; ++ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK; ++} ++ ++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, ++ struct usb_mixer_elem_info *cval, int unitid, ++ struct snd_kcontrol *kctl) ++{ ++ switch (mixer->chip->usb_id) { ++ case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */ ++ if (unitid == 7 && cval->min == 0 && cval->max == 50) ++ snd_dragonfly_quirk_db_scale(mixer, kctl); ++ break; ++ } ++} ++ +diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h +index bdbfab093816..177c329cd4dd 100644 +--- a/sound/usb/mixer_quirks.h ++++ b/sound/usb/mixer_quirks.h +@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip, + void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer, + int unitid); + ++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, ++ struct usb_mixer_elem_info *cval, int unitid, ++ struct snd_kcontrol *kctl); ++ + #endif /* SND_USB_MIXER_QUIRKS_H */ + +-- +2.17.1 + diff --git a/queue-3.18/arm-8799-1-mm-fix-pci_ioremap_io-offset-check.patch b/queue-3.18/arm-8799-1-mm-fix-pci_ioremap_io-offset-check.patch new file mode 100644 index 00000000000..ad258ec4862 --- /dev/null +++ b/queue-3.18/arm-8799-1-mm-fix-pci_ioremap_io-offset-check.patch @@ -0,0 +1,45 @@ +From 1bb18771e5b3c7990490a7150dd4909cdfd018cf Mon Sep 17 00:00:00 2001 +From: Thomas Petazzoni +Date: Thu, 13 Sep 2018 16:48:08 +0100 +Subject: ARM: 8799/1: mm: fix pci_ioremap_io() offset check + +[ Upstream commit 3a58ac65e2d7969bcdf1b6acb70fa4d12a88e53e ] + +IO_SPACE_LIMIT is the ending address of the PCI IO space, i.e +something like 0xfffff (and not 0x100000). + +Therefore, when offset = 0xf0000 is passed as argument, this function +fails even though the offset + SZ_64K fits below the +IO_SPACE_LIMIT. This makes the last chunk of 64 KB of the I/O space +not usable as it cannot be mapped. + +This patch fixes that by substracing 1 to offset + SZ_64K, so that we +compare the addrss of the last byte of the I/O space against +IO_SPACE_LIMIT instead of the address of the first byte of what is +after the I/O space. + +Fixes: c2794437091a4 ("ARM: Add fixed PCI i/o mapping") +Signed-off-by: Thomas Petazzoni +Acked-by: Nicolas Pitre +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/ioremap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mm/ioremap.c b/arch/arm/mm/ioremap.c +index d1e5ad7ab3bc..1500d3befe02 100644 +--- a/arch/arm/mm/ioremap.c ++++ b/arch/arm/mm/ioremap.c +@@ -447,7 +447,7 @@ void pci_ioremap_set_mem_type(int mem_type) + + int pci_ioremap_io(unsigned int offset, phys_addr_t phys_addr) + { +- BUG_ON(offset + SZ_64K > IO_SPACE_LIMIT); ++ BUG_ON(offset + SZ_64K - 1 > IO_SPACE_LIMIT); + + return ioremap_page_range(PCI_IO_VIRT_BASE + offset, + PCI_IO_VIRT_BASE + offset + SZ_64K, +-- +2.17.1 + diff --git a/queue-3.18/arm-arm64-kvm-take-mmap_sem-in-stage2_unmap_vm.patch b/queue-3.18/arm-arm64-kvm-take-mmap_sem-in-stage2_unmap_vm.patch new file mode 100644 index 00000000000..9e777b67e81 --- /dev/null +++ b/queue-3.18/arm-arm64-kvm-take-mmap_sem-in-stage2_unmap_vm.patch @@ -0,0 +1,44 @@ +From b081918d21aa1070f59b933b356e05308dd469ff Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Thu, 16 Mar 2017 18:20:49 +0000 +Subject: arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm + +[ Upstream commit 90f6e150e44a0dc3883110eeb3ab35d1be42b6bb ] + +We don't hold the mmap_sem while searching for the VMAs when +we try to unmap each memslot for a VM. Fix this properly to +avoid unexpected results. + +Fixes: commit 957db105c997 ("arm/arm64: KVM: Introduce stage2_unmap_vm") +Cc: stable@vger.kernel.org # v3.19+ +Reviewed-by: Christoffer Dall +Signed-off-by: Suzuki K Poulose +Signed-off-by: Marc Zyngier +Signed-off-by: Sasha Levin +--- + arch/arm/kvm/mmu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c +index e506389d02fb..017d6d1e1766 100644 +--- a/arch/arm/kvm/mmu.c ++++ b/arch/arm/kvm/mmu.c +@@ -760,6 +760,7 @@ void stage2_unmap_vm(struct kvm *kvm) + int idx; + + idx = srcu_read_lock(&kvm->srcu); ++ down_read(¤t->mm->mmap_sem); + spin_lock(&kvm->mmu_lock); + + slots = kvm_memslots(kvm); +@@ -767,6 +768,7 @@ void stage2_unmap_vm(struct kvm *kvm) + stage2_unmap_memslot(kvm, memslot); + + spin_unlock(&kvm->mmu_lock); ++ up_read(¤t->mm->mmap_sem); + srcu_read_unlock(&kvm->srcu, idx); + } + +-- +2.17.1 + diff --git a/queue-3.18/arm-at91-board-dt-sama5-add-phy_fixup-to-override-na.patch b/queue-3.18/arm-at91-board-dt-sama5-add-phy_fixup-to-override-na.patch new file mode 100644 index 00000000000..8b5917e7228 --- /dev/null +++ b/queue-3.18/arm-at91-board-dt-sama5-add-phy_fixup-to-override-na.patch @@ -0,0 +1,63 @@ +From 36cec9c70ccba5d67b10a75061ebee2d453302d9 Mon Sep 17 00:00:00 2001 +From: Wenyou Yang +Date: Thu, 11 Dec 2014 15:31:09 +0800 +Subject: ARM: at91: board-dt-sama5: add phy_fixup to override NAND_Tree + +[ Upstream commit b8659752c37ec157ee254cff443b1c9d523aea22 ] + +Appearance: On some SAMA5D4EK boards, after power up, the Eth1 doesn't work. + +Reason: The PIOE2 pin is connected to the NAND_Tree# of KSZ8081, +But it outputs LOW during the reset period, which cause the NAND_Tree# enabled. + +Add phy_fixup() to disable NAND_Tree by overriding the Operation +Mode Strap Override register(i.e. Register 16h) to clear the NAND_Tree bit. + +Signed-off-by: Wenyou Yang +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/board-dt-sama5.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm/mach-at91/board-dt-sama5.c b/arch/arm/mach-at91/board-dt-sama5.c +index 129e2917506b..5e4cedfa5c51 100644 +--- a/arch/arm/mach-at91/board-dt-sama5.c ++++ b/arch/arm/mach-at91/board-dt-sama5.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -27,8 +28,25 @@ + #include "at91_aic.h" + #include "generic.h" + ++static int ksz8081_phy_fixup(struct phy_device *phy) ++{ ++ int value; ++ ++ value = phy_read(phy, 0x16); ++ value &= ~0x20; ++ phy_write(phy, 0x16, value); ++ ++ return 0; ++} ++ + static void __init sama5_dt_device_init(void) + { ++ if (of_machine_is_compatible("atmel,sama5d4ek") && ++ IS_ENABLED(CONFIG_PHYLIB)) { ++ phy_register_fixup_for_id("fc028000.etherne:00", ++ ksz8081_phy_fixup); ++ } ++ + of_platform_populate(NULL, of_default_bus_match_table, NULL, NULL); + } + +-- +2.17.1 + diff --git a/queue-3.18/arm-at91-dt-sam9263-add-missing-clocks-to-lcdc-node.patch b/queue-3.18/arm-at91-dt-sam9263-add-missing-clocks-to-lcdc-node.patch new file mode 100644 index 00000000000..b9a21f2c9fe --- /dev/null +++ b/queue-3.18/arm-at91-dt-sam9263-add-missing-clocks-to-lcdc-node.patch @@ -0,0 +1,35 @@ +From 77b073aa0ad24a386933012ccf41cac42a024494 Mon Sep 17 00:00:00 2001 +From: Alexander Stein +Date: Fri, 5 Dec 2014 14:31:39 +0100 +Subject: ARM: at91/dt: sam9263: Add missing clocks to lcdc node + +[ Upstream commit 55eb9c343fdd3611ae3de6ab8a8512f303d3f581 ] + +atmel_lcdfb needs also uses hclk clock, but AT91SAM9263 doesn't have that +specific clock, so use lcd_clk twice. The same was done in +arch/arm/mach-at91/at91sam9263.c + +Signed-off-by: Alexander Stein +Acked-by: Alexandre Belloni +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9263.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi +index 51416c7d0625..272fdd64197c 100644 +--- a/arch/arm/boot/dts/at91sam9263.dtsi ++++ b/arch/arm/boot/dts/at91sam9263.dtsi +@@ -913,6 +913,8 @@ + interrupts = <26 IRQ_TYPE_LEVEL_HIGH 3>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_fb>; ++ clocks = <&lcd_clk>, <&lcd_clk>; ++ clock-names = "lcdc_clk", "hclk"; + status = "disabled"; + }; + +-- +2.17.1 + diff --git a/queue-3.18/arm-at91-dt-sama5d4-fix-the-timer-reg-length.patch b/queue-3.18/arm-at91-dt-sama5d4-fix-the-timer-reg-length.patch new file mode 100644 index 00000000000..df885a946bc --- /dev/null +++ b/queue-3.18/arm-at91-dt-sama5d4-fix-the-timer-reg-length.patch @@ -0,0 +1,32 @@ +From 444df73f446ebffab4fa94b419f49443855415b0 Mon Sep 17 00:00:00 2001 +From: Bo Shen +Date: Thu, 11 Dec 2014 10:54:33 +0800 +Subject: ARM: at91/dt: sama5d4: fix the timer reg length + +[ Upstream commit 0068b2e1b7f925a818fdc0a5d10ef0ad40f746e7 ] + +The second property of reg is the length, so correct it for timer. + +Signed-off-by: Bo Shen +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi +index 0837c1afd666..24e7b237c048 100644 +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -939,7 +939,7 @@ + + pit: timer@fc068630 { + compatible = "atmel,at91sam9260-pit"; +- reg = <0xfc068630 0xf>; ++ reg = <0xfc068630 0x10>; + interrupts = <3 IRQ_TYPE_LEVEL_HIGH 5>; + clocks = <&h32ck>; + }; +-- +2.17.1 + diff --git a/queue-3.18/arm-at91-sama5d3-dt-correct-the-sound-route.patch b/queue-3.18/arm-at91-sama5d3-dt-correct-the-sound-route.patch new file mode 100644 index 00000000000..4d1816d2d5e --- /dev/null +++ b/queue-3.18/arm-at91-sama5d3-dt-correct-the-sound-route.patch @@ -0,0 +1,32 @@ +From 32097a8b19a574b2fe8e701f2a287a3a47131eeb Mon Sep 17 00:00:00 2001 +From: Bo Shen +Date: Fri, 9 Jan 2015 17:18:16 +0800 +Subject: ARM: at91: sama5d3: dt: correct the sound route + +[ Upstream commit 04582fd03fb263598e3b126c76cc42195aa0fd05 ] + +The MICBIAS is a supply, should route to MIC while not IN1L. + +Signed-off-by: Bo Shen +Signed-off-by: Nicolas Ferre +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d3xmb.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sama5d3xmb.dtsi b/arch/arm/boot/dts/sama5d3xmb.dtsi +index 49c10d33df30..77e03655aca3 100644 +--- a/arch/arm/boot/dts/sama5d3xmb.dtsi ++++ b/arch/arm/boot/dts/sama5d3xmb.dtsi +@@ -176,7 +176,7 @@ + "Headphone Jack", "HPOUTR", + "IN2L", "Line In Jack", + "IN2R", "Line In Jack", +- "MICBIAS", "IN1L", ++ "Mic", "MICBIAS", + "IN1L", "Mic"; + + atmel,ssc-controller = <&ssc0>; +-- +2.17.1 + diff --git a/queue-3.18/arm-dra7xx-fix-counter-frequency-drift-for-am572x-er.patch b/queue-3.18/arm-dra7xx-fix-counter-frequency-drift-for-am572x-er.patch new file mode 100644 index 00000000000..4504a65ba04 --- /dev/null +++ b/queue-3.18/arm-dra7xx-fix-counter-frequency-drift-for-am572x-er.patch @@ -0,0 +1,124 @@ +From 2649cd2e6f7235e6ac92c432e7abd355c6efaf21 Mon Sep 17 00:00:00 2001 +From: Lennart Sorensen +Date: Mon, 5 Jan 2015 15:45:45 -0800 +Subject: ARM: dra7xx: Fix counter frequency drift for AM572x errata i856 + +[ Upstream commit afc9d590b8a150cfeaac0078ef5de6fb21a5ea6a ] + +Errata i856 for the AM572x (DRA7xx) points out that the 32.768KHz external +crystal is not enabled at power up. Instead the CPU falls back to using +an emulation for the 32KHz clock which is SYSCLK1/610. SYSCLK1 is usually +20MHz on boards so far (which gives an emulated frequency of 32.786KHz), +but can also be 19.2 or 27MHz which result in much larger drift. + +Since this is used to drive the master counter at 32.768KHz * 375 / +2 = 6.144MHz, the emulated speed for 20MHz is of by 570ppm, or about 43 +seconds per day, and more than the 500ppm NTP is able to tolerate. + +Checking the CTRL_CORE_BOOTSTRAP register can determine if the CPU +is using the real 32.768KHz crystal or the emulated SYSCLK1/610, and +by known that the real counter frequency can be determined and used. +The real speed is then SYSCLK1 / 610 * 375 / 2 or SYSCLK1 * 75 / 244. + +Signed-off-by: Len Sorensen +Tested-by: Lokesh Vutla +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/control.h | 4 ++++ + arch/arm/mach-omap2/timer.c | 36 +++++++++++++++++++++++++++++++++-- + 2 files changed, 38 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap2/control.h b/arch/arm/mach-omap2/control.h +index a3c013345c45..a80ac2d70bb1 100644 +--- a/arch/arm/mach-omap2/control.h ++++ b/arch/arm/mach-omap2/control.h +@@ -286,6 +286,10 @@ + #define OMAP5XXX_CONTROL_STATUS 0x134 + #define OMAP5_DEVICETYPE_MASK (0x7 << 6) + ++/* DRA7XX CONTROL CORE BOOTSTRAP */ ++#define DRA7_CTRL_CORE_BOOTSTRAP 0x6c4 ++#define DRA7_SPEEDSELECT_MASK (0x3 << 8) ++ + /* + * REVISIT: This list of registers is not comprehensive - there are more + * that should be added. +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index fb0cb2b817a9..7d45c84c69ba 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -54,6 +54,7 @@ + + #include "soc.h" + #include "common.h" ++#include "control.h" + #include "powerdomain.h" + #include "omap-secure.h" + +@@ -496,7 +497,8 @@ static void __init realtime_counter_init(void) + void __iomem *base; + static struct clk *sys_clk; + unsigned long rate; +- unsigned int reg, num, den; ++ unsigned int reg; ++ unsigned long long num, den; + + base = ioremap(REALTIME_COUNTER_BASE, SZ_32); + if (!base) { +@@ -511,6 +513,35 @@ static void __init realtime_counter_init(void) + } + + rate = clk_get_rate(sys_clk); ++ ++ if (soc_is_dra7xx()) { ++ /* ++ * Errata i856 says the 32.768KHz crystal does not start at ++ * power on, so the CPU falls back to an emulated 32KHz clock ++ * based on sysclk / 610 instead. This causes the master counter ++ * frequency to not be 6.144MHz but at sysclk / 610 * 375 / 2 ++ * (OR sysclk * 75 / 244) ++ * ++ * This affects at least the DRA7/AM572x 1.0, 1.1 revisions. ++ * Of course any board built without a populated 32.768KHz ++ * crystal would also need this fix even if the CPU is fixed ++ * later. ++ * ++ * Either case can be detected by using the two speedselect bits ++ * If they are not 0, then the 32.768KHz clock driving the ++ * coarse counter that corrects the fine counter every time it ++ * ticks is actually rate/610 rather than 32.768KHz and we ++ * should compensate to avoid the 570ppm (at 20MHz, much worse ++ * at other rates) too fast system time. ++ */ ++ reg = omap_ctrl_readl(DRA7_CTRL_CORE_BOOTSTRAP); ++ if (reg & DRA7_SPEEDSELECT_MASK) { ++ num = 75; ++ den = 244; ++ goto sysclk1_based; ++ } ++ } ++ + /* Numerator/denumerator values refer TRM Realtime Counter section */ + switch (rate) { + case 12000000: +@@ -545,6 +576,7 @@ static void __init realtime_counter_init(void) + break; + } + ++sysclk1_based: + /* Program numerator and denumerator registers */ + reg = readl_relaxed(base + INCREMENTER_NUMERATOR_OFFSET) & + NUMERATOR_DENUMERATOR_MASK; +@@ -556,7 +588,7 @@ static void __init realtime_counter_init(void) + reg |= den; + writel_relaxed(reg, base + INCREMENTER_DENUMERATOR_RELOAD_OFFSET); + +- arch_timer_freq = (rate / den) * num; ++ arch_timer_freq = DIV_ROUND_UP_ULL(rate * num, den); + set_cntfreq(); + + iounmap(base); +-- +2.17.1 + diff --git a/queue-3.18/arm-dts-disable-cci-on-exynos5420-based-arndale-octa.patch b/queue-3.18/arm-dts-disable-cci-on-exynos5420-based-arndale-octa.patch new file mode 100644 index 00000000000..7e33769e5e5 --- /dev/null +++ b/queue-3.18/arm-dts-disable-cci-on-exynos5420-based-arndale-octa.patch @@ -0,0 +1,51 @@ +From 9cb765a406d3cc13d95c542bdde4797001c9e2d4 Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Sat, 10 Jan 2015 08:41:36 +0530 +Subject: ARM: dts: disable CCI on exynos5420 based arndale-octa + +[ Upstream commit 25217fef355174209eff68c0eb438a8af5d7b01c ] + +The arndale-octa board was giving "imprecise external aborts" during +boot-up with MCPM enabled. CCI enablement of the boot cluster was found +to be the cause of these aborts (possibly because the secure f/w was not +allowing it). Hence, disable CCI for the arndale-octa board. + +Signed-off-by: Abhilash Kesavan +Tested-by: Krzysztof Kozlowski +Tested-by: Kevin Hilman +Tested-by: Tyler Baker +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5420-arndale-octa.dts | 4 ++++ + arch/arm/boot/dts/exynos5420.dtsi | 2 +- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5420-arndale-octa.dts b/arch/arm/boot/dts/exynos5420-arndale-octa.dts +index aa7a7d727a7e..db2c1c4cd900 100644 +--- a/arch/arm/boot/dts/exynos5420-arndale-octa.dts ++++ b/arch/arm/boot/dts/exynos5420-arndale-octa.dts +@@ -372,3 +372,7 @@ + &usbdrd_dwc3_1 { + dr_mode = "host"; + }; ++ ++&cci { ++ status = "disabled"; ++}; +diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi +index 1353a092134f..9655a3efbd15 100644 +--- a/arch/arm/boot/dts/exynos5420.dtsi ++++ b/arch/arm/boot/dts/exynos5420.dtsi +@@ -120,7 +120,7 @@ + }; + }; + +- cci@10d20000 { ++ cci: cci@10d20000 { + compatible = "arm,cci-400"; + #address-cells = <1>; + #size-cells = <1>; +-- +2.17.1 + diff --git a/queue-3.18/arm-dts-use-pmu_system_controller-phandle-for-dp-phy.patch b/queue-3.18/arm-dts-use-pmu_system_controller-phandle-for-dp-phy.patch new file mode 100644 index 00000000000..f21fabafe55 --- /dev/null +++ b/queue-3.18/arm-dts-use-pmu_system_controller-phandle-for-dp-phy.patch @@ -0,0 +1,52 @@ +From ae28bebe73164598d29574ec26a67fe8bac36c5a Mon Sep 17 00:00:00 2001 +From: Vivek Gautam +Date: Fri, 9 Jan 2015 01:08:48 +0900 +Subject: arm: dts: Use pmu_system_controller phandle for dp phy + +[ Upstream commit e93e54544adf3aa6908b821e896cb17a562cb683 ] + +DP PHY now require pmu-system-controller to handle PMU register +to control PHY's power isolation. Adding the same to dp-phy +node. + +Signed-off-by: Vivek Gautam +Reviewed-by: Jingoo Han +Tested-by: Javier Martinez Canillas +Signed-off-by: Kukjin Kim +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5250.dtsi | 2 +- + arch/arm/boot/dts/exynos5420.dtsi | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index d55c1a2eb798..251226eefad7 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -732,7 +732,7 @@ + + dp_phy: video-phy@10040720 { + compatible = "samsung,exynos5250-dp-video-phy"; +- reg = <0x10040720 4>; ++ samsung,pmu-syscon = <&pmu_system_controller>; + #phy-cells = <0>; + }; + +diff --git a/arch/arm/boot/dts/exynos5420.dtsi b/arch/arm/boot/dts/exynos5420.dtsi +index 8617a031cbc0..1353a092134f 100644 +--- a/arch/arm/boot/dts/exynos5420.dtsi ++++ b/arch/arm/boot/dts/exynos5420.dtsi +@@ -503,8 +503,8 @@ + }; + + dp_phy: video-phy@10040728 { +- compatible = "samsung,exynos5250-dp-video-phy"; +- reg = <0x10040728 4>; ++ compatible = "samsung,exynos5420-dp-video-phy"; ++ samsung,pmu-syscon = <&pmu_system_controller>; + #phy-cells = <0>; + }; + +-- +2.17.1 + diff --git a/queue-3.18/arm-omap2-fix-n900-board-name-for-legacy-user-space.patch b/queue-3.18/arm-omap2-fix-n900-board-name-for-legacy-user-space.patch new file mode 100644 index 00000000000..a3948f84975 --- /dev/null +++ b/queue-3.18/arm-omap2-fix-n900-board-name-for-legacy-user-space.patch @@ -0,0 +1,59 @@ +From 31464eaadc47765e761f2ea27b6a059aee680019 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 5 Jan 2015 15:45:45 -0800 +Subject: ARM: OMAP2+: Fix n900 board name for legacy user space +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 71c4f6027da75c6c1fd92e05b63108a09ec2b109 ] + +N900 legacy user space apps need the board name in +/proc/cpuinfo to work properly for the Hardware entry. + +For other boards this should not be an issues and they +can use the generic Hardware entry. + +Let's fix the issue by adding a custom DT_MACHINE_START +for n900. + +Tested-by: Pali Rohár +Acked-by: Pavel Machek +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/board-generic.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm/mach-omap2/board-generic.c b/arch/arm/mach-omap2/board-generic.c +index 608079a1aba6..b61c049f92d6 100644 +--- a/arch/arm/mach-omap2/board-generic.c ++++ b/arch/arm/mach-omap2/board-generic.c +@@ -77,6 +77,24 @@ MACHINE_END + #endif + + #ifdef CONFIG_ARCH_OMAP3 ++/* Some boards need board name for legacy userspace in /proc/cpuinfo */ ++static const char *const n900_boards_compat[] __initconst = { ++ "nokia,omap3-n900", ++ NULL, ++}; ++ ++DT_MACHINE_START(OMAP3_N900_DT, "Nokia RX-51 board") ++ .reserve = omap_reserve, ++ .map_io = omap3_map_io, ++ .init_early = omap3430_init_early, ++ .init_machine = omap_generic_init, ++ .init_late = omap3_init_late, ++ .init_time = omap3_sync32k_timer_init, ++ .dt_compat = n900_boards_compat, ++ .restart = omap3xxx_restart, ++MACHINE_END ++ ++/* Generic omap3 boards, most boards can use these */ + static const char *const omap3_boards_compat[] __initconst = { + "ti,omap3430", + "ti,omap3", +-- +2.17.1 + diff --git a/queue-3.18/arm-omap5-dra7-fix-hyp-mode-boot-for-thumb2-build.patch b/queue-3.18/arm-omap5-dra7-fix-hyp-mode-boot-for-thumb2-build.patch new file mode 100644 index 00000000000..1dbb2f582e9 --- /dev/null +++ b/queue-3.18/arm-omap5-dra7-fix-hyp-mode-boot-for-thumb2-build.patch @@ -0,0 +1,42 @@ +From 118f841a3b8b33fd0502334494197737cec5d51b Mon Sep 17 00:00:00 2001 +From: Matthijs van Duin +Date: Thu, 16 Feb 2017 01:05:04 +0100 +Subject: ARM: OMAP5 / DRA7: Fix HYP mode boot for thumb2 build + +[ Upstream commit 448c077eeb02240c430db2a2c3bf5285a4c65d66 ] + +'adr' yields a data-pointer, not a function-pointer. + +Fixes: 999f934de195 ("ARM: omap5/dra7xx: Enable booting secondary +CPU in HYP mode") +Signed-off-by: Matthijs van Duin +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap-headsmp.S | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S +index 6d1dffca6c7b..748dde9fa4a5 100644 +--- a/arch/arm/mach-omap2/omap-headsmp.S ++++ b/arch/arm/mach-omap2/omap-headsmp.S +@@ -17,6 +17,7 @@ + + #include + #include ++#include + + #include "omap44xx.h" + +@@ -56,7 +57,7 @@ wait_2: ldr r2, =AUX_CORE_BOOT0_PA @ read from AuxCoreBoot0 + cmp r0, r4 + bne wait_2 + ldr r12, =API_HYP_ENTRY +- adr r0, hyp_boot ++ badr r0, hyp_boot + smc #0 + hyp_boot: + b secondary_startup +-- +2.17.1 + diff --git a/queue-3.18/arm-shmobile-r8a7740-instantiate-gic-from-c-board-co.patch b/queue-3.18/arm-shmobile-r8a7740-instantiate-gic-from-c-board-co.patch new file mode 100644 index 00000000000..a88bff07bf8 --- /dev/null +++ b/queue-3.18/arm-shmobile-r8a7740-instantiate-gic-from-c-board-co.patch @@ -0,0 +1,56 @@ +From 7686b631db40af912323f0951863407e8d70b25b Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 17 Dec 2014 14:40:42 +0100 +Subject: ARM: shmobile: r8a7740: Instantiate GIC from C board code in legacy + builds + +[ Upstream commit d034f53cc6c5c09a4e10cb9716986f3844c58514 ] + +As of commit 9a1091ef0017c40a ("irqchip: gic: Support hierarchy irq +domain."), armadillo-legacy hangs during boot with: + + sh-tmu.0: ch0: used for clock events + sh-tmu.0: ch0: used for periodic clock events + sh-tmu.0: ch0: failed to request irq 230 + sh-tmu.0: ch1: used as clock source + sh-cmt-48.1: ch0: failed to request irq 90 + sh-cmt-48.1: ch0: registration failed + earlytimer: unable to probe sh-cmt-48 early. + Calibrating delay loop... + +This happens because the IRQ numbers of the GIC are now virtual, and no +longer match the hardcoded hardware IRQ numbers in the platform board +code. +To fix this, instantiate the GIC from platform board code when compiling +a legacy kernel, like is done on sh73a0 for kzm9g-legacy. + +Signed-off-by: Geert Uytterhoeven +Acked-by: Marc Zyngier +Signed-off-by: Simon Horman +Signed-off-by: Sasha Levin +--- + arch/arm/mach-shmobile/setup-r8a7740.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm/mach-shmobile/setup-r8a7740.c b/arch/arm/mach-shmobile/setup-r8a7740.c +index 8894e1b7ab0e..6ccdc4574c89 100644 +--- a/arch/arm/mach-shmobile/setup-r8a7740.c ++++ b/arch/arm/mach-shmobile/setup-r8a7740.c +@@ -792,7 +792,14 @@ void __init r8a7740_init_irq_of(void) + void __iomem *intc_msk_base = ioremap_nocache(0xe6900040, 0x10); + void __iomem *pfc_inta_ctrl = ioremap_nocache(0xe605807c, 0x4); + ++#ifdef CONFIG_ARCH_SHMOBILE_LEGACY ++ void __iomem *gic_dist_base = ioremap_nocache(0xc2800000, 0x1000); ++ void __iomem *gic_cpu_base = ioremap_nocache(0xc2000000, 0x1000); ++ ++ gic_init(0, 29, gic_dist_base, gic_cpu_base); ++#else + irqchip_init(); ++#endif + + /* route signals to GIC */ + iowrite32(0x0, pfc_inta_ctrl); +-- +2.17.1 + diff --git a/queue-3.18/asix-check-for-supported-wake-on-lan-modes.patch b/queue-3.18/asix-check-for-supported-wake-on-lan-modes.patch new file mode 100644 index 00000000000..a49acef8c08 --- /dev/null +++ b/queue-3.18/asix-check-for-supported-wake-on-lan-modes.patch @@ -0,0 +1,36 @@ +From 02b89dd5aa73859eea78b057890ec63bb89669dc Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 28 Sep 2018 16:18:50 -0700 +Subject: asix: Check for supported Wake-on-LAN modes + +[ Upstream commit c4ce446e33d7a0e978256ac6fea4c80e59d9de5f ] + +The driver currently silently accepts unsupported Wake-on-LAN modes +(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, +which is confusing. + +Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix_common.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index 75d6f26729a3..ad81af135a32 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -417,6 +417,9 @@ int asix_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= AX_MONITOR_LINK; + if (wolinfo->wolopts & WAKE_MAGIC) +-- +2.17.1 + diff --git a/queue-3.18/asoc-dapm-don-t-add-prefix-to-widget-stream-name.patch b/queue-3.18/asoc-dapm-don-t-add-prefix-to-widget-stream-name.patch new file mode 100644 index 00000000000..03ab6e42509 --- /dev/null +++ b/queue-3.18/asoc-dapm-don-t-add-prefix-to-widget-stream-name.patch @@ -0,0 +1,76 @@ +From 922ecb1b7c03c4c106e1613247c35ef0948f5fc7 Mon Sep 17 00:00:00 2001 +From: Lars-Peter Clausen +Date: Tue, 21 Jul 2015 11:51:35 +0200 +Subject: ASoC: dapm: Don't add prefix to widget stream name + +[ Upstream commit a798c24a69b64f09e2d323ac8155a36373e5d5fd ] + +Commit fdb6eb0a1287 ("ASoC: dapm: Modify widget stream name according to +prefix") fixed the case where a DAPM route between a DAI widget and a +DAC/ADC/AIF widget with a matching stream name was not created when the +DAPM context was using a prefix. + +Unfortunately the patch introduced a few issues on its own like leaking the +dynamically allocated stream name memory and also not checking whether the +allocation succeeded in the first place. + +It is also incomplete in that it still does not handle the case where +stream name of the widget is a substring of the stream name of the DAI, +which is explicitly allowed and works fine if no DAPM prefix is used. + +Revert the commit and take a slightly different approach to solving the +issue. Instead of comparing the widget's stream name to the name of the DAI +widget compare it to the stream name of the DAI widget. The stream name of +the DAI widget is identical to the name of the DAI widget except that it +wont have the DAPM prefix added. So this approach behaves identical +regardless to whether the DAPM context uses a prefix or not. + +We don't have to worry about potentially matching with a widget with the +same stream name, but from a different DAPM context with a different +prefix, since the code already makes sure that both the DAI widget and the +matched widget are from the same DAPM context. + +Fixes: fdb6eb0a1287 ("ASoC: dapm: Modify widget stream name according to prefix") +Signed-off-by: Lars-Peter Clausen +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + sound/soc/soc-dapm.c | 12 +++--------- + 1 file changed, 3 insertions(+), 9 deletions(-) + +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index d8ac9e5e2c00..d15c34e2f04f 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3087,16 +3087,10 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm, + } + + prefix = soc_dapm_prefix(dapm); +- if (prefix) { ++ if (prefix) + w->name = kasprintf(GFP_KERNEL, "%s %s", prefix, widget->name); +- if (widget->sname) +- w->sname = kasprintf(GFP_KERNEL, "%s %s", prefix, +- widget->sname); +- } else { ++ else + w->name = kasprintf(GFP_KERNEL, "%s", widget->name); +- if (widget->sname) +- w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname); +- } + if (w->name == NULL) { + kfree(w); + return NULL; +@@ -3422,7 +3416,7 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card) + break; + } + +- if (!w->sname || !strstr(w->sname, dai_w->name)) ++ if (!w->sname || !strstr(w->sname, dai_w->sname)) + continue; + + if (dai_w->id == snd_soc_dapm_dai_in) { +-- +2.17.1 + diff --git a/queue-3.18/ax88179_178a-check-for-supported-wake-on-lan-modes.patch b/queue-3.18/ax88179_178a-check-for-supported-wake-on-lan-modes.patch new file mode 100644 index 00000000000..006d92259b6 --- /dev/null +++ b/queue-3.18/ax88179_178a-check-for-supported-wake-on-lan-modes.patch @@ -0,0 +1,36 @@ +From e3054b2ba5b8a3a962950d86983756a15ea45a08 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 28 Sep 2018 16:18:51 -0700 +Subject: ax88179_178a: Check for supported Wake-on-LAN modes + +[ Upstream commit 5ba6b4aa9a410c5e2c6417df52b5e2118ea9b467 ] + +The driver currently silently accepts unsupported Wake-on-LAN modes +(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, +which is confusing. + +Fixes: e2ca90c276e1 ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/ax88179_178a.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index e6338c16081a..e3f2e6098db4 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -566,6 +566,9 @@ ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= AX_MONITOR_MODE_RWLC; + if (wolinfo->wolopts & WAKE_MAGIC) +-- +2.17.1 + diff --git a/queue-3.18/btrfs-avoid-syncing-log-in-the-fast-fsync-path-when-.patch b/queue-3.18/btrfs-avoid-syncing-log-in-the-fast-fsync-path-when-.patch new file mode 100644 index 00000000000..38c157ed935 --- /dev/null +++ b/queue-3.18/btrfs-avoid-syncing-log-in-the-fast-fsync-path-when-.patch @@ -0,0 +1,125 @@ +From bcab29bf6e4fdb81e5075265fd5396a22478b9d5 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Tue, 31 Mar 2015 14:16:52 +0100 +Subject: Btrfs: avoid syncing log in the fast fsync path when not necessary + +[ Upstream commit b659ef027792219b590d67a2baf1643a93727d29 ] + +Commit 3a8b36f37806 ("Btrfs: fix data loss in the fast fsync path") added +a performance regression for that causes an unnecessary sync of the log +trees (fs/subvol and root log trees) when 2 consecutive fsyncs are done +against a file, without no writes or any metadata updates to the inode in +between them and if a transaction is committed before the second fsync is +called. + +Huang Ying reported this to lkml (https://lkml.org/lkml/2015/3/18/99) +after a test sysbench test that measured a -62% decrease of file io +requests per second for that tests' workload. + +The test is: + + echo performance > /sys/devices/system/cpu/cpu0/cpufreq/scaling_governor + echo performance > /sys/devices/system/cpu/cpu1/cpufreq/scaling_governor + echo performance > /sys/devices/system/cpu/cpu2/cpufreq/scaling_governor + echo performance > /sys/devices/system/cpu/cpu3/cpufreq/scaling_governor + mkfs -t btrfs /dev/sda2 + mount -t btrfs /dev/sda2 /fs/sda2 + cd /fs/sda2 + for ((i = 0; i < 1024; i++)); do fallocate -l 67108864 testfile.$i; done + sysbench --test=fileio --max-requests=0 --num-threads=4 --max-time=600 \ + --file-test-mode=rndwr --file-total-size=68719476736 --file-io-mode=sync \ + --file-num=1024 run + +A test on kvm guest, running a debug kernel gave me the following results: + +Without 3a8b36f378060d: 16.01 reqs/sec +With 3a8b36f378060d: 3.39 reqs/sec +With 3a8b36f378060d and this patch: 16.04 reqs/sec + +Reported-by: Huang Ying +Tested-by: Huang, Ying +Signed-off-by: Filipe Manana +Signed-off-by: Chris Mason +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 9 ++++++--- + fs/btrfs/ordered-data.c | 14 ++++++++++++++ + fs/btrfs/ordered-data.h | 3 +++ + 3 files changed, 23 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index 2ad4cb3da8f6..ba37ec6263ca 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -1879,6 +1879,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + struct btrfs_log_ctx ctx; + int ret = 0; + bool full_sync = 0; ++ const u64 len = end - start + 1; + + trace_btrfs_sync_file(file, datasync); + +@@ -1907,7 +1908,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + * all extents are persisted and the respective file extent + * items are in the fs/subvol btree. + */ +- ret = btrfs_wait_ordered_range(inode, start, end - start + 1); ++ ret = btrfs_wait_ordered_range(inode, start, len); + } else { + /* + * Start any new ordered operations before starting to log the +@@ -1979,8 +1980,10 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync) + */ + smp_mb(); + if (btrfs_inode_in_log(inode, root->fs_info->generation) || +- (full_sync && BTRFS_I(inode)->last_trans <= +- root->fs_info->last_trans_committed)) { ++ (BTRFS_I(inode)->last_trans <= ++ root->fs_info->last_trans_committed && ++ (full_sync || ++ !btrfs_have_ordered_extents_in_range(inode, start, len)))) { + /* + * We'v had everything committed since the last time we were + * modified so clear this flag in case it was set for whatever +diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c +index b23d024c0234..4c20199cef62 100644 +--- a/fs/btrfs/ordered-data.c ++++ b/fs/btrfs/ordered-data.c +@@ -848,6 +848,20 @@ out: + return entry; + } + ++bool btrfs_have_ordered_extents_in_range(struct inode *inode, ++ u64 file_offset, ++ u64 len) ++{ ++ struct btrfs_ordered_extent *oe; ++ ++ oe = btrfs_lookup_ordered_range(inode, file_offset, len); ++ if (oe) { ++ btrfs_put_ordered_extent(oe); ++ return true; ++ } ++ return false; ++} ++ + /* + * lookup and return any extent before 'file_offset'. NULL is returned + * if none is found +diff --git a/fs/btrfs/ordered-data.h b/fs/btrfs/ordered-data.h +index 0124bffc775f..a1bce0a5cccc 100644 +--- a/fs/btrfs/ordered-data.h ++++ b/fs/btrfs/ordered-data.h +@@ -191,6 +191,9 @@ btrfs_lookup_first_ordered_extent(struct inode * inode, u64 file_offset); + struct btrfs_ordered_extent *btrfs_lookup_ordered_range(struct inode *inode, + u64 file_offset, + u64 len); ++bool btrfs_have_ordered_extents_in_range(struct inode *inode, ++ u64 file_offset, ++ u64 len); + int btrfs_ordered_update_i_size(struct inode *inode, u64 offset, + struct btrfs_ordered_extent *ordered); + int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr, +-- +2.17.1 + diff --git a/queue-3.18/btrfs-do-not-ignore-errors-from-btrfs_lookup_xattr-i.patch b/queue-3.18/btrfs-do-not-ignore-errors-from-btrfs_lookup_xattr-i.patch new file mode 100644 index 00000000000..f58d85bdd4a --- /dev/null +++ b/queue-3.18/btrfs-do-not-ignore-errors-from-btrfs_lookup_xattr-i.patch @@ -0,0 +1,49 @@ +From 0040a24b8cdf753205e0623c48a8310cfaeb0524 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Mon, 23 Feb 2015 19:50:49 +0000 +Subject: Btrfs: do not ignore errors from btrfs_lookup_xattr in do_setxattr + +[ Upstream commit 5cdf83edb8e41cad1ec8eab2d402b4f9d9eb7ee0 ] + +The return value from btrfs_lookup_xattr() can be a pointer encoding an +error, therefore deal with it. This fixes commit 5f5bc6b1e2d5 +("Btrfs: make xattr replace operations atomic"). + +Signed-off-by: Filipe Manana +Signed-off-by: Chris Mason +Signed-off-by: Sasha Levin +--- + fs/btrfs/xattr.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c +index fbb0533e977f..de5d69a63e3f 100644 +--- a/fs/btrfs/xattr.c ++++ b/fs/btrfs/xattr.c +@@ -111,6 +111,8 @@ static int do_setxattr(struct btrfs_trans_handle *trans, + name, name_len, -1); + if (!di && (flags & XATTR_REPLACE)) + ret = -ENODATA; ++ else if (IS_ERR(di)) ++ ret = PTR_ERR(di); + else if (di) + ret = btrfs_delete_one_dir_name(trans, root, path, di); + goto out; +@@ -127,10 +129,12 @@ static int do_setxattr(struct btrfs_trans_handle *trans, + ASSERT(mutex_is_locked(&inode->i_mutex)); + di = btrfs_lookup_xattr(NULL, root, path, btrfs_ino(inode), + name, name_len, 0); +- if (!di) { ++ if (!di) + ret = -ENODATA; ++ else if (IS_ERR(di)) ++ ret = PTR_ERR(di); ++ if (ret) + goto out; +- } + btrfs_release_path(path); + di = NULL; + } +-- +2.17.1 + diff --git a/queue-3.18/cfg80211-reg-init-wiphy_idx-in-regulatory_hint_core.patch b/queue-3.18/cfg80211-reg-init-wiphy_idx-in-regulatory_hint_core.patch new file mode 100644 index 00000000000..7b333cd934c --- /dev/null +++ b/queue-3.18/cfg80211-reg-init-wiphy_idx-in-regulatory_hint_core.patch @@ -0,0 +1,37 @@ +From 7c71a3f0d169d56638640102fb29b4c8172fdb7a Mon Sep 17 00:00:00 2001 +From: Andrei Otcheretianski +Date: Wed, 5 Sep 2018 08:06:12 +0300 +Subject: cfg80211: reg: Init wiphy_idx in regulatory_hint_core() + +[ Upstream commit 24f33e64fcd0d50a4b1a8e5b41bd0257aa66b0e8 ] + +Core regulatory hints didn't set wiphy_idx to WIPHY_IDX_INVALID. Since +the regulatory request is zeroed, wiphy_idx was always implicitly set to +0. This resulted in updating only phy #0. +Fix that. + +Fixes: 806a9e39670b ("cfg80211: make regulatory_request use wiphy_idx instead of wiphy") +Signed-off-by: Andrei Otcheretianski +Signed-off-by: Luca Coelho +[add fixes tag] +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index 6fd53ea30193..306464b3acdb 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -2033,6 +2033,7 @@ static int regulatory_hint_core(const char *alpha2) + request->alpha2[0] = alpha2[0]; + request->alpha2[1] = alpha2[1]; + request->initiator = NL80211_REGDOM_SET_BY_CORE; ++ request->wiphy_idx = WIPHY_IDX_INVALID; + + queue_regulatory_request(request); + +-- +2.17.1 + diff --git a/queue-3.18/clk-rockchip-fix-deadlock-possibility-in-cpuclk.patch b/queue-3.18/clk-rockchip-fix-deadlock-possibility-in-cpuclk.patch new file mode 100644 index 00000000000..b2075b945e3 --- /dev/null +++ b/queue-3.18/clk-rockchip-fix-deadlock-possibility-in-cpuclk.patch @@ -0,0 +1,88 @@ +From 40b48f1dd22107675cd9baf3c540280ab2ea9ad2 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Heiko=20St=C3=BCbner?= +Date: Fri, 16 Jan 2015 17:52:44 +0100 +Subject: clk: rockchip: fix deadlock possibility in cpuclk + +[ Upstream commit a5e1baf7dca10f8cf945394034013260297bc416 ] + +Lockdep reported a possible deadlock between the cpuclk lock and for example +the i2c driver. + + CPU0 CPU1 + ---- ---- + lock(clk_lock); + local_irq_disable(); + lock(&(&i2c->lock)->rlock); + lock(clk_lock); + + lock(&(&i2c->lock)->rlock); + + *** DEADLOCK *** + +The generic clock-types of the core ccf already use spin_lock_irqsave when +touching clock registers, so do the same for the cpuclk. + +Signed-off-by: Heiko Stuebner +Reviewed-by: Doug Anderson +Signed-off-by: Michael Turquette +[mturquette@linaro.org: removed initialization of "flags"] +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-cpu.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/rockchip/clk-cpu.c b/drivers/clk/rockchip/clk-cpu.c +index 75c8c45ef728..8539c4fd34cc 100644 +--- a/drivers/clk/rockchip/clk-cpu.c ++++ b/drivers/clk/rockchip/clk-cpu.c +@@ -124,10 +124,11 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk, + { + const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data; + unsigned long alt_prate, alt_div; ++ unsigned long flags; + + alt_prate = clk_get_rate(cpuclk->alt_parent); + +- spin_lock(cpuclk->lock); ++ spin_lock_irqsave(cpuclk->lock, flags); + + /* + * If the old parent clock speed is less than the clock speed +@@ -164,7 +165,7 @@ static int rockchip_cpuclk_pre_rate_change(struct rockchip_cpuclk *cpuclk, + cpuclk->reg_base + reg_data->core_reg); + } + +- spin_unlock(cpuclk->lock); ++ spin_unlock_irqrestore(cpuclk->lock, flags); + return 0; + } + +@@ -173,6 +174,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk, + { + const struct rockchip_cpuclk_reg_data *reg_data = cpuclk->reg_data; + const struct rockchip_cpuclk_rate_table *rate; ++ unsigned long flags; + + rate = rockchip_get_cpuclk_settings(cpuclk, ndata->new_rate); + if (!rate) { +@@ -181,7 +183,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk, + return -EINVAL; + } + +- spin_lock(cpuclk->lock); ++ spin_lock_irqsave(cpuclk->lock, flags); + + if (ndata->old_rate < ndata->new_rate) + rockchip_cpuclk_set_dividers(cpuclk, rate); +@@ -201,7 +203,7 @@ static int rockchip_cpuclk_post_rate_change(struct rockchip_cpuclk *cpuclk, + if (ndata->old_rate > ndata->new_rate) + rockchip_cpuclk_set_dividers(cpuclk, rate); + +- spin_unlock(cpuclk->lock); ++ spin_unlock_irqrestore(cpuclk->lock, flags); + return 0; + } + +-- +2.17.1 + diff --git a/queue-3.18/clocksource-exynos_mct-clear-interrupt-when-cpu-is-s.patch b/queue-3.18/clocksource-exynos_mct-clear-interrupt-when-cpu-is-s.patch new file mode 100644 index 00000000000..c586b1cb238 --- /dev/null +++ b/queue-3.18/clocksource-exynos_mct-clear-interrupt-when-cpu-is-s.patch @@ -0,0 +1,52 @@ +From a5403bf1921b79e042818af726b428d44b6477c2 Mon Sep 17 00:00:00 2001 +From: Joonyoung Shim +Date: Tue, 17 Jan 2017 13:54:36 +0900 +Subject: clocksource/exynos_mct: Clear interrupt when cpu is shut down + +[ Upstream commit bc7c36eedb0c7004aa06c2afc3c5385adada8fa3 ] + +When a CPU goes offline a potentially pending timer interrupt is not +cleared. When the CPU comes online again then the pending interrupt is +delivered before the per cpu clockevent device is initialized. As a +consequence the tick interrupt handler dereferences a NULL pointer. + +[ 51.251378] Unable to handle kernel NULL pointer dereference at virtual address 00000040 +[ 51.289348] task: ee942d00 task.stack: ee960000 +[ 51.293861] PC is at tick_periodic+0x38/0xb0 +[ 51.298102] LR is at tick_handle_periodic+0x1c/0x90 + +Clear the pending interrupt in the cpu dying path. + +Fixes: 56a94f13919c ("clocksource: exynos_mct: Avoid blocking calls in the cpu hotplug notifier") +Reported-by: Seung-Woo Kim +Signed-off-by: Joonyoung Shim +Cc: linux-samsung-soc@vger.kernel.org +Cc: cw00.choi@samsung.com +Cc: daniel.lezcano@linaro.org +Cc: stable@vger.kernel.org +Cc: javier@osg.samsung.com +Cc: kgene@kernel.org +Cc: krzk@kernel.org +Cc: linux-arm-kernel@lists.infradead.org +Link: http://lkml.kernel.org/r/1484628876-22065-1-git-send-email-jy0922.shim@samsung.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + drivers/clocksource/exynos_mct.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index c844616028d2..714f9a767b17 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -487,6 +487,7 @@ static void exynos4_local_timer_stop(struct clock_event_device *evt) + if (mct_int_type == MCT_INT_SPI) { + if (evt->irq != -1) + disable_irq_nosync(evt->irq); ++ exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET); + } else { + disable_percpu_irq(mct_irqs[MCT_L0_IRQ]); + } +-- +2.17.1 + diff --git a/queue-3.18/cxl-fix-issues-when-unmapping-contexts.patch b/queue-3.18/cxl-fix-issues-when-unmapping-contexts.patch new file mode 100644 index 00000000000..4ee1d005def --- /dev/null +++ b/queue-3.18/cxl-fix-issues-when-unmapping-contexts.patch @@ -0,0 +1,191 @@ +From e889e3ac98fcb8ce1fbc98616147c3883c118f9a Mon Sep 17 00:00:00 2001 +From: Ian Munsie +Date: Wed, 7 Jan 2015 16:33:04 +1100 +Subject: cxl: Fix issues when unmapping contexts + +[ Upstream commit 0712dc7e73e59d79bcead5d5520acf4e9e917e87 ] + +An issue was introduced with "cxl: Unmap MMIO regions when detaching a +context" (b123429e6a9e8d03aacf888d23262835f0081448) where closing a +context normally could also unmap the problem state area of other +contexts currently using the AFU. + +It was also discovered that after a context's MMIO space had been +unmapped it would read 0s when accessing it, whereas the expected +behaviour was for the access to fail altogether. + +In order to address these issues, this patch does two things: + +- Forced mmap unmapping is only done when we are forcefully detaching + all contexts, and not in the normal detach path. Since the normal + context close path is tied to the file release any mmaps must have + already been released so we don't need to worry in that case. + +- The mmap path now uses a vm_operations_struct with a fault handler. + The fault handler ensures that the context is in started state, + otherwise it fails the access attempt with a SIGBUS. + +Fixes: b123429e6a9e ("cxl: Unmap MMIO regions when detaching a context") +Signed-off-by: Ian Munsie +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + drivers/misc/cxl/context.c | 82 +++++++++++++++++++++++++++++--------- + drivers/misc/cxl/file.c | 14 ++++--- + 2 files changed, 71 insertions(+), 25 deletions(-) + +diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c +index 51fd6b524371..d1b55fe62817 100644 +--- a/drivers/misc/cxl/context.c ++++ b/drivers/misc/cxl/context.c +@@ -100,6 +100,46 @@ int cxl_context_init(struct cxl_context *ctx, struct cxl_afu *afu, bool master, + return 0; + } + ++static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf) ++{ ++ struct cxl_context *ctx = vma->vm_file->private_data; ++ unsigned long address = (unsigned long)vmf->virtual_address; ++ u64 area, offset; ++ ++ offset = vmf->pgoff << PAGE_SHIFT; ++ ++ pr_devel("%s: pe: %i address: 0x%lx offset: 0x%llx\n", ++ __func__, ctx->pe, address, offset); ++ ++ if (ctx->afu->current_mode == CXL_MODE_DEDICATED) { ++ area = ctx->afu->psn_phys; ++ if (offset > ctx->afu->adapter->ps_size) ++ return VM_FAULT_SIGBUS; ++ } else { ++ area = ctx->psn_phys; ++ if (offset > ctx->psn_size) ++ return VM_FAULT_SIGBUS; ++ } ++ ++ mutex_lock(&ctx->status_mutex); ++ ++ if (ctx->status != STARTED) { ++ mutex_unlock(&ctx->status_mutex); ++ pr_devel("%s: Context not started, failing problem state access\n", __func__); ++ return VM_FAULT_SIGBUS; ++ } ++ ++ vm_insert_pfn(vma, address, (area + offset) >> PAGE_SHIFT); ++ ++ mutex_unlock(&ctx->status_mutex); ++ ++ return VM_FAULT_NOPAGE; ++} ++ ++static const struct vm_operations_struct cxl_mmap_vmops = { ++ .fault = cxl_mmap_fault, ++}; ++ + /* + * Map a per-context mmio space into the given vma. + */ +@@ -108,26 +148,25 @@ int cxl_context_iomap(struct cxl_context *ctx, struct vm_area_struct *vma) + u64 len = vma->vm_end - vma->vm_start; + len = min(len, ctx->psn_size); + +- if (ctx->afu->current_mode == CXL_MODE_DEDICATED) { +- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- return vm_iomap_memory(vma, ctx->afu->psn_phys, ctx->afu->adapter->ps_size); +- } ++ if (ctx->afu->current_mode != CXL_MODE_DEDICATED) { ++ /* make sure there is a valid per process space for this AFU */ ++ if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) { ++ pr_devel("AFU doesn't support mmio space\n"); ++ return -EINVAL; ++ } + +- /* make sure there is a valid per process space for this AFU */ +- if ((ctx->master && !ctx->afu->psa) || (!ctx->afu->pp_psa)) { +- pr_devel("AFU doesn't support mmio space\n"); +- return -EINVAL; ++ /* Can't mmap until the AFU is enabled */ ++ if (!ctx->afu->enabled) ++ return -EBUSY; + } + +- /* Can't mmap until the AFU is enabled */ +- if (!ctx->afu->enabled) +- return -EBUSY; +- + pr_devel("%s: mmio physical: %llx pe: %i master:%i\n", __func__, + ctx->psn_phys, ctx->pe , ctx->master); + ++ vma->vm_flags |= VM_IO | VM_PFNMAP; + vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot); +- return vm_iomap_memory(vma, ctx->psn_phys, len); ++ vma->vm_ops = &cxl_mmap_vmops; ++ return 0; + } + + /* +@@ -150,12 +189,6 @@ static void __detach_context(struct cxl_context *ctx) + afu_release_irqs(ctx); + flush_work(&ctx->fault_work); /* Only needed for dedicated process */ + wake_up_all(&ctx->wq); +- +- /* Release Problem State Area mapping */ +- mutex_lock(&ctx->mapping_lock); +- if (ctx->mapping) +- unmap_mapping_range(ctx->mapping, 0, 0, 1); +- mutex_unlock(&ctx->mapping_lock); + } + + /* +@@ -184,6 +217,17 @@ void cxl_context_detach_all(struct cxl_afu *afu) + * created and torn down after the IDR removed + */ + __detach_context(ctx); ++ ++ /* ++ * We are force detaching - remove any active PSA mappings so ++ * userspace cannot interfere with the card if it comes back. ++ * Easiest way to exercise this is to unbind and rebind the ++ * driver via sysfs while it is in use. ++ */ ++ mutex_lock(&ctx->mapping_lock); ++ if (ctx->mapping) ++ unmap_mapping_range(ctx->mapping, 0, 0, 1); ++ mutex_unlock(&ctx->mapping_lock); + } + mutex_unlock(&afu->contexts_lock); + } +diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c +index e9f2f10dbb37..b15d8113877c 100644 +--- a/drivers/misc/cxl/file.c ++++ b/drivers/misc/cxl/file.c +@@ -140,18 +140,20 @@ static long afu_ioctl_start_work(struct cxl_context *ctx, + + pr_devel("%s: pe: %i\n", __func__, ctx->pe); + +- mutex_lock(&ctx->status_mutex); +- if (ctx->status != OPENED) { +- rc = -EIO; +- goto out; +- } +- ++ /* Do this outside the status_mutex to avoid a circular dependency with ++ * the locking in cxl_mmap_fault() */ + if (copy_from_user(&work, uwork, + sizeof(struct cxl_ioctl_start_work))) { + rc = -EFAULT; + goto out; + } + ++ mutex_lock(&ctx->status_mutex); ++ if (ctx->status != OPENED) { ++ rc = -EIO; ++ goto out; ++ } ++ + /* + * if any of the reserved fields are set or any of the unused + * flags are set it's invalid +-- +2.17.1 + diff --git a/queue-3.18/dm-fix-ab-ba-deadlock-in-__dm_destroy.patch b/queue-3.18/dm-fix-ab-ba-deadlock-in-__dm_destroy.patch new file mode 100644 index 00000000000..cc3820b56a9 --- /dev/null +++ b/queue-3.18/dm-fix-ab-ba-deadlock-in-__dm_destroy.patch @@ -0,0 +1,57 @@ +From 25fe074b8d497f048956bb39464f1ae1ab6bd147 Mon Sep 17 00:00:00 2001 +From: Junichi Nomura +Date: Thu, 1 Oct 2015 08:31:51 +0000 +Subject: dm: fix AB-BA deadlock in __dm_destroy() + +[ Upstream commit 2a708cff93f1845b9239bc7d6310aef54e716c6a ] + +__dm_destroy() takes io_barrier SRCU lock (dm_get_live_table) and +suspend_lock in reverse order. Doing so can cause AB-BA deadlock: + + __dm_destroy dm_swap_table + --------------------------------------------------- + mutex_lock(suspend_lock) + dm_get_live_table() + srcu_read_lock(io_barrier) + dm_sync_table() + synchronize_srcu(io_barrier) + .. waiting for dm_put_live_table() + mutex_lock(suspend_lock) + .. waiting for suspend_lock + +Fix this by taking the locks in proper order. + +Signed-off-by: Jun'ichi Nomura +Fixes: ab7c7bb6f4ab ("dm: hold suspend_lock while suspending device during device deletion") +Acked-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/md/dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 1d08dc6fa0b5..00c86ff3c721 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2599,14 +2599,14 @@ static void __dm_destroy(struct mapped_device *md, bool wait) + * do not race with internal suspend. + */ + mutex_lock(&md->suspend_lock); ++ map = dm_get_live_table(md, &srcu_idx); + if (!dm_suspended_md(md)) { + dm_table_presuspend_targets(map); + dm_table_postsuspend_targets(map); + } +- mutex_unlock(&md->suspend_lock); +- + /* dm_put_live_table must be before msleep, otherwise deadlock is possible */ + dm_put_live_table(md, srcu_idx); ++ mutex_unlock(&md->suspend_lock); + + /* + * Rare, but there may be I/O requests still going to complete, +-- +2.17.1 + diff --git a/queue-3.18/dm-thin-restore-requested-error_if_no_space-setting-.patch b/queue-3.18/dm-thin-restore-requested-error_if_no_space-setting-.patch new file mode 100644 index 00000000000..91915de7718 --- /dev/null +++ b/queue-3.18/dm-thin-restore-requested-error_if_no_space-setting-.patch @@ -0,0 +1,48 @@ +From b4d5d394f438399c8b7ac080b8a621af79e7de39 Mon Sep 17 00:00:00 2001 +From: Mike Snitzer +Date: Fri, 6 Nov 2015 10:53:01 -0500 +Subject: dm thin: restore requested 'error_if_no_space' setting on OODS to + WRITE transition + +[ Upstream commit 172c238612ebf81cabccc86b788c9209af591f61 ] + +A thin-pool that is in out-of-data-space (OODS) mode may transition back +to write mode -- without the admin adding more space to the thin-pool -- +if/when blocks are released (either by deleting thin devices or +discarding provisioned blocks). + +But as part of the thin-pool's earlier transition to out-of-data-space +mode the thin-pool may have set the 'error_if_no_space' flag to true if +the no_space_timeout expires without more space having been made +available. That implementation detail, of changing the pool's +error_if_no_space setting, needs to be reset back to the default that +the user specified when the thin-pool's table was loaded. + +Otherwise we'll drop the user requested behaviour on the floor when this +out-of-data-space to write mode transition occurs. + +Reported-by: Vivek Goyal +Signed-off-by: Mike Snitzer +Acked-by: Joe Thornber +Fixes: 2c43fd26e4 ("dm thin: fix missing out-of-data-space to write mode transition if blocks are released") +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/md/dm-thin.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 68c7102a64c8..936c57b57539 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1909,6 +1909,7 @@ static void set_pool_mode(struct pool *pool, enum pool_mode new_mode) + case PM_WRITE: + if (old_mode != new_mode) + notify_of_pool_mode_change(pool, "write"); ++ pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space; + dm_pool_metadata_read_write(pool->pmd); + pool->process_bio = process_bio; + pool->process_discard = process_discard; +-- +2.17.1 + diff --git a/queue-3.18/dm9000-fix-irq-trigger-type-setup-on-non-dt-platform.patch b/queue-3.18/dm9000-fix-irq-trigger-type-setup-on-non-dt-platform.patch new file mode 100644 index 00000000000..ecc0760a212 --- /dev/null +++ b/queue-3.18/dm9000-fix-irq-trigger-type-setup-on-non-dt-platform.patch @@ -0,0 +1,75 @@ +From ecf7ee1946e481094c0f8939b081e9706ea47e24 Mon Sep 17 00:00:00 2001 +From: Sylwester Nawrocki +Date: Tue, 9 Aug 2016 18:00:08 +0200 +Subject: dm9000: Fix irq trigger type setup on non-dt platforms + +[ Upstream commit a96d3b7593a3eefab62dd930e5c99201c3678ee4 ] + +Commit b5a099c67a1c36b "net: ethernet: davicom: fix devicetree irq +resource" causes an interrupt storm after the ethernet interface +is activated on S3C24XX platform (ARM non-dt), due to the interrupt +trigger type not being set properly. + +It seems, after adding parsing of IRQ flags in commit 7085a7401ba54e92b +"drivers: platform: parse IRQ flags from resources", there is no path +for non-dt platforms where irq_set_type callback could be invoked when +we don't pass the trigger type flags to the request_irq() call. + +In case of a board where the regression is seen the interrupt trigger +type flags are passed through a platform device's resource and it is +not currently handled properly without passing the irq trigger type +flags to the request_irq() call. In case of OF an of_irq_get() call +within platform_get_irq() function seems to be ensuring required irq_chip +setup, but there is no equivalent code for non OF/ACPI platforms. + +This patch mostly restores irq trigger type setting code which has been +removed in commit ("net: ethernet: davicom: fix devicetree irq resource"). + +Fixes: b5a099c67a1c36b913 ("net: ethernet: davicom: fix devicetree irq resource") + +Signed-off-by: Sylwester Nawrocki +Acked-by: Robert Jarzmik +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index ef24b60b4d3f..d2e0a10a8511 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -1296,6 +1296,7 @@ static int + dm9000_open(struct net_device *dev) + { + struct board_info *db = netdev_priv(dev); ++ unsigned int irq_flags = irq_get_trigger_type(dev->irq); + + if (netif_msg_ifup(db)) + dev_dbg(db->dev, "enabling %s\n", dev->name); +@@ -1303,9 +1304,11 @@ dm9000_open(struct net_device *dev) + /* If there is no IRQ type specified, tell the user that this is a + * problem + */ +- if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE) ++ if (irq_flags == IRQF_TRIGGER_NONE) + dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n"); + ++ irq_flags |= IRQF_SHARED; ++ + /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */ + iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */ + mdelay(1); /* delay needs by DM9000B */ +@@ -1313,8 +1316,7 @@ dm9000_open(struct net_device *dev) + /* Initialize DM9000 board */ + dm9000_init_dm9000(dev); + +- if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED, +- dev->name, dev)) ++ if (request_irq(dev->irq, dm9000_interrupt, irq_flags, dev->name, dev)) + return -EAGAIN; + /* Now that we have an interrupt handler hooked up we can unmask + * our interrupts +-- +2.17.1 + diff --git a/queue-3.18/drivers-bus-check-cci-device-tree-node-status.patch b/queue-3.18/drivers-bus-check-cci-device-tree-node-status.patch new file mode 100644 index 00000000000..334a9dda086 --- /dev/null +++ b/queue-3.18/drivers-bus-check-cci-device-tree-node-status.patch @@ -0,0 +1,39 @@ +From 51c953254e57d93317c7f915474ec7b40330ed1d Mon Sep 17 00:00:00 2001 +From: Abhilash Kesavan +Date: Sat, 10 Jan 2015 08:41:35 +0530 +Subject: drivers: bus: check cci device tree node status + +[ Upstream commit 896ddd600ba4a3426aeb11710ae9c28dd7ce68ce ] + +The arm-cci driver completes the probe sequence even if the cci node is +marked as disabled. Add a check in the driver to honour the cci status +in the device tree. + +Signed-off-by: Abhilash Kesavan +Acked-by: Sudeep Holla +Acked-by: Nicolas Pitre +Tested-by: Sudeep Holla +Tested-by: Kevin Hilman +Signed-off-by: Olof Johansson +Signed-off-by: Sasha Levin +--- + drivers/bus/arm-cci.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bus/arm-cci.c b/drivers/bus/arm-cci.c +index 7af78df241f2..99cad3ac38f2 100644 +--- a/drivers/bus/arm-cci.c ++++ b/drivers/bus/arm-cci.c +@@ -976,6 +976,9 @@ static int cci_probe(void) + if (!np) + return -ENODEV; + ++ if (!of_device_is_available(np)) ++ return -ENODEV; ++ + cci_config = of_match_node(arm_cci_matches, np)->data; + if (!cci_config) + return -ENODEV; +-- +2.17.1 + diff --git a/queue-3.18/ext4-fix-an-ext3-collapse-range-regression-in-xfstes.patch b/queue-3.18/ext4-fix-an-ext3-collapse-range-regression-in-xfstes.patch new file mode 100644 index 00000000000..f7162df0f26 --- /dev/null +++ b/queue-3.18/ext4-fix-an-ext3-collapse-range-regression-in-xfstes.patch @@ -0,0 +1,43 @@ +From d65fd2014584f040d5a99868ea5b99c38146dc6c Mon Sep 17 00:00:00 2001 +From: Theodore Ts'o +Date: Fri, 15 May 2015 00:24:10 -0400 +Subject: ext4: fix an ext3 collapse range regression in xfstests + +[ Upstream commit b9576fc3624eb9fc88bec0d0ae883fd78be86239 ] + +The xfstests test suite assumes that an attempt to collapse range on +the range (0, 1) will return EOPNOTSUPP if the file system does not +support collapse range. Commit 280227a75b56: "ext4: move check under +lock scope to close a race" broke this, and this caused xfstests to +fail when run when testing file systems that did not have the extents +feature enabled. + +Reported-by: Eric Whitney +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/extents.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 6dbfa92bf78a..1e51008e237f 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5400,6 +5400,14 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) + loff_t new_size, ioffset; + int ret; + ++ /* ++ * We need to test this early because xfstests assumes that a ++ * collapse range of (0, 1) will return EOPNOTSUPP if the file ++ * system does not support collapse range. ++ */ ++ if (!ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) ++ return -EOPNOTSUPP; ++ + /* Collapse range works only on fs block size aligned offsets. */ + if (offset & (EXT4_CLUSTER_SIZE(sb) - 1) || + len & (EXT4_CLUSTER_SIZE(sb) - 1)) +-- +2.17.1 + diff --git a/queue-3.18/fbdev-broadsheetfb-fix-memory-leak.patch b/queue-3.18/fbdev-broadsheetfb-fix-memory-leak.patch new file mode 100644 index 00000000000..0e77700034e --- /dev/null +++ b/queue-3.18/fbdev-broadsheetfb-fix-memory-leak.patch @@ -0,0 +1,62 @@ +From 6103a1fdb328988300d9bc150244f34360532d5e Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Mon, 12 Jan 2015 15:27:52 +0000 +Subject: fbdev/broadsheetfb: fix memory leak + +[ Upstream commit ef6899cdc8608e2f018e590683f04bb04a069704 ] + +static code analysis from cppcheck reports: + +[drivers/video/fbdev/broadsheetfb.c:673]: + (error) Memory leak: sector_buffer + +sector_buffer is not being kfree'd on each call to +broadsheet_spiflash_rewrite_sector(), so free it. + +Signed-off-by: Colin Ian King +Signed-off-by: Tomi Valkeinen +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/broadsheetfb.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/video/fbdev/broadsheetfb.c b/drivers/video/fbdev/broadsheetfb.c +index 8556264b16b7..235542f42da9 100644 +--- a/drivers/video/fbdev/broadsheetfb.c ++++ b/drivers/video/fbdev/broadsheetfb.c +@@ -636,7 +636,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par, + err = broadsheet_spiflash_read_range(par, start_sector_addr, + data_start_addr, sector_buffer); + if (err) +- return err; ++ goto out; + } + + /* now we copy our data into the right place in the sector buffer */ +@@ -657,7 +657,7 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par, + err = broadsheet_spiflash_read_range(par, tail_start_addr, + tail_len, sector_buffer + tail_start_addr); + if (err) +- return err; ++ goto out; + } + + /* if we got here we have the full sector that we want to rewrite. */ +@@ -665,11 +665,13 @@ static int broadsheet_spiflash_rewrite_sector(struct broadsheetfb_par *par, + /* first erase the sector */ + err = broadsheet_spiflash_erase_sector(par, start_sector_addr); + if (err) +- return err; ++ goto out; + + /* now write it */ + err = broadsheet_spiflash_write_sector(par, start_sector_addr, + sector_buffer, sector_size); ++out: ++ kfree(sector_buffer); + return err; + } + +-- +2.17.1 + diff --git a/queue-3.18/fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch b/queue-3.18/fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch new file mode 100644 index 00000000000..690b49533af --- /dev/null +++ b/queue-3.18/fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch @@ -0,0 +1,36 @@ +From 512db0889a2d8a6c4e1dbc2838fff6f50dc2cbbc Mon Sep 17 00:00:00 2001 +From: Khazhismel Kumykov +Date: Fri, 12 Oct 2018 21:34:40 -0700 +Subject: fs/fat/fatent.c: add cond_resched() to fat_count_free_clusters() + +[ Upstream commit ac081c3be3fae6d0cc3e1862507fca3862d30b67 ] + +On non-preempt kernels this loop can take a long time (more than 50 ticks) +processing through entries. + +Link: http://lkml.kernel.org/r/20181010172623.57033-1-khazhy@google.com +Signed-off-by: Khazhismel Kumykov +Acked-by: OGAWA Hirofumi +Reviewed-by: Andrew Morton +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/fat/fatent.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c +index 08b3db146888..83550ac31f49 100644 +--- a/fs/fat/fatent.c ++++ b/fs/fat/fatent.c +@@ -684,6 +684,7 @@ int fat_count_free_clusters(struct super_block *sb) + if (ops->ent_get(&fatent) == FAT_ENT_FREE) + free++; + } while (fat_ent_next(sbi, &fatent)); ++ cond_resched(); + } + sbi->free_clusters = free; + sbi->free_clus_valid = 1; +-- +2.17.1 + diff --git a/queue-3.18/igb-fix-null-derefs-due-to-skipped-sr-iov-enabling.patch b/queue-3.18/igb-fix-null-derefs-due-to-skipped-sr-iov-enabling.patch new file mode 100644 index 00000000000..f4351336785 --- /dev/null +++ b/queue-3.18/igb-fix-null-derefs-due-to-skipped-sr-iov-enabling.patch @@ -0,0 +1,48 @@ +From de75fdac7b41e12ee45759416a38ec289ae863e9 Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Mon, 19 Oct 2015 04:23:29 -0600 +Subject: igb: fix NULL derefs due to skipped SR-IOV enabling + +[ Upstream commit be06998f96ecb93938ad2cce46c4289bf7cf45bc ] + +The combined effect of commits 6423fc3416 ("igb: do not re-init SR-IOV +during probe") and ceee3450b3 ("igb: make sure SR-IOV init uses the +right number of queues") causes VFs no longer getting set up, leading +to NULL pointer dereferences due to the adapter's ->vf_data being NULL +while ->vfs_allocated_count is non-zero. The first commit not only +neglected the side effect of igb_sriov_reinit() that the second commit +tried to account for, but also that of setting IGB_FLAG_HAS_MSIX, +without which igb_enable_sriov() is effectively a no-op. Calling +igb_{,re}set_interrupt_capability() as done here seems to address this, +but I'm not sure whether this is better than sinply reverting the other +two commits. + +Signed-off-by: Jan Beulich +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 84049078c4f0..b73c896ed184 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -2866,6 +2866,13 @@ static void igb_probe_vfs(struct igb_adapter *adapter) + if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211)) + return; + ++ /* Of the below we really only want the effect of getting ++ * IGB_FLAG_HAS_MSIX set (if available), without which ++ * igb_enable_sriov() has no effect. ++ */ ++ igb_set_interrupt_capability(adapter, true); ++ igb_reset_interrupt_capability(adapter); ++ + pci_sriov_set_totalvfs(pdev, 7); + igb_enable_sriov(pdev, max_vfs); + +-- +2.17.1 + diff --git a/queue-3.18/igb-unpair-the-queues-when-changing-the-number-of-qu.patch b/queue-3.18/igb-unpair-the-queues-when-changing-the-number-of-qu.patch new file mode 100644 index 00000000000..5d625e11bc1 --- /dev/null +++ b/queue-3.18/igb-unpair-the-queues-when-changing-the-number-of-qu.patch @@ -0,0 +1,38 @@ +From 0852b00a6fd7a5942a17d6b6f85bbe4a2295ca8d Mon Sep 17 00:00:00 2001 +From: Shota Suzuki +Date: Fri, 11 Dec 2015 18:44:00 +0900 +Subject: igb: Unpair the queues when changing the number of queues + +[ Upstream commit 37a5d163fb447b39f7960d0534de30e88ad395bb ] + +By the commit 72ddef0506da ("igb: Fix oops caused by missing queue +pairing"), the IGB_FLAG_QUEUE_PAIRS flag can now be set when changing the +number of queues by "ethtool -L", but it is never cleared unless the igb +driver is reloaded. +This patch clears it if queue pairing becomes unnecessary as a result of +"ethtool -L". + +Signed-off-by: Shota Suzuki +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igb/igb_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 1ffad88e8a29..84049078c4f0 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -2941,6 +2941,8 @@ void igb_set_flag_queue_pairs(struct igb_adapter *adapter, + */ + if (adapter->rss_queues > (max_rss_queues / 2)) + adapter->flags |= IGB_FLAG_QUEUE_PAIRS; ++ else ++ adapter->flags &= ~IGB_FLAG_QUEUE_PAIRS; + break; + } + } +-- +2.17.1 + diff --git a/queue-3.18/iio-iio-fix-iio_channel_read-return-if-channel-havn-.patch b/queue-3.18/iio-iio-fix-iio_channel_read-return-if-channel-havn-.patch new file mode 100644 index 00000000000..5b150b4e612 --- /dev/null +++ b/queue-3.18/iio-iio-fix-iio_channel_read-return-if-channel-havn-.patch @@ -0,0 +1,37 @@ +From 393c50151b454099a68b782369d2323e0fa3103f Mon Sep 17 00:00:00 2001 +From: Fabien Proriol +Date: Thu, 1 Jan 2015 12:46:48 +0000 +Subject: iio: iio: Fix iio_channel_read return if channel havn't info + +[ Upstream commit 65de7654d39c70c2b942f801cea01590cf7e3458 ] + +When xilinx-xadc is used with hwmon driver to read voltage, offset used +for temperature is always applied whatever the channel. + +iio_channel_read must return an error to avoid offset for channel +without IIO_CHAN_INFO_OFFSET property. + +Signed-off-by: Fabien Proriol +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/inkern.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index f0846108d006..d33590e89337 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -426,6 +426,9 @@ static int iio_channel_read(struct iio_channel *chan, int *val, int *val2, + if (val2 == NULL) + val2 = &unused; + ++ if(!iio_channel_has_info(chan->channel, info)) ++ return -EINVAL; ++ + if (chan->indio_dev->info->read_raw_multi) { + ret = chan->indio_dev->info->read_raw_multi(chan->indio_dev, + chan->channel, INDIO_MAX_RAW_ELEMENTS, +-- +2.17.1 + diff --git a/queue-3.18/iommu-vt-d-fix-vm-domain-id-leak.patch b/queue-3.18/iommu-vt-d-fix-vm-domain-id-leak.patch new file mode 100644 index 00000000000..c5204b97efc --- /dev/null +++ b/queue-3.18/iommu-vt-d-fix-vm-domain-id-leak.patch @@ -0,0 +1,80 @@ +From b6e9c397312ca6040dd9c58f13a9e96516a9b4d5 Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Tue, 14 Jul 2015 14:48:53 -0600 +Subject: iommu/vt-d: Fix VM domain ID leak + +[ Upstream commit 46ebb7af7b93792de65e124e1ab8b89a108a41f2 ] + +This continues the attempt to fix commit fb170fb4c548 ("iommu/vt-d: +Introduce helper functions to make code symmetric for readability"). +The previous attempt in commit 71684406905f ("iommu/vt-d: Detach +domain *only* from attached iommus") overlooked the fact that +dmar_domain.iommu_bmp gets cleared for VM domains when devices are +detached: + +intel_iommu_detach_device + domain_remove_one_dev_info + domain_detach_iommu + +The domain is detached from the iommu, but the iommu is still attached +to the domain, for whatever reason. Thus when we get to domain_exit(), +we can't rely on iommu_bmp for VM domains to find the active iommus, +we must check them all. Without that, the corresponding bit in +intel_iommu.domain_ids doesn't get cleared and repeated VM domain +creation and destruction will run out of domain IDs. Meanwhile we +still can't call iommu_detach_domain() on arbitrary non-VM domains or +we risk clearing in-use domain IDs, as 71684406905f attempted to +address. + +It's tempting to modify iommu_detach_domain() to test the domain +iommu_bmp, but the call ordering from domain_remove_one_dev_info() +prevents it being able to work as fb170fb4c548 seems to have intended. +Caching of unused VM domains on the iommu object seems to be the root +of the problem, but this code is far too fragile for that kind of +rework to be proposed for stable, so we simply revert this chunk to +its state prior to fb170fb4c548. + +Fixes: fb170fb4c548 ("iommu/vt-d: Introduce helper functions to make + code symmetric for readability") +Fixes: 71684406905f ("iommu/vt-d: Detach domain *only* from attached + iommus") +Signed-off-by: Alex Williamson +Cc: Jiang Liu +Cc: stable@vger.kernel.org # v3.17+ +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 351da1da814f..2068cb59f7ed 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1759,8 +1759,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width) + + static void domain_exit(struct dmar_domain *domain) + { ++ struct dmar_drhd_unit *drhd; ++ struct intel_iommu *iommu; + struct page *freelist = NULL; +- int i; + + /* Domain 0 is reserved, so dont process it */ + if (!domain) +@@ -1780,8 +1781,10 @@ static void domain_exit(struct dmar_domain *domain) + + /* clear attached or cached domains */ + rcu_read_lock(); +- for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus) +- iommu_detach_domain(domain, g_iommus[i]); ++ for_each_active_iommu(iommu, drhd) ++ if (domain_type_is_vm(domain) || ++ test_bit(iommu->seq_id, domain->iommu_bmp)) ++ iommu_detach_domain(domain, iommu); + rcu_read_unlock(); + + dma_free_pagelist(freelist); +-- +2.17.1 + diff --git a/queue-3.18/iwlwifi-pcie-correctly-define-7265-d-cfg.patch b/queue-3.18/iwlwifi-pcie-correctly-define-7265-d-cfg.patch new file mode 100644 index 00000000000..f60f05eb6b6 --- /dev/null +++ b/queue-3.18/iwlwifi-pcie-correctly-define-7265-d-cfg.patch @@ -0,0 +1,38 @@ +From c8617e8074ce5cd9e221dc1f97b4775caf42fa1c Mon Sep 17 00:00:00 2001 +From: Arik Nemtsov +Date: Thu, 25 Dec 2014 15:28:58 +0200 +Subject: iwlwifi: pcie: correctly define 7265-D cfg + +[ Upstream commit 2b0e2b0f7bfe9a9098bda6109176adcf78f9b7ac ] + +The trans cfg was not replaced for 7265-D cards. This led to a check of +the min-NVM version against a 7265-C card, causing very-old 7265-D cards +to operate incorrectly with the driver. + +Fixes: 3fd0d3c170ad ("iwlwifi: pcie: support 7265-D devices") +Signed-off-by: Arik Nemtsov +Signed-off-by: Emmanuel Grumbach +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/iwlwifi/pcie/drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c +index 8407ce5f672f..4c7be34219d7 100644 +--- a/drivers/net/wireless/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c +@@ -533,8 +533,10 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + else if (cfg == &iwl7265_n_cfg) + cfg_7265d = &iwl7265d_n_cfg; + if (cfg_7265d && +- (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D) ++ (iwl_trans->hw_rev & CSR_HW_REV_TYPE_MSK) == CSR_HW_REV_TYPE_7265D) { + cfg = cfg_7265d; ++ iwl_trans->cfg = cfg_7265d; ++ } + #endif + + pci_set_drvdata(pdev, iwl_trans); +-- +2.17.1 + diff --git a/queue-3.18/keys-put-keyring-if-install_session_keyring_to_cred-.patch b/queue-3.18/keys-put-keyring-if-install_session_keyring_to_cred-.patch new file mode 100644 index 00000000000..fae8e372eb0 --- /dev/null +++ b/queue-3.18/keys-put-keyring-if-install_session_keyring_to_cred-.patch @@ -0,0 +1,56 @@ +From 4701703d55fef6d9624f875b030a64817d735102 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Thu, 8 Jun 2017 14:48:03 +0100 +Subject: KEYS: put keyring if install_session_keyring_to_cred() fails + +[ Upstream commit d636bd9f12a66ea3775c9fabbf3f8e118253467a ] + +In join_session_keyring(), if install_session_keyring_to_cred() were to +fail, we would leak the keyring reference, just like in the bug fixed by +commit 23567fd052a9 ("KEYS: Fix keyring ref leak in +join_session_keyring()"). Fortunately this cannot happen currently, but +we really should be more careful. Do this by adding and using a new +error label at which the keyring reference is dropped. + +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +--- + security/keys/process_keys.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c +index 85b61a3ac981..6f32ca53456a 100644 +--- a/security/keys/process_keys.c ++++ b/security/keys/process_keys.c +@@ -808,15 +808,14 @@ long join_session_keyring(const char *name) + ret = PTR_ERR(keyring); + goto error2; + } else if (keyring == new->session_keyring) { +- key_put(keyring); + ret = 0; +- goto error2; ++ goto error3; + } + + /* we've got a keyring - now to install it */ + ret = install_session_keyring_to_cred(new, keyring); + if (ret < 0) +- goto error2; ++ goto error3; + + commit_creds(new); + mutex_unlock(&key_session_mutex); +@@ -826,6 +825,8 @@ long join_session_keyring(const char *name) + okay: + return ret; + ++error3: ++ key_put(keyring); + error2: + mutex_unlock(&key_session_mutex); + error: +-- +2.17.1 + diff --git a/queue-3.18/lib-make-memzero_explicit-more-robust-against-dead-s.patch b/queue-3.18/lib-make-memzero_explicit-more-robust-against-dead-s.patch new file mode 100644 index 00000000000..c0a01fb412e --- /dev/null +++ b/queue-3.18/lib-make-memzero_explicit-more-robust-against-dead-s.patch @@ -0,0 +1,171 @@ +From f419557e0f51894101aff85e2034694eabf30373 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Thu, 30 Apr 2015 04:13:52 +0200 +Subject: lib: make memzero_explicit more robust against dead store elimination + +[ Upstream commit 7829fb09a2b4268b30dd9bc782fa5ebee278b137 ] + +In commit 0b053c951829 ("lib: memzero_explicit: use barrier instead +of OPTIMIZER_HIDE_VAR"), we made memzero_explicit() more robust in +case LTO would decide to inline memzero_explicit() and eventually +find out it could be elimiated as dead store. + +While using barrier() works well for the case of gcc, recent efforts +from LLVMLinux people suggest to use llvm as an alternative to gcc, +and there, Stephan found in a simple stand-alone user space example +that llvm could nevertheless optimize and thus elimitate the memset(). +A similar issue has been observed in the referenced llvm bug report, +which is regarded as not-a-bug. + +Based on some experiments, icc is a bit special on its own, while it +doesn't seem to eliminate the memset(), it could do so with an own +implementation, and then result in similar findings as with llvm. + +The fix in this patch now works for all three compilers (also tested +with more aggressive optimization levels). Arguably, in the current +kernel tree it's more of a theoretical issue, but imho, it's better +to be pedantic about it. + +It's clearly visible with gcc/llvm though, with the below code: if we +would have used barrier() only here, llvm would have omitted clearing, +not so with barrier_data() variant: + + static inline void memzero_explicit(void *s, size_t count) + { + memset(s, 0, count); + barrier_data(s); + } + + int main(void) + { + char buff[20]; + memzero_explicit(buff, sizeof(buff)); + return 0; + } + + $ gcc -O2 test.c + $ gdb a.out + (gdb) disassemble main + Dump of assembler code for function main: + 0x0000000000400400 <+0>: lea -0x28(%rsp),%rax + 0x0000000000400405 <+5>: movq $0x0,-0x28(%rsp) + 0x000000000040040e <+14>: movq $0x0,-0x20(%rsp) + 0x0000000000400417 <+23>: movl $0x0,-0x18(%rsp) + 0x000000000040041f <+31>: xor %eax,%eax + 0x0000000000400421 <+33>: retq + End of assembler dump. + + $ clang -O2 test.c + $ gdb a.out + (gdb) disassemble main + Dump of assembler code for function main: + 0x00000000004004f0 <+0>: xorps %xmm0,%xmm0 + 0x00000000004004f3 <+3>: movaps %xmm0,-0x18(%rsp) + 0x00000000004004f8 <+8>: movl $0x0,-0x8(%rsp) + 0x0000000000400500 <+16>: lea -0x18(%rsp),%rax + 0x0000000000400505 <+21>: xor %eax,%eax + 0x0000000000400507 <+23>: retq + End of assembler dump. + +As gcc, clang, but also icc defines __GNUC__, it's sufficient to define +this in compiler-gcc.h only to be picked up. For a fallback or otherwise +unsupported compiler, we define it as a barrier. Similarly, for ecc which +does not support gcc inline asm. + +Reference: https://llvm.org/bugs/show_bug.cgi?id=15495 +Reported-by: Stephan Mueller +Tested-by: Stephan Mueller +Signed-off-by: Daniel Borkmann +Cc: Theodore Ts'o +Cc: Stephan Mueller +Cc: Hannes Frederic Sowa +Cc: mancha security +Cc: Mark Charlebois +Cc: Behan Webster +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + include/linux/compiler-gcc.h | 16 +++++++++++++++- + include/linux/compiler-intel.h | 3 +++ + include/linux/compiler.h | 4 ++++ + lib/string.c | 2 +- + 4 files changed, 23 insertions(+), 2 deletions(-) + +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 633716ef19b0..4d9e673bd76c 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -9,10 +9,24 @@ + + __GNUC_MINOR__ * 100 \ + + __GNUC_PATCHLEVEL__) + +- + /* Optimization barrier */ ++ + /* The "volatile" is due to gcc bugs */ + #define barrier() __asm__ __volatile__("": : :"memory") ++/* ++ * This version is i.e. to prevent dead stores elimination on @ptr ++ * where gcc and llvm may behave differently when otherwise using ++ * normal barrier(): while gcc behavior gets along with a normal ++ * barrier(), llvm needs an explicit input variable to be assumed ++ * clobbered. The issue is as follows: while the inline asm might ++ * access any memory it wants, the compiler could have fit all of ++ * @ptr into memory registers instead, and since @ptr never escaped ++ * from that, it proofed that the inline asm wasn't touching any of ++ * it. This version works well with both compilers, i.e. we're telling ++ * the compiler that the inline asm absolutely may see the contents ++ * of @ptr. See also: https://llvm.org/bugs/show_bug.cgi?id=15495 ++ */ ++#define barrier_data(ptr) __asm__ __volatile__("": :"r"(ptr) :"memory") + + /* + * This macro obfuscates arithmetic on a variable address so that gcc +diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h +index ba147a1727e6..0c9a2f2c2802 100644 +--- a/include/linux/compiler-intel.h ++++ b/include/linux/compiler-intel.h +@@ -13,9 +13,12 @@ + /* Intel ECC compiler doesn't support gcc specific asm stmts. + * It uses intrinsics to do the equivalent things. + */ ++#undef barrier_data + #undef RELOC_HIDE + #undef OPTIMIZER_HIDE_VAR + ++#define barrier_data(ptr) barrier() ++ + #define RELOC_HIDE(ptr, off) \ + ({ unsigned long __ptr; \ + __ptr = (unsigned long) (ptr); \ +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 8cf7a33e1b72..78b27883744c 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -165,6 +165,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); + # define barrier() __memory_barrier() + #endif + ++#ifndef barrier_data ++# define barrier_data(ptr) barrier() ++#endif ++ + /* Unreachable code */ + #ifndef unreachable + # define unreachable() do { } while (1) +diff --git a/lib/string.c b/lib/string.c +index 8e8a2e9e9522..de4bf3778958 100644 +--- a/lib/string.c ++++ b/lib/string.c +@@ -699,7 +699,7 @@ EXPORT_SYMBOL(memset); + void memzero_explicit(void *s, size_t count) + { + memset(s, 0, count); +- barrier(); ++ barrier_data(s); + } + EXPORT_SYMBOL(memzero_explicit); + +-- +2.17.1 + diff --git a/queue-3.18/libata-blacklist-micron-500it-ssd-with-mu01-firmware.patch b/queue-3.18/libata-blacklist-micron-500it-ssd-with-mu01-firmware.patch new file mode 100644 index 00000000000..9283a0d3cf1 --- /dev/null +++ b/queue-3.18/libata-blacklist-micron-500it-ssd-with-mu01-firmware.patch @@ -0,0 +1,68 @@ +From b57ce70f5bd1c8279107f9202a3e380355827ced Mon Sep 17 00:00:00 2001 +From: Sudip Mukherjee +Date: Sat, 19 May 2018 22:29:36 +0100 +Subject: libata: blacklist Micron 500IT SSD with MU01 firmware + +[ Upstream commit 136d769e0b3475d71350aa3648a116a6ee7a8f6c ] + +While whitelisting Micron M500DC drives, the tweaked blacklist entry +enabled queued TRIM from M500IT variants also. But these do not support +queued TRIM. And while using those SSDs with the latest kernel we have +seen errors and even the partition table getting corrupted. + +Some part from the dmesg: +[ 6.727384] ata1.00: ATA-9: Micron_M500IT_MTFDDAK060MBD, MU01, max UDMA/133 +[ 6.727390] ata1.00: 117231408 sectors, multi 16: LBA48 NCQ (depth 31/32), AA +[ 6.741026] ata1.00: supports DRM functions and may not be fully accessible +[ 6.759887] ata1.00: configured for UDMA/133 +[ 6.762256] scsi 0:0:0:0: Direct-Access ATA Micron_M500IT_MT MU01 PQ: 0 ANSI: 5 + +and then for the error: +[ 120.860334] ata1.00: exception Emask 0x1 SAct 0x7ffc0007 SErr 0x0 action 0x6 frozen +[ 120.860338] ata1.00: irq_stat 0x40000008 +[ 120.860342] ata1.00: failed command: SEND FPDMA QUEUED +[ 120.860351] ata1.00: cmd 64/01:00:00:00:00/00:00:00:00:00/a0 tag 0 ncq dma 512 out + res 40/00:00:00:00:00/00:00:00:00:00/00 Emask 0x5 (timeout) +[ 120.860353] ata1.00: status: { DRDY } +[ 120.860543] ata1: hard resetting link +[ 121.166128] ata1: SATA link up 3.0 Gbps (SStatus 123 SControl 300) +[ 121.166376] ata1.00: supports DRM functions and may not be fully accessible +[ 121.186238] ata1.00: supports DRM functions and may not be fully accessible +[ 121.204445] ata1.00: configured for UDMA/133 +[ 121.204454] ata1.00: device reported invalid CHS sector 0 +[ 121.204541] sd 0:0:0:0: [sda] tag#18 UNKNOWN(0x2003) Result: hostbyte=0x00 driverbyte=0x08 +[ 121.204546] sd 0:0:0:0: [sda] tag#18 Sense Key : 0x5 [current] +[ 121.204550] sd 0:0:0:0: [sda] tag#18 ASC=0x21 ASCQ=0x4 +[ 121.204555] sd 0:0:0:0: [sda] tag#18 CDB: opcode=0x93 93 08 00 00 00 00 00 04 28 80 00 00 00 30 00 00 +[ 121.204559] print_req_error: I/O error, dev sda, sector 272512 + +After few reboots with these errors, and the SSD is corrupted. +After blacklisting it, the errors are not seen and the SSD does not get +corrupted any more. + +Fixes: 243918be6393 ("libata: Do not blacklist Micron M500DC") +Cc: Martin K. Petersen +Cc: stable@vger.kernel.org +Signed-off-by: Sudip Mukherjee +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + drivers/ata/libata-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index cd589d012ef1..6629a5deccbd 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4249,6 +4249,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_NOLPM, }, + + /* devices that don't properly handle queued TRIM commands */ ++ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | +-- +2.17.1 + diff --git a/queue-3.18/mcb-mcb-pci-only-remap-the-1st-0x200-bytes-of-bar-0.patch b/queue-3.18/mcb-mcb-pci-only-remap-the-1st-0x200-bytes-of-bar-0.patch new file mode 100644 index 00000000000..3619b24957c --- /dev/null +++ b/queue-3.18/mcb-mcb-pci-only-remap-the-1st-0x200-bytes-of-bar-0.patch @@ -0,0 +1,126 @@ +From 2a86c9c871c2ccdd58f5dbb7b5e515acf652a3ec Mon Sep 17 00:00:00 2001 +From: Johannes Thumshirn +Date: Tue, 16 Dec 2014 10:09:20 +0100 +Subject: mcb: mcb-pci: Only remap the 1st 0x200 bytes of BAR 0 + +[ Upstream commit 7b7c54914f73966976893747ee8e2ca58166a627 ] + +Currently it is not possible to have a kernel with built-in MCB attached +devices. This results out of the fact that mcb-pci requests PCI BAR 0, then +parses the chameleon table and calls the driver's probe function before +releasing BAR 0 again. When building the kernel with modules this is not a +problem (and therefore it wasn't detected by my tests yet). + +A solution is to only remap the 1st 0x200 bytes of a Chameleon PCI device. +0x200 bytes is the maximum size of a Chameleon v2 Table. + +Also this patch stops disabling the PCI device on successful registration of MCB +devices. + +Signed-off-by: Johannes Thumshirn +Suggested-by: Bjorn Helgaas +Reviewed-by: Bjorn Helgaas +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/mcb/mcb-internal.h | 1 + + drivers/mcb/mcb-pci.c | 27 ++++++++++++++++++--------- + 2 files changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/mcb/mcb-internal.h b/drivers/mcb/mcb-internal.h +index f956ef26c0ce..fb7493dcfb79 100644 +--- a/drivers/mcb/mcb-internal.h ++++ b/drivers/mcb/mcb-internal.h +@@ -7,6 +7,7 @@ + #define PCI_DEVICE_ID_MEN_CHAMELEON 0x4d45 + #define CHAMELEON_FILENAME_LEN 12 + #define CHAMELEONV2_MAGIC 0xabce ++#define CHAM_HEADER_SIZE 0x200 + + enum chameleon_descriptor_type { + CHAMELEON_DTYPE_GENERAL = 0x0, +diff --git a/drivers/mcb/mcb-pci.c b/drivers/mcb/mcb-pci.c +index b59181965643..5e1bd5db02c8 100644 +--- a/drivers/mcb/mcb-pci.c ++++ b/drivers/mcb/mcb-pci.c +@@ -17,6 +17,7 @@ + + struct priv { + struct mcb_bus *bus; ++ phys_addr_t mapbase; + void __iomem *base; + }; + +@@ -31,8 +32,8 @@ static int mcb_pci_get_irq(struct mcb_device *mdev) + + static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + { ++ struct resource *res; + struct priv *priv; +- phys_addr_t mapbase; + int ret; + int num_cells; + unsigned long flags; +@@ -47,19 +48,21 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + return -ENODEV; + } + +- mapbase = pci_resource_start(pdev, 0); +- if (!mapbase) { ++ priv->mapbase = pci_resource_start(pdev, 0); ++ if (!priv->mapbase) { + dev_err(&pdev->dev, "No PCI resource\n"); + goto err_start; + } + +- ret = pci_request_region(pdev, 0, KBUILD_MODNAME); +- if (ret) { +- dev_err(&pdev->dev, "Failed to request PCI BARs\n"); ++ res = request_mem_region(priv->mapbase, CHAM_HEADER_SIZE, ++ KBUILD_MODNAME); ++ if (IS_ERR(res)) { ++ dev_err(&pdev->dev, "Failed to request PCI memory\n"); ++ ret = PTR_ERR(res); + goto err_start; + } + +- priv->base = pci_iomap(pdev, 0, 0); ++ priv->base = ioremap(priv->mapbase, CHAM_HEADER_SIZE); + if (!priv->base) { + dev_err(&pdev->dev, "Cannot ioremap\n"); + ret = -ENOMEM; +@@ -84,7 +87,7 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + priv->bus->get_irq = mcb_pci_get_irq; + +- ret = chameleon_parse_cells(priv->bus, mapbase, priv->base); ++ ret = chameleon_parse_cells(priv->bus, priv->mapbase, priv->base); + if (ret < 0) + goto err_drvdata; + num_cells = ret; +@@ -93,8 +96,10 @@ static int mcb_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + mcb_bus_add_devices(priv->bus); + ++ return 0; ++ + err_drvdata: +- pci_iounmap(pdev, priv->base); ++ iounmap(priv->base); + err_ioremap: + pci_release_region(pdev, 0); + err_start: +@@ -107,6 +112,10 @@ static void mcb_pci_remove(struct pci_dev *pdev) + struct priv *priv = pci_get_drvdata(pdev); + + mcb_release_bus(priv->bus); ++ ++ iounmap(priv->base); ++ release_region(priv->mapbase, CHAM_HEADER_SIZE); ++ pci_disable_device(pdev); + } + + static const struct pci_device_id mcb_pci_tbl[] = { +-- +2.17.1 + diff --git a/queue-3.18/mips-fix-up-obsolete-cpu_set-usage.patch b/queue-3.18/mips-fix-up-obsolete-cpu_set-usage.patch new file mode 100644 index 00000000000..ee64b075075 --- /dev/null +++ b/queue-3.18/mips-fix-up-obsolete-cpu_set-usage.patch @@ -0,0 +1,43 @@ +From 92859d8997007c9cf03453db939d4f726612bc1d Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Tue, 28 Apr 2015 18:34:23 -0300 +Subject: MIPS: Fix up obsolete cpu_set usage + +[ Upstream commit 7363cb7de3999e84243bca79ffea257fd86a2cc6 ] + +cpu_set was removed (along with a bunch of cpumask helpers) by +commit 2f0f267ea072 ("cpumask: remove deprecated functions."). + +Fix this by replacing cpu_set with cpumask_set_cpu. Without this +fix the following error is triggered when CONFIG_MIPS_MT_FPAFF=y. + + arch/mips/kernel/smp-cps.c: In function 'cps_smp_setup': + arch/mips/kernel/smp-cps.c:95:3: error: implicit declaration of function 'cpu_set' [-Werror=implicit-function-declaration] + +Fixes: 90db024f140d ("MIPS: smp-cps: cpu_set FPU mask if FPU present") +Signed-off-by: Ezequiel Garcia +Acked-by: Niklas Cassel +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/9912/ +Signed-off-by: Ralf Baechle +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/smp-cps.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/kernel/smp-cps.c b/arch/mips/kernel/smp-cps.c +index 0854f17829f3..5680ff0eb599 100644 +--- a/arch/mips/kernel/smp-cps.c ++++ b/arch/mips/kernel/smp-cps.c +@@ -92,7 +92,7 @@ static void __init cps_smp_setup(void) + #ifdef CONFIG_MIPS_MT_FPAFF + /* If we have an FPU, enroll ourselves in the FPU-full mask */ + if (cpu_has_fpu) +- cpu_set(0, mt_fpu_cpumask); ++ cpumask_set_cpu(0, &mt_fpu_cpumask); + #endif /* CONFIG_MIPS_MT_FPAFF */ + } + +-- +2.17.1 + diff --git a/queue-3.18/mm-migrate-hugetlb-putback-destination-hugepage-to-a.patch b/queue-3.18/mm-migrate-hugetlb-putback-destination-hugepage-to-a.patch new file mode 100644 index 00000000000..d509adb2b76 --- /dev/null +++ b/queue-3.18/mm-migrate-hugetlb-putback-destination-hugepage-to-a.patch @@ -0,0 +1,44 @@ +From 92bf5fab61b4479ac06ac1b4f6f11668639425ac Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Tue, 22 Sep 2015 14:59:14 -0700 +Subject: mm: migrate: hugetlb: putback destination hugepage to active list + +[ Upstream commit 3aaa76e125c1dd58c9b599baa8c6021896874c12 ] + +Since commit bcc54222309c ("mm: hugetlb: introduce page_huge_active") +each hugetlb page maintains its active flag to avoid a race condition +betwe= en multiple calls of isolate_huge_page(), but current kernel +doesn't set the f= lag on a hugepage allocated by migration because the +proper putback routine isn= 't called. This means that users could +still encounter the race referred to by bcc54222309c in this special +case, so this patch fixes it. + +Fixes: bcc54222309c ("mm: hugetlb: introduce page_huge_active") +Signed-off-by: Naoya Horiguchi +Cc: Michal Hocko +Cc: Andi Kleen +Cc: Hugh Dickins +Cc: [4.1.x] +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/migrate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/migrate.c b/mm/migrate.c +index 4d743bce5a23..57559f9295f9 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -1077,7 +1077,7 @@ out: + if (rc != MIGRATEPAGE_SUCCESS && put_new_page) + put_new_page(new_hpage, private); + else +- put_page(new_hpage); ++ putback_active_hugepage(new_hpage); + + if (result) { + if (rc) +-- +2.17.1 + diff --git a/queue-3.18/mmc-sdhci-restore-behavior-when-setting-vdd-via-exte.patch b/queue-3.18/mmc-sdhci-restore-behavior-when-setting-vdd-via-exte.patch new file mode 100644 index 00000000000..32eaae39829 --- /dev/null +++ b/queue-3.18/mmc-sdhci-restore-behavior-when-setting-vdd-via-exte.patch @@ -0,0 +1,81 @@ +From d1b3fb279e84db9a22b89ee3b37b9509d239a62a Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Fri, 11 Dec 2015 21:36:29 +0800 +Subject: mmc: sdhci: restore behavior when setting VDD via external regulator + +[ Upstream commit 918f4cbd4340ddd1eb389cd8efa3b07ac74ec4c0 ] + +After commit 52221610dd84 ("mmc: sdhci: Improve external VDD regulator +support"), for the VDD is supplied via external regulators, we ignore +the code to convert a VDD voltage request into one of the standard +SDHCI voltage levels, then program it in the SDHCI_POWER_CONTROL. This +brings two issues: + +1. SDHCI_QUIRK2_CARD_ON_NEEDS_BUS_ON quirk isn't handled properly any +more. + +2. What's more, once SDHCI_POWER_ON bit is set, some controllers such +as the sdhci-pxav3 used in marvell berlin SoCs require the voltage +levels programming in the SDHCI_POWER_CONTROL register, even the VDD +is supplied by external regulator. So the host in marvell berlin SoCs +still works fine after the commit. However, commit 3cbc6123a93d ("mmc: +sdhci: Set SDHCI_POWER_ON with external vmmc") sets the SDHCI_POWER_ON +bit, this would make the host in marvell berlin SoCs won't work any +more with external vmmc. + +This patch restores the behavior when setting VDD through external +regulator by moving the call of mmc_regulator_set_ocr() to the end +of sdhci_set_power() function. + +After this patch, the sdcard on Marvell Berlin SoC boards work again. + +Signed-off-by: Jisheng Zhang +Fixes: 52221610dd84 ("mmc: sdhci: Improve external VDD ...") +Reviewed-by: Ludovic Desroches +Tested-by: Ludovic Desroches +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci.c | 19 ++++++------------- + 1 file changed, 6 insertions(+), 13 deletions(-) + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 56578504fd24..2295bf6e94a1 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1248,19 +1248,6 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, + struct mmc_host *mmc = host->mmc; + u8 pwr = 0; + +- if (!IS_ERR(mmc->supply.vmmc)) { +- spin_unlock_irq(&host->lock); +- mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); +- spin_lock_irq(&host->lock); +- +- if (mode != MMC_POWER_OFF) +- sdhci_writeb(host, SDHCI_POWER_ON, SDHCI_POWER_CONTROL); +- else +- sdhci_writeb(host, 0, SDHCI_POWER_CONTROL); +- +- return; +- } +- + if (mode != MMC_POWER_OFF) { + switch (1 << vdd) { + case MMC_VDD_165_195: +@@ -1319,6 +1306,12 @@ static void sdhci_set_power(struct sdhci_host *host, unsigned char mode, + if (host->quirks & SDHCI_QUIRK_DELAY_AFTER_POWER) + mdelay(10); + } ++ ++ if (!IS_ERR(mmc->supply.vmmc)) { ++ spin_unlock_irq(&host->lock); ++ mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); ++ spin_lock_irq(&host->lock); ++ } + } + + /*****************************************************************************\ +-- +2.17.1 + diff --git a/queue-3.18/mtd-blkdevs-fix-potential-deadlock-lockdep-warnings.patch b/queue-3.18/mtd-blkdevs-fix-potential-deadlock-lockdep-warnings.patch new file mode 100644 index 00000000000..9287f132687 --- /dev/null +++ b/queue-3.18/mtd-blkdevs-fix-potential-deadlock-lockdep-warnings.patch @@ -0,0 +1,172 @@ +From f342cd402546ac265fb6e560a39b332e325a22df Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Mon, 26 Oct 2015 10:20:23 -0700 +Subject: mtd: blkdevs: fix potential deadlock + lockdep warnings + +[ Upstream commit f3c63795e90f0c6238306883b6c72f14d5355721 ] + +Commit 073db4a51ee4 ("mtd: fix: avoid race condition when accessing +mtd->usecount") fixed a race condition but due to poor ordering of the +mutex acquisition, introduced a potential deadlock. + +The deadlock can occur, for example, when rmmod'ing the m25p80 module, which +will delete one or more MTDs, along with any corresponding mtdblock +devices. This could potentially race with an acquisition of the block +device as follows. + + -> blktrans_open() + -> mutex_lock(&dev->lock); + -> mutex_lock(&mtd_table_mutex); + + -> del_mtd_device() + -> mutex_lock(&mtd_table_mutex); + -> blktrans_notify_remove() -> del_mtd_blktrans_dev() + -> mutex_lock(&dev->lock); + +This is a classic (potential) ABBA deadlock, which can be fixed by +making the A->B ordering consistent everywhere. There was no real +purpose to the ordering in the original patch, AFAIR, so this shouldn't +be a problem. This ordering was actually already present in +del_mtd_blktrans_dev(), for one, where the function tried to ensure that +its caller already held mtd_table_mutex before it acquired &dev->lock: + + if (mutex_trylock(&mtd_table_mutex)) { + mutex_unlock(&mtd_table_mutex); + BUG(); + } + +So, reverse the ordering of acquisition of &dev->lock and &mtd_table_mutex so +we always acquire mtd_table_mutex first. + +Snippets of the lockdep output follow: + + # modprobe -r m25p80 + [ 53.419251] + [ 53.420838] ====================================================== + [ 53.427300] [ INFO: possible circular locking dependency detected ] + [ 53.433865] 4.3.0-rc6 #96 Not tainted + [ 53.437686] ------------------------------------------------------- + [ 53.444220] modprobe/372 is trying to acquire lock: + [ 53.449320] (&new->lock){+.+...}, at: [] del_mtd_blktrans_dev+0x80/0xdc + [ 53.457271] + [ 53.457271] but task is already holding lock: + [ 53.463372] (mtd_table_mutex){+.+.+.}, at: [] del_mtd_device+0x18/0x100 + [ 53.471321] + [ 53.471321] which lock already depends on the new lock. + [ 53.471321] + [ 53.479856] + [ 53.479856] the existing dependency chain (in reverse order) is: + [ 53.487660] + -> #1 (mtd_table_mutex){+.+.+.}: + [ 53.492331] [] blktrans_open+0x34/0x1a4 + [ 53.497879] [] __blkdev_get+0xc4/0x3b0 + [ 53.503364] [] blkdev_get+0x108/0x320 + [ 53.508743] [] do_dentry_open+0x218/0x314 + [ 53.514496] [] path_openat+0x4c0/0xf9c + [ 53.519959] [] do_filp_open+0x5c/0xc0 + [ 53.525336] [] do_sys_open+0xfc/0x1cc + [ 53.530716] [] ret_fast_syscall+0x0/0x1c + [ 53.536375] + -> #0 (&new->lock){+.+...}: + [ 53.540587] [] mutex_lock_nested+0x38/0x3cc + [ 53.546504] [] del_mtd_blktrans_dev+0x80/0xdc + [ 53.552606] [] blktrans_notify_remove+0x7c/0x84 + [ 53.558891] [] del_mtd_device+0x74/0x100 + [ 53.564544] [] del_mtd_partitions+0x80/0xc8 + [ 53.570451] [] mtd_device_unregister+0x24/0x48 + [ 53.576637] [] spi_drv_remove+0x1c/0x34 + [ 53.582207] [] __device_release_driver+0x88/0x114 + [ 53.588663] [] device_release_driver+0x20/0x2c + [ 53.594843] [] bus_remove_device+0xd8/0x108 + [ 53.600748] [] device_del+0x10c/0x210 + [ 53.606127] [] device_unregister+0xc/0x20 + [ 53.611849] [] __unregister+0x10/0x20 + [ 53.617211] [] device_for_each_child+0x50/0x7c + [ 53.623387] [] spi_unregister_master+0x58/0x8c + [ 53.629578] [] release_nodes+0x15c/0x1c8 + [ 53.635223] [] __device_release_driver+0x90/0x114 + [ 53.641689] [] driver_detach+0xb4/0xb8 + [ 53.647147] [] bus_remove_driver+0x4c/0xa0 + [ 53.652970] [] SyS_delete_module+0x11c/0x1e4 + [ 53.658976] [] ret_fast_syscall+0x0/0x1c + [ 53.664621] + [ 53.664621] other info that might help us debug this: + [ 53.664621] + [ 53.672979] Possible unsafe locking scenario: + [ 53.672979] + [ 53.679169] CPU0 CPU1 + [ 53.683900] ---- ---- + [ 53.688633] lock(mtd_table_mutex); + [ 53.692383] lock(&new->lock); + [ 53.698306] lock(mtd_table_mutex); + [ 53.704658] lock(&new->lock); + [ 53.707946] + [ 53.707946] *** DEADLOCK *** + +Fixes: 073db4a51ee4 ("mtd: fix: avoid race condition when accessing mtd->usecount") +Reported-by: Felipe Balbi +Tested-by: Felipe Balbi +Signed-off-by: Brian Norris +Cc: +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtd_blkdevs.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c +index 3e3aa17ee3bd..6368300f3fbe 100644 +--- a/drivers/mtd/mtd_blkdevs.c ++++ b/drivers/mtd/mtd_blkdevs.c +@@ -195,8 +195,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + if (!dev) + return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ + +- mutex_lock(&dev->lock); + mutex_lock(&mtd_table_mutex); ++ mutex_lock(&dev->lock); + + if (dev->open) + goto unlock; +@@ -220,8 +220,8 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) + + unlock: + dev->open++; +- mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); ++ mutex_unlock(&mtd_table_mutex); + blktrans_dev_put(dev); + return ret; + +@@ -231,8 +231,8 @@ error_release: + error_put: + module_put(dev->tr->owner); + kref_put(&dev->ref, blktrans_dev_release); +- mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); ++ mutex_unlock(&mtd_table_mutex); + blktrans_dev_put(dev); + return ret; + } +@@ -244,8 +244,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) + if (!dev) + return; + +- mutex_lock(&dev->lock); + mutex_lock(&mtd_table_mutex); ++ mutex_lock(&dev->lock); + + if (--dev->open) + goto unlock; +@@ -259,8 +259,8 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) + __put_mtd_device(dev->mtd); + } + unlock: +- mutex_unlock(&mtd_table_mutex); + mutex_unlock(&dev->lock); ++ mutex_unlock(&mtd_table_mutex); + blktrans_dev_put(dev); + } + +-- +2.17.1 + diff --git a/queue-3.18/net-cxgb3_main-fix-a-missing-check-bug.patch b/queue-3.18/net-cxgb3_main-fix-a-missing-check-bug.patch new file mode 100644 index 00000000000..0a636120d89 --- /dev/null +++ b/queue-3.18/net-cxgb3_main-fix-a-missing-check-bug.patch @@ -0,0 +1,111 @@ +From aaac5c6d8d51f14eaf6716945efd932489c14553 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Fri, 5 Oct 2018 08:48:27 -0500 +Subject: net: cxgb3_main: fix a missing-check bug + +[ Upstream commit 2c05d88818ab6571816b93edce4d53703870d7ae ] + +In cxgb_extension_ioctl(), the command of the ioctl is firstly copied from +the user-space buffer 'useraddr' to 'cmd' and checked through the +switch statement. If the command is not as expected, an error code +EOPNOTSUPP is returned. In the following execution, i.e., the cases of the +switch statement, the whole buffer of 'useraddr' is copied again to a +specific data structure, according to what kind of command is requested. +However, after the second copy, there is no re-check on the newly-copied +command. Given that the buffer 'useraddr' is in the user space, a malicious +user can race to change the command between the two copies. By doing so, +the attacker can supply malicious data to the kernel and cause undefined +behavior. + +This patch adds a re-check in each case of the switch statement if there is +a second copy in that case, to re-check whether the command obtained in the +second copy is the same as the one in the first copy. If not, an error code +EINVAL is returned. + +Signed-off-by: Wenwen Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +index db76f7040455..dd3e5247190e 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +@@ -2146,6 +2146,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EPERM; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_SET_QSET_PARAMS) ++ return -EINVAL; + if (t.qset_idx >= SGE_QSETS) + return -EINVAL; + if (!in_range(t.intr_lat, 0, M_NEWTIMER) || +@@ -2245,6 +2247,9 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; + ++ if (t.cmd != CHELSIO_GET_QSET_PARAMS) ++ return -EINVAL; ++ + /* Display qsets for all ports when offload enabled */ + if (test_bit(OFFLOAD_DEVMAP_BIT, &adapter->open_device_map)) { + q1 = 0; +@@ -2289,6 +2294,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&edata, useraddr, sizeof(edata))) + return -EFAULT; ++ if (edata.cmd != CHELSIO_SET_QSET_NUM) ++ return -EINVAL; + if (edata.val < 1 || + (edata.val > 1 && !(adapter->flags & USING_MSIX))) + return -EINVAL; +@@ -2329,6 +2336,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EPERM; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_LOAD_FW) ++ return -EINVAL; + /* Check t.len sanity ? */ + fw_data = memdup_user(useraddr + sizeof(t), t.len); + if (IS_ERR(fw_data)) +@@ -2352,6 +2361,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&m, useraddr, sizeof(m))) + return -EFAULT; ++ if (m.cmd != CHELSIO_SETMTUTAB) ++ return -EINVAL; + if (m.nmtus != NMTUS) + return -EINVAL; + if (m.mtus[0] < 81) /* accommodate SACK */ +@@ -2393,6 +2404,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EBUSY; + if (copy_from_user(&m, useraddr, sizeof(m))) + return -EFAULT; ++ if (m.cmd != CHELSIO_SET_PM) ++ return -EINVAL; + if (!is_power_of_2(m.rx_pg_sz) || + !is_power_of_2(m.tx_pg_sz)) + return -EINVAL; /* not power of 2 */ +@@ -2426,6 +2439,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EIO; /* need the memory controllers */ + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_GET_MEM) ++ return -EINVAL; + if ((t.addr & 7) || (t.len & 7)) + return -EINVAL; + if (t.mem_id == MEM_CM) +@@ -2478,6 +2493,8 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + return -EAGAIN; + if (copy_from_user(&t, useraddr, sizeof(t))) + return -EFAULT; ++ if (t.cmd != CHELSIO_SET_TRACE_FILTER) ++ return -EINVAL; + + tp = (const struct trace_params *)&t.sip; + if (t.config_tx) +-- +2.17.1 + diff --git a/queue-3.18/net-ethernet-davicom-fix-devicetree-irq-resource.patch b/queue-3.18/net-ethernet-davicom-fix-devicetree-irq-resource.patch new file mode 100644 index 00000000000..3fbd279aa61 --- /dev/null +++ b/queue-3.18/net-ethernet-davicom-fix-devicetree-irq-resource.patch @@ -0,0 +1,125 @@ +From dc198140a4ba992c0b57ea1170bcf42630797d7d Mon Sep 17 00:00:00 2001 +From: Robert Jarzmik +Date: Sat, 20 Feb 2016 21:45:26 +0100 +Subject: net: ethernet: davicom: fix devicetree irq resource +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit b5a099c67a1c36b91356624ce86eb3f9f48a82c7 ] + +The dm9000 driver doesn't work in at least one device-tree +configuration, spitting an error message on irq resource : +[    1.062495] dm9000 8000000.ethernet: insufficient resources +[    1.068439] dm9000 8000000.ethernet: not found (-2). +[    1.073451] dm9000: probe of 8000000.ethernet failed with error -2 + +The reason behind is that the interrupt might be provided by a gpio +controller, not probed when dm9000 is probed, and needing the probe +deferral mechanism to apply. + +Currently, the interrupt is directly taken from resources. This patch +changes this to use the more generic platform_get_irq(), which handles +the deferral. + +Moreover, since commit Fixes: 7085a7401ba5 ("drivers: platform: parse +IRQ flags from resources"), the interrupt trigger flags are honored in +platform_get_irq(), so remove the needless code in dm9000. + +Signed-off-by: Robert Jarzmik +Acked-by: Marcel Ziswiler +Cc: Sergei Shtylyov +Tested-by: Sergei Ianovich +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/davicom/dm9000.c | 34 +++++++++++++-------------- + 1 file changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c +index f3ba840cbf7b..ef24b60b4d3f 100644 +--- a/drivers/net/ethernet/davicom/dm9000.c ++++ b/drivers/net/ethernet/davicom/dm9000.c +@@ -125,7 +125,6 @@ struct board_info { + struct resource *data_res; + struct resource *addr_req; /* resources requested */ + struct resource *data_req; +- struct resource *irq_res; + + int irq_wake; + +@@ -1297,22 +1296,16 @@ static int + dm9000_open(struct net_device *dev) + { + struct board_info *db = netdev_priv(dev); +- unsigned long irqflags = db->irq_res->flags & IRQF_TRIGGER_MASK; + + if (netif_msg_ifup(db)) + dev_dbg(db->dev, "enabling %s\n", dev->name); + +- /* If there is no IRQ type specified, default to something that +- * may work, and tell the user that this is a problem */ +- +- if (irqflags == IRQF_TRIGGER_NONE) +- irqflags = irq_get_trigger_type(dev->irq); +- +- if (irqflags == IRQF_TRIGGER_NONE) ++ /* If there is no IRQ type specified, tell the user that this is a ++ * problem ++ */ ++ if (irq_get_trigger_type(dev->irq) == IRQF_TRIGGER_NONE) + dev_warn(db->dev, "WARNING: no IRQ resource flags set.\n"); + +- irqflags |= IRQF_SHARED; +- + /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */ + iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */ + mdelay(1); /* delay needs by DM9000B */ +@@ -1320,7 +1313,8 @@ dm9000_open(struct net_device *dev) + /* Initialize DM9000 board */ + dm9000_init_dm9000(dev); + +- if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev)) ++ if (request_irq(dev->irq, dm9000_interrupt, IRQF_SHARED, ++ dev->name, dev)) + return -EAGAIN; + /* Now that we have an interrupt handler hooked up we can unmask + * our interrupts +@@ -1460,15 +1454,22 @@ dm9000_probe(struct platform_device *pdev) + + db->addr_res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + db->data_res = platform_get_resource(pdev, IORESOURCE_MEM, 1); +- db->irq_res = platform_get_resource(pdev, IORESOURCE_IRQ, 0); + +- if (db->addr_res == NULL || db->data_res == NULL || +- db->irq_res == NULL) { +- dev_err(db->dev, "insufficient resources\n"); ++ if (!db->addr_res || !db->data_res) { ++ dev_err(db->dev, "insufficient resources addr=%p data=%p\n", ++ db->addr_res, db->data_res); + ret = -ENOENT; + goto out; + } + ++ ndev->irq = platform_get_irq(pdev, 0); ++ if (ndev->irq < 0) { ++ dev_err(db->dev, "interrupt resource unavailable: %d\n", ++ ndev->irq); ++ ret = ndev->irq; ++ goto out; ++ } ++ + db->irq_wake = platform_get_irq(pdev, 1); + if (db->irq_wake >= 0) { + dev_dbg(db->dev, "wakeup irq %d\n", db->irq_wake); +@@ -1530,7 +1531,6 @@ dm9000_probe(struct platform_device *pdev) + + /* fill in parameters for net-dev structure */ + ndev->base_addr = (unsigned long)db->io_addr; +- ndev->irq = db->irq_res->start; + + /* ensure at least we have a default set of IO routines */ + dm9000_set_io(db, iosize); +-- +2.17.1 + diff --git a/queue-3.18/net-fix-warnings-in-make-htmldocs-by-moving-macro-de.patch b/queue-3.18/net-fix-warnings-in-make-htmldocs-by-moving-macro-de.patch new file mode 100644 index 00000000000..4e5a3bc4ed0 --- /dev/null +++ b/queue-3.18/net-fix-warnings-in-make-htmldocs-by-moving-macro-de.patch @@ -0,0 +1,37 @@ +From 1181bd3d92cb27e6f0d751645dbb3cebb6147a08 Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Mon, 14 Dec 2015 23:30:43 +0100 +Subject: net: fix warnings in 'make htmldocs' by moving macro definition out + of field declaration + +[ Upstream commit 7bbadd2d1009575dad675afc16650ebb5aa10612 ] + +Docbook does not like the definition of macros inside a field declaration +and adds a warning. Move the definition out. + +Fixes: 79462ad02e86180 ("net: add validation for the socket syscall protocol argument") +Reported-by: kbuild test robot +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index a40bc8c0af4b..76afe92a0f4a 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -379,8 +379,8 @@ struct sock { + sk_no_check_rx : 1, + sk_userlocks : 4, + sk_protocol : 8, +-#define SK_PROTOCOL_MAX U8_MAX + sk_type : 16; ++#define SK_PROTOCOL_MAX U8_MAX + kmemcheck_bitfield_end(flags); + int sk_wmem_queued; + gfp_t sk_allocation; +-- +2.17.1 + diff --git a/queue-3.18/net-mlx4_en-remove-dependency-between-timestamping-c.patch b/queue-3.18/net-mlx4_en-remove-dependency-between-timestamping-c.patch new file mode 100644 index 00000000000..6f060779c2b --- /dev/null +++ b/queue-3.18/net-mlx4_en-remove-dependency-between-timestamping-c.patch @@ -0,0 +1,40 @@ +From c0733030d1c74d152a53b0a83c3126d98a8164c5 Mon Sep 17 00:00:00 2001 +From: Eugenia Emantayev +Date: Thu, 17 Dec 2015 15:35:37 +0200 +Subject: net/mlx4_en: Remove dependency between timestamping capability and + service_task + +[ Upstream commit fc9f5ea9b4ecbe9b7839c92f0a54261809c723d3 ] + +Service task is responsible for other tasks in addition to timestamping +overflow check. Launch it even if timestamping is not supported by device. + +Fixes: 07841f9d94c1 ('net/mlx4_en: Schedule napi when RX buffers allocation fails') +Signed-off-by: Eugenia Emantayev +Signed-off-by: Eran Ben Elisha +Signed-off-by: Or Gerlitz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index f31814293d3c..980dd359e3f7 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -2638,9 +2638,8 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + } + queue_delayed_work(mdev->workqueue, &priv->stats_task, STATS_DELAY); + +- if (mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_TS) +- queue_delayed_work(mdev->workqueue, &priv->service_task, +- SERVICE_TASK_DELAY); ++ queue_delayed_work(mdev->workqueue, &priv->service_task, ++ SERVICE_TASK_DELAY); + + err = register_netdev(dev); + if (err) { +-- +2.17.1 + diff --git a/queue-3.18/nfs-fix-high-load-average-due-to-callback-thread-sle.patch b/queue-3.18/nfs-fix-high-load-average-due-to-callback-thread-sle.patch new file mode 100644 index 00000000000..5baddc5bdcd --- /dev/null +++ b/queue-3.18/nfs-fix-high-load-average-due-to-callback-thread-sle.patch @@ -0,0 +1,65 @@ +From e3ec6385a979abb487f3ba4ac7f0cbd5fab3b927 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Fri, 20 Mar 2015 15:15:14 -0400 +Subject: nfs: fix high load average due to callback thread sleeping +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 5d05e54af3cdbb13cf19c557ff2184781b91a22c ] + +Chuck pointed out a problem that crept in with commit 6ffa30d3f734 (nfs: +don't call blocking operations while !TASK_RUNNING). Linux counts tasks +in uninterruptible sleep against the load average, so this caused the +system's load average to be pinned at at least 1 when there was a +NFSv4.1+ mount active. + +Not a huge problem, but it's probably worth fixing before we get too +many complaints about it. This patch converts the code back to use +TASK_INTERRUPTIBLE sleep, simply has it flush any signals on each loop +iteration. In practice no one should really be signalling this thread at +all, so I think this is reasonably safe. + +With this change, there's also no need to game the hung task watchdog so +we can also convert the schedule_timeout call back to a normal schedule. + +Cc: +Reported-by: Chuck Lever +Signed-off-by: Jeff Layton +Tested-by: Chuck Lever +Fixes: commit 6ffa30d3f734 (“nfs: don't call blocking . . .”) +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c +index 3b8cdb8298c4..a78558a25035 100644 +--- a/fs/nfs/callback.c ++++ b/fs/nfs/callback.c +@@ -128,7 +128,7 @@ nfs41_callback_svc(void *vrqstp) + if (try_to_freeze()) + continue; + +- prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_UNINTERRUPTIBLE); ++ prepare_to_wait(&serv->sv_cb_waitq, &wq, TASK_INTERRUPTIBLE); + spin_lock_bh(&serv->sv_cb_lock); + if (!list_empty(&serv->sv_cb_list)) { + req = list_first_entry(&serv->sv_cb_list, +@@ -142,10 +142,10 @@ nfs41_callback_svc(void *vrqstp) + error); + } else { + spin_unlock_bh(&serv->sv_cb_lock); +- /* schedule_timeout to game the hung task watchdog */ +- schedule_timeout(60 * HZ); ++ schedule(); + finish_wait(&serv->sv_cb_waitq, &wq); + } ++ flush_signals(current); + } + return 0; + } +-- +2.17.1 + diff --git a/queue-3.18/nfs-ignore-transport-protocol-when-detecting-server-.patch b/queue-3.18/nfs-ignore-transport-protocol-when-detecting-server-.patch new file mode 100644 index 00000000000..ed137010b2d --- /dev/null +++ b/queue-3.18/nfs-ignore-transport-protocol-when-detecting-server-.patch @@ -0,0 +1,46 @@ +From 9da3c8de71eda04a6f2bba8505be1394d77e117f Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Sat, 3 Jan 2015 14:45:33 -0500 +Subject: NFS: Ignore transport protocol when detecting server trunking + +[ Upstream commit 7a01edf0058df98d6cc734c5a4ecc51f929a86ec ] + +Detect server trunking across transport protocols. Otherwise, an +RDMA mount and a TCP mount of the same server will end up with +separate nfs_clients using the same clientid4. + +Reported-by: Dai Ngo +Signed-off-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index a8a9be4c6cf4..eb8777eb4d2b 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -495,9 +495,6 @@ int nfs40_walk_client_list(struct nfs_client *new, + if (pos->rpc_ops != new->rpc_ops) + continue; + +- if (pos->cl_proto != new->cl_proto) +- continue; +- + if (pos->cl_minorversion != new->cl_minorversion) + continue; + +@@ -633,9 +630,6 @@ int nfs41_walk_client_list(struct nfs_client *new, + if (pos->rpc_ops != new->rpc_ops) + continue; + +- if (pos->cl_proto != new->cl_proto) +- continue; +- + if (pos->cl_minorversion != new->cl_minorversion) + continue; + +-- +2.17.1 + diff --git a/queue-3.18/nfsv4-cache-the-nfsv4-v4.1-client-owner_id-in-the-st.patch b/queue-3.18/nfsv4-cache-the-nfsv4-v4.1-client-owner_id-in-the-st.patch new file mode 100644 index 00000000000..37b28f8e54a --- /dev/null +++ b/queue-3.18/nfsv4-cache-the-nfsv4-v4.1-client-owner_id-in-the-st.patch @@ -0,0 +1,103 @@ +From e11ef1c4d20d847f2758b9bd05dfb5214b77de06 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 3 Jan 2015 15:16:04 -0500 +Subject: NFSv4: Cache the NFSv4/v4.1 client owner_id in the struct nfs_client + +[ Upstream commit ceb3a16c070c403f5f9ca46b46cf2bb79ea11750 ] + +Ensure that we cache the NFSv4/v4.1 client owner_id so that we can +verify it when we're doing trunking detection. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 1 + + fs/nfs/nfs4proc.c | 19 +++++++++++++++---- + include/linux/nfs_fs_sb.h | 3 +++ + 3 files changed, 19 insertions(+), 4 deletions(-) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 723c656ebd28..d748d403bab1 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -228,6 +228,7 @@ static void nfs4_shutdown_client(struct nfs_client *clp) + kfree(clp->cl_serverowner); + kfree(clp->cl_serverscope); + kfree(clp->cl_implid); ++ kfree(clp->cl_owner_id); + } + + void nfs4_free_client(struct nfs_client *clp) +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 321044c183f5..db8456b4ecb8 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -4913,11 +4913,14 @@ static void nfs4_init_boot_verifier(const struct nfs_client *clp, + } + + static unsigned int +-nfs4_init_nonuniform_client_string(const struct nfs_client *clp, ++nfs4_init_nonuniform_client_string(struct nfs_client *clp, + char *buf, size_t len) + { + unsigned int result; + ++ if (clp->cl_owner_id != NULL) ++ return strlcpy(buf, clp->cl_owner_id, len); ++ + rcu_read_lock(); + result = scnprintf(buf, len, "Linux NFSv4.0 %s/%s %s", + clp->cl_ipaddr, +@@ -4926,24 +4929,32 @@ nfs4_init_nonuniform_client_string(const struct nfs_client *clp, + rpc_peeraddr2str(clp->cl_rpcclient, + RPC_DISPLAY_PROTO)); + rcu_read_unlock(); ++ clp->cl_owner_id = kstrdup(buf, GFP_KERNEL); + return result; + } + + static unsigned int +-nfs4_init_uniform_client_string(const struct nfs_client *clp, ++nfs4_init_uniform_client_string(struct nfs_client *clp, + char *buf, size_t len) + { + const char *nodename = clp->cl_rpcclient->cl_nodename; ++ unsigned int result; ++ ++ if (clp->cl_owner_id != NULL) ++ return strlcpy(buf, clp->cl_owner_id, len); + + if (nfs4_client_id_uniquifier[0] != '\0') +- return scnprintf(buf, len, "Linux NFSv%u.%u %s/%s", ++ result = scnprintf(buf, len, "Linux NFSv%u.%u %s/%s", + clp->rpc_ops->version, + clp->cl_minorversion, + nfs4_client_id_uniquifier, + nodename); +- return scnprintf(buf, len, "Linux NFSv%u.%u %s", ++ else ++ result = scnprintf(buf, len, "Linux NFSv%u.%u %s", + clp->rpc_ops->version, clp->cl_minorversion, + nodename); ++ clp->cl_owner_id = kstrdup(buf, GFP_KERNEL); ++ return result; + } + + /* +diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h +index fd249ab2718f..4ac99c07406a 100644 +--- a/include/linux/nfs_fs_sb.h ++++ b/include/linux/nfs_fs_sb.h +@@ -74,6 +74,9 @@ struct nfs_client { + /* idmapper */ + struct idmap * cl_idmap; + ++ /* Client owner identifier */ ++ const char * cl_owner_id; ++ + /* Our own IP address, as a null-terminated string. + * This is used to generate the mv0 callback address. + */ +-- +2.17.1 + diff --git a/queue-3.18/nfsv4-remove-incorrect-check-in-can_open_delegated.patch b/queue-3.18/nfsv4-remove-incorrect-check-in-can_open_delegated.patch new file mode 100644 index 00000000000..69544b4a145 --- /dev/null +++ b/queue-3.18/nfsv4-remove-incorrect-check-in-can_open_delegated.patch @@ -0,0 +1,33 @@ +From 814dc2008f043f485f7a2007397c0a85a04986b6 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Fri, 19 Dec 2014 12:47:50 -0500 +Subject: NFSv4: Remove incorrect check in can_open_delegated() + +[ Upstream commit 4e379d36c050b0117b5d10048be63a44f5036115 ] + +Remove an incorrect check for NFS_DELEGATION_NEED_RECLAIM in +can_open_delegated(). We are allowed to cache opens even in +a situation where we're doing reboot recovery. + +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index db8456b4ecb8..21906d2a13cc 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1117,8 +1117,6 @@ static int can_open_delegated(struct nfs_delegation *delegation, fmode_t fmode) + return 0; + if ((delegation->type & fmode) != fmode) + return 0; +- if (test_bit(NFS_DELEGATION_NEED_RECLAIM, &delegation->flags)) +- return 0; + if (test_bit(NFS_DELEGATION_RETURNING, &delegation->flags)) + return 0; + nfs_mark_delegation_referenced(delegation); +-- +2.17.1 + diff --git a/queue-3.18/nfsv4-v4.1-verify-the-client-owner-id-during-trunkin.patch b/queue-3.18/nfsv4-v4.1-verify-the-client-owner-id-during-trunkin.patch new file mode 100644 index 00000000000..59c54ac51c1 --- /dev/null +++ b/queue-3.18/nfsv4-v4.1-verify-the-client-owner-id-during-trunkin.patch @@ -0,0 +1,73 @@ +From 8dd48c2885007f371a0abd59bfa231fa4c753124 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sat, 3 Jan 2015 15:35:27 -0500 +Subject: NFSv4/v4.1: Verify the client owner id during trunking detection + +[ Upstream commit 55b9df93ddd684cbc4c2dee9b8a99f6e48348212 ] + +While we normally expect the NFSv4 client to always send the same client +owner to all servers, there are a couple of situations where that is not +the case: + 1) In NFSv4.0, switching between use of '-omigration' and not will cause + the kernel to switch between using the non-uniform and uniform client + strings. + 2) In NFSv4.1, or NFSv4.0 when using uniform client strings, if the + uniquifier string is suddenly changed. + +This patch will catch those situations by checking the client owner id +in the trunking detection code, and will do the right thing if it notices +that the strings differ. + +Cc: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index d748d403bab1..a8a9be4c6cf4 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -456,6 +456,14 @@ static void nfs4_swap_callback_idents(struct nfs_client *keep, + spin_unlock(&nn->nfs_client_lock); + } + ++static bool nfs4_match_client_owner_id(const struct nfs_client *clp1, ++ const struct nfs_client *clp2) ++{ ++ if (clp1->cl_owner_id == NULL || clp2->cl_owner_id == NULL) ++ return true; ++ return strcmp(clp1->cl_owner_id, clp2->cl_owner_id) == 0; ++} ++ + /** + * nfs40_walk_client_list - Find server that recognizes a client ID + * +@@ -515,6 +523,9 @@ int nfs40_walk_client_list(struct nfs_client *new, + if (pos->cl_clientid != new->cl_clientid) + continue; + ++ if (!nfs4_match_client_owner_id(pos, new)) ++ continue; ++ + atomic_inc(&pos->cl_count); + spin_unlock(&nn->nfs_client_lock); + +@@ -664,6 +675,13 @@ int nfs41_walk_client_list(struct nfs_client *new, + if (!nfs4_check_clientid_trunking(pos, new)) + continue; + ++ /* Unlike NFSv4.0, we know that NFSv4.1 always uses the ++ * uniform string, however someone might switch the ++ * uniquifier string on us. ++ */ ++ if (!nfs4_match_client_owner_id(pos, new)) ++ continue; ++ + atomic_inc(&pos->cl_count); + *result = pos; + status = 0; +-- +2.17.1 + diff --git a/queue-3.18/ocfs2-fix-journal-commit-deadlock-in-ocfs2_convert_i.patch b/queue-3.18/ocfs2-fix-journal-commit-deadlock-in-ocfs2_convert_i.patch new file mode 100644 index 00000000000..1f86bc75fd8 --- /dev/null +++ b/queue-3.18/ocfs2-fix-journal-commit-deadlock-in-ocfs2_convert_i.patch @@ -0,0 +1,86 @@ +From bb2cbbbb0dd9031959750e0c1c6220518fe52fba Mon Sep 17 00:00:00 2001 +From: alex chen +Date: Tue, 10 Feb 2015 14:09:02 -0800 +Subject: ocfs2: fix journal commit deadlock in + ocfs2_convert_inline_data_to_extents + +[ Upstream commit 15eba0fe3eeaeb1b80489c1ebb9d47d6d7003f57 ] + +Similar to ocfs2_write_end_nolock() which is metioned at commit +136f49b91710 ("ocfs2: fix journal commit deadlock"), we should unlock +pages before ocfs2_commit_trans() in ocfs2_convert_inline_data_to_extents. + +Otherwise, it will cause a deadlock with journal commit threads. + +Signed-off-by: Alex Chen +Reviewed-by: Joseph Qi +Cc: Joel Becker +Cc: Mark Fasheh +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/alloc.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c +index d9db90446c9d..3564b896a92e 100644 +--- a/fs/ocfs2/alloc.c ++++ b/fs/ocfs2/alloc.c +@@ -6871,7 +6871,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + if (IS_ERR(handle)) { + ret = PTR_ERR(handle); + mlog_errno(ret); +- goto out_unlock; ++ goto out; + } + + ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, +@@ -6929,7 +6929,7 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + if (ret) { + mlog_errno(ret); + need_free = 1; +- goto out_commit; ++ goto out_unlock; + } + + page_end = PAGE_CACHE_SIZE; +@@ -6962,12 +6962,16 @@ int ocfs2_convert_inline_data_to_extents(struct inode *inode, + if (ret) { + mlog_errno(ret); + need_free = 1; +- goto out_commit; ++ goto out_unlock; + } + + inode->i_blocks = ocfs2_inode_sector_count(inode); + } + ++out_unlock: ++ if (pages) ++ ocfs2_unlock_and_free_pages(pages, num_pages); ++ + out_commit: + if (ret < 0 && did_quota) + dquot_free_space_nodirty(inode, +@@ -6987,15 +6991,11 @@ out_commit: + + ocfs2_commit_trans(osb, handle); + +-out_unlock: ++out: + if (data_ac) + ocfs2_free_alloc_context(data_ac); +- +-out: +- if (pages) { +- ocfs2_unlock_and_free_pages(pages, num_pages); ++ if (pages) + kfree(pages); +- } + + return ret; + } +-- +2.17.1 + diff --git a/queue-3.18/of-pci-remove-duplicate-kfree-in-of_pci_get_host_bri.patch b/queue-3.18/of-pci-remove-duplicate-kfree-in-of_pci_get_host_bri.patch new file mode 100644 index 00000000000..d93c6ef6d7d --- /dev/null +++ b/queue-3.18/of-pci-remove-duplicate-kfree-in-of_pci_get_host_bri.patch @@ -0,0 +1,40 @@ +From 7845a494911f8a67f28059303e4d6b05fce4925d Mon Sep 17 00:00:00 2001 +From: Lorenzo Pieralisi +Date: Wed, 11 Feb 2015 04:58:35 +0000 +Subject: of/pci: Remove duplicate kfree in of_pci_get_host_bridge_resources() + +[ Upstream commit feb28979c137ba3f649ad36fc27c85c64c111f78 ] + +Commit d2be00c0fb5a ("of/pci: Free resources on failure in +of_pci_get_host_bridge_resources()") fixed the error path so it frees +everything on the "resources" list. That list includes the bus_range, so +we should not free it again. + +Remove the superfluous free of bus_range. + +[bhelgaas: changelog] +Fixes: d2be00c0fb5a ("of/pci: Free resources on failure in of_pci_get_host_bridge_resources()") +Reported-by: Jiang Liu +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +CC: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/of/of_pci.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/of/of_pci.c b/drivers/of/of_pci.c +index ecc5fa5640d2..8a74b1d399a1 100644 +--- a/drivers/of/of_pci.c ++++ b/drivers/of/of_pci.c +@@ -229,7 +229,6 @@ parse_failed: + list_for_each_entry(window, resources, list) + kfree(window->res); + pci_free_resource_list(resources); +- kfree(bus_range); + return err; + } + EXPORT_SYMBOL_GPL(of_pci_get_host_bridge_resources); +-- +2.17.1 + diff --git a/queue-3.18/ovl-fix-open-in-stacked-overlay.patch b/queue-3.18/ovl-fix-open-in-stacked-overlay.patch new file mode 100644 index 00000000000..f41fdbe7204 --- /dev/null +++ b/queue-3.18/ovl-fix-open-in-stacked-overlay.patch @@ -0,0 +1,41 @@ +From dcc72cbffe9818e7ea67aee2f6238efbf9a50988 Mon Sep 17 00:00:00 2001 +From: Miklos Szeredi +Date: Mon, 12 Oct 2015 15:56:20 +0200 +Subject: ovl: fix open in stacked overlay + +[ Upstream commit 1c8a47df36d72ace8cf78eb6c228aa0f8027d3c2 ] + +If two overlayfs filesystems are stacked on top of each other, then we need +recursion in ovl_d_select_inode(). + +I guess d_backing_inode() is supposed to do that. But currently it doesn't +and that functionality is open coded in vfs_open(). This is now copied +into ovl_d_select_inode() to fix this regression. + +Reported-by: Alban Crequy +Signed-off-by: Miklos Szeredi +Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay...") +Cc: David Howells +Cc: # v4.2+ +Signed-off-by: Sasha Levin +--- + fs/overlayfs/inode.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c +index df5c2853c4e5..a01ec1836a72 100644 +--- a/fs/overlayfs/inode.c ++++ b/fs/overlayfs/inode.c +@@ -377,6 +377,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags) + ovl_path_upper(dentry, &realpath); + } + ++ if (realpath.dentry->d_flags & DCACHE_OP_SELECT_INODE) ++ return realpath.dentry->d_op->d_select_inode(realpath.dentry, file_flags); ++ + return d_backing_inode(realpath.dentry); + } + +-- +2.17.1 + diff --git a/queue-3.18/pci-fix-devfn-for-vpd-access-through-function-0.patch b/queue-3.18/pci-fix-devfn-for-vpd-access-through-function-0.patch new file mode 100644 index 00000000000..f2135b161d9 --- /dev/null +++ b/queue-3.18/pci-fix-devfn-for-vpd-access-through-function-0.patch @@ -0,0 +1,62 @@ +From eef5f4ca5cdd2ca1c46f3906d0d7d89b2fb2cfba Mon Sep 17 00:00:00 2001 +From: Alex Williamson +Date: Tue, 15 Sep 2015 11:17:21 -0600 +Subject: PCI: Fix devfn for VPD access through function 0 + +[ Upstream commit 9d9240756e63dd87d6cbf5da8b98ceb8f8192b55 ] + +Commit 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function +0") passes PCI_SLOT(devfn) for the devfn parameter of pci_get_slot(). +Generally this works because we're fairly well guaranteed that a PCIe +device is at slot address 0, but for the general case, including +conventional PCI, it's incorrect. We need to get the slot and then convert +it back into a devfn. + +Fixes: 932c435caba8 ("PCI: Add dev_flags bit to access VPD through function 0") +Signed-off-by: Alex Williamson +Signed-off-by: Bjorn Helgaas +Acked-by: Myron Stowe +Acked-by: Mark Rustad +CC: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/pci/access.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 7f249b9ab2ce..2f15e7bb9f44 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -355,7 +355,8 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = { + static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count, + void *arg) + { +- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ struct pci_dev *tdev = pci_get_slot(dev->bus, ++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); + ssize_t ret; + + if (!tdev) +@@ -369,7 +370,8 @@ static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count, + static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count, + const void *arg) + { +- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ struct pci_dev *tdev = pci_get_slot(dev->bus, ++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); + ssize_t ret; + + if (!tdev) +@@ -388,7 +390,8 @@ static const struct pci_vpd_ops pci_vpd_f0_ops = { + + static int pci_vpd_f0_dev_check(struct pci_dev *dev) + { +- struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn)); ++ struct pci_dev *tdev = pci_get_slot(dev->bus, ++ PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); + int ret = 0; + + if (!tdev) +-- +2.17.1 + diff --git a/queue-3.18/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch b/queue-3.18/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch new file mode 100644 index 00000000000..b3e3f53b627 --- /dev/null +++ b/queue-3.18/pci-mark-atheros-ar9580-to-avoid-bus-reset.patch @@ -0,0 +1,36 @@ +From d664153da5ad0c36d679d936430dfaacc8c8a0cd Mon Sep 17 00:00:00 2001 +From: Maik Broemme +Date: Tue, 9 Aug 2016 16:41:31 +0200 +Subject: PCI: Mark Atheros AR9580 to avoid bus reset + +[ Upstream commit 8e2e03179923479ca0c0b6fdc7c93ecf89bce7a8 ] + +Similar to the AR93xx and the AR94xx series, the AR95xx also have the same +quirk for the Bus Reset. It will lead to instant system reset if the +device is assigned via VFIO to a KVM VM. I've been able reproduce this +behavior with a MikroTik R11e-2HnD. + +Fixes: c3e59ee4e766 ("PCI: Mark Atheros AR93xx to avoid bus reset") +Signed-off-by: Maik Broemme +Signed-off-by: Bjorn Helgaas +CC: stable@vger.kernel.org # v3.14+ +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 9e86ace95832..0b75b47a5329 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3081,6 +3081,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0030, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset); + + #ifdef CONFIG_ACPI + /* +-- +2.17.1 + diff --git a/queue-3.18/perf-bench-numa-fix-to-show-proper-convergence-stats.patch b/queue-3.18/perf-bench-numa-fix-to-show-proper-convergence-stats.patch new file mode 100644 index 00000000000..f681fa0bb49 --- /dev/null +++ b/queue-3.18/perf-bench-numa-fix-to-show-proper-convergence-stats.patch @@ -0,0 +1,54 @@ +From b1401ec96b36818401f13cc406489db93a5d5093 Mon Sep 17 00:00:00 2001 +From: Srikar Dronamraju +Date: Wed, 24 Jun 2015 16:40:04 +0530 +Subject: perf bench numa: Fix to show proper convergence stats + +[ Upstream commit 2b42b09b88c831ba4da2d669581dde371c38c2af ] + +With commit: e1e455f4f4d3 (perf tools: Work around lack of sched_getcpu +in glibc < 2.6), perf_bench numa mem with -c or -m option is not able to +correctly calculate convergence. + +With the above commit, sched_getcpu always seems to return -1. The +intention of commit e1e455f was to add a sched_getcpu in glibc < 2.6. +Hence keep the sched_getcpu definition under an ifdef. + +This regression happened occurred between v4.0 and v4.1 + +Signed-off-by: Srikar Dronamraju +Acked-by: Ingo Molnar +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Namhyung Kim +Cc: Vinson Lee +Fixes: e1e455f4f4d3 ("perf tools: Work around lack of sched_getcpu in glibc < 2.6") +Link: http://lkml.kernel.org/r/20150624111004.GA5220@linux.vnet.ibm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/cloexec.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c +index 85b523885f9d..2babddaa2481 100644 +--- a/tools/perf/util/cloexec.c ++++ b/tools/perf/util/cloexec.c +@@ -7,11 +7,15 @@ + + static unsigned long flag = PERF_FLAG_FD_CLOEXEC; + ++#ifdef __GLIBC_PREREQ ++#if !__GLIBC_PREREQ(2, 6) + int __weak sched_getcpu(void) + { + errno = ENOSYS; + return -1; + } ++#endif ++#endif + + static int perf_flag_probe(void) + { +-- +2.17.1 + diff --git a/queue-3.18/perf-fix-perf_event_ioc_period-deadlock.patch b/queue-3.18/perf-fix-perf_event_ioc_period-deadlock.patch new file mode 100644 index 00000000000..5db58592e03 --- /dev/null +++ b/queue-3.18/perf-fix-perf_event_ioc_period-deadlock.patch @@ -0,0 +1,57 @@ +From 75de191ea4012421df35a64d5869da3d9f0be152 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra +Date: Mon, 30 Nov 2015 12:56:15 +0100 +Subject: perf: Fix PERF_EVENT_IOC_PERIOD deadlock + +[ Upstream commit 642c2d671ceff40e9453203ea0c66e991e11e249 ] + +Dmitry reported a fairly silly recursive lock deadlock for +PERF_EVENT_IOC_PERIOD, fix this by explicitly doing the inactive part of +__perf_event_period() instead of calling that function. + +Reported-by: Dmitry Vyukov +Signed-off-by: Peter Zijlstra (Intel) +Cc: +Cc: Alexander Potapenko +Cc: Arnaldo Carvalho de Melo +Cc: Arnaldo Carvalho de Melo +Cc: Eric Dumazet +Cc: Jiri Olsa +Cc: Kostya Serebryany +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Sasha Levin +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Fixes: c7999c6f3fed ("perf: Fix PERF_EVENT_IOC_PERIOD migration race") +Link: http://lkml.kernel.org/r/20151130115615.GJ17308@twins.programming.kicks-ass.net +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 1f08f691de59..7b2f9d432fe7 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -3929,7 +3929,14 @@ retry: + goto retry; + } + +- __perf_event_period(&pe); ++ if (event->attr.freq) { ++ event->attr.sample_freq = value; ++ } else { ++ event->attr.sample_period = value; ++ event->hw.sample_period = value; ++ } ++ ++ local64_set(&event->hw.period_left, 0); + raw_spin_unlock_irq(&ctx->lock); + + return 0; +-- +2.17.1 + diff --git a/queue-3.18/perf-machine-fix-__machine__findnew_thread-error-pat.patch b/queue-3.18/perf-machine-fix-__machine__findnew_thread-error-pat.patch new file mode 100644 index 00000000000..a9e9be9371c --- /dev/null +++ b/queue-3.18/perf-machine-fix-__machine__findnew_thread-error-pat.patch @@ -0,0 +1,53 @@ +From 737967d63f3e5ee9c28a5f086a4916281173d58a Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Fri, 9 Jan 2015 09:38:12 +0900 +Subject: perf machine: Fix __machine__findnew_thread() error path + +[ Upstream commit 260d819e3abdbdaa2b88fb983d1314f1b263f9e2 ] + +When thread__init_map_groups() fails, a new thread should be removed +from the rbtree since it's gonna be freed. Also update last match cache +only if the function succeeded. + +Reported-by: David Ahern +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: David Ahern +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1420763892-15535-1-git-send-email-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/machine.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c +index 34fc7c8672e4..84238a10c34b 100644 +--- a/tools/perf/util/machine.c ++++ b/tools/perf/util/machine.c +@@ -389,7 +389,6 @@ static struct thread *__machine__findnew_thread(struct machine *machine, + if (th != NULL) { + rb_link_node(&th->rb_node, parent, p); + rb_insert_color(&th->rb_node, &machine->threads); +- machine->last_match = th; + + /* + * We have to initialize map_groups separately +@@ -400,9 +399,12 @@ static struct thread *__machine__findnew_thread(struct machine *machine, + * leader and that would screwed the rb tree. + */ + if (thread__init_map_groups(th, machine)) { ++ rb_erase(&th->rb_node, &machine->threads); + thread__delete(th); + return NULL; + } ++ ++ machine->last_match = th; + } + + return th; +-- +2.17.1 + diff --git a/queue-3.18/perf-rapl-fix-sysfs_show-initialization-for-rapl-pmu.patch b/queue-3.18/perf-rapl-fix-sysfs_show-initialization-for-rapl-pmu.patch new file mode 100644 index 00000000000..a3f86d493bb --- /dev/null +++ b/queue-3.18/perf-rapl-fix-sysfs_show-initialization-for-rapl-pmu.patch @@ -0,0 +1,112 @@ +From e64079c9102e6bdf575340a040a1f28563fecb32 Mon Sep 17 00:00:00 2001 +From: Stephane Eranian +Date: Tue, 13 Jan 2015 23:59:53 +0100 +Subject: perf/rapl: Fix sysfs_show() initialization for RAPL PMU + +[ Upstream commit 433678bdc6ed39f053c55da96b51de5bf0aeebb1 ] + +This patch fixes a problem with the initialization of the +sysfs_show() routine for the RAPL PMU. + +The current code was wrongly relying on the EVENT_ATTR_STR() +macro which uses the events_sysfs_show() function in the x86 +PMU code. That function itself was relying on the x86_pmu data +structure. Yet RAPL and the core PMU (x86_pmu) have nothing to +do with each other. They should therefore not interact with +each other. + +The x86_pmu structure is initialized at boot time based on +the host CPU model. When the host CPU is not supported, the +x86_pmu remains uninitialized and some of the callbacks it +contains are NULL. + +The false dependency with x86_pmu could potentially cause crashes +in case the x86_pmu is not initialized while the RAPL PMU is. This +may, for instance, be the case in virtualized environments. + +This patch fixes the problem by using a private sysfs_show() +routine for exporting the RAPL PMU events. + +Signed-off-by: Stephane Eranian +Signed-off-by: Peter Zijlstra (Intel) +Link: http://lkml.kernel.org/r/20150113225953.GA21525@thinkpad +Cc: vincent.weaver@maine.edu +Cc: jolsa@redhat.com +Cc: Arnaldo Carvalho de Melo +Cc: Linus Torvalds +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/perf_event_intel_rapl.c | 44 +++++++++++++++------ + 1 file changed, 32 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c +index 611d821eac1a..040915c87cb6 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_rapl.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c +@@ -103,6 +103,13 @@ static struct kobj_attribute format_attr_##_var = \ + + #define RAPL_CNTR_WIDTH 32 /* 32-bit rapl counters */ + ++#define RAPL_EVENT_ATTR_STR(_name, v, str) \ ++static struct perf_pmu_events_attr event_attr_##v = { \ ++ .attr = __ATTR(_name, 0444, rapl_sysfs_show, NULL), \ ++ .id = 0, \ ++ .event_str = str, \ ++}; ++ + struct rapl_pmu { + spinlock_t lock; + int hw_unit; /* 1/2^hw_unit Joule */ +@@ -383,23 +390,36 @@ static struct attribute_group rapl_pmu_attr_group = { + .attrs = rapl_pmu_attrs, + }; + +-EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01"); +-EVENT_ATTR_STR(energy-pkg , rapl_pkg, "event=0x02"); +-EVENT_ATTR_STR(energy-ram , rapl_ram, "event=0x03"); +-EVENT_ATTR_STR(energy-gpu , rapl_gpu, "event=0x04"); ++static ssize_t rapl_sysfs_show(struct device *dev, ++ struct device_attribute *attr, ++ char *page) ++{ ++ struct perf_pmu_events_attr *pmu_attr = \ ++ container_of(attr, struct perf_pmu_events_attr, attr); ++ ++ if (pmu_attr->event_str) ++ return sprintf(page, "%s", pmu_attr->event_str); ++ ++ return 0; ++} ++ ++RAPL_EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01"); ++RAPL_EVENT_ATTR_STR(energy-pkg , rapl_pkg, "event=0x02"); ++RAPL_EVENT_ATTR_STR(energy-ram , rapl_ram, "event=0x03"); ++RAPL_EVENT_ATTR_STR(energy-gpu , rapl_gpu, "event=0x04"); + +-EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules"); +-EVENT_ATTR_STR(energy-pkg.unit , rapl_pkg_unit, "Joules"); +-EVENT_ATTR_STR(energy-ram.unit , rapl_ram_unit, "Joules"); +-EVENT_ATTR_STR(energy-gpu.unit , rapl_gpu_unit, "Joules"); ++RAPL_EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules"); ++RAPL_EVENT_ATTR_STR(energy-pkg.unit , rapl_pkg_unit, "Joules"); ++RAPL_EVENT_ATTR_STR(energy-ram.unit , rapl_ram_unit, "Joules"); ++RAPL_EVENT_ATTR_STR(energy-gpu.unit , rapl_gpu_unit, "Joules"); + + /* + * we compute in 0.23 nJ increments regardless of MSR + */ +-EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10"); +-EVENT_ATTR_STR(energy-pkg.scale, rapl_pkg_scale, "2.3283064365386962890625e-10"); +-EVENT_ATTR_STR(energy-ram.scale, rapl_ram_scale, "2.3283064365386962890625e-10"); +-EVENT_ATTR_STR(energy-gpu.scale, rapl_gpu_scale, "2.3283064365386962890625e-10"); ++RAPL_EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10"); ++RAPL_EVENT_ATTR_STR(energy-pkg.scale, rapl_pkg_scale, "2.3283064365386962890625e-10"); ++RAPL_EVENT_ATTR_STR(energy-ram.scale, rapl_ram_scale, "2.3283064365386962890625e-10"); ++RAPL_EVENT_ATTR_STR(energy-gpu.scale, rapl_gpu_scale, "2.3283064365386962890625e-10"); + + static struct attribute *rapl_events_srv_attr[] = { + EVENT_PTR(rapl_cores), +-- +2.17.1 + diff --git a/queue-3.18/perf-ring_buffer-prevent-concurent-ring-buffer-acces.patch b/queue-3.18/perf-ring_buffer-prevent-concurent-ring-buffer-acces.patch new file mode 100644 index 00000000000..5ee7a0e86ee --- /dev/null +++ b/queue-3.18/perf-ring_buffer-prevent-concurent-ring-buffer-acces.patch @@ -0,0 +1,107 @@ +From 67d65cc5404503d8a976ae12795437f5c72f4be3 Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Sun, 23 Sep 2018 18:13:43 +0200 +Subject: perf/ring_buffer: Prevent concurent ring buffer access + +[ Upstream commit cd6fb677ce7e460c25bdd66f689734102ec7d642 ] + +Some of the scheduling tracepoints allow the perf_tp_event +code to write to ring buffer under different cpu than the +code is running on. + +This results in corrupted ring buffer data demonstrated in +following perf commands: + + # perf record -e 'sched:sched_switch,sched:sched_wakeup' perf bench sched messaging + # Running 'sched/messaging' benchmark: + # 20 sender and receiver processes per group + # 10 groups == 400 processes run + + Total time: 0.383 [sec] + [ perf record: Woken up 8 times to write data ] + 0x42b890 [0]: failed to process type: -1765585640 + [ perf record: Captured and wrote 4.825 MB perf.data (29669 samples) ] + + # perf report --stdio + 0x42b890 [0]: failed to process type: -1765585640 + +The reason for the corruption are some of the scheduling tracepoints, +that have __perf_task dfined and thus allow to store data to another +cpu ring buffer: + + sched_waking + sched_wakeup + sched_wakeup_new + sched_stat_wait + sched_stat_sleep + sched_stat_iowait + sched_stat_blocked + +The perf_tp_event function first store samples for current cpu +related events defined for tracepoint: + + hlist_for_each_entry_rcu(event, head, hlist_entry) + perf_swevent_event(event, count, &data, regs); + +And then iterates events of the 'task' and store the sample +for any task's event that passes tracepoint checks: + + ctx = rcu_dereference(task->perf_event_ctxp[perf_sw_context]); + + list_for_each_entry_rcu(event, &ctx->event_list, event_entry) { + if (event->attr.type != PERF_TYPE_TRACEPOINT) + continue; + if (event->attr.config != entry->type) + continue; + + perf_swevent_event(event, count, &data, regs); + } + +Above code can race with same code running on another cpu, +ending up with 2 cpus trying to store under the same ring +buffer, which is specifically not allowed. + +This patch prevents the problem, by allowing only events with the same +current cpu to receive the event. + +NOTE: this requires the use of (per-task-)per-cpu buffers for this +feature to work; perf-record does this. + +Signed-off-by: Jiri Olsa +[peterz: small edits to Changelog] +Signed-off-by: Peter Zijlstra (Intel) +Cc: Alexander Shishkin +Cc: Andrew Vagin +Cc: Arnaldo Carvalho de Melo +Cc: Arnaldo Carvalho de Melo +Cc: Jiri Olsa +Cc: Linus Torvalds +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Stephane Eranian +Cc: Thomas Gleixner +Cc: Vince Weaver +Fixes: e6dab5ffab59 ("perf/trace: Add ability to set a target task for events") +Link: http://lkml.kernel.org/r/20180923161343.GB15054@krava +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 1f08f691de59..98ec8186b7d6 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -6351,6 +6351,8 @@ void perf_tp_event(u64 addr, u64 count, void *record, int entry_size, + goto unlock; + + list_for_each_entry_rcu(event, &ctx->event_list, event_entry) { ++ if (event->cpu != smp_processor_id()) ++ continue; + if (event->attr.type != PERF_TYPE_TRACEPOINT) + continue; + if (event->attr.config != entry->type) +-- +2.17.1 + diff --git a/queue-3.18/perf-tools-avoid-build-splat-for-syscall-numbers-wit.patch b/queue-3.18/perf-tools-avoid-build-splat-for-syscall-numbers-wit.patch new file mode 100644 index 00000000000..6de236f8a97 --- /dev/null +++ b/queue-3.18/perf-tools-avoid-build-splat-for-syscall-numbers-wit.patch @@ -0,0 +1,107 @@ +From 30a34a14dcec55b7cbb9768ef4e2f45d29e54bef Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 13 Jan 2015 19:13:22 +0530 +Subject: perf tools: Avoid build splat for syscall numbers with uclibc + +[ Upstream commit ea1fe3a88763d4dfef7e2529ba606f96e8e6b271 ] + +This is due to duplicated unistd inclusion (via uClibc headers + kernel headers) +Also seen on ARM uClibc based tools + + ------- ARC build ---------->8------------- + + CC util/evlist.o +In file included from +~/arc/k.org/arch/arc/include/uapi/asm/unistd.h:25:0, + from util/../perf-sys.h:10, + from util/../perf.h:15, + from util/event.h:7, + from util/event.c:3: +~/arc/k.org/include/uapi/asm-generic/unistd.h:906:0: +warning: "__NR_fcntl64" redefined [enabled by default] + #define __NR_fcntl64 __NR3264_fcntl + ^ +In file included from +~/arc/gnu/INSTALL_1412-arc-2014.12-rc1/arc-snps-linux-uclibc/sysroot/usr/include/sys/syscall.h:24:0, + from util/../perf-sys.h:6, + ----------------->8------------------- + + ------- ARM build ---------->8------------- + + CC FPIC plugin_scsi.o +In file included from util/../perf-sys.h:9:0, + from util/../perf.h:15, + from util/cache.h:7, + from perf.c:12: +~/arc/k.org/arch/arm/include/uapi/asm/unistd.h:28:0: +warning: "__NR_restart_syscall" redefined [enabled by default] +In file included from +~/buildroot/host/usr/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/include/sys/syscall.h:25:0, + from util/../perf-sys.h:6, + from util/../perf.h:15, + from util/cache.h:7, + from perf.c:12: +~/buildroot/host/usr/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/include/bits/sysnum.h:17:0: +note: this is the location of the previous definition + ----------------->8------------------- + +Signed-off-by: Vineet Gupta +Cc: Alexey Brodkin +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1421156604-30603-4-git-send-email-vgupta@synopsys.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/sched-pipe.c | 2 +- + tools/perf/builtin-top.c | 1 - + tools/perf/perf-sys.h | 1 - + 3 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tools/perf/bench/sched-pipe.c b/tools/perf/bench/sched-pipe.c +index 07a8d7646a15..005cc283790c 100644 +--- a/tools/perf/bench/sched-pipe.c ++++ b/tools/perf/bench/sched-pipe.c +@@ -19,12 +19,12 @@ + #include + #include + #include +-#include + #include + #include + #include + #include + #include ++#include + + #include + +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index 8e37334db4fa..c5b9c3f01d85 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -66,7 +66,6 @@ + #include + #include + +-#include + #include + + static volatile int done; +diff --git a/tools/perf/perf-sys.h b/tools/perf/perf-sys.h +index a3b13d7dc1d4..6ef68165c9db 100644 +--- a/tools/perf/perf-sys.h ++++ b/tools/perf/perf-sys.h +@@ -6,7 +6,6 @@ + #include + #include + #include +-#include + + #if defined(__i386__) + #define mb() asm volatile("lock; addl $0,0(%%esp)" ::: "memory") +-- +2.17.1 + diff --git a/queue-3.18/perf-tools-fix-segfault-for-symbol-annotation-on-tui.patch b/queue-3.18/perf-tools-fix-segfault-for-symbol-annotation-on-tui.patch new file mode 100644 index 00000000000..c06228bd7b6 --- /dev/null +++ b/queue-3.18/perf-tools-fix-segfault-for-symbol-annotation-on-tui.patch @@ -0,0 +1,67 @@ +From 26afaf4b8e6d93a63c0905481a55685ab43b83c5 Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Wed, 14 Jan 2015 20:18:05 +0900 +Subject: perf tools: Fix segfault for symbol annotation on TUI + +[ Upstream commit 813ccd15452ed34e97aa526ffc70d6d8e6c466c5 ] + +Currently the symbol structure is allocated with symbol_conf.priv_size +to carry sideband information like annotation, map browser on TUI and +sort-by-name tree node. So retrieving these information from symbol +needs to care about the details of such placement. + +However the annotation code just assumes that the symbol is placed after +the struct annotation. But actually there's other info between them. +So accessing those struct will lead to an undefined behavior (usually a +crash) after they write their info to the same location. + +To reproduce the problem, please follow the steps below: + + 1. run perf report (TUI of course) with -v option + 2. open map browser (by pressing right arrow key for any entry) + 3. search any function (by pressing '/' key and input whatever..) + 4. return to the hist browser (by pressing 'q' or left arrow key) + 5. open annotation window for the same entry (by pressing 'a' key) + +Signed-off-by: Namhyung Kim +Cc: David Ahern +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Masami Hiramatsu +Cc: Peter Zijlstra +Link: http://lkml.kernel.org/r/1421234288-22758-1-git-send-email-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/annotate.h | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h +index 112d6e268150..dfa6c4c36b3e 100644 +--- a/tools/perf/util/annotate.h ++++ b/tools/perf/util/annotate.h +@@ -115,11 +115,6 @@ struct annotation { + struct annotated_source *src; + }; + +-struct sannotation { +- struct annotation annotation; +- struct symbol symbol; +-}; +- + static inline struct sym_hist *annotation__histogram(struct annotation *notes, int idx) + { + return (((void *)¬es->src->histograms) + +@@ -128,8 +123,7 @@ static inline struct sym_hist *annotation__histogram(struct annotation *notes, i + + static inline struct annotation *symbol__annotation(struct symbol *sym) + { +- struct sannotation *a = container_of(sym, struct sannotation, symbol); +- return &a->annotation; ++ return (void *)sym - symbol_conf.priv_size; + } + + int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx); +-- +2.17.1 + diff --git a/queue-3.18/perf-tools-fix-statfs.f_type-data-type-mismatch-buil.patch b/queue-3.18/perf-tools-fix-statfs.f_type-data-type-mismatch-buil.patch new file mode 100644 index 00000000000..a899f39fb5d --- /dev/null +++ b/queue-3.18/perf-tools-fix-statfs.f_type-data-type-mismatch-buil.patch @@ -0,0 +1,69 @@ +From bcb0e290c3953f8e9055e1c0323f8b4cae41d65e Mon Sep 17 00:00:00 2001 +From: Alexey Brodkin +Date: Sat, 10 Jan 2015 16:40:50 +0530 +Subject: perf tools: Fix statfs.f_type data type mismatch build error with + uclibc + +[ Upstream commit db1806edcfef007d9594435a331dcf7e7f1b8fac ] + +ARC Linux uses the no legacy syscalls abi and corresponding uClibc headers +statfs defines f_type to be U32 which causes perf build breakage + +http://git.uclibc.org/uClibc/tree/libc/sysdeps/linux/common-generic/bits/statfs.h + + ----------->8--------------- + CC fs/fs.o + fs/fs.c: In function 'fs__valid_mount': + fs/fs.c:82:24: error: comparison between signed and unsigned integer + expressions [-Werror=sign-compare] + else if (st_fs.f_type != magic) + ^ + cc1: all warnings being treated as errors + ----------->8--------------- + +Signed-off-by: Alexey Brodkin +Acked-by: Jiri Olsa +Cc: Borislav Petkov +Cc: Cody P Schafer +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Vineet Gupta +Link: http://lkml.kernel.org/r/1420888254-17504-2-git-send-email-vgupta@synopsys.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/api/fs/debugfs.c | 2 +- + tools/lib/api/fs/fs.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/lib/api/fs/debugfs.c b/tools/lib/api/fs/debugfs.c +index a74fba6d7743..86ea2d7b8845 100644 +--- a/tools/lib/api/fs/debugfs.c ++++ b/tools/lib/api/fs/debugfs.c +@@ -67,7 +67,7 @@ int debugfs_valid_mountpoint(const char *debugfs) + + if (statfs(debugfs, &st_fs) < 0) + return -ENOENT; +- else if (st_fs.f_type != (long) DEBUGFS_MAGIC) ++ else if ((long)st_fs.f_type != (long)DEBUGFS_MAGIC) + return -ENOENT; + + return 0; +diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c +index c1b49c36a951..4b2fa7bcbb84 100644 +--- a/tools/lib/api/fs/fs.c ++++ b/tools/lib/api/fs/fs.c +@@ -75,7 +75,7 @@ static int fs__valid_mount(const char *fs, long magic) + + if (statfs(fs, &st_fs) < 0) + return -ENOENT; +- else if (st_fs.f_type != magic) ++ else if ((long)st_fs.f_type != magic) + return -ENOENT; + + return 0; +-- +2.17.1 + diff --git a/queue-3.18/perf-x86-intel-fix-bug-for-cycles-p-and-cycles-pp-on.patch b/queue-3.18/perf-x86-intel-fix-bug-for-cycles-p-and-cycles-pp-on.patch new file mode 100644 index 00000000000..421865f627f --- /dev/null +++ b/queue-3.18/perf-x86-intel-fix-bug-for-cycles-p-and-cycles-pp-on.patch @@ -0,0 +1,50 @@ +From da5512efe9cd8eba2ec56e31be00e7793e885736 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Mon, 12 Jan 2015 17:42:21 +0000 +Subject: perf/x86/intel: Fix bug for "cycles:p" and "cycles:pp" on SLM + +[ Upstream commit 33636732dcd7cc738a5913bb730d663c6b03c8fb ] + +cycles:p and cycles:pp do not work on SLM since commit: + + 86a04461a99f ("perf/x86: Revamp PEBS event selection") + +UOPS_RETIRED.ALL is not a PEBS capable event, so it should not be used +to count cycle number. + +Actually SLM calls intel_pebs_aliases_core2() which uses INST_RETIRED.ANY_P +to count the number of cycles. It's a PEBS capable event. But inv and +cmask must be set to count cycles. + +Considering SLM allows all events as PEBS with no flags, only +INST_RETIRED.ANY_P, inv=1, cmask=16 needs to handled specially. + +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: http://lkml.kernel.org/r/1421084541-31639-1-git-send-email-kan.liang@intel.com +Cc: Arnaldo Carvalho de Melo +Cc: Linus Torvalds +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/perf_event_intel_ds.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c +index 46211bcc813e..423cbd9bea3e 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c ++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c +@@ -568,8 +568,8 @@ struct event_constraint intel_atom_pebs_event_constraints[] = { + }; + + struct event_constraint intel_slm_pebs_event_constraints[] = { +- /* UOPS_RETIRED.ALL, inv=1, cmask=16 (cycles:p). */ +- INTEL_FLAGS_EVENT_CONSTRAINT(0x108001c2, 0xf), ++ /* INST_RETIRED.ANY_P, inv=1, cmask=16 (cycles:p). */ ++ INTEL_FLAGS_EVENT_CONSTRAINT(0x108000c0, 0x1), + /* Allow all events as PEBS with no flags */ + INTEL_ALL_EVENT_CONSTRAINT(0, 0x1), + EVENT_CONSTRAINT_END +-- +2.17.1 + diff --git a/queue-3.18/phy-phy-ti-pipe3-fix-inconsistent-enumeration-of-pci.patch b/queue-3.18/phy-phy-ti-pipe3-fix-inconsistent-enumeration-of-pci.patch new file mode 100644 index 00000000000..95702979750 --- /dev/null +++ b/queue-3.18/phy-phy-ti-pipe3-fix-inconsistent-enumeration-of-pci.patch @@ -0,0 +1,156 @@ +From d971b73a9325d5cde15ea419b1bea64743de4c30 Mon Sep 17 00:00:00 2001 +From: Vignesh R +Date: Tue, 16 Dec 2014 14:52:50 +0530 +Subject: phy: phy-ti-pipe3: fix inconsistent enumeration of PCIe gen2 cards + +[ Upstream commit 0bc09f9cdc589e0b54724096138996a00b19babb ] + +Prior to DRA74x silicon rev 1.1, pcie_pcs register bits 8-15 and bits 16-23 +were used to configure RC delay count for phy1 and phy2 respectively. +phyid was used as index to distinguish the phys and to configure the delay +values appropriately. + +As of DRA74x silicon rev 1.1, pcie_pcs register definition has changed. +Bits 16-23 are used to configure delay values for *both* phy1 and phy2. + +Hence phyid is no longer required. + +So, drop id field from ti_pipe3 structure and its subsequent references +for configuring pcie_pcs register. + +Also, pcie_pcs register now needs to be configured with delay value of 0x96 +at bit positions 16-23. See register description of CTRL_CORE_PCIE_PCS in +ARM572x TRM, SPRUHZ6, October 2014, section 18.5.2.2, table 18-1804. + +This is needed to ensure Gen2 cards are enumerated consistently. + +DRA72x silicon behaves same way as DRA74x rev 1.1 as far as this functionality +is considered. + +Test results on DRA74x and DRA72x EVMs: + +Before patch +------------ +DRA74x ES 1.0: Gen1 cards work, Gen2 cards do not work (expected result due to +silicon errata) +DRA74x ES 1.1: Gen1 cards work, Gen2 cards do not work sometimes due to incorrect +programming of register + +DRA72x: Gen1 cards work, Gen2 cards do not work sometimes due to incorrect +programming of register + +After patch +----------- +DRA74x ES 1.0: Gen1 cards work, Gen2 cards do not work (expected result due to +silicon errata) +DRA74x ES 1.1: Gen1 cards work, Gen2 cards work consistently. + +DRA72x: Gen1 and Gen2 cards enumerate consistently. + +Signed-off-by: Vignesh R +Signed-off-by: Kishon Vijay Abraham I + +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-omap-control.c | 7 +++---- + drivers/phy/phy-ti-pipe3.c | 10 ++++++---- + include/linux/phy/omap_control_phy.h | 6 +++--- + 3 files changed, 12 insertions(+), 11 deletions(-) + +diff --git a/drivers/phy/phy-omap-control.c b/drivers/phy/phy-omap-control.c +index c96e8183a8ff..efe724f97e02 100644 +--- a/drivers/phy/phy-omap-control.c ++++ b/drivers/phy/phy-omap-control.c +@@ -29,10 +29,9 @@ + /** + * omap_control_pcie_pcs - set the PCS delay count + * @dev: the control module device +- * @id: index of the pcie PHY (should be 1 or 2) + * @delay: 8 bit delay value + */ +-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay) ++void omap_control_pcie_pcs(struct device *dev, u8 delay) + { + u32 val; + struct omap_control_phy *control_phy; +@@ -55,8 +54,8 @@ void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay) + + val = readl(control_phy->pcie_pcs); + val &= ~(OMAP_CTRL_PCIE_PCS_MASK << +- (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT)); +- val |= delay << (id * OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT); ++ OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT); ++ val |= (delay << OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT); + writel(val, control_phy->pcie_pcs); + } + EXPORT_SYMBOL_GPL(omap_control_pcie_pcs); +diff --git a/drivers/phy/phy-ti-pipe3.c b/drivers/phy/phy-ti-pipe3.c +index ab1e22d9a1e8..fd92fc64f5da 100644 +--- a/drivers/phy/phy-ti-pipe3.c ++++ b/drivers/phy/phy-ti-pipe3.c +@@ -82,7 +82,6 @@ struct ti_pipe3 { + struct clk *refclk; + struct clk *div_clk; + struct pipe3_dpll_map *dpll_map; +- u8 id; + }; + + static struct pipe3_dpll_map dpll_map_usb[] = { +@@ -217,8 +216,13 @@ static int ti_pipe3_init(struct phy *x) + u32 val; + int ret = 0; + ++ /* ++ * Set pcie_pcs register to 0x96 for proper functioning of phy ++ * as recommended in AM572x TRM SPRUHZ6, section 18.5.2.2, table ++ * 18-1804. ++ */ + if (of_device_is_compatible(phy->dev->of_node, "ti,phy-pipe3-pcie")) { +- omap_control_pcie_pcs(phy->control_dev, phy->id, 0xF1); ++ omap_control_pcie_pcs(phy->control_dev, 0x96); + return 0; + } + +@@ -347,8 +351,6 @@ static int ti_pipe3_probe(struct platform_device *pdev) + } + + if (of_device_is_compatible(node, "ti,phy-pipe3-pcie")) { +- if (of_property_read_u8(node, "id", &phy->id) < 0) +- phy->id = 1; + + clk = devm_clk_get(phy->dev, "dpll_ref"); + if (IS_ERR(clk)) { +diff --git a/include/linux/phy/omap_control_phy.h b/include/linux/phy/omap_control_phy.h +index e9e6cfbfbb58..eb7d4a135a9e 100644 +--- a/include/linux/phy/omap_control_phy.h ++++ b/include/linux/phy/omap_control_phy.h +@@ -66,7 +66,7 @@ enum omap_control_usb_mode { + #define OMAP_CTRL_PIPE3_PHY_TX_RX_POWEROFF 0x0 + + #define OMAP_CTRL_PCIE_PCS_MASK 0xff +-#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT 0x8 ++#define OMAP_CTRL_PCIE_PCS_DELAY_COUNT_SHIFT 16 + + #define OMAP_CTRL_USB2_PHY_PD BIT(28) + +@@ -79,7 +79,7 @@ enum omap_control_usb_mode { + void omap_control_phy_power(struct device *dev, int on); + void omap_control_usb_set_mode(struct device *dev, + enum omap_control_usb_mode mode); +-void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay); ++void omap_control_pcie_pcs(struct device *dev, u8 delay); + #else + + static inline void omap_control_phy_power(struct device *dev, int on) +@@ -91,7 +91,7 @@ static inline void omap_control_usb_set_mode(struct device *dev, + { + } + +-static inline void omap_control_pcie_pcs(struct device *dev, u8 id, u8 delay) ++static inline void omap_control_pcie_pcs(struct device *dev, u8 delay) + { + } + #endif +-- +2.17.1 + diff --git a/queue-3.18/phy-sun4i-usb-change-disconnect-threshold-value-for-.patch b/queue-3.18/phy-sun4i-usb-change-disconnect-threshold-value-for-.patch new file mode 100644 index 00000000000..d340997e953 --- /dev/null +++ b/queue-3.18/phy-sun4i-usb-change-disconnect-threshold-value-for-.patch @@ -0,0 +1,37 @@ +From 83b39ad7a630c1efb488e5a60cf4f250a3b3fad6 Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Wed, 17 Dec 2014 15:39:37 +0100 +Subject: phy-sun4i-usb: Change disconnect threshold value for sun6i + +[ Upstream commit 372400344afb60e275a271f3f5ccce17af0e45cb ] + +The allwinner SDK uses a value of 3 for the disconnect threshold setting on +sun6i, do the same in the kernel. + +In my previous experience with sun5i problems getting the threshold right +is important to avoid usb2 devices being unplugged sometimes going unnoticed. + +Signed-off-by: Hans de Goede +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-sun4i-usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/phy/phy-sun4i-usb.c b/drivers/phy/phy-sun4i-usb.c +index 0baf5efc8a40..1a2b045d6a67 100644 +--- a/drivers/phy/phy-sun4i-usb.c ++++ b/drivers/phy/phy-sun4i-usb.c +@@ -240,7 +240,8 @@ static int sun4i_usb_phy_probe(struct platform_device *pdev) + else + data->num_phys = 3; + +- if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy")) ++ if (of_device_is_compatible(np, "allwinner,sun4i-a10-usb-phy") || ++ of_device_is_compatible(np, "allwinner,sun6i-a31-usb-phy")) + data->disc_thresh = 3; + else + data->disc_thresh = 2; +-- +2.17.1 + diff --git a/queue-3.18/pinctrl-at91-fix-null-pointer-dereference.patch b/queue-3.18/pinctrl-at91-fix-null-pointer-dereference.patch new file mode 100644 index 00000000000..28bca12b1cc --- /dev/null +++ b/queue-3.18/pinctrl-at91-fix-null-pointer-dereference.patch @@ -0,0 +1,119 @@ +From 9cbb2e530ab2a49a3877d905709f70655867009e Mon Sep 17 00:00:00 2001 +From: David Dueck +Date: Tue, 28 Jul 2015 09:48:16 +0200 +Subject: pinctrl: at91: fix null pointer dereference + +[ Upstream commit 1ab36387ea4face01aac3560b396b1e2ce07c4ff ] + +Not all gpio banks are necessarily enabled, in the current code this can +lead to null pointer dereferences. + +[ 51.130000] Unable to handle kernel NULL pointer dereference at virtual address 00000058 +[ 51.130000] pgd = dee04000 +[ 51.130000] [00000058] *pgd=3f66d831, *pte=00000000, *ppte=00000000 +[ 51.140000] Internal error: Oops: 17 [#1] ARM +[ 51.140000] Modules linked in: +[ 51.140000] CPU: 0 PID: 1664 Comm: cat Not tainted 4.1.1+ #6 +[ 51.140000] Hardware name: Atmel SAMA5 +[ 51.140000] task: df6dd880 ti: dec60000 task.ti: dec60000 +[ 51.140000] PC is at at91_pinconf_get+0xb4/0x200 +[ 51.140000] LR is at at91_pinconf_get+0xb4/0x200 +[ 51.140000] pc : [] lr : [] psr: 600f0013 +sp : dec61e48 ip : 600f0013 fp : df522538 +[ 51.140000] r10: df52250c r9 : 00000058 r8 : 00000068 +[ 51.140000] r7 : 00000000 r6 : df53c910 r5 : 00000000 r4 : dec61e7c +[ 51.140000] r3 : 00000000 r2 : c06746d4 r1 : 00000000 r0 : 00000003 +[ 51.140000] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 51.140000] Control: 10c53c7d Table: 3ee04059 DAC: 00000015 +[ 51.140000] Process cat (pid: 1664, stack limit = 0xdec60208) +[ 51.140000] Stack: (0xdec61e48 to 0xdec62000) +[ 51.140000] 1e40: 00000358 00000000 df522500 ded15f80 c05a9d08 ded15f80 +[ 51.140000] 1e60: 0000048c 00000061 df522500 ded15f80 c05a9d08 c01e7304 ded15f80 00000000 +[ 51.140000] 1e80: c01e6008 00000060 0000048c c01e6034 c01e5f6c ded15f80 dec61ec0 00000000 +[ 51.140000] 1ea0: 00020000 ded6f280 dec61f80 00000001 00000001 c00ae0b8 b6e80000 ded15fb0 +[ 51.140000] 1ec0: 00000000 00000000 df4bc974 00000055 00000800 ded6f280 b6e80000 ded6f280 +[ 51.140000] 1ee0: ded6f280 00020000 b6e80000 00000000 00020000 c0090dec c0671e1c dec61fb0 +[ 51.140000] 1f00: b6f8b510 00000001 00004201 c000924c 00000000 00000003 00000003 00000000 +[ 51.140000] 1f20: df4bc940 00022000 00000022 c066e188 b6e7f000 c00836f4 000b6e7f ded6f280 +[ 51.140000] 1f40: ded6f280 b6e80000 dec61f80 ded6f280 00020000 c0091508 00000000 00000003 +[ 51.140000] 1f60: 00022000 00000000 00000000 ded6f280 ded6f280 00020000 b6e80000 c0091d9c +[ 51.140000] 1f80: 00000000 00000000 ffffffff 00020000 00020000 b6e80000 00000003 c000f124 +[ 51.140000] 1fa0: dec60000 c000efa0 00020000 00020000 00000003 b6e80000 00020000 000271c4 +[ 51.140000] 1fc0: 00020000 00020000 b6e80000 00000003 7fffe000 00000000 00000000 00020000 +[ 51.140000] 1fe0: 00000000 bef50b64 00013835 b6f29c76 400f0030 00000003 00000000 00000000 +[ 51.140000] [] (at91_pinconf_get) from [] (at91_pinconf_dbg_show+0x18/0x2c0) +[ 51.140000] [] (at91_pinconf_dbg_show) from [] (pinconf_pins_show+0xc8/0xf8) +[ 51.140000] [] (pinconf_pins_show) from [] (seq_read+0x1a0/0x464) +[ 51.140000] [] (seq_read) from [] (__vfs_read+0x20/0xd0) +[ 51.140000] [] (__vfs_read) from [] (vfs_read+0x7c/0x108) +[ 51.140000] [] (vfs_read) from [] (SyS_read+0x40/0x94) +[ 51.140000] [] (SyS_read) from [] (ret_fast_syscall+0x0/0x3c) +[ 51.140000] Code: eb010ec2 e30a0d08 e34c005a eb0ae5a7 (e5993000) +[ 51.150000] ---[ end trace fb3c370da3ea4794 ]--- + +Fixes: a0b957f306fa ("pinctrl: at91: allow to have disabled gpio bank") +Cc: stable@vger.kernel.org # 3.18 +Signed-off-by: David Dueck +Acked-by: Ludovic Desroches +Acked-by: Alexandre Belloni +Acked-by: Nicolas Ferre +Cc: Boris Brezillon +Cc: Jean-Christophe PLAGNIOL-VILLARD +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-at91.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-at91.c b/drivers/pinctrl/pinctrl-at91.c +index d6380c187db6..ceebe2e3882f 100644 +--- a/drivers/pinctrl/pinctrl-at91.c ++++ b/drivers/pinctrl/pinctrl-at91.c +@@ -322,6 +322,9 @@ static const struct pinctrl_ops at91_pctrl_ops = { + static void __iomem *pin_to_controller(struct at91_pinctrl *info, + unsigned int bank) + { ++ if (!gpio_chips[bank]) ++ return NULL; ++ + return gpio_chips[bank]->regbase; + } + +@@ -731,6 +734,10 @@ static int at91_pmx_set(struct pinctrl_dev *pctldev, unsigned selector, + pin = &pins_conf[i]; + at91_pin_dbg(info->dev, pin); + pio = pin_to_controller(info, pin->bank); ++ ++ if (!pio) ++ continue; ++ + mask = pin_to_mask(pin->pin); + at91_mux_disable_interrupt(pio, mask); + switch (pin->mux) { +@@ -850,6 +857,10 @@ static int at91_pinconf_get(struct pinctrl_dev *pctldev, + *config = 0; + dev_dbg(info->dev, "%s:%d, pin_id=%d", __func__, __LINE__, pin_id); + pio = pin_to_controller(info, pin_to_bank(pin_id)); ++ ++ if (!pio) ++ return -EINVAL; ++ + pin = pin_id % MAX_NB_GPIO_PER_BANK; + + if (at91_mux_get_multidrive(pio, pin)) +@@ -891,6 +902,10 @@ static int at91_pinconf_set(struct pinctrl_dev *pctldev, + "%s:%d, pin_id=%d, config=0x%lx", + __func__, __LINE__, pin_id, config); + pio = pin_to_controller(info, pin_to_bank(pin_id)); ++ ++ if (!pio) ++ return -EINVAL; ++ + pin = pin_id % MAX_NB_GPIO_PER_BANK; + mask = pin_to_mask(pin); + +-- +2.17.1 + diff --git a/queue-3.18/pinctrl-imx25-ensure-that-a-pin-with-id-i-is-at-posi.patch b/queue-3.18/pinctrl-imx25-ensure-that-a-pin-with-id-i-is-at-posi.patch new file mode 100644 index 00000000000..e60e0372ca2 --- /dev/null +++ b/queue-3.18/pinctrl-imx25-ensure-that-a-pin-with-id-i-is-at-posi.patch @@ -0,0 +1,72 @@ +From 1f1ba05b81c10450308ab23c046894c4b3d363e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig?= +Date: Wed, 23 Sep 2015 16:35:09 +0200 +Subject: pinctrl: imx25: ensure that a pin with id i is at position i in the + info array +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 9911a2d5e9d14e39692b751929a92cb5a1d9d0e0 ] + +The code in pinctrl-imx.c only works correctly if in the +imx_pinctrl_soc_info passed to imx_pinctrl_probe we have: + + info->pins[i].number = i + conf_reg(info->pins[i]) = 4 * i + +(which conf_reg(pin) being the offset of the pin's configuration +register). + +When the imx25 specific part was introduced in b4a87c9b966f ("pinctrl: +pinctrl-imx: add imx25 pinctrl driver") we had: + + info->pins[i].number = i + 1 + conf_reg(info->pins[i]) = 4 * i + +. Commit 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins") tried +to fix that but made the situation: + + info->pins[i-1].number = i + conf_reg(info->pins[i-1]) = 4 * i + +which is hardly better but fixed the error seen back then. + +So insert another reserved entry in the array to finally yield: + + info->pins[i].number = i + conf_reg(info->pins[i]) = 4 * i + +Fixes: 34027ca2bbc6 ("pinctrl: imx25: fix numbering for pins") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/freescale/pinctrl-imx25.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/freescale/pinctrl-imx25.c b/drivers/pinctrl/freescale/pinctrl-imx25.c +index b5fabf684632..23e480b5da3e 100644 +--- a/drivers/pinctrl/freescale/pinctrl-imx25.c ++++ b/drivers/pinctrl/freescale/pinctrl-imx25.c +@@ -26,7 +26,8 @@ + #include "pinctrl-imx.h" + + enum imx25_pads { +- MX25_PAD_RESERVE0 = 1, ++ MX25_PAD_RESERVE0 = 0, ++ MX25_PAD_RESERVE1 = 1, + MX25_PAD_A10 = 2, + MX25_PAD_A13 = 3, + MX25_PAD_A14 = 4, +@@ -169,6 +170,7 @@ enum imx25_pads { + /* Pad names for the pinmux subsystem */ + static const struct pinctrl_pin_desc imx25_pinctrl_pads[] = { + IMX_PINCTRL_PIN(MX25_PAD_RESERVE0), ++ IMX_PINCTRL_PIN(MX25_PAD_RESERVE1), + IMX_PINCTRL_PIN(MX25_PAD_A10), + IMX_PINCTRL_PIN(MX25_PAD_A13), + IMX_PINCTRL_PIN(MX25_PAD_A14), +-- +2.17.1 + diff --git a/queue-3.18/quota-fix-maximum-quota-limit-settings.patch b/queue-3.18/quota-fix-maximum-quota-limit-settings.patch new file mode 100644 index 00000000000..33a1481f410 --- /dev/null +++ b/queue-3.18/quota-fix-maximum-quota-limit-settings.patch @@ -0,0 +1,57 @@ +From 2dd8873ee38cbccf053e1e4427a2bf3dd89089dd Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Wed, 4 Mar 2015 14:42:02 +0100 +Subject: quota: Fix maximum quota limit settings + +[ Upstream commit 7e08da50cf706151f324349f9235ebd311226997 ] + +Currently quota format that supports 64-bit usage sets maximum quota +limit as 2^64-1. However quota core code uses signed numbers to track +usage and even limits themselves are stored in long long. Checking of +maximum allowable limits worked by luck until commit 14bf61ffe6ac +(quota: Switch ->get_dqblk() and ->set_dqblk() to use bytes as space +units) because variable we compared with was unsigned. After that commit +the type we compared against changed to signed and thus checks for +maximum limits with the newest VFS quota format started to refuse any +non-negative value. Later the problem was inadvertedly fixed by commit +b10a08194c2b (quota: Store maximum space limit in bytes) because we +started to compare against unsigned type as well. + +Fix possible future problems of this kind by setting maximum limits to +2^63-1 to avoid overflow issues. + +Reported-by: Carlos Carvalho +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/quota_v2.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c +index d1a8054bba9a..5d9fc7918e24 100644 +--- a/fs/quota/quota_v2.c ++++ b/fs/quota/quota_v2.c +@@ -117,12 +117,16 @@ static int v2_read_file_info(struct super_block *sb, int type) + qinfo = info->dqi_priv; + if (version == 0) { + /* limits are stored as unsigned 32-bit data */ +- info->dqi_max_spc_limit = 0xffffffffULL << QUOTABLOCK_BITS; ++ info->dqi_max_spc_limit = 0xffffffffLL << QUOTABLOCK_BITS; + info->dqi_max_ino_limit = 0xffffffff; + } else { +- /* used space is stored as unsigned 64-bit value in bytes */ +- info->dqi_max_spc_limit = 0xffffffffffffffffULL; /* 2^64-1 */ +- info->dqi_max_ino_limit = 0xffffffffffffffffULL; ++ /* ++ * Used space is stored as unsigned 64-bit value in bytes but ++ * quota core supports only signed 64-bit values so use that ++ * as a limit ++ */ ++ info->dqi_max_spc_limit = 0x7fffffffffffffffLL; /* 2^63-1 */ ++ info->dqi_max_ino_limit = 0x7fffffffffffffffLL; + } + info->dqi_bgrace = le32_to_cpu(dinfo.dqi_bgrace); + info->dqi_igrace = le32_to_cpu(dinfo.dqi_igrace); +-- +2.17.1 + diff --git a/queue-3.18/rcu-clear-need_qs-flag-to-prevent-splat.patch b/queue-3.18/rcu-clear-need_qs-flag-to-prevent-splat.patch new file mode 100644 index 00000000000..4418c53e706 --- /dev/null +++ b/queue-3.18/rcu-clear-need_qs-flag-to-prevent-splat.patch @@ -0,0 +1,90 @@ +From 062f0dfdcc2a8ee448c41fefbc32a877df1e2a5a Mon Sep 17 00:00:00 2001 +From: "Paul E. McKenney" +Date: Thu, 22 Jan 2015 22:47:14 -0800 +Subject: rcu: Clear need_qs flag to prevent splat + +[ Upstream commit c0135d07b013fa8f7ba9ec91b4369c372e6a28cb ] + +If the scheduling-clock interrupt sets the current tasks need_qs flag, +but if the current CPU passes through a quiescent state in the meantime, +then rcu_preempt_qs() will fail to clear the need_qs flag, which can fool +RCU into thinking that additional rcu_read_unlock_special() processing +is needed. This commit therefore clears the need_qs flag before checking +for additional processing. + +For this problem to occur, we need rcu_preempt_data.passed_quiesce equal +to true and current->rcu_read_unlock_special.b.need_qs also equal to true. +This condition can occur as follows: + +1. CPU 0 is aware of the current preemptible RCU grace period, + but has not yet passed through a quiescent state. Among other + things, this means that rcu_preempt_data.passed_quiesce is false. + +2. Task A running on CPU 0 enters a preemptible RCU read-side + critical section. + +3. CPU 0 takes a scheduling-clock interrupt, which notices the + RCU read-side critical section and the need for a quiescent state, + and thus sets current->rcu_read_unlock_special.b.need_qs to true. + +4. Task A is preempted, enters the scheduler, eventually invoking + rcu_preempt_note_context_switch() which in turn invokes + rcu_preempt_qs(). + + Because rcu_preempt_data.passed_quiesce is false, + control enters the body of the "if" statement, which sets + rcu_preempt_data.passed_quiesce to true. + +5. At this point, CPU 0 takes an interrupt. The interrupt + handler contains an RCU read-side critical section, and + the rcu_read_unlock() notes that current->rcu_read_unlock_special + is nonzero, and thus invokes rcu_read_unlock_special(). + +6. Once in rcu_read_unlock_special(), the fact that + current->rcu_read_unlock_special.b.need_qs is true becomes + apparent, so rcu_read_unlock_special() invokes rcu_preempt_qs(). + Recursively, given that we interrupted out of that same + function in the preceding step. + +7. Because rcu_preempt_data.passed_quiesce is now true, + rcu_preempt_qs() does nothing, and simply returns. + +8. Upon return to rcu_read_unlock_special(), it is noted that + current->rcu_read_unlock_special is still nonzero (because + the interrupted rcu_preempt_qs() had not yet gotten around + to clearing current->rcu_read_unlock_special.b.need_qs). + +9. Execution proceeds to the WARN_ON_ONCE(), which notes that + we are in an interrupt handler and thus duly splats. + +The solution, as noted above, is to make rcu_read_unlock_special() +clear out current->rcu_read_unlock_special.b.need_qs after calling +rcu_preempt_qs(). The interrupted rcu_preempt_qs() will clear it again, +but this is harmless. The worst that happens is that we clobber another +attempt to set this field, but this is not a problem because we just +got done reporting a quiescent state. + +Reported-by: Sasha Levin +Signed-off-by: Paul E. McKenney +[ paulmck: Fix embarrassing build bug noted by Sasha Levin. ] +Tested-by: Sasha Levin +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree_plugin.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index c1d7f27bd38f..c038831bfa57 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -328,6 +328,7 @@ void rcu_read_unlock_special(struct task_struct *t) + special = t->rcu_read_unlock_special; + if (special.b.need_qs) { + rcu_preempt_qs(); ++ t->rcu_read_unlock_special.b.need_qs = false; + if (!t->rcu_read_unlock_special.s) { + local_irq_restore(flags); + return; +-- +2.17.1 + diff --git a/queue-3.18/revert-drm-i915-fix-mutex-owner-inspection-race-unde.patch b/queue-3.18/revert-drm-i915-fix-mutex-owner-inspection-race-unde.patch new file mode 100644 index 00000000000..d36f32f3ce2 --- /dev/null +++ b/queue-3.18/revert-drm-i915-fix-mutex-owner-inspection-race-unde.patch @@ -0,0 +1,46 @@ +From 453596924d406799c74c9f74fd9654086b7547a6 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 26 Jan 2015 04:43:22 -0800 +Subject: Revert "drm/i915: Fix mutex->owner inspection race under + DEBUG_MUTEXES" + +[ Upstream commit a50940510e94f5fb65ffd79877a60592d85598a9 ] + +The core fix was applied in + +commit a63b03e2d2477586440741677ecac45bcf28d7b1 +Author: Chris Wilson +Date: Tue Jan 6 10:29:35 2015 +0000 + + mutex: Always clear owner field upon mutex_unlock() + +(note the absence of stable@ tag) + +so we can now revert our band-aid commit 226e5ae9e5f910 for -next. + +Signed-off-by: Chris Wilson +Cc: Daniel Vetter +Cc: Jani Nikula +Signed-off-by: Rodrigo Vivi +Signed-off-by: Daniel Vetter +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_gem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index d88dbedeaa77..d0f0a7943d88 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -5144,7 +5144,7 @@ static bool mutex_is_locked_by(struct mutex *mutex, struct task_struct *task) + if (!mutex_is_locked(mutex)) + return false; + +-#if defined(CONFIG_SMP) && !defined(CONFIG_DEBUG_MUTEXES) ++#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_MUTEXES) + return mutex->owner == task; + #else + /* Since UP may be pre-empted, we cannot assume that we own the lock */ +-- +2.17.1 + diff --git a/queue-3.18/revert-scsi-fix-null-pointer-dereference-in-runtime-.patch b/queue-3.18/revert-scsi-fix-null-pointer-dereference-in-runtime-.patch new file mode 100644 index 00000000000..5d0ad8c6929 --- /dev/null +++ b/queue-3.18/revert-scsi-fix-null-pointer-dereference-in-runtime-.patch @@ -0,0 +1,78 @@ +From 291fbfe5f2e069765f6526b515001c7344047304 Mon Sep 17 00:00:00 2001 +From: Ken Xue +Date: Tue, 1 Dec 2015 14:45:23 +0800 +Subject: Revert "SCSI: Fix NULL pointer dereference in runtime PM" + +[ Upstream commit 1c69d3b6eb73e466ecbb8edaf1bc7fd585b288da ] + +This reverts commit 49718f0fb8c9 ("SCSI: Fix NULL pointer dereference in +runtime PM") + +The old commit may lead to a issue that blk_{pre|post}_runtime_suspend and +blk_{pre|post}_runtime_resume may not be called in pairs. + +Take sr device as example, when sr device goes to runtime suspend, +blk_{pre|post}_runtime_suspend will be called since sr device defined +pm->runtime_suspend. But blk_{pre|post}_runtime_resume will not be called +since sr device doesn't have pm->runtime_resume. so, sr device can not +resume correctly anymore. + +More discussion can be found from below link. +http://marc.info/?l=linux-scsi&m=144163730531875&w=2 + +Signed-off-by: Ken Xue +Acked-by: Alan Stern +Cc: Xiangliang Yu +Cc: James E.J. Bottomley +Cc: Jens Axboe +Cc: Michael Terry +Cc: stable@vger.kernel.org +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_pm.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/scsi/scsi_pm.c b/drivers/scsi/scsi_pm.c +index a2dcf6a54ec6..75320dad9677 100644 +--- a/drivers/scsi/scsi_pm.c ++++ b/drivers/scsi/scsi_pm.c +@@ -221,13 +221,13 @@ static int sdev_runtime_suspend(struct device *dev) + struct scsi_device *sdev = to_scsi_device(dev); + int err = 0; + +- if (pm && pm->runtime_suspend) { +- err = blk_pre_runtime_suspend(sdev->request_queue); +- if (err) +- return err; ++ err = blk_pre_runtime_suspend(sdev->request_queue); ++ if (err) ++ return err; ++ if (pm && pm->runtime_suspend) + err = pm->runtime_suspend(dev); +- blk_post_runtime_suspend(sdev->request_queue, err); +- } ++ blk_post_runtime_suspend(sdev->request_queue, err); ++ + return err; + } + +@@ -250,11 +250,11 @@ static int sdev_runtime_resume(struct device *dev) + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + int err = 0; + +- if (pm && pm->runtime_resume) { +- blk_pre_runtime_resume(sdev->request_queue); ++ blk_pre_runtime_resume(sdev->request_queue); ++ if (pm && pm->runtime_resume) + err = pm->runtime_resume(dev); +- blk_post_runtime_resume(sdev->request_queue, err); +- } ++ blk_post_runtime_resume(sdev->request_queue, err); ++ + return err; + } + +-- +2.17.1 + diff --git a/queue-3.18/revert-tty-fix-pty-master-poll-after-slave-closes-v2.patch b/queue-3.18/revert-tty-fix-pty-master-poll-after-slave-closes-v2.patch new file mode 100644 index 00000000000..ae46c85d629 --- /dev/null +++ b/queue-3.18/revert-tty-fix-pty-master-poll-after-slave-closes-v2.patch @@ -0,0 +1,50 @@ +From 381e5448297ddfad20ccff098fc01a41ec9ae1d0 Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Tue, 30 Dec 2014 07:17:09 -0500 +Subject: Revert "tty: Fix pty master poll() after slave closes v2" + +[ Upstream commit 2ce3c10c0c3e0d418c1a7a4c838319ba42c75388 ] + +This reverts commit c4dc304677e8d566572c4738d95c48be150c6606. +This fix is superseded by commit 52bce7f8d4fc633c9a9d0646eef58ba6ae9a3b73, +'pty, n_tty: Simplify input processing on final close'. + +The final close now waits for input processing to complete before +destroying the pty, so poll() does not need to special case this +condition. + +Cc: Francesco Ruggeri +Signed-off-by: Peter Hurley +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_tty.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 6acdd553b707..0ed99ad74bee 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -2472,17 +2472,12 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file, + + poll_wait(file, &tty->read_wait, wait); + poll_wait(file, &tty->write_wait, wait); +- if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) +- mask |= POLLHUP; + if (input_available_p(tty, 1)) + mask |= POLLIN | POLLRDNORM; +- else if (mask & POLLHUP) { +- tty_flush_to_ldisc(tty); +- if (input_available_p(tty, 1)) +- mask |= POLLIN | POLLRDNORM; +- } + if (tty->packet && tty->link->ctrl_status) + mask |= POLLPRI | POLLIN | POLLRDNORM; ++ if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) ++ mask |= POLLHUP; + if (tty_hung_up_p(file)) + mask |= POLLHUP; + if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) { +-- +2.17.1 + diff --git a/queue-3.18/rtlwifi-rtl8821ae-fix-lockups-on-boot.patch b/queue-3.18/rtlwifi-rtl8821ae-fix-lockups-on-boot.patch new file mode 100644 index 00000000000..ded6e112137 --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8821ae-fix-lockups-on-boot.patch @@ -0,0 +1,55 @@ +From 6e7941e06d9e89155471fbab18bac1674de62de9 Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Tue, 10 Nov 2015 10:46:11 -0600 +Subject: rtlwifi: rtl8821ae: Fix lockups on boot + +[ Upstream commit eeec5d0ef7ee54a75e09e861c3cc44177b8752c7 ] + +In commit 54328e64047a5 ("rtlwifi: rtl8821ae: Fix system lockups on boot"), +an attempt was made to fix a regression introduced in commit 1277fa2ab2f9 +("rtlwifi: Remove the clear interrupt routine from all drivers"). +Unfortunately, there were logic errors in that patch that prevented +affected boxes from booting even after that patch was applied. + +The actual cause of the original problem is unknown as none of the +developers have systems that are affected. + +Fixes: 54328e64047a ("rtlwifi: rtl8821ae: Fix system lockups on boot") +Signed-off-by: Larry Finger +Cc: Stable [V4.1+] +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 2 +- + drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +index 28b8b6a25f6d..3639398f3c71 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +@@ -2272,7 +2272,7 @@ void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + +- if (!rtlpci->int_clear) ++ if (rtlpci->int_clear) + rtl8821ae_clear_interrupt(hw);/*clear it here first*/ + + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +index 80307d187c0a..71cf8120a95e 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +@@ -474,7 +474,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n"); + MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n"); + MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); + MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n"); +-MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n"); ++MODULE_PARM_DESC(int_clear, "Set to 0 to disable interrupt clear before set (default 1)\n"); + + static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); + +-- +2.17.1 + diff --git a/queue-3.18/rtlwifi-rtl8821ae-fix-system-lockups-on-boot.patch b/queue-3.18/rtlwifi-rtl8821ae-fix-system-lockups-on-boot.patch new file mode 100644 index 00000000000..ce50ad46d40 --- /dev/null +++ b/queue-3.18/rtlwifi-rtl8821ae-fix-system-lockups-on-boot.patch @@ -0,0 +1,140 @@ +From c615fdcfb3dd757129be4b6f83f8a641b64255cc Mon Sep 17 00:00:00 2001 +From: Larry Finger +Date: Fri, 2 Oct 2015 11:44:30 -0500 +Subject: rtlwifi: rtl8821ae: Fix system lockups on boot + +[ Upstream commit 54328e64047a54b8fc2362c2e1f0fa16c90f739f ] + +In commit 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all +drivers"), the code that cleared all interrupt enable bits before setting them +was removed for all PCI drivers. This fixed an issue that caused TX to be +blocked for 3-5 seconds. On some RTL8821AE units, this change causes soft +lockups to occur on boot. For that reason, the portion of the earlier commit +that applied to rtl8821ae is reverted. Kernels 4.1 and newer are affected. + +See http://marc.info/?l=linux-wireless&m=144373370103285&w=2 and +https://bugzilla.opensuse.org/show_bug.cgi?id=944978 for two cases where +this regression affected user systems. Note that this bug does not appear on +any of the developer's setups. For those users whose systems are affected +by the TX blockage, but do not lock up on boot, a module parameter is added +to disable the interrupt clear + +Fixes: 1277fa2ab2f9 ("rtlwifi: Remove the clear interrupt routine from all drivers") +Signed-off-by: Larry Finger +Cc: Stable [V4.1+] +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rtlwifi/pci.h | 2 ++ + drivers/net/wireless/rtlwifi/rtl8821ae/hw.c | 17 +++++++++++++++++ + drivers/net/wireless/rtlwifi/rtl8821ae/sw.c | 5 +++++ + drivers/net/wireless/rtlwifi/wifi.h | 3 +++ + 4 files changed, 27 insertions(+) + +diff --git a/drivers/net/wireless/rtlwifi/pci.h b/drivers/net/wireless/rtlwifi/pci.h +index d4567d12e07e..5da6703942d9 100644 +--- a/drivers/net/wireless/rtlwifi/pci.h ++++ b/drivers/net/wireless/rtlwifi/pci.h +@@ -247,6 +247,8 @@ struct rtl_pci { + /* MSI support */ + bool msi_support; + bool using_msi; ++ /* interrupt clear before set */ ++ bool int_clear; + }; + + struct mp_adapter { +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +index e17b728a21aa..28b8b6a25f6d 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c +@@ -2253,11 +2253,28 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci) + } + } + ++static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw) ++{ ++ struct rtl_priv *rtlpriv = rtl_priv(hw); ++ u32 tmp = rtl_read_dword(rtlpriv, REG_HISR); ++ ++ rtl_write_dword(rtlpriv, REG_HISR, tmp); ++ ++ tmp = rtl_read_dword(rtlpriv, REG_HISRE); ++ rtl_write_dword(rtlpriv, REG_HISRE, tmp); ++ ++ tmp = rtl_read_dword(rtlpriv, REG_HSISR); ++ rtl_write_dword(rtlpriv, REG_HSISR, tmp); ++} ++ + void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw)); + ++ if (!rtlpci->int_clear) ++ rtl8821ae_clear_interrupt(hw);/*clear it here first*/ ++ + rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF); + rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF); + rtlpci->irq_enabled = true; +diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +index fc92dd6a0d07..80307d187c0a 100644 +--- a/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c ++++ b/drivers/net/wireless/rtlwifi/rtl8821ae/sw.c +@@ -142,6 +142,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw) + + rtl8821ae_bt_reg_init(hw); + rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; ++ rtlpci->int_clear = rtlpriv->cfg->mod_params->int_clear; + rtlpriv->btcoexist.btc_ops = rtl_btc_get_ops_pointer(); + + rtlpriv->dm.dm_initialgain_enable = 1; +@@ -213,6 +214,7 @@ int rtl8821ae_init_sw_vars(struct ieee80211_hw *hw) + rtlpriv->psc.swctrl_lps = rtlpriv->cfg->mod_params->swctrl_lps; + rtlpriv->psc.fwctrl_lps = rtlpriv->cfg->mod_params->fwctrl_lps; + rtlpci->msi_support = rtlpriv->cfg->mod_params->msi_support; ++ rtlpci->msi_support = rtlpriv->cfg->mod_params->int_clear; + if (rtlpriv->cfg->mod_params->disable_watchdog) + pr_info("watchdog disabled\n"); + rtlpriv->psc.reg_fwctrl_lps = 3; +@@ -334,6 +336,7 @@ static struct rtl_mod_params rtl8821ae_mod_params = { + .swctrl_lps = false, + .fwctrl_lps = true, + .msi_support = true, ++ .int_clear = true, + .debug = DBG_EMERG, + .disable_watchdog = 0, + }; +@@ -463,6 +466,7 @@ module_param_named(fwlps, rtl8821ae_mod_params.fwctrl_lps, bool, 0444); + module_param_named(msi, rtl8821ae_mod_params.msi_support, bool, 0444); + module_param_named(disable_watchdog, rtl8821ae_mod_params.disable_watchdog, + bool, 0444); ++module_param_named(int_clear, rtl8821ae_mod_params.int_clear, bool, 0444); + MODULE_PARM_DESC(swenc, "Set to 1 for software crypto (default 0)\n"); + MODULE_PARM_DESC(ips, "Set to 0 to not use link power save (default 1)\n"); + MODULE_PARM_DESC(swlps, "Set to 1 to use SW control power save (default 0)\n"); +@@ -470,6 +474,7 @@ MODULE_PARM_DESC(fwlps, "Set to 1 to use FW control power save (default 1)\n"); + MODULE_PARM_DESC(msi, "Set to 1 to use MSI interrupts mode (default 1)\n"); + MODULE_PARM_DESC(debug, "Set debug level (0-5) (default 0)"); + MODULE_PARM_DESC(disable_watchdog, "Set to 1 to disable the watchdog (default 0)\n"); ++MODULE_PARM_DESC(int_clear, "Set to 1 to disable interrupt clear before set (default 0)\n"); + + static SIMPLE_DEV_PM_OPS(rtlwifi_pm_ops, rtl_pci_suspend, rtl_pci_resume); + +diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h +index 27822fe34d9a..318078645e64 100644 +--- a/drivers/net/wireless/rtlwifi/wifi.h ++++ b/drivers/net/wireless/rtlwifi/wifi.h +@@ -2212,6 +2212,9 @@ struct rtl_mod_params { + + /* default 0: 1 means disable */ + bool disable_watchdog; ++ ++ /* default 0: 1 means do not disable interrupts */ ++ bool int_clear; + }; + + struct rtl_hal_usbint_cfg { +-- +2.17.1 + diff --git a/queue-3.18/rtnl-don-t-account-unused-struct-ifla_port_vsi-in-rt.patch b/queue-3.18/rtnl-don-t-account-unused-struct-ifla_port_vsi-in-rt.patch new file mode 100644 index 00000000000..9dc8b898e17 --- /dev/null +++ b/queue-3.18/rtnl-don-t-account-unused-struct-ifla_port_vsi-in-rt.patch @@ -0,0 +1,61 @@ +From 3085b6eefad91291a1a76d136638fb6740309546 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 17 Feb 2017 01:56:11 +0100 +Subject: rtnl: don't account unused struct ifla_port_vsi in rtnl_port_size + +[ Upstream commit 025331df34f6722f86b467cb13a69326444ab1bc ] + +When allocating rtnl dump messages, struct ifla_port_vsi is never dumped, +so we can save header plus payload in rtnl_port_size(). Infact, attribute +IFLA_PORT_VSI_TYPE and struct ifla_port_vsi are not used anywhere in +the kernel. We only need to keep the nla policy should applications in +user space be filling this out. Same NLA_BINARY issue exists as was fixed +in 364d5716a7ad ("rtnetlink: ifla_vf_policy: fix misuses of NLA_BINARY") +and others, but then again IFLA_PORT_VSI_TYPE is not used anywhere, so +just add a comment that it's unused. + +Signed-off-by: Daniel Borkmann +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 51301ad3c2d9..cd09f85ba8d6 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -817,8 +817,6 @@ static size_t rtnl_port_size(const struct net_device *dev, + { + size_t port_size = nla_total_size(4) /* PORT_VF */ + + nla_total_size(PORT_PROFILE_MAX) /* PORT_PROFILE */ +- + nla_total_size(sizeof(struct ifla_port_vsi)) +- /* PORT_VSI_TYPE */ + + nla_total_size(PORT_UUID_MAX) /* PORT_INSTANCE_UUID */ + + nla_total_size(PORT_UUID_MAX) /* PORT_HOST_UUID */ + + nla_total_size(1) /* PROT_VDP_REQUEST */ +@@ -1231,14 +1229,19 @@ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = { + [IFLA_PORT_VF] = { .type = NLA_U32 }, + [IFLA_PORT_PROFILE] = { .type = NLA_STRING, + .len = PORT_PROFILE_MAX }, +- [IFLA_PORT_VSI_TYPE] = { .type = NLA_BINARY, +- .len = sizeof(struct ifla_port_vsi)}, + [IFLA_PORT_INSTANCE_UUID] = { .type = NLA_BINARY, + .len = PORT_UUID_MAX }, + [IFLA_PORT_HOST_UUID] = { .type = NLA_STRING, + .len = PORT_UUID_MAX }, + [IFLA_PORT_REQUEST] = { .type = NLA_U8, }, + [IFLA_PORT_RESPONSE] = { .type = NLA_U16, }, ++ ++ /* Unused, but we need to keep it here since user space could ++ * fill it. It's also broken with regard to NLA_BINARY use in ++ * combination with structs. ++ */ ++ [IFLA_PORT_VSI_TYPE] = { .type = NLA_BINARY, ++ .len = sizeof(struct ifla_port_vsi) }, + }; + + static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) +-- +2.17.1 + diff --git a/queue-3.18/s390-ftrace-jprobes-fix-conflict-between-jprobes-and.patch b/queue-3.18/s390-ftrace-jprobes-fix-conflict-between-jprobes-and.patch new file mode 100644 index 00000000000..dca95abce57 --- /dev/null +++ b/queue-3.18/s390-ftrace-jprobes-fix-conflict-between-jprobes-and.patch @@ -0,0 +1,58 @@ +From 6fdd7cf27eec069415466874711662982233cc0a Mon Sep 17 00:00:00 2001 +From: Jiri Olsa +Date: Sun, 31 Jul 2016 14:52:53 +0200 +Subject: s390/ftrace/jprobes: Fix conflict between jprobes and function graph + tracing + +[ Upstream commit e64a5470dcd2900ab8f8f83638c00098b10e6300 ] + +This fixes the same issue Steven already fixed for x86 +in following commit: + + 237d28db036e ftrace/jprobes/x86: Fix conflict between jprobes and function graph tracing + +It fixes the crash, that happens when function graph tracing +and jprobes are used simultaneously. Please refer to above +commit for details. + +Signed-off-by: Jiri Olsa +Signed-off-by: Martin Schwidefsky +Acked-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/kprobes.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/arch/s390/kernel/kprobes.c b/arch/s390/kernel/kprobes.c +index 014d4729b134..ee03d8f0ee60 100644 +--- a/arch/s390/kernel/kprobes.c ++++ b/arch/s390/kernel/kprobes.c +@@ -633,6 +633,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) + stack = (unsigned long) regs->gprs[15]; + + memcpy(kcb->jprobes_stack, (void *) stack, MIN_STACK_SIZE(stack)); ++ ++ /* ++ * jprobes use jprobe_return() which skips the normal return ++ * path of the function, and this messes up the accounting of the ++ * function graph tracer to get messed up. ++ * ++ * Pause function graph tracing while performing the jprobe function. ++ */ ++ pause_graph_tracing(); + return 1; + } + +@@ -646,6 +655,9 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) + struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); + unsigned long stack; + ++ /* It's OK to start function graph tracing again */ ++ unpause_graph_tracing(); ++ + stack = (unsigned long) kcb->jprobe_saved_regs.gprs[15]; + + /* Put the regs back */ +-- +2.17.1 + diff --git a/queue-3.18/s390-kvm-replace-barrier-fixup-with-read_once.patch b/queue-3.18/s390-kvm-replace-barrier-fixup-with-read_once.patch new file mode 100644 index 00000000000..56febca3567 --- /dev/null +++ b/queue-3.18/s390-kvm-replace-barrier-fixup-with-read_once.patch @@ -0,0 +1,79 @@ +From 76b7d6e6b1ecea7e8a76344f8424ae721e4fa0f3 Mon Sep 17 00:00:00 2001 +From: Christian Borntraeger +Date: Tue, 25 Nov 2014 13:17:34 +0100 +Subject: s390/kvm: REPLACE barrier fixup with READ_ONCE + +[ Upstream commit 5de72a2247ac05bde7c89039631b3d0c6186fafb ] + +ACCESS_ONCE does not work reliably on non-scalar types. For +example gcc 4.6 and 4.7 might remove the volatile tag for such +accesses during the SRA (scalar replacement of aggregates) step +(https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145) + +Commit 1365039d0cb3 ("KVM: s390: Fix ipte locking") replace +ACCESS_ONCE with barriers. Lets use READ_ONCE instead. + +Signed-off-by: Christian Borntraeger +Acked-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/gaccess.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/arch/s390/kvm/gaccess.c b/arch/s390/kvm/gaccess.c +index 6dc0ad9c7050..8f195fa904a1 100644 +--- a/arch/s390/kvm/gaccess.c ++++ b/arch/s390/kvm/gaccess.c +@@ -229,12 +229,10 @@ static void ipte_lock_simple(struct kvm_vcpu *vcpu) + goto out; + ic = &vcpu->kvm->arch.sca->ipte_control; + do { +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + while (old.k) { + cond_resched(); +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + } + new = old; + new.k = 1; +@@ -253,8 +251,7 @@ static void ipte_unlock_simple(struct kvm_vcpu *vcpu) + goto out; + ic = &vcpu->kvm->arch.sca->ipte_control; + do { +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + new = old; + new.k = 0; + } while (cmpxchg(&ic->val, old.val, new.val) != old.val); +@@ -269,12 +266,10 @@ static void ipte_lock_siif(struct kvm_vcpu *vcpu) + + ic = &vcpu->kvm->arch.sca->ipte_control; + do { +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + while (old.kg) { + cond_resched(); +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + } + new = old; + new.k = 1; +@@ -288,8 +283,7 @@ static void ipte_unlock_siif(struct kvm_vcpu *vcpu) + + ic = &vcpu->kvm->arch.sca->ipte_control; + do { +- old = *ic; +- barrier(); ++ old = READ_ONCE(*ic); + new = old; + new.kh--; + if (!new.kh) +-- +2.17.1 + diff --git a/queue-3.18/scsi-queue_rq-can-t-sleep.patch b/queue-3.18/scsi-queue_rq-can-t-sleep.patch new file mode 100644 index 00000000000..66c2f11091b --- /dev/null +++ b/queue-3.18/scsi-queue_rq-can-t-sleep.patch @@ -0,0 +1,38 @@ +From 09e8b9e3dd71022d8f7518ef9713c637c4243b21 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Mon, 5 Jan 2015 20:29:38 +0100 +Subject: scsi: ->queue_rq can't sleep + +[ Upstream commit 70a0f2c1898c6abf53670e55642b6e840b003892 ] + +The blk-mq ->queue_rq method is always called from process context, +but might have preemption disabled. This means we still always +have to use GFP_ATOMIC for memory allocations, and thus need to +revert part of commit 3c356bde1 ("scsi: stop passing a gfp_mask +argument down the command setup path"). + +Signed-off-by: Christoph Hellwig +Reported-by: Sasha Levin +Reviewed-by: Bart Van Assche +Tested-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index a11837054d6c..0d5c218b7ad1 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -616,7 +616,7 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, + } + + ret = __sg_alloc_table(&sdb->table, nents, SCSI_MAX_SG_SEGMENTS, +- first_chunk, gfp_mask, scsi_sg_alloc); ++ first_chunk, GFP_ATOMIC, scsi_sg_alloc); + if (unlikely(ret)) + scsi_free_sgtable(sdb, mq); + return ret; +-- +2.17.1 + diff --git a/queue-3.18/sctp-translate-network-order-to-host-order-when-user.patch b/queue-3.18/sctp-translate-network-order-to-host-order-when-user.patch new file mode 100644 index 00000000000..b518117a3ce --- /dev/null +++ b/queue-3.18/sctp-translate-network-order-to-host-order-when-user.patch @@ -0,0 +1,53 @@ +From f93a4482d318bbbbbf8b0a1cc2b90ae58e9646be Mon Sep 17 00:00:00 2001 +From: Xin Long +Date: Wed, 3 Feb 2016 23:33:30 +0800 +Subject: sctp: translate network order to host order when users get a hmacid + +[ Upstream commit 7a84bd46647ff181eb2659fdc99590e6f16e501d ] + +Commit ed5a377d87dc ("sctp: translate host order to network order when +setting a hmacid") corrected the hmacid byte-order when setting a hmacid. +but the same issue also exists on getting a hmacid. + +We fix it by changing hmacids to host order when users get them with +getsockopt. + +Fixes: Commit ed5a377d87dc ("sctp: translate host order to network order when setting a hmacid") +Signed-off-by: Xin Long +Acked-by: Marcelo Ricardo Leitner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/socket.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 13693d0adeaf..5c16d0e13987 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -5607,6 +5607,7 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, + struct sctp_hmac_algo_param *hmacs; + __u16 data_len = 0; + u32 num_idents; ++ int i; + + if (!ep->auth_enable) + return -EACCES; +@@ -5624,8 +5625,12 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, + return -EFAULT; + if (put_user(num_idents, &p->shmac_num_idents)) + return -EFAULT; +- if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len)) +- return -EFAULT; ++ for (i = 0; i < num_idents; i++) { ++ __u16 hmacid = ntohs(hmacs->hmac_ids[i]); ++ ++ if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16))) ++ return -EFAULT; ++ } + return 0; + } + +-- +2.17.1 + diff --git a/queue-3.18/selftests-introduce-a-new-script-to-generate-tc-batc.patch b/queue-3.18/selftests-introduce-a-new-script-to-generate-tc-batc.patch new file mode 100644 index 00000000000..327fe7b228b --- /dev/null +++ b/queue-3.18/selftests-introduce-a-new-script-to-generate-tc-batc.patch @@ -0,0 +1,106 @@ +From 007a2f4c6678cba528b754ebb23f14fb50b15c59 Mon Sep 17 00:00:00 2001 +From: Chris Mi +Date: Thu, 26 Oct 2017 18:24:42 -0700 +Subject: selftests: Introduce a new script to generate tc batch file + +[ Upstream commit 7f071998474a9e5f7b98103d3058a1b8ca5887e6 ] + + # ./tdc_batch.py -h + usage: tdc_batch.py [-h] [-n NUMBER] [-o] [-s] [-p] device file + + TC batch file generator + + positional arguments: + device device name + file batch file name + + optional arguments: + -h, --help show this help message and exit + -n NUMBER, --number NUMBER + how many lines in batch file + -o, --skip_sw skip_sw (offload), by default skip_hw + -s, --share_action all filters share the same action + -p, --prio all filters have different prio + +Acked-by: Jamal Hadi Salim +Acked-by: Lucas Bates +Signed-off-by: Chris Mi +Signed-off-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../testing/selftests/tc-testing/tdc_batch.py | 62 +++++++++++++++++++ + 1 file changed, 62 insertions(+) + create mode 100755 tools/testing/selftests/tc-testing/tdc_batch.py + +diff --git a/tools/testing/selftests/tc-testing/tdc_batch.py b/tools/testing/selftests/tc-testing/tdc_batch.py +new file mode 100755 +index 000000000000..707c6bfef689 +--- /dev/null ++++ b/tools/testing/selftests/tc-testing/tdc_batch.py +@@ -0,0 +1,62 @@ ++#!/usr/bin/python3 ++ ++""" ++tdc_batch.py - a script to generate TC batch file ++ ++Copyright (C) 2017 Chris Mi ++""" ++ ++import argparse ++ ++parser = argparse.ArgumentParser(description='TC batch file generator') ++parser.add_argument("device", help="device name") ++parser.add_argument("file", help="batch file name") ++parser.add_argument("-n", "--number", type=int, ++ help="how many lines in batch file") ++parser.add_argument("-o", "--skip_sw", ++ help="skip_sw (offload), by default skip_hw", ++ action="store_true") ++parser.add_argument("-s", "--share_action", ++ help="all filters share the same action", ++ action="store_true") ++parser.add_argument("-p", "--prio", ++ help="all filters have different prio", ++ action="store_true") ++args = parser.parse_args() ++ ++device = args.device ++file = open(args.file, 'w') ++ ++number = 1 ++if args.number: ++ number = args.number ++ ++skip = "skip_hw" ++if args.skip_sw: ++ skip = "skip_sw" ++ ++share_action = "" ++if args.share_action: ++ share_action = "index 1" ++ ++prio = "prio 1" ++if args.prio: ++ prio = "" ++ if number > 0x4000: ++ number = 0x4000 ++ ++index = 0 ++for i in range(0x100): ++ for j in range(0x100): ++ for k in range(0x100): ++ mac = ("%02x:%02x:%02x" % (i, j, k)) ++ src_mac = "e4:11:00:" + mac ++ dst_mac = "e4:12:00:" + mac ++ cmd = ("filter add dev %s %s protocol ip parent ffff: flower %s " ++ "src_mac %s dst_mac %s action drop %s" % ++ (device, prio, skip, src_mac, dst_mac, share_action)) ++ file.write("%s\n" % cmd) ++ index += 1 ++ if index >= number: ++ file.close() ++ exit(0) +-- +2.17.1 + diff --git a/queue-3.18/serial-samsung-add-the-support-for-exynos5433-soc.patch b/queue-3.18/serial-samsung-add-the-support-for-exynos5433-soc.patch new file mode 100644 index 00000000000..cc8ce418b7e --- /dev/null +++ b/queue-3.18/serial-samsung-add-the-support-for-exynos5433-soc.patch @@ -0,0 +1,112 @@ +From ca2099da4c46808a88377be89f62cc67c87ca437 Mon Sep 17 00:00:00 2001 +From: Chanwoo Choi +Date: Tue, 2 Dec 2014 17:49:54 +0900 +Subject: serial: samsung: Add the support for Exynos5433 SoC + +[ Upstream commit 31ec77aca72ee5920ed3ec3d047734dc0bc43342 ] + +This patch adds new s3c24xx_serial_drv_data structure for Exynos5433 SoC +because Exynos5433 has different fifo size from existing Exynos4 SoC. + +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: linux-serial@vger.kernel.org +Signed-off-by: Chanwoo Choi +Acked-by: Inki Dae +Acked-by: Geunsik Lim +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/samsung.c | 56 +++++++++++++++++++++++------------- + 1 file changed, 36 insertions(+), 20 deletions(-) + +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index ba59a76edc8b..957992ceba0a 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1785,32 +1785,43 @@ static struct s3c24xx_serial_drv_data s5pv210_serial_drv_data = { + #endif + + #if defined(CONFIG_ARCH_EXYNOS) ++#define EXYNOS_COMMON_SERIAL_DRV_DATA \ ++ .info = &(struct s3c24xx_uart_info) { \ ++ .name = "Samsung Exynos UART", \ ++ .type = PORT_S3C6400, \ ++ .has_divslot = 1, \ ++ .rx_fifomask = S5PV210_UFSTAT_RXMASK, \ ++ .rx_fifoshift = S5PV210_UFSTAT_RXSHIFT, \ ++ .rx_fifofull = S5PV210_UFSTAT_RXFULL, \ ++ .tx_fifofull = S5PV210_UFSTAT_TXFULL, \ ++ .tx_fifomask = S5PV210_UFSTAT_TXMASK, \ ++ .tx_fifoshift = S5PV210_UFSTAT_TXSHIFT, \ ++ .def_clk_sel = S3C2410_UCON_CLKSEL0, \ ++ .num_clks = 1, \ ++ .clksel_mask = 0, \ ++ .clksel_shift = 0, \ ++ }, \ ++ .def_cfg = &(struct s3c2410_uartcfg) { \ ++ .ucon = S5PV210_UCON_DEFAULT, \ ++ .ufcon = S5PV210_UFCON_DEFAULT, \ ++ .has_fracval = 1, \ ++ } \ ++ + static struct s3c24xx_serial_drv_data exynos4210_serial_drv_data = { +- .info = &(struct s3c24xx_uart_info) { +- .name = "Samsung Exynos4 UART", +- .type = PORT_S3C6400, +- .has_divslot = 1, +- .rx_fifomask = S5PV210_UFSTAT_RXMASK, +- .rx_fifoshift = S5PV210_UFSTAT_RXSHIFT, +- .rx_fifofull = S5PV210_UFSTAT_RXFULL, +- .tx_fifofull = S5PV210_UFSTAT_TXFULL, +- .tx_fifomask = S5PV210_UFSTAT_TXMASK, +- .tx_fifoshift = S5PV210_UFSTAT_TXSHIFT, +- .def_clk_sel = S3C2410_UCON_CLKSEL0, +- .num_clks = 1, +- .clksel_mask = 0, +- .clksel_shift = 0, +- }, +- .def_cfg = &(struct s3c2410_uartcfg) { +- .ucon = S5PV210_UCON_DEFAULT, +- .ufcon = S5PV210_UFCON_DEFAULT, +- .has_fracval = 1, +- }, ++ EXYNOS_COMMON_SERIAL_DRV_DATA, + .fifosize = { 256, 64, 16, 16 }, + }; ++ ++static struct s3c24xx_serial_drv_data exynos5433_serial_drv_data = { ++ EXYNOS_COMMON_SERIAL_DRV_DATA, ++ .fifosize = { 64, 256, 16, 256 }, ++}; ++ + #define EXYNOS4210_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos4210_serial_drv_data) ++#define EXYNOS5433_SERIAL_DRV_DATA ((kernel_ulong_t)&exynos5433_serial_drv_data) + #else + #define EXYNOS4210_SERIAL_DRV_DATA (kernel_ulong_t)NULL ++#define EXYNOS5433_SERIAL_DRV_DATA (kernel_ulong_t)NULL + #endif + + static struct platform_device_id s3c24xx_serial_driver_ids[] = { +@@ -1832,6 +1843,9 @@ static struct platform_device_id s3c24xx_serial_driver_ids[] = { + }, { + .name = "exynos4210-uart", + .driver_data = EXYNOS4210_SERIAL_DRV_DATA, ++ }, { ++ .name = "exynos5433-uart", ++ .driver_data = EXYNOS5433_SERIAL_DRV_DATA, + }, + { }, + }; +@@ -1851,6 +1865,8 @@ static const struct of_device_id s3c24xx_uart_dt_match[] = { + .data = (void *)S5PV210_SERIAL_DRV_DATA }, + { .compatible = "samsung,exynos4210-uart", + .data = (void *)EXYNOS4210_SERIAL_DRV_DATA }, ++ { .compatible = "samsung,exynos5433-uart", ++ .data = (void *)EXYNOS5433_SERIAL_DRV_DATA }, + {}, + }; + MODULE_DEVICE_TABLE(of, s3c24xx_uart_dt_match); +-- +2.17.1 + diff --git a/queue-3.18/series b/queue-3.18/series index a7165524935..1ba07bcf26f 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -17,3 +17,113 @@ ip6_tunnel-be-careful-when-accessing-the-inner-header.patch media-af9035-prevent-buffer-overflow-on-write.patch powerpc-tm-fix-userspace-r13-corruption.patch powerpc-tm-avoid-possible-userspace-r1-corruption-on-reclaim.patch +xfrm-validate-address-prefix-lengths-in-the-xfrm-sel.patch +xfrm6-call-kfree_skb-when-skb-is-toobig.patch +cfg80211-reg-init-wiphy_idx-in-regulatory_hint_core.patch +arm-8799-1-mm-fix-pci_ioremap_io-offset-check.patch +xfrm-validate-template-mode.patch +asix-check-for-supported-wake-on-lan-modes.patch +ax88179_178a-check-for-supported-wake-on-lan-modes.patch +sr9800-check-for-supported-wake-on-lan-modes.patch +smsc75xx-check-for-wake-on-lan-modes.patch +smsc95xx-check-for-wake-on-lan-modes.patch +perf-ring_buffer-prevent-concurent-ring-buffer-acces.patch +net-cxgb3_main-fix-a-missing-check-bug.patch +dm-thin-restore-requested-error_if_no_space-setting-.patch +ocfs2-fix-journal-commit-deadlock-in-ocfs2_convert_i.patch +s390-kvm-replace-barrier-fixup-with-read_once.patch +usb-qcserial-fix-support-for-hp-lt4112-lte-hspa-gobi.patch +cxl-fix-issues-when-unmapping-contexts.patch +s390-ftrace-jprobes-fix-conflict-between-jprobes-and.patch +mmc-sdhci-restore-behavior-when-setting-vdd-via-exte.patch +arm-omap5-dra7-fix-hyp-mode-boot-for-thumb2-build.patch +usb-gadget-gadgetfs-fix-an-oops-in-ep_write.patch +ahci_xgene-fix-the-dma-state-machine-lockup-for-the-.patch +revert-drm-i915-fix-mutex-owner-inspection-race-unde.patch +pinctrl-at91-fix-null-pointer-dereference.patch +pci-mark-atheros-ar9580-to-avoid-bus-reset.patch +arm-shmobile-r8a7740-instantiate-gic-from-c-board-co.patch +usb-musb-fix-a-few-off-by-one-lengths.patch +usb-gadget-f_uac1-access-freed-memory-at-f_audio_fre.patch +usb-musb-fix-randconfig-build-issues-for-kconfig-opt.patch +usb-dwc2-gadget-kill-requests-with-force-in-s3c_hsot.patch +phy-sun4i-usb-change-disconnect-threshold-value-for-.patch +phy-phy-ti-pipe3-fix-inconsistent-enumeration-of-pci.patch +iio-iio-fix-iio_channel_read-return-if-channel-havn-.patch +arm-dra7xx-fix-counter-frequency-drift-for-am572x-er.patch +arm-omap2-fix-n900-board-name-for-legacy-user-space.patch +nfsv4-cache-the-nfsv4-v4.1-client-owner_id-in-the-st.patch +nfsv4-v4.1-verify-the-client-owner-id-during-trunkin.patch +nfs-ignore-transport-protocol-when-detecting-server-.patch +nfsv4-remove-incorrect-check-in-can_open_delegated.patch +arm-dts-use-pmu_system_controller-phandle-for-dp-phy.patch +scsi-queue_rq-can-t-sleep.patch +usb-ehci-adjust-error-return-code.patch +uas-disable-uas-on-apricorn-sata-dongles.patch +usb-host-ehci-tegra-request-deferred-probe-when-fail.patch +revert-tty-fix-pty-master-poll-after-slave-closes-v2.patch +serial-samsung-add-the-support-for-exynos5433-soc.patch +mcb-mcb-pci-only-remap-the-1st-0x200-bytes-of-bar-0.patch +arm-at91-dt-sama5d4-fix-the-timer-reg-length.patch +arm-at91-sama5d3-dt-correct-the-sound-route.patch +arm-at91-dt-sam9263-add-missing-clocks-to-lcdc-node.patch +arm-at91-board-dt-sama5-add-phy_fixup-to-override-na.patch +fbdev-broadsheetfb-fix-memory-leak.patch +tracing-fix-enabling-of-syscall-events-on-the-comman.patch +perf-rapl-fix-sysfs_show-initialization-for-rapl-pmu.patch +perf-x86-intel-fix-bug-for-cycles-p-and-cycles-pp-on.patch +perf-machine-fix-__machine__findnew_thread-error-pat.patch +perf-tools-fix-statfs.f_type-data-type-mismatch-buil.patch +perf-tools-avoid-build-splat-for-syscall-numbers-wit.patch +perf-tools-fix-segfault-for-symbol-annotation-on-tui.patch +drivers-bus-check-cci-device-tree-node-status.patch +arm-dts-disable-cci-on-exynos5420-based-arndale-octa.patch +clk-rockchip-fix-deadlock-possibility-in-cpuclk.patch +quota-fix-maximum-quota-limit-settings.patch +rtnl-don-t-account-unused-struct-ifla_port_vsi-in-rt.patch +nfs-fix-high-load-average-due-to-callback-thread-sle.patch +rcu-clear-need_qs-flag-to-prevent-splat.patch +x86-irq-check-for-valid-irq-descriptor-in-check_irq_.patch +of-pci-remove-duplicate-kfree-in-of_pci_get_host_bri.patch +btrfs-avoid-syncing-log-in-the-fast-fsync-path-when-.patch +pinctrl-imx25-ensure-that-a-pin-with-id-i-is-at-posi.patch +dm-fix-ab-ba-deadlock-in-__dm_destroy.patch +arm-arm64-kvm-take-mmap_sem-in-stage2_unmap_vm.patch +net-mlx4_en-remove-dependency-between-timestamping-c.patch +iommu-vt-d-fix-vm-domain-id-leak.patch +tty-serial-fsl_lpuart-fix-clearing-of-receive-flag.patch +x86-idle-restore-trace_cpu_idle-to-mwait_idle-calls.patch +ext4-fix-an-ext3-collapse-range-regression-in-xfstes.patch +net-ethernet-davicom-fix-devicetree-irq-resource.patch +perf-bench-numa-fix-to-show-proper-convergence-stats.patch +mips-fix-up-obsolete-cpu_set-usage.patch +dm9000-fix-irq-trigger-type-setup-on-non-dt-platform.patch +lib-make-memzero_explicit-more-robust-against-dead-s.patch +asoc-dapm-don-t-add-prefix-to-widget-stream-name.patch +mtd-blkdevs-fix-potential-deadlock-lockdep-warnings.patch +selftests-introduce-a-new-script-to-generate-tc-batc.patch +rtlwifi-rtl8821ae-fix-system-lockups-on-boot.patch +rtlwifi-rtl8821ae-fix-lockups-on-boot.patch +clocksource-exynos_mct-clear-interrupt-when-cpu-is-s.patch +alsa-hda-add-headset-mic-support-for-acer-aspire-v5-.patch +alsa-usb-audio-add-a-more-accurate-volume-quirk-for-.patch +tty-audit-fix-audit-source.patch +btrfs-do-not-ignore-errors-from-btrfs_lookup_xattr-i.patch +igb-unpair-the-queues-when-changing-the-number-of-qu.patch +libata-blacklist-micron-500it-ssd-with-mu01-firmware.patch +perf-fix-perf_event_ioc_period-deadlock.patch +mm-migrate-hugetlb-putback-destination-hugepage-to-a.patch +revert-scsi-fix-null-pointer-dereference-in-runtime-.patch +x86-ldt-fix-small-ldt-allocation-for-xen.patch +pci-fix-devfn-for-vpd-access-through-function-0.patch +vfs-make-sendfile-2-killable-even-better.patch +sctp-translate-network-order-to-host-order-when-user.patch +iwlwifi-pcie-correctly-define-7265-d-cfg.patch +ovl-fix-open-in-stacked-overlay.patch +igb-fix-null-derefs-due-to-skipped-sr-iov-enabling.patch +keys-put-keyring-if-install_session_keyring_to_cred-.patch +usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch +net-fix-warnings-in-make-htmldocs-by-moving-macro-de.patch +x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch +unix-correctly-track-in-flight-fds-in-sending-proces.patch +fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch diff --git a/queue-3.18/smsc75xx-check-for-wake-on-lan-modes.patch b/queue-3.18/smsc75xx-check-for-wake-on-lan-modes.patch new file mode 100644 index 00000000000..0b00d0b55aa --- /dev/null +++ b/queue-3.18/smsc75xx-check-for-wake-on-lan-modes.patch @@ -0,0 +1,36 @@ +From 1af81e9faeea269f8bd839dd2ad523ff5ffeba7c Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 28 Sep 2018 16:18:55 -0700 +Subject: smsc75xx: Check for Wake-on-LAN modes + +[ Upstream commit 9c734b2769a73eea2e9e9767c0e0bf839ff23679 ] + +The driver does not check for Wake-on-LAN modes specified by an user, +but will conditionally set the device as wake-up enabled or not based on +that, which could be a very confusing user experience. + +Fixes: 6c636503260d ("smsc75xx: add wol magic packet support") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc75xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index 3850c342bc54..31724e40f142 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -728,6 +728,9 @@ static int smsc75xx_ethtool_set_wol(struct net_device *net, + struct smsc75xx_priv *pdata = (struct smsc75xx_priv *)(dev->data[0]); + int ret; + ++ if (wolinfo->wolopts & ~SUPPORTED_WAKE) ++ return -EINVAL; ++ + pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; + + ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); +-- +2.17.1 + diff --git a/queue-3.18/smsc95xx-check-for-wake-on-lan-modes.patch b/queue-3.18/smsc95xx-check-for-wake-on-lan-modes.patch new file mode 100644 index 00000000000..b522240e1d7 --- /dev/null +++ b/queue-3.18/smsc95xx-check-for-wake-on-lan-modes.patch @@ -0,0 +1,36 @@ +From 8ced0c2c371a4984950f33efc9fef786bec3a269 Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 28 Sep 2018 16:18:56 -0700 +Subject: smsc95xx: Check for Wake-on-LAN modes + +[ Upstream commit c530c471ba37bdd9fe1c7185b01455c00ae606fb ] + +The driver does not check for Wake-on-LAN modes specified by an user, +but will conditionally set the device as wake-up enabled or not based on +that, which could be a very confusing user experience. + +Fixes: e0e474a83c18 ("smsc95xx: add wol magic packet support") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index d07bf4cb893f..cf71dc04b5bb 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -727,6 +727,9 @@ static int smsc95xx_ethtool_set_wol(struct net_device *net, + struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]); + int ret; + ++ if (wolinfo->wolopts & ~SUPPORTED_WAKE) ++ return -EINVAL; ++ + pdata->wolopts = wolinfo->wolopts & SUPPORTED_WAKE; + + ret = device_set_wakeup_enable(&dev->udev->dev, pdata->wolopts); +-- +2.17.1 + diff --git a/queue-3.18/sr9800-check-for-supported-wake-on-lan-modes.patch b/queue-3.18/sr9800-check-for-supported-wake-on-lan-modes.patch new file mode 100644 index 00000000000..25d0f178c15 --- /dev/null +++ b/queue-3.18/sr9800-check-for-supported-wake-on-lan-modes.patch @@ -0,0 +1,36 @@ +From 0f7683aeaf1be4bcb09cd4002daf7d4071b06e2b Mon Sep 17 00:00:00 2001 +From: Florian Fainelli +Date: Fri, 28 Sep 2018 16:18:53 -0700 +Subject: sr9800: Check for supported Wake-on-LAN modes + +[ Upstream commit c5cb93e994ffb43b7b3b1ff10b9f928f54574a36 ] + +The driver currently silently accepts unsupported Wake-on-LAN modes +(other than WAKE_PHY or WAKE_MAGIC) without reporting that to the user, +which is confusing. + +Fixes: 19a38d8e0aa3 ("USB2NET : SR9800 : One chip USB2.0 USB2NET SR9800 Device Driver Support") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/sr9800.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/usb/sr9800.c b/drivers/net/usb/sr9800.c +index 953de13267df..0144fb19a099 100644 +--- a/drivers/net/usb/sr9800.c ++++ b/drivers/net/usb/sr9800.c +@@ -421,6 +421,9 @@ sr_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo) + struct usbnet *dev = netdev_priv(net); + u8 opt = 0; + ++ if (wolinfo->wolopts & ~(WAKE_PHY | WAKE_MAGIC)) ++ return -EINVAL; ++ + if (wolinfo->wolopts & WAKE_PHY) + opt |= SR_MONITOR_LINK; + if (wolinfo->wolopts & WAKE_MAGIC) +-- +2.17.1 + diff --git a/queue-3.18/tracing-fix-enabling-of-syscall-events-on-the-comman.patch b/queue-3.18/tracing-fix-enabling-of-syscall-events-on-the-comman.patch new file mode 100644 index 00000000000..48ba6e2db04 --- /dev/null +++ b/queue-3.18/tracing-fix-enabling-of-syscall-events-on-the-comman.patch @@ -0,0 +1,135 @@ +From dca9a14c2fc1802df048218792e9e9f26055c3c0 Mon Sep 17 00:00:00 2001 +From: "Steven Rostedt (Red Hat)" +Date: Wed, 14 Jan 2015 12:53:45 -0500 +Subject: tracing: Fix enabling of syscall events on the command line + +[ Upstream commit ce1039bd3a89e99e4f624e75fb1777fc92d76eb3 ] + +Commit 5f893b2639b2 "tracing: Move enabling tracepoints to just after +rcu_init()" broke the enabling of system call events from the command +line. The reason was that the enabling of command line trace events +was moved before PID 1 started, and the syscall tracepoints require +that all tasks have the TIF_SYSCALL_TRACEPOINT flag set. But the +swapper task (pid 0) is not part of that. Since the swapper task is the +only task that is running at this early in boot, no task gets the +flag set, and the tracepoint never gets reached. + +Instead of setting the swapper task flag (there should be no reason to +do that), re-enabled trace events again after the init thread (PID 1) +has been started. It requires disabling all command line events and +re-enabling them, as just enabling them again will not reset the logic +to set the TIF_SYSCALL_TRACEPOINT flag, as the syscall tracepoint will +be fooled into thinking that it was already set, and wont try setting +it again. For this reason, we must first disable it and re-enable it. + +Link: http://lkml.kernel.org/r/1421188517-18312-1-git-send-email-mpe@ellerman.id.au +Link: http://lkml.kernel.org/r/20150115040506.216066449@goodmis.org + +Reported-by: Michael Ellerman +Signed-off-by: Steven Rostedt +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events.c | 69 +++++++++++++++++++++++++++++-------- + 1 file changed, 55 insertions(+), 14 deletions(-) + +diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c +index 51c47bc832d4..edf6ab4d8650 100644 +--- a/kernel/trace/trace_events.c ++++ b/kernel/trace/trace_events.c +@@ -2400,12 +2400,39 @@ static __init int event_trace_memsetup(void) + return 0; + } + ++static __init void ++early_enable_events(struct trace_array *tr, bool disable_first) ++{ ++ char *buf = bootup_event_buf; ++ char *token; ++ int ret; ++ ++ while (true) { ++ token = strsep(&buf, ","); ++ ++ if (!token) ++ break; ++ if (!*token) ++ continue; ++ ++ /* Restarting syscalls requires that we stop them first */ ++ if (disable_first) ++ ftrace_set_clr_event(tr, token, 0); ++ ++ ret = ftrace_set_clr_event(tr, token, 1); ++ if (ret) ++ pr_warn("Failed to enable trace event: %s\n", token); ++ ++ /* Put back the comma to allow this to be called again */ ++ if (buf) ++ *(buf - 1) = ','; ++ } ++} ++ + static __init int event_trace_enable(void) + { + struct trace_array *tr = top_trace_array(); + struct ftrace_event_call **iter, *call; +- char *buf = bootup_event_buf; +- char *token; + int ret; + + if (!tr) +@@ -2427,18 +2454,7 @@ static __init int event_trace_enable(void) + */ + __trace_early_add_events(tr); + +- while (true) { +- token = strsep(&buf, ","); +- +- if (!token) +- break; +- if (!*token) +- continue; +- +- ret = ftrace_set_clr_event(tr, token, 1); +- if (ret) +- pr_warn("Failed to enable trace event: %s\n", token); +- } ++ early_enable_events(tr, false); + + trace_printk_start_comm(); + +@@ -2449,6 +2465,31 @@ static __init int event_trace_enable(void) + return 0; + } + ++/* ++ * event_trace_enable() is called from trace_event_init() first to ++ * initialize events and perhaps start any events that are on the ++ * command line. Unfortunately, there are some events that will not ++ * start this early, like the system call tracepoints that need ++ * to set the TIF_SYSCALL_TRACEPOINT flag of pid 1. But event_trace_enable() ++ * is called before pid 1 starts, and this flag is never set, making ++ * the syscall tracepoint never get reached, but the event is enabled ++ * regardless (and not doing anything). ++ */ ++static __init int event_trace_enable_again(void) ++{ ++ struct trace_array *tr; ++ ++ tr = top_trace_array(); ++ if (!tr) ++ return -ENODEV; ++ ++ early_enable_events(tr, true); ++ ++ return 0; ++} ++ ++early_initcall(event_trace_enable_again); ++ + static __init int event_trace_init(void) + { + struct trace_array *tr; +-- +2.17.1 + diff --git a/queue-3.18/tty-audit-fix-audit-source.patch b/queue-3.18/tty-audit-fix-audit-source.patch new file mode 100644 index 00000000000..e2d06da04c4 --- /dev/null +++ b/queue-3.18/tty-audit-fix-audit-source.patch @@ -0,0 +1,79 @@ +From f89cfa6a6a3c5da233bd9ed75df3062d203029ad Mon Sep 17 00:00:00 2001 +From: Peter Hurley +Date: Sun, 8 Nov 2015 08:52:31 -0500 +Subject: tty: audit: Fix audit source +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 6b2a3d628aa752f0ab825fc6d4d07b09e274d1c1 ] + +The data to audit/record is in the 'from' buffer (ie., the input +read buffer). + +Fixes: 72586c6061ab ("n_tty: Fix auditing support for cannonical mode") +Cc: stable # 4.1+ +Cc: Miloslav Trmač +Signed-off-by: Peter Hurley +Acked-by: Laura Abbott +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/n_tty.c | 2 +- + drivers/tty/tty_audit.c | 2 +- + include/linux/tty.h | 6 +++--- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 0ed99ad74bee..f53682bb30cf 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -195,7 +195,7 @@ static inline int tty_copy_to_user(struct tty_struct *tty, + { + struct n_tty_data *ldata = tty->disc_data; + +- tty_audit_add_data(tty, to, n, ldata->icanon); ++ tty_audit_add_data(tty, from, n, ldata->icanon); + return copy_to_user(to, from, n); + } + +diff --git a/drivers/tty/tty_audit.c b/drivers/tty/tty_audit.c +index 90ca082935f6..3d245cd3d8e6 100644 +--- a/drivers/tty/tty_audit.c ++++ b/drivers/tty/tty_audit.c +@@ -265,7 +265,7 @@ static struct tty_audit_buf *tty_audit_buf_get(struct tty_struct *tty, + * + * Audit @data of @size from @tty, if necessary. + */ +-void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ++void tty_audit_add_data(struct tty_struct *tty, const void *data, + size_t size, unsigned icanon) + { + struct tty_audit_buf *buf; +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 4858a3b79b7a..47d0bfa536e7 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -587,7 +587,7 @@ extern void n_tty_inherit_ops(struct tty_ldisc_ops *ops); + + /* tty_audit.c */ + #ifdef CONFIG_AUDIT +-extern void tty_audit_add_data(struct tty_struct *tty, unsigned char *data, ++extern void tty_audit_add_data(struct tty_struct *tty, const void *data, + size_t size, unsigned icanon); + extern void tty_audit_exit(void); + extern void tty_audit_fork(struct signal_struct *sig); +@@ -595,8 +595,8 @@ extern void tty_audit_tiocsti(struct tty_struct *tty, char ch); + extern void tty_audit_push(struct tty_struct *tty); + extern int tty_audit_push_current(void); + #else +-static inline void tty_audit_add_data(struct tty_struct *tty, +- unsigned char *data, size_t size, unsigned icanon) ++static inline void tty_audit_add_data(struct tty_struct *tty, const void *data, ++ size_t size, unsigned icanon) + { + } + static inline void tty_audit_tiocsti(struct tty_struct *tty, char ch) +-- +2.17.1 + diff --git a/queue-3.18/tty-serial-fsl_lpuart-fix-clearing-of-receive-flag.patch b/queue-3.18/tty-serial-fsl_lpuart-fix-clearing-of-receive-flag.patch new file mode 100644 index 00000000000..fb255f7409e --- /dev/null +++ b/queue-3.18/tty-serial-fsl_lpuart-fix-clearing-of-receive-flag.patch @@ -0,0 +1,50 @@ +From 38a96be4e54195b7c81cb07ea5f0519bb1138772 Mon Sep 17 00:00:00 2001 +From: Stefan Agner +Date: Tue, 19 Jul 2016 13:13:05 +0530 +Subject: tty: serial: fsl_lpuart: fix clearing of receive flag + +[ Upstream commit d68827c62a105eec547945daedf4d1d3e283717d ] + +Commit 8e4934c6d6c6 ("tty: serial: fsl_lpuart: clear receive flag on FIFO +flush") implemented clearing of the receive flag by reading the status register +only. It turned out that even though we flush the FIFO afterwards, a explicit +read of the data register is still required. + +This leads to a FIFO underrun. To avoid this, follow the advice in the overrun +"Operation section": Unconditionally clear RXUF after using RXFLUSH. + +Signed-off-by: Stefan Agner +Signed-off-by: Bhuvanchandra DV +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index af3047d8322a..92b7a5bf7c4d 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -910,13 +910,16 @@ static void lpuart_setup_watermark(struct lpuart_port *sport) + writeb(val | UARTPFIFO_TXFE | UARTPFIFO_RXFE, + sport->port.membase + UARTPFIFO); + +- /* explicitly clear RDRF */ +- readb(sport->port.membase + UARTSR1); +- + /* flush Tx and Rx FIFO */ + writeb(UARTCFIFO_TXFLUSH | UARTCFIFO_RXFLUSH, + sport->port.membase + UARTCFIFO); + ++ /* explicitly clear RDRF */ ++ if (readb(sport->port.membase + UARTSR1) & UARTSR1_RDRF) { ++ readb(sport->port.membase + UARTDR); ++ writeb(UARTSFIFO_RXUF, sport->port.membase + UARTSFIFO); ++ } ++ + writeb(0, sport->port.membase + UARTTWFIFO); + writeb(1, sport->port.membase + UARTRWFIFO); + +-- +2.17.1 + diff --git a/queue-3.18/uas-disable-uas-on-apricorn-sata-dongles.patch b/queue-3.18/uas-disable-uas-on-apricorn-sata-dongles.patch new file mode 100644 index 00000000000..4f26289b9a4 --- /dev/null +++ b/queue-3.18/uas-disable-uas-on-apricorn-sata-dongles.patch @@ -0,0 +1,43 @@ +From efe0b79a52544952898f696449040114ce10e6e1 Mon Sep 17 00:00:00 2001 +From: "Darrick J. Wong" +Date: Thu, 11 Dec 2014 11:01:11 -0800 +Subject: uas: disable UAS on Apricorn SATA dongles + +[ Upstream commit 36d1ffdb210ec2d0d6a69e9f6466ae8727d34119 ] + +The Apricorn SATA dongle will occasionally return "USBSUSBSUSB" in +response to SCSI commands when running in UAS mode. Therefore, +disable UAS mode on this dongle. + +Signed-off-by: Darrick J. Wong +Acked-by: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/storage/unusual_uas.h | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index baf671aef9d0..31c79b1f970e 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -40,6 +40,16 @@ + * and don't forget to CC: the USB development list + */ + ++/* ++ * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI ++ * commands in UAS mode. Observed with the 1.28 firmware; are there others? ++ */ ++UNUSUAL_DEV(0x0984, 0x0301, 0x0128, 0x0128, ++ "Apricorn", ++ "", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_IGNORE_UAS), ++ + /* https://bugzilla.kernel.org/show_bug.cgi?id=79511 */ + UNUSUAL_DEV(0x0bc2, 0x2312, 0x0000, 0x9999, + "Seagate", +-- +2.17.1 + diff --git a/queue-3.18/unix-correctly-track-in-flight-fds-in-sending-proces.patch b/queue-3.18/unix-correctly-track-in-flight-fds-in-sending-proces.patch new file mode 100644 index 00000000000..aefcba2df65 --- /dev/null +++ b/queue-3.18/unix-correctly-track-in-flight-fds-in-sending-proces.patch @@ -0,0 +1,161 @@ +From f6379e4f39e6e6433d9f69df119c3d6cfa6db33e Mon Sep 17 00:00:00 2001 +From: Hannes Frederic Sowa +Date: Wed, 3 Feb 2016 02:11:03 +0100 +Subject: unix: correctly track in-flight fds in sending process user_struct + +[ Upstream commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 ] + +The commit referenced in the Fixes tag incorrectly accounted the number +of in-flight fds over a unix domain socket to the original opener +of the file-descriptor. This allows another process to arbitrary +deplete the original file-openers resource limit for the maximum of +open files. Instead the sending processes and its struct cred should +be credited. + +To do so, we add a reference counted struct user_struct pointer to the +scm_fp_list and use it to account for the number of inflight unix fds. + +Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets") +Reported-by: David Herrmann +Cc: David Herrmann +Cc: Willy Tarreau +Cc: Linus Torvalds +Suggested-by: Linus Torvalds +Signed-off-by: Hannes Frederic Sowa +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/af_unix.h | 4 ++-- + include/net/scm.h | 1 + + net/core/scm.c | 7 +++++++ + net/unix/af_unix.c | 4 ++-- + net/unix/garbage.c | 8 ++++---- + 5 files changed, 16 insertions(+), 8 deletions(-) + +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index e830c3dff61a..7bb69c9c3c43 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -6,8 +6,8 @@ + #include + #include + +-void unix_inflight(struct file *fp); +-void unix_notinflight(struct file *fp); ++void unix_inflight(struct user_struct *user, struct file *fp); ++void unix_notinflight(struct user_struct *user, struct file *fp); + void unix_gc(void); + void wait_for_unix_gc(void); + struct sock *unix_get_socket(struct file *filp); +diff --git a/include/net/scm.h b/include/net/scm.h +index 262532d111f5..59fa93c01d2a 100644 +--- a/include/net/scm.h ++++ b/include/net/scm.h +@@ -21,6 +21,7 @@ struct scm_creds { + struct scm_fp_list { + short count; + short max; ++ struct user_struct *user; + struct file *fp[SCM_MAX_FD]; + }; + +diff --git a/net/core/scm.c b/net/core/scm.c +index d30eb057fa7b..cad57a1390dd 100644 +--- a/net/core/scm.c ++++ b/net/core/scm.c +@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) + *fplp = fpl; + fpl->count = 0; + fpl->max = SCM_MAX_FD; ++ fpl->user = NULL; + } + fpp = &fpl->fp[fpl->count]; + +@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) + *fpp++ = file; + fpl->count++; + } ++ ++ if (!fpl->user) ++ fpl->user = get_uid(current_user()); ++ + return num; + } + +@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm) + scm->fp = NULL; + for (i=fpl->count-1; i>=0; i--) + fput(fpl->fp[i]); ++ free_uid(fpl->user); + kfree(fpl); + } + } +@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) + for (i = 0; i < fpl->count; i++) + get_file(fpl->fp[i]); + new_fpl->max = new_fpl->count; ++ new_fpl->user = get_uid(fpl->user); + } + return new_fpl; + } +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 29b1f4dc48ca..1bd4ba6b6aa4 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -1469,7 +1469,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) + UNIXCB(skb).fp = NULL; + + for (i = scm->fp->count-1; i >= 0; i--) +- unix_notinflight(scm->fp->fp[i]); ++ unix_notinflight(scm->fp->user, scm->fp->fp[i]); + } + + static void unix_destruct_scm(struct sk_buff *skb) +@@ -1534,7 +1534,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) + return -ENOMEM; + + for (i = scm->fp->count - 1; i >= 0; i--) +- unix_inflight(scm->fp->fp[i]); ++ unix_inflight(scm->fp->user, scm->fp->fp[i]); + return max_level; + } + +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index 58783dcfd35d..1105a60468ac 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file *filp) + * descriptor if it is for an AF_UNIX socket. + */ + +-void unix_inflight(struct file *fp) ++void unix_inflight(struct user_struct *user, struct file *fp) + { + struct sock *s = unix_get_socket(fp); + +@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp) + } + unix_tot_inflight++; + } +- fp->f_cred->user->unix_inflight++; ++ user->unix_inflight++; + spin_unlock(&unix_gc_lock); + } + +-void unix_notinflight(struct file *fp) ++void unix_notinflight(struct user_struct *user, struct file *fp) + { + struct sock *s = unix_get_socket(fp); + +@@ -158,7 +158,7 @@ void unix_notinflight(struct file *fp) + list_del_init(&u->link); + unix_tot_inflight--; + } +- fp->f_cred->user->unix_inflight--; ++ user->unix_inflight--; + spin_unlock(&unix_gc_lock); + } + +-- +2.17.1 + diff --git a/queue-3.18/usb-dwc2-gadget-kill-requests-with-force-in-s3c_hsot.patch b/queue-3.18/usb-dwc2-gadget-kill-requests-with-force-in-s3c_hsot.patch new file mode 100644 index 00000000000..2ae7d0f7756 --- /dev/null +++ b/queue-3.18/usb-dwc2-gadget-kill-requests-with-force-in-s3c_hsot.patch @@ -0,0 +1,110 @@ +From 1a2232bf578897ab25f0cef4fe4f6de64146c86e Mon Sep 17 00:00:00 2001 +From: Robert Baldyga +Date: Tue, 9 Dec 2014 14:41:45 +0100 +Subject: usb: dwc2: gadget: kill requests with 'force' in s3c_hsotg_udc_stop() + +[ Upstream commit 62f4f0651ce8ef966a0e5b6db6a7a524c268fdd2 ] + +This makes us sure that all requests are completed before we unbind +gadget. There are assumptions in gadget API that all requests have to +be completed and leak of complete can break some usb function drivers. + +For example unbind of ECM function can cause NULL pointer dereference: + +[ 26.396595] configfs-gadget gadget: unbind function +'cdc_ethernet'/e79c4c00 +[ 26.414999] Unable to handle kernel NULL pointer dereference at +virtual address 00000000 +(...) +[ 26.452223] PC is at ecm_unbind+0x6c/0x9c +[ 26.456209] LR is at ecm_unbind+0x68/0x9c +(...) +[ 26.603696] [] (ecm_unbind) from [] +(purge_configs_funcs+0x94/0xd8) +[ 26.611674] [] (purge_configs_funcs) from [] +(configfs_composite_unbind+0x14/0x34) +[ 26.620961] [] (configfs_composite_unbind) from +[] (usb_gadget_remove_driver+0x68/0x9c) +[ 26.630683] [] (usb_gadget_remove_driver) from [] +(usb_gadget_unregister_driver+0x64/0x94) +[ 26.640664] [] (usb_gadget_unregister_driver) from +[] (unregister_gadget+0x20/0x3c) +[ 26.650038] [] (unregister_gadget) from [] +(gadget_dev_desc_UDC_store+0x80/0xb8) +[ 26.659152] [] (gadget_dev_desc_UDC_store) from +[] (gadget_info_attr_store+0x1c/0x28) +[ 26.668703] [] (gadget_info_attr_store) from [] +(configfs_write_file+0xe8/0x148) +[ 26.677818] [] (configfs_write_file) from [] +(vfs_write+0xb0/0x1a0) +[ 26.685801] [] (vfs_write) from [] +(SyS_write+0x44/0x84) +[ 26.692834] [] (SyS_write) from [] +(ret_fast_syscall+0x0/0x30) +[ 26.700381] Code: e30409f8 e34c0069 eb07b88d e59430a8 (e5930000) +[ 26.706485] ---[ end trace f62a082b323838a2 ]--- + +It's because in some cases request is still running on endpoint during +unbind and kill_all_requests() called from s3c_hsotg_udc_stop() function +doesn't cause call of complete() of request. Missing complete() call +causes ecm->notify_req equals NULL in ecm_unbind() function, and this +is reason of this bug. + +Similar breaks can be observed in another usb function drivers. + +This patch fixes this bug forcing usb request completion in when +s3c_hsotg_ep_disable() is called from s3c_hsotg_udc_stop(). + +Acked-by: Paul Zimmerman +Signed-off-by: Robert Baldyga +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 8b5c079c7b7d..cb4c925fb87c 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -2590,7 +2590,7 @@ error: + * s3c_hsotg_ep_disable - disable given endpoint + * @ep: The endpoint to disable. + */ +-static int s3c_hsotg_ep_disable(struct usb_ep *ep) ++static int s3c_hsotg_ep_disable_force(struct usb_ep *ep, bool force) + { + struct s3c_hsotg_ep *hs_ep = our_ep(ep); + struct s3c_hsotg *hsotg = hs_ep->parent; +@@ -2611,7 +2611,7 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep) + + spin_lock_irqsave(&hsotg->lock, flags); + /* terminate all requests with shutdown */ +- kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, false); ++ kill_all_requests(hsotg, hs_ep, -ESHUTDOWN, force); + + hsotg->fifo_map &= ~(1<fifo_index); + hs_ep->fifo_index = 0; +@@ -2632,6 +2632,10 @@ static int s3c_hsotg_ep_disable(struct usb_ep *ep) + return 0; + } + ++static int s3c_hsotg_ep_disable(struct usb_ep *ep) ++{ ++ return s3c_hsotg_ep_disable_force(ep, false); ++} + /** + * on_list - check request is on the given endpoint + * @ep: The endpoint to check. +@@ -2933,7 +2937,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget, + + /* all endpoints should be shutdown */ + for (ep = 1; ep < hsotg->num_of_eps; ep++) +- s3c_hsotg_ep_disable(&hsotg->eps[ep].ep); ++ s3c_hsotg_ep_disable_force(&hsotg->eps[ep].ep, true); + + spin_lock_irqsave(&hsotg->lock, flags); + +-- +2.17.1 + diff --git a/queue-3.18/usb-ehci-adjust-error-return-code.patch b/queue-3.18/usb-ehci-adjust-error-return-code.patch new file mode 100644 index 00000000000..4d1fe1b53c2 --- /dev/null +++ b/queue-3.18/usb-ehci-adjust-error-return-code.patch @@ -0,0 +1,47 @@ +From 4d3d5e236027c2da59ade274ec058bb487c63d73 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Thu, 4 Dec 2014 10:22:57 -0500 +Subject: USB: EHCI: adjust error return code + +[ Upstream commit c401e7b4a808d50ab53ef45cb8d0b99b238bf2c9 ] + +The USB stack uses error code -ENOSPC to indicate that the periodic +schedule is too full, with insufficient bandwidth to accommodate a new +allocation. It uses -EFBIG to indicate that an isochronous transfer +could not be linked into the schedule because it would exceed the +number of isochronous packets the host controller driver can handle +(generally because the new transfer would extend too far into the +future). + +ehci-hcd uses the wrong error code at one point. This patch fixes it, +along with a misleading comment and debugging message. + +Signed-off-by: Alan Stern +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-sched.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c +index c399606f154e..f9a332775c47 100644 +--- a/drivers/usb/host/ehci-sched.c ++++ b/drivers/usb/host/ehci-sched.c +@@ -1604,11 +1604,11 @@ iso_stream_schedule ( + */ + now2 = (now - base) & (mod - 1); + +- /* Is the schedule already full? */ ++ /* Is the schedule about to wrap around? */ + if (unlikely(!empty && start < period)) { +- ehci_dbg(ehci, "iso sched full %p (%u-%u < %u mod %u)\n", ++ ehci_dbg(ehci, "request %p would overflow (%u-%u < %u mod %u)\n", + urb, stream->next_uframe, base, period, mod); +- status = -ENOSPC; ++ status = -EFBIG; + goto fail; + } + +-- +2.17.1 + diff --git a/queue-3.18/usb-gadget-f_uac1-access-freed-memory-at-f_audio_fre.patch b/queue-3.18/usb-gadget-f_uac1-access-freed-memory-at-f_audio_fre.patch new file mode 100644 index 00000000000..91eb79a1180 --- /dev/null +++ b/queue-3.18/usb-gadget-f_uac1-access-freed-memory-at-f_audio_fre.patch @@ -0,0 +1,123 @@ +From 0d684de5a27b7c022f92795ace572b3bc120b90c Mon Sep 17 00:00:00 2001 +From: Peter Chen +Date: Mon, 1 Dec 2014 16:09:27 +0800 +Subject: usb: gadget: f_uac1: access freed memory at f_audio_free_inst + +[ Upstream commit 4fde6204df052bb89ba3d915ed6ed9f306f3cfa1 ] + +At f_audio_free_inst, it tries to access struct gaudio *card which is +freed at f_audio_free, it causes below oops if the audio device is not +there (do unload module may trigger the same problem). The gaudio_cleanup +is related to function, so it is better move to f_audio_free. + +root@freescale ~$ modprobe g_audio +[ 751.968931] g_audio gadget: unable to open sound control device file: /dev/snd/controlC0 +[ 751.977134] g_audio gadget: we need at least one control device +[ 751.988633] Unable to handle kernel paging request at virtual address 455f448e +[ 751.995963] pgd = bd42c000 +[ 751.998681] [455f448e] *pgd=00000000 +[ 752.002383] Internal error: Oops: 5 [#1] SMP ARM +[ 752.007008] Modules linked in: usb_f_uac1 g_audio(+) usb_f_mass_storage libcomposite configfs [last unloaded: g_mass_storage] +[ 752.018427] CPU: 0 PID: 692 Comm: modprobe Not tainted 3.18.0-rc4-00345-g842f57b #10 +[ 752.026176] task: bdb3ba80 ti: bd41a000 task.ti: bd41a000 +[ 752.031590] PC is at filp_close+0xc/0x84 +[ 752.035530] LR is at gaudio_cleanup+0x28/0x54 [usb_f_uac1] +[ 752.041023] pc : [<800ec94c>] lr : [<7f03c63c>] psr: 20000013 +[ 752.041023] sp : bd41bcc8 ip : bd41bce8 fp : bd41bce4 +[ 752.052504] r10: 7f036234 r9 : 7f036220 r8 : 7f036500 +[ 752.057732] r7 : bd456480 r6 : 7f036500 r5 : 7f03626c r4 : bd441000 +[ 752.064264] r3 : 7f03b3dc r2 : 7f03cab0 r1 : 00000000 r0 : 455f4456 +[ 752.070798] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user +[ 752.077938] Control: 10c5387d Table: bd42c04a DAC: 00000015 +[ 752.083688] Process modprobe (pid: 692, stack limit = 0xbd41a240) +[ 752.089786] Stack: (0xbd41bcc8 to 0xbd41c000) +[ 752.094152] bcc0: 7f03b3dc bd441000 7f03626c 7f036500 bd41bcfc bd41bce8 +[ 752.102337] bce0: 7f03c63c 800ec94c 7f03b3dc bdaa6b00 bd41bd14 bd41bd00 7f03b3f4 7f03c620 +[ 752.110521] bd00: 7f03b3dc 7f03cbd4 bd41bd2c bd41bd18 7f00f88c 7f03b3e8 00000000 fffffffe +[ 752.118705] bd20: bd41bd5c bd41bd30 7f0380d8 7f00f874 7f038000 bd456480 7f036364 be392240 +[ 752.126889] bd40: 00000000 7f00f620 7f00f638 bd41a008 bd41bd94 bd41bd60 7f00f6d4 7f03800c +[ 752.135073] bd60: 00000001 00000000 8047438c be3a4000 7f036364 7f036364 7f00db28 7f00f620 +[ 752.143257] bd80: 7f00f638 bd41a008 bd41bdb4 bd41bd98 804742ac 7f00f644 00000000 809adde0 +[ 752.151442] bda0: 7f036364 7f036364 bd41bdcc bd41bdb8 804743c8 80474284 7f03633c 7f036200 +[ 752.159626] bdc0: bd41bdf4 bd41bdd0 7f00d5b4 8047435c bd41a000 80974060 7f038158 00000000 +[ 752.167811] bde0: 80974060 bdaa9940 bd41be04 bd41bdf8 7f03816c 7f00d518 bd41be8c bd41be08 +[ 752.175995] be00: 80008a5c 7f038164 be001f00 7f0363c4 bd41bf48 00000000 bd41be54 bd41be28 +[ 752.184179] be20: 800e9498 800e8e74 00000002 00000003 bd4129c0 c0a07000 00000001 7f0363c4 +[ 752.192363] be40: bd41bf48 00000000 bd41be74 bd41be58 800de780 800e9320 bd41a000 7f0363d0 +[ 752.200547] be60: 00000000 bd41a000 7f0363d0 00000000 bd41beec 7f0363c4 bd41bf48 00000000 +[ 752.208731] be80: bd41bf44 bd41be90 80093e54 800089e0 ffff8000 00007fff 80091390 0000065f +[ 752.216915] bea0: 00000000 c0a0834c bd41bf7c 00000086 bd41bf50 00000000 7f03651c 00000086 +[ 752.225099] bec0: bd41a010 00c28758 800ddcc4 800ddae0 000000d2 bd412a00 bd41bf24 00000000 +[ 752.233283] bee0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 752.241467] bf00: 00000000 00000000 00000000 00000000 00000000 00000000 bd41bf44 000025b0 +[ 752.249651] bf20: 00c28a08 00c28758 00000080 8000edc4 bd41a000 00000000 bd41bfa4 bd41bf48 +[ 752.257835] bf40: 800943e4 800932ec c0a07000 000025b0 c0a07f8c c0a07ea4 c0a08e5c 0000051c +[ 752.266019] bf60: 0000088c 00000000 00000000 00000000 00000018 00000019 00000010 0000000b +[ 752.274203] bf80: 00000009 00000000 00000000 000025b0 00000000 00c28758 00000000 bd41bfa8 +[ 752.282387] bfa0: 8000ec00 8009430c 000025b0 00000000 00c28a08 000025b0 00c28758 00c28980 +[ 752.290571] bfc0: 000025b0 00000000 00c28758 00000080 000a6a78 00000007 00c28718 00c28980 +[ 752.298756] bfe0: 7ebc1af0 7ebc1ae0 0001a32c 76e9c490 60000010 00c28a08 22013510 ecebffff +[ 752.306933] Backtrace: +[ 752.309414] [<800ec940>] (filp_close) from [<7f03c63c>] (gaudio_cleanup+0x28/0x54 [usb_f_uac1]) +[ 752.318115] r6:7f036500 r5:7f03626c r4:bd441000 r3:7f03b3dc +[ 752.323851] [<7f03c614>] (gaudio_cleanup [usb_f_uac1]) from [<7f03b3f4>] (f_audio_free_inst+0x18/0x68 [usb_f_uac1]) +[ 752.334288] r4:bdaa6b00 r3:7f03b3dc +[ 752.337931] [<7f03b3dc>] (f_audio_free_inst [usb_f_uac1]) from [<7f00f88c>] (usb_put_function_instance+0x24/0x30 [libcomposite]) +[ 752.349498] r4:7f03cbd4 r3:7f03b3dc +[ 752.353127] [<7f00f868>] (usb_put_function_instance [libcomposite]) from [<7f0380d8>] (audio_bind+0xd8/0xfc [g_audio]) +[ 752.363824] r4:fffffffe r3:00000000 +[ 752.367456] [<7f038000>] (audio_bind [g_audio]) from [<7f00f6d4>] (composite_bind+0x9c/0x1e8 [libcomposite]) +[ 752.377284] r10:bd41a008 r9:7f00f638 r8:7f00f620 r7:00000000 r6:be392240 r5:7f036364 +[ 752.385193] r4:bd456480 r3:7f038000 +[ 752.388825] [<7f00f638>] (composite_bind [libcomposite]) from [<804742ac>] (udc_bind_to_driver+0x34/0xd8) +[ 752.398394] r10:bd41a008 r9:7f00f638 r8:7f00f620 r7:7f00db28 r6:7f036364 r5:7f036364 +[ 752.406302] r4:be3a4000 +[ 752.408860] [<80474278>] (udc_bind_to_driver) from [<804743c8>] (usb_gadget_probe_driver+0x78/0xa8) +[ 752.417908] r6:7f036364 r5:7f036364 r4:809adde0 r3:00000000 +[ 752.423649] [<80474350>] (usb_gadget_probe_driver) from [<7f00d5b4>] (usb_composite_probe+0xa8/0xd4 [libcomposite]) +[ 752.434086] r5:7f036200 r4:7f03633c +[ 752.437713] [<7f00d50c>] (usb_composite_probe [libcomposite]) from [<7f03816c>] (audio_driver_init+0x14/0x1c [g_audio]) +[ 752.448498] r9:bdaa9940 r8:80974060 r7:00000000 r6:7f038158 r5:80974060 r4:bd41a000 +[ 752.456330] [<7f038158>] (audio_driver_init [g_audio]) from [<80008a5c>] (do_one_initcall+0x88/0x1d4) +[ 752.465564] [<800089d4>] (do_one_initcall) from [<80093e54>] (load_module+0xb74/0x1020) +[ 752.473571] r10:00000000 r9:bd41bf48 r8:7f0363c4 r7:bd41beec r6:00000000 r5:7f0363d0 +[ 752.481478] r4:bd41a000 +[ 752.484037] [<800932e0>] (load_module) from [<800943e4>] (SyS_init_module+0xe4/0xf8) +[ 752.491781] r10:00000000 r9:bd41a000 r8:8000edc4 r7:00000080 r6:00c28758 r5:00c28a08 +[ 752.499689] r4:000025b0 +[ 752.502252] [<80094300>] (SyS_init_module) from [<8000ec00>] (ret_fast_syscall+0x0/0x48) +[ 752.510345] r6:00c28758 r5:00000000 r4:000025b0 +[ 752.515013] Code: 808475b4 e1a0c00d e92dd878 e24cb004 (e5904038) +[ 752.521223] ---[ end trace 70babe34de4ab99b ]--- +Segmentation fault + +Signed-off-by: Peter Chen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_uac1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_uac1.c b/drivers/usb/gadget/function/f_uac1.c +index f7b203293205..e9715845f82e 100644 +--- a/drivers/usb/gadget/function/f_uac1.c ++++ b/drivers/usb/gadget/function/f_uac1.c +@@ -897,7 +897,6 @@ static void f_audio_free_inst(struct usb_function_instance *f) + struct f_uac1_opts *opts; + + opts = container_of(f, struct f_uac1_opts, func_inst); +- gaudio_cleanup(opts->card); + if (opts->fn_play_alloc) + kfree(opts->fn_play); + if (opts->fn_cap_alloc) +@@ -935,6 +934,7 @@ static void f_audio_free(struct usb_function *f) + struct f_audio *audio = func_to_audio(f); + struct f_uac1_opts *opts; + ++ gaudio_cleanup(&audio->card); + opts = container_of(f->fi, struct f_uac1_opts, func_inst); + kfree(audio); + mutex_lock(&opts->lock); +-- +2.17.1 + diff --git a/queue-3.18/usb-gadget-gadgetfs-fix-an-oops-in-ep_write.patch b/queue-3.18/usb-gadget-gadgetfs-fix-an-oops-in-ep_write.patch new file mode 100644 index 00000000000..e98f5cb08e4 --- /dev/null +++ b/queue-3.18/usb-gadget-gadgetfs-fix-an-oops-in-ep_write.patch @@ -0,0 +1,32 @@ +From e950bdf0fc69da545be135163071d2206e4e1bd2 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 6 Jan 2015 13:19:21 +0300 +Subject: usb: gadget: gadgetfs: fix an oops in ep_write() + +[ Upstream commit 42d6cfa0caec4b68a7f17147fbf13a36e94a8bf2 ] + +We try to free an ERR_PTR on this error path. + +Fixes: b44be2462dbe ('usb: gadget: gadgetfs: Free memory allocated by memdup_user()') +Signed-off-by: Dan Carpenter +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index e2d57e3d67c7..7974956e8ded 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -442,6 +442,7 @@ ep_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + kbuf = memdup_user(buf, len); + if (IS_ERR(kbuf)) { + value = PTR_ERR(kbuf); ++ kbuf = NULL; + goto free1; + } + +-- +2.17.1 + diff --git a/queue-3.18/usb-host-ehci-tegra-request-deferred-probe-when-fail.patch b/queue-3.18/usb-host-ehci-tegra-request-deferred-probe-when-fail.patch new file mode 100644 index 00000000000..1a2af45608e --- /dev/null +++ b/queue-3.18/usb-host-ehci-tegra-request-deferred-probe-when-fail.patch @@ -0,0 +1,36 @@ +From 6dd07b00fc418d5e2b2d32927b7623cad08e71aa Mon Sep 17 00:00:00 2001 +From: Vince Hsu +Date: Wed, 24 Dec 2014 18:16:30 +0800 +Subject: usb: host: ehci-tegra: request deferred probe when failing to get phy + +[ Upstream commit f56e67f0a880a5b795cdb5f62614aafe264c5304 ] + +The commit 1290a958d48e ("usb: phy: propagate __of_usb_find_phy()'s error on +failure") changed the condition to return -EPROBE_DEFER to host driver. +Originally the Tegra host driver depended on the returned -EPROBE_DEFER to +get the phy device later when booting. Now we have to do that explicitly. + +Signed-off-by: Vince Hsu +Tested-by: Tomeu Vizoso +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-tegra.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c +index aad253559bcd..b4cc4c90b8e3 100644 +--- a/drivers/usb/host/ehci-tegra.c ++++ b/drivers/usb/host/ehci-tegra.c +@@ -451,7 +451,7 @@ static int tegra_ehci_probe(struct platform_device *pdev) + + u_phy = devm_usb_get_phy_by_phandle(&pdev->dev, "nvidia,phy", 0); + if (IS_ERR(u_phy)) { +- err = PTR_ERR(u_phy); ++ err = -EPROBE_DEFER; + goto cleanup_clk_en; + } + hcd->usb_phy = u_phy; +-- +2.17.1 + diff --git a/queue-3.18/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch b/queue-3.18/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch new file mode 100644 index 00000000000..b55a3df03e3 --- /dev/null +++ b/queue-3.18/usb-hub-fix-up-early-exit-pathway-in-hub_activate.patch @@ -0,0 +1,67 @@ +From 50da2eb257c379fc61920a0625e962a84e45d706 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Fri, 5 Aug 2016 11:49:45 -0400 +Subject: USB: hub: fix up early-exit pathway in hub_activate + +[ Upstream commit ca5cbc8b02f9b21cc8cd1ab36668763ec34f9ee8 ] + +The early-exit pathway in hub_activate, added by commit e50293ef9775 +("USB: fix invalid memory access in hub_activate()") needs +improvement. It duplicates code that is already present at the end of +the subroutine, and it neglects to undo the effect of a +usb_autopm_get_interface_no_resume() call. + +This patch fixes both problems by making the early-exit pathway jump +directly to the end of the subroutine. It simplifies the code at the +end by merging two conditionals that actually test the same condition +although they appear different: If type < HUB_INIT3 then type must be +either HUB_INIT2 or HUB_INIT, and it can't be HUB_INIT because in that +case the subroutine would have exited earlier. + +Signed-off-by: Alan Stern +CC: #4.4+ +Reviewed-by: Viresh Kumar +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/hub.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 164fdeddfc05..9a47a9c8ebb4 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1000,11 +1000,8 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + device_lock(hub->intfdev); + + /* Was the hub disconnected while we were waiting? */ +- if (hub->disconnected) { +- device_unlock(hub->intfdev); +- kref_put(&hub->kref, hub_release); +- return; +- } ++ if (hub->disconnected) ++ goto disconnected; + if (type == HUB_INIT2) + goto init2; + goto init3; +@@ -1230,12 +1227,12 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + /* Scan all ports that need attention */ + kick_hub_wq(hub); + +- /* Allow autosuspend if it was suppressed */ +- if (type <= HUB_INIT3) ++ if (type == HUB_INIT2 || type == HUB_INIT3) { ++ /* Allow autosuspend if it was suppressed */ ++ disconnected: + usb_autopm_put_interface_async(to_usb_interface(hub->intfdev)); +- +- if (type == HUB_INIT2 || type == HUB_INIT3) + device_unlock(hub->intfdev); ++ } + + kref_put(&hub->kref, hub_release); + } +-- +2.17.1 + diff --git a/queue-3.18/usb-musb-fix-a-few-off-by-one-lengths.patch b/queue-3.18/usb-musb-fix-a-few-off-by-one-lengths.patch new file mode 100644 index 00000000000..d7a2cebf0f4 --- /dev/null +++ b/queue-3.18/usb-musb-fix-a-few-off-by-one-lengths.patch @@ -0,0 +1,86 @@ +From 24e994f555e515ef7e7ef0e20d49254843d38908 Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Thu, 27 Nov 2014 22:25:45 +0100 +Subject: usb: musb: Fix a few off-by-one lengths + +[ Upstream commit e87c3f80ad0490d26ffe04754b7d094463b40f30 ] + +!strncmp(buf, "force host", 9) is true if and only if buf starts with +"force hos". This was obviously not what was intended. The same error +exists for "force full-speed", "force high-speed" and "test +packet". Using strstarts avoids the error-prone hardcoding of the +prefix length. + +For consistency, also change the other occurences of the !strncmp +idiom. + +Signed-off-by: Rasmus Villemoes +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/musb_cppi41.c | 4 ++-- + drivers/usb/musb/musb_debugfs.c | 16 ++++++++-------- + 2 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c +index 2a535b70af21..3d69971156ea 100644 +--- a/drivers/usb/musb/musb_cppi41.c ++++ b/drivers/usb/musb/musb_cppi41.c +@@ -629,9 +629,9 @@ static int cppi41_dma_controller_start(struct cppi41_dma_controller *controller) + ret = of_property_read_string_index(np, "dma-names", i, &str); + if (ret) + goto err; +- if (!strncmp(str, "tx", 2)) ++ if (strstarts(str, "tx")) + is_tx = 1; +- else if (!strncmp(str, "rx", 2)) ++ else if (strstarts(str, "rx")) + is_tx = 0; + else { + dev_err(dev, "Wrong dmatype %s\n", str); +diff --git a/drivers/usb/musb/musb_debugfs.c b/drivers/usb/musb/musb_debugfs.c +index 4c216790e86b..05d1b203f0d0 100644 +--- a/drivers/usb/musb/musb_debugfs.c ++++ b/drivers/usb/musb/musb_debugfs.c +@@ -194,30 +194,30 @@ static ssize_t musb_test_mode_write(struct file *file, + if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count))) + return -EFAULT; + +- if (!strncmp(buf, "force host", 9)) ++ if (strstarts(buf, "force host")) + test = MUSB_TEST_FORCE_HOST; + +- if (!strncmp(buf, "fifo access", 11)) ++ if (strstarts(buf, "fifo access")) + test = MUSB_TEST_FIFO_ACCESS; + +- if (!strncmp(buf, "force full-speed", 15)) ++ if (strstarts(buf, "force full-speed")) + test = MUSB_TEST_FORCE_FS; + +- if (!strncmp(buf, "force high-speed", 15)) ++ if (strstarts(buf, "force high-speed")) + test = MUSB_TEST_FORCE_HS; + +- if (!strncmp(buf, "test packet", 10)) { ++ if (strstarts(buf, "test packet")) { + test = MUSB_TEST_PACKET; + musb_load_testpacket(musb); + } + +- if (!strncmp(buf, "test K", 6)) ++ if (strstarts(buf, "test K")) + test = MUSB_TEST_K; + +- if (!strncmp(buf, "test J", 6)) ++ if (strstarts(buf, "test J")) + test = MUSB_TEST_J; + +- if (!strncmp(buf, "test SE0 NAK", 12)) ++ if (strstarts(buf, "test SE0 NAK")) + test = MUSB_TEST_SE0_NAK; + + musb_writeb(musb->mregs, MUSB_TESTMODE, test); +-- +2.17.1 + diff --git a/queue-3.18/usb-musb-fix-randconfig-build-issues-for-kconfig-opt.patch b/queue-3.18/usb-musb-fix-randconfig-build-issues-for-kconfig-opt.patch new file mode 100644 index 00000000000..13cf041da95 --- /dev/null +++ b/queue-3.18/usb-musb-fix-randconfig-build-issues-for-kconfig-opt.patch @@ -0,0 +1,71 @@ +From 3f295c54c0b88640a6535c79b358a968725622c0 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Mon, 1 Dec 2014 11:10:15 -0800 +Subject: usb: musb: Fix randconfig build issues for Kconfig options + +[ Upstream commit c0442479652b99b62dd1ffccb34231caff25751c ] + +Commit 82c02f58ba3a ("usb: musb: Allow multiple glue layers to be +built in") enabled selecting multiple glue layers, which in turn +exposed things more for randconfig builds. If NOP_USB_XCEIV is +built-in and TUSB6010 is a loadable module, we will get: + +drivers/built-in.o: In function `tusb_remove': +tusb6010.c:(.text+0x16a817): undefined reference to `usb_phy_generic_unregister' +drivers/built-in.o: In function `tusb_probe': +tusb6010.c:(.text+0x16b24e): undefined reference to `usb_phy_generic_register' +make: *** [vmlinux] Error 1 + +Let's fix this the same way as commit 70c1ff4b3c86 ("usb: musb: +tusb-dma can't be built-in if tusb is not"). + +And while at it, let's not allow selecting the glue layers except +on platforms really using them unless COMPILE_TEST is specified: + +- TUSB6010 is in practise only used on omaps + +- DSPS is only used on TI platforms + +- UX500 is only used on STE platforms + +Cc: Linus Walleij +Reported-by: Jim Davis +Signed-off-by: Tony Lindgren +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/Kconfig | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig +index dbc56eb5eee4..5ab24cd38f37 100644 +--- a/drivers/usb/musb/Kconfig ++++ b/drivers/usb/musb/Kconfig +@@ -73,6 +73,8 @@ config USB_MUSB_DA8XX + + config USB_MUSB_TUSB6010 + tristate "TUSB6010" ++ depends on ARCH_OMAP2PLUS || COMPILE_TEST ++ depends on NOP_USB_XCEIV = USB_MUSB_HDRC # both built-in or both modules + + config USB_MUSB_OMAP2PLUS + tristate "OMAP2430 and onwards" +@@ -86,6 +88,7 @@ config USB_MUSB_AM35X + config USB_MUSB_DSPS + tristate "TI DSPS platforms" + select USB_MUSB_AM335X_CHILD ++ depends on ARCH_OMAP2PLUS || COMPILE_TEST + depends on OF_IRQ + + config USB_MUSB_BLACKFIN +@@ -94,6 +97,7 @@ config USB_MUSB_BLACKFIN + + config USB_MUSB_UX500 + tristate "Ux500 platforms" ++ depends on ARCH_U8500 || COMPILE_TEST + + config USB_MUSB_JZ4740 + tristate "JZ4740" +-- +2.17.1 + diff --git a/queue-3.18/usb-qcserial-fix-support-for-hp-lt4112-lte-hspa-gobi.patch b/queue-3.18/usb-qcserial-fix-support-for-hp-lt4112-lte-hspa-gobi.patch new file mode 100644 index 00000000000..fd4b1b281a3 --- /dev/null +++ b/queue-3.18/usb-qcserial-fix-support-for-hp-lt4112-lte-hspa-gobi.patch @@ -0,0 +1,110 @@ +From 18958aa10bc94ead18884bba371c9489b6090246 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= +Date: Mon, 16 Nov 2015 13:15:46 +0100 +Subject: USB: qcserial: Fix support for HP lt4112 LTE/HSPA+ Gobi 4G Modem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 59536da34513c594af2a6fd35ba65ea45b6960a1 ] + +The DEVICE_HWI type was added under the faulty assumption that Huawei +devices based on Qualcomm chipsets and firmware use the static USB +interface numbering known from Gobi devices. But this model does +not apply to Huawei devices like the HP branded lt4112 (Huawei me906e). +Huawei firmwares will dynamically assign interface numbers. Functions +are renumbered when the firmware is reconfigured. + +Fix by changing the DEVICE_HWI type to use a simplified version +of Huawei's subclass + protocol scheme: Blacklisting known network +interface combinations and assuming the rest are serial. + +Reported-and-tested-by: Muri Nicanor +Tested-by: Martin Hauke +Cc: +Fixes: e7181d005e84 ("USB: qcserial: Add support for HP lt4112 LTE/HSPA+ Gobi 4G Modem") +Signed-off-by: Bjørn Mork +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/qcserial.c | 54 ++++++++++++++++++++++------------- + 1 file changed, 34 insertions(+), 20 deletions(-) + +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index adc372411019..7e8014304b33 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -190,6 +190,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + __u8 ifnum; + int altsetting = -1; + ++ /* we only support vendor specific functions */ ++ if (intf->desc.bInterfaceClass != USB_CLASS_VENDOR_SPEC) ++ goto done; ++ + nintf = serial->dev->actconfig->desc.bNumInterfaces; + dev_dbg(dev, "Num Interfaces = %d\n", nintf); + ifnum = intf->desc.bInterfaceNumber; +@@ -309,29 +313,39 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + break; + case QCSERIAL_HWI: + /* +- * Huawei layout: +- * 0: AT-capable modem port +- * 1: DM/DIAG +- * 2: AT-capable modem port +- * 3: CCID-compatible PCSC interface +- * 4: QMI/net +- * 5: NMEA ++ * Huawei devices map functions by subclass + protocol ++ * instead of interface numbers. The protocol identify ++ * a specific function, while the subclass indicate a ++ * specific firmware source ++ * ++ * This is a blacklist of functions known to be ++ * non-serial. The rest are assumed to be serial and ++ * will be handled by this driver + */ +- switch (ifnum) { +- case 0: +- case 2: +- dev_dbg(dev, "Modem port found\n"); +- break; +- case 1: +- dev_dbg(dev, "DM/DIAG interface found\n"); +- break; +- case 5: +- dev_dbg(dev, "NMEA GPS interface found\n"); +- break; +- default: +- /* don't claim any unsupported interface */ ++ switch (intf->desc.bInterfaceProtocol) { ++ /* QMI combined (qmi_wwan) */ ++ case 0x07: ++ case 0x37: ++ case 0x67: ++ /* QMI data (qmi_wwan) */ ++ case 0x08: ++ case 0x38: ++ case 0x68: ++ /* QMI control (qmi_wwan) */ ++ case 0x09: ++ case 0x39: ++ case 0x69: ++ /* NCM like (huawei_cdc_ncm) */ ++ case 0x16: ++ case 0x46: ++ case 0x76: + altsetting = -1; + break; ++ default: ++ dev_dbg(dev, "Huawei type serial port found (%02x/%02x/%02x)\n", ++ intf->desc.bInterfaceClass, ++ intf->desc.bInterfaceSubClass, ++ intf->desc.bInterfaceProtocol); + } + break; + default: +-- +2.17.1 + diff --git a/queue-3.18/vfs-make-sendfile-2-killable-even-better.patch b/queue-3.18/vfs-make-sendfile-2-killable-even-better.patch new file mode 100644 index 00000000000..cd8b2c76cc5 --- /dev/null +++ b/queue-3.18/vfs-make-sendfile-2-killable-even-better.patch @@ -0,0 +1,59 @@ +From 73d5001a2e0a07a7883e7cd190f020d8667c5278 Mon Sep 17 00:00:00 2001 +From: Jan Kara +Date: Mon, 23 Nov 2015 13:09:50 +0100 +Subject: vfs: Make sendfile(2) killable even better + +[ Upstream commit c725bfce7968009756ed2836a8cd7ba4dc163011 ] + +Commit 296291cdd162 (mm: make sendfile(2) killable) fixed an issue where +sendfile(2) was doing a lot of tiny writes into a filesystem and thus +was unkillable for a long time. However sendfile(2) can be (mis)used to +issue lots of writes into arbitrary file descriptor such as evenfd or +similar special file descriptors which never hit the standard filesystem +write path and thus are still unkillable. E.g. the following example +from Dmitry burns CPU for ~16s on my test system without possibility to +be killed: + + int r1 = eventfd(0, 0); + int r2 = memfd_create("", 0); + unsigned long n = 1<<30; + fallocate(r2, 0, 0, n); + sendfile(r1, r2, 0, n); + +There are actually quite a few tests for pending signals in sendfile +code however we data to write is always available none of them seems to +trigger. So fix the problem by adding a test for pending signal into +splice_from_pipe_next() also before the loop waiting for pipe buffers to +be available. This should fix all the lockup issues with sendfile of the +do-ton-of-tiny-writes nature. + +CC: stable@vger.kernel.org +Reported-by: Dmitry Vyukov +Signed-off-by: Jan Kara +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/splice.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/splice.c b/fs/splice.c +index cf0cb768a1a7..852194d3ce4a 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -809,6 +809,13 @@ static int splice_from_pipe_feed(struct pipe_inode_info *pipe, struct splice_des + */ + static int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd) + { ++ /* ++ * Check for signal early to make process killable when there are ++ * always buffers available ++ */ ++ if (signal_pending(current)) ++ return -ERESTARTSYS; ++ + while (!pipe->nrbufs) { + if (!pipe->writers) + return 0; +-- +2.17.1 + diff --git a/queue-3.18/x86-idle-restore-trace_cpu_idle-to-mwait_idle-calls.patch b/queue-3.18/x86-idle-restore-trace_cpu_idle-to-mwait_idle-calls.patch new file mode 100644 index 00000000000..a69a9a7b3e7 --- /dev/null +++ b/queue-3.18/x86-idle-restore-trace_cpu_idle-to-mwait_idle-calls.patch @@ -0,0 +1,49 @@ +From c18cc84849578ce60a11dda85714527fc9b96c1b Mon Sep 17 00:00:00 2001 +From: Jisheng Zhang +Date: Thu, 20 Aug 2015 12:54:39 +0800 +Subject: x86/idle: Restore trace_cpu_idle to mwait_idle() calls + +[ Upstream commit e43d0189ac02415fe4487f79fc35e8f147e9ea0d ] + +Commit b253149b843f ("sched/idle/x86: Restore mwait_idle() to fix boot +hangs, to improve power savings and to improve performance") restores +mwait_idle(), but the trace_cpu_idle related calls are missing. This +causes powertop on my old desktop powered by Intel Core2 E6550 to +report zero wakeups and zero events. + +Add them back to restore the proper behaviour. + +Fixes: b253149b843f ("sched/idle/x86: Restore mwait_idle() to ...") +Signed-off-by: Jisheng Zhang +Cc: +Cc: stable@vger.kernel.org # 4.1 +Link: http://lkml.kernel.org/r/1440046479-4262-1-git-send-email-jszhang@marvell.com +Signed-off-by: Thomas Gleixner +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/process.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index a388bb883128..54499d34cf55 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -430,6 +430,7 @@ static int prefer_mwait_c1_over_halt(const struct cpuinfo_x86 *c) + static void mwait_idle(void) + { + if (!current_set_polling_and_test()) { ++ trace_cpu_idle_rcuidle(1, smp_processor_id()); + if (this_cpu_has(X86_BUG_CLFLUSH_MONITOR)) { + smp_mb(); /* quirk */ + clflush((void *)¤t_thread_info()->flags); +@@ -441,6 +442,7 @@ static void mwait_idle(void) + __sti_mwait(0, 0); + else + local_irq_enable(); ++ trace_cpu_idle_rcuidle(PWR_EVENT_EXIT, smp_processor_id()); + } else { + local_irq_enable(); + } +-- +2.17.1 + diff --git a/queue-3.18/x86-irq-check-for-valid-irq-descriptor-in-check_irq_.patch b/queue-3.18/x86-irq-check-for-valid-irq-descriptor-in-check_irq_.patch new file mode 100644 index 00000000000..10643e34656 --- /dev/null +++ b/queue-3.18/x86-irq-check-for-valid-irq-descriptor-in-check_irq_.patch @@ -0,0 +1,65 @@ +From 10227eb72dce2b9d4733c64717c9727481d43cd7 Mon Sep 17 00:00:00 2001 +From: Joerg Roedel +Date: Wed, 4 Feb 2015 13:33:33 +0100 +Subject: x86/irq: Check for valid irq descriptor in + check_irq_vectors_for_cpu_disable() + +[ Upstream commit d97eb8966c91f2c9d05f0a22eb89ed5b76d966d1 ] + +When an interrupt is migrated away from a cpu it will stay +in its vector_irq array until smp_irq_move_cleanup_interrupt +succeeded. The cfg->move_in_progress flag is cleared already +when the IPI was sent. + +When the interrupt is destroyed after migration its 'struct +irq_desc' is freed and the vector_irq arrays are cleaned up. +But since cfg->move_in_progress is already 0 the references +at cpus before the last migration will not be cleared. So +this would leave a reference to an already destroyed irq +alive. + +When the cpu is taken down at this point, the +check_irq_vectors_for_cpu_disable() function finds a valid irq +number in the vector_irq array, but gets NULL for its +descriptor and dereferences it, causing a kernel panic. + +This has been observed on real systems at shutdown. Add a +check to check_irq_vectors_for_cpu_disable() for a valid +'struct irq_desc' to prevent this issue. + +Signed-off-by: Joerg Roedel +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Jiang Liu +Cc: H. Peter Anvin +Cc: Jan Beulich +Cc: K. Y. Srinivasan +Cc: Linus Torvalds +Cc: Prarit Bhargava +Cc: Rasmus Villemoes +Cc: Yinghai Lu +Cc: alnovak@suse.com +Cc: joro@8bytes.org +Link: http://lkml.kernel.org/r/20150204132754.GA10078@suse.de +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/irq.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index 37907756fc41..1d6e2946a3da 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -302,6 +302,9 @@ int check_irq_vectors_for_cpu_disable(void) + irq = __this_cpu_read(vector_irq[vector]); + if (irq >= 0) { + desc = irq_to_desc(irq); ++ if (!desc) ++ continue; ++ + data = irq_desc_get_irq_data(desc); + cpumask_copy(&affinity_new, data->affinity); + cpu_clear(this_cpu, affinity_new); +-- +2.17.1 + diff --git a/queue-3.18/x86-ldt-fix-small-ldt-allocation-for-xen.patch b/queue-3.18/x86-ldt-fix-small-ldt-allocation-for-xen.patch new file mode 100644 index 00000000000..5124518df7b --- /dev/null +++ b/queue-3.18/x86-ldt-fix-small-ldt-allocation-for-xen.patch @@ -0,0 +1,64 @@ +From dc782d9354311ae96821743df7cd9f2e4e85a5b6 Mon Sep 17 00:00:00 2001 +From: Jan Beulich +Date: Wed, 2 Sep 2015 09:45:58 -0600 +Subject: x86/ldt: Fix small LDT allocation for Xen + +[ Upstream commit f454b478861325f067fd58ba7ee9f1b5c4a9d6a0 ] + +While the following commit: + + 37868fe113 ("x86/ldt: Make modify_ldt synchronous") + +added a nice comment explaining that Xen needs page-aligned +whole page chunks for guest descriptor tables, it then +nevertheless used kzalloc() on the small size path. + +As I'm unaware of guarantees for kmalloc(PAGE_SIZE, ) to return +page-aligned memory blocks, I believe this needs to be switched +back to __get_free_page() (or better get_zeroed_page()). + +Signed-off-by: Jan Beulich +Cc: Andy Lutomirski +Cc: Andy Lutomirski +Cc: Boris Ostrovsky +Cc: Borislav Petkov +Cc: Brian Gerst +Cc: David Vrabel +Cc: Denys Vlasenko +Cc: H. Peter Anvin +Cc: Konrad Rzeszutek Wilk +Cc: Linus Torvalds +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Link: http://lkml.kernel.org/r/55E735D6020000780009F1E6@prv-mh.provo.novell.com +Signed-off-by: Ingo Molnar +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/ldt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c +index 2bcc0525f1c1..6acc9dd91f36 100644 +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -58,7 +58,7 @@ static struct ldt_struct *alloc_ldt_struct(int size) + if (alloc_size > PAGE_SIZE) + new_ldt->entries = vzalloc(alloc_size); + else +- new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL); ++ new_ldt->entries = (void *)get_zeroed_page(GFP_KERNEL); + + if (!new_ldt->entries) { + kfree(new_ldt); +@@ -95,7 +95,7 @@ static void free_ldt_struct(struct ldt_struct *ldt) + if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE) + vfree(ldt->entries); + else +- kfree(ldt->entries); ++ free_page((unsigned long)ldt->entries); + kfree(ldt); + } + +-- +2.17.1 + diff --git a/queue-3.18/x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch b/queue-3.18/x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch new file mode 100644 index 00000000000..0d48158a984 --- /dev/null +++ b/queue-3.18/x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch @@ -0,0 +1,66 @@ +From 1fef93985e76902e2f88f7b69a43eeb8e3b5950c Mon Sep 17 00:00:00 2001 +From: Prarit Bhargava +Date: Wed, 11 May 2016 12:27:15 -0400 +Subject: x86/PCI: Mark Broadwell-EP Home Agent 1 as having non-compliant BARs + +[ Upstream commit da77b67195de1c65bef4908fa29967c4d0af2da2 ] + +Commit b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having +non-compliant BARs") marked Home Agent 0 & PCU has having non-compliant +BARs. Home Agent 1 also has non-compliant BARs. + +Mark Home Agent 1 as having non-compliant BARs so the PCI core doesn't +touch them. + +The problem with these devices is documented in the Xeon v4 specification +update: + + BDF2 PCI BARs in the Home Agent Will Return Non-Zero Values + During Enumeration + + Problem: During system initialization the Operating System may access + the standard PCI BARs (Base Address Registers). Due to + this erratum, accesses to the Home Agent BAR registers (Bus + 1; Device 18; Function 0,4; Offsets (0x14-0x24) will return + non-zero values. + + Implication: The operating system may issue a warning. Intel has not + observed any functional failures due to this erratum. + +Link: http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html +Fixes: b894157145e4 ("x86/PCI: Mark Broadwell-EP Home Agent & PCU as having non-compliant BARs") +Signed-off-by: Prarit Bhargava +Signed-off-by: Bjorn Helgaas +CC: Thomas Gleixner +CC: Ingo Molnar +CC: "H. Peter Anvin" +CC: Andi Kleen +Signed-off-by: Sasha Levin +--- + arch/x86/pci/fixup.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c +index f16af96c60a2..156fbb69031c 100644 +--- a/arch/x86/pci/fixup.c ++++ b/arch/x86/pci/fixup.c +@@ -554,9 +554,16 @@ static void twinhead_reserve_killing_zone(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x27B9, twinhead_reserve_killing_zone); + ++/* ++ * Broadwell EP Home Agent BARs erroneously return non-zero values when read. ++ * ++ * See http://www.intel.com/content/www/us/en/processors/xeon/xeon-e5-v4-spec-update.html ++ * entry BDF2. ++ */ + static void pci_bdwep_bar(struct pci_dev *dev) + { + dev->non_compliant_bars = 1; + } ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6f60, pci_bdwep_bar); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fa0, pci_bdwep_bar); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x6fc0, pci_bdwep_bar); +-- +2.17.1 + diff --git a/queue-3.18/xfrm-validate-address-prefix-lengths-in-the-xfrm-sel.patch b/queue-3.18/xfrm-validate-address-prefix-lengths-in-the-xfrm-sel.patch new file mode 100644 index 00000000000..1f35b92a486 --- /dev/null +++ b/queue-3.18/xfrm-validate-address-prefix-lengths-in-the-xfrm-sel.patch @@ -0,0 +1,63 @@ +From d0ae6c3b4547fe7a1a5f9478ec857bda27bcf4d6 Mon Sep 17 00:00:00 2001 +From: Steffen Klassert +Date: Wed, 1 Aug 2018 13:45:11 +0200 +Subject: xfrm: Validate address prefix lengths in the xfrm selector. + +[ Upstream commit 07bf7908950a8b14e81aa1807e3c667eab39287a ] + +We don't validate the address prefix lengths in the xfrm +selector we got from userspace. This can lead to undefined +behaviour in the address matching functions if the prefix +is too big for the given address family. Fix this by checking +the prefixes and refuse SA/policy insertation when a prefix +is invalid. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Air Icy +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 4fe43d80c153..ca99638b5d5a 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -150,10 +150,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p, + err = -EINVAL; + switch (p->family) { + case AF_INET: ++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) ++ goto out; ++ + break; + + case AF_INET6: + #if IS_ENABLED(CONFIG_IPV6) ++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) ++ goto out; ++ + break; + #else + err = -EAFNOSUPPORT; +@@ -1285,10 +1291,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p) + + switch (p->sel.family) { + case AF_INET: ++ if (p->sel.prefixlen_d > 32 || p->sel.prefixlen_s > 32) ++ return -EINVAL; ++ + break; + + case AF_INET6: + #if IS_ENABLED(CONFIG_IPV6) ++ if (p->sel.prefixlen_d > 128 || p->sel.prefixlen_s > 128) ++ return -EINVAL; ++ + break; + #else + return -EAFNOSUPPORT; +-- +2.17.1 + diff --git a/queue-3.18/xfrm-validate-template-mode.patch b/queue-3.18/xfrm-validate-template-mode.patch new file mode 100644 index 00000000000..d2c44644e6e --- /dev/null +++ b/queue-3.18/xfrm-validate-template-mode.patch @@ -0,0 +1,64 @@ +From a1978bb833d17d8c584dea2bcc6f231d5aaa2378 Mon Sep 17 00:00:00 2001 +From: Sean Tranchetti +Date: Wed, 19 Sep 2018 13:54:56 -0600 +Subject: xfrm: validate template mode + +[ Upstream commit 32bf94fb5c2ec4ec842152d0e5937cd4bb6738fa ] + +XFRM mode parameters passed as part of the user templates +in the IP_XFRM_POLICY are never properly validated. Passing +values other than valid XFRM modes can cause stack-out-of-bounds +reads to occur later in the XFRM processing: + +[ 140.535608] ================================================================ +[ 140.543058] BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x17e4/0x1cc4 +[ 140.550306] Read of size 4 at addr ffffffc0238a7a58 by task repro/5148 +[ 140.557369] +[ 140.558927] Call trace: +[ 140.558936] dump_backtrace+0x0/0x388 +[ 140.558940] show_stack+0x24/0x30 +[ 140.558946] __dump_stack+0x24/0x2c +[ 140.558949] dump_stack+0x8c/0xd0 +[ 140.558956] print_address_description+0x74/0x234 +[ 140.558960] kasan_report+0x240/0x264 +[ 140.558963] __asan_report_load4_noabort+0x2c/0x38 +[ 140.558967] xfrm_state_find+0x17e4/0x1cc4 +[ 140.558971] xfrm_resolve_and_create_bundle+0x40c/0x1fb8 +[ 140.558975] xfrm_lookup+0x238/0x1444 +[ 140.558977] xfrm_lookup_route+0x48/0x11c +[ 140.558984] ip_route_output_flow+0x88/0xc4 +[ 140.558991] raw_sendmsg+0xa74/0x266c +[ 140.558996] inet_sendmsg+0x258/0x3b0 +[ 140.559002] sock_sendmsg+0xbc/0xec +[ 140.559005] SyS_sendto+0x3a8/0x5a8 +[ 140.559008] el0_svc_naked+0x34/0x38 +[ 140.559009] +[ 140.592245] page dumped because: kasan: bad access detected +[ 140.597981] page_owner info is not active (free page?) +[ 140.603267] +[ 140.653503] ================================================================ + +Signed-off-by: Sean Tranchetti +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index ca99638b5d5a..017b1c91d58e 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1381,6 +1381,9 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family) + (ut[i].family != prev_family)) + return -EINVAL; + ++ if (ut[i].mode >= XFRM_MODE_MAX) ++ return -EINVAL; ++ + prev_family = ut[i].family; + + switch (ut[i].family) { +-- +2.17.1 + diff --git a/queue-3.18/xfrm6-call-kfree_skb-when-skb-is-toobig.patch b/queue-3.18/xfrm6-call-kfree_skb-when-skb-is-toobig.patch new file mode 100644 index 00000000000..f1690160724 --- /dev/null +++ b/queue-3.18/xfrm6-call-kfree_skb-when-skb-is-toobig.patch @@ -0,0 +1,46 @@ +From 037f3cb483634958bfbbf4b15b3b4ecdca1b3399 Mon Sep 17 00:00:00 2001 +From: Thadeu Lima de Souza Cascardo +Date: Fri, 31 Aug 2018 08:38:49 -0300 +Subject: xfrm6: call kfree_skb when skb is toobig + +[ Upstream commit 215ab0f021c9fea3c18b75e7d522400ee6a49990 ] + +After commit d6990976af7c5d8f55903bfb4289b6fb030bf754 ("vti6: fix PMTU caching +and reporting on xmit"), some too big skbs might be potentially passed down to +__xfrm6_output, causing it to fail to transmit but not free the skb, causing a +leak of skb, and consequentially a leak of dst references. + +After running pmtu.sh, that shows as failure to unregister devices in a namespace: + +[ 311.397671] unregister_netdevice: waiting for veth_b to become free. Usage count = 1 + +The fix is to call kfree_skb in case of transmit failures. + +Fixes: dd767856a36e ("xfrm6: Don't call icmpv6_send on local error") +Signed-off-by: Thadeu Lima de Souza Cascardo +Reviewed-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv6/xfrm6_output.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index ca3f29b98ae5..63724226042c 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -151,9 +151,11 @@ static int __xfrm6_output(struct sk_buff *skb) + + if (skb->len > mtu && xfrm6_local_dontfrag(skb)) { + xfrm6_local_rxpmtu(skb, mtu); ++ kfree_skb(skb); + return -EMSGSIZE; + } else if (!skb->ignore_df && skb->len > mtu && skb->sk) { + xfrm_local_error(skb, mtu); ++ kfree_skb(skb); + return -EMSGSIZE; + } + +-- +2.17.1 +